I'm trying to add and react to some annotations on expressions and
variables with a checker. I'm running into some issues:
I'm not sure what to use as the "key" for my annotations. For
example, if my annotations are simple unsigned ints representing some
characteristics of an expression or a variable, I've tried something
typedef llvm::ImmutableMap<SymbolRef, unsigned> SymRefState;
typedef llvm::ImmutableMap<const SymExpr *, unsigned> SymExprState;
These seem to fail in some cases I need. Typically, I was trying to
populate the annotations with a:
SVal sv = state->getSVal(expression);
SymExpr *se = sv.getAsSymbolicExpression();
and then with a CheckerContext cc
(or a sv.getAsSymbol() for the SymbolRef map).
Both of these fell flat on their face when any of the SVal's are of
UnknownKind. I can't completely enumerate the cases when that
happens, but the existence of conjured symbols does not seems to
propagate up expressions: i.e., it seems like Conjured op Conjured ->
I'd love to maintain annotations on SVal's directly .... something
like: typedef llvm::ImmutableMap<SVal, unsigned> SValState;
Unfortunately, I think SVal's don't support the comparisons needed for
management by an ImmutableMap.
I know there is a GenericTaintChecker.cpp in progress in svn, but I
can't utilize the svn code for this project.