clang  14.0.0git
ExprEngineC.cpp
Go to the documentation of this file.
1 //=-- ExprEngineC.cpp - ExprEngine support for C expressions ----*- C++ -*-===//
2 //
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6 //
7 //===----------------------------------------------------------------------===//
8 //
9 // This file defines ExprEngine's support for C expressions.
10 //
11 //===----------------------------------------------------------------------===//
12 
13 #include "clang/AST/ExprCXX.h"
14 #include "clang/AST/DeclCXX.h"
17 
18 using namespace clang;
19 using namespace ento;
20 using llvm::APSInt;
21 
22 /// Optionally conjure and return a symbol for offset when processing
23 /// an expression \p Expression.
24 /// If \p Other is a location, conjure a symbol for \p Symbol
25 /// (offset) if it is unknown so that memory arithmetic always
26 /// results in an ElementRegion.
27 /// \p Count The number of times the current basic block was visited.
29  SVal Symbol, SVal Other, Expr* Expression, SValBuilder &svalBuilder,
30  unsigned Count, const LocationContext *LCtx) {
31  QualType Ty = Expression->getType();
32  if (Other.getAs<Loc>() &&
34  Symbol.isUnknown()) {
35  return svalBuilder.conjureSymbolVal(Expression, LCtx, Ty, Count);
36  }
37  return Symbol;
38 }
39 
41  ExplodedNode *Pred,
42  ExplodedNodeSet &Dst) {
43 
44  Expr *LHS = B->getLHS()->IgnoreParens();
45  Expr *RHS = B->getRHS()->IgnoreParens();
46 
47  // FIXME: Prechecks eventually go in ::Visit().
48  ExplodedNodeSet CheckedSet;
49  ExplodedNodeSet Tmp2;
50  getCheckerManager().runCheckersForPreStmt(CheckedSet, Pred, B, *this);
51 
52  // With both the LHS and RHS evaluated, process the operation itself.
53  for (ExplodedNodeSet::iterator it=CheckedSet.begin(), ei=CheckedSet.end();
54  it != ei; ++it) {
55 
56  ProgramStateRef state = (*it)->getState();
57  const LocationContext *LCtx = (*it)->getLocationContext();
58  SVal LeftV = state->getSVal(LHS, LCtx);
59  SVal RightV = state->getSVal(RHS, LCtx);
60 
62 
63  if (Op == BO_Assign) {
64  // EXPERIMENTAL: "Conjured" symbols.
65  // FIXME: Handle structs.
66  if (RightV.isUnknown()) {
67  unsigned Count = currBldrCtx->blockCount();
68  RightV = svalBuilder.conjureSymbolVal(nullptr, B->getRHS(), LCtx,
69  Count);
70  }
71  // Simulate the effects of a "store": bind the value of the RHS
72  // to the L-Value represented by the LHS.
73  SVal ExprVal = B->isGLValue() ? LeftV : RightV;
74  evalStore(Tmp2, B, LHS, *it, state->BindExpr(B, LCtx, ExprVal),
75  LeftV, RightV);
76  continue;
77  }
78 
79  if (!B->isAssignmentOp()) {
80  StmtNodeBuilder Bldr(*it, Tmp2, *currBldrCtx);
81 
82  if (B->isAdditiveOp()) {
83  // TODO: This can be removed after we enable history tracking with
84  // SymSymExpr.
85  unsigned Count = currBldrCtx->blockCount();
87  RightV, LeftV, RHS, svalBuilder, Count, LCtx);
89  LeftV, RightV, LHS, svalBuilder, Count, LCtx);
90  }
91 
92  // Although we don't yet model pointers-to-members, we do need to make
93  // sure that the members of temporaries have a valid 'this' pointer for
94  // other checks.
95  if (B->getOpcode() == BO_PtrMemD)
96  state = createTemporaryRegionIfNeeded(state, LCtx, LHS);
97 
98  // Process non-assignments except commas or short-circuited
99  // logical expressions (LAnd and LOr).
100  SVal Result = evalBinOp(state, Op, LeftV, RightV, B->getType());
101  if (!Result.isUnknown()) {
102  state = state->BindExpr(B, LCtx, Result);
103  } else {
104  // If we cannot evaluate the operation escape the operands.
105  state = escapeValues(state, LeftV, PSK_EscapeOther);
106  state = escapeValues(state, RightV, PSK_EscapeOther);
107  }
108 
109  Bldr.generateNode(B, *it, state);
110  continue;
111  }
112 
113  assert (B->isCompoundAssignmentOp());
114 
115  switch (Op) {
116  default:
117  llvm_unreachable("Invalid opcode for compound assignment.");
118  case BO_MulAssign: Op = BO_Mul; break;
119  case BO_DivAssign: Op = BO_Div; break;
120  case BO_RemAssign: Op = BO_Rem; break;
121  case BO_AddAssign: Op = BO_Add; break;
122  case BO_SubAssign: Op = BO_Sub; break;
123  case BO_ShlAssign: Op = BO_Shl; break;
124  case BO_ShrAssign: Op = BO_Shr; break;
125  case BO_AndAssign: Op = BO_And; break;
126  case BO_XorAssign: Op = BO_Xor; break;
127  case BO_OrAssign: Op = BO_Or; break;
128  }
129 
130  // Perform a load (the LHS). This performs the checks for
131  // null dereferences, and so on.
132  ExplodedNodeSet Tmp;
133  SVal location = LeftV;
134  evalLoad(Tmp, B, LHS, *it, state, location);
135 
136  for (ExplodedNodeSet::iterator I = Tmp.begin(), E = Tmp.end(); I != E;
137  ++I) {
138 
139  state = (*I)->getState();
140  const LocationContext *LCtx = (*I)->getLocationContext();
141  SVal V = state->getSVal(LHS, LCtx);
142 
143  // Get the computation type.
144  QualType CTy =
145  cast<CompoundAssignOperator>(B)->getComputationResultType();
146  CTy = getContext().getCanonicalType(CTy);
147 
148  QualType CLHSTy =
149  cast<CompoundAssignOperator>(B)->getComputationLHSType();
150  CLHSTy = getContext().getCanonicalType(CLHSTy);
151 
153 
154  // Promote LHS.
155  V = svalBuilder.evalCast(V, CLHSTy, LTy);
156 
157  // Compute the result of the operation.
158  SVal Result = svalBuilder.evalCast(evalBinOp(state, Op, V, RightV, CTy),
159  B->getType(), CTy);
160 
161  // EXPERIMENTAL: "Conjured" symbols.
162  // FIXME: Handle structs.
163 
164  SVal LHSVal;
165 
166  if (Result.isUnknown()) {
167  // The symbolic value is actually for the type of the left-hand side
168  // expression, not the computation type, as this is the value the
169  // LValue on the LHS will bind to.
170  LHSVal = svalBuilder.conjureSymbolVal(nullptr, B->getRHS(), LCtx, LTy,
171  currBldrCtx->blockCount());
172  // However, we need to convert the symbol to the computation type.
173  Result = svalBuilder.evalCast(LHSVal, CTy, LTy);
174  }
175  else {
176  // The left-hand side may bind to a different value then the
177  // computation type.
178  LHSVal = svalBuilder.evalCast(Result, LTy, CTy);
179  }
180 
181  // In C++, assignment and compound assignment operators return an
182  // lvalue.
183  if (B->isGLValue())
184  state = state->BindExpr(B, LCtx, location);
185  else
186  state = state->BindExpr(B, LCtx, Result);
187 
188  evalStore(Tmp2, B, LHS, *I, state, location, LHSVal);
189  }
190  }
191 
192  // FIXME: postvisits eventually go in ::Visit()
193  getCheckerManager().runCheckersForPostStmt(Dst, Tmp2, B, *this);
194 }
195 
197  ExplodedNodeSet &Dst) {
198 
200 
201  const BlockDecl *BD = BE->getBlockDecl();
202  // Get the value of the block itself.
203  SVal V = svalBuilder.getBlockPointer(BD, T,
204  Pred->getLocationContext(),
205  currBldrCtx->blockCount());
206 
207  ProgramStateRef State = Pred->getState();
208 
209  // If we created a new MemRegion for the block, we should explicitly bind
210  // the captured variables.
211  if (const BlockDataRegion *BDR =
212  dyn_cast_or_null<BlockDataRegion>(V.getAsRegion())) {
213 
214  BlockDataRegion::referenced_vars_iterator I = BDR->referenced_vars_begin(),
215  E = BDR->referenced_vars_end();
216 
217  auto CI = BD->capture_begin();
218  auto CE = BD->capture_end();
219  for (; I != E; ++I) {
220  const VarRegion *capturedR = I.getCapturedRegion();
221  const TypedValueRegion *originalR = I.getOriginalRegion();
222 
223  // If the capture had a copy expression, use the result of evaluating
224  // that expression, otherwise use the original value.
225  // We rely on the invariant that the block declaration's capture variables
226  // are a prefix of the BlockDataRegion's referenced vars (which may include
227  // referenced globals, etc.) to enable fast lookup of the capture for a
228  // given referenced var.
229  const Expr *copyExpr = nullptr;
230  if (CI != CE) {
231  assert(CI->getVariable() == capturedR->getDecl());
232  copyExpr = CI->getCopyExpr();
233  CI++;
234  }
235 
236  if (capturedR != originalR) {
237  SVal originalV;
238  const LocationContext *LCtx = Pred->getLocationContext();
239  if (copyExpr) {
240  originalV = State->getSVal(copyExpr, LCtx);
241  } else {
242  originalV = State->getSVal(loc::MemRegionVal(originalR));
243  }
244  State = State->bindLoc(loc::MemRegionVal(capturedR), originalV, LCtx);
245  }
246  }
247  }
248 
249  ExplodedNodeSet Tmp;
250  StmtNodeBuilder Bldr(Pred, Tmp, *currBldrCtx);
251  Bldr.generateNode(BE, Pred,
252  State->BindExpr(BE, Pred->getLocationContext(), V),
254 
255  // FIXME: Move all post/pre visits to ::Visit().
256  getCheckerManager().runCheckersForPostStmt(Dst, Tmp, BE, *this);
257 }
258 
260  ProgramStateRef state, const Expr* Ex, const LocationContext* LCtx,
261  QualType T, QualType ExTy, const CastExpr* CastE, StmtNodeBuilder& Bldr,
262  ExplodedNode* Pred) {
263  if (T->isLValueReferenceType()) {
264  assert(!CastE->getType()->isLValueReferenceType());
265  ExTy = getContext().getLValueReferenceType(ExTy);
266  } else if (T->isRValueReferenceType()) {
267  assert(!CastE->getType()->isRValueReferenceType());
268  ExTy = getContext().getRValueReferenceType(ExTy);
269  }
270  // Delegate to SValBuilder to process.
271  SVal OrigV = state->getSVal(Ex, LCtx);
272  SVal V = svalBuilder.evalCast(OrigV, T, ExTy);
273  // Negate the result if we're treating the boolean as a signed i1
274  if (CastE->getCastKind() == CK_BooleanToSignedIntegral)
275  V = evalMinus(V);
276  state = state->BindExpr(CastE, LCtx, V);
277  if (V.isUnknown() && !OrigV.isUnknown()) {
278  state = escapeValues(state, OrigV, PSK_EscapeOther);
279  }
280  Bldr.generateNode(CastE, Pred, state);
281 
282  return state;
283 }
284 
285 void ExprEngine::VisitCast(const CastExpr *CastE, const Expr *Ex,
286  ExplodedNode *Pred, ExplodedNodeSet &Dst) {
287 
288  ExplodedNodeSet dstPreStmt;
289  getCheckerManager().runCheckersForPreStmt(dstPreStmt, Pred, CastE, *this);
290 
291  if (CastE->getCastKind() == CK_LValueToRValue ||
292  CastE->getCastKind() == CK_LValueToRValueBitCast) {
293  for (ExplodedNodeSet::iterator I = dstPreStmt.begin(), E = dstPreStmt.end();
294  I!=E; ++I) {
295  ExplodedNode *subExprNode = *I;
296  ProgramStateRef state = subExprNode->getState();
297  const LocationContext *LCtx = subExprNode->getLocationContext();
298  evalLoad(Dst, CastE, CastE, subExprNode, state, state->getSVal(Ex, LCtx));
299  }
300  return;
301  }
302 
303  // All other casts.
304  QualType T = CastE->getType();
305  QualType ExTy = Ex->getType();
306 
307  if (const ExplicitCastExpr *ExCast=dyn_cast_or_null<ExplicitCastExpr>(CastE))
308  T = ExCast->getTypeAsWritten();
309 
310  StmtNodeBuilder Bldr(dstPreStmt, Dst, *currBldrCtx);
311  for (ExplodedNodeSet::iterator I = dstPreStmt.begin(), E = dstPreStmt.end();
312  I != E; ++I) {
313 
314  Pred = *I;
315  ProgramStateRef state = Pred->getState();
316  const LocationContext *LCtx = Pred->getLocationContext();
317 
318  switch (CastE->getCastKind()) {
319  case CK_LValueToRValue:
320  case CK_LValueToRValueBitCast:
321  llvm_unreachable("LValueToRValue casts handled earlier.");
322  case CK_ToVoid:
323  continue;
324  // The analyzer doesn't do anything special with these casts,
325  // since it understands retain/release semantics already.
326  case CK_ARCProduceObject:
327  case CK_ARCConsumeObject:
328  case CK_ARCReclaimReturnedObject:
329  case CK_ARCExtendBlockObject: // Fall-through.
330  case CK_CopyAndAutoreleaseBlockObject:
331  // The analyser can ignore atomic casts for now, although some future
332  // checkers may want to make certain that you're not modifying the same
333  // value through atomic and nonatomic pointers.
334  case CK_AtomicToNonAtomic:
335  case CK_NonAtomicToAtomic:
336  // True no-ops.
337  case CK_NoOp:
338  case CK_ConstructorConversion:
339  case CK_UserDefinedConversion:
340  case CK_FunctionToPointerDecay:
341  case CK_BuiltinFnToFnPtr: {
342  // Copy the SVal of Ex to CastE.
343  ProgramStateRef state = Pred->getState();
344  const LocationContext *LCtx = Pred->getLocationContext();
345  SVal V = state->getSVal(Ex, LCtx);
346  state = state->BindExpr(CastE, LCtx, V);
347  Bldr.generateNode(CastE, Pred, state);
348  continue;
349  }
350  case CK_MemberPointerToBoolean:
351  case CK_PointerToBoolean: {
352  SVal V = state->getSVal(Ex, LCtx);
353  auto PTMSV = V.getAs<nonloc::PointerToMember>();
354  if (PTMSV)
355  V = svalBuilder.makeTruthVal(!PTMSV->isNullMemberPointer(), ExTy);
356  if (V.isUndef() || PTMSV) {
357  state = state->BindExpr(CastE, LCtx, V);
358  Bldr.generateNode(CastE, Pred, state);
359  continue;
360  }
361  // Explicitly proceed with default handler for this case cascade.
362  state =
363  handleLValueBitCast(state, Ex, LCtx, T, ExTy, CastE, Bldr, Pred);
364  continue;
365  }
366  case CK_Dependent:
367  case CK_ArrayToPointerDecay:
368  case CK_BitCast:
369  case CK_AddressSpaceConversion:
370  case CK_BooleanToSignedIntegral:
371  case CK_IntegralToPointer:
372  case CK_PointerToIntegral: {
373  SVal V = state->getSVal(Ex, LCtx);
374  if (V.getAs<nonloc::PointerToMember>()) {
375  state = state->BindExpr(CastE, LCtx, UnknownVal());
376  Bldr.generateNode(CastE, Pred, state);
377  continue;
378  }
379  // Explicitly proceed with default handler for this case cascade.
380  state =
381  handleLValueBitCast(state, Ex, LCtx, T, ExTy, CastE, Bldr, Pred);
382  continue;
383  }
384  case CK_IntegralToBoolean:
385  case CK_IntegralToFloating:
386  case CK_FloatingToIntegral:
387  case CK_FloatingToBoolean:
388  case CK_FloatingCast:
389  case CK_FloatingRealToComplex:
390  case CK_FloatingComplexToReal:
391  case CK_FloatingComplexToBoolean:
392  case CK_FloatingComplexCast:
393  case CK_FloatingComplexToIntegralComplex:
394  case CK_IntegralRealToComplex:
395  case CK_IntegralComplexToReal:
396  case CK_IntegralComplexToBoolean:
397  case CK_IntegralComplexCast:
398  case CK_IntegralComplexToFloatingComplex:
399  case CK_CPointerToObjCPointerCast:
400  case CK_BlockPointerToObjCPointerCast:
401  case CK_AnyPointerToBlockPointerCast:
402  case CK_ObjCObjectLValueCast:
403  case CK_ZeroToOCLOpaqueType:
404  case CK_IntToOCLSampler:
405  case CK_LValueBitCast:
406  case CK_FloatingToFixedPoint:
407  case CK_FixedPointToFloating:
408  case CK_FixedPointCast:
409  case CK_FixedPointToBoolean:
410  case CK_FixedPointToIntegral:
411  case CK_IntegralToFixedPoint: {
412  state =
413  handleLValueBitCast(state, Ex, LCtx, T, ExTy, CastE, Bldr, Pred);
414  continue;
415  }
416  case CK_IntegralCast: {
417  // Delegate to SValBuilder to process.
418  SVal V = state->getSVal(Ex, LCtx);
419  V = svalBuilder.evalIntegralCast(state, V, T, ExTy);
420  state = state->BindExpr(CastE, LCtx, V);
421  Bldr.generateNode(CastE, Pred, state);
422  continue;
423  }
424  case CK_DerivedToBase:
425  case CK_UncheckedDerivedToBase: {
426  // For DerivedToBase cast, delegate to the store manager.
427  SVal val = state->getSVal(Ex, LCtx);
428  val = getStoreManager().evalDerivedToBase(val, CastE);
429  state = state->BindExpr(CastE, LCtx, val);
430  Bldr.generateNode(CastE, Pred, state);
431  continue;
432  }
433  // Handle C++ dyn_cast.
434  case CK_Dynamic: {
435  SVal val = state->getSVal(Ex, LCtx);
436 
437  // Compute the type of the result.
438  QualType resultType = CastE->getType();
439  if (CastE->isGLValue())
440  resultType = getContext().getPointerType(resultType);
441 
442  bool Failed = false;
443 
444  // Check if the value being cast evaluates to 0.
445  if (val.isZeroConstant())
446  Failed = true;
447  // Else, evaluate the cast.
448  else
449  val = getStoreManager().attemptDownCast(val, T, Failed);
450 
451  if (Failed) {
452  if (T->isReferenceType()) {
453  // A bad_cast exception is thrown if input value is a reference.
454  // Currently, we model this, by generating a sink.
455  Bldr.generateSink(CastE, Pred, state);
456  continue;
457  } else {
458  // If the cast fails on a pointer, bind to 0.
459  state = state->BindExpr(CastE, LCtx, svalBuilder.makeNull());
460  }
461  } else {
462  // If we don't know if the cast succeeded, conjure a new symbol.
463  if (val.isUnknown()) {
464  DefinedOrUnknownSVal NewSym =
465  svalBuilder.conjureSymbolVal(nullptr, CastE, LCtx, resultType,
466  currBldrCtx->blockCount());
467  state = state->BindExpr(CastE, LCtx, NewSym);
468  } else
469  // Else, bind to the derived region value.
470  state = state->BindExpr(CastE, LCtx, val);
471  }
472  Bldr.generateNode(CastE, Pred, state);
473  continue;
474  }
475  case CK_BaseToDerived: {
476  SVal val = state->getSVal(Ex, LCtx);
477  QualType resultType = CastE->getType();
478  if (CastE->isGLValue())
479  resultType = getContext().getPointerType(resultType);
480 
481  bool Failed = false;
482 
483  if (!val.isConstant()) {
484  val = getStoreManager().attemptDownCast(val, T, Failed);
485  }
486 
487  // Failed to cast or the result is unknown, fall back to conservative.
488  if (Failed || val.isUnknown()) {
489  val =
490  svalBuilder.conjureSymbolVal(nullptr, CastE, LCtx, resultType,
491  currBldrCtx->blockCount());
492  }
493  state = state->BindExpr(CastE, LCtx, val);
494  Bldr.generateNode(CastE, Pred, state);
495  continue;
496  }
497  case CK_NullToPointer: {
498  SVal V = svalBuilder.makeNull();
499  state = state->BindExpr(CastE, LCtx, V);
500  Bldr.generateNode(CastE, Pred, state);
501  continue;
502  }
503  case CK_NullToMemberPointer: {
504  SVal V = svalBuilder.getMemberPointer(nullptr);
505  state = state->BindExpr(CastE, LCtx, V);
506  Bldr.generateNode(CastE, Pred, state);
507  continue;
508  }
509  case CK_DerivedToBaseMemberPointer:
510  case CK_BaseToDerivedMemberPointer:
511  case CK_ReinterpretMemberPointer: {
512  SVal V = state->getSVal(Ex, LCtx);
513  if (auto PTMSV = V.getAs<nonloc::PointerToMember>()) {
514  SVal CastedPTMSV =
515  svalBuilder.makePointerToMember(getBasicVals().accumCXXBase(
516  CastE->path(), *PTMSV, CastE->getCastKind()));
517  state = state->BindExpr(CastE, LCtx, CastedPTMSV);
518  Bldr.generateNode(CastE, Pred, state);
519  continue;
520  }
521  // Explicitly proceed with default handler for this case cascade.
522  }
523  LLVM_FALLTHROUGH;
524  // Various C++ casts that are not handled yet.
525  case CK_ToUnion:
526  case CK_MatrixCast:
527  case CK_VectorSplat: {
528  QualType resultType = CastE->getType();
529  if (CastE->isGLValue())
530  resultType = getContext().getPointerType(resultType);
531  SVal result = svalBuilder.conjureSymbolVal(
532  /*symbolTag=*/nullptr, CastE, LCtx, resultType,
533  currBldrCtx->blockCount());
534  state = state->BindExpr(CastE, LCtx, result);
535  Bldr.generateNode(CastE, Pred, state);
536  continue;
537  }
538  }
539  }
540 }
541 
543  ExplodedNode *Pred,
544  ExplodedNodeSet &Dst) {
545  StmtNodeBuilder B(Pred, Dst, *currBldrCtx);
546 
547  ProgramStateRef State = Pred->getState();
548  const LocationContext *LCtx = Pred->getLocationContext();
549 
550  const Expr *Init = CL->getInitializer();
551  SVal V = State->getSVal(CL->getInitializer(), LCtx);
552 
553  if (isa<CXXConstructExpr, CXXStdInitializerListExpr>(Init)) {
554  // No work needed. Just pass the value up to this expression.
555  } else {
556  assert(isa<InitListExpr>(Init));
557  Loc CLLoc = State->getLValue(CL, LCtx);
558  State = State->bindLoc(CLLoc, V, LCtx);
559 
560  if (CL->isGLValue())
561  V = CLLoc;
562  }
563 
564  B.generateNode(CL, Pred, State->BindExpr(CL, LCtx, V));
565 }
566 
568  ExplodedNodeSet &Dst) {
569  if (isa<TypedefNameDecl>(*DS->decl_begin())) {
570  // C99 6.7.7 "Any array size expressions associated with variable length
571  // array declarators are evaluated each time the declaration of the typedef
572  // name is reached in the order of execution."
573  // The checkers should know about typedef to be able to handle VLA size
574  // expressions.
575  ExplodedNodeSet DstPre;
576  getCheckerManager().runCheckersForPreStmt(DstPre, Pred, DS, *this);
577  getCheckerManager().runCheckersForPostStmt(Dst, DstPre, DS, *this);
578  return;
579  }
580 
581  // Assumption: The CFG has one DeclStmt per Decl.
582  const VarDecl *VD = dyn_cast_or_null<VarDecl>(*DS->decl_begin());
583 
584  if (!VD) {
585  //TODO:AZ: remove explicit insertion after refactoring is done.
586  Dst.insert(Pred);
587  return;
588  }
589 
590  // FIXME: all pre/post visits should eventually be handled by ::Visit().
591  ExplodedNodeSet dstPreVisit;
592  getCheckerManager().runCheckersForPreStmt(dstPreVisit, Pred, DS, *this);
593 
594  ExplodedNodeSet dstEvaluated;
595  StmtNodeBuilder B(dstPreVisit, dstEvaluated, *currBldrCtx);
596  for (ExplodedNodeSet::iterator I = dstPreVisit.begin(), E = dstPreVisit.end();
597  I!=E; ++I) {
598  ExplodedNode *N = *I;
600  const LocationContext *LC = N->getLocationContext();
601 
602  // Decls without InitExpr are not initialized explicitly.
603  if (const Expr *InitEx = VD->getInit()) {
604 
605  // Note in the state that the initialization has occurred.
606  ExplodedNode *UpdatedN = N;
607  SVal InitVal = state->getSVal(InitEx, LC);
608 
609  assert(DS->isSingleDecl());
610  if (getObjectUnderConstruction(state, DS, LC)) {
611  state = finishObjectConstruction(state, DS, LC);
612  // We constructed the object directly in the variable.
613  // No need to bind anything.
614  B.generateNode(DS, UpdatedN, state);
615  } else {
616  // Recover some path-sensitivity if a scalar value evaluated to
617  // UnknownVal.
618  if (InitVal.isUnknown()) {
619  QualType Ty = InitEx->getType();
620  if (InitEx->isGLValue()) {
621  Ty = getContext().getPointerType(Ty);
622  }
623 
624  InitVal = svalBuilder.conjureSymbolVal(nullptr, InitEx, LC, Ty,
625  currBldrCtx->blockCount());
626  }
627 
628 
629  B.takeNodes(UpdatedN);
630  ExplodedNodeSet Dst2;
631  evalBind(Dst2, DS, UpdatedN, state->getLValue(VD, LC), InitVal, true);
632  B.addNodes(Dst2);
633  }
634  }
635  else {
636  B.generateNode(DS, N, state);
637  }
638  }
639 
640  getCheckerManager().runCheckersForPostStmt(Dst, B.getResults(), DS, *this);
641 }
642 
644  ExplodedNodeSet &Dst) {
645  // This method acts upon CFG elements for logical operators && and ||
646  // and attaches the value (true or false) to them as expressions.
647  // It doesn't produce any state splits.
648  // If we made it that far, we're past the point when we modeled the short
649  // circuit. It means that we should have precise knowledge about whether
650  // we've short-circuited. If we did, we already know the value we need to
651  // bind. If we didn't, the value of the RHS (casted to the boolean type)
652  // is the answer.
653  // Currently this method tries to figure out whether we've short-circuited
654  // by looking at the ExplodedGraph. This method is imperfect because there
655  // could inevitably have been merges that would have resulted in multiple
656  // potential path traversal histories. We bail out when we fail.
657  // Due to this ambiguity, a more reliable solution would have been to
658  // track the short circuit operation history path-sensitively until
659  // we evaluate the respective logical operator.
660  assert(B->getOpcode() == BO_LAnd ||
661  B->getOpcode() == BO_LOr);
662 
663  StmtNodeBuilder Bldr(Pred, Dst, *currBldrCtx);
664  ProgramStateRef state = Pred->getState();
665 
666  if (B->getType()->isVectorType()) {
667  // FIXME: We do not model vector arithmetic yet. When adding support for
668  // that, note that the CFG-based reasoning below does not apply, because
669  // logical operators on vectors are not short-circuit. Currently they are
670  // modeled as short-circuit in Clang CFG but this is incorrect.
671  // Do not set the value for the expression. It'd be UnknownVal by default.
672  Bldr.generateNode(B, Pred, state);
673  return;
674  }
675 
676  ExplodedNode *N = Pred;
677  while (!N->getLocation().getAs<BlockEntrance>()) {
678  ProgramPoint P = N->getLocation();
679  assert(P.getAs<PreStmt>()|| P.getAs<PreStmtPurgeDeadSymbols>());
680  (void) P;
681  if (N->pred_size() != 1) {
682  // We failed to track back where we came from.
683  Bldr.generateNode(B, Pred, state);
684  return;
685  }
686  N = *N->pred_begin();
687  }
688 
689  if (N->pred_size() != 1) {
690  // We failed to track back where we came from.
691  Bldr.generateNode(B, Pred, state);
692  return;
693  }
694 
695  N = *N->pred_begin();
696  BlockEdge BE = N->getLocation().castAs<BlockEdge>();
697  SVal X;
698 
699  // Determine the value of the expression by introspecting how we
700  // got this location in the CFG. This requires looking at the previous
701  // block we were in and what kind of control-flow transfer was involved.
702  const CFGBlock *SrcBlock = BE.getSrc();
703  // The only terminator (if there is one) that makes sense is a logical op.
704  CFGTerminator T = SrcBlock->getTerminator();
705  if (const BinaryOperator *Term = cast_or_null<BinaryOperator>(T.getStmt())) {
706  (void) Term;
707  assert(Term->isLogicalOp());
708  assert(SrcBlock->succ_size() == 2);
709  // Did we take the true or false branch?
710  unsigned constant = (*SrcBlock->succ_begin() == BE.getDst()) ? 1 : 0;
711  X = svalBuilder.makeIntVal(constant, B->getType());
712  }
713  else {
714  // If there is no terminator, by construction the last statement
715  // in SrcBlock is the value of the enclosing expression.
716  // However, we still need to constrain that value to be 0 or 1.
717  assert(!SrcBlock->empty());
718  CFGStmt Elem = SrcBlock->rbegin()->castAs<CFGStmt>();
719  const Expr *RHS = cast<Expr>(Elem.getStmt());
720  SVal RHSVal = N->getState()->getSVal(RHS, Pred->getLocationContext());
721 
722  if (RHSVal.isUndef()) {
723  X = RHSVal;
724  } else {
725  // We evaluate "RHSVal != 0" expression which result in 0 if the value is
726  // known to be false, 1 if the value is known to be true and a new symbol
727  // when the assumption is unknown.
729  X = evalBinOp(N->getState(), BO_NE,
730  svalBuilder.evalCast(RHSVal, B->getType(), RHS->getType()),
731  Zero, B->getType());
732  }
733  }
734  Bldr.generateNode(B, Pred, state->BindExpr(B, Pred->getLocationContext(), X));
735 }
736 
738  ExplodedNode *Pred,
739  ExplodedNodeSet &Dst) {
740  StmtNodeBuilder B(Pred, Dst, *currBldrCtx);
741 
742  ProgramStateRef state = Pred->getState();
743  const LocationContext *LCtx = Pred->getLocationContext();
745  unsigned NumInitElements = IE->getNumInits();
746 
747  if (!IE->isGLValue() && !IE->isTransparent() &&
748  (T->isArrayType() || T->isRecordType() || T->isVectorType() ||
749  T->isAnyComplexType())) {
750  llvm::ImmutableList<SVal> vals = getBasicVals().getEmptySValList();
751 
752  // Handle base case where the initializer has no elements.
753  // e.g: static int* myArray[] = {};
754  if (NumInitElements == 0) {
755  SVal V = svalBuilder.makeCompoundVal(T, vals);
756  B.generateNode(IE, Pred, state->BindExpr(IE, LCtx, V));
757  return;
758  }
759 
761  ei = IE->rend(); it != ei; ++it) {
762  SVal V = state->getSVal(cast<Expr>(*it), LCtx);
763  vals = getBasicVals().prependSVal(V, vals);
764  }
765 
766  B.generateNode(IE, Pred,
767  state->BindExpr(IE, LCtx,
768  svalBuilder.makeCompoundVal(T, vals)));
769  return;
770  }
771 
772  // Handle scalars: int{5} and int{} and GLvalues.
773  // Note, if the InitListExpr is a GLvalue, it means that there is an address
774  // representing it, so it must have a single init element.
775  assert(NumInitElements <= 1);
776 
777  SVal V;
778  if (NumInitElements == 0)
780  else
781  V = state->getSVal(IE->getInit(0), LCtx);
782 
783  B.generateNode(IE, Pred, state->BindExpr(IE, LCtx, V));
784 }
785 
787  const Expr *L,
788  const Expr *R,
789  ExplodedNode *Pred,
790  ExplodedNodeSet &Dst) {
791  assert(L && R);
792 
793  StmtNodeBuilder B(Pred, Dst, *currBldrCtx);
794  ProgramStateRef state = Pred->getState();
795  const LocationContext *LCtx = Pred->getLocationContext();
796  const CFGBlock *SrcBlock = nullptr;
797 
798  // Find the predecessor block.
799  ProgramStateRef SrcState = state;
800  for (const ExplodedNode *N = Pred ; N ; N = *N->pred_begin()) {
801  ProgramPoint PP = N->getLocation();
802  if (PP.getAs<PreStmtPurgeDeadSymbols>() || PP.getAs<BlockEntrance>()) {
803  // If the state N has multiple predecessors P, it means that successors
804  // of P are all equivalent.
805  // In turn, that means that all nodes at P are equivalent in terms
806  // of observable behavior at N, and we can follow any of them.
807  // FIXME: a more robust solution which does not walk up the tree.
808  continue;
809  }
810  SrcBlock = PP.castAs<BlockEdge>().getSrc();
811  SrcState = N->getState();
812  break;
813  }
814 
815  assert(SrcBlock && "missing function entry");
816 
817  // Find the last expression in the predecessor block. That is the
818  // expression that is used for the value of the ternary expression.
819  bool hasValue = false;
820  SVal V;
821 
822  for (CFGElement CE : llvm::reverse(*SrcBlock)) {
823  if (Optional<CFGStmt> CS = CE.getAs<CFGStmt>()) {
824  const Expr *ValEx = cast<Expr>(CS->getStmt());
825  ValEx = ValEx->IgnoreParens();
826 
827  // For GNU extension '?:' operator, the left hand side will be an
828  // OpaqueValueExpr, so get the underlying expression.
829  if (const OpaqueValueExpr *OpaqueEx = dyn_cast<OpaqueValueExpr>(L))
830  L = OpaqueEx->getSourceExpr();
831 
832  // If the last expression in the predecessor block matches true or false
833  // subexpression, get its the value.
834  if (ValEx == L->IgnoreParens() || ValEx == R->IgnoreParens()) {
835  hasValue = true;
836  V = SrcState->getSVal(ValEx, LCtx);
837  }
838  break;
839  }
840  }
841 
842  if (!hasValue)
843  V = svalBuilder.conjureSymbolVal(nullptr, Ex, LCtx,
844  currBldrCtx->blockCount());
845 
846  // Generate a new node with the binding from the appropriate path.
847  B.generateNode(Ex, Pred, state->BindExpr(Ex, LCtx, V, true));
848 }
849 
850 void ExprEngine::
852  ExplodedNode *Pred, ExplodedNodeSet &Dst) {
853  StmtNodeBuilder B(Pred, Dst, *currBldrCtx);
854  Expr::EvalResult Result;
855  if (OOE->EvaluateAsInt(Result, getContext())) {
856  APSInt IV = Result.Val.getInt();
857  assert(IV.getBitWidth() == getContext().getTypeSize(OOE->getType()));
858  assert(OOE->getType()->castAs<BuiltinType>()->isInteger());
859  assert(IV.isSigned() == OOE->getType()->isSignedIntegerType());
860  SVal X = svalBuilder.makeIntVal(IV);
861  B.generateNode(OOE, Pred,
862  Pred->getState()->BindExpr(OOE, Pred->getLocationContext(),
863  X));
864  }
865  // FIXME: Handle the case where __builtin_offsetof is not a constant.
866 }
867 
868 
869 void ExprEngine::
871  ExplodedNode *Pred,
872  ExplodedNodeSet &Dst) {
873  // FIXME: Prechecks eventually go in ::Visit().
874  ExplodedNodeSet CheckedSet;
875  getCheckerManager().runCheckersForPreStmt(CheckedSet, Pred, Ex, *this);
876 
877  ExplodedNodeSet EvalSet;
878  StmtNodeBuilder Bldr(CheckedSet, EvalSet, *currBldrCtx);
879 
880  QualType T = Ex->getTypeOfArgument();
881 
882  for (ExplodedNodeSet::iterator I = CheckedSet.begin(), E = CheckedSet.end();
883  I != E; ++I) {
884  if (Ex->getKind() == UETT_SizeOf) {
885  if (!T->isIncompleteType() && !T->isConstantSizeType()) {
886  assert(T->isVariableArrayType() && "Unknown non-constant-sized type.");
887 
888  // FIXME: Add support for VLA type arguments and VLA expressions.
889  // When that happens, we should probably refactor VLASizeChecker's code.
890  continue;
891  } else if (T->getAs<ObjCObjectType>()) {
892  // Some code tries to take the sizeof an ObjCObjectType, relying that
893  // the compiler has laid out its representation. Just report Unknown
894  // for these.
895  continue;
896  }
897  }
898 
900  CharUnits amt = CharUnits::fromQuantity(Value.getZExtValue());
901 
902  ProgramStateRef state = (*I)->getState();
903  state = state->BindExpr(Ex, (*I)->getLocationContext(),
904  svalBuilder.makeIntVal(amt.getQuantity(),
905  Ex->getType()));
906  Bldr.generateNode(Ex, *I, state);
907  }
908 
909  getCheckerManager().runCheckersForPostStmt(Dst, EvalSet, Ex, *this);
910 }
911 
913  const UnaryOperator *U,
914  StmtNodeBuilder &Bldr) {
915  // FIXME: We can probably just have some magic in Environment::getSVal()
916  // that propagates values, instead of creating a new node here.
917  //
918  // Unary "+" is a no-op, similar to a parentheses. We still have places
919  // where it may be a block-level expression, so we need to
920  // generate an extra node that just propagates the value of the
921  // subexpression.
922  const Expr *Ex = U->getSubExpr()->IgnoreParens();
923  ProgramStateRef state = (*I)->getState();
924  const LocationContext *LCtx = (*I)->getLocationContext();
925  Bldr.generateNode(U, *I, state->BindExpr(U, LCtx,
926  state->getSVal(Ex, LCtx)));
927 }
928 
930  ExplodedNodeSet &Dst) {
931  // FIXME: Prechecks eventually go in ::Visit().
932  ExplodedNodeSet CheckedSet;
933  getCheckerManager().runCheckersForPreStmt(CheckedSet, Pred, U, *this);
934 
935  ExplodedNodeSet EvalSet;
936  StmtNodeBuilder Bldr(CheckedSet, EvalSet, *currBldrCtx);
937 
938  for (ExplodedNodeSet::iterator I = CheckedSet.begin(), E = CheckedSet.end();
939  I != E; ++I) {
940  switch (U->getOpcode()) {
941  default: {
942  Bldr.takeNodes(*I);
943  ExplodedNodeSet Tmp;
945  Bldr.addNodes(Tmp);
946  break;
947  }
948  case UO_Real: {
949  const Expr *Ex = U->getSubExpr()->IgnoreParens();
950 
951  // FIXME: We don't have complex SValues yet.
952  if (Ex->getType()->isAnyComplexType()) {
953  // Just report "Unknown."
954  break;
955  }
956 
957  // For all other types, UO_Real is an identity operation.
958  assert (U->getType() == Ex->getType());
959  ProgramStateRef state = (*I)->getState();
960  const LocationContext *LCtx = (*I)->getLocationContext();
961  Bldr.generateNode(U, *I, state->BindExpr(U, LCtx,
962  state->getSVal(Ex, LCtx)));
963  break;
964  }
965 
966  case UO_Imag: {
967  const Expr *Ex = U->getSubExpr()->IgnoreParens();
968  // FIXME: We don't have complex SValues yet.
969  if (Ex->getType()->isAnyComplexType()) {
970  // Just report "Unknown."
971  break;
972  }
973  // For all other types, UO_Imag returns 0.
974  ProgramStateRef state = (*I)->getState();
975  const LocationContext *LCtx = (*I)->getLocationContext();
976  SVal X = svalBuilder.makeZeroVal(Ex->getType());
977  Bldr.generateNode(U, *I, state->BindExpr(U, LCtx, X));
978  break;
979  }
980 
981  case UO_AddrOf: {
982  // Process pointer-to-member address operation.
983  const Expr *Ex = U->getSubExpr()->IgnoreParens();
984  if (const DeclRefExpr *DRE = dyn_cast<DeclRefExpr>(Ex)) {
985  const ValueDecl *VD = DRE->getDecl();
986 
987  if (isa<CXXMethodDecl, FieldDecl, IndirectFieldDecl>(VD)) {
988  ProgramStateRef State = (*I)->getState();
989  const LocationContext *LCtx = (*I)->getLocationContext();
990  SVal SV = svalBuilder.getMemberPointer(cast<NamedDecl>(VD));
991  Bldr.generateNode(U, *I, State->BindExpr(U, LCtx, SV));
992  break;
993  }
994  }
995  // Explicitly proceed with default handler for this case cascade.
996  handleUOExtension(I, U, Bldr);
997  break;
998  }
999  case UO_Plus:
1000  assert(!U->isGLValue());
1001  LLVM_FALLTHROUGH;
1002  case UO_Deref:
1003  case UO_Extension: {
1004  handleUOExtension(I, U, Bldr);
1005  break;
1006  }
1007 
1008  case UO_LNot:
1009  case UO_Minus:
1010  case UO_Not: {
1011  assert (!U->isGLValue());
1012  const Expr *Ex = U->getSubExpr()->IgnoreParens();
1013  ProgramStateRef state = (*I)->getState();
1014  const LocationContext *LCtx = (*I)->getLocationContext();
1015 
1016  // Get the value of the subexpression.
1017  SVal V = state->getSVal(Ex, LCtx);
1018 
1019  if (V.isUnknownOrUndef()) {
1020  Bldr.generateNode(U, *I, state->BindExpr(U, LCtx, V));
1021  break;
1022  }
1023 
1024  switch (U->getOpcode()) {
1025  default:
1026  llvm_unreachable("Invalid Opcode.");
1027  case UO_Not:
1028  // FIXME: Do we need to handle promotions?
1029  state = state->BindExpr(U, LCtx, evalComplement(V.castAs<NonLoc>()));
1030  break;
1031  case UO_Minus:
1032  // FIXME: Do we need to handle promotions?
1033  state = state->BindExpr(U, LCtx, evalMinus(V.castAs<NonLoc>()));
1034  break;
1035  case UO_LNot:
1036  // C99 6.5.3.3: "The expression !E is equivalent to (0==E)."
1037  //
1038  // Note: technically we do "E == 0", but this is the same in the
1039  // transfer functions as "0 == E".
1040  SVal Result;
1041  if (Optional<Loc> LV = V.getAs<Loc>()) {
1042  Loc X = svalBuilder.makeNullWithType(Ex->getType());
1043  Result = evalBinOp(state, BO_EQ, *LV, X, U->getType());
1044  } else if (Ex->getType()->isFloatingType()) {
1045  // FIXME: handle floating point types.
1046  Result = UnknownVal();
1047  } else {
1049  Result = evalBinOp(state, BO_EQ, V.castAs<NonLoc>(), X,
1050  U->getType());
1051  }
1052 
1053  state = state->BindExpr(U, LCtx, Result);
1054  break;
1055  }
1056  Bldr.generateNode(U, *I, state);
1057  break;
1058  }
1059  }
1060  }
1061 
1062  getCheckerManager().runCheckersForPostStmt(Dst, EvalSet, U, *this);
1063 }
1064 
1066  ExplodedNode *Pred,
1067  ExplodedNodeSet &Dst) {
1068  // Handle ++ and -- (both pre- and post-increment).
1069  assert (U->isIncrementDecrementOp());
1070  const Expr *Ex = U->getSubExpr()->IgnoreParens();
1071 
1072  const LocationContext *LCtx = Pred->getLocationContext();
1073  ProgramStateRef state = Pred->getState();
1074  SVal loc = state->getSVal(Ex, LCtx);
1075 
1076  // Perform a load.
1077  ExplodedNodeSet Tmp;
1078  evalLoad(Tmp, U, Ex, Pred, state, loc);
1079 
1080  ExplodedNodeSet Dst2;
1081  StmtNodeBuilder Bldr(Tmp, Dst2, *currBldrCtx);
1082  for (ExplodedNodeSet::iterator I=Tmp.begin(), E=Tmp.end();I!=E;++I) {
1083 
1084  state = (*I)->getState();
1085  assert(LCtx == (*I)->getLocationContext());
1086  SVal V2_untested = state->getSVal(Ex, LCtx);
1087 
1088  // Propagate unknown and undefined values.
1089  if (V2_untested.isUnknownOrUndef()) {
1090  state = state->BindExpr(U, LCtx, V2_untested);
1091 
1092  // Perform the store, so that the uninitialized value detection happens.
1093  Bldr.takeNodes(*I);
1094  ExplodedNodeSet Dst3;
1095  evalStore(Dst3, U, Ex, *I, state, loc, V2_untested);
1096  Bldr.addNodes(Dst3);
1097 
1098  continue;
1099  }
1100  DefinedSVal V2 = V2_untested.castAs<DefinedSVal>();
1101 
1102  // Handle all other values.
1103  BinaryOperator::Opcode Op = U->isIncrementOp() ? BO_Add : BO_Sub;
1104 
1105  // If the UnaryOperator has non-location type, use its type to create the
1106  // constant value. If the UnaryOperator has location type, create the
1107  // constant with int type and pointer width.
1108  SVal RHS;
1109  SVal Result;
1110 
1111  if (U->getType()->isAnyPointerType())
1112  RHS = svalBuilder.makeArrayIndex(1);
1113  else if (U->getType()->isIntegralOrEnumerationType())
1114  RHS = svalBuilder.makeIntVal(1, U->getType());
1115  else
1116  RHS = UnknownVal();
1117 
1118  // The use of an operand of type bool with the ++ operators is deprecated
1119  // but valid until C++17. And if the operand of the ++ operator is of type
1120  // bool, it is set to true until C++17. Note that for '_Bool', it is also
1121  // set to true when it encounters ++ operator.
1122  if (U->getType()->isBooleanType() && U->isIncrementOp())
1123  Result = svalBuilder.makeTruthVal(true, U->getType());
1124  else
1125  Result = evalBinOp(state, Op, V2, RHS, U->getType());
1126 
1127  // Conjure a new symbol if necessary to recover precision.
1128  if (Result.isUnknown()){
1129  DefinedOrUnknownSVal SymVal =
1130  svalBuilder.conjureSymbolVal(nullptr, U, LCtx,
1131  currBldrCtx->blockCount());
1132  Result = SymVal;
1133 
1134  // If the value is a location, ++/-- should always preserve
1135  // non-nullness. Check if the original value was non-null, and if so
1136  // propagate that constraint.
1137  if (Loc::isLocType(U->getType())) {
1138  DefinedOrUnknownSVal Constraint =
1139  svalBuilder.evalEQ(state, V2,svalBuilder.makeZeroVal(U->getType()));
1140 
1141  if (!state->assume(Constraint, true)) {
1142  // It isn't feasible for the original value to be null.
1143  // Propagate this constraint.
1144  Constraint = svalBuilder.evalEQ(state, SymVal,
1145  svalBuilder.makeZeroVal(U->getType()));
1146 
1147  state = state->assume(Constraint, false);
1148  assert(state);
1149  }
1150  }
1151  }
1152 
1153  // Since the lvalue-to-rvalue conversion is explicit in the AST,
1154  // we bind an l-value if the operator is prefix and an lvalue (in C++).
1155  if (U->isGLValue())
1156  state = state->BindExpr(U, LCtx, loc);
1157  else
1158  state = state->BindExpr(U, LCtx, U->isPostfix() ? V2 : Result);
1159 
1160  // Perform the store.
1161  Bldr.takeNodes(*I);
1162  ExplodedNodeSet Dst3;
1163  evalStore(Dst3, U, Ex, *I, state, loc, Result);
1164  Bldr.addNodes(Dst3);
1165  }
1166  Dst.insert(Dst2);
1167 }
clang::BuiltinType
This class is used for builtin types like 'int'.
Definition: Type.h:2493
clang::CFGBlock::getTerminator
CFGTerminator getTerminator() const
Definition: CFG.h:1048
clang::ento::StmtNodeBuilder::generateSink
ExplodedNode * generateSink(const Stmt *S, ExplodedNode *Pred, ProgramStateRef St, const ProgramPointTag *tag=nullptr, ProgramPoint::Kind K=ProgramPoint::PostStmtKind)
Definition: CoreEngine.h:418
clang::ProgramPoint::PostLValueKind
@ PostLValueKind
Definition: ProgramPoint.h:73
clang::ento::ExplodedNode::pred_begin
pred_iterator pred_begin()
Definition: ExplodedGraph.h:239
clang::ento::Loc::isLocType
static bool isLocType(QualType T)
Definition: SVals.h:336
clang::Type::isRecordType
bool isRecordType() const
Definition: Type.h:6762
clang::BinaryOperator::isAssignmentOp
static bool isAssignmentOp(Opcode Opc)
Definition: Expr.h:3938
clang::ento::BasicValueFactory::getEmptySValList
llvm::ImmutableList< SVal > getEmptySValList()
Definition: BasicValueFactory.h:251
clang::OffsetOfExpr
OffsetOfExpr - [C99 7.17] - This represents an expression of the form offsetof(record-type,...
Definition: Expr.h:2438
clang::ento::ExplodedNode::getLocationContext
const LocationContext * getLocationContext() const
Definition: ExplodedGraph.h:146
clang::LocationContext
It wraps the AnalysisDeclContext to represent both the call stack with the help of StackFrameContext ...
Definition: AnalysisDeclContext.h:215
clang::CFGBlock::empty
bool empty() const
Definition: CFG.h:918
clang::ento::SVal::castAs
T castAs() const
Convert to the specified SVal type, asserting that this SVal is of the desired type.
Definition: SVals.h:103
clang::ento::SVal::isConstant
bool isConstant() const
Definition: SVals.cpp:259
clang::ento::SVal::isUndef
bool isUndef() const
Definition: SVals.h:140
clang::ento::NonLoc
Definition: SVals.h:305
clang::ento::ExplodedNodeSet::iterator
ImplTy::iterator iterator
Definition: ExplodedGraph.h:479
clang::CFGBlock::succ_size
unsigned succ_size() const
Definition: CFG.h:973
clang::InitListExpr::rbegin
reverse_iterator rbegin()
Definition: Expr.h:4995
clang::CFGBlock::succ_begin
succ_iterator succ_begin()
Definition: CFG.h:955
clang::ento::DefinedOrUnknownSVal
Definition: SVals.h:236
clang::ento::ExprEngine::getContext
ASTContext & getContext() const
getContext - Return the ASTContext associated with this analysis.
Definition: ExprEngine.h:206
clang::ento::ExprEngine::handleUOExtension
void handleUOExtension(ExplodedNodeSet::iterator I, const UnaryOperator *U, StmtNodeBuilder &Bldr)
Definition: ExprEngineC.cpp:912
clang::InitListExpr::const_reverse_iterator
InitExprsTy::const_reverse_iterator const_reverse_iterator
Definition: Expr.h:4989
clang::QualType
A (possibly-)qualified type.
Definition: Type.h:673
clang::ento::SVal::isZeroConstant
bool isZeroConstant() const
Definition: SVals.cpp:271
clang::ento::ExplodedNode
Definition: ExplodedGraph.h:65
clang::Type::isFloatingType
bool isFloatingType() const
Definition: Type.cpp:2104
DeclCXX.h
clang::ento::ExprEngine::VisitUnaryOperator
void VisitUnaryOperator(const UnaryOperator *B, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitUnaryOperator - Transfer function logic for unary operators.
Definition: ExprEngineC.cpp:929
clang::ento::ExprEngine::evalComplement
SVal evalComplement(SVal X)
Definition: ExprEngine.h:596
clang::InitListExpr
Describes an C or C++ initializer list.
Definition: Expr.h:4786
llvm::Optional
Definition: LLVM.h:40
clang::ento::SValBuilder::makeZeroVal
DefinedOrUnknownSVal makeZeroVal(QualType type)
Construct an SVal representing '0' for the specified type.
Definition: SValBuilder.cpp:62
clang::Type::isVariableArrayType
bool isVariableArrayType() const
Definition: Type.h:6750
clang::UnaryOperator
UnaryOperator - This represents the unary-expression's (except sizeof and alignof),...
Definition: Expr.h:2157
Expression
clang::ento::nonloc::ConcreteInt
Value representing integer constant.
Definition: SVals.h:386
clang::tooling::X
static ToolExecutorPluginRegistry::Add< AllTUsToolExecutorPlugin > X("all-TUs", "Runs FrontendActions on all TUs in the compilation database. " "Tool results are stored in memory.")
clang::ento::StoreManager::evalDerivedToBase
SVal evalDerivedToBase(SVal Derived, const CastExpr *Cast)
Evaluates a chain of derived-to-base casts through the path specified in Cast.
Definition: Store.cpp:250
clang::ento::UnknownVal
Definition: SVals.h:257
clang::ento::StmtNodeBuilder
Definition: CoreEngine.h:379
clang::BinaryOperator::getOpcode
Opcode getOpcode() const
Definition: Expr.h:3847
clang::Type::isRValueReferenceType
bool isRValueReferenceType() const
Definition: Type.h:6692
clang::ento::loc::MemRegionVal
Definition: SVals.h:606
clang::InitListExpr::isTransparent
bool isTransparent() const
Is this a transparent initializer list (that is, an InitListExpr that is purely syntactic,...
Definition: Expr.cpp:2306
clang::Expr::isGLValue
bool isGLValue() const
Definition: Expr.h:273
clang::OpaqueValueExpr
OpaqueValueExpr - An expression referring to an opaque object of a fixed type and value class.
Definition: Expr.h:1129
clang::ento::ExprEngine::evalBinOp
SVal evalBinOp(ProgramStateRef state, BinaryOperator::Opcode op, NonLoc L, NonLoc R, QualType T)
Definition: ExprEngine.h:617
getValue
static SVal getValue(SVal val, SValBuilder &svalBuilder)
Definition: ArrayBoundCheckerV2.cpp:277
clang::ento::ExprEngine::evalLoad
void evalLoad(ExplodedNodeSet &Dst, const Expr *NodeEx, const Expr *BoundExpr, ExplodedNode *Pred, ProgramStateRef St, SVal location, const ProgramPointTag *tag=nullptr, QualType LoadTy=QualType())
Simulate a read of the result of Ex.
Definition: ExprEngine.cpp:2959
clang::ObjCObjectType
Represents a class type in Objective C.
Definition: Type.h:5816
clang::BlockEdge::getSrc
const CFGBlock * getSrc() const
Definition: ProgramPoint.h:511
clang::CFGTerminator::getStmt
Stmt * getStmt()
Definition: CFG.h:535
clang::CFGBlock
Represents a single basic block in a source-level CFG.
Definition: CFG.h:576
APSInt
llvm::APSInt APSInt
Definition: ByteCodeEmitter.cpp:19
U
clang::ento::NodeBuilder::takeNodes
void takeNodes(const ExplodedNodeSet &S)
Definition: CoreEngine.h:330
clang::Type::isReferenceType
bool isReferenceType() const
Definition: Type.h:6684
V
#define V(N, I)
Definition: ASTContext.h:3121
clang::BlockDecl::capture_begin
capture_const_iterator capture_begin() const
Definition: Decl.h:4282
clang::ento::ExplodedNode::getState
const ProgramStateRef & getState() const
Definition: ExplodedGraph.h:169
clang::ento::DefinedSVal
Definition: SVals.h:269
clang::UnaryExprOrTypeTraitExpr
UnaryExprOrTypeTraitExpr - expression with either a type or (unevaluated) expression operand.
Definition: Expr.h:2543
clang::ento::ExprEngine::evalStore
void evalStore(ExplodedNodeSet &Dst, const Expr *AssignE, const Expr *StoreE, ExplodedNode *Pred, ProgramStateRef St, SVal TargetLV, SVal Val, const ProgramPointTag *tag=nullptr)
evalStore - Handle the semantics of a store via an assignment.
Definition: ExprEngine.cpp:2936
clang::BlockDecl
Represents a block literal declaration, which is like an unnamed FunctionDecl.
Definition: Decl.h:4153
clang::BinaryOperator
A builtin binary operation expression such as "x + y" or "x <= y".
Definition: Expr.h:3803
clang::ento::BlockDataRegion::referenced_vars_iterator
Definition: MemRegion.h:694
clang::CharUnits::fromQuantity
static CharUnits fromQuantity(QuantityType Quantity)
fromQuantity - Construct a CharUnits quantity from a raw integer type.
Definition: CharUnits.h:63
CheckerManager.h
clang::BlockExpr::getBlockDecl
const BlockDecl * getBlockDecl() const
Definition: Expr.h:5977
clang::ProgramPoint::getAs
Optional< T > getAs() const
Convert to the specified ProgramPoint type, returning None if this ProgramPoint is not of the desired...
Definition: ProgramPoint.h:151
clang::ento::SValBuilder::makeNullWithType
Loc makeNullWithType(QualType type)
Create NULL pointer, with proper pointer bit-width for given address space.
Definition: SValBuilder.h:368
clang::Type::getAs
const T * getAs() const
Member-template getAs<specific type>'.
Definition: Type.h:7161
clang::ASTContext::getRValueReferenceType
QualType getRValueReferenceType(QualType T) const
Return the uniqued reference to the type for an rvalue reference to the specified type.
Definition: ASTContext.cpp:3408
clang::ento::nonloc::PointerToMember
Value representing pointer-to-member.
Definition: SVals.h:532
clang::Type::isVectorType
bool isVectorType() const
Definition: Type.h:6774
clang::ento::BlockDataRegion::referenced_vars_iterator::getOriginalRegion
const VarRegion * getOriginalRegion() const
Definition: MemRegion.h:707
clang::ento::ExprEngine::getObjectUnderConstruction
static Optional< SVal > getObjectUnderConstruction(ProgramStateRef State, const ConstructionContextItem &Item, const LocationContext *LC)
By looking at a certain item that may be potentially part of an object's ConstructionContext,...
Definition: ExprEngine.cpp:474
clang::Type::isLValueReferenceType
bool isLValueReferenceType() const
Definition: Type.h:6688
clang::ento::NodeBuilder::getResults
const ExplodedNodeSet & getResults()
Definition: CoreEngine.h:307
clang::ento::ExplodedNodeSet::end
iterator end()
Definition: ExplodedGraph.h:497
clang::ento::BlockDataRegion
BlockDataRegion - A region that represents a block instance.
Definition: MemRegion.h:663
clang::ento::VarRegion
Definition: MemRegion.h:906
clang::ProgramPoint::castAs
T castAs() const
Convert to the specified ProgramPoint type, asserting that this ProgramPoint is of the desired type.
Definition: ProgramPoint.h:140
clang::CastExpr::path
llvm::iterator_range< path_iterator > path()
Definition: Expr.h:3549
clang::Expr::EvalResult
EvalResult is a struct with detailed info about an evaluated expression.
Definition: Expr.h:606
clang::ento::BasicValueFactory::prependSVal
llvm::ImmutableList< SVal > prependSVal(SVal X, llvm::ImmutableList< SVal > L)
Definition: BasicValueFactory.h:255
clang::ento::ExprEngine::VisitCompoundLiteralExpr
void VisitCompoundLiteralExpr(const CompoundLiteralExpr *CL, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitCompoundLiteralExpr - Transfer function logic for compound literals.
Definition: ExprEngineC.cpp:542
clang::interp::Zero
bool Zero(InterpState &S, CodePtr OpPC)
Definition: Interp.h:814
clang::VarDecl
Represents a variable declaration or definition.
Definition: Decl.h:876
clang::ento::ExprEngine::VisitIncrementDecrementOperator
void VisitIncrementDecrementOperator(const UnaryOperator *U, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Handle ++ and – (both pre- and post-increment).
Definition: ExprEngineC.cpp:1065
clang::ASTContext::getCanonicalType
CanQualType getCanonicalType(QualType T) const
Return the canonical (structural) type corresponding to the specified potentially non-canonical type ...
Definition: ASTContext.h:2468
clang::Expr::EvaluateKnownConstInt
llvm::APSInt EvaluateKnownConstInt(const ASTContext &Ctx, SmallVectorImpl< PartialDiagnosticAt > *Diag=nullptr) const
EvaluateKnownConstInt - Call EvaluateAsRValue and return the folded integer.
Definition: ExprConstant.cpp:14958
clang::ento::SValBuilder::makePointerToMember
NonLoc makePointerToMember(const DeclaratorDecl *DD)
Definition: SValBuilder.h:283
clang::BlockEdge::getDst
const CFGBlock * getDst() const
Definition: ProgramPoint.h:515
clang::ento::ExprEngine::VisitUnaryExprOrTypeTraitExpr
void VisitUnaryExprOrTypeTraitExpr(const UnaryExprOrTypeTraitExpr *Ex, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitUnaryExprOrTypeTraitExpr - Transfer function for sizeof.
Definition: ExprEngineC.cpp:870
clang::Type::isAnyComplexType
bool isAnyComplexType() const
Definition: Type.h:6770
clang::ento::NodeBuilderContext::blockCount
unsigned blockCount() const
Returns the number of times the current basic block has been visited on the exploded graph path.
Definition: CoreEngine.h:221
clang::CanQual< Type >
ExprCXX.h
conjureOffsetSymbolOnLocation
static SVal conjureOffsetSymbolOnLocation(SVal Symbol, SVal Other, Expr *Expression, SValBuilder &svalBuilder, unsigned Count, const LocationContext *LCtx)
Optionally conjure and return a symbol for offset when processing an expression Expression.
Definition: ExprEngineC.cpp:28
clang::CFGBlock::rbegin
reverse_iterator rbegin()
Definition: CFG.h:880
clang::CFGTerminator
Represents CFGBlock terminator statement.
Definition: CFG.h:503
clang::CastExpr::getCastKind
CastKind getCastKind() const
Definition: Expr.h:3518
state
and static some checkers Checker The latter are built on top of the former via the Checker and CheckerVisitor and attempts to isolate them from much of the gore of the internal analysis the analyzer is basically a source code simulator that traces out possible paths of execution The state of the and the combination of state and program point is a node in an exploded which has the entry program point and initial state
Definition: README.txt:30
clang::ento::Loc
Definition: SVals.h:327
clang::ento::ExplodedNode::pred_size
unsigned pred_size() const
Definition: ExplodedGraph.h:200
clang::Type::castAs
const T * castAs() const
Member-template castAs<specific type>.
Definition: Type.h:7226
clang::CompoundLiteralExpr
CompoundLiteralExpr - [C99 6.5.2.5].
Definition: Expr.h:3403
clang::BlockEntrance
Definition: ProgramPoint.h:225
clang::ento::ExprEngine::VisitBlockExpr
void VisitBlockExpr(const BlockExpr *BE, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitBlockExpr - Transfer function logic for BlockExprs.
Definition: ExprEngineC.cpp:196
P
StringRef P
Definition: ASTMatchersInternal.cpp:563
clang::ento::SValBuilder::makeCompoundVal
NonLoc makeCompoundVal(QualType type, llvm::ImmutableList< SVal > vals)
Definition: SValBuilder.h:273
clang::ento::ExprEngine::VisitInitListExpr
void VisitInitListExpr(const InitListExpr *E, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Definition: ExprEngineC.cpp:737
clang::DeclStmt::isSingleDecl
bool isSingleDecl() const
isSingleDecl - This method returns true if this DeclStmt refers to a single Decl.
Definition: Stmt.h:1305
clang::ento::PSK_EscapeOther
@ PSK_EscapeOther
The reason for pointer escape is unknown.
Definition: CheckerManager.h:99
clang::PreStmt
Definition: ProgramPoint.h:295
clang::CFGStmt
Definition: CFG.h:132
clang::CFGElement::castAs
T castAs() const
Convert to the specified CFGElement type, asserting that this CFGElement is of the desired type.
Definition: CFG.h:98
clang::ento::SValBuilder::evalCast
SVal evalCast(SVal V, QualType CastTy, QualType OriginalTy)
Cast a given SVal to another SVal using given QualType's.
Definition: SValBuilder.cpp:579
clang::ValueDecl
Represent the declaration of a variable (in which case it is an lvalue) a function (in which case it ...
Definition: Decl.h:676
clang::ento::ExprEngine::handleLValueBitCast
ProgramStateRef handleLValueBitCast(ProgramStateRef state, const Expr *Ex, const LocationContext *LCtx, QualType T, QualType ExTy, const CastExpr *CastE, StmtNodeBuilder &Bldr, ExplodedNode *Pred)
Definition: ExprEngineC.cpp:259
clang::BinaryOperator::getLHS
Expr * getLHS() const
Definition: Expr.h:3852
clang::ento::SValBuilder::makeNull
Loc makeNull()
Definition: SValBuilder.h:372
clang::ento::ExprEngine::evalMinus
SVal evalMinus(SVal X)
Definition: ExprEngine.h:592
clang::ento::ExprEngine::VisitCast
void VisitCast(const CastExpr *CastE, const Expr *Ex, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitCast - Transfer function logic for all casts (implicit and explicit).
Definition: ExprEngineC.cpp:285
clang::BlockExpr
BlockExpr - Adaptor class for mixing a BlockDecl with expressions.
Definition: Expr.h:5965
clang::ento::CheckerManager::runCheckersForPostStmt
void runCheckersForPostStmt(ExplodedNodeSet &Dst, const ExplodedNodeSet &Src, const Stmt *S, ExprEngine &Eng, bool wasInlined=false)
Run checkers for post-visiting Stmts.
Definition: CheckerManager.h:262
Value
Value
Definition: UninitializedValues.cpp:102
clang::ento::SValBuilder::makeIntVal
nonloc::ConcreteInt makeIntVal(const IntegerLiteral *integer)
Definition: SValBuilder.h:301
clang::UnaryExprOrTypeTraitExpr::getTypeOfArgument
QualType getTypeOfArgument() const
Gets the argument type, or the type of the argument expression, whichever is appropriate.
Definition: Expr.h:2612
clang::Type::isConstantSizeType
bool isConstantSizeType() const
Return true if this is not a variable sized type, according to the rules of C99 6....
Definition: Type.cpp:2207
clang::CFGStmt::getStmt
const Stmt * getStmt() const
Definition: CFG.h:138
State
LineState State
Definition: UnwrappedLineFormatter.cpp:986
clang::ento::ExprEngine::VisitOffsetOfExpr
void VisitOffsetOfExpr(const OffsetOfExpr *Ex, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitOffsetOfExpr - Transfer function for offsetof.
Definition: ExprEngineC.cpp:851
clang::Type::isSignedIntegerType
bool isSignedIntegerType() const
Return true if this is an integer type that is signed, according to C99 6.2.5p4 [char,...
Definition: Type.cpp:2013
clang::ento::ExprEngine::getSValBuilder
SValBuilder & getSValBuilder()
Definition: ExprEngine.h:218
clang::BinaryOperatorKind
BinaryOperatorKind
Definition: OperationKinds.h:25
clang::VarDecl::getInit
const Expr * getInit() const
Definition: Decl.h:1285
clang::Expr::EvaluateAsInt
bool EvaluateAsInt(EvalResult &Result, const ASTContext &Ctx, SideEffectsKind AllowSideEffects=SE_NoSideEffects, bool InConstantContext=false) const
EvaluateAsInt - Return true if this is a constant which we can fold and convert to an integer,...
Definition: ExprConstant.cpp:14735
clang::ento::SValBuilder::getBlockPointer
DefinedSVal getBlockPointer(const BlockDecl *block, CanQualType locTy, const LocationContext *locContext, unsigned blockCount)
Definition: SValBuilder.cpp:276
clang::ento::ExplodedNodeSet::begin
iterator begin()
Definition: ExplodedGraph.h:496
clang::CFGElement
Represents a top-level expression in a basic block.
Definition: CFG.h:55
clang::ASTContext::getLValueReferenceType
QualType getLValueReferenceType(QualType T, bool SpelledAsLValue=true) const
Return the uniqued reference to the type for an lvalue reference to the specified type.
Definition: ASTContext.cpp:3369
clang::DeclStmt
DeclStmt - Adaptor class for mixing declarations with statements and expressions.
Definition: Stmt.h:1292
clang::ento::SValBuilder::makeTruthVal
nonloc::ConcreteInt makeTruthVal(bool b, QualType type)
Definition: SValBuilder.h:357
ExprEngine.h
clang::BinaryOperator::isCompoundAssignmentOp
static bool isCompoundAssignmentOp(Opcode Opc)
Definition: Expr.h:3943
clang::ento::ExprEngine::getStoreManager
StoreManager & getStoreManager()
Definition: ExprEngine.h:417
clang::UnaryExprOrTypeTraitExpr::getKind
UnaryExprOrTypeTrait getKind() const
Definition: Expr.h:2575
clang::ento::ExprEngine::VisitDeclStmt
void VisitDeclStmt(const DeclStmt *DS, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitDeclStmt - Transfer function logic for DeclStmts.
Definition: ExprEngineC.cpp:567
clang::CompoundLiteralExpr::getInitializer
const Expr * getInitializer() const
Definition: Expr.h:3426
clang::DeclStmt::decl_begin
decl_iterator decl_begin()
Definition: Stmt.h:1346
clang::Expr::IgnoreParens
Expr * IgnoreParens() LLVM_READONLY
Skip past any parentheses which might surround this expression until reaching a fixed point.
Definition: Expr.cpp:2915
clang
Definition: CalledOnceCheck.h:17
clang::BuiltinType::isInteger
bool isInteger() const
Definition: Type.h:2541
clang::Type::isArrayType
bool isArrayType() const
Definition: Type.h:6738
clang::ento::ExplodedNode::getLocation
ProgramPoint getLocation() const
getLocation - Returns the edge associated with the given node.
Definition: ExplodedGraph.h:144
clang::ento::StoreManager::attemptDownCast
SVal attemptDownCast(SVal Base, QualType DerivedPtrType, bool &Failed)
Attempts to do a down cast.
Definition: Store.cpp:316
clang::ento::SVal::isUnknownOrUndef
bool isUnknownOrUndef() const
Definition: SVals.h:144
clang::BinaryOperator::getRHS
Expr * getRHS() const
Definition: Expr.h:3854
clang::ento::SValBuilder::evalIntegralCast
SVal evalIntegralCast(ProgramStateRef state, SVal val, QualType castTy, QualType originalType)
Definition: SValBuilder.cpp:527
clang::ento::ExplodedNodeSet::insert
void insert(const ExplodedNodeSet &S)
Definition: ExplodedGraph.h:488
clang::ento::SVal::isUnknown
bool isUnknown() const
Definition: SVals.h:136
clang::Expr::getType
QualType getType() const
Definition: Expr.h:141
clang::BlockDecl::capture_end
capture_const_iterator capture_end() const
Definition: Decl.h:4283
clang::ento::ExprEngine::VisitGuardedExpr
void VisitGuardedExpr(const Expr *Ex, const Expr *L, const Expr *R, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitGuardedExpr - Transfer function logic for ?, __builtin_choose.
Definition: ExprEngineC.cpp:786
clang::ento::SValBuilder::makeArrayIndex
NonLoc makeArrayIndex(uint64_t idx)
Definition: SValBuilder.h:295
clang::BlockEdge
Definition: ProgramPoint.h:503
clang::ASTContext::getPointerType
QualType getPointerType(QualType T) const
Return the uniqued reference to the type for a pointer to the specified type.
Definition: ASTContext.cpp:3249
clang::InitListExpr::getInit
const Expr * getInit(unsigned Init) const
Definition: Expr.h:4834
clang::ento::SVal
SVal - This represents a symbolic expression, which can be either an L-value or an R-value.
Definition: SVals.h:75
clang::CharUnits
CharUnits - This is an opaque type for sizes expressed in character units.
Definition: CharUnits.h:38
clang::ento::NodeBuilder::addNodes
void addNodes(const ExplodedNodeSet &S)
Definition: CoreEngine.h:336
clang::ento::TypedValueRegion
TypedValueRegion - An abstract class representing regions having a typed value.
Definition: MemRegion.h:522
clang::BinaryOperator::isAdditiveOp
static bool isAdditiveOp(Opcode Opc)
Definition: Expr.h:3888
clang::ento::SValBuilder::evalEQ
SVal evalEQ(ProgramStateRef state, SVal lhs, SVal rhs)
Definition: SValBuilder.cpp:480
clang::Expr
This represents one expression.
Definition: Expr.h:109
clang::InitListExpr::rend
reverse_iterator rend()
Definition: Expr.h:4997
clang::ento::CheckerManager::runCheckersForPreStmt
void runCheckersForPreStmt(ExplodedNodeSet &Dst, const ExplodedNodeSet &Src, const Stmt *S, ExprEngine &Eng)
Run checkers for pre-visiting Stmts.
Definition: CheckerManager.h:249
clang::ento::SValBuilder::conjureSymbolVal
DefinedOrUnknownSVal conjureSymbolVal(const void *symbolTag, const Expr *expr, const LocationContext *LCtx, unsigned count)
Create a new symbol with a unique 'name'.
clang::ento::SValBuilder::getMemberPointer
DefinedSVal getMemberPointer(const NamedDecl *ND)
Definition: SValBuilder.cpp:256
clang::Type::isIncompleteType
bool isIncompleteType(NamedDecl **Def=nullptr) const
Types are partitioned into 3 broad categories (C99 6.2.5p1): object types, function types,...
Definition: Type.cpp:2217
clang::CastExpr
CastExpr - Base class for type casts, including both implicit casts (ImplicitCastExpr) and explicit c...
Definition: Expr.h:3473
clang::ento::ExprEngine::getBasicVals
BasicValueFactory & getBasicVals()
Definition: ExprEngine.h:424
clang::DeclRefExpr
A reference to a declared variable, function, enum, etc.
Definition: Expr.h:1217
clang::ento::StmtNodeBuilder::generateNode
ExplodedNode * generateNode(const Stmt *S, ExplodedNode *Pred, ProgramStateRef St, const ProgramPointTag *tag=nullptr, ProgramPoint::Kind K=ProgramPoint::PostStmtKind)
Definition: CoreEngine.h:408
clang::ento::ExplodedNodeSet
Definition: ExplodedGraph.h:463
clang::ProgramPoint
Definition: ProgramPoint.h:59
clang::InitListExpr::getNumInits
unsigned getNumInits() const
Definition: Expr.h:4816
clang::ento::VarRegion::getDecl
const VarDecl * getDecl() const override=0
clang::CharUnits::getQuantity
QuantityType getQuantity() const
getQuantity - Get the raw integer representation of this quantity.
Definition: CharUnits.h:179
llvm::IntrusiveRefCntPtr< const ProgramState >
clang::ExplicitCastExpr
ExplicitCastExpr - An explicit cast written in the source code.
Definition: Expr.h:3695
clang::Type::isIntegralOrEnumerationType
bool isIntegralOrEnumerationType() const
Determine whether this type is an integral or enumeration type.
Definition: Type.h:7058
clang::ento::BlockDataRegion::referenced_vars_iterator::getCapturedRegion
const VarRegion * getCapturedRegion() const
Definition: MemRegion.h:703
clang::PreStmtPurgeDeadSymbols
Represents a point after we ran remove dead bindings BEFORE processing the given statement.
Definition: ProgramPoint.h:473
clang::ento::ExprEngine::VisitBinaryOperator
void VisitBinaryOperator(const BinaryOperator *B, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitBinaryOperator - Transfer function logic for binary operators.
Definition: ExprEngineC.cpp:40
clang::ento::ExprEngine::getCheckerManager
CheckerManager & getCheckerManager() const
Definition: ExprEngine.h:214
clang::ento::ExprEngine::VisitLogicalExpr
void VisitLogicalExpr(const BinaryOperator *B, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitLogicalExpr - Transfer function logic for '&&', '||'.
Definition: ExprEngineC.cpp:643