27 SVal location = state->getLValue(Ex->
getDecl(), baseVal);
31 Bldr.
generateNode(Ex, Pred, state->BindExpr(Ex, LCtx, location));
60 if (
const auto *R = dyn_cast<TypedValueRegion>(MV->getRegion())) {
76 nextState = nextState->bindLoc(elementV,
V, LCtx);
111 const Stmt *elem = S->getElement();
112 const Stmt *collection = S->getCollection();
117 if (
const auto *DS = dyn_cast<DeclStmt>(elem)) {
118 const VarDecl *elemD = cast<VarDecl>(DS->getSingleDecl());
119 assert(elemD->
getInit() ==
nullptr);
125 bool isContainerNull = state->isNull(collectionV).isConstrainedTrue();
128 evalLocation(dstLocation, S, elem, Pred, state, elementV,
false);
133 if (!isContainerNull)
135 SymMgr, currBldrCtx, Bldr,
139 SymMgr, currBldrCtx, Bldr,
196 if (Msg->isInstanceMessage()) {
197 SVal recVal = Msg->getReceiverSVal();
205 std::tie(notNilState, nilState) = State->assume(receiverVal);
208 if (nilState && !notNilState) {
214 assert((Pred || HasTag) &&
"Should have cached out already!");
222 for (
auto *I : dstPostCheckers)
223 finishArgumentConstruction(Dst, I, *Msg);
231 if (notNilState != State) {
234 assert((Pred || HasTag) &&
"Should have cached out already!");
255 DE = dstGenericPrevisit.
end(); DI != DE; ++DI) {
260 if (UpdatedMsg->isInstanceMessage()) {
261 SVal recVal = UpdatedMsg->getReceiverSVal();
286 for (
auto *I : dstEval)
287 finishArgumentConstruction(dstArgCleanup, I, *Msg);
static void populateObjCForDestinationSet(ExplodedNodeSet &dstLocation, SValBuilder &svalBuilder, const ObjCForCollectionStmt *S, const Stmt *elem, SVal elementV, SymbolManager &SymMgr, const NodeBuilderContext *currBldrCtx, StmtNodeBuilder &Bldr, bool hasElements)
Generate a node in Bldr for an iteration statement using ObjC for-loop iterator.
Defines the Objective-C statement AST node classes.
It wraps the AnalysisDeclContext to represent both the call stack with the help of StackFrameContext ...
Represents Objective-C's @synchronized statement.
Represents Objective-C's collection statement.
ObjCIvarRefExpr - A reference to an ObjC instance variable.
const Expr * getBase() const
An expression that sends a message to the given Objective-C object or class.
bool isImplicitNoReturn(const ObjCMessageExpr *ME)
Return true if the given message expression is known to never return.
const ProgramPointTag * getTag() const
A (possibly-)qualified type.
Stmt - This represents one statement.
Represents a variable declaration or definition.
const Expr * getInit() const
Manages the lifetime of CallEvent objects.
CallEventRef< ObjCMethodCall > getObjCMethodCall(const ObjCMessageExpr *E, ProgramStateRef State, const LocationContext *LCtx, CFGBlock::ConstCFGElementRef ElemRef)
CallEventRef< T > cloneWithState(ProgramStateRef State) const
void runCheckersForPreObjCMessage(ExplodedNodeSet &Dst, const ExplodedNodeSet &Src, const ObjCMethodCall &msg, ExprEngine &Eng)
Run checkers for pre-visiting obj-c messages.
void runCheckersForPreCall(ExplodedNodeSet &Dst, const ExplodedNodeSet &Src, const CallEvent &Call, ExprEngine &Eng)
Run checkers for pre-visiting obj-c messages.
void runCheckersForPostObjCMessage(ExplodedNodeSet &Dst, const ExplodedNodeSet &Src, const ObjCMethodCall &msg, ExprEngine &Eng, bool wasInlined=false)
Run checkers for post-visiting obj-c messages.
void runCheckersForPostStmt(ExplodedNodeSet &Dst, const ExplodedNodeSet &Src, const Stmt *S, ExprEngine &Eng, bool wasInlined=false)
Run checkers for post-visiting Stmts.
void runCheckersForPreStmt(ExplodedNodeSet &Dst, const ExplodedNodeSet &Src, const Stmt *S, ExprEngine &Eng)
Run checkers for pre-visiting Stmts.
void runCheckersForObjCMessageNil(ExplodedNodeSet &Dst, const ExplodedNodeSet &Src, const ObjCMethodCall &msg, ExprEngine &Eng)
Run checkers for visiting an obj-c message to nil.
void runCheckersForPostCall(ExplodedNodeSet &Dst, const ExplodedNodeSet &Src, const CallEvent &Call, ExprEngine &Eng, bool wasInlined=false)
Run checkers for post-visiting obj-c messages.
ImplTy::iterator iterator
const ProgramStateRef & getState() const
ProgramPoint getLocation() const
getLocation - Returns the edge associated with the given node.
const LocationContext * getLocationContext() const
ProgramStateManager & getStateManager()
void VisitObjCMessage(const ObjCMessageExpr *ME, ExplodedNode *Pred, ExplodedNodeSet &Dst)
void VisitObjCAtSynchronizedStmt(const ObjCAtSynchronizedStmt *S, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Transfer function logic for ObjCAtSynchronizedStmts.
void VisitObjCForCollectionStmt(const ObjCForCollectionStmt *S, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitObjCForCollectionStmt - Transfer function logic for ObjCForCollectionStmt.
void VisitLvalObjCIvarRefExpr(const ObjCIvarRefExpr *DR, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Transfer function logic for computing the lvalue of an Objective-C ivar.
CFGBlock::ConstCFGElementRef getCFGElementRef() const
CheckerManager & getCheckerManager() const
void defaultEvalCall(NodeBuilder &B, ExplodedNode *Pred, const CallEvent &Call, const EvalCallOptions &CallOpts={})
Default implementation of call evaluation.
static ProgramStateRef setWhetherHasMoreIteration(ProgramStateRef State, const ObjCForCollectionStmt *O, const LocationContext *LC, bool HasMoreIteraton)
Note whether this loop has any more iteratios to model.
static bool isLocType(QualType T)
CallEventManager & getCallEventManager()
nonloc::ConcreteInt makeIntVal(const IntegerLiteral *integer)
loc::MemRegionVal makeLoc(SymbolRef sym)
SVal - This represents a symbolic expression, which can be either an L-value or an R-value.
std::optional< T > getAs() const
Convert to the specified SVal type, returning std::nullopt if this SVal is not of the desired type.
T castAs() const
Convert to the specified SVal type, asserting that this SVal is of the desired type.
This builder class is useful for generating nodes that resulted from visiting a statement.
ExplodedNode * generateNode(const Stmt *S, ExplodedNode *Pred, ProgramStateRef St, const ProgramPointTag *tag=nullptr, ProgramPoint::Kind K=ProgramPoint::PostStmtKind)
ExplodedNode * generateSink(const Stmt *S, ExplodedNode *Pred, ProgramStateRef St, const ProgramPointTag *tag=nullptr, ProgramPoint::Kind K=ProgramPoint::PostStmtKind)
const SymbolConjured * conjureSymbol(const Stmt *E, const LocationContext *LCtx, QualType T, unsigned VisitCount, const void *SymbolTag=nullptr)
unsigned blockCount() const
Returns the number of times the current basic block has been visited on the exploded graph path.