clang  6.0.0svn
Store.cpp
Go to the documentation of this file.
1 //== Store.cpp - Interface for maps from Locations to Values ----*- C++ -*--==//
2 //
3 // The LLVM Compiler Infrastructure
4 //
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
7 //
8 //===----------------------------------------------------------------------===//
9 //
10 // This file defined the types Store and StoreManager.
11 //
12 //===----------------------------------------------------------------------===//
13 
16 #include "clang/AST/CharUnits.h"
17 #include "clang/AST/DeclObjC.h"
20 
21 using namespace clang;
22 using namespace ento;
23 
25  : svalBuilder(stateMgr.getSValBuilder()), StateMgr(stateMgr),
26  MRMgr(svalBuilder.getRegionManager()), Ctx(stateMgr.getContext()) {}
27 
29  const CallEvent &Call,
30  const StackFrameContext *LCtx) {
31  StoreRef Store = StoreRef(OldStore, *this);
32 
34  Call.getInitialStackFrameContents(LCtx, InitialBindings);
35 
36  for (CallEvent::BindingsTy::iterator I = InitialBindings.begin(),
37  E = InitialBindings.end();
38  I != E; ++I) {
39  Store = Bind(Store.getStore(), I->first, I->second);
40  }
41 
42  return Store;
43 }
44 
46  QualType EleTy,
47  uint64_t index) {
48  NonLoc idx = svalBuilder.makeArrayIndex(index);
49  return MRMgr.getElementRegion(EleTy, idx, Base, svalBuilder.getContext());
50 }
51 
53  return StoreRef(store, *this);
54 }
55 
57  QualType T) {
59  assert(!T.isNull());
60  return MRMgr.getElementRegion(T, idx, R, Ctx);
61 }
62 
64 
66 
67  // Handle casts to Objective-C objects.
68  if (CastToTy->isObjCObjectPointerType())
69  return R->StripCasts();
70 
71  if (CastToTy->isBlockPointerType()) {
72  // FIXME: We may need different solutions, depending on the symbol
73  // involved. Blocks can be casted to/from 'id', as they can be treated
74  // as Objective-C objects. This could possibly be handled by enhancing
75  // our reasoning of downcasts of symbolic objects.
76  if (isa<CodeTextRegion>(R) || isa<SymbolicRegion>(R))
77  return R;
78 
79  // We don't know what to make of it. Return a NULL region, which
80  // will be interpretted as UnknownVal.
81  return nullptr;
82  }
83 
84  // Now assume we are casting from pointer to pointer. Other cases should
85  // already be handled.
86  QualType PointeeTy = CastToTy->getPointeeType();
87  QualType CanonPointeeTy = Ctx.getCanonicalType(PointeeTy);
88 
89  // Handle casts to void*. We just pass the region through.
90  if (CanonPointeeTy.getLocalUnqualifiedType() == Ctx.VoidTy)
91  return R;
92 
93  // Handle casts from compatible types.
94  if (R->isBoundable())
95  if (const TypedValueRegion *TR = dyn_cast<TypedValueRegion>(R)) {
96  QualType ObjTy = Ctx.getCanonicalType(TR->getValueType());
97  if (CanonPointeeTy == ObjTy)
98  return R;
99  }
100 
101  // Process region cast according to the kind of the region being cast.
102  switch (R->getKind()) {
103  case MemRegion::CXXThisRegionKind:
104  case MemRegion::CodeSpaceRegionKind:
105  case MemRegion::StackLocalsSpaceRegionKind:
106  case MemRegion::StackArgumentsSpaceRegionKind:
107  case MemRegion::HeapSpaceRegionKind:
108  case MemRegion::UnknownSpaceRegionKind:
109  case MemRegion::StaticGlobalSpaceRegionKind:
110  case MemRegion::GlobalInternalSpaceRegionKind:
111  case MemRegion::GlobalSystemSpaceRegionKind:
112  case MemRegion::GlobalImmutableSpaceRegionKind: {
113  llvm_unreachable("Invalid region cast");
114  }
115 
116  case MemRegion::FunctionCodeRegionKind:
117  case MemRegion::BlockCodeRegionKind:
118  case MemRegion::BlockDataRegionKind:
119  case MemRegion::StringRegionKind:
120  // FIXME: Need to handle arbitrary downcasts.
121  case MemRegion::SymbolicRegionKind:
122  case MemRegion::AllocaRegionKind:
123  case MemRegion::CompoundLiteralRegionKind:
124  case MemRegion::FieldRegionKind:
125  case MemRegion::ObjCIvarRegionKind:
126  case MemRegion::ObjCStringRegionKind:
127  case MemRegion::VarRegionKind:
128  case MemRegion::CXXTempObjectRegionKind:
129  case MemRegion::CXXBaseObjectRegionKind:
130  return MakeElementRegion(cast<SubRegion>(R), PointeeTy);
131 
132  case MemRegion::ElementRegionKind: {
133  // If we are casting from an ElementRegion to another type, the
134  // algorithm is as follows:
135  //
136  // (1) Compute the "raw offset" of the ElementRegion from the
137  // base region. This is done by calling 'getAsRawOffset()'.
138  //
139  // (2a) If we get a 'RegionRawOffset' after calling
140  // 'getAsRawOffset()', determine if the absolute offset
141  // can be exactly divided into chunks of the size of the
142  // casted-pointee type. If so, create a new ElementRegion with
143  // the pointee-cast type as the new ElementType and the index
144  // being the offset divded by the chunk size. If not, create
145  // a new ElementRegion at offset 0 off the raw offset region.
146  //
147  // (2b) If we don't a get a 'RegionRawOffset' after calling
148  // 'getAsRawOffset()', it means that we are at offset 0.
149  //
150  // FIXME: Handle symbolic raw offsets.
151 
152  const ElementRegion *elementR = cast<ElementRegion>(R);
153  const RegionRawOffset &rawOff = elementR->getAsArrayOffset();
154  const MemRegion *baseR = rawOff.getRegion();
155 
156  // If we cannot compute a raw offset, throw up our hands and return
157  // a NULL MemRegion*.
158  if (!baseR)
159  return nullptr;
160 
161  CharUnits off = rawOff.getOffset();
162 
163  if (off.isZero()) {
164  // Edge case: we are at 0 bytes off the beginning of baseR. We
165  // check to see if type we are casting to is the same as the base
166  // region. If so, just return the base region.
167  if (const TypedValueRegion *TR = dyn_cast<TypedValueRegion>(baseR)) {
168  QualType ObjTy = Ctx.getCanonicalType(TR->getValueType());
169  QualType CanonPointeeTy = Ctx.getCanonicalType(PointeeTy);
170  if (CanonPointeeTy == ObjTy)
171  return baseR;
172  }
173 
174  // Otherwise, create a new ElementRegion at offset 0.
175  return MakeElementRegion(cast<SubRegion>(baseR), PointeeTy);
176  }
177 
178  // We have a non-zero offset from the base region. We want to determine
179  // if the offset can be evenly divided by sizeof(PointeeTy). If so,
180  // we create an ElementRegion whose index is that value. Otherwise, we
181  // create two ElementRegions, one that reflects a raw offset and the other
182  // that reflects the cast.
183 
184  // Compute the index for the new ElementRegion.
185  int64_t newIndex = 0;
186  const MemRegion *newSuperR = nullptr;
187 
188  // We can only compute sizeof(PointeeTy) if it is a complete type.
189  if (!PointeeTy->isIncompleteType()) {
190  // Compute the size in **bytes**.
191  CharUnits pointeeTySize = Ctx.getTypeSizeInChars(PointeeTy);
192  if (!pointeeTySize.isZero()) {
193  // Is the offset a multiple of the size? If so, we can layer the
194  // ElementRegion (with elementType == PointeeTy) directly on top of
195  // the base region.
196  if (off % pointeeTySize == 0) {
197  newIndex = off / pointeeTySize;
198  newSuperR = baseR;
199  }
200  }
201  }
202 
203  if (!newSuperR) {
204  // Create an intermediate ElementRegion to represent the raw byte.
205  // This will be the super region of the final ElementRegion.
206  newSuperR = MakeElementRegion(cast<SubRegion>(baseR), Ctx.CharTy,
207  off.getQuantity());
208  }
209 
210  return MakeElementRegion(cast<SubRegion>(newSuperR), PointeeTy, newIndex);
211  }
212  }
213 
214  llvm_unreachable("unreachable");
215 }
216 
218  const MemRegion *MR = V.getAsRegion();
219  if (!MR)
220  return true;
221 
222  const TypedValueRegion *TVR = dyn_cast<TypedValueRegion>(MR);
223  if (!TVR)
224  return true;
225 
226  const CXXRecordDecl *RD = TVR->getValueType()->getAsCXXRecordDecl();
227  if (!RD)
228  return true;
229 
231  if (!Expected)
232  Expected = Ty->getAsCXXRecordDecl();
233 
234  return Expected->getCanonicalDecl() == RD->getCanonicalDecl();
235 }
236 
238  // Sanity check to avoid doing the wrong thing in the face of
239  // reinterpret_cast.
240  if (!regionMatchesCXXRecordType(Derived, Cast->getSubExpr()->getType()))
241  return UnknownVal();
242 
243  // Walk through the cast path to create nested CXXBaseRegions.
244  SVal Result = Derived;
245  for (CastExpr::path_const_iterator I = Cast->path_begin(),
246  E = Cast->path_end();
247  I != E; ++I) {
248  Result = evalDerivedToBase(Result, (*I)->getType(), (*I)->isVirtual());
249  }
250  return Result;
251 }
252 
254  // Walk through the path to create nested CXXBaseRegions.
255  SVal Result = Derived;
256  for (CXXBasePath::const_iterator I = Path.begin(), E = Path.end();
257  I != E; ++I) {
258  Result = evalDerivedToBase(Result, I->Base->getType(),
259  I->Base->isVirtual());
260  }
261  return Result;
262 }
263 
265  bool IsVirtual) {
266  Optional<loc::MemRegionVal> DerivedRegVal =
267  Derived.getAs<loc::MemRegionVal>();
268  if (!DerivedRegVal)
269  return Derived;
270 
271  const CXXRecordDecl *BaseDecl = BaseType->getPointeeCXXRecordDecl();
272  if (!BaseDecl)
273  BaseDecl = BaseType->getAsCXXRecordDecl();
274  assert(BaseDecl && "not a C++ object?");
275 
276  const MemRegion *BaseReg = MRMgr.getCXXBaseObjectRegion(
277  BaseDecl, cast<SubRegion>(DerivedRegVal->getRegion()), IsVirtual);
278 
279  return loc::MemRegionVal(BaseReg);
280 }
281 
282 /// Returns the static type of the given region, if it represents a C++ class
283 /// object.
284 ///
285 /// This handles both fully-typed regions, where the dynamic type is known, and
286 /// symbolic regions, where the dynamic type is merely bounded (and even then,
287 /// only ostensibly!), but does not take advantage of any dynamic type info.
288 static const CXXRecordDecl *getCXXRecordType(const MemRegion *MR) {
289  if (const TypedValueRegion *TVR = dyn_cast<TypedValueRegion>(MR))
290  return TVR->getValueType()->getAsCXXRecordDecl();
291  if (const SymbolicRegion *SR = dyn_cast<SymbolicRegion>(MR))
292  return SR->getSymbol()->getType()->getPointeeCXXRecordDecl();
293  return nullptr;
294 }
295 
297  bool &Failed) {
298  Failed = false;
299 
300  const MemRegion *MR = Base.getAsRegion();
301  if (!MR)
302  return UnknownVal();
303 
304  // Assume the derived class is a pointer or a reference to a CXX record.
305  TargetType = TargetType->getPointeeType();
306  assert(!TargetType.isNull());
307  const CXXRecordDecl *TargetClass = TargetType->getAsCXXRecordDecl();
308  if (!TargetClass && !TargetType->isVoidType())
309  return UnknownVal();
310 
311  // Drill down the CXXBaseObject chains, which represent upcasts (casts from
312  // derived to base).
313  while (const CXXRecordDecl *MRClass = getCXXRecordType(MR)) {
314  // If found the derived class, the cast succeeds.
315  if (MRClass == TargetClass)
316  return loc::MemRegionVal(MR);
317 
318  // We skip over incomplete types. They must be the result of an earlier
319  // reinterpret_cast, as one can only dynamic_cast between types in the same
320  // class hierarchy.
321  if (!TargetType->isVoidType() && MRClass->hasDefinition()) {
322  // Static upcasts are marked as DerivedToBase casts by Sema, so this will
323  // only happen when multiple or virtual inheritance is involved.
324  CXXBasePaths Paths(/*FindAmbiguities=*/false, /*RecordPaths=*/true,
325  /*DetectVirtual=*/false);
326  if (MRClass->isDerivedFrom(TargetClass, Paths))
327  return evalDerivedToBase(loc::MemRegionVal(MR), Paths.front());
328  }
329 
330  if (const CXXBaseObjectRegion *BaseR = dyn_cast<CXXBaseObjectRegion>(MR)) {
331  // Drill down the chain to get the derived classes.
332  MR = BaseR->getSuperRegion();
333  continue;
334  }
335 
336  // If this is a cast to void*, return the region.
337  if (TargetType->isVoidType())
338  return loc::MemRegionVal(MR);
339 
340  // Strange use of reinterpret_cast can give us paths we don't reason
341  // about well, by putting in ElementRegions where we'd expect
342  // CXXBaseObjectRegions. If it's a valid reinterpret_cast (i.e. if the
343  // derived class has a zero offset from the base class), then it's safe
344  // to strip the cast; if it's invalid, -Wreinterpret-base-class should
345  // catch it. In the interest of performance, the analyzer will silently
346  // do the wrong thing in the invalid case (because offsets for subregions
347  // will be wrong).
348  const MemRegion *Uncasted = MR->StripCasts(/*IncludeBaseCasts=*/false);
349  if (Uncasted == MR) {
350  // We reached the bottom of the hierarchy and did not find the derived
351  // class. We we must be casting the base to derived, so the cast should
352  // fail.
353  break;
354  }
355 
356  MR = Uncasted;
357  }
358 
359  // We failed if the region we ended up with has perfect type info.
360  Failed = isa<TypedValueRegion>(MR);
361  return UnknownVal();
362 }
363 
364 
365 /// CastRetrievedVal - Used by subclasses of StoreManager to implement
366 /// implicit casts that arise from loads from regions that are reinterpreted
367 /// as another region.
369  QualType castTy, bool performTestOnly) {
370 
371  if (castTy.isNull() || V.isUnknownOrUndef())
372  return V;
373 
375 
376  if (performTestOnly) {
377  // Automatically translate references to pointers.
378  QualType T = R->getValueType();
379  if (const ReferenceType *RT = T->getAs<ReferenceType>())
380  T = Ctx.getPointerType(RT->getPointeeType());
381 
382  assert(svalBuilder.getContext().hasSameUnqualifiedType(castTy, T));
383  return V;
384  }
385 
386  return svalBuilder.dispatchCast(V, castTy);
387 }
388 
389 SVal StoreManager::getLValueFieldOrIvar(const Decl *D, SVal Base) {
390  if (Base.isUnknownOrUndef())
391  return Base;
392 
393  Loc BaseL = Base.castAs<Loc>();
394  const SubRegion* BaseR = nullptr;
395 
396  switch (BaseL.getSubKind()) {
397  case loc::MemRegionValKind:
398  BaseR = cast<SubRegion>(BaseL.castAs<loc::MemRegionVal>().getRegion());
399  break;
400 
401  case loc::GotoLabelKind:
402  // These are anormal cases. Flag an undefined value.
403  return UndefinedVal();
404 
405  case loc::ConcreteIntKind:
406  // While these seem funny, this can happen through casts.
407  // FIXME: What we should return is the field offset, not base. For example,
408  // add the field offset to the integer value. That way things
409  // like this work properly: &(((struct foo *) 0xa)->f)
410  // However, that's not easy to fix without reducing our abilities
411  // to catch null pointer dereference. Eg., ((struct foo *)0x0)->f = 7
412  // is a null dereference even though we're dereferencing offset of f
413  // rather than null. Coming up with an approach that computes offsets
414  // over null pointers properly while still being able to catch null
415  // dereferences might be worth it.
416  return Base;
417 
418  default:
419  llvm_unreachable("Unhandled Base.");
420  }
421 
422  // NOTE: We must have this check first because ObjCIvarDecl is a subclass
423  // of FieldDecl.
424  if (const ObjCIvarDecl *ID = dyn_cast<ObjCIvarDecl>(D))
426 
427  return loc::MemRegionVal(MRMgr.getFieldRegion(cast<FieldDecl>(D), BaseR));
428 }
429 
431  return getLValueFieldOrIvar(decl, base);
432 }
433 
435  SVal Base) {
436 
437  // If the base is an unknown or undefined value, just return it back.
438  // FIXME: For absolute pointer addresses, we just return that value back as
439  // well, although in reality we should return the offset added to that
440  // value. See also the similar FIXME in getLValueFieldOrIvar().
441  if (Base.isUnknownOrUndef() || Base.getAs<loc::ConcreteInt>())
442  return Base;
443 
444  const SubRegion *BaseRegion =
445  Base.castAs<loc::MemRegionVal>().getRegionAs<SubRegion>();
446 
447  // Pointer of any type can be cast and used as array base.
448  const ElementRegion *ElemR = dyn_cast<ElementRegion>(BaseRegion);
449 
450  // Convert the offset to the appropriate size and signedness.
451  Offset = svalBuilder.convertToArrayIndex(Offset).castAs<NonLoc>();
452 
453  if (!ElemR) {
454  //
455  // If the base region is not an ElementRegion, create one.
456  // This can happen in the following example:
457  //
458  // char *p = __builtin_alloc(10);
459  // p[1] = 8;
460  //
461  // Observe that 'p' binds to an AllocaRegion.
462  //
463  return loc::MemRegionVal(MRMgr.getElementRegion(elementType, Offset,
464  BaseRegion, Ctx));
465  }
466 
467  SVal BaseIdx = ElemR->getIndex();
468 
469  if (!BaseIdx.getAs<nonloc::ConcreteInt>())
470  return UnknownVal();
471 
472  const llvm::APSInt &BaseIdxI =
473  BaseIdx.castAs<nonloc::ConcreteInt>().getValue();
474 
475  // Only allow non-integer offsets if the base region has no offset itself.
476  // FIXME: This is a somewhat arbitrary restriction. We should be using
477  // SValBuilder here to add the two offsets without checking their types.
478  if (!Offset.getAs<nonloc::ConcreteInt>()) {
479  if (isa<ElementRegion>(BaseRegion->StripCasts()))
480  return UnknownVal();
481 
483  elementType, Offset, cast<SubRegion>(ElemR->getSuperRegion()), Ctx));
484  }
485 
486  const llvm::APSInt& OffI = Offset.castAs<nonloc::ConcreteInt>().getValue();
487  assert(BaseIdxI.isSigned());
488 
489  // Compute the new index.
490  nonloc::ConcreteInt NewIdx(svalBuilder.getBasicValueFactory().getValue(BaseIdxI +
491  OffI));
492 
493  // Construct the new ElementRegion.
494  const SubRegion *ArrayR = cast<SubRegion>(ElemR->getSuperRegion());
495  return loc::MemRegionVal(MRMgr.getElementRegion(elementType, NewIdx, ArrayR,
496  Ctx));
497 }
498 
500 
502  Store store,
503  const MemRegion* R,
504  SVal val) {
505  SymbolRef SymV = val.getAsLocSymbol();
506  if (!SymV || SymV != Sym)
507  return true;
508 
509  if (Binding) {
510  First = false;
511  return false;
512  }
513  else
514  Binding = R;
515 
516  return true;
517 }
SVal attemptDownCast(SVal Base, QualType DerivedPtrType, bool &Failed)
Attempts to do a down cast.
Definition: Store.cpp:296
TypedValueRegion - An abstract class representing regions having a typed value.
Definition: MemRegion.h:511
SVal evalDerivedToBase(SVal Derived, const CastExpr *Cast)
Evaluates a chain of derived-to-base casts through the path specified in Cast.
Definition: Store.cpp:237
A (possibly-)qualified type.
Definition: Type.h:614
MemRegion - The root abstract class for all memory regions.
Definition: MemRegion.h:79
bool isBlockPointerType() const
Definition: Type.h:5772
Store getStore() const
Definition: StoreRef.h:46
NonLoc getIndex() const
Definition: MemRegion.h:1085
QualType getPointeeType() const
If this is a pointer, ObjC object pointer, or block pointer, this returns the respective pointee...
Definition: Type.cpp:435
Decl - This represents one declaration (or definition), e.g.
Definition: DeclBase.h:81
virtual QualType getValueType() const =0
const void * Store
Store - This opaque type encapsulates an immutable mapping from locations to values.
Definition: StoreRef.h:26
bool isZero() const
isZero - Test whether the quantity equals zero.
Definition: CharUnits.h:116
Represents a path from a specific derived class (which is not represented as part of the path) to a p...
Value representing integer constant.
Definition: SVals.h:352
const ObjCIvarRegion * getObjCIvarRegion(const ObjCIvarDecl *ivd, const SubRegion *superRegion)
getObjCIvarRegion - Retrieve or create the memory region associated with a specified Objective-c inst...
Definition: MemRegion.cpp:972
const CXXBaseSpecifier *const * path_const_iterator
Definition: Expr.h:2775
SymbolRef getAsLocSymbol(bool IncludeBaseRegions=false) const
If this SVal is a location and wraps a symbol, return that SymbolRef.
Definition: SVals.cpp:74
const T * getAs() const
Member-template getAs<specific type>&#39;.
Definition: Type.h:6099
virtual SVal dispatchCast(SVal val, QualType castTy)=0
NonLoc makeArrayIndex(uint64_t idx)
Definition: SValBuilder.h:248
const ElementRegion * GetElementZeroRegion(const SubRegion *R, QualType T)
Definition: Store.cpp:56
QualType getLocalUnqualifiedType() const
Return this type with all of the instance-specific qualifiers removed, but without removing any quali...
Definition: Type.h:847
const MemRegion * castRegion(const MemRegion *region, QualType CastToTy)
castRegion - Used by ExprEngine::VisitCast to handle casts from a MemRegion* to a specific location t...
Definition: Store.cpp:63
ASTContext & Ctx
Definition: Store.h:46
Symbolic value.
Definition: SymExpr.h:29
const MemRegion * getSuperRegion() const
Definition: MemRegion.h:430
bool HandleBinding(StoreManager &SMgr, Store store, const MemRegion *R, SVal val) override
Definition: Store.cpp:501
Holds long-lived AST nodes (such as types and decls) that can be referred to throughout the semantic ...
Definition: ASTContext.h:128
static bool regionMatchesCXXRecordType(SVal V, QualType Ty)
Definition: Store.cpp:217
const internal::VariadicAllOfMatcher< Decl > decl
Matches declarations.
Definition: ASTMatchers.h:281
Expr * getSubExpr()
Definition: Expr.h:2762
CharUnits - This is an opaque type for sizes expressed in character units.
Definition: CharUnits.h:38
uint32_t Offset
Definition: CacheTokens.cpp:43
path_iterator path_begin()
Definition: Expr.h:2778
CXXRecordDecl * getCanonicalDecl() override
Retrieves the "canonical" declaration of the given declaration.
Definition: DeclCXX.h:670
CastExpr - Base class for type casts, including both implicit casts (ImplicitCastExpr) and explicit c...
Definition: Expr.h:2710
StoreRef enterStackFrame(Store store, const CallEvent &Call, const StackFrameContext *CalleeCtx)
enterStackFrame - Let the StoreManager to do something when execution engine is about to execute into...
Definition: Store.cpp:28
virtual SVal getLValueIvar(const ObjCIvarDecl *decl, SVal base)
Definition: Store.cpp:430
CXXRecordDecl * getAsCXXRecordDecl() const
Retrieves the CXXRecordDecl that this type refers to, either because the type is a RecordType or beca...
Definition: Type.cpp:1569
unsigned getSubKind() const
Definition: SVals.h:111
QuantityType getQuantity() const
getQuantity - Get the raw integer representation of this quantity.
Definition: CharUnits.h:179
SymbolicRegion - A special, "non-concrete" region.
Definition: MemRegion.h:742
const FunctionProtoType * T
SValBuilder & svalBuilder
Definition: Store.h:41
const CXXRecordDecl * getPointeeCXXRecordDecl() const
If this is a pointer or reference to a RecordType, return the CXXRecordDecl that that type refers to...
Definition: Type.cpp:1554
static SVal getValue(SVal val, SValBuilder &svalBuilder)
QualType getType() const
Definition: Expr.h:128
ProgramStateManager & StateMgr
Definition: Store.h:42
virtual StoreRef Bind(Store store, Loc loc, SVal val)=0
Return a store with the specified value bound to the given location.
bool isNull() const
Return true if this QualType doesn&#39;t point to a type yet.
Definition: Type.h:681
Optional< T > getAs() const
Convert to the specified SVal type, returning None if this SVal is not of the desired type...
Definition: SVals.h:100
virtual bool isBoundable() const
Definition: MemRegion.h:152
const MemRegion * StripCasts(bool StripBaseCasts=true) const
Definition: MemRegion.cpp:1117
Kind getKind() const
Definition: MemRegion.h:148
virtual void getInitialStackFrameContents(const StackFrameContext *CalleeCtx, BindingsTy &Bindings) const =0
Populates the given SmallVector with the bindings in the callee&#39;s stack frame at the start of this ca...
const MemRegion * getAsRegion() const
Definition: SVals.cpp:140
SVal CastRetrievedVal(SVal val, const TypedValueRegion *region, QualType castTy, bool performTestOnly=true)
CastRetrievedVal - Used by subclasses of StoreManager to implement implicit casts that arise from loa...
Definition: Store.cpp:368
ASTContext & getContext()
Definition: SValBuilder.h:131
SVal - This represents a symbolic expression, which can be either an L-value or an R-value...
Definition: SVals.h:63
CanQualType VoidTy
Definition: ASTContext.h:965
bool isObjCObjectPointerType() const
Definition: Type.h:5841
RegionRawOffset getAsArrayOffset() const
Compute the offset within the array. The array might also be a subobject.
Definition: MemRegion.cpp:1150
bool hasSameUnqualifiedType(QualType T1, QualType T2) const
Determine whether the given types are equivalent after cvr-qualifiers have been removed.
Definition: ASTContext.h:2165
const CXXBaseObjectRegion * getCXXBaseObjectRegion(const CXXRecordDecl *BaseClass, const SubRegion *Super, bool IsVirtual)
Create a CXXBaseObjectRegion with the given base class for region Super.
Definition: MemRegion.cpp:1008
CanQualType CharTy
Definition: ASTContext.h:967
Dataflow Directional Tag Classes.
const ElementRegion * getElementRegion(QualType elementType, NonLoc Idx, const SubRegion *superRegion, ASTContext &Ctx)
getElementRegion - Retrieve the memory region associated with the associated element type...
Definition: MemRegion.cpp:923
Represents an abstract call to a function or method along a particular path.
Definition: CallEvent.h:140
SVal convertToArrayIndex(SVal val)
Definition: SValBuilder.cpp:79
path_iterator path_end()
Definition: Expr.h:2779
T castAs() const
Convert to the specified SVal type, asserting that this SVal is of the desired type.
Definition: SVals.h:92
BasicValueFactory & getBasicValueFactory()
Definition: SValBuilder.h:144
SubRegion - A region that subsets another larger region.
Definition: MemRegion.h:419
const ElementRegion * MakeElementRegion(const SubRegion *baseRegion, QualType pointeeTy, uint64_t index=0)
Definition: Store.cpp:45
CXXBasePath & front()
Base for LValueReferenceType and RValueReferenceType.
Definition: Type.h:2358
MemRegionManager & MRMgr
MRMgr - Manages region objects associated with this StoreManager.
Definition: Store.h:45
bool isIncompleteType(NamedDecl **Def=nullptr) const
Types are partitioned into 3 broad categories (C99 6.2.5p1): object types, function types...
Definition: Type.cpp:1951
virtual SVal getLValueElement(QualType elementType, NonLoc offset, SVal Base)
Definition: Store.cpp:434
CanQualType getCanonicalType(QualType T) const
Return the canonical (structural) type corresponding to the specified potentially non-canonical type ...
Definition: ASTContext.h:2124
static const CXXRecordDecl * getCXXRecordType(const MemRegion *MR)
Returns the static type of the given region, if it represents a C++ class object. ...
Definition: Store.cpp:288
Represents a C++ struct/union/class.
Definition: DeclCXX.h:266
bool isVoidType() const
Definition: Type.h:5963
ObjCIvarDecl - Represents an ObjC instance variable.
Definition: DeclObjC.h:1866
QualType getPointerType(QualType T) const
Return the uniqued reference to the type for a pointer to the specified type.
virtual StoreRef BindDefault(Store store, const MemRegion *R, SVal V)
Definition: Store.cpp:52
ElementRegin is used to represent both array elements and casts.
Definition: MemRegion.h:1066
BasePaths - Represents the set of paths from a derived class to one of its (direct or indirect) bases...
CharUnits getTypeSizeInChars(QualType T) const
Return the size of the specified (complete) type T, in characters.
StoreManager(ProgramStateManager &stateMgr)
Definition: Store.cpp:24
const FieldRegion * getFieldRegion(const FieldDecl *fd, const SubRegion *superRegion)
getFieldRegion - Retrieve or create the memory region associated with a specified FieldDecl...
Definition: MemRegion.cpp:966
bool isUnknownOrUndef() const
Definition: SVals.h:136