clang/unittests/StaticAnalyzer/FalsePositiveRefutationBRVisitorTest.cpp

   1 //===- unittests/StaticAnalyzer/FalsePositiveRefutationBRVisitorTest.cpp --===//
   2 //
   3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
   4 // See https://llvm.org/LICENSE.txt for license information.
   5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
   6 //
   7 //===----------------------------------------------------------------------===//
   8
   9 #include "CheckerRegistration.h"
  10 #include "Reusables.h"
  11 #include "clang/Frontend/CompilerInstance.h"
  12 #include "clang/StaticAnalyzer/Core/BugReporter/BugReporter.h"
  13 #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
  14 #include "clang/StaticAnalyzer/Core/Checker.h"
  15 #include "clang/StaticAnalyzer/Core/PathSensitive/CallDescription.h"
  16 #include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
  17 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
  18 #include "clang/StaticAnalyzer/Frontend/AnalysisConsumer.h"
  19 #include "clang/StaticAnalyzer/Frontend/CheckerRegistry.h"
  20 #include "llvm/Config/llvm-config.h"
  21 #include "gtest/gtest.h"
  22
  23 namespace clang {
  24 namespace ento {
  25 namespace {
  26
  27 class FalsePositiveGenerator : public Checker<eval::Call> {
  28   using Self = FalsePositiveGenerator;
  29   const BugType FalsePositiveGeneratorBug{this, "FalsePositiveGenerator"};
  30   using HandlerFn = bool (Self::*)(const CallEvent &Call,
  31                                    CheckerContext &) const;
  32   CallDescriptionMap<HandlerFn> Callbacks = {
  33       {{{"reachedWithContradiction"}, 0}, &Self::reachedWithContradiction},
  34       {{{"reachedWithNoContradiction"}, 0}, &Self::reachedWithNoContradiction},
  35       {{{"reportIfCanBeTrue"}, 1}, &Self::reportIfCanBeTrue},
  36   };
  37
  38   bool report(CheckerContext &C, ProgramStateRef State,
  39               StringRef Description) const {
  40     ExplodedNode *Node = C.generateNonFatalErrorNode(State);
  41     if (!Node)
  42       return false;
  43
  44     auto Report = std::make_unique<PathSensitiveBugReport>(
  45         FalsePositiveGeneratorBug, Description, Node);
  46     C.emitReport(std::move(Report));
  47     return true;
  48   }
  49
  50   bool reachedWithNoContradiction(const CallEvent &, CheckerContext &C) const {
  51     return report(C, C.getState(), "REACHED_WITH_NO_CONTRADICTION");
  52   }
  53
  54   bool reachedWithContradiction(const CallEvent &, CheckerContext &C) const {
  55     return report(C, C.getState(), "REACHED_WITH_CONTRADICTION");
  56   }
  57
  58   // Similar to ExprInspectionChecker::analyzerEval except it emits warning only
  59   // if the argument can be true. The report emits the report in the state where
  60   // the assertion true.
  61   bool reportIfCanBeTrue(const CallEvent &Call, CheckerContext &C) const {
  62     // A specific instantiation of an inlined function may have more constrained
  63     // values than can generally be assumed. Skip the check.
  64     if (C.getPredecessor()->getLocationContext()->getStackFrame()->getParent())
  65       return false;
  66
  67     SVal AssertionVal = Call.getArgSVal(0);
  68     if (AssertionVal.isUndef())
  69       return false;
  70
  71     ProgramStateRef State = C.getPredecessor()->getState();
  72     ProgramStateRef StTrue;
  73     std::tie(StTrue, std::ignore) =
  74         State->assume(AssertionVal.castAs<DefinedOrUnknownSVal>());
  75     if (StTrue)
  76       return report(C, StTrue, "CAN_BE_TRUE");
  77     return false;
  78   }
  79
  80 public:
  81   bool evalCall(const CallEvent &Call, CheckerContext &C) const {
  82     if (const HandlerFn *Callback = Callbacks.lookup(Call))
  83       return (this->*(*Callback))(Call, C);
  84     return false;
  85   }
  86 };
  87
  88 void addFalsePositiveGenerator(AnalysisASTConsumer &AnalysisConsumer,
  89                                AnalyzerOptions &AnOpts) {
  90   AnOpts.CheckersAndPackages = {{"test.FalsePositiveGenerator", true},
  91                                 {"debug.ViewExplodedGraph", false}};
  92   AnalysisConsumer.AddCheckerRegistrationFn([](CheckerRegistry &Registry) {
  93     Registry.addChecker<FalsePositiveGenerator>(
  94         "test.FalsePositiveGenerator", "EmptyDescription", "EmptyDocsUri");
  95   });
  96 }
  97
  98 class FalsePositiveRefutationBRVisitorTestBase : public testing::Test {
  99 public:
 100   void SetUp() override {
 101 #ifndef LLVM_WITH_Z3
 102     GTEST_SKIP() << "Requires the LLVM_ENABLE_Z3_SOLVER cmake option.";
 103 #endif
 104   }
 105 };
 106
 107 // C++20 use constexpr below.
 108 const std::vector<std::string> LazyAssumeArgs{
 109     "-Xclang", "-analyzer-config", "-Xclang", "eagerly-assume=false"};
 110 const std::vector<std::string> LazyAssumeAndCrossCheckArgs{
 111     "-Xclang", "-analyzer-config", "-Xclang", "eagerly-assume=false",
 112     "-Xclang", "-analyzer-config", "-Xclang", "crosscheck-with-z3=true"};
 113
 114 TEST_F(FalsePositiveRefutationBRVisitorTestBase, UnSatInTheMiddleNoReport) {
 115   constexpr auto Code = R"(
 116      void reachedWithContradiction();
 117      void reachedWithNoContradiction();
 118      void test(int x, int y) {
 119        if (x * y == 0)
 120          return;
 121        reachedWithNoContradiction();
 122        if (x == 0) {
 123          reachedWithContradiction();
 124          // x * y != 0  =>  x != 0 && y != 0  => contradict with x == 0
 125        }
 126      })";
 127
 128   std::string Diags;
 129   EXPECT_TRUE(runCheckerOnCodeWithArgs<addFalsePositiveGenerator>(
 130       Code, LazyAssumeAndCrossCheckArgs, Diags, /*OnlyEmitWarnings=*/ true));
 131   EXPECT_EQ(Diags,
 132             "test.FalsePositiveGenerator: REACHED_WITH_NO_CONTRADICTION\n");
 133   // Single warning. The second report was invalidated by the visitor.
 134
 135   // Without enabling the crosscheck-with-z3 both reports are displayed.
 136   std::string Diags2;
 137   EXPECT_TRUE(runCheckerOnCodeWithArgs<addFalsePositiveGenerator>(
 138       Code, LazyAssumeArgs, Diags2, /*OnlyEmitWarnings=*/ true));
 139   EXPECT_EQ(Diags2,
 140             "test.FalsePositiveGenerator: REACHED_WITH_NO_CONTRADICTION\n"
 141             "test.FalsePositiveGenerator: REACHED_WITH_CONTRADICTION\n");
 142 }
 143
 144 TEST_F(FalsePositiveRefutationBRVisitorTestBase,
 145        UnSatAtErrorNodeWithNewSymbolNoReport) {
 146   constexpr auto Code = R"(
 147     void reportIfCanBeTrue(bool);
 148     void reachedWithNoContradiction();
 149     void test(int x, int y) {
 150       if (x * y == 0)
 151        return;
 152       // We know that 'x * y': {[MIN,-1], [1,MAX]}
 153       reachedWithNoContradiction();
 154       reportIfCanBeTrue(x == 0); // contradiction
 155       // The function introduces the 'x == 0' constraint in the ErrorNode which
 156       // leads to contradiction with the constraint of 'x * y'.
 157       // Note that the new constraint was bound to a new symbol 'x'.
 158     })";
 159   std::string Diags;
 160   EXPECT_TRUE(runCheckerOnCodeWithArgs<addFalsePositiveGenerator>(
 161       Code, LazyAssumeAndCrossCheckArgs, Diags, /*OnlyEmitWarnings=*/ true));
 162   EXPECT_EQ(Diags,
 163             "test.FalsePositiveGenerator: REACHED_WITH_NO_CONTRADICTION\n");
 164   // Single warning. The second report was invalidated by the visitor.
 165
 166   // Without enabling the crosscheck-with-z3 both reports are displayed.
 167   std::string Diags2;
 168   EXPECT_TRUE(runCheckerOnCodeWithArgs<addFalsePositiveGenerator>(
 169       Code, LazyAssumeArgs, Diags2, /*OnlyEmitWarnings=*/ true));
 170   EXPECT_EQ(Diags2,
 171             "test.FalsePositiveGenerator: REACHED_WITH_NO_CONTRADICTION\n"
 172             "test.FalsePositiveGenerator: CAN_BE_TRUE\n");
 173 }
 174
 175 TEST_F(FalsePositiveRefutationBRVisitorTestBase,
 176        UnSatAtErrorNodeDueToRefinedConstraintNoReport) {
 177   constexpr auto Code = R"(
 178     void reportIfCanBeTrue(bool);
 179     void reachedWithNoContradiction();
 180     void test(unsigned x, unsigned n) {
 181       if (n >= 1 && n <= 2) {
 182         if (x >= 3)
 183           return;
 184         // x: [0,2] and n: [1,2]
 185         int y = x + n; // y: '(x+n)' Which is in approximately between 1 and 4.
 186
 187         // Registers the symbol 'y' with the constraint [1, MAX] in the true
 188         // branch.
 189         if (y > 0) {
 190           // Since the x: [0,2] and n: [1,2], the 'y' is indeed greater than
 191           // zero. If we emit a warning here, the constraints on the BugPath is
 192           // SAT. Therefore that report is NOT invalidated.
 193           reachedWithNoContradiction(); // 'y' can be greater than zero. OK
 194
 195           // If we ask the analyzer whether the 'y' can be 5. It won't know,
 196           // therefore, the state will be created where the 'y' expression is 5.
 197           // Although, this assumption is false!
 198           // 'y' can not be 5 if the maximal value of both x and n is 2.
 199           // The BugPath which become UnSAT in the ErrorNode with a refined
 200           // constraint, should be invalidated.
 201           reportIfCanBeTrue(y == 5);
 202         }
 203       }
 204     })";
 205
 206   std::string Diags;
 207   EXPECT_TRUE(runCheckerOnCodeWithArgs<addFalsePositiveGenerator>(
 208       Code, LazyAssumeAndCrossCheckArgs, Diags, /*OnlyEmitWarnings=*/ true));
 209   EXPECT_EQ(Diags,
 210             "test.FalsePositiveGenerator: REACHED_WITH_NO_CONTRADICTION\n");
 211   // Single warning. The second report was invalidated by the visitor.
 212
 213   // Without enabling the crosscheck-with-z3 both reports are displayed.
 214   std::string Diags2;
 215   EXPECT_TRUE(runCheckerOnCodeWithArgs<addFalsePositiveGenerator>(
 216       Code, LazyAssumeArgs, Diags2, /*OnlyEmitWarnings=*/ true));
 217   EXPECT_EQ(Diags2,
 218             "test.FalsePositiveGenerator: REACHED_WITH_NO_CONTRADICTION\n"
 219             "test.FalsePositiveGenerator: CAN_BE_TRUE\n");
 220 }
 221
 222 } // namespace
 223 } // namespace ento
 224 } // namespace clang