clang API Documentation

Public Types | Public Member Functions | Static Public Member Functions | Friends
clang::ento::ProgramState Class Reference

#include <ProgramState.h>

Inheritance diagram for clang::ento::ProgramState:
Inheritance graph
[legend]
Collaboration diagram for clang::ento::ProgramState:
Collaboration graph
[legend]

List of all members.

Public Types

typedef llvm::ImmutableSet
< llvm::APSInt * > 
IntSetTy
typedef llvm::ImmutableMap
< void *, void * > 
GenericDataMap

Public Member Functions

 ProgramState (ProgramStateManager *mgr, const Environment &env, StoreRef st, GenericDataMap gdm)
 This ctor is used when creating the first ProgramState object.
 ProgramState (const ProgramState &RHS)
 ~ProgramState ()
ProgramStateManagergetStateManager () const
 Return the ProgramStateManager associated with this state.
const EnvironmentgetEnvironment () const
Store getStore () const
GenericDataMap getGDM () const
 getGDM - Return the generic data map associated with this state.
void setGDM (GenericDataMap gdm)
void Profile (llvm::FoldingSetNodeID &ID) const
BasicValueFactorygetBasicVals () const
SymbolManagergetSymbolManager () const
ProgramStateRef assume (DefinedOrUnknownSVal cond, bool assumption) const
std::pair< ProgramStateRef,
ProgramStateRef
assume (DefinedOrUnknownSVal cond) const
ProgramStateRef assumeInBound (DefinedOrUnknownSVal idx, DefinedOrUnknownSVal upperBound, bool assumption, QualType IndexType=QualType()) const
const VarRegiongetRegion (const VarDecl *D, const LocationContext *LC) const
 Utility method for getting regions.
ProgramStateRef bindCompoundLiteral (const CompoundLiteralExpr *CL, const LocationContext *LC, SVal V) const
ProgramStateRef BindExpr (const Stmt *S, const LocationContext *LCtx, SVal V, bool Invalidate=true) const
ProgramStateRef bindExprAndLocation (const Stmt *S, const LocationContext *LCtx, SVal location, SVal V) const
ProgramStateRef bindDecl (const VarRegion *VR, SVal V) const
ProgramStateRef bindDeclWithNoInit (const VarRegion *VR) const
ProgramStateRef bindLoc (Loc location, SVal V) const
ProgramStateRef bindLoc (SVal location, SVal V) const
ProgramStateRef bindDefault (SVal loc, SVal V) const
ProgramStateRef unbindLoc (Loc LV) const
ProgramStateRef invalidateRegions (ArrayRef< const MemRegion * > Regions, const Expr *E, unsigned BlockCount, const LocationContext *LCtx, StoreManager::InvalidatedSymbols *IS=0, const CallOrObjCMessage *Call=0) const
ProgramStateRef enterStackFrame (const LocationContext *callerCtx, const StackFrameContext *calleeCtx) const
Loc getLValue (const VarDecl *D, const LocationContext *LC) const
 Get the lvalue for a variable reference.
Loc getLValue (const CompoundLiteralExpr *literal, const LocationContext *LC) const
SVal getLValue (const ObjCIvarDecl *decl, SVal base) const
 Get the lvalue for an ivar reference.
SVal getLValue (const FieldDecl *decl, SVal Base) const
 Get the lvalue for a field reference.
SVal getLValue (QualType ElementType, SVal Idx, SVal Base) const
 Get the lvalue for an array index.
const llvm::APSInt * getSymVal (SymbolRef sym) const
SVal getSVal (const Stmt *S, const LocationContext *LCtx, bool useOnlyDirectBindings=false) const
 Returns the SVal bound to the statement 'S' in the state's environment.
SVal getSValAsScalarOrLoc (const Stmt *Ex, const LocationContext *LCtx) const
SVal getSVal (Loc LV, QualType T=QualType()) const
 Return the value bound to the specified location. Returns UnknownVal() if none found.
SVal getRawSVal (Loc LV, QualType T=QualType()) const
 Returns the "raw" SVal bound to LV before any value simplfication.
SVal getSVal (const MemRegion *R) const
 Return the value bound to the specified location. Returns UnknownVal() if none found.
SVal getSValAsScalarOrLoc (const MemRegion *R) const
bool scanReachableSymbols (SVal val, SymbolVisitor &visitor) const
 Visits the symbols reachable from the given SVal using the provided SymbolVisitor.
bool scanReachableSymbols (const SVal *I, const SVal *E, SymbolVisitor &visitor) const
 Visits the symbols reachable from the SVals in the given range using the provided SymbolVisitor.
bool scanReachableSymbols (const MemRegion *const *I, const MemRegion *const *E, SymbolVisitor &visitor) const
 Visits the symbols reachable from the regions in the given MemRegions range using the provided SymbolVisitor.
template<typename CB >
CB scanReachableSymbols (SVal val) const
template<typename CB >
CB scanReachableSymbols (const SVal *beg, const SVal *end) const
template<typename CB >
CB scanReachableSymbols (const MemRegion *const *beg, const MemRegion *const *end) const
ProgramStateRef addTaint (const Stmt *S, const LocationContext *LCtx, TaintTagType Kind=TaintTagGeneric) const
 Create a new state in which the statement is marked as tainted.
ProgramStateRef addTaint (SymbolRef S, TaintTagType Kind=TaintTagGeneric) const
 Create a new state in which the symbol is marked as tainted.
ProgramStateRef addTaint (const MemRegion *R, TaintTagType Kind=TaintTagGeneric) const
 Create a new state in which the region symbol is marked as tainted.
bool isTainted (const Stmt *S, const LocationContext *LCtx, TaintTagType Kind=TaintTagGeneric) const
 Check if the statement is tainted in the current state.
bool isTainted (SVal V, TaintTagType Kind=TaintTagGeneric) const
bool isTainted (SymbolRef Sym, TaintTagType Kind=TaintTagGeneric) const
bool isTainted (const MemRegion *Reg, TaintTagType Kind=TaintTagGeneric) const
void *const * FindGDM (void *K) const
template<typename T >
ProgramStateRef add (typename ProgramStateTrait< T >::key_type K) const
template<typename T >
ProgramStateTrait< T >::data_type get () const
template<typename T >
ProgramStateTrait< T >::lookup_type get (typename ProgramStateTrait< T >::key_type key) const
template<typename T >
ProgramStateTrait< T >
::context_type 
get_context () const
template<typename T >
ProgramStateRef remove (typename ProgramStateTrait< T >::key_type K) const
template<typename T >
ProgramStateRef remove (typename ProgramStateTrait< T >::key_type K, typename ProgramStateTrait< T >::context_type C) const
template<typename T >
ProgramStateRef remove () const
template<typename T >
ProgramStateRef set (typename ProgramStateTrait< T >::data_type D) const
template<typename T >
ProgramStateRef set (typename ProgramStateTrait< T >::key_type K, typename ProgramStateTrait< T >::value_type E) const
template<typename T >
ProgramStateRef set (typename ProgramStateTrait< T >::key_type K, typename ProgramStateTrait< T >::value_type E, typename ProgramStateTrait< T >::context_type C) const
template<typename T >
bool contains (typename ProgramStateTrait< T >::key_type key) const
void print (raw_ostream &Out, const char *nl="\n", const char *sep="") const
void printDOT (raw_ostream &Out) const
void printTaint (raw_ostream &Out, const char *nl="\n", const char *sep="") const
void dump () const
void dumpTaint () const

Static Public Member Functions

static void Profile (llvm::FoldingSetNodeID &ID, const ProgramState *V)

Friends

class ProgramStateManager
class ExplodedGraph
class ExplodedNode
void ProgramStateRetain (const ProgramState *state)
 Increments the number of times this state is referenced.
void ProgramStateRelease (const ProgramState *state)
 Decrement the number of times this state is referenced.

Detailed Description

ProgramState - This class encapsulates:

1. A mapping from expressions to values (Environment) 2. A mapping from locations to values (Store) 3. Constraints on symbolic values (GenericDataMap)

Together these represent the "abstract state" of a program.

ProgramState is intended to be used as a functional object; that is, once it is created and made "persistent" in a FoldingSet, its values will never change.

Definition at line 71 of file ProgramState.h.


Member Typedef Documentation

typedef llvm::ImmutableMap<void*, void*> clang::ento::ProgramState::GenericDataMap

Definition at line 74 of file ProgramState.h.

typedef llvm::ImmutableSet<llvm::APSInt*> clang::ento::ProgramState::IntSetTy

Definition at line 73 of file ProgramState.h.


Constructor & Destructor Documentation

ProgramState::ProgramState ( ProgramStateManager mgr,
const Environment env,
StoreRef  st,
GenericDataMap  gdm 
)

This ctor is used when creating the first ProgramState object.

Definition at line 48 of file ProgramState.cpp.

References clang::ento::ProgramStateManager::getStoreManager(), and clang::ento::StoreManager::incrementReferenceCount().

ProgramState::ProgramState ( const ProgramState RHS)

Copy ctor - We must explicitly define this or else the "Next" ptr in FoldingSetNode will also get copied.

Definition at line 58 of file ProgramState.cpp.

References clang::ento::ProgramStateManager::getStoreManager(), and clang::ento::StoreManager::incrementReferenceCount().

ProgramState::~ProgramState ( )

Member Function Documentation

template<typename T >
ProgramStateRef clang::ento::ProgramState::add ( typename ProgramStateTrait< T >::key_type  K) const

Definition at line 700 of file ProgramState.h.

References clang::ento::ProgramStateManager::add(), and getStateManager().

ProgramStateRef clang::ento::ProgramState::addTaint ( const Stmt S,
const LocationContext LCtx,
TaintTagType  Kind = TaintTagGeneric 
) const

Create a new state in which the statement is marked as tainted.

ProgramStateRef clang::ento::ProgramState::addTaint ( SymbolRef  S,
TaintTagType  Kind = TaintTagGeneric 
) const

Create a new state in which the symbol is marked as tainted.

ProgramStateRef clang::ento::ProgramState::addTaint ( const MemRegion R,
TaintTagType  Kind = TaintTagGeneric 
) const

Create a new state in which the region symbol is marked as tainted.

ProgramStateRef clang::ento::ProgramState::assume ( DefinedOrUnknownSVal  cond,
bool  assumption 
) const [inline]

Definition at line 613 of file ProgramState.h.

References getStateManager(), and clang::ento::SVal::isUnknown().

std::pair< ProgramStateRef, ProgramStateRef > clang::ento::ProgramState::assume ( DefinedOrUnknownSVal  cond) const [inline]

This method assumes both "true" and "false" for 'cond', and returns both corresponding states. It's shorthand for doing 'assume' twice.

Definition at line 623 of file ProgramState.h.

References getStateManager(), and clang::ento::SVal::isUnknown().

ProgramStateRef ProgramState::assumeInBound ( DefinedOrUnknownSVal  idx,
DefinedOrUnknownSVal  upperBound,
bool  assumption,
QualType  IndexType = QualType() 
) const
ProgramStateRef ProgramState::bindCompoundLiteral ( const CompoundLiteralExpr CL,
const LocationContext LC,
SVal  V 
) const

BindCompoundLiteral - Return the state that has the bindings currently in this state plus the bindings for the CompoundLiteral.

Definition at line 114 of file ProgramState.cpp.

References getStateManager(), and getStore().

ProgramStateRef ProgramState::bindDecl ( const VarRegion VR,
SVal  V 
) const

Definition at line 122 of file ProgramState.cpp.

References getStateManager(), and getStore().

ProgramStateRef ProgramState::bindDeclWithNoInit ( const VarRegion VR) const

Definition at line 128 of file ProgramState.cpp.

References getStateManager(), and getStore().

ProgramStateRef ProgramState::bindDefault ( SVal  loc,
SVal  V 
) const
ProgramStateRef ProgramState::BindExpr ( const Stmt S,
const LocationContext LCtx,
SVal  V,
bool  Invalidate = true 
) const

Create a new state by binding the value 'V' to the statement 'S' in the state's environment.

Definition at line 266 of file ProgramState.cpp.

References clang::ento::EnvironmentManager::bindExpr(), clang::ento::ProgramStateManager::getPersistentState(), and getStateManager().

ProgramStateRef ProgramState::bindExprAndLocation ( const Stmt S,
const LocationContext LCtx,
SVal  location,
SVal  V 
) const

Create a new state by binding the value 'V' and location 'locaton' to the statement 'S' in the state's environment.

Definition at line 148 of file Environment.cpp.

References MakeLocation().

ProgramStateRef clang::ento::ProgramState::bindLoc ( Loc  location,
SVal  V 
) const

Referenced by bindLoc().

ProgramStateRef clang::ento::ProgramState::bindLoc ( SVal  location,
SVal  V 
) const [inline]

Definition at line 631 of file ProgramState.h.

References bindLoc().

template<typename T >
bool clang::ento::ProgramState::contains ( typename ProgramStateTrait< T >::key_type  key) const [inline]

Definition at line 361 of file ProgramState.h.

References FindGDM().

void clang::ento::ProgramState::dump ( ) const
void ProgramState::dumpTaint ( ) const

Definition at line 438 of file ProgramState.cpp.

References printTaint().

ProgramStateRef clang::ento::ProgramState::enterStackFrame ( const LocationContext callerCtx,
const StackFrameContext calleeCtx 
) const

enterStackFrame - Returns the state for entry to the given stack frame, preserving the current state.

void *const * ProgramState::FindGDM ( void *  K) const

Definition at line 446 of file ProgramState.cpp.

Referenced by contains(), and get().

template<typename T >
ProgramStateTrait<T>::data_type clang::ento::ProgramState::get ( ) const [inline]

Definition at line 324 of file ProgramState.h.

References FindGDM().

template<typename T >
ProgramStateTrait<T>::lookup_type clang::ento::ProgramState::get ( typename ProgramStateTrait< T >::key_type  key) const [inline]

Definition at line 330 of file ProgramState.h.

References FindGDM().

template<typename T >
ProgramStateTrait< T >::context_type clang::ento::ProgramState::get_context ( ) const
BasicValueFactory & clang::ento::ProgramState::getBasicVals ( ) const [inline]
const Environment& clang::ento::ProgramState::getEnvironment ( ) const [inline]

getEnvironment - Return the environment associated with this state. The environment is the mapping from expressions to values.

Definition at line 111 of file ProgramState.h.

GenericDataMap clang::ento::ProgramState::getGDM ( ) const [inline]

getGDM - Return the generic data map associated with this state.

Definition at line 119 of file ProgramState.h.

Loc clang::ento::ProgramState::getLValue ( const VarDecl D,
const LocationContext LC 
) const [inline]

Get the lvalue for a variable reference.

Definition at line 635 of file ProgramState.h.

References getStateManager().

Referenced by clang::ento::ConditionBRVisitor::patternMatch(), and clang::ento::ConditionBRVisitor::VisitConditionVariable().

Loc clang::ento::ProgramState::getLValue ( const CompoundLiteralExpr literal,
const LocationContext LC 
) const [inline]

Definition at line 640 of file ProgramState.h.

References getStateManager().

SVal clang::ento::ProgramState::getLValue ( const ObjCIvarDecl decl,
SVal  base 
) const [inline]

Get the lvalue for an ivar reference.

Definition at line 645 of file ProgramState.h.

References getStateManager().

SVal clang::ento::ProgramState::getLValue ( const FieldDecl decl,
SVal  Base 
) const [inline]

Get the lvalue for a field reference.

Definition at line 649 of file ProgramState.h.

References getStateManager().

SVal clang::ento::ProgramState::getLValue ( QualType  ElementType,
SVal  Idx,
SVal  Base 
) const [inline]

Get the lvalue for an array index.

Definition at line 653 of file ProgramState.h.

References getStateManager().

SVal clang::ento::ProgramState::getRawSVal ( Loc  LV,
QualType  T = QualType() 
) const [inline]

Returns the "raw" SVal bound to LV before any value simplfication.

Definition at line 682 of file ProgramState.h.

References getStateManager(), and getStore().

const VarRegion * clang::ento::ProgramState::getRegion ( const VarDecl D,
const LocationContext LC 
) const [inline]

Utility method for getting regions.

Definition at line 607 of file ProgramState.h.

References clang::ento::ProgramStateManager::getRegionManager(), getStateManager(), and clang::ento::MemRegionManager::getVarRegion().

Referenced by bindDefault().

ProgramStateManager& clang::ento::ProgramState::getStateManager ( ) const [inline]
Store clang::ento::ProgramState::getStore ( ) const [inline]

Return the store associated with this state. The store is a mapping from locations to values.

Definition at line 115 of file ProgramState.h.

Referenced by bindCompoundLiteral(), bindDecl(), bindDeclWithNoInit(), bindDefault(), getRawSVal(), getSVal(), and unbindLoc().

SVal clang::ento::ProgramState::getSVal ( const Stmt S,
const LocationContext LCtx,
bool  useOnlyDirectBindings = false 
) const [inline]

Returns the SVal bound to the statement 'S' in the state's environment.

Definition at line 663 of file ProgramState.h.

References getStateManager(), and clang::ento::Environment::getSVal().

Referenced by getSValAsScalarOrLoc(), and clang::ento::ConditionBRVisitor::patternMatch().

SVal clang::ento::ProgramState::getSVal ( Loc  LV,
QualType  T = QualType() 
) const

Return the value bound to the specified location. Returns UnknownVal() if none found.

SVal Environment::getSVal ( const MemRegion R) const [inline]

Return the value bound to the specified location. Returns UnknownVal() if none found.

Definition at line 686 of file ProgramState.h.

References getStateManager(), and getStore().

SVal clang::ento::ProgramState::getSValAsScalarOrLoc ( const Stmt Ex,
const LocationContext LCtx 
) const [inline]

Definition at line 671 of file ProgramState.h.

References getSVal(), and clang::ento::Loc::isLocType().

SVal clang::ento::ProgramState::getSValAsScalarOrLoc ( const MemRegion R) const
SymbolManager & clang::ento::ProgramState::getSymbolManager ( ) const [inline]
const llvm::APSInt * clang::ento::ProgramState::getSymVal ( SymbolRef  sym) const [inline]
ProgramStateRef clang::ento::ProgramState::invalidateRegions ( ArrayRef< const MemRegion * >  Regions,
const Expr E,
unsigned  BlockCount,
const LocationContext LCtx,
StoreManager::InvalidatedSymbols IS = 0,
const CallOrObjCMessage Call = 0 
) const

invalidateRegions - Returns the state with bindings for the given regions cleared from the store. The regions are provided as a continuous array from Begin to End. Optionally invalidates global regions as well.

bool clang::ento::ProgramState::isTainted ( const Stmt S,
const LocationContext LCtx,
TaintTagType  Kind = TaintTagGeneric 
) const

Check if the statement is tainted in the current state.

bool clang::ento::ProgramState::isTainted ( SVal  V,
TaintTagType  Kind = TaintTagGeneric 
) const
bool clang::ento::ProgramState::isTainted ( SymbolRef  Sym,
TaintTagType  Kind = TaintTagGeneric 
) const
bool clang::ento::ProgramState::isTainted ( const MemRegion Reg,
TaintTagType  Kind = TaintTagGeneric 
) const
void clang::ento::ProgramState::print ( raw_ostream &  Out,
const char *  nl = "\n",
const char *  sep = "" 
) const

Referenced by printDOT().

void ProgramState::printDOT ( raw_ostream &  Out) const

Definition at line 418 of file ProgramState.cpp.

References print().

void ProgramState::printTaint ( raw_ostream &  Out,
const char *  nl = "\n",
const char *  sep = "" 
) const

Definition at line 426 of file ProgramState.cpp.

Referenced by dumpTaint().

static void clang::ento::ProgramState::Profile ( llvm::FoldingSetNodeID &  ID,
const ProgramState V 
) [inline, static]

Profile - Profile the contents of a ProgramState object for use in a FoldingSet. Two ProgramState objects are considered equal if they have the same Environment, Store, and GenericDataMap.

Definition at line 126 of file ProgramState.h.

References clang::ento::Environment::Profile().

Referenced by clang::ento::ProgramStateManager::getPersistentState(), and Profile().

void clang::ento::ProgramState::Profile ( llvm::FoldingSetNodeID &  ID) const [inline]

Profile - Used to profile the contents of this object for inclusion in a FoldingSet.

Definition at line 134 of file ProgramState.h.

References Profile().

template<typename T >
ProgramStateRef clang::ento::ProgramState::remove ( typename ProgramStateTrait< T >::key_type  K) const
template<typename T >
ProgramStateRef clang::ento::ProgramState::remove ( typename ProgramStateTrait< T >::key_type  K,
typename ProgramStateTrait< T >::context_type  C 
) const
template<typename T >
ProgramStateRef clang::ento::ProgramState::remove ( ) const
bool clang::ento::ProgramState::scanReachableSymbols ( SVal  val,
SymbolVisitor visitor 
) const

Visits the symbols reachable from the given SVal using the provided SymbolVisitor.

This is a convenience API. Consider using ScanReachableSymbols class directly when making multiple scans on the same state with the same visitor to avoid repeated initialization cost.

See also:
ScanReachableSymbols

Referenced by scanReachableSymbols().

bool clang::ento::ProgramState::scanReachableSymbols ( const SVal I,
const SVal E,
SymbolVisitor visitor 
) const

Visits the symbols reachable from the SVals in the given range using the provided SymbolVisitor.

bool clang::ento::ProgramState::scanReachableSymbols ( const MemRegion *const *  I,
const MemRegion *const *  E,
SymbolVisitor visitor 
) const

Visits the symbols reachable from the regions in the given MemRegions range using the provided SymbolVisitor.

template<typename CB >
CB clang::ento::ProgramState::scanReachableSymbols ( SVal  val) const

Definition at line 744 of file ProgramState.h.

References scanReachableSymbols().

template<typename CB >
CB clang::ento::ProgramState::scanReachableSymbols ( const SVal beg,
const SVal end 
) const

Definition at line 751 of file ProgramState.h.

References scanReachableSymbols().

template<typename CB >
CB clang::ento::ProgramState::scanReachableSymbols ( const MemRegion *const *  beg,
const MemRegion *const *  end 
) const

Definition at line 758 of file ProgramState.h.

References scanReachableSymbols().

template<typename T >
ProgramStateRef clang::ento::ProgramState::set ( typename ProgramStateTrait< T >::data_type  D) const

Definition at line 726 of file ProgramState.h.

References getStateManager(), and clang::ento::ProgramStateManager::set().

template<typename T >
ProgramStateRef clang::ento::ProgramState::set ( typename ProgramStateTrait< T >::key_type  K,
typename ProgramStateTrait< T >::value_type  E 
) const

Definition at line 731 of file ProgramState.h.

References getStateManager(), and clang::ento::ProgramStateManager::set().

template<typename T >
ProgramStateRef clang::ento::ProgramState::set ( typename ProgramStateTrait< T >::key_type  K,
typename ProgramStateTrait< T >::value_type  E,
typename ProgramStateTrait< T >::context_type  C 
) const

Definition at line 737 of file ProgramState.h.

References getStateManager(), and clang::ento::ProgramStateManager::set().

void clang::ento::ProgramState::setGDM ( GenericDataMap  gdm) [inline]

Definition at line 121 of file ProgramState.h.

ProgramStateRef ProgramState::unbindLoc ( Loc  LV) const

Friends And Related Function Documentation

friend class ExplodedGraph [friend]

Definition at line 80 of file ProgramState.h.

friend class ExplodedNode [friend]

Definition at line 81 of file ProgramState.h.

friend class ProgramStateManager [friend]

Definition at line 79 of file ProgramState.h.

void ProgramStateRelease ( const ProgramState state) [friend]

Decrement the number of times this state is referenced.

void ProgramStateRetain ( const ProgramState state) [friend]

Increments the number of times this state is referenced.


The documentation for this class was generated from the following files: