clang  10.0.0svn
CoreEngine.h
Go to the documentation of this file.
1 //===- CoreEngine.h - Path-Sensitive Dataflow Engine ------------*- C++ -*-===//
2 //
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6 //
7 //===----------------------------------------------------------------------===//
8 //
9 // This file defines a generic engine for intraprocedural, path-sensitive,
10 // dataflow analysis via graph reachability.
11 //
12 //===----------------------------------------------------------------------===//
13 
14 #ifndef LLVM_CLANG_STATICANALYZER_CORE_PATHSENSITIVE_COREENGINE_H
15 #define LLVM_CLANG_STATICANALYZER_CORE_PATHSENSITIVE_COREENGINE_H
16 
17 #include "clang/AST/Stmt.h"
19 #include "clang/Analysis/CFG.h"
21 #include "clang/Basic/LLVM.h"
27 #include "llvm/ADT/SmallVector.h"
28 #include "llvm/Support/Casting.h"
29 #include <cassert>
30 #include <memory>
31 #include <utility>
32 #include <vector>
33 
34 namespace clang {
35 
36 class AnalyzerOptions;
37 class CXXBindTemporaryExpr;
38 class Expr;
39 class LabelDecl;
40 
41 namespace ento {
42 
43 class FunctionSummariesTy;
44 class SubEngine;
45 
46 //===----------------------------------------------------------------------===//
47 /// CoreEngine - Implements the core logic of the graph-reachability
48 /// analysis. It traverses the CFG and generates the ExplodedGraph.
49 /// Program "states" are treated as opaque void pointers.
50 /// The template class CoreEngine (which subclasses CoreEngine)
51 /// provides the matching component to the engine that knows the actual types
52 /// for states. Note that this engine only dispatches to transfer functions
53 /// at the statement and block-level. The analyses themselves must implement
54 /// any transfer function logic and the sub-expression level (if any).
55 class CoreEngine {
56  friend class CommonNodeBuilder;
58  friend class ExprEngine;
60  friend class NodeBuilder;
61  friend struct NodeBuilderContext;
62  friend class SwitchNodeBuilder;
63 
64 public:
65  using BlocksExhausted =
66  std::vector<std::pair<BlockEdge, const ExplodedNode *>>;
67 
68  using BlocksAborted =
69  std::vector<std::pair<const CFGBlock *, const ExplodedNode *>>;
70 
71 private:
72  SubEngine &SubEng;
73 
74  /// G - The simulation graph. Each node is a (location,state) pair.
75  mutable ExplodedGraph G;
76 
77  /// WList - A set of queued nodes that need to be processed by the
78  /// worklist algorithm. It is up to the implementation of WList to decide
79  /// the order that nodes are processed.
80  std::unique_ptr<WorkList> WList;
81 
82  /// BCounterFactory - A factory object for created BlockCounter objects.
83  /// These are used to record for key nodes in the ExplodedGraph the
84  /// number of times different CFGBlocks have been visited along a path.
85  BlockCounter::Factory BCounterFactory;
86 
87  /// The locations where we stopped doing work because we visited a location
88  /// too many times.
89  BlocksExhausted blocksExhausted;
90 
91  /// The locations where we stopped because the engine aborted analysis,
92  /// usually because it could not reason about something.
93  BlocksAborted blocksAborted;
94 
95  /// The information about functions shared by the whole translation unit.
96  /// (This data is owned by AnalysisConsumer.)
97  FunctionSummariesTy *FunctionSummaries;
98 
99  /// Add path note tags along the path when we see that something interesting
100  /// is happening. This field is the allocator for such tags.
101  NoteTag::Factory NoteTags;
102 
103  void generateNode(const ProgramPoint &Loc,
105  ExplodedNode *Pred);
106 
107  void HandleBlockEdge(const BlockEdge &E, ExplodedNode *Pred);
108  void HandleBlockEntrance(const BlockEntrance &E, ExplodedNode *Pred);
109  void HandleBlockExit(const CFGBlock *B, ExplodedNode *Pred);
110 
111  void HandleCallEnter(const CallEnter &CE, ExplodedNode *Pred);
112 
113  void HandlePostStmt(const CFGBlock *B, unsigned StmtIdx, ExplodedNode *Pred);
114 
115  void HandleBranch(const Stmt *Cond, const Stmt *Term, const CFGBlock *B,
116  ExplodedNode *Pred);
117  void HandleCleanupTemporaryBranch(const CXXBindTemporaryExpr *BTE,
118  const CFGBlock *B, ExplodedNode *Pred);
119 
120  /// Handle conditional logic for running static initializers.
121  void HandleStaticInit(const DeclStmt *DS, const CFGBlock *B,
122  ExplodedNode *Pred);
123 
124  void HandleVirtualBaseBranch(const CFGBlock *B, ExplodedNode *Pred);
125 
126 private:
127  ExplodedNode *generateCallExitBeginNode(ExplodedNode *N,
128  const ReturnStmt *RS);
129 
130 public:
131  /// Construct a CoreEngine object to analyze the provided CFG.
132  CoreEngine(SubEngine &subengine,
134  AnalyzerOptions &Opts);
135 
136  CoreEngine(const CoreEngine &) = delete;
137  CoreEngine &operator=(const CoreEngine &) = delete;
138 
139  /// getGraph - Returns the exploded graph.
140  ExplodedGraph &getGraph() { return G; }
141 
142  /// ExecuteWorkList - Run the worklist algorithm for a maximum number of
143  /// steps. Returns true if there is still simulation state on the worklist.
144  bool ExecuteWorkList(const LocationContext *L, unsigned Steps,
145  ProgramStateRef InitState);
146 
147  /// Returns true if there is still simulation state on the worklist.
149  unsigned Steps,
150  ProgramStateRef InitState,
151  ExplodedNodeSet &Dst);
152 
153  /// Dispatch the work list item based on the given location information.
154  /// Use Pred parameter as the predecessor state.
156  const WorkListUnit& WU);
157 
158  // Functions for external checking of whether we have unfinished work
159  bool wasBlockAborted() const { return !blocksAborted.empty(); }
160  bool wasBlocksExhausted() const { return !blocksExhausted.empty(); }
161  bool hasWorkRemaining() const { return wasBlocksExhausted() ||
162  WList->hasWork() ||
163  wasBlockAborted(); }
164 
165  /// Inform the CoreEngine that a basic block was aborted because
166  /// it could not be completely analyzed.
167  void addAbortedBlock(const ExplodedNode *node, const CFGBlock *block) {
168  blocksAborted.push_back(std::make_pair(block, node));
169  }
170 
171  WorkList *getWorkList() const { return WList.get(); }
172 
173  BlocksExhausted::const_iterator blocks_exhausted_begin() const {
174  return blocksExhausted.begin();
175  }
176 
177  BlocksExhausted::const_iterator blocks_exhausted_end() const {
178  return blocksExhausted.end();
179  }
180 
181  BlocksAborted::const_iterator blocks_aborted_begin() const {
182  return blocksAborted.begin();
183  }
184 
185  BlocksAborted::const_iterator blocks_aborted_end() const {
186  return blocksAborted.end();
187  }
188 
189  /// Enqueue the given set of nodes onto the work list.
190  void enqueue(ExplodedNodeSet &Set);
191 
192  /// Enqueue nodes that were created as a result of processing
193  /// a statement onto the work list.
194  void enqueue(ExplodedNodeSet &Set, const CFGBlock *Block, unsigned Idx);
195 
196  /// enqueue the nodes corresponding to the end of function onto the
197  /// end of path / work list.
198  void enqueueEndOfFunction(ExplodedNodeSet &Set, const ReturnStmt *RS);
199 
200  /// Enqueue a single node created as a result of statement processing.
201  void enqueueStmtNode(ExplodedNode *N, const CFGBlock *Block, unsigned Idx);
202 
203  NoteTag::Factory &getNoteTags() { return NoteTags; }
204 };
205 
206 // TODO: Turn into a class.
208  const CoreEngine &Eng;
209  const CFGBlock *Block;
211 
213  : Eng(E), Block(B), LC(N->getLocationContext()) { assert(B); }
214 
215  /// Return the CFGBlock associated with this builder.
216  const CFGBlock *getBlock() const { return Block; }
217 
218  /// Returns the number of times the current basic block has been
219  /// visited on the exploded graph path.
220  unsigned blockCount() const {
221  return Eng.WList->getBlockCounter().getNumVisited(
222  LC->getStackFrame(),
223  Block->getBlockID());
224  }
225 };
226 
227 /// \class NodeBuilder
228 /// This is the simplest builder which generates nodes in the
229 /// ExplodedGraph.
230 ///
231 /// The main benefit of the builder is that it automatically tracks the
232 /// frontier nodes (or destination set). This is the set of nodes which should
233 /// be propagated to the next step / builder. They are the nodes which have been
234 /// added to the builder (either as the input node set or as the newly
235 /// constructed nodes) but did not have any outgoing transitions added.
236 class NodeBuilder {
237  virtual void anchor();
238 
239 protected:
241 
242  /// Specifies if the builder results have been finalized. For example, if it
243  /// is set to false, autotransitions are yet to be generated.
244  bool Finalized;
245 
246  bool HasGeneratedNodes = false;
247 
248  /// The frontier set - a set of nodes which need to be propagated after
249  /// the builder dies.
251 
252  /// Checks if the results are ready.
253  virtual bool checkResults() {
254  return Finalized;
255  }
256 
258  for (const auto I : Frontier)
259  if (I->isSink())
260  return false;
261  return true;
262  }
263 
264  /// Allow subclasses to finalize results before result_begin() is executed.
265  virtual void finalizeResults() {}
266 
267  ExplodedNode *generateNodeImpl(const ProgramPoint &PP,
269  ExplodedNode *Pred,
270  bool MarkAsSink = false);
271 
272 public:
274  const NodeBuilderContext &Ctx, bool F = true)
275  : C(Ctx), Finalized(F), Frontier(DstSet) {
276  Frontier.Add(SrcNode);
277  }
278 
280  const NodeBuilderContext &Ctx, bool F = true)
281  : C(Ctx), Finalized(F), Frontier(DstSet) {
282  Frontier.insert(SrcSet);
283  assert(hasNoSinksInFrontier());
284  }
285 
286  virtual ~NodeBuilder() = default;
287 
288  /// Generates a node in the ExplodedGraph.
290  ProgramStateRef State,
291  ExplodedNode *Pred) {
292  return generateNodeImpl(PP, State, Pred, false);
293  }
294 
295  /// Generates a sink in the ExplodedGraph.
296  ///
297  /// When a node is marked as sink, the exploration from the node is stopped -
298  /// the node becomes the last node on the path and certain kinds of bugs are
299  /// suppressed.
301  ProgramStateRef State,
302  ExplodedNode *Pred) {
303  return generateNodeImpl(PP, State, Pred, true);
304  }
305 
307  finalizeResults();
308  assert(checkResults());
309  return Frontier;
310  }
311 
313 
314  /// Iterators through the results frontier.
316  finalizeResults();
317  assert(checkResults());
318  return Frontier.begin();
319  }
320 
322  finalizeResults();
323  return Frontier.end();
324  }
325 
326  const NodeBuilderContext &getContext() { return C; }
327  bool hasGeneratedNodes() { return HasGeneratedNodes; }
328 
329  void takeNodes(const ExplodedNodeSet &S) {
330  for (const auto I : S)
331  Frontier.erase(I);
332  }
333 
334  void takeNodes(ExplodedNode *N) { Frontier.erase(N); }
335  void addNodes(const ExplodedNodeSet &S) { Frontier.insert(S); }
336  void addNodes(ExplodedNode *N) { Frontier.Add(N); }
337 };
338 
339 /// \class NodeBuilderWithSinks
340 /// This node builder keeps track of the generated sink nodes.
342  void anchor() override;
343 
344 protected:
347 
348 public:
350  const NodeBuilderContext &Ctx, ProgramPoint &L)
351  : NodeBuilder(Pred, DstSet, Ctx), Location(L) {}
352 
354  ExplodedNode *Pred,
355  const ProgramPointTag *Tag = nullptr) {
356  const ProgramPoint &LocalLoc = (Tag ? Location.withTag(Tag) : Location);
357  return NodeBuilder::generateNode(LocalLoc, State, Pred);
358  }
359 
361  const ProgramPointTag *Tag = nullptr) {
362  const ProgramPoint &LocalLoc = (Tag ? Location.withTag(Tag) : Location);
363  ExplodedNode *N = NodeBuilder::generateSink(LocalLoc, State, Pred);
364  if (N && N->isSink())
365  sinksGenerated.push_back(N);
366  return N;
367  }
368 
370  return sinksGenerated;
371  }
372 };
373 
374 /// \class StmtNodeBuilder
375 /// This builder class is useful for generating nodes that resulted from
376 /// visiting a statement. The main difference from its parent NodeBuilder is
377 /// that it creates a statement specific ProgramPoint.
379  NodeBuilder *EnclosingBldr;
380 
381 public:
382  /// Constructs a StmtNodeBuilder. If the builder is going to process
383  /// nodes currently owned by another builder(with larger scope), use
384  /// Enclosing builder to transfer ownership.
386  const NodeBuilderContext &Ctx,
387  NodeBuilder *Enclosing = nullptr)
388  : NodeBuilder(SrcNode, DstSet, Ctx), EnclosingBldr(Enclosing) {
389  if (EnclosingBldr)
390  EnclosingBldr->takeNodes(SrcNode);
391  }
392 
394  const NodeBuilderContext &Ctx,
395  NodeBuilder *Enclosing = nullptr)
396  : NodeBuilder(SrcSet, DstSet, Ctx), EnclosingBldr(Enclosing) {
397  if (EnclosingBldr)
398  for (const auto I : SrcSet)
399  EnclosingBldr->takeNodes(I);
400  }
401 
402  ~StmtNodeBuilder() override;
403 
406 
408  ExplodedNode *Pred,
409  ProgramStateRef St,
410  const ProgramPointTag *tag = nullptr,
413  Pred->getLocationContext(), tag);
414  return NodeBuilder::generateNode(L, St, Pred);
415  }
416 
418  ExplodedNode *Pred,
419  ProgramStateRef St,
420  const ProgramPointTag *tag = nullptr,
423  Pred->getLocationContext(), tag);
424  return NodeBuilder::generateSink(L, St, Pred);
425  }
426 };
427 
428 /// BranchNodeBuilder is responsible for constructing the nodes
429 /// corresponding to the two branches of the if statement - true and false.
431  const CFGBlock *DstT;
432  const CFGBlock *DstF;
433 
434  bool InFeasibleTrue;
435  bool InFeasibleFalse;
436 
437  void anchor() override;
438 
439 public:
441  const NodeBuilderContext &C,
442  const CFGBlock *dstT, const CFGBlock *dstF)
443  : NodeBuilder(SrcNode, DstSet, C), DstT(dstT), DstF(dstF),
444  InFeasibleTrue(!DstT), InFeasibleFalse(!DstF) {
445  // The branch node builder does not generate autotransitions.
446  // If there are no successors it means that both branches are infeasible.
447  takeNodes(SrcNode);
448  }
449 
451  const NodeBuilderContext &C,
452  const CFGBlock *dstT, const CFGBlock *dstF)
453  : NodeBuilder(SrcSet, DstSet, C), DstT(dstT), DstF(dstF),
454  InFeasibleTrue(!DstT), InFeasibleFalse(!DstF) {
455  takeNodes(SrcSet);
456  }
457 
458  ExplodedNode *generateNode(ProgramStateRef State, bool branch,
459  ExplodedNode *Pred);
460 
461  const CFGBlock *getTargetBlock(bool branch) const {
462  return branch ? DstT : DstF;
463  }
464 
465  void markInfeasible(bool branch) {
466  if (branch)
467  InFeasibleTrue = true;
468  else
469  InFeasibleFalse = true;
470  }
471 
472  bool isFeasible(bool branch) {
473  return branch ? !InFeasibleTrue : !InFeasibleFalse;
474  }
475 };
476 
478  CoreEngine& Eng;
479  const CFGBlock *Src;
480  const CFGBlock &DispatchBlock;
481  const Expr *E;
482  ExplodedNode *Pred;
483 
484 public:
486  const Expr *e, const CFGBlock *dispatch, CoreEngine* eng)
487  : Eng(*eng), Src(src), DispatchBlock(*dispatch), E(e), Pred(pred) {}
488 
489  class iterator {
491 
493 
495 
496  public:
497  iterator &operator++() { ++I; return *this; }
498  bool operator!=(const iterator &X) const { return I != X.I; }
499 
500  const LabelDecl *getLabel() const {
501  return cast<LabelStmt>((*I)->getLabel())->getDecl();
502  }
503 
504  const CFGBlock *getBlock() const {
505  return *I;
506  }
507  };
508 
509  iterator begin() { return iterator(DispatchBlock.succ_begin()); }
510  iterator end() { return iterator(DispatchBlock.succ_end()); }
511 
512  ExplodedNode *generateNode(const iterator &I,
514  bool isSink = false);
515 
516  const Expr *getTarget() const { return E; }
517 
518  ProgramStateRef getState() const { return Pred->State; }
519 
521  return Pred->getLocationContext();
522  }
523 };
524 
526  CoreEngine& Eng;
527  const CFGBlock *Src;
528  const Expr *Condition;
529  ExplodedNode *Pred;
530 
531 public:
533  const Expr *condition, CoreEngine* eng)
534  : Eng(*eng), Src(src), Condition(condition), Pred(pred) {}
535 
536  class iterator {
537  friend class SwitchNodeBuilder;
538 
540 
542 
543  public:
544  iterator &operator++() { ++I; return *this; }
545  bool operator!=(const iterator &X) const { return I != X.I; }
546  bool operator==(const iterator &X) const { return I == X.I; }
547 
548  const CaseStmt *getCase() const {
549  return cast<CaseStmt>((*I)->getLabel());
550  }
551 
552  const CFGBlock *getBlock() const {
553  return *I;
554  }
555  };
556 
557  iterator begin() { return iterator(Src->succ_rbegin()+1); }
558  iterator end() { return iterator(Src->succ_rend()); }
559 
560  const SwitchStmt *getSwitch() const {
561  return cast<SwitchStmt>(Src->getTerminator());
562  }
563 
564  ExplodedNode *generateCaseStmtNode(const iterator &I,
566 
567  ExplodedNode *generateDefaultCaseNode(ProgramStateRef State,
568  bool isSink = false);
569 
570  const Expr *getCondition() const { return Condition; }
571 
572  ProgramStateRef getState() const { return Pred->State; }
573 
575  return Pred->getLocationContext();
576  }
577 };
578 
579 } // namespace ento
580 
581 } // namespace clang
582 
583 #endif // LLVM_CLANG_STATICANALYZER_CORE_PATHSENSITIVE_COREENGINE_H
bool operator!=(const iterator &X) const
Definition: CoreEngine.h:545
succ_reverse_iterator succ_rbegin()
Definition: CFG.h:961
void markInfeasible(bool branch)
Definition: CoreEngine.h:465
succ_iterator succ_begin()
Definition: CFG.h:956
unsigned blockCount() const
Returns the number of times the current basic block has been visited on the exploded graph path...
Definition: CoreEngine.h:220
bool ExecuteWorkList(const LocationContext *L, unsigned Steps, ProgramStateRef InitState)
ExecuteWorkList - Run the worklist algorithm for a maximum number of steps.
Definition: CoreEngine.cpp:80
Stmt - This represents one statement.
Definition: Stmt.h:66
ExplodedNodeSet::iterator iterator
Definition: CoreEngine.h:312
This builder class is useful for generating nodes that resulted from visiting a statement.
Definition: CoreEngine.h:378
bool wasBlockAborted() const
Definition: CoreEngine.h:159
unsigned getBlockID() const
Definition: CFG.h:1075
Represents a point when we begin processing an inlined call.
Definition: ProgramPoint.h:630
ProgramPoint withTag(const ProgramPointTag *tag) const
Create a new ProgramPoint object that is the same as the original except for using the specified tag ...
Definition: ProgramPoint.h:132
IndirectGotoNodeBuilder(ExplodedNode *pred, const CFGBlock *src, const Expr *e, const CFGBlock *dispatch, CoreEngine *eng)
Definition: CoreEngine.h:485
NoteTag::Factory & getNoteTags()
Definition: CoreEngine.h:203
const CaseStmt * getCase() const
Definition: CoreEngine.h:548
NodeBuilderWithSinks(ExplodedNode *Pred, ExplodedNodeSet &DstSet, const NodeBuilderContext &Ctx, ProgramPoint &L)
Definition: CoreEngine.h:349
BranchNodeBuilder(ExplodedNode *SrcNode, ExplodedNodeSet &DstSet, const NodeBuilderContext &C, const CFGBlock *dstT, const CFGBlock *dstF)
Definition: CoreEngine.h:440
void takeNodes(const ExplodedNodeSet &S)
Definition: CoreEngine.h:329
virtual void finalizeResults()
Allow subclasses to finalize results before result_begin() is executed.
Definition: CoreEngine.h:265
BlocksAborted::const_iterator blocks_aborted_begin() const
Definition: CoreEngine.h:181
void enqueue(ExplodedNodeSet &Set)
Enqueue the given set of nodes onto the work list.
Definition: CoreEngine.cpp:577
bool ExecuteWorkListWithInitialState(const LocationContext *L, unsigned Steps, ProgramStateRef InitState, ExplodedNodeSet &Dst)
Returns true if there is still simulation state on the worklist.
Definition: CoreEngine.cpp:197
static ProgramPoint getProgramPoint(const Stmt *S, ProgramPoint::Kind K, const LocationContext *LC, const ProgramPointTag *tag)
BlocksExhausted::const_iterator blocks_exhausted_end() const
Definition: CoreEngine.h:177
const CFGBlock * getTargetBlock(bool branch) const
Definition: CoreEngine.h:461
bool hasWorkRemaining() const
Definition: CoreEngine.h:161
bool operator==(const iterator &X) const
Definition: CoreEngine.h:546
bool Finalized
Specifies if the builder results have been finalized.
Definition: CoreEngine.h:244
LineState State
CoreEngine(SubEngine &subengine, FunctionSummariesTy *FS, AnalyzerOptions &Opts)
Construct a CoreEngine object to analyze the provided CFG.
Definition: CoreEngine.cpp:74
BlocksExhausted::const_iterator blocks_exhausted_begin() const
Definition: CoreEngine.h:173
friend class CommonNodeBuilder
Definition: CoreEngine.h:56
AdjacentBlocks::const_iterator const_succ_iterator
Definition: CFG.h:932
ExplodedNode * generateSink(const Stmt *S, ExplodedNode *Pred, ProgramStateRef St, const ProgramPointTag *tag=nullptr, ProgramPoint::Kind K=ProgramPoint::PostStmtKind)
Definition: CoreEngine.h:417
WorkList * getWorkList() const
Definition: CoreEngine.h:171
void addNodes(ExplodedNode *N)
Definition: CoreEngine.h:336
Forward-declares and imports various common LLVM datatypes that clang wants to use unqualified...
const LocationContext * getLocationContext() const
const CFGBlock * getBlock() const
Definition: CoreEngine.h:552
ExplodedNodeSet & Frontier
The frontier set - a set of nodes which need to be propagated after the builder dies.
Definition: CoreEngine.h:250
const SmallVectorImpl< ExplodedNode * > & getSinks() const
Definition: CoreEngine.h:369
CaseStmt - Represent a case statement.
Definition: Stmt.h:1478
Represents binding an expression to a temporary.
Definition: ExprCXX.h:1282
RangeSelector node(std::string ID)
Selects a node, including trailing semicolon (for non-expression statements).
StmtNodeBuilder(ExplodedNodeSet &SrcSet, ExplodedNodeSet &DstSet, const NodeBuilderContext &Ctx, NodeBuilder *Enclosing=nullptr)
Definition: CoreEngine.h:393
Represents a single basic block in a source-level CFG.
Definition: CFG.h:576
ExplodedNode * generateSink(const ProgramPoint &PP, ProgramStateRef State, ExplodedNode *Pred)
Generates a sink in the ExplodedGraph.
Definition: CoreEngine.h:300
This represents one expression.
Definition: Expr.h:108
ExplodedGraph & getGraph()
getGraph - Returns the exploded graph.
Definition: CoreEngine.h:140
const Expr * getCondition() const
Definition: CoreEngine.h:570
std::vector< std::pair< const CFGBlock *, const ExplodedNode * > > BlocksAborted
Definition: CoreEngine.h:69
This is the simplest builder which generates nodes in the ExplodedGraph.
Definition: CoreEngine.h:236
void Add(ExplodedNode *N)
const ExplodedNodeSet & getResults()
Definition: CoreEngine.h:306
const LocationContext * getLocationContext() const
Definition: CoreEngine.h:574
SmallVector< ExplodedNode *, 2 > sinksGenerated
Definition: CoreEngine.h:345
void enqueueStmtNode(ExplodedNode *N, const CFGBlock *Block, unsigned Idx)
Enqueue a single node created as a result of statement processing.
Definition: CoreEngine.cpp:513
ReturnStmt - This represents a return, optionally of an expression: return; return 4;...
Definition: Stmt.h:2610
const SwitchStmt * getSwitch() const
Definition: CoreEngine.h:560
virtual bool checkResults()
Checks if the results are ready.
Definition: CoreEngine.h:253
BlocksAborted::const_iterator blocks_aborted_end() const
Definition: CoreEngine.h:185
const LocationContext * getLocationContext() const
Definition: CoreEngine.h:520
ProgramPoints can be "tagged" as representing points specific to a given analysis entity...
Definition: ProgramPoint.h:39
bool wasBlocksExhausted() const
Definition: CoreEngine.h:160
DeclStmt - Adaptor class for mixing declarations with statements and expressions. ...
Definition: Stmt.h:1203
Represents the declaration of a label.
Definition: Decl.h:476
ExplodedNode * generateNode(ProgramStateRef State, ExplodedNode *Pred, const ProgramPointTag *Tag=nullptr)
Definition: CoreEngine.h:353
void dispatchWorkItem(ExplodedNode *Pred, ProgramPoint Loc, const WorkListUnit &WU)
Dispatch the work list item based on the given location information.
Definition: CoreEngine.cpp:154
succ_reverse_iterator succ_rend()
Definition: CFG.h:962
succ_iterator succ_end()
Definition: CFG.h:957
bool operator!=(const iterator &X) const
Definition: CoreEngine.h:498
void insert(const ExplodedNodeSet &S)
std::vector< std::pair< BlockEdge, const ExplodedNode * > > BlocksExhausted
Definition: CoreEngine.h:66
CoreEngine - Implements the core logic of the graph-reachability analysis.
Definition: CoreEngine.h:55
Dataflow Directional Tag Classes.
void takeNodes(ExplodedNode *N)
Definition: CoreEngine.h:334
void addNodes(const ExplodedNodeSet &S)
Definition: CoreEngine.h:335
const NodeBuilderContext & getContext()
Definition: CoreEngine.h:326
BranchNodeBuilder(const ExplodedNodeSet &SrcSet, ExplodedNodeSet &DstSet, const NodeBuilderContext &C, const CFGBlock *dstT, const CFGBlock *dstF)
Definition: CoreEngine.h:450
This node builder keeps track of the generated sink nodes.
Definition: CoreEngine.h:341
BranchNodeBuilder is responsible for constructing the nodes corresponding to the two branches of the ...
Definition: CoreEngine.h:430
ProgramStateRef getState() const
Definition: CoreEngine.h:572
NodeBuilderContext(const CoreEngine &E, const CFGBlock *B, ExplodedNode *N)
Definition: CoreEngine.h:212
SwitchStmt - This represents a &#39;switch&#39; stmt.
Definition: Stmt.h:2017
friend class EndOfFunctionNodeBuilder
Definition: CoreEngine.h:57
ExplodedNode * generateSink(ProgramStateRef State, ExplodedNode *Pred, const ProgramPointTag *Tag=nullptr)
Definition: CoreEngine.h:360
const StackFrameContext * getStackFrame() const
AdjacentBlocks::const_reverse_iterator const_succ_reverse_iterator
Definition: CFG.h:934
Stores options for the analyzer from the command line.
void addAbortedBlock(const ExplodedNode *node, const CFGBlock *block)
Inform the CoreEngine that a basic block was aborted because it could not be completely analyzed...
Definition: CoreEngine.h:167
bool erase(ExplodedNode *N)
const NodeBuilderContext & C
Definition: CoreEngine.h:240
void enqueueEndOfFunction(ExplodedNodeSet &Set, const ReturnStmt *RS)
enqueue the nodes corresponding to the end of function onto the end of path / work list...
Definition: CoreEngine.cpp:588
X
Add a minimal nested name specifier fixit hint to allow lookup of a tag name from an outer enclosing ...
Definition: SemaDecl.cpp:14647
ExplodedNode * generateNode(const ProgramPoint &PP, ProgramStateRef State, ExplodedNode *Pred)
Generates a node in the ExplodedGraph.
Definition: CoreEngine.h:289
SwitchNodeBuilder(ExplodedNode *pred, const CFGBlock *src, const Expr *condition, CoreEngine *eng)
Definition: CoreEngine.h:532
StmtNodeBuilder(ExplodedNode *SrcNode, ExplodedNodeSet &DstSet, const NodeBuilderContext &Ctx, NodeBuilder *Enclosing=nullptr)
Constructs a StmtNodeBuilder.
Definition: CoreEngine.h:385
ProgramStateRef getState() const
Definition: CoreEngine.h:518
CoreEngine & operator=(const CoreEngine &)=delete
NodeBuilder(ExplodedNode *SrcNode, ExplodedNodeSet &DstSet, const NodeBuilderContext &Ctx, bool F=true)
Definition: CoreEngine.h:273
ExplodedNode * generateNode(const Stmt *S, ExplodedNode *Pred, ProgramStateRef St, const ProgramPointTag *tag=nullptr, ProgramPoint::Kind K=ProgramPoint::PostStmtKind)
Definition: CoreEngine.h:407
iterator begin()
Iterators through the results frontier.
Definition: CoreEngine.h:315
NodeBuilder(const ExplodedNodeSet &SrcSet, ExplodedNodeSet &DstSet, const NodeBuilderContext &Ctx, bool F=true)
Definition: CoreEngine.h:279
CFGTerminator getTerminator() const
Definition: CFG.h:1049
bool isFeasible(bool branch)
Definition: CoreEngine.h:472
const Expr * getTarget() const
Definition: CoreEngine.h:516
const CFGBlock * getBlock() const
Return the CFGBlock associated with this builder.
Definition: CoreEngine.h:216
const LocationContext * LC
Definition: CoreEngine.h:210