clang  7.0.0svn
SValBuilder.cpp
Go to the documentation of this file.
1 //===- SValBuilder.cpp - Basic class for all SValBuilder implementations --===//
2 //
3 // The LLVM Compiler Infrastructure
4 //
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
7 //
8 //===----------------------------------------------------------------------===//
9 //
10 // This file defines SValBuilder, the base class for all (complete) SValBuilder
11 // implementations.
12 //
13 //===----------------------------------------------------------------------===//
14 
16 #include "clang/AST/ASTContext.h"
17 #include "clang/AST/Decl.h"
18 #include "clang/AST/DeclCXX.h"
19 #include "clang/AST/ExprCXX.h"
20 #include "clang/AST/ExprObjC.h"
21 #include "clang/AST/Stmt.h"
22 #include "clang/AST/Type.h"
23 #include "clang/Basic/LLVM.h"
34 #include "llvm/ADT/APSInt.h"
35 #include "llvm/ADT/None.h"
36 #include "llvm/ADT/Optional.h"
37 #include "llvm/Support/Casting.h"
38 #include "llvm/Support/Compiler.h"
39 #include <cassert>
40 #include <tuple>
41 
42 using namespace clang;
43 using namespace ento;
44 
45 //===----------------------------------------------------------------------===//
46 // Basic SVal creation.
47 //===----------------------------------------------------------------------===//
48 
49 void SValBuilder::anchor() {}
50 
52  if (Loc::isLocType(type))
53  return makeNull();
54 
55  if (type->isIntegralOrEnumerationType())
56  return makeIntVal(0, type);
57 
58  if (type->isArrayType() || type->isRecordType() || type->isVectorType() ||
59  type->isAnyComplexType())
61 
62  // FIXME: Handle floats.
63  return UnknownVal();
64 }
65 
67  const llvm::APSInt& rhs, QualType type) {
68  // The Environment ensures we always get a persistent APSInt in
69  // BasicValueFactory, so we don't need to get the APSInt from
70  // BasicValueFactory again.
71  assert(lhs);
72  assert(!Loc::isLocType(type));
73  return nonloc::SymbolVal(SymMgr.getSymIntExpr(lhs, op, rhs, type));
74 }
75 
76 NonLoc SValBuilder::makeNonLoc(const llvm::APSInt& lhs,
77  BinaryOperator::Opcode op, const SymExpr *rhs,
78  QualType type) {
79  assert(rhs);
80  assert(!Loc::isLocType(type));
81  return nonloc::SymbolVal(SymMgr.getIntSymExpr(lhs, op, rhs, type));
82 }
83 
85  const SymExpr *rhs, QualType type) {
86  assert(lhs && rhs);
87  assert(!Loc::isLocType(type));
88  return nonloc::SymbolVal(SymMgr.getSymSymExpr(lhs, op, rhs, type));
89 }
90 
92  QualType fromTy, QualType toTy) {
93  assert(operand);
94  assert(!Loc::isLocType(toTy));
95  return nonloc::SymbolVal(SymMgr.getCastSymbol(operand, fromTy, toTy));
96 }
97 
99  if (val.isUnknownOrUndef())
100  return val;
101 
102  // Common case: we have an appropriately sized integer.
104  const llvm::APSInt& I = CI->getValue();
105  if (I.getBitWidth() == ArrayIndexWidth && I.isSigned())
106  return val;
107  }
108 
110 }
111 
113  return makeTruthVal(boolean->getValue());
114 }
115 
118  QualType T = region->getValueType();
119 
120  if (T->isNullPtrType())
121  return makeZeroVal(T);
122 
124  return UnknownVal();
125 
126  SymbolRef sym = SymMgr.getRegionValueSymbol(region);
127 
128  if (Loc::isLocType(T))
130 
131  return nonloc::SymbolVal(sym);
132 }
133 
135  const Expr *Ex,
136  const LocationContext *LCtx,
137  unsigned Count) {
138  QualType T = Ex->getType();
139 
140  if (T->isNullPtrType())
141  return makeZeroVal(T);
142 
143  // Compute the type of the result. If the expression is not an R-value, the
144  // result should be a location.
145  QualType ExType = Ex->getType();
146  if (Ex->isGLValue())
147  T = LCtx->getAnalysisDeclContext()->getASTContext().getPointerType(ExType);
148 
149  return conjureSymbolVal(SymbolTag, Ex, LCtx, T, Count);
150 }
151 
153  const Expr *expr,
154  const LocationContext *LCtx,
155  QualType type,
156  unsigned count) {
157  if (type->isNullPtrType())
158  return makeZeroVal(type);
159 
161  return UnknownVal();
162 
163  SymbolRef sym = SymMgr.conjureSymbol(expr, LCtx, type, count, symbolTag);
164 
165  if (Loc::isLocType(type))
167 
168  return nonloc::SymbolVal(sym);
169 }
170 
172  const LocationContext *LCtx,
173  QualType type,
174  unsigned visitCount) {
175  if (type->isNullPtrType())
176  return makeZeroVal(type);
177 
179  return UnknownVal();
180 
181  SymbolRef sym = SymMgr.conjureSymbol(stmt, LCtx, type, visitCount);
182 
183  if (Loc::isLocType(type))
185 
186  return nonloc::SymbolVal(sym);
187 }
188 
191  const LocationContext *LCtx,
192  unsigned VisitCount) {
193  QualType T = E->getType();
194  assert(Loc::isLocType(T));
196  if (T->isNullPtrType())
197  return makeZeroVal(T);
198 
199  SymbolRef sym = SymMgr.conjureSymbol(E, LCtx, T, VisitCount);
201 }
202 
204  const MemRegion *region,
205  const Expr *expr, QualType type,
206  const LocationContext *LCtx,
207  unsigned count) {
208  assert(SymbolManager::canSymbolicate(type) && "Invalid metadata symbol type");
209 
210  SymbolRef sym =
211  SymMgr.getMetadataSymbol(region, expr, type, LCtx, count, symbolTag);
212 
213  if (Loc::isLocType(type))
215 
216  return nonloc::SymbolVal(sym);
217 }
218 
221  const TypedValueRegion *region) {
222  QualType T = region->getValueType();
223 
224  if (T->isNullPtrType())
225  return makeZeroVal(T);
226 
228  return UnknownVal();
229 
230  SymbolRef sym = SymMgr.getDerivedSymbol(parentSymbol, region);
231 
232  if (Loc::isLocType(T))
234 
235  return nonloc::SymbolVal(sym);
236 }
237 
239  assert(!DD || isa<CXXMethodDecl>(DD) || isa<FieldDecl>(DD));
240 
241  if (const auto *MD = dyn_cast_or_null<CXXMethodDecl>(DD)) {
242  // Sema treats pointers to static member functions as have function pointer
243  // type, so return a function pointer for the method.
244  // We don't need to play a similar trick for static member fields
245  // because these are represented as plain VarDecls and not FieldDecls
246  // in the AST.
247  if (MD->isStatic())
248  return getFunctionPointer(MD);
249  }
250 
251  return nonloc::PointerToMember(DD);
252 }
253 
256 }
257 
259  CanQualType locTy,
260  const LocationContext *locContext,
261  unsigned blockCount) {
262  const BlockCodeRegion *BC =
263  MemMgr.getBlockCodeRegion(block, locTy, locContext->getAnalysisDeclContext());
264  const BlockDataRegion *BD = MemMgr.getBlockDataRegion(BC, locContext,
265  blockCount);
266  return loc::MemRegionVal(BD);
267 }
268 
269 /// Return a memory region for the 'this' object reference.
271  const StackFrameContext *SFC) {
273  getCXXThisRegion(D->getThisType(getContext()), SFC));
274 }
275 
276 /// Return a memory region for the 'this' object reference.
278  const StackFrameContext *SFC) {
279  const Type *T = D->getTypeForDecl();
281  return loc::MemRegionVal(getRegionManager().getCXXThisRegion(PT, SFC));
282 }
283 
285  E = E->IgnoreParens();
286 
287  switch (E->getStmtClass()) {
288  // Handle expressions that we treat differently from the AST's constant
289  // evaluator.
290  case Stmt::AddrLabelExprClass:
291  return makeLoc(cast<AddrLabelExpr>(E));
292 
293  case Stmt::CXXScalarValueInitExprClass:
294  case Stmt::ImplicitValueInitExprClass:
295  return makeZeroVal(E->getType());
296 
297  case Stmt::ObjCStringLiteralClass: {
298  const auto *SL = cast<ObjCStringLiteral>(E);
299  return makeLoc(getRegionManager().getObjCStringRegion(SL));
300  }
301 
302  case Stmt::StringLiteralClass: {
303  const auto *SL = cast<StringLiteral>(E);
304  return makeLoc(getRegionManager().getStringRegion(SL));
305  }
306 
307  // Fast-path some expressions to avoid the overhead of going through the AST's
308  // constant evaluator
309  case Stmt::CharacterLiteralClass: {
310  const auto *C = cast<CharacterLiteral>(E);
311  return makeIntVal(C->getValue(), C->getType());
312  }
313 
314  case Stmt::CXXBoolLiteralExprClass:
315  return makeBoolVal(cast<CXXBoolLiteralExpr>(E));
316 
317  case Stmt::TypeTraitExprClass: {
318  const auto *TE = cast<TypeTraitExpr>(E);
319  return makeTruthVal(TE->getValue(), TE->getType());
320  }
321 
322  case Stmt::IntegerLiteralClass:
323  return makeIntVal(cast<IntegerLiteral>(E));
324 
325  case Stmt::ObjCBoolLiteralExprClass:
326  return makeBoolVal(cast<ObjCBoolLiteralExpr>(E));
327 
328  case Stmt::CXXNullPtrLiteralExprClass:
329  return makeNull();
330 
331  case Stmt::CStyleCastExprClass:
332  case Stmt::CXXFunctionalCastExprClass:
333  case Stmt::CXXConstCastExprClass:
334  case Stmt::CXXReinterpretCastExprClass:
335  case Stmt::CXXStaticCastExprClass:
336  case Stmt::ImplicitCastExprClass: {
337  const auto *CE = cast<CastExpr>(E);
338  switch (CE->getCastKind()) {
339  default:
340  break;
341  case CK_ArrayToPointerDecay:
342  case CK_IntegralToPointer:
343  case CK_NoOp:
344  case CK_BitCast: {
345  const Expr *SE = CE->getSubExpr();
346  Optional<SVal> Val = getConstantVal(SE);
347  if (!Val)
348  return None;
349  return evalCast(*Val, CE->getType(), SE->getType());
350  }
351  }
352  // FALLTHROUGH
353  LLVM_FALLTHROUGH;
354  }
355 
356  // If we don't have a special case, fall back to the AST's constant evaluator.
357  default: {
358  // Don't try to come up with a value for materialized temporaries.
359  if (E->isGLValue())
360  return None;
361 
362  ASTContext &Ctx = getContext();
363  llvm::APSInt Result;
364  if (E->EvaluateAsInt(Result, Ctx))
365  return makeIntVal(Result);
366 
367  if (Loc::isLocType(E->getType()))
369  return makeNull();
370 
371  return None;
372  }
373  }
374 }
375 
378  NonLoc LHS, NonLoc RHS,
379  QualType ResultTy) {
380  if (!State->isTainted(RHS) && !State->isTainted(LHS))
381  return UnknownVal();
382 
383  const SymExpr *symLHS = LHS.getAsSymExpr();
384  const SymExpr *symRHS = RHS.getAsSymExpr();
385  // TODO: When the Max Complexity is reached, we should conjure a symbol
386  // instead of generating an Unknown value and propagate the taint info to it.
387  const unsigned MaxComp = 10000; // 100000 28X
388 
389  if (symLHS && symRHS &&
390  (symLHS->computeComplexity() + symRHS->computeComplexity()) < MaxComp)
391  return makeNonLoc(symLHS, Op, symRHS, ResultTy);
392 
393  if (symLHS && symLHS->computeComplexity() < MaxComp)
395  return makeNonLoc(symLHS, Op, rInt->getValue(), ResultTy);
396 
397  if (symRHS && symRHS->computeComplexity() < MaxComp)
399  return makeNonLoc(lInt->getValue(), Op, symRHS, ResultTy);
400 
401  return UnknownVal();
402 }
403 
405  SVal lhs, SVal rhs, QualType type) {
406  if (lhs.isUndef() || rhs.isUndef())
407  return UndefinedVal();
408 
409  if (lhs.isUnknown() || rhs.isUnknown())
410  return UnknownVal();
411 
412  if (lhs.getAs<nonloc::LazyCompoundVal>() ||
414  return UnknownVal();
415  }
416 
417  if (Optional<Loc> LV = lhs.getAs<Loc>()) {
418  if (Optional<Loc> RV = rhs.getAs<Loc>())
419  return evalBinOpLL(state, op, *LV, *RV, type);
420 
421  return evalBinOpLN(state, op, *LV, rhs.castAs<NonLoc>(), type);
422  }
423 
424  if (Optional<Loc> RV = rhs.getAs<Loc>()) {
425  // Support pointer arithmetic where the addend is on the left
426  // and the pointer on the right.
427  assert(op == BO_Add);
428 
429  // Commute the operands.
430  return evalBinOpLN(state, op, *RV, lhs.castAs<NonLoc>(), type);
431  }
432 
433  return evalBinOpNN(state, op, lhs.castAs<NonLoc>(), rhs.castAs<NonLoc>(),
434  type);
435 }
436 
438  SVal rhs) {
439  return state->isNonNull(evalEQ(state, lhs, rhs));
440 }
441 
443  return evalBinOp(state, BO_EQ, lhs, rhs, getConditionType());
444 }
445 
448  DefinedOrUnknownSVal rhs) {
449  return evalEQ(state, static_cast<SVal>(lhs), static_cast<SVal>(rhs))
451 }
452 
453 /// Recursively check if the pointer types are equal modulo const, volatile,
454 /// and restrict qualifiers. Also, assume that all types are similar to 'void'.
455 /// Assumes the input types are canonical.
457  QualType FromTy) {
458  while (Context.UnwrapSimilarPointerTypes(ToTy, FromTy)) {
459  Qualifiers Quals1, Quals2;
460  ToTy = Context.getUnqualifiedArrayType(ToTy, Quals1);
461  FromTy = Context.getUnqualifiedArrayType(FromTy, Quals2);
462 
463  // Make sure that non-cvr-qualifiers the other qualifiers (e.g., address
464  // spaces) are identical.
465  Quals1.removeCVRQualifiers();
466  Quals2.removeCVRQualifiers();
467  if (Quals1 != Quals2)
468  return false;
469  }
470 
471  // If we are casting to void, the 'From' value can be used to represent the
472  // 'To' value.
473  if (ToTy->isVoidType())
474  return true;
475 
476  if (ToTy != FromTy)
477  return false;
478 
479  return true;
480 }
481 
482 // Handles casts of type CK_IntegralCast.
483 // At the moment, this function will redirect to evalCast, except when the range
484 // of the original value is known to be greater than the max of the target type.
486  QualType castTy, QualType originalTy) {
487  // No truncations if target type is big enough.
488  if (getContext().getTypeSize(castTy) >= getContext().getTypeSize(originalTy))
489  return evalCast(val, castTy, originalTy);
490 
491  const SymExpr *se = val.getAsSymbolicExpression();
492  if (!se) // Let evalCast handle non symbolic expressions.
493  return evalCast(val, castTy, originalTy);
494 
495  // Find the maximum value of the target type.
496  APSIntType ToType(getContext().getTypeSize(castTy),
497  castTy->isUnsignedIntegerType());
498  llvm::APSInt ToTypeMax = ToType.getMaxValue();
499  NonLoc ToTypeMaxVal =
500  makeIntVal(ToTypeMax.isUnsigned() ? ToTypeMax.getZExtValue()
501  : ToTypeMax.getSExtValue(),
502  castTy)
503  .castAs<NonLoc>();
504  // Check the range of the symbol being casted against the maximum value of the
505  // target type.
506  NonLoc FromVal = val.castAs<NonLoc>();
507  QualType CmpTy = getConditionType();
508  NonLoc CompVal =
509  evalBinOpNN(state, BO_LE, FromVal, ToTypeMaxVal, CmpTy).castAs<NonLoc>();
510  ProgramStateRef IsNotTruncated, IsTruncated;
511  std::tie(IsNotTruncated, IsTruncated) = state->assume(CompVal);
512  if (!IsNotTruncated && IsTruncated) {
513  // Symbol is truncated so we evaluate it as a cast.
514  NonLoc CastVal = makeNonLoc(se, originalTy, castTy);
515  return CastVal;
516  }
517  return evalCast(val, castTy, originalTy);
518 }
519 
520 // FIXME: should rewrite according to the cast kind.
521 SVal SValBuilder::evalCast(SVal val, QualType castTy, QualType originalTy) {
522  castTy = Context.getCanonicalType(castTy);
523  originalTy = Context.getCanonicalType(originalTy);
524  if (val.isUnknownOrUndef() || castTy == originalTy)
525  return val;
526 
527  if (castTy->isBooleanType()) {
528  if (val.isUnknownOrUndef())
529  return val;
530  if (val.isConstant())
531  return makeTruthVal(!val.isZeroConstant(), castTy);
532  if (!Loc::isLocType(originalTy) &&
533  !originalTy->isIntegralOrEnumerationType() &&
534  !originalTy->isMemberPointerType())
535  return UnknownVal();
536  if (SymbolRef Sym = val.getAsSymbol(true)) {
538  // FIXME: If we had a state here, we could see if the symbol is known to
539  // be zero, but we don't.
540  return makeNonLoc(Sym, BO_NE, BVF.getValue(0, Sym->getType()), castTy);
541  }
542  // Loc values are not always true, they could be weakly linked functions.
543  if (Optional<Loc> L = val.getAs<Loc>())
544  return evalCastFromLoc(*L, castTy);
545 
546  Loc L = val.castAs<nonloc::LocAsInteger>().getLoc();
547  return evalCastFromLoc(L, castTy);
548  }
549 
550  // For const casts, casts to void, just propagate the value.
551  if (!castTy->isVariableArrayType() && !originalTy->isVariableArrayType())
553  Context.getPointerType(originalTy)))
554  return val;
555 
556  // Check for casts from pointers to integers.
557  if (castTy->isIntegralOrEnumerationType() && Loc::isLocType(originalTy))
558  return evalCastFromLoc(val.castAs<Loc>(), castTy);
559 
560  // Check for casts from integers to pointers.
561  if (Loc::isLocType(castTy) && originalTy->isIntegralOrEnumerationType()) {
563  if (const MemRegion *R = LV->getLoc().getAsRegion()) {
564  StoreManager &storeMgr = StateMgr.getStoreManager();
565  R = storeMgr.castRegion(R, castTy);
566  return R ? SVal(loc::MemRegionVal(R)) : UnknownVal();
567  }
568  return LV->getLoc();
569  }
570  return dispatchCast(val, castTy);
571  }
572 
573  // Just pass through function and block pointers.
574  if (originalTy->isBlockPointerType() || originalTy->isFunctionPointerType()) {
575  assert(Loc::isLocType(castTy));
576  return val;
577  }
578 
579  // Check for casts from array type to another type.
580  if (const auto *arrayT =
581  dyn_cast<ArrayType>(originalTy.getCanonicalType())) {
582  // We will always decay to a pointer.
583  QualType elemTy = arrayT->getElementType();
584  val = StateMgr.ArrayToPointer(val.castAs<Loc>(), elemTy);
585 
586  // Are we casting from an array to a pointer? If so just pass on
587  // the decayed value.
588  if (castTy->isPointerType() || castTy->isReferenceType())
589  return val;
590 
591  // Are we casting from an array to an integer? If so, cast the decayed
592  // pointer value to an integer.
593  assert(castTy->isIntegralOrEnumerationType());
594 
595  // FIXME: Keep these here for now in case we decide soon that we
596  // need the original decayed type.
597  // QualType elemTy = cast<ArrayType>(originalTy)->getElementType();
598  // QualType pointerTy = C.getPointerType(elemTy);
599  return evalCastFromLoc(val.castAs<Loc>(), castTy);
600  }
601 
602  // Check for casts from a region to a specific type.
603  if (const MemRegion *R = val.getAsRegion()) {
604  // Handle other casts of locations to integers.
605  if (castTy->isIntegralOrEnumerationType())
606  return evalCastFromLoc(loc::MemRegionVal(R), castTy);
607 
608  // FIXME: We should handle the case where we strip off view layers to get
609  // to a desugared type.
610  if (!Loc::isLocType(castTy)) {
611  // FIXME: There can be gross cases where one casts the result of a function
612  // (that returns a pointer) to some other value that happens to fit
613  // within that pointer value. We currently have no good way to
614  // model such operations. When this happens, the underlying operation
615  // is that the caller is reasoning about bits. Conceptually we are
616  // layering a "view" of a location on top of those bits. Perhaps
617  // we need to be more lazy about mutual possible views, even on an
618  // SVal? This may be necessary for bit-level reasoning as well.
619  return UnknownVal();
620  }
621 
622  // We get a symbolic function pointer for a dereference of a function
623  // pointer, but it is of function type. Example:
624 
625  // struct FPRec {
626  // void (*my_func)(int * x);
627  // };
628  //
629  // int bar(int x);
630  //
631  // int f1_a(struct FPRec* foo) {
632  // int x;
633  // (*foo->my_func)(&x);
634  // return bar(x)+1; // no-warning
635  // }
636 
637  assert(Loc::isLocType(originalTy) || originalTy->isFunctionType() ||
638  originalTy->isBlockPointerType() || castTy->isReferenceType());
639 
640  StoreManager &storeMgr = StateMgr.getStoreManager();
641 
642  // Delegate to store manager to get the result of casting a region to a
643  // different type. If the MemRegion* returned is NULL, this expression
644  // Evaluates to UnknownVal.
645  R = storeMgr.castRegion(R, castTy);
646  return R ? SVal(loc::MemRegionVal(R)) : UnknownVal();
647  }
648 
649  return dispatchCast(val, castTy);
650 }
Defines the clang::ASTContext interface.
Represents a function declaration or definition.
Definition: Decl.h:1714
TypedValueRegion - An abstract class representing regions having a typed value.
Definition: MemRegion.h:525
nonloc::ConcreteInt makeIntVal(const IntegerLiteral *integer)
Definition: SValBuilder.h:279
DefinedSVal getBlockPointer(const BlockDecl *block, CanQualType locTy, const LocationContext *locContext, unsigned blockCount)
A (possibly-)qualified type.
Definition: Type.h:655
MemRegion - The root abstract class for all memory regions.
Definition: MemRegion.h:94
bool isBlockPointerType() const
Definition: Type.h:6057
bool isArrayType() const
Definition: Type.h:6098
bool isMemberPointerType() const
Definition: Type.h:6080
const internal::VariadicAllOfMatcher< Stmt > stmt
Matches statements.
Stmt - This represents one statement.
Definition: Stmt.h:66
const IntSymExpr * getIntSymExpr(const llvm::APSInt &lhs, BinaryOperator::Opcode op, const SymExpr *rhs, QualType t)
C Language Family Type Representation.
bool isRecordType() const
Definition: Type.h:6122
BlockCodeRegion - A region that represents code texts of blocks (closures).
Definition: MemRegion.h:623
const Type * getTypeForDecl() const
Definition: Decl.h:2840
virtual QualType getValueType() const =0
SVal makeSymExprValNN(ProgramStateRef state, BinaryOperator::Opcode op, NonLoc lhs, NonLoc rhs, QualType resultTy)
Constructs a symbolic expression for two non-location values.
ProgramStateManager & StateMgr
Definition: SValBuilder.h:68
The base class of the type hierarchy.
Definition: Type.h:1421
SVal evalCast(SVal val, QualType castTy, QualType originalType)
Value representing integer constant.
Definition: SVals.h:374
MemRegionManager MemMgr
Manages the creation of memory regions.
Definition: SValBuilder.h:66
bool isUnsignedIntegerType() const
Return true if this is an integer type that is unsigned, according to C99 6.2.5p6 [which returns true...
Definition: Type.cpp:1847
bool EvaluateAsInt(llvm::APSInt &Result, const ASTContext &Ctx, SideEffectsKind AllowSideEffects=SE_NoSideEffects) const
EvaluateAsInt - Return true if this is a constant which we can fold and convert to an integer...
ASTContext & getASTContext() const
const internal::VariadicDynCastAllOfMatcher< Stmt, Expr > expr
Matches expressions.
virtual SVal dispatchCast(SVal val, QualType castTy)=0
loc::MemRegionVal getCXXThis(const CXXMethodDecl *D, const StackFrameContext *SFC)
Return a memory region for the &#39;this&#39; object reference.
NonLoc makeNonLoc(const SymExpr *lhs, BinaryOperator::Opcode op, const llvm::APSInt &rhs, QualType type)
Definition: SValBuilder.cpp:66
BasicValueFactory BasicVals
Manager of APSInt values.
Definition: SValBuilder.h:60
Defines the clang::Expr interface and subclasses for C++ expressions.
The collection of all-type qualifiers we support.
Definition: Type.h:154
const MemRegion * castRegion(const MemRegion *region, QualType CastToTy)
castRegion - Used by ExprEngine::VisitCast to handle casts from a MemRegion* to a specific location t...
Definition: Store.cpp:75
bool isVariableArrayType() const
Definition: Type.h:6110
Symbolic value.
Definition: SymExpr.h:30
const SymbolDerived * getDerivedSymbol(SymbolRef parentSymbol, const TypedValueRegion *R)
virtual SVal evalCastFromNonLoc(NonLoc val, QualType castTy)=0
virtual SVal evalBinOpLN(ProgramStateRef state, BinaryOperator::Opcode op, Loc lhs, NonLoc rhs, QualType resultTy)=0
Create a new value which represents a binary expression with a memory location and non-location opera...
MemRegionManager & getRegionManager()
Definition: SValBuilder.h:175
Holds long-lived AST nodes (such as types and decls) that can be referred to throughout the semantic ...
Definition: ASTContext.h:150
LineState State
SVal evalIntegralCast(ProgramStateRef state, SVal val, QualType castTy, QualType originalType)
static bool canSymbolicate(QualType T)
bool isReferenceType() const
Definition: Type.h:6061
DefinedOrUnknownSVal getDerivedRegionValueSymbolVal(SymbolRef parentSymbol, const TypedValueRegion *region)
i32 captured_struct **param SharedsTy A type which contains references the shared variables *param Shareds Context with the list of shared variables from the p *TaskFunction *param Data Additional data for task generation like final * state
const SymExpr * getAsSymbolicExpression() const
getAsSymbolicExpression - If this Sval wraps a symbolic expression then return that expression...
Definition: SVals.cpp:137
bool isIntegralOrEnumerationType() const
Determine whether this type is an integral or enumeration type.
Definition: Type.h:6370
const SymbolicRegion * getSymbolicRegion(SymbolRef Sym)
Retrieve or create a "symbolic" memory region.
Definition: MemRegion.cpp:994
bool isGLValue() const
Definition: Expr.h:252
static bool isLocType(QualType T)
Definition: SVals.h:327
BinaryOperatorKind
BlockDataRegion - A region that represents a block instance.
Definition: MemRegion.h:668
QualType getThisType(ASTContext &C) const
Returns the type of the this pointer.
Definition: DeclCXX.cpp:2138
bool UnwrapSimilarPointerTypes(QualType &T1, QualType &T2)
UnwrapSimilarPointerTypes - If T1 and T2 are pointer types that may be similar (C++ 4...
Forward-declares and imports various common LLVM datatypes that clang wants to use unqualified...
const SymIntExpr * getSymIntExpr(const SymExpr *lhs, BinaryOperator::Opcode op, const llvm::APSInt &rhs, QualType t)
bool isUnknown() const
Definition: SVals.h:137
DefinedOrUnknownSVal getRegionValueSymbolVal(const TypedValueRegion *region)
Make a unique symbol for value of region.
A record of the "type" of an APSInt, used for conversions.
Definition: APSIntType.h:20
NonLoc makeCompoundVal(QualType type, llvm::ImmutableList< SVal > vals)
Definition: SValBuilder.h:251
DefinedSVal getFunctionPointer(const FunctionDecl *func)
bool isConstant() const
Definition: SVals.cpp:218
const BlockCodeRegion * getBlockCodeRegion(const BlockDecl *BD, CanQualType locTy, AnalysisDeclContext *AC)
Definition: MemRegion.cpp:988
SymbolRef getAsSymbol(bool IncludeBaseRegions=false) const
If this SVal wraps a symbol return that SymbolRef.
Definition: SVals.cpp:127
Represents a ValueDecl that came out of a declarator.
Definition: Decl.h:688
nonloc::ConcreteInt makeBoolVal(const ObjCBoolLiteralExpr *boolean)
Definition: SValBuilder.h:285
ConditionTruthVal areEqual(ProgramStateRef state, SVal lhs, SVal rhs)
Loc makeLoc(SymbolRef sym)
Definition: SValBuilder.h:354
DefinedOrUnknownSVal makeZeroVal(QualType type)
Construct an SVal representing &#39;0&#39; for the specified type.
Definition: SValBuilder.cpp:51
Pepresents a block literal declaration, which is like an unnamed FunctionDecl.
Definition: Decl.h:3838
Expr - This represents one expression.
Definition: Expr.h:106
const FunctionProtoType * T
bool isNullPtrType() const
Definition: Type.h:6295
const QualType ArrayIndexTy
The scalar type to use for array indices.
Definition: SValBuilder.h:71
QualType getConditionType() const
Definition: SValBuilder.h:161
bool isAnyComplexType() const
Definition: Type.h:6130
QualType getType() const
Definition: Expr.h:128
virtual SVal evalBinOpLL(ProgramStateRef state, BinaryOperator::Opcode op, Loc lhs, Loc rhs, QualType resultTy)=0
Create a new value which represents a binary expression with two memory location operands.
SVal evalBinOp(ProgramStateRef state, BinaryOperator::Opcode op, SVal lhs, SVal rhs, QualType type)
void removeCVRQualifiers(unsigned mask)
Definition: Type.h:298
bool getValue() const
Definition: ExprCXX.h:543
Optional< T > getAs() const
Convert to the specified SVal type, returning None if this SVal is not of the desired type...
Definition: SVals.h:112
const SymbolCast * getCastSymbol(const SymExpr *Operand, QualType From, QualType To)
llvm::APSInt getMaxValue() const LLVM_READONLY
Returns the maximum value for this type.
Definition: APSIntType.h:66
const SymSymExpr * getSymSymExpr(const SymExpr *lhs, BinaryOperator::Opcode op, const SymExpr *rhs, QualType t)
QualType getCanonicalType() const
Definition: Type.h:5864
NullPointerConstantKind isNullPointerConstant(ASTContext &Ctx, NullPointerConstantValueDependence NPC) const
isNullPointerConstant - C99 6.3.2.3p3 - Test if this reduces down to a Null pointer constant...
Definition: Expr.cpp:3324
SymbolManager SymMgr
Manages the creation of symbols.
Definition: SValBuilder.h:63
DefinedOrUnknownSVal conjureSymbolVal(const void *symbolTag, const Expr *expr, const LocationContext *LCtx, unsigned count)
Create a new symbol with a unique &#39;name&#39;.
virtual SVal evalCastFromLoc(Loc val, QualType castTy)=0
const SymbolMetadata * getMetadataSymbol(const MemRegion *R, const Stmt *S, QualType T, const LocationContext *LCtx, unsigned VisitCount, const void *SymbolTag=nullptr)
Creates a metadata symbol associated with a specific region.
const MemRegion * getAsRegion() const
Definition: SVals.cpp:151
Represents a static or instance method of a struct/union/class.
Definition: DeclCXX.h:2031
ASTContext & getContext()
Definition: SValBuilder.h:156
const SymbolRegionValue * getRegionValueSymbol(const TypedValueRegion *R)
Make a unique symbol for MemRegion R according to its kind.
SVal - This represents a symbolic expression, which can be either an L-value or an R-value...
Definition: SVals.h:76
Specifies that a value-dependent expression should be considered to never be a null pointer constant...
Definition: Expr.h:713
static bool shouldBeModeledWithNoOp(ASTContext &Context, QualType ToTy, QualType FromTy)
Recursively check if the pointer types are equal modulo const, volatile, and restrict qualifiers...
DefinedOrUnknownSVal getConjuredHeapSymbolVal(const Expr *E, const LocationContext *LCtx, unsigned Count)
Conjure a symbol representing heap allocated memory region.
bool isVectorType() const
Definition: Type.h:6134
virtual SVal evalBinOpNN(ProgramStateRef state, BinaryOperator::Opcode op, NonLoc lhs, NonLoc rhs, QualType resultTy)=0
Create a new value which represents a binary expression with two non- location operands.
const unsigned ArrayIndexWidth
The width of the scalar type used for array indices.
Definition: SValBuilder.h:74
const SymbolicRegion * getSymbolicHeapRegion(SymbolRef sym)
Return a unique symbolic region belonging to heap memory space.
Definition: MemRegion.cpp:998
Dataflow Directional Tag Classes.
SVal ArrayToPointer(Loc Array, QualType ElementTy)
Definition: ProgramState.h:578
bool isZeroConstant() const
Definition: SVals.cpp:230
StmtClass getStmtClass() const
Definition: Stmt.h:389
bool isBooleanType() const
Definition: Type.h:6383
SVal evalEQ(ProgramStateRef state, SVal lhs, SVal rhs)
Represents symbolic expression.
Definition: SVals.h:347
unsigned computeComplexity() const
SVal convertToArrayIndex(SVal val)
Definition: SValBuilder.cpp:98
const SymbolConjured * conjureSymbol(const Stmt *E, const LocationContext *LCtx, QualType T, unsigned VisitCount, const void *SymbolTag=nullptr)
const FunctionCodeRegion * getFunctionCodeRegion(const NamedDecl *FD)
Definition: MemRegion.cpp:983
DefinedSVal getMetadataSymbolVal(const void *symbolTag, const MemRegion *region, const Expr *expr, QualType type, const LocationContext *LCtx, unsigned count)
T castAs() const
Convert to the specified SVal type, asserting that this SVal is of the desired type.
Definition: SVals.h:104
BasicValueFactory & getBasicValueFactory()
Definition: SValBuilder.h:169
DefinedSVal getMemberPointer(const DeclaratorDecl *DD)
bool isFunctionType() const
Definition: Type.h:6045
const SymExpr * getAsSymExpr() const
Definition: SVals.cpp:144
const BlockDataRegion * getBlockDataRegion(const BlockCodeRegion *bc, const LocationContext *lc, unsigned blockCount)
getBlockDataRegion - Get the memory region associated with an instance of a block.
Definition: MemRegion.cpp:911
CanQualType getCanonicalType(QualType T) const
Return the canonical (structural) type corresponding to the specified potentially non-canonical type ...
Definition: ASTContext.h:2207
Defines the C++ Decl subclasses, other than those for templates (found in DeclTemplate.h) and friends (in DeclFriend.h).
Represents a C++ struct/union/class.
Definition: DeclCXX.h:300
bool isVoidType() const
Definition: Type.h:6276
Optional< SVal > getConstantVal(const Expr *E)
Returns the value of E, if it can be determined in a non-path-sensitive manner.
QualType getPointerType(QualType T) const
Return the uniqued reference to the type for a pointer to the specified type.
bool isUndef() const
Definition: SVals.h:141
bool isPointerType() const
Definition: Type.h:6049
nonloc::ConcreteInt makeTruthVal(bool b, QualType type)
Definition: SValBuilder.h:335
A boolean literal, per ([C++ lex.bool] Boolean literals).
Definition: ExprCXX.h:530
AnalysisDeclContext * getAnalysisDeclContext() const
bool isFunctionPointerType() const
Definition: Type.h:6073
QualType getUnqualifiedArrayType(QualType T, Qualifiers &Quals)
Return this type as a completely-unqualified array type, capturing the qualifiers in Quals...
bool isUnknownOrUndef() const
Definition: SVals.h:145
llvm::ImmutableList< SVal > getEmptySValList()
Expr * IgnoreParens() LLVM_READONLY
IgnoreParens - Ignore parentheses.
Definition: Expr.cpp:2469