clang  16.0.0git
ExprEngine.h
Go to the documentation of this file.
1 //===- ExprEngine.h - Path-Sensitive Expression-Level Dataflow --*- C++ -*-===//
2 //
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6 //
7 //===----------------------------------------------------------------------===//
8 //
9 // This file defines a meta-engine for path-sensitive dataflow analysis that
10 // is built on CoreEngine, but provides the boilerplate to execute transfer
11 // functions and build the ExplodedGraph at the expression level.
12 //
13 //===----------------------------------------------------------------------===//
14 
15 #ifndef LLVM_CLANG_STATICANALYZER_CORE_PATHSENSITIVE_EXPRENGINE_H
16 #define LLVM_CLANG_STATICANALYZER_CORE_PATHSENSITIVE_EXPRENGINE_H
17 
18 #include "clang/AST/Expr.h"
19 #include "clang/AST/Type.h"
20 #include "clang/Analysis/CFG.h"
23 #include "clang/Basic/LLVM.h"
37 #include "llvm/ADT/ArrayRef.h"
38 #include <cassert>
39 #include <utility>
40 
41 namespace clang {
42 
43 class AnalysisDeclContextManager;
44 class AnalyzerOptions;
45 class ASTContext;
46 class CFGBlock;
47 class CFGElement;
48 class ConstructionContext;
49 class CXXBindTemporaryExpr;
50 class CXXCatchStmt;
51 class CXXConstructExpr;
52 class CXXDeleteExpr;
53 class CXXNewExpr;
54 class CXXThisExpr;
55 class Decl;
56 class DeclStmt;
57 class GCCAsmStmt;
58 class LambdaExpr;
59 class LocationContext;
60 class MaterializeTemporaryExpr;
61 class MSAsmStmt;
62 class NamedDecl;
63 class ObjCAtSynchronizedStmt;
64 class ObjCForCollectionStmt;
65 class ObjCIvarRefExpr;
66 class ObjCMessageExpr;
67 class ReturnStmt;
68 class Stmt;
69 
70 namespace cross_tu {
71 
72 class CrossTranslationUnitContext;
73 
74 } // namespace cross_tu
75 
76 namespace ento {
77 
78 class AnalysisManager;
79 class BasicValueFactory;
80 class CallEvent;
81 class CheckerManager;
82 class ConstraintManager;
83 class ExplodedNodeSet;
84 class ExplodedNode;
85 class IndirectGotoNodeBuilder;
86 class MemRegion;
87 struct NodeBuilderContext;
88 class NodeBuilderWithSinks;
89 class ProgramState;
90 class ProgramStateManager;
91 class RegionAndSymbolInvalidationTraits;
92 class SymbolManager;
93 class SwitchNodeBuilder;
94 
95 /// Hints for figuring out of a call should be inlined during evalCall().
97  /// This call is a constructor or a destructor for which we do not currently
98  /// compute the this-region correctly.
100 
101  /// This call is a constructor or a destructor for a single element within
102  /// an array, a part of array construction or destruction.
103  bool IsArrayCtorOrDtor = false;
104 
105  /// This call is a constructor or a destructor of a temporary value.
106  bool IsTemporaryCtorOrDtor = false;
107 
108  /// This call is a constructor for a temporary that is lifetime-extended
109  /// by binding it to a reference-type field within an aggregate,
110  /// for example 'A { const C &c; }; A a = { C() };'
112 
113  /// This call is a pre-C++17 elidable constructor that we failed to elide
114  /// because we failed to compute the target region into which
115  /// this constructor would have been ultimately elided. Analysis that
116  /// we perform in this case is still correct but it behaves differently,
117  /// as if copy elision is disabled.
119 
121 };
122 
123 class ExprEngine {
124  void anchor();
125 
126 public:
127  /// The modes of inlining, which override the default analysis-wide settings.
129  /// Follow the default settings for inlining callees.
131 
132  /// Do minimal inlining of callees.
134  };
135 
136 private:
138  bool IsCTUEnabled;
139 
140  AnalysisManager &AMgr;
141 
142  AnalysisDeclContextManager &AnalysisDeclContexts;
143 
144  CoreEngine Engine;
145 
146  /// G - the simulation graph.
147  ExplodedGraph &G;
148 
149  /// StateMgr - Object that manages the data for all created states.
150  ProgramStateManager StateMgr;
151 
152  /// SymMgr - Object that manages the symbol information.
153  SymbolManager &SymMgr;
154 
155  /// MRMgr - MemRegionManager object that creates memory regions.
156  MemRegionManager &MRMgr;
157 
158  /// svalBuilder - SValBuilder object that creates SVals from expressions.
159  SValBuilder &svalBuilder;
160 
161  unsigned int currStmtIdx = 0;
162  const NodeBuilderContext *currBldrCtx = nullptr;
163 
164  /// Helper object to determine if an Objective-C message expression
165  /// implicitly never returns.
166  ObjCNoReturn ObjCNoRet;
167 
168  /// The BugReporter associated with this engine. It is important that
169  /// this object be placed at the very end of member variables so that its
170  /// destructor is called before the rest of the ExprEngine is destroyed.
172 
173  /// The functions which have been analyzed through inlining. This is owned by
174  /// AnalysisConsumer. It can be null.
175  SetOfConstDecls *VisitedCallees;
176 
177  /// The flag, which specifies the mode of inlining for the engine.
178  InliningModes HowToInline;
179 
180 public:
182  SetOfConstDecls *VisitedCalleesIn,
183  FunctionSummariesTy *FS, InliningModes HowToInlineIn);
184 
185  virtual ~ExprEngine() = default;
186 
187  /// Returns true if there is still simulation state on the worklist.
188  bool ExecuteWorkList(const LocationContext *L, unsigned Steps = 150000) {
189  return Engine.ExecuteWorkList(L, Steps, nullptr);
190  }
191 
192  /// Execute the work list with an initial state. Nodes that reaches the exit
193  /// of the function are added into the Dst set, which represent the exit
194  /// state of the function call. Returns true if there is still simulation
195  /// state on the worklist.
196  bool ExecuteWorkListWithInitialState(const LocationContext *L, unsigned Steps,
197  ProgramStateRef InitState,
198  ExplodedNodeSet &Dst) {
199  return Engine.ExecuteWorkListWithInitialState(L, Steps, InitState, Dst);
200  }
201 
202  /// getContext - Return the ASTContext associated with this analysis.
203  ASTContext &getContext() const { return AMgr.getASTContext(); }
204 
206 
208  return AMgr.getAnalysisDeclContextManager();
209  }
210 
212  return *AMgr.getCheckerManager();
213  }
214 
215  SValBuilder &getSValBuilder() { return svalBuilder; }
216 
217  BugReporter &getBugReporter() { return BR; }
218 
221  return &CTU;
222  }
223 
225  assert(currBldrCtx);
226  return *currBldrCtx;
227  }
228 
229  const Stmt *getStmt() const;
230 
232  assert(G.roots_begin() != G.roots_end());
233  return (*G.roots_begin())->getLocation().getLocationContext();
234  }
235 
239 
240 
241  /// Dump graph to the specified filename.
242  /// If filename is empty, generate a temporary one.
243  /// \return The filename the graph is written into.
244  std::string DumpGraph(bool trim = false, StringRef Filename="");
245 
246  /// Dump the graph consisting of the given nodes to a specified filename.
247  /// Generate a temporary filename if it's not provided.
248  /// \return The filename the graph is written into.
250  StringRef Filename = "");
251 
252  /// Visualize the ExplodedGraph created by executing the simulation.
253  void ViewGraph(bool trim = false);
254 
255  /// Visualize a trimmed ExplodedGraph that only contains paths to the given
256  /// nodes.
258 
259  /// getInitialState - Return the initial state used for the root vertex
260  /// in the ExplodedGraph.
262 
263  ExplodedGraph &getGraph() { return G; }
264  const ExplodedGraph &getGraph() const { return G; }
265 
266  /// Run the analyzer's garbage collection - remove dead symbols and
267  /// bindings from the state.
268  ///
269  /// Checkers can participate in this process with two callbacks:
270  /// \c checkLiveSymbols and \c checkDeadSymbols. See the CheckerDocumentation
271  /// class for more information.
272  ///
273  /// \param Node The predecessor node, from which the processing should start.
274  /// \param Out The returned set of output nodes.
275  /// \param ReferenceStmt The statement which is about to be processed.
276  /// Everything needed for this statement should be considered live.
277  /// A null statement means that everything in child LocationContexts
278  /// is dead.
279  /// \param LC The location context of the \p ReferenceStmt. A null location
280  /// context means that we have reached the end of analysis and that
281  /// all statements and local variables should be considered dead.
282  /// \param DiagnosticStmt Used as a location for any warnings that should
283  /// occur while removing the dead (e.g. leaks). By default, the
284  /// \p ReferenceStmt is used.
285  /// \param K Denotes whether this is a pre- or post-statement purge. This
286  /// must only be ProgramPoint::PostStmtPurgeDeadSymbolsKind if an
287  /// entire location context is being cleared, in which case the
288  /// \p ReferenceStmt must either be a ReturnStmt or \c NULL. Otherwise,
289  /// it must be ProgramPoint::PreStmtPurgeDeadSymbolsKind (the default)
290  /// and \p ReferenceStmt must be valid (non-null).
292  const Stmt *ReferenceStmt, const LocationContext *LC,
293  const Stmt *DiagnosticStmt = nullptr,
295 
296  /// processCFGElement - Called by CoreEngine. Used to generate new successor
297  /// nodes by processing the 'effects' of a CFG element.
298  void processCFGElement(const CFGElement E, ExplodedNode *Pred,
299  unsigned StmtIdx, NodeBuilderContext *Ctx);
300 
301  void ProcessStmt(const Stmt *S, ExplodedNode *Pred);
302 
303  void ProcessLoopExit(const Stmt* S, ExplodedNode *Pred);
304 
305  void ProcessInitializer(const CFGInitializer I, ExplodedNode *Pred);
306 
307  void ProcessImplicitDtor(const CFGImplicitDtor D, ExplodedNode *Pred);
308 
309  void ProcessNewAllocator(const CXXNewExpr *NE, ExplodedNode *Pred);
310 
312  ExplodedNode *Pred, ExplodedNodeSet &Dst);
313  void ProcessDeleteDtor(const CFGDeleteDtor D,
314  ExplodedNode *Pred, ExplodedNodeSet &Dst);
315  void ProcessBaseDtor(const CFGBaseDtor D,
316  ExplodedNode *Pred, ExplodedNodeSet &Dst);
317  void ProcessMemberDtor(const CFGMemberDtor D,
318  ExplodedNode *Pred, ExplodedNodeSet &Dst);
320  ExplodedNode *Pred, ExplodedNodeSet &Dst);
321 
322  /// Called by CoreEngine when processing the entrance of a CFGBlock.
323  void processCFGBlockEntrance(const BlockEdge &L,
324  NodeBuilderWithSinks &nodeBuilder,
325  ExplodedNode *Pred);
326 
327  /// ProcessBranch - Called by CoreEngine. Used to generate successor
328  /// nodes by processing the 'effects' of a branch condition.
329  void processBranch(const Stmt *Condition,
330  NodeBuilderContext& BuilderCtx,
331  ExplodedNode *Pred,
332  ExplodedNodeSet &Dst,
333  const CFGBlock *DstT,
334  const CFGBlock *DstF);
335 
336  /// Called by CoreEngine.
337  /// Used to generate successor nodes for temporary destructors depending
338  /// on whether the corresponding constructor was visited.
340  NodeBuilderContext &BldCtx,
341  ExplodedNode *Pred, ExplodedNodeSet &Dst,
342  const CFGBlock *DstT,
343  const CFGBlock *DstF);
344 
345  /// Called by CoreEngine. Used to processing branching behavior
346  /// at static initializers.
347  void processStaticInitializer(const DeclStmt *DS,
348  NodeBuilderContext& BuilderCtx,
349  ExplodedNode *Pred,
350  ExplodedNodeSet &Dst,
351  const CFGBlock *DstT,
352  const CFGBlock *DstF);
353 
354  /// processIndirectGoto - Called by CoreEngine. Used to generate successor
355  /// nodes by processing the 'effects' of a computed goto jump.
357 
358  /// ProcessSwitch - Called by CoreEngine. Used to generate successor
359  /// nodes by processing the 'effects' of a switch statement.
360  void processSwitch(SwitchNodeBuilder& builder);
361 
362  /// Called by CoreEngine. Used to notify checkers that processing a
363  /// function has begun. Called for both inlined and top-level functions.
365  ExplodedNode *Pred, ExplodedNodeSet &Dst,
366  const BlockEdge &L);
367 
368  /// Called by CoreEngine. Used to notify checkers that processing a
369  /// function has ended. Called for both inlined and top-level functions.
371  ExplodedNode *Pred,
372  const ReturnStmt *RS = nullptr);
373 
374  /// Remove dead bindings/symbols before exiting a function.
376  ExplodedNode *Pred,
377  ExplodedNodeSet &Dst);
378 
379  /// Generate the entry node of the callee.
381  ExplodedNode *Pred);
382 
383  /// Generate the sequence of nodes that simulate the call exit and the post
384  /// visit for CallExpr.
385  void processCallExit(ExplodedNode *Pred);
386 
387  /// Called by CoreEngine when the analysis worklist has terminated.
388  void processEndWorklist();
389 
390  /// evalAssume - Callback function invoked by the ConstraintManager when
391  /// making assumptions about state values.
393  bool assumption);
394 
395  /// processRegionChanges - Called by ProgramStateManager whenever a change is made
396  /// to the store. Used to update checkers that track region values.
399  const InvalidatedSymbols *invalidated,
400  ArrayRef<const MemRegion *> ExplicitRegions,
402  const LocationContext *LCtx,
403  const CallEvent *Call);
404 
405  inline ProgramStateRef
407  const MemRegion* MR,
408  const LocationContext *LCtx) {
409  return processRegionChanges(state, nullptr, MR, MR, LCtx, nullptr);
410  }
411 
412  /// printJson - Called by ProgramStateManager to print checker-specific data.
413  void printJson(raw_ostream &Out, ProgramStateRef State,
414  const LocationContext *LCtx, const char *NL,
415  unsigned int Space, bool IsDot) const;
416 
417  ProgramStateManager &getStateManager() { return StateMgr; }
418 
419  StoreManager &getStoreManager() { return StateMgr.getStoreManager(); }
420 
422  return StateMgr.getConstraintManager();
423  }
424 
425  // FIXME: Remove when we migrate over to just using SValBuilder.
427  return StateMgr.getBasicVals();
428  }
429 
430  SymbolManager &getSymbolManager() { return SymMgr; }
431  MemRegionManager &getRegionManager() { return MRMgr; }
432 
433  DataTag::Factory &getDataTags() { return Engine.getDataTags(); }
434 
435  // Functions for external checking of whether we have unfinished work
436  bool wasBlocksExhausted() const { return Engine.wasBlocksExhausted(); }
437  bool hasEmptyWorkList() const { return !Engine.getWorkList()->hasWork(); }
438  bool hasWorkRemaining() const { return Engine.hasWorkRemaining(); }
439 
440  const CoreEngine &getCoreEngine() const { return Engine; }
441 
442 public:
443  /// Visit - Transfer function logic for all statements. Dispatches to
444  /// other functions that handle specific kinds of statements.
445  void Visit(const Stmt *S, ExplodedNode *Pred, ExplodedNodeSet &Dst);
446 
447  /// VisitArrayInitLoopExpr - Transfer function for array init loop.
449  ExplodedNodeSet &Dst);
450 
451  /// VisitArraySubscriptExpr - Transfer function for array accesses.
453  ExplodedNode *Pred,
454  ExplodedNodeSet &Dst);
455 
456  /// VisitGCCAsmStmt - Transfer function logic for inline asm.
457  void VisitGCCAsmStmt(const GCCAsmStmt *A, ExplodedNode *Pred,
458  ExplodedNodeSet &Dst);
459 
460  /// VisitMSAsmStmt - Transfer function logic for MS inline asm.
461  void VisitMSAsmStmt(const MSAsmStmt *A, ExplodedNode *Pred,
462  ExplodedNodeSet &Dst);
463 
464  /// VisitBlockExpr - Transfer function logic for BlockExprs.
465  void VisitBlockExpr(const BlockExpr *BE, ExplodedNode *Pred,
466  ExplodedNodeSet &Dst);
467 
468  /// VisitLambdaExpr - Transfer function logic for LambdaExprs.
469  void VisitLambdaExpr(const LambdaExpr *LE, ExplodedNode *Pred,
470  ExplodedNodeSet &Dst);
471 
472  /// VisitBinaryOperator - Transfer function logic for binary operators.
473  void VisitBinaryOperator(const BinaryOperator* B, ExplodedNode *Pred,
474  ExplodedNodeSet &Dst);
475 
476 
477  /// VisitCall - Transfer function for function calls.
478  void VisitCallExpr(const CallExpr *CE, ExplodedNode *Pred,
479  ExplodedNodeSet &Dst);
480 
481  /// VisitCast - Transfer function logic for all casts (implicit and explicit).
482  void VisitCast(const CastExpr *CastE, const Expr *Ex, ExplodedNode *Pred,
483  ExplodedNodeSet &Dst);
484 
485  /// VisitCompoundLiteralExpr - Transfer function logic for compound literals.
487  ExplodedNode *Pred, ExplodedNodeSet &Dst);
488 
489  /// Transfer function logic for DeclRefExprs and BlockDeclRefExprs.
490  void VisitCommonDeclRefExpr(const Expr *DR, const NamedDecl *D,
491  ExplodedNode *Pred, ExplodedNodeSet &Dst);
492 
493  /// VisitDeclStmt - Transfer function logic for DeclStmts.
494  void VisitDeclStmt(const DeclStmt *DS, ExplodedNode *Pred,
495  ExplodedNodeSet &Dst);
496 
497  /// VisitGuardedExpr - Transfer function logic for ?, __builtin_choose
498  void VisitGuardedExpr(const Expr *Ex, const Expr *L, const Expr *R,
499  ExplodedNode *Pred, ExplodedNodeSet &Dst);
500 
501  void VisitInitListExpr(const InitListExpr *E, ExplodedNode *Pred,
502  ExplodedNodeSet &Dst);
503 
504  /// VisitLogicalExpr - Transfer function logic for '&&', '||'
505  void VisitLogicalExpr(const BinaryOperator* B, ExplodedNode *Pred,
506  ExplodedNodeSet &Dst);
507 
508  /// VisitMemberExpr - Transfer function for member expressions.
509  void VisitMemberExpr(const MemberExpr *M, ExplodedNode *Pred,
510  ExplodedNodeSet &Dst);
511 
512  /// VisitAtomicExpr - Transfer function for builtin atomic expressions
513  void VisitAtomicExpr(const AtomicExpr *E, ExplodedNode *Pred,
514  ExplodedNodeSet &Dst);
515 
516  /// Transfer function logic for ObjCAtSynchronizedStmts.
518  ExplodedNode *Pred, ExplodedNodeSet &Dst);
519 
520  /// Transfer function logic for computing the lvalue of an Objective-C ivar.
522  ExplodedNodeSet &Dst);
523 
524  /// VisitObjCForCollectionStmt - Transfer function logic for
525  /// ObjCForCollectionStmt.
527  ExplodedNode *Pred, ExplodedNodeSet &Dst);
528 
529  void VisitObjCMessage(const ObjCMessageExpr *ME, ExplodedNode *Pred,
530  ExplodedNodeSet &Dst);
531 
532  /// VisitReturnStmt - Transfer function logic for return statements.
533  void VisitReturnStmt(const ReturnStmt *R, ExplodedNode *Pred,
534  ExplodedNodeSet &Dst);
535 
536  /// VisitOffsetOfExpr - Transfer function for offsetof.
537  void VisitOffsetOfExpr(const OffsetOfExpr *Ex, ExplodedNode *Pred,
538  ExplodedNodeSet &Dst);
539 
540  /// VisitUnaryExprOrTypeTraitExpr - Transfer function for sizeof.
542  ExplodedNode *Pred, ExplodedNodeSet &Dst);
543 
544  /// VisitUnaryOperator - Transfer function logic for unary operators.
545  void VisitUnaryOperator(const UnaryOperator* B, ExplodedNode *Pred,
546  ExplodedNodeSet &Dst);
547 
548  /// Handle ++ and -- (both pre- and post-increment).
550  ExplodedNode *Pred,
551  ExplodedNodeSet &Dst);
552 
554  ExplodedNodeSet &PreVisit,
555  ExplodedNodeSet &Dst);
556 
557  void VisitCXXCatchStmt(const CXXCatchStmt *CS, ExplodedNode *Pred,
558  ExplodedNodeSet &Dst);
559 
560  void VisitCXXThisExpr(const CXXThisExpr *TE, ExplodedNode *Pred,
561  ExplodedNodeSet & Dst);
562 
564  ExplodedNodeSet &Dst);
565 
567  ExplodedNode *Pred, ExplodedNodeSet &Dst);
568 
569  void VisitCXXDestructor(QualType ObjectType, const MemRegion *Dest,
570  const Stmt *S, bool IsBaseDtor,
571  ExplodedNode *Pred, ExplodedNodeSet &Dst,
572  EvalCallOptions &Options);
573 
574  void VisitCXXNewAllocatorCall(const CXXNewExpr *CNE,
575  ExplodedNode *Pred,
576  ExplodedNodeSet &Dst);
577 
578  void VisitCXXNewExpr(const CXXNewExpr *CNE, ExplodedNode *Pred,
579  ExplodedNodeSet &Dst);
580 
581  void VisitCXXDeleteExpr(const CXXDeleteExpr *CDE, ExplodedNode *Pred,
582  ExplodedNodeSet &Dst);
583 
584  /// Create a C++ temporary object for an rvalue.
586  ExplodedNode *Pred,
587  ExplodedNodeSet &Dst);
588 
589  /// evalEagerlyAssumeBinOpBifurcation - Given the nodes in 'Src', eagerly assume symbolic
590  /// expressions of the form 'x != 0' and generate new nodes (stored in Dst)
591  /// with those assumptions.
593  const Expr *Ex);
594 
595  static std::pair<const ProgramPointTag *, const ProgramPointTag *>
597 
599  const LocationContext *LCtx, QualType T,
600  QualType ExTy, const CastExpr *CastE,
601  StmtNodeBuilder &Bldr,
602  ExplodedNode *Pred);
603 
605  const LocationContext *LCtx,
606  const CastExpr *CastE,
607  StmtNodeBuilder &Bldr,
608  ExplodedNode *Pred);
609 
611  const UnaryOperator* U,
612  StmtNodeBuilder &Bldr);
613 
614 public:
616  SVal LHS, SVal RHS, QualType T) {
617  return svalBuilder.evalBinOp(ST, Op, LHS, RHS, T);
618  }
619 
620  /// Retreives which element is being constructed in a non-POD type array.
621  static Optional<unsigned>
623  const LocationContext *LCtx);
624 
625  /// Retreives which element is being destructed in a non-POD type array.
626  static Optional<unsigned>
628  const LocationContext *LCtx);
629 
630  /// Retreives the size of the array in the pending ArrayInitLoopExpr.
632  const CXXConstructExpr *E,
633  const LocationContext *LCtx);
634 
635  /// By looking at a certain item that may be potentially part of an object's
636  /// ConstructionContext, retrieve such object's location. A particular
637  /// statement can be transparently passed as \p Item in most cases.
638  static Optional<SVal>
640  const ConstructionContextItem &Item,
641  const LocationContext *LC);
642 
643  /// Call PointerEscape callback when a value escapes as a result of bind.
645  ProgramStateRef State, ArrayRef<std::pair<SVal, SVal>> LocAndVals,
647  const CallEvent *Call);
648 
649  /// Call PointerEscape callback when a value escapes as a result of
650  /// region invalidation.
651  /// \param[in] ITraits Specifies invalidation traits for regions/symbols.
654  const InvalidatedSymbols *Invalidated,
655  ArrayRef<const MemRegion *> ExplicitRegions,
656  const CallEvent *Call,
658 
659 private:
660  /// evalBind - Handle the semantics of binding a value to a specific location.
661  /// This method is used by evalStore, VisitDeclStmt, and others.
662  void evalBind(ExplodedNodeSet &Dst, const Stmt *StoreE, ExplodedNode *Pred,
663  SVal location, SVal Val, bool atDeclInit = false,
664  const ProgramPoint *PP = nullptr);
665 
668  SVal Loc, SVal Val,
669  const LocationContext *LCtx);
670 
671  /// A simple wrapper when you only need to notify checkers of pointer-escape
672  /// of some values.
675  const CallEvent *Call = nullptr) const;
676 
677 public:
678  // FIXME: 'tag' should be removed, and a LocationContext should be used
679  // instead.
680  // FIXME: Comment on the meaning of the arguments, when 'St' may not
681  // be the same as Pred->state, and when 'location' may not be the
682  // same as state->getLValue(Ex).
683  /// Simulate a read of the result of Ex.
684  void evalLoad(ExplodedNodeSet &Dst,
685  const Expr *NodeEx, /* Eventually will be a CFGStmt */
686  const Expr *BoundExpr,
687  ExplodedNode *Pred,
688  ProgramStateRef St,
689  SVal location,
690  const ProgramPointTag *tag = nullptr,
691  QualType LoadTy = QualType());
692 
693  // FIXME: 'tag' should be removed, and a LocationContext should be used
694  // instead.
695  void evalStore(ExplodedNodeSet &Dst, const Expr *AssignE, const Expr *StoreE,
696  ExplodedNode *Pred, ProgramStateRef St, SVal TargetLV, SVal Val,
697  const ProgramPointTag *tag = nullptr);
698 
699  /// Return the CFG element corresponding to the worklist element
700  /// that is currently being processed by ExprEngine.
702  return (*currBldrCtx->getBlock())[currStmtIdx];
703  }
704 
705  /// Create a new state in which the call return value is binded to the
706  /// call origin expression.
708  const LocationContext *LCtx,
710 
711  /// Evaluate a call, running pre- and post-call checkers and allowing checkers
712  /// to be responsible for handling the evaluation of the call itself.
713  void evalCall(ExplodedNodeSet &Dst, ExplodedNode *Pred,
714  const CallEvent &Call);
715 
716  /// Default implementation of call evaluation.
718  const CallEvent &Call,
719  const EvalCallOptions &CallOpts = {});
720 
721  /// Find location of the object that is being constructed by a given
722  /// constructor. This should ideally always succeed but due to not being
723  /// fully implemented it sometimes indicates that it failed via its
724  /// out-parameter CallOpts; in such cases a fake temporary region is
725  /// returned, which is better than nothing but does not represent
726  /// the actual behavior of the program. The Idx parameter is used if we
727  /// construct an array of objects. In that case it points to the index
728  /// of the continuous memory region.
729  /// E.g.:
730  /// For `int arr[4]` this index can be 0,1,2,3.
731  /// For `int arr2[3][3]` this index can be 0,1,...,7,8.
732  /// A multi-dimensional array is also a continuous memory location in a
733  /// row major order, so for arr[0][0] Idx is 0 and for arr[2][2] Idx is 8.
735  const NodeBuilderContext *BldrCtx,
736  const LocationContext *LCtx,
737  const ConstructionContext *CC,
738  EvalCallOptions &CallOpts,
739  unsigned Idx = 0);
740 
741  /// Update the program state with all the path-sensitive information
742  /// that's necessary to perform construction of an object with a given
743  /// syntactic construction context. V and CallOpts have to be obtained from
744  /// computeObjectUnderConstruction() invoked with the same set of
745  /// the remaining arguments (E, State, LCtx, CC).
747  SVal V, const Expr *E, ProgramStateRef State, const LocationContext *LCtx,
748  const ConstructionContext *CC, const EvalCallOptions &CallOpts);
749 
750  /// A convenient wrapper around computeObjectUnderConstruction
751  /// and updateObjectsUnderConstruction.
752  std::pair<ProgramStateRef, SVal> handleConstructionContext(
753  const Expr *E, ProgramStateRef State, const NodeBuilderContext *BldrCtx,
754  const LocationContext *LCtx, const ConstructionContext *CC,
755  EvalCallOptions &CallOpts, unsigned Idx = 0) {
756 
757  SVal V = computeObjectUnderConstruction(E, State, BldrCtx, LCtx, CC,
758  CallOpts, Idx);
759  State = updateObjectsUnderConstruction(V, E, State, LCtx, CC, CallOpts);
760 
761  return std::make_pair(State, V);
762  }
763 
764 private:
765  ProgramStateRef finishArgumentConstruction(ProgramStateRef State,
766  const CallEvent &Call);
767  void finishArgumentConstruction(ExplodedNodeSet &Dst, ExplodedNode *Pred,
768  const CallEvent &Call);
769 
770  void evalLoadCommon(ExplodedNodeSet &Dst,
771  const Expr *NodeEx, /* Eventually will be a CFGStmt */
772  const Expr *BoundEx,
773  ExplodedNode *Pred,
774  ProgramStateRef St,
775  SVal location,
776  const ProgramPointTag *tag,
777  QualType LoadTy);
778 
779  void evalLocation(ExplodedNodeSet &Dst,
780  const Stmt *NodeEx, /* This will eventually be a CFGStmt */
781  const Stmt *BoundEx,
782  ExplodedNode *Pred,
783  ProgramStateRef St,
784  SVal location,
785  bool isLoad);
786 
787  /// Count the stack depth and determine if the call is recursive.
788  void examineStackFrames(const Decl *D, const LocationContext *LCtx,
789  bool &IsRecursive, unsigned &StackDepth);
790 
791  enum CallInlinePolicy {
792  CIP_Allowed,
793  CIP_DisallowedOnce,
794  CIP_DisallowedAlways
795  };
796 
797  /// See if a particular call should be inlined, by only looking
798  /// at the call event and the current state of analysis.
799  CallInlinePolicy mayInlineCallKind(const CallEvent &Call,
800  const ExplodedNode *Pred,
801  AnalyzerOptions &Opts,
802  const EvalCallOptions &CallOpts);
803 
804  /// See if the given AnalysisDeclContext is built for a function that we
805  /// should always inline simply because it's small enough.
806  /// Apart from "small" functions, we also have "large" functions
807  /// (cf. isLarge()), some of which are huge (cf. isHuge()), and we classify
808  /// the remaining functions as "medium".
809  bool isSmall(AnalysisDeclContext *ADC) const;
810 
811  /// See if the given AnalysisDeclContext is built for a function that we
812  /// should inline carefully because it looks pretty large.
813  bool isLarge(AnalysisDeclContext *ADC) const;
814 
815  /// See if the given AnalysisDeclContext is built for a function that we
816  /// should never inline because it's legit gigantic.
817  bool isHuge(AnalysisDeclContext *ADC) const;
818 
819  /// See if the given AnalysisDeclContext is built for a function that we
820  /// should inline, just by looking at the declaration of the function.
821  bool mayInlineDecl(AnalysisDeclContext *ADC) const;
822 
823  /// Checks our policies and decides weither the given call should be inlined.
824  bool shouldInlineCall(const CallEvent &Call, const Decl *D,
825  const ExplodedNode *Pred,
826  const EvalCallOptions &CallOpts = {});
827 
828  /// Checks whether our policies allow us to inline a non-POD type array
829  /// construction.
830  bool shouldInlineArrayConstruction(const ProgramStateRef State,
831  const CXXConstructExpr *CE,
832  const LocationContext *LCtx);
833 
834  /// Checks whether our policies allow us to inline a non-POD type array
835  /// destruction.
836  /// \param Size The size of the array.
837  bool shouldInlineArrayDestruction(uint64_t Size);
838 
839  /// Prepares the program state for array destruction. If no error happens
840  /// the function binds a 'PendingArrayDestruction' entry to the state, which
841  /// it returns along with the index. If any error happens (we fail to read
842  /// the size, the index would be -1, etc.) the function will return the
843  /// original state along with an index of 0. The actual element count of the
844  /// array can be accessed by the optional 'ElementCountVal' parameter. \param
845  /// State The program state. \param Region The memory region where the array
846  /// is stored. \param ElementTy The type an element in the array. \param LCty
847  /// The location context. \param ElementCountVal A pointer to an optional
848  /// SVal. If specified, the size of the array will be returned in it. It can
849  /// be Unknown.
850  std::pair<ProgramStateRef, uint64_t> prepareStateForArrayDestruction(
851  const ProgramStateRef State, const MemRegion *Region,
852  const QualType &ElementTy, const LocationContext *LCtx,
853  SVal *ElementCountVal = nullptr);
854 
855  /// Checks whether we construct an array of non-POD type, and decides if the
856  /// constructor should be inkoved once again.
857  bool shouldRepeatCtorCall(ProgramStateRef State, const CXXConstructExpr *E,
858  const LocationContext *LCtx);
859 
860  void inlineCall(WorkList *WList, const CallEvent &Call, const Decl *D,
861  NodeBuilder &Bldr, ExplodedNode *Pred, ProgramStateRef State);
862 
863  void ctuBifurcate(const CallEvent &Call, const Decl *D, NodeBuilder &Bldr,
864  ExplodedNode *Pred, ProgramStateRef State);
865 
866  /// Returns true if the CTU analysis is running its second phase.
867  bool isSecondPhaseCTU() { return IsCTUEnabled && !Engine.getCTUWorkList(); }
868 
869  /// Conservatively evaluate call by invalidating regions and binding
870  /// a conjured return value.
871  void conservativeEvalCall(const CallEvent &Call, NodeBuilder &Bldr,
872  ExplodedNode *Pred, ProgramStateRef State);
873 
874  /// Either inline or process the call conservatively (or both), based
875  /// on DynamicDispatchBifurcation data.
876  void BifurcateCall(const MemRegion *BifurReg,
877  const CallEvent &Call, const Decl *D, NodeBuilder &Bldr,
878  ExplodedNode *Pred);
879 
880  bool replayWithoutInlining(ExplodedNode *P, const LocationContext *CalleeLC);
881 
882  /// Models a trivial copy or move constructor or trivial assignment operator
883  /// call with a simple bind.
884  void performTrivialCopy(NodeBuilder &Bldr, ExplodedNode *Pred,
885  const CallEvent &Call);
886 
887  /// If the value of the given expression \p InitWithAdjustments is a NonLoc,
888  /// copy it into a new temporary object region, and replace the value of the
889  /// expression with that.
890  ///
891  /// If \p Result is provided, the new region will be bound to this expression
892  /// instead of \p InitWithAdjustments.
893  ///
894  /// Returns the temporary region with adjustments into the optional
895  /// OutRegionWithAdjustments out-parameter if a new region was indeed needed,
896  /// otherwise sets it to nullptr.
897  ProgramStateRef createTemporaryRegionIfNeeded(
898  ProgramStateRef State, const LocationContext *LC,
899  const Expr *InitWithAdjustments, const Expr *Result = nullptr,
900  const SubRegion **OutRegionWithAdjustments = nullptr);
901 
902  /// Returns a region representing the `Idx`th element of a (possibly
903  /// multi-dimensional) array, for the purposes of element construction or
904  /// destruction.
905  ///
906  /// On return, \p Ty will be set to the base type of the array.
907  ///
908  /// If the type is not an array type at all, the original value is returned.
909  /// Otherwise the "IsArray" flag is set.
910  static SVal makeElementRegion(ProgramStateRef State, SVal LValue,
911  QualType &Ty, bool &IsArray, unsigned Idx = 0);
912 
913  /// For a DeclStmt or CXXInitCtorInitializer, walk backward in the current CFG
914  /// block to find the constructor expression that directly constructed into
915  /// the storage for this statement. Returns null if the constructor for this
916  /// statement created a temporary object region rather than directly
917  /// constructing into an existing region.
918  const CXXConstructExpr *findDirectConstructorForCurrentCFGElement();
919 
920  /// Common code that handles either a CXXConstructExpr or a
921  /// CXXInheritedCtorInitExpr.
922  void handleConstructor(const Expr *E, ExplodedNode *Pred,
923  ExplodedNodeSet &Dst);
924 
925 public:
926  /// Note whether this loop has any more iteratios to model. These methods are
927  /// essentially an interface for a GDM trait. Further reading in
928  /// ExprEngine::VisitObjCForCollectionStmt().
929  [[nodiscard]] static ProgramStateRef
931  const ObjCForCollectionStmt *O,
932  const LocationContext *LC, bool HasMoreIteraton);
933 
934  [[nodiscard]] static ProgramStateRef
935  removeIterationState(ProgramStateRef State, const ObjCForCollectionStmt *O,
936  const LocationContext *LC);
937 
938  [[nodiscard]] static bool hasMoreIteration(ProgramStateRef State,
939  const ObjCForCollectionStmt *O,
940  const LocationContext *LC);
941 
942 private:
943  /// Assuming we construct an array of non-POD types, this method allows us
944  /// to store which element is to be constructed next.
945  static ProgramStateRef
946  setIndexOfElementToConstruct(ProgramStateRef State, const CXXConstructExpr *E,
947  const LocationContext *LCtx, unsigned Idx);
948 
949  static ProgramStateRef
950  removeIndexOfElementToConstruct(ProgramStateRef State,
951  const CXXConstructExpr *E,
952  const LocationContext *LCtx);
953 
954  /// Assuming we destruct an array of non-POD types, this method allows us
955  /// to store which element is to be destructed next.
956  static ProgramStateRef setPendingArrayDestruction(ProgramStateRef State,
957  const LocationContext *LCtx,
958  unsigned Idx);
959 
960  static ProgramStateRef
961  removePendingArrayDestruction(ProgramStateRef State,
962  const LocationContext *LCtx);
963 
964  /// Sets the size of the array in a pending ArrayInitLoopExpr.
965  static ProgramStateRef setPendingInitLoop(ProgramStateRef State,
966  const CXXConstructExpr *E,
967  const LocationContext *LCtx,
968  unsigned Idx);
969 
970  static ProgramStateRef removePendingInitLoop(ProgramStateRef State,
971  const CXXConstructExpr *E,
972  const LocationContext *LCtx);
973 
974  static ProgramStateRef
975  removeStateTraitsUsedForArrayEvaluation(ProgramStateRef State,
976  const CXXConstructExpr *E,
977  const LocationContext *LCtx);
978 
979  /// Store the location of a C++ object corresponding to a statement
980  /// until the statement is actually encountered. For example, if a DeclStmt
981  /// has CXXConstructExpr as its initializer, the object would be considered
982  /// to be "under construction" between CXXConstructExpr and DeclStmt.
983  /// This allows, among other things, to keep bindings to variable's fields
984  /// made within the constructor alive until its declaration actually
985  /// goes into scope.
986  static ProgramStateRef
987  addObjectUnderConstruction(ProgramStateRef State,
988  const ConstructionContextItem &Item,
989  const LocationContext *LC, SVal V);
990 
991  /// Mark the object sa fully constructed, cleaning up the state trait
992  /// that tracks objects under construction.
993  static ProgramStateRef
994  finishObjectConstruction(ProgramStateRef State,
995  const ConstructionContextItem &Item,
996  const LocationContext *LC);
997 
998  /// If the given expression corresponds to a temporary that was used for
999  /// passing into an elidable copy/move constructor and that constructor
1000  /// was actually elided, track that we also need to elide the destructor.
1001  static ProgramStateRef elideDestructor(ProgramStateRef State,
1002  const CXXBindTemporaryExpr *BTE,
1003  const LocationContext *LC);
1004 
1005  /// Stop tracking the destructor that corresponds to an elided constructor.
1006  static ProgramStateRef
1007  cleanupElidedDestructor(ProgramStateRef State,
1008  const CXXBindTemporaryExpr *BTE,
1009  const LocationContext *LC);
1010 
1011  /// Returns true if the given expression corresponds to a temporary that
1012  /// was constructed for passing into an elidable copy/move constructor
1013  /// and that constructor was actually elided.
1014  static bool isDestructorElided(ProgramStateRef State,
1015  const CXXBindTemporaryExpr *BTE,
1016  const LocationContext *LC);
1017 
1018  /// Check if all objects under construction have been fully constructed
1019  /// for the given context range (including FromLC, not including ToLC).
1020  /// This is useful for assertions. Also checks if elided destructors
1021  /// were cleaned up.
1022  static bool areAllObjectsFullyConstructed(ProgramStateRef State,
1023  const LocationContext *FromLC,
1024  const LocationContext *ToLC);
1025 };
1026 
1027 /// Traits for storing the call processing policy inside GDM.
1028 /// The GDM stores the corresponding CallExpr pointer.
1029 // FIXME: This does not use the nice trait macros because it must be accessible
1030 // from multiple translation units.
1032 template <>
1034  public ProgramStatePartialTrait<const void*> {
1035  static void *GDMIndex();
1036 };
1037 
1038 } // namespace ento
1039 
1040 } // namespace clang
1041 
1042 #endif // LLVM_CLANG_STATICANALYZER_CORE_PATHSENSITIVE_EXPRENGINE_H
clang::ento::ExprEngine::processCallEnter
void processCallEnter(NodeBuilderContext &BC, CallEnter CE, ExplodedNode *Pred)
Generate the entry node of the callee.
Definition: ExprEngineCallAndReturn.cpp:43
clang::ento::ProgramStatePartialTrait
Definition: ProgramStateTrait.h:29
clang::ento::SValBuilder::evalBinOp
SVal evalBinOp(ProgramStateRef state, BinaryOperator::Opcode op, SVal lhs, SVal rhs, QualType type)
Definition: SValBuilder.cpp:484
clang::ento::ExprEngine::hasWorkRemaining
bool hasWorkRemaining() const
Definition: ExprEngine.h:438
clang::AtomicExpr
AtomicExpr - Variadic atomic builtins: __atomic_exchange, __atomic_fetch_*, __atomic_load,...
Definition: Expr.h:6239
clang::ento::ExprEngine::VisitLambdaExpr
void VisitLambdaExpr(const LambdaExpr *LE, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitLambdaExpr - Transfer function logic for LambdaExprs.
Definition: ExprEngineCXX.cpp:1177
clang::ento::ExprEngine::getStateManager
ProgramStateManager & getStateManager()
Definition: ExprEngine.h:417
clang::ento::ExprEngine::updateObjectsUnderConstruction
ProgramStateRef updateObjectsUnderConstruction(SVal V, const Expr *E, ProgramStateRef State, const LocationContext *LCtx, const ConstructionContext *CC, const EvalCallOptions &CallOpts)
Update the program state with all the path-sensitive information that's necessary to perform construc...
Definition: ExprEngineCXX.cpp:390
clang::OffsetOfExpr
OffsetOfExpr - [C99 7.17] - This represents an expression of the form offsetof(record-type,...
Definition: Expr.h:2453
clang::ento::EvalCallOptions::EvalCallOptions
EvalCallOptions()
Definition: ExprEngine.h:120
clang::ento::ExprEngine::removeIterationState
static ProgramStateRef removeIterationState(ProgramStateRef State, const ObjCForCollectionStmt *O, const LocationContext *LC)
Definition: ExprEngine.cpp:2659
clang::ento::BasicValueFactory
Definition: BasicValueFactory.h:113
clang::LocationContext
It wraps the AnalysisDeclContext to represent both the call stack with the help of StackFrameContext ...
Definition: AnalysisDeclContext.h:215
clang::ento::AnalysisManager::getCheckerManager
CheckerManager * getCheckerManager() const
Definition: AnalysisManager.h:80
SVals.h
Nodes
BoundNodesTreeBuilder Nodes
Definition: ASTMatchFinder.cpp:83
string
string(SUBSTRING ${CMAKE_CURRENT_BINARY_DIR} 0 ${PATH_LIB_START} PATH_HEAD) string(SUBSTRING $
Definition: CMakeLists.txt:22
clang::ento::ExprEngine::hasEmptyWorkList
bool hasEmptyWorkList() const
Definition: ExprEngine.h:437
clang::ento::ExprEngine::VisitCallExpr
void VisitCallExpr(const CallExpr *CE, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitCall - Transfer function for function calls.
Definition: ExprEngineCallAndReturn.cpp:604
clang::ento::ExplodedNodeSet::iterator
ImplTy::iterator iterator
Definition: ExplodedGraph.h:477
clang::ento::ConstraintManager
Definition: ConstraintManager.h:69
clang::ento::ExprEngine::getDataTags
DataTag::Factory & getDataTags()
Definition: ExprEngine.h:433
clang::ento::ExprEngine::Visit
void Visit(const Stmt *S, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Visit - Transfer function logic for all statements.
Definition: ExprEngine.cpp:1692
clang::ProgramPointTag
ProgramPoints can be "tagged" as representing points specific to a given analysis entity.
Definition: ProgramPoint.h:38
clang::ento::ExprEngine::getContext
ASTContext & getContext() const
getContext - Return the ASTContext associated with this analysis.
Definition: ExprEngine.h:203
clang::ento::ExprEngine::handleUOExtension
void handleUOExtension(ExplodedNodeSet::iterator I, const UnaryOperator *U, StmtNodeBuilder &Bldr)
Definition: ExprEngineC.cpp:915
clang::NamedDecl
This represents a decl that may have a name.
Definition: Decl.h:247
clang::ento::ExprEngine::hasMoreIteration
static bool hasMoreIteration(ProgramStateRef State, const ObjCForCollectionStmt *O, const LocationContext *LC)
Definition: ExprEngine.cpp:2666
clang::ento::ExprEngine::removeDeadOnEndOfFunction
void removeDeadOnEndOfFunction(NodeBuilderContext &BC, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Remove dead bindings/symbols before exiting a function.
Definition: ExprEngineCallAndReturn.cpp:164
clang::CFGTemporaryDtor
Represents C++ object destructor implicitly generated at the end of full expression for temporary obj...
Definition: CFG.h:484
clang::ento::ProgramStateRef
IntrusiveRefCntPtr< const ProgramState > ProgramStateRef
Definition: ProgramState_Fwd.h:37
clang::QualType
A (possibly-)qualified type.
Definition: Type.h:737
clang::ConstructionContext
ConstructionContext's subclasses describe different ways of constructing an object in C++.
Definition: ConstructionContext.h:243
clang::AnalysisDeclContext
AnalysisDeclContext contains the context data for the function, method or block under analysis.
Definition: AnalysisDeclContext.h:72
clang::ento::ExprEngine::ProcessMemberDtor
void ProcessMemberDtor(const CFGMemberDtor D, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Definition: ExprEngine.cpp:1486
clang::ento::ExprEngine::getCrossTranslationUnitContext
cross_tu::CrossTranslationUnitContext * getCrossTranslationUnitContext()
Definition: ExprEngine.h:220
clang::ento::ExprEngine::evalBinOp
SVal evalBinOp(ProgramStateRef ST, BinaryOperator::Opcode Op, SVal LHS, SVal RHS, QualType T)
Definition: ExprEngine.h:615
clang::ento::ExplodedNode
Definition: ExplodedGraph.h:65
Filename
StringRef Filename
Definition: Format.cpp:2715
clang::ento::ExprEngine::VisitReturnStmt
void VisitReturnStmt(const ReturnStmt *R, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitReturnStmt - Transfer function logic for return statements.
Definition: ExprEngineCallAndReturn.cpp:1309
ProgramState_Fwd.h
clang::CXXNewExpr
Represents a new-expression for memory allocation and constructor calls, e.g: "new CXXNewExpr(foo)".
Definition: ExprCXX.h:2146
clang::ento::ExprEngine::VisitUnaryOperator
void VisitUnaryOperator(const UnaryOperator *B, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitUnaryOperator - Transfer function logic for unary operators.
Definition: ExprEngineC.cpp:932
clang::ento::ExprEngine::VisitLvalObjCIvarRefExpr
void VisitLvalObjCIvarRefExpr(const ObjCIvarRefExpr *DR, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Transfer function logic for computing the lvalue of an Objective-C ivar.
Definition: ExprEngineObjC.cpp:21
clang::InitListExpr
Describes an C or C++ initializer list.
Definition: Expr.h:4796
clang::ento::ExprEngine::VisitArraySubscriptExpr
void VisitArraySubscriptExpr(const ArraySubscriptExpr *Ex, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitArraySubscriptExpr - Transfer function for array accesses.
Definition: ExprEngine.cpp:3273
clang::ento::ExprEngine::ProcessInitializer
void ProcessInitializer(const CFGInitializer I, ExplodedNode *Pred)
Definition: ExprEngine.cpp:1151
clang::ento::ExprEngine::VisitCXXNewExpr
void VisitCXXNewExpr(const CXXNewExpr *CNE, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Definition: ExprEngineCXX.cpp:989
llvm::Optional< unsigned >
clang::UnaryOperator
UnaryOperator - This represents the unary-expression's (except sizeof and alignof),...
Definition: Expr.h:2172
clang::ento::ExprEngine::getRootLocationContext
const LocationContext * getRootLocationContext() const
Definition: ExprEngine.h:231
clang::ento::ExprEngine::processCleanupTemporaryBranch
void processCleanupTemporaryBranch(const CXXBindTemporaryExpr *BTE, NodeBuilderContext &BldCtx, ExplodedNode *Pred, ExplodedNodeSet &Dst, const CFGBlock *DstT, const CFGBlock *DstF)
Called by CoreEngine.
Definition: ExprEngine.cpp:1620
clang::ento::StmtNodeBuilder
Definition: CoreEngine.h:391
clang::ObjCForCollectionStmt
Represents Objective-C's collection statement.
Definition: StmtObjC.h:23
clang::ArrayInitLoopExpr
Represents a loop initializing the elements of an array.
Definition: Expr.h:5426
clang::ento::ExprEngine::bindReturnValue
ProgramStateRef bindReturnValue(const CallEvent &Call, const LocationContext *LCtx, ProgramStateRef State)
Create a new state in which the call return value is binded to the call origin expression.
Definition: ExprEngineCallAndReturn.cpp:744
clang::ConstructionContextItem
Represents a single point (AST node) in the program that requires attention during construction of an...
Definition: ConstructionContext.h:28
clang::ento::ExprEngine::processCallExit
void processCallExit(ExplodedNode *Pred)
Generate the sequence of nodes that simulate the call exit and the post visit for CallExpr.
Definition: ExprEngineCallAndReturn.cpp:253
clang::ento::ExprEngine::VisitMSAsmStmt
void VisitMSAsmStmt(const MSAsmStmt *A, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitMSAsmStmt - Transfer function logic for MS inline asm.
Definition: ExprEngine.cpp:3777
clang::ento::StoreManager
Definition: Store.h:53
clang::ento::ExprEngine::processSwitch
void processSwitch(SwitchNodeBuilder &builder)
ProcessSwitch - Called by CoreEngine.
Definition: ExprEngine.cpp:2952
clang::ento::EvalCallOptions::IsArrayCtorOrDtor
bool IsArrayCtorOrDtor
This call is a constructor or a destructor for a single element within an array, a part of array cons...
Definition: ExprEngine.h:103
clang::ento::ExprEngine::evalLoad
void evalLoad(ExplodedNodeSet &Dst, const Expr *NodeEx, const Expr *BoundExpr, ExplodedNode *Pred, ProgramStateRef St, SVal location, const ProgramPointTag *tag=nullptr, QualType LoadTy=QualType())
Simulate a read of the result of Ex.
Definition: ExprEngine.cpp:3629
clang::ento::MemRegion
MemRegion - The root abstract class for all memory regions.
Definition: MemRegion.h:95
clang::CodeGen::AlignmentSource::Decl
@ Decl
The l-value was an access to a declared entity or something equivalently strong, like the address of ...
clang::CFGBlock
Represents a single basic block in a source-level CFG.
Definition: CFG.h:578
U
clang::ento::ExprEngine::Inline_Minimal
@ Inline_Minimal
Do minimal inlining of callees.
Definition: ExprEngine.h:133
V
#define V(N, I)
Definition: ASTContext.h:3237
clang::ento::EvalCallOptions
Hints for figuring out of a call should be inlined during evalCall().
Definition: ExprEngine.h:96
ProgramPoint.h
clang::UnaryExprOrTypeTraitExpr
UnaryExprOrTypeTraitExpr - expression with either a type or (unevaluated) expression operand.
Definition: Expr.h:2558
clang::ento::ExprEngine::ProcessAutomaticObjDtor
void ProcessAutomaticObjDtor(const CFGAutomaticObjDtor D, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Definition: ExprEngine.cpp:1322
clang::ento::ExprEngine::VisitMemberExpr
void VisitMemberExpr(const MemberExpr *M, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitMemberExpr - Transfer function for member expressions.
Definition: ExprEngine.cpp:3324
clang::ento::ExprEngine::evalStore
void evalStore(ExplodedNodeSet &Dst, const Expr *AssignE, const Expr *StoreE, ExplodedNode *Pred, ProgramStateRef St, SVal TargetLV, SVal Val, const ProgramPointTag *tag=nullptr)
evalStore - Handle the semantics of a store via an assignment.
Definition: ExprEngine.cpp:3606
clang::ento::NodeBuilder
Definition: CoreEngine.h:247
Node
DynTypedNode Node
Definition: ASTMatchFinder.cpp:68
clang::CXXBindTemporaryExpr
Represents binding an expression to a temporary.
Definition: ExprCXX.h:1419
clang::BinaryOperator
A builtin binary operation expression such as "x + y" or "x <= y".
Definition: Expr.h:3812
clang::ento::ExprEngine::VisitAtomicExpr
void VisitAtomicExpr(const AtomicExpr *E, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitAtomicExpr - Transfer function for builtin atomic expressions.
Definition: ExprEngine.cpp:3412
hlsl::uint64_t
unsigned long uint64_t
Definition: hlsl_basic_types.h:25
clang::ento::ExprEngine::getStmt
const Stmt * getStmt() const
clang::LambdaExpr
A C++ lambda expression, which produces a function object (of unspecified type) that can be invoked l...
Definition: ExprCXX.h:1872
clang::cross_tu::CrossTranslationUnitContext
This class is used for tools that requires cross translation unit capability.
Definition: CrossTranslationUnit.h:127
clang::interp::LE
bool LE(InterpState &S, CodePtr OpPC)
Definition: Interp.h:504
clang::ento::ExprEngine::evalCall
void evalCall(ExplodedNodeSet &Dst, ExplodedNode *Pred, const CallEvent &Call)
Evaluate a call, running pre- and post-call checkers and allowing checkers to be responsible for hand...
Definition: ExprEngineCallAndReturn.cpp:676
CheckerManager.h
clang::ento::ExprEngine::getSymbolManager
SymbolManager & getSymbolManager()
Definition: ExprEngine.h:430
BugReporter.h
clang::CFGMemberDtor
Represents C++ object destructor implicitly generated for member object in destructor.
Definition: CFG.h:463
clang::MaterializeTemporaryExpr
Represents a prvalue temporary that is written into memory so that a reference can bind to it.
Definition: ExprCXX.h:4513
clang::ASTContext
Holds long-lived AST nodes (such as types and decls) that can be referred to throughout the semantic ...
Definition: ASTContext.h:209
clang::ento::ExprEngine::VisitCXXCatchStmt
void VisitCXXCatchStmt(const CXXCatchStmt *CS, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Definition: ExprEngineCXX.cpp:1143
clang::ento::CoreEngine::ExecuteWorkListWithInitialState
bool ExecuteWorkListWithInitialState(const LocationContext *L, unsigned Steps, ProgramStateRef InitState, ExplodedNodeSet &Dst)
Returns true if there is still simulation state on the worklist.
Definition: CoreEngine.cpp:225
clang::DeclaratorContext::LambdaExpr
@ LambdaExpr
clang::ento::ExprEngine::VisitCXXInheritedCtorInitExpr
void VisitCXXInheritedCtorInitExpr(const CXXInheritedCtorInitExpr *E, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Definition: ExprEngineCXX.cpp:844
Store.h
clang::CFGAutomaticObjDtor
Represents C++ object destructor implicitly generated for automatic object or temporary bound to cons...
Definition: CFG.h:391
clang::ento::ProgramStateTrait
Definition: ProgramState.h:50
clang::ento::ExprEngine::processBranch
void processBranch(const Stmt *Condition, NodeBuilderContext &BuilderCtx, ExplodedNode *Pred, ExplodedNodeSet &Dst, const CFGBlock *DstT, const CFGBlock *DstF)
ProcessBranch - Called by CoreEngine.
Definition: ExprEngine.cpp:2723
clang::ento::ExprEngine::notifyCheckersOfPointerEscape
ProgramStateRef notifyCheckersOfPointerEscape(ProgramStateRef State, const InvalidatedSymbols *Invalidated, ArrayRef< const MemRegion * > ExplicitRegions, const CallEvent *Call, RegionAndSymbolInvalidationTraits &ITraits)
Call PointerEscape callback when a value escapes as a result of region invalidation.
Definition: ExprEngine.cpp:3505
clang::ento::ExprEngine::processCFGBlockEntrance
void processCFGBlockEntrance(const BlockEdge &L, NodeBuilderWithSinks &nodeBuilder, ExplodedNode *Pred)
Called by CoreEngine when processing the entrance of a CFGBlock.
Definition: ExprEngine.cpp:2469
clang::ObjCAtSynchronizedStmt
Represents Objective-C's @synchronized statement.
Definition: StmtObjC.h:302
clang::ento::ExprEngine::getObjectUnderConstruction
static Optional< SVal > getObjectUnderConstruction(ProgramStateRef State, const ConstructionContextItem &Item, const LocationContext *LC)
By looking at a certain item that may be potentially part of an object's ConstructionContext,...
Definition: ExprEngine.cpp:598
clang::ento::ExprEngine::ProcessImplicitDtor
void ProcessImplicitDtor(const CFGImplicitDtor D, ExplodedNode *Pred)
Definition: ExprEngine.cpp:1276
clang::ento::WorkList::hasWork
virtual bool hasWork() const =0
clang::ento::ExprEngine::wasBlocksExhausted
bool wasBlocksExhausted() const
Definition: ExprEngine.h:436
clang::ento::ExprEngine::getBuilderContext
const NodeBuilderContext & getBuilderContext()
Definition: ExprEngine.h:224
Type.h
clang::ento::ExprEngine::GenerateCallExitNode
void GenerateCallExitNode(ExplodedNode *N)
clang::ento::ExprEngine::evalEagerlyAssumeBinOpBifurcation
void evalEagerlyAssumeBinOpBifurcation(ExplodedNodeSet &Dst, ExplodedNodeSet &Src, const Expr *Ex)
evalEagerlyAssumeBinOpBifurcation - Given the nodes in 'Src', eagerly assume symbolic expressions of ...
Definition: ExprEngine.cpp:3713
Expr.h
clang::ento::ExprEngine::VisitCXXThisExpr
void VisitCXXThisExpr(const CXXThisExpr *TE, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Definition: ExprEngineCXX.cpp:1161
clang::ento::ExprEngine::ProcessTemporaryDtor
void ProcessTemporaryDtor(const CFGTemporaryDtor D, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Definition: ExprEngine.cpp:1543
clang::ento::ExprEngine::VisitCompoundLiteralExpr
void VisitCompoundLiteralExpr(const CompoundLiteralExpr *CL, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitCompoundLiteralExpr - Transfer function logic for compound literals.
Definition: ExprEngineC.cpp:546
clang::ento::ExprEngine::~ExprEngine
virtual ~ExprEngine()=default
clang::ento::ExprEngine::VisitIncrementDecrementOperator
void VisitIncrementDecrementOperator(const UnaryOperator *U, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Handle ++ and – (both pre- and post-increment).
Definition: ExprEngineC.cpp:1070
clang::ento::ExprEngine::VisitArrayInitLoopExpr
void VisitArrayInitLoopExpr(const ArrayInitLoopExpr *Ex, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitArrayInitLoopExpr - Transfer function for array init loop.
Definition: ExprEngine.cpp:3175
clang::ento::ExprEngine::InliningModes
InliningModes
The modes of inlining, which override the default analysis-wide settings.
Definition: ExprEngine.h:128
llvm::DenseSet
Definition: Sema.h:77
clang::ento::ExprEngine::VisitUnaryExprOrTypeTraitExpr
void VisitUnaryExprOrTypeTraitExpr(const UnaryExprOrTypeTraitExpr *Ex, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitUnaryExprOrTypeTraitExpr - Transfer function for sizeof.
Definition: ExprEngineC.cpp:873
clang::ento::BugReporter
BugReporter is a utility class for generating PathDiagnostics for analysis.
Definition: BugReporter.h:585
clang::ProgramPoint::PreStmtPurgeDeadSymbolsKind
@ PreStmtPurgeDeadSymbolsKind
Definition: ProgramPoint.h:64
clang::ento::IndirectGotoNodeBuilder
Definition: CoreEngine.h:490
clang::ento::ExprEngine::VisitObjCForCollectionStmt
void VisitObjCForCollectionStmt(const ObjCForCollectionStmt *S, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitObjCForCollectionStmt - Transfer function logic for ObjCForCollectionStmt.
Definition: ExprEngineObjC.cpp:83
clang::ento::ExprEngine::ExprEngine
ExprEngine(cross_tu::CrossTranslationUnitContext &CTU, AnalysisManager &mgr, SetOfConstDecls *VisitedCalleesIn, FunctionSummariesTy *FS, InliningModes HowToInlineIn)
Definition: ExprEngine.cpp:220
clang::CXXInheritedCtorInitExpr
Represents a call to an inherited base class constructor from an inheriting constructor.
Definition: ExprCXX.h:1658
clang::ento::ExplodedGraph
Definition: ExplodedGraph.h:302
clang::ento::ProgramStateManager::getBasicVals
BasicValueFactory & getBasicVals()
Definition: ProgramState.h:548
clang::ento::ExprEngine::getCoreEngine
const CoreEngine & getCoreEngine() const
Definition: ExprEngine.h:440
clang::ento::SwitchNodeBuilder
Definition: CoreEngine.h:538
clang::ento::CoreEngine
CoreEngine - Implements the core logic of the graph-reachability analysis.
Definition: CoreEngine.h:55
clang::ObjCMessageExpr
An expression that sends a message to the given Objective-C object or class.
Definition: ExprObjC.h:940
clang::ento::ExprEngine::VisitGCCAsmStmt
void VisitGCCAsmStmt(const GCCAsmStmt *A, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitGCCAsmStmt - Transfer function logic for inline asm.
Definition: ExprEngine.cpp:3754
state
and static some checkers Checker The latter are built on top of the former via the Checker and CheckerVisitor and attempts to isolate them from much of the gore of the internal analysis the analyzer is basically a source code simulator that traces out possible paths of execution The state of the and the combination of state and program point is a node in an exploded which has the entry program point and initial state
Definition: README.txt:30
clang::ento::Loc
Definition: SVals.h:282
clang::ento::ExprEngine::processEndWorklist
void processEndWorklist()
Called by CoreEngine when the analysis worklist has terminated.
Definition: ExprEngine.cpp:955
clang::ento::ExprEngine::geteagerlyAssumeBinOpBifurcationTags
static std::pair< const ProgramPointTag *, const ProgramPointTag * > geteagerlyAssumeBinOpBifurcationTags()
Definition: ExprEngine.cpp:3703
clang::ento::ExprEngine::getConstraintManager
ConstraintManager & getConstraintManager()
Definition: ExprEngine.h:421
clang::CFGImplicitDtor
Represents C++ object destructor implicitly generated by compiler on various occasions.
Definition: CFG.h:366
clang::ento::SValBuilder
Definition: SValBuilder.h:53
ObjCNoReturn.h
clang::CompoundLiteralExpr
CompoundLiteralExpr - [C99 6.5.2.5].
Definition: Expr.h:3410
FunctionSummary.h
clang::ento::ExprEngine::getInitialState
ProgramStateRef getInitialState(const LocationContext *InitLoc)
getInitialState - Return the initial state used for the root vertex in the ExplodedGraph.
Definition: ExprEngine.cpp:243
clang::GCCAsmStmt
This represents a GCC inline-assembly statement extension.
Definition: Stmt.h:3038
clang::ento::ExprEngine::processRegionChanges
ProgramStateRef processRegionChanges(ProgramStateRef state, const InvalidatedSymbols *invalidated, ArrayRef< const MemRegion * > ExplicitRegions, ArrayRef< const MemRegion * > Regions, const LocationContext *LCtx, const CallEvent *Call)
processRegionChanges - Called by ProgramStateManager whenever a change is made to the store.
Definition: ExprEngine.cpp:668
clang::ento::ExprEngine::printJson
void printJson(raw_ostream &Out, ProgramStateRef State, const LocationContext *LCtx, const char *NL, unsigned int Space, bool IsDot) const
printJson - Called by ProgramStateManager to print checker-specific data.
Definition: ExprEngine.cpp:934
clang::ento::ExprEngine::VisitBlockExpr
void VisitBlockExpr(const BlockExpr *BE, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitBlockExpr - Transfer function logic for BlockExprs.
Definition: ExprEngineC.cpp:195
P
StringRef P
Definition: ASTMatchersInternal.cpp:563
clang::ento::ExprEngine::VisitInitListExpr
void VisitInitListExpr(const InitListExpr *E, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Definition: ExprEngineC.cpp:741
clang::ento::ExprEngine::ProcessLoopExit
void ProcessLoopExit(const Stmt *S, ExplodedNode *Pred)
Definition: ExprEngine.cpp:1133
clang::ento::ExprEngine::getPendingInitLoop
static Optional< unsigned > getPendingInitLoop(ProgramStateRef State, const CXXConstructExpr *E, const LocationContext *LCtx)
Retreives the size of the array in the pending ArrayInitLoopExpr.
Definition: ExprEngine.cpp:480
clang::ento::ProgramStateManager
Definition: ProgramState.h:502
SValBuilder.h
clang::ento::ExprEngine::VisitCXXDestructor
void VisitCXXDestructor(QualType ObjectType, const MemRegion *Dest, const Stmt *S, bool IsBaseDtor, ExplodedNode *Pred, ExplodedNodeSet &Dst, EvalCallOptions &Options)
Definition: ExprEngineCXX.cpp:850
clang::ento::ExprEngine::handleLValueBitCast
ProgramStateRef handleLValueBitCast(ProgramStateRef state, const Expr *Ex, const LocationContext *LCtx, QualType T, QualType ExTy, const CastExpr *CastE, StmtNodeBuilder &Bldr, ExplodedNode *Pred)
Definition: ExprEngineC.cpp:258
clang::ento::AnalysisManager::getASTContext
ASTContext & getASTContext() override
Definition: AnalysisManager.h:82
clang::CFGInitializer
Represents C++ base or member initializer from constructor's initialization list.
Definition: CFG.h:227
clang::ento::CoreEngine::getCTUWorkList
WorkList * getCTUWorkList() const
Definition: CoreEngine.h:176
clang::ento::ExprEngine::VisitCast
void VisitCast(const CastExpr *CastE, const Expr *Ex, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitCast - Transfer function logic for all casts (implicit and explicit).
Definition: ExprEngineC.cpp:285
clang::ento::ExprEngine::processEndOfFunction
void processEndOfFunction(NodeBuilderContext &BC, ExplodedNode *Pred, const ReturnStmt *RS=nullptr)
Called by CoreEngine.
Definition: ExprEngine.cpp:2878
clang::ProgramPoint::Kind
Kind
Definition: ProgramPoint.h:60
clang::CXXDeleteExpr
Represents a delete expression for memory deallocation and destructor calls, e.g.
Definition: ExprCXX.h:2422
clang::ento::AnalysisManager::getAnalysisDeclContextManager
AnalysisDeclContextManager & getAnalysisDeclContextManager()
Definition: AnalysisManager.h:62
clang::BlockExpr
BlockExpr - Adaptor class for mixing a BlockDecl with expressions.
Definition: Expr.h:5975
llvm::ArrayRef
Definition: LLVM.h:34
clang::Decl
Decl - This represents one declaration (or definition), e.g.
Definition: DeclBase.h:83
ProgramState
and static some checkers Checker The latter are built on top of the former via the Checker and CheckerVisitor and attempts to isolate them from much of the gore of the internal analysis the analyzer is basically a source code simulator that traces out possible paths of execution The state of the and the combination of state and program point is a node in an exploded which has the entry program point and initial and then simulate transitions by analyzing individual expressions The analysis of an expression can cause the state to resulting in a new node in the ExplodedGraph with an updated program point and an updated state A bug is found by hitting a node that satisfies some bug condition(basically a violation of a checking invariant). The analyzer traces out multiple paths by reasoning about branches and then bifurcating the state it can contain cycles as paths loop back onto each other and cache out ProgramState and ExplodedNodes are basically immutable once created Once one creates a ProgramState
Definition: README.txt:34
clang::ento::ExprEngine::processStaticInitializer
void processStaticInitializer(const DeclStmt *DS, NodeBuilderContext &BuilderCtx, ExplodedNode *Pred, ExplodedNodeSet &Dst, const CFGBlock *DstT, const CFGBlock *DstF)
Called by CoreEngine.
BugReporterVisitors.h
clang::ArraySubscriptExpr
ArraySubscriptExpr - [C99 6.5.2.1] Array Subscripting.
Definition: Expr.h:2654
clang::ento::ExprEngine::VisitCXXDeleteExpr
void VisitCXXDeleteExpr(const CXXDeleteExpr *CDE, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Definition: ExprEngineCXX.cpp:1121
clang::ento::FunctionSummariesTy
Definition: FunctionSummary.h:33
clang::ento::ExprEngine::VisitCXXBindTemporaryExpr
void VisitCXXBindTemporaryExpr(const CXXBindTemporaryExpr *BTE, ExplodedNodeSet &PreVisit, ExplodedNodeSet &Dst)
Definition: ExprEngine.cpp:1638
clang::ento::ExprEngine::getAnalysisDeclContextManager
AnalysisDeclContextManager & getAnalysisDeclContextManager()
Definition: ExprEngine.h:207
clang::ento::ReplayWithoutInlining
Traits for storing the call processing policy inside GDM.
Definition: ExprEngine.h:1031
clang::ento::CoreEngine::hasWorkRemaining
bool hasWorkRemaining() const
Definition: CoreEngine.h:165
LLVM.h
clang::AnalyzerOptions
Stores options for the analyzer from the command line.
Definition: AnalyzerOptions.h:150
State
LineState State
Definition: UnwrappedLineFormatter.cpp:1147
clang::ento::ExprEngine::VisitOffsetOfExpr
void VisitOffsetOfExpr(const OffsetOfExpr *Ex, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitOffsetOfExpr - Transfer function for offsetof.
Definition: ExprEngineC.cpp:854
clang::ento::ExprEngine::processIndirectGoto
void processIndirectGoto(IndirectGotoNodeBuilder &builder)
processIndirectGoto - Called by CoreEngine.
Definition: ExprEngine.cpp:2827
clang::ento::ExprEngine::getSValBuilder
SValBuilder & getSValBuilder()
Definition: ExprEngine.h:215
clang::ento::ExprEngine::getBugReporter
BugReporter & getBugReporter()
Definition: ExprEngine.h:217
clang::ento::ExprEngine::ProcessBaseDtor
void ProcessBaseDtor(const CFGBaseDtor D, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Definition: ExprEngine.cpp:1466
clang::ento::ExprEngine::processBeginOfFunction
void processBeginOfFunction(NodeBuilderContext &BC, ExplodedNode *Pred, ExplodedNodeSet &Dst, const BlockEdge &L)
Called by CoreEngine.
Definition: ExprEngine.cpp:2868
clang::ento::AnalysisManager
Definition: AnalysisManager.h:31
clang::BinaryOperatorKind
BinaryOperatorKind
Definition: OperationKinds.h:25
clang::ObjCNoReturn
Definition: ObjCNoReturn.h:24
clang::ento::ExprEngine::getCurrentCFGElement
CFGElement getCurrentCFGElement()
Return the CFG element corresponding to the worklist element that is currently being processed by Exp...
Definition: ExprEngine.h:701
clang::ento::ExprEngine::ViewGraph
void ViewGraph(bool trim=false)
Visualize the ExplodedGraph created by executing the simulation.
clang::ento::ExprEngine::getAnalysisManager
AnalysisManager & getAnalysisManager()
Definition: ExprEngine.h:205
CoreEngine.h
clang::ento::CoreEngine::wasBlocksExhausted
bool wasBlocksExhausted() const
Definition: CoreEngine.h:164
clang::ento::ExprEngine::getGraph
const ExplodedGraph & getGraph() const
Definition: ExprEngine.h:264
clang::ento::ExprEngine::handleConstructionContext
std::pair< ProgramStateRef, SVal > handleConstructionContext(const Expr *E, ProgramStateRef State, const NodeBuilderContext *BldrCtx, const LocationContext *LCtx, const ConstructionContext *CC, EvalCallOptions &CallOpts, unsigned Idx=0)
A convenient wrapper around computeObjectUnderConstruction and updateObjectsUnderConstruction.
Definition: ExprEngine.h:752
clang::ento::PathSensitiveBugReporter
GRBugReporter is used for generating path-sensitive reports.
Definition: BugReporter.h:664
clang::ento::ExplodedGraph::roots_end
roots_iterator roots_end()
Definition: ExplodedGraph.h:408
clang::CFGElement
Represents a top-level expression in a basic block.
Definition: CFG.h:55
clang::ObjCPropertyAttribute::Kind
Kind
Definition: DeclObjCCommon.h:22
clang::ento::ExprEngine::computeObjectUnderConstruction
SVal computeObjectUnderConstruction(const Expr *E, ProgramStateRef State, const NodeBuilderContext *BldrCtx, const LocationContext *LCtx, const ConstructionContext *CC, EvalCallOptions &CallOpts, unsigned Idx=0)
Find location of the object that is being constructed by a given constructor.
Definition: ExprEngineCXX.cpp:119
clang::DeclStmt
DeclStmt - Adaptor class for mixing declarations with statements and expressions.
Definition: Stmt.h:1303
clang::ento::ExprEngine
Definition: ExprEngine.h:123
clang::ento::ExplodedGraph::roots_begin
roots_iterator roots_begin()
Definition: ExplodedGraph.h:406
ProgramState.h
clang::ento::ProgramStateManager::getStoreManager
StoreManager & getStoreManager()
Definition: ProgramState.h:578
clang::ento::MemRegionManager
Definition: MemRegion.h:1353
clang::ento::CoreEngine::getWorkList
WorkList * getWorkList() const
Definition: CoreEngine.h:175
clang::CXXThisExpr
Represents the this expression in C++.
Definition: ExprCXX.h:1149
clang::ento::ExprEngine::DumpGraph
std::string DumpGraph(bool trim=false, StringRef Filename="")
Dump graph to the specified filename.
clang::ento::ExprEngine::setWhetherHasMoreIteration
static ProgramStateRef setWhetherHasMoreIteration(ProgramStateRef State, const ObjCForCollectionStmt *O, const LocationContext *LC, bool HasMoreIteraton)
Note whether this loop has any more iteratios to model.
Definition: ExprEngine.cpp:2651
clang::ento::ExprEngine::processRegionChange
ProgramStateRef processRegionChange(ProgramStateRef state, const MemRegion *MR, const LocationContext *LCtx)
Definition: ExprEngine.h:406
clang::ento::ExprEngine::ProcessStmt
void ProcessStmt(const Stmt *S, ExplodedNode *Pred)
Definition: ExprEngine.cpp:1103
clang::ento::ExprEngine::getStoreManager
StoreManager & getStoreManager()
Definition: ExprEngine.h:419
clang::interp::NE
bool NE(InterpState &S, CodePtr OpPC)
Definition: Interp.h:490
clang::ento::ExprEngine::ProcessDeleteDtor
void ProcessDeleteDtor(const CFGDeleteDtor D, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Definition: ExprEngine.cpp:1392
WorkList.h
clang::ento::ExprEngine::VisitDeclStmt
void VisitDeclStmt(const DeclStmt *DS, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitDeclStmt - Transfer function logic for DeclStmts.
Definition: ExprEngineC.cpp:571
clang::ento::CheckerManager
Definition: CheckerManager.h:126
clang::ento::EvalCallOptions::IsElidableCtorThatHasNotBeenElided
bool IsElidableCtorThatHasNotBeenElided
This call is a pre-C++17 elidable constructor that we failed to elide because we failed to compute th...
Definition: ExprEngine.h:118
clang
Definition: CalledOnceCheck.h:17
clang::ento::ExprEngine::VisitObjCAtSynchronizedStmt
void VisitObjCAtSynchronizedStmt(const ObjCAtSynchronizedStmt *S, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Transfer function logic for ObjCAtSynchronizedStmts.
Definition: ExprEngineObjC.cpp:38
clang::ento::ExprEngine::removeDead
void removeDead(ExplodedNode *Node, ExplodedNodeSet &Out, const Stmt *ReferenceStmt, const LocationContext *LC, const Stmt *DiagnosticStmt=nullptr, ProgramPoint::Kind K=ProgramPoint::PreStmtPurgeDeadSymbolsKind)
Run the analyzer's garbage collection - remove dead symbols and bindings from the state.
Definition: ExprEngine.cpp:1023
clang::CFGDeleteDtor
Represents C++ object destructor generated from a call to delete.
Definition: CFG.h:416
CFG.h
clang::ento::ExprEngine::processAssume
ProgramStateRef processAssume(ProgramStateRef state, SVal cond, bool assumption)
evalAssume - Callback function invoked by the ConstraintManager when making assumptions about state v...
Definition: ExprEngine.cpp:662
clang::Stmt
Stmt - This represents one statement.
Definition: Stmt.h:71
clang::ento::ExprEngine::processCFGElement
void processCFGElement(const CFGElement E, ExplodedNode *Pred, unsigned StmtIdx, NodeBuilderContext *Ctx)
processCFGElement - Called by CoreEngine.
Definition: ExprEngine.cpp:961
clang::CXXCatchStmt
CXXCatchStmt - This represents a C++ catch block.
Definition: StmtCXX.h:28
clang::ento::ExprEngine::GenerateAutoTransition
void GenerateAutoTransition(ExplodedNode *N)
clang::ento::ExprEngine::handleLVectorSplat
ProgramStateRef handleLVectorSplat(ProgramStateRef state, const LocationContext *LCtx, const CastExpr *CastE, StmtNodeBuilder &Bldr, ExplodedNode *Pred)
clang::CFGBaseDtor
Represents C++ object destructor implicitly generated for base object in destructor.
Definition: CFG.h:442
clang::ento::NodeBuilderContext::getBlock
const CFGBlock * getBlock() const
Return the CFGBlock associated with this builder.
Definition: CoreEngine.h:227
clang::ento::CallEvent
Represents an abstract call to a function or method along a particular path.
Definition: CallEvent.h:148
clang::ento::ExprEngine::ExecuteWorkListWithInitialState
bool ExecuteWorkListWithInitialState(const LocationContext *L, unsigned Steps, ProgramStateRef InitState, ExplodedNodeSet &Dst)
Execute the work list with an initial state.
Definition: ExprEngine.h:196
clang::ento::ExprEngine::VisitCXXConstructExpr
void VisitCXXConstructExpr(const CXXConstructExpr *E, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Definition: ExprEngineCXX.cpp:838
clang::ento::PointerEscapeKind
PointerEscapeKind
Describes the different reasons a pointer escapes during analysis.
Definition: CheckerManager.h:78
clang::ento::NodeBuilderContext
Definition: CoreEngine.h:212
clang::ento::ExprEngine::getIndexOfElementToConstruct
static Optional< unsigned > getIndexOfElementToConstruct(ProgramStateRef State, const CXXConstructExpr *E, const LocationContext *LCtx)
Retreives which element is being constructed in a non-POD type array.
Definition: ExprEngine.cpp:508
clang::AnalysisDeclContextManager
Definition: AnalysisDeclContext.h:425
clang::CallEnter
Represents a point when we begin processing an inlined call.
Definition: ProgramPoint.h:629
clang::ento::ProgramStateManager::getConstraintManager
ConstraintManager & getConstraintManager()
Definition: ProgramState.h:579
clang::ento::ExprEngine::VisitGuardedExpr
void VisitGuardedExpr(const Expr *Ex, const Expr *L, const Expr *R, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitGuardedExpr - Transfer function logic for ?, __builtin_choose.
Definition: ExprEngineC.cpp:789
clang::ento::EvalCallOptions::IsTemporaryCtorOrDtor
bool IsTemporaryCtorOrDtor
This call is a constructor or a destructor of a temporary value.
Definition: ExprEngine.h:106
clang::ento::ExprEngine::getPendingArrayDestruction
static Optional< unsigned > getPendingArrayDestruction(ProgramStateRef State, const LocationContext *LCtx)
Retreives which element is being destructed in a non-POD type array.
Definition: ExprEngine.cpp:527
clang::MemberExpr
MemberExpr - [C99 6.5.2.3] Structure and Union Members.
Definition: Expr.h:3169
clang::ento::ExprEngine::VisitCXXNewAllocatorCall
void VisitCXXNewAllocatorCall(const CXXNewExpr *CNE, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Definition: ExprEngineCXX.cpp:917
clang::BlockEdge
Definition: ProgramPoint.h:502
clang::ento::SVal
SVal - This represents a symbolic expression, which can be either an L-value or an R-value.
Definition: SVals.h:73
clang::ento::CoreEngine::getDataTags
DataTag::Factory & getDataTags()
Definition: CoreEngine.h:208
clang::ento::NodeBuilderWithSinks
Definition: CoreEngine.h:354
clang::ento::ExprEngine::enqueueEndOfPath
void enqueueEndOfPath(ExplodedNodeSet &S)
clang::ento::ExprEngine::processPointerEscapedOnBind
ProgramStateRef processPointerEscapedOnBind(ProgramStateRef State, ArrayRef< std::pair< SVal, SVal >> LocAndVals, const LocationContext *LCtx, PointerEscapeKind Kind, const CallEvent *Call)
Call PointerEscape callback when a value escapes as a result of bind.
Definition: ExprEngine.cpp:3456
clang::ento::RegionAndSymbolInvalidationTraits
Information about invalidation for a particular region/symbol.
Definition: MemRegion.h:1570
ProgramStateTrait.h
clang::Expr
This represents one expression.
Definition: Expr.h:109
clang::ento::ExprEngine::Inline_Regular
@ Inline_Regular
Follow the default settings for inlining callees.
Definition: ExprEngine.h:130
AnalysisManager.h
clang::CastExpr
CastExpr - Base class for type casts, including both implicit casts (ImplicitCastExpr) and explicit c...
Definition: Expr.h:3480
clang::ento::ExprEngine::CreateCXXTemporaryObject
void CreateCXXTemporaryObject(const MaterializeTemporaryExpr *ME, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Create a C++ temporary object for an rvalue.
Definition: ExprEngineCXX.cpp:27
clang::MSAsmStmt
This represents a Microsoft inline-assembly statement extension.
Definition: Stmt.h:3261
clang::ento::ExprEngine::getBasicVals
BasicValueFactory & getBasicVals()
Definition: ExprEngine.h:426
clang::ento::ExplodedNodeSet
Definition: ExplodedGraph.h:461
clang::ProgramPoint
Definition: ProgramPoint.h:58
clang::CallExpr
CallExpr - Represents a function call (C99 6.5.2.2, C++ [expr.call]).
Definition: Expr.h:2810
clang::ento::ExprEngine::VisitCommonDeclRefExpr
void VisitCommonDeclRefExpr(const Expr *DR, const NamedDecl *D, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Transfer function logic for DeclRefExprs and BlockDeclRefExprs.
Definition: ExprEngine.cpp:3035
clang::ento::SymbolManager
Definition: SymbolManager.h:481
clang::ento::DataTag::Factory
Definition: BugReporter.h:743
clang::ento::ExprEngine::ProcessNewAllocator
void ProcessNewAllocator(const CXXNewExpr *NE, ExplodedNode *Pred)
Definition: ExprEngine.cpp:1303
clang::ento::CoreEngine::ExecuteWorkList
bool ExecuteWorkList(const LocationContext *L, unsigned Steps, ProgramStateRef InitState)
ExecuteWorkList - Run the worklist algorithm for a maximum number of steps.
Definition: CoreEngine.cpp:88
clang::CXXConstructExpr
Represents a call to a C++ constructor.
Definition: ExprCXX.h:1467
clang::ObjCIvarRefExpr
ObjCIvarRefExpr - A reference to an ObjC instance variable.
Definition: ExprObjC.h:548
clang::ento::ExprEngine::getGraph
ExplodedGraph & getGraph()
Definition: ExprEngine.h:263
clang::ento::ExprEngine::defaultEvalCall
void defaultEvalCall(NodeBuilder &B, ExplodedNode *Pred, const CallEvent &Call, const EvalCallOptions &CallOpts={})
Default implementation of call evaluation.
Definition: ExprEngineCallAndReturn.cpp:1216
llvm::IntrusiveRefCntPtr< const ProgramState >
clang::ento::ExprEngine::ExecuteWorkList
bool ExecuteWorkList(const LocationContext *L, unsigned Steps=150000)
Returns true if there is still simulation state on the worklist.
Definition: ExprEngine.h:188
clang::ento::ExprEngine::getRegionManager
MemRegionManager & getRegionManager()
Definition: ExprEngine.h:431
clang::ento::EvalCallOptions::IsTemporaryLifetimeExtendedViaAggregate
bool IsTemporaryLifetimeExtendedViaAggregate
This call is a constructor for a temporary that is lifetime-extended by binding it to a reference-typ...
Definition: ExprEngine.h:111
clang::ReturnStmt
ReturnStmt - This represents a return, optionally of an expression: return; return 4;.
Definition: Stmt.h:2796
clang::ento::ExprEngine::VisitBinaryOperator
void VisitBinaryOperator(const BinaryOperator *B, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitBinaryOperator - Transfer function logic for binary operators.
Definition: ExprEngineC.cpp:39
clang::ento::ExprEngine::VisitObjCMessage
void VisitObjCMessage(const ObjCMessageExpr *ME, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Definition: ExprEngineObjC.cpp:147
clang::ento::EvalCallOptions::IsCtorOrDtorWithImproperlyModeledTargetRegion
bool IsCtorOrDtorWithImproperlyModeledTargetRegion
This call is a constructor or a destructor for which we do not currently compute the this-region corr...
Definition: ExprEngine.h:99
clang::ento::ExprEngine::getCheckerManager
CheckerManager & getCheckerManager() const
Definition: ExprEngine.h:211
clang::ento::ExprEngine::VisitLogicalExpr
void VisitLogicalExpr(const BinaryOperator *B, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitLogicalExpr - Transfer function logic for '&&', '||'.
Definition: ExprEngineC.cpp:647