clang  6.0.0svn
CoreEngine.h
Go to the documentation of this file.
1 //==- CoreEngine.h - Path-Sensitive Dataflow Engine ----------------*- C++ -*-//
2 //
3 // The LLVM Compiler Infrastructure
4 //
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
7 //
8 //===----------------------------------------------------------------------===//
9 //
10 // This file defines a generic engine for intraprocedural, path-sensitive,
11 // dataflow analysis via graph reachability.
12 //
13 //===----------------------------------------------------------------------===//
14 
15 #ifndef LLVM_CLANG_STATICANALYZER_CORE_PATHSENSITIVE_COREENGINE_H
16 #define LLVM_CLANG_STATICANALYZER_CORE_PATHSENSITIVE_COREENGINE_H
17 
18 #include "clang/AST/Expr.h"
24 #include <memory>
25 
26 namespace clang {
27 
28 class ProgramPointTag;
29 
30 namespace ento {
31 
32 class NodeBuilder;
33 
34 //===----------------------------------------------------------------------===//
35 /// CoreEngine - Implements the core logic of the graph-reachability
36 /// analysis. It traverses the CFG and generates the ExplodedGraph.
37 /// Program "states" are treated as opaque void pointers.
38 /// The template class CoreEngine (which subclasses CoreEngine)
39 /// provides the matching component to the engine that knows the actual types
40 /// for states. Note that this engine only dispatches to transfer functions
41 /// at the statement and block-level. The analyses themselves must implement
42 /// any transfer function logic and the sub-expression level (if any).
43 class CoreEngine {
44  friend struct NodeBuilderContext;
45  friend class NodeBuilder;
46  friend class ExprEngine;
47  friend class CommonNodeBuilder;
49  friend class SwitchNodeBuilder;
51 public:
52  typedef std::vector<std::pair<BlockEdge, const ExplodedNode*> >
54 
55  typedef std::vector<std::pair<const CFGBlock*, const ExplodedNode*> >
57 
58 private:
59 
60  SubEngine& SubEng;
61 
62  /// G - The simulation graph. Each node is a (location,state) pair.
63  mutable ExplodedGraph G;
64 
65  /// WList - A set of queued nodes that need to be processed by the
66  /// worklist algorithm. It is up to the implementation of WList to decide
67  /// the order that nodes are processed.
68  std::unique_ptr<WorkList> WList;
69 
70  /// BCounterFactory - A factory object for created BlockCounter objects.
71  /// These are used to record for key nodes in the ExplodedGraph the
72  /// number of times different CFGBlocks have been visited along a path.
73  BlockCounter::Factory BCounterFactory;
74 
75  /// The locations where we stopped doing work because we visited a location
76  /// too many times.
77  BlocksExhausted blocksExhausted;
78 
79  /// The locations where we stopped because the engine aborted analysis,
80  /// usually because it could not reason about something.
81  BlocksAborted blocksAborted;
82 
83  /// The information about functions shared by the whole translation unit.
84  /// (This data is owned by AnalysisConsumer.)
85  FunctionSummariesTy *FunctionSummaries;
86 
87  void generateNode(const ProgramPoint &Loc,
89  ExplodedNode *Pred);
90 
91  void HandleBlockEdge(const BlockEdge &E, ExplodedNode *Pred);
92  void HandleBlockEntrance(const BlockEntrance &E, ExplodedNode *Pred);
93  void HandleBlockExit(const CFGBlock *B, ExplodedNode *Pred);
94 
95  void HandleCallEnter(const CallEnter &CE, ExplodedNode *Pred);
96 
97  void HandlePostStmt(const CFGBlock *B, unsigned StmtIdx, ExplodedNode *Pred);
98 
99  void HandleBranch(const Stmt *Cond, const Stmt *Term, const CFGBlock *B,
100  ExplodedNode *Pred);
101  void HandleCleanupTemporaryBranch(const CXXBindTemporaryExpr *BTE,
102  const CFGBlock *B, ExplodedNode *Pred);
103 
104  /// Handle conditional logic for running static initializers.
105  void HandleStaticInit(const DeclStmt *DS, const CFGBlock *B,
106  ExplodedNode *Pred);
107 
108 private:
109  CoreEngine(const CoreEngine &) = delete;
110  void operator=(const CoreEngine &) = delete;
111 
112  ExplodedNode *generateCallExitBeginNode(ExplodedNode *N,
113  const ReturnStmt *RS);
114 
115 public:
116  /// Construct a CoreEngine object to analyze the provided CFG.
118  : SubEng(subengine), WList(WorkList::makeDFS()),
119  BCounterFactory(G.getAllocator()), FunctionSummaries(FS) {}
120 
121  /// getGraph - Returns the exploded graph.
122  ExplodedGraph &getGraph() { return G; }
123 
124  /// ExecuteWorkList - Run the worklist algorithm for a maximum number of
125  /// steps. Returns true if there is still simulation state on the worklist.
126  bool ExecuteWorkList(const LocationContext *L, unsigned Steps,
127  ProgramStateRef InitState);
128  /// Returns true if there is still simulation state on the worklist.
130  unsigned Steps,
131  ProgramStateRef InitState,
132  ExplodedNodeSet &Dst);
133 
134  /// Dispatch the work list item based on the given location information.
135  /// Use Pred parameter as the predecessor state.
137  const WorkListUnit& WU);
138 
139  // Functions for external checking of whether we have unfinished work
140  bool wasBlockAborted() const { return !blocksAborted.empty(); }
141  bool wasBlocksExhausted() const { return !blocksExhausted.empty(); }
142  bool hasWorkRemaining() const { return wasBlocksExhausted() ||
143  WList->hasWork() ||
144  wasBlockAborted(); }
145 
146  /// Inform the CoreEngine that a basic block was aborted because
147  /// it could not be completely analyzed.
148  void addAbortedBlock(const ExplodedNode *node, const CFGBlock *block) {
149  blocksAborted.push_back(std::make_pair(block, node));
150  }
151 
152  WorkList *getWorkList() const { return WList.get(); }
153 
154  BlocksExhausted::const_iterator blocks_exhausted_begin() const {
155  return blocksExhausted.begin();
156  }
157  BlocksExhausted::const_iterator blocks_exhausted_end() const {
158  return blocksExhausted.end();
159  }
160  BlocksAborted::const_iterator blocks_aborted_begin() const {
161  return blocksAborted.begin();
162  }
163  BlocksAborted::const_iterator blocks_aborted_end() const {
164  return blocksAborted.end();
165  }
166 
167  /// \brief Enqueue the given set of nodes onto the work list.
168  void enqueue(ExplodedNodeSet &Set);
169 
170  /// \brief Enqueue nodes that were created as a result of processing
171  /// a statement onto the work list.
172  void enqueue(ExplodedNodeSet &Set, const CFGBlock *Block, unsigned Idx);
173 
174  /// \brief enqueue the nodes corresponding to the end of function onto the
175  /// end of path / work list.
176  void enqueueEndOfFunction(ExplodedNodeSet &Set, const ReturnStmt *RS);
177 
178  /// \brief Enqueue a single node created as a result of statement processing.
179  void enqueueStmtNode(ExplodedNode *N, const CFGBlock *Block, unsigned Idx);
180 };
181 
182 // TODO: Turn into a calss.
184  const CoreEngine &Eng;
185  const CFGBlock *Block;
188  : Eng(E), Block(B), LC(N->getLocationContext()) { assert(B); }
189 
190  /// \brief Return the CFGBlock associated with this builder.
191  const CFGBlock *getBlock() const { return Block; }
192 
193  /// \brief Returns the number of times the current basic block has been
194  /// visited on the exploded graph path.
195  unsigned blockCount() const {
196  return Eng.WList->getBlockCounter().getNumVisited(
197  LC->getCurrentStackFrame(),
198  Block->getBlockID());
199  }
200 };
201 
202 /// \class NodeBuilder
203 /// \brief This is the simplest builder which generates nodes in the
204 /// ExplodedGraph.
205 ///
206 /// The main benefit of the builder is that it automatically tracks the
207 /// frontier nodes (or destination set). This is the set of nodes which should
208 /// be propagated to the next step / builder. They are the nodes which have been
209 /// added to the builder (either as the input node set or as the newly
210 /// constructed nodes) but did not have any outgoing transitions added.
211 class NodeBuilder {
212  virtual void anchor();
213 protected:
215 
216  /// Specifies if the builder results have been finalized. For example, if it
217  /// is set to false, autotransitions are yet to be generated.
218  bool Finalized;
220  /// \brief The frontier set - a set of nodes which need to be propagated after
221  /// the builder dies.
223 
224  /// Checkes if the results are ready.
225  virtual bool checkResults() {
226  if (!Finalized)
227  return false;
228  return true;
229  }
230 
232  for (iterator I = Frontier.begin(), E = Frontier.end(); I != E; ++I) {
233  if ((*I)->isSink())
234  return false;
235  }
236  return true;
237  }
238 
239  /// Allow subclasses to finalize results before result_begin() is executed.
240  virtual void finalizeResults() {}
241 
242  ExplodedNode *generateNodeImpl(const ProgramPoint &PP,
244  ExplodedNode *Pred,
245  bool MarkAsSink = false);
246 
247 public:
249  const NodeBuilderContext &Ctx, bool F = true)
250  : C(Ctx), Finalized(F), HasGeneratedNodes(false), Frontier(DstSet) {
251  Frontier.Add(SrcNode);
252  }
253 
255  const NodeBuilderContext &Ctx, bool F = true)
256  : C(Ctx), Finalized(F), HasGeneratedNodes(false), Frontier(DstSet) {
257  Frontier.insert(SrcSet);
258  assert(hasNoSinksInFrontier());
259  }
260 
261  virtual ~NodeBuilder() {}
262 
263  /// \brief Generates a node in the ExplodedGraph.
265  ProgramStateRef State,
266  ExplodedNode *Pred) {
267  return generateNodeImpl(PP, State, Pred, false);
268  }
269 
270  /// \brief Generates a sink in the ExplodedGraph.
271  ///
272  /// When a node is marked as sink, the exploration from the node is stopped -
273  /// the node becomes the last node on the path and certain kinds of bugs are
274  /// suppressed.
276  ProgramStateRef State,
277  ExplodedNode *Pred) {
278  return generateNodeImpl(PP, State, Pred, true);
279  }
280 
282  finalizeResults();
283  assert(checkResults());
284  return Frontier;
285  }
286 
288  /// \brief Iterators through the results frontier.
289  inline iterator begin() {
290  finalizeResults();
291  assert(checkResults());
292  return Frontier.begin();
293  }
294  inline iterator end() {
295  finalizeResults();
296  return Frontier.end();
297  }
298 
299  const NodeBuilderContext &getContext() { return C; }
300  bool hasGeneratedNodes() { return HasGeneratedNodes; }
301 
302  void takeNodes(const ExplodedNodeSet &S) {
303  for (ExplodedNodeSet::iterator I = S.begin(), E = S.end(); I != E; ++I )
304  Frontier.erase(*I);
305  }
306  void takeNodes(ExplodedNode *N) { Frontier.erase(N); }
307  void addNodes(const ExplodedNodeSet &S) { Frontier.insert(S); }
308  void addNodes(ExplodedNode *N) { Frontier.Add(N); }
309 };
310 
311 /// \class NodeBuilderWithSinks
312 /// \brief This node builder keeps track of the generated sink nodes.
314  void anchor() override;
315 protected:
318 
319 public:
321  const NodeBuilderContext &Ctx, ProgramPoint &L)
322  : NodeBuilder(Pred, DstSet, Ctx), Location(L) {}
323 
325  ExplodedNode *Pred,
326  const ProgramPointTag *Tag = nullptr) {
327  const ProgramPoint &LocalLoc = (Tag ? Location.withTag(Tag) : Location);
328  return NodeBuilder::generateNode(LocalLoc, State, Pred);
329  }
330 
332  const ProgramPointTag *Tag = nullptr) {
333  const ProgramPoint &LocalLoc = (Tag ? Location.withTag(Tag) : Location);
334  ExplodedNode *N = NodeBuilder::generateSink(LocalLoc, State, Pred);
335  if (N && N->isSink())
336  sinksGenerated.push_back(N);
337  return N;
338  }
339 
341  return sinksGenerated;
342  }
343 };
344 
345 /// \class StmtNodeBuilder
346 /// \brief This builder class is useful for generating nodes that resulted from
347 /// visiting a statement. The main difference from its parent NodeBuilder is
348 /// that it creates a statement specific ProgramPoint.
350  NodeBuilder *EnclosingBldr;
351 public:
352 
353  /// \brief Constructs a StmtNodeBuilder. If the builder is going to process
354  /// nodes currently owned by another builder(with larger scope), use
355  /// Enclosing builder to transfer ownership.
357  const NodeBuilderContext &Ctx,
358  NodeBuilder *Enclosing = nullptr)
359  : NodeBuilder(SrcNode, DstSet, Ctx), EnclosingBldr(Enclosing) {
360  if (EnclosingBldr)
361  EnclosingBldr->takeNodes(SrcNode);
362  }
363 
365  const NodeBuilderContext &Ctx,
366  NodeBuilder *Enclosing = nullptr)
367  : NodeBuilder(SrcSet, DstSet, Ctx), EnclosingBldr(Enclosing) {
368  if (EnclosingBldr)
369  for (ExplodedNodeSet::iterator I = SrcSet.begin(),
370  E = SrcSet.end(); I != E; ++I )
371  EnclosingBldr->takeNodes(*I);
372  }
373 
374  ~StmtNodeBuilder() override;
375 
378 
380  ExplodedNode *Pred,
381  ProgramStateRef St,
382  const ProgramPointTag *tag = nullptr,
385  Pred->getLocationContext(), tag);
386  return NodeBuilder::generateNode(L, St, Pred);
387  }
388 
390  ExplodedNode *Pred,
391  ProgramStateRef St,
392  const ProgramPointTag *tag = nullptr,
395  Pred->getLocationContext(), tag);
396  return NodeBuilder::generateSink(L, St, Pred);
397  }
398 };
399 
400 /// \brief BranchNodeBuilder is responsible for constructing the nodes
401 /// corresponding to the two branches of the if statement - true and false.
403  void anchor() override;
404  const CFGBlock *DstT;
405  const CFGBlock *DstF;
406 
407  bool InFeasibleTrue;
408  bool InFeasibleFalse;
409 
410 public:
412  const NodeBuilderContext &C,
413  const CFGBlock *dstT, const CFGBlock *dstF)
414  : NodeBuilder(SrcNode, DstSet, C), DstT(dstT), DstF(dstF),
415  InFeasibleTrue(!DstT), InFeasibleFalse(!DstF) {
416  // The branch node builder does not generate autotransitions.
417  // If there are no successors it means that both branches are infeasible.
418  takeNodes(SrcNode);
419  }
420 
422  const NodeBuilderContext &C,
423  const CFGBlock *dstT, const CFGBlock *dstF)
424  : NodeBuilder(SrcSet, DstSet, C), DstT(dstT), DstF(dstF),
425  InFeasibleTrue(!DstT), InFeasibleFalse(!DstF) {
426  takeNodes(SrcSet);
427  }
428 
429  ExplodedNode *generateNode(ProgramStateRef State, bool branch,
430  ExplodedNode *Pred);
431 
432  const CFGBlock *getTargetBlock(bool branch) const {
433  return branch ? DstT : DstF;
434  }
435 
436  void markInfeasible(bool branch) {
437  if (branch)
438  InFeasibleTrue = true;
439  else
440  InFeasibleFalse = true;
441  }
442 
443  bool isFeasible(bool branch) {
444  return branch ? !InFeasibleTrue : !InFeasibleFalse;
445  }
446 };
447 
449  CoreEngine& Eng;
450  const CFGBlock *Src;
451  const CFGBlock &DispatchBlock;
452  const Expr *E;
453  ExplodedNode *Pred;
454 
455 public:
457  const Expr *e, const CFGBlock *dispatch, CoreEngine* eng)
458  : Eng(*eng), Src(src), DispatchBlock(*dispatch), E(e), Pred(pred) {}
459 
460  class iterator {
462 
465  public:
466 
467  iterator &operator++() { ++I; return *this; }
468  bool operator!=(const iterator &X) const { return I != X.I; }
469 
470  const LabelDecl *getLabel() const {
471  return cast<LabelStmt>((*I)->getLabel())->getDecl();
472  }
473 
474  const CFGBlock *getBlock() const {
475  return *I;
476  }
477  };
478 
479  iterator begin() { return iterator(DispatchBlock.succ_begin()); }
480  iterator end() { return iterator(DispatchBlock.succ_end()); }
481 
482  ExplodedNode *generateNode(const iterator &I,
484  bool isSink = false);
485 
486  const Expr *getTarget() const { return E; }
487 
488  ProgramStateRef getState() const { return Pred->State; }
489 
491  return Pred->getLocationContext();
492  }
493 };
494 
496  CoreEngine& Eng;
497  const CFGBlock *Src;
498  const Expr *Condition;
499  ExplodedNode *Pred;
500 
501 public:
503  const Expr *condition, CoreEngine* eng)
504  : Eng(*eng), Src(src), Condition(condition), Pred(pred) {}
505 
506  class iterator {
508 
509  friend class SwitchNodeBuilder;
511 
512  public:
513  iterator &operator++() { ++I; return *this; }
514  bool operator!=(const iterator &X) const { return I != X.I; }
515  bool operator==(const iterator &X) const { return I == X.I; }
516 
517  const CaseStmt *getCase() const {
518  return cast<CaseStmt>((*I)->getLabel());
519  }
520 
521  const CFGBlock *getBlock() const {
522  return *I;
523  }
524  };
525 
526  iterator begin() { return iterator(Src->succ_rbegin()+1); }
527  iterator end() { return iterator(Src->succ_rend()); }
528 
529  const SwitchStmt *getSwitch() const {
530  return cast<SwitchStmt>(Src->getTerminator());
531  }
532 
533  ExplodedNode *generateCaseStmtNode(const iterator &I,
535 
536  ExplodedNode *generateDefaultCaseNode(ProgramStateRef State,
537  bool isSink = false);
538 
539  const Expr *getCondition() const { return Condition; }
540 
541  ProgramStateRef getState() const { return Pred->State; }
542 
544  return Pred->getLocationContext();
545  }
546 };
547 
548 } // end ento namespace
549 } // end clang namespace
550 
551 #endif
bool operator!=(const iterator &X) const
Definition: CoreEngine.h:514
succ_reverse_iterator succ_rbegin()
Definition: CFG.h:605
void markInfeasible(bool branch)
Definition: CoreEngine.h:436
succ_iterator succ_begin()
Definition: CFG.h:600
unsigned blockCount() const
Returns the number of times the current basic block has been visited on the exploded graph path...
Definition: CoreEngine.h:195
CoreEngine(SubEngine &subengine, FunctionSummariesTy *FS)
Construct a CoreEngine object to analyze the provided CFG.
Definition: CoreEngine.h:117
bool ExecuteWorkList(const LocationContext *L, unsigned Steps, ProgramStateRef InitState)
ExecuteWorkList - Run the worklist algorithm for a maximum number of steps.
Definition: CoreEngine.cpp:164
Stmt - This represents one statement.
Definition: Stmt.h:66
This builder class is useful for generating nodes that resulted from visiting a statement.
Definition: CoreEngine.h:349
bool wasBlockAborted() const
Definition: CoreEngine.h:140
unsigned getBlockID() const
Definition: CFG.h:704
Represents a point when we begin processing an inlined call.
Definition: ProgramPoint.h:585
ProgramPoint withTag(const ProgramPointTag *tag) const
Create a new ProgramPoint object that is the same as the original except for using the specified tag ...
Definition: ProgramPoint.h:132
IndirectGotoNodeBuilder(ExplodedNode *pred, const CFGBlock *src, const Expr *e, const CFGBlock *dispatch, CoreEngine *eng)
Definition: CoreEngine.h:456
const CaseStmt * getCase() const
Definition: CoreEngine.h:517
NodeBuilderWithSinks(ExplodedNode *Pred, ExplodedNodeSet &DstSet, const NodeBuilderContext &Ctx, ProgramPoint &L)
Definition: CoreEngine.h:320
BranchNodeBuilder(ExplodedNode *SrcNode, ExplodedNodeSet &DstSet, const NodeBuilderContext &C, const CFGBlock *dstT, const CFGBlock *dstF)
Definition: CoreEngine.h:411
void takeNodes(const ExplodedNodeSet &S)
Definition: CoreEngine.h:302
virtual void finalizeResults()
Allow subclasses to finalize results before result_begin() is executed.
Definition: CoreEngine.h:240
BlocksAborted::const_iterator blocks_aborted_begin() const
Definition: CoreEngine.h:160
void enqueue(ExplodedNodeSet &Set)
Enqueue the given set of nodes onto the work list.
Definition: CoreEngine.cpp:621
bool ExecuteWorkListWithInitialState(const LocationContext *L, unsigned Steps, ProgramStateRef InitState, ExplodedNodeSet &Dst)
Returns true if there is still simulation state on the worklist.
Definition: CoreEngine.cpp:284
static ProgramPoint getProgramPoint(const Stmt *S, ProgramPoint::Kind K, const LocationContext *LC, const ProgramPointTag *tag)
BlocksExhausted::const_iterator blocks_exhausted_end() const
Definition: CoreEngine.h:157
const CFGBlock * getTargetBlock(bool branch) const
Definition: CoreEngine.h:432
bool hasWorkRemaining() const
Definition: CoreEngine.h:142
bool operator==(const iterator &X) const
Definition: CoreEngine.h:515
bool Finalized
Specifies if the builder results have been finalized.
Definition: CoreEngine.h:218
LineState State
BlocksExhausted::const_iterator blocks_exhausted_begin() const
Definition: CoreEngine.h:154
friend class CommonNodeBuilder
Definition: CoreEngine.h:47
ExplodedNodeSet::iterator iterator
Definition: CoreEngine.h:287
ExplodedNode * generateSink(const Stmt *S, ExplodedNode *Pred, ProgramStateRef St, const ProgramPointTag *tag=nullptr, ProgramPoint::Kind K=ProgramPoint::PostStmtKind)
Definition: CoreEngine.h:389
WorkList * getWorkList() const
Definition: CoreEngine.h:152
void addNodes(ExplodedNode *N)
Definition: CoreEngine.h:308
const StackFrameContext * getCurrentStackFrame() const
const LocationContext * getLocationContext() const
const CFGBlock * getBlock() const
Definition: CoreEngine.h:521
ExplodedNodeSet & Frontier
The frontier set - a set of nodes which need to be propagated after the builder dies.
Definition: CoreEngine.h:222
const SmallVectorImpl< ExplodedNode * > & getSinks() const
Definition: CoreEngine.h:340
Represents binding an expression to a temporary.
Definition: ExprCXX.h:1196
StmtNodeBuilder(ExplodedNodeSet &SrcSet, ExplodedNodeSet &DstSet, const NodeBuilderContext &Ctx, NodeBuilder *Enclosing=nullptr)
Definition: CoreEngine.h:364
CFGBlock - Represents a single basic block in a source-level CFG.
Definition: CFG.h:401
ExplodedNode * generateSink(const ProgramPoint &PP, ProgramStateRef State, ExplodedNode *Pred)
Generates a sink in the ExplodedGraph.
Definition: CoreEngine.h:275
Expr - This represents one expression.
Definition: Expr.h:106
ExplodedGraph & getGraph()
getGraph - Returns the exploded graph.
Definition: CoreEngine.h:122
const Expr * getCondition() const
Definition: CoreEngine.h:539
This is the simplest builder which generates nodes in the ExplodedGraph.
Definition: CoreEngine.h:211
void Add(ExplodedNode *N)
const ExplodedNodeSet & getResults()
Definition: CoreEngine.h:281
const LocationContext * getLocationContext() const
Definition: CoreEngine.h:543
SmallVector< ExplodedNode *, 2 > sinksGenerated
Definition: CoreEngine.h:316
void enqueueStmtNode(ExplodedNode *N, const CFGBlock *Block, unsigned Idx)
Enqueue a single node created as a result of statement processing.
Definition: CoreEngine.cpp:555
ReturnStmt - This represents a return, optionally of an expression: return; return 4;...
Definition: Stmt.h:1413
const SwitchStmt * getSwitch() const
Definition: CoreEngine.h:529
virtual bool checkResults()
Checkes if the results are ready.
Definition: CoreEngine.h:225
BlocksAborted::const_iterator blocks_aborted_end() const
Definition: CoreEngine.h:163
CFGTerminator getTerminator()
Definition: CFG.h:688
#define false
Definition: stdbool.h:33
const LocationContext * getLocationContext() const
Definition: CoreEngine.h:490
ProgramPoints can be "tagged" as representing points specific to a given analysis entity...
Definition: ProgramPoint.h:40
bool wasBlocksExhausted() const
Definition: CoreEngine.h:141
DeclStmt - Adaptor class for mixing declarations with statements and expressions. ...
Definition: Stmt.h:487
LabelDecl - Represents the declaration of a label.
Definition: Decl.h:460
ExplodedNode * generateNode(ProgramStateRef State, ExplodedNode *Pred, const ProgramPointTag *Tag=nullptr)
Definition: CoreEngine.h:324
void dispatchWorkItem(ExplodedNode *Pred, ProgramPoint Loc, const WorkListUnit &WU)
Dispatch the work list item based on the given location information.
Definition: CoreEngine.cpp:241
succ_reverse_iterator succ_rend()
Definition: CFG.h:606
std::vector< std::pair< const CFGBlock *, const ExplodedNode * > > BlocksAborted
Definition: CoreEngine.h:56
succ_iterator succ_end()
Definition: CFG.h:601
bool operator!=(const iterator &X) const
Definition: CoreEngine.h:468
AdjacentBlocks::const_iterator const_succ_iterator
Definition: CFG.h:577
void insert(const ExplodedNodeSet &S)
CoreEngine - Implements the core logic of the graph-reachability analysis.
Definition: CoreEngine.h:43
Dataflow Directional Tag Classes.
void takeNodes(ExplodedNode *N)
Definition: CoreEngine.h:306
void addNodes(const ExplodedNodeSet &S)
Definition: CoreEngine.h:307
const NodeBuilderContext & getContext()
Definition: CoreEngine.h:299
BranchNodeBuilder(const ExplodedNodeSet &SrcSet, ExplodedNodeSet &DstSet, const NodeBuilderContext &C, const CFGBlock *dstT, const CFGBlock *dstF)
Definition: CoreEngine.h:421
This node builder keeps track of the generated sink nodes.
Definition: CoreEngine.h:313
BranchNodeBuilder is responsible for constructing the nodes corresponding to the two branches of the ...
Definition: CoreEngine.h:402
ProgramStateRef getState() const
Definition: CoreEngine.h:541
NodeBuilderContext(const CoreEngine &E, const CFGBlock *B, ExplodedNode *N)
Definition: CoreEngine.h:187
SwitchStmt - This represents a &#39;switch&#39; stmt.
Definition: Stmt.h:1007
friend class EndOfFunctionNodeBuilder
Definition: CoreEngine.h:50
ExplodedNode * generateSink(ProgramStateRef State, ExplodedNode *Pred, const ProgramPointTag *Tag=nullptr)
Definition: CoreEngine.h:331
std::vector< std::pair< BlockEdge, const ExplodedNode * > > BlocksExhausted
Definition: CoreEngine.h:53
void addAbortedBlock(const ExplodedNode *node, const CFGBlock *block)
Inform the CoreEngine that a basic block was aborted because it could not be completely analyzed...
Definition: CoreEngine.h:148
bool erase(ExplodedNode *N)
const NodeBuilderContext & C
Definition: CoreEngine.h:214
void enqueueEndOfFunction(ExplodedNodeSet &Set, const ReturnStmt *RS)
enqueue the nodes corresponding to the end of function onto the end of path / work list...
Definition: CoreEngine.cpp:636
X
Add a minimal nested name specifier fixit hint to allow lookup of a tag name from an outer enclosing ...
Definition: SemaDecl.cpp:13194
ExplodedNode * generateNode(const ProgramPoint &PP, ProgramStateRef State, ExplodedNode *Pred)
Generates a node in the ExplodedGraph.
Definition: CoreEngine.h:264
SwitchNodeBuilder(ExplodedNode *pred, const CFGBlock *src, const Expr *condition, CoreEngine *eng)
Definition: CoreEngine.h:502
StmtNodeBuilder(ExplodedNode *SrcNode, ExplodedNodeSet &DstSet, const NodeBuilderContext &Ctx, NodeBuilder *Enclosing=nullptr)
Constructs a StmtNodeBuilder.
Definition: CoreEngine.h:356
ProgramStateRef getState() const
Definition: CoreEngine.h:488
AdjacentBlocks::const_reverse_iterator const_succ_reverse_iterator
Definition: CFG.h:579
NodeBuilder(ExplodedNode *SrcNode, ExplodedNodeSet &DstSet, const NodeBuilderContext &Ctx, bool F=true)
Definition: CoreEngine.h:248
ExplodedNode * generateNode(const Stmt *S, ExplodedNode *Pred, ProgramStateRef St, const ProgramPointTag *tag=nullptr, ProgramPoint::Kind K=ProgramPoint::PostStmtKind)
Definition: CoreEngine.h:379
iterator begin()
Iterators through the results frontier.
Definition: CoreEngine.h:289
NodeBuilder(const ExplodedNodeSet &SrcSet, ExplodedNodeSet &DstSet, const NodeBuilderContext &Ctx, bool F=true)
Definition: CoreEngine.h:254
bool isFeasible(bool branch)
Definition: CoreEngine.h:443
const Expr * getTarget() const
Definition: CoreEngine.h:486
const CFGBlock * getBlock() const
Return the CFGBlock associated with this builder.
Definition: CoreEngine.h:191
const LocationContext * LC
Definition: CoreEngine.h:186