clang  7.0.0svn
ExprEngine.h
Go to the documentation of this file.
1 //===-- ExprEngine.h - Path-Sensitive Expression-Level Dataflow ---*- C++ -*-=//
2 //
3 // The LLVM Compiler Infrastructure
4 //
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
7 //
8 //===----------------------------------------------------------------------===//
9 //
10 // This file defines a meta-engine for path-sensitive dataflow analysis that
11 // is built on CoreEngine, but provides the boilerplate to execute transfer
12 // functions and build the ExplodedGraph at the expression level.
13 //
14 //===----------------------------------------------------------------------===//
15 
16 #ifndef LLVM_CLANG_STATICANALYZER_CORE_PATHSENSITIVE_EXPRENGINE_H
17 #define LLVM_CLANG_STATICANALYZER_CORE_PATHSENSITIVE_EXPRENGINE_H
18 
19 #include "clang/AST/Expr.h"
20 #include "clang/AST/Type.h"
28 
29 namespace clang {
30 
31 class AnalysisDeclContextManager;
32 class CXXCatchStmt;
33 class CXXConstructExpr;
34 class CXXDeleteExpr;
35 class CXXNewExpr;
36 class CXXTemporaryObjectExpr;
37 class CXXThisExpr;
38 class MaterializeTemporaryExpr;
39 class ObjCAtSynchronizedStmt;
40 class ObjCForCollectionStmt;
41 
42 namespace ento {
43 
44 class AnalysisManager;
45 class CallEvent;
46 class CXXConstructorCall;
47 
48 class ExprEngine : public SubEngine {
49 public:
50  /// The modes of inlining, which override the default analysis-wide settings.
52  /// Follow the default settings for inlining callees.
54  /// Do minimal inlining of callees.
56  };
57 
58  /// Hints for figuring out of a call should be inlined during evalCall().
59  struct EvalCallOptions {
60  /// This call is a constructor or a destructor for which we do not currently
61  /// compute the this-region correctly.
63  /// This call is a constructor or a destructor for a single element within
64  /// an array, a part of array construction or destruction.
65  bool IsArrayCtorOrDtor = false;
66  /// This call is a constructor or a destructor of a temporary value.
67  bool IsTemporaryCtorOrDtor = false;
68 
70  };
71 
72 private:
73  AnalysisManager &AMgr;
74 
75  AnalysisDeclContextManager &AnalysisDeclContexts;
76 
77  CoreEngine Engine;
78 
79  /// G - the simulation graph.
80  ExplodedGraph& G;
81 
82  /// StateMgr - Object that manages the data for all created states.
83  ProgramStateManager StateMgr;
84 
85  /// SymMgr - Object that manages the symbol information.
86  SymbolManager& SymMgr;
87 
88  /// svalBuilder - SValBuilder object that creates SVals from expressions.
89  SValBuilder &svalBuilder;
90 
91  unsigned int currStmtIdx;
92  const NodeBuilderContext *currBldrCtx;
93 
94  /// Helper object to determine if an Objective-C message expression
95  /// implicitly never returns.
96  ObjCNoReturn ObjCNoRet;
97 
98  /// Whether or not GC is enabled in this analysis.
99  bool ObjCGCEnabled;
100 
101  /// The BugReporter associated with this engine. It is important that
102  /// this object be placed at the very end of member variables so that its
103  /// destructor is called before the rest of the ExprEngine is destroyed.
104  GRBugReporter BR;
105 
106  /// The functions which have been analyzed through inlining. This is owned by
107  /// AnalysisConsumer. It can be null.
108  SetOfConstDecls *VisitedCallees;
109 
110  /// The flag, which specifies the mode of inlining for the engine.
111  InliningModes HowToInline;
112 
113 public:
114  ExprEngine(AnalysisManager &mgr, bool gcEnabled,
115  SetOfConstDecls *VisitedCalleesIn,
117  InliningModes HowToInlineIn);
118 
119  ~ExprEngine() override;
120 
121  /// Returns true if there is still simulation state on the worklist.
122  bool ExecuteWorkList(const LocationContext *L, unsigned Steps = 150000) {
123  return Engine.ExecuteWorkList(L, Steps, nullptr);
124  }
125 
126  /// Execute the work list with an initial state. Nodes that reaches the exit
127  /// of the function are added into the Dst set, which represent the exit
128  /// state of the function call. Returns true if there is still simulation
129  /// state on the worklist.
130  bool ExecuteWorkListWithInitialState(const LocationContext *L, unsigned Steps,
131  ProgramStateRef InitState,
132  ExplodedNodeSet &Dst) {
133  return Engine.ExecuteWorkListWithInitialState(L, Steps, InitState, Dst);
134  }
135 
136  /// getContext - Return the ASTContext associated with this analysis.
137  ASTContext &getContext() const { return AMgr.getASTContext(); }
138 
139  AnalysisManager &getAnalysisManager() override { return AMgr; }
140 
142  return *AMgr.getCheckerManager();
143  }
144 
145  SValBuilder &getSValBuilder() { return svalBuilder; }
146 
147  BugReporter& getBugReporter() { return BR; }
148 
150  assert(currBldrCtx);
151  return *currBldrCtx;
152  }
153 
154  bool isObjCGCEnabled() { return ObjCGCEnabled; }
155 
156  const Stmt *getStmt() const;
157 
161 
162  /// Visualize the ExplodedGraph created by executing the simulation.
163  void ViewGraph(bool trim = false);
164 
165  /// Visualize a trimmed ExplodedGraph that only contains paths to the given
166  /// nodes.
168 
169  /// getInitialState - Return the initial state used for the root vertex
170  /// in the ExplodedGraph.
171  ProgramStateRef getInitialState(const LocationContext *InitLoc) override;
172 
173  ExplodedGraph& getGraph() { return G; }
174  const ExplodedGraph& getGraph() const { return G; }
175 
176  /// \brief Run the analyzer's garbage collection - remove dead symbols and
177  /// bindings from the state.
178  ///
179  /// Checkers can participate in this process with two callbacks:
180  /// \c checkLiveSymbols and \c checkDeadSymbols. See the CheckerDocumentation
181  /// class for more information.
182  ///
183  /// \param Node The predecessor node, from which the processing should start.
184  /// \param Out The returned set of output nodes.
185  /// \param ReferenceStmt The statement which is about to be processed.
186  /// Everything needed for this statement should be considered live.
187  /// A null statement means that everything in child LocationContexts
188  /// is dead.
189  /// \param LC The location context of the \p ReferenceStmt. A null location
190  /// context means that we have reached the end of analysis and that
191  /// all statements and local variables should be considered dead.
192  /// \param DiagnosticStmt Used as a location for any warnings that should
193  /// occur while removing the dead (e.g. leaks). By default, the
194  /// \p ReferenceStmt is used.
195  /// \param K Denotes whether this is a pre- or post-statement purge. This
196  /// must only be ProgramPoint::PostStmtPurgeDeadSymbolsKind if an
197  /// entire location context is being cleared, in which case the
198  /// \p ReferenceStmt must either be a ReturnStmt or \c NULL. Otherwise,
199  /// it must be ProgramPoint::PreStmtPurgeDeadSymbolsKind (the default)
200  /// and \p ReferenceStmt must be valid (non-null).
202  const Stmt *ReferenceStmt, const LocationContext *LC,
203  const Stmt *DiagnosticStmt = nullptr,
205 
206  /// processCFGElement - Called by CoreEngine. Used to generate new successor
207  /// nodes by processing the 'effects' of a CFG element.
208  void processCFGElement(const CFGElement E, ExplodedNode *Pred,
209  unsigned StmtIdx, NodeBuilderContext *Ctx) override;
210 
211  void ProcessStmt(const Stmt *S, ExplodedNode *Pred);
212 
213  void ProcessLoopExit(const Stmt* S, ExplodedNode *Pred);
214 
215  void ProcessInitializer(const CFGInitializer I, ExplodedNode *Pred);
216 
217  void ProcessImplicitDtor(const CFGImplicitDtor D, ExplodedNode *Pred);
218 
219  void ProcessNewAllocator(const CXXNewExpr *NE, ExplodedNode *Pred);
220 
222  ExplodedNode *Pred, ExplodedNodeSet &Dst);
223  void ProcessDeleteDtor(const CFGDeleteDtor D,
224  ExplodedNode *Pred, ExplodedNodeSet &Dst);
225  void ProcessBaseDtor(const CFGBaseDtor D,
226  ExplodedNode *Pred, ExplodedNodeSet &Dst);
227  void ProcessMemberDtor(const CFGMemberDtor D,
228  ExplodedNode *Pred, ExplodedNodeSet &Dst);
230  ExplodedNode *Pred, ExplodedNodeSet &Dst);
231 
232  /// Called by CoreEngine when processing the entrance of a CFGBlock.
233  void processCFGBlockEntrance(const BlockEdge &L,
234  NodeBuilderWithSinks &nodeBuilder,
235  ExplodedNode *Pred) override;
236 
237  /// ProcessBranch - Called by CoreEngine. Used to generate successor
238  /// nodes by processing the 'effects' of a branch condition.
239  void processBranch(const Stmt *Condition, const Stmt *Term,
240  NodeBuilderContext& BuilderCtx,
241  ExplodedNode *Pred,
242  ExplodedNodeSet &Dst,
243  const CFGBlock *DstT,
244  const CFGBlock *DstF) override;
245 
246  /// Called by CoreEngine.
247  /// Used to generate successor nodes for temporary destructors depending
248  /// on whether the corresponding constructor was visited.
250  NodeBuilderContext &BldCtx,
251  ExplodedNode *Pred, ExplodedNodeSet &Dst,
252  const CFGBlock *DstT,
253  const CFGBlock *DstF) override;
254 
255  /// Called by CoreEngine. Used to processing branching behavior
256  /// at static initializers.
257  void processStaticInitializer(const DeclStmt *DS,
258  NodeBuilderContext& BuilderCtx,
259  ExplodedNode *Pred,
260  ExplodedNodeSet &Dst,
261  const CFGBlock *DstT,
262  const CFGBlock *DstF) override;
263 
264  /// processIndirectGoto - Called by CoreEngine. Used to generate successor
265  /// nodes by processing the 'effects' of a computed goto jump.
266  void processIndirectGoto(IndirectGotoNodeBuilder& builder) override;
267 
268  /// ProcessSwitch - Called by CoreEngine. Used to generate successor
269  /// nodes by processing the 'effects' of a switch statement.
270  void processSwitch(SwitchNodeBuilder& builder) override;
271 
272  /// Called by CoreEngine. Used to notify checkers that processing a
273  /// function has begun. Called for both inlined and and top-level functions.
275  ExplodedNode *Pred, ExplodedNodeSet &Dst,
276  const BlockEdge &L) override;
277 
278  /// Called by CoreEngine. Used to notify checkers that processing a
279  /// function has ended. Called for both inlined and and top-level functions.
281  ExplodedNode *Pred,
282  const ReturnStmt *RS = nullptr) override;
283 
284  /// Remove dead bindings/symbols before exiting a function.
286  ExplodedNode *Pred,
287  ExplodedNodeSet &Dst);
288 
289  /// Generate the entry node of the callee.
291  ExplodedNode *Pred) override;
292 
293  /// Generate the sequence of nodes that simulate the call exit and the post
294  /// visit for CallExpr.
295  void processCallExit(ExplodedNode *Pred) override;
296 
297  /// Called by CoreEngine when the analysis worklist has terminated.
298  void processEndWorklist(bool hasWorkRemaining) override;
299 
300  /// evalAssume - Callback function invoked by the ConstraintManager when
301  /// making assumptions about state values.
303  bool assumption) override;
304 
305  /// processRegionChanges - Called by ProgramStateManager whenever a change is made
306  /// to the store. Used to update checkers that track region values.
309  const InvalidatedSymbols *invalidated,
310  ArrayRef<const MemRegion *> ExplicitRegions,
312  const LocationContext *LCtx,
313  const CallEvent *Call) override;
314 
315  /// printState - Called by ProgramStateManager to print checker-specific data.
316  void printState(raw_ostream &Out, ProgramStateRef State, const char *NL,
317  const char *Sep,
318  const LocationContext *LCtx = nullptr) override;
319 
320  ProgramStateManager& getStateManager() override { return StateMgr; }
321 
322  StoreManager& getStoreManager() { return StateMgr.getStoreManager(); }
323 
325  return StateMgr.getConstraintManager();
326  }
327 
328  // FIXME: Remove when we migrate over to just using SValBuilder.
330  return StateMgr.getBasicVals();
331  }
332 
333  // FIXME: Remove when we migrate over to just using ValueManager.
334  SymbolManager& getSymbolManager() { return SymMgr; }
335  const SymbolManager& getSymbolManager() const { return SymMgr; }
336 
337  // Functions for external checking of whether we have unfinished work
338  bool wasBlocksExhausted() const { return Engine.wasBlocksExhausted(); }
339  bool hasEmptyWorkList() const { return !Engine.getWorkList()->hasWork(); }
340  bool hasWorkRemaining() const { return Engine.hasWorkRemaining(); }
341 
342  const CoreEngine &getCoreEngine() const { return Engine; }
343 
344 public:
345  /// Visit - Transfer function logic for all statements. Dispatches to
346  /// other functions that handle specific kinds of statements.
347  void Visit(const Stmt *S, ExplodedNode *Pred, ExplodedNodeSet &Dst);
348 
349  /// VisitArraySubscriptExpr - Transfer function for array accesses.
351  ExplodedNode *Pred,
352  ExplodedNodeSet &Dst);
353 
354  /// VisitGCCAsmStmt - Transfer function logic for inline asm.
355  void VisitGCCAsmStmt(const GCCAsmStmt *A, ExplodedNode *Pred,
356  ExplodedNodeSet &Dst);
357 
358  /// VisitMSAsmStmt - Transfer function logic for MS inline asm.
359  void VisitMSAsmStmt(const MSAsmStmt *A, ExplodedNode *Pred,
360  ExplodedNodeSet &Dst);
361 
362  /// VisitBlockExpr - Transfer function logic for BlockExprs.
363  void VisitBlockExpr(const BlockExpr *BE, ExplodedNode *Pred,
364  ExplodedNodeSet &Dst);
365 
366  /// VisitLambdaExpr - Transfer function logic for LambdaExprs.
367  void VisitLambdaExpr(const LambdaExpr *LE, ExplodedNode *Pred,
368  ExplodedNodeSet &Dst);
369 
370  /// VisitBinaryOperator - Transfer function logic for binary operators.
371  void VisitBinaryOperator(const BinaryOperator* B, ExplodedNode *Pred,
372  ExplodedNodeSet &Dst);
373 
374 
375  /// VisitCall - Transfer function for function calls.
376  void VisitCallExpr(const CallExpr *CE, ExplodedNode *Pred,
377  ExplodedNodeSet &Dst);
378 
379  /// VisitCast - Transfer function logic for all casts (implicit and explicit).
380  void VisitCast(const CastExpr *CastE, const Expr *Ex, ExplodedNode *Pred,
381  ExplodedNodeSet &Dst);
382 
383  /// VisitCompoundLiteralExpr - Transfer function logic for compound literals.
385  ExplodedNode *Pred, ExplodedNodeSet &Dst);
386 
387  /// Transfer function logic for DeclRefExprs and BlockDeclRefExprs.
388  void VisitCommonDeclRefExpr(const Expr *DR, const NamedDecl *D,
389  ExplodedNode *Pred, ExplodedNodeSet &Dst);
390 
391  /// VisitDeclStmt - Transfer function logic for DeclStmts.
392  void VisitDeclStmt(const DeclStmt *DS, ExplodedNode *Pred,
393  ExplodedNodeSet &Dst);
394 
395  /// VisitGuardedExpr - Transfer function logic for ?, __builtin_choose
396  void VisitGuardedExpr(const Expr *Ex, const Expr *L, const Expr *R,
397  ExplodedNode *Pred, ExplodedNodeSet &Dst);
398 
399  void VisitInitListExpr(const InitListExpr *E, ExplodedNode *Pred,
400  ExplodedNodeSet &Dst);
401 
402  /// VisitLogicalExpr - Transfer function logic for '&&', '||'
403  void VisitLogicalExpr(const BinaryOperator* B, ExplodedNode *Pred,
404  ExplodedNodeSet &Dst);
405 
406  /// VisitMemberExpr - Transfer function for member expressions.
407  void VisitMemberExpr(const MemberExpr *M, ExplodedNode *Pred,
408  ExplodedNodeSet &Dst);
409 
410  /// VisitAtomicExpr - Transfer function for builtin atomic expressions
411  void VisitAtomicExpr(const AtomicExpr *E, ExplodedNode *Pred,
412  ExplodedNodeSet &Dst);
413 
414  /// Transfer function logic for ObjCAtSynchronizedStmts.
416  ExplodedNode *Pred, ExplodedNodeSet &Dst);
417 
418  /// Transfer function logic for computing the lvalue of an Objective-C ivar.
420  ExplodedNodeSet &Dst);
421 
422  /// VisitObjCForCollectionStmt - Transfer function logic for
423  /// ObjCForCollectionStmt.
425  ExplodedNode *Pred, ExplodedNodeSet &Dst);
426 
427  void VisitObjCMessage(const ObjCMessageExpr *ME, ExplodedNode *Pred,
428  ExplodedNodeSet &Dst);
429 
430  /// VisitReturnStmt - Transfer function logic for return statements.
431  void VisitReturnStmt(const ReturnStmt *R, ExplodedNode *Pred,
432  ExplodedNodeSet &Dst);
433 
434  /// VisitOffsetOfExpr - Transfer function for offsetof.
435  void VisitOffsetOfExpr(const OffsetOfExpr *Ex, ExplodedNode *Pred,
436  ExplodedNodeSet &Dst);
437 
438  /// VisitUnaryExprOrTypeTraitExpr - Transfer function for sizeof.
440  ExplodedNode *Pred, ExplodedNodeSet &Dst);
441 
442  /// VisitUnaryOperator - Transfer function logic for unary operators.
443  void VisitUnaryOperator(const UnaryOperator* B, ExplodedNode *Pred,
444  ExplodedNodeSet &Dst);
445 
446  /// Handle ++ and -- (both pre- and post-increment).
448  ExplodedNode *Pred,
449  ExplodedNodeSet &Dst);
450 
451  void VisitCXXCatchStmt(const CXXCatchStmt *CS, ExplodedNode *Pred,
452  ExplodedNodeSet &Dst);
453 
454  void VisitCXXThisExpr(const CXXThisExpr *TE, ExplodedNode *Pred,
455  ExplodedNodeSet & Dst);
456 
458  ExplodedNodeSet &Dst);
459 
460  void VisitCXXDestructor(QualType ObjectType, const MemRegion *Dest,
461  const Stmt *S, bool IsBaseDtor,
462  ExplodedNode *Pred, ExplodedNodeSet &Dst,
463  const EvalCallOptions &Options);
464 
465  void VisitCXXNewAllocatorCall(const CXXNewExpr *CNE,
466  ExplodedNode *Pred,
467  ExplodedNodeSet &Dst);
468 
469  void VisitCXXNewExpr(const CXXNewExpr *CNE, ExplodedNode *Pred,
470  ExplodedNodeSet &Dst);
471 
472  void VisitCXXDeleteExpr(const CXXDeleteExpr *CDE, ExplodedNode *Pred,
473  ExplodedNodeSet &Dst);
474 
475  /// Create a C++ temporary object for an rvalue.
477  ExplodedNode *Pred,
478  ExplodedNodeSet &Dst);
479 
480  /// evalEagerlyAssumeBinOpBifurcation - Given the nodes in 'Src', eagerly assume symbolic
481  /// expressions of the form 'x != 0' and generate new nodes (stored in Dst)
482  /// with those assumptions.
484  const Expr *Ex);
485 
486  std::pair<const ProgramPointTag *, const ProgramPointTag*>
488 
490  return X.isValid() ? svalBuilder.evalMinus(X.castAs<NonLoc>()) : X;
491  }
492 
494  return X.isValid() ? svalBuilder.evalComplement(X.castAs<NonLoc>()) : X;
495  }
496 
498  const LocationContext *LCtx, QualType T,
499  QualType ExTy, const CastExpr *CastE,
500  StmtNodeBuilder &Bldr,
501  ExplodedNode *Pred);
502 
504  const LocationContext *LCtx,
505  const CastExpr *CastE,
506  StmtNodeBuilder &Bldr,
507  ExplodedNode *Pred);
508 
510  const UnaryOperator* U,
511  StmtNodeBuilder &Bldr);
512 
513 public:
514 
516  NonLoc L, NonLoc R, QualType T) {
517  return svalBuilder.evalBinOpNN(state, op, L, R, T);
518  }
519 
521  NonLoc L, SVal R, QualType T) {
522  return R.isValid() ? svalBuilder.evalBinOpNN(state, op, L,
523  R.castAs<NonLoc>(), T) : R;
524  }
525 
527  SVal LHS, SVal RHS, QualType T) {
528  return svalBuilder.evalBinOp(ST, Op, LHS, RHS, T);
529  }
530 
531 protected:
532  /// evalBind - Handle the semantics of binding a value to a specific location.
533  /// This method is used by evalStore, VisitDeclStmt, and others.
534  void evalBind(ExplodedNodeSet &Dst, const Stmt *StoreE, ExplodedNode *Pred,
535  SVal location, SVal Val, bool atDeclInit = false,
536  const ProgramPoint *PP = nullptr);
537 
538  /// Call PointerEscape callback when a value escapes as a result of bind.
540  SVal Loc,
541  SVal Val,
542  const LocationContext *LCtx) override;
543  /// Call PointerEscape callback when a value escapes as a result of
544  /// region invalidation.
545  /// \param[in] ITraits Specifies invalidation traits for regions/symbols.
547  ProgramStateRef State,
548  const InvalidatedSymbols *Invalidated,
549  ArrayRef<const MemRegion *> ExplicitRegions,
551  const CallEvent *Call,
552  RegionAndSymbolInvalidationTraits &ITraits) override;
553 
554 public:
555  // FIXME: 'tag' should be removed, and a LocationContext should be used
556  // instead.
557  // FIXME: Comment on the meaning of the arguments, when 'St' may not
558  // be the same as Pred->state, and when 'location' may not be the
559  // same as state->getLValue(Ex).
560  /// Simulate a read of the result of Ex.
561  void evalLoad(ExplodedNodeSet &Dst,
562  const Expr *NodeEx, /* Eventually will be a CFGStmt */
563  const Expr *BoundExpr,
564  ExplodedNode *Pred,
565  ProgramStateRef St,
566  SVal location,
567  const ProgramPointTag *tag = nullptr,
568  QualType LoadTy = QualType());
569 
570  // FIXME: 'tag' should be removed, and a LocationContext should be used
571  // instead.
572  void evalStore(ExplodedNodeSet &Dst, const Expr *AssignE, const Expr *StoreE,
573  ExplodedNode *Pred, ProgramStateRef St, SVal TargetLV, SVal Val,
574  const ProgramPointTag *tag = nullptr);
575 
576  /// Return the CFG element corresponding to the worklist element
577  /// that is currently being processed by ExprEngine.
579  return (*currBldrCtx->getBlock())[currStmtIdx];
580  }
581 
582  /// \brief Create a new state in which the call return value is binded to the
583  /// call origin expression.
585  const LocationContext *LCtx,
586  ProgramStateRef State);
587 
588  /// Evaluate a call, running pre- and post-call checks and allowing checkers
589  /// to be responsible for handling the evaluation of the call itself.
590  void evalCall(ExplodedNodeSet &Dst, ExplodedNode *Pred,
591  const CallEvent &Call);
592 
593  /// \brief Default implementation of call evaluation.
595  const CallEvent &Call,
596  const EvalCallOptions &CallOpts = {});
597 
598 private:
599  void evalLoadCommon(ExplodedNodeSet &Dst,
600  const Expr *NodeEx, /* Eventually will be a CFGStmt */
601  const Expr *BoundEx,
602  ExplodedNode *Pred,
603  ProgramStateRef St,
604  SVal location,
605  const ProgramPointTag *tag,
606  QualType LoadTy);
607 
608  // FIXME: 'tag' should be removed, and a LocationContext should be used
609  // instead.
610  void evalLocation(ExplodedNodeSet &Dst,
611  const Stmt *NodeEx, /* This will eventually be a CFGStmt */
612  const Stmt *BoundEx,
613  ExplodedNode *Pred,
614  ProgramStateRef St, SVal location,
615  const ProgramPointTag *tag, bool isLoad);
616 
617  /// Count the stack depth and determine if the call is recursive.
618  void examineStackFrames(const Decl *D, const LocationContext *LCtx,
619  bool &IsRecursive, unsigned &StackDepth);
620 
621  enum CallInlinePolicy {
622  CIP_Allowed,
623  CIP_DisallowedOnce,
624  CIP_DisallowedAlways
625  };
626 
627  /// \brief See if a particular call should be inlined, by only looking
628  /// at the call event and the current state of analysis.
629  CallInlinePolicy mayInlineCallKind(const CallEvent &Call,
630  const ExplodedNode *Pred,
631  AnalyzerOptions &Opts,
632  const EvalCallOptions &CallOpts);
633 
634  /// Checks our policies and decides weither the given call should be inlined.
635  bool shouldInlineCall(const CallEvent &Call, const Decl *D,
636  const ExplodedNode *Pred,
637  const EvalCallOptions &CallOpts = {});
638 
639  bool inlineCall(const CallEvent &Call, const Decl *D, NodeBuilder &Bldr,
640  ExplodedNode *Pred, ProgramStateRef State);
641 
642  /// \brief Conservatively evaluate call by invalidating regions and binding
643  /// a conjured return value.
644  void conservativeEvalCall(const CallEvent &Call, NodeBuilder &Bldr,
645  ExplodedNode *Pred, ProgramStateRef State);
646 
647  /// \brief Either inline or process the call conservatively (or both), based
648  /// on DynamicDispatchBifurcation data.
649  void BifurcateCall(const MemRegion *BifurReg,
650  const CallEvent &Call, const Decl *D, NodeBuilder &Bldr,
651  ExplodedNode *Pred);
652 
653  bool replayWithoutInlining(ExplodedNode *P, const LocationContext *CalleeLC);
654 
655  /// Models a trivial copy or move constructor or trivial assignment operator
656  /// call with a simple bind.
657  void performTrivialCopy(NodeBuilder &Bldr, ExplodedNode *Pred,
658  const CallEvent &Call);
659 
660  /// If the value of the given expression \p InitWithAdjustments is a NonLoc,
661  /// copy it into a new temporary object region, and replace the value of the
662  /// expression with that.
663  ///
664  /// If \p Result is provided, the new region will be bound to this expression
665  /// instead of \p InitWithAdjustments.
666  ProgramStateRef createTemporaryRegionIfNeeded(ProgramStateRef State,
667  const LocationContext *LC,
668  const Expr *InitWithAdjustments,
669  const Expr *Result = nullptr);
670 
671  /// Returns a region representing the first element of a (possibly
672  /// multi-dimensional) array, for the purposes of element construction or
673  /// destruction.
674  ///
675  /// On return, \p Ty will be set to the base type of the array.
676  ///
677  /// If the type is not an array type at all, the original value is returned.
678  /// Otherwise the "IsArray" flag is set.
679  static SVal makeZeroElementRegion(ProgramStateRef State, SVal LValue,
680  QualType &Ty, bool &IsArray);
681 
682  /// For a DeclStmt or CXXInitCtorInitializer, walk backward in the current CFG
683  /// block to find the constructor expression that directly constructed into
684  /// the storage for this statement. Returns null if the constructor for this
685  /// statement created a temporary object region rather than directly
686  /// constructing into an existing region.
687  const CXXConstructExpr *findDirectConstructorForCurrentCFGElement();
688 
689  /// For a given constructor, look forward in the current CFG block to
690  /// determine the region into which an object will be constructed by \p CE.
691  /// When the lookahead fails, a temporary region is returned, and the
692  /// IsConstructorWithImproperlyModeledTargetRegion flag is set in \p CallOpts.
693  const MemRegion *getRegionForConstructedObject(const CXXConstructExpr *CE,
694  ExplodedNode *Pred,
695  const ConstructionContext *CC,
696  EvalCallOptions &CallOpts);
697 
698  /// Store the region of a C++ temporary object corresponding to a
699  /// CXXBindTemporaryExpr for later destruction.
700  static ProgramStateRef addInitializedTemporary(
701  ProgramStateRef State, const CXXBindTemporaryExpr *BTE,
702  const LocationContext *LC, const CXXTempObjectRegion *R);
703 
704  /// Check if all initialized temporary regions are clear for the given
705  /// context range (including FromLC, not including ToLC).
706  /// This is useful for assertions.
707  static bool areInitializedTemporariesClear(ProgramStateRef State,
708  const LocationContext *FromLC,
709  const LocationContext *ToLC);
710 
711  /// Store the region returned by operator new() so that the constructor
712  /// that follows it knew what location to initialize. The value should be
713  /// cleared once the respective CXXNewExpr CFGStmt element is processed.
714  static ProgramStateRef
715  setCXXNewAllocatorValue(ProgramStateRef State, const CXXNewExpr *CNE,
716  const LocationContext *CallerLC, SVal V);
717 
718  /// Retrieve the location returned by the current operator new().
719  static SVal
720  getCXXNewAllocatorValue(ProgramStateRef State, const CXXNewExpr *CNE,
721  const LocationContext *CallerLC);
722 
723  /// Clear the location returned by the respective operator new(). This needs
724  /// to be done as soon as CXXNewExpr CFG block is evaluated.
725  static ProgramStateRef
726  clearCXXNewAllocatorValue(ProgramStateRef State, const CXXNewExpr *CNE,
727  const LocationContext *CallerLC);
728 
729  /// Check if all allocator values are clear for the given context range
730  /// (including FromLC, not including ToLC). This is useful for assertions.
731  static bool areCXXNewAllocatorValuesClear(ProgramStateRef State,
732  const LocationContext *FromLC,
733  const LocationContext *ToLC);
734 };
735 
736 /// Traits for storing the call processing policy inside GDM.
737 /// The GDM stores the corresponding CallExpr pointer.
738 // FIXME: This does not use the nice trait macros because it must be accessible
739 // from multiple translation units.
741 template <>
743  public ProgramStatePartialTrait<const void*> {
744  static void *GDMIndex() { static int index = 0; return &index; }
745 };
746 
747 } // end ento namespace
748 
749 } // end clang namespace
750 
751 #endif
This represents a GCC inline-assembly statement extension.
Definition: Stmt.h:1620
void VisitArraySubscriptExpr(const ArraySubscriptExpr *Ex, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitArraySubscriptExpr - Transfer function for array accesses.
void ProcessInitializer(const CFGInitializer I, ExplodedNode *Pred)
Definition: ExprEngine.cpp:689
A (possibly-)qualified type.
Definition: Type.h:653
MemRegion - The root abstract class for all memory regions.
Definition: MemRegion.h:79
bool IsTemporaryCtorOrDtor
This call is a constructor or a destructor of a temporary value.
Definition: ExprEngine.h:67
ProgramStateRef notifyCheckersOfPointerEscape(ProgramStateRef State, const InvalidatedSymbols *Invalidated, ArrayRef< const MemRegion *> ExplicitRegions, ArrayRef< const MemRegion *> Regions, const CallEvent *Call, RegionAndSymbolInvalidationTraits &ITraits) override
Call PointerEscape callback when a value escapes as a result of region invalidation.
CheckerManager * getCheckerManager() const
void VisitCallExpr(const CallExpr *CE, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitCall - Transfer function for function calls.
void processCallExit(ExplodedNode *Pred) override
Generate the sequence of nodes that simulate the call exit and the post visit for CallExpr...
bool ExecuteWorkList(const LocationContext *L, unsigned Steps, ProgramStateRef InitState)
ExecuteWorkList - Run the worklist algorithm for a maximum number of steps.
Definition: CoreEngine.cpp:222
Stmt - This represents one statement.
Definition: Stmt.h:66
Information about invalidation for a particular region/symbol.
Definition: MemRegion.h:1389
BasicValueFactory & getBasicVals()
Definition: ProgramState.h:515
This builder class is useful for generating nodes that resulted from visiting a statement.
Definition: CoreEngine.h:350
C Language Family Type Representation.
Decl - This represents one declaration (or definition), e.g.
Definition: DeclBase.h:86
void VisitMSAsmStmt(const MSAsmStmt *A, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitMSAsmStmt - Transfer function logic for MS inline asm.
Represents a point when we begin processing an inlined call.
Definition: ProgramPoint.h:600
StringRef P
bool ExecuteWorkListWithInitialState(const LocationContext *L, unsigned Steps, ProgramStateRef InitState, ExplodedNodeSet &Dst)
Execute the work list with an initial state.
Definition: ExprEngine.h:130
SVal evalBinOp(ProgramStateRef state, BinaryOperator::Opcode op, NonLoc L, NonLoc R, QualType T)
Definition: ExprEngine.h:515
void processCleanupTemporaryBranch(const CXXBindTemporaryExpr *BTE, NodeBuilderContext &BldCtx, ExplodedNode *Pred, ExplodedNodeSet &Dst, const CFGBlock *DstT, const CFGBlock *DstF) override
Called by CoreEngine.
Definition: ExprEngine.cpp:988
CFGDeleteDtor - Represents C++ object destructor generated from a call to delete. ...
Definition: CFG.h:366
Hints for figuring out of a call should be inlined during evalCall().
Definition: ExprEngine.h:59
Represents a call to a C++ constructor.
Definition: ExprCXX.h:1239
bool IsArrayCtorOrDtor
This call is a constructor or a destructor for a single element within an array, a part of array cons...
Definition: ExprEngine.h:65
void ProcessMemberDtor(const CFGMemberDtor D, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Definition: ExprEngine.cpp:915
Represents a prvalue temporary that is written into memory so that a reference can bind to it...
Definition: ExprCXX.h:4039
void processCFGBlockEntrance(const BlockEdge &L, NodeBuilderWithSinks &nodeBuilder, ExplodedNode *Pred) override
Called by CoreEngine when processing the entrance of a CFGBlock.
ProgramStateRef getInitialState(const LocationContext *InitLoc) override
getInitialState - Return the initial state used for the root vertex in the ExplodedGraph.
Definition: ExprEngine.cpp:124
void VisitUnaryOperator(const UnaryOperator *B, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitUnaryOperator - Transfer function logic for unary operators.
void handleUOExtension(ExplodedNodeSet::iterator I, const UnaryOperator *U, StmtNodeBuilder &Bldr)
CompoundLiteralExpr - [C99 6.5.2.5].
Definition: Expr.h:2650
void ProcessDeleteDtor(const CFGDeleteDtor D, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Definition: ExprEngine.cpp:858
const NodeBuilderContext & getBuilderContext()
Definition: ExprEngine.h:149
void evalStore(ExplodedNodeSet &Dst, const Expr *AssignE, const Expr *StoreE, ExplodedNode *Pred, ProgramStateRef St, SVal TargetLV, SVal Val, const ProgramPointTag *tag=nullptr)
evalStore - Handle the semantics of a store via an assignment.
bool ExecuteWorkListWithInitialState(const LocationContext *L, unsigned Steps, ProgramStateRef InitState, ExplodedNodeSet &Dst)
Returns true if there is still simulation state on the worklist.
Definition: CoreEngine.cpp:343
void removeDead(ExplodedNode *Node, ExplodedNodeSet &Out, const Stmt *ReferenceStmt, const LocationContext *LC, const Stmt *DiagnosticStmt=nullptr, ProgramPoint::Kind K=ProgramPoint::PreStmtPurgeDeadSymbolsKind)
Run the analyzer&#39;s garbage collection - remove dead symbols and bindings from the state...
Definition: ExprEngine.cpp:547
void VisitCXXThisExpr(const CXXThisExpr *TE, ExplodedNode *Pred, ExplodedNodeSet &Dst)
BoundNodesTreeBuilder Nodes
void ProcessTemporaryDtor(const CFGTemporaryDtor D, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Definition: ExprEngine.cpp:939
void ProcessLoopExit(const Stmt *S, ExplodedNode *Pred)
Definition: ExprEngine.cpp:671
void GenerateAutoTransition(ExplodedNode *N)
bool hasWorkRemaining() const
Definition: CoreEngine.h:143
Follow the default settings for inlining callees.
Definition: ExprEngine.h:53
Holds long-lived AST nodes (such as types and decls) that can be referred to throughout the semantic ...
Definition: ASTContext.h:149
LineState State
CFGAutomaticObjDtor - Represents C++ object destructor implicitly generated for automatic object or t...
Definition: CFG.h:340
bool hasEmptyWorkList() const
Definition: ExprEngine.h:339
void ProcessImplicitDtor(const CFGImplicitDtor D, ExplodedNode *Pred)
Definition: ExprEngine.cpp:778
bool wasBlocksExhausted() const
Definition: ExprEngine.h:338
i32 captured_struct **param SharedsTy A type which contains references the shared variables *param Shareds Context with the list of shared variables from the p *TaskFunction *param Data Additional data for task generation like final * state
ProgramStateRef processPointerEscapedOnBind(ProgramStateRef State, SVal Loc, SVal Val, const LocationContext *LCtx) override
Call PointerEscape callback when a value escapes as a result of bind.
Describes an C or C++ initializer list.
Definition: Expr.h:3885
void VisitOffsetOfExpr(const OffsetOfExpr *Ex, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitOffsetOfExpr - Transfer function for offsetof.
BinaryOperatorKind
WorkList * getWorkList() const
Definition: CoreEngine.h:153
CFGElement getCurrentCFGElement()
Return the CFG element corresponding to the worklist element that is currently being processed by Exp...
Definition: ExprEngine.h:578
A builtin binary operation expression such as "x + y" or "x <= y".
Definition: Expr.h:2998
const Stmt * getStmt() const
void VisitReturnStmt(const ReturnStmt *R, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitReturnStmt - Transfer function logic for return statements.
const CoreEngine & getCoreEngine() const
Definition: ExprEngine.h:342
CastExpr - Base class for type casts, including both implicit casts (ImplicitCastExpr) and explicit c...
Definition: Expr.h:2723
void ProcessNewAllocator(const CXXNewExpr *NE, ExplodedNode *Pred)
Definition: ExprEngine.cpp:805
void ProcessAutomaticObjDtor(const CFGAutomaticObjDtor D, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Definition: ExprEngine.cpp:824
Represents binding an expression to a temporary.
Definition: ExprCXX.h:1196
SVal evalComplement(SVal X)
Definition: ExprEngine.h:493
A C++ lambda expression, which produces a function object (of unspecified type) that can be invoked l...
Definition: ExprCXX.h:1583
void VisitDeclStmt(const DeclStmt *DS, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitDeclStmt - Transfer function logic for DeclStmts.
ASTContext & getASTContext() override
void processStaticInitializer(const DeclStmt *DS, NodeBuilderContext &BuilderCtx, ExplodedNode *Pred, ExplodedNodeSet &Dst, const CFGBlock *DstT, const CFGBlock *DstF) override
Called by CoreEngine.
Represents the this expression in C++.
Definition: ExprCXX.h:945
void evalBind(ExplodedNodeSet &Dst, const Stmt *StoreE, ExplodedNode *Pred, SVal location, SVal Val, bool atDeclInit=false, const ProgramPoint *PP=nullptr)
evalBind - Handle the semantics of binding a value to a specific location.
CheckerManager & getCheckerManager() const
Definition: ExprEngine.h:141
void VisitLogicalExpr(const BinaryOperator *B, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitLogicalExpr - Transfer function logic for &#39;&&&#39;, &#39;||&#39;.
void removeDeadOnEndOfFunction(NodeBuilderContext &BC, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Remove dead bindings/symbols before exiting a function.
ProgramStateRef bindReturnValue(const CallEvent &Call, const LocationContext *LCtx, ProgramStateRef State)
Create a new state in which the call return value is binded to the call origin expression.
void GenerateCallExitNode(ExplodedNode *N)
void VisitCXXCatchStmt(const CXXCatchStmt *CS, ExplodedNode *Pred, ExplodedNodeSet &Dst)
UnaryExprOrTypeTraitExpr - expression with either a type or (unevaluated) expression operand...
Definition: Expr.h:2040
SVal evalBinOp(ProgramStateRef ST, BinaryOperator::Opcode Op, SVal LHS, SVal RHS, QualType T)
Definition: ExprEngine.h:526
CFGBlock - Represents a single basic block in a source-level CFG.
Definition: CFG.h:509
void VisitInitListExpr(const InitListExpr *E, ExplodedNode *Pred, ExplodedNodeSet &Dst)
InliningModes
The modes of inlining, which override the default analysis-wide settings.
Definition: ExprEngine.h:51
void ProcessBaseDtor(const CFGBaseDtor D, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Definition: ExprEngine.cpp:896
void processSwitch(SwitchNodeBuilder &builder) override
ProcessSwitch - Called by CoreEngine.
void printState(raw_ostream &Out, ProgramStateRef State, const char *NL, const char *Sep, const LocationContext *LCtx=nullptr) override
printState - Called by ProgramStateManager to print checker-specific data.
Definition: ExprEngine.cpp:459
void processBeginOfFunction(NodeBuilderContext &BC, ExplodedNode *Pred, ExplodedNodeSet &Dst, const BlockEdge &L) override
Called by CoreEngine.
Expr - This represents one expression.
Definition: Expr.h:106
virtual SVal evalMinus(NonLoc val)=0
void VisitLvalObjCIvarRefExpr(const ObjCIvarRefExpr *DR, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Transfer function logic for computing the lvalue of an Objective-C ivar.
void VisitCXXNewExpr(const CXXNewExpr *CNE, ExplodedNode *Pred, ExplodedNodeSet &Dst)
const FunctionProtoType * T
void VisitCXXNewAllocatorCall(const CXXNewExpr *CNE, ExplodedNode *Pred, ExplodedNodeSet &Dst)
void VisitCast(const CastExpr *CastE, const Expr *Ex, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitCast - Transfer function logic for all casts (implicit and explicit).
BlockExpr - Adaptor class for mixing a BlockDecl with expressions.
Definition: Expr.h:4864
This is the simplest builder which generates nodes in the ExplodedGraph.
Definition: CoreEngine.h:212
bool isValid() const
Definition: SVals.h:137
Represents Objective-C&#39;s @synchronized statement.
Definition: StmtObjC.h:262
void Visit(const Stmt *S, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Visit - Transfer function logic for all statements.
std::pair< const ProgramPointTag *, const ProgramPointTag * > geteagerlyAssumeBinOpBifurcationTags()
ASTContext & getContext() const
getContext - Return the ASTContext associated with this analysis.
Definition: ExprEngine.h:137
Traits for storing the call processing policy inside GDM.
Definition: ExprEngine.h:740
ReturnStmt - This represents a return, optionally of an expression: return; return 4;...
Definition: Stmt.h:1417
SVal evalBinOp(ProgramStateRef state, BinaryOperator::Opcode op, SVal lhs, SVal rhs, QualType type)
An expression that sends a message to the given Objective-C object or class.
Definition: ExprObjC.h:903
void VisitAtomicExpr(const AtomicExpr *E, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitAtomicExpr - Transfer function for builtin atomic expressions.
This represents a Microsoft inline-assembly statement extension.
Definition: Stmt.h:1799
UnaryOperator - This represents the unary-expression&#39;s (except sizeof and alignof), the postinc/postdec operators from postfix-expression, and various extensions.
Definition: Expr.h:1717
void evalLoad(ExplodedNodeSet &Dst, const Expr *NodeEx, const Expr *BoundExpr, ExplodedNode *Pred, ProgramStateRef St, SVal location, const ProgramPointTag *tag=nullptr, QualType LoadTy=QualType())
Simulate a read of the result of Ex.
CFGBaseDtor - Represents C++ object destructor implicitly generated for base object in destructor...
Definition: CFG.h:392
SymbolManager & getSymbolManager()
Definition: ExprEngine.h:334
void processEndOfFunction(NodeBuilderContext &BC, ExplodedNode *Pred, const ReturnStmt *RS=nullptr) override
Called by CoreEngine.
BugReporter is a utility class for generating PathDiagnostics for analysis.
Definition: BugReporter.h:403
void processCFGElement(const CFGElement E, ExplodedNode *Pred, unsigned StmtIdx, NodeBuilderContext *Ctx) override
processCFGElement - Called by CoreEngine.
Definition: ExprEngine.cpp:487
void VisitGuardedExpr(const Expr *Ex, const Expr *L, const Expr *R, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitGuardedExpr - Transfer function logic for ?, __builtin_choose.
ProgramPoints can be "tagged" as representing points specific to a given analysis entity...
Definition: ProgramPoint.h:40
AnalysisManager & getAnalysisManager() override
Definition: ExprEngine.h:139
void evalEagerlyAssumeBinOpBifurcation(ExplodedNodeSet &Dst, ExplodedNodeSet &Src, const Expr *Ex)
evalEagerlyAssumeBinOpBifurcation - Given the nodes in &#39;Src&#39;, eagerly assume symbolic expressions of ...
bool wasBlocksExhausted() const
Definition: CoreEngine.h:142
Represents a new-expression for memory allocation and constructor calls, e.g: "new CXXNewExpr(foo)"...
Definition: ExprCXX.h:1845
virtual bool hasWork() const =0
DeclStmt - Adaptor class for mixing declarations with statements and expressions. ...
Definition: Stmt.h:487
void VisitCompoundLiteralExpr(const CompoundLiteralExpr *CL, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitCompoundLiteralExpr - Transfer function logic for compound literals.
void processIndirectGoto(IndirectGotoNodeBuilder &builder) override
processIndirectGoto - Called by CoreEngine.
void evalCall(ExplodedNodeSet &Dst, ExplodedNode *Pred, const CallEvent &Call)
Evaluate a call, running pre- and post-call checks and allowing checkers to be responsible for handli...
ProgramStateRef handleLVectorSplat(ProgramStateRef state, const LocationContext *LCtx, const CastExpr *CastE, StmtNodeBuilder &Bldr, ExplodedNode *Pred)
void VisitCXXDeleteExpr(const CXXDeleteExpr *CDE, ExplodedNode *Pred, ExplodedNodeSet &Dst)
void processBranch(const Stmt *Condition, const Stmt *Term, NodeBuilderContext &BuilderCtx, ExplodedNode *Pred, ExplodedNodeSet &Dst, const CFGBlock *DstT, const CFGBlock *DstF) override
ProcessBranch - Called by CoreEngine.
bool IsCtorOrDtorWithImproperlyModeledTargetRegion
This call is a constructor or a destructor for which we do not currently compute the this-region corr...
Definition: ExprEngine.h:62
SVal - This represents a symbolic expression, which can be either an L-value or an R-value...
Definition: SVals.h:63
AtomicExpr - Variadic atomic builtins: __atomic_exchange, __atomic_fetch_*, __atomic_load, __atomic_store, and __atomic_compare_exchange_*, for the similarly-named C++11 instructions, and __c11 variants for <stdatomic.h>, and corresponding __opencl_atomic_* for OpenCL 2.0.
Definition: Expr.h:5116
void VisitUnaryExprOrTypeTraitExpr(const UnaryExprOrTypeTraitExpr *Ex, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitUnaryExprOrTypeTraitExpr - Transfer function for sizeof.
void VisitObjCForCollectionStmt(const ObjCForCollectionStmt *S, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitObjCForCollectionStmt - Transfer function logic for ObjCForCollectionStmt.
BugReporter & getBugReporter()
Definition: ExprEngine.h:147
Do minimal inlining of callees.
Definition: ExprEngine.h:55
BasicValueFactory & getBasicVals()
Definition: ExprEngine.h:329
virtual SVal evalBinOpNN(ProgramStateRef state, BinaryOperator::Opcode op, NonLoc lhs, NonLoc rhs, QualType resultTy)=0
Create a new value which represents a binary expression with two non- location operands.
bool ExecuteWorkList(const LocationContext *L, unsigned Steps=150000)
Returns true if there is still simulation state on the worklist.
Definition: ExprEngine.h:122
ast_type_traits::DynTypedNode Node
CoreEngine - Implements the core logic of the graph-reachability analysis.
Definition: CoreEngine.h:44
void enqueueEndOfPath(ExplodedNodeSet &S)
const SymbolManager & getSymbolManager() const
Definition: ExprEngine.h:335
Dataflow Directional Tag Classes.
void ProcessStmt(const Stmt *S, ExplodedNode *Pred)
Definition: ExprEngine.cpp:640
void VisitIncrementDecrementOperator(const UnaryOperator *U, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Handle ++ and – (both pre- and post-increment).
SValBuilder & getSValBuilder()
Definition: ExprEngine.h:145
Represents a delete expression for memory deallocation and destructor calls, e.g. ...
Definition: ExprCXX.h:2074
StoreManager & getStoreManager()
Definition: ExprEngine.h:322
ProgramStateRef processRegionChanges(ProgramStateRef state, const InvalidatedSymbols *invalidated, ArrayRef< const MemRegion *> ExplicitRegions, ArrayRef< const MemRegion *> Regions, const LocationContext *LCtx, const CallEvent *Call) override
processRegionChanges - Called by ProgramStateManager whenever a change is made to the store...
Definition: ExprEngine.cpp:408
void VisitCXXDestructor(QualType ObjectType, const MemRegion *Dest, const Stmt *S, bool IsBaseDtor, ExplodedNode *Pred, ExplodedNodeSet &Dst, const EvalCallOptions &Options)
bool hasWorkRemaining() const
Definition: ExprEngine.h:340
This node builder keeps track of the generated sink nodes.
Definition: CoreEngine.h:314
const ExplodedGraph & getGraph() const
Definition: ExprEngine.h:174
void VisitLambdaExpr(const LambdaExpr *LE, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitLambdaExpr - Transfer function logic for LambdaExprs.
Represents an abstract call to a function or method along a particular path.
Definition: CallEvent.h:140
ExprEngine(AnalysisManager &mgr, bool gcEnabled, SetOfConstDecls *VisitedCalleesIn, FunctionSummariesTy *FS, InliningModes HowToInlineIn)
Definition: ExprEngine.cpp:90
ProgramStateManager & getStateManager() override
Definition: ExprEngine.h:320
void defaultEvalCall(NodeBuilder &B, ExplodedNode *Pred, const CallEvent &Call, const EvalCallOptions &CallOpts={})
Default implementation of call evaluation.
ConstraintManager & getConstraintManager()
Definition: ProgramState.h:542
ProgramStateRef handleLValueBitCast(ProgramStateRef state, const Expr *Ex, const LocationContext *LCtx, QualType T, QualType ExTy, const CastExpr *CastE, StmtNodeBuilder &Bldr, ExplodedNode *Pred)
T castAs() const
Convert to the specified SVal type, asserting that this SVal is of the desired type.
Definition: SVals.h:92
SVal evalMinus(SVal X)
Definition: ExprEngine.h:489
ArraySubscriptExpr - [C99 6.5.2.1] Array Subscripting.
Definition: Expr.h:2130
Represents Objective-C&#39;s collection statement.
Definition: StmtObjC.h:24
void VisitCXXConstructExpr(const CXXConstructExpr *E, ExplodedNode *Pred, ExplodedNodeSet &Dst)
void VisitObjCAtSynchronizedStmt(const ObjCAtSynchronizedStmt *S, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Transfer function logic for ObjCAtSynchronizedStmts.
void VisitObjCMessage(const ObjCMessageExpr *ME, ExplodedNode *Pred, ExplodedNodeSet &Dst)
ObjCIvarRefExpr - A reference to an ObjC instance variable.
Definition: ExprObjC.h:513
X
Add a minimal nested name specifier fixit hint to allow lookup of a tag name from an outer enclosing ...
Definition: SemaDecl.cpp:13401
void VisitBlockExpr(const BlockExpr *BE, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitBlockExpr - Transfer function logic for BlockExprs.
MemberExpr - [C99 6.5.2.3] Structure and Union Members.
Definition: Expr.h:2400
virtual SVal evalComplement(NonLoc val)=0
CFGImplicitDtor - Represents C++ object destructor implicitly generated by compiler on various occasi...
Definition: CFG.h:315
SVal evalBinOp(ProgramStateRef state, BinaryOperator::Opcode op, NonLoc L, SVal R, QualType T)
Definition: ExprEngine.h:520
CXXCatchStmt - This represents a C++ catch block.
Definition: StmtCXX.h:29
CFGElement - Represents a top-level expression in a basic block.
Definition: CFG.h:54
ProgramStateRef processAssume(ProgramStateRef state, SVal cond, bool assumption) override
evalAssume - Callback function invoked by the ConstraintManager when making assumptions about state v...
Definition: ExprEngine.cpp:402
CFGMemberDtor - Represents C++ object destructor implicitly generated for member object in destructor...
Definition: CFG.h:413
CallExpr - Represents a function call (C99 6.5.2.2, C++ [expr.call]).
Definition: Expr.h:2218
void processEndWorklist(bool hasWorkRemaining) override
Called by CoreEngine when the analysis worklist has terminated.
Definition: ExprEngine.cpp:483
void VisitCommonDeclRefExpr(const Expr *DR, const NamedDecl *D, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Transfer function logic for DeclRefExprs and BlockDeclRefExprs.
CFGInitializer - Represents C++ base or member initializer from constructor&#39;s initialization list...
Definition: CFG.h:225
ExplodedGraph & getGraph()
Definition: ExprEngine.h:173
void VisitGCCAsmStmt(const GCCAsmStmt *A, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitGCCAsmStmt - Transfer function logic for inline asm.
void VisitMemberExpr(const MemberExpr *M, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitMemberExpr - Transfer function for member expressions.
This represents a decl that may have a name.
Definition: Decl.h:248
void ViewGraph(bool trim=false)
Visualize the ExplodedGraph created by executing the simulation.
ConstraintManager & getConstraintManager()
Definition: ExprEngine.h:324
OffsetOfExpr - [C99 7.17] - This represents an expression of the form offsetof(record-type, member-designator).
Definition: Expr.h:1935
void VisitBinaryOperator(const BinaryOperator *B, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitBinaryOperator - Transfer function logic for binary operators.
Definition: ExprEngineC.cpp:41
void CreateCXXTemporaryObject(const MaterializeTemporaryExpr *ME, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Create a C++ temporary object for an rvalue.
CFGTemporaryDtor - Represents C++ object destructor implicitly generated at the end of full expressio...
Definition: CFG.h:434
void processCallEnter(NodeBuilderContext &BC, CallEnter CE, ExplodedNode *Pred) override
Generate the entry node of the callee.
const CFGBlock * getBlock() const
Return the CFGBlock associated with this builder.
Definition: CoreEngine.h:192