clang 17.0.0git
ExprEngine.h
Go to the documentation of this file.
1//===- ExprEngine.h - Path-Sensitive Expression-Level Dataflow --*- C++ -*-===//
2//
3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4// See https://llvm.org/LICENSE.txt for license information.
5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6//
7//===----------------------------------------------------------------------===//
8//
9// This file defines a meta-engine for path-sensitive dataflow analysis that
10// is built on CoreEngine, but provides the boilerplate to execute transfer
11// functions and build the ExplodedGraph at the expression level.
12//
13//===----------------------------------------------------------------------===//
14
15#ifndef LLVM_CLANG_STATICANALYZER_CORE_PATHSENSITIVE_EXPRENGINE_H
16#define LLVM_CLANG_STATICANALYZER_CORE_PATHSENSITIVE_EXPRENGINE_H
17
18#include "clang/AST/Expr.h"
19#include "clang/AST/Type.h"
20#include "clang/Analysis/CFG.h"
23#include "clang/Basic/LLVM.h"
37#include "llvm/ADT/ArrayRef.h"
38#include <cassert>
39#include <optional>
40#include <utility>
41
42namespace clang {
43
44class AnalysisDeclContextManager;
45class AnalyzerOptions;
46class ASTContext;
47class CFGBlock;
48class CFGElement;
49class ConstructionContext;
50class CXXBindTemporaryExpr;
51class CXXCatchStmt;
52class CXXConstructExpr;
53class CXXDeleteExpr;
54class CXXNewExpr;
55class CXXThisExpr;
56class Decl;
57class DeclStmt;
58class GCCAsmStmt;
59class LambdaExpr;
60class LocationContext;
61class MaterializeTemporaryExpr;
62class MSAsmStmt;
63class NamedDecl;
64class ObjCAtSynchronizedStmt;
65class ObjCForCollectionStmt;
66class ObjCIvarRefExpr;
67class ObjCMessageExpr;
68class ReturnStmt;
69class Stmt;
70
71namespace cross_tu {
72
73class CrossTranslationUnitContext;
74
75} // namespace cross_tu
76
77namespace ento {
78
79class AnalysisManager;
80class BasicValueFactory;
81class CallEvent;
82class CheckerManager;
83class ConstraintManager;
84class ExplodedNodeSet;
85class ExplodedNode;
86class IndirectGotoNodeBuilder;
87class MemRegion;
88struct NodeBuilderContext;
89class NodeBuilderWithSinks;
90class ProgramState;
91class ProgramStateManager;
92class RegionAndSymbolInvalidationTraits;
93class SymbolManager;
94class SwitchNodeBuilder;
95
96/// Hints for figuring out of a call should be inlined during evalCall().
98 /// This call is a constructor or a destructor for which we do not currently
99 /// compute the this-region correctly.
101
102 /// This call is a constructor or a destructor for a single element within
103 /// an array, a part of array construction or destruction.
104 bool IsArrayCtorOrDtor = false;
105
106 /// This call is a constructor or a destructor of a temporary value.
108
109 /// This call is a constructor for a temporary that is lifetime-extended
110 /// by binding it to a reference-type field within an aggregate,
111 /// for example 'A { const C &c; }; A a = { C() };'
113
114 /// This call is a pre-C++17 elidable constructor that we failed to elide
115 /// because we failed to compute the target region into which
116 /// this constructor would have been ultimately elided. Analysis that
117 /// we perform in this case is still correct but it behaves differently,
118 /// as if copy elision is disabled.
120
122};
123
125 void anchor();
126
127public:
128 /// The modes of inlining, which override the default analysis-wide settings.
130 /// Follow the default settings for inlining callees.
132
133 /// Do minimal inlining of callees.
134 Inline_Minimal = 0x1
135 };
136
137private:
139 bool IsCTUEnabled;
140
141 AnalysisManager &AMgr;
142
143 AnalysisDeclContextManager &AnalysisDeclContexts;
144
145 CoreEngine Engine;
146
147 /// G - the simulation graph.
148 ExplodedGraph &G;
149
150 /// StateMgr - Object that manages the data for all created states.
151 ProgramStateManager StateMgr;
152
153 /// SymMgr - Object that manages the symbol information.
154 SymbolManager &SymMgr;
155
156 /// MRMgr - MemRegionManager object that creates memory regions.
157 MemRegionManager &MRMgr;
158
159 /// svalBuilder - SValBuilder object that creates SVals from expressions.
160 SValBuilder &svalBuilder;
161
162 unsigned int currStmtIdx = 0;
163 const NodeBuilderContext *currBldrCtx = nullptr;
164
165 /// Helper object to determine if an Objective-C message expression
166 /// implicitly never returns.
167 ObjCNoReturn ObjCNoRet;
168
169 /// The BugReporter associated with this engine. It is important that
170 /// this object be placed at the very end of member variables so that its
171 /// destructor is called before the rest of the ExprEngine is destroyed.
173
174 /// The functions which have been analyzed through inlining. This is owned by
175 /// AnalysisConsumer. It can be null.
176 SetOfConstDecls *VisitedCallees;
177
178 /// The flag, which specifies the mode of inlining for the engine.
179 InliningModes HowToInline;
180
181public:
183 SetOfConstDecls *VisitedCalleesIn,
184 FunctionSummariesTy *FS, InliningModes HowToInlineIn);
185
186 virtual ~ExprEngine() = default;
187
188 /// Returns true if there is still simulation state on the worklist.
189 bool ExecuteWorkList(const LocationContext *L, unsigned Steps = 150000) {
190 return Engine.ExecuteWorkList(L, Steps, nullptr);
191 }
192
193 /// Execute the work list with an initial state. Nodes that reaches the exit
194 /// of the function are added into the Dst set, which represent the exit
195 /// state of the function call. Returns true if there is still simulation
196 /// state on the worklist.
198 ProgramStateRef InitState,
199 ExplodedNodeSet &Dst) {
200 return Engine.ExecuteWorkListWithInitialState(L, Steps, InitState, Dst);
201 }
202
203 /// getContext - Return the ASTContext associated with this analysis.
204 ASTContext &getContext() const { return AMgr.getASTContext(); }
205
207
209 return AMgr.getAnalysisDeclContextManager();
210 }
211
213 return *AMgr.getCheckerManager();
214 }
215
216 SValBuilder &getSValBuilder() { return svalBuilder; }
217
218 BugReporter &getBugReporter() { return BR; }
219
222 return &CTU;
223 }
224
226 assert(currBldrCtx);
227 return *currBldrCtx;
228 }
229
230 const Stmt *getStmt() const;
231
233 assert(G.roots_begin() != G.roots_end());
234 return (*G.roots_begin())->getLocation().getLocationContext();
235 }
236
238 const CFGBlock *blockPtr = currBldrCtx ? currBldrCtx->getBlock() : nullptr;
239 return {blockPtr, currStmtIdx};
240 }
241
245
246
247 /// Dump graph to the specified filename.
248 /// If filename is empty, generate a temporary one.
249 /// \return The filename the graph is written into.
250 std::string DumpGraph(bool trim = false, StringRef Filename="");
251
252 /// Dump the graph consisting of the given nodes to a specified filename.
253 /// Generate a temporary filename if it's not provided.
254 /// \return The filename the graph is written into.
256 StringRef Filename = "");
257
258 /// Visualize the ExplodedGraph created by executing the simulation.
259 void ViewGraph(bool trim = false);
260
261 /// Visualize a trimmed ExplodedGraph that only contains paths to the given
262 /// nodes.
264
265 /// getInitialState - Return the initial state used for the root vertex
266 /// in the ExplodedGraph.
268
269 ExplodedGraph &getGraph() { return G; }
270 const ExplodedGraph &getGraph() const { return G; }
271
272 /// Run the analyzer's garbage collection - remove dead symbols and
273 /// bindings from the state.
274 ///
275 /// Checkers can participate in this process with two callbacks:
276 /// \c checkLiveSymbols and \c checkDeadSymbols. See the CheckerDocumentation
277 /// class for more information.
278 ///
279 /// \param Node The predecessor node, from which the processing should start.
280 /// \param Out The returned set of output nodes.
281 /// \param ReferenceStmt The statement which is about to be processed.
282 /// Everything needed for this statement should be considered live.
283 /// A null statement means that everything in child LocationContexts
284 /// is dead.
285 /// \param LC The location context of the \p ReferenceStmt. A null location
286 /// context means that we have reached the end of analysis and that
287 /// all statements and local variables should be considered dead.
288 /// \param DiagnosticStmt Used as a location for any warnings that should
289 /// occur while removing the dead (e.g. leaks). By default, the
290 /// \p ReferenceStmt is used.
291 /// \param K Denotes whether this is a pre- or post-statement purge. This
292 /// must only be ProgramPoint::PostStmtPurgeDeadSymbolsKind if an
293 /// entire location context is being cleared, in which case the
294 /// \p ReferenceStmt must either be a ReturnStmt or \c NULL. Otherwise,
295 /// it must be ProgramPoint::PreStmtPurgeDeadSymbolsKind (the default)
296 /// and \p ReferenceStmt must be valid (non-null).
298 const Stmt *ReferenceStmt, const LocationContext *LC,
299 const Stmt *DiagnosticStmt = nullptr,
301
302 /// processCFGElement - Called by CoreEngine. Used to generate new successor
303 /// nodes by processing the 'effects' of a CFG element.
304 void processCFGElement(const CFGElement E, ExplodedNode *Pred,
305 unsigned StmtIdx, NodeBuilderContext *Ctx);
306
307 void ProcessStmt(const Stmt *S, ExplodedNode *Pred);
308
309 void ProcessLoopExit(const Stmt* S, ExplodedNode *Pred);
310
312
314
315 void ProcessNewAllocator(const CXXNewExpr *NE, ExplodedNode *Pred);
316
318 ExplodedNode *Pred, ExplodedNodeSet &Dst);
319 void ProcessDeleteDtor(const CFGDeleteDtor D,
320 ExplodedNode *Pred, ExplodedNodeSet &Dst);
321 void ProcessBaseDtor(const CFGBaseDtor D,
322 ExplodedNode *Pred, ExplodedNodeSet &Dst);
323 void ProcessMemberDtor(const CFGMemberDtor D,
324 ExplodedNode *Pred, ExplodedNodeSet &Dst);
326 ExplodedNode *Pred, ExplodedNodeSet &Dst);
327
328 /// Called by CoreEngine when processing the entrance of a CFGBlock.
330 NodeBuilderWithSinks &nodeBuilder,
331 ExplodedNode *Pred);
332
333 /// ProcessBranch - Called by CoreEngine. Used to generate successor
334 /// nodes by processing the 'effects' of a branch condition.
335 void processBranch(const Stmt *Condition,
336 NodeBuilderContext& BuilderCtx,
337 ExplodedNode *Pred,
338 ExplodedNodeSet &Dst,
339 const CFGBlock *DstT,
340 const CFGBlock *DstF);
341
342 /// Called by CoreEngine.
343 /// Used to generate successor nodes for temporary destructors depending
344 /// on whether the corresponding constructor was visited.
346 NodeBuilderContext &BldCtx,
347 ExplodedNode *Pred, ExplodedNodeSet &Dst,
348 const CFGBlock *DstT,
349 const CFGBlock *DstF);
350
351 /// Called by CoreEngine. Used to processing branching behavior
352 /// at static initializers.
354 NodeBuilderContext& BuilderCtx,
355 ExplodedNode *Pred,
356 ExplodedNodeSet &Dst,
357 const CFGBlock *DstT,
358 const CFGBlock *DstF);
359
360 /// processIndirectGoto - Called by CoreEngine. Used to generate successor
361 /// nodes by processing the 'effects' of a computed goto jump.
363
364 /// ProcessSwitch - Called by CoreEngine. Used to generate successor
365 /// nodes by processing the 'effects' of a switch statement.
366 void processSwitch(SwitchNodeBuilder& builder);
367
368 /// Called by CoreEngine. Used to notify checkers that processing a
369 /// function has begun. Called for both inlined and top-level functions.
371 ExplodedNode *Pred, ExplodedNodeSet &Dst,
372 const BlockEdge &L);
373
374 /// Called by CoreEngine. Used to notify checkers that processing a
375 /// function has ended. Called for both inlined and top-level functions.
377 ExplodedNode *Pred,
378 const ReturnStmt *RS = nullptr);
379
380 /// Remove dead bindings/symbols before exiting a function.
382 ExplodedNode *Pred,
383 ExplodedNodeSet &Dst);
384
385 /// Generate the entry node of the callee.
387 ExplodedNode *Pred);
388
389 /// Generate the sequence of nodes that simulate the call exit and the post
390 /// visit for CallExpr.
391 void processCallExit(ExplodedNode *Pred);
392
393 /// Called by CoreEngine when the analysis worklist has terminated.
394 void processEndWorklist();
395
396 /// evalAssume - Callback function invoked by the ConstraintManager when
397 /// making assumptions about state values.
399 bool assumption);
400
401 /// processRegionChanges - Called by ProgramStateManager whenever a change is made
402 /// to the store. Used to update checkers that track region values.
405 const InvalidatedSymbols *invalidated,
406 ArrayRef<const MemRegion *> ExplicitRegions,
408 const LocationContext *LCtx,
409 const CallEvent *Call);
410
411 inline ProgramStateRef
413 const MemRegion* MR,
414 const LocationContext *LCtx) {
415 return processRegionChanges(state, nullptr, MR, MR, LCtx, nullptr);
416 }
417
418 /// printJson - Called by ProgramStateManager to print checker-specific data.
419 void printJson(raw_ostream &Out, ProgramStateRef State,
420 const LocationContext *LCtx, const char *NL,
421 unsigned int Space, bool IsDot) const;
422
423 ProgramStateManager &getStateManager() { return StateMgr; }
424
426
428 return StateMgr.getConstraintManager();
429 }
430
431 // FIXME: Remove when we migrate over to just using SValBuilder.
433 return StateMgr.getBasicVals();
434 }
435
436 SymbolManager &getSymbolManager() { return SymMgr; }
438
440
441 // Functions for external checking of whether we have unfinished work
442 bool wasBlocksExhausted() const { return Engine.wasBlocksExhausted(); }
443 bool hasEmptyWorkList() const { return !Engine.getWorkList()->hasWork(); }
444 bool hasWorkRemaining() const { return Engine.hasWorkRemaining(); }
445
446 const CoreEngine &getCoreEngine() const { return Engine; }
447
448public:
449 /// Visit - Transfer function logic for all statements. Dispatches to
450 /// other functions that handle specific kinds of statements.
451 void Visit(const Stmt *S, ExplodedNode *Pred, ExplodedNodeSet &Dst);
452
453 /// VisitArrayInitLoopExpr - Transfer function for array init loop.
455 ExplodedNodeSet &Dst);
456
457 /// VisitArraySubscriptExpr - Transfer function for array accesses.
459 ExplodedNode *Pred,
460 ExplodedNodeSet &Dst);
461
462 /// VisitGCCAsmStmt - Transfer function logic for inline asm.
463 void VisitGCCAsmStmt(const GCCAsmStmt *A, ExplodedNode *Pred,
464 ExplodedNodeSet &Dst);
465
466 /// VisitMSAsmStmt - Transfer function logic for MS inline asm.
467 void VisitMSAsmStmt(const MSAsmStmt *A, ExplodedNode *Pred,
468 ExplodedNodeSet &Dst);
469
470 /// VisitBlockExpr - Transfer function logic for BlockExprs.
471 void VisitBlockExpr(const BlockExpr *BE, ExplodedNode *Pred,
472 ExplodedNodeSet &Dst);
473
474 /// VisitLambdaExpr - Transfer function logic for LambdaExprs.
475 void VisitLambdaExpr(const LambdaExpr *LE, ExplodedNode *Pred,
476 ExplodedNodeSet &Dst);
477
478 /// VisitBinaryOperator - Transfer function logic for binary operators.
480 ExplodedNodeSet &Dst);
481
482
483 /// VisitCall - Transfer function for function calls.
484 void VisitCallExpr(const CallExpr *CE, ExplodedNode *Pred,
485 ExplodedNodeSet &Dst);
486
487 /// VisitCast - Transfer function logic for all casts (implicit and explicit).
488 void VisitCast(const CastExpr *CastE, const Expr *Ex, ExplodedNode *Pred,
489 ExplodedNodeSet &Dst);
490
491 /// VisitCompoundLiteralExpr - Transfer function logic for compound literals.
493 ExplodedNode *Pred, ExplodedNodeSet &Dst);
494
495 /// Transfer function logic for DeclRefExprs and BlockDeclRefExprs.
496 void VisitCommonDeclRefExpr(const Expr *DR, const NamedDecl *D,
497 ExplodedNode *Pred, ExplodedNodeSet &Dst);
498
499 /// VisitDeclStmt - Transfer function logic for DeclStmts.
500 void VisitDeclStmt(const DeclStmt *DS, ExplodedNode *Pred,
501 ExplodedNodeSet &Dst);
502
503 /// VisitGuardedExpr - Transfer function logic for ?, __builtin_choose
504 void VisitGuardedExpr(const Expr *Ex, const Expr *L, const Expr *R,
505 ExplodedNode *Pred, ExplodedNodeSet &Dst);
506
507 void VisitInitListExpr(const InitListExpr *E, ExplodedNode *Pred,
508 ExplodedNodeSet &Dst);
509
510 /// VisitLogicalExpr - Transfer function logic for '&&', '||'
511 void VisitLogicalExpr(const BinaryOperator* B, ExplodedNode *Pred,
512 ExplodedNodeSet &Dst);
513
514 /// VisitMemberExpr - Transfer function for member expressions.
515 void VisitMemberExpr(const MemberExpr *M, ExplodedNode *Pred,
516 ExplodedNodeSet &Dst);
517
518 /// VisitAtomicExpr - Transfer function for builtin atomic expressions
519 void VisitAtomicExpr(const AtomicExpr *E, ExplodedNode *Pred,
520 ExplodedNodeSet &Dst);
521
522 /// Transfer function logic for ObjCAtSynchronizedStmts.
524 ExplodedNode *Pred, ExplodedNodeSet &Dst);
525
526 /// Transfer function logic for computing the lvalue of an Objective-C ivar.
528 ExplodedNodeSet &Dst);
529
530 /// VisitObjCForCollectionStmt - Transfer function logic for
531 /// ObjCForCollectionStmt.
533 ExplodedNode *Pred, ExplodedNodeSet &Dst);
534
535 void VisitObjCMessage(const ObjCMessageExpr *ME, ExplodedNode *Pred,
536 ExplodedNodeSet &Dst);
537
538 /// VisitReturnStmt - Transfer function logic for return statements.
539 void VisitReturnStmt(const ReturnStmt *R, ExplodedNode *Pred,
540 ExplodedNodeSet &Dst);
541
542 /// VisitOffsetOfExpr - Transfer function for offsetof.
543 void VisitOffsetOfExpr(const OffsetOfExpr *Ex, ExplodedNode *Pred,
544 ExplodedNodeSet &Dst);
545
546 /// VisitUnaryExprOrTypeTraitExpr - Transfer function for sizeof.
548 ExplodedNode *Pred, ExplodedNodeSet &Dst);
549
550 /// VisitUnaryOperator - Transfer function logic for unary operators.
551 void VisitUnaryOperator(const UnaryOperator* B, ExplodedNode *Pred,
552 ExplodedNodeSet &Dst);
553
554 /// Handle ++ and -- (both pre- and post-increment).
556 ExplodedNode *Pred,
557 ExplodedNodeSet &Dst);
558
560 ExplodedNodeSet &PreVisit,
561 ExplodedNodeSet &Dst);
562
563 void VisitCXXCatchStmt(const CXXCatchStmt *CS, ExplodedNode *Pred,
564 ExplodedNodeSet &Dst);
565
566 void VisitCXXThisExpr(const CXXThisExpr *TE, ExplodedNode *Pred,
567 ExplodedNodeSet & Dst);
568
570 ExplodedNodeSet &Dst);
571
573 ExplodedNode *Pred, ExplodedNodeSet &Dst);
574
575 void VisitCXXDestructor(QualType ObjectType, const MemRegion *Dest,
576 const Stmt *S, bool IsBaseDtor,
577 ExplodedNode *Pred, ExplodedNodeSet &Dst,
578 EvalCallOptions &Options);
579
580 void VisitCXXNewAllocatorCall(const CXXNewExpr *CNE,
581 ExplodedNode *Pred,
582 ExplodedNodeSet &Dst);
583
584 void VisitCXXNewExpr(const CXXNewExpr *CNE, ExplodedNode *Pred,
585 ExplodedNodeSet &Dst);
586
587 void VisitCXXDeleteExpr(const CXXDeleteExpr *CDE, ExplodedNode *Pred,
588 ExplodedNodeSet &Dst);
589
590 /// Create a C++ temporary object for an rvalue.
592 ExplodedNode *Pred,
593 ExplodedNodeSet &Dst);
594
595 /// evalEagerlyAssumeBinOpBifurcation - Given the nodes in 'Src', eagerly assume symbolic
596 /// expressions of the form 'x != 0' and generate new nodes (stored in Dst)
597 /// with those assumptions.
599 const Expr *Ex);
600
601 static std::pair<const ProgramPointTag *, const ProgramPointTag *>
603
605 const LocationContext *LCtx, QualType T,
606 QualType ExTy, const CastExpr *CastE,
607 StmtNodeBuilder &Bldr,
608 ExplodedNode *Pred);
609
611 const LocationContext *LCtx,
612 const CastExpr *CastE,
613 StmtNodeBuilder &Bldr,
614 ExplodedNode *Pred);
615
617 const UnaryOperator* U,
618 StmtNodeBuilder &Bldr);
619
620public:
622 SVal LHS, SVal RHS, QualType T) {
623 return svalBuilder.evalBinOp(ST, Op, LHS, RHS, T);
624 }
625
626 /// Retreives which element is being constructed in a non-POD type array.
627 static std::optional<unsigned>
629 const LocationContext *LCtx);
630
631 /// Retreives which element is being destructed in a non-POD type array.
632 static std::optional<unsigned>
634 const LocationContext *LCtx);
635
636 /// Retreives the size of the array in the pending ArrayInitLoopExpr.
637 static std::optional<unsigned>
639 const LocationContext *LCtx);
640
641 /// By looking at a certain item that may be potentially part of an object's
642 /// ConstructionContext, retrieve such object's location. A particular
643 /// statement can be transparently passed as \p Item in most cases.
644 static std::optional<SVal>
646 const ConstructionContextItem &Item,
647 const LocationContext *LC);
648
649 /// Call PointerEscape callback when a value escapes as a result of bind.
651 ProgramStateRef State, ArrayRef<std::pair<SVal, SVal>> LocAndVals,
652 const LocationContext *LCtx, PointerEscapeKind Kind,
653 const CallEvent *Call);
654
655 /// Call PointerEscape callback when a value escapes as a result of
656 /// region invalidation.
657 /// \param[in] ITraits Specifies invalidation traits for regions/symbols.
659 ProgramStateRef State,
660 const InvalidatedSymbols *Invalidated,
661 ArrayRef<const MemRegion *> ExplicitRegions,
662 const CallEvent *Call,
664
665private:
666 /// evalBind - Handle the semantics of binding a value to a specific location.
667 /// This method is used by evalStore, VisitDeclStmt, and others.
668 void evalBind(ExplodedNodeSet &Dst, const Stmt *StoreE, ExplodedNode *Pred,
669 SVal location, SVal Val, bool atDeclInit = false,
670 const ProgramPoint *PP = nullptr);
671
674 SVal Loc, SVal Val,
675 const LocationContext *LCtx);
676
677 /// A simple wrapper when you only need to notify checkers of pointer-escape
678 /// of some values.
679 ProgramStateRef escapeValues(ProgramStateRef State, ArrayRef<SVal> Vs,
681 const CallEvent *Call = nullptr) const;
682
683public:
684 // FIXME: 'tag' should be removed, and a LocationContext should be used
685 // instead.
686 // FIXME: Comment on the meaning of the arguments, when 'St' may not
687 // be the same as Pred->state, and when 'location' may not be the
688 // same as state->getLValue(Ex).
689 /// Simulate a read of the result of Ex.
690 void evalLoad(ExplodedNodeSet &Dst,
691 const Expr *NodeEx, /* Eventually will be a CFGStmt */
692 const Expr *BoundExpr,
693 ExplodedNode *Pred,
695 SVal location,
696 const ProgramPointTag *tag = nullptr,
697 QualType LoadTy = QualType());
698
699 // FIXME: 'tag' should be removed, and a LocationContext should be used
700 // instead.
701 void evalStore(ExplodedNodeSet &Dst, const Expr *AssignE, const Expr *StoreE,
702 ExplodedNode *Pred, ProgramStateRef St, SVal TargetLV, SVal Val,
703 const ProgramPointTag *tag = nullptr);
704
705 /// Return the CFG element corresponding to the worklist element
706 /// that is currently being processed by ExprEngine.
708 return (*currBldrCtx->getBlock())[currStmtIdx];
709 }
710
711 /// Create a new state in which the call return value is binded to the
712 /// call origin expression.
714 const LocationContext *LCtx,
715 ProgramStateRef State);
716
717 /// Evaluate a call, running pre- and post-call checkers and allowing checkers
718 /// to be responsible for handling the evaluation of the call itself.
719 void evalCall(ExplodedNodeSet &Dst, ExplodedNode *Pred,
720 const CallEvent &Call);
721
722 /// Default implementation of call evaluation.
724 const CallEvent &Call,
725 const EvalCallOptions &CallOpts = {});
726
727 /// Find location of the object that is being constructed by a given
728 /// constructor. This should ideally always succeed but due to not being
729 /// fully implemented it sometimes indicates that it failed via its
730 /// out-parameter CallOpts; in such cases a fake temporary region is
731 /// returned, which is better than nothing but does not represent
732 /// the actual behavior of the program. The Idx parameter is used if we
733 /// construct an array of objects. In that case it points to the index
734 /// of the continuous memory region.
735 /// E.g.:
736 /// For `int arr[4]` this index can be 0,1,2,3.
737 /// For `int arr2[3][3]` this index can be 0,1,...,7,8.
738 /// A multi-dimensional array is also a continuous memory location in a
739 /// row major order, so for arr[0][0] Idx is 0 and for arr[2][2] Idx is 8.
741 const NodeBuilderContext *BldrCtx,
742 const LocationContext *LCtx,
743 const ConstructionContext *CC,
744 EvalCallOptions &CallOpts,
745 unsigned Idx = 0);
746
747 /// Update the program state with all the path-sensitive information
748 /// that's necessary to perform construction of an object with a given
749 /// syntactic construction context. V and CallOpts have to be obtained from
750 /// computeObjectUnderConstruction() invoked with the same set of
751 /// the remaining arguments (E, State, LCtx, CC).
753 SVal V, const Expr *E, ProgramStateRef State, const LocationContext *LCtx,
754 const ConstructionContext *CC, const EvalCallOptions &CallOpts);
755
756 /// A convenient wrapper around computeObjectUnderConstruction
757 /// and updateObjectsUnderConstruction.
758 std::pair<ProgramStateRef, SVal> handleConstructionContext(
759 const Expr *E, ProgramStateRef State, const NodeBuilderContext *BldrCtx,
760 const LocationContext *LCtx, const ConstructionContext *CC,
761 EvalCallOptions &CallOpts, unsigned Idx = 0) {
762
763 SVal V = computeObjectUnderConstruction(E, State, BldrCtx, LCtx, CC,
764 CallOpts, Idx);
765 State = updateObjectsUnderConstruction(V, E, State, LCtx, CC, CallOpts);
766
767 return std::make_pair(State, V);
768 }
769
770private:
771 ProgramStateRef finishArgumentConstruction(ProgramStateRef State,
772 const CallEvent &Call);
773 void finishArgumentConstruction(ExplodedNodeSet &Dst, ExplodedNode *Pred,
774 const CallEvent &Call);
775
776 void evalLoadCommon(ExplodedNodeSet &Dst,
777 const Expr *NodeEx, /* Eventually will be a CFGStmt */
778 const Expr *BoundEx,
779 ExplodedNode *Pred,
781 SVal location,
782 const ProgramPointTag *tag,
783 QualType LoadTy);
784
785 void evalLocation(ExplodedNodeSet &Dst,
786 const Stmt *NodeEx, /* This will eventually be a CFGStmt */
787 const Stmt *BoundEx,
788 ExplodedNode *Pred,
790 SVal location,
791 bool isLoad);
792
793 /// Count the stack depth and determine if the call is recursive.
794 void examineStackFrames(const Decl *D, const LocationContext *LCtx,
795 bool &IsRecursive, unsigned &StackDepth);
796
797 enum CallInlinePolicy {
798 CIP_Allowed,
799 CIP_DisallowedOnce,
800 CIP_DisallowedAlways
801 };
802
803 /// See if a particular call should be inlined, by only looking
804 /// at the call event and the current state of analysis.
805 CallInlinePolicy mayInlineCallKind(const CallEvent &Call,
806 const ExplodedNode *Pred,
807 AnalyzerOptions &Opts,
808 const EvalCallOptions &CallOpts);
809
810 /// See if the given AnalysisDeclContext is built for a function that we
811 /// should always inline simply because it's small enough.
812 /// Apart from "small" functions, we also have "large" functions
813 /// (cf. isLarge()), some of which are huge (cf. isHuge()), and we classify
814 /// the remaining functions as "medium".
815 bool isSmall(AnalysisDeclContext *ADC) const;
816
817 /// See if the given AnalysisDeclContext is built for a function that we
818 /// should inline carefully because it looks pretty large.
819 bool isLarge(AnalysisDeclContext *ADC) const;
820
821 /// See if the given AnalysisDeclContext is built for a function that we
822 /// should never inline because it's legit gigantic.
823 bool isHuge(AnalysisDeclContext *ADC) const;
824
825 /// See if the given AnalysisDeclContext is built for a function that we
826 /// should inline, just by looking at the declaration of the function.
827 bool mayInlineDecl(AnalysisDeclContext *ADC) const;
828
829 /// Checks our policies and decides weither the given call should be inlined.
830 bool shouldInlineCall(const CallEvent &Call, const Decl *D,
831 const ExplodedNode *Pred,
832 const EvalCallOptions &CallOpts = {});
833
834 /// Checks whether our policies allow us to inline a non-POD type array
835 /// construction.
836 bool shouldInlineArrayConstruction(const ProgramStateRef State,
837 const CXXConstructExpr *CE,
838 const LocationContext *LCtx);
839
840 /// Checks whether our policies allow us to inline a non-POD type array
841 /// destruction.
842 /// \param Size The size of the array.
843 bool shouldInlineArrayDestruction(uint64_t Size);
844
845 /// Prepares the program state for array destruction. If no error happens
846 /// the function binds a 'PendingArrayDestruction' entry to the state, which
847 /// it returns along with the index. If any error happens (we fail to read
848 /// the size, the index would be -1, etc.) the function will return the
849 /// original state along with an index of 0. The actual element count of the
850 /// array can be accessed by the optional 'ElementCountVal' parameter. \param
851 /// State The program state. \param Region The memory region where the array
852 /// is stored. \param ElementTy The type an element in the array. \param LCty
853 /// The location context. \param ElementCountVal A pointer to an optional
854 /// SVal. If specified, the size of the array will be returned in it. It can
855 /// be Unknown.
856 std::pair<ProgramStateRef, uint64_t> prepareStateForArrayDestruction(
857 const ProgramStateRef State, const MemRegion *Region,
858 const QualType &ElementTy, const LocationContext *LCtx,
859 SVal *ElementCountVal = nullptr);
860
861 /// Checks whether we construct an array of non-POD type, and decides if the
862 /// constructor should be inkoved once again.
863 bool shouldRepeatCtorCall(ProgramStateRef State, const CXXConstructExpr *E,
864 const LocationContext *LCtx);
865
866 void inlineCall(WorkList *WList, const CallEvent &Call, const Decl *D,
867 NodeBuilder &Bldr, ExplodedNode *Pred, ProgramStateRef State);
868
869 void ctuBifurcate(const CallEvent &Call, const Decl *D, NodeBuilder &Bldr,
870 ExplodedNode *Pred, ProgramStateRef State);
871
872 /// Returns true if the CTU analysis is running its second phase.
873 bool isSecondPhaseCTU() { return IsCTUEnabled && !Engine.getCTUWorkList(); }
874
875 /// Conservatively evaluate call by invalidating regions and binding
876 /// a conjured return value.
877 void conservativeEvalCall(const CallEvent &Call, NodeBuilder &Bldr,
878 ExplodedNode *Pred, ProgramStateRef State);
879
880 /// Either inline or process the call conservatively (or both), based
881 /// on DynamicDispatchBifurcation data.
882 void BifurcateCall(const MemRegion *BifurReg,
883 const CallEvent &Call, const Decl *D, NodeBuilder &Bldr,
884 ExplodedNode *Pred);
885
886 bool replayWithoutInlining(ExplodedNode *P, const LocationContext *CalleeLC);
887
888 /// Models a trivial copy or move constructor or trivial assignment operator
889 /// call with a simple bind.
890 void performTrivialCopy(NodeBuilder &Bldr, ExplodedNode *Pred,
891 const CallEvent &Call);
892
893 /// If the value of the given expression \p InitWithAdjustments is a NonLoc,
894 /// copy it into a new temporary object region, and replace the value of the
895 /// expression with that.
896 ///
897 /// If \p Result is provided, the new region will be bound to this expression
898 /// instead of \p InitWithAdjustments.
899 ///
900 /// Returns the temporary region with adjustments into the optional
901 /// OutRegionWithAdjustments out-parameter if a new region was indeed needed,
902 /// otherwise sets it to nullptr.
903 ProgramStateRef createTemporaryRegionIfNeeded(
904 ProgramStateRef State, const LocationContext *LC,
905 const Expr *InitWithAdjustments, const Expr *Result = nullptr,
906 const SubRegion **OutRegionWithAdjustments = nullptr);
907
908 /// Returns a region representing the `Idx`th element of a (possibly
909 /// multi-dimensional) array, for the purposes of element construction or
910 /// destruction.
911 ///
912 /// On return, \p Ty will be set to the base type of the array.
913 ///
914 /// If the type is not an array type at all, the original value is returned.
915 /// Otherwise the "IsArray" flag is set.
916 static SVal makeElementRegion(ProgramStateRef State, SVal LValue,
917 QualType &Ty, bool &IsArray, unsigned Idx = 0);
918
919 /// For a DeclStmt or CXXInitCtorInitializer, walk backward in the current CFG
920 /// block to find the constructor expression that directly constructed into
921 /// the storage for this statement. Returns null if the constructor for this
922 /// statement created a temporary object region rather than directly
923 /// constructing into an existing region.
924 const CXXConstructExpr *findDirectConstructorForCurrentCFGElement();
925
926 /// Common code that handles either a CXXConstructExpr or a
927 /// CXXInheritedCtorInitExpr.
928 void handleConstructor(const Expr *E, ExplodedNode *Pred,
929 ExplodedNodeSet &Dst);
930
931public:
932 /// Note whether this loop has any more iteratios to model. These methods are
933 /// essentially an interface for a GDM trait. Further reading in
934 /// ExprEngine::VisitObjCForCollectionStmt().
935 [[nodiscard]] static ProgramStateRef
937 const ObjCForCollectionStmt *O,
938 const LocationContext *LC, bool HasMoreIteraton);
939
940 [[nodiscard]] static ProgramStateRef
941 removeIterationState(ProgramStateRef State, const ObjCForCollectionStmt *O,
942 const LocationContext *LC);
943
944 [[nodiscard]] static bool hasMoreIteration(ProgramStateRef State,
945 const ObjCForCollectionStmt *O,
946 const LocationContext *LC);
947
948private:
949 /// Assuming we construct an array of non-POD types, this method allows us
950 /// to store which element is to be constructed next.
951 static ProgramStateRef
952 setIndexOfElementToConstruct(ProgramStateRef State, const CXXConstructExpr *E,
953 const LocationContext *LCtx, unsigned Idx);
954
955 static ProgramStateRef
956 removeIndexOfElementToConstruct(ProgramStateRef State,
957 const CXXConstructExpr *E,
958 const LocationContext *LCtx);
959
960 /// Assuming we destruct an array of non-POD types, this method allows us
961 /// to store which element is to be destructed next.
962 static ProgramStateRef setPendingArrayDestruction(ProgramStateRef State,
963 const LocationContext *LCtx,
964 unsigned Idx);
965
966 static ProgramStateRef
967 removePendingArrayDestruction(ProgramStateRef State,
968 const LocationContext *LCtx);
969
970 /// Sets the size of the array in a pending ArrayInitLoopExpr.
971 static ProgramStateRef setPendingInitLoop(ProgramStateRef State,
972 const CXXConstructExpr *E,
973 const LocationContext *LCtx,
974 unsigned Idx);
975
976 static ProgramStateRef removePendingInitLoop(ProgramStateRef State,
977 const CXXConstructExpr *E,
978 const LocationContext *LCtx);
979
980 static ProgramStateRef
981 removeStateTraitsUsedForArrayEvaluation(ProgramStateRef State,
982 const CXXConstructExpr *E,
983 const LocationContext *LCtx);
984
985 /// Store the location of a C++ object corresponding to a statement
986 /// until the statement is actually encountered. For example, if a DeclStmt
987 /// has CXXConstructExpr as its initializer, the object would be considered
988 /// to be "under construction" between CXXConstructExpr and DeclStmt.
989 /// This allows, among other things, to keep bindings to variable's fields
990 /// made within the constructor alive until its declaration actually
991 /// goes into scope.
992 static ProgramStateRef
993 addObjectUnderConstruction(ProgramStateRef State,
994 const ConstructionContextItem &Item,
995 const LocationContext *LC, SVal V);
996
997 /// Mark the object sa fully constructed, cleaning up the state trait
998 /// that tracks objects under construction.
999 static ProgramStateRef
1000 finishObjectConstruction(ProgramStateRef State,
1001 const ConstructionContextItem &Item,
1002 const LocationContext *LC);
1003
1004 /// If the given expression corresponds to a temporary that was used for
1005 /// passing into an elidable copy/move constructor and that constructor
1006 /// was actually elided, track that we also need to elide the destructor.
1007 static ProgramStateRef elideDestructor(ProgramStateRef State,
1008 const CXXBindTemporaryExpr *BTE,
1009 const LocationContext *LC);
1010
1011 /// Stop tracking the destructor that corresponds to an elided constructor.
1012 static ProgramStateRef
1013 cleanupElidedDestructor(ProgramStateRef State,
1014 const CXXBindTemporaryExpr *BTE,
1015 const LocationContext *LC);
1016
1017 /// Returns true if the given expression corresponds to a temporary that
1018 /// was constructed for passing into an elidable copy/move constructor
1019 /// and that constructor was actually elided.
1020 static bool isDestructorElided(ProgramStateRef State,
1021 const CXXBindTemporaryExpr *BTE,
1022 const LocationContext *LC);
1023
1024 /// Check if all objects under construction have been fully constructed
1025 /// for the given context range (including FromLC, not including ToLC).
1026 /// This is useful for assertions. Also checks if elided destructors
1027 /// were cleaned up.
1028 static bool areAllObjectsFullyConstructed(ProgramStateRef State,
1029 const LocationContext *FromLC,
1030 const LocationContext *ToLC);
1031};
1032
1033/// Traits for storing the call processing policy inside GDM.
1034/// The GDM stores the corresponding CallExpr pointer.
1035// FIXME: This does not use the nice trait macros because it must be accessible
1036// from multiple translation units.
1038template <>
1040 public ProgramStatePartialTrait<const void*> {
1041 static void *GDMIndex();
1042};
1043
1044} // namespace ento
1045
1046} // namespace clang
1047
1048#endif // LLVM_CLANG_STATICANALYZER_CORE_PATHSENSITIVE_EXPRENGINE_H
#define V(N, I)
Definition: ASTContext.h:3217
BoundNodesTreeBuilder Nodes
DynTypedNode Node
StringRef P
StringRef Filename
Definition: Format.cpp:2774
Forward-declares and imports various common LLVM datatypes that clang wants to use unqualified.
C Language Family Type Representation.
Holds long-lived AST nodes (such as types and decls) that can be referred to throughout the semantic ...
Definition: ASTContext.h:182
AnalysisDeclContext contains the context data for the function, method or block under analysis.
Stores options for the analyzer from the command line.
Represents a loop initializing the elements of an array.
Definition: Expr.h:5428
ArraySubscriptExpr - [C99 6.5.2.1] Array Subscripting.
Definition: Expr.h:2656
AtomicExpr - Variadic atomic builtins: __atomic_exchange, __atomic_fetch_*, __atomic_load,...
Definition: Expr.h:6239
A builtin binary operation expression such as "x + y" or "x <= y".
Definition: Expr.h:3814
BlockExpr - Adaptor class for mixing a BlockDecl with expressions.
Definition: Expr.h:5975
Represents C++ object destructor implicitly generated for automatic object or temporary bound to cons...
Definition: CFG.h:389
Represents C++ object destructor implicitly generated for base object in destructor.
Definition: CFG.h:440
Represents a single basic block in a source-level CFG.
Definition: CFG.h:576
ElementRefImpl< true > ConstCFGElementRef
Definition: CFG.h:886
Represents C++ object destructor generated from a call to delete.
Definition: CFG.h:414
Represents a top-level expression in a basic block.
Definition: CFG.h:54
Represents C++ object destructor implicitly generated by compiler on various occasions.
Definition: CFG.h:364
Represents C++ base or member initializer from constructor's initialization list.
Definition: CFG.h:225
Represents C++ object destructor implicitly generated for member object in destructor.
Definition: CFG.h:461
Represents C++ object destructor implicitly generated at the end of full expression for temporary obj...
Definition: CFG.h:482
Represents binding an expression to a temporary.
Definition: ExprCXX.h:1470
CXXCatchStmt - This represents a C++ catch block.
Definition: StmtCXX.h:28
Represents a call to a C++ constructor.
Definition: ExprCXX.h:1518
Represents a delete expression for memory deallocation and destructor calls, e.g.
Definition: ExprCXX.h:2473
Represents a call to an inherited base class constructor from an inheriting constructor.
Definition: ExprCXX.h:1709
Represents a new-expression for memory allocation and constructor calls, e.g: "new CXXNewExpr(foo)".
Definition: ExprCXX.h:2199
Represents the this expression in C++.
Definition: ExprCXX.h:1148
Represents a point when we begin processing an inlined call.
Definition: ProgramPoint.h:628
CallExpr - Represents a function call (C99 6.5.2.2, C++ [expr.call]).
Definition: Expr.h:2812
CastExpr - Base class for type casts, including both implicit casts (ImplicitCastExpr) and explicit c...
Definition: Expr.h:3482
CompoundLiteralExpr - [C99 6.5.2.5].
Definition: Expr.h:3412
Represents a single point (AST node) in the program that requires attention during construction of an...
ConstructionContext's subclasses describe different ways of constructing an object in C++.
DeclStmt - Adaptor class for mixing declarations with statements and expressions.
Definition: Stmt.h:1311
Decl - This represents one declaration (or definition), e.g.
Definition: DeclBase.h:83
This represents one expression.
Definition: Expr.h:110
This represents a GCC inline-assembly statement extension.
Definition: Stmt.h:3046
Describes an C or C++ initializer list.
Definition: Expr.h:4800
A C++ lambda expression, which produces a function object (of unspecified type) that can be invoked l...
Definition: ExprCXX.h:1924
It wraps the AnalysisDeclContext to represent both the call stack with the help of StackFrameContext ...
This represents a Microsoft inline-assembly statement extension.
Definition: Stmt.h:3269
Represents a prvalue temporary that is written into memory so that a reference can bind to it.
Definition: ExprCXX.h:4562
MemberExpr - [C99 6.5.2.3] Structure and Union Members.
Definition: Expr.h:3175
This represents a decl that may have a name.
Definition: Decl.h:247
Represents Objective-C's @synchronized statement.
Definition: StmtObjC.h:302
Represents Objective-C's collection statement.
Definition: StmtObjC.h:23
ObjCIvarRefExpr - A reference to an ObjC instance variable.
Definition: ExprObjC.h:548
An expression that sends a message to the given Objective-C object or class.
Definition: ExprObjC.h:942
OffsetOfExpr - [C99 7.17] - This represents an expression of the form offsetof(record-type,...
Definition: Expr.h:2457
ProgramPoints can be "tagged" as representing points specific to a given analysis entity.
Definition: ProgramPoint.h:38
A (possibly-)qualified type.
Definition: Type.h:736
ReturnStmt - This represents a return, optionally of an expression: return; return 4;.
Definition: Stmt.h:2806
Stmt - This represents one statement.
Definition: Stmt.h:72
UnaryExprOrTypeTraitExpr - expression with either a type or (unevaluated) expression operand.
Definition: Expr.h:2560
UnaryOperator - This represents the unary-expression's (except sizeof and alignof),...
Definition: Expr.h:2176
This class is used for tools that requires cross translation unit capability.
ASTContext & getASTContext() override
AnalysisDeclContextManager & getAnalysisDeclContextManager()
CheckerManager * getCheckerManager() const
BugReporter is a utility class for generating PathDiagnostics for analysis.
Definition: BugReporter.h:585
Represents an abstract call to a function or method along a particular path.
Definition: CallEvent.h:149
CoreEngine - Implements the core logic of the graph-reachability analysis.
Definition: CoreEngine.h:55
DataTag::Factory & getDataTags()
Definition: CoreEngine.h:208
WorkList * getCTUWorkList() const
Definition: CoreEngine.h:176
bool wasBlocksExhausted() const
Definition: CoreEngine.h:164
WorkList * getWorkList() const
Definition: CoreEngine.h:175
bool ExecuteWorkListWithInitialState(const LocationContext *L, unsigned Steps, ProgramStateRef InitState, ExplodedNodeSet &Dst)
Returns true if there is still simulation state on the worklist.
Definition: CoreEngine.cpp:225
bool ExecuteWorkList(const LocationContext *L, unsigned Steps, ProgramStateRef InitState)
ExecuteWorkList - Run the worklist algorithm for a maximum number of steps.
Definition: CoreEngine.cpp:88
bool hasWorkRemaining() const
Definition: CoreEngine.h:165
roots_iterator roots_end()
roots_iterator roots_begin()
void processEndOfFunction(NodeBuilderContext &BC, ExplodedNode *Pred, const ReturnStmt *RS=nullptr)
Called by CoreEngine.
void VisitBinaryOperator(const BinaryOperator *B, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitBinaryOperator - Transfer function logic for binary operators.
Definition: ExprEngineC.cpp:40
bool ExecuteWorkListWithInitialState(const LocationContext *L, unsigned Steps, ProgramStateRef InitState, ExplodedNodeSet &Dst)
Execute the work list with an initial state.
Definition: ExprEngine.h:197
ProgramStateManager & getStateManager()
Definition: ExprEngine.h:423
void VisitArraySubscriptExpr(const ArraySubscriptExpr *Ex, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitArraySubscriptExpr - Transfer function for array accesses.
void VisitCommonDeclRefExpr(const Expr *DR, const NamedDecl *D, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Transfer function logic for DeclRefExprs and BlockDeclRefExprs.
void ProcessInitializer(const CFGInitializer I, ExplodedNode *Pred)
void VisitObjCMessage(const ObjCMessageExpr *ME, ExplodedNode *Pred, ExplodedNodeSet &Dst)
void ProcessTemporaryDtor(const CFGTemporaryDtor D, ExplodedNode *Pred, ExplodedNodeSet &Dst)
void VisitGuardedExpr(const Expr *Ex, const Expr *L, const Expr *R, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitGuardedExpr - Transfer function logic for ?, __builtin_choose.
void processCallEnter(NodeBuilderContext &BC, CallEnter CE, ExplodedNode *Pred)
Generate the entry node of the callee.
void enqueueEndOfPath(ExplodedNodeSet &S)
void processBeginOfFunction(NodeBuilderContext &BC, ExplodedNode *Pred, ExplodedNodeSet &Dst, const BlockEdge &L)
Called by CoreEngine.
void VisitCast(const CastExpr *CastE, const Expr *Ex, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitCast - Transfer function logic for all casts (implicit and explicit).
void removeDead(ExplodedNode *Node, ExplodedNodeSet &Out, const Stmt *ReferenceStmt, const LocationContext *LC, const Stmt *DiagnosticStmt=nullptr, ProgramPoint::Kind K=ProgramPoint::PreStmtPurgeDeadSymbolsKind)
Run the analyzer's garbage collection - remove dead symbols and bindings from the state.
BasicValueFactory & getBasicVals()
Definition: ExprEngine.h:432
void VisitLogicalExpr(const BinaryOperator *B, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitLogicalExpr - Transfer function logic for '&&', '||'.
std::pair< ProgramStateRef, SVal > handleConstructionContext(const Expr *E, ProgramStateRef State, const NodeBuilderContext *BldrCtx, const LocationContext *LCtx, const ConstructionContext *CC, EvalCallOptions &CallOpts, unsigned Idx=0)
A convenient wrapper around computeObjectUnderConstruction and updateObjectsUnderConstruction.
Definition: ExprEngine.h:758
void VisitCXXDestructor(QualType ObjectType, const MemRegion *Dest, const Stmt *S, bool IsBaseDtor, ExplodedNode *Pred, ExplodedNodeSet &Dst, EvalCallOptions &Options)
void GenerateAutoTransition(ExplodedNode *N)
void VisitObjCAtSynchronizedStmt(const ObjCAtSynchronizedStmt *S, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Transfer function logic for ObjCAtSynchronizedStmts.
void VisitReturnStmt(const ReturnStmt *R, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitReturnStmt - Transfer function logic for return statements.
const CoreEngine & getCoreEngine() const
Definition: ExprEngine.h:446
SVal evalBinOp(ProgramStateRef ST, BinaryOperator::Opcode Op, SVal LHS, SVal RHS, QualType T)
Definition: ExprEngine.h:621
void VisitCXXNewExpr(const CXXNewExpr *CNE, ExplodedNode *Pred, ExplodedNodeSet &Dst)
ProgramStateRef processRegionChange(ProgramStateRef state, const MemRegion *MR, const LocationContext *LCtx)
Definition: ExprEngine.h:412
void VisitLambdaExpr(const LambdaExpr *LE, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitLambdaExpr - Transfer function logic for LambdaExprs.
void ProcessImplicitDtor(const CFGImplicitDtor D, ExplodedNode *Pred)
void VisitObjCForCollectionStmt(const ObjCForCollectionStmt *S, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitObjCForCollectionStmt - Transfer function logic for ObjCForCollectionStmt.
void VisitUnaryOperator(const UnaryOperator *B, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitUnaryOperator - Transfer function logic for unary operators.
ProgramStateRef getInitialState(const LocationContext *InitLoc)
getInitialState - Return the initial state used for the root vertex in the ExplodedGraph.
Definition: ExprEngine.cpp:243
void VisitLvalObjCIvarRefExpr(const ObjCIvarRefExpr *DR, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Transfer function logic for computing the lvalue of an Objective-C ivar.
static bool hasMoreIteration(ProgramStateRef State, const ObjCForCollectionStmt *O, const LocationContext *LC)
void VisitDeclStmt(const DeclStmt *DS, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitDeclStmt - Transfer function logic for DeclStmts.
void processCallExit(ExplodedNode *Pred)
Generate the sequence of nodes that simulate the call exit and the post visit for CallExpr.
ProgramStateRef handleLValueBitCast(ProgramStateRef state, const Expr *Ex, const LocationContext *LCtx, QualType T, QualType ExTy, const CastExpr *CastE, StmtNodeBuilder &Bldr, ExplodedNode *Pred)
void VisitMSAsmStmt(const MSAsmStmt *A, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitMSAsmStmt - Transfer function logic for MS inline asm.
static std::optional< SVal > getObjectUnderConstruction(ProgramStateRef State, const ConstructionContextItem &Item, const LocationContext *LC)
By looking at a certain item that may be potentially part of an object's ConstructionContext,...
Definition: ExprEngine.cpp:598
CFGElement getCurrentCFGElement()
Return the CFG element corresponding to the worklist element that is currently being processed by Exp...
Definition: ExprEngine.h:707
std::string DumpGraph(bool trim=false, StringRef Filename="")
Dump graph to the specified filename.
bool hasWorkRemaining() const
Definition: ExprEngine.h:444
void printJson(raw_ostream &Out, ProgramStateRef State, const LocationContext *LCtx, const char *NL, unsigned int Space, bool IsDot) const
printJson - Called by ProgramStateManager to print checker-specific data.
Definition: ExprEngine.cpp:934
virtual ~ExprEngine()=default
InliningModes
The modes of inlining, which override the default analysis-wide settings.
Definition: ExprEngine.h:129
@ Inline_Minimal
Do minimal inlining of callees.
Definition: ExprEngine.h:134
@ Inline_Regular
Follow the default settings for inlining callees.
Definition: ExprEngine.h:131
ProgramStateRef processPointerEscapedOnBind(ProgramStateRef State, ArrayRef< std::pair< SVal, SVal > > LocAndVals, const LocationContext *LCtx, PointerEscapeKind Kind, const CallEvent *Call)
Call PointerEscape callback when a value escapes as a result of bind.
SVal computeObjectUnderConstruction(const Expr *E, ProgramStateRef State, const NodeBuilderContext *BldrCtx, const LocationContext *LCtx, const ConstructionContext *CC, EvalCallOptions &CallOpts, unsigned Idx=0)
Find location of the object that is being constructed by a given constructor.
const LocationContext * getRootLocationContext() const
Definition: ExprEngine.h:232
static ProgramStateRef removeIterationState(ProgramStateRef State, const ObjCForCollectionStmt *O, const LocationContext *LC)
const ExplodedGraph & getGraph() const
Definition: ExprEngine.h:270
ProgramStateRef processAssume(ProgramStateRef state, SVal cond, bool assumption)
evalAssume - Callback function invoked by the ConstraintManager when making assumptions about state v...
Definition: ExprEngine.cpp:662
AnalysisDeclContextManager & getAnalysisDeclContextManager()
Definition: ExprEngine.h:208
static std::optional< unsigned > getIndexOfElementToConstruct(ProgramStateRef State, const CXXConstructExpr *E, const LocationContext *LCtx)
Retreives which element is being constructed in a non-POD type array.
Definition: ExprEngine.cpp:508
void VisitBlockExpr(const BlockExpr *BE, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitBlockExpr - Transfer function logic for BlockExprs.
void ProcessBaseDtor(const CFGBaseDtor D, ExplodedNode *Pred, ExplodedNodeSet &Dst)
void GenerateCallExitNode(ExplodedNode *N)
void VisitIncrementDecrementOperator(const UnaryOperator *U, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Handle ++ and – (both pre- and post-increment).
void VisitCallExpr(const CallExpr *CE, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitCall - Transfer function for function calls.
ASTContext & getContext() const
getContext - Return the ASTContext associated with this analysis.
Definition: ExprEngine.h:204
StoreManager & getStoreManager()
Definition: ExprEngine.h:425
void VisitCXXNewAllocatorCall(const CXXNewExpr *CNE, ExplodedNode *Pred, ExplodedNodeSet &Dst)
void handleUOExtension(ExplodedNodeSet::iterator I, const UnaryOperator *U, StmtNodeBuilder &Bldr)
void CreateCXXTemporaryObject(const MaterializeTemporaryExpr *ME, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Create a C++ temporary object for an rvalue.
CFGBlock::ConstCFGElementRef getCFGElementRef() const
Definition: ExprEngine.h:237
void evalCall(ExplodedNodeSet &Dst, ExplodedNode *Pred, const CallEvent &Call)
Evaluate a call, running pre- and post-call checkers and allowing checkers to be responsible for hand...
void VisitGCCAsmStmt(const GCCAsmStmt *A, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitGCCAsmStmt - Transfer function logic for inline asm.
BugReporter & getBugReporter()
Definition: ExprEngine.h:218
void processCFGBlockEntrance(const BlockEdge &L, NodeBuilderWithSinks &nodeBuilder, ExplodedNode *Pred)
Called by CoreEngine when processing the entrance of a CFGBlock.
void VisitInitListExpr(const InitListExpr *E, ExplodedNode *Pred, ExplodedNodeSet &Dst)
bool hasEmptyWorkList() const
Definition: ExprEngine.h:443
void processBranch(const Stmt *Condition, NodeBuilderContext &BuilderCtx, ExplodedNode *Pred, ExplodedNodeSet &Dst, const CFGBlock *DstT, const CFGBlock *DstF)
ProcessBranch - Called by CoreEngine.
ProgramStateRef processRegionChanges(ProgramStateRef state, const InvalidatedSymbols *invalidated, ArrayRef< const MemRegion * > ExplicitRegions, ArrayRef< const MemRegion * > Regions, const LocationContext *LCtx, const CallEvent *Call)
processRegionChanges - Called by ProgramStateManager whenever a change is made to the store.
Definition: ExprEngine.cpp:668
void ProcessStmt(const Stmt *S, ExplodedNode *Pred)
void ViewGraph(bool trim=false)
Visualize the ExplodedGraph created by executing the simulation.
static std::optional< unsigned > getPendingArrayDestruction(ProgramStateRef State, const LocationContext *LCtx)
Retreives which element is being destructed in a non-POD type array.
Definition: ExprEngine.cpp:527
ProgramStateRef notifyCheckersOfPointerEscape(ProgramStateRef State, const InvalidatedSymbols *Invalidated, ArrayRef< const MemRegion * > ExplicitRegions, const CallEvent *Call, RegionAndSymbolInvalidationTraits &ITraits)
Call PointerEscape callback when a value escapes as a result of region invalidation.
ProgramStateRef handleLVectorSplat(ProgramStateRef state, const LocationContext *LCtx, const CastExpr *CastE, StmtNodeBuilder &Bldr, ExplodedNode *Pred)
void processCFGElement(const CFGElement E, ExplodedNode *Pred, unsigned StmtIdx, NodeBuilderContext *Ctx)
processCFGElement - Called by CoreEngine.
Definition: ExprEngine.cpp:961
void processStaticInitializer(const DeclStmt *DS, NodeBuilderContext &BuilderCtx, ExplodedNode *Pred, ExplodedNodeSet &Dst, const CFGBlock *DstT, const CFGBlock *DstF)
Called by CoreEngine.
void VisitUnaryExprOrTypeTraitExpr(const UnaryExprOrTypeTraitExpr *Ex, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitUnaryExprOrTypeTraitExpr - Transfer function for sizeof.
cross_tu::CrossTranslationUnitContext * getCrossTranslationUnitContext()
Definition: ExprEngine.h:221
void ProcessLoopExit(const Stmt *S, ExplodedNode *Pred)
void processSwitch(SwitchNodeBuilder &builder)
ProcessSwitch - Called by CoreEngine.
void processEndWorklist()
Called by CoreEngine when the analysis worklist has terminated.
Definition: ExprEngine.cpp:955
CheckerManager & getCheckerManager() const
Definition: ExprEngine.h:212
SymbolManager & getSymbolManager()
Definition: ExprEngine.h:436
void VisitAtomicExpr(const AtomicExpr *E, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitAtomicExpr - Transfer function for builtin atomic expressions.
bool wasBlocksExhausted() const
Definition: ExprEngine.h:442
MemRegionManager & getRegionManager()
Definition: ExprEngine.h:437
ProgramStateRef bindReturnValue(const CallEvent &Call, const LocationContext *LCtx, ProgramStateRef State)
Create a new state in which the call return value is binded to the call origin expression.
void ProcessMemberDtor(const CFGMemberDtor D, ExplodedNode *Pred, ExplodedNodeSet &Dst)
void VisitCXXThisExpr(const CXXThisExpr *TE, ExplodedNode *Pred, ExplodedNodeSet &Dst)
void VisitCXXDeleteExpr(const CXXDeleteExpr *CDE, ExplodedNode *Pred, ExplodedNodeSet &Dst)
void VisitMemberExpr(const MemberExpr *M, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitMemberExpr - Transfer function for member expressions.
void VisitCXXConstructExpr(const CXXConstructExpr *E, ExplodedNode *Pred, ExplodedNodeSet &Dst)
void VisitCXXInheritedCtorInitExpr(const CXXInheritedCtorInitExpr *E, ExplodedNode *Pred, ExplodedNodeSet &Dst)
ConstraintManager & getConstraintManager()
Definition: ExprEngine.h:427
DataTag::Factory & getDataTags()
Definition: ExprEngine.h:439
void processCleanupTemporaryBranch(const CXXBindTemporaryExpr *BTE, NodeBuilderContext &BldCtx, ExplodedNode *Pred, ExplodedNodeSet &Dst, const CFGBlock *DstT, const CFGBlock *DstF)
Called by CoreEngine.
void ProcessAutomaticObjDtor(const CFGAutomaticObjDtor D, ExplodedNode *Pred, ExplodedNodeSet &Dst)
void evalEagerlyAssumeBinOpBifurcation(ExplodedNodeSet &Dst, ExplodedNodeSet &Src, const Expr *Ex)
evalEagerlyAssumeBinOpBifurcation - Given the nodes in 'Src', eagerly assume symbolic expressions of ...
const Stmt * getStmt() const
void VisitOffsetOfExpr(const OffsetOfExpr *Ex, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitOffsetOfExpr - Transfer function for offsetof.
void evalLoad(ExplodedNodeSet &Dst, const Expr *NodeEx, const Expr *BoundExpr, ExplodedNode *Pred, ProgramStateRef St, SVal location, const ProgramPointTag *tag=nullptr, QualType LoadTy=QualType())
Simulate a read of the result of Ex.
void removeDeadOnEndOfFunction(NodeBuilderContext &BC, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Remove dead bindings/symbols before exiting a function.
static std::pair< const ProgramPointTag *, const ProgramPointTag * > geteagerlyAssumeBinOpBifurcationTags()
void Visit(const Stmt *S, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Visit - Transfer function logic for all statements.
void defaultEvalCall(NodeBuilder &B, ExplodedNode *Pred, const CallEvent &Call, const EvalCallOptions &CallOpts={})
Default implementation of call evaluation.
AnalysisManager & getAnalysisManager()
Definition: ExprEngine.h:206
ExplodedGraph & getGraph()
Definition: ExprEngine.h:269
void ProcessDeleteDtor(const CFGDeleteDtor D, ExplodedNode *Pred, ExplodedNodeSet &Dst)
void VisitCXXCatchStmt(const CXXCatchStmt *CS, ExplodedNode *Pred, ExplodedNodeSet &Dst)
void VisitCompoundLiteralExpr(const CompoundLiteralExpr *CL, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitCompoundLiteralExpr - Transfer function logic for compound literals.
SValBuilder & getSValBuilder()
Definition: ExprEngine.h:216
void VisitArrayInitLoopExpr(const ArrayInitLoopExpr *Ex, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitArrayInitLoopExpr - Transfer function for array init loop.
ProgramStateRef updateObjectsUnderConstruction(SVal V, const Expr *E, ProgramStateRef State, const LocationContext *LCtx, const ConstructionContext *CC, const EvalCallOptions &CallOpts)
Update the program state with all the path-sensitive information that's necessary to perform construc...
bool ExecuteWorkList(const LocationContext *L, unsigned Steps=150000)
Returns true if there is still simulation state on the worklist.
Definition: ExprEngine.h:189
void evalStore(ExplodedNodeSet &Dst, const Expr *AssignE, const Expr *StoreE, ExplodedNode *Pred, ProgramStateRef St, SVal TargetLV, SVal Val, const ProgramPointTag *tag=nullptr)
evalStore - Handle the semantics of a store via an assignment.
void VisitCXXBindTemporaryExpr(const CXXBindTemporaryExpr *BTE, ExplodedNodeSet &PreVisit, ExplodedNodeSet &Dst)
void processIndirectGoto(IndirectGotoNodeBuilder &builder)
processIndirectGoto - Called by CoreEngine.
const NodeBuilderContext & getBuilderContext()
Definition: ExprEngine.h:225
static ProgramStateRef setWhetherHasMoreIteration(ProgramStateRef State, const ObjCForCollectionStmt *O, const LocationContext *LC, bool HasMoreIteraton)
Note whether this loop has any more iteratios to model.
static std::optional< unsigned > getPendingInitLoop(ProgramStateRef State, const CXXConstructExpr *E, const LocationContext *LCtx)
Retreives the size of the array in the pending ArrayInitLoopExpr.
Definition: ExprEngine.cpp:481
void ProcessNewAllocator(const CXXNewExpr *NE, ExplodedNode *Pred)
MemRegion - The root abstract class for all memory regions.
Definition: MemRegion.h:95
This node builder keeps track of the generated sink nodes.
Definition: CoreEngine.h:354
This is the simplest builder which generates nodes in the ExplodedGraph.
Definition: CoreEngine.h:247
GRBugReporter is used for generating path-sensitive reports.
Definition: BugReporter.h:664
BasicValueFactory & getBasicVals()
Definition: ProgramState.h:549
ConstraintManager & getConstraintManager()
Definition: ProgramState.h:580
Information about invalidation for a particular region/symbol.
Definition: MemRegion.h:1570
SVal evalBinOp(ProgramStateRef state, BinaryOperator::Opcode op, SVal lhs, SVal rhs, QualType type)
SVal - This represents a symbolic expression, which can be either an L-value or an R-value.
Definition: SVals.h:72
This builder class is useful for generating nodes that resulted from visiting a statement.
Definition: CoreEngine.h:391
virtual bool hasWork() const =0
@ Decl
The l-value was an access to a declared entity or something equivalently strong, like the address of ...
PointerEscapeKind
Describes the different reasons a pointer escapes during analysis.
IntrusiveRefCntPtr< const ProgramState > ProgramStateRef
BinaryOperatorKind
@ Result
The result type of a method or function.
Hints for figuring out of a call should be inlined during evalCall().
Definition: ExprEngine.h:97
bool IsTemporaryLifetimeExtendedViaAggregate
This call is a constructor for a temporary that is lifetime-extended by binding it to a reference-typ...
Definition: ExprEngine.h:112
bool IsTemporaryCtorOrDtor
This call is a constructor or a destructor of a temporary value.
Definition: ExprEngine.h:107
bool IsArrayCtorOrDtor
This call is a constructor or a destructor for a single element within an array, a part of array cons...
Definition: ExprEngine.h:104
bool IsElidableCtorThatHasNotBeenElided
This call is a pre-C++17 elidable constructor that we failed to elide because we failed to compute th...
Definition: ExprEngine.h:119
bool IsCtorOrDtorWithImproperlyModeledTargetRegion
This call is a constructor or a destructor for which we do not currently compute the this-region corr...
Definition: ExprEngine.h:100
const CFGBlock * getBlock() const
Return the CFGBlock associated with this builder.
Definition: CoreEngine.h:227
Traits for storing the call processing policy inside GDM.
Definition: ExprEngine.h:1037