1 //===--- CallAndMessageChecker.cpp ------------------------------*- C++ -*--==//
2 //
3 //                     The LLVM Compiler Infrastructure
4 //
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
7 //
8 //===----------------------------------------------------------------------===//
9 //
10 // This defines CallAndMessageChecker, a builtin checker that checks for various
11 // errors of call and objc message expressions.
12 //
13 //===----------------------------------------------------------------------===//
14 
15 #include "ClangSACheckers.h"
16 #include "clang/AST/ParentMap.h"
17 #include "clang/Basic/TargetInfo.h"
18 #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
19 #include "clang/StaticAnalyzer/Core/Checker.h"
20 #include "clang/StaticAnalyzer/Core/CheckerManager.h"
21 #include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
22 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
23 #include "llvm/ADT/SmallString.h"
24 #include "llvm/Support/raw_ostream.h"
25 
26 using namespace clang;
27 using namespace ento;
28 
29 namespace {
30 
31 struct ChecksFilter {
32   DefaultBool Check_CallAndMessageUnInitRefArg;
33   DefaultBool Check_CallAndMessageChecker;
34 
35   CheckName CheckName_CallAndMessageUnInitRefArg;
36   CheckName CheckName_CallAndMessageChecker;
37 };
38 
39 class CallAndMessageChecker
40   : public Checker< check::PreStmt<CallExpr>,
41                     check::PreStmt<CXXDeleteExpr>,
42                     check::PreObjCMessage,
43                     check::PreCall > {
44   mutable std::unique_ptr<BugType> BT_call_null;
45   mutable std::unique_ptr<BugType> BT_call_undef;
46   mutable std::unique_ptr<BugType> BT_cxx_call_null;
47   mutable std::unique_ptr<BugType> BT_cxx_call_undef;
48   mutable std::unique_ptr<BugType> BT_call_arg;
49   mutable std::unique_ptr<BugType> BT_cxx_delete_undef;
50   mutable std::unique_ptr<BugType> BT_msg_undef;
51   mutable std::unique_ptr<BugType> BT_objc_prop_undef;
52   mutable std::unique_ptr<BugType> BT_objc_subscript_undef;
53   mutable std::unique_ptr<BugType> BT_msg_arg;
54   mutable std::unique_ptr<BugType> BT_msg_ret;
55   mutable std::unique_ptr<BugType> BT_call_few_args;
56 
57 public:
58   ChecksFilter Filter;
59 
60   void checkPreStmt(const CallExpr *CE, CheckerContext &C) const;
61   void checkPreStmt(const CXXDeleteExpr *DE, CheckerContext &C) const;
62   void checkPreObjCMessage(const ObjCMethodCall &msg, CheckerContext &C) const;
63   void checkPreCall(const CallEvent &Call, CheckerContext &C) const;
64 
65 private:
66   bool PreVisitProcessArg(CheckerContext &C, SVal V, SourceRange ArgRange,
67                           const Expr *ArgEx, bool IsFirstArgument,
68                           bool CheckUninitFields, const CallEvent &Call,
69                           std::unique_ptr<BugType> &BT,
70                           const ParmVarDecl *ParamDecl) const;
71 
72   static void emitBadCall(BugType *BT, CheckerContext &C, const Expr *BadE);
73   void emitNilReceiverBug(CheckerContext &C, const ObjCMethodCall &msg,
74                           ExplodedNode *N) const;
75 
76   void HandleNilReceiver(CheckerContext &C,
77                          ProgramStateRef state,
78                          const ObjCMethodCall &msg) const;
79 
LazyInit_BT(const char * desc,std::unique_ptr<BugType> & BT) const80   void LazyInit_BT(const char *desc, std::unique_ptr<BugType> &BT) const {
81     if (!BT)
82       BT.reset(new BuiltinBug(this, desc));
83   }
84   bool uninitRefOrPointer(CheckerContext &C, const SVal &V,
85                           const SourceRange &ArgRange,
86                           const Expr *ArgEx, std::unique_ptr<BugType> &BT,
87                           const ParmVarDecl *ParamDecl, const char *BD) const;
88 };
89 } // end anonymous namespace
90 
emitBadCall(BugType * BT,CheckerContext & C,const Expr * BadE)91 void CallAndMessageChecker::emitBadCall(BugType *BT, CheckerContext &C,
92                                         const Expr *BadE) {
93   ExplodedNode *N = C.generateSink();
94   if (!N)
95     return;
96 
97   BugReport *R = new BugReport(*BT, BT->getName(), N);
98   if (BadE) {
99     R->addRange(BadE->getSourceRange());
100     if (BadE->isGLValue())
101       BadE = bugreporter::getDerefExpr(BadE);
102     bugreporter::trackNullOrUndefValue(N, BadE, *R);
103   }
104   C.emitReport(R);
105 }
106 
describeUninitializedArgumentInCall(const CallEvent & Call,bool IsFirstArgument)107 static StringRef describeUninitializedArgumentInCall(const CallEvent &Call,
108                                                      bool IsFirstArgument) {
109   switch (Call.getKind()) {
110   case CE_ObjCMessage: {
111     const ObjCMethodCall &Msg = cast<ObjCMethodCall>(Call);
112     switch (Msg.getMessageKind()) {
113     case OCM_Message:
114       return "Argument in message expression is an uninitialized value";
115     case OCM_PropertyAccess:
116       assert(Msg.isSetter() && "Getters have no args");
117       return "Argument for property setter is an uninitialized value";
118     case OCM_Subscript:
119       if (Msg.isSetter() && IsFirstArgument)
120         return "Argument for subscript setter is an uninitialized value";
121       return "Subscript index is an uninitialized value";
122     }
123     llvm_unreachable("Unknown message kind.");
124   }
125   case CE_Block:
126     return "Block call argument is an uninitialized value";
127   default:
128     return "Function call argument is an uninitialized value";
129   }
130 }
131 
uninitRefOrPointer(CheckerContext & C,const SVal & V,const SourceRange & ArgRange,const Expr * ArgEx,std::unique_ptr<BugType> & BT,const ParmVarDecl * ParamDecl,const char * BD) const132 bool CallAndMessageChecker::uninitRefOrPointer(CheckerContext &C,
133                                                const SVal &V,
134                                                const SourceRange &ArgRange,
135                                                const Expr *ArgEx,
136                                                std::unique_ptr<BugType> &BT,
137                                                const ParmVarDecl *ParamDecl,
138                                                const char *BD) const {
139   if (!Filter.Check_CallAndMessageUnInitRefArg)
140     return false;
141 
142   // No parameter declaration available, i.e. variadic function argument.
143   if(!ParamDecl)
144     return false;
145 
146   // If parameter is declared as pointer to const in function declaration,
147   // then check if corresponding argument in function call is
148   // pointing to undefined symbol value (uninitialized memory).
149   StringRef Message;
150 
151   if (ParamDecl->getType()->isPointerType()) {
152     Message = "Function call argument is a pointer to uninitialized value";
153   } else if (ParamDecl->getType()->isReferenceType()) {
154     Message = "Function call argument is an uninitialized value";
155   } else
156     return false;
157 
158   if(!ParamDecl->getType()->getPointeeType().isConstQualified())
159     return false;
160 
161   if (const MemRegion *SValMemRegion = V.getAsRegion()) {
162     const ProgramStateRef State = C.getState();
163     const SVal PSV = State->getSVal(SValMemRegion);
164     if (PSV.isUndef()) {
165       if (ExplodedNode *N = C.generateSink()) {
166         LazyInit_BT(BD, BT);
167         BugReport *R = new BugReport(*BT, Message, N);
168         R->addRange(ArgRange);
169         if (ArgEx) {
170           bugreporter::trackNullOrUndefValue(N, ArgEx, *R);
171         }
172         C.emitReport(R);
173       }
174       return true;
175     }
176   }
177   return false;
178 }
179 
PreVisitProcessArg(CheckerContext & C,SVal V,SourceRange ArgRange,const Expr * ArgEx,bool IsFirstArgument,bool CheckUninitFields,const CallEvent & Call,std::unique_ptr<BugType> & BT,const ParmVarDecl * ParamDecl) const180 bool CallAndMessageChecker::PreVisitProcessArg(CheckerContext &C,
181                                                SVal V,
182                                                SourceRange ArgRange,
183                                                const Expr *ArgEx,
184                                                bool IsFirstArgument,
185                                                bool CheckUninitFields,
186                                                const CallEvent &Call,
187                                                std::unique_ptr<BugType> &BT,
188                                                const ParmVarDecl *ParamDecl
189                                                ) const {
190   const char *BD = "Uninitialized argument value";
191 
192   if (uninitRefOrPointer(C, V, ArgRange, ArgEx, BT, ParamDecl, BD))
193     return true;
194 
195   if (V.isUndef()) {
196     if (ExplodedNode *N = C.generateSink()) {
197       LazyInit_BT(BD, BT);
198 
199       // Generate a report for this bug.
200       StringRef Desc =
201           describeUninitializedArgumentInCall(Call, IsFirstArgument);
202       BugReport *R = new BugReport(*BT, Desc, N);
203       R->addRange(ArgRange);
204       if (ArgEx)
205         bugreporter::trackNullOrUndefValue(N, ArgEx, *R);
206       C.emitReport(R);
207     }
208     return true;
209   }
210 
211   if (!CheckUninitFields)
212     return false;
213 
214   if (Optional<nonloc::LazyCompoundVal> LV =
215           V.getAs<nonloc::LazyCompoundVal>()) {
216 
217     class FindUninitializedField {
218     public:
219       SmallVector<const FieldDecl *, 10> FieldChain;
220     private:
221       StoreManager &StoreMgr;
222       MemRegionManager &MrMgr;
223       Store store;
224     public:
225       FindUninitializedField(StoreManager &storeMgr,
226                              MemRegionManager &mrMgr, Store s)
227       : StoreMgr(storeMgr), MrMgr(mrMgr), store(s) {}
228 
229       bool Find(const TypedValueRegion *R) {
230         QualType T = R->getValueType();
231         if (const RecordType *RT = T->getAsStructureType()) {
232           const RecordDecl *RD = RT->getDecl()->getDefinition();
233           assert(RD && "Referred record has no definition");
234           for (const auto *I : RD->fields()) {
235             const FieldRegion *FR = MrMgr.getFieldRegion(I, R);
236             FieldChain.push_back(I);
237             T = I->getType();
238             if (T->getAsStructureType()) {
239               if (Find(FR))
240                 return true;
241             }
242             else {
243               const SVal &V = StoreMgr.getBinding(store, loc::MemRegionVal(FR));
244               if (V.isUndef())
245                 return true;
246             }
247             FieldChain.pop_back();
248           }
249         }
250 
251         return false;
252       }
253     };
254 
255     const LazyCompoundValData *D = LV->getCVData();
256     FindUninitializedField F(C.getState()->getStateManager().getStoreManager(),
257                              C.getSValBuilder().getRegionManager(),
258                              D->getStore());
259 
260     if (F.Find(D->getRegion())) {
261       if (ExplodedNode *N = C.generateSink()) {
262         LazyInit_BT(BD, BT);
263         SmallString<512> Str;
264         llvm::raw_svector_ostream os(Str);
265         os << "Passed-by-value struct argument contains uninitialized data";
266 
267         if (F.FieldChain.size() == 1)
268           os << " (e.g., field: '" << *F.FieldChain[0] << "')";
269         else {
270           os << " (e.g., via the field chain: '";
271           bool first = true;
272           for (SmallVectorImpl<const FieldDecl *>::iterator
273                DI = F.FieldChain.begin(), DE = F.FieldChain.end(); DI!=DE;++DI){
274             if (first)
275               first = false;
276             else
277               os << '.';
278             os << **DI;
279           }
280           os << "')";
281         }
282 
283         // Generate a report for this bug.
284         BugReport *R = new BugReport(*BT, os.str(), N);
285         R->addRange(ArgRange);
286 
287         // FIXME: enhance track back for uninitialized value for arbitrary
288         // memregions
289         C.emitReport(R);
290       }
291       return true;
292     }
293   }
294 
295   return false;
296 }
297 
checkPreStmt(const CallExpr * CE,CheckerContext & C) const298 void CallAndMessageChecker::checkPreStmt(const CallExpr *CE,
299                                          CheckerContext &C) const{
300 
301   const Expr *Callee = CE->getCallee()->IgnoreParens();
302   ProgramStateRef State = C.getState();
303   const LocationContext *LCtx = C.getLocationContext();
304   SVal L = State->getSVal(Callee, LCtx);
305 
306   if (L.isUndef()) {
307     if (!BT_call_undef)
308       BT_call_undef.reset(new BuiltinBug(
309           this, "Called function pointer is an uninitalized pointer value"));
310     emitBadCall(BT_call_undef.get(), C, Callee);
311     return;
312   }
313 
314   ProgramStateRef StNonNull, StNull;
315   std::tie(StNonNull, StNull) = State->assume(L.castAs<DefinedOrUnknownSVal>());
316 
317   if (StNull && !StNonNull) {
318     if (!BT_call_null)
319       BT_call_null.reset(new BuiltinBug(
320           this, "Called function pointer is null (null dereference)"));
321     emitBadCall(BT_call_null.get(), C, Callee);
322     return;
323   }
324 
325   C.addTransition(StNonNull);
326 }
327 
checkPreStmt(const CXXDeleteExpr * DE,CheckerContext & C) const328 void CallAndMessageChecker::checkPreStmt(const CXXDeleteExpr *DE,
329                                          CheckerContext &C) const {
330 
331   SVal Arg = C.getSVal(DE->getArgument());
332   if (Arg.isUndef()) {
333     StringRef Desc;
334     ExplodedNode *N = C.generateSink();
335     if (!N)
336       return;
337     if (!BT_cxx_delete_undef)
338       BT_cxx_delete_undef.reset(
339           new BuiltinBug(this, "Uninitialized argument value"));
340     if (DE->isArrayFormAsWritten())
341       Desc = "Argument to 'delete[]' is uninitialized";
342     else
343       Desc = "Argument to 'delete' is uninitialized";
344     BugType *BT = BT_cxx_delete_undef.get();
345     BugReport *R = new BugReport(*BT, Desc, N);
346     bugreporter::trackNullOrUndefValue(N, DE, *R);
347     C.emitReport(R);
348     return;
349   }
350 }
351 
352 
checkPreCall(const CallEvent & Call,CheckerContext & C) const353 void CallAndMessageChecker::checkPreCall(const CallEvent &Call,
354                                          CheckerContext &C) const {
355   ProgramStateRef State = C.getState();
356 
357   // If this is a call to a C++ method, check if the callee is null or
358   // undefined.
359   if (const CXXInstanceCall *CC = dyn_cast<CXXInstanceCall>(&Call)) {
360     SVal V = CC->getCXXThisVal();
361     if (V.isUndef()) {
362       if (!BT_cxx_call_undef)
363         BT_cxx_call_undef.reset(
364             new BuiltinBug(this, "Called C++ object pointer is uninitialized"));
365       emitBadCall(BT_cxx_call_undef.get(), C, CC->getCXXThisExpr());
366       return;
367     }
368 
369     ProgramStateRef StNonNull, StNull;
370     std::tie(StNonNull, StNull) =
371         State->assume(V.castAs<DefinedOrUnknownSVal>());
372 
373     if (StNull && !StNonNull) {
374       if (!BT_cxx_call_null)
375         BT_cxx_call_null.reset(
376             new BuiltinBug(this, "Called C++ object pointer is null"));
377       emitBadCall(BT_cxx_call_null.get(), C, CC->getCXXThisExpr());
378       return;
379     }
380 
381     State = StNonNull;
382   }
383 
384   const Decl *D = Call.getDecl();
385   const FunctionDecl *FD = dyn_cast_or_null<FunctionDecl>(D);
386   if (FD) {
387     // If we have a declaration, we can make sure we pass enough parameters to
388     // the function.
389     unsigned Params = FD->getNumParams();
390     if (Call.getNumArgs() < Params) {
391       ExplodedNode *N = C.generateSink();
392       if (!N)
393         return;
394 
395       LazyInit_BT("Function call with too few arguments", BT_call_few_args);
396 
397       SmallString<512> Str;
398       llvm::raw_svector_ostream os(Str);
399       os << "Function taking " << Params << " argument"
400          << (Params == 1 ? "" : "s") << " is called with less ("
401          << Call.getNumArgs() << ")";
402 
403       BugReport *R = new BugReport(*BT_call_few_args, os.str(), N);
404       C.emitReport(R);
405     }
406   }
407 
408   // Don't check for uninitialized field values in arguments if the
409   // caller has a body that is available and we have the chance to inline it.
410   // This is a hack, but is a reasonable compromise betweens sometimes warning
411   // and sometimes not depending on if we decide to inline a function.
412   const bool checkUninitFields =
413     !(C.getAnalysisManager().shouldInlineCall() && (D && D->getBody()));
414 
415   std::unique_ptr<BugType> *BT;
416   if (isa<ObjCMethodCall>(Call))
417     BT = &BT_msg_arg;
418   else
419     BT = &BT_call_arg;
420 
421   for (unsigned i = 0, e = Call.getNumArgs(); i != e; ++i) {
422     const ParmVarDecl *ParamDecl = nullptr;
423     if(FD && i < FD->getNumParams())
424       ParamDecl = FD->getParamDecl(i);
425     if (PreVisitProcessArg(C, Call.getArgSVal(i), Call.getArgSourceRange(i),
426                            Call.getArgExpr(i), /*IsFirstArgument=*/i == 0,
427                            checkUninitFields, Call, *BT, ParamDecl))
428       return;
429   }
430 
431   // If we make it here, record our assumptions about the callee.
432   C.addTransition(State);
433 }
434 
checkPreObjCMessage(const ObjCMethodCall & msg,CheckerContext & C) const435 void CallAndMessageChecker::checkPreObjCMessage(const ObjCMethodCall &msg,
436                                                 CheckerContext &C) const {
437   SVal recVal = msg.getReceiverSVal();
438   if (recVal.isUndef()) {
439     if (ExplodedNode *N = C.generateSink()) {
440       BugType *BT = nullptr;
441       switch (msg.getMessageKind()) {
442       case OCM_Message:
443         if (!BT_msg_undef)
444           BT_msg_undef.reset(new BuiltinBug(this,
445                                             "Receiver in message expression "
446                                             "is an uninitialized value"));
447         BT = BT_msg_undef.get();
448         break;
449       case OCM_PropertyAccess:
450         if (!BT_objc_prop_undef)
451           BT_objc_prop_undef.reset(new BuiltinBug(
452               this, "Property access on an uninitialized object pointer"));
453         BT = BT_objc_prop_undef.get();
454         break;
455       case OCM_Subscript:
456         if (!BT_objc_subscript_undef)
457           BT_objc_subscript_undef.reset(new BuiltinBug(
458               this, "Subscript access on an uninitialized object pointer"));
459         BT = BT_objc_subscript_undef.get();
460         break;
461       }
462       assert(BT && "Unknown message kind.");
463 
464       BugReport *R = new BugReport(*BT, BT->getName(), N);
465       const ObjCMessageExpr *ME = msg.getOriginExpr();
466       R->addRange(ME->getReceiverRange());
467 
468       // FIXME: getTrackNullOrUndefValueVisitor can't handle "super" yet.
469       if (const Expr *ReceiverE = ME->getInstanceReceiver())
470         bugreporter::trackNullOrUndefValue(N, ReceiverE, *R);
471       C.emitReport(R);
472     }
473     return;
474   } else {
475     // Bifurcate the state into nil and non-nil ones.
476     DefinedOrUnknownSVal receiverVal = recVal.castAs<DefinedOrUnknownSVal>();
477 
478     ProgramStateRef state = C.getState();
479     ProgramStateRef notNilState, nilState;
480     std::tie(notNilState, nilState) = state->assume(receiverVal);
481 
482     // Handle receiver must be nil.
483     if (nilState && !notNilState) {
484       HandleNilReceiver(C, state, msg);
485       return;
486     }
487   }
488 }
489 
emitNilReceiverBug(CheckerContext & C,const ObjCMethodCall & msg,ExplodedNode * N) const490 void CallAndMessageChecker::emitNilReceiverBug(CheckerContext &C,
491                                                const ObjCMethodCall &msg,
492                                                ExplodedNode *N) const {
493 
494   if (!BT_msg_ret)
495     BT_msg_ret.reset(
496         new BuiltinBug(this, "Receiver in message expression is 'nil'"));
497 
498   const ObjCMessageExpr *ME = msg.getOriginExpr();
499 
500   QualType ResTy = msg.getResultType();
501 
502   SmallString<200> buf;
503   llvm::raw_svector_ostream os(buf);
504   os << "The receiver of message '";
505   ME->getSelector().print(os);
506   os << "' is nil";
507   if (ResTy->isReferenceType()) {
508     os << ", which results in forming a null reference";
509   } else {
510     os << " and returns a value of type '";
511     msg.getResultType().print(os, C.getLangOpts());
512     os << "' that will be garbage";
513   }
514 
515   BugReport *report = new BugReport(*BT_msg_ret, os.str(), N);
516   report->addRange(ME->getReceiverRange());
517   // FIXME: This won't track "self" in messages to super.
518   if (const Expr *receiver = ME->getInstanceReceiver()) {
519     bugreporter::trackNullOrUndefValue(N, receiver, *report);
520   }
521   C.emitReport(report);
522 }
523 
supportsNilWithFloatRet(const llvm::Triple & triple)524 static bool supportsNilWithFloatRet(const llvm::Triple &triple) {
525   return (triple.getVendor() == llvm::Triple::Apple &&
526           (triple.isiOS() || !triple.isMacOSXVersionLT(10,5)));
527 }
528 
HandleNilReceiver(CheckerContext & C,ProgramStateRef state,const ObjCMethodCall & Msg) const529 void CallAndMessageChecker::HandleNilReceiver(CheckerContext &C,
530                                               ProgramStateRef state,
531                                               const ObjCMethodCall &Msg) const {
532   ASTContext &Ctx = C.getASTContext();
533   static CheckerProgramPointTag Tag(this, "NilReceiver");
534 
535   // Check the return type of the message expression.  A message to nil will
536   // return different values depending on the return type and the architecture.
537   QualType RetTy = Msg.getResultType();
538   CanQualType CanRetTy = Ctx.getCanonicalType(RetTy);
539   const LocationContext *LCtx = C.getLocationContext();
540 
541   if (CanRetTy->isStructureOrClassType()) {
542     // Structure returns are safe since the compiler zeroes them out.
543     SVal V = C.getSValBuilder().makeZeroVal(RetTy);
544     C.addTransition(state->BindExpr(Msg.getOriginExpr(), LCtx, V), &Tag);
545     return;
546   }
547 
548   // Other cases: check if sizeof(return type) > sizeof(void*)
549   if (CanRetTy != Ctx.VoidTy && C.getLocationContext()->getParentMap()
550                                   .isConsumedExpr(Msg.getOriginExpr())) {
551     // Compute: sizeof(void *) and sizeof(return type)
552     const uint64_t voidPtrSize = Ctx.getTypeSize(Ctx.VoidPtrTy);
553     const uint64_t returnTypeSize = Ctx.getTypeSize(CanRetTy);
554 
555     if (CanRetTy.getTypePtr()->isReferenceType()||
556         (voidPtrSize < returnTypeSize &&
557          !(supportsNilWithFloatRet(Ctx.getTargetInfo().getTriple()) &&
558            (Ctx.FloatTy == CanRetTy ||
559             Ctx.DoubleTy == CanRetTy ||
560             Ctx.LongDoubleTy == CanRetTy ||
561             Ctx.LongLongTy == CanRetTy ||
562             Ctx.UnsignedLongLongTy == CanRetTy)))) {
563       if (ExplodedNode *N = C.generateSink(state, nullptr, &Tag))
564         emitNilReceiverBug(C, Msg, N);
565       return;
566     }
567 
568     // Handle the safe cases where the return value is 0 if the
569     // receiver is nil.
570     //
571     // FIXME: For now take the conservative approach that we only
572     // return null values if we *know* that the receiver is nil.
573     // This is because we can have surprises like:
574     //
575     //   ... = [[NSScreens screens] objectAtIndex:0];
576     //
577     // What can happen is that [... screens] could return nil, but
578     // it most likely isn't nil.  We should assume the semantics
579     // of this case unless we have *a lot* more knowledge.
580     //
581     SVal V = C.getSValBuilder().makeZeroVal(RetTy);
582     C.addTransition(state->BindExpr(Msg.getOriginExpr(), LCtx, V), &Tag);
583     return;
584   }
585 
586   C.addTransition(state);
587 }
588 
589 #define REGISTER_CHECKER(name)                                                 \
590   void ento::register##name(CheckerManager &mgr) {                             \
591     CallAndMessageChecker *Checker =                                           \
592         mgr.registerChecker<CallAndMessageChecker>();                          \
593     Checker->Filter.Check_##name = true;                                       \
594     Checker->Filter.CheckName_##name = mgr.getCurrentCheckName();              \
595   }
596 
597 REGISTER_CHECKER(CallAndMessageUnInitRefArg)
598 REGISTER_CHECKER(CallAndMessageChecker)
599