clang  8.0.0svn
SubEngine.h
Go to the documentation of this file.
1 //== SubEngine.h - Interface of the subengine of CoreEngine --------*- C++ -*-//
2 //
3 // The LLVM Compiler Infrastructure
4 //
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
7 //
8 //===----------------------------------------------------------------------===//
9 //
10 // This file defines the interface of a subengine of the CoreEngine.
11 //
12 //===----------------------------------------------------------------------===//
13 #ifndef LLVM_CLANG_STATICANALYZER_CORE_PATHSENSITIVE_SUBENGINE_H
14 #define LLVM_CLANG_STATICANALYZER_CORE_PATHSENSITIVE_SUBENGINE_H
15 
19 
20 namespace clang {
21 
22 class CFGBlock;
23 class CFGElement;
24 class LocationContext;
25 class Stmt;
26 
27 namespace cross_tu {
28 class CrossTranslationUnitContext;
29 }
30 
31 namespace ento {
32 
33 struct NodeBuilderContext;
34 class AnalysisManager;
35 class ExplodedNodeSet;
36 class ExplodedNode;
37 class ProgramState;
38 class ProgramStateManager;
39 class BlockCounter;
40 class BranchNodeBuilder;
41 class IndirectGotoNodeBuilder;
42 class SwitchNodeBuilder;
43 class EndOfFunctionNodeBuilder;
44 class NodeBuilderWithSinks;
45 class MemRegion;
46 
47 class SubEngine {
48  virtual void anchor();
49 public:
50  virtual ~SubEngine() {}
51 
52  virtual ProgramStateRef getInitialState(const LocationContext *InitLoc) = 0;
53 
54  virtual AnalysisManager &getAnalysisManager() = 0;
55 
57  getCrossTranslationUnitContext() = 0;
58 
59  virtual ProgramStateManager &getStateManager() = 0;
60 
61  /// Called by CoreEngine. Used to generate new successor
62  /// nodes by processing the 'effects' of a block-level statement.
63  virtual void processCFGElement(const CFGElement E, ExplodedNode* Pred,
64  unsigned StmtIdx, NodeBuilderContext *Ctx)=0;
65 
66  /// Called by CoreEngine when it starts processing a CFGBlock. The
67  /// SubEngine is expected to populate dstNodes with new nodes representing
68  /// updated analysis state, or generate no nodes at all if it doesn't.
69  virtual void processCFGBlockEntrance(const BlockEdge &L,
70  NodeBuilderWithSinks &nodeBuilder,
71  ExplodedNode *Pred) = 0;
72 
73  /// Called by CoreEngine. Used to generate successor
74  /// nodes by processing the 'effects' of a branch condition.
75  virtual void processBranch(const Stmt *Condition,
76  NodeBuilderContext& BuilderCtx,
77  ExplodedNode *Pred,
78  ExplodedNodeSet &Dst,
79  const CFGBlock *DstT,
80  const CFGBlock *DstF) = 0;
81 
82  /// Called by CoreEngine.
83  /// Used to generate successor nodes for temporary destructors depending
84  /// on whether the corresponding constructor was visited.
85  virtual void processCleanupTemporaryBranch(const CXXBindTemporaryExpr *BTE,
86  NodeBuilderContext &BldCtx,
87  ExplodedNode *Pred,
88  ExplodedNodeSet &Dst,
89  const CFGBlock *DstT,
90  const CFGBlock *DstF) = 0;
91 
92  /// Called by CoreEngine. Used to processing branching behavior
93  /// at static initializers.
94  virtual void processStaticInitializer(const DeclStmt *DS,
95  NodeBuilderContext& BuilderCtx,
96  ExplodedNode *Pred,
97  ExplodedNodeSet &Dst,
98  const CFGBlock *DstT,
99  const CFGBlock *DstF) = 0;
100 
101  /// Called by CoreEngine. Used to generate successor
102  /// nodes by processing the 'effects' of a computed goto jump.
103  virtual void processIndirectGoto(IndirectGotoNodeBuilder& builder) = 0;
104 
105  /// Called by CoreEngine. Used to generate successor
106  /// nodes by processing the 'effects' of a switch statement.
107  virtual void processSwitch(SwitchNodeBuilder& builder) = 0;
108 
109  /// Called by CoreEngine. Used to notify checkers that processing a
110  /// function has begun. Called for both inlined and and top-level functions.
111  virtual void processBeginOfFunction(NodeBuilderContext &BC,
112  ExplodedNode *Pred,
113  ExplodedNodeSet &Dst,
114  const BlockEdge &L) = 0;
115 
116  /// Called by CoreEngine. Used to notify checkers that processing a
117  /// function has ended. Called for both inlined and and top-level functions.
118  virtual void processEndOfFunction(NodeBuilderContext& BC,
119  ExplodedNode *Pred,
120  const ReturnStmt *RS = nullptr) = 0;
121 
122  // Generate the entry node of the callee.
123  virtual void processCallEnter(NodeBuilderContext& BC, CallEnter CE,
124  ExplodedNode *Pred) = 0;
125 
126  // Generate the first post callsite node.
127  virtual void processCallExit(ExplodedNode *Pred) = 0;
128 
129  /// Called by ConstraintManager. Used to call checker-specific
130  /// logic for handling assumptions on symbolic values.
131  virtual ProgramStateRef processAssume(ProgramStateRef state,
132  SVal cond, bool assumption) = 0;
133 
134  /// processRegionChanges - Called by ProgramStateManager whenever a change is
135  /// made to the store. Used to update checkers that track region values.
136  virtual ProgramStateRef
137  processRegionChanges(ProgramStateRef state,
138  const InvalidatedSymbols *invalidated,
139  ArrayRef<const MemRegion *> ExplicitRegions,
141  const LocationContext *LCtx,
142  const CallEvent *Call) = 0;
143 
144 
145  inline ProgramStateRef
147  const MemRegion* MR,
148  const LocationContext *LCtx) {
149  return processRegionChanges(state, nullptr, MR, MR, LCtx, nullptr);
150  }
151 
152  virtual ProgramStateRef
153  processPointerEscapedOnBind(ProgramStateRef State, SVal Loc, SVal Val, const LocationContext *LCtx) = 0;
154 
155  virtual ProgramStateRef
156  notifyCheckersOfPointerEscape(ProgramStateRef State,
157  const InvalidatedSymbols *Invalidated,
158  ArrayRef<const MemRegion *> ExplicitRegions,
159  const CallEvent *Call,
160  RegionAndSymbolInvalidationTraits &HTraits) = 0;
161 
162  /// printState - Called by ProgramStateManager to print checker-specific data.
163  virtual void printState(raw_ostream &Out, ProgramStateRef State,
164  const char *NL, const char *Sep,
165  const LocationContext *LCtx = nullptr) = 0;
166 
167  /// Called by CoreEngine when the analysis worklist is either empty or the
168  // maximum number of analysis steps have been reached.
169  virtual void processEndWorklist() = 0;
170 };
171 
172 } // end GR namespace
173 
174 } // end clang namespace
175 
176 #endif
ProgramStateRef processRegionChange(ProgramStateRef state, const MemRegion *MR, const LocationContext *LCtx)
Definition: SubEngine.h:146
MemRegion - The root abstract class for all memory regions.
Definition: MemRegion.h:94
Stmt - This represents one statement.
Definition: Stmt.h:66
Information about invalidation for a particular region/symbol.
Definition: MemRegion.h:1438
Represents a point when we begin processing an inlined call.
Definition: ProgramPoint.h:632
LineState State
i32 captured_struct **param SharedsTy A type which contains references the shared variables *param Shareds Context with the list of shared variables from the p *TaskFunction *param Data Additional data for task generation like final * state
Represents binding an expression to a temporary.
Definition: ExprCXX.h:1217
Represents a single basic block in a source-level CFG.
Definition: CFG.h:552
ReturnStmt - This represents a return, optionally of an expression: return; return 4;...
Definition: Stmt.h:1444
DeclStmt - Adaptor class for mixing declarations with statements and expressions. ...
Definition: Stmt.h:505
SVal - This represents a symbolic expression, which can be either an L-value or an R-value...
Definition: SVals.h:76
Dataflow Directional Tag Classes.
This node builder keeps track of the generated sink nodes.
Definition: CoreEngine.h:333
Represents an abstract call to a function or method along a particular path.
Definition: CallEvent.h:171
This class is used for tools that requires cross translation unit capability.
Represents a top-level expression in a basic block.
Definition: CFG.h:56
virtual ~SubEngine()
Definition: SubEngine.h:50