clang 19.0.0git
ExprEngine.h
Go to the documentation of this file.
1//===- ExprEngine.h - Path-Sensitive Expression-Level Dataflow --*- C++ -*-===//
2//
3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4// See https://llvm.org/LICENSE.txt for license information.
5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6//
7//===----------------------------------------------------------------------===//
8//
9// This file defines a meta-engine for path-sensitive dataflow analysis that
10// is built on CoreEngine, but provides the boilerplate to execute transfer
11// functions and build the ExplodedGraph at the expression level.
12//
13//===----------------------------------------------------------------------===//
14
15#ifndef LLVM_CLANG_STATICANALYZER_CORE_PATHSENSITIVE_EXPRENGINE_H
16#define LLVM_CLANG_STATICANALYZER_CORE_PATHSENSITIVE_EXPRENGINE_H
17
18#include "clang/AST/Expr.h"
19#include "clang/AST/Type.h"
20#include "clang/Analysis/CFG.h"
23#include "clang/Basic/LLVM.h"
37#include "llvm/ADT/ArrayRef.h"
38#include <cassert>
39#include <optional>
40#include <utility>
41
42namespace clang {
43
44class AnalysisDeclContextManager;
45class AnalyzerOptions;
46class ASTContext;
47class CFGBlock;
48class CFGElement;
49class ConstructionContext;
50class CXXBindTemporaryExpr;
51class CXXCatchStmt;
52class CXXConstructExpr;
53class CXXDeleteExpr;
54class CXXNewExpr;
55class CXXThisExpr;
56class Decl;
57class DeclStmt;
58class GCCAsmStmt;
59class LambdaExpr;
60class LocationContext;
61class MaterializeTemporaryExpr;
62class MSAsmStmt;
63class NamedDecl;
64class ObjCAtSynchronizedStmt;
65class ObjCForCollectionStmt;
66class ObjCIvarRefExpr;
67class ObjCMessageExpr;
68class ReturnStmt;
69class Stmt;
70
71namespace cross_tu {
72
73class CrossTranslationUnitContext;
74
75} // namespace cross_tu
76
77namespace ento {
78
79class AnalysisManager;
80class BasicValueFactory;
81class CallEvent;
82class CheckerManager;
83class ConstraintManager;
84class ExplodedNodeSet;
85class ExplodedNode;
86class IndirectGotoNodeBuilder;
87class MemRegion;
88struct NodeBuilderContext;
89class NodeBuilderWithSinks;
90class ProgramState;
91class ProgramStateManager;
92class RegionAndSymbolInvalidationTraits;
93class SymbolManager;
94class SwitchNodeBuilder;
95
96/// Hints for figuring out of a call should be inlined during evalCall().
98 /// This call is a constructor or a destructor for which we do not currently
99 /// compute the this-region correctly.
101
102 /// This call is a constructor or a destructor for a single element within
103 /// an array, a part of array construction or destruction.
104 bool IsArrayCtorOrDtor = false;
105
106 /// This call is a constructor or a destructor of a temporary value.
108
109 /// This call is a constructor for a temporary that is lifetime-extended
110 /// by binding it to a reference-type field within an aggregate,
111 /// for example 'A { const C &c; }; A a = { C() };'
113
114 /// This call is a pre-C++17 elidable constructor that we failed to elide
115 /// because we failed to compute the target region into which
116 /// this constructor would have been ultimately elided. Analysis that
117 /// we perform in this case is still correct but it behaves differently,
118 /// as if copy elision is disabled.
120
122};
123
125 void anchor();
126
127public:
128 /// The modes of inlining, which override the default analysis-wide settings.
130 /// Follow the default settings for inlining callees.
132
133 /// Do minimal inlining of callees.
134 Inline_Minimal = 0x1
135 };
136
137private:
139 bool IsCTUEnabled;
140
141 AnalysisManager &AMgr;
142
143 AnalysisDeclContextManager &AnalysisDeclContexts;
144
145 CoreEngine Engine;
146
147 /// G - the simulation graph.
148 ExplodedGraph &G;
149
150 /// StateMgr - Object that manages the data for all created states.
151 ProgramStateManager StateMgr;
152
153 /// SymMgr - Object that manages the symbol information.
154 SymbolManager &SymMgr;
155
156 /// MRMgr - MemRegionManager object that creates memory regions.
157 MemRegionManager &MRMgr;
158
159 /// svalBuilder - SValBuilder object that creates SVals from expressions.
160 SValBuilder &svalBuilder;
161
162 unsigned int currStmtIdx = 0;
163 const NodeBuilderContext *currBldrCtx = nullptr;
164
165 /// Helper object to determine if an Objective-C message expression
166 /// implicitly never returns.
167 ObjCNoReturn ObjCNoRet;
168
169 /// The BugReporter associated with this engine. It is important that
170 /// this object be placed at the very end of member variables so that its
171 /// destructor is called before the rest of the ExprEngine is destroyed.
173
174 /// The functions which have been analyzed through inlining. This is owned by
175 /// AnalysisConsumer. It can be null.
176 SetOfConstDecls *VisitedCallees;
177
178 /// The flag, which specifies the mode of inlining for the engine.
179 InliningModes HowToInline;
180
181public:
183 SetOfConstDecls *VisitedCalleesIn,
184 FunctionSummariesTy *FS, InliningModes HowToInlineIn);
185
186 virtual ~ExprEngine() = default;
187
188 /// Returns true if there is still simulation state on the worklist.
189 bool ExecuteWorkList(const LocationContext *L, unsigned Steps = 150000) {
190 return Engine.ExecuteWorkList(L, Steps, nullptr);
191 }
192
193 /// Execute the work list with an initial state. Nodes that reaches the exit
194 /// of the function are added into the Dst set, which represent the exit
195 /// state of the function call. Returns true if there is still simulation
196 /// state on the worklist.
198 ProgramStateRef InitState,
199 ExplodedNodeSet &Dst) {
200 return Engine.ExecuteWorkListWithInitialState(L, Steps, InitState, Dst);
201 }
202
203 /// getContext - Return the ASTContext associated with this analysis.
204 ASTContext &getContext() const { return AMgr.getASTContext(); }
205
207
209 return AMgr.getAnalysisDeclContextManager();
210 }
211
213 return *AMgr.getCheckerManager();
214 }
215
216 SValBuilder &getSValBuilder() { return svalBuilder; }
217
218 BugReporter &getBugReporter() { return BR; }
219
222 return &CTU;
223 }
224
226 assert(currBldrCtx);
227 return *currBldrCtx;
228 }
229
230 const Stmt *getStmt() const;
231
233 assert(G.roots_begin() != G.roots_end());
234 return (*G.roots_begin())->getLocation().getLocationContext();
235 }
236
238 const CFGBlock *blockPtr = currBldrCtx ? currBldrCtx->getBlock() : nullptr;
239 return {blockPtr, currStmtIdx};
240 }
241
242 /// Dump graph to the specified filename.
243 /// If filename is empty, generate a temporary one.
244 /// \return The filename the graph is written into.
245 std::string DumpGraph(bool trim = false, StringRef Filename="");
246
247 /// Dump the graph consisting of the given nodes to a specified filename.
248 /// Generate a temporary filename if it's not provided.
249 /// \return The filename the graph is written into.
251 StringRef Filename = "");
252
253 /// Visualize the ExplodedGraph created by executing the simulation.
254 void ViewGraph(bool trim = false);
255
256 /// Visualize a trimmed ExplodedGraph that only contains paths to the given
257 /// nodes.
259
260 /// getInitialState - Return the initial state used for the root vertex
261 /// in the ExplodedGraph.
263
264 ExplodedGraph &getGraph() { return G; }
265 const ExplodedGraph &getGraph() const { return G; }
266
267 /// Run the analyzer's garbage collection - remove dead symbols and
268 /// bindings from the state.
269 ///
270 /// Checkers can participate in this process with two callbacks:
271 /// \c checkLiveSymbols and \c checkDeadSymbols. See the CheckerDocumentation
272 /// class for more information.
273 ///
274 /// \param Node The predecessor node, from which the processing should start.
275 /// \param Out The returned set of output nodes.
276 /// \param ReferenceStmt The statement which is about to be processed.
277 /// Everything needed for this statement should be considered live.
278 /// A null statement means that everything in child LocationContexts
279 /// is dead.
280 /// \param LC The location context of the \p ReferenceStmt. A null location
281 /// context means that we have reached the end of analysis and that
282 /// all statements and local variables should be considered dead.
283 /// \param DiagnosticStmt Used as a location for any warnings that should
284 /// occur while removing the dead (e.g. leaks). By default, the
285 /// \p ReferenceStmt is used.
286 /// \param K Denotes whether this is a pre- or post-statement purge. This
287 /// must only be ProgramPoint::PostStmtPurgeDeadSymbolsKind if an
288 /// entire location context is being cleared, in which case the
289 /// \p ReferenceStmt must either be a ReturnStmt or \c NULL. Otherwise,
290 /// it must be ProgramPoint::PreStmtPurgeDeadSymbolsKind (the default)
291 /// and \p ReferenceStmt must be valid (non-null).
293 const Stmt *ReferenceStmt, const LocationContext *LC,
294 const Stmt *DiagnosticStmt = nullptr,
296
297 /// processCFGElement - Called by CoreEngine. Used to generate new successor
298 /// nodes by processing the 'effects' of a CFG element.
299 void processCFGElement(const CFGElement E, ExplodedNode *Pred,
300 unsigned StmtIdx, NodeBuilderContext *Ctx);
301
302 void ProcessStmt(const Stmt *S, ExplodedNode *Pred);
303
304 void ProcessLoopExit(const Stmt* S, ExplodedNode *Pred);
305
307
309
310 void ProcessNewAllocator(const CXXNewExpr *NE, ExplodedNode *Pred);
311
313 ExplodedNode *Pred, ExplodedNodeSet &Dst);
314 void ProcessDeleteDtor(const CFGDeleteDtor D,
315 ExplodedNode *Pred, ExplodedNodeSet &Dst);
316 void ProcessBaseDtor(const CFGBaseDtor D,
317 ExplodedNode *Pred, ExplodedNodeSet &Dst);
318 void ProcessMemberDtor(const CFGMemberDtor D,
319 ExplodedNode *Pred, ExplodedNodeSet &Dst);
321 ExplodedNode *Pred, ExplodedNodeSet &Dst);
322
323 /// Called by CoreEngine when processing the entrance of a CFGBlock.
325 NodeBuilderWithSinks &nodeBuilder,
326 ExplodedNode *Pred);
327
328 /// ProcessBranch - Called by CoreEngine. Used to generate successor
329 /// nodes by processing the 'effects' of a branch condition.
330 void processBranch(const Stmt *Condition,
331 NodeBuilderContext& BuilderCtx,
332 ExplodedNode *Pred,
333 ExplodedNodeSet &Dst,
334 const CFGBlock *DstT,
335 const CFGBlock *DstF);
336
337 /// Called by CoreEngine.
338 /// Used to generate successor nodes for temporary destructors depending
339 /// on whether the corresponding constructor was visited.
341 NodeBuilderContext &BldCtx,
342 ExplodedNode *Pred, ExplodedNodeSet &Dst,
343 const CFGBlock *DstT,
344 const CFGBlock *DstF);
345
346 /// Called by CoreEngine. Used to processing branching behavior
347 /// at static initializers.
349 NodeBuilderContext& BuilderCtx,
350 ExplodedNode *Pred,
351 ExplodedNodeSet &Dst,
352 const CFGBlock *DstT,
353 const CFGBlock *DstF);
354
355 /// processIndirectGoto - Called by CoreEngine. Used to generate successor
356 /// nodes by processing the 'effects' of a computed goto jump.
358
359 /// ProcessSwitch - Called by CoreEngine. Used to generate successor
360 /// nodes by processing the 'effects' of a switch statement.
361 void processSwitch(SwitchNodeBuilder& builder);
362
363 /// Called by CoreEngine. Used to notify checkers that processing a
364 /// function has begun. Called for both inlined and top-level functions.
366 ExplodedNode *Pred, ExplodedNodeSet &Dst,
367 const BlockEdge &L);
368
369 /// Called by CoreEngine. Used to notify checkers that processing a
370 /// function has ended. Called for both inlined and top-level functions.
372 ExplodedNode *Pred,
373 const ReturnStmt *RS = nullptr);
374
375 /// Remove dead bindings/symbols before exiting a function.
377 ExplodedNode *Pred,
378 ExplodedNodeSet &Dst);
379
380 /// Generate the entry node of the callee.
382 ExplodedNode *Pred);
383
384 /// Generate the sequence of nodes that simulate the call exit and the post
385 /// visit for CallExpr.
386 void processCallExit(ExplodedNode *Pred);
387
388 /// Called by CoreEngine when the analysis worklist has terminated.
389 void processEndWorklist();
390
391 /// evalAssume - Callback function invoked by the ConstraintManager when
392 /// making assumptions about state values.
394 bool assumption);
395
396 /// processRegionChanges - Called by ProgramStateManager whenever a change is made
397 /// to the store. Used to update checkers that track region values.
400 const InvalidatedSymbols *invalidated,
401 ArrayRef<const MemRegion *> ExplicitRegions,
403 const LocationContext *LCtx,
404 const CallEvent *Call);
405
406 inline ProgramStateRef
408 const MemRegion* MR,
409 const LocationContext *LCtx) {
410 return processRegionChanges(state, nullptr, MR, MR, LCtx, nullptr);
411 }
412
413 /// printJson - Called by ProgramStateManager to print checker-specific data.
414 void printJson(raw_ostream &Out, ProgramStateRef State,
415 const LocationContext *LCtx, const char *NL,
416 unsigned int Space, bool IsDot) const;
417
418 ProgramStateManager &getStateManager() { return StateMgr; }
419
421
423 return StateMgr.getConstraintManager();
424 }
425
426 // FIXME: Remove when we migrate over to just using SValBuilder.
428 return StateMgr.getBasicVals();
429 }
430
431 SymbolManager &getSymbolManager() { return SymMgr; }
433
435
436 // Functions for external checking of whether we have unfinished work
437 bool wasBlocksExhausted() const { return Engine.wasBlocksExhausted(); }
438 bool hasEmptyWorkList() const { return !Engine.getWorkList()->hasWork(); }
439 bool hasWorkRemaining() const { return Engine.hasWorkRemaining(); }
440
441 const CoreEngine &getCoreEngine() const { return Engine; }
442
443public:
444 /// Visit - Transfer function logic for all statements. Dispatches to
445 /// other functions that handle specific kinds of statements.
446 void Visit(const Stmt *S, ExplodedNode *Pred, ExplodedNodeSet &Dst);
447
448 /// VisitArrayInitLoopExpr - Transfer function for array init loop.
450 ExplodedNodeSet &Dst);
451
452 /// VisitArraySubscriptExpr - Transfer function for array accesses.
454 ExplodedNode *Pred,
455 ExplodedNodeSet &Dst);
456
457 /// VisitGCCAsmStmt - Transfer function logic for inline asm.
458 void VisitGCCAsmStmt(const GCCAsmStmt *A, ExplodedNode *Pred,
459 ExplodedNodeSet &Dst);
460
461 /// VisitMSAsmStmt - Transfer function logic for MS inline asm.
462 void VisitMSAsmStmt(const MSAsmStmt *A, ExplodedNode *Pred,
463 ExplodedNodeSet &Dst);
464
465 /// VisitBlockExpr - Transfer function logic for BlockExprs.
466 void VisitBlockExpr(const BlockExpr *BE, ExplodedNode *Pred,
467 ExplodedNodeSet &Dst);
468
469 /// VisitLambdaExpr - Transfer function logic for LambdaExprs.
470 void VisitLambdaExpr(const LambdaExpr *LE, ExplodedNode *Pred,
471 ExplodedNodeSet &Dst);
472
473 /// VisitBinaryOperator - Transfer function logic for binary operators.
475 ExplodedNodeSet &Dst);
476
477
478 /// VisitCall - Transfer function for function calls.
479 void VisitCallExpr(const CallExpr *CE, ExplodedNode *Pred,
480 ExplodedNodeSet &Dst);
481
482 /// VisitCast - Transfer function logic for all casts (implicit and explicit).
483 void VisitCast(const CastExpr *CastE, const Expr *Ex, ExplodedNode *Pred,
484 ExplodedNodeSet &Dst);
485
486 /// VisitCompoundLiteralExpr - Transfer function logic for compound literals.
488 ExplodedNode *Pred, ExplodedNodeSet &Dst);
489
490 /// Transfer function logic for DeclRefExprs and BlockDeclRefExprs.
491 void VisitCommonDeclRefExpr(const Expr *DR, const NamedDecl *D,
492 ExplodedNode *Pred, ExplodedNodeSet &Dst);
493
494 /// VisitDeclStmt - Transfer function logic for DeclStmts.
495 void VisitDeclStmt(const DeclStmt *DS, ExplodedNode *Pred,
496 ExplodedNodeSet &Dst);
497
498 /// VisitGuardedExpr - Transfer function logic for ?, __builtin_choose
499 void VisitGuardedExpr(const Expr *Ex, const Expr *L, const Expr *R,
500 ExplodedNode *Pred, ExplodedNodeSet &Dst);
501
502 void VisitInitListExpr(const InitListExpr *E, ExplodedNode *Pred,
503 ExplodedNodeSet &Dst);
504
505 /// VisitLogicalExpr - Transfer function logic for '&&', '||'
506 void VisitLogicalExpr(const BinaryOperator* B, ExplodedNode *Pred,
507 ExplodedNodeSet &Dst);
508
509 /// VisitMemberExpr - Transfer function for member expressions.
510 void VisitMemberExpr(const MemberExpr *M, ExplodedNode *Pred,
511 ExplodedNodeSet &Dst);
512
513 /// VisitAtomicExpr - Transfer function for builtin atomic expressions
514 void VisitAtomicExpr(const AtomicExpr *E, ExplodedNode *Pred,
515 ExplodedNodeSet &Dst);
516
517 /// Transfer function logic for ObjCAtSynchronizedStmts.
519 ExplodedNode *Pred, ExplodedNodeSet &Dst);
520
521 /// Transfer function logic for computing the lvalue of an Objective-C ivar.
523 ExplodedNodeSet &Dst);
524
525 /// VisitObjCForCollectionStmt - Transfer function logic for
526 /// ObjCForCollectionStmt.
528 ExplodedNode *Pred, ExplodedNodeSet &Dst);
529
530 void VisitObjCMessage(const ObjCMessageExpr *ME, ExplodedNode *Pred,
531 ExplodedNodeSet &Dst);
532
533 /// VisitReturnStmt - Transfer function logic for return statements.
534 void VisitReturnStmt(const ReturnStmt *R, ExplodedNode *Pred,
535 ExplodedNodeSet &Dst);
536
537 /// VisitOffsetOfExpr - Transfer function for offsetof.
538 void VisitOffsetOfExpr(const OffsetOfExpr *Ex, ExplodedNode *Pred,
539 ExplodedNodeSet &Dst);
540
541 /// VisitUnaryExprOrTypeTraitExpr - Transfer function for sizeof.
543 ExplodedNode *Pred, ExplodedNodeSet &Dst);
544
545 /// VisitUnaryOperator - Transfer function logic for unary operators.
546 void VisitUnaryOperator(const UnaryOperator* B, ExplodedNode *Pred,
547 ExplodedNodeSet &Dst);
548
549 /// Handle ++ and -- (both pre- and post-increment).
551 ExplodedNode *Pred,
552 ExplodedNodeSet &Dst);
553
555 ExplodedNodeSet &PreVisit,
556 ExplodedNodeSet &Dst);
557
558 void VisitCXXCatchStmt(const CXXCatchStmt *CS, ExplodedNode *Pred,
559 ExplodedNodeSet &Dst);
560
561 void VisitCXXThisExpr(const CXXThisExpr *TE, ExplodedNode *Pred,
562 ExplodedNodeSet & Dst);
563
565 ExplodedNodeSet &Dst);
566
568 ExplodedNode *Pred, ExplodedNodeSet &Dst);
569
570 void VisitCXXDestructor(QualType ObjectType, const MemRegion *Dest,
571 const Stmt *S, bool IsBaseDtor,
572 ExplodedNode *Pred, ExplodedNodeSet &Dst,
573 EvalCallOptions &Options);
574
575 void VisitCXXNewAllocatorCall(const CXXNewExpr *CNE,
576 ExplodedNode *Pred,
577 ExplodedNodeSet &Dst);
578
579 void VisitCXXNewExpr(const CXXNewExpr *CNE, ExplodedNode *Pred,
580 ExplodedNodeSet &Dst);
581
582 void VisitCXXDeleteExpr(const CXXDeleteExpr *CDE, ExplodedNode *Pred,
583 ExplodedNodeSet &Dst);
584
585 /// Create a C++ temporary object for an rvalue.
587 ExplodedNode *Pred,
588 ExplodedNodeSet &Dst);
589
590 /// evalEagerlyAssumeBinOpBifurcation - Given the nodes in 'Src', eagerly assume symbolic
591 /// expressions of the form 'x != 0' and generate new nodes (stored in Dst)
592 /// with those assumptions.
594 const Expr *Ex);
595
596 static std::pair<const ProgramPointTag *, const ProgramPointTag *>
598
600 const LocationContext *LCtx, QualType T,
601 QualType ExTy, const CastExpr *CastE,
602 StmtNodeBuilder &Bldr,
603 ExplodedNode *Pred);
604
606 StmtNodeBuilder &Bldr);
607
608public:
610 SVal LHS, SVal RHS, QualType T) {
611 return svalBuilder.evalBinOp(ST, Op, LHS, RHS, T);
612 }
613
614 /// Retreives which element is being constructed in a non-POD type array.
615 static std::optional<unsigned>
617 const LocationContext *LCtx);
618
619 /// Retreives which element is being destructed in a non-POD type array.
620 static std::optional<unsigned>
622 const LocationContext *LCtx);
623
624 /// Retreives the size of the array in the pending ArrayInitLoopExpr.
625 static std::optional<unsigned>
627 const LocationContext *LCtx);
628
629 /// By looking at a certain item that may be potentially part of an object's
630 /// ConstructionContext, retrieve such object's location. A particular
631 /// statement can be transparently passed as \p Item in most cases.
632 static std::optional<SVal>
634 const ConstructionContextItem &Item,
635 const LocationContext *LC);
636
637 /// Call PointerEscape callback when a value escapes as a result of bind.
639 ProgramStateRef State, ArrayRef<std::pair<SVal, SVal>> LocAndVals,
640 const LocationContext *LCtx, PointerEscapeKind Kind,
641 const CallEvent *Call);
642
643 /// Call PointerEscape callback when a value escapes as a result of
644 /// region invalidation.
645 /// \param[in] ITraits Specifies invalidation traits for regions/symbols.
647 ProgramStateRef State,
648 const InvalidatedSymbols *Invalidated,
649 ArrayRef<const MemRegion *> ExplicitRegions,
650 const CallEvent *Call,
652
653private:
654 /// evalBind - Handle the semantics of binding a value to a specific location.
655 /// This method is used by evalStore, VisitDeclStmt, and others.
656 void evalBind(ExplodedNodeSet &Dst, const Stmt *StoreE, ExplodedNode *Pred,
657 SVal location, SVal Val, bool atDeclInit = false,
658 const ProgramPoint *PP = nullptr);
659
662 SVal Loc, SVal Val,
663 const LocationContext *LCtx);
664
665 /// A simple wrapper when you only need to notify checkers of pointer-escape
666 /// of some values.
667 ProgramStateRef escapeValues(ProgramStateRef State, ArrayRef<SVal> Vs,
669 const CallEvent *Call = nullptr) const;
670
671public:
672 // FIXME: 'tag' should be removed, and a LocationContext should be used
673 // instead.
674 // FIXME: Comment on the meaning of the arguments, when 'St' may not
675 // be the same as Pred->state, and when 'location' may not be the
676 // same as state->getLValue(Ex).
677 /// Simulate a read of the result of Ex.
678 void evalLoad(ExplodedNodeSet &Dst,
679 const Expr *NodeEx, /* Eventually will be a CFGStmt */
680 const Expr *BoundExpr,
681 ExplodedNode *Pred,
683 SVal location,
684 const ProgramPointTag *tag = nullptr,
685 QualType LoadTy = QualType());
686
687 // FIXME: 'tag' should be removed, and a LocationContext should be used
688 // instead.
689 void evalStore(ExplodedNodeSet &Dst, const Expr *AssignE, const Expr *StoreE,
690 ExplodedNode *Pred, ProgramStateRef St, SVal TargetLV, SVal Val,
691 const ProgramPointTag *tag = nullptr);
692
693 /// Return the CFG element corresponding to the worklist element
694 /// that is currently being processed by ExprEngine.
696 return (*currBldrCtx->getBlock())[currStmtIdx];
697 }
698
699 /// Create a new state in which the call return value is binded to the
700 /// call origin expression.
702 const LocationContext *LCtx,
703 ProgramStateRef State);
704
705 /// Evaluate a call, running pre- and post-call checkers and allowing checkers
706 /// to be responsible for handling the evaluation of the call itself.
707 void evalCall(ExplodedNodeSet &Dst, ExplodedNode *Pred,
708 const CallEvent &Call);
709
710 /// Default implementation of call evaluation.
712 const CallEvent &Call,
713 const EvalCallOptions &CallOpts = {});
714
715 /// Find location of the object that is being constructed by a given
716 /// constructor. This should ideally always succeed but due to not being
717 /// fully implemented it sometimes indicates that it failed via its
718 /// out-parameter CallOpts; in such cases a fake temporary region is
719 /// returned, which is better than nothing but does not represent
720 /// the actual behavior of the program. The Idx parameter is used if we
721 /// construct an array of objects. In that case it points to the index
722 /// of the continuous memory region.
723 /// E.g.:
724 /// For `int arr[4]` this index can be 0,1,2,3.
725 /// For `int arr2[3][3]` this index can be 0,1,...,7,8.
726 /// A multi-dimensional array is also a continuous memory location in a
727 /// row major order, so for arr[0][0] Idx is 0 and for arr[2][2] Idx is 8.
729 const NodeBuilderContext *BldrCtx,
730 const LocationContext *LCtx,
731 const ConstructionContext *CC,
732 EvalCallOptions &CallOpts,
733 unsigned Idx = 0);
734
735 /// Update the program state with all the path-sensitive information
736 /// that's necessary to perform construction of an object with a given
737 /// syntactic construction context. V and CallOpts have to be obtained from
738 /// computeObjectUnderConstruction() invoked with the same set of
739 /// the remaining arguments (E, State, LCtx, CC).
741 SVal V, const Expr *E, ProgramStateRef State, const LocationContext *LCtx,
742 const ConstructionContext *CC, const EvalCallOptions &CallOpts);
743
744 /// A convenient wrapper around computeObjectUnderConstruction
745 /// and updateObjectsUnderConstruction.
746 std::pair<ProgramStateRef, SVal> handleConstructionContext(
747 const Expr *E, ProgramStateRef State, const NodeBuilderContext *BldrCtx,
748 const LocationContext *LCtx, const ConstructionContext *CC,
749 EvalCallOptions &CallOpts, unsigned Idx = 0) {
750
751 SVal V = computeObjectUnderConstruction(E, State, BldrCtx, LCtx, CC,
752 CallOpts, Idx);
753 State = updateObjectsUnderConstruction(V, E, State, LCtx, CC, CallOpts);
754
755 return std::make_pair(State, V);
756 }
757
758private:
759 ProgramStateRef finishArgumentConstruction(ProgramStateRef State,
760 const CallEvent &Call);
761 void finishArgumentConstruction(ExplodedNodeSet &Dst, ExplodedNode *Pred,
762 const CallEvent &Call);
763
764 void evalLocation(ExplodedNodeSet &Dst,
765 const Stmt *NodeEx, /* This will eventually be a CFGStmt */
766 const Stmt *BoundEx,
767 ExplodedNode *Pred,
769 SVal location,
770 bool isLoad);
771
772 /// Count the stack depth and determine if the call is recursive.
773 void examineStackFrames(const Decl *D, const LocationContext *LCtx,
774 bool &IsRecursive, unsigned &StackDepth);
775
776 enum CallInlinePolicy {
777 CIP_Allowed,
778 CIP_DisallowedOnce,
779 CIP_DisallowedAlways
780 };
781
782 /// See if a particular call should be inlined, by only looking
783 /// at the call event and the current state of analysis.
784 CallInlinePolicy mayInlineCallKind(const CallEvent &Call,
785 const ExplodedNode *Pred,
786 AnalyzerOptions &Opts,
787 const EvalCallOptions &CallOpts);
788
789 /// See if the given AnalysisDeclContext is built for a function that we
790 /// should always inline simply because it's small enough.
791 /// Apart from "small" functions, we also have "large" functions
792 /// (cf. isLarge()), some of which are huge (cf. isHuge()), and we classify
793 /// the remaining functions as "medium".
794 bool isSmall(AnalysisDeclContext *ADC) const;
795
796 /// See if the given AnalysisDeclContext is built for a function that we
797 /// should inline carefully because it looks pretty large.
798 bool isLarge(AnalysisDeclContext *ADC) const;
799
800 /// See if the given AnalysisDeclContext is built for a function that we
801 /// should never inline because it's legit gigantic.
802 bool isHuge(AnalysisDeclContext *ADC) const;
803
804 /// See if the given AnalysisDeclContext is built for a function that we
805 /// should inline, just by looking at the declaration of the function.
806 bool mayInlineDecl(AnalysisDeclContext *ADC) const;
807
808 /// Checks our policies and decides weither the given call should be inlined.
809 bool shouldInlineCall(const CallEvent &Call, const Decl *D,
810 const ExplodedNode *Pred,
811 const EvalCallOptions &CallOpts = {});
812
813 /// Checks whether our policies allow us to inline a non-POD type array
814 /// construction.
815 bool shouldInlineArrayConstruction(const ProgramStateRef State,
816 const CXXConstructExpr *CE,
817 const LocationContext *LCtx);
818
819 /// Checks whether our policies allow us to inline a non-POD type array
820 /// destruction.
821 /// \param Size The size of the array.
822 bool shouldInlineArrayDestruction(uint64_t Size);
823
824 /// Prepares the program state for array destruction. If no error happens
825 /// the function binds a 'PendingArrayDestruction' entry to the state, which
826 /// it returns along with the index. If any error happens (we fail to read
827 /// the size, the index would be -1, etc.) the function will return the
828 /// original state along with an index of 0. The actual element count of the
829 /// array can be accessed by the optional 'ElementCountVal' parameter. \param
830 /// State The program state. \param Region The memory region where the array
831 /// is stored. \param ElementTy The type an element in the array. \param LCty
832 /// The location context. \param ElementCountVal A pointer to an optional
833 /// SVal. If specified, the size of the array will be returned in it. It can
834 /// be Unknown.
835 std::pair<ProgramStateRef, uint64_t> prepareStateForArrayDestruction(
836 const ProgramStateRef State, const MemRegion *Region,
837 const QualType &ElementTy, const LocationContext *LCtx,
838 SVal *ElementCountVal = nullptr);
839
840 /// Checks whether we construct an array of non-POD type, and decides if the
841 /// constructor should be inkoved once again.
842 bool shouldRepeatCtorCall(ProgramStateRef State, const CXXConstructExpr *E,
843 const LocationContext *LCtx);
844
845 void inlineCall(WorkList *WList, const CallEvent &Call, const Decl *D,
846 NodeBuilder &Bldr, ExplodedNode *Pred, ProgramStateRef State);
847
848 void ctuBifurcate(const CallEvent &Call, const Decl *D, NodeBuilder &Bldr,
849 ExplodedNode *Pred, ProgramStateRef State);
850
851 /// Returns true if the CTU analysis is running its second phase.
852 bool isSecondPhaseCTU() { return IsCTUEnabled && !Engine.getCTUWorkList(); }
853
854 /// Conservatively evaluate call by invalidating regions and binding
855 /// a conjured return value.
856 void conservativeEvalCall(const CallEvent &Call, NodeBuilder &Bldr,
857 ExplodedNode *Pred, ProgramStateRef State);
858
859 /// Either inline or process the call conservatively (or both), based
860 /// on DynamicDispatchBifurcation data.
861 void BifurcateCall(const MemRegion *BifurReg,
862 const CallEvent &Call, const Decl *D, NodeBuilder &Bldr,
863 ExplodedNode *Pred);
864
865 bool replayWithoutInlining(ExplodedNode *P, const LocationContext *CalleeLC);
866
867 /// Models a trivial copy or move constructor or trivial assignment operator
868 /// call with a simple bind.
869 void performTrivialCopy(NodeBuilder &Bldr, ExplodedNode *Pred,
870 const CallEvent &Call);
871
872 /// If the value of the given expression \p InitWithAdjustments is a NonLoc,
873 /// copy it into a new temporary object region, and replace the value of the
874 /// expression with that.
875 ///
876 /// If \p Result is provided, the new region will be bound to this expression
877 /// instead of \p InitWithAdjustments.
878 ///
879 /// Returns the temporary region with adjustments into the optional
880 /// OutRegionWithAdjustments out-parameter if a new region was indeed needed,
881 /// otherwise sets it to nullptr.
882 ProgramStateRef createTemporaryRegionIfNeeded(
883 ProgramStateRef State, const LocationContext *LC,
884 const Expr *InitWithAdjustments, const Expr *Result = nullptr,
885 const SubRegion **OutRegionWithAdjustments = nullptr);
886
887 /// Returns a region representing the `Idx`th element of a (possibly
888 /// multi-dimensional) array, for the purposes of element construction or
889 /// destruction.
890 ///
891 /// On return, \p Ty will be set to the base type of the array.
892 ///
893 /// If the type is not an array type at all, the original value is returned.
894 /// Otherwise the "IsArray" flag is set.
895 static SVal makeElementRegion(ProgramStateRef State, SVal LValue,
896 QualType &Ty, bool &IsArray, unsigned Idx = 0);
897
898 /// Common code that handles either a CXXConstructExpr or a
899 /// CXXInheritedCtorInitExpr.
900 void handleConstructor(const Expr *E, ExplodedNode *Pred,
901 ExplodedNodeSet &Dst);
902
903public:
904 /// Note whether this loop has any more iteratios to model. These methods are
905 /// essentially an interface for a GDM trait. Further reading in
906 /// ExprEngine::VisitObjCForCollectionStmt().
907 [[nodiscard]] static ProgramStateRef
909 const ObjCForCollectionStmt *O,
910 const LocationContext *LC, bool HasMoreIteraton);
911
912 [[nodiscard]] static ProgramStateRef
913 removeIterationState(ProgramStateRef State, const ObjCForCollectionStmt *O,
914 const LocationContext *LC);
915
916 [[nodiscard]] static bool hasMoreIteration(ProgramStateRef State,
917 const ObjCForCollectionStmt *O,
918 const LocationContext *LC);
919
920private:
921 /// Assuming we construct an array of non-POD types, this method allows us
922 /// to store which element is to be constructed next.
923 static ProgramStateRef
924 setIndexOfElementToConstruct(ProgramStateRef State, const CXXConstructExpr *E,
925 const LocationContext *LCtx, unsigned Idx);
926
927 static ProgramStateRef
928 removeIndexOfElementToConstruct(ProgramStateRef State,
929 const CXXConstructExpr *E,
930 const LocationContext *LCtx);
931
932 /// Assuming we destruct an array of non-POD types, this method allows us
933 /// to store which element is to be destructed next.
934 static ProgramStateRef setPendingArrayDestruction(ProgramStateRef State,
935 const LocationContext *LCtx,
936 unsigned Idx);
937
938 static ProgramStateRef
939 removePendingArrayDestruction(ProgramStateRef State,
940 const LocationContext *LCtx);
941
942 /// Sets the size of the array in a pending ArrayInitLoopExpr.
943 static ProgramStateRef setPendingInitLoop(ProgramStateRef State,
944 const CXXConstructExpr *E,
945 const LocationContext *LCtx,
946 unsigned Idx);
947
948 static ProgramStateRef removePendingInitLoop(ProgramStateRef State,
949 const CXXConstructExpr *E,
950 const LocationContext *LCtx);
951
952 static ProgramStateRef
953 removeStateTraitsUsedForArrayEvaluation(ProgramStateRef State,
954 const CXXConstructExpr *E,
955 const LocationContext *LCtx);
956
957 /// Store the location of a C++ object corresponding to a statement
958 /// until the statement is actually encountered. For example, if a DeclStmt
959 /// has CXXConstructExpr as its initializer, the object would be considered
960 /// to be "under construction" between CXXConstructExpr and DeclStmt.
961 /// This allows, among other things, to keep bindings to variable's fields
962 /// made within the constructor alive until its declaration actually
963 /// goes into scope.
964 static ProgramStateRef
965 addObjectUnderConstruction(ProgramStateRef State,
966 const ConstructionContextItem &Item,
967 const LocationContext *LC, SVal V);
968
969 /// Mark the object sa fully constructed, cleaning up the state trait
970 /// that tracks objects under construction.
971 static ProgramStateRef
972 finishObjectConstruction(ProgramStateRef State,
973 const ConstructionContextItem &Item,
974 const LocationContext *LC);
975
976 /// If the given expression corresponds to a temporary that was used for
977 /// passing into an elidable copy/move constructor and that constructor
978 /// was actually elided, track that we also need to elide the destructor.
979 static ProgramStateRef elideDestructor(ProgramStateRef State,
980 const CXXBindTemporaryExpr *BTE,
981 const LocationContext *LC);
982
983 /// Stop tracking the destructor that corresponds to an elided constructor.
984 static ProgramStateRef
985 cleanupElidedDestructor(ProgramStateRef State,
986 const CXXBindTemporaryExpr *BTE,
987 const LocationContext *LC);
988
989 /// Returns true if the given expression corresponds to a temporary that
990 /// was constructed for passing into an elidable copy/move constructor
991 /// and that constructor was actually elided.
992 static bool isDestructorElided(ProgramStateRef State,
993 const CXXBindTemporaryExpr *BTE,
994 const LocationContext *LC);
995
996 /// Check if all objects under construction have been fully constructed
997 /// for the given context range (including FromLC, not including ToLC).
998 /// This is useful for assertions. Also checks if elided destructors
999 /// were cleaned up.
1000 static bool areAllObjectsFullyConstructed(ProgramStateRef State,
1001 const LocationContext *FromLC,
1002 const LocationContext *ToLC);
1003};
1004
1005/// Traits for storing the call processing policy inside GDM.
1006/// The GDM stores the corresponding CallExpr pointer.
1007// FIXME: This does not use the nice trait macros because it must be accessible
1008// from multiple translation units.
1010template <>
1012 public ProgramStatePartialTrait<const void*> {
1013 static void *GDMIndex();
1014};
1015
1016} // namespace ento
1017
1018} // namespace clang
1019
1020#endif // LLVM_CLANG_STATICANALYZER_CORE_PATHSENSITIVE_EXPRENGINE_H
#define V(N, I)
Definition: ASTContext.h:3255
BoundNodesTreeBuilder Nodes
DynTypedNode Node
StringRef P
StringRef Filename
Definition: Format.cpp:2977
Forward-declares and imports various common LLVM datatypes that clang wants to use unqualified.
C Language Family Type Representation.
Holds long-lived AST nodes (such as types and decls) that can be referred to throughout the semantic ...
Definition: ASTContext.h:182
AnalysisDeclContext contains the context data for the function, method or block under analysis.
Stores options for the analyzer from the command line.
Represents a loop initializing the elements of an array.
Definition: Expr.h:5481
ArraySubscriptExpr - [C99 6.5.2.1] Array Subscripting.
Definition: Expr.h:2639
AtomicExpr - Variadic atomic builtins: __atomic_exchange, __atomic_fetch_*, __atomic_load,...
Definition: Expr.h:6407
A builtin binary operation expression such as "x + y" or "x <= y".
Definition: Expr.h:3810
BlockExpr - Adaptor class for mixing a BlockDecl with expressions.
Definition: Expr.h:6143
Represents C++ object destructor implicitly generated for automatic object or temporary bound to cons...
Definition: CFG.h:417
Represents C++ object destructor implicitly generated for base object in destructor.
Definition: CFG.h:468
Represents a single basic block in a source-level CFG.
Definition: CFG.h:604
ElementRefImpl< true > ConstCFGElementRef
Definition: CFG.h:915
Represents C++ object destructor generated from a call to delete.
Definition: CFG.h:442
Represents a top-level expression in a basic block.
Definition: CFG.h:55
Represents C++ object destructor implicitly generated by compiler on various occasions.
Definition: CFG.h:366
Represents C++ base or member initializer from constructor's initialization list.
Definition: CFG.h:227
Represents C++ object destructor implicitly generated for member object in destructor.
Definition: CFG.h:489
Represents C++ object destructor implicitly generated at the end of full expression for temporary obj...
Definition: CFG.h:510
Represents binding an expression to a temporary.
Definition: ExprCXX.h:1475
CXXCatchStmt - This represents a C++ catch block.
Definition: StmtCXX.h:28
Represents a call to a C++ constructor.
Definition: ExprCXX.h:1530
Represents a delete expression for memory deallocation and destructor calls, e.g.
Definition: ExprCXX.h:2481
Represents a call to an inherited base class constructor from an inheriting constructor.
Definition: ExprCXX.h:1721
Represents a new-expression for memory allocation and constructor calls, e.g: "new CXXNewExpr(foo)".
Definition: ExprCXX.h:2224
Represents the this expression in C++.
Definition: ExprCXX.h:1148
Represents a point when we begin processing an inlined call.
Definition: ProgramPoint.h:628
CallExpr - Represents a function call (C99 6.5.2.2, C++ [expr.call]).
Definition: Expr.h:2795
CastExpr - Base class for type casts, including both implicit casts (ImplicitCastExpr) and explicit c...
Definition: Expr.h:3465
CompoundLiteralExpr - [C99 6.5.2.5].
Definition: Expr.h:3395
Represents a single point (AST node) in the program that requires attention during construction of an...
ConstructionContext's subclasses describe different ways of constructing an object in C++.
DeclStmt - Adaptor class for mixing declarations with statements and expressions.
Definition: Stmt.h:1495
Decl - This represents one declaration (or definition), e.g.
Definition: DeclBase.h:85
This represents one expression.
Definition: Expr.h:110
This represents a GCC inline-assembly statement extension.
Definition: Stmt.h:3257
Describes an C or C++ initializer list.
Definition: Expr.h:4817
A C++ lambda expression, which produces a function object (of unspecified type) that can be invoked l...
Definition: ExprCXX.h:1938
It wraps the AnalysisDeclContext to represent both the call stack with the help of StackFrameContext ...
This represents a Microsoft inline-assembly statement extension.
Definition: Stmt.h:3480
Represents a prvalue temporary that is written into memory so that a reference can bind to it.
Definition: ExprCXX.h:4679
MemberExpr - [C99 6.5.2.3] Structure and Union Members.
Definition: Expr.h:3158
This represents a decl that may have a name.
Definition: Decl.h:249
Represents Objective-C's @synchronized statement.
Definition: StmtObjC.h:303
Represents Objective-C's collection statement.
Definition: StmtObjC.h:23
ObjCIvarRefExpr - A reference to an ObjC instance variable.
Definition: ExprObjC.h:549
An expression that sends a message to the given Objective-C object or class.
Definition: ExprObjC.h:945
OffsetOfExpr - [C99 7.17] - This represents an expression of the form offsetof(record-type,...
Definition: Expr.h:2440
ProgramPoints can be "tagged" as representing points specific to a given analysis entity.
Definition: ProgramPoint.h:38
A (possibly-)qualified type.
Definition: Type.h:737
ReturnStmt - This represents a return, optionally of an expression: return; return 4;.
Definition: Stmt.h:3017
Stmt - This represents one statement.
Definition: Stmt.h:84
UnaryExprOrTypeTraitExpr - expression with either a type or (unevaluated) expression operand.
Definition: Expr.h:2543
UnaryOperator - This represents the unary-expression's (except sizeof and alignof),...
Definition: Expr.h:2158
This class is used for tools that requires cross translation unit capability.
ASTContext & getASTContext() override
AnalysisDeclContextManager & getAnalysisDeclContextManager()
CheckerManager * getCheckerManager() const
BugReporter is a utility class for generating PathDiagnostics for analysis.
Definition: BugReporter.h:585
Represents an abstract call to a function or method along a particular path.
Definition: CallEvent.h:152
CoreEngine - Implements the core logic of the graph-reachability analysis.
Definition: CoreEngine.h:56
DataTag::Factory & getDataTags()
Definition: CoreEngine.h:199
WorkList * getCTUWorkList() const
Definition: CoreEngine.h:177
bool wasBlocksExhausted() const
Definition: CoreEngine.h:165
WorkList * getWorkList() const
Definition: CoreEngine.h:176
bool ExecuteWorkListWithInitialState(const LocationContext *L, unsigned Steps, ProgramStateRef InitState, ExplodedNodeSet &Dst)
Returns true if there is still simulation state on the worklist.
Definition: CoreEngine.cpp:225
bool ExecuteWorkList(const LocationContext *L, unsigned Steps, ProgramStateRef InitState)
ExecuteWorkList - Run the worklist algorithm for a maximum number of steps.
Definition: CoreEngine.cpp:88
bool hasWorkRemaining() const
Definition: CoreEngine.h:166
roots_iterator roots_end()
roots_iterator roots_begin()
void processEndOfFunction(NodeBuilderContext &BC, ExplodedNode *Pred, const ReturnStmt *RS=nullptr)
Called by CoreEngine.
void VisitBinaryOperator(const BinaryOperator *B, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitBinaryOperator - Transfer function logic for binary operators.
Definition: ExprEngineC.cpp:40
bool ExecuteWorkListWithInitialState(const LocationContext *L, unsigned Steps, ProgramStateRef InitState, ExplodedNodeSet &Dst)
Execute the work list with an initial state.
Definition: ExprEngine.h:197
ProgramStateManager & getStateManager()
Definition: ExprEngine.h:418
void VisitArraySubscriptExpr(const ArraySubscriptExpr *Ex, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitArraySubscriptExpr - Transfer function for array accesses.
void VisitCommonDeclRefExpr(const Expr *DR, const NamedDecl *D, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Transfer function logic for DeclRefExprs and BlockDeclRefExprs.
void ProcessInitializer(const CFGInitializer I, ExplodedNode *Pred)
void VisitObjCMessage(const ObjCMessageExpr *ME, ExplodedNode *Pred, ExplodedNodeSet &Dst)
void ProcessTemporaryDtor(const CFGTemporaryDtor D, ExplodedNode *Pred, ExplodedNodeSet &Dst)
void VisitGuardedExpr(const Expr *Ex, const Expr *L, const Expr *R, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitGuardedExpr - Transfer function logic for ?, __builtin_choose.
void processCallEnter(NodeBuilderContext &BC, CallEnter CE, ExplodedNode *Pred)
Generate the entry node of the callee.
void processBeginOfFunction(NodeBuilderContext &BC, ExplodedNode *Pred, ExplodedNodeSet &Dst, const BlockEdge &L)
Called by CoreEngine.
void VisitCast(const CastExpr *CastE, const Expr *Ex, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitCast - Transfer function logic for all casts (implicit and explicit).
void removeDead(ExplodedNode *Node, ExplodedNodeSet &Out, const Stmt *ReferenceStmt, const LocationContext *LC, const Stmt *DiagnosticStmt=nullptr, ProgramPoint::Kind K=ProgramPoint::PreStmtPurgeDeadSymbolsKind)
Run the analyzer's garbage collection - remove dead symbols and bindings from the state.
BasicValueFactory & getBasicVals()
Definition: ExprEngine.h:427
void VisitLogicalExpr(const BinaryOperator *B, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitLogicalExpr - Transfer function logic for '&&', '||'.
std::pair< ProgramStateRef, SVal > handleConstructionContext(const Expr *E, ProgramStateRef State, const NodeBuilderContext *BldrCtx, const LocationContext *LCtx, const ConstructionContext *CC, EvalCallOptions &CallOpts, unsigned Idx=0)
A convenient wrapper around computeObjectUnderConstruction and updateObjectsUnderConstruction.
Definition: ExprEngine.h:746
void VisitCXXDestructor(QualType ObjectType, const MemRegion *Dest, const Stmt *S, bool IsBaseDtor, ExplodedNode *Pred, ExplodedNodeSet &Dst, EvalCallOptions &Options)
void VisitObjCAtSynchronizedStmt(const ObjCAtSynchronizedStmt *S, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Transfer function logic for ObjCAtSynchronizedStmts.
void VisitReturnStmt(const ReturnStmt *R, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitReturnStmt - Transfer function logic for return statements.
const CoreEngine & getCoreEngine() const
Definition: ExprEngine.h:441
SVal evalBinOp(ProgramStateRef ST, BinaryOperator::Opcode Op, SVal LHS, SVal RHS, QualType T)
Definition: ExprEngine.h:609
void VisitCXXNewExpr(const CXXNewExpr *CNE, ExplodedNode *Pred, ExplodedNodeSet &Dst)
ProgramStateRef processRegionChange(ProgramStateRef state, const MemRegion *MR, const LocationContext *LCtx)
Definition: ExprEngine.h:407
void VisitLambdaExpr(const LambdaExpr *LE, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitLambdaExpr - Transfer function logic for LambdaExprs.
void ProcessImplicitDtor(const CFGImplicitDtor D, ExplodedNode *Pred)
void VisitObjCForCollectionStmt(const ObjCForCollectionStmt *S, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitObjCForCollectionStmt - Transfer function logic for ObjCForCollectionStmt.
void VisitUnaryOperator(const UnaryOperator *B, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitUnaryOperator - Transfer function logic for unary operators.
ProgramStateRef getInitialState(const LocationContext *InitLoc)
getInitialState - Return the initial state used for the root vertex in the ExplodedGraph.
Definition: ExprEngine.cpp:244
void VisitLvalObjCIvarRefExpr(const ObjCIvarRefExpr *DR, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Transfer function logic for computing the lvalue of an Objective-C ivar.
static bool hasMoreIteration(ProgramStateRef State, const ObjCForCollectionStmt *O, const LocationContext *LC)
void VisitDeclStmt(const DeclStmt *DS, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitDeclStmt - Transfer function logic for DeclStmts.
void processCallExit(ExplodedNode *Pred)
Generate the sequence of nodes that simulate the call exit and the post visit for CallExpr.
ProgramStateRef handleLValueBitCast(ProgramStateRef state, const Expr *Ex, const LocationContext *LCtx, QualType T, QualType ExTy, const CastExpr *CastE, StmtNodeBuilder &Bldr, ExplodedNode *Pred)
void VisitMSAsmStmt(const MSAsmStmt *A, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitMSAsmStmt - Transfer function logic for MS inline asm.
static std::optional< SVal > getObjectUnderConstruction(ProgramStateRef State, const ConstructionContextItem &Item, const LocationContext *LC)
By looking at a certain item that may be potentially part of an object's ConstructionContext,...
Definition: ExprEngine.cpp:603
CFGElement getCurrentCFGElement()
Return the CFG element corresponding to the worklist element that is currently being processed by Exp...
Definition: ExprEngine.h:695
std::string DumpGraph(bool trim=false, StringRef Filename="")
Dump graph to the specified filename.
bool hasWorkRemaining() const
Definition: ExprEngine.h:439
void printJson(raw_ostream &Out, ProgramStateRef State, const LocationContext *LCtx, const char *NL, unsigned int Space, bool IsDot) const
printJson - Called by ProgramStateManager to print checker-specific data.
Definition: ExprEngine.cpp:939
virtual ~ExprEngine()=default
InliningModes
The modes of inlining, which override the default analysis-wide settings.
Definition: ExprEngine.h:129
@ Inline_Minimal
Do minimal inlining of callees.
Definition: ExprEngine.h:134
@ Inline_Regular
Follow the default settings for inlining callees.
Definition: ExprEngine.h:131
ProgramStateRef processPointerEscapedOnBind(ProgramStateRef State, ArrayRef< std::pair< SVal, SVal > > LocAndVals, const LocationContext *LCtx, PointerEscapeKind Kind, const CallEvent *Call)
Call PointerEscape callback when a value escapes as a result of bind.
SVal computeObjectUnderConstruction(const Expr *E, ProgramStateRef State, const NodeBuilderContext *BldrCtx, const LocationContext *LCtx, const ConstructionContext *CC, EvalCallOptions &CallOpts, unsigned Idx=0)
Find location of the object that is being constructed by a given constructor.
const LocationContext * getRootLocationContext() const
Definition: ExprEngine.h:232
static ProgramStateRef removeIterationState(ProgramStateRef State, const ObjCForCollectionStmt *O, const LocationContext *LC)
const ExplodedGraph & getGraph() const
Definition: ExprEngine.h:265
ProgramStateRef processAssume(ProgramStateRef state, SVal cond, bool assumption)
evalAssume - Callback function invoked by the ConstraintManager when making assumptions about state v...
Definition: ExprEngine.cpp:667
AnalysisDeclContextManager & getAnalysisDeclContextManager()
Definition: ExprEngine.h:208
static std::optional< unsigned > getIndexOfElementToConstruct(ProgramStateRef State, const CXXConstructExpr *E, const LocationContext *LCtx)
Retreives which element is being constructed in a non-POD type array.
Definition: ExprEngine.cpp:513
void VisitBlockExpr(const BlockExpr *BE, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitBlockExpr - Transfer function logic for BlockExprs.
void ProcessBaseDtor(const CFGBaseDtor D, ExplodedNode *Pred, ExplodedNodeSet &Dst)
void VisitIncrementDecrementOperator(const UnaryOperator *U, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Handle ++ and – (both pre- and post-increment).
void VisitCallExpr(const CallExpr *CE, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitCall - Transfer function for function calls.
ASTContext & getContext() const
getContext - Return the ASTContext associated with this analysis.
Definition: ExprEngine.h:204
StoreManager & getStoreManager()
Definition: ExprEngine.h:420
void VisitCXXNewAllocatorCall(const CXXNewExpr *CNE, ExplodedNode *Pred, ExplodedNodeSet &Dst)
void CreateCXXTemporaryObject(const MaterializeTemporaryExpr *ME, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Create a C++ temporary object for an rvalue.
CFGBlock::ConstCFGElementRef getCFGElementRef() const
Definition: ExprEngine.h:237
void evalCall(ExplodedNodeSet &Dst, ExplodedNode *Pred, const CallEvent &Call)
Evaluate a call, running pre- and post-call checkers and allowing checkers to be responsible for hand...
void VisitGCCAsmStmt(const GCCAsmStmt *A, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitGCCAsmStmt - Transfer function logic for inline asm.
BugReporter & getBugReporter()
Definition: ExprEngine.h:218
void processCFGBlockEntrance(const BlockEdge &L, NodeBuilderWithSinks &nodeBuilder, ExplodedNode *Pred)
Called by CoreEngine when processing the entrance of a CFGBlock.
void VisitInitListExpr(const InitListExpr *E, ExplodedNode *Pred, ExplodedNodeSet &Dst)
bool hasEmptyWorkList() const
Definition: ExprEngine.h:438
void processBranch(const Stmt *Condition, NodeBuilderContext &BuilderCtx, ExplodedNode *Pred, ExplodedNodeSet &Dst, const CFGBlock *DstT, const CFGBlock *DstF)
ProcessBranch - Called by CoreEngine.
ProgramStateRef processRegionChanges(ProgramStateRef state, const InvalidatedSymbols *invalidated, ArrayRef< const MemRegion * > ExplicitRegions, ArrayRef< const MemRegion * > Regions, const LocationContext *LCtx, const CallEvent *Call)
processRegionChanges - Called by ProgramStateManager whenever a change is made to the store.
Definition: ExprEngine.cpp:673
void ProcessStmt(const Stmt *S, ExplodedNode *Pred)
void ViewGraph(bool trim=false)
Visualize the ExplodedGraph created by executing the simulation.
static std::optional< unsigned > getPendingArrayDestruction(ProgramStateRef State, const LocationContext *LCtx)
Retreives which element is being destructed in a non-POD type array.
Definition: ExprEngine.cpp:532
ProgramStateRef notifyCheckersOfPointerEscape(ProgramStateRef State, const InvalidatedSymbols *Invalidated, ArrayRef< const MemRegion * > ExplicitRegions, const CallEvent *Call, RegionAndSymbolInvalidationTraits &ITraits)
Call PointerEscape callback when a value escapes as a result of region invalidation.
void processCFGElement(const CFGElement E, ExplodedNode *Pred, unsigned StmtIdx, NodeBuilderContext *Ctx)
processCFGElement - Called by CoreEngine.
Definition: ExprEngine.cpp:966
void processStaticInitializer(const DeclStmt *DS, NodeBuilderContext &BuilderCtx, ExplodedNode *Pred, ExplodedNodeSet &Dst, const CFGBlock *DstT, const CFGBlock *DstF)
Called by CoreEngine.
void VisitUnaryExprOrTypeTraitExpr(const UnaryExprOrTypeTraitExpr *Ex, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitUnaryExprOrTypeTraitExpr - Transfer function for sizeof.
cross_tu::CrossTranslationUnitContext * getCrossTranslationUnitContext()
Definition: ExprEngine.h:221
void ProcessLoopExit(const Stmt *S, ExplodedNode *Pred)
void processSwitch(SwitchNodeBuilder &builder)
ProcessSwitch - Called by CoreEngine.
void processEndWorklist()
Called by CoreEngine when the analysis worklist has terminated.
Definition: ExprEngine.cpp:960
CheckerManager & getCheckerManager() const
Definition: ExprEngine.h:212
SymbolManager & getSymbolManager()
Definition: ExprEngine.h:431
void VisitAtomicExpr(const AtomicExpr *E, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitAtomicExpr - Transfer function for builtin atomic expressions.
bool wasBlocksExhausted() const
Definition: ExprEngine.h:437
MemRegionManager & getRegionManager()
Definition: ExprEngine.h:432
ProgramStateRef bindReturnValue(const CallEvent &Call, const LocationContext *LCtx, ProgramStateRef State)
Create a new state in which the call return value is binded to the call origin expression.
void ProcessMemberDtor(const CFGMemberDtor D, ExplodedNode *Pred, ExplodedNodeSet &Dst)
void VisitCXXThisExpr(const CXXThisExpr *TE, ExplodedNode *Pred, ExplodedNodeSet &Dst)
void VisitCXXDeleteExpr(const CXXDeleteExpr *CDE, ExplodedNode *Pred, ExplodedNodeSet &Dst)
void VisitMemberExpr(const MemberExpr *M, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitMemberExpr - Transfer function for member expressions.
void VisitCXXConstructExpr(const CXXConstructExpr *E, ExplodedNode *Pred, ExplodedNodeSet &Dst)
void VisitCXXInheritedCtorInitExpr(const CXXInheritedCtorInitExpr *E, ExplodedNode *Pred, ExplodedNodeSet &Dst)
ConstraintManager & getConstraintManager()
Definition: ExprEngine.h:422
DataTag::Factory & getDataTags()
Definition: ExprEngine.h:434
void processCleanupTemporaryBranch(const CXXBindTemporaryExpr *BTE, NodeBuilderContext &BldCtx, ExplodedNode *Pred, ExplodedNodeSet &Dst, const CFGBlock *DstT, const CFGBlock *DstF)
Called by CoreEngine.
void ProcessAutomaticObjDtor(const CFGAutomaticObjDtor D, ExplodedNode *Pred, ExplodedNodeSet &Dst)
void evalEagerlyAssumeBinOpBifurcation(ExplodedNodeSet &Dst, ExplodedNodeSet &Src, const Expr *Ex)
evalEagerlyAssumeBinOpBifurcation - Given the nodes in 'Src', eagerly assume symbolic expressions of ...
const Stmt * getStmt() const
void VisitOffsetOfExpr(const OffsetOfExpr *Ex, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitOffsetOfExpr - Transfer function for offsetof.
void evalLoad(ExplodedNodeSet &Dst, const Expr *NodeEx, const Expr *BoundExpr, ExplodedNode *Pred, ProgramStateRef St, SVal location, const ProgramPointTag *tag=nullptr, QualType LoadTy=QualType())
Simulate a read of the result of Ex.
void handleUOExtension(ExplodedNode *N, const UnaryOperator *U, StmtNodeBuilder &Bldr)
void removeDeadOnEndOfFunction(NodeBuilderContext &BC, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Remove dead bindings/symbols before exiting a function.
static std::pair< const ProgramPointTag *, const ProgramPointTag * > geteagerlyAssumeBinOpBifurcationTags()
void Visit(const Stmt *S, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Visit - Transfer function logic for all statements.
void defaultEvalCall(NodeBuilder &B, ExplodedNode *Pred, const CallEvent &Call, const EvalCallOptions &CallOpts={})
Default implementation of call evaluation.
AnalysisManager & getAnalysisManager()
Definition: ExprEngine.h:206
ExplodedGraph & getGraph()
Definition: ExprEngine.h:264
void ProcessDeleteDtor(const CFGDeleteDtor D, ExplodedNode *Pred, ExplodedNodeSet &Dst)
void VisitCXXCatchStmt(const CXXCatchStmt *CS, ExplodedNode *Pred, ExplodedNodeSet &Dst)
void VisitCompoundLiteralExpr(const CompoundLiteralExpr *CL, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitCompoundLiteralExpr - Transfer function logic for compound literals.
SValBuilder & getSValBuilder()
Definition: ExprEngine.h:216
void VisitArrayInitLoopExpr(const ArrayInitLoopExpr *Ex, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitArrayInitLoopExpr - Transfer function for array init loop.
ProgramStateRef updateObjectsUnderConstruction(SVal V, const Expr *E, ProgramStateRef State, const LocationContext *LCtx, const ConstructionContext *CC, const EvalCallOptions &CallOpts)
Update the program state with all the path-sensitive information that's necessary to perform construc...
bool ExecuteWorkList(const LocationContext *L, unsigned Steps=150000)
Returns true if there is still simulation state on the worklist.
Definition: ExprEngine.h:189
void evalStore(ExplodedNodeSet &Dst, const Expr *AssignE, const Expr *StoreE, ExplodedNode *Pred, ProgramStateRef St, SVal TargetLV, SVal Val, const ProgramPointTag *tag=nullptr)
evalStore - Handle the semantics of a store via an assignment.
void VisitCXXBindTemporaryExpr(const CXXBindTemporaryExpr *BTE, ExplodedNodeSet &PreVisit, ExplodedNodeSet &Dst)
void processIndirectGoto(IndirectGotoNodeBuilder &builder)
processIndirectGoto - Called by CoreEngine.
const NodeBuilderContext & getBuilderContext()
Definition: ExprEngine.h:225
static ProgramStateRef setWhetherHasMoreIteration(ProgramStateRef State, const ObjCForCollectionStmt *O, const LocationContext *LC, bool HasMoreIteraton)
Note whether this loop has any more iteratios to model.
static std::optional< unsigned > getPendingInitLoop(ProgramStateRef State, const CXXConstructExpr *E, const LocationContext *LCtx)
Retreives the size of the array in the pending ArrayInitLoopExpr.
Definition: ExprEngine.cpp:486
void ProcessNewAllocator(const CXXNewExpr *NE, ExplodedNode *Pred)
MemRegion - The root abstract class for all memory regions.
Definition: MemRegion.h:96
This node builder keeps track of the generated sink nodes.
Definition: CoreEngine.h:345
This is the simplest builder which generates nodes in the ExplodedGraph.
Definition: CoreEngine.h:238
GRBugReporter is used for generating path-sensitive reports.
Definition: BugReporter.h:668
BasicValueFactory & getBasicVals()
Definition: ProgramState.h:549
ConstraintManager & getConstraintManager()
Definition: ProgramState.h:580
Information about invalidation for a particular region/symbol.
Definition: MemRegion.h:1624
SVal evalBinOp(ProgramStateRef state, BinaryOperator::Opcode op, SVal lhs, SVal rhs, QualType type)
SVal - This represents a symbolic expression, which can be either an L-value or an R-value.
Definition: SVals.h:55
This builder class is useful for generating nodes that resulted from visiting a statement.
Definition: CoreEngine.h:382
virtual bool hasWork() const =0
@ Decl
The l-value was an access to a declared entity or something equivalently strong, like the address of ...
PointerEscapeKind
Describes the different reasons a pointer escapes during analysis.
IntrusiveRefCntPtr< const ProgramState > ProgramStateRef
The JSON file list parser is used to communicate input to InstallAPI.
BinaryOperatorKind
@ Result
The result type of a method or function.
Hints for figuring out of a call should be inlined during evalCall().
Definition: ExprEngine.h:97
bool IsTemporaryLifetimeExtendedViaAggregate
This call is a constructor for a temporary that is lifetime-extended by binding it to a reference-typ...
Definition: ExprEngine.h:112
bool IsTemporaryCtorOrDtor
This call is a constructor or a destructor of a temporary value.
Definition: ExprEngine.h:107
bool IsArrayCtorOrDtor
This call is a constructor or a destructor for a single element within an array, a part of array cons...
Definition: ExprEngine.h:104
bool IsElidableCtorThatHasNotBeenElided
This call is a pre-C++17 elidable constructor that we failed to elide because we failed to compute th...
Definition: ExprEngine.h:119
bool IsCtorOrDtorWithImproperlyModeledTargetRegion
This call is a constructor or a destructor for which we do not currently compute the this-region corr...
Definition: ExprEngine.h:100
const CFGBlock * getBlock() const
Return the CFGBlock associated with this builder.
Definition: CoreEngine.h:218
Traits for storing the call processing policy inside GDM.
Definition: ExprEngine.h:1009