};
class BuiltinBug : public BugType {
- GRExprEngine &Eng;
+ GRExprEngine *Eng;
protected:
const std::string desc;
public:
+ BuiltinBug(const char *name, const char *description)
+ : BugType(name, "Logic error"), Eng(0), desc(description) {}
+
+ BuiltinBug(const char *name)
+ : BugType(name, "Logic error"), Eng(0), desc(name) {}
+
BuiltinBug(GRExprEngine *eng, const char* n, const char* d)
- : BugType(n, "Logic error"), Eng(*eng), desc(d) {}
+ : BugType(n, "Logic error"), Eng(eng), desc(d) {}
BuiltinBug(GRExprEngine *eng, const char* n)
- : BugType(n, "Logic error"), Eng(*eng), desc(n) {}
+ : BugType(n, "Logic error"), Eng(eng), desc(n) {}
const std::string &getDescription() const { return desc; }
virtual void FlushReportsImpl(BugReporter& BR, GRExprEngine& Eng) {}
- void FlushReports(BugReporter& BR) { FlushReportsImpl(BR, Eng); }
+ void FlushReports(BugReporter& BR) { FlushReportsImpl(BR, *Eng); }
virtual void registerInitialVisitors(BugReporterContext& BRC,
const ExplodedNode* N,
if (!NotNullState) { // Explicit null case.
if (!BT)
- BT = new BuiltinBug(NULL, "Null dereference",
- "Dereference of null pointer");
+ BT = new BuiltinBug("Null dereference","Dereference of null pointer");
EnhancedBugReport *R =
new EnhancedBugReport(*BT, BT->getDescription().c_str(), N);
-
+
R->addVisitorCreator(bugreporter::registerTrackNullOrUndefValue,
bugreporter::GetDerefExpr(N));
if (stateZero && !stateNotZero) {
if (ExplodedNode *N = C.GenerateNode(B, stateZero, true)) {
if (!BT)
- BT = new BuiltinBug(0, "Division by zero");
+ BT = new BuiltinBug("Division by zero");
EnhancedBugReport *R =
new EnhancedBugReport(*BT, BT->getDescription().c_str(), N);
if (C.getState()->getSVal(*I).isUndef()) {
if (ExplodedNode *N = C.GenerateNode(CE, true)) {
if (!BT)
- BT = new BugType("Pass-by-value argument in function call is "
- "undefined", "Logic error");
+ BT = new BuiltinBug("Pass-by-value argument in function call is "
+ "undefined");
// Generate a report for this bug.
EnhancedBugReport *R = new EnhancedBugReport(*BT, BT->getName().c_str(),
N);
return;
if (!BT)
- BT = new BugType("Assigned value is garbage or undefined",
- "Logic error");
+ BT = new BuiltinBug("Assigned value is garbage or undefined");
// Generate a report for this bug.
EnhancedBugReport *R = new EnhancedBugReport(*BT, BT->getName().c_str(), N);
if (ExplodedNode* N = Builder.generateNode(S, state, Pred)) {
N->markAsSink();
if (!BT)
- BT = new BugType("Declared variable-length array (VLA) uses a garbage"
- " value as its size", "Logic error");
+ BT = new BuiltinBug("Declared variable-length array (VLA) uses a "
+ "garbage value as its size");
EnhancedBugReport *R =
new EnhancedBugReport(*BT, BT->getName().c_str(), N);