clang  10.0.0svn
SubEngine.h
Go to the documentation of this file.
1 //== SubEngine.h - Interface of the subengine of CoreEngine --------*- C++ -*-//
2 //
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6 //
7 //===----------------------------------------------------------------------===//
8 //
9 // This file defines the interface of a subengine of the CoreEngine.
10 //
11 //===----------------------------------------------------------------------===//
12 #ifndef LLVM_CLANG_STATICANALYZER_CORE_PATHSENSITIVE_SUBENGINE_H
13 #define LLVM_CLANG_STATICANALYZER_CORE_PATHSENSITIVE_SUBENGINE_H
14 
18 
19 namespace clang {
20 
21 class CFGBlock;
22 class CFGElement;
23 class LocationContext;
24 class Stmt;
25 
26 namespace cross_tu {
27 class CrossTranslationUnitContext;
28 }
29 
30 namespace ento {
31 
32 struct NodeBuilderContext;
33 class AnalysisManager;
34 class ExplodedNodeSet;
35 class ExplodedNode;
36 class ProgramState;
37 class ProgramStateManager;
38 class BlockCounter;
39 class BranchNodeBuilder;
40 class IndirectGotoNodeBuilder;
41 class SwitchNodeBuilder;
42 class EndOfFunctionNodeBuilder;
43 class NodeBuilderWithSinks;
44 class MemRegion;
45 
46 class SubEngine {
47  virtual void anchor();
48 public:
49  virtual ~SubEngine() {}
50 
51  virtual ProgramStateRef getInitialState(const LocationContext *InitLoc) = 0;
52 
53  virtual AnalysisManager &getAnalysisManager() = 0;
54 
56  getCrossTranslationUnitContext() = 0;
57 
58  virtual ProgramStateManager &getStateManager() = 0;
59 
60  /// Called by CoreEngine. Used to generate new successor
61  /// nodes by processing the 'effects' of a block-level statement.
62  virtual void processCFGElement(const CFGElement E, ExplodedNode* Pred,
63  unsigned StmtIdx, NodeBuilderContext *Ctx)=0;
64 
65  /// Called by CoreEngine when it starts processing a CFGBlock. The
66  /// SubEngine is expected to populate dstNodes with new nodes representing
67  /// updated analysis state, or generate no nodes at all if it doesn't.
68  virtual void processCFGBlockEntrance(const BlockEdge &L,
69  NodeBuilderWithSinks &nodeBuilder,
70  ExplodedNode *Pred) = 0;
71 
72  /// Called by CoreEngine. Used to generate successor
73  /// nodes by processing the 'effects' of a branch condition.
74  virtual void processBranch(const Stmt *Condition,
75  NodeBuilderContext& BuilderCtx,
76  ExplodedNode *Pred,
77  ExplodedNodeSet &Dst,
78  const CFGBlock *DstT,
79  const CFGBlock *DstF) = 0;
80 
81  /// Called by CoreEngine.
82  /// Used to generate successor nodes for temporary destructors depending
83  /// on whether the corresponding constructor was visited.
84  virtual void processCleanupTemporaryBranch(const CXXBindTemporaryExpr *BTE,
85  NodeBuilderContext &BldCtx,
86  ExplodedNode *Pred,
87  ExplodedNodeSet &Dst,
88  const CFGBlock *DstT,
89  const CFGBlock *DstF) = 0;
90 
91  /// Called by CoreEngine. Used to processing branching behavior
92  /// at static initializers.
93  virtual void processStaticInitializer(const DeclStmt *DS,
94  NodeBuilderContext& BuilderCtx,
95  ExplodedNode *Pred,
96  ExplodedNodeSet &Dst,
97  const CFGBlock *DstT,
98  const CFGBlock *DstF) = 0;
99 
100  /// Called by CoreEngine. Used to generate successor
101  /// nodes by processing the 'effects' of a computed goto jump.
102  virtual void processIndirectGoto(IndirectGotoNodeBuilder& builder) = 0;
103 
104  /// Called by CoreEngine. Used to generate successor
105  /// nodes by processing the 'effects' of a switch statement.
106  virtual void processSwitch(SwitchNodeBuilder& builder) = 0;
107 
108  /// Called by CoreEngine. Used to notify checkers that processing a
109  /// function has begun. Called for both inlined and and top-level functions.
110  virtual void processBeginOfFunction(NodeBuilderContext &BC,
111  ExplodedNode *Pred,
112  ExplodedNodeSet &Dst,
113  const BlockEdge &L) = 0;
114 
115  /// Called by CoreEngine. Used to notify checkers that processing a
116  /// function has ended. Called for both inlined and and top-level functions.
117  virtual void processEndOfFunction(NodeBuilderContext& BC,
118  ExplodedNode *Pred,
119  const ReturnStmt *RS = nullptr) = 0;
120 
121  // Generate the entry node of the callee.
122  virtual void processCallEnter(NodeBuilderContext& BC, CallEnter CE,
123  ExplodedNode *Pred) = 0;
124 
125  // Generate the first post callsite node.
126  virtual void processCallExit(ExplodedNode *Pred) = 0;
127 
128  /// Called by ConstraintManager. Used to call checker-specific
129  /// logic for handling assumptions on symbolic values.
130  virtual ProgramStateRef processAssume(ProgramStateRef state,
131  SVal cond, bool assumption) = 0;
132 
133  /// processRegionChanges - Called by ProgramStateManager whenever a change is
134  /// made to the store. Used to update checkers that track region values.
135  virtual ProgramStateRef
136  processRegionChanges(ProgramStateRef state,
137  const InvalidatedSymbols *invalidated,
138  ArrayRef<const MemRegion *> ExplicitRegions,
140  const LocationContext *LCtx,
141  const CallEvent *Call) = 0;
142 
143 
144  inline ProgramStateRef
146  const MemRegion* MR,
147  const LocationContext *LCtx) {
148  return processRegionChanges(state, nullptr, MR, MR, LCtx, nullptr);
149  }
150 
151  virtual ProgramStateRef
152  processPointerEscapedOnBind(ProgramStateRef State, SVal Loc, SVal Val, const LocationContext *LCtx) = 0;
153 
154  virtual ProgramStateRef
155  notifyCheckersOfPointerEscape(ProgramStateRef State,
156  const InvalidatedSymbols *Invalidated,
157  ArrayRef<const MemRegion *> ExplicitRegions,
158  const CallEvent *Call,
159  RegionAndSymbolInvalidationTraits &HTraits) = 0;
160 
161  /// printJson - Called by ProgramStateManager to print checker-specific data.
162  virtual void printJson(raw_ostream &Out, ProgramStateRef State,
163  const LocationContext *LCtx, const char *NL,
164  unsigned int Space, bool IsDot) const = 0;
165 
166  /// Called by CoreEngine when the analysis worklist is either empty or the
167  // maximum number of analysis steps have been reached.
168  virtual void processEndWorklist() = 0;
169 };
170 
171 } // end GR namespace
172 
173 } // end clang namespace
174 
175 #endif
ProgramStateRef processRegionChange(ProgramStateRef state, const MemRegion *MR, const LocationContext *LCtx)
Definition: SubEngine.h:145
MemRegion - The root abstract class for all memory regions.
Definition: MemRegion.h:94
Stmt - This represents one statement.
Definition: Stmt.h:66
Information about invalidation for a particular region/symbol.
Definition: MemRegion.h:1445
Represents a point when we begin processing an inlined call.
Definition: ProgramPoint.h:630
LineState State
i32 captured_struct **param SharedsTy A type which contains references the shared variables *param Shareds Context with the list of shared variables from the p *TaskFunction *param Data Additional data for task generation like final * state
Represents binding an expression to a temporary.
Definition: ExprCXX.h:1282
Represents a single basic block in a source-level CFG.
Definition: CFG.h:576
ReturnStmt - This represents a return, optionally of an expression: return; return 4;...
Definition: Stmt.h:2610
DeclStmt - Adaptor class for mixing declarations with statements and expressions. ...
Definition: Stmt.h:1203
SVal - This represents a symbolic expression, which can be either an L-value or an R-value...
Definition: SVals.h:75
Dataflow Directional Tag Classes.
This node builder keeps track of the generated sink nodes.
Definition: CoreEngine.h:341
Represents an abstract call to a function or method along a particular path.
Definition: CallEvent.h:138
This class is used for tools that requires cross translation unit capability.
Represents a top-level expression in a basic block.
Definition: CFG.h:55
virtual ~SubEngine()
Definition: SubEngine.h:49