227 lines · cpp
1//===- unittests/StaticAnalyzer/FalsePositiveRefutationBRVisitorTest.cpp --===//2//3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.4// See https://llvm.org/LICENSE.txt for license information.5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception6//7//===----------------------------------------------------------------------===//8 9#include "CheckerRegistration.h"10#include "Reusables.h"11#include "clang/Frontend/CompilerInstance.h"12#include "clang/StaticAnalyzer/Core/BugReporter/BugReporter.h"13#include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"14#include "clang/StaticAnalyzer/Core/Checker.h"15#include "clang/StaticAnalyzer/Core/PathSensitive/CallDescription.h"16#include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"17#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"18#include "clang/StaticAnalyzer/Frontend/AnalysisConsumer.h"19#include "clang/StaticAnalyzer/Frontend/CheckerRegistry.h"20#include "llvm/Config/llvm-config.h"21#include "gtest/gtest.h"22 23namespace clang {24namespace ento {25namespace {26 27class FalsePositiveGenerator : public Checker<eval::Call> {28 using Self = FalsePositiveGenerator;29 const BugType FalsePositiveGeneratorBug{this, "FalsePositiveGenerator"};30 using HandlerFn = bool (Self::*)(const CallEvent &Call,31 CheckerContext &) const;32 CallDescriptionMap<HandlerFn> Callbacks = {33 {{CDM::SimpleFunc, {"reachedWithContradiction"}, 0},34 &Self::reachedWithContradiction},35 {{CDM::SimpleFunc, {"reachedWithNoContradiction"}, 0},36 &Self::reachedWithNoContradiction},37 {{CDM::SimpleFunc, {"reportIfCanBeTrue"}, 1}, &Self::reportIfCanBeTrue},38 };39 40 bool report(CheckerContext &C, ProgramStateRef State,41 StringRef Description) const {42 ExplodedNode *Node = C.generateNonFatalErrorNode(State);43 if (!Node)44 return false;45 46 auto Report = std::make_unique<PathSensitiveBugReport>(47 FalsePositiveGeneratorBug, Description, Node);48 C.emitReport(std::move(Report));49 return true;50 }51 52 bool reachedWithNoContradiction(const CallEvent &, CheckerContext &C) const {53 return report(C, C.getState(), "REACHED_WITH_NO_CONTRADICTION");54 }55 56 bool reachedWithContradiction(const CallEvent &, CheckerContext &C) const {57 return report(C, C.getState(), "REACHED_WITH_CONTRADICTION");58 }59 60 // Similar to ExprInspectionChecker::analyzerEval except it emits warning only61 // if the argument can be true. The report emits the report in the state where62 // the assertion true.63 bool reportIfCanBeTrue(const CallEvent &Call, CheckerContext &C) const {64 // A specific instantiation of an inlined function may have more constrained65 // values than can generally be assumed. Skip the check.66 if (C.getPredecessor()->getLocationContext()->getStackFrame()->getParent())67 return false;68 69 SVal AssertionVal = Call.getArgSVal(0);70 if (AssertionVal.isUndef())71 return false;72 73 ProgramStateRef State = C.getPredecessor()->getState();74 ProgramStateRef StTrue;75 std::tie(StTrue, std::ignore) =76 State->assume(AssertionVal.castAs<DefinedOrUnknownSVal>());77 if (StTrue)78 return report(C, StTrue, "CAN_BE_TRUE");79 return false;80 }81 82public:83 bool evalCall(const CallEvent &Call, CheckerContext &C) const {84 if (const HandlerFn *Callback = Callbacks.lookup(Call))85 return (this->*(*Callback))(Call, C);86 return false;87 }88};89 90void addFalsePositiveGenerator(AnalysisASTConsumer &AnalysisConsumer,91 AnalyzerOptions &AnOpts) {92 AnOpts.CheckersAndPackages = {{"test.FalsePositiveGenerator", true},93 {"debug.ViewExplodedGraph", false}};94 AnalysisConsumer.AddCheckerRegistrationFn([](CheckerRegistry &Registry) {95 Registry.addChecker<FalsePositiveGenerator>("test.FalsePositiveGenerator",96 "MockDescription");97 });98}99 100class FalsePositiveRefutationBRVisitorTestBase : public testing::Test {101public:102 void SetUp() override {103#ifndef LLVM_WITH_Z3104 GTEST_SKIP() << "Requires the LLVM_ENABLE_Z3_SOLVER cmake option.";105#endif106 }107};108 109// C++20 use constexpr below.110const std::vector<std::string> LazyAssumeArgs{111 "-Xclang", "-analyzer-config", "-Xclang", "eagerly-assume=false"};112const std::vector<std::string> LazyAssumeAndCrossCheckArgs{113 "-Xclang", "-analyzer-config", "-Xclang", "eagerly-assume=false",114 "-Xclang", "-analyzer-config", "-Xclang", "crosscheck-with-z3=true"};115 116TEST_F(FalsePositiveRefutationBRVisitorTestBase, UnSatInTheMiddleNoReport) {117 constexpr auto Code = R"(118 void reachedWithContradiction();119 void reachedWithNoContradiction();120 void test(int x, int y) {121 if (x * y == 0)122 return;123 reachedWithNoContradiction();124 if (x == 0) {125 reachedWithContradiction();126 // x * y != 0 => x != 0 && y != 0 => contradict with x == 0127 }128 })";129 130 std::string Diags;131 EXPECT_TRUE(runCheckerOnCodeWithArgs<addFalsePositiveGenerator>(132 Code, LazyAssumeAndCrossCheckArgs, Diags, /*OnlyEmitWarnings=*/ true));133 EXPECT_EQ(Diags,134 "test.FalsePositiveGenerator: REACHED_WITH_NO_CONTRADICTION\n");135 // Single warning. The second report was invalidated by the visitor.136 137 // Without enabling the crosscheck-with-z3 both reports are displayed.138 std::string Diags2;139 EXPECT_TRUE(runCheckerOnCodeWithArgs<addFalsePositiveGenerator>(140 Code, LazyAssumeArgs, Diags2, /*OnlyEmitWarnings=*/ true));141 EXPECT_EQ(Diags2,142 "test.FalsePositiveGenerator: REACHED_WITH_NO_CONTRADICTION\n"143 "test.FalsePositiveGenerator: REACHED_WITH_CONTRADICTION\n");144}145 146TEST_F(FalsePositiveRefutationBRVisitorTestBase,147 UnSatAtErrorNodeWithNewSymbolNoReport) {148 constexpr auto Code = R"(149 void reportIfCanBeTrue(bool);150 void reachedWithNoContradiction();151 void test(int x, int y) {152 if (x * y == 0)153 return;154 // We know that 'x * y': {[MIN,-1], [1,MAX]}155 reachedWithNoContradiction();156 reportIfCanBeTrue(x == 0); // contradiction157 // The function introduces the 'x == 0' constraint in the ErrorNode which158 // leads to contradiction with the constraint of 'x * y'.159 // Note that the new constraint was bound to a new symbol 'x'.160 })";161 std::string Diags;162 EXPECT_TRUE(runCheckerOnCodeWithArgs<addFalsePositiveGenerator>(163 Code, LazyAssumeAndCrossCheckArgs, Diags, /*OnlyEmitWarnings=*/ true));164 EXPECT_EQ(Diags,165 "test.FalsePositiveGenerator: REACHED_WITH_NO_CONTRADICTION\n");166 // Single warning. The second report was invalidated by the visitor.167 168 // Without enabling the crosscheck-with-z3 both reports are displayed.169 std::string Diags2;170 EXPECT_TRUE(runCheckerOnCodeWithArgs<addFalsePositiveGenerator>(171 Code, LazyAssumeArgs, Diags2, /*OnlyEmitWarnings=*/ true));172 EXPECT_EQ(Diags2,173 "test.FalsePositiveGenerator: REACHED_WITH_NO_CONTRADICTION\n"174 "test.FalsePositiveGenerator: CAN_BE_TRUE\n");175}176 177TEST_F(FalsePositiveRefutationBRVisitorTestBase,178 UnSatAtErrorNodeDueToRefinedConstraintNoReport) {179 constexpr auto Code = R"(180 void reportIfCanBeTrue(bool);181 void reachedWithNoContradiction();182 void test(unsigned x, unsigned n) {183 if (n >= 1 && n <= 2) {184 if (x >= 3)185 return;186 // x: [0,2] and n: [1,2]187 int y = x + n; // y: '(x+n)' Which is in approximately between 1 and 4.188 189 // Registers the symbol 'y' with the constraint [1, MAX] in the true190 // branch.191 if (y > 0) {192 // Since the x: [0,2] and n: [1,2], the 'y' is indeed greater than193 // zero. If we emit a warning here, the constraints on the BugPath is194 // SAT. Therefore that report is NOT invalidated.195 reachedWithNoContradiction(); // 'y' can be greater than zero. OK196 197 // If we ask the analyzer whether the 'y' can be 5. It won't know,198 // therefore, the state will be created where the 'y' expression is 5.199 // Although, this assumption is false!200 // 'y' can not be 5 if the maximal value of both x and n is 2.201 // The BugPath which become UnSAT in the ErrorNode with a refined202 // constraint, should be invalidated.203 reportIfCanBeTrue(y == 5);204 }205 }206 })";207 208 std::string Diags;209 EXPECT_TRUE(runCheckerOnCodeWithArgs<addFalsePositiveGenerator>(210 Code, LazyAssumeAndCrossCheckArgs, Diags, /*OnlyEmitWarnings=*/ true));211 EXPECT_EQ(Diags,212 "test.FalsePositiveGenerator: REACHED_WITH_NO_CONTRADICTION\n");213 // Single warning. The second report was invalidated by the visitor.214 215 // Without enabling the crosscheck-with-z3 both reports are displayed.216 std::string Diags2;217 EXPECT_TRUE(runCheckerOnCodeWithArgs<addFalsePositiveGenerator>(218 Code, LazyAssumeArgs, Diags2, /*OnlyEmitWarnings=*/ true));219 EXPECT_EQ(Diags2,220 "test.FalsePositiveGenerator: REACHED_WITH_NO_CONTRADICTION\n"221 "test.FalsePositiveGenerator: CAN_BE_TRUE\n");222}223 224} // namespace225} // namespace ento226} // namespace clang227