clang  14.0.0git
ExprEngine.h
Go to the documentation of this file.
1 //===- ExprEngine.h - Path-Sensitive Expression-Level Dataflow --*- C++ -*-===//
2 //
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6 //
7 //===----------------------------------------------------------------------===//
8 //
9 // This file defines a meta-engine for path-sensitive dataflow analysis that
10 // is built on CoreEngine, but provides the boilerplate to execute transfer
11 // functions and build the ExplodedGraph at the expression level.
12 //
13 //===----------------------------------------------------------------------===//
14 
15 #ifndef LLVM_CLANG_STATICANALYZER_CORE_PATHSENSITIVE_EXPRENGINE_H
16 #define LLVM_CLANG_STATICANALYZER_CORE_PATHSENSITIVE_EXPRENGINE_H
17 
18 #include "clang/AST/Expr.h"
19 #include "clang/AST/Type.h"
20 #include "clang/Analysis/CFG.h"
23 #include "clang/Basic/LLVM.h"
37 #include "llvm/ADT/ArrayRef.h"
38 #include <cassert>
39 #include <utility>
40 
41 namespace clang {
42 
43 class AnalysisDeclContextManager;
44 class AnalyzerOptions;
45 class ASTContext;
46 class CFGBlock;
47 class CFGElement;
48 class ConstructionContext;
49 class CXXBindTemporaryExpr;
50 class CXXCatchStmt;
51 class CXXConstructExpr;
52 class CXXDeleteExpr;
53 class CXXNewExpr;
54 class CXXThisExpr;
55 class Decl;
56 class DeclStmt;
57 class GCCAsmStmt;
58 class LambdaExpr;
59 class LocationContext;
60 class MaterializeTemporaryExpr;
61 class MSAsmStmt;
62 class NamedDecl;
63 class ObjCAtSynchronizedStmt;
64 class ObjCForCollectionStmt;
65 class ObjCIvarRefExpr;
66 class ObjCMessageExpr;
67 class ReturnStmt;
68 class Stmt;
69 
70 namespace cross_tu {
71 
72 class CrossTranslationUnitContext;
73 
74 } // namespace cross_tu
75 
76 namespace ento {
77 
78 class AnalysisManager;
79 class BasicValueFactory;
80 class BlockCounter;
81 class BranchNodeBuilder;
82 class CallEvent;
83 class CheckerManager;
84 class ConstraintManager;
85 class CXXTempObjectRegion;
86 class EndOfFunctionNodeBuilder;
87 class ExplodedNodeSet;
88 class ExplodedNode;
89 class IndirectGotoNodeBuilder;
90 class MemRegion;
91 struct NodeBuilderContext;
92 class NodeBuilderWithSinks;
93 class ProgramState;
94 class ProgramStateManager;
95 class RegionAndSymbolInvalidationTraits;
96 class SymbolManager;
97 class SwitchNodeBuilder;
98 
99 /// Hints for figuring out of a call should be inlined during evalCall().
101  /// This call is a constructor or a destructor for which we do not currently
102  /// compute the this-region correctly.
104 
105  /// This call is a constructor or a destructor for a single element within
106  /// an array, a part of array construction or destruction.
107  bool IsArrayCtorOrDtor = false;
108 
109  /// This call is a constructor or a destructor of a temporary value.
110  bool IsTemporaryCtorOrDtor = false;
111 
112  /// This call is a constructor for a temporary that is lifetime-extended
113  /// by binding it to a reference-type field within an aggregate,
114  /// for example 'A { const C &c; }; A a = { C() };'
116 
117  /// This call is a pre-C++17 elidable constructor that we failed to elide
118  /// because we failed to compute the target region into which
119  /// this constructor would have been ultimately elided. Analysis that
120  /// we perform in this case is still correct but it behaves differently,
121  /// as if copy elision is disabled.
123 
125 };
126 
127 class ExprEngine {
128  void anchor();
129 
130 public:
131  /// The modes of inlining, which override the default analysis-wide settings.
133  /// Follow the default settings for inlining callees.
135 
136  /// Do minimal inlining of callees.
138  };
139 
140 private:
142 
143  AnalysisManager &AMgr;
144 
145  AnalysisDeclContextManager &AnalysisDeclContexts;
146 
147  CoreEngine Engine;
148 
149  /// G - the simulation graph.
150  ExplodedGraph &G;
151 
152  /// StateMgr - Object that manages the data for all created states.
153  ProgramStateManager StateMgr;
154 
155  /// SymMgr - Object that manages the symbol information.
156  SymbolManager &SymMgr;
157 
158  /// MRMgr - MemRegionManager object that creates memory regions.
159  MemRegionManager &MRMgr;
160 
161  /// svalBuilder - SValBuilder object that creates SVals from expressions.
162  SValBuilder &svalBuilder;
163 
164  unsigned int currStmtIdx = 0;
165  const NodeBuilderContext *currBldrCtx = nullptr;
166 
167  /// Helper object to determine if an Objective-C message expression
168  /// implicitly never returns.
169  ObjCNoReturn ObjCNoRet;
170 
171  /// The BugReporter associated with this engine. It is important that
172  /// this object be placed at the very end of member variables so that its
173  /// destructor is called before the rest of the ExprEngine is destroyed.
175 
176  /// The functions which have been analyzed through inlining. This is owned by
177  /// AnalysisConsumer. It can be null.
178  SetOfConstDecls *VisitedCallees;
179 
180  /// The flag, which specifies the mode of inlining for the engine.
181  InliningModes HowToInline;
182 
183 public:
185  SetOfConstDecls *VisitedCalleesIn,
186  FunctionSummariesTy *FS, InliningModes HowToInlineIn);
187 
188  virtual ~ExprEngine() = default;
189 
190  /// Returns true if there is still simulation state on the worklist.
191  bool ExecuteWorkList(const LocationContext *L, unsigned Steps = 150000) {
192  return Engine.ExecuteWorkList(L, Steps, nullptr);
193  }
194 
195  /// Execute the work list with an initial state. Nodes that reaches the exit
196  /// of the function are added into the Dst set, which represent the exit
197  /// state of the function call. Returns true if there is still simulation
198  /// state on the worklist.
199  bool ExecuteWorkListWithInitialState(const LocationContext *L, unsigned Steps,
200  ProgramStateRef InitState,
201  ExplodedNodeSet &Dst) {
202  return Engine.ExecuteWorkListWithInitialState(L, Steps, InitState, Dst);
203  }
204 
205  /// getContext - Return the ASTContext associated with this analysis.
206  ASTContext &getContext() const { return AMgr.getASTContext(); }
207 
209 
211  return AMgr.getAnalysisDeclContextManager();
212  }
213 
215  return *AMgr.getCheckerManager();
216  }
217 
218  SValBuilder &getSValBuilder() { return svalBuilder; }
219 
220  BugReporter &getBugReporter() { return BR; }
221 
224  return &CTU;
225  }
226 
228  assert(currBldrCtx);
229  return *currBldrCtx;
230  }
231 
232  const Stmt *getStmt() const;
233 
237 
238 
239  /// Dump graph to the specified filename.
240  /// If filename is empty, generate a temporary one.
241  /// \return The filename the graph is written into.
242  std::string DumpGraph(bool trim = false, StringRef Filename="");
243 
244  /// Dump the graph consisting of the given nodes to a specified filename.
245  /// Generate a temporary filename if it's not provided.
246  /// \return The filename the graph is written into.
248  StringRef Filename = "");
249 
250  /// Visualize the ExplodedGraph created by executing the simulation.
251  void ViewGraph(bool trim = false);
252 
253  /// Visualize a trimmed ExplodedGraph that only contains paths to the given
254  /// nodes.
256 
257  /// getInitialState - Return the initial state used for the root vertex
258  /// in the ExplodedGraph.
260 
261  ExplodedGraph &getGraph() { return G; }
262  const ExplodedGraph &getGraph() const { return G; }
263 
264  /// Run the analyzer's garbage collection - remove dead symbols and
265  /// bindings from the state.
266  ///
267  /// Checkers can participate in this process with two callbacks:
268  /// \c checkLiveSymbols and \c checkDeadSymbols. See the CheckerDocumentation
269  /// class for more information.
270  ///
271  /// \param Node The predecessor node, from which the processing should start.
272  /// \param Out The returned set of output nodes.
273  /// \param ReferenceStmt The statement which is about to be processed.
274  /// Everything needed for this statement should be considered live.
275  /// A null statement means that everything in child LocationContexts
276  /// is dead.
277  /// \param LC The location context of the \p ReferenceStmt. A null location
278  /// context means that we have reached the end of analysis and that
279  /// all statements and local variables should be considered dead.
280  /// \param DiagnosticStmt Used as a location for any warnings that should
281  /// occur while removing the dead (e.g. leaks). By default, the
282  /// \p ReferenceStmt is used.
283  /// \param K Denotes whether this is a pre- or post-statement purge. This
284  /// must only be ProgramPoint::PostStmtPurgeDeadSymbolsKind if an
285  /// entire location context is being cleared, in which case the
286  /// \p ReferenceStmt must either be a ReturnStmt or \c NULL. Otherwise,
287  /// it must be ProgramPoint::PreStmtPurgeDeadSymbolsKind (the default)
288  /// and \p ReferenceStmt must be valid (non-null).
290  const Stmt *ReferenceStmt, const LocationContext *LC,
291  const Stmt *DiagnosticStmt = nullptr,
293 
294  /// processCFGElement - Called by CoreEngine. Used to generate new successor
295  /// nodes by processing the 'effects' of a CFG element.
296  void processCFGElement(const CFGElement E, ExplodedNode *Pred,
297  unsigned StmtIdx, NodeBuilderContext *Ctx);
298 
299  void ProcessStmt(const Stmt *S, ExplodedNode *Pred);
300 
301  void ProcessLoopExit(const Stmt* S, ExplodedNode *Pred);
302 
303  void ProcessInitializer(const CFGInitializer I, ExplodedNode *Pred);
304 
305  void ProcessImplicitDtor(const CFGImplicitDtor D, ExplodedNode *Pred);
306 
307  void ProcessNewAllocator(const CXXNewExpr *NE, ExplodedNode *Pred);
308 
310  ExplodedNode *Pred, ExplodedNodeSet &Dst);
311  void ProcessDeleteDtor(const CFGDeleteDtor D,
312  ExplodedNode *Pred, ExplodedNodeSet &Dst);
313  void ProcessBaseDtor(const CFGBaseDtor D,
314  ExplodedNode *Pred, ExplodedNodeSet &Dst);
315  void ProcessMemberDtor(const CFGMemberDtor D,
316  ExplodedNode *Pred, ExplodedNodeSet &Dst);
318  ExplodedNode *Pred, ExplodedNodeSet &Dst);
319 
320  /// Called by CoreEngine when processing the entrance of a CFGBlock.
321  void processCFGBlockEntrance(const BlockEdge &L,
322  NodeBuilderWithSinks &nodeBuilder,
323  ExplodedNode *Pred);
324 
325  /// ProcessBranch - Called by CoreEngine. Used to generate successor
326  /// nodes by processing the 'effects' of a branch condition.
327  void processBranch(const Stmt *Condition,
328  NodeBuilderContext& BuilderCtx,
329  ExplodedNode *Pred,
330  ExplodedNodeSet &Dst,
331  const CFGBlock *DstT,
332  const CFGBlock *DstF);
333 
334  /// Called by CoreEngine.
335  /// Used to generate successor nodes for temporary destructors depending
336  /// on whether the corresponding constructor was visited.
338  NodeBuilderContext &BldCtx,
339  ExplodedNode *Pred, ExplodedNodeSet &Dst,
340  const CFGBlock *DstT,
341  const CFGBlock *DstF);
342 
343  /// Called by CoreEngine. Used to processing branching behavior
344  /// at static initializers.
345  void processStaticInitializer(const DeclStmt *DS,
346  NodeBuilderContext& BuilderCtx,
347  ExplodedNode *Pred,
348  ExplodedNodeSet &Dst,
349  const CFGBlock *DstT,
350  const CFGBlock *DstF);
351 
352  /// processIndirectGoto - Called by CoreEngine. Used to generate successor
353  /// nodes by processing the 'effects' of a computed goto jump.
355 
356  /// ProcessSwitch - Called by CoreEngine. Used to generate successor
357  /// nodes by processing the 'effects' of a switch statement.
358  void processSwitch(SwitchNodeBuilder& builder);
359 
360  /// Called by CoreEngine. Used to notify checkers that processing a
361  /// function has begun. Called for both inlined and and top-level functions.
363  ExplodedNode *Pred, ExplodedNodeSet &Dst,
364  const BlockEdge &L);
365 
366  /// Called by CoreEngine. Used to notify checkers that processing a
367  /// function has ended. Called for both inlined and and top-level functions.
369  ExplodedNode *Pred,
370  const ReturnStmt *RS = nullptr);
371 
372  /// Remove dead bindings/symbols before exiting a function.
374  ExplodedNode *Pred,
375  ExplodedNodeSet &Dst);
376 
377  /// Generate the entry node of the callee.
379  ExplodedNode *Pred);
380 
381  /// Generate the sequence of nodes that simulate the call exit and the post
382  /// visit for CallExpr.
383  void processCallExit(ExplodedNode *Pred);
384 
385  /// Called by CoreEngine when the analysis worklist has terminated.
386  void processEndWorklist();
387 
388  /// evalAssume - Callback function invoked by the ConstraintManager when
389  /// making assumptions about state values.
391  bool assumption);
392 
393  /// processRegionChanges - Called by ProgramStateManager whenever a change is made
394  /// to the store. Used to update checkers that track region values.
397  const InvalidatedSymbols *invalidated,
398  ArrayRef<const MemRegion *> ExplicitRegions,
400  const LocationContext *LCtx,
401  const CallEvent *Call);
402 
403  inline ProgramStateRef
405  const MemRegion* MR,
406  const LocationContext *LCtx) {
407  return processRegionChanges(state, nullptr, MR, MR, LCtx, nullptr);
408  }
409 
410  /// printJson - Called by ProgramStateManager to print checker-specific data.
411  void printJson(raw_ostream &Out, ProgramStateRef State,
412  const LocationContext *LCtx, const char *NL,
413  unsigned int Space, bool IsDot) const;
414 
415  ProgramStateManager &getStateManager() { return StateMgr; }
416 
417  StoreManager &getStoreManager() { return StateMgr.getStoreManager(); }
418 
420  return StateMgr.getConstraintManager();
421  }
422 
423  // FIXME: Remove when we migrate over to just using SValBuilder.
425  return StateMgr.getBasicVals();
426  }
427 
428  SymbolManager &getSymbolManager() { return SymMgr; }
429  MemRegionManager &getRegionManager() { return MRMgr; }
430 
431  DataTag::Factory &getDataTags() { return Engine.getDataTags(); }
432 
433  // Functions for external checking of whether we have unfinished work
434  bool wasBlocksExhausted() const { return Engine.wasBlocksExhausted(); }
435  bool hasEmptyWorkList() const { return !Engine.getWorkList()->hasWork(); }
436  bool hasWorkRemaining() const { return Engine.hasWorkRemaining(); }
437 
438  const CoreEngine &getCoreEngine() const { return Engine; }
439 
440 public:
441  /// Visit - Transfer function logic for all statements. Dispatches to
442  /// other functions that handle specific kinds of statements.
443  void Visit(const Stmt *S, ExplodedNode *Pred, ExplodedNodeSet &Dst);
444 
445  /// VisitArraySubscriptExpr - Transfer function for array accesses.
447  ExplodedNode *Pred,
448  ExplodedNodeSet &Dst);
449 
450  /// VisitGCCAsmStmt - Transfer function logic for inline asm.
451  void VisitGCCAsmStmt(const GCCAsmStmt *A, ExplodedNode *Pred,
452  ExplodedNodeSet &Dst);
453 
454  /// VisitMSAsmStmt - Transfer function logic for MS inline asm.
455  void VisitMSAsmStmt(const MSAsmStmt *A, ExplodedNode *Pred,
456  ExplodedNodeSet &Dst);
457 
458  /// VisitBlockExpr - Transfer function logic for BlockExprs.
459  void VisitBlockExpr(const BlockExpr *BE, ExplodedNode *Pred,
460  ExplodedNodeSet &Dst);
461 
462  /// VisitLambdaExpr - Transfer function logic for LambdaExprs.
463  void VisitLambdaExpr(const LambdaExpr *LE, ExplodedNode *Pred,
464  ExplodedNodeSet &Dst);
465 
466  /// VisitBinaryOperator - Transfer function logic for binary operators.
467  void VisitBinaryOperator(const BinaryOperator* B, ExplodedNode *Pred,
468  ExplodedNodeSet &Dst);
469 
470 
471  /// VisitCall - Transfer function for function calls.
472  void VisitCallExpr(const CallExpr *CE, ExplodedNode *Pred,
473  ExplodedNodeSet &Dst);
474 
475  /// VisitCast - Transfer function logic for all casts (implicit and explicit).
476  void VisitCast(const CastExpr *CastE, const Expr *Ex, ExplodedNode *Pred,
477  ExplodedNodeSet &Dst);
478 
479  /// VisitCompoundLiteralExpr - Transfer function logic for compound literals.
481  ExplodedNode *Pred, ExplodedNodeSet &Dst);
482 
483  /// Transfer function logic for DeclRefExprs and BlockDeclRefExprs.
484  void VisitCommonDeclRefExpr(const Expr *DR, const NamedDecl *D,
485  ExplodedNode *Pred, ExplodedNodeSet &Dst);
486 
487  /// VisitDeclStmt - Transfer function logic for DeclStmts.
488  void VisitDeclStmt(const DeclStmt *DS, ExplodedNode *Pred,
489  ExplodedNodeSet &Dst);
490 
491  /// VisitGuardedExpr - Transfer function logic for ?, __builtin_choose
492  void VisitGuardedExpr(const Expr *Ex, const Expr *L, const Expr *R,
493  ExplodedNode *Pred, ExplodedNodeSet &Dst);
494 
495  void VisitInitListExpr(const InitListExpr *E, ExplodedNode *Pred,
496  ExplodedNodeSet &Dst);
497 
498  /// VisitLogicalExpr - Transfer function logic for '&&', '||'
499  void VisitLogicalExpr(const BinaryOperator* B, ExplodedNode *Pred,
500  ExplodedNodeSet &Dst);
501 
502  /// VisitMemberExpr - Transfer function for member expressions.
503  void VisitMemberExpr(const MemberExpr *M, ExplodedNode *Pred,
504  ExplodedNodeSet &Dst);
505 
506  /// VisitAtomicExpr - Transfer function for builtin atomic expressions
507  void VisitAtomicExpr(const AtomicExpr *E, ExplodedNode *Pred,
508  ExplodedNodeSet &Dst);
509 
510  /// Transfer function logic for ObjCAtSynchronizedStmts.
512  ExplodedNode *Pred, ExplodedNodeSet &Dst);
513 
514  /// Transfer function logic for computing the lvalue of an Objective-C ivar.
516  ExplodedNodeSet &Dst);
517 
518  /// VisitObjCForCollectionStmt - Transfer function logic for
519  /// ObjCForCollectionStmt.
521  ExplodedNode *Pred, ExplodedNodeSet &Dst);
522 
523  void VisitObjCMessage(const ObjCMessageExpr *ME, ExplodedNode *Pred,
524  ExplodedNodeSet &Dst);
525 
526  /// VisitReturnStmt - Transfer function logic for return statements.
527  void VisitReturnStmt(const ReturnStmt *R, ExplodedNode *Pred,
528  ExplodedNodeSet &Dst);
529 
530  /// VisitOffsetOfExpr - Transfer function for offsetof.
531  void VisitOffsetOfExpr(const OffsetOfExpr *Ex, ExplodedNode *Pred,
532  ExplodedNodeSet &Dst);
533 
534  /// VisitUnaryExprOrTypeTraitExpr - Transfer function for sizeof.
536  ExplodedNode *Pred, ExplodedNodeSet &Dst);
537 
538  /// VisitUnaryOperator - Transfer function logic for unary operators.
539  void VisitUnaryOperator(const UnaryOperator* B, ExplodedNode *Pred,
540  ExplodedNodeSet &Dst);
541 
542  /// Handle ++ and -- (both pre- and post-increment).
544  ExplodedNode *Pred,
545  ExplodedNodeSet &Dst);
546 
548  ExplodedNodeSet &PreVisit,
549  ExplodedNodeSet &Dst);
550 
551  void VisitCXXCatchStmt(const CXXCatchStmt *CS, ExplodedNode *Pred,
552  ExplodedNodeSet &Dst);
553 
554  void VisitCXXThisExpr(const CXXThisExpr *TE, ExplodedNode *Pred,
555  ExplodedNodeSet & Dst);
556 
558  ExplodedNodeSet &Dst);
559 
561  ExplodedNode *Pred, ExplodedNodeSet &Dst);
562 
563  void VisitCXXDestructor(QualType ObjectType, const MemRegion *Dest,
564  const Stmt *S, bool IsBaseDtor,
565  ExplodedNode *Pred, ExplodedNodeSet &Dst,
566  EvalCallOptions &Options);
567 
568  void VisitCXXNewAllocatorCall(const CXXNewExpr *CNE,
569  ExplodedNode *Pred,
570  ExplodedNodeSet &Dst);
571 
572  void VisitCXXNewExpr(const CXXNewExpr *CNE, ExplodedNode *Pred,
573  ExplodedNodeSet &Dst);
574 
575  void VisitCXXDeleteExpr(const CXXDeleteExpr *CDE, ExplodedNode *Pred,
576  ExplodedNodeSet &Dst);
577 
578  /// Create a C++ temporary object for an rvalue.
580  ExplodedNode *Pred,
581  ExplodedNodeSet &Dst);
582 
583  /// evalEagerlyAssumeBinOpBifurcation - Given the nodes in 'Src', eagerly assume symbolic
584  /// expressions of the form 'x != 0' and generate new nodes (stored in Dst)
585  /// with those assumptions.
587  const Expr *Ex);
588 
589  static std::pair<const ProgramPointTag *, const ProgramPointTag *>
591 
593  return X.isValid() ? svalBuilder.evalMinus(X.castAs<NonLoc>()) : X;
594  }
595 
597  return X.isValid() ? svalBuilder.evalComplement(X.castAs<NonLoc>()) : X;
598  }
599 
601  const LocationContext *LCtx, QualType T,
602  QualType ExTy, const CastExpr *CastE,
603  StmtNodeBuilder &Bldr,
604  ExplodedNode *Pred);
605 
607  const LocationContext *LCtx,
608  const CastExpr *CastE,
609  StmtNodeBuilder &Bldr,
610  ExplodedNode *Pred);
611 
613  const UnaryOperator* U,
614  StmtNodeBuilder &Bldr);
615 
616 public:
618  NonLoc L, NonLoc R, QualType T) {
619  return svalBuilder.evalBinOpNN(state, op, L, R, T);
620  }
621 
623  NonLoc L, SVal R, QualType T) {
624  return R.isValid() ? svalBuilder.evalBinOpNN(state, op, L,
625  R.castAs<NonLoc>(), T) : R;
626  }
627 
629  SVal LHS, SVal RHS, QualType T) {
630  return svalBuilder.evalBinOp(ST, Op, LHS, RHS, T);
631  }
632 
633  /// By looking at a certain item that may be potentially part of an object's
634  /// ConstructionContext, retrieve such object's location. A particular
635  /// statement can be transparently passed as \p Item in most cases.
636  static Optional<SVal>
638  const ConstructionContextItem &Item,
639  const LocationContext *LC);
640 
641  /// Call PointerEscape callback when a value escapes as a result of bind.
643  ProgramStateRef State, ArrayRef<std::pair<SVal, SVal>> LocAndVals,
645  const CallEvent *Call);
646 
647  /// Call PointerEscape callback when a value escapes as a result of
648  /// region invalidation.
649  /// \param[in] ITraits Specifies invalidation traits for regions/symbols.
652  const InvalidatedSymbols *Invalidated,
653  ArrayRef<const MemRegion *> ExplicitRegions,
654  const CallEvent *Call,
656 
657 private:
658  /// evalBind - Handle the semantics of binding a value to a specific location.
659  /// This method is used by evalStore, VisitDeclStmt, and others.
660  void evalBind(ExplodedNodeSet &Dst, const Stmt *StoreE, ExplodedNode *Pred,
661  SVal location, SVal Val, bool atDeclInit = false,
662  const ProgramPoint *PP = nullptr);
663 
666  SVal Loc, SVal Val,
667  const LocationContext *LCtx);
668 
669  /// A simple wrapper when you only need to notify checkers of pointer-escape
670  /// of some values.
673  const CallEvent *Call = nullptr) const;
674 
675 public:
676  // FIXME: 'tag' should be removed, and a LocationContext should be used
677  // instead.
678  // FIXME: Comment on the meaning of the arguments, when 'St' may not
679  // be the same as Pred->state, and when 'location' may not be the
680  // same as state->getLValue(Ex).
681  /// Simulate a read of the result of Ex.
682  void evalLoad(ExplodedNodeSet &Dst,
683  const Expr *NodeEx, /* Eventually will be a CFGStmt */
684  const Expr *BoundExpr,
685  ExplodedNode *Pred,
686  ProgramStateRef St,
687  SVal location,
688  const ProgramPointTag *tag = nullptr,
689  QualType LoadTy = QualType());
690 
691  // FIXME: 'tag' should be removed, and a LocationContext should be used
692  // instead.
693  void evalStore(ExplodedNodeSet &Dst, const Expr *AssignE, const Expr *StoreE,
694  ExplodedNode *Pred, ProgramStateRef St, SVal TargetLV, SVal Val,
695  const ProgramPointTag *tag = nullptr);
696 
697  /// Return the CFG element corresponding to the worklist element
698  /// that is currently being processed by ExprEngine.
700  return (*currBldrCtx->getBlock())[currStmtIdx];
701  }
702 
703  /// Create a new state in which the call return value is binded to the
704  /// call origin expression.
706  const LocationContext *LCtx,
708 
709  /// Evaluate a call, running pre- and post-call checkers and allowing checkers
710  /// to be responsible for handling the evaluation of the call itself.
711  void evalCall(ExplodedNodeSet &Dst, ExplodedNode *Pred,
712  const CallEvent &Call);
713 
714  /// Default implementation of call evaluation.
716  const CallEvent &Call,
717  const EvalCallOptions &CallOpts = {});
718 
719  /// Find location of the object that is being constructed by a given
720  /// constructor. This should ideally always succeed but due to not being
721  /// fully implemented it sometimes indicates that it failed via its
722  /// out-parameter CallOpts; in such cases a fake temporary region is
723  /// returned, which is better than nothing but does not represent
724  /// the actual behavior of the program.
726  const Expr *E, ProgramStateRef State, const LocationContext *LCtx,
727  const ConstructionContext *CC, EvalCallOptions &CallOpts);
728 
729  /// Update the program state with all the path-sensitive information
730  /// that's necessary to perform construction of an object with a given
731  /// syntactic construction context. V and CallOpts have to be obtained from
732  /// computeObjectUnderConstruction() invoked with the same set of
733  /// the remaining arguments (E, State, LCtx, CC).
735  SVal V, const Expr *E, ProgramStateRef State, const LocationContext *LCtx,
736  const ConstructionContext *CC, const EvalCallOptions &CallOpts);
737 
738  /// A convenient wrapper around computeObjectUnderConstruction
739  /// and updateObjectsUnderConstruction.
740  std::pair<ProgramStateRef, SVal> handleConstructionContext(
741  const Expr *E, ProgramStateRef State, const LocationContext *LCtx,
742  const ConstructionContext *CC, EvalCallOptions &CallOpts) {
743  SVal V = computeObjectUnderConstruction(E, State, LCtx, CC, CallOpts);
744  return std::make_pair(
745  updateObjectsUnderConstruction(V, E, State, LCtx, CC, CallOpts), V);
746  }
747 
748 private:
749  ProgramStateRef finishArgumentConstruction(ProgramStateRef State,
750  const CallEvent &Call);
751  void finishArgumentConstruction(ExplodedNodeSet &Dst, ExplodedNode *Pred,
752  const CallEvent &Call);
753 
754  void evalLoadCommon(ExplodedNodeSet &Dst,
755  const Expr *NodeEx, /* Eventually will be a CFGStmt */
756  const Expr *BoundEx,
757  ExplodedNode *Pred,
758  ProgramStateRef St,
759  SVal location,
760  const ProgramPointTag *tag,
761  QualType LoadTy);
762 
763  void evalLocation(ExplodedNodeSet &Dst,
764  const Stmt *NodeEx, /* This will eventually be a CFGStmt */
765  const Stmt *BoundEx,
766  ExplodedNode *Pred,
767  ProgramStateRef St,
768  SVal location,
769  bool isLoad);
770 
771  /// Count the stack depth and determine if the call is recursive.
772  void examineStackFrames(const Decl *D, const LocationContext *LCtx,
773  bool &IsRecursive, unsigned &StackDepth);
774 
775  enum CallInlinePolicy {
776  CIP_Allowed,
777  CIP_DisallowedOnce,
778  CIP_DisallowedAlways
779  };
780 
781  /// See if a particular call should be inlined, by only looking
782  /// at the call event and the current state of analysis.
783  CallInlinePolicy mayInlineCallKind(const CallEvent &Call,
784  const ExplodedNode *Pred,
785  AnalyzerOptions &Opts,
786  const EvalCallOptions &CallOpts);
787 
788  /// See if the given AnalysisDeclContext is built for a function that we
789  /// should always inline simply because it's small enough.
790  /// Apart from "small" functions, we also have "large" functions
791  /// (cf. isLarge()), some of which are huge (cf. isHuge()), and we classify
792  /// the remaining functions as "medium".
793  bool isSmall(AnalysisDeclContext *ADC) const;
794 
795  /// See if the given AnalysisDeclContext is built for a function that we
796  /// should inline carefully because it looks pretty large.
797  bool isLarge(AnalysisDeclContext *ADC) const;
798 
799  /// See if the given AnalysisDeclContext is built for a function that we
800  /// should never inline because it's legit gigantic.
801  bool isHuge(AnalysisDeclContext *ADC) const;
802 
803  /// See if the given AnalysisDeclContext is built for a function that we
804  /// should inline, just by looking at the declaration of the function.
805  bool mayInlineDecl(AnalysisDeclContext *ADC) const;
806 
807  /// Checks our policies and decides weither the given call should be inlined.
808  bool shouldInlineCall(const CallEvent &Call, const Decl *D,
809  const ExplodedNode *Pred,
810  const EvalCallOptions &CallOpts = {});
811 
812  bool inlineCall(const CallEvent &Call, const Decl *D, NodeBuilder &Bldr,
813  ExplodedNode *Pred, ProgramStateRef State);
814 
815  /// Conservatively evaluate call by invalidating regions and binding
816  /// a conjured return value.
817  void conservativeEvalCall(const CallEvent &Call, NodeBuilder &Bldr,
818  ExplodedNode *Pred, ProgramStateRef State);
819 
820  /// Either inline or process the call conservatively (or both), based
821  /// on DynamicDispatchBifurcation data.
822  void BifurcateCall(const MemRegion *BifurReg,
823  const CallEvent &Call, const Decl *D, NodeBuilder &Bldr,
824  ExplodedNode *Pred);
825 
826  bool replayWithoutInlining(ExplodedNode *P, const LocationContext *CalleeLC);
827 
828  /// Models a trivial copy or move constructor or trivial assignment operator
829  /// call with a simple bind.
830  void performTrivialCopy(NodeBuilder &Bldr, ExplodedNode *Pred,
831  const CallEvent &Call);
832 
833  /// If the value of the given expression \p InitWithAdjustments is a NonLoc,
834  /// copy it into a new temporary object region, and replace the value of the
835  /// expression with that.
836  ///
837  /// If \p Result is provided, the new region will be bound to this expression
838  /// instead of \p InitWithAdjustments.
839  ///
840  /// Returns the temporary region with adjustments into the optional
841  /// OutRegionWithAdjustments out-parameter if a new region was indeed needed,
842  /// otherwise sets it to nullptr.
843  ProgramStateRef createTemporaryRegionIfNeeded(
844  ProgramStateRef State, const LocationContext *LC,
845  const Expr *InitWithAdjustments, const Expr *Result = nullptr,
846  const SubRegion **OutRegionWithAdjustments = nullptr);
847 
848  /// Returns a region representing the first element of a (possibly
849  /// multi-dimensional) array, for the purposes of element construction or
850  /// destruction.
851  ///
852  /// On return, \p Ty will be set to the base type of the array.
853  ///
854  /// If the type is not an array type at all, the original value is returned.
855  /// Otherwise the "IsArray" flag is set.
856  static SVal makeZeroElementRegion(ProgramStateRef State, SVal LValue,
857  QualType &Ty, bool &IsArray);
858 
859  /// For a DeclStmt or CXXInitCtorInitializer, walk backward in the current CFG
860  /// block to find the constructor expression that directly constructed into
861  /// the storage for this statement. Returns null if the constructor for this
862  /// statement created a temporary object region rather than directly
863  /// constructing into an existing region.
864  const CXXConstructExpr *findDirectConstructorForCurrentCFGElement();
865 
866  /// Common code that handles either a CXXConstructExpr or a
867  /// CXXInheritedCtorInitExpr.
868  void handleConstructor(const Expr *E, ExplodedNode *Pred,
869  ExplodedNodeSet &Dst);
870 
871 public:
872  /// Note whether this loop has any more iteratios to model. These methods are
873  /// essentially an interface for a GDM trait. Further reading in
874  /// ExprEngine::VisitObjCForCollectionStmt().
875  LLVM_NODISCARD static ProgramStateRef
877  const ObjCForCollectionStmt *O,
878  const LocationContext *LC, bool HasMoreIteraton);
879 
880  LLVM_NODISCARD static ProgramStateRef
881  removeIterationState(ProgramStateRef State, const ObjCForCollectionStmt *O,
882  const LocationContext *LC);
883 
884  LLVM_NODISCARD static bool hasMoreIteration(ProgramStateRef State,
885  const ObjCForCollectionStmt *O,
886  const LocationContext *LC);
887 private:
888  /// Store the location of a C++ object corresponding to a statement
889  /// until the statement is actually encountered. For example, if a DeclStmt
890  /// has CXXConstructExpr as its initializer, the object would be considered
891  /// to be "under construction" between CXXConstructExpr and DeclStmt.
892  /// This allows, among other things, to keep bindings to variable's fields
893  /// made within the constructor alive until its declaration actually
894  /// goes into scope.
895  static ProgramStateRef
896  addObjectUnderConstruction(ProgramStateRef State,
897  const ConstructionContextItem &Item,
898  const LocationContext *LC, SVal V);
899 
900  /// Mark the object sa fully constructed, cleaning up the state trait
901  /// that tracks objects under construction.
902  static ProgramStateRef
903  finishObjectConstruction(ProgramStateRef State,
904  const ConstructionContextItem &Item,
905  const LocationContext *LC);
906 
907  /// If the given expression corresponds to a temporary that was used for
908  /// passing into an elidable copy/move constructor and that constructor
909  /// was actually elided, track that we also need to elide the destructor.
910  static ProgramStateRef elideDestructor(ProgramStateRef State,
911  const CXXBindTemporaryExpr *BTE,
912  const LocationContext *LC);
913 
914  /// Stop tracking the destructor that corresponds to an elided constructor.
915  static ProgramStateRef
916  cleanupElidedDestructor(ProgramStateRef State,
917  const CXXBindTemporaryExpr *BTE,
918  const LocationContext *LC);
919 
920  /// Returns true if the given expression corresponds to a temporary that
921  /// was constructed for passing into an elidable copy/move constructor
922  /// and that constructor was actually elided.
923  static bool isDestructorElided(ProgramStateRef State,
924  const CXXBindTemporaryExpr *BTE,
925  const LocationContext *LC);
926 
927  /// Check if all objects under construction have been fully constructed
928  /// for the given context range (including FromLC, not including ToLC).
929  /// This is useful for assertions. Also checks if elided destructors
930  /// were cleaned up.
931  static bool areAllObjectsFullyConstructed(ProgramStateRef State,
932  const LocationContext *FromLC,
933  const LocationContext *ToLC);
934 };
935 
936 /// Traits for storing the call processing policy inside GDM.
937 /// The GDM stores the corresponding CallExpr pointer.
938 // FIXME: This does not use the nice trait macros because it must be accessible
939 // from multiple translation units.
941 template <>
943  public ProgramStatePartialTrait<const void*> {
944  static void *GDMIndex();
945 };
946 
947 } // namespace ento
948 
949 } // namespace clang
950 
951 #endif // LLVM_CLANG_STATICANALYZER_CORE_PATHSENSITIVE_EXPRENGINE_H
clang::ento::ExprEngine::processCallEnter
void processCallEnter(NodeBuilderContext &BC, CallEnter CE, ExplodedNode *Pred)
Generate the entry node of the callee.
Definition: ExprEngineCallAndReturn.cpp:43
clang::ento::ProgramStatePartialTrait
Definition: ProgramState.h:50
clang::ento::SVal::isValid
bool isValid() const
Definition: SVals.h:148
clang::ento::SValBuilder::evalBinOp
SVal evalBinOp(ProgramStateRef state, BinaryOperator::Opcode op, SVal lhs, SVal rhs, QualType type)
Definition: SValBuilder.cpp:435
clang::ento::ExprEngine::hasWorkRemaining
bool hasWorkRemaining() const
Definition: ExprEngine.h:436
clang::AtomicExpr
AtomicExpr - Variadic atomic builtins: __atomic_exchange, __atomic_fetch_*, __atomic_load,...
Definition: Expr.h:6229
clang::ento::ExprEngine::VisitLambdaExpr
void VisitLambdaExpr(const LambdaExpr *LE, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitLambdaExpr - Transfer function logic for LambdaExprs.
Definition: ExprEngineCXX.cpp:989
clang::ento::ExprEngine::getStateManager
ProgramStateManager & getStateManager()
Definition: ExprEngine.h:415
clang::ento::ExprEngine::updateObjectsUnderConstruction
ProgramStateRef updateObjectsUnderConstruction(SVal V, const Expr *E, ProgramStateRef State, const LocationContext *LCtx, const ConstructionContext *CC, const EvalCallOptions &CallOpts)
Update the program state with all the path-sensitive information that's necessary to perform construc...
Definition: ExprEngineCXX.cpp:356
clang::OffsetOfExpr
OffsetOfExpr - [C99 7.17] - This represents an expression of the form offsetof(record-type,...
Definition: Expr.h:2438
clang::ento::EvalCallOptions::EvalCallOptions
EvalCallOptions()
Definition: ExprEngine.h:124
clang::ento::ExprEngine::removeIterationState
static LLVM_NODISCARD ProgramStateRef removeIterationState(ProgramStateRef State, const ObjCForCollectionStmt *O, const LocationContext *LC)
Definition: ExprEngine.cpp:2153
clang::ento::BasicValueFactory
Definition: BasicValueFactory.h:108
clang::LocationContext
It wraps the AnalysisDeclContext to represent both the call stack with the help of StackFrameContext ...
Definition: AnalysisDeclContext.h:215
clang::ento::AnalysisManager::getCheckerManager
CheckerManager * getCheckerManager() const
Definition: AnalysisManager.h:80
SVals.h
Nodes
BoundNodesTreeBuilder Nodes
Definition: ASTMatchFinder.cpp:82
string
string(SUBSTRING ${CMAKE_CURRENT_BINARY_DIR} 0 ${PATH_LIB_START} PATH_HEAD) string(SUBSTRING $
Definition: CMakeLists.txt:22
clang::ento::ExprEngine::hasEmptyWorkList
bool hasEmptyWorkList() const
Definition: ExprEngine.h:435
clang::ento::SVal::castAs
T castAs() const
Convert to the specified SVal type, asserting that this SVal is of the desired type.
Definition: SVals.h:103
clang::ento::ExprEngine::VisitCallExpr
void VisitCallExpr(const CallExpr *CE, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitCall - Transfer function for function calls.
Definition: ExprEngineCallAndReturn.cpp:497
clang::ento::NonLoc
Definition: SVals.h:305
clang::ento::ExplodedNodeSet::iterator
ImplTy::iterator iterator
Definition: ExplodedGraph.h:479
clang::ento::ConstraintManager
Definition: ConstraintManager.h:77
clang::ento::ExprEngine::getDataTags
DataTag::Factory & getDataTags()
Definition: ExprEngine.h:431
clang::ento::ExprEngine::Visit
void Visit(const Stmt *S, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Visit - Transfer function logic for all statements.
Definition: ExprEngine.cpp:1202
clang::ProgramPointTag
ProgramPoints can be "tagged" as representing points specific to a given analysis entity.
Definition: ProgramPoint.h:39
clang::ento::ExprEngine::getContext
ASTContext & getContext() const
getContext - Return the ASTContext associated with this analysis.
Definition: ExprEngine.h:206
clang::ento::ExprEngine::handleUOExtension
void handleUOExtension(ExplodedNodeSet::iterator I, const UnaryOperator *U, StmtNodeBuilder &Bldr)
Definition: ExprEngineC.cpp:912
clang::NamedDecl
This represents a decl that may have a name.
Definition: Decl.h:249
clang::ento::ExprEngine::hasMoreIteration
static LLVM_NODISCARD bool hasMoreIteration(ProgramStateRef State, const ObjCForCollectionStmt *O, const LocationContext *LC)
Definition: ExprEngine.cpp:2160
clang::ento::ExprEngine::removeDeadOnEndOfFunction
void removeDeadOnEndOfFunction(NodeBuilderContext &BC, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Remove dead bindings/symbols before exiting a function.
Definition: ExprEngineCallAndReturn.cpp:164
clang::CFGTemporaryDtor
Represents C++ object destructor implicitly generated at the end of full expression for temporary obj...
Definition: CFG.h:482
clang::ento::ProgramStateRef
IntrusiveRefCntPtr< const ProgramState > ProgramStateRef
Definition: ProgramState_Fwd.h:37
clang::QualType
A (possibly-)qualified type.
Definition: Type.h:673
clang::ConstructionContext
ConstructionContext's subclasses describe different ways of constructing an object in C++.
Definition: ConstructionContext.h:236
clang::AnalysisDeclContext
AnalysisDeclContext contains the context data for the function, method or block under analysis.
Definition: AnalysisDeclContext.h:72
clang::ento::ExprEngine::ProcessMemberDtor
void ProcessMemberDtor(const CFGMemberDtor D, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Definition: ExprEngine.cpp:1045
clang::ento::ExprEngine::getCrossTranslationUnitContext
cross_tu::CrossTranslationUnitContext * getCrossTranslationUnitContext()
Definition: ExprEngine.h:223
clang::ento::ExprEngine::evalBinOp
SVal evalBinOp(ProgramStateRef ST, BinaryOperator::Opcode Op, SVal LHS, SVal RHS, QualType T)
Definition: ExprEngine.h:628
clang::ento::ExplodedNode
Definition: ExplodedGraph.h:65
Filename
StringRef Filename
Definition: Format.cpp:2333
clang::ento::ExprEngine::VisitReturnStmt
void VisitReturnStmt(const ReturnStmt *R, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitReturnStmt - Transfer function logic for return statements.
Definition: ExprEngineCallAndReturn.cpp:1137
ProgramState_Fwd.h
clang::CXXNewExpr
Represents a new-expression for memory allocation and constructor calls, e.g: "new CXXNewExpr(foo)".
Definition: ExprCXX.h:2139
clang::ento::ExprEngine::VisitUnaryOperator
void VisitUnaryOperator(const UnaryOperator *B, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitUnaryOperator - Transfer function logic for unary operators.
Definition: ExprEngineC.cpp:929
clang::ento::ExprEngine::evalComplement
SVal evalComplement(SVal X)
Definition: ExprEngine.h:596
clang::ento::ExprEngine::VisitLvalObjCIvarRefExpr
void VisitLvalObjCIvarRefExpr(const ObjCIvarRefExpr *DR, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Transfer function logic for computing the lvalue of an Objective-C ivar.
Definition: ExprEngineObjC.cpp:21
clang::InitListExpr
Describes an C or C++ initializer list.
Definition: Expr.h:4786
clang::ento::ExprEngine::VisitArraySubscriptExpr
void VisitArraySubscriptExpr(const ArraySubscriptExpr *Ex, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitArraySubscriptExpr - Transfer function for array accesses.
Definition: ExprEngine.cpp:2612
clang::ento::ExprEngine::ProcessInitializer
void ProcessInitializer(const CFGInitializer I, ExplodedNode *Pred)
Definition: ExprEngine.cpp:817
clang::ento::ExprEngine::VisitCXXNewExpr
void VisitCXXNewExpr(const CXXNewExpr *CNE, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Definition: ExprEngineCXX.cpp:832
llvm::Optional
Definition: LLVM.h:40
clang::UnaryOperator
UnaryOperator - This represents the unary-expression's (except sizeof and alignof),...
Definition: Expr.h:2157
clang::ento::ExprEngine::processCleanupTemporaryBranch
void processCleanupTemporaryBranch(const CXXBindTemporaryExpr *BTE, NodeBuilderContext &BldCtx, ExplodedNode *Pred, ExplodedNodeSet &Dst, const CFGBlock *DstT, const CFGBlock *DstF)
Called by CoreEngine.
Definition: ExprEngine.cpp:1130
clang::tooling::X
static ToolExecutorPluginRegistry::Add< AllTUsToolExecutorPlugin > X("all-TUs", "Runs FrontendActions on all TUs in the compilation database. " "Tool results are stored in memory.")
clang::ento::StmtNodeBuilder
Definition: CoreEngine.h:379
clang::ObjCForCollectionStmt
Represents Objective-C's collection statement.
Definition: StmtObjC.h:23
clang::ento::ExprEngine::bindReturnValue
ProgramStateRef bindReturnValue(const CallEvent &Call, const LocationContext *LCtx, ProgramStateRef State)
Create a new state in which the call return value is binded to the call origin expression.
Definition: ExprEngineCallAndReturn.cpp:637
clang::ConstructionContextItem
Represents a single point (AST node) in the program that requires attention during construction of an...
Definition: ConstructionContext.h:28
clang::ento::ExprEngine::processCallExit
void processCallExit(ExplodedNode *Pred)
Generate the sequence of nodes that simulate the call exit and the post visit for CallExpr.
Definition: ExprEngineCallAndReturn.cpp:206
clang::ento::ExprEngine::VisitMSAsmStmt
void VisitMSAsmStmt(const MSAsmStmt *A, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitMSAsmStmt - Transfer function logic for MS inline asm.
Definition: ExprEngine.cpp:3108
clang::ento::StoreManager
Definition: Store.h:53
clang::ento::ExprEngine::evalBinOp
SVal evalBinOp(ProgramStateRef state, BinaryOperator::Opcode op, NonLoc L, NonLoc R, QualType T)
Definition: ExprEngine.h:617
clang::ento::ExprEngine::processSwitch
void processSwitch(SwitchNodeBuilder &builder)
ProcessSwitch - Called by CoreEngine.
Definition: ExprEngine.cpp:2446
clang::ento::EvalCallOptions::IsArrayCtorOrDtor
bool IsArrayCtorOrDtor
This call is a constructor or a destructor for a single element within an array, a part of array cons...
Definition: ExprEngine.h:107
clang::ento::ExprEngine::evalLoad
void evalLoad(ExplodedNodeSet &Dst, const Expr *NodeEx, const Expr *BoundExpr, ExplodedNode *Pred, ProgramStateRef St, SVal location, const ProgramPointTag *tag=nullptr, QualType LoadTy=QualType())
Simulate a read of the result of Ex.
Definition: ExprEngine.cpp:2960
clang::ento::ExprEngine::evalBinOp
SVal evalBinOp(ProgramStateRef state, BinaryOperator::Opcode op, NonLoc L, SVal R, QualType T)
Definition: ExprEngine.h:622
clang::ento::MemRegion
MemRegion - The root abstract class for all memory regions.
Definition: MemRegion.h:94
clang::CodeGen::AlignmentSource::Decl
@ Decl
The l-value was an access to a declared entity or something equivalently strong, like the address of ...
clang::CFGBlock
Represents a single basic block in a source-level CFG.
Definition: CFG.h:576
U
clang::ento::ExprEngine::Inline_Minimal
@ Inline_Minimal
Do minimal inlining of callees.
Definition: ExprEngine.h:137
V
#define V(N, I)
Definition: ASTContext.h:3113
clang::ento::EvalCallOptions
Hints for figuring out of a call should be inlined during evalCall().
Definition: ExprEngine.h:100
ProgramPoint.h
clang::UnaryExprOrTypeTraitExpr
UnaryExprOrTypeTraitExpr - expression with either a type or (unevaluated) expression operand.
Definition: Expr.h:2543
clang::ento::ExprEngine::ProcessAutomaticObjDtor
void ProcessAutomaticObjDtor(const CFGAutomaticObjDtor D, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Definition: ExprEngine.cpp:951
clang::ento::ExprEngine::VisitMemberExpr
void VisitMemberExpr(const MemberExpr *M, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitMemberExpr - Transfer function for member expressions.
Definition: ExprEngine.cpp:2663
clang::ento::ExprEngine::evalStore
void evalStore(ExplodedNodeSet &Dst, const Expr *AssignE, const Expr *StoreE, ExplodedNode *Pred, ProgramStateRef St, SVal TargetLV, SVal Val, const ProgramPointTag *tag=nullptr)
evalStore - Handle the semantics of a store via an assignment.
Definition: ExprEngine.cpp:2937
clang::ento::NodeBuilder
Definition: CoreEngine.h:237
Node
DynTypedNode Node
Definition: ASTMatchFinder.cpp:67
clang::CXXBindTemporaryExpr
Represents binding an expression to a temporary.
Definition: ExprCXX.h:1412
clang::BinaryOperator
A builtin binary operation expression such as "x + y" or "x <= y".
Definition: Expr.h:3803
clang::ento::ExprEngine::VisitAtomicExpr
void VisitAtomicExpr(const AtomicExpr *E, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitAtomicExpr - Transfer function for builtin atomic expressions.
Definition: ExprEngine.cpp:2743
clang::ento::ExprEngine::getStmt
const Stmt * getStmt() const
clang::LambdaExpr
A C++ lambda expression, which produces a function object (of unspecified type) that can be invoked l...
Definition: ExprCXX.h:1865
clang::cross_tu::CrossTranslationUnitContext
This class is used for tools that requires cross translation unit capability.
Definition: CrossTranslationUnit.h:125
clang::interp::LE
bool LE(InterpState &S, CodePtr OpPC)
Definition: Interp.h:239
clang::ento::ExprEngine::evalCall
void evalCall(ExplodedNodeSet &Dst, ExplodedNode *Pred, const CallEvent &Call)
Evaluate a call, running pre- and post-call checkers and allowing checkers to be responsible for hand...
Definition: ExprEngineCallAndReturn.cpp:569
CheckerManager.h
clang::ento::ExprEngine::computeObjectUnderConstruction
SVal computeObjectUnderConstruction(const Expr *E, ProgramStateRef State, const LocationContext *LCtx, const ConstructionContext *CC, EvalCallOptions &CallOpts)
Find location of the object that is being constructed by a given constructor.
Definition: ExprEngineCXX.cpp:112
clang::ento::ExprEngine::getSymbolManager
SymbolManager & getSymbolManager()
Definition: ExprEngine.h:428
BugReporter.h
clang::CFGMemberDtor
Represents C++ object destructor implicitly generated for member object in destructor.
Definition: CFG.h:461
clang::MaterializeTemporaryExpr
Represents a prvalue temporary that is written into memory so that a reference can bind to it.
Definition: ExprCXX.h:4462
clang::ASTContext
Holds long-lived AST nodes (such as types and decls) that can be referred to throughout the semantic ...
Definition: ASTContext.h:211
clang::ento::ExprEngine::VisitCXXCatchStmt
void VisitCXXCatchStmt(const CXXCatchStmt *CS, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Definition: ExprEngineCXX.cpp:955
clang::ento::CoreEngine::ExecuteWorkListWithInitialState
bool ExecuteWorkListWithInitialState(const LocationContext *L, unsigned Steps, ProgramStateRef InitState, ExplodedNodeSet &Dst)
Returns true if there is still simulation state on the worklist.
Definition: CoreEngine.cpp:196
clang::DeclaratorContext::LambdaExpr
@ LambdaExpr
clang::ento::ExprEngine::VisitCXXInheritedCtorInitExpr
void VisitCXXInheritedCtorInitExpr(const CXXInheritedCtorInitExpr *E, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Definition: ExprEngineCXX.cpp:692
Store.h
clang::CFGAutomaticObjDtor
Represents C++ object destructor implicitly generated for automatic object or temporary bound to cons...
Definition: CFG.h:389
clang::ento::ProgramStateTrait
Definition: ProgramState.h:52
clang::ento::ExprEngine::processBranch
void processBranch(const Stmt *Condition, NodeBuilderContext &BuilderCtx, ExplodedNode *Pred, ExplodedNodeSet &Dst, const CFGBlock *DstT, const CFGBlock *DstF)
ProcessBranch - Called by CoreEngine.
Definition: ExprEngine.cpp:2217
clang::ento::ExprEngine::notifyCheckersOfPointerEscape
ProgramStateRef notifyCheckersOfPointerEscape(ProgramStateRef State, const InvalidatedSymbols *Invalidated, ArrayRef< const MemRegion * > ExplicitRegions, const CallEvent *Call, RegionAndSymbolInvalidationTraits &ITraits)
Call PointerEscape callback when a value escapes as a result of region invalidation.
Definition: ExprEngine.cpp:2836
clang::ento::ExprEngine::processCFGBlockEntrance
void processCFGBlockEntrance(const BlockEdge &L, NodeBuilderWithSinks &nodeBuilder, ExplodedNode *Pred)
Called by CoreEngine when processing the entrance of a CFGBlock.
Definition: ExprEngine.cpp:1962
clang::ObjCAtSynchronizedStmt
Represents Objective-C's @synchronized statement.
Definition: StmtObjC.h:277
clang::ento::ExprEngine::getObjectUnderConstruction
static Optional< SVal > getObjectUnderConstruction(ProgramStateRef State, const ConstructionContextItem &Item, const LocationContext *LC)
By looking at a certain item that may be potentially part of an object's ConstructionContext,...
Definition: ExprEngine.cpp:474
clang::ento::ExprEngine::ProcessImplicitDtor
void ProcessImplicitDtor(const CFGImplicitDtor D, ExplodedNode *Pred)
Definition: ExprEngine.cpp:905
clang::ento::WorkList::hasWork
virtual bool hasWork() const =0
clang::ento::ExprEngine::wasBlocksExhausted
bool wasBlocksExhausted() const
Definition: ExprEngine.h:434
clang::ento::ExprEngine::getBuilderContext
const NodeBuilderContext & getBuilderContext()
Definition: ExprEngine.h:227
Type.h
clang::ento::ExprEngine::GenerateCallExitNode
void GenerateCallExitNode(ExplodedNode *N)
clang::ento::ExprEngine::evalEagerlyAssumeBinOpBifurcation
void evalEagerlyAssumeBinOpBifurcation(ExplodedNodeSet &Dst, ExplodedNodeSet &Src, const Expr *Ex)
evalEagerlyAssumeBinOpBifurcation - Given the nodes in 'Src', eagerly assume symbolic expressions of ...
Definition: ExprEngine.cpp:3044
Expr.h
clang::ento::ExprEngine::VisitCXXThisExpr
void VisitCXXThisExpr(const CXXThisExpr *TE, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Definition: ExprEngineCXX.cpp:973
clang::ento::ExprEngine::ProcessTemporaryDtor
void ProcessTemporaryDtor(const CFGTemporaryDtor D, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Definition: ExprEngine.cpp:1069
clang::ento::ExprEngine::VisitCompoundLiteralExpr
void VisitCompoundLiteralExpr(const CompoundLiteralExpr *CL, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitCompoundLiteralExpr - Transfer function logic for compound literals.
Definition: ExprEngineC.cpp:542
clang::ento::ExprEngine::~ExprEngine
virtual ~ExprEngine()=default
clang::ento::ExprEngine::VisitIncrementDecrementOperator
void VisitIncrementDecrementOperator(const UnaryOperator *U, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Handle ++ and – (both pre- and post-increment).
Definition: ExprEngineC.cpp:1066
clang::ento::ExprEngine::InliningModes
InliningModes
The modes of inlining, which override the default analysis-wide settings.
Definition: ExprEngine.h:132
llvm::DenseSet
Definition: Sema.h:78
clang::ento::ExprEngine::VisitUnaryExprOrTypeTraitExpr
void VisitUnaryExprOrTypeTraitExpr(const UnaryExprOrTypeTraitExpr *Ex, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitUnaryExprOrTypeTraitExpr - Transfer function for sizeof.
Definition: ExprEngineC.cpp:870
clang::ento::BugReporter
BugReporter is a utility class for generating PathDiagnostics for analysis.
Definition: BugReporter.h:587
clang::ProgramPoint::PreStmtPurgeDeadSymbolsKind
@ PreStmtPurgeDeadSymbolsKind
Definition: ProgramPoint.h:65
clang::ento::IndirectGotoNodeBuilder
Definition: CoreEngine.h:478
clang::ento::ExprEngine::VisitObjCForCollectionStmt
void VisitObjCForCollectionStmt(const ObjCForCollectionStmt *S, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitObjCForCollectionStmt - Transfer function logic for ObjCForCollectionStmt.
Definition: ExprEngineObjC.cpp:83
clang::ento::ExprEngine::ExprEngine
ExprEngine(cross_tu::CrossTranslationUnitContext &CTU, AnalysisManager &mgr, SetOfConstDecls *VisitedCalleesIn, FunctionSummariesTy *FS, InliningModes HowToInlineIn)
Definition: ExprEngine.cpp:202
clang::CXXInheritedCtorInitExpr
Represents a call to an inherited base class constructor from an inheriting constructor.
Definition: ExprCXX.h:1651
clang::ento::ExplodedGraph
Definition: ExplodedGraph.h:304
clang::ento::ProgramStateManager::getBasicVals
BasicValueFactory & getBasicVals()
Definition: ProgramState.h:509
clang::ento::ExprEngine::getCoreEngine
const CoreEngine & getCoreEngine() const
Definition: ExprEngine.h:438
clang::ento::SwitchNodeBuilder
Definition: CoreEngine.h:526
clang::ento::CoreEngine
CoreEngine - Implements the core logic of the graph-reachability analysis.
Definition: CoreEngine.h:55
clang::ObjCMessageExpr
An expression that sends a message to the given Objective-C object or class.
Definition: ExprObjC.h:940
clang::ento::ExprEngine::VisitGCCAsmStmt
void VisitGCCAsmStmt(const GCCAsmStmt *A, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitGCCAsmStmt - Transfer function logic for inline asm.
Definition: ExprEngine.cpp:3085
state
and static some checkers Checker The latter are built on top of the former via the Checker and CheckerVisitor and attempts to isolate them from much of the gore of the internal analysis the analyzer is basically a source code simulator that traces out possible paths of execution The state of the and the combination of state and program point is a node in an exploded which has the entry program point and initial state
Definition: README.txt:30
clang::ento::Loc
Definition: SVals.h:327
clang::ento::ExprEngine::processEndWorklist
void processEndWorklist()
Called by CoreEngine when the analysis worklist has terminated.
Definition: ExprEngine.cpp:623
clang::ento::ExprEngine::geteagerlyAssumeBinOpBifurcationTags
static std::pair< const ProgramPointTag *, const ProgramPointTag * > geteagerlyAssumeBinOpBifurcationTags()
Definition: ExprEngine.cpp:3034
clang::ento::ExprEngine::getConstraintManager
ConstraintManager & getConstraintManager()
Definition: ExprEngine.h:419
clang::CFGImplicitDtor
Represents C++ object destructor implicitly generated by compiler on various occasions.
Definition: CFG.h:364
clang::ento::SValBuilder
Definition: SValBuilder.h:53
ObjCNoReturn.h
clang::CompoundLiteralExpr
CompoundLiteralExpr - [C99 6.5.2.5].
Definition: Expr.h:3403
FunctionSummary.h
clang::ento::ExprEngine::getInitialState
ProgramStateRef getInitialState(const LocationContext *InitLoc)
getInitialState - Return the initial state used for the root vertex in the ExplodedGraph.
Definition: ExprEngine.cpp:232
clang::GCCAsmStmt
This represents a GCC inline-assembly statement extension.
Definition: Stmt.h:2973
clang::ento::ExprEngine::processRegionChanges
ProgramStateRef processRegionChanges(ProgramStateRef state, const InvalidatedSymbols *invalidated, ArrayRef< const MemRegion * > ExplicitRegions, ArrayRef< const MemRegion * > Regions, const LocationContext *LCtx, const CallEvent *Call)
processRegionChanges - Called by ProgramStateManager whenever a change is made to the store.
Definition: ExprEngine.cpp:543
clang::ento::ExprEngine::handleConstructionContext
std::pair< ProgramStateRef, SVal > handleConstructionContext(const Expr *E, ProgramStateRef State, const LocationContext *LCtx, const ConstructionContext *CC, EvalCallOptions &CallOpts)
A convenient wrapper around computeObjectUnderConstruction and updateObjectsUnderConstruction.
Definition: ExprEngine.h:740
clang::ento::ExprEngine::printJson
void printJson(raw_ostream &Out, ProgramStateRef State, const LocationContext *LCtx, const char *NL, unsigned int Space, bool IsDot) const
printJson - Called by ProgramStateManager to print checker-specific data.
Definition: ExprEngine.cpp:601
clang::ento::ExprEngine::VisitBlockExpr
void VisitBlockExpr(const BlockExpr *BE, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitBlockExpr - Transfer function logic for BlockExprs.
Definition: ExprEngineC.cpp:196
P
StringRef P
Definition: ASTMatchersInternal.cpp:563
clang::ento::ExprEngine::VisitInitListExpr
void VisitInitListExpr(const InitListExpr *E, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Definition: ExprEngineC.cpp:737
clang::ento::ExprEngine::ProcessLoopExit
void ProcessLoopExit(const Stmt *S, ExplodedNode *Pred)
Definition: ExprEngine.cpp:799
clang::ento::ProgramStateManager
Definition: ProgramState.h:463
SValBuilder.h
clang::ento::ExprEngine::VisitCXXDestructor
void VisitCXXDestructor(QualType ObjectType, const MemRegion *Dest, const Stmt *S, bool IsBaseDtor, ExplodedNode *Pred, ExplodedNodeSet &Dst, EvalCallOptions &Options)
Definition: ExprEngineCXX.cpp:698
clang::ento::ExprEngine::handleLValueBitCast
ProgramStateRef handleLValueBitCast(ProgramStateRef state, const Expr *Ex, const LocationContext *LCtx, QualType T, QualType ExTy, const CastExpr *CastE, StmtNodeBuilder &Bldr, ExplodedNode *Pred)
Definition: ExprEngineC.cpp:259
clang::ento::ExprEngine::evalMinus
SVal evalMinus(SVal X)
Definition: ExprEngine.h:592
clang::ento::AnalysisManager::getASTContext
ASTContext & getASTContext() override
Definition: AnalysisManager.h:82
clang::CFGInitializer
Represents C++ base or member initializer from constructor's initialization list.
Definition: CFG.h:225
clang::ento::ExprEngine::VisitCast
void VisitCast(const CastExpr *CastE, const Expr *Ex, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitCast - Transfer function logic for all casts (implicit and explicit).
Definition: ExprEngineC.cpp:285
clang::ento::ExprEngine::processEndOfFunction
void processEndOfFunction(NodeBuilderContext &BC, ExplodedNode *Pred, const ReturnStmt *RS=nullptr)
Called by CoreEngine.
Definition: ExprEngine.cpp:2372
clang::ProgramPoint::Kind
Kind
Definition: ProgramPoint.h:61
clang::ento::SValBuilder::evalBinOpNN
virtual SVal evalBinOpNN(ProgramStateRef state, BinaryOperator::Opcode op, NonLoc lhs, NonLoc rhs, QualType resultTy)=0
Create a new value which represents a binary expression with two non- location operands.
clang::CXXDeleteExpr
Represents a delete expression for memory deallocation and destructor calls, e.g.
Definition: ExprCXX.h:2398
clang::ento::AnalysisManager::getAnalysisDeclContextManager
AnalysisDeclContextManager & getAnalysisDeclContextManager()
Definition: AnalysisManager.h:62
clang::BlockExpr
BlockExpr - Adaptor class for mixing a BlockDecl with expressions.
Definition: Expr.h:5965
llvm::ArrayRef
Definition: LLVM.h:34
clang::Decl
Decl - This represents one declaration (or definition), e.g.
Definition: DeclBase.h:89
ProgramState
and static some checkers Checker The latter are built on top of the former via the Checker and CheckerVisitor and attempts to isolate them from much of the gore of the internal analysis the analyzer is basically a source code simulator that traces out possible paths of execution The state of the and the combination of state and program point is a node in an exploded which has the entry program point and initial and then simulate transitions by analyzing individual expressions The analysis of an expression can cause the state to resulting in a new node in the ExplodedGraph with an updated program point and an updated state A bug is found by hitting a node that satisfies some bug condition(basically a violation of a checking invariant). The analyzer traces out multiple paths by reasoning about branches and then bifurcating the state it can contain cycles as paths loop back onto each other and cache out ProgramState and ExplodedNodes are basically immutable once created Once one creates a ProgramState
Definition: README.txt:34
clang::ento::ExprEngine::processStaticInitializer
void processStaticInitializer(const DeclStmt *DS, NodeBuilderContext &BuilderCtx, ExplodedNode *Pred, ExplodedNodeSet &Dst, const CFGBlock *DstT, const CFGBlock *DstF)
Called by CoreEngine.
BugReporterVisitors.h
clang::ArraySubscriptExpr
ArraySubscriptExpr - [C99 6.5.2.1] Array Subscripting.
Definition: Expr.h:2639
clang::ento::ExprEngine::VisitCXXDeleteExpr
void VisitCXXDeleteExpr(const CXXDeleteExpr *CDE, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Definition: ExprEngineCXX.cpp:942
clang::ento::FunctionSummariesTy
Definition: FunctionSummary.h:33
clang::ento::ExprEngine::VisitCXXBindTemporaryExpr
void VisitCXXBindTemporaryExpr(const CXXBindTemporaryExpr *BTE, ExplodedNodeSet &PreVisit, ExplodedNodeSet &Dst)
Definition: ExprEngine.cpp:1148
clang::ento::ExprEngine::getAnalysisDeclContextManager
AnalysisDeclContextManager & getAnalysisDeclContextManager()
Definition: ExprEngine.h:210
clang::ento::ReplayWithoutInlining
Traits for storing the call processing policy inside GDM.
Definition: ExprEngine.h:940
clang::ento::CoreEngine::hasWorkRemaining
bool hasWorkRemaining() const
Definition: CoreEngine.h:162
LLVM.h
clang::AnalyzerOptions
Stores options for the analyzer from the command line.
Definition: AnalyzerOptions.h:163
State
LineState State
Definition: UnwrappedLineFormatter.cpp:986
clang::ento::ExprEngine::VisitOffsetOfExpr
void VisitOffsetOfExpr(const OffsetOfExpr *Ex, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitOffsetOfExpr - Transfer function for offsetof.
Definition: ExprEngineC.cpp:851
clang::ento::ExprEngine::processIndirectGoto
void processIndirectGoto(IndirectGotoNodeBuilder &builder)
processIndirectGoto - Called by CoreEngine.
Definition: ExprEngine.cpp:2321
clang::ento::ExprEngine::getSValBuilder
SValBuilder & getSValBuilder()
Definition: ExprEngine.h:218
clang::ento::ExprEngine::getBugReporter
BugReporter & getBugReporter()
Definition: ExprEngine.h:220
clang::ento::ExprEngine::ProcessBaseDtor
void ProcessBaseDtor(const CFGBaseDtor D, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Definition: ExprEngine.cpp:1025
clang::ento::ExprEngine::processBeginOfFunction
void processBeginOfFunction(NodeBuilderContext &BC, ExplodedNode *Pred, ExplodedNodeSet &Dst, const BlockEdge &L)
Called by CoreEngine.
Definition: ExprEngine.cpp:2362
clang::ento::AnalysisManager
Definition: AnalysisManager.h:31
clang::BinaryOperatorKind
BinaryOperatorKind
Definition: OperationKinds.h:25
clang::ObjCNoReturn
Definition: ObjCNoReturn.h:24
clang::ento::ExprEngine::getCurrentCFGElement
CFGElement getCurrentCFGElement()
Return the CFG element corresponding to the worklist element that is currently being processed by Exp...
Definition: ExprEngine.h:699
clang::ento::ExprEngine::ViewGraph
void ViewGraph(bool trim=false)
Visualize the ExplodedGraph created by executing the simulation.
clang::ento::ExprEngine::getAnalysisManager
AnalysisManager & getAnalysisManager()
Definition: ExprEngine.h:208
CoreEngine.h
clang::ento::CoreEngine::wasBlocksExhausted
bool wasBlocksExhausted() const
Definition: CoreEngine.h:161
clang::ento::ExprEngine::getGraph
const ExplodedGraph & getGraph() const
Definition: ExprEngine.h:262
clang::ento::PathSensitiveBugReporter
GRBugReporter is used for generating path-sensitive reports.
Definition: BugReporter.h:666
clang::CFGElement
Represents a top-level expression in a basic block.
Definition: CFG.h:55
clang::ObjCPropertyAttribute::Kind
Kind
Definition: DeclObjCCommon.h:22
clang::DeclStmt
DeclStmt - Adaptor class for mixing declarations with statements and expressions.
Definition: Stmt.h:1291
clang::ento::ExprEngine
Definition: ExprEngine.h:127
ProgramState.h
clang::ento::SValBuilder::evalComplement
virtual SVal evalComplement(NonLoc val)=0
clang::ento::ProgramStateManager::getStoreManager
StoreManager & getStoreManager()
Definition: ProgramState.h:539
clang::ento::MemRegionManager
Definition: MemRegion.h:1302
clang::ento::CoreEngine::getWorkList
WorkList * getWorkList() const
Definition: CoreEngine.h:172
clang::CXXThisExpr
Represents the this expression in C++.
Definition: ExprCXX.h:1142
clang::ento::ExprEngine::DumpGraph
std::string DumpGraph(bool trim=false, StringRef Filename="")
Dump graph to the specified filename.
clang::ento::ExprEngine::setWhetherHasMoreIteration
static LLVM_NODISCARD ProgramStateRef setWhetherHasMoreIteration(ProgramStateRef State, const ObjCForCollectionStmt *O, const LocationContext *LC, bool HasMoreIteraton)
Note whether this loop has any more iteratios to model.
Definition: ExprEngine.cpp:2145
clang::ento::ExprEngine::processRegionChange
ProgramStateRef processRegionChange(ProgramStateRef state, const MemRegion *MR, const LocationContext *LCtx)
Definition: ExprEngine.h:404
clang::ento::ExprEngine::ProcessStmt
void ProcessStmt(const Stmt *S, ExplodedNode *Pred)
Definition: ExprEngine.cpp:769
clang::ento::ExprEngine::getStoreManager
StoreManager & getStoreManager()
Definition: ExprEngine.h:417
clang::interp::NE
bool NE(InterpState &S, CodePtr OpPC)
Definition: Interp.h:225
clang::ento::ExprEngine::ProcessDeleteDtor
void ProcessDeleteDtor(const CFGDeleteDtor D, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Definition: ExprEngine.cpp:985
WorkList.h
clang::ento::SValBuilder::evalMinus
virtual SVal evalMinus(NonLoc val)=0
clang::ento::ExprEngine::VisitDeclStmt
void VisitDeclStmt(const DeclStmt *DS, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitDeclStmt - Transfer function logic for DeclStmts.
Definition: ExprEngineC.cpp:567
clang::ento::CheckerManager
Definition: CheckerManager.h:127
clang::ento::EvalCallOptions::IsElidableCtorThatHasNotBeenElided
bool IsElidableCtorThatHasNotBeenElided
This call is a pre-C++17 elidable constructor that we failed to elide because we failed to compute th...
Definition: ExprEngine.h:122
clang
Definition: CalledOnceCheck.h:17
clang::ento::ExprEngine::VisitObjCAtSynchronizedStmt
void VisitObjCAtSynchronizedStmt(const ObjCAtSynchronizedStmt *S, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Transfer function logic for ObjCAtSynchronizedStmts.
Definition: ExprEngineObjC.cpp:38
clang::ento::ExprEngine::removeDead
void removeDead(ExplodedNode *Node, ExplodedNodeSet &Out, const Stmt *ReferenceStmt, const LocationContext *LC, const Stmt *DiagnosticStmt=nullptr, ProgramPoint::Kind K=ProgramPoint::PreStmtPurgeDeadSymbolsKind)
Run the analyzer's garbage collection - remove dead symbols and bindings from the state.
Definition: ExprEngine.cpp:689
clang::CFGDeleteDtor
Represents C++ object destructor generated from a call to delete.
Definition: CFG.h:414
CFG.h
clang::ento::ExprEngine::processAssume
ProgramStateRef processAssume(ProgramStateRef state, SVal cond, bool assumption)
evalAssume - Callback function invoked by the ConstraintManager when making assumptions about state v...
Definition: ExprEngine.cpp:537
clang::Stmt
Stmt - This represents one statement.
Definition: Stmt.h:68
clang::ento::ExprEngine::processCFGElement
void processCFGElement(const CFGElement E, ExplodedNode *Pred, unsigned StmtIdx, NodeBuilderContext *Ctx)
processCFGElement - Called by CoreEngine.
Definition: ExprEngine.cpp:627
clang::CXXCatchStmt
CXXCatchStmt - This represents a C++ catch block.
Definition: StmtCXX.h:28
clang::ento::ExprEngine::GenerateAutoTransition
void GenerateAutoTransition(ExplodedNode *N)
clang::ento::ExprEngine::handleLVectorSplat
ProgramStateRef handleLVectorSplat(ProgramStateRef state, const LocationContext *LCtx, const CastExpr *CastE, StmtNodeBuilder &Bldr, ExplodedNode *Pred)
clang::CFGBaseDtor
Represents C++ object destructor implicitly generated for base object in destructor.
Definition: CFG.h:440
clang::ento::NodeBuilderContext::getBlock
const CFGBlock * getBlock() const
Return the CFGBlock associated with this builder.
Definition: CoreEngine.h:217
clang::ento::CallEvent
Represents an abstract call to a function or method along a particular path.
Definition: CallEvent.h:143
clang::ento::ExprEngine::ExecuteWorkListWithInitialState
bool ExecuteWorkListWithInitialState(const LocationContext *L, unsigned Steps, ProgramStateRef InitState, ExplodedNodeSet &Dst)
Execute the work list with an initial state.
Definition: ExprEngine.h:199
clang::ento::ExprEngine::VisitCXXConstructExpr
void VisitCXXConstructExpr(const CXXConstructExpr *E, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Definition: ExprEngineCXX.cpp:686
clang::ento::PointerEscapeKind
PointerEscapeKind
Describes the different reasons a pointer escapes during analysis.
Definition: CheckerManager.h:79
clang::ento::NodeBuilderContext
Definition: CoreEngine.h:208
clang::AnalysisDeclContextManager
Definition: AnalysisDeclContext.h:421
clang::CallEnter
Represents a point when we begin processing an inlined call.
Definition: ProgramPoint.h:630
clang::ento::ProgramStateManager::getConstraintManager
ConstraintManager & getConstraintManager()
Definition: ProgramState.h:540
clang::ento::ExprEngine::VisitGuardedExpr
void VisitGuardedExpr(const Expr *Ex, const Expr *L, const Expr *R, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitGuardedExpr - Transfer function logic for ?, __builtin_choose.
Definition: ExprEngineC.cpp:786
clang::ento::EvalCallOptions::IsTemporaryCtorOrDtor
bool IsTemporaryCtorOrDtor
This call is a constructor or a destructor of a temporary value.
Definition: ExprEngine.h:110
clang::MemberExpr
MemberExpr - [C99 6.5.2.3] Structure and Union Members.
Definition: Expr.h:3162
clang::ento::ExprEngine::VisitCXXNewAllocatorCall
void VisitCXXNewAllocatorCall(const CXXNewExpr *CNE, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Definition: ExprEngineCXX.cpp:765
clang::BlockEdge
Definition: ProgramPoint.h:503
clang::ento::SVal
SVal - This represents a symbolic expression, which can be either an L-value or an R-value.
Definition: SVals.h:75
clang::ento::CoreEngine::getDataTags
DataTag::Factory & getDataTags()
Definition: CoreEngine.h:204
clang::ento::NodeBuilderWithSinks
Definition: CoreEngine.h:342
clang::ento::ExprEngine::enqueueEndOfPath
void enqueueEndOfPath(ExplodedNodeSet &S)
clang::ento::ExprEngine::processPointerEscapedOnBind
ProgramStateRef processPointerEscapedOnBind(ProgramStateRef State, ArrayRef< std::pair< SVal, SVal >> LocAndVals, const LocationContext *LCtx, PointerEscapeKind Kind, const CallEvent *Call)
Call PointerEscape callback when a value escapes as a result of bind.
Definition: ExprEngine.cpp:2787
clang::ento::RegionAndSymbolInvalidationTraits
Information about invalidation for a particular region/symbol.
Definition: MemRegion.h:1516
ProgramStateTrait.h
clang::Expr
This represents one expression.
Definition: Expr.h:109
clang::ento::ExprEngine::Inline_Regular
@ Inline_Regular
Follow the default settings for inlining callees.
Definition: ExprEngine.h:134
AnalysisManager.h
clang::CastExpr
CastExpr - Base class for type casts, including both implicit casts (ImplicitCastExpr) and explicit c...
Definition: Expr.h:3473
clang::ento::ExprEngine::CreateCXXTemporaryObject
void CreateCXXTemporaryObject(const MaterializeTemporaryExpr *ME, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Create a C++ temporary object for an rvalue.
Definition: ExprEngineCXX.cpp:26
clang::MSAsmStmt
This represents a Microsoft inline-assembly statement extension.
Definition: Stmt.h:3196
clang::ento::ExprEngine::getBasicVals
BasicValueFactory & getBasicVals()
Definition: ExprEngine.h:424
clang::ento::ExplodedNodeSet
Definition: ExplodedGraph.h:463
clang::ProgramPoint
Definition: ProgramPoint.h:59
clang::CallExpr
CallExpr - Represents a function call (C99 6.5.2.2, C++ [expr.call]).
Definition: Expr.h:2795
clang::ento::ExprEngine::VisitCommonDeclRefExpr
void VisitCommonDeclRefExpr(const Expr *DR, const NamedDecl *D, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Transfer function logic for DeclRefExprs and BlockDeclRefExprs.
Definition: ExprEngine.cpp:2529
clang::ento::SymbolManager
Definition: SymbolManager.h:417
clang::ento::DataTag::Factory
Definition: BugReporter.h:745
clang::ento::ExprEngine::ProcessNewAllocator
void ProcessNewAllocator(const CXXNewExpr *NE, ExplodedNode *Pred)
Definition: ExprEngine.cpp:932
clang::ento::CoreEngine::ExecuteWorkList
bool ExecuteWorkList(const LocationContext *L, unsigned Steps, ProgramStateRef InitState)
ExecuteWorkList - Run the worklist algorithm for a maximum number of steps.
Definition: CoreEngine.cpp:79
clang::CXXConstructExpr
Represents a call to a C++ constructor.
Definition: ExprCXX.h:1460
clang::ObjCIvarRefExpr
ObjCIvarRefExpr - A reference to an ObjC instance variable.
Definition: ExprObjC.h:548
clang::ento::ExprEngine::getGraph
ExplodedGraph & getGraph()
Definition: ExprEngine.h:261
clang::ento::ExprEngine::defaultEvalCall
void defaultEvalCall(NodeBuilder &B, ExplodedNode *Pred, const CallEvent &Call, const EvalCallOptions &CallOpts={})
Default implementation of call evaluation.
Definition: ExprEngineCallAndReturn.cpp:1047
llvm::IntrusiveRefCntPtr< const ProgramState >
clang::ento::ExprEngine::ExecuteWorkList
bool ExecuteWorkList(const LocationContext *L, unsigned Steps=150000)
Returns true if there is still simulation state on the worklist.
Definition: ExprEngine.h:191
clang::ento::ExprEngine::getRegionManager
MemRegionManager & getRegionManager()
Definition: ExprEngine.h:429
clang::ento::EvalCallOptions::IsTemporaryLifetimeExtendedViaAggregate
bool IsTemporaryLifetimeExtendedViaAggregate
This call is a constructor for a temporary that is lifetime-extended by binding it to a reference-typ...
Definition: ExprEngine.h:115
clang::ReturnStmt
ReturnStmt - This represents a return, optionally of an expression: return; return 4;.
Definition: Stmt.h:2731
clang::ento::ExprEngine::VisitBinaryOperator
void VisitBinaryOperator(const BinaryOperator *B, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitBinaryOperator - Transfer function logic for binary operators.
Definition: ExprEngineC.cpp:40
clang::ento::ExprEngine::VisitObjCMessage
void VisitObjCMessage(const ObjCMessageExpr *ME, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Definition: ExprEngineObjC.cpp:147
clang::ento::EvalCallOptions::IsCtorOrDtorWithImproperlyModeledTargetRegion
bool IsCtorOrDtorWithImproperlyModeledTargetRegion
This call is a constructor or a destructor for which we do not currently compute the this-region corr...
Definition: ExprEngine.h:103
clang::ento::ExprEngine::getCheckerManager
CheckerManager & getCheckerManager() const
Definition: ExprEngine.h:214
clang::ento::ExprEngine::VisitLogicalExpr
void VisitLogicalExpr(const BinaryOperator *B, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitLogicalExpr - Transfer function logic for '&&', '||'.
Definition: ExprEngineC.cpp:643