clang  7.0.0svn
CoreEngine.h
Go to the documentation of this file.
1 //==- CoreEngine.h - Path-Sensitive Dataflow Engine ----------------*- C++ -*-//
2 //
3 // The LLVM Compiler Infrastructure
4 //
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
7 //
8 //===----------------------------------------------------------------------===//
9 //
10 // This file defines a generic engine for intraprocedural, path-sensitive,
11 // dataflow analysis via graph reachability.
12 //
13 //===----------------------------------------------------------------------===//
14 
15 #ifndef LLVM_CLANG_STATICANALYZER_CORE_PATHSENSITIVE_COREENGINE_H
16 #define LLVM_CLANG_STATICANALYZER_CORE_PATHSENSITIVE_COREENGINE_H
17 
18 #include "clang/AST/Expr.h"
25 #include <memory>
26 
27 namespace clang {
28 
29 class ProgramPointTag;
30 
31 namespace ento {
32 
33 class NodeBuilder;
34 
35 //===----------------------------------------------------------------------===//
36 /// CoreEngine - Implements the core logic of the graph-reachability
37 /// analysis. It traverses the CFG and generates the ExplodedGraph.
38 /// Program "states" are treated as opaque void pointers.
39 /// The template class CoreEngine (which subclasses CoreEngine)
40 /// provides the matching component to the engine that knows the actual types
41 /// for states. Note that this engine only dispatches to transfer functions
42 /// at the statement and block-level. The analyses themselves must implement
43 /// any transfer function logic and the sub-expression level (if any).
44 class CoreEngine {
45  friend struct NodeBuilderContext;
46  friend class NodeBuilder;
47  friend class ExprEngine;
48  friend class CommonNodeBuilder;
50  friend class SwitchNodeBuilder;
52 public:
53  typedef std::vector<std::pair<BlockEdge, const ExplodedNode*> >
55 
56  typedef std::vector<std::pair<const CFGBlock*, const ExplodedNode*> >
58 
59 private:
60 
61  SubEngine& SubEng;
62 
63  /// G - The simulation graph. Each node is a (location,state) pair.
64  mutable ExplodedGraph G;
65 
66  /// WList - A set of queued nodes that need to be processed by the
67  /// worklist algorithm. It is up to the implementation of WList to decide
68  /// the order that nodes are processed.
69  std::unique_ptr<WorkList> WList;
70 
71  /// BCounterFactory - A factory object for created BlockCounter objects.
72  /// These are used to record for key nodes in the ExplodedGraph the
73  /// number of times different CFGBlocks have been visited along a path.
74  BlockCounter::Factory BCounterFactory;
75 
76  /// The locations where we stopped doing work because we visited a location
77  /// too many times.
78  BlocksExhausted blocksExhausted;
79 
80  /// The locations where we stopped because the engine aborted analysis,
81  /// usually because it could not reason about something.
82  BlocksAborted blocksAborted;
83 
84  /// The information about functions shared by the whole translation unit.
85  /// (This data is owned by AnalysisConsumer.)
86  FunctionSummariesTy *FunctionSummaries;
87 
88  void generateNode(const ProgramPoint &Loc,
90  ExplodedNode *Pred);
91 
92  void HandleBlockEdge(const BlockEdge &E, ExplodedNode *Pred);
93  void HandleBlockEntrance(const BlockEntrance &E, ExplodedNode *Pred);
94  void HandleBlockExit(const CFGBlock *B, ExplodedNode *Pred);
95 
96  void HandleCallEnter(const CallEnter &CE, ExplodedNode *Pred);
97 
98  void HandlePostStmt(const CFGBlock *B, unsigned StmtIdx, ExplodedNode *Pred);
99 
100  void HandleBranch(const Stmt *Cond, const Stmt *Term, const CFGBlock *B,
101  ExplodedNode *Pred);
102  void HandleCleanupTemporaryBranch(const CXXBindTemporaryExpr *BTE,
103  const CFGBlock *B, ExplodedNode *Pred);
104 
105  /// Handle conditional logic for running static initializers.
106  void HandleStaticInit(const DeclStmt *DS, const CFGBlock *B,
107  ExplodedNode *Pred);
108 
109 private:
110  CoreEngine(const CoreEngine &) = delete;
111  void operator=(const CoreEngine &) = delete;
112 
113  ExplodedNode *generateCallExitBeginNode(ExplodedNode *N,
114  const ReturnStmt *RS);
115 
116 public:
117  /// Construct a CoreEngine object to analyze the provided CFG.
118  CoreEngine(SubEngine &subengine,
120  AnalyzerOptions &Opts);
121 
122  /// getGraph - Returns the exploded graph.
123  ExplodedGraph &getGraph() { return G; }
124 
125  /// ExecuteWorkList - Run the worklist algorithm for a maximum number of
126  /// steps. Returns true if there is still simulation state on the worklist.
127  bool ExecuteWorkList(const LocationContext *L, unsigned Steps,
128  ProgramStateRef InitState);
129  /// Returns true if there is still simulation state on the worklist.
131  unsigned Steps,
132  ProgramStateRef InitState,
133  ExplodedNodeSet &Dst);
134 
135  /// Dispatch the work list item based on the given location information.
136  /// Use Pred parameter as the predecessor state.
138  const WorkListUnit& WU);
139 
140  // Functions for external checking of whether we have unfinished work
141  bool wasBlockAborted() const { return !blocksAborted.empty(); }
142  bool wasBlocksExhausted() const { return !blocksExhausted.empty(); }
143  bool hasWorkRemaining() const { return wasBlocksExhausted() ||
144  WList->hasWork() ||
145  wasBlockAborted(); }
146 
147  /// Inform the CoreEngine that a basic block was aborted because
148  /// it could not be completely analyzed.
149  void addAbortedBlock(const ExplodedNode *node, const CFGBlock *block) {
150  blocksAborted.push_back(std::make_pair(block, node));
151  }
152 
153  WorkList *getWorkList() const { return WList.get(); }
154 
155  BlocksExhausted::const_iterator blocks_exhausted_begin() const {
156  return blocksExhausted.begin();
157  }
158  BlocksExhausted::const_iterator blocks_exhausted_end() const {
159  return blocksExhausted.end();
160  }
161  BlocksAborted::const_iterator blocks_aborted_begin() const {
162  return blocksAborted.begin();
163  }
164  BlocksAborted::const_iterator blocks_aborted_end() const {
165  return blocksAborted.end();
166  }
167 
168  /// \brief Enqueue the given set of nodes onto the work list.
169  void enqueue(ExplodedNodeSet &Set);
170 
171  /// \brief Enqueue nodes that were created as a result of processing
172  /// a statement onto the work list.
173  void enqueue(ExplodedNodeSet &Set, const CFGBlock *Block, unsigned Idx);
174 
175  /// \brief enqueue the nodes corresponding to the end of function onto the
176  /// end of path / work list.
177  void enqueueEndOfFunction(ExplodedNodeSet &Set, const ReturnStmt *RS);
178 
179  /// \brief Enqueue a single node created as a result of statement processing.
180  void enqueueStmtNode(ExplodedNode *N, const CFGBlock *Block, unsigned Idx);
181 };
182 
183 // TODO: Turn into a calss.
185  const CoreEngine &Eng;
186  const CFGBlock *Block;
189  : Eng(E), Block(B), LC(N->getLocationContext()) { assert(B); }
190 
191  /// \brief Return the CFGBlock associated with this builder.
192  const CFGBlock *getBlock() const { return Block; }
193 
194  /// \brief Returns the number of times the current basic block has been
195  /// visited on the exploded graph path.
196  unsigned blockCount() const {
197  return Eng.WList->getBlockCounter().getNumVisited(
198  LC->getCurrentStackFrame(),
199  Block->getBlockID());
200  }
201 };
202 
203 /// \class NodeBuilder
204 /// \brief This is the simplest builder which generates nodes in the
205 /// ExplodedGraph.
206 ///
207 /// The main benefit of the builder is that it automatically tracks the
208 /// frontier nodes (or destination set). This is the set of nodes which should
209 /// be propagated to the next step / builder. They are the nodes which have been
210 /// added to the builder (either as the input node set or as the newly
211 /// constructed nodes) but did not have any outgoing transitions added.
212 class NodeBuilder {
213  virtual void anchor();
214 protected:
216 
217  /// Specifies if the builder results have been finalized. For example, if it
218  /// is set to false, autotransitions are yet to be generated.
219  bool Finalized;
221  /// \brief The frontier set - a set of nodes which need to be propagated after
222  /// the builder dies.
224 
225  /// Checkes if the results are ready.
226  virtual bool checkResults() {
227  if (!Finalized)
228  return false;
229  return true;
230  }
231 
233  for (iterator I = Frontier.begin(), E = Frontier.end(); I != E; ++I) {
234  if ((*I)->isSink())
235  return false;
236  }
237  return true;
238  }
239 
240  /// Allow subclasses to finalize results before result_begin() is executed.
241  virtual void finalizeResults() {}
242 
243  ExplodedNode *generateNodeImpl(const ProgramPoint &PP,
245  ExplodedNode *Pred,
246  bool MarkAsSink = false);
247 
248 public:
250  const NodeBuilderContext &Ctx, bool F = true)
251  : C(Ctx), Finalized(F), HasGeneratedNodes(false), Frontier(DstSet) {
252  Frontier.Add(SrcNode);
253  }
254 
256  const NodeBuilderContext &Ctx, bool F = true)
257  : C(Ctx), Finalized(F), HasGeneratedNodes(false), Frontier(DstSet) {
258  Frontier.insert(SrcSet);
259  assert(hasNoSinksInFrontier());
260  }
261 
262  virtual ~NodeBuilder() {}
263 
264  /// \brief Generates a node in the ExplodedGraph.
266  ProgramStateRef State,
267  ExplodedNode *Pred) {
268  return generateNodeImpl(PP, State, Pred, false);
269  }
270 
271  /// \brief Generates a sink in the ExplodedGraph.
272  ///
273  /// When a node is marked as sink, the exploration from the node is stopped -
274  /// the node becomes the last node on the path and certain kinds of bugs are
275  /// suppressed.
277  ProgramStateRef State,
278  ExplodedNode *Pred) {
279  return generateNodeImpl(PP, State, Pred, true);
280  }
281 
283  finalizeResults();
284  assert(checkResults());
285  return Frontier;
286  }
287 
289  /// \brief Iterators through the results frontier.
290  inline iterator begin() {
291  finalizeResults();
292  assert(checkResults());
293  return Frontier.begin();
294  }
295  inline iterator end() {
296  finalizeResults();
297  return Frontier.end();
298  }
299 
300  const NodeBuilderContext &getContext() { return C; }
301  bool hasGeneratedNodes() { return HasGeneratedNodes; }
302 
303  void takeNodes(const ExplodedNodeSet &S) {
304  for (ExplodedNodeSet::iterator I = S.begin(), E = S.end(); I != E; ++I )
305  Frontier.erase(*I);
306  }
307  void takeNodes(ExplodedNode *N) { Frontier.erase(N); }
308  void addNodes(const ExplodedNodeSet &S) { Frontier.insert(S); }
309  void addNodes(ExplodedNode *N) { Frontier.Add(N); }
310 };
311 
312 /// \class NodeBuilderWithSinks
313 /// \brief This node builder keeps track of the generated sink nodes.
315  void anchor() override;
316 protected:
319 
320 public:
322  const NodeBuilderContext &Ctx, ProgramPoint &L)
323  : NodeBuilder(Pred, DstSet, Ctx), Location(L) {}
324 
326  ExplodedNode *Pred,
327  const ProgramPointTag *Tag = nullptr) {
328  const ProgramPoint &LocalLoc = (Tag ? Location.withTag(Tag) : Location);
329  return NodeBuilder::generateNode(LocalLoc, State, Pred);
330  }
331 
333  const ProgramPointTag *Tag = nullptr) {
334  const ProgramPoint &LocalLoc = (Tag ? Location.withTag(Tag) : Location);
335  ExplodedNode *N = NodeBuilder::generateSink(LocalLoc, State, Pred);
336  if (N && N->isSink())
337  sinksGenerated.push_back(N);
338  return N;
339  }
340 
342  return sinksGenerated;
343  }
344 };
345 
346 /// \class StmtNodeBuilder
347 /// \brief This builder class is useful for generating nodes that resulted from
348 /// visiting a statement. The main difference from its parent NodeBuilder is
349 /// that it creates a statement specific ProgramPoint.
351  NodeBuilder *EnclosingBldr;
352 public:
353 
354  /// \brief Constructs a StmtNodeBuilder. If the builder is going to process
355  /// nodes currently owned by another builder(with larger scope), use
356  /// Enclosing builder to transfer ownership.
358  const NodeBuilderContext &Ctx,
359  NodeBuilder *Enclosing = nullptr)
360  : NodeBuilder(SrcNode, DstSet, Ctx), EnclosingBldr(Enclosing) {
361  if (EnclosingBldr)
362  EnclosingBldr->takeNodes(SrcNode);
363  }
364 
366  const NodeBuilderContext &Ctx,
367  NodeBuilder *Enclosing = nullptr)
368  : NodeBuilder(SrcSet, DstSet, Ctx), EnclosingBldr(Enclosing) {
369  if (EnclosingBldr)
370  for (ExplodedNodeSet::iterator I = SrcSet.begin(),
371  E = SrcSet.end(); I != E; ++I )
372  EnclosingBldr->takeNodes(*I);
373  }
374 
375  ~StmtNodeBuilder() override;
376 
379 
381  ExplodedNode *Pred,
382  ProgramStateRef St,
383  const ProgramPointTag *tag = nullptr,
386  Pred->getLocationContext(), tag);
387  return NodeBuilder::generateNode(L, St, Pred);
388  }
389 
391  ExplodedNode *Pred,
392  ProgramStateRef St,
393  const ProgramPointTag *tag = nullptr,
396  Pred->getLocationContext(), tag);
397  return NodeBuilder::generateSink(L, St, Pred);
398  }
399 };
400 
401 /// \brief BranchNodeBuilder is responsible for constructing the nodes
402 /// corresponding to the two branches of the if statement - true and false.
404  void anchor() override;
405  const CFGBlock *DstT;
406  const CFGBlock *DstF;
407 
408  bool InFeasibleTrue;
409  bool InFeasibleFalse;
410 
411 public:
413  const NodeBuilderContext &C,
414  const CFGBlock *dstT, const CFGBlock *dstF)
415  : NodeBuilder(SrcNode, DstSet, C), DstT(dstT), DstF(dstF),
416  InFeasibleTrue(!DstT), InFeasibleFalse(!DstF) {
417  // The branch node builder does not generate autotransitions.
418  // If there are no successors it means that both branches are infeasible.
419  takeNodes(SrcNode);
420  }
421 
423  const NodeBuilderContext &C,
424  const CFGBlock *dstT, const CFGBlock *dstF)
425  : NodeBuilder(SrcSet, DstSet, C), DstT(dstT), DstF(dstF),
426  InFeasibleTrue(!DstT), InFeasibleFalse(!DstF) {
427  takeNodes(SrcSet);
428  }
429 
430  ExplodedNode *generateNode(ProgramStateRef State, bool branch,
431  ExplodedNode *Pred);
432 
433  const CFGBlock *getTargetBlock(bool branch) const {
434  return branch ? DstT : DstF;
435  }
436 
437  void markInfeasible(bool branch) {
438  if (branch)
439  InFeasibleTrue = true;
440  else
441  InFeasibleFalse = true;
442  }
443 
444  bool isFeasible(bool branch) {
445  return branch ? !InFeasibleTrue : !InFeasibleFalse;
446  }
447 };
448 
450  CoreEngine& Eng;
451  const CFGBlock *Src;
452  const CFGBlock &DispatchBlock;
453  const Expr *E;
454  ExplodedNode *Pred;
455 
456 public:
458  const Expr *e, const CFGBlock *dispatch, CoreEngine* eng)
459  : Eng(*eng), Src(src), DispatchBlock(*dispatch), E(e), Pred(pred) {}
460 
461  class iterator {
463 
466  public:
467 
468  iterator &operator++() { ++I; return *this; }
469  bool operator!=(const iterator &X) const { return I != X.I; }
470 
471  const LabelDecl *getLabel() const {
472  return cast<LabelStmt>((*I)->getLabel())->getDecl();
473  }
474 
475  const CFGBlock *getBlock() const {
476  return *I;
477  }
478  };
479 
480  iterator begin() { return iterator(DispatchBlock.succ_begin()); }
481  iterator end() { return iterator(DispatchBlock.succ_end()); }
482 
483  ExplodedNode *generateNode(const iterator &I,
485  bool isSink = false);
486 
487  const Expr *getTarget() const { return E; }
488 
489  ProgramStateRef getState() const { return Pred->State; }
490 
492  return Pred->getLocationContext();
493  }
494 };
495 
497  CoreEngine& Eng;
498  const CFGBlock *Src;
499  const Expr *Condition;
500  ExplodedNode *Pred;
501 
502 public:
504  const Expr *condition, CoreEngine* eng)
505  : Eng(*eng), Src(src), Condition(condition), Pred(pred) {}
506 
507  class iterator {
509 
510  friend class SwitchNodeBuilder;
512 
513  public:
514  iterator &operator++() { ++I; return *this; }
515  bool operator!=(const iterator &X) const { return I != X.I; }
516  bool operator==(const iterator &X) const { return I == X.I; }
517 
518  const CaseStmt *getCase() const {
519  return cast<CaseStmt>((*I)->getLabel());
520  }
521 
522  const CFGBlock *getBlock() const {
523  return *I;
524  }
525  };
526 
527  iterator begin() { return iterator(Src->succ_rbegin()+1); }
528  iterator end() { return iterator(Src->succ_rend()); }
529 
530  const SwitchStmt *getSwitch() const {
531  return cast<SwitchStmt>(Src->getTerminator());
532  }
533 
534  ExplodedNode *generateCaseStmtNode(const iterator &I,
536 
537  ExplodedNode *generateDefaultCaseNode(ProgramStateRef State,
538  bool isSink = false);
539 
540  const Expr *getCondition() const { return Condition; }
541 
542  ProgramStateRef getState() const { return Pred->State; }
543 
545  return Pred->getLocationContext();
546  }
547 };
548 
549 } // end ento namespace
550 } // end clang namespace
551 
552 #endif
bool operator!=(const iterator &X) const
Definition: CoreEngine.h:515
succ_reverse_iterator succ_rbegin()
Definition: CFG.h:769
void markInfeasible(bool branch)
Definition: CoreEngine.h:437
succ_iterator succ_begin()
Definition: CFG.h:764
unsigned blockCount() const
Returns the number of times the current basic block has been visited on the exploded graph path...
Definition: CoreEngine.h:196
bool ExecuteWorkList(const LocationContext *L, unsigned Steps, ProgramStateRef InitState)
ExecuteWorkList - Run the worklist algorithm for a maximum number of steps.
Definition: CoreEngine.cpp:222
Stmt - This represents one statement.
Definition: Stmt.h:66
This builder class is useful for generating nodes that resulted from visiting a statement.
Definition: CoreEngine.h:350
bool wasBlockAborted() const
Definition: CoreEngine.h:141
unsigned getBlockID() const
Definition: CFG.h:869
Represents a point when we begin processing an inlined call.
Definition: ProgramPoint.h:600
ProgramPoint withTag(const ProgramPointTag *tag) const
Create a new ProgramPoint object that is the same as the original except for using the specified tag ...
Definition: ProgramPoint.h:133
IndirectGotoNodeBuilder(ExplodedNode *pred, const CFGBlock *src, const Expr *e, const CFGBlock *dispatch, CoreEngine *eng)
Definition: CoreEngine.h:457
const CaseStmt * getCase() const
Definition: CoreEngine.h:518
NodeBuilderWithSinks(ExplodedNode *Pred, ExplodedNodeSet &DstSet, const NodeBuilderContext &Ctx, ProgramPoint &L)
Definition: CoreEngine.h:321
BranchNodeBuilder(ExplodedNode *SrcNode, ExplodedNodeSet &DstSet, const NodeBuilderContext &C, const CFGBlock *dstT, const CFGBlock *dstF)
Definition: CoreEngine.h:412
void takeNodes(const ExplodedNodeSet &S)
Definition: CoreEngine.h:303
virtual void finalizeResults()
Allow subclasses to finalize results before result_begin() is executed.
Definition: CoreEngine.h:241
BlocksAborted::const_iterator blocks_aborted_begin() const
Definition: CoreEngine.h:161
void enqueue(ExplodedNodeSet &Set)
Enqueue the given set of nodes onto the work list.
Definition: CoreEngine.cpp:677
bool ExecuteWorkListWithInitialState(const LocationContext *L, unsigned Steps, ProgramStateRef InitState, ExplodedNodeSet &Dst)
Returns true if there is still simulation state on the worklist.
Definition: CoreEngine.cpp:343
static ProgramPoint getProgramPoint(const Stmt *S, ProgramPoint::Kind K, const LocationContext *LC, const ProgramPointTag *tag)
BlocksExhausted::const_iterator blocks_exhausted_end() const
Definition: CoreEngine.h:158
const CFGBlock * getTargetBlock(bool branch) const
Definition: CoreEngine.h:433
bool hasWorkRemaining() const
Definition: CoreEngine.h:143
bool operator==(const iterator &X) const
Definition: CoreEngine.h:516
bool Finalized
Specifies if the builder results have been finalized.
Definition: CoreEngine.h:219
LineState State
BlocksExhausted::const_iterator blocks_exhausted_begin() const
Definition: CoreEngine.h:155
friend class CommonNodeBuilder
Definition: CoreEngine.h:48
AdjacentBlocks::const_iterator const_succ_iterator
Definition: CFG.h:740
ExplodedNodeSet::iterator iterator
Definition: CoreEngine.h:288
ExplodedNode * generateSink(const Stmt *S, ExplodedNode *Pred, ProgramStateRef St, const ProgramPointTag *tag=nullptr, ProgramPoint::Kind K=ProgramPoint::PostStmtKind)
Definition: CoreEngine.h:390
WorkList * getWorkList() const
Definition: CoreEngine.h:153
void addNodes(ExplodedNode *N)
Definition: CoreEngine.h:309
const StackFrameContext * getCurrentStackFrame() const
const LocationContext * getLocationContext() const
const CFGBlock * getBlock() const
Definition: CoreEngine.h:522
ExplodedNodeSet & Frontier
The frontier set - a set of nodes which need to be propagated after the builder dies.
Definition: CoreEngine.h:223
const SmallVectorImpl< ExplodedNode * > & getSinks() const
Definition: CoreEngine.h:341
Represents binding an expression to a temporary.
Definition: ExprCXX.h:1196
StmtNodeBuilder(ExplodedNodeSet &SrcSet, ExplodedNodeSet &DstSet, const NodeBuilderContext &Ctx, NodeBuilder *Enclosing=nullptr)
Definition: CoreEngine.h:365
CFGBlock - Represents a single basic block in a source-level CFG.
Definition: CFG.h:562
ExplodedNode * generateSink(const ProgramPoint &PP, ProgramStateRef State, ExplodedNode *Pred)
Generates a sink in the ExplodedGraph.
Definition: CoreEngine.h:276
Expr - This represents one expression.
Definition: Expr.h:106
ExplodedGraph & getGraph()
getGraph - Returns the exploded graph.
Definition: CoreEngine.h:123
const Expr * getCondition() const
Definition: CoreEngine.h:540
This is the simplest builder which generates nodes in the ExplodedGraph.
Definition: CoreEngine.h:212
void Add(ExplodedNode *N)
const ExplodedNodeSet & getResults()
Definition: CoreEngine.h:282
const LocationContext * getLocationContext() const
Definition: CoreEngine.h:544
SmallVector< ExplodedNode *, 2 > sinksGenerated
Definition: CoreEngine.h:317
void enqueueStmtNode(ExplodedNode *N, const CFGBlock *Block, unsigned Idx)
Enqueue a single node created as a result of statement processing.
Definition: CoreEngine.cpp:611
ReturnStmt - This represents a return, optionally of an expression: return; return 4;...
Definition: Stmt.h:1417
const SwitchStmt * getSwitch() const
Definition: CoreEngine.h:530
virtual bool checkResults()
Checkes if the results are ready.
Definition: CoreEngine.h:226
BlocksAborted::const_iterator blocks_aborted_end() const
Definition: CoreEngine.h:164
CFGTerminator getTerminator()
Definition: CFG.h:853
#define false
Definition: stdbool.h:33
const LocationContext * getLocationContext() const
Definition: CoreEngine.h:491
ProgramPoints can be "tagged" as representing points specific to a given analysis entity...
Definition: ProgramPoint.h:40
bool wasBlocksExhausted() const
Definition: CoreEngine.h:142
DeclStmt - Adaptor class for mixing declarations with statements and expressions. ...
Definition: Stmt.h:487
Represents the declaration of a label.
Definition: Decl.h:468
ExplodedNode * generateNode(ProgramStateRef State, ExplodedNode *Pred, const ProgramPointTag *Tag=nullptr)
Definition: CoreEngine.h:325
void dispatchWorkItem(ExplodedNode *Pred, ProgramPoint Loc, const WorkListUnit &WU)
Dispatch the work list item based on the given location information.
Definition: CoreEngine.cpp:299
succ_reverse_iterator succ_rend()
Definition: CFG.h:770
std::vector< std::pair< const CFGBlock *, const ExplodedNode * > > BlocksAborted
Definition: CoreEngine.h:57
succ_iterator succ_end()
Definition: CFG.h:765
bool operator!=(const iterator &X) const
Definition: CoreEngine.h:469
void insert(const ExplodedNodeSet &S)
CoreEngine - Implements the core logic of the graph-reachability analysis.
Definition: CoreEngine.h:44
Dataflow Directional Tag Classes.
void takeNodes(ExplodedNode *N)
Definition: CoreEngine.h:307
void addNodes(const ExplodedNodeSet &S)
Definition: CoreEngine.h:308
const NodeBuilderContext & getContext()
Definition: CoreEngine.h:300
BranchNodeBuilder(const ExplodedNodeSet &SrcSet, ExplodedNodeSet &DstSet, const NodeBuilderContext &C, const CFGBlock *dstT, const CFGBlock *dstF)
Definition: CoreEngine.h:422
This node builder keeps track of the generated sink nodes.
Definition: CoreEngine.h:314
BranchNodeBuilder is responsible for constructing the nodes corresponding to the two branches of the ...
Definition: CoreEngine.h:403
ProgramStateRef getState() const
Definition: CoreEngine.h:542
NodeBuilderContext(const CoreEngine &E, const CFGBlock *B, ExplodedNode *N)
Definition: CoreEngine.h:188
SwitchStmt - This represents a &#39;switch&#39; stmt.
Definition: Stmt.h:1011
friend class EndOfFunctionNodeBuilder
Definition: CoreEngine.h:51
ExplodedNode * generateSink(ProgramStateRef State, ExplodedNode *Pred, const ProgramPointTag *Tag=nullptr)
Definition: CoreEngine.h:332
std::vector< std::pair< BlockEdge, const ExplodedNode * > > BlocksExhausted
Definition: CoreEngine.h:54
AdjacentBlocks::const_reverse_iterator const_succ_reverse_iterator
Definition: CFG.h:742
void addAbortedBlock(const ExplodedNode *node, const CFGBlock *block)
Inform the CoreEngine that a basic block was aborted because it could not be completely analyzed...
Definition: CoreEngine.h:149
bool erase(ExplodedNode *N)
const NodeBuilderContext & C
Definition: CoreEngine.h:215
void enqueueEndOfFunction(ExplodedNodeSet &Set, const ReturnStmt *RS)
enqueue the nodes corresponding to the end of function onto the end of path / work list...
Definition: CoreEngine.cpp:692
X
Add a minimal nested name specifier fixit hint to allow lookup of a tag name from an outer enclosing ...
Definition: SemaDecl.cpp:13401
ExplodedNode * generateNode(const ProgramPoint &PP, ProgramStateRef State, ExplodedNode *Pred)
Generates a node in the ExplodedGraph.
Definition: CoreEngine.h:265
SwitchNodeBuilder(ExplodedNode *pred, const CFGBlock *src, const Expr *condition, CoreEngine *eng)
Definition: CoreEngine.h:503
StmtNodeBuilder(ExplodedNode *SrcNode, ExplodedNodeSet &DstSet, const NodeBuilderContext &Ctx, NodeBuilder *Enclosing=nullptr)
Constructs a StmtNodeBuilder.
Definition: CoreEngine.h:357
ProgramStateRef getState() const
Definition: CoreEngine.h:489
NodeBuilder(ExplodedNode *SrcNode, ExplodedNodeSet &DstSet, const NodeBuilderContext &Ctx, bool F=true)
Definition: CoreEngine.h:249
ExplodedNode * generateNode(const Stmt *S, ExplodedNode *Pred, ProgramStateRef St, const ProgramPointTag *tag=nullptr, ProgramPoint::Kind K=ProgramPoint::PostStmtKind)
Definition: CoreEngine.h:380
iterator begin()
Iterators through the results frontier.
Definition: CoreEngine.h:290
NodeBuilder(const ExplodedNodeSet &SrcSet, ExplodedNodeSet &DstSet, const NodeBuilderContext &Ctx, bool F=true)
Definition: CoreEngine.h:255
bool isFeasible(bool branch)
Definition: CoreEngine.h:444
const Expr * getTarget() const
Definition: CoreEngine.h:487
const CFGBlock * getBlock() const
Return the CFGBlock associated with this builder.
Definition: CoreEngine.h:192
const LocationContext * LC
Definition: CoreEngine.h:187