clang  15.0.0git
ExprEngineC.cpp
Go to the documentation of this file.
1 //=-- ExprEngineC.cpp - ExprEngine support for C expressions ----*- C++ -*-===//
2 //
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6 //
7 //===----------------------------------------------------------------------===//
8 //
9 // This file defines ExprEngine's support for C expressions.
10 //
11 //===----------------------------------------------------------------------===//
12 
13 #include "clang/AST/ExprCXX.h"
14 #include "clang/AST/DeclCXX.h"
17 
18 using namespace clang;
19 using namespace ento;
20 using llvm::APSInt;
21 
22 /// Optionally conjure and return a symbol for offset when processing
23 /// an expression \p Expression.
24 /// If \p Other is a location, conjure a symbol for \p Symbol
25 /// (offset) if it is unknown so that memory arithmetic always
26 /// results in an ElementRegion.
27 /// \p Count The number of times the current basic block was visited.
29  SVal Symbol, SVal Other, Expr* Expression, SValBuilder &svalBuilder,
30  unsigned Count, const LocationContext *LCtx) {
31  QualType Ty = Expression->getType();
32  if (Other.getAs<Loc>() &&
34  Symbol.isUnknown()) {
35  return svalBuilder.conjureSymbolVal(Expression, LCtx, Ty, Count);
36  }
37  return Symbol;
38 }
39 
41  ExplodedNode *Pred,
42  ExplodedNodeSet &Dst) {
43 
44  Expr *LHS = B->getLHS()->IgnoreParens();
45  Expr *RHS = B->getRHS()->IgnoreParens();
46 
47  // FIXME: Prechecks eventually go in ::Visit().
48  ExplodedNodeSet CheckedSet;
49  ExplodedNodeSet Tmp2;
50  getCheckerManager().runCheckersForPreStmt(CheckedSet, Pred, B, *this);
51 
52  // With both the LHS and RHS evaluated, process the operation itself.
53  for (ExplodedNodeSet::iterator it=CheckedSet.begin(), ei=CheckedSet.end();
54  it != ei; ++it) {
55 
56  ProgramStateRef state = (*it)->getState();
57  const LocationContext *LCtx = (*it)->getLocationContext();
58  SVal LeftV = state->getSVal(LHS, LCtx);
59  SVal RightV = state->getSVal(RHS, LCtx);
60 
62 
63  if (Op == BO_Assign) {
64  // EXPERIMENTAL: "Conjured" symbols.
65  // FIXME: Handle structs.
66  if (RightV.isUnknown()) {
67  unsigned Count = currBldrCtx->blockCount();
68  RightV = svalBuilder.conjureSymbolVal(nullptr, B->getRHS(), LCtx,
69  Count);
70  }
71  // Simulate the effects of a "store": bind the value of the RHS
72  // to the L-Value represented by the LHS.
73  SVal ExprVal = B->isGLValue() ? LeftV : RightV;
74  evalStore(Tmp2, B, LHS, *it, state->BindExpr(B, LCtx, ExprVal),
75  LeftV, RightV);
76  continue;
77  }
78 
79  if (!B->isAssignmentOp()) {
80  StmtNodeBuilder Bldr(*it, Tmp2, *currBldrCtx);
81 
82  if (B->isAdditiveOp()) {
83  // TODO: This can be removed after we enable history tracking with
84  // SymSymExpr.
85  unsigned Count = currBldrCtx->blockCount();
87  RightV, LeftV, RHS, svalBuilder, Count, LCtx);
89  LeftV, RightV, LHS, svalBuilder, Count, LCtx);
90  }
91 
92  // Although we don't yet model pointers-to-members, we do need to make
93  // sure that the members of temporaries have a valid 'this' pointer for
94  // other checks.
95  if (B->getOpcode() == BO_PtrMemD)
96  state = createTemporaryRegionIfNeeded(state, LCtx, LHS);
97 
98  // Process non-assignments except commas or short-circuited
99  // logical expressions (LAnd and LOr).
100  SVal Result = evalBinOp(state, Op, LeftV, RightV, B->getType());
101  if (!Result.isUnknown()) {
102  state = state->BindExpr(B, LCtx, Result);
103  } else {
104  // If we cannot evaluate the operation escape the operands.
105  state = escapeValues(state, LeftV, PSK_EscapeOther);
106  state = escapeValues(state, RightV, PSK_EscapeOther);
107  }
108 
109  Bldr.generateNode(B, *it, state);
110  continue;
111  }
112 
113  assert (B->isCompoundAssignmentOp());
114 
115  switch (Op) {
116  default:
117  llvm_unreachable("Invalid opcode for compound assignment.");
118  case BO_MulAssign: Op = BO_Mul; break;
119  case BO_DivAssign: Op = BO_Div; break;
120  case BO_RemAssign: Op = BO_Rem; break;
121  case BO_AddAssign: Op = BO_Add; break;
122  case BO_SubAssign: Op = BO_Sub; break;
123  case BO_ShlAssign: Op = BO_Shl; break;
124  case BO_ShrAssign: Op = BO_Shr; break;
125  case BO_AndAssign: Op = BO_And; break;
126  case BO_XorAssign: Op = BO_Xor; break;
127  case BO_OrAssign: Op = BO_Or; break;
128  }
129 
130  // Perform a load (the LHS). This performs the checks for
131  // null dereferences, and so on.
132  ExplodedNodeSet Tmp;
133  SVal location = LeftV;
134  evalLoad(Tmp, B, LHS, *it, state, location);
135 
136  for (ExplodedNodeSet::iterator I = Tmp.begin(), E = Tmp.end(); I != E;
137  ++I) {
138 
139  state = (*I)->getState();
140  const LocationContext *LCtx = (*I)->getLocationContext();
141  SVal V = state->getSVal(LHS, LCtx);
142 
143  // Get the computation type.
144  QualType CTy =
145  cast<CompoundAssignOperator>(B)->getComputationResultType();
146  CTy = getContext().getCanonicalType(CTy);
147 
148  QualType CLHSTy =
149  cast<CompoundAssignOperator>(B)->getComputationLHSType();
150  CLHSTy = getContext().getCanonicalType(CLHSTy);
151 
153 
154  // Promote LHS.
155  V = svalBuilder.evalCast(V, CLHSTy, LTy);
156 
157  // Compute the result of the operation.
158  SVal Result = svalBuilder.evalCast(evalBinOp(state, Op, V, RightV, CTy),
159  B->getType(), CTy);
160 
161  // EXPERIMENTAL: "Conjured" symbols.
162  // FIXME: Handle structs.
163 
164  SVal LHSVal;
165 
166  if (Result.isUnknown()) {
167  // The symbolic value is actually for the type of the left-hand side
168  // expression, not the computation type, as this is the value the
169  // LValue on the LHS will bind to.
170  LHSVal = svalBuilder.conjureSymbolVal(nullptr, B->getRHS(), LCtx, LTy,
171  currBldrCtx->blockCount());
172  // However, we need to convert the symbol to the computation type.
173  Result = svalBuilder.evalCast(LHSVal, CTy, LTy);
174  }
175  else {
176  // The left-hand side may bind to a different value then the
177  // computation type.
178  LHSVal = svalBuilder.evalCast(Result, LTy, CTy);
179  }
180 
181  // In C++, assignment and compound assignment operators return an
182  // lvalue.
183  if (B->isGLValue())
184  state = state->BindExpr(B, LCtx, location);
185  else
186  state = state->BindExpr(B, LCtx, Result);
187 
188  evalStore(Tmp2, B, LHS, *I, state, location, LHSVal);
189  }
190  }
191 
192  // FIXME: postvisits eventually go in ::Visit()
193  getCheckerManager().runCheckersForPostStmt(Dst, Tmp2, B, *this);
194 }
195 
197  ExplodedNodeSet &Dst) {
198 
200 
201  const BlockDecl *BD = BE->getBlockDecl();
202  // Get the value of the block itself.
203  SVal V = svalBuilder.getBlockPointer(BD, T,
204  Pred->getLocationContext(),
205  currBldrCtx->blockCount());
206 
207  ProgramStateRef State = Pred->getState();
208 
209  // If we created a new MemRegion for the block, we should explicitly bind
210  // the captured variables.
211  if (const BlockDataRegion *BDR =
212  dyn_cast_or_null<BlockDataRegion>(V.getAsRegion())) {
213 
214  BlockDataRegion::referenced_vars_iterator I = BDR->referenced_vars_begin(),
215  E = BDR->referenced_vars_end();
216 
217  auto CI = BD->capture_begin();
218  auto CE = BD->capture_end();
219  for (; I != E; ++I) {
220  const VarRegion *capturedR = I.getCapturedRegion();
221  const TypedValueRegion *originalR = I.getOriginalRegion();
222 
223  // If the capture had a copy expression, use the result of evaluating
224  // that expression, otherwise use the original value.
225  // We rely on the invariant that the block declaration's capture variables
226  // are a prefix of the BlockDataRegion's referenced vars (which may include
227  // referenced globals, etc.) to enable fast lookup of the capture for a
228  // given referenced var.
229  const Expr *copyExpr = nullptr;
230  if (CI != CE) {
231  assert(CI->getVariable() == capturedR->getDecl());
232  copyExpr = CI->getCopyExpr();
233  CI++;
234  }
235 
236  if (capturedR != originalR) {
237  SVal originalV;
238  const LocationContext *LCtx = Pred->getLocationContext();
239  if (copyExpr) {
240  originalV = State->getSVal(copyExpr, LCtx);
241  } else {
242  originalV = State->getSVal(loc::MemRegionVal(originalR));
243  }
244  State = State->bindLoc(loc::MemRegionVal(capturedR), originalV, LCtx);
245  }
246  }
247  }
248 
249  ExplodedNodeSet Tmp;
250  StmtNodeBuilder Bldr(Pred, Tmp, *currBldrCtx);
251  Bldr.generateNode(BE, Pred,
252  State->BindExpr(BE, Pred->getLocationContext(), V),
254 
255  // FIXME: Move all post/pre visits to ::Visit().
256  getCheckerManager().runCheckersForPostStmt(Dst, Tmp, BE, *this);
257 }
258 
260  ProgramStateRef state, const Expr* Ex, const LocationContext* LCtx,
261  QualType T, QualType ExTy, const CastExpr* CastE, StmtNodeBuilder& Bldr,
262  ExplodedNode* Pred) {
263  if (T->isLValueReferenceType()) {
264  assert(!CastE->getType()->isLValueReferenceType());
265  ExTy = getContext().getLValueReferenceType(ExTy);
266  } else if (T->isRValueReferenceType()) {
267  assert(!CastE->getType()->isRValueReferenceType());
268  ExTy = getContext().getRValueReferenceType(ExTy);
269  }
270  // Delegate to SValBuilder to process.
271  SVal OrigV = state->getSVal(Ex, LCtx);
272  SVal V = svalBuilder.evalCast(OrigV, T, ExTy);
273  // Negate the result if we're treating the boolean as a signed i1
274  if (CastE->getCastKind() == CK_BooleanToSignedIntegral)
275  V = evalMinus(V);
276  state = state->BindExpr(CastE, LCtx, V);
277  if (V.isUnknown() && !OrigV.isUnknown()) {
278  state = escapeValues(state, OrigV, PSK_EscapeOther);
279  }
280  Bldr.generateNode(CastE, Pred, state);
281 
282  return state;
283 }
284 
285 void ExprEngine::VisitCast(const CastExpr *CastE, const Expr *Ex,
286  ExplodedNode *Pred, ExplodedNodeSet &Dst) {
287 
288  ExplodedNodeSet dstPreStmt;
289  getCheckerManager().runCheckersForPreStmt(dstPreStmt, Pred, CastE, *this);
290 
291  if (CastE->getCastKind() == CK_LValueToRValue ||
292  CastE->getCastKind() == CK_LValueToRValueBitCast) {
293  for (ExplodedNodeSet::iterator I = dstPreStmt.begin(), E = dstPreStmt.end();
294  I!=E; ++I) {
295  ExplodedNode *subExprNode = *I;
296  ProgramStateRef state = subExprNode->getState();
297  const LocationContext *LCtx = subExprNode->getLocationContext();
298  evalLoad(Dst, CastE, CastE, subExprNode, state, state->getSVal(Ex, LCtx));
299  }
300  return;
301  }
302 
303  // All other casts.
304  QualType T = CastE->getType();
305  QualType ExTy = Ex->getType();
306 
307  if (const ExplicitCastExpr *ExCast=dyn_cast_or_null<ExplicitCastExpr>(CastE))
308  T = ExCast->getTypeAsWritten();
309 
310  StmtNodeBuilder Bldr(dstPreStmt, Dst, *currBldrCtx);
311  for (ExplodedNodeSet::iterator I = dstPreStmt.begin(), E = dstPreStmt.end();
312  I != E; ++I) {
313 
314  Pred = *I;
315  ProgramStateRef state = Pred->getState();
316  const LocationContext *LCtx = Pred->getLocationContext();
317 
318  switch (CastE->getCastKind()) {
319  case CK_LValueToRValue:
320  case CK_LValueToRValueBitCast:
321  llvm_unreachable("LValueToRValue casts handled earlier.");
322  case CK_ToVoid:
323  continue;
324  // The analyzer doesn't do anything special with these casts,
325  // since it understands retain/release semantics already.
326  case CK_ARCProduceObject:
327  case CK_ARCConsumeObject:
328  case CK_ARCReclaimReturnedObject:
329  case CK_ARCExtendBlockObject: // Fall-through.
330  case CK_CopyAndAutoreleaseBlockObject:
331  // The analyser can ignore atomic casts for now, although some future
332  // checkers may want to make certain that you're not modifying the same
333  // value through atomic and nonatomic pointers.
334  case CK_AtomicToNonAtomic:
335  case CK_NonAtomicToAtomic:
336  // True no-ops.
337  case CK_NoOp:
338  case CK_ConstructorConversion:
339  case CK_UserDefinedConversion:
340  case CK_FunctionToPointerDecay:
341  case CK_BuiltinFnToFnPtr: {
342  // Copy the SVal of Ex to CastE.
343  ProgramStateRef state = Pred->getState();
344  const LocationContext *LCtx = Pred->getLocationContext();
345  SVal V = state->getSVal(Ex, LCtx);
346  state = state->BindExpr(CastE, LCtx, V);
347  Bldr.generateNode(CastE, Pred, state);
348  continue;
349  }
350  case CK_MemberPointerToBoolean:
351  case CK_PointerToBoolean: {
352  SVal V = state->getSVal(Ex, LCtx);
353  auto PTMSV = V.getAs<nonloc::PointerToMember>();
354  if (PTMSV)
355  V = svalBuilder.makeTruthVal(!PTMSV->isNullMemberPointer(), ExTy);
356  if (V.isUndef() || PTMSV) {
357  state = state->BindExpr(CastE, LCtx, V);
358  Bldr.generateNode(CastE, Pred, state);
359  continue;
360  }
361  // Explicitly proceed with default handler for this case cascade.
362  state =
363  handleLValueBitCast(state, Ex, LCtx, T, ExTy, CastE, Bldr, Pred);
364  continue;
365  }
366  case CK_Dependent:
367  case CK_ArrayToPointerDecay:
368  case CK_BitCast:
369  case CK_AddressSpaceConversion:
370  case CK_BooleanToSignedIntegral:
371  case CK_IntegralToPointer:
372  case CK_PointerToIntegral: {
373  SVal V = state->getSVal(Ex, LCtx);
374  if (V.getAs<nonloc::PointerToMember>()) {
375  state = state->BindExpr(CastE, LCtx, UnknownVal());
376  Bldr.generateNode(CastE, Pred, state);
377  continue;
378  }
379  // Explicitly proceed with default handler for this case cascade.
380  state =
381  handleLValueBitCast(state, Ex, LCtx, T, ExTy, CastE, Bldr, Pred);
382  continue;
383  }
384  case CK_IntegralToBoolean:
385  case CK_IntegralToFloating:
386  case CK_FloatingToIntegral:
387  case CK_FloatingToBoolean:
388  case CK_FloatingCast:
389  case CK_FloatingRealToComplex:
390  case CK_FloatingComplexToReal:
391  case CK_FloatingComplexToBoolean:
392  case CK_FloatingComplexCast:
393  case CK_FloatingComplexToIntegralComplex:
394  case CK_IntegralRealToComplex:
395  case CK_IntegralComplexToReal:
396  case CK_IntegralComplexToBoolean:
397  case CK_IntegralComplexCast:
398  case CK_IntegralComplexToFloatingComplex:
399  case CK_CPointerToObjCPointerCast:
400  case CK_BlockPointerToObjCPointerCast:
401  case CK_AnyPointerToBlockPointerCast:
402  case CK_ObjCObjectLValueCast:
403  case CK_ZeroToOCLOpaqueType:
404  case CK_IntToOCLSampler:
405  case CK_LValueBitCast:
406  case CK_FloatingToFixedPoint:
407  case CK_FixedPointToFloating:
408  case CK_FixedPointCast:
409  case CK_FixedPointToBoolean:
410  case CK_FixedPointToIntegral:
411  case CK_IntegralToFixedPoint: {
412  state =
413  handleLValueBitCast(state, Ex, LCtx, T, ExTy, CastE, Bldr, Pred);
414  continue;
415  }
416  case CK_IntegralCast: {
417  // Delegate to SValBuilder to process.
418  SVal V = state->getSVal(Ex, LCtx);
419  if (AMgr.options.ShouldSupportSymbolicIntegerCasts)
420  V = svalBuilder.evalCast(V, T, ExTy);
421  else
422  V = svalBuilder.evalIntegralCast(state, V, T, ExTy);
423  state = state->BindExpr(CastE, LCtx, V);
424  Bldr.generateNode(CastE, Pred, state);
425  continue;
426  }
427  case CK_DerivedToBase:
428  case CK_UncheckedDerivedToBase: {
429  // For DerivedToBase cast, delegate to the store manager.
430  SVal val = state->getSVal(Ex, LCtx);
431  val = getStoreManager().evalDerivedToBase(val, CastE);
432  state = state->BindExpr(CastE, LCtx, val);
433  Bldr.generateNode(CastE, Pred, state);
434  continue;
435  }
436  // Handle C++ dyn_cast.
437  case CK_Dynamic: {
438  SVal val = state->getSVal(Ex, LCtx);
439 
440  // Compute the type of the result.
441  QualType resultType = CastE->getType();
442  if (CastE->isGLValue())
443  resultType = getContext().getPointerType(resultType);
444 
445  bool Failed = true;
446 
447  // Check if the value being cast does not evaluates to 0.
448  if (!val.isZeroConstant())
449  if (Optional<SVal> V =
450  StateMgr.getStoreManager().evalBaseToDerived(val, T)) {
451  val = *V;
452  Failed = false;
453  }
454 
455  if (Failed) {
456  if (T->isReferenceType()) {
457  // A bad_cast exception is thrown if input value is a reference.
458  // Currently, we model this, by generating a sink.
459  Bldr.generateSink(CastE, Pred, state);
460  continue;
461  } else {
462  // If the cast fails on a pointer, bind to 0.
463  state = state->BindExpr(CastE, LCtx,
464  svalBuilder.makeNullWithType(resultType));
465  }
466  } else {
467  // If we don't know if the cast succeeded, conjure a new symbol.
468  if (val.isUnknown()) {
469  DefinedOrUnknownSVal NewSym =
470  svalBuilder.conjureSymbolVal(nullptr, CastE, LCtx, resultType,
471  currBldrCtx->blockCount());
472  state = state->BindExpr(CastE, LCtx, NewSym);
473  } else
474  // Else, bind to the derived region value.
475  state = state->BindExpr(CastE, LCtx, val);
476  }
477  Bldr.generateNode(CastE, Pred, state);
478  continue;
479  }
480  case CK_BaseToDerived: {
481  SVal val = state->getSVal(Ex, LCtx);
482  QualType resultType = CastE->getType();
483  if (CastE->isGLValue())
484  resultType = getContext().getPointerType(resultType);
485 
486  if (!val.isConstant()) {
488  val = V ? *V : UnknownVal();
489  }
490 
491  // Failed to cast or the result is unknown, fall back to conservative.
492  if (val.isUnknown()) {
493  val =
494  svalBuilder.conjureSymbolVal(nullptr, CastE, LCtx, resultType,
495  currBldrCtx->blockCount());
496  }
497  state = state->BindExpr(CastE, LCtx, val);
498  Bldr.generateNode(CastE, Pred, state);
499  continue;
500  }
501  case CK_NullToPointer: {
502  SVal V = svalBuilder.makeNullWithType(CastE->getType());
503  state = state->BindExpr(CastE, LCtx, V);
504  Bldr.generateNode(CastE, Pred, state);
505  continue;
506  }
507  case CK_NullToMemberPointer: {
508  SVal V = svalBuilder.getMemberPointer(nullptr);
509  state = state->BindExpr(CastE, LCtx, V);
510  Bldr.generateNode(CastE, Pred, state);
511  continue;
512  }
513  case CK_DerivedToBaseMemberPointer:
514  case CK_BaseToDerivedMemberPointer:
515  case CK_ReinterpretMemberPointer: {
516  SVal V = state->getSVal(Ex, LCtx);
517  if (auto PTMSV = V.getAs<nonloc::PointerToMember>()) {
518  SVal CastedPTMSV =
519  svalBuilder.makePointerToMember(getBasicVals().accumCXXBase(
520  CastE->path(), *PTMSV, CastE->getCastKind()));
521  state = state->BindExpr(CastE, LCtx, CastedPTMSV);
522  Bldr.generateNode(CastE, Pred, state);
523  continue;
524  }
525  // Explicitly proceed with default handler for this case cascade.
526  }
527  LLVM_FALLTHROUGH;
528  // Various C++ casts that are not handled yet.
529  case CK_ToUnion:
530  case CK_MatrixCast:
531  case CK_VectorSplat: {
532  QualType resultType = CastE->getType();
533  if (CastE->isGLValue())
534  resultType = getContext().getPointerType(resultType);
535  SVal result = svalBuilder.conjureSymbolVal(
536  /*symbolTag=*/nullptr, CastE, LCtx, resultType,
537  currBldrCtx->blockCount());
538  state = state->BindExpr(CastE, LCtx, result);
539  Bldr.generateNode(CastE, Pred, state);
540  continue;
541  }
542  }
543  }
544 }
545 
547  ExplodedNode *Pred,
548  ExplodedNodeSet &Dst) {
549  StmtNodeBuilder B(Pred, Dst, *currBldrCtx);
550 
551  ProgramStateRef State = Pred->getState();
552  const LocationContext *LCtx = Pred->getLocationContext();
553 
554  const Expr *Init = CL->getInitializer();
555  SVal V = State->getSVal(CL->getInitializer(), LCtx);
556 
557  if (isa<CXXConstructExpr, CXXStdInitializerListExpr>(Init)) {
558  // No work needed. Just pass the value up to this expression.
559  } else {
560  assert(isa<InitListExpr>(Init));
561  Loc CLLoc = State->getLValue(CL, LCtx);
562  State = State->bindLoc(CLLoc, V, LCtx);
563 
564  if (CL->isGLValue())
565  V = CLLoc;
566  }
567 
568  B.generateNode(CL, Pred, State->BindExpr(CL, LCtx, V));
569 }
570 
572  ExplodedNodeSet &Dst) {
573  if (isa<TypedefNameDecl>(*DS->decl_begin())) {
574  // C99 6.7.7 "Any array size expressions associated with variable length
575  // array declarators are evaluated each time the declaration of the typedef
576  // name is reached in the order of execution."
577  // The checkers should know about typedef to be able to handle VLA size
578  // expressions.
579  ExplodedNodeSet DstPre;
580  getCheckerManager().runCheckersForPreStmt(DstPre, Pred, DS, *this);
581  getCheckerManager().runCheckersForPostStmt(Dst, DstPre, DS, *this);
582  return;
583  }
584 
585  // Assumption: The CFG has one DeclStmt per Decl.
586  const VarDecl *VD = dyn_cast_or_null<VarDecl>(*DS->decl_begin());
587 
588  if (!VD) {
589  //TODO:AZ: remove explicit insertion after refactoring is done.
590  Dst.insert(Pred);
591  return;
592  }
593 
594  // FIXME: all pre/post visits should eventually be handled by ::Visit().
595  ExplodedNodeSet dstPreVisit;
596  getCheckerManager().runCheckersForPreStmt(dstPreVisit, Pred, DS, *this);
597 
598  ExplodedNodeSet dstEvaluated;
599  StmtNodeBuilder B(dstPreVisit, dstEvaluated, *currBldrCtx);
600  for (ExplodedNodeSet::iterator I = dstPreVisit.begin(), E = dstPreVisit.end();
601  I!=E; ++I) {
602  ExplodedNode *N = *I;
604  const LocationContext *LC = N->getLocationContext();
605 
606  // Decls without InitExpr are not initialized explicitly.
607  if (const Expr *InitEx = VD->getInit()) {
608 
609  // Note in the state that the initialization has occurred.
610  ExplodedNode *UpdatedN = N;
611  SVal InitVal = state->getSVal(InitEx, LC);
612 
613  assert(DS->isSingleDecl());
614  if (getObjectUnderConstruction(state, DS, LC)) {
615  state = finishObjectConstruction(state, DS, LC);
616  // We constructed the object directly in the variable.
617  // No need to bind anything.
618  B.generateNode(DS, UpdatedN, state);
619  } else {
620  // Recover some path-sensitivity if a scalar value evaluated to
621  // UnknownVal.
622  if (InitVal.isUnknown()) {
623  QualType Ty = InitEx->getType();
624  if (InitEx->isGLValue()) {
625  Ty = getContext().getPointerType(Ty);
626  }
627 
628  InitVal = svalBuilder.conjureSymbolVal(nullptr, InitEx, LC, Ty,
629  currBldrCtx->blockCount());
630  }
631 
632 
633  B.takeNodes(UpdatedN);
634  ExplodedNodeSet Dst2;
635  evalBind(Dst2, DS, UpdatedN, state->getLValue(VD, LC), InitVal, true);
636  B.addNodes(Dst2);
637  }
638  }
639  else {
640  B.generateNode(DS, N, state);
641  }
642  }
643 
644  getCheckerManager().runCheckersForPostStmt(Dst, B.getResults(), DS, *this);
645 }
646 
648  ExplodedNodeSet &Dst) {
649  // This method acts upon CFG elements for logical operators && and ||
650  // and attaches the value (true or false) to them as expressions.
651  // It doesn't produce any state splits.
652  // If we made it that far, we're past the point when we modeled the short
653  // circuit. It means that we should have precise knowledge about whether
654  // we've short-circuited. If we did, we already know the value we need to
655  // bind. If we didn't, the value of the RHS (casted to the boolean type)
656  // is the answer.
657  // Currently this method tries to figure out whether we've short-circuited
658  // by looking at the ExplodedGraph. This method is imperfect because there
659  // could inevitably have been merges that would have resulted in multiple
660  // potential path traversal histories. We bail out when we fail.
661  // Due to this ambiguity, a more reliable solution would have been to
662  // track the short circuit operation history path-sensitively until
663  // we evaluate the respective logical operator.
664  assert(B->getOpcode() == BO_LAnd ||
665  B->getOpcode() == BO_LOr);
666 
667  StmtNodeBuilder Bldr(Pred, Dst, *currBldrCtx);
668  ProgramStateRef state = Pred->getState();
669 
670  if (B->getType()->isVectorType()) {
671  // FIXME: We do not model vector arithmetic yet. When adding support for
672  // that, note that the CFG-based reasoning below does not apply, because
673  // logical operators on vectors are not short-circuit. Currently they are
674  // modeled as short-circuit in Clang CFG but this is incorrect.
675  // Do not set the value for the expression. It'd be UnknownVal by default.
676  Bldr.generateNode(B, Pred, state);
677  return;
678  }
679 
680  ExplodedNode *N = Pred;
681  while (!N->getLocation().getAs<BlockEntrance>()) {
682  ProgramPoint P = N->getLocation();
683  assert(P.getAs<PreStmt>()|| P.getAs<PreStmtPurgeDeadSymbols>());
684  (void) P;
685  if (N->pred_size() != 1) {
686  // We failed to track back where we came from.
687  Bldr.generateNode(B, Pred, state);
688  return;
689  }
690  N = *N->pred_begin();
691  }
692 
693  if (N->pred_size() != 1) {
694  // We failed to track back where we came from.
695  Bldr.generateNode(B, Pred, state);
696  return;
697  }
698 
699  N = *N->pred_begin();
700  BlockEdge BE = N->getLocation().castAs<BlockEdge>();
701  SVal X;
702 
703  // Determine the value of the expression by introspecting how we
704  // got this location in the CFG. This requires looking at the previous
705  // block we were in and what kind of control-flow transfer was involved.
706  const CFGBlock *SrcBlock = BE.getSrc();
707  // The only terminator (if there is one) that makes sense is a logical op.
708  CFGTerminator T = SrcBlock->getTerminator();
709  if (const BinaryOperator *Term = cast_or_null<BinaryOperator>(T.getStmt())) {
710  (void) Term;
711  assert(Term->isLogicalOp());
712  assert(SrcBlock->succ_size() == 2);
713  // Did we take the true or false branch?
714  unsigned constant = (*SrcBlock->succ_begin() == BE.getDst()) ? 1 : 0;
715  X = svalBuilder.makeIntVal(constant, B->getType());
716  }
717  else {
718  // If there is no terminator, by construction the last statement
719  // in SrcBlock is the value of the enclosing expression.
720  // However, we still need to constrain that value to be 0 or 1.
721  assert(!SrcBlock->empty());
722  CFGStmt Elem = SrcBlock->rbegin()->castAs<CFGStmt>();
723  const Expr *RHS = cast<Expr>(Elem.getStmt());
724  SVal RHSVal = N->getState()->getSVal(RHS, Pred->getLocationContext());
725 
726  if (RHSVal.isUndef()) {
727  X = RHSVal;
728  } else {
729  // We evaluate "RHSVal != 0" expression which result in 0 if the value is
730  // known to be false, 1 if the value is known to be true and a new symbol
731  // when the assumption is unknown.
733  X = evalBinOp(N->getState(), BO_NE,
734  svalBuilder.evalCast(RHSVal, B->getType(), RHS->getType()),
735  Zero, B->getType());
736  }
737  }
738  Bldr.generateNode(B, Pred, state->BindExpr(B, Pred->getLocationContext(), X));
739 }
740 
742  ExplodedNode *Pred,
743  ExplodedNodeSet &Dst) {
744  StmtNodeBuilder B(Pred, Dst, *currBldrCtx);
745 
746  ProgramStateRef state = Pred->getState();
747  const LocationContext *LCtx = Pred->getLocationContext();
749  unsigned NumInitElements = IE->getNumInits();
750 
751  if (!IE->isGLValue() && !IE->isTransparent() &&
752  (T->isArrayType() || T->isRecordType() || T->isVectorType() ||
753  T->isAnyComplexType())) {
754  llvm::ImmutableList<SVal> vals = getBasicVals().getEmptySValList();
755 
756  // Handle base case where the initializer has no elements.
757  // e.g: static int* myArray[] = {};
758  if (NumInitElements == 0) {
759  SVal V = svalBuilder.makeCompoundVal(T, vals);
760  B.generateNode(IE, Pred, state->BindExpr(IE, LCtx, V));
761  return;
762  }
763 
764  for (const Stmt *S : llvm::reverse(*IE)) {
765  SVal V = state->getSVal(cast<Expr>(S), LCtx);
766  vals = getBasicVals().prependSVal(V, vals);
767  }
768 
769  B.generateNode(IE, Pred,
770  state->BindExpr(IE, LCtx,
771  svalBuilder.makeCompoundVal(T, vals)));
772  return;
773  }
774 
775  // Handle scalars: int{5} and int{} and GLvalues.
776  // Note, if the InitListExpr is a GLvalue, it means that there is an address
777  // representing it, so it must have a single init element.
778  assert(NumInitElements <= 1);
779 
780  SVal V;
781  if (NumInitElements == 0)
783  else
784  V = state->getSVal(IE->getInit(0), LCtx);
785 
786  B.generateNode(IE, Pred, state->BindExpr(IE, LCtx, V));
787 }
788 
790  const Expr *L,
791  const Expr *R,
792  ExplodedNode *Pred,
793  ExplodedNodeSet &Dst) {
794  assert(L && R);
795 
796  StmtNodeBuilder B(Pred, Dst, *currBldrCtx);
797  ProgramStateRef state = Pred->getState();
798  const LocationContext *LCtx = Pred->getLocationContext();
799  const CFGBlock *SrcBlock = nullptr;
800 
801  // Find the predecessor block.
802  ProgramStateRef SrcState = state;
803  for (const ExplodedNode *N = Pred ; N ; N = *N->pred_begin()) {
804  ProgramPoint PP = N->getLocation();
805  if (PP.getAs<PreStmtPurgeDeadSymbols>() || PP.getAs<BlockEntrance>()) {
806  // If the state N has multiple predecessors P, it means that successors
807  // of P are all equivalent.
808  // In turn, that means that all nodes at P are equivalent in terms
809  // of observable behavior at N, and we can follow any of them.
810  // FIXME: a more robust solution which does not walk up the tree.
811  continue;
812  }
813  SrcBlock = PP.castAs<BlockEdge>().getSrc();
814  SrcState = N->getState();
815  break;
816  }
817 
818  assert(SrcBlock && "missing function entry");
819 
820  // Find the last expression in the predecessor block. That is the
821  // expression that is used for the value of the ternary expression.
822  bool hasValue = false;
823  SVal V;
824 
825  for (CFGElement CE : llvm::reverse(*SrcBlock)) {
826  if (Optional<CFGStmt> CS = CE.getAs<CFGStmt>()) {
827  const Expr *ValEx = cast<Expr>(CS->getStmt());
828  ValEx = ValEx->IgnoreParens();
829 
830  // For GNU extension '?:' operator, the left hand side will be an
831  // OpaqueValueExpr, so get the underlying expression.
832  if (const OpaqueValueExpr *OpaqueEx = dyn_cast<OpaqueValueExpr>(L))
833  L = OpaqueEx->getSourceExpr();
834 
835  // If the last expression in the predecessor block matches true or false
836  // subexpression, get its the value.
837  if (ValEx == L->IgnoreParens() || ValEx == R->IgnoreParens()) {
838  hasValue = true;
839  V = SrcState->getSVal(ValEx, LCtx);
840  }
841  break;
842  }
843  }
844 
845  if (!hasValue)
846  V = svalBuilder.conjureSymbolVal(nullptr, Ex, LCtx,
847  currBldrCtx->blockCount());
848 
849  // Generate a new node with the binding from the appropriate path.
850  B.generateNode(Ex, Pred, state->BindExpr(Ex, LCtx, V, true));
851 }
852 
853 void ExprEngine::
855  ExplodedNode *Pred, ExplodedNodeSet &Dst) {
856  StmtNodeBuilder B(Pred, Dst, *currBldrCtx);
857  Expr::EvalResult Result;
858  if (OOE->EvaluateAsInt(Result, getContext())) {
859  APSInt IV = Result.Val.getInt();
860  assert(IV.getBitWidth() == getContext().getTypeSize(OOE->getType()));
861  assert(OOE->getType()->castAs<BuiltinType>()->isInteger());
862  assert(IV.isSigned() == OOE->getType()->isSignedIntegerType());
863  SVal X = svalBuilder.makeIntVal(IV);
864  B.generateNode(OOE, Pred,
865  Pred->getState()->BindExpr(OOE, Pred->getLocationContext(),
866  X));
867  }
868  // FIXME: Handle the case where __builtin_offsetof is not a constant.
869 }
870 
871 
872 void ExprEngine::
874  ExplodedNode *Pred,
875  ExplodedNodeSet &Dst) {
876  // FIXME: Prechecks eventually go in ::Visit().
877  ExplodedNodeSet CheckedSet;
878  getCheckerManager().runCheckersForPreStmt(CheckedSet, Pred, Ex, *this);
879 
880  ExplodedNodeSet EvalSet;
881  StmtNodeBuilder Bldr(CheckedSet, EvalSet, *currBldrCtx);
882 
883  QualType T = Ex->getTypeOfArgument();
884 
885  for (ExplodedNodeSet::iterator I = CheckedSet.begin(), E = CheckedSet.end();
886  I != E; ++I) {
887  if (Ex->getKind() == UETT_SizeOf) {
888  if (!T->isIncompleteType() && !T->isConstantSizeType()) {
889  assert(T->isVariableArrayType() && "Unknown non-constant-sized type.");
890 
891  // FIXME: Add support for VLA type arguments and VLA expressions.
892  // When that happens, we should probably refactor VLASizeChecker's code.
893  continue;
894  } else if (T->getAs<ObjCObjectType>()) {
895  // Some code tries to take the sizeof an ObjCObjectType, relying that
896  // the compiler has laid out its representation. Just report Unknown
897  // for these.
898  continue;
899  }
900  }
901 
903  CharUnits amt = CharUnits::fromQuantity(Value.getZExtValue());
904 
905  ProgramStateRef state = (*I)->getState();
906  state = state->BindExpr(Ex, (*I)->getLocationContext(),
907  svalBuilder.makeIntVal(amt.getQuantity(),
908  Ex->getType()));
909  Bldr.generateNode(Ex, *I, state);
910  }
911 
912  getCheckerManager().runCheckersForPostStmt(Dst, EvalSet, Ex, *this);
913 }
914 
916  const UnaryOperator *U,
917  StmtNodeBuilder &Bldr) {
918  // FIXME: We can probably just have some magic in Environment::getSVal()
919  // that propagates values, instead of creating a new node here.
920  //
921  // Unary "+" is a no-op, similar to a parentheses. We still have places
922  // where it may be a block-level expression, so we need to
923  // generate an extra node that just propagates the value of the
924  // subexpression.
925  const Expr *Ex = U->getSubExpr()->IgnoreParens();
926  ProgramStateRef state = (*I)->getState();
927  const LocationContext *LCtx = (*I)->getLocationContext();
928  Bldr.generateNode(U, *I, state->BindExpr(U, LCtx,
929  state->getSVal(Ex, LCtx)));
930 }
931 
933  ExplodedNodeSet &Dst) {
934  // FIXME: Prechecks eventually go in ::Visit().
935  ExplodedNodeSet CheckedSet;
936  getCheckerManager().runCheckersForPreStmt(CheckedSet, Pred, U, *this);
937 
938  ExplodedNodeSet EvalSet;
939  StmtNodeBuilder Bldr(CheckedSet, EvalSet, *currBldrCtx);
940 
941  for (ExplodedNodeSet::iterator I = CheckedSet.begin(), E = CheckedSet.end();
942  I != E; ++I) {
943  switch (U->getOpcode()) {
944  default: {
945  Bldr.takeNodes(*I);
946  ExplodedNodeSet Tmp;
948  Bldr.addNodes(Tmp);
949  break;
950  }
951  case UO_Real: {
952  const Expr *Ex = U->getSubExpr()->IgnoreParens();
953 
954  // FIXME: We don't have complex SValues yet.
955  if (Ex->getType()->isAnyComplexType()) {
956  // Just report "Unknown."
957  break;
958  }
959 
960  // For all other types, UO_Real is an identity operation.
961  assert (U->getType() == Ex->getType());
962  ProgramStateRef state = (*I)->getState();
963  const LocationContext *LCtx = (*I)->getLocationContext();
964  Bldr.generateNode(U, *I, state->BindExpr(U, LCtx,
965  state->getSVal(Ex, LCtx)));
966  break;
967  }
968 
969  case UO_Imag: {
970  const Expr *Ex = U->getSubExpr()->IgnoreParens();
971  // FIXME: We don't have complex SValues yet.
972  if (Ex->getType()->isAnyComplexType()) {
973  // Just report "Unknown."
974  break;
975  }
976  // For all other types, UO_Imag returns 0.
977  ProgramStateRef state = (*I)->getState();
978  const LocationContext *LCtx = (*I)->getLocationContext();
979  SVal X = svalBuilder.makeZeroVal(Ex->getType());
980  Bldr.generateNode(U, *I, state->BindExpr(U, LCtx, X));
981  break;
982  }
983 
984  case UO_AddrOf: {
985  // Process pointer-to-member address operation.
986  const Expr *Ex = U->getSubExpr()->IgnoreParens();
987  if (const DeclRefExpr *DRE = dyn_cast<DeclRefExpr>(Ex)) {
988  const ValueDecl *VD = DRE->getDecl();
989 
990  if (isa<CXXMethodDecl, FieldDecl, IndirectFieldDecl>(VD)) {
991  ProgramStateRef State = (*I)->getState();
992  const LocationContext *LCtx = (*I)->getLocationContext();
993  SVal SV = svalBuilder.getMemberPointer(cast<NamedDecl>(VD));
994  Bldr.generateNode(U, *I, State->BindExpr(U, LCtx, SV));
995  break;
996  }
997  }
998  // Explicitly proceed with default handler for this case cascade.
999  handleUOExtension(I, U, Bldr);
1000  break;
1001  }
1002  case UO_Plus:
1003  assert(!U->isGLValue());
1004  LLVM_FALLTHROUGH;
1005  case UO_Deref:
1006  case UO_Extension: {
1007  handleUOExtension(I, U, Bldr);
1008  break;
1009  }
1010 
1011  case UO_LNot:
1012  case UO_Minus:
1013  case UO_Not: {
1014  assert (!U->isGLValue());
1015  const Expr *Ex = U->getSubExpr()->IgnoreParens();
1016  ProgramStateRef state = (*I)->getState();
1017  const LocationContext *LCtx = (*I)->getLocationContext();
1018 
1019  // Get the value of the subexpression.
1020  SVal V = state->getSVal(Ex, LCtx);
1021 
1022  if (V.isUnknownOrUndef()) {
1023  Bldr.generateNode(U, *I, state->BindExpr(U, LCtx, V));
1024  break;
1025  }
1026 
1027  switch (U->getOpcode()) {
1028  default:
1029  llvm_unreachable("Invalid Opcode.");
1030  case UO_Not:
1031  // FIXME: Do we need to handle promotions?
1032  state = state->BindExpr(U, LCtx, evalComplement(V.castAs<NonLoc>()));
1033  break;
1034  case UO_Minus:
1035  // FIXME: Do we need to handle promotions?
1036  state = state->BindExpr(U, LCtx, evalMinus(V.castAs<NonLoc>()));
1037  break;
1038  case UO_LNot:
1039  // C99 6.5.3.3: "The expression !E is equivalent to (0==E)."
1040  //
1041  // Note: technically we do "E == 0", but this is the same in the
1042  // transfer functions as "0 == E".
1043  SVal Result;
1044  if (Optional<Loc> LV = V.getAs<Loc>()) {
1045  Loc X = svalBuilder.makeNullWithType(Ex->getType());
1046  Result = evalBinOp(state, BO_EQ, *LV, X, U->getType());
1047  } else if (Ex->getType()->isFloatingType()) {
1048  // FIXME: handle floating point types.
1049  Result = UnknownVal();
1050  } else {
1052  Result = evalBinOp(state, BO_EQ, V.castAs<NonLoc>(), X,
1053  U->getType());
1054  }
1055 
1056  state = state->BindExpr(U, LCtx, Result);
1057  break;
1058  }
1059  Bldr.generateNode(U, *I, state);
1060  break;
1061  }
1062  }
1063  }
1064 
1065  getCheckerManager().runCheckersForPostStmt(Dst, EvalSet, U, *this);
1066 }
1067 
1069  ExplodedNode *Pred,
1070  ExplodedNodeSet &Dst) {
1071  // Handle ++ and -- (both pre- and post-increment).
1072  assert (U->isIncrementDecrementOp());
1073  const Expr *Ex = U->getSubExpr()->IgnoreParens();
1074 
1075  const LocationContext *LCtx = Pred->getLocationContext();
1076  ProgramStateRef state = Pred->getState();
1077  SVal loc = state->getSVal(Ex, LCtx);
1078 
1079  // Perform a load.
1080  ExplodedNodeSet Tmp;
1081  evalLoad(Tmp, U, Ex, Pred, state, loc);
1082 
1083  ExplodedNodeSet Dst2;
1084  StmtNodeBuilder Bldr(Tmp, Dst2, *currBldrCtx);
1085  for (ExplodedNodeSet::iterator I=Tmp.begin(), E=Tmp.end();I!=E;++I) {
1086 
1087  state = (*I)->getState();
1088  assert(LCtx == (*I)->getLocationContext());
1089  SVal V2_untested = state->getSVal(Ex, LCtx);
1090 
1091  // Propagate unknown and undefined values.
1092  if (V2_untested.isUnknownOrUndef()) {
1093  state = state->BindExpr(U, LCtx, V2_untested);
1094 
1095  // Perform the store, so that the uninitialized value detection happens.
1096  Bldr.takeNodes(*I);
1097  ExplodedNodeSet Dst3;
1098  evalStore(Dst3, U, Ex, *I, state, loc, V2_untested);
1099  Bldr.addNodes(Dst3);
1100 
1101  continue;
1102  }
1103  DefinedSVal V2 = V2_untested.castAs<DefinedSVal>();
1104 
1105  // Handle all other values.
1106  BinaryOperator::Opcode Op = U->isIncrementOp() ? BO_Add : BO_Sub;
1107 
1108  // If the UnaryOperator has non-location type, use its type to create the
1109  // constant value. If the UnaryOperator has location type, create the
1110  // constant with int type and pointer width.
1111  SVal RHS;
1112  SVal Result;
1113 
1114  if (U->getType()->isAnyPointerType())
1115  RHS = svalBuilder.makeArrayIndex(1);
1116  else if (U->getType()->isIntegralOrEnumerationType())
1117  RHS = svalBuilder.makeIntVal(1, U->getType());
1118  else
1119  RHS = UnknownVal();
1120 
1121  // The use of an operand of type bool with the ++ operators is deprecated
1122  // but valid until C++17. And if the operand of the ++ operator is of type
1123  // bool, it is set to true until C++17. Note that for '_Bool', it is also
1124  // set to true when it encounters ++ operator.
1125  if (U->getType()->isBooleanType() && U->isIncrementOp())
1126  Result = svalBuilder.makeTruthVal(true, U->getType());
1127  else
1128  Result = evalBinOp(state, Op, V2, RHS, U->getType());
1129 
1130  // Conjure a new symbol if necessary to recover precision.
1131  if (Result.isUnknown()){
1132  DefinedOrUnknownSVal SymVal =
1133  svalBuilder.conjureSymbolVal(nullptr, U, LCtx,
1134  currBldrCtx->blockCount());
1135  Result = SymVal;
1136 
1137  // If the value is a location, ++/-- should always preserve
1138  // non-nullness. Check if the original value was non-null, and if so
1139  // propagate that constraint.
1140  if (Loc::isLocType(U->getType())) {
1141  DefinedOrUnknownSVal Constraint =
1142  svalBuilder.evalEQ(state, V2,svalBuilder.makeZeroVal(U->getType()));
1143 
1144  if (!state->assume(Constraint, true)) {
1145  // It isn't feasible for the original value to be null.
1146  // Propagate this constraint.
1147  Constraint = svalBuilder.evalEQ(state, SymVal,
1148  svalBuilder.makeZeroVal(U->getType()));
1149 
1150  state = state->assume(Constraint, false);
1151  assert(state);
1152  }
1153  }
1154  }
1155 
1156  // Since the lvalue-to-rvalue conversion is explicit in the AST,
1157  // we bind an l-value if the operator is prefix and an lvalue (in C++).
1158  if (U->isGLValue())
1159  state = state->BindExpr(U, LCtx, loc);
1160  else
1161  state = state->BindExpr(U, LCtx, U->isPostfix() ? V2 : Result);
1162 
1163  // Perform the store.
1164  Bldr.takeNodes(*I);
1165  ExplodedNodeSet Dst3;
1166  evalStore(Dst3, U, Ex, *I, state, loc, Result);
1167  Bldr.addNodes(Dst3);
1168  }
1169  Dst.insert(Dst2);
1170 }
clang::BuiltinType
This class is used for builtin types like 'int'.
Definition: Type.h:2504
clang::CFGBlock::getTerminator
CFGTerminator getTerminator() const
Definition: CFG.h:1048
clang::ento::StmtNodeBuilder::generateSink
ExplodedNode * generateSink(const Stmt *S, ExplodedNode *Pred, ProgramStateRef St, const ProgramPointTag *tag=nullptr, ProgramPoint::Kind K=ProgramPoint::PostStmtKind)
Definition: CoreEngine.h:424
clang::ProgramPoint::PostLValueKind
@ PostLValueKind
Definition: ProgramPoint.h:72
clang::ento::ExplodedNode::pred_begin
pred_iterator pred_begin()
Definition: ExplodedGraph.h:237
clang::ento::Loc::isLocType
static bool isLocType(QualType T)
Definition: SVals.h:335
clang::Type::isRecordType
bool isRecordType() const
Definition: Type.h:6838
clang::BinaryOperator::isAssignmentOp
static bool isAssignmentOp(Opcode Opc)
Definition: Expr.h:3942
clang::ento::BasicValueFactory::getEmptySValList
llvm::ImmutableList< SVal > getEmptySValList()
Definition: BasicValueFactory.h:242
clang::OffsetOfExpr
OffsetOfExpr - [C99 7.17] - This represents an expression of the form offsetof(record-type,...
Definition: Expr.h:2444
clang::ento::ExplodedNode::getLocationContext
const LocationContext * getLocationContext() const
Definition: ExplodedGraph.h:146
clang::LocationContext
It wraps the AnalysisDeclContext to represent both the call stack with the help of StackFrameContext ...
Definition: AnalysisDeclContext.h:215
clang::CFGBlock::empty
bool empty() const
Definition: CFG.h:918
clang::ento::SVal::castAs
T castAs() const
Convert to the specified SVal type, asserting that this SVal is of the desired type.
Definition: SVals.h:102
clang::ento::SVal::isConstant
bool isConstant() const
Definition: SVals.cpp:259
clang::ento::SVal::isUndef
bool isUndef() const
Definition: SVals.h:139
clang::ento::NonLoc
Definition: SVals.h:304
clang::ento::ExplodedNodeSet::iterator
ImplTy::iterator iterator
Definition: ExplodedGraph.h:477
clang::CFGBlock::succ_size
unsigned succ_size() const
Definition: CFG.h:973
clang::CFGBlock::succ_begin
succ_iterator succ_begin()
Definition: CFG.h:955
clang::ento::DefinedOrUnknownSVal
Definition: SVals.h:235
clang::ento::ExprEngine::getContext
ASTContext & getContext() const
getContext - Return the ASTContext associated with this analysis.
Definition: ExprEngine.h:203
clang::ento::ExprEngine::handleUOExtension
void handleUOExtension(ExplodedNodeSet::iterator I, const UnaryOperator *U, StmtNodeBuilder &Bldr)
Definition: ExprEngineC.cpp:915
clang::ento::SValBuilder::makeNullWithType
loc::ConcreteInt makeNullWithType(QualType type)
Create NULL pointer, with proper pointer bit-width for given address space.
Definition: SValBuilder.h:368
clang::QualType
A (possibly-)qualified type.
Definition: Type.h:675
clang::ento::SVal::isZeroConstant
bool isZeroConstant() const
Definition: SVals.cpp:271
clang::ento::ExplodedNode
Definition: ExplodedGraph.h:65
clang::Type::isFloatingType
bool isFloatingType() const
Definition: Type.cpp:2121
DeclCXX.h
clang::ento::ExprEngine::VisitUnaryOperator
void VisitUnaryOperator(const UnaryOperator *B, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitUnaryOperator - Transfer function logic for unary operators.
Definition: ExprEngineC.cpp:932
clang::ento::ExprEngine::evalComplement
SVal evalComplement(SVal X)
Definition: ExprEngine.h:593
clang::InitListExpr
Describes an C or C++ initializer list.
Definition: Expr.h:4791
llvm::Optional
Definition: LLVM.h:40
clang::ento::SValBuilder::makeZeroVal
DefinedOrUnknownSVal makeZeroVal(QualType type)
Construct an SVal representing '0' for the specified type.
Definition: SValBuilder.cpp:62
clang::Type::isVariableArrayType
bool isVariableArrayType() const
Definition: Type.h:6826
clang::UnaryOperator
UnaryOperator - This represents the unary-expression's (except sizeof and alignof),...
Definition: Expr.h:2163
Expression
clang::ento::nonloc::ConcreteInt
Value representing integer constant.
Definition: SVals.h:385
clang::tooling::X
static ToolExecutorPluginRegistry::Add< AllTUsToolExecutorPlugin > X("all-TUs", "Runs FrontendActions on all TUs in the compilation database. " "Tool results are stored in memory.")
clang::ento::StoreManager::evalDerivedToBase
SVal evalDerivedToBase(SVal Derived, const CastExpr *Cast)
Evaluates a chain of derived-to-base casts through the path specified in Cast.
Definition: Store.cpp:251
clang::ento::UnknownVal
Definition: SVals.h:256
clang::ento::StmtNodeBuilder
Definition: CoreEngine.h:385
clang::BinaryOperator::getOpcode
Opcode getOpcode() const
Definition: Expr.h:3851
clang::Type::isRValueReferenceType
bool isRValueReferenceType() const
Definition: Type.h:6768
clang::ento::loc::MemRegionVal
Definition: SVals.h:598
clang::InitListExpr::isTransparent
bool isTransparent() const
Is this a transparent initializer list (that is, an InitListExpr that is purely syntactic,...
Definition: Expr.cpp:2320
clang::Expr::isGLValue
bool isGLValue() const
Definition: Expr.h:273
clang::OpaqueValueExpr
OpaqueValueExpr - An expression referring to an opaque object of a fixed type and value class.
Definition: Expr.h:1135
clang::ento::ExprEngine::evalBinOp
SVal evalBinOp(ProgramStateRef state, BinaryOperator::Opcode op, NonLoc L, NonLoc R, QualType T)
Definition: ExprEngine.h:614
getValue
static SVal getValue(SVal val, SValBuilder &svalBuilder)
Definition: ArrayBoundCheckerV2.cpp:277
clang::ento::ExprEngine::evalLoad
void evalLoad(ExplodedNodeSet &Dst, const Expr *NodeEx, const Expr *BoundExpr, ExplodedNode *Pred, ProgramStateRef St, SVal location, const ProgramPointTag *tag=nullptr, QualType LoadTy=QualType())
Simulate a read of the result of Ex.
Definition: ExprEngine.cpp:2957
clang::ObjCObjectType
Represents a class type in Objective C.
Definition: Type.h:5892
clang::BlockEdge::getSrc
const CFGBlock * getSrc() const
Definition: ProgramPoint.h:510
clang::CFGTerminator::getStmt
Stmt * getStmt()
Definition: CFG.h:535
clang::CFGBlock
Represents a single basic block in a source-level CFG.
Definition: CFG.h:576
APSInt
llvm::APSInt APSInt
Definition: ByteCodeEmitter.cpp:19
U
clang::ento::NodeBuilder::takeNodes
void takeNodes(const ExplodedNodeSet &S)
Definition: CoreEngine.h:336
clang::Type::isReferenceType
bool isReferenceType() const
Definition: Type.h:6760
V
#define V(N, I)
Definition: ASTContext.h:3176
clang::BlockDecl::capture_begin
capture_const_iterator capture_begin() const
Definition: Decl.h:4330
clang::ento::ExplodedNode::getState
const ProgramStateRef & getState() const
Definition: ExplodedGraph.h:168
clang::ento::DefinedSVal
Definition: SVals.h:268
clang::UnaryExprOrTypeTraitExpr
UnaryExprOrTypeTraitExpr - expression with either a type or (unevaluated) expression operand.
Definition: Expr.h:2549
clang::ento::ExprEngine::evalStore
void evalStore(ExplodedNodeSet &Dst, const Expr *AssignE, const Expr *StoreE, ExplodedNode *Pred, ProgramStateRef St, SVal TargetLV, SVal Val, const ProgramPointTag *tag=nullptr)
evalStore - Handle the semantics of a store via an assignment.
Definition: ExprEngine.cpp:2934
clang::BlockDecl
Represents a block literal declaration, which is like an unnamed FunctionDecl.
Definition: Decl.h:4201
clang::BinaryOperator
A builtin binary operation expression such as "x + y" or "x <= y".
Definition: Expr.h:3807
clang::ento::BlockDataRegion::referenced_vars_iterator
Definition: MemRegion.h:694
clang::CharUnits::fromQuantity
static CharUnits fromQuantity(QuantityType Quantity)
fromQuantity - Construct a CharUnits quantity from a raw integer type.
Definition: CharUnits.h:63
CheckerManager.h
clang::BlockExpr::getBlockDecl
const BlockDecl * getBlockDecl() const
Definition: Expr.h:5982
clang::ProgramPoint::getAs
Optional< T > getAs() const
Convert to the specified ProgramPoint type, returning None if this ProgramPoint is not of the desired...
Definition: ProgramPoint.h:150
clang::Type::getAs
const T * getAs() const
Member-template getAs<specific type>'.
Definition: Type.h:7243
clang::ASTContext::getRValueReferenceType
QualType getRValueReferenceType(QualType T) const
Return the uniqued reference to the type for an rvalue reference to the specified type.
Definition: ASTContext.cpp:3420
clang::ento::nonloc::PointerToMember
Value representing pointer-to-member.
Definition: SVals.h:524
clang::Type::isVectorType
bool isVectorType() const
Definition: Type.h:6850
clang::ento::BlockDataRegion::referenced_vars_iterator::getOriginalRegion
const VarRegion * getOriginalRegion() const
Definition: MemRegion.h:707
clang::ento::ExprEngine::getObjectUnderConstruction
static Optional< SVal > getObjectUnderConstruction(ProgramStateRef State, const ConstructionContextItem &Item, const LocationContext *LC)
By looking at a certain item that may be potentially part of an object's ConstructionContext,...
Definition: ExprEngine.cpp:466
clang::Type::isLValueReferenceType
bool isLValueReferenceType() const
Definition: Type.h:6764
clang::ento::NodeBuilder::getResults
const ExplodedNodeSet & getResults()
Definition: CoreEngine.h:313
clang::ento::ExplodedNodeSet::end
iterator end()
Definition: ExplodedGraph.h:495
clang::ento::BlockDataRegion
BlockDataRegion - A region that represents a block instance.
Definition: MemRegion.h:663
clang::ento::VarRegion
Definition: MemRegion.h:907
clang::ProgramPoint::castAs
T castAs() const
Convert to the specified ProgramPoint type, asserting that this ProgramPoint is of the desired type.
Definition: ProgramPoint.h:139
clang::CastExpr::path
llvm::iterator_range< path_iterator > path()
Definition: Expr.h:3550
clang::Expr::EvalResult
EvalResult is a struct with detailed info about an evaluated expression.
Definition: Expr.h:612
clang::ento::BasicValueFactory::prependSVal
llvm::ImmutableList< SVal > prependSVal(SVal X, llvm::ImmutableList< SVal > L)
Definition: BasicValueFactory.h:246
clang::ento::ExprEngine::VisitCompoundLiteralExpr
void VisitCompoundLiteralExpr(const CompoundLiteralExpr *CL, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitCompoundLiteralExpr - Transfer function logic for compound literals.
Definition: ExprEngineC.cpp:546
clang::interp::Zero
bool Zero(InterpState &S, CodePtr OpPC)
Definition: Interp.h:814
clang::VarDecl
Represents a variable declaration or definition.
Definition: Decl.h:874
clang::ento::ExprEngine::VisitIncrementDecrementOperator
void VisitIncrementDecrementOperator(const UnaryOperator *U, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Handle ++ and – (both pre- and post-increment).
Definition: ExprEngineC.cpp:1068
clang::ASTContext::getCanonicalType
CanQualType getCanonicalType(QualType T) const
Return the canonical (structural) type corresponding to the specified potentially non-canonical type ...
Definition: ASTContext.h:2508
clang::Expr::EvaluateKnownConstInt
llvm::APSInt EvaluateKnownConstInt(const ASTContext &Ctx, SmallVectorImpl< PartialDiagnosticAt > *Diag=nullptr) const
EvaluateKnownConstInt - Call EvaluateAsRValue and return the folded integer.
Definition: ExprConstant.cpp:15217
clang::ento::SValBuilder::makePointerToMember
NonLoc makePointerToMember(const DeclaratorDecl *DD)
Definition: SValBuilder.h:282
clang::BlockEdge::getDst
const CFGBlock * getDst() const
Definition: ProgramPoint.h:514
clang::ento::ExprEngine::VisitUnaryExprOrTypeTraitExpr
void VisitUnaryExprOrTypeTraitExpr(const UnaryExprOrTypeTraitExpr *Ex, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitUnaryExprOrTypeTraitExpr - Transfer function for sizeof.
Definition: ExprEngineC.cpp:873
clang::Type::isAnyComplexType
bool isAnyComplexType() const
Definition: Type.h:6846
clang::ento::NodeBuilderContext::blockCount
unsigned blockCount() const
Returns the number of times the current basic block has been visited on the exploded graph path.
Definition: CoreEngine.h:225
clang::CanQual< Type >
ExprCXX.h
conjureOffsetSymbolOnLocation
static SVal conjureOffsetSymbolOnLocation(SVal Symbol, SVal Other, Expr *Expression, SValBuilder &svalBuilder, unsigned Count, const LocationContext *LCtx)
Optionally conjure and return a symbol for offset when processing an expression Expression.
Definition: ExprEngineC.cpp:28
clang::CFGBlock::rbegin
reverse_iterator rbegin()
Definition: CFG.h:880
clang::CFGTerminator
Represents CFGBlock terminator statement.
Definition: CFG.h:503
clang::CastExpr::getCastKind
CastKind getCastKind() const
Definition: Expr.h:3519
state
and static some checkers Checker The latter are built on top of the former via the Checker and CheckerVisitor and attempts to isolate them from much of the gore of the internal analysis the analyzer is basically a source code simulator that traces out possible paths of execution The state of the and the combination of state and program point is a node in an exploded which has the entry program point and initial state
Definition: README.txt:30
clang::ento::Loc
Definition: SVals.h:326
clang::ento::ExplodedNode::pred_size
unsigned pred_size() const
Definition: ExplodedGraph.h:198
clang::Type::castAs
const T * castAs() const
Member-template castAs<specific type>.
Definition: Type.h:7310
clang::CompoundLiteralExpr
CompoundLiteralExpr - [C99 6.5.2.5].
Definition: Expr.h:3405
clang::BlockEntrance
Definition: ProgramPoint.h:224
clang::ento::ExprEngine::VisitBlockExpr
void VisitBlockExpr(const BlockExpr *BE, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitBlockExpr - Transfer function logic for BlockExprs.
Definition: ExprEngineC.cpp:196
P
StringRef P
Definition: ASTMatchersInternal.cpp:563
clang::ento::SValBuilder::makeCompoundVal
NonLoc makeCompoundVal(QualType type, llvm::ImmutableList< SVal > vals)
Definition: SValBuilder.h:272
clang::ento::ExprEngine::VisitInitListExpr
void VisitInitListExpr(const InitListExpr *E, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Definition: ExprEngineC.cpp:741
clang::DeclStmt::isSingleDecl
bool isSingleDecl() const
isSingleDecl - This method returns true if this DeclStmt refers to a single Decl.
Definition: Stmt.h:1307
clang::ento::PSK_EscapeOther
@ PSK_EscapeOther
The reason for pointer escape is unknown.
Definition: CheckerManager.h:98
clang::PreStmt
Definition: ProgramPoint.h:294
clang::CFGStmt
Definition: CFG.h:132
clang::CFGElement::castAs
T castAs() const
Convert to the specified CFGElement type, asserting that this CFGElement is of the desired type.
Definition: CFG.h:98
clang::ento::SValBuilder::evalCast
SVal evalCast(SVal V, QualType CastTy, QualType OriginalTy)
Cast a given SVal to another SVal using given QualType's.
Definition: SValBuilder.cpp:591
clang::ento::AnalysisManager::options
AnalyzerOptions & options
Definition: AnalysisManager.h:47
clang::ValueDecl
Represent the declaration of a variable (in which case it is an lvalue) a function (in which case it ...
Definition: Decl.h:674
clang::ento::ExprEngine::handleLValueBitCast
ProgramStateRef handleLValueBitCast(ProgramStateRef state, const Expr *Ex, const LocationContext *LCtx, QualType T, QualType ExTy, const CastExpr *CastE, StmtNodeBuilder &Bldr, ExplodedNode *Pred)
Definition: ExprEngineC.cpp:259
clang::BinaryOperator::getLHS
Expr * getLHS() const
Definition: Expr.h:3856
clang::ento::ExprEngine::evalMinus
SVal evalMinus(SVal X)
Definition: ExprEngine.h:589
clang::ento::ExprEngine::VisitCast
void VisitCast(const CastExpr *CastE, const Expr *Ex, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitCast - Transfer function logic for all casts (implicit and explicit).
Definition: ExprEngineC.cpp:285
clang::BlockExpr
BlockExpr - Adaptor class for mixing a BlockDecl with expressions.
Definition: Expr.h:5970
clang::ento::CheckerManager::runCheckersForPostStmt
void runCheckersForPostStmt(ExplodedNodeSet &Dst, const ExplodedNodeSet &Src, const Stmt *S, ExprEngine &Eng, bool wasInlined=false)
Run checkers for post-visiting Stmts.
Definition: CheckerManager.h:261
Value
Value
Definition: UninitializedValues.cpp:102
clang::ento::SValBuilder::makeIntVal
nonloc::ConcreteInt makeIntVal(const IntegerLiteral *integer)
Definition: SValBuilder.h:300
clang::UnaryExprOrTypeTraitExpr::getTypeOfArgument
QualType getTypeOfArgument() const
Gets the argument type, or the type of the argument expression, whichever is appropriate.
Definition: Expr.h:2618
clang::Type::isConstantSizeType
bool isConstantSizeType() const
Return true if this is not a variable sized type, according to the rules of C99 6....
Definition: Type.cpp:2224
clang::CFGStmt::getStmt
const Stmt * getStmt() const
Definition: CFG.h:138
State
LineState State
Definition: UnwrappedLineFormatter.cpp:1126
clang::ento::ExprEngine::VisitOffsetOfExpr
void VisitOffsetOfExpr(const OffsetOfExpr *Ex, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitOffsetOfExpr - Transfer function for offsetof.
Definition: ExprEngineC.cpp:854
clang::Type::isSignedIntegerType
bool isSignedIntegerType() const
Return true if this is an integer type that is signed, according to C99 6.2.5p4 [char,...
Definition: Type.cpp:2018
clang::ento::ExprEngine::getSValBuilder
SValBuilder & getSValBuilder()
Definition: ExprEngine.h:215
clang::BinaryOperatorKind
BinaryOperatorKind
Definition: OperationKinds.h:25
clang::VarDecl::getInit
const Expr * getInit() const
Definition: Decl.h:1283
clang::Expr::EvaluateAsInt
bool EvaluateAsInt(EvalResult &Result, const ASTContext &Ctx, SideEffectsKind AllowSideEffects=SE_NoSideEffects, bool InConstantContext=false) const
EvaluateAsInt - Return true if this is a constant which we can fold and convert to an integer,...
Definition: ExprConstant.cpp:14994
clang::ento::SValBuilder::getBlockPointer
DefinedSVal getBlockPointer(const BlockDecl *block, CanQualType locTy, const LocationContext *locContext, unsigned blockCount)
Definition: SValBuilder.cpp:279
clang::ento::ExplodedNodeSet::begin
iterator begin()
Definition: ExplodedGraph.h:494
clang::CFGElement
Represents a top-level expression in a basic block.
Definition: CFG.h:55
clang::ASTContext::getLValueReferenceType
QualType getLValueReferenceType(QualType T, bool SpelledAsLValue=true) const
Return the uniqued reference to the type for an lvalue reference to the specified type.
Definition: ASTContext.cpp:3380
clang::DeclStmt
DeclStmt - Adaptor class for mixing declarations with statements and expressions.
Definition: Stmt.h:1294
clang::ento::ProgramStateManager::getStoreManager
StoreManager & getStoreManager()
Definition: ProgramState.h:574
clang::ento::SValBuilder::makeTruthVal
nonloc::ConcreteInt makeTruthVal(bool b, QualType type)
Definition: SValBuilder.h:357
ExprEngine.h
clang::BinaryOperator::isCompoundAssignmentOp
static bool isCompoundAssignmentOp(Opcode Opc)
Definition: Expr.h:3947
clang::ento::ExprEngine::getStoreManager
StoreManager & getStoreManager()
Definition: ExprEngine.h:414
clang::UnaryExprOrTypeTraitExpr::getKind
UnaryExprOrTypeTrait getKind() const
Definition: Expr.h:2581
clang::ento::ExprEngine::VisitDeclStmt
void VisitDeclStmt(const DeclStmt *DS, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitDeclStmt - Transfer function logic for DeclStmts.
Definition: ExprEngineC.cpp:571
clang::CompoundLiteralExpr::getInitializer
const Expr * getInitializer() const
Definition: Expr.h:3428
clang::DeclStmt::decl_begin
decl_iterator decl_begin()
Definition: Stmt.h:1348
clang::Expr::IgnoreParens
Expr * IgnoreParens() LLVM_READONLY
Skip past any parentheses which might surround this expression until reaching a fixed point.
Definition: Expr.cpp:2943
clang
Definition: CalledOnceCheck.h:17
clang::BuiltinType::isInteger
bool isInteger() const
Definition: Type.h:2552
clang::Type::isArrayType
bool isArrayType() const
Definition: Type.h:6814
clang::ento::ExplodedNode::getLocation
ProgramPoint getLocation() const
getLocation - Returns the edge associated with the given node.
Definition: ExplodedGraph.h:144
clang::ento::SVal::isUnknownOrUndef
bool isUnknownOrUndef() const
Definition: SVals.h:143
clang::Stmt
Stmt - This represents one statement.
Definition: Stmt.h:69
clang::BinaryOperator::getRHS
Expr * getRHS() const
Definition: Expr.h:3858
clang::ento::SValBuilder::evalIntegralCast
SVal evalIntegralCast(ProgramStateRef state, SVal val, QualType castTy, QualType originalType)
Definition: SValBuilder.cpp:540
clang::ento::ExplodedNodeSet::insert
void insert(const ExplodedNodeSet &S)
Definition: ExplodedGraph.h:486
clang::ento::SVal::isUnknown
bool isUnknown() const
Definition: SVals.h:135
clang::Expr::getType
QualType getType() const
Definition: Expr.h:141
clang::BlockDecl::capture_end
capture_const_iterator capture_end() const
Definition: Decl.h:4331
clang::ento::ExprEngine::VisitGuardedExpr
void VisitGuardedExpr(const Expr *Ex, const Expr *L, const Expr *R, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitGuardedExpr - Transfer function logic for ?, __builtin_choose.
Definition: ExprEngineC.cpp:789
clang::ento::SValBuilder::makeArrayIndex
NonLoc makeArrayIndex(uint64_t idx)
Definition: SValBuilder.h:294
clang::BlockEdge
Definition: ProgramPoint.h:502
clang::ASTContext::getPointerType
QualType getPointerType(QualType T) const
Return the uniqued reference to the type for a pointer to the specified type.
Definition: ASTContext.cpp:3260
clang::InitListExpr::getInit
const Expr * getInit(unsigned Init) const
Definition: Expr.h:4839
clang::ento::SVal
SVal - This represents a symbolic expression, which can be either an L-value or an R-value.
Definition: SVals.h:74
clang::CharUnits
CharUnits - This is an opaque type for sizes expressed in character units.
Definition: CharUnits.h:38
clang::ento::NodeBuilder::addNodes
void addNodes(const ExplodedNodeSet &S)
Definition: CoreEngine.h:342
clang::ento::TypedValueRegion
TypedValueRegion - An abstract class representing regions having a typed value.
Definition: MemRegion.h:522
clang::BinaryOperator::isAdditiveOp
static bool isAdditiveOp(Opcode Opc)
Definition: Expr.h:3892
clang::ento::SValBuilder::evalEQ
SVal evalEQ(ProgramStateRef state, SVal lhs, SVal rhs)
Definition: SValBuilder.cpp:493
clang::Expr
This represents one expression.
Definition: Expr.h:109
clang::ento::CheckerManager::runCheckersForPreStmt
void runCheckersForPreStmt(ExplodedNodeSet &Dst, const ExplodedNodeSet &Src, const Stmt *S, ExprEngine &Eng)
Run checkers for pre-visiting Stmts.
Definition: CheckerManager.h:248
clang::ento::SValBuilder::conjureSymbolVal
DefinedOrUnknownSVal conjureSymbolVal(const void *symbolTag, const Expr *expr, const LocationContext *LCtx, unsigned count)
Create a new symbol with a unique 'name'.
clang::ento::SValBuilder::getMemberPointer
DefinedSVal getMemberPointer(const NamedDecl *ND)
Definition: SValBuilder.cpp:259
clang::ento::StoreManager::evalBaseToDerived
Optional< SVal > evalBaseToDerived(SVal Base, QualType DerivedPtrType)
Attempts to do a down cast.
Definition: Store.cpp:317
clang::Type::isIncompleteType
bool isIncompleteType(NamedDecl **Def=nullptr) const
Types are partitioned into 3 broad categories (C99 6.2.5p1): object types, function types,...
Definition: Type.cpp:2234
clang::CastExpr
CastExpr - Base class for type casts, including both implicit casts (ImplicitCastExpr) and explicit c...
Definition: Expr.h:3475
clang::ento::ExprEngine::getBasicVals
BasicValueFactory & getBasicVals()
Definition: ExprEngine.h:421
clang::DeclRefExpr
A reference to a declared variable, function, enum, etc.
Definition: Expr.h:1223
clang::ento::StmtNodeBuilder::generateNode
ExplodedNode * generateNode(const Stmt *S, ExplodedNode *Pred, ProgramStateRef St, const ProgramPointTag *tag=nullptr, ProgramPoint::Kind K=ProgramPoint::PostStmtKind)
Definition: CoreEngine.h:414
clang::ento::ExplodedNodeSet
Definition: ExplodedGraph.h:461
clang::ProgramPoint
Definition: ProgramPoint.h:58
clang::InitListExpr::getNumInits
unsigned getNumInits() const
Definition: Expr.h:4821
clang::ento::VarRegion::getDecl
const VarDecl * getDecl() const override=0
clang::CharUnits::getQuantity
QuantityType getQuantity() const
getQuantity - Get the raw integer representation of this quantity.
Definition: CharUnits.h:179
llvm::IntrusiveRefCntPtr< const ProgramState >
clang::ExplicitCastExpr
ExplicitCastExpr - An explicit cast written in the source code.
Definition: Expr.h:3697
clang::Type::isIntegralOrEnumerationType
bool isIntegralOrEnumerationType() const
Determine whether this type is an integral or enumeration type.
Definition: Type.h:7140
clang::ento::BlockDataRegion::referenced_vars_iterator::getCapturedRegion
const VarRegion * getCapturedRegion() const
Definition: MemRegion.h:703
clang::PreStmtPurgeDeadSymbols
Represents a point after we ran remove dead bindings BEFORE processing the given statement.
Definition: ProgramPoint.h:472
clang::ento::ExprEngine::VisitBinaryOperator
void VisitBinaryOperator(const BinaryOperator *B, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitBinaryOperator - Transfer function logic for binary operators.
Definition: ExprEngineC.cpp:40
clang::ento::ExprEngine::getCheckerManager
CheckerManager & getCheckerManager() const
Definition: ExprEngine.h:211
clang::ento::ExprEngine::VisitLogicalExpr
void VisitLogicalExpr(const BinaryOperator *B, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitLogicalExpr - Transfer function logic for '&&', '||'.
Definition: ExprEngineC.cpp:647