clang API Documentation

Public Types | Public Member Functions | Static Public Member Functions | Friends
clang::ento::ProgramState Class Reference

#include <ProgramState.h>

Inheritance diagram for clang::ento::ProgramState:
Inheritance graph
[legend]
Collaboration diagram for clang::ento::ProgramState:
Collaboration graph
[legend]

List of all members.

Public Types

typedef llvm::ImmutableSet
< llvm::APSInt * > 
IntSetTy
typedef llvm::ImmutableMap
< void *, void * > 
GenericDataMap

Public Member Functions

 ProgramState (ProgramStateManager *mgr, const Environment &env, StoreRef st, GenericDataMap gdm)
 This ctor is used when creating the first ProgramState object.
 ProgramState (const ProgramState &RHS)
 ~ProgramState ()
ProgramStateManagergetStateManager () const
 Return the ProgramStateManager associated with this state.
ConstraintManagergetConstraintManager () const
 Return the ConstraintManager.
const EnvironmentgetEnvironment () const
Store getStore () const
GenericDataMap getGDM () const
 getGDM - Return the generic data map associated with this state.
void setGDM (GenericDataMap gdm)
void Profile (llvm::FoldingSetNodeID &ID) const
BasicValueFactorygetBasicVals () const
SymbolManagergetSymbolManager () const
ProgramStateRef assume (DefinedOrUnknownSVal cond, bool assumption) const
std::pair< ProgramStateRef,
ProgramStateRef
assume (DefinedOrUnknownSVal cond) const
ProgramStateRef assumeInBound (DefinedOrUnknownSVal idx, DefinedOrUnknownSVal upperBound, bool assumption, QualType IndexType=QualType()) const
ConditionTruthVal isNull (SVal V) const
 Check if the given SVal is constrained to zero or is a zero constant.
const VarRegiongetRegion (const VarDecl *D, const LocationContext *LC) const
 Utility method for getting regions.
ProgramStateRef BindExpr (const Stmt *S, const LocationContext *LCtx, SVal V, bool Invalidate=true) const
ProgramStateRef bindLoc (Loc location, SVal V, bool notifyChanges=true) const
ProgramStateRef bindLoc (SVal location, SVal V) const
ProgramStateRef bindDefault (SVal loc, SVal V) const
ProgramStateRef killBinding (Loc LV) const
ProgramStateRef invalidateRegions (ArrayRef< const MemRegion * > Regions, const Expr *E, unsigned BlockCount, const LocationContext *LCtx, bool CausesPointerEscape, InvalidatedSymbols *IS=nullptr, const CallEvent *Call=nullptr, RegionAndSymbolInvalidationTraits *ITraits=nullptr) const
 Returns the state with bindings for the given regions cleared from the store.
ProgramStateRef invalidateRegions (ArrayRef< SVal > Regions, const Expr *E, unsigned BlockCount, const LocationContext *LCtx, bool CausesPointerEscape, InvalidatedSymbols *IS=nullptr, const CallEvent *Call=nullptr, RegionAndSymbolInvalidationTraits *ITraits=nullptr) const
ProgramStateRef enterStackFrame (const CallEvent &Call, const StackFrameContext *CalleeCtx) const
Loc getLValue (const VarDecl *D, const LocationContext *LC) const
 Get the lvalue for a variable reference.
Loc getLValue (const CompoundLiteralExpr *literal, const LocationContext *LC) const
SVal getLValue (const ObjCIvarDecl *decl, SVal base) const
 Get the lvalue for an ivar reference.
SVal getLValue (const FieldDecl *decl, SVal Base) const
 Get the lvalue for a field reference.
SVal getLValue (const IndirectFieldDecl *decl, SVal Base) const
 Get the lvalue for an indirect field reference.
SVal getLValue (QualType ElementType, SVal Idx, SVal Base) const
 Get the lvalue for an array index.
SVal getSVal (const Stmt *S, const LocationContext *LCtx) const
 Returns the SVal bound to the statement 'S' in the state's environment.
SVal getSValAsScalarOrLoc (const Stmt *Ex, const LocationContext *LCtx) const
SVal getSVal (Loc LV, QualType T=QualType()) const
 Return the value bound to the specified location. Returns UnknownVal() if none found.
SVal getRawSVal (Loc LV, QualType T=QualType()) const
 Returns the "raw" SVal bound to LV before any value simplfication.
SVal getSVal (const MemRegion *R) const
 Return the value bound to the specified location. Returns UnknownVal() if none found.
SVal getSValAsScalarOrLoc (const MemRegion *R) const
bool scanReachableSymbols (SVal val, SymbolVisitor &visitor) const
 Visits the symbols reachable from the given SVal using the provided SymbolVisitor.
bool scanReachableSymbols (const SVal *I, const SVal *E, SymbolVisitor &visitor) const
 Visits the symbols reachable from the SVals in the given range using the provided SymbolVisitor.
bool scanReachableSymbols (const MemRegion *const *I, const MemRegion *const *E, SymbolVisitor &visitor) const
 Visits the symbols reachable from the regions in the given MemRegions range using the provided SymbolVisitor.
template<typename CB >
CB scanReachableSymbols (SVal val) const
template<typename CB >
CB scanReachableSymbols (const SVal *beg, const SVal *end) const
template<typename CB >
CB scanReachableSymbols (const MemRegion *const *beg, const MemRegion *const *end) const
ProgramStateRef addTaint (const Stmt *S, const LocationContext *LCtx, TaintTagType Kind=TaintTagGeneric) const
 Create a new state in which the statement is marked as tainted.
ProgramStateRef addTaint (SymbolRef S, TaintTagType Kind=TaintTagGeneric) const
 Create a new state in which the symbol is marked as tainted.
ProgramStateRef addTaint (const MemRegion *R, TaintTagType Kind=TaintTagGeneric) const
 Create a new state in which the region symbol is marked as tainted.
bool isTainted (const Stmt *S, const LocationContext *LCtx, TaintTagType Kind=TaintTagGeneric) const
 Check if the statement is tainted in the current state.
bool isTainted (SVal V, TaintTagType Kind=TaintTagGeneric) const
bool isTainted (SymbolRef Sym, TaintTagType Kind=TaintTagGeneric) const
bool isTainted (const MemRegion *Reg, TaintTagType Kind=TaintTagGeneric) const
DynamicTypeInfo getDynamicTypeInfo (const MemRegion *Reg) const
 Get dynamic type information for a region.
ProgramStateRef setDynamicTypeInfo (const MemRegion *Reg, DynamicTypeInfo NewTy) const
 Set dynamic type information of the region; return the new state.
ProgramStateRef setDynamicTypeInfo (const MemRegion *Reg, QualType NewTy, bool CanBeSubClassed=true) const
 Set dynamic type information of the region; return the new state.
void *const * FindGDM (void *K) const
template<typename T >
ProgramStateRef add (typename ProgramStateTrait< T >::key_type K) const
template<typename T >
ProgramStateTrait< T >::data_type get () const
template<typename T >
ProgramStateTrait< T >::lookup_type get (typename ProgramStateTrait< T >::key_type key) const
template<typename T >
ProgramStateTrait< T >
::context_type 
get_context () const
template<typename T >
ProgramStateRef remove (typename ProgramStateTrait< T >::key_type K) const
template<typename T >
ProgramStateRef remove (typename ProgramStateTrait< T >::key_type K, typename ProgramStateTrait< T >::context_type C) const
template<typename T >
ProgramStateRef remove () const
template<typename T >
ProgramStateRef set (typename ProgramStateTrait< T >::data_type D) const
template<typename T >
ProgramStateRef set (typename ProgramStateTrait< T >::key_type K, typename ProgramStateTrait< T >::value_type E) const
template<typename T >
ProgramStateRef set (typename ProgramStateTrait< T >::key_type K, typename ProgramStateTrait< T >::value_type E, typename ProgramStateTrait< T >::context_type C) const
template<typename T >
bool contains (typename ProgramStateTrait< T >::key_type key) const
void print (raw_ostream &Out, const char *nl="\n", const char *sep="") const
void printDOT (raw_ostream &Out) const
void printTaint (raw_ostream &Out, const char *nl="\n", const char *sep="") const
void dump () const
void dumpTaint () const

Static Public Member Functions

static void Profile (llvm::FoldingSetNodeID &ID, const ProgramState *V)

Friends

class ProgramStateManager
class ExplodedGraph
class ExplodedNode
void ProgramStateRetain (const ProgramState *state)
 Increments the number of times this state is referenced.
void ProgramStateRelease (const ProgramState *state)
 Decrement the number of times this state is referenced.

Detailed Description

ProgramState - This class encapsulates:

1. A mapping from expressions to values (Environment) 2. A mapping from locations to values (Store) 3. Constraints on symbolic values (GenericDataMap)

Together these represent the "abstract state" of a program.

ProgramState is intended to be used as a functional object; that is, once it is created and made "persistent" in a FoldingSet, its values will never change.

Definition at line 72 of file ProgramState.h.


Member Typedef Documentation

typedef llvm::ImmutableMap<void*, void*> clang::ento::ProgramState::GenericDataMap

Definition at line 75 of file ProgramState.h.

typedef llvm::ImmutableSet<llvm::APSInt*> clang::ento::ProgramState::IntSetTy

Definition at line 74 of file ProgramState.h.


Constructor & Destructor Documentation

This ctor is used when creating the first ProgramState object.

Definition at line 45 of file ProgramState.cpp.

References clang::ento::ProgramStateManager::getStoreManager(), and clang::ento::StoreManager::incrementReferenceCount().

Copy ctor - We must explicitly define this or else the "Next" ptr in FoldingSetNode will also get copied.

Definition at line 55 of file ProgramState.cpp.

References clang::ento::ProgramStateManager::getStoreManager(), and clang::ento::StoreManager::incrementReferenceCount().


Member Function Documentation

template<typename T >
ProgramStateRef clang::ento::ProgramState::add ( typename ProgramStateTrait< T >::key_type  K) const

Definition at line 729 of file ProgramState.h.

References clang::ento::ProgramStateManager::add(), and getStateManager().

ProgramStateRef ProgramState::addTaint ( const Stmt S,
const LocationContext LCtx,
TaintTagType  Kind = TaintTagGeneric 
) const

Create a new state in which the statement is marked as tainted.

Definition at line 651 of file ProgramState.cpp.

References clang::ento::SVal::getAsRegion(), clang::ento::SVal::getAsSymbol(), getSVal(), and clang::Expr::IgnoreParens().

Referenced by addTaint().

Create a new state in which the symbol is marked as tainted.

Definition at line 675 of file ProgramState.cpp.

Create a new state in which the region symbol is marked as tainted.

Definition at line 668 of file ProgramState.cpp.

References addTaint().

Assumes that the value of cond is zero (if assumption is "false") or non-zero (if assumption is "true").

This returns a new state with the added constraint on cond. If no new state is feasible, NULL is returned.

Definition at line 634 of file ProgramState.h.

References clang::ento::SVal::castAs(), getStateManager(), and clang::ento::SVal::isUnknown().

Assumes both "true" and "false" for cond, and returns both corresponding states (respectively).

This is more efficient than calling assume() twice. Note that one (but not both) of the returned states may be NULL.

Definition at line 644 of file ProgramState.h.

References clang::ento::SVal::castAs(), getStateManager(), and clang::ento::SVal::isUnknown().

ProgramStateRef ProgramState::assumeInBound ( DefinedOrUnknownSVal  idx,
DefinedOrUnknownSVal  upperBound,
bool  assumption,
QualType  IndexType = QualType() 
) const
ProgramStateRef ProgramState::BindExpr ( const Stmt S,
const LocationContext LCtx,
SVal  V,
bool  Invalidate = true 
) const

Create a new state by binding the value 'V' to the statement 'S' in the state's environment.

Definition at line 290 of file ProgramState.cpp.

References clang::ento::EnvironmentManager::bindExpr(), clang::ento::ProgramStateManager::getPersistentState(), and getStateManager().

ProgramStateRef ProgramState::bindLoc ( Loc  location,
SVal  V,
bool  notifyChanges = true 
) const
ProgramStateRef clang::ento::ProgramState::bindLoc ( SVal  location,
SVal  V 
) const [inline]

Definition at line 652 of file ProgramState.h.

References bindLoc(), and clang::ento::SVal::getAs().

template<typename T >
bool clang::ento::ProgramState::contains ( typename ProgramStateTrait< T >::key_type  key) const [inline]

Definition at line 401 of file ProgramState.h.

References FindGDM().

void ProgramState::dump ( ) const

Definition at line 442 of file ProgramState.cpp.

References print().

void ProgramState::dumpTaint ( ) const

Definition at line 458 of file ProgramState.cpp.

References printTaint().

ProgramStateRef ProgramState::enterStackFrame ( const CallEvent Call,
const StackFrameContext CalleeCtx 
) const

enterStackFrame - Returns the state for entry to the given stack frame, preserving the current state.

Definition at line 228 of file ProgramState.cpp.

References getStateManager(), and getStore().

void *const * ProgramState::FindGDM ( void *  K) const

Definition at line 466 of file ProgramState.cpp.

Referenced by contains(), and get().

template<typename T >
ProgramStateTrait<T>::data_type clang::ento::ProgramState::get ( ) const [inline]

Definition at line 364 of file ProgramState.h.

References FindGDM().

template<typename T >
ProgramStateTrait<T>::lookup_type clang::ento::ProgramState::get ( typename ProgramStateTrait< T >::key_type  key) const [inline]

Definition at line 370 of file ProgramState.h.

References FindGDM().

template<typename T >
ProgramStateTrait< T >::context_type clang::ento::ProgramState::get_context ( ) const

Definition at line 720 of file ProgramState.h.

References clang::ento::ProgramStateManager::getBasicVals(), and getStateManager().

Referenced by getSVal().

Get dynamic type information for a region.

getEnvironment - Return the environment associated with this state. The environment is the mapping from expressions to values.

Definition at line 117 of file ProgramState.h.

getGDM - Return the generic data map associated with this state.

Definition at line 125 of file ProgramState.h.

Loc clang::ento::ProgramState::getLValue ( const VarDecl D,
const LocationContext LC 
) const [inline]
Loc clang::ento::ProgramState::getLValue ( const CompoundLiteralExpr literal,
const LocationContext LC 
) const [inline]

Definition at line 663 of file ProgramState.h.

References getStateManager().

SVal clang::ento::ProgramState::getLValue ( const ObjCIvarDecl decl,
SVal  base 
) const [inline]

Get the lvalue for an ivar reference.

Definition at line 668 of file ProgramState.h.

References getStateManager().

SVal clang::ento::ProgramState::getLValue ( const FieldDecl decl,
SVal  Base 
) const [inline]

Get the lvalue for a field reference.

Definition at line 672 of file ProgramState.h.

References getStateManager().

SVal clang::ento::ProgramState::getLValue ( const IndirectFieldDecl decl,
SVal  Base 
) const [inline]

Get the lvalue for an indirect field reference.

Definition at line 676 of file ProgramState.h.

References clang::IndirectFieldDecl::chain(), clang::ento::StoreManager::getLValueField(), getStateManager(), and SM.

SVal clang::ento::ProgramState::getLValue ( QualType  ElementType,
SVal  Idx,
SVal  Base 
) const [inline]

Get the lvalue for an array index.

Definition at line 686 of file ProgramState.h.

References clang::ento::SVal::getAs(), and getStateManager().

SVal clang::ento::ProgramState::getRawSVal ( Loc  LV,
QualType  T = QualType() 
) const [inline]

Returns the "raw" SVal bound to LV before any value simplfication.

Definition at line 711 of file ProgramState.h.

References getStateManager(), and getStore().

Referenced by getSVal(), and reversePropagateInterestingSymbols().

const VarRegion * clang::ento::ProgramState::getRegion ( const VarDecl D,
const LocationContext LC 
) const [inline]

Utility method for getting regions.

Definition at line 628 of file ProgramState.h.

References clang::ento::ProgramStateManager::getRegionManager(), getStateManager(), and clang::ento::MemRegionManager::getVarRegion().

Referenced by bindDefault().

Return the store associated with this state. The store is a mapping from locations to values.

Definition at line 121 of file ProgramState.h.

Referenced by bindDefault(), bindLoc(), enterStackFrame(), getRawSVal(), getSVal(), killBinding(), print(), and clang::ento::ProgramStateManager::removeDeadBindings().

SVal clang::ento::ProgramState::getSVal ( const Stmt S,
const LocationContext LCtx 
) const [inline]

Returns the SVal bound to the statement 'S' in the state's environment.

Definition at line 692 of file ProgramState.h.

References getStateManager(), and clang::ento::Environment::getSVal().

Referenced by addTaint(), getSValAsScalarOrLoc(), isTainted(), clang::ento::ConditionBRVisitor::patternMatch(), and reversePropagateIntererstingSymbols().

SVal ProgramState::getSVal ( Loc  LV,
QualType  T = QualType() 
) const
SVal clang::ento::ProgramState::getSVal ( const MemRegion R) const [inline]

Return the value bound to the specified location. Returns UnknownVal() if none found.

Definition at line 715 of file ProgramState.h.

References getStateManager(), and getStore().

SVal clang::ento::ProgramState::getSValAsScalarOrLoc ( const Stmt Ex,
const LocationContext LCtx 
) const [inline]
ProgramStateRef clang::ento::ProgramState::invalidateRegions ( ArrayRef< const MemRegion * >  Regions,
const Expr E,
unsigned  BlockCount,
const LocationContext LCtx,
bool  CausesPointerEscape,
InvalidatedSymbols IS = nullptr,
const CallEvent Call = nullptr,
RegionAndSymbolInvalidationTraits ITraits = nullptr 
) const

Returns the state with bindings for the given regions cleared from the store.

Optionally invalidates global regions as well.

Parameters:
Regionsthe set of regions to be invalidated.
Ethe expression that caused the invalidation.
BlockCountThe number of times the current basic block has been
CausesPointerEscapethe flag is set to true when the invalidation entails escape of a symbol (representing a pointer). For example, due to it being passed as an argument in a call.
ISthe set of invalidated symbols.
Callif non-null, the invalidated regions represent parameters to the call and should be considered directly invalidated.
ITraitsinformation about special handling for a particular region/symbol.
ProgramStateRef clang::ento::ProgramState::invalidateRegions ( ArrayRef< SVal Regions,
const Expr E,
unsigned  BlockCount,
const LocationContext LCtx,
bool  CausesPointerEscape,
InvalidatedSymbols IS = nullptr,
const CallEvent Call = nullptr,
RegionAndSymbolInvalidationTraits ITraits = nullptr 
) const

Check if the given SVal is constrained to zero or is a zero constant.

Definition at line 350 of file ProgramState.cpp.

References clang::ento::SVal::getAsSymbol(), getStateManager(), clang::ento::SVal::isConstant(), and clang::ento::SVal::isZeroConstant().

bool ProgramState::isTainted ( const Stmt S,
const LocationContext LCtx,
TaintTagType  Kind = TaintTagGeneric 
) const

Check if the statement is tainted in the current state.

Definition at line 687 of file ProgramState.cpp.

References getSVal(), and clang::Expr::IgnoreParens().

Referenced by isTainted().

bool ProgramState::isTainted ( const MemRegion Reg,
TaintTagType  Kind = TaintTagGeneric 
) const

Definition at line 704 of file ProgramState.cpp.

References isTainted().

void ProgramState::print ( raw_ostream &  Out,
const char *  nl = "\n",
const char *  sep = "" 
) const
void ProgramState::printDOT ( raw_ostream &  Out) const

Definition at line 438 of file ProgramState.cpp.

References print().

void ProgramState::printTaint ( raw_ostream &  Out,
const char *  nl = "\n",
const char *  sep = "" 
) const

Definition at line 446 of file ProgramState.cpp.

Referenced by dumpTaint().

static void clang::ento::ProgramState::Profile ( llvm::FoldingSetNodeID &  ID,
const ProgramState V 
) [inline, static]

Profile - Profile the contents of a ProgramState object for use in a FoldingSet. Two ProgramState objects are considered equal if they have the same Environment, Store, and GenericDataMap.

Definition at line 132 of file ProgramState.h.

References clang::ento::Environment::Profile().

Referenced by clang::ento::ProgramStateManager::getPersistentState(), and Profile().

void clang::ento::ProgramState::Profile ( llvm::FoldingSetNodeID &  ID) const [inline]

Profile - Used to profile the contents of this object for inclusion in a FoldingSet.

Definition at line 140 of file ProgramState.h.

References Profile().

template<typename T >
ProgramStateRef clang::ento::ProgramState::remove ( typename ProgramStateTrait< T >::key_type  K) const
template<typename T >
ProgramStateRef clang::ento::ProgramState::remove ( typename ProgramStateTrait< T >::key_type  K,
typename ProgramStateTrait< T >::context_type  C 
) const
template<typename T >
ProgramStateRef clang::ento::ProgramState::remove ( ) const

Visits the symbols reachable from the given SVal using the provided SymbolVisitor.

This is a convenience API. Consider using ScanReachableSymbols class directly when making multiple scans on the same state with the same visitor to avoid repeated initialization cost.

See also:
ScanReachableSymbols

Definition at line 625 of file ProgramState.cpp.

References S, and clang::ento::ScanReachableSymbols::scan().

Referenced by scanReachableSymbols().

bool ProgramState::scanReachableSymbols ( const SVal I,
const SVal E,
SymbolVisitor visitor 
) const

Visits the symbols reachable from the SVals in the given range using the provided SymbolVisitor.

Definition at line 630 of file ProgramState.cpp.

References S, and clang::ento::ScanReachableSymbols::scan().

bool ProgramState::scanReachableSymbols ( const MemRegion *const *  I,
const MemRegion *const *  E,
SymbolVisitor visitor 
) const

Visits the symbols reachable from the regions in the given MemRegions range using the provided SymbolVisitor.

Definition at line 640 of file ProgramState.cpp.

References S, and clang::ento::ScanReachableSymbols::scan().

template<typename CB >
CB clang::ento::ProgramState::scanReachableSymbols ( SVal  val) const

Definition at line 773 of file ProgramState.h.

References scanReachableSymbols().

template<typename CB >
CB clang::ento::ProgramState::scanReachableSymbols ( const SVal beg,
const SVal end 
) const

Definition at line 780 of file ProgramState.h.

References scanReachableSymbols().

template<typename CB >
CB clang::ento::ProgramState::scanReachableSymbols ( const MemRegion *const *  beg,
const MemRegion *const *  end 
) const

Definition at line 787 of file ProgramState.h.

References scanReachableSymbols().

template<typename T >
ProgramStateRef clang::ento::ProgramState::set ( typename ProgramStateTrait< T >::data_type  D) const

Definition at line 755 of file ProgramState.h.

References getStateManager(), and clang::ento::ProgramStateManager::set().

template<typename T >
ProgramStateRef clang::ento::ProgramState::set ( typename ProgramStateTrait< T >::key_type  K,
typename ProgramStateTrait< T >::value_type  E 
) const

Definition at line 760 of file ProgramState.h.

References getStateManager(), and clang::ento::ProgramStateManager::set().

template<typename T >
ProgramStateRef clang::ento::ProgramState::set ( typename ProgramStateTrait< T >::key_type  K,
typename ProgramStateTrait< T >::value_type  E,
typename ProgramStateTrait< T >::context_type  C 
) const

Set dynamic type information of the region; return the new state.

Definition at line 781 of file ProgramState.cpp.

References clang::ento::MemRegion::StripCasts().

Referenced by setDynamicTypeInfo().

ProgramStateRef clang::ento::ProgramState::setDynamicTypeInfo ( const MemRegion Reg,
QualType  NewTy,
bool  CanBeSubClassed = true 
) const [inline]

Set dynamic type information of the region; return the new state.

Definition at line 347 of file ProgramState.h.

References setDynamicTypeInfo().

Definition at line 127 of file ProgramState.h.


Friends And Related Function Documentation

friend class ExplodedGraph [friend]

Definition at line 81 of file ProgramState.h.

friend class ExplodedNode [friend]

Definition at line 82 of file ProgramState.h.

friend class ProgramStateManager [friend]

Definition at line 80 of file ProgramState.h.

void ProgramStateRelease ( const ProgramState state) [friend]

Decrement the number of times this state is referenced.

void ProgramStateRetain ( const ProgramState state) [friend]

Increments the number of times this state is referenced.


The documentation for this class was generated from the following files: