clang 19.0.0git
Classes | Namespaces | Macros | Typedefs | Functions | Variables
ExprEngine.cpp File Reference
#include "clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h"
#include "PrettyStackTraceLocationContext.h"
#include "clang/AST/ASTContext.h"
#include "clang/AST/Decl.h"
#include "clang/AST/DeclBase.h"
#include "clang/AST/DeclCXX.h"
#include "clang/AST/DeclObjC.h"
#include "clang/AST/Expr.h"
#include "clang/AST/ExprCXX.h"
#include "clang/AST/ExprObjC.h"
#include "clang/AST/ParentMap.h"
#include "clang/AST/PrettyPrinter.h"
#include "clang/AST/Stmt.h"
#include "clang/AST/StmtCXX.h"
#include "clang/AST/StmtObjC.h"
#include "clang/AST/Type.h"
#include "clang/Analysis/AnalysisDeclContext.h"
#include "clang/Analysis/CFG.h"
#include "clang/Analysis/ConstructionContext.h"
#include "clang/Analysis/ProgramPoint.h"
#include "clang/Basic/IdentifierTable.h"
#include "clang/Basic/JsonSupport.h"
#include "clang/Basic/LLVM.h"
#include "clang/Basic/LangOptions.h"
#include "clang/Basic/PrettyStackTrace.h"
#include "clang/Basic/SourceLocation.h"
#include "clang/Basic/SourceManager.h"
#include "clang/Basic/Specifiers.h"
#include "clang/StaticAnalyzer/Core/AnalyzerOptions.h"
#include "clang/StaticAnalyzer/Core/BugReporter/BugReporter.h"
#include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
#include "clang/StaticAnalyzer/Core/CheckerManager.h"
#include "clang/StaticAnalyzer/Core/PathSensitive/AnalysisManager.h"
#include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
#include "clang/StaticAnalyzer/Core/PathSensitive/ConstraintManager.h"
#include "clang/StaticAnalyzer/Core/PathSensitive/CoreEngine.h"
#include "clang/StaticAnalyzer/Core/PathSensitive/DynamicExtent.h"
#include "clang/StaticAnalyzer/Core/PathSensitive/ExplodedGraph.h"
#include "clang/StaticAnalyzer/Core/PathSensitive/LoopUnrolling.h"
#include "clang/StaticAnalyzer/Core/PathSensitive/LoopWidening.h"
#include "clang/StaticAnalyzer/Core/PathSensitive/MemRegion.h"
#include "clang/StaticAnalyzer/Core/PathSensitive/ProgramState.h"
#include "clang/StaticAnalyzer/Core/PathSensitive/ProgramStateTrait.h"
#include "clang/StaticAnalyzer/Core/PathSensitive/ProgramState_Fwd.h"
#include "clang/StaticAnalyzer/Core/PathSensitive/SValBuilder.h"
#include "clang/StaticAnalyzer/Core/PathSensitive/SVals.h"
#include "clang/StaticAnalyzer/Core/PathSensitive/Store.h"
#include "clang/StaticAnalyzer/Core/PathSensitive/SymExpr.h"
#include "clang/StaticAnalyzer/Core/PathSensitive/SymbolManager.h"
#include "llvm/ADT/APSInt.h"
#include "llvm/ADT/DenseMap.h"
#include "llvm/ADT/ImmutableMap.h"
#include "llvm/ADT/ImmutableSet.h"
#include "llvm/ADT/STLExtras.h"
#include "llvm/ADT/SmallVector.h"
#include "llvm/ADT/Statistic.h"
#include "llvm/Support/Casting.h"
#include "llvm/Support/Compiler.h"
#include "llvm/Support/DOTGraphTraits.h"
#include "llvm/Support/ErrorHandling.h"
#include "llvm/Support/GraphWriter.h"
#include "llvm/Support/SaveAndRestore.h"
#include "llvm/Support/raw_ostream.h"
#include <cassert>
#include <cstdint>
#include <memory>
#include <optional>
#include <string>
#include <tuple>
#include <utility>
#include <vector>

Go to the source code of this file.

Classes

struct  llvm::DOTGraphTraits< ExplodedGraph * >
 

Namespaces

namespace  llvm
 Diagnostic wrappers for TextAPI types for error reporting.
 

Macros

#define DEBUG_TYPE   "ExprEngine"
 

Typedefs

typedef llvm::ImmutableMap< ConstructedObjectKey, SValObjectsUnderConstructionMap
 
using ObjCForLctxPair = std::pair< const ObjCForCollectionStmt *, const LocationContext * >
 

Functions

 STATISTIC (NumRemoveDeadBindings, "The # of times RemoveDeadBindings is called")
 
 STATISTIC (NumMaxBlockCountReached, "The # of aborted paths due to reaching the maximum block count in " "a top level function")
 
 STATISTIC (NumMaxBlockCountReachedInInlined, "The # of aborted paths due to reaching the maximum block count in " "an inlined function")
 
 STATISTIC (NumTimesRetriedWithoutInlining, "The # of times we re-evaluated a call without inlining")
 
 REGISTER_TRAIT_WITH_PROGRAMSTATE (PendingArrayDestruction, PendingArrayDestructionMap) static const char *TagProviderName
 
static void printObjectsUnderConstructionJson (raw_ostream &Out, ProgramStateRef State, const char *NL, const LocationContext *LCtx, unsigned int Space=0, bool IsDot=false)
 
static void printIndicesOfElementsToConstructJson (raw_ostream &Out, ProgramStateRef State, const char *NL, const LocationContext *LCtx, unsigned int Space=0, bool IsDot=false)
 
static void printPendingInitLoopJson (raw_ostream &Out, ProgramStateRef State, const char *NL, const LocationContext *LCtx, unsigned int Space=0, bool IsDot=false)
 
static void printPendingArrayDestructionsJson (raw_ostream &Out, ProgramStateRef State, const char *NL, const LocationContext *LCtx, unsigned int Space=0, bool IsDot=false)
 
template<typename Trait , typename Printer , typename... Args>
static void printStateTraitWithLocationContextJson (raw_ostream &Out, ProgramStateRef State, const LocationContext *LCtx, const char *NL, unsigned int Space, bool IsDot, const char *jsonPropertyName, Printer printer, Args &&...args)
 A helper function to generalize program state trait printing.
 
static bool shouldRemoveDeadBindings (AnalysisManager &AMgr, const Stmt *S, const ExplodedNode *Pred, const LocationContext *LC)
 
static SVal RecoverCastedSymbol (ProgramStateRef state, const Stmt *Condition, const LocationContext *LCtx, ASTContext &Ctx)
 RecoverCastedSymbol - A helper function for ProcessBranch that is used to try to recover some path-sensitivity for casts of symbolic integers that promote their values (which are currently not tracked well).
 
static const StmtgetRightmostLeaf (const Stmt *Condition)
 
static const StmtResolveCondition (const Stmt *Condition, const CFGBlock *B)
 
static std::optional< std::pair< ProgramStateRef, ProgramStateRef > > assumeCondition (const Stmt *Condition, ExplodedNode *N)
 Split the state on whether there are any more iterations left for this loop.
 
 REGISTER_TRAIT_WITH_PROGRAMSTATE (InitializedGlobalsSet, llvm::ImmutableSet< const VarDecl * >) void ExprEngine
 The GDM component containing the set of global variables which have been previously initialized with explicit initializers.
 

Variables

REGISTER_TRAIT_WITH_PROGRAMSTATE(ObjectsUnderConstruction, ObjectsUnderConstructionMap) typedef llvm REGISTER_TRAIT_WITH_PROGRAMSTATE(IndexOfElementToConstruct, IndexOfElementToConstructMap) typedef llvm typedef llvm::ImmutableMap< const LocationContext *, unsignedPendingArrayDestructionMap
 

Macro Definition Documentation

◆ DEBUG_TYPE

#define DEBUG_TYPE   "ExprEngine"

Definition at line 90 of file ExprEngine.cpp.

Typedef Documentation

◆ ObjCForLctxPair

using ObjCForLctxPair = std::pair<const ObjCForCollectionStmt *, const LocationContext *>

Definition at line 2668 of file ExprEngine.cpp.

◆ ObjectsUnderConstructionMap

typedef llvm::ImmutableMap<ConstructedObjectKey, SVal> ObjectsUnderConstructionMap

Definition at line 186 of file ExprEngine.cpp.

Function Documentation

◆ assumeCondition()

static std::optional< std::pair< ProgramStateRef, ProgramStateRef > > assumeCondition ( const Stmt Condition,
ExplodedNode N 
)
static

Split the state on whether there are any more iterations left for this loop.

Returns a (HasMoreIteration, HasNoMoreIteration) pair, or std::nullopt when the acquisition of the loop condition value failed.

Definition at line 2699 of file ExprEngine.cpp.

References clang::Condition, clang::ento::ExplodedNode::getLocationContext(), clang::ento::ExplodedNode::getState(), clang::ento::ExprEngine::hasMoreIteration(), clang::ento::SVal::isUnknown(), RecoverCastedSymbol(), clang::ento::ExprEngine::removeIterationState(), V, and X.

Referenced by clang::ento::ExprEngine::processBranch().

◆ getRightmostLeaf()

static const Stmt * getRightmostLeaf ( const Stmt Condition)
static

Definition at line 2611 of file ExprEngine.cpp.

References clang::Condition.

Referenced by ResolveCondition().

◆ printIndicesOfElementsToConstructJson()

static void printIndicesOfElementsToConstructJson ( raw_ostream &  Out,
ProgramStateRef  State,
const char *  NL,
const LocationContext LCtx,
unsigned int  Space = 0,
bool  IsDot = false 
)
static

◆ printObjectsUnderConstructionJson()

static void printObjectsUnderConstructionJson ( raw_ostream &  Out,
ProgramStateRef  State,
const char *  NL,
const LocationContext LCtx,
unsigned int  Space = 0,
bool  IsDot = false 
)
static

◆ printPendingArrayDestructionsJson()

static void printPendingArrayDestructionsJson ( raw_ostream &  Out,
ProgramStateRef  State,
const char *  NL,
const LocationContext LCtx,
unsigned int  Space = 0,
bool  IsDot = false 
)
static

Definition at line 854 of file ExprEngine.cpp.

Referenced by clang::ento::ExprEngine::printJson().

◆ printPendingInitLoopJson()

static void printPendingInitLoopJson ( raw_ostream &  Out,
ProgramStateRef  State,
const char *  NL,
const LocationContext LCtx,
unsigned int  Space = 0,
bool  IsDot = false 
)
static

◆ printStateTraitWithLocationContextJson()

template<typename Trait , typename Printer , typename... Args>
static void printStateTraitWithLocationContextJson ( raw_ostream &  Out,
ProgramStateRef  State,
const LocationContext LCtx,
const char *  NL,
unsigned int  Space,
bool  IsDot,
const char *  jsonPropertyName,
Printer  printer,
Args &&...  args 
)
static

A helper function to generalize program state trait printing.

The function invokes Printer as 'Printer(Out, State, NL, LC, Space, IsDot, std::forward<Args>(args)...)'.
One possible type for Printer is 'void()(raw_ostream &, ProgramStateRef, const char *, const LocationContext *, unsigned int, bool, ...)'

Parameters
TraitThe state trait to be printed.
PrinterA void function that prints Trait.
ArgsAn additional parameter pack that is passed to Print upon invocation.

Definition at line 910 of file ExprEngine.cpp.

References bool, int, and clang::LocationContext::printJson().

◆ RecoverCastedSymbol()

static SVal RecoverCastedSymbol ( ProgramStateRef  state,
const Stmt Condition,
const LocationContext LCtx,
ASTContext Ctx 
)
static

RecoverCastedSymbol - A helper function for ProcessBranch that is used to try to recover some path-sensitivity for casts of symbolic integers that promote their values (which are currently not tracked well).

This function returns the SVal bound to Condition->IgnoreCasts if all the

Definition at line 2573 of file ExprEngine.cpp.

References clang::Condition, clang::ASTContext::getTypeSize(), clang::Type::isIntegralOrEnumerationType(), and clang::T.

Referenced by assumeCondition().

◆ REGISTER_TRAIT_WITH_PROGRAMSTATE() [1/2]

REGISTER_TRAIT_WITH_PROGRAMSTATE ( InitializedGlobalsSet  ,
llvm::ImmutableSet< const VarDecl * >   
)

The GDM component containing the set of global variables which have been previously initialized with explicit initializers.

Definition at line 2820 of file ExprEngine.cpp.

References clang::ento::ExplodedNode::getLocationContext(), clang::DeclStmt::getSingleDecl(), and clang::ento::ExplodedNode::getState().

◆ REGISTER_TRAIT_WITH_PROGRAMSTATE() [2/2]

REGISTER_TRAIT_WITH_PROGRAMSTATE ( PendingArrayDestruction  ,
PendingArrayDestructionMap   
) const

◆ ResolveCondition()

static const Stmt * ResolveCondition ( const Stmt Condition,
const CFGBlock B 
)
static

◆ shouldRemoveDeadBindings()

static bool shouldRemoveDeadBindings ( AnalysisManager AMgr,
const Stmt S,
const ExplodedNode Pred,
const LocationContext LC 
)
static

◆ STATISTIC() [1/4]

STATISTIC ( NumMaxBlockCountReached  ,
"The # of aborted paths due to reaching the maximum block count in " "a top level function"   
)

◆ STATISTIC() [2/4]

STATISTIC ( NumMaxBlockCountReachedInInlined  ,
"The # of aborted paths due to reaching the maximum block count in " "an inlined function"   
)

◆ STATISTIC() [3/4]

STATISTIC ( NumRemoveDeadBindings  ,
"The # of times RemoveDeadBindings is called"   
)

◆ STATISTIC() [4/4]

STATISTIC ( NumTimesRetriedWithoutInlining  ,
"The # of times we re-evaluated a call without inlining"   
)

Variable Documentation

◆ PendingArrayDestructionMap

REGISTER_TRAIT_WITH_PROGRAMSTATE (ObjectsUnderConstruction, ObjectsUnderConstructionMap) typedef llvm REGISTER_TRAIT_WITH_PROGRAMSTATE (IndexOfElementToConstruct, IndexOfElementToConstructMap) typedef llvm typedef llvm::ImmutableMap<const LocationContext *, unsigned> PendingArrayDestructionMap

Definition at line 211 of file ExprEngine.cpp.