63 #include "llvm/ADT/APSInt.h" 64 #include "llvm/ADT/DenseMap.h" 65 #include "llvm/ADT/ImmutableMap.h" 66 #include "llvm/ADT/ImmutableSet.h" 67 #include "llvm/ADT/Optional.h" 68 #include "llvm/ADT/SmallVector.h" 69 #include "llvm/ADT/Statistic.h" 70 #include "llvm/Support/Casting.h" 71 #include "llvm/Support/Compiler.h" 72 #include "llvm/Support/DOTGraphTraits.h" 73 #include "llvm/Support/ErrorHandling.h" 74 #include "llvm/Support/GraphWriter.h" 75 #include "llvm/Support/SaveAndRestore.h" 76 #include "llvm/Support/raw_ostream.h" 85 using namespace clang;
88 #define DEBUG_TYPE "ExprEngine" 91 "The # of times RemoveDeadBindings is called");
93 "The # of aborted paths due to reaching the maximum block count in " 94 "a top level function");
95 STATISTIC(NumMaxBlockCountReachedInInlined,
96 "The # of aborted paths due to reaching the maximum block count in " 97 "an inlined function");
99 "The # of times we re-evaluated a call without inlining");
120 class ConstructedObjectKey {
121 typedef std::pair<ConstructionContextItem, const LocationContext *>
122 ConstructedObjectKeyImpl;
124 const ConstructedObjectKeyImpl Impl;
126 const void *getAnyASTNodePtr()
const {
127 if (
const Stmt *S = getItem().getStmtOrNull())
130 return getItem().getCXXCtorInitializer();
139 const LocationContext *getLocationContext()
const {
return Impl.second; }
142 return getLocationContext()->getDecl()->getASTContext();
145 void printJson(llvm::raw_ostream &Out,
PrinterHelper *Helper,
147 const Stmt *S = getItem().getStmtOrNull();
150 I = getItem().getCXXCtorInitializer();
153 Out <<
"\"stmt_id\": " << S->
getID(getASTContext());
155 Out <<
"\"init_id\": " << I->
getID(getASTContext());
158 Out <<
", \"kind\": \"" << getItem().getKindAsString()
159 <<
"\", \"argument_index\": ";
162 Out << getItem().getIndex();
167 Out <<
", \"pretty\": ";
176 void Profile(llvm::FoldingSetNodeID &
ID)
const {
178 ID.AddPointer(Impl.second);
181 bool operator==(
const ConstructedObjectKey &RHS)
const {
182 return Impl == RHS.Impl;
185 bool operator<(
const ConstructedObjectKey &RHS)
const {
186 return Impl < RHS.Impl;
191 typedef llvm::ImmutableMap<ConstructedObjectKey, SVal>
200 static const char* TagProviderName =
"ExprEngine";
207 : CTU(CTU), AMgr(mgr),
208 AnalysisDeclContexts(mgr.getAnalysisDeclContextManager()),
209 Engine(*this, FS, mgr.getAnalyzerOptions()), G(Engine.getGraph()),
210 StateMgr(getContext(), mgr.getStoreManagerCreator(),
211 mgr.getConstraintManagerCreator(), G.getAllocator(),
213 SymMgr(StateMgr.getSymbolManager()),
214 MRMgr(StateMgr.getRegionManager()),
215 svalBuilder(StateMgr.getSValBuilder()),
216 ObjCNoRet(mgr.getASTContext()),
218 VisitedCallees(VisitedCalleesIn),
219 HowToInline(HowToInlineIn)
221 unsigned TrimInterval = mgr.
options.GraphTrimInterval;
222 if (TrimInterval != 0) {
240 if (
const auto *FD = dyn_cast<FunctionDecl>(D)) {
244 if (!II || !(II->
getName() ==
"main" && FD->getNumParams() > 0))
250 if (!BT || !BT->isInteger())
253 const MemRegion *R = state->getRegion(PD, InitLoc);
275 if (
const auto *MD = dyn_cast<ObjCMethodDecl>(D)) {
279 const MemRegion *R = state->getRegion(SelfD, InitLoc);
284 state = state->assume(*LV,
true);
285 assert(state &&
"'self' cannot be null");
289 if (
const auto *MD = dyn_cast<CXXMethodDecl>(D)) {
290 if (!MD->isStatic()) {
297 SVal V = state->getSVal(L);
299 state = state->assume(*LV,
true);
300 assert(state &&
"'this' cannot be null");
311 const Expr *InitWithAdjustments,
const Expr *Result,
312 const SubRegion **OutRegionWithAdjustments) {
318 SVal InitValWithAdjustments = State->getSVal(InitWithAdjustments, LC);
323 if (OutRegionWithAdjustments)
324 *OutRegionWithAdjustments =
nullptr;
327 Result = InitWithAdjustments;
331 assert(!InitValWithAdjustments.
getAs<
Loc>() ||
365 CommaLHSs, Adjustments);
373 if (
const auto *MT = dyn_cast<MaterializeTemporaryExpr>(Result)) {
375 State = finishObjectConstruction(State, MT, LC);
376 State = State->BindExpr(Result, LC, *
V);
396 for (
auto I = Adjustments.rbegin(), E = Adjustments.rend(); I != E; ++I) {
407 State = State->invalidateRegions(Reg, InitWithAdjustments,
409 nullptr,
nullptr,
nullptr);
422 SVal InitVal = State->getSVal(Init, LC);
426 State = State->bindLoc(BaseReg.
castAs<
Loc>(), InitVal, LC,
false);
430 if (InitValWithAdjustments.
isUnknown()) {
434 Result, LC, InitWithAdjustments->
getType(),
438 State->bindLoc(Reg.
castAs<
Loc>(), InitValWithAdjustments, LC,
false);
440 State = State->bindLoc(BaseReg.
castAs<
Loc>(), InitVal, LC,
false);
447 State = State->BindExpr(Result, LC, Reg);
449 State = State->BindExpr(Result, LC, InitValWithAdjustments);
455 if (OutRegionWithAdjustments)
456 *OutRegionWithAdjustments = cast<SubRegion>(Reg.
getAsRegion());
467 assert(!State->get<ObjectsUnderConstruction>(Key) ||
468 Key.getItem().getKind() ==
470 return State->set<ObjectsUnderConstruction>(Key,
V);
486 assert(State->contains<ObjectsUnderConstruction>(Key));
487 return State->remove<ObjectsUnderConstruction>(Key);
493 ConstructedObjectKey Key({BTE,
true}, LC);
496 return State->set<ObjectsUnderConstruction>(Key,
UnknownVal());
503 ConstructedObjectKey Key({BTE,
true}, LC);
504 assert(State->contains<ObjectsUnderConstruction>(Key));
505 return State->remove<ObjectsUnderConstruction>(Key);
511 ConstructedObjectKey Key({BTE,
true}, LC);
512 return State->contains<ObjectsUnderConstruction>(Key);
520 assert(LC &&
"ToLC must be a parent of FromLC!");
521 for (
auto I : State->get<ObjectsUnderConstruction>())
522 if (I.first.getLocationContext() == LC)
538 SVal cond,
bool assumption) {
557 unsigned int Space = 0,
bool IsDot =
false) {
562 bool HasItem =
false;
565 const ConstructedObjectKey *LastKey =
nullptr;
566 for (
const auto &I : State->get<ObjectsUnderConstruction>()) {
567 const ConstructedObjectKey &Key = I.first;
568 if (Key.getLocationContext() != LCtx)
579 for (
const auto &I : State->get<ObjectsUnderConstruction>()) {
580 const ConstructedObjectKey &Key = I.first;
581 SVal
Value = I.second;
582 if (Key.getLocationContext() != LCtx)
585 Indent(Out, Space, IsDot) <<
"{ ";
586 Key.printJson(Out,
nullptr, PP);
587 Out <<
", \"value\": \"" << Value <<
"\" }";
595 Indent(Out, --Space, IsDot) <<
']';
603 unsigned int Space,
bool IsDot)
const {
604 Indent(Out, Space, IsDot) <<
"\"constructing_objects\": ";
606 if (LCtx && !State->get<ObjectsUnderConstruction>().isEmpty()) {
614 Indent(Out, Space, IsDot) <<
"]," << NL;
616 Out <<
"null," << NL;
630 currStmtIdx = StmtIdx;
665 const ExplodedNode *Pred,
668 if (AMgr.options.AnalysisPurgeOpt == PurgeNone)
690 const Stmt *ReferenceStmt,
692 const Stmt *DiagnosticStmt,
695 ReferenceStmt ==
nullptr || isa<ReturnStmt>(ReferenceStmt))
696 &&
"PostStmt is not generally supported by the SymbolReaper yet");
697 assert(LC &&
"Must pass the current (or expiring) LocationContext");
699 if (!DiagnosticStmt) {
700 DiagnosticStmt = ReferenceStmt;
701 assert(DiagnosticStmt &&
"Required for clearing a LocationContext");
704 NumRemoveDeadBindings++;
710 if (!ReferenceStmt) {
712 "Use PostStmtPurgeDeadSymbolsKind for clearing a LocationContext");
719 for (
auto I : CleanedState->get<ObjectsUnderConstruction>()) {
720 if (
SymbolRef Sym = I.second.getAsSymbol())
722 if (
const MemRegion *MR = I.second.getAsRegion())
740 DiagnosticStmt, *
this, K);
746 for (
const auto I : CheckedSet) {
754 "Checkers are not allowed to modify the Environment as a part of " 755 "checkDeadSymbols processing.");
757 "Checkers are not allowed to modify the Store as a part of " 758 "checkDeadSymbols processing.");
764 Bldr.
generateNode(DiagnosticStmt, I, CleanedCheckerSt, &cleanupTag, K);
774 "Error evaluating statement");
783 CleanedStates.Add(Pred);
787 for (
const auto I : CleanedStates) {
790 Visit(currStmt, I, DstI);
801 "Error evaluating end of the loop");
807 if(AMgr.
options.ShouldUnrollLoops)
824 "Error evaluating initializer");
828 const auto *
decl = cast<CXXConstructorDecl>(stackFrame->getDecl());
831 SVal thisVal = State->getSVal(svalBuilder.
getCXXThis(decl, stackFrame));
843 State = finishObjectConstruction(State, BMI, LC);
845 PostStore PS(Init, LC,
nullptr,
nullptr);
854 FieldLoc = State->getLValue(BMI->
getMember(), thisVal);
862 while ((ASE = dyn_cast<ArraySubscriptExpr>(Init)))
865 SVal LValue = State->getSVal(Init, stackFrame);
868 InitVal = State->getSVal(*LValueLoc);
878 InitVal = State->getSVal(BMI->
getInit(), stackFrame);
882 evalBind(Tmp, Init, Pred, FieldLoc, InitVal,
true, &PP);
895 for (
const auto I : Tmp) {
924 llvm_unreachable(
"Unexpected dtor kind.");
939 if (Opts.MayInlineCXXAllocator)
961 const MemRegion *ValueRegion = state->getSVal(Region).getAsRegion();
970 varType = cast<TypedValueRegion>(Region)->getValueType();
981 false, Pred, Dst, CallOpts);
992 SVal ArgVal = State->getSVal(Arg, LCtx);
996 if (State->isNull(ArgVal).isConstrainedTrue()) {
1003 Bldr.generateNode(PP, Pred->
getState(), Pred);
1016 DTy = AT->getElementType();
1028 const auto *CurDtor = cast<CXXDestructorDecl>(LCtx->
getDecl());
1041 true, Pred, Dst, CallOpts);
1051 const auto *CurDtor = cast<CXXDestructorDecl>(LCtx->
getDecl());
1052 Loc ThisStorageLoc =
1054 Loc ThisLoc = State->getSVal(ThisStorageLoc).castAs<
Loc>();
1055 SVal FieldVal = State->getLValue(Member, ThisLoc);
1061 FieldVal = makeZeroElementRegion(State, FieldVal, T,
1065 false, Pred, Dst, CallOpts);
1089 if (isDestructorElided(State, BTE, LC)) {
1090 State = cleanupElidedDestructor(State, BTE, LC);
1106 assert(CleanDtorState.
size() <= 1);
1108 CleanDtorState.
empty() ? Pred : *CleanDtorState.
begin();
1117 T = AT->getElementType();
1126 false, CleanPred, Dst, CallOpts);
1168 State = addObjectUnderConstruction(State, BTE, LC,
UnknownVal());
1176 class CollectReachableSymbolsCallback final :
public SymbolVisitor {
1184 bool VisitSymbol(
SymbolRef Sym)
override {
1185 Symbols.insert(Sym);
1190 const CollectReachableSymbolsCallback &Scanner =
1191 State->scanReachableSymbols<CollectReachableSymbolsCallback>(
V);
1193 State, Scanner.getSymbols(),
nullptr, K,
nullptr);
1203 assert(!isa<Expr>(S) || S == cast<Expr>(S)->IgnoreParens());
1207 case Expr::ObjCIndirectCopyRestoreExprClass:
1208 case Stmt::CXXDependentScopeMemberExprClass:
1209 case Stmt::CXXInheritedCtorInitExprClass:
1210 case Stmt::CXXTryStmtClass:
1211 case Stmt::CXXTypeidExprClass:
1212 case Stmt::CXXUuidofExprClass:
1213 case Stmt::CXXFoldExprClass:
1214 case Stmt::MSPropertyRefExprClass:
1215 case Stmt::MSPropertySubscriptExprClass:
1216 case Stmt::CXXUnresolvedConstructExprClass:
1217 case Stmt::DependentScopeDeclRefExprClass:
1218 case Stmt::ArrayTypeTraitExprClass:
1219 case Stmt::ExpressionTraitExprClass:
1220 case Stmt::UnresolvedLookupExprClass:
1221 case Stmt::UnresolvedMemberExprClass:
1222 case Stmt::TypoExprClass:
1223 case Stmt::CXXNoexceptExprClass:
1224 case Stmt::PackExpansionExprClass:
1225 case Stmt::SubstNonTypeTemplateParmPackExprClass:
1226 case Stmt::FunctionParmPackExprClass:
1227 case Stmt::CoroutineBodyStmtClass:
1228 case Stmt::CoawaitExprClass:
1229 case Stmt::DependentCoawaitExprClass:
1230 case Stmt::CoreturnStmtClass:
1231 case Stmt::CoyieldExprClass:
1232 case Stmt::SEHTryStmtClass:
1233 case Stmt::SEHExceptStmtClass:
1234 case Stmt::SEHLeaveStmtClass:
1235 case Stmt::SEHFinallyStmtClass:
1236 case Stmt::OMPParallelDirectiveClass:
1237 case Stmt::OMPSimdDirectiveClass:
1238 case Stmt::OMPForDirectiveClass:
1239 case Stmt::OMPForSimdDirectiveClass:
1240 case Stmt::OMPSectionsDirectiveClass:
1241 case Stmt::OMPSectionDirectiveClass:
1242 case Stmt::OMPSingleDirectiveClass:
1243 case Stmt::OMPMasterDirectiveClass:
1244 case Stmt::OMPCriticalDirectiveClass:
1245 case Stmt::OMPParallelForDirectiveClass:
1246 case Stmt::OMPParallelForSimdDirectiveClass:
1247 case Stmt::OMPParallelSectionsDirectiveClass:
1248 case Stmt::OMPTaskDirectiveClass:
1249 case Stmt::OMPTaskyieldDirectiveClass:
1250 case Stmt::OMPBarrierDirectiveClass:
1251 case Stmt::OMPTaskwaitDirectiveClass:
1252 case Stmt::OMPTaskgroupDirectiveClass:
1253 case Stmt::OMPFlushDirectiveClass:
1254 case Stmt::OMPOrderedDirectiveClass:
1255 case Stmt::OMPAtomicDirectiveClass:
1256 case Stmt::OMPTargetDirectiveClass:
1257 case Stmt::OMPTargetDataDirectiveClass:
1258 case Stmt::OMPTargetEnterDataDirectiveClass:
1259 case Stmt::OMPTargetExitDataDirectiveClass:
1260 case Stmt::OMPTargetParallelDirectiveClass:
1261 case Stmt::OMPTargetParallelForDirectiveClass:
1262 case Stmt::OMPTargetUpdateDirectiveClass:
1263 case Stmt::OMPTeamsDirectiveClass:
1264 case Stmt::OMPCancellationPointDirectiveClass:
1265 case Stmt::OMPCancelDirectiveClass:
1266 case Stmt::OMPTaskLoopDirectiveClass:
1267 case Stmt::OMPTaskLoopSimdDirectiveClass:
1268 case Stmt::OMPMasterTaskLoopDirectiveClass:
1269 case Stmt::OMPMasterTaskLoopSimdDirectiveClass:
1270 case Stmt::OMPParallelMasterTaskLoopDirectiveClass:
1271 case Stmt::OMPDistributeDirectiveClass:
1272 case Stmt::OMPDistributeParallelForDirectiveClass:
1273 case Stmt::OMPDistributeParallelForSimdDirectiveClass:
1274 case Stmt::OMPDistributeSimdDirectiveClass:
1275 case Stmt::OMPTargetParallelForSimdDirectiveClass:
1276 case Stmt::OMPTargetSimdDirectiveClass:
1277 case Stmt::OMPTeamsDistributeDirectiveClass:
1278 case Stmt::OMPTeamsDistributeSimdDirectiveClass:
1279 case Stmt::OMPTeamsDistributeParallelForSimdDirectiveClass:
1280 case Stmt::OMPTeamsDistributeParallelForDirectiveClass:
1281 case Stmt::OMPTargetTeamsDirectiveClass:
1282 case Stmt::OMPTargetTeamsDistributeDirectiveClass:
1283 case Stmt::OMPTargetTeamsDistributeParallelForDirectiveClass:
1284 case Stmt::OMPTargetTeamsDistributeParallelForSimdDirectiveClass:
1285 case Stmt::OMPTargetTeamsDistributeSimdDirectiveClass:
1286 case Stmt::CapturedStmtClass: {
1288 Engine.addAbortedBlock(node, currBldrCtx->getBlock());
1292 case Stmt::ParenExprClass:
1293 llvm_unreachable(
"ParenExprs already handled.");
1294 case Stmt::GenericSelectionExprClass:
1295 llvm_unreachable(
"GenericSelectionExprs already handled.");
1298 case Stmt::BreakStmtClass:
1299 case Stmt::CaseStmtClass:
1300 case Stmt::CompoundStmtClass:
1301 case Stmt::ContinueStmtClass:
1302 case Stmt::CXXForRangeStmtClass:
1303 case Stmt::DefaultStmtClass:
1304 case Stmt::DoStmtClass:
1305 case Stmt::ForStmtClass:
1306 case Stmt::GotoStmtClass:
1307 case Stmt::IfStmtClass:
1308 case Stmt::IndirectGotoStmtClass:
1309 case Stmt::LabelStmtClass:
1311 case Stmt::NullStmtClass:
1312 case Stmt::SwitchStmtClass:
1313 case Stmt::WhileStmtClass:
1314 case Expr::MSDependentExistsStmtClass:
1315 llvm_unreachable(
"Stmt should not be in analyzer evaluation loop");
1317 case Stmt::ObjCSubscriptRefExprClass:
1318 case Stmt::ObjCPropertyRefExprClass:
1319 llvm_unreachable(
"These are handled by PseudoObjectExpr");
1321 case Stmt::GNUNullExprClass: {
1325 svalBuilder.makeIntValWithPtrWidth(0,
false));
1330 case Stmt::ObjCAtSynchronizedStmtClass:
1336 case Expr::ConstantExprClass:
1337 case Stmt::ExprWithCleanupsClass:
1341 case Stmt::CXXBindTemporaryExprClass: {
1353 case Stmt::DesignatedInitExprClass:
1354 case Stmt::DesignatedInitUpdateExprClass:
1355 case Stmt::ArrayInitLoopExprClass:
1356 case Stmt::ArrayInitIndexExprClass:
1357 case Stmt::ExtVectorElementExprClass:
1358 case Stmt::ImaginaryLiteralClass:
1359 case Stmt::ObjCAtCatchStmtClass:
1360 case Stmt::ObjCAtFinallyStmtClass:
1361 case Stmt::ObjCAtTryStmtClass:
1362 case Stmt::ObjCAutoreleasePoolStmtClass:
1363 case Stmt::ObjCEncodeExprClass:
1364 case Stmt::ObjCIsaExprClass:
1365 case Stmt::ObjCProtocolExprClass:
1366 case Stmt::ObjCSelectorExprClass:
1367 case Stmt::ParenListExprClass:
1368 case Stmt::ShuffleVectorExprClass:
1369 case Stmt::ConvertVectorExprClass:
1370 case Stmt::VAArgExprClass:
1371 case Stmt::CUDAKernelCallExprClass:
1372 case Stmt::OpaqueValueExprClass:
1373 case Stmt::AsTypeExprClass:
1374 case Stmt::ConceptSpecializationExprClass:
1375 case Stmt::CXXRewrittenBinaryOperatorClass:
1380 case Stmt::PredefinedExprClass:
1381 case Stmt::AddrLabelExprClass:
1382 case Stmt::AttributedStmtClass:
1383 case Stmt::IntegerLiteralClass:
1384 case Stmt::FixedPointLiteralClass:
1385 case Stmt::CharacterLiteralClass:
1386 case Stmt::ImplicitValueInitExprClass:
1387 case Stmt::CXXScalarValueInitExprClass:
1388 case Stmt::CXXBoolLiteralExprClass:
1389 case Stmt::ObjCBoolLiteralExprClass:
1390 case Stmt::ObjCAvailabilityCheckExprClass:
1391 case Stmt::FloatingLiteralClass:
1392 case Stmt::NoInitExprClass:
1393 case Stmt::SizeOfPackExprClass:
1394 case Stmt::StringLiteralClass:
1395 case Stmt::SourceLocExprClass:
1396 case Stmt::ObjCStringLiteralClass:
1397 case Stmt::CXXPseudoDestructorExprClass:
1398 case Stmt::SubstNonTypeTemplateParmExprClass:
1399 case Stmt::CXXNullPtrLiteralExprClass:
1400 case Stmt::OMPArraySectionExprClass:
1401 case Stmt::TypeTraitExprClass: {
1410 case Stmt::CXXDefaultArgExprClass:
1411 case Stmt::CXXDefaultInitExprClass: {
1420 if (
const auto *DefE = dyn_cast<CXXDefaultArgExpr>(S))
1421 ArgE = DefE->getExpr();
1422 else if (
const auto *DefE = dyn_cast<CXXDefaultInitExpr>(S))
1423 ArgE = DefE->getExpr();
1425 llvm_unreachable(
"unknown constant wrapper kind");
1427 bool IsTemporary =
false;
1428 if (
const auto *MTE = dyn_cast<MaterializeTemporaryExpr>(ArgE)) {
1429 ArgE = MTE->GetTemporaryExpr();
1438 for (
const auto I : PreVisit) {
1440 State = State->BindExpr(S, LCtx, *ConstantVal);
1442 State = createTemporaryRegionIfNeeded(State, LCtx,
1454 case Stmt::CXXStdInitializerListExprClass:
1455 case Expr::ObjCArrayLiteralClass:
1456 case Expr::ObjCDictionaryLiteralClass:
1457 case Expr::ObjCBoxedExprClass: {
1466 const auto *Ex = cast<Expr>(S);
1467 QualType resultType = Ex->getType();
1469 for (
const auto N : preVisit) {
1471 SVal result = svalBuilder.conjureSymbolVal(
nullptr, Ex, LCtx,
1473 currBldrCtx->blockCount());
1478 if (!(isa<ObjCBoxedExpr>(Ex) &&
1479 !cast<ObjCBoxedExpr>(Ex)->getSubExpr()
1481 for (
auto Child : Ex->children()) {
1483 SVal Val = State->getSVal(Child, LCtx);
1495 case Stmt::ArraySubscriptExprClass:
1501 case Stmt::GCCAsmStmtClass:
1507 case Stmt::MSAsmStmtClass:
1513 case Stmt::BlockExprClass:
1519 case Stmt::LambdaExprClass:
1520 if (AMgr.options.ShouldInlineLambdas) {
1526 Engine.addAbortedBlock(node, currBldrCtx->getBlock());
1530 case Stmt::BinaryOperatorClass: {
1531 const auto *B = cast<BinaryOperator>(S);
1532 if (B->isLogicalOp()) {
1538 else if (B->getOpcode() == BO_Comma) {
1542 state->getSVal(B->getRHS(),
1549 if (AMgr.options.ShouldEagerlyAssume &&
1550 (B->isRelationalOp() || B->isEqualityOp())) {
1562 case Stmt::CXXOperatorCallExprClass: {
1563 const auto *OCE = cast<CXXOperatorCallExpr>(S);
1567 const Decl *Callee = OCE->getCalleeDecl();
1568 if (
const auto *MD = dyn_cast_or_null<CXXMethodDecl>(Callee)) {
1569 if (MD->isInstance()) {
1573 createTemporaryRegionIfNeeded(State, LCtx, OCE->getArg(0));
1574 if (NewState != State) {
1587 case Stmt::CallExprClass:
1588 case Stmt::CXXMemberCallExprClass:
1589 case Stmt::UserDefinedLiteralClass:
1595 case Stmt::CXXCatchStmtClass:
1601 case Stmt::CXXTemporaryObjectExprClass:
1602 case Stmt::CXXConstructExprClass:
1608 case Stmt::CXXNewExprClass: {
1615 for (
const auto i : PreVisit)
1623 case Stmt::CXXDeleteExprClass: {
1626 const auto *CDE = cast<CXXDeleteExpr>(S);
1629 for (
const auto i : PreVisit)
1638 case Stmt::ChooseExprClass: {
1640 const auto *C = cast<ChooseExpr>(S);
1646 case Stmt::CompoundAssignOperatorClass:
1652 case Stmt::CompoundLiteralExprClass:
1658 case Stmt::BinaryConditionalOperatorClass:
1659 case Stmt::ConditionalOperatorClass: {
1661 const auto *C = cast<AbstractConditionalOperator>(S);
1667 case Stmt::CXXThisExprClass:
1673 case Stmt::DeclRefExprClass: {
1675 const auto *DE = cast<DeclRefExpr>(S);
1681 case Stmt::DeclStmtClass:
1687 case Stmt::ImplicitCastExprClass:
1688 case Stmt::CStyleCastExprClass:
1689 case Stmt::CXXStaticCastExprClass:
1690 case Stmt::CXXDynamicCastExprClass:
1691 case Stmt::CXXReinterpretCastExprClass:
1692 case Stmt::CXXConstCastExprClass:
1693 case Stmt::CXXFunctionalCastExprClass:
1694 case Stmt::BuiltinBitCastExprClass:
1695 case Stmt::ObjCBridgedCastExprClass: {
1697 const auto *C = cast<CastExpr>(S);
1699 VisitCast(C, C->getSubExpr(), Pred, dstExpr);
1707 case Expr::MaterializeTemporaryExprClass: {
1709 const auto *MTE = cast<MaterializeTemporaryExpr>(S);
1713 for (
const auto i : dstPrevisit)
1720 case Stmt::InitListExprClass:
1726 case Stmt::MemberExprClass:
1732 case Stmt::AtomicExprClass:
1738 case Stmt::ObjCIvarRefExprClass:
1744 case Stmt::ObjCForCollectionStmtClass:
1750 case Stmt::ObjCMessageExprClass:
1756 case Stmt::ObjCAtThrowStmtClass:
1757 case Stmt::CXXThrowExprClass:
1763 case Stmt::ReturnStmtClass:
1769 case Stmt::OffsetOfExprClass: {
1775 for (
const auto Node : PreVisit)
1783 case Stmt::UnaryExprOrTypeTraitExprClass:
1790 case Stmt::StmtExprClass: {
1791 const auto *SE = cast<StmtExpr>(S);
1793 if (SE->getSubStmt()->body_empty()) {
1796 &&
"Empty statement expression must have void type.");
1800 if (
const auto *LastExpr =
1801 dyn_cast<Expr>(*SE->getSubStmt()->body_rbegin())) {
1805 state->getSVal(LastExpr,
1811 case Stmt::UnaryOperatorClass: {
1813 const auto *U = cast<UnaryOperator>(S);
1814 if (AMgr.options.ShouldEagerlyAssume && (U->getOpcode() == UO_LNot)) {
1825 case Stmt::PseudoObjectExprClass: {
1828 const auto *PE = cast<PseudoObjectExpr>(S);
1829 if (
const Expr *Result = PE->getResultExpr()) {
1845 bool ExprEngine::replayWithoutInlining(
ExplodedNode *N,
1849 assert(CalleeSF && CallerSF);
1856 BeforeProcessingCall = N;
1871 if (SP->getStmt() == CE)
1876 if (!BeforeProcessingCall)
1893 ExplodedNode *NewNode = G.getNode(NewNodeLoc, NewNodeState,
false, &IsNew);
1904 NumTimesRetriedWithoutInlining++;
1915 if(AMgr.options.ShouldUnrollLoops) {
1916 unsigned maxBlockVisitOnPath = AMgr.options.maxBlockVisitOnPath;
1920 Pred, maxBlockVisitOnPath);
1921 if (NewState != Pred->
getState()) {
1936 if (BlockCount == AMgr.options.maxBlockVisitOnPath - 1 &&
1937 AMgr.options.ShouldWidenLoops) {
1940 (isa<ForStmt>(Term) || isa<WhileStmt>(Term) || isa<DoStmt>(Term))))
1951 if (BlockCount >= AMgr.options.maxBlockVisitOnPath) {
1961 (*G.roots_begin())->getLocation().getLocationContext();
1963 Engine.FunctionSummaries->markReachedMaxBlockCount(CalleeSF->
getDecl());
1969 if ((!AMgr.options.NoRetryExhausted &&
1970 replayWithoutInlining(Pred, CalleeLC)))
1972 NumMaxBlockCountReachedInInlined++;
1974 NumMaxBlockCountReached++;
1977 Engine.blocksExhausted.push_back(std::make_pair(L, Sink));
1991 const Stmt *Condition,
1995 const auto *Ex = dyn_cast<
Expr>(Condition);
1997 return UnknownVal();
2000 bool bitsInit =
false;
2002 while (
const auto *CE = dyn_cast<CastExpr>(Ex)) {
2006 return UnknownVal();
2009 if (!bitsInit || newBits < bits) {
2014 Ex = CE->getSubExpr();
2022 return UnknownVal();
2024 return state->getSVal(Ex, LCtx);
2031 if (!BO || !BO->isLogicalOp()) {
2034 Condition = BO->getRHS()->IgnoreParens();
2056 if (
const auto *Ex = dyn_cast<Expr>(Condition))
2057 Condition = Ex->IgnoreParens();
2060 if (!BO || !BO->isLogicalOp())
2064 "Other kinds of branches are handled separately!");
2075 for (; I != E; ++I) {
2080 const Stmt *LastStmt = CS->getStmt();
2084 llvm_unreachable(
"could not resolve condition");
2093 assert((!Condition || !isa<CXXBindTemporaryExpr>(Condition)) &&
2094 "CXXBindTemporaryExprs are handled by processBindTemporary.");
2097 currBldrCtx = &BldCtx;
2107 if (
const auto *Ex = dyn_cast<Expr>(Condition))
2108 Condition = Ex->IgnoreParens();
2113 "Error evaluating branch");
2119 if (CheckersOutSet.empty())
2123 for (
const auto PredI : CheckersOutSet) {
2124 if (PredI->isSink())
2128 SVal X = PrevState->getSVal(Condition, PredI->getLocationContext());
2132 if (
const auto *Ex = dyn_cast<Expr>(Condition)) {
2133 if (Ex->getType()->isIntegralOrEnumerationType()) {
2139 PredI->getLocationContext(),
2159 std::tie(StTrue, StFalse) = PrevState->assume(V);
2177 currBldrCtx =
nullptr;
2183 llvm::ImmutableSet<const VarDecl *>)
2186 NodeBuilderContext &BuilderCtx,
2188 ExplodedNodeSet &Dst,
2191 PrettyStackTraceLocationContext CrashInfo(Pred->getLocationContext());
2192 currBldrCtx = &BuilderCtx;
2196 bool initHasRun = state->contains<InitializedGlobalsSet>(VD);
2197 BranchNodeBuilder builder(Pred, Dst, BuilderCtx, DstT, DstF);
2200 state = state->add<InitializedGlobalsSet>(VD);
2203 builder.generateNode(state, initHasRun, Pred);
2204 builder.markInfeasible(!initHasRun);
2206 currBldrCtx =
nullptr;
2227 for (iterator I = builder.
begin(), E = builder.
end(); I != E; ++I) {
2228 if (I.getLabel() == L) {
2234 llvm_unreachable(
"No block with label.");
2248 for (iterator I = builder.
begin(), E = builder.
end(); I != E; ++I)
2268 State = finishArgumentConstruction(
2283 while (LC != ToLC) {
2284 assert(LC &&
"ToLC must be a parent of FromLC!");
2285 for (
auto I : State->get<ObjectsUnderConstruction>())
2286 if (I.first.getLocationContext() == LC) {
2290 assert(I.first.getItem().getKind() ==
2292 I.first.getItem().getKind() ==
2294 State = State->remove<ObjectsUnderConstruction>(I.first);
2312 assert(areAllObjectsFullyConstructed(Pred->
getState(),
2325 for (
const auto I : AfterRemovedDead)
2331 Engine.enqueueEndOfFunction(Dst, RS);
2343 if (CondV_untested.
isUndef()) {
2354 iterator I = builder.
begin(), EI = builder.
end();
2355 bool defaultIsFeasible = I == EI;
2357 for ( ; I != EI; ++I) {
2362 const CaseStmt *Case = I.getCase();
2377 std::tie(StateCase, DefaultSt) =
2378 DefaultSt->assumeInclusiveRange(*NL, V1, V2);
2380 StateCase = DefaultSt;
2388 defaultIsFeasible =
true;
2390 defaultIsFeasible =
false;
2395 if (!defaultIsFeasible)
2427 if (
const auto *VD = dyn_cast<VarDecl>(D)) {
2430 assert(Ex->
isGLValue() || VD->getType()->isVoidType());
2432 const Decl *D = LocCtxt->getDecl();
2433 const auto *MD = dyn_cast_or_null<CXXMethodDecl>(D);
2434 const auto *DeclRefEx = dyn_cast<
DeclRefExpr>(Ex);
2437 if (AMgr.options.ShouldInlineLambdas && DeclRefEx &&
2438 DeclRefEx->refersToEnclosingVariableOrCapture() && MD &&
2439 MD->getParent()->isLambda()) {
2442 llvm::DenseMap<const VarDecl *, FieldDecl *> LambdaCaptureFields;
2448 if (
const FieldDecl *FD = LambdaCaptureFields[VD]) {
2450 svalBuilder.getCXXThis(MD, LocCtxt->getStackFrame());
2451 SVal CXXThisVal = state->getSVal(CXXThis);
2452 VInfo = std::make_pair(state->getLValue(FD, CXXThisVal), FD->getType());
2457 VInfo = std::make_pair(state->getLValue(VD, LocCtxt), VD->getType());
2459 SVal V = VInfo->first;
2460 bool IsReference = VInfo->second->isReferenceType();
2465 if (
const MemRegion *R = V.getAsRegion())
2466 V = state->getSVal(R);
2471 Bldr.
generateNode(Ex, Pred, state->BindExpr(Ex, LCtx, V),
nullptr,
2475 if (
const auto *ED = dyn_cast<EnumConstantDecl>(D)) {
2477 SVal V = svalBuilder.makeIntVal(ED->getInitVal());
2478 Bldr.
generateNode(Ex, Pred, state->BindExpr(Ex, LCtx, V));
2481 if (
const auto *FD = dyn_cast<FunctionDecl>(D)) {
2482 SVal V = svalBuilder.getFunctionPointer(FD);
2483 Bldr.
generateNode(Ex, Pred, state->BindExpr(Ex, LCtx, V),
nullptr,
2487 if (isa<FieldDecl>(D) || isa<IndirectFieldDecl>(D)) {
2493 SVal V = svalBuilder.conjureSymbolVal(Ex, LCtx,
getContext().VoidPtrTy,
2494 currBldrCtx->blockCount());
2496 Bldr.
generateNode(Ex, Pred, state->BindExpr(Ex, LCtx, V),
nullptr,
2500 if (isa<BindingDecl>(D)) {
2506 llvm_unreachable(
"Support for this Decl not implemented.");
2530 for (
auto *
Node : CheckerPreStmt) {
2534 if (IsGLValueLike) {
2543 SVal V = state->getLValue(T,
2544 state->getSVal(Idx, LCtx),
2545 state->getSVal(Base, LCtx));
2548 }
else if (IsVectorType) {
2552 llvm_unreachable(
"Array subscript should be an lValue when not \ 2553 a vector and not a forbidden lvalue type");
2572 if (isa<VarDecl>(Member) || isa<EnumConstantDecl>(Member)) {
2573 for (
const auto I : CheckedSet)
2579 for (
const auto I : CheckedSet) {
2585 if (
const auto *MD = dyn_cast<CXXMethodDecl>(Member)) {
2586 if (MD->isInstance())
2587 state = createTemporaryRegionIfNeeded(state, LCtx, BaseExpr);
2589 SVal MDVal = svalBuilder.getFunctionPointer(MD);
2590 state = state->BindExpr(M, LCtx, MDVal);
2598 state = createTemporaryRegionIfNeeded(state, LCtx, BaseExpr,
2604 const auto *field = cast<FieldDecl>(Member);
2605 SVal L = state->getLValue(field, baseExprVal);
2616 if (!PE || PE->getCastKind() != CK_ArrayToPointerDecay) {
2617 llvm_unreachable(
"should always be wrapped in ArrayToPointerDecay");
2621 if (field->getType()->isReferenceType()) {
2622 if (
const MemRegion *R = L.getAsRegion())
2623 L = state->getSVal(R);
2628 Bldr.
generateNode(M, I, state->BindExpr(M, LCtx, L),
nullptr,
2652 for (
const auto I : AfterPreSet) {
2657 for (
unsigned SI = 0, Count = AE->
getNumSubExprs(); SI != Count; SI++) {
2659 SVal SubExprVal = State->getSVal(SubExpr, LCtx);
2660 ValuesToInvalidate.push_back(SubExprVal);
2663 State = State->invalidateRegions(ValuesToInvalidate, AE,
2664 currBldrCtx->blockCount(),
2670 State = State->BindExpr(AE, LCtx, ResultVal);
2695 if (
const auto *VR = dyn_cast<VarRegion>(MR->
getBaseRegion()))
2696 if (VR->hasStackParametersStorage() && VR->getStackFrame()->inTopFrame())
2697 if (
const auto *RD = VR->getValueType()->getAsCXXRecordDecl())
2698 if (!RD->hasTrivialDestructor())
2706 SVal StoredVal = State->getSVal(MR);
2707 if (StoredVal != Val)
2720 if (!Invalidated || Invalidated->empty())
2733 for (
const auto I : ExplicitRegions) {
2735 SymbolsDirectlyInvalidated.insert(R->getSymbol());
2739 for (
const auto &sym : *Invalidated) {
2740 if (SymbolsDirectlyInvalidated.count(sym))
2742 SymbolsIndirectlyInvalidated.insert(sym);
2745 if (!SymbolsDirectlyInvalidated.empty())
2750 if (!SymbolsIndirectlyInvalidated.empty())
2771 StoreE, *
this, *PP);
2786 for (
const auto PredI : CheckedSet) {
2794 state = state->bindLoc(location.
castAs<
Loc>(),
2795 Val, LC, !atDeclInit);
2800 LocReg = LocRegVal->getRegion();
2817 const Expr *LocationE,
2823 const Expr *StoreE = AssignE ? AssignE : LocationE;
2827 evalLocation(Tmp, AssignE, LocationE, Pred, state, location,
false);
2835 for (
const auto I : Tmp)
2836 evalBind(Dst, StoreE, I, location, Val,
false);
2841 const Expr *BoundEx,
2847 assert(!location.
getAs<
NonLoc>() &&
"location cannot be a NonLoc.");
2852 evalLocation(Tmp, NodeEx, BoundEx, Pred, state, location,
true);
2861 for (
const auto I : Tmp) {
2862 state = I->getState();
2869 V = state->getSVal(location.
castAs<
Loc>(), LoadTy);
2872 Bldr.
generateNode(NodeEx, I, state->BindExpr(BoundEx, LCtx, V), tag,
2879 const Stmt *BoundEx,
2908 NodeEx, BoundEx, *
this);
2912 std::pair<const ProgramPointTag *, const ProgramPointTag*>
2915 eagerlyAssumeBinOpBifurcationTrue(TagProviderName,
2916 "Eagerly Assume True"),
2917 eagerlyAssumeBinOpBifurcationFalse(TagProviderName,
2918 "Eagerly Assume False");
2919 return std::make_pair(&eagerlyAssumeBinOpBifurcationTrue,
2920 &eagerlyAssumeBinOpBifurcationFalse);
2928 for (
const auto Pred : Src) {
2940 if (SEV && SEV->isExpression()) {
2941 const std::pair<const ProgramPointTag *, const ProgramPointTag*> &tags =
2945 std::tie(StateTrue, StateFalse) = state->assume(*SEV);
2949 SVal Val = svalBuilder.makeIntVal(1U, Ex->
getType());
2956 SVal Val = svalBuilder.makeIntVal(0U, Ex->
getType());
3006 N->getState()->getStateManager().getOwningEngine()).
getBugReporter();
3008 const auto EQClasses =
3009 llvm::make_range(BR.EQClasses_begin(), BR.EQClasses_end());
3011 for (
const auto &
EQ : EQClasses) {
3012 for (
const auto &I :
EQ.getReports()) {
3013 const auto *PR = dyn_cast<PathSensitiveBugReport>(I.get());
3016 const ExplodedNode *EN = PR->getErrorNode();
3017 if (EN->getState() == N->getState() &&
3018 EN->getLocation() == N->getLocation())
3029 static bool traverseHiddenNodes(
3030 const ExplodedNode *N,
3031 llvm::function_ref<
void(
const ExplodedNode *)> PreCallback,
3032 llvm::function_ref<
void(
const ExplodedNode *)> PostCallback,
3033 llvm::function_ref<
bool(
const ExplodedNode *)> Stop) {
3039 if (N->succ_size() != 1 || !isNodeHidden(N->getFirstSucc()))
3043 N = N->getFirstSucc();
3048 static bool isNodeHidden(
const ExplodedNode *N) {
3049 return N->isTrivial();
3052 static std::string getNodeLabel(
const ExplodedNode *N, ExplodedGraph *G){
3054 llvm::raw_string_ostream Out(Buf);
3056 const bool IsDot =
true;
3057 const unsigned int Space = 1;
3060 Out <<
"{ \"state_id\": " << State->getID()
3063 Indent(Out, Space, IsDot) <<
"\"program_points\": [\\l";
3066 traverseHiddenNodes(
3068 [&](
const ExplodedNode *OtherNode) {
3069 Indent(Out, Space + 1, IsDot) <<
"{ ";
3070 OtherNode->getLocation().printJson(Out,
"\\l");
3071 Out <<
", \"tag\": ";
3073 Out <<
'\"' << Tag->getTagDescription() <<
"\"";
3076 Out <<
", \"node_id\": " << OtherNode->getID() <<
3077 ", \"is_sink\": " << OtherNode->isSink() <<
3081 [&](
const ExplodedNode *) { Out <<
",\\l"; },
3082 [&](
const ExplodedNode *) {
return false; });
3085 Indent(Out, Space, IsDot) <<
"],\\l";
3087 State->printDOT(Out, N->getLocationContext(), Space);
3100 llvm::DisplayGraph(Filename,
false, llvm::GraphProgram::DOT);
3102 llvm::errs() <<
"Warning: viewing graph requires assertions" <<
"\n";
3109 llvm::DisplayGraph(Filename,
false, llvm::GraphProgram::DOT);
3111 llvm::errs() <<
"Warning: viewing graph requires assertions" <<
"\n";
3117 std::vector<const ExplodedNode *> Src;
3121 EI = BR.EQClasses_begin(), EE = BR.EQClasses_end(); EI != EE; ++EI) {
3123 dyn_cast<PathSensitiveBugReport>(EI->getReports()[0].get());
3126 const auto *N =
const_cast<ExplodedNode *
>(R->getErrorNode());
3131 return llvm::WriteGraph(&G,
"ExprEngine",
false,
3132 "Exploded Graph", Filename);
3135 llvm::errs() <<
"Warning: dumping graph requires assertions" <<
"\n";
3140 StringRef Filename) {
3142 std::unique_ptr<ExplodedGraph> TrimmedG(G.trim(Nodes));
3144 if (!TrimmedG.get()) {
3145 llvm::errs() <<
"warning: Trimmed ExplodedGraph is empty.\n";
3147 return llvm::WriteGraph(TrimmedG.get(),
"TrimmedExprEngine",
3149 "Trimmed Exploded Graph",
3153 llvm::errs() <<
"Warning: dumping graph requires assertions" <<
"\n";
3158 static int index = 0;
void processEndWorklist() override
Called by CoreEngine when the analysis worklist has terminated.
bool isBaseInitializer() const
Determine whether this initializer is initializing a base class.
Defines the clang::ASTContext interface.
Represents C++ allocator call.
This represents a GCC inline-assembly statement extension.
TypedValueRegion - An abstract class representing regions having a typed value.
ProgramStateRef processRegionChange(ProgramStateRef state, const MemRegion *MR, const LocationContext *LCtx)
Expr * getInit() const
Get the initializer.
void VisitArraySubscriptExpr(const ArraySubscriptExpr *Ex, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitArraySubscriptExpr - Transfer function for array accesses.
void ProcessInitializer(const CFGInitializer I, ExplodedNode *Pred)
SVal evalDerivedToBase(SVal Derived, const CastExpr *Cast)
Evaluates a chain of derived-to-base casts through the path specified in Cast.
A (possibly-)qualified type.
MemRegion - The root abstract class for all memory regions.
void markLive(SymbolRef sym)
Unconditionally marks a symbol as live.
bool isMemberPointerType() const
ValueDecl * getMemberDecl() const
Retrieve the member declaration to which this expression refers.
void markInfeasible(bool branch)
const Expr * skipRValueSubobjectAdjustments(SmallVectorImpl< const Expr *> &CommaLHS, SmallVectorImpl< SubobjectAdjustment > &Adjustments) const
Walk outwards from an expression we want to bind a reference to and find the expression whose lifetim...
const Stmt * getStmt() const
bool IsTemporaryCtorOrDtor
This call is a constructor or a destructor of a temporary value.
bool operator==(CanQual< T > x, CanQual< U > y)
static bool nodeHasBugReport(const ExplodedNode *N)
bool isCForbiddenLValueType() const
Determine whether expressions of the given type are forbidden from being lvalues in C...
unsigned blockCount() const
Returns the number of times the current basic block has been visited on the exploded graph path...
Specialize PointerLikeTypeTraits to allow LazyGenerationalUpdatePtr to be placed into a PointerUnion...
void VisitCallExpr(const CallExpr *CE, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitCall - Transfer function for function calls.
Stmt - This represents one statement.
Information about invalidation for a particular region/symbol.
This builder class is useful for generating nodes that resulted from visiting a statement.
void VisitCXXBindTemporaryExpr(const CXXBindTemporaryExpr *BTE, ExplodedNodeSet &PreVisit, ExplodedNodeSet &Dst)
C Language Family Type Representation.
Defines the SourceManager interface.
static bool nodeHasBugReport(const ExplodedNode *N)
static const Stmt * getRightmostLeaf(const Stmt *Condition)
void VisitMSAsmStmt(const MSAsmStmt *A, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitMSAsmStmt - Transfer function logic for MS inline asm.
Decl - This represents one declaration (or definition), e.g.
Represents a point when we begin processing an inlined call.
Defines the PrettyStackTraceEntry class, which is used to make crashes give more contextual informati...
FunctionDecl * getOperatorNew() const
bool isVirtual() const
Determines whether the base class is a virtual base class (or not).
IntrusiveRefCntPtr< const ProgramState > ProgramStateRef
ExprEngine(cross_tu::CrossTranslationUnitContext &CTU, AnalysisManager &mgr, SetOfConstDecls *VisitedCalleesIn, FunctionSummariesTy *FS, InliningModes HowToInlineIn)
const CastExpr * BasePath
SVal evalBinOp(ProgramStateRef state, BinaryOperator::Opcode op, NonLoc L, NonLoc R, QualType T)
void processBranch(const Stmt *Condition, NodeBuilderContext &BuilderCtx, ExplodedNode *Pred, ExplodedNodeSet &Dst, const CFGBlock *DstT, const CFGBlock *DstF) override
ProcessBranch - Called by CoreEngine.
The pointer has been passed to a function indirectly.
void ViewGraph(bool trim=false)
Visualize the ExplodedGraph created by executing the simulation.
void processCleanupTemporaryBranch(const CXXBindTemporaryExpr *BTE, NodeBuilderContext &BldCtx, ExplodedNode *Pred, ExplodedNodeSet &Dst, const CFGBlock *DstT, const CFGBlock *DstF) override
Called by CoreEngine.
Represents C++ object destructor generated from a call to delete.
Represents an array type, per C99 6.7.5.2 - Array Declarators.
Hints for figuring out of a call should be inlined during evalCall().
Represents a program point just before an implicit call event.
bool IsArrayCtorOrDtor
This call is a constructor or a destructor for a single element within an array, a part of array cons...
void ProcessMemberDtor(const CFGMemberDtor D, ExplodedNode *Pred, ExplodedNodeSet &Dst)
StorageDuration
The storage duration for an object (per C++ [basic.stc]).
void runCheckersForPrintStateJson(raw_ostream &Out, ProgramStateRef State, const char *NL="\, unsigned int Space=0, bool IsDot=false) const
Run checkers for debug-printing a ProgramState.
T castAs() const
Convert to the specified CFGElement type, asserting that this CFGElement is of the desired type...
const ProgramStateRef & getState() const
DOTGraphTraits(bool isSimple=false)
void processCFGBlockEntrance(const BlockEdge &L, NodeBuilderWithSinks &nodeBuilder, ExplodedNode *Pred) override
Called by CoreEngine when processing the entrance of a CFGBlock.
Represents a point when we exit a loop.
ProgramStateRef getInitialState(const LocationContext *InitLoc) override
getInitialState - Return the initial state used for the root vertex in the ExplodedGraph.
const CXXDestructorDecl * getDestructorDecl(ASTContext &astContext) const
static void printObjectsUnderConstructionJson(raw_ostream &Out, ProgramStateRef State, const char *NL, const LocationContext *LCtx, unsigned int Space=0, bool IsDot=false)
bool isIndirectMemberInitializer() const
bool isConsumedExpr(Expr *E) const
void VisitUnaryOperator(const UnaryOperator *B, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitUnaryOperator - Transfer function logic for unary operators.
void takeNodes(const ExplodedNodeSet &S)
Represents a variable declaration or definition.
ProgramStateRef notifyCheckersOfPointerEscape(ProgramStateRef State, const InvalidatedSymbols *Invalidated, ArrayRef< const MemRegion *> ExplicitRegions, const CallEvent *Call, RegionAndSymbolInvalidationTraits &ITraits) override
Call PointerEscape callback when a value escapes as a result of region invalidation.
ASTContext & getASTContext() const
REGISTER_TRAIT_WITH_PROGRAMSTATE(ObjectsUnderConstruction, ObjectsUnderConstructionMap) static const char *TagProviderName
const T * getAs() const
Member-template getAs<specific type>'.
void ProcessDeleteDtor(const CFGDeleteDtor D, ExplodedNode *Pred, ExplodedNodeSet &Dst)
loc::MemRegionVal getCXXThis(const CXXMethodDecl *D, const StackFrameContext *SFC)
Return a memory region for the 'this' object reference.
static Optional< SVal > getObjectUnderConstruction(ProgramStateRef State, const ConstructionContextItem &Item, const LocationContext *LC)
By looking at a certain item that may be potentially part of an object's ConstructionContext, retrieve such object's location.
void evalStore(ExplodedNodeSet &Dst, const Expr *AssignE, const Expr *StoreE, ExplodedNode *Pred, ProgramStateRef St, SVal TargetLV, SVal Val, const ProgramPointTag *tag=nullptr)
evalStore - Handle the semantics of a store via an assignment.
bool isUnrolledState(ProgramStateRef State)
Returns if the given State indicates that is inside a completely unrolled loop.
const ElementRegion * GetElementZeroRegion(const SubRegion *R, QualType T)
void enqueue(ExplodedNodeSet &Set)
Enqueue the given set of nodes onto the work list.
const internal::VariadicDynCastAllOfMatcher< Decl, VarDecl > varDecl
Matches variable declarations.
const Stmt * getTriggerStmt() const
Describes how types, statements, expressions, and declarations should be printed. ...
Defines the Objective-C statement AST node classes.
void removeDead(ExplodedNode *Node, ExplodedNodeSet &Out, const Stmt *ReferenceStmt, const LocationContext *LC, const Stmt *DiagnosticStmt=nullptr, ProgramPoint::Kind K=ProgramPoint::PreStmtPurgeDeadSymbolsKind)
Run the analyzer's garbage collection - remove dead symbols and bindings from the state...
ProgramStateRef removeDeadBindings(ProgramStateRef St, const StackFrameContext *LCtx, SymbolReaper &SymReaper)
Represents a parameter to a function.
Defines the clang::Expr interface and subclasses for C++ expressions.
void VisitCXXThisExpr(const CXXThisExpr *TE, ExplodedNode *Pred, ExplodedNodeSet &Dst)
BoundNodesTreeBuilder Nodes
static bool shouldRemoveDeadBindings(AnalysisManager &AMgr, const Stmt *S, const ExplodedNode *Pred, const LocationContext *LC)
void ProcessTemporaryDtor(const CFGTemporaryDtor D, ExplodedNode *Pred, ExplodedNodeSet &Dst)
void ProcessLoopExit(const Stmt *S, ExplodedNode *Pred)
void runCheckersForLocation(ExplodedNodeSet &Dst, const ExplodedNodeSet &Src, SVal location, bool isLoad, const Stmt *NodeEx, const Stmt *BoundEx, ExprEngine &Eng)
Run checkers for load/store of a location.
bool haveEqualEnvironments(ProgramStateRef S1, ProgramStateRef S2) const
ProgramStateRef runCheckersForPointerEscape(ProgramStateRef State, const InvalidatedSymbols &Escaped, const CallEvent *Call, PointerEscapeKind Kind, RegionAndSymbolInvalidationTraits *ITraits)
Run checkers when pointers escape.
One of these records is kept for each identifier that is lexed.
A pointer escapes due to binding its value to a location that the analyzer cannot track...
Holds long-lived AST nodes (such as types and decls) that can be referred to throughout the semantic ...
void runCheckersForLiveSymbols(ProgramStateRef state, SymbolReaper &SymReaper)
Run checkers for live symbols.
void printJson(raw_ostream &Out, PrinterHelper *Helper, const PrintingPolicy &Policy, bool AddQuotes) const
Pretty-prints in JSON format.
SourceLocation getBeginLoc() const LLVM_READONLY
Represents a member of a struct/union/class.
Represents a program point after a store evaluation.
Represents C++ object destructor implicitly generated for automatic object or temporary bound to cons...
bool haveEqualStores(ProgramStateRef S1, ProgramStateRef S2) const
ProgramStateRef processLoopEnd(const Stmt *LoopStmt, ProgramStateRef State)
Updates the given ProgramState.
bool isReferenceType() const
void ProcessImplicitDtor(const CFGImplicitDtor D, ExplodedNode *Pred)
bool isAllEnumCasesCovered() const
Returns true if the SwitchStmt is a switch of an enum value and all cases have been explicitly covere...
void addPredecessor(ExplodedNode *V, ExplodedGraph &G)
addPredeccessor - Adds a predecessor to the current node, and in tandem add this node as a successor ...
i32 captured_struct **param SharedsTy A type which contains references the shared variables *param Shareds Context with the list of shared variables from the p *TaskFunction *param Data Additional data for task generation like final * state
const StackFrameContext * getStackFrame() const
bool isIntegralOrEnumerationType() const
Determine whether this type is an integral or enumeration type.
void enableNodeReclamation(unsigned Interval)
Enable tracking of recently allocated nodes for potential reclamation when calling reclaimRecentlyAll...
ProgramStateRef processPointerEscapedOnBind(ProgramStateRef State, SVal Loc, SVal Val, const LocationContext *LCtx) override
Call PointerEscape callback when a value escapes as a result of bind.
static bool isLocType(QualType T)
void VisitOffsetOfExpr(const OffsetOfExpr *Ex, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitOffsetOfExpr - Transfer function for offsetof.
This is a meta program point, which should be skipped by all the diagnostic reasoning etc...
ProgramStateRef updateLoopStack(const Stmt *LoopStmt, ASTContext &ASTCtx, ExplodedNode *Pred, unsigned maxVisitOnPath)
Updates the stack of loops contained by the ProgramState.
ExplodedNode * generateSink(const Stmt *S, ExplodedNode *Pred, ProgramStateRef St, const ProgramPointTag *tag=nullptr, ProgramPoint::Kind K=ProgramPoint::PostStmtKind)
SourceLocation getBeginLoc() const LLVM_READONLY
Forward-declares and imports various common LLVM datatypes that clang wants to use unqualified...
STATISTIC(NumRemoveDeadBindings, "The # of times RemoveDeadBindings is called")
const LocationContext * getLocationContext() const
ExplodedNode * generateCaseStmtNode(const iterator &I, ProgramStateRef State)
virtual bool inTopFrame() const
Return true if the current LocationContext has no caller context.
const clang::PrintingPolicy & getPrintingPolicy() const
static bool isRecordType(QualType T)
const LocationContext * getParent() const
A builtin binary operation expression such as "x + y" or "x <= y".
If a crash happens while one of these objects are live, the message is printed out along with the spe...
void VisitReturnStmt(const ReturnStmt *R, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitReturnStmt - Transfer function logic for return statements.
const VarDecl * getVarDecl() const
CaseStmt - Represent a case statement.
const CXXBaseSpecifier * getBaseSpecifier() const
bool isAnyMemberInitializer() const
An adjustment to be made to the temporary created when emitting a reference binding, which accesses a particular subobject of that temporary.
void ProcessNewAllocator(const CXXNewExpr *NE, ExplodedNode *Pred)
void ProcessAutomaticObjDtor(const CFGAutomaticObjDtor D, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Represents binding an expression to a temporary.
virtual SVal getLValueField(const FieldDecl *D, SVal Base)
FieldDecl * getAnyMember() const
void VisitDeclStmt(const DeclStmt *DS, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitDeclStmt - Transfer function logic for DeclStmts.
CXXDestructorDecl * getDestructor() const
Returns the destructor decl for this class.
FieldDecl * getMember() const
If this is a member initializer, returns the declaration of the non-static data member being initiali...
void runCheckersForEndFunction(NodeBuilderContext &BC, ExplodedNodeSet &Dst, ExplodedNode *Pred, ExprEngine &Eng, const ReturnStmt *RS)
Run checkers on end of function.
void processStaticInitializer(const DeclStmt *DS, NodeBuilderContext &BuilderCtx, ExplodedNode *Pred, ExplodedNodeSet &Dst, const CFGBlock *DstT, const CFGBlock *DstF) override
Called by CoreEngine.
const CFGBlock * getCallSiteBlock() const
void evalBind(ExplodedNodeSet &Dst, const Stmt *StoreE, ExplodedNode *Pred, SVal location, SVal Val, bool atDeclInit=false, const ProgramPoint *PP=nullptr)
evalBind - Handle the semantics of binding a value to a specific location.
CheckerManager & getCheckerManager() const
void VisitLogicalExpr(const BinaryOperator *B, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitLogicalExpr - Transfer function logic for '&&', '||'.
CXXCtorInitializer * getInitializer() const
void removeDeadOnEndOfFunction(NodeBuilderContext &BC, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Remove dead bindings/symbols before exiting a function.
void runCheckersForBind(ExplodedNodeSet &Dst, const ExplodedNodeSet &Src, SVal location, SVal val, const Stmt *S, ExprEngine &Eng, const ProgramPoint &PP)
Run checkers for binding of a value to a location.
CXXRecordDecl * getAsCXXRecordDecl() const
Retrieves the CXXRecordDecl that this type refers to, either because the type is a RecordType or beca...
const FieldDecl * getFieldDecl() const
const Stmt * getCallSite() const
void VisitCXXCatchStmt(const CXXCatchStmt *CS, ExplodedNode *Pred, ExplodedNodeSet &Dst)
bool isDelegatingInitializer() const
Determine whether this initializer is creating a delegating constructor.
const CXXBindTemporaryExpr * getBindTemporaryExpr() const
Represents a single basic block in a source-level CFG.
void VisitInitListExpr(const InitListExpr *E, ExplodedNode *Pred, ExplodedNodeSet &Dst)
llvm::APSInt EvaluateKnownConstInt(const ASTContext &Ctx, SmallVectorImpl< PartialDiagnosticAt > *Diag=nullptr) const
EvaluateKnownConstInt - Call EvaluateAsRValue and return the folded integer.
InliningModes
The modes of inlining, which override the default analysis-wide settings.
SymbolicRegion - A special, "non-concrete" region.
void runCheckersForPostStmt(ExplodedNodeSet &Dst, const ExplodedNodeSet &Src, const Stmt *S, ExprEngine &Eng, bool wasInlined=false)
Run checkers for post-visiting Stmts.
static unsigned getNumSubExprs(AtomicOp Op)
Determine the number of arguments the specified atomic builtin should have.
void ProcessBaseDtor(const CFGBaseDtor D, ExplodedNode *Pred, ExplodedNodeSet &Dst)
DefinedOrUnknownSVal makeZeroVal(QualType type)
Construct an SVal representing '0' for the specified type.
void processSwitch(SwitchNodeBuilder &builder) override
ProcessSwitch - Called by CoreEngine.
void processBeginOfFunction(NodeBuilderContext &BC, ExplodedNode *Pred, ExplodedNodeSet &Dst, const BlockEdge &L) override
Called by CoreEngine.
Represent the declaration of a variable (in which case it is an lvalue) a function (in which case it ...
This represents one expression.
Defines the clang::LangOptions interface.
void VisitLvalObjCIvarRefExpr(const ObjCIvarRefExpr *DR, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Transfer function logic for computing the lvalue of an Objective-C ivar.
void VisitCXXNewExpr(const CXXNewExpr *CNE, ExplodedNode *Pred, ExplodedNodeSet &Dst)
void VisitCXXNewAllocatorCall(const CXXNewExpr *CNE, ExplodedNode *Pred, ExplodedNodeSet &Dst)
const Expr * getCondition() const
CallEventRef getCaller(const StackFrameContext *CalleeCtx, ProgramStateRef State)
Gets an outside caller given a callee context.
void VisitCast(const CastExpr *CastE, const Expr *Ex, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitCast - Transfer function logic for all casts (implicit and explicit).
Represents a C++ destructor within a class.
const internal::VariadicAllOfMatcher< Decl > decl
Matches declarations.
This is the simplest builder which generates nodes in the ExplodedGraph.
void Add(ExplodedNode *N)
The pointer has been passed to a function call directly.
QualType getConditionType() const
const LocationContext * getLocationContext() const
bool inTopFrame() const override
Return true if the current LocationContext has no caller context.
void Visit(const Stmt *S, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Visit - Transfer function logic for all statements.
Defines the clang::IdentifierInfo, clang::IdentifierTable, and clang::Selector interfaces.
static std::pair< const ProgramPointTag *, const ProgramPointTag * > geteagerlyAssumeBinOpBifurcationTags()
The reason for pointer escape is unknown.
ASTContext & getContext() const
getContext - Return the ASTContext associated with this analysis.
Traits for storing the call processing policy inside GDM.
DeclContext * getParent()
getParent - Returns the containing DeclContext.
ReturnStmt - This represents a return, optionally of an expression: return; return 4;...
void VisitAtomicExpr(const AtomicExpr *E, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitAtomicExpr - Transfer function for builtin atomic expressions.
This represents a Microsoft inline-assembly statement extension.
const SwitchStmt * getSwitch() const
void evalLoad(ExplodedNodeSet &Dst, const Expr *NodeEx, const Expr *BoundExpr, ExplodedNode *Pred, ProgramStateRef St, SVal location, const ProgramPointTag *tag=nullptr, QualType LoadTy=QualType())
Simulate a read of the result of Ex.
Represents C++ object destructor implicitly generated for base object in destructor.
QualType getDestroyedType() const
Retrieve the type being destroyed.
const Expr * getSubExpr() const
bool isNull() const
Return true if this QualType doesn't point to a type yet.
reverse_iterator rbegin()
virtual ProgramStateRef removeDeadBindings(ProgramStateRef state, SymbolReaper &SymReaper)=0
Scan all symbols referenced by the constraints.
Optional< T > getAs() const
Convert to the specified SVal type, returning None if this SVal is not of the desired type...
ExplodedNode * generateNode(const iterator &I, ProgramStateRef State, bool isSink=false)
While alive, includes the current analysis stack in a crash trace.
void processEndOfFunction(NodeBuilderContext &BC, ExplodedNode *Pred, const ReturnStmt *RS=nullptr) override
Called by CoreEngine.
static const Stmt * ResolveCondition(const Stmt *Condition, const CFGBlock *B)
void processCFGElement(const CFGElement E, ExplodedNode *Pred, unsigned StmtIdx, NodeBuilderContext *Ctx) override
processCFGElement - Called by CoreEngine.
ProgramStateRef getInitialState(const LocationContext *InitLoc)
const LocationContext * getLocationContext() const
const Stmt * getStmt() const
void VisitGuardedExpr(const Expr *Ex, const Expr *L, const Expr *R, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitGuardedExpr - Transfer function logic for ?, __builtin_choose.
void printJson(raw_ostream &Out, ProgramStateRef State, const LocationContext *LCtx, const char *NL, unsigned int Space, bool IsDot) const override
printJson - Called by ProgramStateManager to print checker-specific data.
DefinedOrUnknownSVal conjureSymbolVal(const void *symbolTag, const Expr *expr, const LocationContext *LCtx, unsigned count)
Create a new symbol with a unique 'name'.
ProgramStateRef getWidenedLoopState(ProgramStateRef PrevState, const LocationContext *LCtx, unsigned BlockCount, const Stmt *LoopStmt)
Get the states that result from widening the loop.
A helper class that allows the use of isa/cast/dyncast to detect TagType objects of enums...
void runCheckersForBranchCondition(const Stmt *condition, ExplodedNodeSet &Dst, ExplodedNode *Pred, ExprEngine &Eng)
Run checkers for branch condition.
T castAs() const
Convert to the specified ProgramPoint type, asserting that this ProgramPoint is of the desired type...
static bool isCallStmt(const Stmt *S)
Returns true if this is a statement is a function or method call of some kind.
DOTGraphTraits(bool isSimple=false)
ProgramPoints can be "tagged" as representing points specific to a given analysis entity...
AnalysisManager & getAnalysisManager() override
std::string getNameAsString() const
Get a human-readable name for the declaration, even if it is one of the special kinds of names (C++ c...
void evalEagerlyAssumeBinOpBifurcation(ExplodedNodeSet &Dst, ExplodedNodeSet &Src, const Expr *Ex)
evalEagerlyAssumeBinOpBifurcation - Given the nodes in 'Src', eagerly assume symbolic expressions of ...
const MemRegion * getAsRegion() const
Represents a new-expression for memory allocation and constructor calls, e.g: "new CXXNewExpr(foo)"...
SourceLocation getBeginLoc() const
CallEventManager & getCallEventManager()
DeclStmt - Adaptor class for mixing declarations with statements and expressions. ...
void VisitCompoundLiteralExpr(const CompoundLiteralExpr *CL, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitCompoundLiteralExpr - Transfer function logic for compound literals.
Represents the declaration of a label.
ExplodedNode * generateNode(ProgramStateRef State, ExplodedNode *Pred, const ProgramPointTag *Tag=nullptr)
void processIndirectGoto(IndirectGotoNodeBuilder &builder) override
processIndirectGoto - Called by CoreEngine.
QualType getBaseElementType(const ArrayType *VAT) const
Return the innermost element type of an array type.
const CXXTempObjectRegion * getCXXTempObjectRegion(Expr const *Ex, LocationContext const *LC)
void VisitCXXDeleteExpr(const CXXDeleteExpr *CDE, ExplodedNode *Pred, ExplodedNodeSet &Dst)
ProgramPoint getLocation() const
getLocation - Returns the edge associated with the given node.
SVal - This represents a symbolic expression, which can be either an L-value or an R-value...
int64_t getID(const ASTContext &Context) const
const ArrayType * getAsArrayType(QualType T) const
Type Query functions.
AtomicExpr - Variadic atomic builtins: __atomic_exchange, __atomic_fetch_*, __atomic_load, __atomic_store, and __atomic_compare_exchange_*, for the similarly-named C++11 instructions, and __c11 variants for <stdatomic.h>, and corresponding __opencl_atomic_* for OpenCL 2.0.
void VisitUnaryExprOrTypeTraitExpr(const UnaryExprOrTypeTraitExpr *Ex, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitUnaryExprOrTypeTraitExpr - Transfer function for sizeof.
ProgramStateRef runCheckersForEvalAssume(ProgramStateRef state, SVal Cond, bool Assumption)
Run checkers for handling assumptions on symbolic values.
AnalyzerOptions & options
ImplicitCastExpr - Allows us to explicitly represent implicit type conversions, which have no direct ...
BugReporter & getBugReporter()
void VisitObjCForCollectionStmt(const ObjCForCollectionStmt *S, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitObjCForCollectionStmt - Transfer function logic for ObjCForCollectionStmt.
A class responsible for cleaning up unused symbols.
bool operator<(DeclarationName LHS, DeclarationName RHS)
Ordering on two declaration names.
enum clang::SubobjectAdjustment::@46 Kind
void runCheckersForPreStmt(ExplodedNodeSet &Dst, const ExplodedNodeSet &Src, const Stmt *S, ExprEngine &Eng)
Run checkers for pre-visiting Stmts.
bool isVectorType() const
bool isStmtBranch() const
ProgramStateRef getPersistentStateWithGDM(ProgramStateRef FromState, ProgramStateRef GDMState)
void insert(const ExplodedNodeSet &S)
Optional< T > getAs() const
Convert to the specified CFGElement type, returning None if this CFGElement is not of the desired typ...
Defines various enumerations that describe declaration and type specifiers.
StringRef getName() const
Return the actual identifier string.
ast_type_traits::DynTypedNode Node
void runCheckersForDeadSymbols(ExplodedNodeSet &Dst, const ExplodedNodeSet &Src, SymbolReaper &SymReaper, const Stmt *S, ExprEngine &Eng, ProgramPoint::Kind K)
Run checkers for dead symbols.
Dataflow Directional Tag Classes.
void ProcessStmt(const Stmt *S, ExplodedNode *Pred)
ExplodedNode * generateDefaultCaseNode(ProgramStateRef State, bool isSink=false)
SValBuilder & getSValBuilder()
Represents a delete expression for memory deallocation and destructor calls, e.g. ...
void addNodes(const ExplodedNodeSet &S)
StoreManager & getStoreManager()
Represents a program point just after an implicit call event.
bool NE(InterpState &S, CodePtr OpPC)
ProgramStateRef processRegionChanges(ProgramStateRef state, const InvalidatedSymbols *invalidated, ArrayRef< const MemRegion *> ExplicitRegions, ArrayRef< const MemRegion *> Regions, const LocationContext *LCtx, const CallEvent *Call) override
processRegionChanges - Called by ProgramStateManager whenever a change is made to the store...
SourceLocation getSourceLocation() const
Determine the source location of the initializer.
const NodeBuilderContext & getContext()
std::unique_ptr< DiagnosticConsumer > create(StringRef OutputFile, DiagnosticOptions *Diags, bool MergeChildRecords=false)
Returns a DiagnosticConsumer that serializes diagnostics to a bitcode file.
This node builder keeps track of the generated sink nodes.
bool isPurgeKind()
Is this a program point corresponding to purge/removal of dead symbols and bindings.
StmtClass getStmtClass() const
void reclaimRecentlyAllocatedNodes()
Reclaim "uninteresting" nodes created since the last time this method was called. ...
void VisitLambdaExpr(const LambdaExpr *LE, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitLambdaExpr - Transfer function logic for LambdaExprs.
const Decl * getSingleDecl() const
Represents symbolic expression that isn't a location.
Stmt * getTerminatorStmt()
BranchNodeBuilder is responsible for constructing the nodes corresponding to the two branches of the ...
Represents an abstract call to a function or method along a particular path.
ProgramStateRef getState() const
const Stmt * getLoopStmt() const
ProgramStateManager & getStateManager() override
This class is used for tools that requires cross translation unit capability.
const Decl * getDecl() const
const CXXDeleteExpr * getDeleteExpr() const
Represents a single point (AST node) in the program that requires attention during construction of an...
Expr * IgnoreParenImpCasts() LLVM_READONLY
Skip past any parentheses and implicit casts which might surround this expression until reaching a fi...
const CXXTempObjectRegion * getCXXStaticTempObjectRegion(const Expr *Ex)
Create a CXXTempObjectRegion for temporaries which are lifetime-extended by static references...
PointerEscapeKind
Describes the different reasons a pointer escapes during analysis.
SwitchStmt - This represents a 'switch' stmt.
void VisitCXXDestructor(QualType ObjectType, const MemRegion *Dest, const Stmt *S, bool IsBaseDtor, ExplodedNode *Pred, ExplodedNodeSet &Dst, EvalCallOptions &Options)
SourceLocation getBeginLoc() const
unsigned getIntWidth(QualType T) const
Expr * IgnoreImplicit() LLVM_READONLY
Skip past any implicit AST nodes which might surround this expression until reaching a fixed point...
void runCheckersForEndAnalysis(ExplodedGraph &G, BugReporter &BR, ExprEngine &Eng)
Run checkers for end of analysis.
T castAs() const
Convert to the specified SVal type, asserting that this SVal is of the desired type.
ArraySubscriptExpr - [C99 6.5.2.1] Array Subscripting.
ExplodedNode * generateSink(ProgramStateRef State, ExplodedNode *Pred, const ProgramPointTag *Tag=nullptr)
SubRegion - A region that subsets another larger region.
Represents a C++ base or member initializer.
void VisitCXXConstructExpr(const CXXConstructExpr *E, ExplodedNode *Pred, ExplodedNodeSet &Dst)
unsigned getIndex() const
void VisitObjCAtSynchronizedStmt(const ObjCAtSynchronizedStmt *S, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Transfer function logic for ObjCAtSynchronizedStmts.
IndirectFieldDecl * getIndirectMember() const
const LocationContext * getLocationContext() const
void VisitObjCMessage(const ObjCMessageExpr *ME, ExplodedNode *Pred, ExplodedNodeSet &Dst)
bool hasStackStorage() const
const StackFrameContext * getStackFrame() const
void printJson(raw_ostream &Out, const char *NL="\, unsigned int Space=0, bool IsDot=false, std::function< void(const LocationContext *)> printMoreInfoPerContext=[](const LocationContext *) {}) const
llvm::FoldingSet< BugReportEquivClass >::iterator EQClasses_iterator
Iterator over the set of BugReports tracked by the BugReporter.
Represents a base class of a C++ class.
Stores options for the analyzer from the command line.
void getCaptureFields(llvm::DenseMap< const VarDecl *, FieldDecl *> &Captures, FieldDecl *&ThisCapture) const
For a closure type, retrieve the mapping from captured variables and this to the non-static data memb...
uint64_t getTypeSize(QualType T) const
Return the size of the specified (complete) type T, in bits.
X
Add a minimal nested name specifier fixit hint to allow lookup of a tag name from an outer enclosing ...
ExplodedNode * generateNode(const ProgramPoint &PP, ProgramStateRef State, ExplodedNode *Pred)
Generates a node in the ExplodedGraph.
const CXXNewExpr * getAllocatorExpr() const
void VisitBlockExpr(const BlockExpr *BE, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitBlockExpr - Transfer function logic for BlockExprs.
Defines the C++ Decl subclasses, other than those for templates (found in DeclTemplate.h) and friends (in DeclFriend.h).
MemberExpr - [C99 6.5.2.3] Structure and Union Members.
Defines the clang::SourceLocation class and associated facilities.
Represents a C++ struct/union/class.
Represents C++ object destructor implicitly generated by compiler on various occasions.
ProgramStateRef getState() const
pred_iterator pred_begin()
ExplodedNode * generateNode(ProgramStateRef State, bool branch, ExplodedNode *Pred)
Represents a top-level expression in a basic block.
This class is used for builtin types like 'int'.
ProgramStateRef processAssume(ProgramStateRef state, SVal cond, bool assumption) override
evalAssume - Callback function invoked by the ConstraintManager when making assumptions about state v...
Represents C++ object destructor implicitly generated for member object in destructor.
const MemRegion * getBaseRegion() const
ExplodedNode * generateNode(const Stmt *S, ExplodedNode *Pred, ProgramStateRef St, const ProgramPointTag *tag=nullptr, ProgramPoint::Kind K=ProgramPoint::PostStmtKind)
static Decl::Kind getKind(const Decl *D)
ProgramStateRef runCheckersForRegionChanges(ProgramStateRef state, const InvalidatedSymbols *invalidated, ArrayRef< const MemRegion *> ExplicitRegions, ArrayRef< const MemRegion *> Regions, const LocationContext *LCtx, const CallEvent *Call)
Run checkers for region changes.
std::string DumpGraph(bool trim=false, StringRef Filename="")
Dump graph to the specified filename.
void runCheckersForBeginFunction(ExplodedNodeSet &Dst, const BlockEdge &L, ExplodedNode *Pred, ExprEngine &Eng)
Run checkers on beginning of function.
void VisitCommonDeclRefExpr(const Expr *DR, const NamedDecl *D, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Transfer function logic for DeclRefExprs and BlockDeclRefExprs.
raw_ostream & Indent(raw_ostream &Out, const unsigned int Space, bool IsDot)
A reference to a declared variable, function, enum, etc.
Represents C++ base or member initializer from constructor's initialization list. ...
void VisitGCCAsmStmt(const GCCAsmStmt *A, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitGCCAsmStmt - Transfer function logic for inline asm.
const StackFrameContext * getStackFrame() const
void VisitMemberExpr(const MemberExpr *M, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitMemberExpr - Transfer function for member expressions.
ParentMap & getParentMap()
ProgramStateRef escapeValue(ProgramStateRef State, SVal V, PointerEscapeKind K) const
A simple wrapper when you only need to notify checkers of pointer-escape of a single value...
llvm::ImmutableMap< ConstructedObjectKey, SVal > ObjectsUnderConstructionMap
This represents a decl that may have a name.
Optional< T > getAs() const
Convert to the specified ProgramPoint type, returning None if this ProgramPoint is not of the desired...
ConstraintManager & getConstraintManager()
void VisitBinaryOperator(const BinaryOperator *B, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitBinaryOperator - Transfer function logic for binary operators.
CFGTerminator getTerminator() const
AnalysisDeclContext * getAnalysisDeclContext() const
bool isFeasible(bool branch)
void CreateCXXTemporaryObject(const MaterializeTemporaryExpr *ME, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Create a C++ temporary object for an rvalue.
static SVal RecoverCastedSymbol(ProgramStateRef state, const Stmt *Condition, const LocationContext *LCtx, ASTContext &Ctx)
RecoverCastedSymbol - A helper function for ProcessBranch that is used to try to recover some path-se...
const Expr * getTarget() const
Represents C++ object destructor implicitly generated at the end of full expression for temporary obj...
const CFGBlock * getBlock() const
Return the CFGBlock associated with this builder.
int64_t getID(const ASTContext &Context) const
bool isUnknownOrUndef() const
bool EQ(InterpState &S, CodePtr OpPC)
Expr * IgnoreParens() LLVM_READONLY
Skip past any parentheses which might surround this expression until reaching a fixed point...
QualType getType() const
Retrieves the type of the base class.
Represents the point where a loop ends.