|
clang 20.0.0git
|
#include "clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h"#include "PrettyStackTraceLocationContext.h"#include "clang/AST/ASTContext.h"#include "clang/AST/Decl.h"#include "clang/AST/DeclBase.h"#include "clang/AST/DeclCXX.h"#include "clang/AST/DeclObjC.h"#include "clang/AST/Expr.h"#include "clang/AST/ExprCXX.h"#include "clang/AST/ExprObjC.h"#include "clang/AST/ParentMap.h"#include "clang/AST/PrettyPrinter.h"#include "clang/AST/Stmt.h"#include "clang/AST/StmtCXX.h"#include "clang/AST/StmtObjC.h"#include "clang/AST/Type.h"#include "clang/Analysis/AnalysisDeclContext.h"#include "clang/Analysis/CFG.h"#include "clang/Analysis/ConstructionContext.h"#include "clang/Analysis/ProgramPoint.h"#include "clang/Basic/IdentifierTable.h"#include "clang/Basic/JsonSupport.h"#include "clang/Basic/LLVM.h"#include "clang/Basic/LangOptions.h"#include "clang/Basic/PrettyStackTrace.h"#include "clang/Basic/SourceLocation.h"#include "clang/Basic/SourceManager.h"#include "clang/Basic/Specifiers.h"#include "clang/StaticAnalyzer/Core/AnalyzerOptions.h"#include "clang/StaticAnalyzer/Core/BugReporter/BugReporter.h"#include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"#include "clang/StaticAnalyzer/Core/CheckerManager.h"#include "clang/StaticAnalyzer/Core/PathSensitive/AnalysisManager.h"#include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"#include "clang/StaticAnalyzer/Core/PathSensitive/ConstraintManager.h"#include "clang/StaticAnalyzer/Core/PathSensitive/CoreEngine.h"#include "clang/StaticAnalyzer/Core/PathSensitive/DynamicExtent.h"#include "clang/StaticAnalyzer/Core/PathSensitive/ExplodedGraph.h"#include "clang/StaticAnalyzer/Core/PathSensitive/LoopUnrolling.h"#include "clang/StaticAnalyzer/Core/PathSensitive/LoopWidening.h"#include "clang/StaticAnalyzer/Core/PathSensitive/MemRegion.h"#include "clang/StaticAnalyzer/Core/PathSensitive/ProgramState.h"#include "clang/StaticAnalyzer/Core/PathSensitive/ProgramStateTrait.h"#include "clang/StaticAnalyzer/Core/PathSensitive/ProgramState_Fwd.h"#include "clang/StaticAnalyzer/Core/PathSensitive/SValBuilder.h"#include "clang/StaticAnalyzer/Core/PathSensitive/SVals.h"#include "clang/StaticAnalyzer/Core/PathSensitive/Store.h"#include "clang/StaticAnalyzer/Core/PathSensitive/SymExpr.h"#include "clang/StaticAnalyzer/Core/PathSensitive/SymbolManager.h"#include "llvm/ADT/APSInt.h"#include "llvm/ADT/DenseMap.h"#include "llvm/ADT/ImmutableMap.h"#include "llvm/ADT/ImmutableSet.h"#include "llvm/ADT/STLExtras.h"#include "llvm/ADT/SmallVector.h"#include "llvm/ADT/Statistic.h"#include "llvm/Support/Casting.h"#include "llvm/Support/Compiler.h"#include "llvm/Support/DOTGraphTraits.h"#include "llvm/Support/ErrorHandling.h"#include "llvm/Support/GraphWriter.h"#include "llvm/Support/SaveAndRestore.h"#include "llvm/Support/raw_ostream.h"#include <cassert>#include <cstdint>#include <memory>#include <optional>#include <string>#include <tuple>#include <utility>#include <vector>Go to the source code of this file.
Classes | |
| struct | llvm::DOTGraphTraits< ExplodedGraph * > |
Namespaces | |
| namespace | llvm |
| Diagnostic wrappers for TextAPI types for error reporting. | |
Macros | |
| #define | DEBUG_TYPE "ExprEngine" |
Typedefs | |
| typedef llvm::ImmutableMap< ConstructedObjectKey, SVal > | ObjectsUnderConstructionMap |
| using | ObjCForLctxPair = std::pair< const ObjCForCollectionStmt *, const LocationContext * > |
Functions | |
| STATISTIC (NumRemoveDeadBindings, "The # of times RemoveDeadBindings is called") | |
| STATISTIC (NumMaxBlockCountReached, "The # of aborted paths due to reaching the maximum block count in " "a top level function") | |
| STATISTIC (NumMaxBlockCountReachedInInlined, "The # of aborted paths due to reaching the maximum block count in " "an inlined function") | |
| STATISTIC (NumTimesRetriedWithoutInlining, "The # of times we re-evaluated a call without inlining") | |
| REGISTER_TRAIT_WITH_PROGRAMSTATE (PendingArrayDestruction, PendingArrayDestructionMap) static const char *TagProviderName | |
| static void | printObjectsUnderConstructionJson (raw_ostream &Out, ProgramStateRef State, const char *NL, const LocationContext *LCtx, unsigned int Space=0, bool IsDot=false) |
| static void | printIndicesOfElementsToConstructJson (raw_ostream &Out, ProgramStateRef State, const char *NL, const LocationContext *LCtx, unsigned int Space=0, bool IsDot=false) |
| static void | printPendingInitLoopJson (raw_ostream &Out, ProgramStateRef State, const char *NL, const LocationContext *LCtx, unsigned int Space=0, bool IsDot=false) |
| static void | printPendingArrayDestructionsJson (raw_ostream &Out, ProgramStateRef State, const char *NL, const LocationContext *LCtx, unsigned int Space=0, bool IsDot=false) |
| template<typename Trait , typename Printer , typename... Args> | |
| static void | printStateTraitWithLocationContextJson (raw_ostream &Out, ProgramStateRef State, const LocationContext *LCtx, const char *NL, unsigned int Space, bool IsDot, const char *jsonPropertyName, Printer printer, Args &&...args) |
| A helper function to generalize program state trait printing. | |
| static bool | shouldRemoveDeadBindings (AnalysisManager &AMgr, const Stmt *S, const ExplodedNode *Pred, const LocationContext *LC) |
| static SVal | RecoverCastedSymbol (ProgramStateRef state, const Stmt *Condition, const LocationContext *LCtx, ASTContext &Ctx) |
| RecoverCastedSymbol - A helper function for ProcessBranch that is used to try to recover some path-sensitivity for casts of symbolic integers that promote their values (which are currently not tracked well). | |
| static const Stmt * | getRightmostLeaf (const Stmt *Condition) |
| static const Stmt * | ResolveCondition (const Stmt *Condition, const CFGBlock *B) |
| static std::optional< std::pair< ProgramStateRef, ProgramStateRef > > | assumeCondition (const Stmt *Condition, ExplodedNode *N) |
| Split the state on whether there are any more iterations left for this loop. | |
| REGISTER_TRAIT_WITH_PROGRAMSTATE (InitializedGlobalsSet, llvm::ImmutableSet< const VarDecl * >) void ExprEngine | |
| The GDM component containing the set of global variables which have been previously initialized with explicit initializers. | |
Variables | |
| REGISTER_TRAIT_WITH_PROGRAMSTATE(ObjectsUnderConstruction, ObjectsUnderConstructionMap) typedef llvm REGISTER_TRAIT_WITH_PROGRAMSTATE(IndexOfElementToConstruct, IndexOfElementToConstructMap) typedef llvm typedef llvm::ImmutableMap< const LocationContext *, unsigned > | PendingArrayDestructionMap |
| #define DEBUG_TYPE "ExprEngine" |
Definition at line 90 of file ExprEngine.cpp.
| using ObjCForLctxPair = std::pair<const ObjCForCollectionStmt *, const LocationContext *> |
Definition at line 2681 of file ExprEngine.cpp.
| typedef llvm::ImmutableMap<ConstructedObjectKey, SVal> ObjectsUnderConstructionMap |
Definition at line 186 of file ExprEngine.cpp.
|
static |
Split the state on whether there are any more iterations left for this loop.
Returns a (HasMoreIteration, HasNoMoreIteration) pair, or std::nullopt when the acquisition of the loop condition value failed.
Definition at line 2712 of file ExprEngine.cpp.
References clang::Condition, clang::ento::ExplodedNode::getLocationContext(), clang::ento::ExplodedNode::getState(), clang::ento::ExprEngine::hasMoreIteration(), clang::ento::SVal::isUnknown(), RecoverCastedSymbol(), clang::ento::ExprEngine::removeIterationState(), V, and X.
Referenced by clang::ento::ExprEngine::processBranch().
Definition at line 2624 of file ExprEngine.cpp.
References clang::Condition.
Referenced by ResolveCondition().
|
static |
Definition at line 731 of file ExprEngine.cpp.
References E, clang::LocationContext::getAnalysisDeclContext(), clang::QualType::getAsString(), clang::AnalysisDeclContext::getASTContext(), clang::Stmt::getID(), clang::ASTContext::getPrintingPolicy(), clang::ASTContext::getSourceManager(), clang::Stmt::getSourceRange(), clang::Stmt::getStmtClassName(), clang::Expr::getType(), clang::SourceRange::printToString(), and clang::QualType::split().
Referenced by clang::ento::ExprEngine::printJson().
|
static |
Definition at line 685 of file ExprEngine.cpp.
References clang::LocationContext::getAnalysisDeclContext(), clang::AnalysisDeclContext::getASTContext(), and clang::ASTContext::getPrintingPolicy().
Referenced by clang::ento::ExprEngine::printJson().
|
static |
Definition at line 854 of file ExprEngine.cpp.
Referenced by clang::ento::ExprEngine::printJson().
|
static |
Definition at line 793 of file ExprEngine.cpp.
References E, clang::LocationContext::getAnalysisDeclContext(), clang::QualType::getAsString(), clang::AnalysisDeclContext::getASTContext(), clang::Stmt::getID(), clang::ASTContext::getPrintingPolicy(), clang::ASTContext::getSourceManager(), clang::Stmt::getSourceRange(), clang::Stmt::getStmtClassName(), clang::Expr::getType(), clang::SourceRange::printToString(), and clang::QualType::split().
Referenced by clang::ento::ExprEngine::printJson().
|
static |
A helper function to generalize program state trait printing.
The function invokes Printer as 'Printer(Out, State, NL, LC, Space, IsDot,
std::forward<Args>(args)...)'.
One possible type for Printer is 'void()(raw_ostream &, ProgramStateRef, const char *, const LocationContext *, unsigned int, bool, ...)'
| Trait | The state trait to be printed. |
| Printer | A void function that prints Trait. |
| Args | An additional parameter pack that is passed to Print upon invocation. |
Definition at line 910 of file ExprEngine.cpp.
References bool, int, and clang::LocationContext::printJson().
|
static |
RecoverCastedSymbol - A helper function for ProcessBranch that is used to try to recover some path-sensitivity for casts of symbolic integers that promote their values (which are currently not tracked well).
This function returns the SVal bound to Condition->IgnoreCasts if all the
Definition at line 2586 of file ExprEngine.cpp.
References clang::Condition, clang::ASTContext::getTypeSize(), clang::Type::isIntegralOrEnumerationType(), and clang::T.
Referenced by assumeCondition().
| REGISTER_TRAIT_WITH_PROGRAMSTATE | ( | InitializedGlobalsSet | , |
| llvm::ImmutableSet< const VarDecl * > | |||
| ) |
The GDM component containing the set of global variables which have been previously initialized with explicit initializers.
Definition at line 2833 of file ExprEngine.cpp.
References clang::ento::ExplodedNode::getLocationContext(), clang::DeclStmt::getSingleDecl(), and clang::ento::ExplodedNode::getState().
| REGISTER_TRAIT_WITH_PROGRAMSTATE | ( | PendingArrayDestruction | , |
| PendingArrayDestructionMap | |||
| ) | const |
Definition at line 2650 of file ExprEngine.cpp.
References clang::Condition, getRightmostLeaf(), clang::CFGBlock::getTerminator(), and clang::CFGTerminator::isStmtBranch().
Referenced by clang::ento::ExprEngine::processBranch().
|
static |
Definition at line 1003 of file ExprEngine.cpp.
References clang::AnalyzerOptions::AnalysisPurgeOpt, clang::LocationContext::getAnalysisDeclContext(), clang::ProgramPoint::getAs(), clang::ento::ExplodedNode::getLocation(), clang::AnalysisDeclContext::getParentMap(), clang::ento::CallEvent::isCallStmt(), clang::ParentMap::isConsumedExpr(), and clang::ento::AnalysisManager::options.
Referenced by clang::ento::ExprEngine::ProcessStmt().
| STATISTIC | ( | NumMaxBlockCountReached | , |
| "The # of aborted paths due to reaching the maximum block count in " "a top level function" | |||
| ) |
| STATISTIC | ( | NumMaxBlockCountReachedInInlined | , |
| "The # of aborted paths due to reaching the maximum block count in " "an inlined function" | |||
| ) |
| STATISTIC | ( | NumRemoveDeadBindings | , |
| "The # of times RemoveDeadBindings is called" | |||
| ) |
| STATISTIC | ( | NumTimesRetriedWithoutInlining | , |
| "The # of times we re-evaluated a call without inlining" | |||
| ) |
| REGISTER_TRAIT_WITH_PROGRAMSTATE (ObjectsUnderConstruction, ObjectsUnderConstructionMap) typedef llvm REGISTER_TRAIT_WITH_PROGRAMSTATE (IndexOfElementToConstruct, IndexOfElementToConstructMap) typedef llvm typedef llvm::ImmutableMap<const LocationContext *, unsigned> PendingArrayDestructionMap |
Definition at line 211 of file ExprEngine.cpp.
1.9.6