clang  15.0.0git
ExprEngine.h
Go to the documentation of this file.
1 //===- ExprEngine.h - Path-Sensitive Expression-Level Dataflow --*- C++ -*-===//
2 //
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6 //
7 //===----------------------------------------------------------------------===//
8 //
9 // This file defines a meta-engine for path-sensitive dataflow analysis that
10 // is built on CoreEngine, but provides the boilerplate to execute transfer
11 // functions and build the ExplodedGraph at the expression level.
12 //
13 //===----------------------------------------------------------------------===//
14 
15 #ifndef LLVM_CLANG_STATICANALYZER_CORE_PATHSENSITIVE_EXPRENGINE_H
16 #define LLVM_CLANG_STATICANALYZER_CORE_PATHSENSITIVE_EXPRENGINE_H
17 
18 #include "clang/AST/Expr.h"
19 #include "clang/AST/Type.h"
20 #include "clang/Analysis/CFG.h"
23 #include "clang/Basic/LLVM.h"
37 #include "llvm/ADT/ArrayRef.h"
38 #include <cassert>
39 #include <utility>
40 
41 namespace clang {
42 
43 class AnalysisDeclContextManager;
44 class AnalyzerOptions;
45 class ASTContext;
46 class CFGBlock;
47 class CFGElement;
48 class ConstructionContext;
49 class CXXBindTemporaryExpr;
50 class CXXCatchStmt;
51 class CXXConstructExpr;
52 class CXXDeleteExpr;
53 class CXXNewExpr;
54 class CXXThisExpr;
55 class Decl;
56 class DeclStmt;
57 class GCCAsmStmt;
58 class LambdaExpr;
59 class LocationContext;
60 class MaterializeTemporaryExpr;
61 class MSAsmStmt;
62 class NamedDecl;
63 class ObjCAtSynchronizedStmt;
64 class ObjCForCollectionStmt;
65 class ObjCIvarRefExpr;
66 class ObjCMessageExpr;
67 class ReturnStmt;
68 class Stmt;
69 
70 namespace cross_tu {
71 
72 class CrossTranslationUnitContext;
73 
74 } // namespace cross_tu
75 
76 namespace ento {
77 
78 class AnalysisManager;
79 class BasicValueFactory;
80 class CallEvent;
81 class CheckerManager;
82 class ConstraintManager;
83 class ExplodedNodeSet;
84 class ExplodedNode;
85 class IndirectGotoNodeBuilder;
86 class MemRegion;
87 struct NodeBuilderContext;
88 class NodeBuilderWithSinks;
89 class ProgramState;
90 class ProgramStateManager;
91 class RegionAndSymbolInvalidationTraits;
92 class SymbolManager;
93 class SwitchNodeBuilder;
94 
95 /// Hints for figuring out of a call should be inlined during evalCall().
97  /// This call is a constructor or a destructor for which we do not currently
98  /// compute the this-region correctly.
100 
101  /// This call is a constructor or a destructor for a single element within
102  /// an array, a part of array construction or destruction.
103  bool IsArrayCtorOrDtor = false;
104 
105  /// This call is a constructor or a destructor of a temporary value.
106  bool IsTemporaryCtorOrDtor = false;
107 
108  /// This call is a constructor for a temporary that is lifetime-extended
109  /// by binding it to a reference-type field within an aggregate,
110  /// for example 'A { const C &c; }; A a = { C() };'
112 
113  /// This call is a pre-C++17 elidable constructor that we failed to elide
114  /// because we failed to compute the target region into which
115  /// this constructor would have been ultimately elided. Analysis that
116  /// we perform in this case is still correct but it behaves differently,
117  /// as if copy elision is disabled.
119 
121 };
122 
123 class ExprEngine {
124  void anchor();
125 
126 public:
127  /// The modes of inlining, which override the default analysis-wide settings.
129  /// Follow the default settings for inlining callees.
131 
132  /// Do minimal inlining of callees.
134  };
135 
136 private:
138  bool IsCTUEnabled;
139 
140  AnalysisManager &AMgr;
141 
142  AnalysisDeclContextManager &AnalysisDeclContexts;
143 
144  CoreEngine Engine;
145 
146  /// G - the simulation graph.
147  ExplodedGraph &G;
148 
149  /// StateMgr - Object that manages the data for all created states.
150  ProgramStateManager StateMgr;
151 
152  /// SymMgr - Object that manages the symbol information.
153  SymbolManager &SymMgr;
154 
155  /// MRMgr - MemRegionManager object that creates memory regions.
156  MemRegionManager &MRMgr;
157 
158  /// svalBuilder - SValBuilder object that creates SVals from expressions.
159  SValBuilder &svalBuilder;
160 
161  unsigned int currStmtIdx = 0;
162  const NodeBuilderContext *currBldrCtx = nullptr;
163 
164  /// Helper object to determine if an Objective-C message expression
165  /// implicitly never returns.
166  ObjCNoReturn ObjCNoRet;
167 
168  /// The BugReporter associated with this engine. It is important that
169  /// this object be placed at the very end of member variables so that its
170  /// destructor is called before the rest of the ExprEngine is destroyed.
172 
173  /// The functions which have been analyzed through inlining. This is owned by
174  /// AnalysisConsumer. It can be null.
175  SetOfConstDecls *VisitedCallees;
176 
177  /// The flag, which specifies the mode of inlining for the engine.
178  InliningModes HowToInline;
179 
180 public:
182  SetOfConstDecls *VisitedCalleesIn,
183  FunctionSummariesTy *FS, InliningModes HowToInlineIn);
184 
185  virtual ~ExprEngine() = default;
186 
187  /// Returns true if there is still simulation state on the worklist.
188  bool ExecuteWorkList(const LocationContext *L, unsigned Steps = 150000) {
189  return Engine.ExecuteWorkList(L, Steps, nullptr);
190  }
191 
192  /// Execute the work list with an initial state. Nodes that reaches the exit
193  /// of the function are added into the Dst set, which represent the exit
194  /// state of the function call. Returns true if there is still simulation
195  /// state on the worklist.
196  bool ExecuteWorkListWithInitialState(const LocationContext *L, unsigned Steps,
197  ProgramStateRef InitState,
198  ExplodedNodeSet &Dst) {
199  return Engine.ExecuteWorkListWithInitialState(L, Steps, InitState, Dst);
200  }
201 
202  /// getContext - Return the ASTContext associated with this analysis.
203  ASTContext &getContext() const { return AMgr.getASTContext(); }
204 
206 
208  return AMgr.getAnalysisDeclContextManager();
209  }
210 
212  return *AMgr.getCheckerManager();
213  }
214 
215  SValBuilder &getSValBuilder() { return svalBuilder; }
216 
217  BugReporter &getBugReporter() { return BR; }
218 
221  return &CTU;
222  }
223 
225  assert(currBldrCtx);
226  return *currBldrCtx;
227  }
228 
229  const Stmt *getStmt() const;
230 
232  assert(G.roots_begin() != G.roots_end());
233  return (*G.roots_begin())->getLocation().getLocationContext();
234  }
235 
239 
240 
241  /// Dump graph to the specified filename.
242  /// If filename is empty, generate a temporary one.
243  /// \return The filename the graph is written into.
244  std::string DumpGraph(bool trim = false, StringRef Filename="");
245 
246  /// Dump the graph consisting of the given nodes to a specified filename.
247  /// Generate a temporary filename if it's not provided.
248  /// \return The filename the graph is written into.
250  StringRef Filename = "");
251 
252  /// Visualize the ExplodedGraph created by executing the simulation.
253  void ViewGraph(bool trim = false);
254 
255  /// Visualize a trimmed ExplodedGraph that only contains paths to the given
256  /// nodes.
258 
259  /// getInitialState - Return the initial state used for the root vertex
260  /// in the ExplodedGraph.
262 
263  ExplodedGraph &getGraph() { return G; }
264  const ExplodedGraph &getGraph() const { return G; }
265 
266  /// Run the analyzer's garbage collection - remove dead symbols and
267  /// bindings from the state.
268  ///
269  /// Checkers can participate in this process with two callbacks:
270  /// \c checkLiveSymbols and \c checkDeadSymbols. See the CheckerDocumentation
271  /// class for more information.
272  ///
273  /// \param Node The predecessor node, from which the processing should start.
274  /// \param Out The returned set of output nodes.
275  /// \param ReferenceStmt The statement which is about to be processed.
276  /// Everything needed for this statement should be considered live.
277  /// A null statement means that everything in child LocationContexts
278  /// is dead.
279  /// \param LC The location context of the \p ReferenceStmt. A null location
280  /// context means that we have reached the end of analysis and that
281  /// all statements and local variables should be considered dead.
282  /// \param DiagnosticStmt Used as a location for any warnings that should
283  /// occur while removing the dead (e.g. leaks). By default, the
284  /// \p ReferenceStmt is used.
285  /// \param K Denotes whether this is a pre- or post-statement purge. This
286  /// must only be ProgramPoint::PostStmtPurgeDeadSymbolsKind if an
287  /// entire location context is being cleared, in which case the
288  /// \p ReferenceStmt must either be a ReturnStmt or \c NULL. Otherwise,
289  /// it must be ProgramPoint::PreStmtPurgeDeadSymbolsKind (the default)
290  /// and \p ReferenceStmt must be valid (non-null).
292  const Stmt *ReferenceStmt, const LocationContext *LC,
293  const Stmt *DiagnosticStmt = nullptr,
295 
296  /// processCFGElement - Called by CoreEngine. Used to generate new successor
297  /// nodes by processing the 'effects' of a CFG element.
298  void processCFGElement(const CFGElement E, ExplodedNode *Pred,
299  unsigned StmtIdx, NodeBuilderContext *Ctx);
300 
301  void ProcessStmt(const Stmt *S, ExplodedNode *Pred);
302 
303  void ProcessLoopExit(const Stmt* S, ExplodedNode *Pred);
304 
305  void ProcessInitializer(const CFGInitializer I, ExplodedNode *Pred);
306 
307  void ProcessImplicitDtor(const CFGImplicitDtor D, ExplodedNode *Pred);
308 
309  void ProcessNewAllocator(const CXXNewExpr *NE, ExplodedNode *Pred);
310 
312  ExplodedNode *Pred, ExplodedNodeSet &Dst);
313  void ProcessDeleteDtor(const CFGDeleteDtor D,
314  ExplodedNode *Pred, ExplodedNodeSet &Dst);
315  void ProcessBaseDtor(const CFGBaseDtor D,
316  ExplodedNode *Pred, ExplodedNodeSet &Dst);
317  void ProcessMemberDtor(const CFGMemberDtor D,
318  ExplodedNode *Pred, ExplodedNodeSet &Dst);
320  ExplodedNode *Pred, ExplodedNodeSet &Dst);
321 
322  /// Called by CoreEngine when processing the entrance of a CFGBlock.
323  void processCFGBlockEntrance(const BlockEdge &L,
324  NodeBuilderWithSinks &nodeBuilder,
325  ExplodedNode *Pred);
326 
327  /// ProcessBranch - Called by CoreEngine. Used to generate successor
328  /// nodes by processing the 'effects' of a branch condition.
329  void processBranch(const Stmt *Condition,
330  NodeBuilderContext& BuilderCtx,
331  ExplodedNode *Pred,
332  ExplodedNodeSet &Dst,
333  const CFGBlock *DstT,
334  const CFGBlock *DstF);
335 
336  /// Called by CoreEngine.
337  /// Used to generate successor nodes for temporary destructors depending
338  /// on whether the corresponding constructor was visited.
340  NodeBuilderContext &BldCtx,
341  ExplodedNode *Pred, ExplodedNodeSet &Dst,
342  const CFGBlock *DstT,
343  const CFGBlock *DstF);
344 
345  /// Called by CoreEngine. Used to processing branching behavior
346  /// at static initializers.
347  void processStaticInitializer(const DeclStmt *DS,
348  NodeBuilderContext& BuilderCtx,
349  ExplodedNode *Pred,
350  ExplodedNodeSet &Dst,
351  const CFGBlock *DstT,
352  const CFGBlock *DstF);
353 
354  /// processIndirectGoto - Called by CoreEngine. Used to generate successor
355  /// nodes by processing the 'effects' of a computed goto jump.
357 
358  /// ProcessSwitch - Called by CoreEngine. Used to generate successor
359  /// nodes by processing the 'effects' of a switch statement.
360  void processSwitch(SwitchNodeBuilder& builder);
361 
362  /// Called by CoreEngine. Used to notify checkers that processing a
363  /// function has begun. Called for both inlined and and top-level functions.
365  ExplodedNode *Pred, ExplodedNodeSet &Dst,
366  const BlockEdge &L);
367 
368  /// Called by CoreEngine. Used to notify checkers that processing a
369  /// function has ended. Called for both inlined and and top-level functions.
371  ExplodedNode *Pred,
372  const ReturnStmt *RS = nullptr);
373 
374  /// Remove dead bindings/symbols before exiting a function.
376  ExplodedNode *Pred,
377  ExplodedNodeSet &Dst);
378 
379  /// Generate the entry node of the callee.
381  ExplodedNode *Pred);
382 
383  /// Generate the sequence of nodes that simulate the call exit and the post
384  /// visit for CallExpr.
385  void processCallExit(ExplodedNode *Pred);
386 
387  /// Called by CoreEngine when the analysis worklist has terminated.
388  void processEndWorklist();
389 
390  /// evalAssume - Callback function invoked by the ConstraintManager when
391  /// making assumptions about state values.
393  bool assumption);
394 
395  /// processRegionChanges - Called by ProgramStateManager whenever a change is made
396  /// to the store. Used to update checkers that track region values.
399  const InvalidatedSymbols *invalidated,
400  ArrayRef<const MemRegion *> ExplicitRegions,
402  const LocationContext *LCtx,
403  const CallEvent *Call);
404 
405  inline ProgramStateRef
407  const MemRegion* MR,
408  const LocationContext *LCtx) {
409  return processRegionChanges(state, nullptr, MR, MR, LCtx, nullptr);
410  }
411 
412  /// printJson - Called by ProgramStateManager to print checker-specific data.
413  void printJson(raw_ostream &Out, ProgramStateRef State,
414  const LocationContext *LCtx, const char *NL,
415  unsigned int Space, bool IsDot) const;
416 
417  ProgramStateManager &getStateManager() { return StateMgr; }
418 
419  StoreManager &getStoreManager() { return StateMgr.getStoreManager(); }
420 
422  return StateMgr.getConstraintManager();
423  }
424 
425  // FIXME: Remove when we migrate over to just using SValBuilder.
427  return StateMgr.getBasicVals();
428  }
429 
430  SymbolManager &getSymbolManager() { return SymMgr; }
431  MemRegionManager &getRegionManager() { return MRMgr; }
432 
433  DataTag::Factory &getDataTags() { return Engine.getDataTags(); }
434 
435  // Functions for external checking of whether we have unfinished work
436  bool wasBlocksExhausted() const { return Engine.wasBlocksExhausted(); }
437  bool hasEmptyWorkList() const { return !Engine.getWorkList()->hasWork(); }
438  bool hasWorkRemaining() const { return Engine.hasWorkRemaining(); }
439 
440  const CoreEngine &getCoreEngine() const { return Engine; }
441 
442 public:
443  /// Visit - Transfer function logic for all statements. Dispatches to
444  /// other functions that handle specific kinds of statements.
445  void Visit(const Stmt *S, ExplodedNode *Pred, ExplodedNodeSet &Dst);
446 
447  /// VisitArrayInitLoopExpr - Transfer function for array init loop.
449  ExplodedNodeSet &Dst);
450 
451  /// VisitArraySubscriptExpr - Transfer function for array accesses.
453  ExplodedNode *Pred,
454  ExplodedNodeSet &Dst);
455 
456  /// VisitGCCAsmStmt - Transfer function logic for inline asm.
457  void VisitGCCAsmStmt(const GCCAsmStmt *A, ExplodedNode *Pred,
458  ExplodedNodeSet &Dst);
459 
460  /// VisitMSAsmStmt - Transfer function logic for MS inline asm.
461  void VisitMSAsmStmt(const MSAsmStmt *A, ExplodedNode *Pred,
462  ExplodedNodeSet &Dst);
463 
464  /// VisitBlockExpr - Transfer function logic for BlockExprs.
465  void VisitBlockExpr(const BlockExpr *BE, ExplodedNode *Pred,
466  ExplodedNodeSet &Dst);
467 
468  /// VisitLambdaExpr - Transfer function logic for LambdaExprs.
469  void VisitLambdaExpr(const LambdaExpr *LE, ExplodedNode *Pred,
470  ExplodedNodeSet &Dst);
471 
472  /// VisitBinaryOperator - Transfer function logic for binary operators.
473  void VisitBinaryOperator(const BinaryOperator* B, ExplodedNode *Pred,
474  ExplodedNodeSet &Dst);
475 
476 
477  /// VisitCall - Transfer function for function calls.
478  void VisitCallExpr(const CallExpr *CE, ExplodedNode *Pred,
479  ExplodedNodeSet &Dst);
480 
481  /// VisitCast - Transfer function logic for all casts (implicit and explicit).
482  void VisitCast(const CastExpr *CastE, const Expr *Ex, ExplodedNode *Pred,
483  ExplodedNodeSet &Dst);
484 
485  /// VisitCompoundLiteralExpr - Transfer function logic for compound literals.
487  ExplodedNode *Pred, ExplodedNodeSet &Dst);
488 
489  /// Transfer function logic for DeclRefExprs and BlockDeclRefExprs.
490  void VisitCommonDeclRefExpr(const Expr *DR, const NamedDecl *D,
491  ExplodedNode *Pred, ExplodedNodeSet &Dst);
492 
493  /// VisitDeclStmt - Transfer function logic for DeclStmts.
494  void VisitDeclStmt(const DeclStmt *DS, ExplodedNode *Pred,
495  ExplodedNodeSet &Dst);
496 
497  /// VisitGuardedExpr - Transfer function logic for ?, __builtin_choose
498  void VisitGuardedExpr(const Expr *Ex, const Expr *L, const Expr *R,
499  ExplodedNode *Pred, ExplodedNodeSet &Dst);
500 
501  void VisitInitListExpr(const InitListExpr *E, ExplodedNode *Pred,
502  ExplodedNodeSet &Dst);
503 
504  /// VisitLogicalExpr - Transfer function logic for '&&', '||'
505  void VisitLogicalExpr(const BinaryOperator* B, ExplodedNode *Pred,
506  ExplodedNodeSet &Dst);
507 
508  /// VisitMemberExpr - Transfer function for member expressions.
509  void VisitMemberExpr(const MemberExpr *M, ExplodedNode *Pred,
510  ExplodedNodeSet &Dst);
511 
512  /// VisitAtomicExpr - Transfer function for builtin atomic expressions
513  void VisitAtomicExpr(const AtomicExpr *E, ExplodedNode *Pred,
514  ExplodedNodeSet &Dst);
515 
516  /// Transfer function logic for ObjCAtSynchronizedStmts.
518  ExplodedNode *Pred, ExplodedNodeSet &Dst);
519 
520  /// Transfer function logic for computing the lvalue of an Objective-C ivar.
522  ExplodedNodeSet &Dst);
523 
524  /// VisitObjCForCollectionStmt - Transfer function logic for
525  /// ObjCForCollectionStmt.
527  ExplodedNode *Pred, ExplodedNodeSet &Dst);
528 
529  void VisitObjCMessage(const ObjCMessageExpr *ME, ExplodedNode *Pred,
530  ExplodedNodeSet &Dst);
531 
532  /// VisitReturnStmt - Transfer function logic for return statements.
533  void VisitReturnStmt(const ReturnStmt *R, ExplodedNode *Pred,
534  ExplodedNodeSet &Dst);
535 
536  /// VisitOffsetOfExpr - Transfer function for offsetof.
537  void VisitOffsetOfExpr(const OffsetOfExpr *Ex, ExplodedNode *Pred,
538  ExplodedNodeSet &Dst);
539 
540  /// VisitUnaryExprOrTypeTraitExpr - Transfer function for sizeof.
542  ExplodedNode *Pred, ExplodedNodeSet &Dst);
543 
544  /// VisitUnaryOperator - Transfer function logic for unary operators.
545  void VisitUnaryOperator(const UnaryOperator* B, ExplodedNode *Pred,
546  ExplodedNodeSet &Dst);
547 
548  /// Handle ++ and -- (both pre- and post-increment).
550  ExplodedNode *Pred,
551  ExplodedNodeSet &Dst);
552 
554  ExplodedNodeSet &PreVisit,
555  ExplodedNodeSet &Dst);
556 
557  void VisitCXXCatchStmt(const CXXCatchStmt *CS, ExplodedNode *Pred,
558  ExplodedNodeSet &Dst);
559 
560  void VisitCXXThisExpr(const CXXThisExpr *TE, ExplodedNode *Pred,
561  ExplodedNodeSet & Dst);
562 
564  ExplodedNodeSet &Dst);
565 
567  ExplodedNode *Pred, ExplodedNodeSet &Dst);
568 
569  void VisitCXXDestructor(QualType ObjectType, const MemRegion *Dest,
570  const Stmt *S, bool IsBaseDtor,
571  ExplodedNode *Pred, ExplodedNodeSet &Dst,
572  EvalCallOptions &Options);
573 
574  void VisitCXXNewAllocatorCall(const CXXNewExpr *CNE,
575  ExplodedNode *Pred,
576  ExplodedNodeSet &Dst);
577 
578  void VisitCXXNewExpr(const CXXNewExpr *CNE, ExplodedNode *Pred,
579  ExplodedNodeSet &Dst);
580 
581  void VisitCXXDeleteExpr(const CXXDeleteExpr *CDE, ExplodedNode *Pred,
582  ExplodedNodeSet &Dst);
583 
584  /// Create a C++ temporary object for an rvalue.
586  ExplodedNode *Pred,
587  ExplodedNodeSet &Dst);
588 
589  /// evalEagerlyAssumeBinOpBifurcation - Given the nodes in 'Src', eagerly assume symbolic
590  /// expressions of the form 'x != 0' and generate new nodes (stored in Dst)
591  /// with those assumptions.
593  const Expr *Ex);
594 
595  static std::pair<const ProgramPointTag *, const ProgramPointTag *>
597 
599  const LocationContext *LCtx, QualType T,
600  QualType ExTy, const CastExpr *CastE,
601  StmtNodeBuilder &Bldr,
602  ExplodedNode *Pred);
603 
605  const LocationContext *LCtx,
606  const CastExpr *CastE,
607  StmtNodeBuilder &Bldr,
608  ExplodedNode *Pred);
609 
611  const UnaryOperator* U,
612  StmtNodeBuilder &Bldr);
613 
614 public:
616  SVal LHS, SVal RHS, QualType T) {
617  return svalBuilder.evalBinOp(ST, Op, LHS, RHS, T);
618  }
619 
620  /// By looking at a certain item that may be potentially part of an object's
621  /// ConstructionContext, retrieve such object's location. A particular
622  /// statement can be transparently passed as \p Item in most cases.
623  static Optional<SVal>
625  const ConstructionContextItem &Item,
626  const LocationContext *LC);
627 
628  /// Call PointerEscape callback when a value escapes as a result of bind.
630  ProgramStateRef State, ArrayRef<std::pair<SVal, SVal>> LocAndVals,
632  const CallEvent *Call);
633 
634  /// Call PointerEscape callback when a value escapes as a result of
635  /// region invalidation.
636  /// \param[in] ITraits Specifies invalidation traits for regions/symbols.
639  const InvalidatedSymbols *Invalidated,
640  ArrayRef<const MemRegion *> ExplicitRegions,
641  const CallEvent *Call,
643 
644 private:
645  /// evalBind - Handle the semantics of binding a value to a specific location.
646  /// This method is used by evalStore, VisitDeclStmt, and others.
647  void evalBind(ExplodedNodeSet &Dst, const Stmt *StoreE, ExplodedNode *Pred,
648  SVal location, SVal Val, bool atDeclInit = false,
649  const ProgramPoint *PP = nullptr);
650 
653  SVal Loc, SVal Val,
654  const LocationContext *LCtx);
655 
656  /// A simple wrapper when you only need to notify checkers of pointer-escape
657  /// of some values.
660  const CallEvent *Call = nullptr) const;
661 
662 public:
663  // FIXME: 'tag' should be removed, and a LocationContext should be used
664  // instead.
665  // FIXME: Comment on the meaning of the arguments, when 'St' may not
666  // be the same as Pred->state, and when 'location' may not be the
667  // same as state->getLValue(Ex).
668  /// Simulate a read of the result of Ex.
669  void evalLoad(ExplodedNodeSet &Dst,
670  const Expr *NodeEx, /* Eventually will be a CFGStmt */
671  const Expr *BoundExpr,
672  ExplodedNode *Pred,
673  ProgramStateRef St,
674  SVal location,
675  const ProgramPointTag *tag = nullptr,
676  QualType LoadTy = QualType());
677 
678  // FIXME: 'tag' should be removed, and a LocationContext should be used
679  // instead.
680  void evalStore(ExplodedNodeSet &Dst, const Expr *AssignE, const Expr *StoreE,
681  ExplodedNode *Pred, ProgramStateRef St, SVal TargetLV, SVal Val,
682  const ProgramPointTag *tag = nullptr);
683 
684  /// Return the CFG element corresponding to the worklist element
685  /// that is currently being processed by ExprEngine.
687  return (*currBldrCtx->getBlock())[currStmtIdx];
688  }
689 
690  /// Create a new state in which the call return value is binded to the
691  /// call origin expression.
693  const LocationContext *LCtx,
695 
696  /// Evaluate a call, running pre- and post-call checkers and allowing checkers
697  /// to be responsible for handling the evaluation of the call itself.
698  void evalCall(ExplodedNodeSet &Dst, ExplodedNode *Pred,
699  const CallEvent &Call);
700 
701  /// Default implementation of call evaluation.
703  const CallEvent &Call,
704  const EvalCallOptions &CallOpts = {});
705 
706  /// Find location of the object that is being constructed by a given
707  /// constructor. This should ideally always succeed but due to not being
708  /// fully implemented it sometimes indicates that it failed via its
709  /// out-parameter CallOpts; in such cases a fake temporary region is
710  /// returned, which is better than nothing but does not represent
711  /// the actual behavior of the program.
713  const Expr *E, ProgramStateRef State, const LocationContext *LCtx,
714  const ConstructionContext *CC, EvalCallOptions &CallOpts);
715 
716  /// Update the program state with all the path-sensitive information
717  /// that's necessary to perform construction of an object with a given
718  /// syntactic construction context. V and CallOpts have to be obtained from
719  /// computeObjectUnderConstruction() invoked with the same set of
720  /// the remaining arguments (E, State, LCtx, CC).
722  SVal V, const Expr *E, ProgramStateRef State, const LocationContext *LCtx,
723  const ConstructionContext *CC, const EvalCallOptions &CallOpts);
724 
725  /// A convenient wrapper around computeObjectUnderConstruction
726  /// and updateObjectsUnderConstruction.
727  std::pair<ProgramStateRef, SVal> handleConstructionContext(
728  const Expr *E, ProgramStateRef State, const LocationContext *LCtx,
729  const ConstructionContext *CC, EvalCallOptions &CallOpts) {
730  SVal V = computeObjectUnderConstruction(E, State, LCtx, CC, CallOpts);
731  return std::make_pair(
732  updateObjectsUnderConstruction(V, E, State, LCtx, CC, CallOpts), V);
733  }
734 
735 private:
736  ProgramStateRef finishArgumentConstruction(ProgramStateRef State,
737  const CallEvent &Call);
738  void finishArgumentConstruction(ExplodedNodeSet &Dst, ExplodedNode *Pred,
739  const CallEvent &Call);
740 
741  void evalLoadCommon(ExplodedNodeSet &Dst,
742  const Expr *NodeEx, /* Eventually will be a CFGStmt */
743  const Expr *BoundEx,
744  ExplodedNode *Pred,
745  ProgramStateRef St,
746  SVal location,
747  const ProgramPointTag *tag,
748  QualType LoadTy);
749 
750  void evalLocation(ExplodedNodeSet &Dst,
751  const Stmt *NodeEx, /* This will eventually be a CFGStmt */
752  const Stmt *BoundEx,
753  ExplodedNode *Pred,
754  ProgramStateRef St,
755  SVal location,
756  bool isLoad);
757 
758  /// Count the stack depth and determine if the call is recursive.
759  void examineStackFrames(const Decl *D, const LocationContext *LCtx,
760  bool &IsRecursive, unsigned &StackDepth);
761 
762  enum CallInlinePolicy {
763  CIP_Allowed,
764  CIP_DisallowedOnce,
765  CIP_DisallowedAlways
766  };
767 
768  /// See if a particular call should be inlined, by only looking
769  /// at the call event and the current state of analysis.
770  CallInlinePolicy mayInlineCallKind(const CallEvent &Call,
771  const ExplodedNode *Pred,
772  AnalyzerOptions &Opts,
773  const EvalCallOptions &CallOpts);
774 
775  /// See if the given AnalysisDeclContext is built for a function that we
776  /// should always inline simply because it's small enough.
777  /// Apart from "small" functions, we also have "large" functions
778  /// (cf. isLarge()), some of which are huge (cf. isHuge()), and we classify
779  /// the remaining functions as "medium".
780  bool isSmall(AnalysisDeclContext *ADC) const;
781 
782  /// See if the given AnalysisDeclContext is built for a function that we
783  /// should inline carefully because it looks pretty large.
784  bool isLarge(AnalysisDeclContext *ADC) const;
785 
786  /// See if the given AnalysisDeclContext is built for a function that we
787  /// should never inline because it's legit gigantic.
788  bool isHuge(AnalysisDeclContext *ADC) const;
789 
790  /// See if the given AnalysisDeclContext is built for a function that we
791  /// should inline, just by looking at the declaration of the function.
792  bool mayInlineDecl(AnalysisDeclContext *ADC) const;
793 
794  /// Checks our policies and decides weither the given call should be inlined.
795  bool shouldInlineCall(const CallEvent &Call, const Decl *D,
796  const ExplodedNode *Pred,
797  const EvalCallOptions &CallOpts = {});
798 
799  void inlineCall(WorkList *WList, const CallEvent &Call, const Decl *D,
800  NodeBuilder &Bldr, ExplodedNode *Pred, ProgramStateRef State);
801 
802  void ctuBifurcate(const CallEvent &Call, const Decl *D, NodeBuilder &Bldr,
803  ExplodedNode *Pred, ProgramStateRef State);
804 
805  /// Returns true if the CTU analysis is running its second phase.
806  bool isSecondPhaseCTU() { return IsCTUEnabled && !Engine.getCTUWorkList(); }
807 
808  /// Conservatively evaluate call by invalidating regions and binding
809  /// a conjured return value.
810  void conservativeEvalCall(const CallEvent &Call, NodeBuilder &Bldr,
811  ExplodedNode *Pred, ProgramStateRef State);
812 
813  /// Either inline or process the call conservatively (or both), based
814  /// on DynamicDispatchBifurcation data.
815  void BifurcateCall(const MemRegion *BifurReg,
816  const CallEvent &Call, const Decl *D, NodeBuilder &Bldr,
817  ExplodedNode *Pred);
818 
819  bool replayWithoutInlining(ExplodedNode *P, const LocationContext *CalleeLC);
820 
821  /// Models a trivial copy or move constructor or trivial assignment operator
822  /// call with a simple bind.
823  void performTrivialCopy(NodeBuilder &Bldr, ExplodedNode *Pred,
824  const CallEvent &Call);
825 
826  /// If the value of the given expression \p InitWithAdjustments is a NonLoc,
827  /// copy it into a new temporary object region, and replace the value of the
828  /// expression with that.
829  ///
830  /// If \p Result is provided, the new region will be bound to this expression
831  /// instead of \p InitWithAdjustments.
832  ///
833  /// Returns the temporary region with adjustments into the optional
834  /// OutRegionWithAdjustments out-parameter if a new region was indeed needed,
835  /// otherwise sets it to nullptr.
836  ProgramStateRef createTemporaryRegionIfNeeded(
837  ProgramStateRef State, const LocationContext *LC,
838  const Expr *InitWithAdjustments, const Expr *Result = nullptr,
839  const SubRegion **OutRegionWithAdjustments = nullptr);
840 
841  /// Returns a region representing the first element of a (possibly
842  /// multi-dimensional) array, for the purposes of element construction or
843  /// destruction.
844  ///
845  /// On return, \p Ty will be set to the base type of the array.
846  ///
847  /// If the type is not an array type at all, the original value is returned.
848  /// Otherwise the "IsArray" flag is set.
849  static SVal makeZeroElementRegion(ProgramStateRef State, SVal LValue,
850  QualType &Ty, bool &IsArray);
851 
852  /// For a DeclStmt or CXXInitCtorInitializer, walk backward in the current CFG
853  /// block to find the constructor expression that directly constructed into
854  /// the storage for this statement. Returns null if the constructor for this
855  /// statement created a temporary object region rather than directly
856  /// constructing into an existing region.
857  const CXXConstructExpr *findDirectConstructorForCurrentCFGElement();
858 
859  /// Common code that handles either a CXXConstructExpr or a
860  /// CXXInheritedCtorInitExpr.
861  void handleConstructor(const Expr *E, ExplodedNode *Pred,
862  ExplodedNodeSet &Dst);
863 
864 public:
865  /// Note whether this loop has any more iteratios to model. These methods are
866  /// essentially an interface for a GDM trait. Further reading in
867  /// ExprEngine::VisitObjCForCollectionStmt().
868  LLVM_NODISCARD static ProgramStateRef
870  const ObjCForCollectionStmt *O,
871  const LocationContext *LC, bool HasMoreIteraton);
872 
873  LLVM_NODISCARD static ProgramStateRef
874  removeIterationState(ProgramStateRef State, const ObjCForCollectionStmt *O,
875  const LocationContext *LC);
876 
877  LLVM_NODISCARD static bool hasMoreIteration(ProgramStateRef State,
878  const ObjCForCollectionStmt *O,
879  const LocationContext *LC);
880 private:
881  /// Store the location of a C++ object corresponding to a statement
882  /// until the statement is actually encountered. For example, if a DeclStmt
883  /// has CXXConstructExpr as its initializer, the object would be considered
884  /// to be "under construction" between CXXConstructExpr and DeclStmt.
885  /// This allows, among other things, to keep bindings to variable's fields
886  /// made within the constructor alive until its declaration actually
887  /// goes into scope.
888  static ProgramStateRef
889  addObjectUnderConstruction(ProgramStateRef State,
890  const ConstructionContextItem &Item,
891  const LocationContext *LC, SVal V);
892 
893  /// Mark the object sa fully constructed, cleaning up the state trait
894  /// that tracks objects under construction.
895  static ProgramStateRef
896  finishObjectConstruction(ProgramStateRef State,
897  const ConstructionContextItem &Item,
898  const LocationContext *LC);
899 
900  /// If the given expression corresponds to a temporary that was used for
901  /// passing into an elidable copy/move constructor and that constructor
902  /// was actually elided, track that we also need to elide the destructor.
903  static ProgramStateRef elideDestructor(ProgramStateRef State,
904  const CXXBindTemporaryExpr *BTE,
905  const LocationContext *LC);
906 
907  /// Stop tracking the destructor that corresponds to an elided constructor.
908  static ProgramStateRef
909  cleanupElidedDestructor(ProgramStateRef State,
910  const CXXBindTemporaryExpr *BTE,
911  const LocationContext *LC);
912 
913  /// Returns true if the given expression corresponds to a temporary that
914  /// was constructed for passing into an elidable copy/move constructor
915  /// and that constructor was actually elided.
916  static bool isDestructorElided(ProgramStateRef State,
917  const CXXBindTemporaryExpr *BTE,
918  const LocationContext *LC);
919 
920  /// Check if all objects under construction have been fully constructed
921  /// for the given context range (including FromLC, not including ToLC).
922  /// This is useful for assertions. Also checks if elided destructors
923  /// were cleaned up.
924  static bool areAllObjectsFullyConstructed(ProgramStateRef State,
925  const LocationContext *FromLC,
926  const LocationContext *ToLC);
927 };
928 
929 /// Traits for storing the call processing policy inside GDM.
930 /// The GDM stores the corresponding CallExpr pointer.
931 // FIXME: This does not use the nice trait macros because it must be accessible
932 // from multiple translation units.
934 template <>
936  public ProgramStatePartialTrait<const void*> {
937  static void *GDMIndex();
938 };
939 
940 } // namespace ento
941 
942 } // namespace clang
943 
944 #endif // LLVM_CLANG_STATICANALYZER_CORE_PATHSENSITIVE_EXPRENGINE_H
clang::ento::ExprEngine::processCallEnter
void processCallEnter(NodeBuilderContext &BC, CallEnter CE, ExplodedNode *Pred)
Generate the entry node of the callee.
Definition: ExprEngineCallAndReturn.cpp:43
clang::ento::ProgramStatePartialTrait
Definition: ProgramStateTrait.h:29
clang::ento::SValBuilder::evalBinOp
SVal evalBinOp(ProgramStateRef state, BinaryOperator::Opcode op, SVal lhs, SVal rhs, QualType type)
Definition: SValBuilder.cpp:483
clang::ento::ExprEngine::hasWorkRemaining
bool hasWorkRemaining() const
Definition: ExprEngine.h:438
clang::AtomicExpr
AtomicExpr - Variadic atomic builtins: __atomic_exchange, __atomic_fetch_*, __atomic_load,...
Definition: Expr.h:6234
clang::ento::ExprEngine::VisitLambdaExpr
void VisitLambdaExpr(const LambdaExpr *LE, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitLambdaExpr - Transfer function logic for LambdaExprs.
Definition: ExprEngineCXX.cpp:995
clang::ento::ExprEngine::getStateManager
ProgramStateManager & getStateManager()
Definition: ExprEngine.h:417
clang::ento::ExprEngine::updateObjectsUnderConstruction
ProgramStateRef updateObjectsUnderConstruction(SVal V, const Expr *E, ProgramStateRef State, const LocationContext *LCtx, const ConstructionContext *CC, const EvalCallOptions &CallOpts)
Update the program state with all the path-sensitive information that's necessary to perform construc...
Definition: ExprEngineCXX.cpp:356
clang::OffsetOfExpr
OffsetOfExpr - [C99 7.17] - This represents an expression of the form offsetof(record-type,...
Definition: Expr.h:2444
clang::ento::EvalCallOptions::EvalCallOptions
EvalCallOptions()
Definition: ExprEngine.h:120
clang::ento::ExprEngine::removeIterationState
static LLVM_NODISCARD ProgramStateRef removeIterationState(ProgramStateRef State, const ObjCForCollectionStmt *O, const LocationContext *LC)
Definition: ExprEngine.cpp:2153
clang::ento::BasicValueFactory
Definition: BasicValueFactory.h:113
clang::LocationContext
It wraps the AnalysisDeclContext to represent both the call stack with the help of StackFrameContext ...
Definition: AnalysisDeclContext.h:215
clang::ento::AnalysisManager::getCheckerManager
CheckerManager * getCheckerManager() const
Definition: AnalysisManager.h:80
SVals.h
Nodes
BoundNodesTreeBuilder Nodes
Definition: ASTMatchFinder.cpp:83
string
string(SUBSTRING ${CMAKE_CURRENT_BINARY_DIR} 0 ${PATH_LIB_START} PATH_HEAD) string(SUBSTRING $
Definition: CMakeLists.txt:22
clang::ento::ExprEngine::hasEmptyWorkList
bool hasEmptyWorkList() const
Definition: ExprEngine.h:437
clang::ento::ExprEngine::VisitCallExpr
void VisitCallExpr(const CallExpr *CE, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitCall - Transfer function for function calls.
Definition: ExprEngineCallAndReturn.cpp:532
clang::ento::ExplodedNodeSet::iterator
ImplTy::iterator iterator
Definition: ExplodedGraph.h:477
clang::ento::ConstraintManager
Definition: ConstraintManager.h:73
clang::ento::ExprEngine::getDataTags
DataTag::Factory & getDataTags()
Definition: ExprEngine.h:433
clang::ento::ExprEngine::Visit
void Visit(const Stmt *S, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Visit - Transfer function logic for all statements.
Definition: ExprEngine.cpp:1188
clang::ProgramPointTag
ProgramPoints can be "tagged" as representing points specific to a given analysis entity.
Definition: ProgramPoint.h:38
clang::ento::ExprEngine::getContext
ASTContext & getContext() const
getContext - Return the ASTContext associated with this analysis.
Definition: ExprEngine.h:203
clang::ento::ExprEngine::handleUOExtension
void handleUOExtension(ExplodedNodeSet::iterator I, const UnaryOperator *U, StmtNodeBuilder &Bldr)
Definition: ExprEngineC.cpp:915
clang::NamedDecl
This represents a decl that may have a name.
Definition: Decl.h:247
clang::ento::ExprEngine::hasMoreIteration
static LLVM_NODISCARD bool hasMoreIteration(ProgramStateRef State, const ObjCForCollectionStmt *O, const LocationContext *LC)
Definition: ExprEngine.cpp:2160
clang::ento::ExprEngine::removeDeadOnEndOfFunction
void removeDeadOnEndOfFunction(NodeBuilderContext &BC, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Remove dead bindings/symbols before exiting a function.
Definition: ExprEngineCallAndReturn.cpp:164
clang::CFGTemporaryDtor
Represents C++ object destructor implicitly generated at the end of full expression for temporary obj...
Definition: CFG.h:482
clang::ento::ProgramStateRef
IntrusiveRefCntPtr< const ProgramState > ProgramStateRef
Definition: ProgramState_Fwd.h:37
clang::QualType
A (possibly-)qualified type.
Definition: Type.h:731
clang::ConstructionContext
ConstructionContext's subclasses describe different ways of constructing an object in C++.
Definition: ConstructionContext.h:237
clang::AnalysisDeclContext
AnalysisDeclContext contains the context data for the function, method or block under analysis.
Definition: AnalysisDeclContext.h:72
clang::ento::ExprEngine::ProcessMemberDtor
void ProcessMemberDtor(const CFGMemberDtor D, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Definition: ExprEngine.cpp:1031
clang::ento::ExprEngine::getCrossTranslationUnitContext
cross_tu::CrossTranslationUnitContext * getCrossTranslationUnitContext()
Definition: ExprEngine.h:220
clang::ento::ExprEngine::evalBinOp
SVal evalBinOp(ProgramStateRef ST, BinaryOperator::Opcode Op, SVal LHS, SVal RHS, QualType T)
Definition: ExprEngine.h:615
clang::ento::ExplodedNode
Definition: ExplodedGraph.h:65
Filename
StringRef Filename
Definition: Format.cpp:2572
clang::ento::ExprEngine::VisitReturnStmt
void VisitReturnStmt(const ReturnStmt *R, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitReturnStmt - Transfer function logic for return statements.
Definition: ExprEngineCallAndReturn.cpp:1170
ProgramState_Fwd.h
clang::CXXNewExpr
Represents a new-expression for memory allocation and constructor calls, e.g: "new CXXNewExpr(foo)".
Definition: ExprCXX.h:2139
clang::ento::ExprEngine::VisitUnaryOperator
void VisitUnaryOperator(const UnaryOperator *B, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitUnaryOperator - Transfer function logic for unary operators.
Definition: ExprEngineC.cpp:932
clang::ento::ExprEngine::VisitLvalObjCIvarRefExpr
void VisitLvalObjCIvarRefExpr(const ObjCIvarRefExpr *DR, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Transfer function logic for computing the lvalue of an Objective-C ivar.
Definition: ExprEngineObjC.cpp:21
clang::InitListExpr
Describes an C or C++ initializer list.
Definition: Expr.h:4791
clang::ento::ExprEngine::VisitArraySubscriptExpr
void VisitArraySubscriptExpr(const ArraySubscriptExpr *Ex, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitArraySubscriptExpr - Transfer function for array accesses.
Definition: ExprEngine.cpp:2741
clang::ento::ExprEngine::ProcessInitializer
void ProcessInitializer(const CFGInitializer I, ExplodedNode *Pred)
Definition: ExprEngine.cpp:803
clang::ento::ExprEngine::VisitCXXNewExpr
void VisitCXXNewExpr(const CXXNewExpr *CNE, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Definition: ExprEngineCXX.cpp:832
llvm::Optional
Definition: LLVM.h:40
clang::UnaryOperator
UnaryOperator - This represents the unary-expression's (except sizeof and alignof),...
Definition: Expr.h:2163
clang::ento::ExprEngine::getRootLocationContext
const LocationContext * getRootLocationContext() const
Definition: ExprEngine.h:231
clang::ento::ExprEngine::processCleanupTemporaryBranch
void processCleanupTemporaryBranch(const CXXBindTemporaryExpr *BTE, NodeBuilderContext &BldCtx, ExplodedNode *Pred, ExplodedNodeSet &Dst, const CFGBlock *DstT, const CFGBlock *DstF)
Called by CoreEngine.
Definition: ExprEngine.cpp:1116
clang::ento::StmtNodeBuilder
Definition: CoreEngine.h:385
clang::ObjCForCollectionStmt
Represents Objective-C's collection statement.
Definition: StmtObjC.h:23
clang::ArrayInitLoopExpr
Represents a loop initializing the elements of an array.
Definition: Expr.h:5421
clang::ento::ExprEngine::bindReturnValue
ProgramStateRef bindReturnValue(const CallEvent &Call, const LocationContext *LCtx, ProgramStateRef State)
Create a new state in which the call return value is binded to the call origin expression.
Definition: ExprEngineCallAndReturn.cpp:672
clang::ConstructionContextItem
Represents a single point (AST node) in the program that requires attention during construction of an...
Definition: ConstructionContext.h:28
clang::ento::ExprEngine::processCallExit
void processCallExit(ExplodedNode *Pred)
Generate the sequence of nodes that simulate the call exit and the post visit for CallExpr.
Definition: ExprEngineCallAndReturn.cpp:206
clang::ento::ExprEngine::VisitMSAsmStmt
void VisitMSAsmStmt(const MSAsmStmt *A, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitMSAsmStmt - Transfer function logic for MS inline asm.
Definition: ExprEngine.cpp:3237
clang::ento::StoreManager
Definition: Store.h:53
clang::ento::ExprEngine::processSwitch
void processSwitch(SwitchNodeBuilder &builder)
ProcessSwitch - Called by CoreEngine.
Definition: ExprEngine.cpp:2446
clang::ento::EvalCallOptions::IsArrayCtorOrDtor
bool IsArrayCtorOrDtor
This call is a constructor or a destructor for a single element within an array, a part of array cons...
Definition: ExprEngine.h:103
clang::ento::ExprEngine::evalLoad
void evalLoad(ExplodedNodeSet &Dst, const Expr *NodeEx, const Expr *BoundExpr, ExplodedNode *Pred, ProgramStateRef St, SVal location, const ProgramPointTag *tag=nullptr, QualType LoadTy=QualType())
Simulate a read of the result of Ex.
Definition: ExprEngine.cpp:3089
clang::ento::MemRegion
MemRegion - The root abstract class for all memory regions.
Definition: MemRegion.h:95
clang::CodeGen::AlignmentSource::Decl
@ Decl
The l-value was an access to a declared entity or something equivalently strong, like the address of ...
clang::CFGBlock
Represents a single basic block in a source-level CFG.
Definition: CFG.h:576
U
clang::ento::ExprEngine::Inline_Minimal
@ Inline_Minimal
Do minimal inlining of callees.
Definition: ExprEngine.h:133
V
#define V(N, I)
Definition: ASTContext.h:3176
clang::ento::EvalCallOptions
Hints for figuring out of a call should be inlined during evalCall().
Definition: ExprEngine.h:96
ProgramPoint.h
clang::UnaryExprOrTypeTraitExpr
UnaryExprOrTypeTraitExpr - expression with either a type or (unevaluated) expression operand.
Definition: Expr.h:2549
clang::ento::ExprEngine::ProcessAutomaticObjDtor
void ProcessAutomaticObjDtor(const CFGAutomaticObjDtor D, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Definition: ExprEngine.cpp:937
clang::ento::ExprEngine::VisitMemberExpr
void VisitMemberExpr(const MemberExpr *M, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitMemberExpr - Transfer function for member expressions.
Definition: ExprEngine.cpp:2792
clang::ento::ExprEngine::evalStore
void evalStore(ExplodedNodeSet &Dst, const Expr *AssignE, const Expr *StoreE, ExplodedNode *Pred, ProgramStateRef St, SVal TargetLV, SVal Val, const ProgramPointTag *tag=nullptr)
evalStore - Handle the semantics of a store via an assignment.
Definition: ExprEngine.cpp:3066
clang::ento::NodeBuilder
Definition: CoreEngine.h:241
Node
DynTypedNode Node
Definition: ASTMatchFinder.cpp:68
clang::CXXBindTemporaryExpr
Represents binding an expression to a temporary.
Definition: ExprCXX.h:1412
clang::BinaryOperator
A builtin binary operation expression such as "x + y" or "x <= y".
Definition: Expr.h:3807
clang::ento::ExprEngine::VisitAtomicExpr
void VisitAtomicExpr(const AtomicExpr *E, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitAtomicExpr - Transfer function for builtin atomic expressions.
Definition: ExprEngine.cpp:2872
clang::ento::ExprEngine::getStmt
const Stmt * getStmt() const
clang::LambdaExpr
A C++ lambda expression, which produces a function object (of unspecified type) that can be invoked l...
Definition: ExprCXX.h:1865
clang::cross_tu::CrossTranslationUnitContext
This class is used for tools that requires cross translation unit capability.
Definition: CrossTranslationUnit.h:127
clang::interp::LE
bool LE(InterpState &S, CodePtr OpPC)
Definition: Interp.h:239
clang::ento::ExprEngine::evalCall
void evalCall(ExplodedNodeSet &Dst, ExplodedNode *Pred, const CallEvent &Call)
Evaluate a call, running pre- and post-call checkers and allowing checkers to be responsible for hand...
Definition: ExprEngineCallAndReturn.cpp:604
CheckerManager.h
clang::ento::ExprEngine::computeObjectUnderConstruction
SVal computeObjectUnderConstruction(const Expr *E, ProgramStateRef State, const LocationContext *LCtx, const ConstructionContext *CC, EvalCallOptions &CallOpts)
Find location of the object that is being constructed by a given constructor.
Definition: ExprEngineCXX.cpp:112
clang::ento::ExprEngine::getSymbolManager
SymbolManager & getSymbolManager()
Definition: ExprEngine.h:430
BugReporter.h
clang::CFGMemberDtor
Represents C++ object destructor implicitly generated for member object in destructor.
Definition: CFG.h:461
clang::MaterializeTemporaryExpr
Represents a prvalue temporary that is written into memory so that a reference can bind to it.
Definition: ExprCXX.h:4479
clang::ASTContext
Holds long-lived AST nodes (such as types and decls) that can be referred to throughout the semantic ...
Definition: ASTContext.h:208
clang::ento::ExprEngine::VisitCXXCatchStmt
void VisitCXXCatchStmt(const CXXCatchStmt *CS, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Definition: ExprEngineCXX.cpp:961
clang::ento::CoreEngine::ExecuteWorkListWithInitialState
bool ExecuteWorkListWithInitialState(const LocationContext *L, unsigned Steps, ProgramStateRef InitState, ExplodedNodeSet &Dst)
Returns true if there is still simulation state on the worklist.
Definition: CoreEngine.cpp:225
clang::DeclaratorContext::LambdaExpr
@ LambdaExpr
clang::ento::ExprEngine::VisitCXXInheritedCtorInitExpr
void VisitCXXInheritedCtorInitExpr(const CXXInheritedCtorInitExpr *E, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Definition: ExprEngineCXX.cpp:692
Store.h
clang::CFGAutomaticObjDtor
Represents C++ object destructor implicitly generated for automatic object or temporary bound to cons...
Definition: CFG.h:389
clang::ento::ProgramStateTrait
Definition: ProgramState.h:50
clang::ento::ExprEngine::processBranch
void processBranch(const Stmt *Condition, NodeBuilderContext &BuilderCtx, ExplodedNode *Pred, ExplodedNodeSet &Dst, const CFGBlock *DstT, const CFGBlock *DstF)
ProcessBranch - Called by CoreEngine.
Definition: ExprEngine.cpp:2217
clang::ento::ExprEngine::notifyCheckersOfPointerEscape
ProgramStateRef notifyCheckersOfPointerEscape(ProgramStateRef State, const InvalidatedSymbols *Invalidated, ArrayRef< const MemRegion * > ExplicitRegions, const CallEvent *Call, RegionAndSymbolInvalidationTraits &ITraits)
Call PointerEscape callback when a value escapes as a result of region invalidation.
Definition: ExprEngine.cpp:2965
clang::ento::ExprEngine::processCFGBlockEntrance
void processCFGBlockEntrance(const BlockEdge &L, NodeBuilderWithSinks &nodeBuilder, ExplodedNode *Pred)
Called by CoreEngine when processing the entrance of a CFGBlock.
Definition: ExprEngine.cpp:1963
clang::ObjCAtSynchronizedStmt
Represents Objective-C's @synchronized statement.
Definition: StmtObjC.h:302
clang::ento::ExprEngine::getObjectUnderConstruction
static Optional< SVal > getObjectUnderConstruction(ProgramStateRef State, const ConstructionContextItem &Item, const LocationContext *LC)
By looking at a certain item that may be potentially part of an object's ConstructionContext,...
Definition: ExprEngine.cpp:458
clang::ento::ExprEngine::ProcessImplicitDtor
void ProcessImplicitDtor(const CFGImplicitDtor D, ExplodedNode *Pred)
Definition: ExprEngine.cpp:891
clang::ento::WorkList::hasWork
virtual bool hasWork() const =0
clang::ento::ExprEngine::wasBlocksExhausted
bool wasBlocksExhausted() const
Definition: ExprEngine.h:436
clang::ento::ExprEngine::getBuilderContext
const NodeBuilderContext & getBuilderContext()
Definition: ExprEngine.h:224
Type.h
clang::ento::ExprEngine::GenerateCallExitNode
void GenerateCallExitNode(ExplodedNode *N)
clang::ento::ExprEngine::evalEagerlyAssumeBinOpBifurcation
void evalEagerlyAssumeBinOpBifurcation(ExplodedNodeSet &Dst, ExplodedNodeSet &Src, const Expr *Ex)
evalEagerlyAssumeBinOpBifurcation - Given the nodes in 'Src', eagerly assume symbolic expressions of ...
Definition: ExprEngine.cpp:3173
Expr.h
clang::ento::ExprEngine::VisitCXXThisExpr
void VisitCXXThisExpr(const CXXThisExpr *TE, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Definition: ExprEngineCXX.cpp:979
clang::ento::ExprEngine::ProcessTemporaryDtor
void ProcessTemporaryDtor(const CFGTemporaryDtor D, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Definition: ExprEngine.cpp:1055
clang::ento::ExprEngine::VisitCompoundLiteralExpr
void VisitCompoundLiteralExpr(const CompoundLiteralExpr *CL, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitCompoundLiteralExpr - Transfer function logic for compound literals.
Definition: ExprEngineC.cpp:546
clang::ento::ExprEngine::~ExprEngine
virtual ~ExprEngine()=default
clang::ento::ExprEngine::VisitIncrementDecrementOperator
void VisitIncrementDecrementOperator(const UnaryOperator *U, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Handle ++ and – (both pre- and post-increment).
Definition: ExprEngineC.cpp:1070
clang::ento::ExprEngine::VisitArrayInitLoopExpr
void VisitArrayInitLoopExpr(const ArrayInitLoopExpr *Ex, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitArrayInitLoopExpr - Transfer function for array init loop.
Definition: ExprEngine.cpp:2648
clang::ento::ExprEngine::InliningModes
InliningModes
The modes of inlining, which override the default analysis-wide settings.
Definition: ExprEngine.h:128
llvm::DenseSet
Definition: Sema.h:77
clang::ento::ExprEngine::VisitUnaryExprOrTypeTraitExpr
void VisitUnaryExprOrTypeTraitExpr(const UnaryExprOrTypeTraitExpr *Ex, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitUnaryExprOrTypeTraitExpr - Transfer function for sizeof.
Definition: ExprEngineC.cpp:873
clang::ento::BugReporter
BugReporter is a utility class for generating PathDiagnostics for analysis.
Definition: BugReporter.h:585
clang::ProgramPoint::PreStmtPurgeDeadSymbolsKind
@ PreStmtPurgeDeadSymbolsKind
Definition: ProgramPoint.h:64
clang::ento::IndirectGotoNodeBuilder
Definition: CoreEngine.h:484
clang::ento::ExprEngine::VisitObjCForCollectionStmt
void VisitObjCForCollectionStmt(const ObjCForCollectionStmt *S, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitObjCForCollectionStmt - Transfer function logic for ObjCForCollectionStmt.
Definition: ExprEngineObjC.cpp:83
clang::ento::ExprEngine::ExprEngine
ExprEngine(cross_tu::CrossTranslationUnitContext &CTU, AnalysisManager &mgr, SetOfConstDecls *VisitedCalleesIn, FunctionSummariesTy *FS, InliningModes HowToInlineIn)
Definition: ExprEngine.cpp:194
clang::CXXInheritedCtorInitExpr
Represents a call to an inherited base class constructor from an inheriting constructor.
Definition: ExprCXX.h:1651
clang::ento::ExplodedGraph
Definition: ExplodedGraph.h:302
clang::ento::ProgramStateManager::getBasicVals
BasicValueFactory & getBasicVals()
Definition: ProgramState.h:549
clang::ento::ExprEngine::getCoreEngine
const CoreEngine & getCoreEngine() const
Definition: ExprEngine.h:440
clang::ento::SwitchNodeBuilder
Definition: CoreEngine.h:532
clang::ento::CoreEngine
CoreEngine - Implements the core logic of the graph-reachability analysis.
Definition: CoreEngine.h:55
clang::ObjCMessageExpr
An expression that sends a message to the given Objective-C object or class.
Definition: ExprObjC.h:940
clang::ento::ExprEngine::VisitGCCAsmStmt
void VisitGCCAsmStmt(const GCCAsmStmt *A, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitGCCAsmStmt - Transfer function logic for inline asm.
Definition: ExprEngine.cpp:3214
state
and static some checkers Checker The latter are built on top of the former via the Checker and CheckerVisitor and attempts to isolate them from much of the gore of the internal analysis the analyzer is basically a source code simulator that traces out possible paths of execution The state of the and the combination of state and program point is a node in an exploded which has the entry program point and initial state
Definition: README.txt:30
clang::ento::Loc
Definition: SVals.h:278
clang::ento::ExprEngine::processEndWorklist
void processEndWorklist()
Called by CoreEngine when the analysis worklist has terminated.
Definition: ExprEngine.cpp:607
clang::ento::ExprEngine::geteagerlyAssumeBinOpBifurcationTags
static std::pair< const ProgramPointTag *, const ProgramPointTag * > geteagerlyAssumeBinOpBifurcationTags()
Definition: ExprEngine.cpp:3163
clang::ento::ExprEngine::getConstraintManager
ConstraintManager & getConstraintManager()
Definition: ExprEngine.h:421
clang::CFGImplicitDtor
Represents C++ object destructor implicitly generated by compiler on various occasions.
Definition: CFG.h:364
clang::ento::SValBuilder
Definition: SValBuilder.h:53
ObjCNoReturn.h
clang::CompoundLiteralExpr
CompoundLiteralExpr - [C99 6.5.2.5].
Definition: Expr.h:3405
FunctionSummary.h
clang::ento::ExprEngine::getInitialState
ProgramStateRef getInitialState(const LocationContext *InitLoc)
getInitialState - Return the initial state used for the root vertex in the ExplodedGraph.
Definition: ExprEngine.cpp:217
clang::GCCAsmStmt
This represents a GCC inline-assembly statement extension.
Definition: Stmt.h:3034
clang::ento::ExprEngine::processRegionChanges
ProgramStateRef processRegionChanges(ProgramStateRef state, const InvalidatedSymbols *invalidated, ArrayRef< const MemRegion * > ExplicitRegions, ArrayRef< const MemRegion * > Regions, const LocationContext *LCtx, const CallEvent *Call)
processRegionChanges - Called by ProgramStateManager whenever a change is made to the store.
Definition: ExprEngine.cpp:527
clang::ento::ExprEngine::handleConstructionContext
std::pair< ProgramStateRef, SVal > handleConstructionContext(const Expr *E, ProgramStateRef State, const LocationContext *LCtx, const ConstructionContext *CC, EvalCallOptions &CallOpts)
A convenient wrapper around computeObjectUnderConstruction and updateObjectsUnderConstruction.
Definition: ExprEngine.h:727
clang::ento::ExprEngine::printJson
void printJson(raw_ostream &Out, ProgramStateRef State, const LocationContext *LCtx, const char *NL, unsigned int Space, bool IsDot) const
printJson - Called by ProgramStateManager to print checker-specific data.
Definition: ExprEngine.cpp:585
clang::ento::ExprEngine::VisitBlockExpr
void VisitBlockExpr(const BlockExpr *BE, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitBlockExpr - Transfer function logic for BlockExprs.
Definition: ExprEngineC.cpp:195
P
StringRef P
Definition: ASTMatchersInternal.cpp:563
clang::ento::ExprEngine::VisitInitListExpr
void VisitInitListExpr(const InitListExpr *E, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Definition: ExprEngineC.cpp:741
clang::ento::ExprEngine::ProcessLoopExit
void ProcessLoopExit(const Stmt *S, ExplodedNode *Pred)
Definition: ExprEngine.cpp:785
clang::ento::ProgramStateManager
Definition: ProgramState.h:503
SValBuilder.h
clang::ento::ExprEngine::VisitCXXDestructor
void VisitCXXDestructor(QualType ObjectType, const MemRegion *Dest, const Stmt *S, bool IsBaseDtor, ExplodedNode *Pred, ExplodedNodeSet &Dst, EvalCallOptions &Options)
Definition: ExprEngineCXX.cpp:698
clang::ento::ExprEngine::handleLValueBitCast
ProgramStateRef handleLValueBitCast(ProgramStateRef state, const Expr *Ex, const LocationContext *LCtx, QualType T, QualType ExTy, const CastExpr *CastE, StmtNodeBuilder &Bldr, ExplodedNode *Pred)
Definition: ExprEngineC.cpp:258
clang::ento::AnalysisManager::getASTContext
ASTContext & getASTContext() override
Definition: AnalysisManager.h:82
clang::CFGInitializer
Represents C++ base or member initializer from constructor's initialization list.
Definition: CFG.h:225
clang::ento::CoreEngine::getCTUWorkList
WorkList * getCTUWorkList() const
Definition: CoreEngine.h:176
clang::ento::ExprEngine::VisitCast
void VisitCast(const CastExpr *CastE, const Expr *Ex, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitCast - Transfer function logic for all casts (implicit and explicit).
Definition: ExprEngineC.cpp:285
clang::ento::ExprEngine::processEndOfFunction
void processEndOfFunction(NodeBuilderContext &BC, ExplodedNode *Pred, const ReturnStmt *RS=nullptr)
Called by CoreEngine.
Definition: ExprEngine.cpp:2372
clang::ProgramPoint::Kind
Kind
Definition: ProgramPoint.h:60
clang::CXXDeleteExpr
Represents a delete expression for memory deallocation and destructor calls, e.g.
Definition: ExprCXX.h:2415
clang::ento::AnalysisManager::getAnalysisDeclContextManager
AnalysisDeclContextManager & getAnalysisDeclContextManager()
Definition: AnalysisManager.h:62
clang::BlockExpr
BlockExpr - Adaptor class for mixing a BlockDecl with expressions.
Definition: Expr.h:5970
llvm::ArrayRef
Definition: LLVM.h:34
clang::Decl
Decl - This represents one declaration (or definition), e.g.
Definition: DeclBase.h:83
ProgramState
and static some checkers Checker The latter are built on top of the former via the Checker and CheckerVisitor and attempts to isolate them from much of the gore of the internal analysis the analyzer is basically a source code simulator that traces out possible paths of execution The state of the and the combination of state and program point is a node in an exploded which has the entry program point and initial and then simulate transitions by analyzing individual expressions The analysis of an expression can cause the state to resulting in a new node in the ExplodedGraph with an updated program point and an updated state A bug is found by hitting a node that satisfies some bug condition(basically a violation of a checking invariant). The analyzer traces out multiple paths by reasoning about branches and then bifurcating the state it can contain cycles as paths loop back onto each other and cache out ProgramState and ExplodedNodes are basically immutable once created Once one creates a ProgramState
Definition: README.txt:34
clang::ento::ExprEngine::processStaticInitializer
void processStaticInitializer(const DeclStmt *DS, NodeBuilderContext &BuilderCtx, ExplodedNode *Pred, ExplodedNodeSet &Dst, const CFGBlock *DstT, const CFGBlock *DstF)
Called by CoreEngine.
BugReporterVisitors.h
clang::ArraySubscriptExpr
ArraySubscriptExpr - [C99 6.5.2.1] Array Subscripting.
Definition: Expr.h:2645
clang::ento::ExprEngine::VisitCXXDeleteExpr
void VisitCXXDeleteExpr(const CXXDeleteExpr *CDE, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Definition: ExprEngineCXX.cpp:939
clang::ento::FunctionSummariesTy
Definition: FunctionSummary.h:33
clang::ento::ExprEngine::VisitCXXBindTemporaryExpr
void VisitCXXBindTemporaryExpr(const CXXBindTemporaryExpr *BTE, ExplodedNodeSet &PreVisit, ExplodedNodeSet &Dst)
Definition: ExprEngine.cpp:1134
clang::ento::ExprEngine::getAnalysisDeclContextManager
AnalysisDeclContextManager & getAnalysisDeclContextManager()
Definition: ExprEngine.h:207
clang::ento::ReplayWithoutInlining
Traits for storing the call processing policy inside GDM.
Definition: ExprEngine.h:933
clang::ento::CoreEngine::hasWorkRemaining
bool hasWorkRemaining() const
Definition: CoreEngine.h:165
LLVM.h
clang::AnalyzerOptions
Stores options for the analyzer from the command line.
Definition: AnalyzerOptions.h:151
State
LineState State
Definition: UnwrappedLineFormatter.cpp:1126
clang::ento::ExprEngine::VisitOffsetOfExpr
void VisitOffsetOfExpr(const OffsetOfExpr *Ex, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitOffsetOfExpr - Transfer function for offsetof.
Definition: ExprEngineC.cpp:854
clang::ento::ExprEngine::processIndirectGoto
void processIndirectGoto(IndirectGotoNodeBuilder &builder)
processIndirectGoto - Called by CoreEngine.
Definition: ExprEngine.cpp:2321
clang::ento::ExprEngine::getSValBuilder
SValBuilder & getSValBuilder()
Definition: ExprEngine.h:215
clang::ento::ExprEngine::getBugReporter
BugReporter & getBugReporter()
Definition: ExprEngine.h:217
clang::ento::ExprEngine::ProcessBaseDtor
void ProcessBaseDtor(const CFGBaseDtor D, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Definition: ExprEngine.cpp:1011
clang::ento::ExprEngine::processBeginOfFunction
void processBeginOfFunction(NodeBuilderContext &BC, ExplodedNode *Pred, ExplodedNodeSet &Dst, const BlockEdge &L)
Called by CoreEngine.
Definition: ExprEngine.cpp:2362
clang::ento::AnalysisManager
Definition: AnalysisManager.h:31
clang::BinaryOperatorKind
BinaryOperatorKind
Definition: OperationKinds.h:25
clang::ObjCNoReturn
Definition: ObjCNoReturn.h:24
clang::ento::ExprEngine::getCurrentCFGElement
CFGElement getCurrentCFGElement()
Return the CFG element corresponding to the worklist element that is currently being processed by Exp...
Definition: ExprEngine.h:686
clang::ento::ExprEngine::ViewGraph
void ViewGraph(bool trim=false)
Visualize the ExplodedGraph created by executing the simulation.
clang::ento::ExprEngine::getAnalysisManager
AnalysisManager & getAnalysisManager()
Definition: ExprEngine.h:205
CoreEngine.h
clang::ento::CoreEngine::wasBlocksExhausted
bool wasBlocksExhausted() const
Definition: CoreEngine.h:164
clang::ento::ExprEngine::getGraph
const ExplodedGraph & getGraph() const
Definition: ExprEngine.h:264
clang::ento::PathSensitiveBugReporter
GRBugReporter is used for generating path-sensitive reports.
Definition: BugReporter.h:664
clang::ento::ExplodedGraph::roots_end
roots_iterator roots_end()
Definition: ExplodedGraph.h:408
clang::CFGElement
Represents a top-level expression in a basic block.
Definition: CFG.h:55
clang::ObjCPropertyAttribute::Kind
Kind
Definition: DeclObjCCommon.h:22
clang::DeclStmt
DeclStmt - Adaptor class for mixing declarations with statements and expressions.
Definition: Stmt.h:1299
clang::ento::ExprEngine
Definition: ExprEngine.h:123
clang::ento::ExplodedGraph::roots_begin
roots_iterator roots_begin()
Definition: ExplodedGraph.h:406
ProgramState.h
clang::ento::ProgramStateManager::getStoreManager
StoreManager & getStoreManager()
Definition: ProgramState.h:579
clang::ento::MemRegionManager
Definition: MemRegion.h:1341
clang::ento::CoreEngine::getWorkList
WorkList * getWorkList() const
Definition: CoreEngine.h:175
clang::CXXThisExpr
Represents the this expression in C++.
Definition: ExprCXX.h:1142
clang::ento::ExprEngine::DumpGraph
std::string DumpGraph(bool trim=false, StringRef Filename="")
Dump graph to the specified filename.
clang::ento::ExprEngine::setWhetherHasMoreIteration
static LLVM_NODISCARD ProgramStateRef setWhetherHasMoreIteration(ProgramStateRef State, const ObjCForCollectionStmt *O, const LocationContext *LC, bool HasMoreIteraton)
Note whether this loop has any more iteratios to model.
Definition: ExprEngine.cpp:2145
clang::ento::ExprEngine::processRegionChange
ProgramStateRef processRegionChange(ProgramStateRef state, const MemRegion *MR, const LocationContext *LCtx)
Definition: ExprEngine.h:406
clang::ento::ExprEngine::ProcessStmt
void ProcessStmt(const Stmt *S, ExplodedNode *Pred)
Definition: ExprEngine.cpp:755
clang::ento::ExprEngine::getStoreManager
StoreManager & getStoreManager()
Definition: ExprEngine.h:419
clang::interp::NE
bool NE(InterpState &S, CodePtr OpPC)
Definition: Interp.h:225
clang::ento::ExprEngine::ProcessDeleteDtor
void ProcessDeleteDtor(const CFGDeleteDtor D, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Definition: ExprEngine.cpp:971
WorkList.h
clang::ento::ExprEngine::VisitDeclStmt
void VisitDeclStmt(const DeclStmt *DS, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitDeclStmt - Transfer function logic for DeclStmts.
Definition: ExprEngineC.cpp:571
clang::ento::CheckerManager
Definition: CheckerManager.h:126
clang::ento::EvalCallOptions::IsElidableCtorThatHasNotBeenElided
bool IsElidableCtorThatHasNotBeenElided
This call is a pre-C++17 elidable constructor that we failed to elide because we failed to compute th...
Definition: ExprEngine.h:118
clang
Definition: CalledOnceCheck.h:17
clang::ento::ExprEngine::VisitObjCAtSynchronizedStmt
void VisitObjCAtSynchronizedStmt(const ObjCAtSynchronizedStmt *S, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Transfer function logic for ObjCAtSynchronizedStmts.
Definition: ExprEngineObjC.cpp:38
clang::ento::ExprEngine::removeDead
void removeDead(ExplodedNode *Node, ExplodedNodeSet &Out, const Stmt *ReferenceStmt, const LocationContext *LC, const Stmt *DiagnosticStmt=nullptr, ProgramPoint::Kind K=ProgramPoint::PreStmtPurgeDeadSymbolsKind)
Run the analyzer's garbage collection - remove dead symbols and bindings from the state.
Definition: ExprEngine.cpp:675
clang::CFGDeleteDtor
Represents C++ object destructor generated from a call to delete.
Definition: CFG.h:414
CFG.h
clang::ento::ExprEngine::processAssume
ProgramStateRef processAssume(ProgramStateRef state, SVal cond, bool assumption)
evalAssume - Callback function invoked by the ConstraintManager when making assumptions about state v...
Definition: ExprEngine.cpp:521
clang::Stmt
Stmt - This represents one statement.
Definition: Stmt.h:70
clang::ento::ExprEngine::processCFGElement
void processCFGElement(const CFGElement E, ExplodedNode *Pred, unsigned StmtIdx, NodeBuilderContext *Ctx)
processCFGElement - Called by CoreEngine.
Definition: ExprEngine.cpp:613
clang::CXXCatchStmt
CXXCatchStmt - This represents a C++ catch block.
Definition: StmtCXX.h:28
clang::ento::ExprEngine::GenerateAutoTransition
void GenerateAutoTransition(ExplodedNode *N)
clang::ento::ExprEngine::handleLVectorSplat
ProgramStateRef handleLVectorSplat(ProgramStateRef state, const LocationContext *LCtx, const CastExpr *CastE, StmtNodeBuilder &Bldr, ExplodedNode *Pred)
clang::CFGBaseDtor
Represents C++ object destructor implicitly generated for base object in destructor.
Definition: CFG.h:440
clang::ento::NodeBuilderContext::getBlock
const CFGBlock * getBlock() const
Return the CFGBlock associated with this builder.
Definition: CoreEngine.h:221
clang::ento::CallEvent
Represents an abstract call to a function or method along a particular path.
Definition: CallEvent.h:148
clang::ento::ExprEngine::ExecuteWorkListWithInitialState
bool ExecuteWorkListWithInitialState(const LocationContext *L, unsigned Steps, ProgramStateRef InitState, ExplodedNodeSet &Dst)
Execute the work list with an initial state.
Definition: ExprEngine.h:196
clang::ento::ExprEngine::VisitCXXConstructExpr
void VisitCXXConstructExpr(const CXXConstructExpr *E, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Definition: ExprEngineCXX.cpp:686
clang::ento::PointerEscapeKind
PointerEscapeKind
Describes the different reasons a pointer escapes during analysis.
Definition: CheckerManager.h:78
clang::ento::NodeBuilderContext
Definition: CoreEngine.h:212
clang::AnalysisDeclContextManager
Definition: AnalysisDeclContext.h:425
clang::CallEnter
Represents a point when we begin processing an inlined call.
Definition: ProgramPoint.h:629
clang::ento::ProgramStateManager::getConstraintManager
ConstraintManager & getConstraintManager()
Definition: ProgramState.h:580
clang::ento::ExprEngine::VisitGuardedExpr
void VisitGuardedExpr(const Expr *Ex, const Expr *L, const Expr *R, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitGuardedExpr - Transfer function logic for ?, __builtin_choose.
Definition: ExprEngineC.cpp:789
clang::ento::EvalCallOptions::IsTemporaryCtorOrDtor
bool IsTemporaryCtorOrDtor
This call is a constructor or a destructor of a temporary value.
Definition: ExprEngine.h:106
clang::MemberExpr
MemberExpr - [C99 6.5.2.3] Structure and Union Members.
Definition: Expr.h:3164
clang::ento::ExprEngine::VisitCXXNewAllocatorCall
void VisitCXXNewAllocatorCall(const CXXNewExpr *CNE, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Definition: ExprEngineCXX.cpp:765
clang::BlockEdge
Definition: ProgramPoint.h:502
clang::ento::SVal
SVal - This represents a symbolic expression, which can be either an L-value or an R-value.
Definition: SVals.h:74
clang::ento::CoreEngine::getDataTags
DataTag::Factory & getDataTags()
Definition: CoreEngine.h:208
clang::ento::NodeBuilderWithSinks
Definition: CoreEngine.h:348
clang::ento::ExprEngine::enqueueEndOfPath
void enqueueEndOfPath(ExplodedNodeSet &S)
clang::ento::ExprEngine::processPointerEscapedOnBind
ProgramStateRef processPointerEscapedOnBind(ProgramStateRef State, ArrayRef< std::pair< SVal, SVal >> LocAndVals, const LocationContext *LCtx, PointerEscapeKind Kind, const CallEvent *Call)
Call PointerEscape callback when a value escapes as a result of bind.
Definition: ExprEngine.cpp:2916
clang::ento::RegionAndSymbolInvalidationTraits
Information about invalidation for a particular region/symbol.
Definition: MemRegion.h:1557
ProgramStateTrait.h
clang::Expr
This represents one expression.
Definition: Expr.h:109
clang::ento::ExprEngine::Inline_Regular
@ Inline_Regular
Follow the default settings for inlining callees.
Definition: ExprEngine.h:130
AnalysisManager.h
clang::CastExpr
CastExpr - Base class for type casts, including both implicit casts (ImplicitCastExpr) and explicit c...
Definition: Expr.h:3475
clang::ento::ExprEngine::CreateCXXTemporaryObject
void CreateCXXTemporaryObject(const MaterializeTemporaryExpr *ME, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Create a C++ temporary object for an rvalue.
Definition: ExprEngineCXX.cpp:26
clang::MSAsmStmt
This represents a Microsoft inline-assembly statement extension.
Definition: Stmt.h:3257
clang::ento::ExprEngine::getBasicVals
BasicValueFactory & getBasicVals()
Definition: ExprEngine.h:426
clang::ento::ExplodedNodeSet
Definition: ExplodedGraph.h:461
clang::ProgramPoint
Definition: ProgramPoint.h:58
clang::CallExpr
CallExpr - Represents a function call (C99 6.5.2.2, C++ [expr.call]).
Definition: Expr.h:2801
clang::ento::ExprEngine::VisitCommonDeclRefExpr
void VisitCommonDeclRefExpr(const Expr *DR, const NamedDecl *D, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Transfer function logic for DeclRefExprs and BlockDeclRefExprs.
Definition: ExprEngine.cpp:2529
clang::ento::SymbolManager
Definition: SymbolManager.h:481
clang::ento::DataTag::Factory
Definition: BugReporter.h:743
clang::ento::ExprEngine::ProcessNewAllocator
void ProcessNewAllocator(const CXXNewExpr *NE, ExplodedNode *Pred)
Definition: ExprEngine.cpp:918
clang::ento::CoreEngine::ExecuteWorkList
bool ExecuteWorkList(const LocationContext *L, unsigned Steps, ProgramStateRef InitState)
ExecuteWorkList - Run the worklist algorithm for a maximum number of steps.
Definition: CoreEngine.cpp:88
clang::CXXConstructExpr
Represents a call to a C++ constructor.
Definition: ExprCXX.h:1460
clang::ObjCIvarRefExpr
ObjCIvarRefExpr - A reference to an ObjC instance variable.
Definition: ExprObjC.h:548
clang::ento::ExprEngine::getGraph
ExplodedGraph & getGraph()
Definition: ExprEngine.h:263
clang::ento::ExprEngine::defaultEvalCall
void defaultEvalCall(NodeBuilder &B, ExplodedNode *Pred, const CallEvent &Call, const EvalCallOptions &CallOpts={})
Default implementation of call evaluation.
Definition: ExprEngineCallAndReturn.cpp:1082
llvm::IntrusiveRefCntPtr< const ProgramState >
clang::ento::ExprEngine::ExecuteWorkList
bool ExecuteWorkList(const LocationContext *L, unsigned Steps=150000)
Returns true if there is still simulation state on the worklist.
Definition: ExprEngine.h:188
clang::ento::ExprEngine::getRegionManager
MemRegionManager & getRegionManager()
Definition: ExprEngine.h:431
clang::ento::EvalCallOptions::IsTemporaryLifetimeExtendedViaAggregate
bool IsTemporaryLifetimeExtendedViaAggregate
This call is a constructor for a temporary that is lifetime-extended by binding it to a reference-typ...
Definition: ExprEngine.h:111
clang::ReturnStmt
ReturnStmt - This represents a return, optionally of an expression: return; return 4;.
Definition: Stmt.h:2792
clang::ento::ExprEngine::VisitBinaryOperator
void VisitBinaryOperator(const BinaryOperator *B, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitBinaryOperator - Transfer function logic for binary operators.
Definition: ExprEngineC.cpp:39
clang::ento::ExprEngine::VisitObjCMessage
void VisitObjCMessage(const ObjCMessageExpr *ME, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Definition: ExprEngineObjC.cpp:147
clang::ento::EvalCallOptions::IsCtorOrDtorWithImproperlyModeledTargetRegion
bool IsCtorOrDtorWithImproperlyModeledTargetRegion
This call is a constructor or a destructor for which we do not currently compute the this-region corr...
Definition: ExprEngine.h:99
clang::ento::ExprEngine::getCheckerManager
CheckerManager & getCheckerManager() const
Definition: ExprEngine.h:211
clang::ento::ExprEngine::VisitLogicalExpr
void VisitLogicalExpr(const BinaryOperator *B, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitLogicalExpr - Transfer function logic for '&&', '||'.
Definition: ExprEngineC.cpp:647