18 using namespace clang;
29 SVal Symbol, SVal Other,
Expr* Expression, SValBuilder &svalBuilder,
32 if (Other.getAs<Loc>() &&
35 return svalBuilder.conjureSymbolVal(Expression, LCtx, Ty, Count);
58 SVal LeftV = state->getSVal(LHS, LCtx);
59 SVal RightV = state->getSVal(RHS, LCtx);
63 if (Op == BO_Assign) {
74 evalStore(Tmp2, B, LHS, *it, state->BindExpr(B, LCtx, ExprVal),
87 RightV, LeftV, RHS, svalBuilder, Count, LCtx);
89 LeftV, RightV, LHS, svalBuilder, Count, LCtx);
96 state = createTemporaryRegionIfNeeded(state, LCtx, LHS);
102 state = state->BindExpr(B, LCtx, Result);
113 llvm_unreachable(
"Invalid opcode for compound assignment.");
114 case BO_MulAssign: Op = BO_Mul;
break;
115 case BO_DivAssign: Op = BO_Div;
break;
116 case BO_RemAssign: Op = BO_Rem;
break;
117 case BO_AddAssign: Op = BO_Add;
break;
118 case BO_SubAssign: Op = BO_Sub;
break;
119 case BO_ShlAssign: Op = BO_Shl;
break;
120 case BO_ShrAssign: Op = BO_Shr;
break;
121 case BO_AndAssign: Op = BO_And;
break;
122 case BO_XorAssign: Op = BO_Xor;
break;
123 case BO_OrAssign: Op = BO_Or;
break;
129 SVal location = LeftV;
130 evalLoad(Tmp, B, LHS, *it, state, location);
135 state = (*I)->getState();
137 SVal V = state->getSVal(LHS, LCtx);
141 cast<CompoundAssignOperator>(B)->getComputationResultType();
145 cast<CompoundAssignOperator>(B)->getComputationLHSType();
151 V = svalBuilder.
evalCast(V, CLHSTy, LTy);
169 Result = svalBuilder.
evalCast(LHSVal, CTy, LTy);
174 LHSVal = svalBuilder.
evalCast(Result, LTy, CTy);
180 state = state->BindExpr(B, LCtx, location);
182 state = state->BindExpr(B, LCtx, Result);
184 evalStore(Tmp2, B, LHS, *I, state, location, LHSVal);
208 dyn_cast_or_null<BlockDataRegion>(V.
getAsRegion())) {
211 E = BDR->referenced_vars_end();
215 for (; I != E; ++I) {
225 const Expr *copyExpr =
nullptr;
227 assert(CI->getVariable() == capturedR->
getDecl());
228 copyExpr = CI->getCopyExpr();
232 if (capturedR != originalR) {
236 originalV = State->getSVal(copyExpr, LCtx);
267 SVal OrigV = state->getSVal(Ex, LCtx);
270 if (CastE->
getCastKind() == CK_BooleanToSignedIntegral)
272 state = state->BindExpr(CastE, LCtx, V);
291 state = state->BindExpr(CastE, LCtx, result);
309 evalLoad(Dst, CastE, CastE, subExprNode, state, state->getSVal(Ex, LCtx));
318 if (
const ExplicitCastExpr *ExCast=dyn_cast_or_null<ExplicitCastExpr>(CastE))
319 T = ExCast->getTypeAsWritten();
330 case CK_LValueToRValue:
331 llvm_unreachable(
"LValueToRValue casts handled earlier.");
336 case CK_ARCProduceObject:
337 case CK_ARCConsumeObject:
338 case CK_ARCReclaimReturnedObject:
339 case CK_ARCExtendBlockObject:
340 case CK_CopyAndAutoreleaseBlockObject:
344 case CK_AtomicToNonAtomic:
345 case CK_NonAtomicToAtomic:
348 case CK_ConstructorConversion:
349 case CK_UserDefinedConversion:
350 case CK_FunctionToPointerDecay:
351 case CK_BuiltinFnToFnPtr: {
355 SVal V = state->getSVal(Ex, LCtx);
356 state = state->BindExpr(CastE, LCtx, V);
360 case CK_MemberPointerToBoolean:
361 case CK_PointerToBoolean: {
362 SVal V = state->getSVal(Ex, LCtx);
365 V = svalBuilder.
makeTruthVal(!PTMSV->isNullMemberPointer(), ExTy);
367 state = state->BindExpr(CastE, LCtx, V);
377 case CK_ArrayToPointerDecay:
379 case CK_AddressSpaceConversion:
380 case CK_BooleanToSignedIntegral:
381 case CK_NullToPointer:
382 case CK_IntegralToPointer:
383 case CK_PointerToIntegral: {
384 SVal V = state->getSVal(Ex, LCtx);
386 state = state->BindExpr(CastE, LCtx,
UnknownVal());
395 case CK_IntegralToBoolean:
396 case CK_IntegralToFloating:
397 case CK_FloatingToIntegral:
398 case CK_FloatingToBoolean:
399 case CK_FloatingCast:
400 case CK_FloatingRealToComplex:
401 case CK_FloatingComplexToReal:
402 case CK_FloatingComplexToBoolean:
403 case CK_FloatingComplexCast:
404 case CK_FloatingComplexToIntegralComplex:
405 case CK_IntegralRealToComplex:
406 case CK_IntegralComplexToReal:
407 case CK_IntegralComplexToBoolean:
408 case CK_IntegralComplexCast:
409 case CK_IntegralComplexToFloatingComplex:
410 case CK_CPointerToObjCPointerCast:
411 case CK_BlockPointerToObjCPointerCast:
412 case CK_AnyPointerToBlockPointerCast:
413 case CK_ObjCObjectLValueCast:
414 case CK_ZeroToOCLOpaqueType:
415 case CK_IntToOCLSampler:
416 case CK_LValueBitCast:
417 case CK_FixedPointCast:
418 case CK_FixedPointToBoolean: {
423 case CK_IntegralCast: {
425 SVal V = state->getSVal(Ex, LCtx);
427 state = state->BindExpr(CastE, LCtx, V);
431 case CK_DerivedToBase:
432 case CK_UncheckedDerivedToBase: {
434 SVal val = state->getSVal(Ex, LCtx);
436 state = state->BindExpr(CastE, LCtx, val);
442 SVal val = state->getSVal(Ex, LCtx);
466 state = state->BindExpr(CastE, LCtx, svalBuilder.
makeNull());
474 state = state->BindExpr(CastE, LCtx, NewSym);
477 state = state->BindExpr(CastE, LCtx, val);
482 case CK_BaseToDerived: {
483 SVal val = state->getSVal(Ex, LCtx);
500 state = state->BindExpr(CastE, LCtx, val);
504 case CK_NullToMemberPointer: {
506 state = state->BindExpr(CastE, LCtx, V);
510 case CK_DerivedToBaseMemberPointer:
511 case CK_BaseToDerivedMemberPointer:
512 case CK_ReinterpretMemberPointer: {
513 SVal V = state->getSVal(Ex, LCtx);
517 llvm::make_range<CastExpr::path_const_iterator>(
519 state = state->BindExpr(CastE, LCtx, CastedPTMSV);
529 case CK_VectorSplat: {
548 if (isa<CXXConstructExpr>(Init) || isa<CXXStdInitializerListExpr>(Init)) {
551 assert(isa<InitListExpr>(Init));
552 Loc CLLoc = State->getLValue(CL, LCtx);
553 State = State->bindLoc(CLLoc, V, LCtx);
590 SVal InitVal = state->getSVal(InitEx, LC);
594 state = finishObjectConstruction(state, DS, LC);
603 if (InitEx->isGLValue()) {
614 evalBind(Dst2, DS, UpdatedN, state->getLValue(VD, LC), InitVal,
true);
640 Bldr.generateNode(B, Pred, state);
665 assert(Term->isLogicalOp());
675 assert(!SrcBlock->
empty());
677 const Expr *RHS = cast<Expr>(Elem.getStmt());
680 if (RHSVal.isUndef()) {
712 if (NumInitElements == 0) {
719 ei = IE->
rend(); it != ei; ++it) {
720 SVal V = state->getSVal(cast<Expr>(*it), LCtx);
725 state->BindExpr(IE, LCtx,
733 assert(NumInitElements <= 1);
736 if (NumInitElements == 0)
739 V = state->getSVal(IE->
getInit(0), LCtx);
769 SrcState = N->getState();
773 assert(SrcBlock &&
"missing function entry");
777 bool hasValue =
false;
780 for (
CFGElement CE : llvm::reverse(*SrcBlock)) {
782 const Expr *ValEx = cast<Expr>(CS->getStmt());
788 L = OpaqueEx->getSourceExpr();
794 V = SrcState->getSVal(ValEx, LCtx);
805 B.
generateNode(Ex, Pred, state->BindExpr(Ex, LCtx, V,
true));
862 state = state->BindExpr(Ex, (*I)->getLocationContext(),
885 state->getSVal(Ex, LCtx)));
921 state->getSVal(Ex, LCtx)));
943 if (
const DeclRefExpr *DRE = dyn_cast<DeclRefExpr>(Ex)) {
946 if (isa<CXXMethodDecl>(VD) || isa<FieldDecl>(VD)) {
976 SVal V = state->getSVal(Ex, LCtx);
985 llvm_unreachable(
"Invalid Opcode.");
1003 }
else if (Ex->getType()->isFloatingType()) {
1012 state = state->BindExpr(U, LCtx, Result);
1033 SVal loc = state->getSVal(Ex, LCtx);
1037 evalLoad(Tmp, U, Ex, Pred, state, loc);
1043 state = (*I)->getState();
1044 assert(LCtx == (*I)->getLocationContext());
1045 SVal V2_untested = state->getSVal(Ex, LCtx);
1048 if (V2_untested.isUnknownOrUndef()) {
1049 state = state->BindExpr(U, LCtx, V2_untested);
1054 evalStore(Dst3, U, Ex, *I, state, loc, V2_untested);
1100 if (!state->assume(Constraint,
true)) {
1103 Constraint = svalBuilder.
evalEQ(state, SymVal,
1106 state = state->assume(Constraint,
false);
1115 state = state->BindExpr(U, LCtx, loc);
1117 state = state->BindExpr(U, LCtx, U->
isPostfix() ? V2 : Result);
1122 evalStore(Dst3, U, Ex, *I, state, loc, Result);
SVal attemptDownCast(SVal Base, QualType DerivedPtrType, bool &Failed)
Attempts to do a down cast.
const BlockDecl * getBlockDecl() const
nonloc::ConcreteInt makeIntVal(const IntegerLiteral *integer)
DefinedSVal getBlockPointer(const BlockDecl *block, CanQualType locTy, const LocationContext *locContext, unsigned blockCount)
reverse_iterator rbegin()
SVal evalDerivedToBase(SVal Derived, const CastExpr *Cast)
Evaluates a chain of derived-to-base casts through the path specified in Cast.
A (possibly-)qualified type.
succ_iterator succ_begin()
capture_const_iterator capture_begin() const
ImplTy::iterator iterator
const Expr * getInit(unsigned Init) const
unsigned blockCount() const
Returns the number of times the current basic block has been visited on the exploded graph path...
bool EvaluateAsInt(EvalResult &Result, const ASTContext &Ctx, SideEffectsKind AllowSideEffects=SE_NoSideEffects) const
EvaluateAsInt - Return true if this is a constant which we can fold and convert to an integer...
This builder class is useful for generating nodes that resulted from visiting a statement.
bool isRecordType() const
const CFGBlock * getSrc() const
QualType getLValueReferenceType(QualType T, bool SpelledAsLValue=true) const
Return the uniqued reference to the type for an lvalue reference to the specified type...
SVal evalBinOp(ProgramStateRef state, BinaryOperator::Opcode op, NonLoc L, NonLoc R, QualType T)
Represents a point after we ran remove dead bindings BEFORE processing the given statement.
T castAs() const
Convert to the specified CFGElement type, asserting that this CFGElement is of the desired type...
const ProgramStateRef & getState() const
SVal evalCast(SVal val, QualType castTy, QualType originalType)
Value representing integer constant.
capture_const_iterator capture_end() const
unsigned succ_size() const
void VisitUnaryOperator(const UnaryOperator *B, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitUnaryOperator - Transfer function logic for unary operators.
void takeNodes(const ExplodedNodeSet &S)
void handleUOExtension(ExplodedNodeSet::iterator I, const UnaryOperator *U, StmtNodeBuilder &Bldr)
Represents a variable declaration or definition.
CompoundLiteralExpr - [C99 6.5.2.5].
const T * getAs() const
Member-template getAs<specific type>'.
NonLoc makeArrayIndex(uint64_t idx)
static Optional< SVal > getObjectUnderConstruction(ProgramStateRef State, const ConstructionContextItem &Item, const LocationContext *LC)
By looking at a certain item that may be potentially part of an object's ConstructionContext, retrieve such object's location.
void evalStore(ExplodedNodeSet &Dst, const Expr *AssignE, const Expr *StoreE, ExplodedNode *Pred, ProgramStateRef St, SVal TargetLV, SVal Val, const ProgramPointTag *tag=nullptr)
evalStore - Handle the semantics of a store via an assignment.
static bool isAssignmentOp(Opcode Opc)
Defines the clang::Expr interface and subclasses for C++ expressions.
bool isVariableArrayType() const
InitExprsTy::const_reverse_iterator const_reverse_iterator
Represents a class type in Objective C.
Value representing pointer-to-member.
const VarRegion * getOriginalRegion() const
SVal evalIntegralCast(ProgramStateRef state, SVal val, QualType castTy, QualType originalType)
Loc makeNullWithType(QualType type)
Create NULL pointer, with proper pointer bit-width for given address space.
static bool isIncrementDecrementOp(Opcode Op)
bool isReferenceType() const
i32 captured_struct **param SharedsTy A type which contains references the shared variables *param Shareds Context with the list of shared variables from the p *TaskFunction *param Data Additional data for task generation like final * state
bool isIntegralOrEnumerationType() const
Determine whether this type is an integral or enumeration type.
llvm::ImmutableList< SVal > prependSVal(SVal X, llvm::ImmutableList< SVal > L)
static bool isLocType(QualType T)
Describes an C or C++ initializer list.
void VisitOffsetOfExpr(const OffsetOfExpr *Ex, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitOffsetOfExpr - Transfer function for offsetof.
BlockDataRegion - A region that represents a block instance.
ExplodedNode * generateSink(const Stmt *S, ExplodedNode *Pred, ProgramStateRef St, const ProgramPointTag *tag=nullptr, ProgramPoint::Kind K=ProgramPoint::PostStmtKind)
CharUnits - This is an opaque type for sizes expressed in character units.
APValue Val
Val - This is the value the expression can be folded to.
path_iterator path_begin()
const LocationContext * getLocationContext() const
A builtin binary operation expression such as "x + y" or "x <= y".
NonLoc makePointerToMember(const DeclaratorDecl *DD)
static bool isPostfix(Opcode Op)
isPostfix - Return true if this is a postfix operation, like x++.
bool isRValueReferenceType() const
NonLoc makeCompoundVal(QualType type, llvm::ImmutableList< SVal > vals)
CastExpr - Base class for type casts, including both implicit casts (ImplicitCastExpr) and explicit c...
SVal evalComplement(SVal X)
void VisitDeclStmt(const DeclStmt *DS, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitDeclStmt - Transfer function logic for DeclStmts.
unsigned pred_size() const
void evalBind(ExplodedNodeSet &Dst, const Stmt *StoreE, ExplodedNode *Pred, SVal location, SVal Val, bool atDeclInit=false, const ProgramPoint *PP=nullptr)
evalBind - Handle the semantics of binding a value to a specific location.
CheckerManager & getCheckerManager() const
void VisitLogicalExpr(const BinaryOperator *B, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitLogicalExpr - Transfer function logic for '&&', '||'.
const VarRegion * getCapturedRegion() const
UnaryExprOrTypeTraitExpr - expression with either a type or (unevaluated) expression operand...
Represents a single basic block in a source-level CFG.
void VisitInitListExpr(const InitListExpr *E, ExplodedNode *Pred, ExplodedNodeSet &Dst)
QuantityType getQuantity() const
getQuantity - Get the raw integer representation of this quantity.
llvm::APSInt EvaluateKnownConstInt(const ASTContext &Ctx, SmallVectorImpl< PartialDiagnosticAt > *Diag=nullptr) const
EvaluateKnownConstInt - Call EvaluateAsRValue and return the folded integer.
void runCheckersForPostStmt(ExplodedNodeSet &Dst, const ExplodedNodeSet &Src, const Stmt *S, ExprEngine &Eng, bool wasInlined=false)
Run checkers for post-visiting Stmts.
DefinedOrUnknownSVal makeZeroVal(QualType type)
Construct an SVal representing '0' for the specified type.
Represents a block literal declaration, which is like an unnamed FunctionDecl.
Represent the declaration of a variable (in which case it is an lvalue) a function (in which case it ...
This represents one expression.
static SVal conjureOffsetSymbolOnLocation(SVal Symbol, SVal Other, Expr *Expression, SValBuilder &svalBuilder, unsigned Count, const LocationContext *LCtx)
Optionally conjure and return a symbol for offset when processing an expression Expression.
void VisitCast(const CastExpr *CastE, const Expr *Ex, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitCast - Transfer function logic for all casts (implicit and explicit).
BlockExpr - Adaptor class for mixing a BlockDecl with expressions.
unsigned getNumInits() const
const ExplodedNodeSet & getResults()
bool isAnyComplexType() const
static CharUnits fromQuantity(QuantityType Quantity)
fromQuantity - Construct a CharUnits quantity from a raw integer type.
static SVal getValue(SVal val, SValBuilder &svalBuilder)
bool isSignedIntegerType() const
Return true if this is an integer type that is signed, according to C99 6.2.5p4 [char, signed char, short, int, long..], or an enum decl which has a signed representation.
const CFGBlock * getDst() const
QualType getTypeOfArgument() const
Gets the argument type, or the type of the argument expression, whichever is appropriate.
The reason for pointer escape is unknown.
ASTContext & getContext() const
getContext - Return the ASTContext associated with this analysis.
UnaryOperator - This represents the unary-expression's (except sizeof and alignof), the postinc/postdec operators from postfix-expression, and various extensions.
void evalLoad(ExplodedNodeSet &Dst, const Expr *NodeEx, const Expr *BoundExpr, ExplodedNode *Pred, ProgramStateRef St, SVal location, const ProgramPointTag *tag=nullptr, QualType LoadTy=QualType())
Simulate a read of the result of Ex.
reverse_iterator rbegin()
Optional< T > getAs() const
Convert to the specified SVal type, returning None if this SVal is not of the desired type...
const VarDecl * getDecl() const
CFGTerminator getTerminator()
OpaqueValueExpr - An expression referring to an opaque object of a fixed type and value class...
bool isBuiltinType() const
Helper methods to distinguish type categories.
void VisitGuardedExpr(const Expr *Ex, const Expr *L, const Expr *R, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitGuardedExpr - Transfer function logic for ?, __builtin_choose.
DefinedOrUnknownSVal conjureSymbolVal(const void *symbolTag, const Expr *expr, const LocationContext *LCtx, unsigned count)
Create a new symbol with a unique 'name'.
Expr * getSubExpr() const
T castAs() const
Convert to the specified ProgramPoint type, asserting that this ProgramPoint is of the desired type...
CastKind getCastKind() const
const MemRegion * getAsRegion() const
DeclStmt - Adaptor class for mixing declarations with statements and expressions. ...
void VisitCompoundLiteralExpr(const CompoundLiteralExpr *CL, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitCompoundLiteralExpr - Transfer function logic for compound literals.
ProgramStateRef handleLVectorSplat(ProgramStateRef state, const LocationContext *LCtx, const CastExpr *CastE, StmtNodeBuilder &Bldr, ExplodedNode *Pred)
ProgramPoint getLocation() const
getLocation - Returns the edge associated with the given node.
SVal - This represents a symbolic expression, which can be either an L-value or an R-value...
UnaryExprOrTypeTrait getKind() const
decl_iterator decl_begin()
void VisitUnaryExprOrTypeTraitExpr(const UnaryExprOrTypeTraitExpr *Ex, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitUnaryExprOrTypeTraitExpr - Transfer function for sizeof.
bool isAnyPointerType() const
BasicValueFactory & getBasicVals()
void runCheckersForPreStmt(ExplodedNodeSet &Dst, const ExplodedNodeSet &Src, const Stmt *S, ExprEngine &Eng)
Run checkers for pre-visiting Stmts.
bool isVectorType() const
void insert(const ExplodedNodeSet &S)
const Expr * getInitializer() const
Dataflow Directional Tag Classes.
void VisitIncrementDecrementOperator(const UnaryOperator *U, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Handle ++ and – (both pre- and post-increment).
SValBuilder & getSValBuilder()
EvalResult is a struct with detailed info about an evaluated expression.
void addNodes(const ExplodedNodeSet &S)
StoreManager & getStoreManager()
bool isZeroConstant() const
const Expr * getInit() const
bool isBooleanType() const
SVal evalEQ(ProgramStateRef state, SVal lhs, SVal rhs)
ExplicitCastExpr - An explicit cast written in the source code.
bool isSingleDecl() const
isSingleDecl - This method returns true if this DeclStmt refers to a single Decl. ...
ProgramStateRef handleLValueBitCast(ProgramStateRef state, const Expr *Ex, const LocationContext *LCtx, QualType T, QualType ExTy, const CastExpr *CastE, StmtNodeBuilder &Bldr, ExplodedNode *Pred)
T castAs() const
Convert to the specified SVal type, asserting that this SVal is of the desired type.
bool isConstantSizeType() const
Return true if this is not a variable sized type, according to the rules of C99 6.7.5p3.
DefinedSVal getMemberPointer(const DeclaratorDecl *DD)
static bool isAdditiveOp(Opcode Opc)
uint64_t getTypeSize(QualType T) const
Return the size of the specified (complete) type T, in bits.
bool isIncompleteType(NamedDecl **Def=nullptr) const
Types are partitioned into 3 broad categories (C99 6.2.5p1): object types, function types...
static bool isIncrementOp(Opcode Op)
CanQualType getCanonicalType(QualType T) const
Return the canonical (structural) type corresponding to the specified potentially non-canonical type ...
bool isLValueReferenceType() const
X
Add a minimal nested name specifier fixit hint to allow lookup of a tag name from an outer enclosing ...
void VisitBlockExpr(const BlockExpr *BE, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitBlockExpr - Transfer function logic for BlockExprs.
Defines the C++ Decl subclasses, other than those for templates (found in DeclTemplate.h) and friends (in DeclFriend.h).
static bool isCompoundAssignmentOp(Opcode Opc)
QualType getRValueReferenceType(QualType T) const
Return the uniqued reference to the type for an rvalue reference to the specified type...
pred_iterator pred_begin()
Represents a top-level expression in a basic block.
QualType getPointerType(QualType T) const
Return the uniqued reference to the type for a pointer to the specified type.
This class is used for builtin types like 'int'.
Represents CFGBlock terminator statement.
ExplodedNode * generateNode(const Stmt *S, ExplodedNode *Pred, ProgramStateRef St, const ProgramPointTag *tag=nullptr, ProgramPoint::Kind K=ProgramPoint::PostStmtKind)
A reference to a declared variable, function, enum, etc.
nonloc::ConcreteInt makeTruthVal(bool b, QualType type)
ProgramStateRef escapeValue(ProgramStateRef State, SVal V, PointerEscapeKind K) const
A simple wrapper when you only need to notify checkers of pointer-escape of a single value...
Optional< T > getAs() const
Convert to the specified ProgramPoint type, returning None if this ProgramPoint is not of the desired...
OffsetOfExpr - [C99 7.17] - This represents an expression of the form offsetof(record-type, member-designator).
void VisitBinaryOperator(const BinaryOperator *B, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitBinaryOperator - Transfer function logic for binary operators.
bool isUnknownOrUndef() const
llvm::ImmutableList< SVal > getEmptySValList()
Expr * IgnoreParens() LLVM_READONLY
Skip past any parentheses which might surround this expression until reaching a fixed point...