1//===----- UninitializedObjectChecker.cpp ------------------------*- C++ -*-==//
2//
3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4// See https://llvm.org/LICENSE.txt for license information.
5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6//
7//===----------------------------------------------------------------------===//
8//
9// This file defines a checker that reports uninitialized fields in objects
10// created after a constructor call.
11//
12// To read about command line options and how the checker works, refer to the
13// top of the file and inline comments in UninitializedObject.h.
14//
15// Some of the logic is implemented in UninitializedPointee.cpp, to reduce the
16// complexity of this file.
17//
18//===----------------------------------------------------------------------===//
19
20#include "UninitializedObject.h"
21#include "clang/ASTMatchers/ASTMatchFinder.h"
22#include "clang/Driver/DriverDiagnostic.h"
23#include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h"
24#include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
25#include "clang/StaticAnalyzer/Core/Checker.h"
26#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
27#include "clang/StaticAnalyzer/Core/PathSensitive/DynamicType.h"
28#include "llvm/ADT/STLExtras.h"
29
30using namespace clang;
31using namespace clang::ento;
32using namespace clang::ast_matchers;
33
34/// We'll mark fields (and pointee of fields) that are confirmed to be
35/// uninitialized as already analyzed.
36REGISTER_SET_WITH_PROGRAMSTATE(AnalyzedRegions, const MemRegion *)
37
38namespace {
39
40class UninitializedObjectChecker
41 : public Checker<check::EndFunction, check::DeadSymbols> {
42 const BugType BT_uninitField{this, "Uninitialized fields"};
43
44public:
45 // The fields of this struct will be initialized when registering the checker.
46 UninitObjCheckerOptions Opts;
47
48 void checkEndFunction(const ReturnStmt *RS, CheckerContext &C) const;
49 void checkDeadSymbols(SymbolReaper &SR, CheckerContext &C) const;
50};
51
52/// A basic field type, that is not a pointer or a reference, it's dynamic and
53/// static type is the same.
54class RegularField final : public FieldNode {
55public:
56 RegularField(const FieldRegion *FR) : FieldNode(FR) {}
57
58 void printNoteMsg(llvm::raw_ostream &Out) const override {
59 Out << "uninitialized field ";
60 }
61
62 void printPrefix(llvm::raw_ostream &Out) const override {}
63
64 void printNode(llvm::raw_ostream &Out) const override {
65 Out << getVariableName(Field: getDecl());
66 }
67
68 void printSeparator(llvm::raw_ostream &Out) const override { Out << '.'; }
69};
70
71/// Represents that the FieldNode that comes after this is declared in a base
72/// of the previous FieldNode. As such, this descendant doesn't wrap a
73/// FieldRegion, and is purely a tool to describe a relation between two other
74/// FieldRegion wrapping descendants.
75class BaseClass final : public FieldNode {
76 const QualType BaseClassT;
77
78public:
79 BaseClass(const QualType &T) : FieldNode(nullptr), BaseClassT(T) {
80 assert(!T.isNull());
81 assert(T->getAsCXXRecordDecl());
82 }
83
84 void printNoteMsg(llvm::raw_ostream &Out) const override {
85 llvm_unreachable("This node can never be the final node in the "
86 "fieldchain!");
87 }
88
89 void printPrefix(llvm::raw_ostream &Out) const override {}
90
91 void printNode(llvm::raw_ostream &Out) const override {
92 Out << BaseClassT->getAsCXXRecordDecl()->getName() << "::";
93 }
94
95 void printSeparator(llvm::raw_ostream &Out) const override {}
96
97 bool isBase() const override { return true; }
98};
99
100} // end of anonymous namespace
101
102// Utility function declarations.
103
104/// Returns the region that was constructed by CtorDecl, or nullptr if that
105/// isn't possible.
106static const TypedValueRegion *
107getConstructedRegion(const CXXConstructorDecl *CtorDecl,
108 CheckerContext &Context);
109
110/// Checks whether the object constructed by \p Ctor will be analyzed later
111/// (e.g. if the object is a field of another object, in which case we'd check
112/// it multiple times).
113static bool willObjectBeAnalyzedLater(const CXXConstructorDecl *Ctor,
114 CheckerContext &Context);
115
116/// Checks whether RD contains a field with a name or type name that matches
117/// \p Pattern.
118static bool shouldIgnoreRecord(const RecordDecl *RD, StringRef Pattern);
119
120/// Checks _syntactically_ whether it is possible to access FD from the record
121/// that contains it without a preceding assert (even if that access happens
122/// inside a method). This is mainly used for records that act like unions, like
123/// having multiple bit fields, with only a fraction being properly initialized.
124/// If these fields are properly guarded with asserts, this method returns
125/// false.
126///
127/// Since this check is done syntactically, this method could be inaccurate.
128static bool hasUnguardedAccess(const FieldDecl *FD, ProgramStateRef State);
129
130//===----------------------------------------------------------------------===//
131// Methods for UninitializedObjectChecker.
132//===----------------------------------------------------------------------===//
133
134void UninitializedObjectChecker::checkEndFunction(
135 const ReturnStmt *RS, CheckerContext &Context) const {
136
137 const auto *CtorDecl =
138 dyn_cast_or_null<CXXConstructorDecl>(Val: Context.getStackFrame()->getDecl());
139 if (!CtorDecl)
140 return;
141
142 if (!CtorDecl->isUserProvided())
143 return;
144
145 if (CtorDecl->getParent()->isUnion())
146 return;
147
148 // This avoids essentially the same error being reported multiple times.
149 if (willObjectBeAnalyzedLater(Ctor: CtorDecl, Context))
150 return;
151
152 const TypedValueRegion *R = getConstructedRegion(CtorDecl, Context);
153 if (!R)
154 return;
155
156 FindUninitializedFields F(Context.getState(), R, Opts);
157
158 std::pair<ProgramStateRef, const UninitFieldMap &> UninitInfo =
159 F.getResults();
160
161 ProgramStateRef UpdatedState = UninitInfo.first;
162 const UninitFieldMap &UninitFields = UninitInfo.second;
163
164 if (UninitFields.empty()) {
165 Context.addTransition(State: UpdatedState);
166 return;
167 }
168
169 // There are uninitialized fields in the record.
170
171 ExplodedNode *Node = Context.generateNonFatalErrorNode(State: UpdatedState);
172 if (!Node)
173 return;
174
175 PathDiagnosticLocation LocUsedForUniqueing;
176 const Expr *CallSite = Context.getStackFrame()->getCallSite();
177 if (CallSite)
178 LocUsedForUniqueing = PathDiagnosticLocation::createBegin(
179 S: CallSite, SM: Context.getSourceManager(), SFAC: Node->getStackFrame());
180
181 // For Plist consumers that don't support notes just yet, we'll convert notes
182 // to warnings.
183 if (Opts.ShouldConvertNotesToWarnings) {
184 for (const auto &Pair : UninitFields) {
185
186 auto Report = std::make_unique<PathSensitiveBugReport>(
187 args: BT_uninitField, args: Pair.second, args&: Node, args&: LocUsedForUniqueing,
188 args: Node->getStackFrame()->getDecl());
189 Context.emitReport(R: std::move(Report));
190 }
191 return;
192 }
193
194 SmallString<100> WarningBuf;
195 llvm::raw_svector_ostream WarningOS(WarningBuf);
196 WarningOS << UninitFields.size() << " uninitialized field"
197 << (UninitFields.size() == 1 ? "" : "s")
198 << " at the end of the constructor call";
199
200 auto Report = std::make_unique<PathSensitiveBugReport>(
201 args: BT_uninitField, args: WarningOS.str(), args&: Node, args&: LocUsedForUniqueing,
202 args: Node->getStackFrame()->getDecl());
203
204 for (const auto &Pair : UninitFields) {
205 Report->addNote(Msg: Pair.second,
206 Pos: PathDiagnosticLocation::create(D: Pair.first->getDecl(),
207 SM: Context.getSourceManager()));
208 }
209 Context.emitReport(R: std::move(Report));
210}
211
212void UninitializedObjectChecker::checkDeadSymbols(SymbolReaper &SR,
213 CheckerContext &C) const {
214 ProgramStateRef State = C.getState();
215 for (const MemRegion *R : State->get<AnalyzedRegions>()) {
216 if (!SR.isLiveRegion(region: R))
217 State = State->remove<AnalyzedRegions>(K: R);
218 }
219}
220
221//===----------------------------------------------------------------------===//
222// Methods for FindUninitializedFields.
223//===----------------------------------------------------------------------===//
224
225FindUninitializedFields::FindUninitializedFields(
226 ProgramStateRef State, const TypedValueRegion *const R,
227 const UninitObjCheckerOptions &Opts)
228 : State(State), ObjectR(R), Opts(Opts) {
229
230 isNonUnionUninit(R: ObjectR, LocalChain: FieldChainInfo(ChainFactory));
231
232 // In non-pedantic mode, if ObjectR doesn't contain a single initialized
233 // field, we'll assume that Object was intentionally left uninitialized.
234 if (!Opts.IsPedantic && !isAnyFieldInitialized())
235 UninitFields.clear();
236}
237
238bool FindUninitializedFields::addFieldToUninits(FieldChainInfo Chain,
239 const MemRegion *PointeeR) {
240 const FieldRegion *FR = Chain.getUninitRegion();
241
242 assert((PointeeR || !isDereferencableType(FR->getDecl()->getType())) &&
243 "One must also pass the pointee region as a parameter for "
244 "dereferenceable fields!");
245
246 if (State->getStateManager().getContext().getSourceManager().isInSystemHeader(
247 Loc: FR->getDecl()->getLocation()))
248 return false;
249
250 if (Opts.IgnoreGuardedFields && !hasUnguardedAccess(FD: FR->getDecl(), State))
251 return false;
252
253 if (State->contains<AnalyzedRegions>(key: FR))
254 return false;
255
256 if (PointeeR) {
257 if (State->contains<AnalyzedRegions>(key: PointeeR)) {
258 return false;
259 }
260 State = State->add<AnalyzedRegions>(K: PointeeR);
261 }
262
263 State = State->add<AnalyzedRegions>(K: FR);
264
265 UninitFieldMap::mapped_type NoteMsgBuf;
266 llvm::raw_svector_ostream OS(NoteMsgBuf);
267 Chain.printNoteMsg(Out&: OS);
268
269 return UninitFields.insert(x: {FR, std::move(NoteMsgBuf)}).second;
270}
271
272bool FindUninitializedFields::isNonUnionUninit(const TypedValueRegion *R,
273 FieldChainInfo LocalChain) {
274 assert(R->getValueType()->isRecordType() &&
275 !R->getValueType()->isUnionType() &&
276 "This method only checks non-union record objects!");
277
278 const RecordDecl *RD = R->getValueType()->getAsRecordDecl()->getDefinition();
279
280 if (!RD) {
281 IsAnyFieldInitialized = true;
282 return true;
283 }
284
285 if (!Opts.IgnoredRecordsWithFieldPattern.empty() &&
286 shouldIgnoreRecord(RD, Pattern: Opts.IgnoredRecordsWithFieldPattern)) {
287 IsAnyFieldInitialized = true;
288 return false;
289 }
290
291 bool ContainsUninitField = false;
292
293 // Are all of this non-union's fields initialized?
294 for (const FieldDecl *I : RD->fields()) {
295 if (I->isUnnamedBitField()) {
296 continue;
297 }
298 const auto FieldVal =
299 State->getLValue(decl: I, Base: loc::MemRegionVal(R)).castAs<loc::MemRegionVal>();
300 const auto *FR = FieldVal.getRegionAs<FieldRegion>();
301 QualType T = I->getType();
302
303 // If LocalChain already contains FR, then we encountered a cyclic
304 // reference. In this case, region FR is already under checking at an
305 // earlier node in the directed tree.
306 if (LocalChain.contains(FR))
307 return false;
308
309 if (T->isStructureOrClassType()) {
310 if (isNonUnionUninit(R: FR, LocalChain: LocalChain.add(FN: RegularField(FR))))
311 ContainsUninitField = true;
312 continue;
313 }
314
315 if (T->isUnionType()) {
316 if (isUnionUninit(R: FR)) {
317 if (addFieldToUninits(Chain: LocalChain.add(FN: RegularField(FR))))
318 ContainsUninitField = true;
319 } else
320 IsAnyFieldInitialized = true;
321 continue;
322 }
323
324 if (T->isArrayType()) {
325 IsAnyFieldInitialized = true;
326 continue;
327 }
328
329 SVal V = State->getSVal(LV: FieldVal);
330
331 if (isDereferencableType(T) || isa<nonloc::LocAsInteger>(Val: V)) {
332 if (isDereferencableUninit(FR, LocalChain))
333 ContainsUninitField = true;
334 continue;
335 }
336
337 if (isPrimitiveType(T)) {
338 if (isPrimitiveUninit(V)) {
339 if (addFieldToUninits(Chain: LocalChain.add(FN: RegularField(FR))))
340 ContainsUninitField = true;
341 }
342 continue;
343 }
344
345 llvm_unreachable("All cases are handled!");
346 }
347
348 // Checking bases. The checker will regard inherited data members as direct
349 // fields.
350 const auto *CXXRD = dyn_cast<CXXRecordDecl>(Val: RD);
351 if (!CXXRD)
352 return ContainsUninitField;
353
354 for (const CXXBaseSpecifier &BaseSpec : CXXRD->bases()) {
355 const auto *BaseRegion = State->getLValue(BaseSpec, Super: R)
356 .castAs<loc::MemRegionVal>()
357 .getRegionAs<TypedValueRegion>();
358
359 // If the head of the list is also a BaseClass, we'll overwrite it to avoid
360 // note messages like 'this->A::B::x'.
361 if (!LocalChain.isEmpty() && LocalChain.getHead().isBase()) {
362 if (isNonUnionUninit(R: BaseRegion, LocalChain: LocalChain.replaceHead(
363 FN: BaseClass(BaseSpec.getType()))))
364 ContainsUninitField = true;
365 } else {
366 if (isNonUnionUninit(R: BaseRegion,
367 LocalChain: LocalChain.add(FN: BaseClass(BaseSpec.getType()))))
368 ContainsUninitField = true;
369 }
370 }
371
372 return ContainsUninitField;
373}
374
375bool FindUninitializedFields::isUnionUninit(const TypedValueRegion *R) {
376 assert(R->getValueType()->isUnionType() &&
377 "This method only checks union objects!");
378 // TODO: Implement support for union fields.
379 return false;
380}
381
382bool FindUninitializedFields::isPrimitiveUninit(SVal V) {
383 if (V.isUndef())
384 return true;
385
386 IsAnyFieldInitialized = true;
387 return false;
388}
389
390//===----------------------------------------------------------------------===//
391// Methods for FieldChainInfo.
392//===----------------------------------------------------------------------===//
393
394bool FieldChainInfo::contains(const FieldRegion *FR) const {
395 for (const FieldNode &Node : Chain) {
396 if (Node.isSameRegion(OtherFR: FR))
397 return true;
398 }
399 return false;
400}
401
402/// Prints every element except the last to `Out`. Since ImmutableLists store
403/// elements in reverse order, and have no reverse iterators, we use a
404/// recursive function to print the fieldchain correctly. The last element in
405/// the chain is to be printed by `FieldChainInfo::print`.
406static void printTail(llvm::raw_ostream &Out,
407 const FieldChainInfo::FieldChain L);
408
409// FIXME: This function constructs an incorrect string in the following case:
410//
411// struct Base { int x; };
412// struct D1 : Base {}; struct D2 : Base {};
413//
414// struct MostDerived : D1, D2 {
415// MostDerived() {}
416// }
417//
418// A call to MostDerived::MostDerived() will cause two notes that say
419// "uninitialized field 'this->x'", but we can't refer to 'x' directly,
420// we need an explicit namespace resolution whether the uninit field was
421// 'D1::x' or 'D2::x'.
422void FieldChainInfo::printNoteMsg(llvm::raw_ostream &Out) const {
423 if (Chain.isEmpty())
424 return;
425
426 const FieldNode &LastField = getHead();
427
428 LastField.printNoteMsg(Out);
429 Out << '\'';
430
431 for (const FieldNode &Node : Chain)
432 Node.printPrefix(Out);
433
434 Out << "this->";
435 printTail(Out, L: Chain.getTail());
436 LastField.printNode(Out);
437 Out << '\'';
438}
439
440static void printTail(llvm::raw_ostream &Out,
441 const FieldChainInfo::FieldChain L) {
442 if (L.isEmpty())
443 return;
444
445 printTail(Out, L: L.getTail());
446
447 L.getHead().printNode(Out);
448 L.getHead().printSeparator(Out);
449}
450
451//===----------------------------------------------------------------------===//
452// Utility functions.
453//===----------------------------------------------------------------------===//
454
455static const SubRegion *
456getConstructedSubRegion(const CXXConstructorDecl *CtorDecl,
457 CheckerContext &Context) {
458 Loc ThisLoc =
459 Context.getSValBuilder().getCXXThis(D: CtorDecl, SF: Context.getStackFrame());
460 SVal ObjectV = Context.getState()->getSVal(LV: ThisLoc);
461 return ObjectV.getAsRegion()->getAs<SubRegion>();
462}
463
464static const TypedValueRegion *
465getConstructedRegion(const CXXConstructorDecl *CtorDecl,
466 CheckerContext &Context) {
467
468 const SubRegion *SR = getConstructedSubRegion(CtorDecl, Context);
469 if (!SR)
470 return nullptr;
471
472 if (const auto *TVR = SR->getAs<TypedValueRegion>()) {
473 return TVR->getValueType()->getAsCXXRecordDecl() ? TVR : nullptr;
474 }
475
476 QualType ThisPointeeTy = CtorDecl->getThisType()->getPointeeType();
477 if (!ThisPointeeTy->getAsCXXRecordDecl())
478 return nullptr;
479
480 auto &MemMgr = Context.getState()->getStateManager().getRegionManager();
481 auto &SVB = Context.getSValBuilder();
482
483 const auto *ElemR = MemMgr.getElementRegion(
484 elementType: ThisPointeeTy, Idx: SVB.makeZeroArrayIndex(), superRegion: SR, Ctx: Context.getASTContext());
485
486 return ElemR;
487}
488
489static bool willObjectBeAnalyzedLater(const CXXConstructorDecl *Ctor,
490 CheckerContext &Context) {
491
492 const SubRegion *CurrRegion = getConstructedSubRegion(CtorDecl: Ctor, Context);
493 if (!CurrRegion)
494 return false;
495
496 // Returns true if \p Ctor was called by another constructor whose region
497 // contains CurrRegion, so CurrRegion will be analyzed during that analysis.
498 return llvm::any_of(
499 Range: Context.getStackFrame()->parents(), P: [&](const StackFrame &SF) {
500 const auto *OtherCtor = dyn_cast<CXXConstructorDecl>(Val: SF.getDecl());
501 if (!OtherCtor)
502 return false;
503
504 const SubRegion *OtherRegion =
505 getConstructedSubRegion(CtorDecl: OtherCtor, Context);
506 return OtherRegion && CurrRegion->isSubRegionOf(R: OtherRegion);
507 });
508}
509
510static bool shouldIgnoreRecord(const RecordDecl *RD, StringRef Pattern) {
511 llvm::Regex R(Pattern);
512
513 for (const FieldDecl *FD : RD->fields()) {
514 if (R.match(String: FD->getType().getAsString()))
515 return true;
516 if (R.match(String: FD->getName()))
517 return true;
518 }
519
520 return false;
521}
522
523static const Stmt *getMethodBody(const CXXMethodDecl *M) {
524 if (isa<CXXConstructorDecl>(Val: M))
525 return nullptr;
526
527 if (!M->isDefined())
528 return nullptr;
529
530 return M->getDefinition()->getBody();
531}
532
533static bool hasUnguardedAccess(const FieldDecl *FD, ProgramStateRef State) {
534
535 if (FD->getAccess() == AccessSpecifier::AS_public)
536 return true;
537
538 const auto *Parent = dyn_cast<CXXRecordDecl>(Val: FD->getParent());
539
540 if (!Parent)
541 return true;
542
543 Parent = Parent->getDefinition();
544 assert(Parent && "The record's definition must be avaible if an uninitialized"
545 " field of it was found!");
546
547 ASTContext &AC = State->getStateManager().getContext();
548
549 auto FieldAccessM = memberExpr(hasDeclaration(InnerMatcher: equalsNode(Other: FD))).bind(ID: "access");
550
551 auto AssertLikeM = callExpr(callee(InnerMatcher: functionDecl(
552 hasAnyName("exit", "panic", "error", "Assert", "assert", "ziperr",
553 "assfail", "db_error", "__assert", "__assert2", "_wassert",
554 "__assert_rtn", "__assert_fail", "dtrace_assfail",
555 "yy_fatal_error", "_XCAssertionFailureHandler",
556 "_DTAssertionFailureHandler", "_TSAssertionFailureHandler"))));
557
558 auto NoReturnFuncM = callExpr(callee(InnerMatcher: functionDecl(isNoReturn())));
559
560 auto GuardM =
561 stmt(anyOf(ifStmt(), switchStmt(), conditionalOperator(), AssertLikeM,
562 NoReturnFuncM))
563 .bind(ID: "guard");
564
565 for (const CXXMethodDecl *M : Parent->methods()) {
566 const Stmt *MethodBody = getMethodBody(M);
567 if (!MethodBody)
568 continue;
569
570 auto Accesses = match(Matcher: stmt(hasDescendant(FieldAccessM)), Node: *MethodBody, Context&: AC);
571 if (Accesses.empty())
572 continue;
573 const auto *FirstAccess = Accesses[0].getNodeAs<MemberExpr>(ID: "access");
574 assert(FirstAccess);
575
576 auto Guards = match(Matcher: stmt(hasDescendant(GuardM)), Node: *MethodBody, Context&: AC);
577 if (Guards.empty())
578 return true;
579 const auto *FirstGuard = Guards[0].getNodeAs<Stmt>(ID: "guard");
580 assert(FirstGuard);
581
582 if (FirstAccess->getBeginLoc() < FirstGuard->getBeginLoc())
583 return true;
584 }
585
586 return false;
587}
588
589std::string clang::ento::getVariableName(const FieldDecl *Field) {
590 // If Field is a captured lambda variable, Field->getName() will return with
591 // an empty string. We can however acquire it's name from the lambda's
592 // captures.
593 const auto *CXXParent = dyn_cast<CXXRecordDecl>(Val: Field->getParent());
594
595 if (CXXParent && CXXParent->isLambda()) {
596 assert(CXXParent->captures_begin());
597 auto It = CXXParent->captures_begin() + Field->getFieldIndex();
598
599 if (It->capturesVariable())
600 return llvm::Twine("/*captured variable*/" +
601 It->getCapturedVar()->getName())
602 .str();
603
604 if (It->capturesThis())
605 return "/*'this' capture*/";
606
607 llvm_unreachable("No other capture type is expected!");
608 }
609
610 return std::string(Field->getName());
611}
612
613void ento::registerUninitializedObjectChecker(CheckerManager &Mgr) {
614 auto Chk = Mgr.registerChecker<UninitializedObjectChecker>();
615
616 const AnalyzerOptions &AnOpts = Mgr.getAnalyzerOptions();
617 UninitObjCheckerOptions &ChOpts = Chk->Opts;
618
619 ChOpts.IsPedantic = AnOpts.getCheckerBooleanOption(C: Chk, OptionName: "Pedantic");
620 ChOpts.ShouldConvertNotesToWarnings = AnOpts.getCheckerBooleanOption(
621 C: Chk, OptionName: "NotesAsWarnings");
622 ChOpts.CheckPointeeInitialization = AnOpts.getCheckerBooleanOption(
623 C: Chk, OptionName: "CheckPointeeInitialization");
624 ChOpts.IgnoredRecordsWithFieldPattern =
625 std::string(AnOpts.getCheckerStringOption(C: Chk, OptionName: "IgnoreRecordsWithField"));
626 ChOpts.IgnoreGuardedFields =
627 AnOpts.getCheckerBooleanOption(C: Chk, OptionName: "IgnoreGuardedFields");
628
629 std::string ErrorMsg;
630 if (!llvm::Regex(ChOpts.IgnoredRecordsWithFieldPattern).isValid(Error&: ErrorMsg))
631 Mgr.reportInvalidCheckerOptionValue(Checker: Chk, OptionName: "IgnoreRecordsWithField",
632 ExpectedValueDesc: "a valid regex, building failed with error message "
633 "\"" + ErrorMsg + "\"");
634}
635
636bool ento::shouldRegisterUninitializedObjectChecker(const CheckerManager &mgr) {
637 return true;
638}
639