clang  6.0.0svn
SValBuilder.cpp
Go to the documentation of this file.
1 // SValBuilder.cpp - Basic class for all SValBuilder implementations -*- C++ -*-
2 //
3 // The LLVM Compiler Infrastructure
4 //
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
7 //
8 //===----------------------------------------------------------------------===//
9 //
10 // This file defines SValBuilder, the base class for all (complete) SValBuilder
11 // implementations.
12 //
13 //===----------------------------------------------------------------------===//
14 
16 #include "clang/AST/DeclCXX.h"
17 #include "clang/AST/ExprCXX.h"
22 
23 using namespace clang;
24 using namespace ento;
25 
26 //===----------------------------------------------------------------------===//
27 // Basic SVal creation.
28 //===----------------------------------------------------------------------===//
29 
30 void SValBuilder::anchor() { }
31 
33  if (Loc::isLocType(type))
34  return makeNull();
35 
36  if (type->isIntegralOrEnumerationType())
37  return makeIntVal(0, type);
38 
39  if (type->isArrayType() || type->isRecordType() || type->isVectorType() ||
40  type->isAnyComplexType())
42 
43  // FIXME: Handle floats.
44  return UnknownVal();
45 }
46 
48  const llvm::APSInt& rhs, QualType type) {
49  // The Environment ensures we always get a persistent APSInt in
50  // BasicValueFactory, so we don't need to get the APSInt from
51  // BasicValueFactory again.
52  assert(lhs);
53  assert(!Loc::isLocType(type));
54  return nonloc::SymbolVal(SymMgr.getSymIntExpr(lhs, op, rhs, type));
55 }
56 
57 NonLoc SValBuilder::makeNonLoc(const llvm::APSInt& lhs,
58  BinaryOperator::Opcode op, const SymExpr *rhs,
59  QualType type) {
60  assert(rhs);
61  assert(!Loc::isLocType(type));
62  return nonloc::SymbolVal(SymMgr.getIntSymExpr(lhs, op, rhs, type));
63 }
64 
66  const SymExpr *rhs, QualType type) {
67  assert(lhs && rhs);
68  assert(!Loc::isLocType(type));
69  return nonloc::SymbolVal(SymMgr.getSymSymExpr(lhs, op, rhs, type));
70 }
71 
73  QualType fromTy, QualType toTy) {
74  assert(operand);
75  assert(!Loc::isLocType(toTy));
76  return nonloc::SymbolVal(SymMgr.getCastSymbol(operand, fromTy, toTy));
77 }
78 
80  if (val.isUnknownOrUndef())
81  return val;
82 
83  // Common case: we have an appropriately sized integer.
85  const llvm::APSInt& I = CI->getValue();
86  if (I.getBitWidth() == ArrayIndexWidth && I.isSigned())
87  return val;
88  }
89 
91 }
92 
94  return makeTruthVal(boolean->getValue());
95 }
96 
99  QualType T = region->getValueType();
100 
101  if (T->isNullPtrType())
102  return makeZeroVal(T);
103 
105  return UnknownVal();
106 
107  SymbolRef sym = SymMgr.getRegionValueSymbol(region);
108 
109  if (Loc::isLocType(T))
111 
112  return nonloc::SymbolVal(sym);
113 }
114 
116  const Expr *Ex,
117  const LocationContext *LCtx,
118  unsigned Count) {
119  QualType T = Ex->getType();
120 
121  if (T->isNullPtrType())
122  return makeZeroVal(T);
123 
124  // Compute the type of the result. If the expression is not an R-value, the
125  // result should be a location.
126  QualType ExType = Ex->getType();
127  if (Ex->isGLValue())
128  T = LCtx->getAnalysisDeclContext()->getASTContext().getPointerType(ExType);
129 
130  return conjureSymbolVal(SymbolTag, Ex, LCtx, T, Count);
131 }
132 
134  const Expr *expr,
135  const LocationContext *LCtx,
136  QualType type,
137  unsigned count) {
138  if (type->isNullPtrType())
139  return makeZeroVal(type);
140 
142  return UnknownVal();
143 
144  SymbolRef sym = SymMgr.conjureSymbol(expr, LCtx, type, count, symbolTag);
145 
146  if (Loc::isLocType(type))
148 
149  return nonloc::SymbolVal(sym);
150 }
151 
152 
154  const LocationContext *LCtx,
155  QualType type,
156  unsigned visitCount) {
157  if (type->isNullPtrType())
158  return makeZeroVal(type);
159 
161  return UnknownVal();
162 
163  SymbolRef sym = SymMgr.conjureSymbol(stmt, LCtx, type, visitCount);
164 
165  if (Loc::isLocType(type))
167 
168  return nonloc::SymbolVal(sym);
169 }
170 
173  const LocationContext *LCtx,
174  unsigned VisitCount) {
175  QualType T = E->getType();
176  assert(Loc::isLocType(T));
178  if (T->isNullPtrType())
179  return makeZeroVal(T);
180 
181  SymbolRef sym = SymMgr.conjureSymbol(E, LCtx, T, VisitCount);
183 }
184 
186  const MemRegion *region,
187  const Expr *expr, QualType type,
188  const LocationContext *LCtx,
189  unsigned count) {
190  assert(SymbolManager::canSymbolicate(type) && "Invalid metadata symbol type");
191 
192  SymbolRef sym =
193  SymMgr.getMetadataSymbol(region, expr, type, LCtx, count, symbolTag);
194 
195  if (Loc::isLocType(type))
197 
198  return nonloc::SymbolVal(sym);
199 }
200 
203  const TypedValueRegion *region) {
204  QualType T = region->getValueType();
205 
206  if (T->isNullPtrType())
207  return makeZeroVal(T);
208 
210  return UnknownVal();
211 
212  SymbolRef sym = SymMgr.getDerivedSymbol(parentSymbol, region);
213 
214  if (Loc::isLocType(T))
216 
217  return nonloc::SymbolVal(sym);
218 }
219 
221  assert(!DD || isa<CXXMethodDecl>(DD) || isa<FieldDecl>(DD));
222 
223  if (auto *MD = dyn_cast_or_null<CXXMethodDecl>(DD)) {
224  // Sema treats pointers to static member functions as have function pointer
225  // type, so return a function pointer for the method.
226  // We don't need to play a similar trick for static member fields
227  // because these are represented as plain VarDecls and not FieldDecls
228  // in the AST.
229  if (MD->isStatic())
230  return getFunctionPointer(MD);
231  }
232 
233  return nonloc::PointerToMember(DD);
234 }
235 
238 }
239 
241  CanQualType locTy,
242  const LocationContext *locContext,
243  unsigned blockCount) {
244  const BlockCodeRegion *BC =
245  MemMgr.getBlockCodeRegion(block, locTy, locContext->getAnalysisDeclContext());
246  const BlockDataRegion *BD = MemMgr.getBlockDataRegion(BC, locContext,
247  blockCount);
248  return loc::MemRegionVal(BD);
249 }
250 
251 /// Return a memory region for the 'this' object reference.
253  const StackFrameContext *SFC) {
255  getCXXThisRegion(D->getThisType(getContext()), SFC));
256 }
257 
258 /// Return a memory region for the 'this' object reference.
260  const StackFrameContext *SFC) {
261  const Type *T = D->getTypeForDecl();
263  return loc::MemRegionVal(getRegionManager().getCXXThisRegion(PT, SFC));
264 }
265 
267  E = E->IgnoreParens();
268 
269  switch (E->getStmtClass()) {
270  // Handle expressions that we treat differently from the AST's constant
271  // evaluator.
272  case Stmt::AddrLabelExprClass:
273  return makeLoc(cast<AddrLabelExpr>(E));
274 
275  case Stmt::CXXScalarValueInitExprClass:
276  case Stmt::ImplicitValueInitExprClass:
277  return makeZeroVal(E->getType());
278 
279  case Stmt::ObjCStringLiteralClass: {
280  const ObjCStringLiteral *SL = cast<ObjCStringLiteral>(E);
281  return makeLoc(getRegionManager().getObjCStringRegion(SL));
282  }
283 
284  case Stmt::StringLiteralClass: {
285  const StringLiteral *SL = cast<StringLiteral>(E);
286  return makeLoc(getRegionManager().getStringRegion(SL));
287  }
288 
289  // Fast-path some expressions to avoid the overhead of going through the AST's
290  // constant evaluator
291  case Stmt::CharacterLiteralClass: {
292  const CharacterLiteral *C = cast<CharacterLiteral>(E);
293  return makeIntVal(C->getValue(), C->getType());
294  }
295 
296  case Stmt::CXXBoolLiteralExprClass:
297  return makeBoolVal(cast<CXXBoolLiteralExpr>(E));
298 
299  case Stmt::TypeTraitExprClass: {
300  const TypeTraitExpr *TE = cast<TypeTraitExpr>(E);
301  return makeTruthVal(TE->getValue(), TE->getType());
302  }
303 
304  case Stmt::IntegerLiteralClass:
305  return makeIntVal(cast<IntegerLiteral>(E));
306 
307  case Stmt::ObjCBoolLiteralExprClass:
308  return makeBoolVal(cast<ObjCBoolLiteralExpr>(E));
309 
310  case Stmt::CXXNullPtrLiteralExprClass:
311  return makeNull();
312 
313  case Stmt::ImplicitCastExprClass: {
314  const CastExpr *CE = cast<CastExpr>(E);
315  switch (CE->getCastKind()) {
316  default:
317  break;
318  case CK_ArrayToPointerDecay:
319  case CK_BitCast: {
320  const Expr *SE = CE->getSubExpr();
321  Optional<SVal> Val = getConstantVal(SE);
322  if (!Val)
323  return None;
324  return evalCast(*Val, CE->getType(), SE->getType());
325  }
326  }
327  // FALLTHROUGH
328  LLVM_FALLTHROUGH;
329  }
330 
331  // If we don't have a special case, fall back to the AST's constant evaluator.
332  default: {
333  // Don't try to come up with a value for materialized temporaries.
334  if (E->isGLValue())
335  return None;
336 
337  ASTContext &Ctx = getContext();
338  llvm::APSInt Result;
339  if (E->EvaluateAsInt(Result, Ctx))
340  return makeIntVal(Result);
341 
342  if (Loc::isLocType(E->getType()))
344  return makeNull();
345 
346  return None;
347  }
348  }
349 }
350 
351 //===----------------------------------------------------------------------===//
352 
355  NonLoc LHS, NonLoc RHS,
356  QualType ResultTy) {
357  if (!State->isTainted(RHS) && !State->isTainted(LHS))
358  return UnknownVal();
359 
360  const SymExpr *symLHS = LHS.getAsSymExpr();
361  const SymExpr *symRHS = RHS.getAsSymExpr();
362  // TODO: When the Max Complexity is reached, we should conjure a symbol
363  // instead of generating an Unknown value and propagate the taint info to it.
364  const unsigned MaxComp = 10000; // 100000 28X
365 
366  if (symLHS && symRHS &&
367  (symLHS->computeComplexity() + symRHS->computeComplexity()) < MaxComp)
368  return makeNonLoc(symLHS, Op, symRHS, ResultTy);
369 
370  if (symLHS && symLHS->computeComplexity() < MaxComp)
372  return makeNonLoc(symLHS, Op, rInt->getValue(), ResultTy);
373 
374  if (symRHS && symRHS->computeComplexity() < MaxComp)
376  return makeNonLoc(lInt->getValue(), Op, symRHS, ResultTy);
377 
378  return UnknownVal();
379 }
380 
381 
383  SVal lhs, SVal rhs, QualType type) {
384 
385  if (lhs.isUndef() || rhs.isUndef())
386  return UndefinedVal();
387 
388  if (lhs.isUnknown() || rhs.isUnknown())
389  return UnknownVal();
390 
391  if (lhs.getAs<nonloc::LazyCompoundVal>() ||
393  return UnknownVal();
394  }
395 
396  if (Optional<Loc> LV = lhs.getAs<Loc>()) {
397  if (Optional<Loc> RV = rhs.getAs<Loc>())
398  return evalBinOpLL(state, op, *LV, *RV, type);
399 
400  return evalBinOpLN(state, op, *LV, rhs.castAs<NonLoc>(), type);
401  }
402 
403  if (Optional<Loc> RV = rhs.getAs<Loc>()) {
404  // Support pointer arithmetic where the addend is on the left
405  // and the pointer on the right.
406  assert(op == BO_Add);
407 
408  // Commute the operands.
409  return evalBinOpLN(state, op, *RV, lhs.castAs<NonLoc>(), type);
410  }
411 
412  return evalBinOpNN(state, op, lhs.castAs<NonLoc>(), rhs.castAs<NonLoc>(),
413  type);
414 }
415 
418  DefinedOrUnknownSVal rhs) {
419  return evalBinOp(state, BO_EQ, lhs, rhs, getConditionType())
421 }
422 
423 /// Recursively check if the pointer types are equal modulo const, volatile,
424 /// and restrict qualifiers. Also, assume that all types are similar to 'void'.
425 /// Assumes the input types are canonical.
427  QualType FromTy) {
428  while (Context.UnwrapSimilarPointerTypes(ToTy, FromTy)) {
429  Qualifiers Quals1, Quals2;
430  ToTy = Context.getUnqualifiedArrayType(ToTy, Quals1);
431  FromTy = Context.getUnqualifiedArrayType(FromTy, Quals2);
432 
433  // Make sure that non-cvr-qualifiers the other qualifiers (e.g., address
434  // spaces) are identical.
435  Quals1.removeCVRQualifiers();
436  Quals2.removeCVRQualifiers();
437  if (Quals1 != Quals2)
438  return false;
439  }
440 
441  // If we are casting to void, the 'From' value can be used to represent the
442  // 'To' value.
443  if (ToTy->isVoidType())
444  return true;
445 
446  if (ToTy != FromTy)
447  return false;
448 
449  return true;
450 }
451 
452 // Handles casts of type CK_IntegralCast.
453 // At the moment, this function will redirect to evalCast, except when the range
454 // of the original value is known to be greater than the max of the target type.
456  QualType castTy, QualType originalTy) {
457 
458  // No truncations if target type is big enough.
459  if (getContext().getTypeSize(castTy) >= getContext().getTypeSize(originalTy))
460  return evalCast(val, castTy, originalTy);
461 
462  const SymExpr *se = val.getAsSymbolicExpression();
463  if (!se) // Let evalCast handle non symbolic expressions.
464  return evalCast(val, castTy, originalTy);
465 
466  // Find the maximum value of the target type.
467  APSIntType ToType(getContext().getTypeSize(castTy),
468  castTy->isUnsignedIntegerType());
469  llvm::APSInt ToTypeMax = ToType.getMaxValue();
470  NonLoc ToTypeMaxVal =
471  makeIntVal(ToTypeMax.isUnsigned() ? ToTypeMax.getZExtValue()
472  : ToTypeMax.getSExtValue(),
473  castTy)
474  .castAs<NonLoc>();
475  // Check the range of the symbol being casted against the maximum value of the
476  // target type.
477  NonLoc FromVal = val.castAs<NonLoc>();
478  QualType CmpTy = getConditionType();
479  NonLoc CompVal =
480  evalBinOpNN(state, BO_LE, FromVal, ToTypeMaxVal, CmpTy).castAs<NonLoc>();
481  ProgramStateRef IsNotTruncated, IsTruncated;
482  std::tie(IsNotTruncated, IsTruncated) = state->assume(CompVal);
483  if (!IsNotTruncated && IsTruncated) {
484  // Symbol is truncated so we evaluate it as a cast.
485  NonLoc CastVal = makeNonLoc(se, originalTy, castTy);
486  return CastVal;
487  }
488  return evalCast(val, castTy, originalTy);
489 }
490 
491 // FIXME: should rewrite according to the cast kind.
492 SVal SValBuilder::evalCast(SVal val, QualType castTy, QualType originalTy) {
493  castTy = Context.getCanonicalType(castTy);
494  originalTy = Context.getCanonicalType(originalTy);
495  if (val.isUnknownOrUndef() || castTy == originalTy)
496  return val;
497 
498  if (castTy->isBooleanType()) {
499  if (val.isUnknownOrUndef())
500  return val;
501  if (val.isConstant())
502  return makeTruthVal(!val.isZeroConstant(), castTy);
503  if (!Loc::isLocType(originalTy) &&
504  !originalTy->isIntegralOrEnumerationType() &&
505  !originalTy->isMemberPointerType())
506  return UnknownVal();
507  if (SymbolRef Sym = val.getAsSymbol(true)) {
509  // FIXME: If we had a state here, we could see if the symbol is known to
510  // be zero, but we don't.
511  return makeNonLoc(Sym, BO_NE, BVF.getValue(0, Sym->getType()), castTy);
512  }
513  // Loc values are not always true, they could be weakly linked functions.
514  if (Optional<Loc> L = val.getAs<Loc>())
515  return evalCastFromLoc(*L, castTy);
516 
517  Loc L = val.castAs<nonloc::LocAsInteger>().getLoc();
518  return evalCastFromLoc(L, castTy);
519  }
520 
521  // For const casts, casts to void, just propagate the value.
522  if (!castTy->isVariableArrayType() && !originalTy->isVariableArrayType())
524  Context.getPointerType(originalTy)))
525  return val;
526 
527  // Check for casts from pointers to integers.
528  if (castTy->isIntegralOrEnumerationType() && Loc::isLocType(originalTy))
529  return evalCastFromLoc(val.castAs<Loc>(), castTy);
530 
531  // Check for casts from integers to pointers.
532  if (Loc::isLocType(castTy) && originalTy->isIntegralOrEnumerationType()) {
534  if (const MemRegion *R = LV->getLoc().getAsRegion()) {
535  StoreManager &storeMgr = StateMgr.getStoreManager();
536  R = storeMgr.castRegion(R, castTy);
537  return R ? SVal(loc::MemRegionVal(R)) : UnknownVal();
538  }
539  return LV->getLoc();
540  }
541  return dispatchCast(val, castTy);
542  }
543 
544  // Just pass through function and block pointers.
545  if (originalTy->isBlockPointerType() || originalTy->isFunctionPointerType()) {
546  assert(Loc::isLocType(castTy));
547  return val;
548  }
549 
550  // Check for casts from array type to another type.
551  if (const ArrayType *arrayT =
552  dyn_cast<ArrayType>(originalTy.getCanonicalType())) {
553  // We will always decay to a pointer.
554  QualType elemTy = arrayT->getElementType();
555  val = StateMgr.ArrayToPointer(val.castAs<Loc>(), elemTy);
556 
557  // Are we casting from an array to a pointer? If so just pass on
558  // the decayed value.
559  if (castTy->isPointerType() || castTy->isReferenceType())
560  return val;
561 
562  // Are we casting from an array to an integer? If so, cast the decayed
563  // pointer value to an integer.
564  assert(castTy->isIntegralOrEnumerationType());
565 
566  // FIXME: Keep these here for now in case we decide soon that we
567  // need the original decayed type.
568  // QualType elemTy = cast<ArrayType>(originalTy)->getElementType();
569  // QualType pointerTy = C.getPointerType(elemTy);
570  return evalCastFromLoc(val.castAs<Loc>(), castTy);
571  }
572 
573  // Check for casts from a region to a specific type.
574  if (const MemRegion *R = val.getAsRegion()) {
575  // Handle other casts of locations to integers.
576  if (castTy->isIntegralOrEnumerationType())
577  return evalCastFromLoc(loc::MemRegionVal(R), castTy);
578 
579  // FIXME: We should handle the case where we strip off view layers to get
580  // to a desugared type.
581  if (!Loc::isLocType(castTy)) {
582  // FIXME: There can be gross cases where one casts the result of a function
583  // (that returns a pointer) to some other value that happens to fit
584  // within that pointer value. We currently have no good way to
585  // model such operations. When this happens, the underlying operation
586  // is that the caller is reasoning about bits. Conceptually we are
587  // layering a "view" of a location on top of those bits. Perhaps
588  // we need to be more lazy about mutual possible views, even on an
589  // SVal? This may be necessary for bit-level reasoning as well.
590  return UnknownVal();
591  }
592 
593  // We get a symbolic function pointer for a dereference of a function
594  // pointer, but it is of function type. Example:
595 
596  // struct FPRec {
597  // void (*my_func)(int * x);
598  // };
599  //
600  // int bar(int x);
601  //
602  // int f1_a(struct FPRec* foo) {
603  // int x;
604  // (*foo->my_func)(&x);
605  // return bar(x)+1; // no-warning
606  // }
607 
608  assert(Loc::isLocType(originalTy) || originalTy->isFunctionType() ||
609  originalTy->isBlockPointerType() || castTy->isReferenceType());
610 
611  StoreManager &storeMgr = StateMgr.getStoreManager();
612 
613  // Delegate to store manager to get the result of casting a region to a
614  // different type. If the MemRegion* returned is NULL, this expression
615  // Evaluates to UnknownVal.
616  R = storeMgr.castRegion(R, castTy);
617  return R ? SVal(loc::MemRegionVal(R)) : UnknownVal();
618  }
619 
620  return dispatchCast(val, castTy);
621 }
FunctionDecl - An instance of this class is created to represent a function declaration or definition...
Definition: Decl.h:1631
bool getValue() const
Definition: ExprCXX.h:2295
const internal::VariadicDynCastAllOfMatcher< Stmt, Expr > expr
Matches expressions.
Definition: ASTMatchers.h:1538
TypedValueRegion - An abstract class representing regions having a typed value.
Definition: MemRegion.h:511
nonloc::ConcreteInt makeIntVal(const IntegerLiteral *integer)
Definition: SValBuilder.h:254
DefinedSVal getBlockPointer(const BlockDecl *block, CanQualType locTy, const LocationContext *locContext, unsigned blockCount)
A (possibly-)qualified type.
Definition: Type.h:614
MemRegion - The root abstract class for all memory regions.
Definition: MemRegion.h:79
bool isBlockPointerType() const
Definition: Type.h:5772
bool isArrayType() const
Definition: Type.h:5805
bool isMemberPointerType() const
Definition: Type.h:5790
A type trait used in the implementation of various C++11 and Library TR1 trait templates.
Definition: ExprCXX.h:2256
Stmt - This represents one statement.
Definition: Stmt.h:60
const internal::VariadicAllOfMatcher< Stmt > stmt
Matches statements.
Definition: ASTMatchers.h:1068
const IntSymExpr * getIntSymExpr(const llvm::APSInt &lhs, BinaryOperator::Opcode op, const SymExpr *rhs, QualType t)
bool isRecordType() const
Definition: Type.h:5823
BlockCodeRegion - A region that represents code texts of blocks (closures).
Definition: MemRegion.h:611
const Type * getTypeForDecl() const
Definition: Decl.h:2693
virtual QualType getValueType() const =0
SVal makeSymExprValNN(ProgramStateRef state, BinaryOperator::Opcode op, NonLoc lhs, NonLoc rhs, QualType resultTy)
Constructs a symbolic expression for two non-location values.
ProgramStateManager & StateMgr
Definition: SValBuilder.h:46
The base class of the type hierarchy.
Definition: Type.h:1300
Represents an array type, per C99 6.7.5.2 - Array Declarators.
Definition: Type.h:2495
SVal evalCast(SVal val, QualType castTy, QualType originalType)
Value representing integer constant.
Definition: SVals.h:352
MemRegionManager MemMgr
Manages the creation of memory regions.
Definition: SValBuilder.h:44
bool isUnsignedIntegerType() const
Return true if this is an integer type that is unsigned, according to C99 6.2.5p6 [which returns true...
Definition: Type.cpp:1805
bool EvaluateAsInt(llvm::APSInt &Result, const ASTContext &Ctx, SideEffectsKind AllowSideEffects=SE_NoSideEffects) const
EvaluateAsInt - Return true if this is a constant which we can fold and convert to an integer...
ASTContext & getASTContext() const
virtual SVal dispatchCast(SVal val, QualType castTy)=0
loc::MemRegionVal getCXXThis(const CXXMethodDecl *D, const StackFrameContext *SFC)
Return a memory region for the &#39;this&#39; object reference.
NonLoc makeNonLoc(const SymExpr *lhs, BinaryOperator::Opcode op, const llvm::APSInt &rhs, QualType type)
Definition: SValBuilder.cpp:47
BasicValueFactory BasicVals
Manager of APSInt values.
Definition: SValBuilder.h:38
Defines the clang::Expr interface and subclasses for C++ expressions.
The collection of all-type qualifiers we support.
Definition: Type.h:116
const MemRegion * castRegion(const MemRegion *region, QualType CastToTy)
castRegion - Used by ExprEngine::VisitCast to handle casts from a MemRegion* to a specific location t...
Definition: Store.cpp:63
bool isVariableArrayType() const
Definition: Type.h:5814
Symbolic value.
Definition: SymExpr.h:29
const SymbolDerived * getDerivedSymbol(SymbolRef parentSymbol, const TypedValueRegion *R)
virtual SVal evalCastFromNonLoc(NonLoc val, QualType castTy)=0
virtual SVal evalBinOpLN(ProgramStateRef state, BinaryOperator::Opcode op, Loc lhs, NonLoc rhs, QualType resultTy)=0
Create a new value which represents a binary expression with a memory location and non-location opera...
MemRegionManager & getRegionManager()
Definition: SValBuilder.h:150
Holds long-lived AST nodes (such as types and decls) that can be referred to throughout the semantic ...
Definition: ASTContext.h:128
LineState State
SVal evalIntegralCast(ProgramStateRef state, SVal val, QualType castTy, QualType originalType)
static bool canSymbolicate(QualType T)
bool isReferenceType() const
Definition: Type.h:5775
DefinedOrUnknownSVal getDerivedRegionValueSymbolVal(SymbolRef parentSymbol, const TypedValueRegion *region)
Expr * getSubExpr()
Definition: Expr.h:2762
i32 captured_struct **param SharedsTy A type which contains references the shared variables *param Shareds Context with the list of shared variables from the p *TaskFunction *param Data Additional data for task generation like final * state
const SymExpr * getAsSymbolicExpression() const
getAsSymbolicExpression - If this Sval wraps a symbolic expression then return that expression...
Definition: SVals.cpp:126
bool isIntegralOrEnumerationType() const
Determine whether this type is an integral or enumeration type.
Definition: Type.h:6013
const SymbolicRegion * getSymbolicRegion(SymbolRef Sym)
Retrieve or create a "symbolic" memory region.
Definition: MemRegion.cpp:957
bool isGLValue() const
Definition: Expr.h:252
static bool isLocType(QualType T)
Definition: SVals.h:307
BinaryOperatorKind
BlockDataRegion - A region that represents a block instance.
Definition: MemRegion.h:656
QualType getThisType(ASTContext &C) const
Returns the type of the this pointer.
Definition: DeclCXX.cpp:1913
bool UnwrapSimilarPointerTypes(QualType &T1, QualType &T2)
UnwrapSimilarPointerTypes - If T1 and T2 are pointer types that may be similar (C++ 4...
const SymIntExpr * getSymIntExpr(const SymExpr *lhs, BinaryOperator::Opcode op, const llvm::APSInt &rhs, QualType t)
bool isUnknown() const
Definition: SVals.h:128
DefinedOrUnknownSVal getRegionValueSymbolVal(const TypedValueRegion *region)
Make a unique symbol for value of region.
Definition: SValBuilder.cpp:98
A record of the "type" of an APSInt, used for conversions.
Definition: APSIntType.h:20
NonLoc makeCompoundVal(QualType type, llvm::ImmutableList< SVal > vals)
Definition: SValBuilder.h:226
ObjCStringLiteral, used for Objective-C string literals i.e.
Definition: ExprObjC.h:29
DefinedSVal getFunctionPointer(const FunctionDecl *func)
CastExpr - Base class for type casts, including both implicit casts (ImplicitCastExpr) and explicit c...
Definition: Expr.h:2710
bool isConstant() const
Definition: SVals.cpp:207
const BlockCodeRegion * getBlockCodeRegion(const BlockDecl *BD, CanQualType locTy, AnalysisDeclContext *AC)
Definition: MemRegion.cpp:950
SymbolRef getAsSymbol(bool IncludeBaseRegions=false) const
If this SVal wraps a symbol return that SymbolRef.
Definition: SVals.cpp:116
Represents a ValueDecl that came out of a declarator.
Definition: Decl.h:649
nonloc::ConcreteInt makeBoolVal(const ObjCBoolLiteralExpr *boolean)
Definition: SValBuilder.h:260
Loc makeLoc(SymbolRef sym)
Definition: SValBuilder.h:329
unsigned getValue() const
Definition: Expr.h:1372
DefinedOrUnknownSVal makeZeroVal(QualType type)
Construct an SVal representing &#39;0&#39; for the specified type.
Definition: SValBuilder.cpp:32
BlockDecl - This represents a block literal declaration, which is like an unnamed FunctionDecl...
Definition: Decl.h:3587
Expr - This represents one expression.
Definition: Expr.h:106
const FunctionProtoType * T
bool isNullPtrType() const
Definition: Type.h:5976
const QualType ArrayIndexTy
The scalar type to use for array indices.
Definition: SValBuilder.h:49
QualType getConditionType() const
Definition: SValBuilder.h:136
bool isAnyComplexType() const
Definition: Type.h:5829
QualType getType() const
Definition: Expr.h:128
virtual SVal evalBinOpLL(ProgramStateRef state, BinaryOperator::Opcode op, Loc lhs, Loc rhs, QualType resultTy)=0
Create a new value which represents a binary expression with two memory location operands.
SVal evalBinOp(ProgramStateRef state, BinaryOperator::Opcode op, SVal lhs, SVal rhs, QualType type)
void removeCVRQualifiers(unsigned mask)
Definition: Type.h:260
bool getValue() const
Definition: ExprCXX.h:498
Optional< T > getAs() const
Convert to the specified SVal type, returning None if this SVal is not of the desired type...
Definition: SVals.h:100
const SymbolCast * getCastSymbol(const SymExpr *Operand, QualType From, QualType To)
llvm::APSInt getMaxValue() const LLVM_READONLY
Returns the maximum value for this type.
Definition: APSIntType.h:66
const SymSymExpr * getSymSymExpr(const SymExpr *lhs, BinaryOperator::Opcode op, const SymExpr *rhs, QualType t)
QualType getCanonicalType() const
Definition: Type.h:5582
NullPointerConstantKind isNullPointerConstant(ASTContext &Ctx, NullPointerConstantValueDependence NPC) const
isNullPointerConstant - C99 6.3.2.3p3 - Test if this reduces down to a Null pointer constant...
Definition: Expr.cpp:3273
SymbolManager SymMgr
Manages the creation of symbols.
Definition: SValBuilder.h:41
DefinedOrUnknownSVal conjureSymbolVal(const void *symbolTag, const Expr *expr, const LocationContext *LCtx, unsigned count)
Create a new symbol with a unique &#39;name&#39;.
virtual SVal evalCastFromLoc(Loc val, QualType castTy)=0
CastKind getCastKind() const
Definition: Expr.h:2758
const SymbolMetadata * getMetadataSymbol(const MemRegion *R, const Stmt *S, QualType T, const LocationContext *LCtx, unsigned VisitCount, const void *SymbolTag=nullptr)
Creates a metadata symbol associated with a specific region.
const MemRegion * getAsRegion() const
Definition: SVals.cpp:140
Represents a static or instance method of a struct/union/class.
Definition: DeclCXX.h:1918
ASTContext & getContext()
Definition: SValBuilder.h:131
const SymbolRegionValue * getRegionValueSymbol(const TypedValueRegion *R)
Make a unique symbol for MemRegion R according to its kind.
SVal - This represents a symbolic expression, which can be either an L-value or an R-value...
Definition: SVals.h:63
Specifies that a value-dependent expression should be considered to never be a null pointer constant...
Definition: Expr.h:706
static bool shouldBeModeledWithNoOp(ASTContext &Context, QualType ToTy, QualType FromTy)
Recursively check if the pointer types are equal modulo const, volatile, and restrict qualifiers...
DefinedOrUnknownSVal getConjuredHeapSymbolVal(const Expr *E, const LocationContext *LCtx, unsigned Count)
Conjure a symbol representing heap allocated memory region.
bool isVectorType() const
Definition: Type.h:5832
virtual SVal evalBinOpNN(ProgramStateRef state, BinaryOperator::Opcode op, NonLoc lhs, NonLoc rhs, QualType resultTy)=0
Create a new value which represents a binary expression with two non- location operands.
const unsigned ArrayIndexWidth
The width of the scalar type used for array indices.
Definition: SValBuilder.h:52
const SymbolicRegion * getSymbolicHeapRegion(SymbolRef sym)
Return a unique symbolic region belonging to heap memory space.
Definition: MemRegion.cpp:961
Dataflow Directional Tag Classes.
SVal ArrayToPointer(Loc Array, QualType ElementTy)
Definition: ProgramState.h:539
bool isZeroConstant() const
Definition: SVals.cpp:219
StmtClass getStmtClass() const
Definition: Stmt.h:361
bool isBooleanType() const
Definition: Type.h:6026
Represents symbolic expression.
Definition: SVals.h:326
unsigned computeComplexity() const
SVal convertToArrayIndex(SVal val)
Definition: SValBuilder.cpp:79
const SymbolConjured * conjureSymbol(const Stmt *E, const LocationContext *LCtx, QualType T, unsigned VisitCount, const void *SymbolTag=nullptr)
const FunctionCodeRegion * getFunctionCodeRegion(const NamedDecl *FD)
Definition: MemRegion.cpp:945
DefinedSVal getMetadataSymbolVal(const void *symbolTag, const MemRegion *region, const Expr *expr, QualType type, const LocationContext *LCtx, unsigned count)
T castAs() const
Convert to the specified SVal type, asserting that this SVal is of the desired type.
Definition: SVals.h:92
BasicValueFactory & getBasicValueFactory()
Definition: SValBuilder.h:144
DefinedSVal getMemberPointer(const DeclaratorDecl *DD)
bool isFunctionType() const
Definition: Type.h:5763
const SymExpr * getAsSymExpr() const
Definition: SVals.cpp:133
const BlockDataRegion * getBlockDataRegion(const BlockCodeRegion *bc, const LocationContext *lc, unsigned blockCount)
getBlockDataRegion - Get the memory region associated with an instance of a block.
Definition: MemRegion.cpp:873
CanQualType getCanonicalType(QualType T) const
Return the canonical (structural) type corresponding to the specified potentially non-canonical type ...
Definition: ASTContext.h:2124
Defines the C++ Decl subclasses, other than those for templates (found in DeclTemplate.h) and friends (in DeclFriend.h).
Represents a C++ struct/union/class.
Definition: DeclCXX.h:266
DefinedOrUnknownSVal evalEQ(ProgramStateRef state, DefinedOrUnknownSVal lhs, DefinedOrUnknownSVal rhs)
bool isVoidType() const
Definition: Type.h:5963
Optional< SVal > getConstantVal(const Expr *E)
Returns the value of E, if it can be determined in a non-path-sensitive manner.
QualType getPointerType(QualType T) const
Return the uniqued reference to the type for a pointer to the specified type.
StringLiteral - This represents a string literal expression, e.g.
Definition: Expr.h:1509
bool isUndef() const
Definition: SVals.h:132
bool isPointerType() const
Definition: Type.h:5766
nonloc::ConcreteInt makeTruthVal(bool b, QualType type)
Definition: SValBuilder.h:310
A boolean literal, per ([C++ lex.bool] Boolean literals).
Definition: ExprCXX.h:486
AnalysisDeclContext * getAnalysisDeclContext() const
bool isFunctionPointerType() const
Definition: Type.h:5784
QualType getUnqualifiedArrayType(QualType T, Qualifiers &Quals)
Return this type as a completely-unqualified array type, capturing the qualifiers in Quals...
bool isUnknownOrUndef() const
Definition: SVals.h:136
llvm::ImmutableList< SVal > getEmptySValList()
Expr * IgnoreParens() LLVM_READONLY
IgnoreParens - Ignore parentheses.
Definition: Expr.cpp:2432