clang  7.0.0svn
CoreEngine.h
Go to the documentation of this file.
1 //===- CoreEngine.h - Path-Sensitive Dataflow Engine ------------*- C++ -*-===//
2 //
3 // The LLVM Compiler Infrastructure
4 //
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
7 //
8 //===----------------------------------------------------------------------===//
9 //
10 // This file defines a generic engine for intraprocedural, path-sensitive,
11 // dataflow analysis via graph reachability.
12 //
13 //===----------------------------------------------------------------------===//
14 
15 #ifndef LLVM_CLANG_STATICANALYZER_CORE_PATHSENSITIVE_COREENGINE_H
16 #define LLVM_CLANG_STATICANALYZER_CORE_PATHSENSITIVE_COREENGINE_H
17 
18 #include "clang/AST/Stmt.h"
20 #include "clang/Analysis/CFG.h"
22 #include "clang/Basic/LLVM.h"
27 #include "llvm/ADT/SmallVector.h"
28 #include "llvm/Support/Casting.h"
29 #include <cassert>
30 #include <memory>
31 #include <utility>
32 #include <vector>
33 
34 namespace clang {
35 
36 class AnalyzerOptions;
37 class CXXBindTemporaryExpr;
38 class Expr;
39 class LabelDecl;
40 
41 namespace ento {
42 
43 class FunctionSummariesTy;
44 class SubEngine;
45 
46 //===----------------------------------------------------------------------===//
47 /// CoreEngine - Implements the core logic of the graph-reachability
48 /// analysis. It traverses the CFG and generates the ExplodedGraph.
49 /// Program "states" are treated as opaque void pointers.
50 /// The template class CoreEngine (which subclasses CoreEngine)
51 /// provides the matching component to the engine that knows the actual types
52 /// for states. Note that this engine only dispatches to transfer functions
53 /// at the statement and block-level. The analyses themselves must implement
54 /// any transfer function logic and the sub-expression level (if any).
55 class CoreEngine {
56  friend class CommonNodeBuilder;
58  friend class ExprEngine;
60  friend class NodeBuilder;
61  friend struct NodeBuilderContext;
62  friend class SwitchNodeBuilder;
63 
64 public:
65  using BlocksExhausted =
66  std::vector<std::pair<BlockEdge, const ExplodedNode *>>;
67 
68  using BlocksAborted =
69  std::vector<std::pair<const CFGBlock *, const ExplodedNode *>>;
70 
71 private:
72  SubEngine &SubEng;
73 
74  /// G - The simulation graph. Each node is a (location,state) pair.
75  mutable ExplodedGraph G;
76 
77  /// WList - A set of queued nodes that need to be processed by the
78  /// worklist algorithm. It is up to the implementation of WList to decide
79  /// the order that nodes are processed.
80  std::unique_ptr<WorkList> WList;
81 
82  /// BCounterFactory - A factory object for created BlockCounter objects.
83  /// These are used to record for key nodes in the ExplodedGraph the
84  /// number of times different CFGBlocks have been visited along a path.
85  BlockCounter::Factory BCounterFactory;
86 
87  /// The locations where we stopped doing work because we visited a location
88  /// too many times.
89  BlocksExhausted blocksExhausted;
90 
91  /// The locations where we stopped because the engine aborted analysis,
92  /// usually because it could not reason about something.
93  BlocksAborted blocksAborted;
94 
95  /// The information about functions shared by the whole translation unit.
96  /// (This data is owned by AnalysisConsumer.)
97  FunctionSummariesTy *FunctionSummaries;
98 
99  void generateNode(const ProgramPoint &Loc,
101  ExplodedNode *Pred);
102 
103  void HandleBlockEdge(const BlockEdge &E, ExplodedNode *Pred);
104  void HandleBlockEntrance(const BlockEntrance &E, ExplodedNode *Pred);
105  void HandleBlockExit(const CFGBlock *B, ExplodedNode *Pred);
106 
107  void HandleCallEnter(const CallEnter &CE, ExplodedNode *Pred);
108 
109  void HandlePostStmt(const CFGBlock *B, unsigned StmtIdx, ExplodedNode *Pred);
110 
111  void HandleBranch(const Stmt *Cond, const Stmt *Term, const CFGBlock *B,
112  ExplodedNode *Pred);
113  void HandleCleanupTemporaryBranch(const CXXBindTemporaryExpr *BTE,
114  const CFGBlock *B, ExplodedNode *Pred);
115 
116  /// Handle conditional logic for running static initializers.
117  void HandleStaticInit(const DeclStmt *DS, const CFGBlock *B,
118  ExplodedNode *Pred);
119 
120 private:
121  ExplodedNode *generateCallExitBeginNode(ExplodedNode *N,
122  const ReturnStmt *RS);
123 
124 public:
125  /// Construct a CoreEngine object to analyze the provided CFG.
126  CoreEngine(SubEngine &subengine,
128  AnalyzerOptions &Opts);
129 
130  CoreEngine(const CoreEngine &) = delete;
131  CoreEngine &operator=(const CoreEngine &) = delete;
132 
133  /// getGraph - Returns the exploded graph.
134  ExplodedGraph &getGraph() { return G; }
135 
136  /// ExecuteWorkList - Run the worklist algorithm for a maximum number of
137  /// steps. Returns true if there is still simulation state on the worklist.
138  bool ExecuteWorkList(const LocationContext *L, unsigned Steps,
139  ProgramStateRef InitState);
140 
141  /// Returns true if there is still simulation state on the worklist.
143  unsigned Steps,
144  ProgramStateRef InitState,
145  ExplodedNodeSet &Dst);
146 
147  /// Dispatch the work list item based on the given location information.
148  /// Use Pred parameter as the predecessor state.
150  const WorkListUnit& WU);
151 
152  // Functions for external checking of whether we have unfinished work
153  bool wasBlockAborted() const { return !blocksAborted.empty(); }
154  bool wasBlocksExhausted() const { return !blocksExhausted.empty(); }
155  bool hasWorkRemaining() const { return wasBlocksExhausted() ||
156  WList->hasWork() ||
157  wasBlockAborted(); }
158 
159  /// Inform the CoreEngine that a basic block was aborted because
160  /// it could not be completely analyzed.
161  void addAbortedBlock(const ExplodedNode *node, const CFGBlock *block) {
162  blocksAborted.push_back(std::make_pair(block, node));
163  }
164 
165  WorkList *getWorkList() const { return WList.get(); }
166 
167  BlocksExhausted::const_iterator blocks_exhausted_begin() const {
168  return blocksExhausted.begin();
169  }
170 
171  BlocksExhausted::const_iterator blocks_exhausted_end() const {
172  return blocksExhausted.end();
173  }
174 
175  BlocksAborted::const_iterator blocks_aborted_begin() const {
176  return blocksAborted.begin();
177  }
178 
179  BlocksAborted::const_iterator blocks_aborted_end() const {
180  return blocksAborted.end();
181  }
182 
183  /// \brief Enqueue the given set of nodes onto the work list.
184  void enqueue(ExplodedNodeSet &Set);
185 
186  /// \brief Enqueue nodes that were created as a result of processing
187  /// a statement onto the work list.
188  void enqueue(ExplodedNodeSet &Set, const CFGBlock *Block, unsigned Idx);
189 
190  /// \brief enqueue the nodes corresponding to the end of function onto the
191  /// end of path / work list.
192  void enqueueEndOfFunction(ExplodedNodeSet &Set, const ReturnStmt *RS);
193 
194  /// \brief Enqueue a single node created as a result of statement processing.
195  void enqueueStmtNode(ExplodedNode *N, const CFGBlock *Block, unsigned Idx);
196 };
197 
198 // TODO: Turn into a calss.
200  const CoreEngine &Eng;
201  const CFGBlock *Block;
203 
205  : Eng(E), Block(B), LC(N->getLocationContext()) { assert(B); }
206 
207  /// \brief Return the CFGBlock associated with this builder.
208  const CFGBlock *getBlock() const { return Block; }
209 
210  /// \brief Returns the number of times the current basic block has been
211  /// visited on the exploded graph path.
212  unsigned blockCount() const {
213  return Eng.WList->getBlockCounter().getNumVisited(
214  LC->getCurrentStackFrame(),
215  Block->getBlockID());
216  }
217 };
218 
219 /// \class NodeBuilder
220 /// \brief This is the simplest builder which generates nodes in the
221 /// ExplodedGraph.
222 ///
223 /// The main benefit of the builder is that it automatically tracks the
224 /// frontier nodes (or destination set). This is the set of nodes which should
225 /// be propagated to the next step / builder. They are the nodes which have been
226 /// added to the builder (either as the input node set or as the newly
227 /// constructed nodes) but did not have any outgoing transitions added.
228 class NodeBuilder {
229  virtual void anchor();
230 
231 protected:
233 
234  /// Specifies if the builder results have been finalized. For example, if it
235  /// is set to false, autotransitions are yet to be generated.
236  bool Finalized;
237 
238  bool HasGeneratedNodes = false;
239 
240  /// \brief The frontier set - a set of nodes which need to be propagated after
241  /// the builder dies.
243 
244  /// Checks if the results are ready.
245  virtual bool checkResults() {
246  return Finalized;
247  }
248 
250  for (const auto I : Frontier)
251  if (I->isSink())
252  return false;
253  return true;
254  }
255 
256  /// Allow subclasses to finalize results before result_begin() is executed.
257  virtual void finalizeResults() {}
258 
259  ExplodedNode *generateNodeImpl(const ProgramPoint &PP,
261  ExplodedNode *Pred,
262  bool MarkAsSink = false);
263 
264 public:
266  const NodeBuilderContext &Ctx, bool F = true)
267  : C(Ctx), Finalized(F), Frontier(DstSet) {
268  Frontier.Add(SrcNode);
269  }
270 
272  const NodeBuilderContext &Ctx, bool F = true)
273  : C(Ctx), Finalized(F), Frontier(DstSet) {
274  Frontier.insert(SrcSet);
275  assert(hasNoSinksInFrontier());
276  }
277 
278  virtual ~NodeBuilder() = default;
279 
280  /// \brief Generates a node in the ExplodedGraph.
282  ProgramStateRef State,
283  ExplodedNode *Pred) {
284  return generateNodeImpl(PP, State, Pred, false);
285  }
286 
287  /// \brief Generates a sink in the ExplodedGraph.
288  ///
289  /// When a node is marked as sink, the exploration from the node is stopped -
290  /// the node becomes the last node on the path and certain kinds of bugs are
291  /// suppressed.
293  ProgramStateRef State,
294  ExplodedNode *Pred) {
295  return generateNodeImpl(PP, State, Pred, true);
296  }
297 
299  finalizeResults();
300  assert(checkResults());
301  return Frontier;
302  }
303 
305 
306  /// \brief Iterators through the results frontier.
308  finalizeResults();
309  assert(checkResults());
310  return Frontier.begin();
311  }
312 
314  finalizeResults();
315  return Frontier.end();
316  }
317 
318  const NodeBuilderContext &getContext() { return C; }
319  bool hasGeneratedNodes() { return HasGeneratedNodes; }
320 
321  void takeNodes(const ExplodedNodeSet &S) {
322  for (const auto I : S)
323  Frontier.erase(I);
324  }
325 
326  void takeNodes(ExplodedNode *N) { Frontier.erase(N); }
327  void addNodes(const ExplodedNodeSet &S) { Frontier.insert(S); }
328  void addNodes(ExplodedNode *N) { Frontier.Add(N); }
329 };
330 
331 /// \class NodeBuilderWithSinks
332 /// \brief This node builder keeps track of the generated sink nodes.
334  void anchor() override;
335 
336 protected:
339 
340 public:
342  const NodeBuilderContext &Ctx, ProgramPoint &L)
343  : NodeBuilder(Pred, DstSet, Ctx), Location(L) {}
344 
346  ExplodedNode *Pred,
347  const ProgramPointTag *Tag = nullptr) {
348  const ProgramPoint &LocalLoc = (Tag ? Location.withTag(Tag) : Location);
349  return NodeBuilder::generateNode(LocalLoc, State, Pred);
350  }
351 
353  const ProgramPointTag *Tag = nullptr) {
354  const ProgramPoint &LocalLoc = (Tag ? Location.withTag(Tag) : Location);
355  ExplodedNode *N = NodeBuilder::generateSink(LocalLoc, State, Pred);
356  if (N && N->isSink())
357  sinksGenerated.push_back(N);
358  return N;
359  }
360 
362  return sinksGenerated;
363  }
364 };
365 
366 /// \class StmtNodeBuilder
367 /// \brief This builder class is useful for generating nodes that resulted from
368 /// visiting a statement. The main difference from its parent NodeBuilder is
369 /// that it creates a statement specific ProgramPoint.
371  NodeBuilder *EnclosingBldr;
372 
373 public:
374  /// \brief Constructs a StmtNodeBuilder. If the builder is going to process
375  /// nodes currently owned by another builder(with larger scope), use
376  /// Enclosing builder to transfer ownership.
378  const NodeBuilderContext &Ctx,
379  NodeBuilder *Enclosing = nullptr)
380  : NodeBuilder(SrcNode, DstSet, Ctx), EnclosingBldr(Enclosing) {
381  if (EnclosingBldr)
382  EnclosingBldr->takeNodes(SrcNode);
383  }
384 
386  const NodeBuilderContext &Ctx,
387  NodeBuilder *Enclosing = nullptr)
388  : NodeBuilder(SrcSet, DstSet, Ctx), EnclosingBldr(Enclosing) {
389  if (EnclosingBldr)
390  for (const auto I : SrcSet)
391  EnclosingBldr->takeNodes(I);
392  }
393 
394  ~StmtNodeBuilder() override;
395 
398 
400  ExplodedNode *Pred,
401  ProgramStateRef St,
402  const ProgramPointTag *tag = nullptr,
405  Pred->getLocationContext(), tag);
406  return NodeBuilder::generateNode(L, St, Pred);
407  }
408 
410  ExplodedNode *Pred,
411  ProgramStateRef St,
412  const ProgramPointTag *tag = nullptr,
415  Pred->getLocationContext(), tag);
416  return NodeBuilder::generateSink(L, St, Pred);
417  }
418 };
419 
420 /// \brief BranchNodeBuilder is responsible for constructing the nodes
421 /// corresponding to the two branches of the if statement - true and false.
423  const CFGBlock *DstT;
424  const CFGBlock *DstF;
425 
426  bool InFeasibleTrue;
427  bool InFeasibleFalse;
428 
429  void anchor() override;
430 
431 public:
433  const NodeBuilderContext &C,
434  const CFGBlock *dstT, const CFGBlock *dstF)
435  : NodeBuilder(SrcNode, DstSet, C), DstT(dstT), DstF(dstF),
436  InFeasibleTrue(!DstT), InFeasibleFalse(!DstF) {
437  // The branch node builder does not generate autotransitions.
438  // If there are no successors it means that both branches are infeasible.
439  takeNodes(SrcNode);
440  }
441 
443  const NodeBuilderContext &C,
444  const CFGBlock *dstT, const CFGBlock *dstF)
445  : NodeBuilder(SrcSet, DstSet, C), DstT(dstT), DstF(dstF),
446  InFeasibleTrue(!DstT), InFeasibleFalse(!DstF) {
447  takeNodes(SrcSet);
448  }
449 
450  ExplodedNode *generateNode(ProgramStateRef State, bool branch,
451  ExplodedNode *Pred);
452 
453  const CFGBlock *getTargetBlock(bool branch) const {
454  return branch ? DstT : DstF;
455  }
456 
457  void markInfeasible(bool branch) {
458  if (branch)
459  InFeasibleTrue = true;
460  else
461  InFeasibleFalse = true;
462  }
463 
464  bool isFeasible(bool branch) {
465  return branch ? !InFeasibleTrue : !InFeasibleFalse;
466  }
467 };
468 
470  CoreEngine& Eng;
471  const CFGBlock *Src;
472  const CFGBlock &DispatchBlock;
473  const Expr *E;
474  ExplodedNode *Pred;
475 
476 public:
478  const Expr *e, const CFGBlock *dispatch, CoreEngine* eng)
479  : Eng(*eng), Src(src), DispatchBlock(*dispatch), E(e), Pred(pred) {}
480 
481  class iterator {
483 
485 
487 
488  public:
489  iterator &operator++() { ++I; return *this; }
490  bool operator!=(const iterator &X) const { return I != X.I; }
491 
492  const LabelDecl *getLabel() const {
493  return cast<LabelStmt>((*I)->getLabel())->getDecl();
494  }
495 
496  const CFGBlock *getBlock() const {
497  return *I;
498  }
499  };
500 
501  iterator begin() { return iterator(DispatchBlock.succ_begin()); }
502  iterator end() { return iterator(DispatchBlock.succ_end()); }
503 
504  ExplodedNode *generateNode(const iterator &I,
506  bool isSink = false);
507 
508  const Expr *getTarget() const { return E; }
509 
510  ProgramStateRef getState() const { return Pred->State; }
511 
513  return Pred->getLocationContext();
514  }
515 };
516 
518  CoreEngine& Eng;
519  const CFGBlock *Src;
520  const Expr *Condition;
521  ExplodedNode *Pred;
522 
523 public:
525  const Expr *condition, CoreEngine* eng)
526  : Eng(*eng), Src(src), Condition(condition), Pred(pred) {}
527 
528  class iterator {
529  friend class SwitchNodeBuilder;
530 
532 
534 
535  public:
536  iterator &operator++() { ++I; return *this; }
537  bool operator!=(const iterator &X) const { return I != X.I; }
538  bool operator==(const iterator &X) const { return I == X.I; }
539 
540  const CaseStmt *getCase() const {
541  return cast<CaseStmt>((*I)->getLabel());
542  }
543 
544  const CFGBlock *getBlock() const {
545  return *I;
546  }
547  };
548 
549  iterator begin() { return iterator(Src->succ_rbegin()+1); }
550  iterator end() { return iterator(Src->succ_rend()); }
551 
552  const SwitchStmt *getSwitch() const {
553  return cast<SwitchStmt>(Src->getTerminator());
554  }
555 
556  ExplodedNode *generateCaseStmtNode(const iterator &I,
558 
559  ExplodedNode *generateDefaultCaseNode(ProgramStateRef State,
560  bool isSink = false);
561 
562  const Expr *getCondition() const { return Condition; }
563 
564  ProgramStateRef getState() const { return Pred->State; }
565 
567  return Pred->getLocationContext();
568  }
569 };
570 
571 } // namespace ento
572 
573 } // namespace clang
574 
575 #endif // LLVM_CLANG_STATICANALYZER_CORE_PATHSENSITIVE_COREENGINE_H
bool operator!=(const iterator &X) const
Definition: CoreEngine.h:537
succ_reverse_iterator succ_rbegin()
Definition: CFG.h:755
void markInfeasible(bool branch)
Definition: CoreEngine.h:457
succ_iterator succ_begin()
Definition: CFG.h:750
unsigned blockCount() const
Returns the number of times the current basic block has been visited on the exploded graph path...
Definition: CoreEngine.h:212
bool ExecuteWorkList(const LocationContext *L, unsigned Steps, ProgramStateRef InitState)
ExecuteWorkList - Run the worklist algorithm for a maximum number of steps.
Definition: CoreEngine.cpp:79
Stmt - This represents one statement.
Definition: Stmt.h:66
ExplodedNodeSet::iterator iterator
Definition: CoreEngine.h:304
This builder class is useful for generating nodes that resulted from visiting a statement.
Definition: CoreEngine.h:370
bool wasBlockAborted() const
Definition: CoreEngine.h:153
unsigned getBlockID() const
Definition: CFG.h:855
Represents a point when we begin processing an inlined call.
Definition: ProgramPoint.h:600
ProgramPoint withTag(const ProgramPointTag *tag) const
Create a new ProgramPoint object that is the same as the original except for using the specified tag ...
Definition: ProgramPoint.h:133
IndirectGotoNodeBuilder(ExplodedNode *pred, const CFGBlock *src, const Expr *e, const CFGBlock *dispatch, CoreEngine *eng)
Definition: CoreEngine.h:477
const CaseStmt * getCase() const
Definition: CoreEngine.h:540
NodeBuilderWithSinks(ExplodedNode *Pred, ExplodedNodeSet &DstSet, const NodeBuilderContext &Ctx, ProgramPoint &L)
Definition: CoreEngine.h:341
BranchNodeBuilder(ExplodedNode *SrcNode, ExplodedNodeSet &DstSet, const NodeBuilderContext &C, const CFGBlock *dstT, const CFGBlock *dstF)
Definition: CoreEngine.h:432
void takeNodes(const ExplodedNodeSet &S)
Definition: CoreEngine.h:321
virtual void finalizeResults()
Allow subclasses to finalize results before result_begin() is executed.
Definition: CoreEngine.h:257
BlocksAborted::const_iterator blocks_aborted_begin() const
Definition: CoreEngine.h:175
void enqueue(ExplodedNodeSet &Set)
Enqueue the given set of nodes onto the work list.
Definition: CoreEngine.cpp:520
bool ExecuteWorkListWithInitialState(const LocationContext *L, unsigned Steps, ProgramStateRef InitState, ExplodedNodeSet &Dst)
Returns true if there is still simulation state on the worklist.
Definition: CoreEngine.cpp:196
static ProgramPoint getProgramPoint(const Stmt *S, ProgramPoint::Kind K, const LocationContext *LC, const ProgramPointTag *tag)
BlocksExhausted::const_iterator blocks_exhausted_end() const
Definition: CoreEngine.h:171
const CFGBlock * getTargetBlock(bool branch) const
Definition: CoreEngine.h:453
bool hasWorkRemaining() const
Definition: CoreEngine.h:155
bool operator==(const iterator &X) const
Definition: CoreEngine.h:538
bool Finalized
Specifies if the builder results have been finalized.
Definition: CoreEngine.h:236
LineState State
CoreEngine(SubEngine &subengine, FunctionSummariesTy *FS, AnalyzerOptions &Opts)
Construct a CoreEngine object to analyze the provided CFG.
Definition: CoreEngine.cpp:73
BlocksExhausted::const_iterator blocks_exhausted_begin() const
Definition: CoreEngine.h:167
friend class CommonNodeBuilder
Definition: CoreEngine.h:56
AdjacentBlocks::const_iterator const_succ_iterator
Definition: CFG.h:726
ExplodedNode * generateSink(const Stmt *S, ExplodedNode *Pred, ProgramStateRef St, const ProgramPointTag *tag=nullptr, ProgramPoint::Kind K=ProgramPoint::PostStmtKind)
Definition: CoreEngine.h:409
WorkList * getWorkList() const
Definition: CoreEngine.h:165
void addNodes(ExplodedNode *N)
Definition: CoreEngine.h:328
Forward-declares and imports various common LLVM datatypes that clang wants to use unqualified...
const StackFrameContext * getCurrentStackFrame() const
const LocationContext * getLocationContext() const
const CFGBlock * getBlock() const
Definition: CoreEngine.h:544
ExplodedNodeSet & Frontier
The frontier set - a set of nodes which need to be propagated after the builder dies.
Definition: CoreEngine.h:242
const SmallVectorImpl< ExplodedNode * > & getSinks() const
Definition: CoreEngine.h:361
Represents binding an expression to a temporary.
Definition: ExprCXX.h:1196
StmtNodeBuilder(ExplodedNodeSet &SrcSet, ExplodedNodeSet &DstSet, const NodeBuilderContext &Ctx, NodeBuilder *Enclosing=nullptr)
Definition: CoreEngine.h:385
CFGBlock - Represents a single basic block in a source-level CFG.
Definition: CFG.h:548
ExplodedNode * generateSink(const ProgramPoint &PP, ProgramStateRef State, ExplodedNode *Pred)
Generates a sink in the ExplodedGraph.
Definition: CoreEngine.h:292
Expr - This represents one expression.
Definition: Expr.h:106
ExplodedGraph & getGraph()
getGraph - Returns the exploded graph.
Definition: CoreEngine.h:134
const Expr * getCondition() const
Definition: CoreEngine.h:562
std::vector< std::pair< const CFGBlock *, const ExplodedNode * > > BlocksAborted
Definition: CoreEngine.h:69
This is the simplest builder which generates nodes in the ExplodedGraph.
Definition: CoreEngine.h:228
void Add(ExplodedNode *N)
const ExplodedNodeSet & getResults()
Definition: CoreEngine.h:298
const LocationContext * getLocationContext() const
Definition: CoreEngine.h:566
SmallVector< ExplodedNode *, 2 > sinksGenerated
Definition: CoreEngine.h:337
void enqueueStmtNode(ExplodedNode *N, const CFGBlock *Block, unsigned Idx)
Enqueue a single node created as a result of statement processing.
Definition: CoreEngine.cpp:456
ReturnStmt - This represents a return, optionally of an expression: return; return 4;...
Definition: Stmt.h:1433
const SwitchStmt * getSwitch() const
Definition: CoreEngine.h:552
virtual bool checkResults()
Checks if the results are ready.
Definition: CoreEngine.h:245
BlocksAborted::const_iterator blocks_aborted_end() const
Definition: CoreEngine.h:179
CFGTerminator getTerminator()
Definition: CFG.h:839
const LocationContext * getLocationContext() const
Definition: CoreEngine.h:512
ProgramPoints can be "tagged" as representing points specific to a given analysis entity...
Definition: ProgramPoint.h:40
bool wasBlocksExhausted() const
Definition: CoreEngine.h:154
DeclStmt - Adaptor class for mixing declarations with statements and expressions. ...
Definition: Stmt.h:499
Represents the declaration of a label.
Definition: Decl.h:468
ExplodedNode * generateNode(ProgramStateRef State, ExplodedNode *Pred, const ProgramPointTag *Tag=nullptr)
Definition: CoreEngine.h:345
void dispatchWorkItem(ExplodedNode *Pred, ProgramPoint Loc, const WorkListUnit &WU)
Dispatch the work list item based on the given location information.
Definition: CoreEngine.cpp:153
succ_reverse_iterator succ_rend()
Definition: CFG.h:756
succ_iterator succ_end()
Definition: CFG.h:751
bool operator!=(const iterator &X) const
Definition: CoreEngine.h:490
void insert(const ExplodedNodeSet &S)
std::vector< std::pair< BlockEdge, const ExplodedNode * > > BlocksExhausted
Definition: CoreEngine.h:66
CoreEngine - Implements the core logic of the graph-reachability analysis.
Definition: CoreEngine.h:55
Dataflow Directional Tag Classes.
void takeNodes(ExplodedNode *N)
Definition: CoreEngine.h:326
void addNodes(const ExplodedNodeSet &S)
Definition: CoreEngine.h:327
const NodeBuilderContext & getContext()
Definition: CoreEngine.h:318
BranchNodeBuilder(const ExplodedNodeSet &SrcSet, ExplodedNodeSet &DstSet, const NodeBuilderContext &C, const CFGBlock *dstT, const CFGBlock *dstF)
Definition: CoreEngine.h:442
This node builder keeps track of the generated sink nodes.
Definition: CoreEngine.h:333
BranchNodeBuilder is responsible for constructing the nodes corresponding to the two branches of the ...
Definition: CoreEngine.h:422
ProgramStateRef getState() const
Definition: CoreEngine.h:564
NodeBuilderContext(const CoreEngine &E, const CFGBlock *B, ExplodedNode *N)
Definition: CoreEngine.h:204
SwitchStmt - This represents a &#39;switch&#39; stmt.
Definition: Stmt.h:1027
friend class EndOfFunctionNodeBuilder
Definition: CoreEngine.h:57
ExplodedNode * generateSink(ProgramStateRef State, ExplodedNode *Pred, const ProgramPointTag *Tag=nullptr)
Definition: CoreEngine.h:352
AdjacentBlocks::const_reverse_iterator const_succ_reverse_iterator
Definition: CFG.h:728
void addAbortedBlock(const ExplodedNode *node, const CFGBlock *block)
Inform the CoreEngine that a basic block was aborted because it could not be completely analyzed...
Definition: CoreEngine.h:161
bool erase(ExplodedNode *N)
const NodeBuilderContext & C
Definition: CoreEngine.h:232
void enqueueEndOfFunction(ExplodedNodeSet &Set, const ReturnStmt *RS)
enqueue the nodes corresponding to the end of function onto the end of path / work list...
Definition: CoreEngine.cpp:531
X
Add a minimal nested name specifier fixit hint to allow lookup of a tag name from an outer enclosing ...
Definition: SemaDecl.cpp:13483
ExplodedNode * generateNode(const ProgramPoint &PP, ProgramStateRef State, ExplodedNode *Pred)
Generates a node in the ExplodedGraph.
Definition: CoreEngine.h:281
SwitchNodeBuilder(ExplodedNode *pred, const CFGBlock *src, const Expr *condition, CoreEngine *eng)
Definition: CoreEngine.h:524
StmtNodeBuilder(ExplodedNode *SrcNode, ExplodedNodeSet &DstSet, const NodeBuilderContext &Ctx, NodeBuilder *Enclosing=nullptr)
Constructs a StmtNodeBuilder.
Definition: CoreEngine.h:377
ProgramStateRef getState() const
Definition: CoreEngine.h:510
CoreEngine & operator=(const CoreEngine &)=delete
NodeBuilder(ExplodedNode *SrcNode, ExplodedNodeSet &DstSet, const NodeBuilderContext &Ctx, bool F=true)
Definition: CoreEngine.h:265
ExplodedNode * generateNode(const Stmt *S, ExplodedNode *Pred, ProgramStateRef St, const ProgramPointTag *tag=nullptr, ProgramPoint::Kind K=ProgramPoint::PostStmtKind)
Definition: CoreEngine.h:399
iterator begin()
Iterators through the results frontier.
Definition: CoreEngine.h:307
NodeBuilder(const ExplodedNodeSet &SrcSet, ExplodedNodeSet &DstSet, const NodeBuilderContext &Ctx, bool F=true)
Definition: CoreEngine.h:271
bool isFeasible(bool branch)
Definition: CoreEngine.h:464
const Expr * getTarget() const
Definition: CoreEngine.h:508
const CFGBlock * getBlock() const
Return the CFGBlock associated with this builder.
Definition: CoreEngine.h:208
const LocationContext * LC
Definition: CoreEngine.h:202