clang 17.0.0git
CoreEngine.h
Go to the documentation of this file.
1//===- CoreEngine.h - Path-Sensitive Dataflow Engine ------------*- C++ -*-===//
2//
3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4// See https://llvm.org/LICENSE.txt for license information.
5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6//
7//===----------------------------------------------------------------------===//
8//
9// This file defines a generic engine for intraprocedural, path-sensitive,
10// dataflow analysis via graph reachability.
11//
12//===----------------------------------------------------------------------===//
13
14#ifndef LLVM_CLANG_STATICANALYZER_CORE_PATHSENSITIVE_COREENGINE_H
15#define LLVM_CLANG_STATICANALYZER_CORE_PATHSENSITIVE_COREENGINE_H
16
17#include "clang/AST/Stmt.h"
19#include "clang/Analysis/CFG.h"
21#include "clang/Basic/LLVM.h"
27#include "llvm/ADT/SmallVector.h"
28#include "llvm/Support/Casting.h"
29#include <cassert>
30#include <memory>
31#include <utility>
32#include <vector>
33
34namespace clang {
35
36class AnalyzerOptions;
37class CXXBindTemporaryExpr;
38class Expr;
39class LabelDecl;
40
41namespace ento {
42
43class FunctionSummariesTy;
44class ExprEngine;
45
46//===----------------------------------------------------------------------===//
47/// CoreEngine - Implements the core logic of the graph-reachability
48/// analysis. It traverses the CFG and generates the ExplodedGraph.
49/// Program "states" are treated as opaque void pointers.
50/// The template class CoreEngine (which subclasses CoreEngine)
51/// provides the matching component to the engine that knows the actual types
52/// for states. Note that this engine only dispatches to transfer functions
53/// at the statement and block-level. The analyses themselves must implement
54/// any transfer function logic and the sub-expression level (if any).
56 friend class CommonNodeBuilder;
58 friend class ExprEngine;
60 friend class NodeBuilder;
61 friend struct NodeBuilderContext;
62 friend class SwitchNodeBuilder;
63
64public:
66 std::vector<std::pair<BlockEdge, const ExplodedNode *>>;
67
69 std::vector<std::pair<const CFGBlock *, const ExplodedNode *>>;
70
71private:
72 ExprEngine &ExprEng;
73
74 /// G - The simulation graph. Each node is a (location,state) pair.
75 mutable ExplodedGraph G;
76
77 /// WList - A set of queued nodes that need to be processed by the
78 /// worklist algorithm. It is up to the implementation of WList to decide
79 /// the order that nodes are processed.
80 std::unique_ptr<WorkList> WList;
81 std::unique_ptr<WorkList> CTUWList;
82
83 /// BCounterFactory - A factory object for created BlockCounter objects.
84 /// These are used to record for key nodes in the ExplodedGraph the
85 /// number of times different CFGBlocks have been visited along a path.
86 BlockCounter::Factory BCounterFactory;
87
88 /// The locations where we stopped doing work because we visited a location
89 /// too many times.
90 BlocksExhausted blocksExhausted;
91
92 /// The locations where we stopped because the engine aborted analysis,
93 /// usually because it could not reason about something.
94 BlocksAborted blocksAborted;
95
96 /// The information about functions shared by the whole translation unit.
97 /// (This data is owned by AnalysisConsumer.)
98 FunctionSummariesTy *FunctionSummaries;
99
100 /// Add path tags with some useful data along the path when we see that
101 /// something interesting is happening. This field is the allocator for such
102 /// tags.
103 DataTag::Factory DataTags;
104
105 void setBlockCounter(BlockCounter C);
106
107 void generateNode(const ProgramPoint &Loc,
108 ProgramStateRef State,
109 ExplodedNode *Pred);
110
111 void HandleBlockEdge(const BlockEdge &E, ExplodedNode *Pred);
112 void HandleBlockEntrance(const BlockEntrance &E, ExplodedNode *Pred);
113 void HandleBlockExit(const CFGBlock *B, ExplodedNode *Pred);
114
115 void HandleCallEnter(const CallEnter &CE, ExplodedNode *Pred);
116
117 void HandlePostStmt(const CFGBlock *B, unsigned StmtIdx, ExplodedNode *Pred);
118
119 void HandleBranch(const Stmt *Cond, const Stmt *Term, const CFGBlock *B,
120 ExplodedNode *Pred);
121 void HandleCleanupTemporaryBranch(const CXXBindTemporaryExpr *BTE,
122 const CFGBlock *B, ExplodedNode *Pred);
123
124 /// Handle conditional logic for running static initializers.
125 void HandleStaticInit(const DeclStmt *DS, const CFGBlock *B,
126 ExplodedNode *Pred);
127
128 void HandleVirtualBaseBranch(const CFGBlock *B, ExplodedNode *Pred);
129
130private:
131 ExplodedNode *generateCallExitBeginNode(ExplodedNode *N,
132 const ReturnStmt *RS);
133
134public:
135 /// Construct a CoreEngine object to analyze the provided CFG.
136 CoreEngine(ExprEngine &exprengine,
138 AnalyzerOptions &Opts);
139
140 CoreEngine(const CoreEngine &) = delete;
141 CoreEngine &operator=(const CoreEngine &) = delete;
142
143 /// getGraph - Returns the exploded graph.
144 ExplodedGraph &getGraph() { return G; }
145
146 /// ExecuteWorkList - Run the worklist algorithm for a maximum number of
147 /// steps. Returns true if there is still simulation state on the worklist.
148 bool ExecuteWorkList(const LocationContext *L, unsigned Steps,
149 ProgramStateRef InitState);
150
151 /// Returns true if there is still simulation state on the worklist.
153 unsigned Steps,
154 ProgramStateRef InitState,
155 ExplodedNodeSet &Dst);
156
157 /// Dispatch the work list item based on the given location information.
158 /// Use Pred parameter as the predecessor state.
160 const WorkListUnit& WU);
161
162 // Functions for external checking of whether we have unfinished work
163 bool wasBlockAborted() const { return !blocksAborted.empty(); }
164 bool wasBlocksExhausted() const { return !blocksExhausted.empty(); }
165 bool hasWorkRemaining() const { return wasBlocksExhausted() ||
166 WList->hasWork() ||
167 wasBlockAborted(); }
168
169 /// Inform the CoreEngine that a basic block was aborted because
170 /// it could not be completely analyzed.
171 void addAbortedBlock(const ExplodedNode *node, const CFGBlock *block) {
172 blocksAborted.push_back(std::make_pair(block, node));
173 }
174
175 WorkList *getWorkList() const { return WList.get(); }
176 WorkList *getCTUWorkList() const { return CTUWList.get(); }
177
178 BlocksExhausted::const_iterator blocks_exhausted_begin() const {
179 return blocksExhausted.begin();
180 }
181
182 BlocksExhausted::const_iterator blocks_exhausted_end() const {
183 return blocksExhausted.end();
184 }
185
186 BlocksAborted::const_iterator blocks_aborted_begin() const {
187 return blocksAborted.begin();
188 }
189
190 BlocksAborted::const_iterator blocks_aborted_end() const {
191 return blocksAborted.end();
192 }
193
194 /// Enqueue the given set of nodes onto the work list.
195 void enqueue(ExplodedNodeSet &Set);
196
197 /// Enqueue nodes that were created as a result of processing
198 /// a statement onto the work list.
199 void enqueue(ExplodedNodeSet &Set, const CFGBlock *Block, unsigned Idx);
200
201 /// enqueue the nodes corresponding to the end of function onto the
202 /// end of path / work list.
203 void enqueueEndOfFunction(ExplodedNodeSet &Set, const ReturnStmt *RS);
204
205 /// Enqueue a single node created as a result of statement processing.
206 void enqueueStmtNode(ExplodedNode *N, const CFGBlock *Block, unsigned Idx);
207
208 DataTag::Factory &getDataTags() { return DataTags; }
209};
210
211// TODO: Turn into a class.
216
218 const LocationContext *L)
219 : Eng(E), Block(B), LC(L) {
220 assert(B);
221 }
222
224 : NodeBuilderContext(E, B, N->getLocationContext()) {}
225
226 /// Return the CFGBlock associated with this builder.
227 const CFGBlock *getBlock() const { return Block; }
228
229 /// Returns the number of times the current basic block has been
230 /// visited on the exploded graph path.
231 unsigned blockCount() const {
232 return Eng.WList->getBlockCounter().getNumVisited(
233 LC->getStackFrame(),
234 Block->getBlockID());
235 }
236};
237
238/// \class NodeBuilder
239/// This is the simplest builder which generates nodes in the
240/// ExplodedGraph.
241///
242/// The main benefit of the builder is that it automatically tracks the
243/// frontier nodes (or destination set). This is the set of nodes which should
244/// be propagated to the next step / builder. They are the nodes which have been
245/// added to the builder (either as the input node set or as the newly
246/// constructed nodes) but did not have any outgoing transitions added.
248 virtual void anchor();
249
250protected:
252
253 /// Specifies if the builder results have been finalized. For example, if it
254 /// is set to false, autotransitions are yet to be generated.
256
257 bool HasGeneratedNodes = false;
258
259 /// The frontier set - a set of nodes which need to be propagated after
260 /// the builder dies.
262
263 /// Checks if the results are ready.
264 virtual bool checkResults() {
265 return Finalized;
266 }
267
269 for (const auto I : Frontier)
270 if (I->isSink())
271 return false;
272 return true;
273 }
274
275 /// Allow subclasses to finalize results before result_begin() is executed.
276 virtual void finalizeResults() {}
277
279 ProgramStateRef State,
280 ExplodedNode *Pred,
281 bool MarkAsSink = false);
282
283public:
285 const NodeBuilderContext &Ctx, bool F = true)
286 : C(Ctx), Finalized(F), Frontier(DstSet) {
287 Frontier.Add(SrcNode);
288 }
289
291 const NodeBuilderContext &Ctx, bool F = true)
292 : C(Ctx), Finalized(F), Frontier(DstSet) {
293 Frontier.insert(SrcSet);
294 assert(hasNoSinksInFrontier());
295 }
296
297 virtual ~NodeBuilder() = default;
298
299 /// Generates a node in the ExplodedGraph.
301 ProgramStateRef State,
302 ExplodedNode *Pred) {
303 return generateNodeImpl(
304 PP, State, Pred,
305 /*MarkAsSink=*/State->isPosteriorlyOverconstrained());
306 }
307
308 /// Generates a sink in the ExplodedGraph.
309 ///
310 /// When a node is marked as sink, the exploration from the node is stopped -
311 /// the node becomes the last node on the path and certain kinds of bugs are
312 /// suppressed.
314 ProgramStateRef State,
315 ExplodedNode *Pred) {
316 return generateNodeImpl(PP, State, Pred, true);
317 }
318
321 assert(checkResults());
322 return Frontier;
323 }
324
326
327 /// Iterators through the results frontier.
330 assert(checkResults());
331 return Frontier.begin();
332 }
333
336 return Frontier.end();
337 }
338
339 const NodeBuilderContext &getContext() { return C; }
341
342 void takeNodes(const ExplodedNodeSet &S) {
343 for (const auto I : S)
344 Frontier.erase(I);
345 }
346
350};
351
352/// \class NodeBuilderWithSinks
353/// This node builder keeps track of the generated sink nodes.
355 void anchor() override;
356
357protected:
360
361public:
363 const NodeBuilderContext &Ctx, ProgramPoint &L)
364 : NodeBuilder(Pred, DstSet, Ctx), Location(L) {}
365
367 ExplodedNode *Pred,
368 const ProgramPointTag *Tag = nullptr) {
369 const ProgramPoint &LocalLoc = (Tag ? Location.withTag(Tag) : Location);
370 return NodeBuilder::generateNode(LocalLoc, State, Pred);
371 }
372
374 const ProgramPointTag *Tag = nullptr) {
375 const ProgramPoint &LocalLoc = (Tag ? Location.withTag(Tag) : Location);
376 ExplodedNode *N = NodeBuilder::generateSink(LocalLoc, State, Pred);
377 if (N && N->isSink())
378 sinksGenerated.push_back(N);
379 return N;
380 }
381
383 return sinksGenerated;
384 }
385};
386
387/// \class StmtNodeBuilder
388/// This builder class is useful for generating nodes that resulted from
389/// visiting a statement. The main difference from its parent NodeBuilder is
390/// that it creates a statement specific ProgramPoint.
392 NodeBuilder *EnclosingBldr;
393
394public:
395 /// Constructs a StmtNodeBuilder. If the builder is going to process
396 /// nodes currently owned by another builder(with larger scope), use
397 /// Enclosing builder to transfer ownership.
399 const NodeBuilderContext &Ctx,
400 NodeBuilder *Enclosing = nullptr)
401 : NodeBuilder(SrcNode, DstSet, Ctx), EnclosingBldr(Enclosing) {
402 if (EnclosingBldr)
403 EnclosingBldr->takeNodes(SrcNode);
404 }
405
407 const NodeBuilderContext &Ctx,
408 NodeBuilder *Enclosing = nullptr)
409 : NodeBuilder(SrcSet, DstSet, Ctx), EnclosingBldr(Enclosing) {
410 if (EnclosingBldr)
411 for (const auto I : SrcSet)
412 EnclosingBldr->takeNodes(I);
413 }
414
415 ~StmtNodeBuilder() override;
416
419
421 ExplodedNode *Pred,
423 const ProgramPointTag *tag = nullptr,
426 Pred->getLocationContext(), tag);
427 return NodeBuilder::generateNode(L, St, Pred);
428 }
429
431 ExplodedNode *Pred,
433 const ProgramPointTag *tag = nullptr,
436 Pred->getLocationContext(), tag);
437 return NodeBuilder::generateSink(L, St, Pred);
438 }
439};
440
441/// BranchNodeBuilder is responsible for constructing the nodes
442/// corresponding to the two branches of the if statement - true and false.
444 const CFGBlock *DstT;
445 const CFGBlock *DstF;
446
447 bool InFeasibleTrue;
448 bool InFeasibleFalse;
449
450 void anchor() override;
451
452public:
454 const NodeBuilderContext &C,
455 const CFGBlock *dstT, const CFGBlock *dstF)
456 : NodeBuilder(SrcNode, DstSet, C), DstT(dstT), DstF(dstF),
457 InFeasibleTrue(!DstT), InFeasibleFalse(!DstF) {
458 // The branch node builder does not generate autotransitions.
459 // If there are no successors it means that both branches are infeasible.
460 takeNodes(SrcNode);
461 }
462
464 const NodeBuilderContext &C,
465 const CFGBlock *dstT, const CFGBlock *dstF)
466 : NodeBuilder(SrcSet, DstSet, C), DstT(dstT), DstF(dstF),
467 InFeasibleTrue(!DstT), InFeasibleFalse(!DstF) {
468 takeNodes(SrcSet);
469 }
470
471 ExplodedNode *generateNode(ProgramStateRef State, bool branch,
472 ExplodedNode *Pred);
473
474 const CFGBlock *getTargetBlock(bool branch) const {
475 return branch ? DstT : DstF;
476 }
477
478 void markInfeasible(bool branch) {
479 if (branch)
480 InFeasibleTrue = true;
481 else
482 InFeasibleFalse = true;
483 }
484
485 bool isFeasible(bool branch) {
486 return branch ? !InFeasibleTrue : !InFeasibleFalse;
487 }
488};
489
491 CoreEngine& Eng;
492 const CFGBlock *Src;
493 const CFGBlock &DispatchBlock;
494 const Expr *E;
495 ExplodedNode *Pred;
496
497public:
499 const Expr *e, const CFGBlock *dispatch, CoreEngine* eng)
500 : Eng(*eng), Src(src), DispatchBlock(*dispatch), E(e), Pred(pred) {}
501
502 class iterator {
504
506
508
509 public:
510 iterator &operator++() { ++I; return *this; }
511 bool operator!=(const iterator &X) const { return I != X.I; }
512
513 const LabelDecl *getLabel() const {
514 return cast<LabelStmt>((*I)->getLabel())->getDecl();
515 }
516
517 const CFGBlock *getBlock() const {
518 return *I;
519 }
520 };
521
522 iterator begin() { return iterator(DispatchBlock.succ_begin()); }
523 iterator end() { return iterator(DispatchBlock.succ_end()); }
524
525 ExplodedNode *generateNode(const iterator &I,
526 ProgramStateRef State,
527 bool isSink = false);
528
529 const Expr *getTarget() const { return E; }
530
531 ProgramStateRef getState() const { return Pred->State; }
532
534 return Pred->getLocationContext();
535 }
536};
537
539 CoreEngine& Eng;
540 const CFGBlock *Src;
541 const Expr *Condition;
542 ExplodedNode *Pred;
543
544public:
546 const Expr *condition, CoreEngine* eng)
547 : Eng(*eng), Src(src), Condition(condition), Pred(pred) {}
548
549 class iterator {
550 friend class SwitchNodeBuilder;
551
553
555
556 public:
557 iterator &operator++() { ++I; return *this; }
558 bool operator!=(const iterator &X) const { return I != X.I; }
559 bool operator==(const iterator &X) const { return I == X.I; }
560
561 const CaseStmt *getCase() const {
562 return cast<CaseStmt>((*I)->getLabel());
563 }
564
565 const CFGBlock *getBlock() const {
566 return *I;
567 }
568 };
569
570 iterator begin() { return iterator(Src->succ_rbegin()+1); }
571 iterator end() { return iterator(Src->succ_rend()); }
572
573 const SwitchStmt *getSwitch() const {
574 return cast<SwitchStmt>(Src->getTerminator());
575 }
576
577 ExplodedNode *generateCaseStmtNode(const iterator &I,
578 ProgramStateRef State);
579
581 bool isSink = false);
582
583 const Expr *getCondition() const { return Condition; }
584
585 ProgramStateRef getState() const { return Pred->State; }
586
588 return Pred->getLocationContext();
589 }
590};
591
592} // namespace ento
593
594} // namespace clang
595
596#endif // LLVM_CLANG_STATICANALYZER_CORE_PATHSENSITIVE_COREENGINE_H
This file defines AnalysisDeclContext, a class that manages the analysis context data for context sen...
static CompilationDatabasePluginRegistry::Add< FixedCompilationDatabasePlugin > X("fixed-compilation-database", "Reads plain-text flags file")
Forward-declares and imports various common LLVM datatypes that clang wants to use unqualified.
Stores options for the analyzer from the command line.
Represents a single basic block in a source-level CFG.
Definition: CFG.h:576
succ_iterator succ_end()
Definition: CFG.h:956
succ_reverse_iterator succ_rend()
Definition: CFG.h:961
succ_reverse_iterator succ_rbegin()
Definition: CFG.h:960
AdjacentBlocks::const_reverse_iterator const_succ_reverse_iterator
Definition: CFG.h:933
CFGTerminator getTerminator() const
Definition: CFG.h:1048
succ_iterator succ_begin()
Definition: CFG.h:955
unsigned getBlockID() const
Definition: CFG.h:1074
AdjacentBlocks::const_iterator const_succ_iterator
Definition: CFG.h:931
Represents binding an expression to a temporary.
Definition: ExprCXX.h:1470
Represents a point when we begin processing an inlined call.
Definition: ProgramPoint.h:628
CaseStmt - Represent a case statement.
Definition: Stmt.h:1613
DeclStmt - Adaptor class for mixing declarations with statements and expressions.
Definition: Stmt.h:1311
This represents one expression.
Definition: Expr.h:110
Represents the declaration of a label.
Definition: Decl.h:494
It wraps the AnalysisDeclContext to represent both the call stack with the help of StackFrameContext ...
const StackFrameContext * getStackFrame() const
ProgramPoints can be "tagged" as representing points specific to a given analysis entity.
Definition: ProgramPoint.h:38
static ProgramPoint getProgramPoint(const Stmt *S, ProgramPoint::Kind K, const LocationContext *LC, const ProgramPointTag *tag)
ProgramPoint withTag(const ProgramPointTag *tag) const
Create a new ProgramPoint object that is the same as the original except for using the specified tag ...
Definition: ProgramPoint.h:129
ReturnStmt - This represents a return, optionally of an expression: return; return 4;.
Definition: Stmt.h:2806
Stmt - This represents one statement.
Definition: Stmt.h:72
SwitchStmt - This represents a 'switch' stmt.
Definition: Stmt.h:2195
An abstract data type used to count the number of times a given block has been visited along a path a...
Definition: BlockCounter.h:29
BranchNodeBuilder is responsible for constructing the nodes corresponding to the two branches of the ...
Definition: CoreEngine.h:443
BranchNodeBuilder(ExplodedNode *SrcNode, ExplodedNodeSet &DstSet, const NodeBuilderContext &C, const CFGBlock *dstT, const CFGBlock *dstF)
Definition: CoreEngine.h:453
void markInfeasible(bool branch)
Definition: CoreEngine.h:478
ExplodedNode * generateNode(ProgramStateRef State, bool branch, ExplodedNode *Pred)
Definition: CoreEngine.cpp:663
bool isFeasible(bool branch)
Definition: CoreEngine.h:485
BranchNodeBuilder(const ExplodedNodeSet &SrcSet, ExplodedNodeSet &DstSet, const NodeBuilderContext &C, const CFGBlock *dstT, const CFGBlock *dstF)
Definition: CoreEngine.h:463
const CFGBlock * getTargetBlock(bool branch) const
Definition: CoreEngine.h:474
CoreEngine - Implements the core logic of the graph-reachability analysis.
Definition: CoreEngine.h:55
void addAbortedBlock(const ExplodedNode *node, const CFGBlock *block)
Inform the CoreEngine that a basic block was aborted because it could not be completely analyzed.
Definition: CoreEngine.h:171
DataTag::Factory & getDataTags()
Definition: CoreEngine.h:208
void enqueueStmtNode(ExplodedNode *N, const CFGBlock *Block, unsigned Idx)
Enqueue a single node created as a result of statement processing.
Definition: CoreEngine.cpp:542
bool wasBlockAborted() const
Definition: CoreEngine.h:163
CoreEngine & operator=(const CoreEngine &)=delete
friend class CommonNodeBuilder
Definition: CoreEngine.h:56
void dispatchWorkItem(ExplodedNode *Pred, ProgramPoint Loc, const WorkListUnit &WU)
Dispatch the work list item based on the given location information.
Definition: CoreEngine.cpp:182
WorkList * getCTUWorkList() const
Definition: CoreEngine.h:176
bool wasBlocksExhausted() const
Definition: CoreEngine.h:164
BlocksAborted::const_iterator blocks_aborted_begin() const
Definition: CoreEngine.h:186
WorkList * getWorkList() const
Definition: CoreEngine.h:175
BlocksExhausted::const_iterator blocks_exhausted_begin() const
Definition: CoreEngine.h:178
std::vector< std::pair< BlockEdge, const ExplodedNode * > > BlocksExhausted
Definition: CoreEngine.h:66
BlocksAborted::const_iterator blocks_aborted_end() const
Definition: CoreEngine.h:190
CoreEngine(const CoreEngine &)=delete
std::vector< std::pair< const CFGBlock *, const ExplodedNode * > > BlocksAborted
Definition: CoreEngine.h:69
bool ExecuteWorkListWithInitialState(const LocationContext *L, unsigned Steps, ProgramStateRef InitState, ExplodedNodeSet &Dst)
Returns true if there is still simulation state on the worklist.
Definition: CoreEngine.cpp:225
bool ExecuteWorkList(const LocationContext *L, unsigned Steps, ProgramStateRef InitState)
ExecuteWorkList - Run the worklist algorithm for a maximum number of steps.
Definition: CoreEngine.cpp:88
friend class EndOfFunctionNodeBuilder
Definition: CoreEngine.h:57
bool hasWorkRemaining() const
Definition: CoreEngine.h:165
ExplodedGraph & getGraph()
getGraph - Returns the exploded graph.
Definition: CoreEngine.h:144
BlocksExhausted::const_iterator blocks_exhausted_end() const
Definition: CoreEngine.h:182
void enqueueEndOfFunction(ExplodedNodeSet &Set, const ReturnStmt *RS)
enqueue the nodes corresponding to the end of function onto the end of path / work list.
Definition: CoreEngine.cpp:617
void enqueue(ExplodedNodeSet &Set)
Enqueue the given set of nodes onto the work list.
Definition: CoreEngine.cpp:606
bool erase(ExplodedNode *N)
void insert(const ExplodedNodeSet &S)
void Add(ExplodedNode *N)
const LocationContext * getLocationContext() const
bool operator!=(const iterator &X) const
Definition: CoreEngine.h:511
const Expr * getTarget() const
Definition: CoreEngine.h:529
const LocationContext * getLocationContext() const
Definition: CoreEngine.h:533
IndirectGotoNodeBuilder(ExplodedNode *pred, const CFGBlock *src, const Expr *e, const CFGBlock *dispatch, CoreEngine *eng)
Definition: CoreEngine.h:498
ProgramStateRef getState() const
Definition: CoreEngine.h:531
ExplodedNode * generateNode(const iterator &I, ProgramStateRef State, bool isSink=false)
Definition: CoreEngine.cpp:677
This node builder keeps track of the generated sink nodes.
Definition: CoreEngine.h:354
ExplodedNode * generateNode(ProgramStateRef State, ExplodedNode *Pred, const ProgramPointTag *Tag=nullptr)
Definition: CoreEngine.h:366
NodeBuilderWithSinks(ExplodedNode *Pred, ExplodedNodeSet &DstSet, const NodeBuilderContext &Ctx, ProgramPoint &L)
Definition: CoreEngine.h:362
ExplodedNode * generateSink(ProgramStateRef State, ExplodedNode *Pred, const ProgramPointTag *Tag=nullptr)
Definition: CoreEngine.h:373
const SmallVectorImpl< ExplodedNode * > & getSinks() const
Definition: CoreEngine.h:382
SmallVector< ExplodedNode *, 2 > sinksGenerated
Definition: CoreEngine.h:358
This is the simplest builder which generates nodes in the ExplodedGraph.
Definition: CoreEngine.h:247
const NodeBuilderContext & C
Definition: CoreEngine.h:251
virtual void finalizeResults()
Allow subclasses to finalize results before result_begin() is executed.
Definition: CoreEngine.h:276
bool Finalized
Specifies if the builder results have been finalized.
Definition: CoreEngine.h:255
virtual ~NodeBuilder()=default
void takeNodes(ExplodedNode *N)
Definition: CoreEngine.h:347
ExplodedNode * generateNode(const ProgramPoint &PP, ProgramStateRef State, ExplodedNode *Pred)
Generates a node in the ExplodedGraph.
Definition: CoreEngine.h:300
iterator begin()
Iterators through the results frontier.
Definition: CoreEngine.h:328
ExplodedNodeSet::iterator iterator
Definition: CoreEngine.h:325
void takeNodes(const ExplodedNodeSet &S)
Definition: CoreEngine.h:342
NodeBuilder(ExplodedNode *SrcNode, ExplodedNodeSet &DstSet, const NodeBuilderContext &Ctx, bool F=true)
Definition: CoreEngine.h:284
ExplodedNode * generateSink(const ProgramPoint &PP, ProgramStateRef State, ExplodedNode *Pred)
Generates a sink in the ExplodedGraph.
Definition: CoreEngine.h:313
ExplodedNodeSet & Frontier
The frontier set - a set of nodes which need to be propagated after the builder dies.
Definition: CoreEngine.h:261
void addNodes(ExplodedNode *N)
Definition: CoreEngine.h:349
void addNodes(const ExplodedNodeSet &S)
Definition: CoreEngine.h:348
const NodeBuilderContext & getContext()
Definition: CoreEngine.h:339
NodeBuilder(const ExplodedNodeSet &SrcSet, ExplodedNodeSet &DstSet, const NodeBuilderContext &Ctx, bool F=true)
Definition: CoreEngine.h:290
virtual bool checkResults()
Checks if the results are ready.
Definition: CoreEngine.h:264
ExplodedNode * generateNodeImpl(const ProgramPoint &PP, ProgramStateRef State, ExplodedNode *Pred, bool MarkAsSink=false)
Definition: CoreEngine.cpp:634
const ExplodedNodeSet & getResults()
Definition: CoreEngine.h:319
This builder class is useful for generating nodes that resulted from visiting a statement.
Definition: CoreEngine.h:391
ExplodedNode * generateNode(const Stmt *S, ExplodedNode *Pred, ProgramStateRef St, const ProgramPointTag *tag=nullptr, ProgramPoint::Kind K=ProgramPoint::PostStmtKind)
Definition: CoreEngine.h:420
ExplodedNode * generateSink(const Stmt *S, ExplodedNode *Pred, ProgramStateRef St, const ProgramPointTag *tag=nullptr, ProgramPoint::Kind K=ProgramPoint::PostStmtKind)
Definition: CoreEngine.h:430
StmtNodeBuilder(ExplodedNode *SrcNode, ExplodedNodeSet &DstSet, const NodeBuilderContext &Ctx, NodeBuilder *Enclosing=nullptr)
Constructs a StmtNodeBuilder.
Definition: CoreEngine.h:398
StmtNodeBuilder(ExplodedNodeSet &SrcSet, ExplodedNodeSet &DstSet, const NodeBuilderContext &Ctx, NodeBuilder *Enclosing=nullptr)
Definition: CoreEngine.h:406
bool operator==(const iterator &X) const
Definition: CoreEngine.h:559
bool operator!=(const iterator &X) const
Definition: CoreEngine.h:558
const CFGBlock * getBlock() const
Definition: CoreEngine.h:565
const CaseStmt * getCase() const
Definition: CoreEngine.h:561
ProgramStateRef getState() const
Definition: CoreEngine.h:585
const Expr * getCondition() const
Definition: CoreEngine.h:583
ExplodedNode * generateDefaultCaseNode(ProgramStateRef State, bool isSink=false)
Definition: CoreEngine.cpp:711
ExplodedNode * generateCaseStmtNode(const iterator &I, ProgramStateRef State)
Definition: CoreEngine.cpp:696
const LocationContext * getLocationContext() const
Definition: CoreEngine.h:587
SwitchNodeBuilder(ExplodedNode *pred, const CFGBlock *src, const Expr *condition, CoreEngine *eng)
Definition: CoreEngine.h:545
const SwitchStmt * getSwitch() const
Definition: CoreEngine.h:573
@ C
Languages that the frontend can parse and compile.
const CFGBlock * getBlock() const
Return the CFGBlock associated with this builder.
Definition: CoreEngine.h:227
NodeBuilderContext(const CoreEngine &E, const CFGBlock *B, const LocationContext *L)
Definition: CoreEngine.h:217
NodeBuilderContext(const CoreEngine &E, const CFGBlock *B, ExplodedNode *N)
Definition: CoreEngine.h:223
const LocationContext * LC
Definition: CoreEngine.h:215
unsigned blockCount() const
Returns the number of times the current basic block has been visited on the exploded graph path.
Definition: CoreEngine.h:231