clang  14.0.0git
ProgramState.cpp
Go to the documentation of this file.
1 //= ProgramState.cpp - Path-Sensitive "State" for tracking values --*- C++ -*--=
2 //
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6 //
7 //===----------------------------------------------------------------------===//
8 //
9 // This file implements ProgramState and ProgramStateManager.
10 //
11 //===----------------------------------------------------------------------===//
12 
14 #include "clang/Analysis/CFG.h"
21 #include "llvm/Support/raw_ostream.h"
22 
23 using namespace clang;
24 using namespace ento;
25 
26 namespace clang { namespace ento {
27 /// Increments the number of times this state is referenced.
28 
30  ++const_cast<ProgramState*>(state)->refCount;
31 }
32 
33 /// Decrement the number of times this state is referenced.
35  assert(state->refCount > 0);
36  ProgramState *s = const_cast<ProgramState*>(state);
37  if (--s->refCount == 0) {
38  ProgramStateManager &Mgr = s->getStateManager();
39  Mgr.StateSet.RemoveNode(s);
40  s->~ProgramState();
41  Mgr.freeStates.push_back(s);
42  }
43 }
44 }}
45 
47  StoreRef st, GenericDataMap gdm)
48  : stateMgr(mgr),
49  Env(env),
50  store(st.getStore()),
51  GDM(gdm),
52  refCount(0) {
53  stateMgr->getStoreManager().incrementReferenceCount(store);
54 }
55 
57  : stateMgr(RHS.stateMgr), Env(RHS.Env), store(RHS.store), GDM(RHS.GDM),
58  refCount(0) {
59  stateMgr->getStoreManager().incrementReferenceCount(store);
60 }
61 
63  if (store)
64  stateMgr->getStoreManager().decrementReferenceCount(store);
65 }
66 
67 int64_t ProgramState::getID() const {
68  return getStateManager().Alloc.identifyKnownAlignedObject<ProgramState>(this);
69 }
70 
72  StoreManagerCreator CreateSMgr,
73  ConstraintManagerCreator CreateCMgr,
74  llvm::BumpPtrAllocator &alloc,
75  ExprEngine *ExprEng)
76  : Eng(ExprEng), EnvMgr(alloc), GDMFactory(alloc),
77  svalBuilder(createSimpleSValBuilder(alloc, Ctx, *this)),
78  CallEventMgr(new CallEventManager(alloc)), Alloc(alloc) {
79  StoreMgr = (*CreateSMgr)(*this);
80  ConstraintMgr = (*CreateCMgr)(*this, ExprEng);
81 }
82 
83 
85  for (GDMContextsTy::iterator I=GDMContexts.begin(), E=GDMContexts.end();
86  I!=E; ++I)
87  I->second.second(I->second.first);
88 }
89 
92  SymbolReaper &SymReaper) {
93 
94  // This code essentially performs a "mark-and-sweep" of the VariableBindings.
95  // The roots are any Block-level exprs and Decls that our liveness algorithm
96  // tells us are live. We then see what Decls they may reference, and keep
97  // those around. This code more than likely can be made faster, and the
98  // frequency of which this method is called should be experimented with
99  // for optimum performance.
100  ProgramState NewState = *state;
101 
102  NewState.Env = EnvMgr.removeDeadBindings(NewState.Env, SymReaper, state);
103 
104  // Clean up the store.
105  StoreRef newStore = StoreMgr->removeDeadBindings(NewState.getStore(), LCtx,
106  SymReaper);
107  NewState.setStore(newStore);
108  SymReaper.setReapedStore(newStore);
109 
110  return getPersistentState(NewState);
111 }
112 
114  SVal V,
115  const LocationContext *LCtx,
116  bool notifyChanges) const {
118  ProgramStateRef newState = makeWithStore(Mgr.StoreMgr->Bind(getStore(),
119  LV, V));
120  const MemRegion *MR = LV.getAsRegion();
121  if (MR && notifyChanges)
122  return Mgr.getOwningEngine().processRegionChange(newState, MR, LCtx);
123 
124  return newState;
125 }
126 
129  const LocationContext *LCtx) const {
131  const MemRegion *R = loc.castAs<loc::MemRegionVal>().getRegion();
132  const StoreRef &newStore = Mgr.StoreMgr->BindDefaultInitial(getStore(), R, V);
133  ProgramStateRef new_state = makeWithStore(newStore);
134  return Mgr.getOwningEngine().processRegionChange(new_state, R, LCtx);
135 }
136 
140  const MemRegion *R = loc.castAs<loc::MemRegionVal>().getRegion();
141  const StoreRef &newStore = Mgr.StoreMgr->BindDefaultZero(getStore(), R);
142  ProgramStateRef new_state = makeWithStore(newStore);
143  return Mgr.getOwningEngine().processRegionChange(new_state, R, LCtx);
144 }
145 
146 typedef ArrayRef<const MemRegion *> RegionList;
147 typedef ArrayRef<SVal> ValueList;
148 
151  const Expr *E, unsigned Count,
152  const LocationContext *LCtx,
153  bool CausedByPointerEscape,
154  InvalidatedSymbols *IS,
155  const CallEvent *Call,
156  RegionAndSymbolInvalidationTraits *ITraits) const {
157  SmallVector<SVal, 8> Values;
158  for (RegionList::const_iterator I = Regions.begin(),
159  End = Regions.end(); I != End; ++I)
160  Values.push_back(loc::MemRegionVal(*I));
161 
162  return invalidateRegionsImpl(Values, E, Count, LCtx, CausedByPointerEscape,
163  IS, ITraits, Call);
164 }
165 
168  const Expr *E, unsigned Count,
169  const LocationContext *LCtx,
170  bool CausedByPointerEscape,
171  InvalidatedSymbols *IS,
172  const CallEvent *Call,
173  RegionAndSymbolInvalidationTraits *ITraits) const {
174 
175  return invalidateRegionsImpl(Values, E, Count, LCtx, CausedByPointerEscape,
176  IS, ITraits, Call);
177 }
178 
180 ProgramState::invalidateRegionsImpl(ValueList Values,
181  const Expr *E, unsigned Count,
182  const LocationContext *LCtx,
183  bool CausedByPointerEscape,
184  InvalidatedSymbols *IS,
185  RegionAndSymbolInvalidationTraits *ITraits,
186  const CallEvent *Call) const {
188  ExprEngine &Eng = Mgr.getOwningEngine();
189 
190  InvalidatedSymbols InvalidatedSyms;
191  if (!IS)
192  IS = &InvalidatedSyms;
193 
194  RegionAndSymbolInvalidationTraits ITraitsLocal;
195  if (!ITraits)
196  ITraits = &ITraitsLocal;
197 
198  StoreManager::InvalidatedRegions TopLevelInvalidated;
200  const StoreRef &newStore
201  = Mgr.StoreMgr->invalidateRegions(getStore(), Values, E, Count, LCtx, Call,
202  *IS, *ITraits, &TopLevelInvalidated,
203  &Invalidated);
204 
205  ProgramStateRef newState = makeWithStore(newStore);
206 
207  if (CausedByPointerEscape) {
208  newState = Eng.notifyCheckersOfPointerEscape(newState, IS,
209  TopLevelInvalidated,
210  Call,
211  *ITraits);
212  }
213 
214  return Eng.processRegionChanges(newState, IS, TopLevelInvalidated,
215  Invalidated, LCtx, Call);
216 }
217 
219  assert(!LV.getAs<loc::MemRegionVal>() && "Use invalidateRegion instead.");
220 
221  Store OldStore = getStore();
222  const StoreRef &newStore =
223  getStateManager().StoreMgr->killBinding(OldStore, LV);
224 
225  if (newStore.getStore() == OldStore)
226  return this;
227 
228  return makeWithStore(newStore);
229 }
230 
233  const StackFrameContext *CalleeCtx) const {
234  const StoreRef &NewStore =
235  getStateManager().StoreMgr->enterStackFrame(getStore(), Call, CalleeCtx);
236  return makeWithStore(NewStore);
237 }
238 
240  const ImplicitParamDecl *SelfDecl = LCtx->getSelfDecl();
241  if (!SelfDecl)
242  return SVal();
243  return getSVal(getRegion(SelfDecl, LCtx));
244 }
245 
247  // We only want to do fetches from regions that we can actually bind
248  // values. For example, SymbolicRegions of type 'id<...>' cannot
249  // have direct bindings (but their can be bindings on their subregions).
250  if (!R->isBoundable())
251  return UnknownVal();
252 
253  if (const TypedValueRegion *TR = dyn_cast<TypedValueRegion>(R)) {
254  QualType T = TR->getValueType();
256  return getSVal(R);
257  }
258 
259  return UnknownVal();
260 }
261 
262 SVal ProgramState::getSVal(Loc location, QualType T) const {
263  SVal V = getRawSVal(location, T);
264 
265  // If 'V' is a symbolic value that is *perfectly* constrained to
266  // be a constant value, use that value instead to lessen the burden
267  // on later analysis stages (so we have less symbolic values to reason
268  // about).
269  // We only go into this branch if we can convert the APSInt value we have
270  // to the type of T, which is not always the case (e.g. for void).
271  if (!T.isNull() && (T->isIntegralOrEnumerationType() || Loc::isLocType(T))) {
272  if (SymbolRef sym = V.getAsSymbol()) {
273  if (const llvm::APSInt *Int = getStateManager()
275  .getSymVal(this, sym)) {
276  // FIXME: Because we don't correctly model (yet) sign-extension
277  // and truncation of symbolic values, we need to convert
278  // the integer value to the correct signedness and bitwidth.
279  //
280  // This shows up in the following:
281  //
282  // char foo();
283  // unsigned x = foo();
284  // if (x == 54)
285  // ...
286  //
287  // The symbolic value stored to 'x' is actually the conjured
288  // symbol for the call to foo(); the type of that symbol is 'char',
289  // not unsigned.
290  const llvm::APSInt &NewV = getBasicVals().Convert(T, *Int);
291 
292  if (V.getAs<Loc>())
293  return loc::ConcreteInt(NewV);
294  else
295  return nonloc::ConcreteInt(NewV);
296  }
297  }
298  }
299 
300  return V;
301 }
302 
304  const LocationContext *LCtx,
305  SVal V, bool Invalidate) const{
306  Environment NewEnv =
307  getStateManager().EnvMgr.bindExpr(Env, EnvironmentEntry(S, LCtx), V,
308  Invalidate);
309  if (NewEnv == Env)
310  return this;
311 
312  ProgramState NewSt = *this;
313  NewSt.Env = NewEnv;
314  return getStateManager().getPersistentState(NewSt);
315 }
316 
318  DefinedOrUnknownSVal UpperBound,
319  bool Assumption,
320  QualType indexTy) const {
321  if (Idx.isUnknown() || UpperBound.isUnknown())
322  return this;
323 
324  // Build an expression for 0 <= Idx < UpperBound.
325  // This is the same as Idx + MIN < UpperBound + MIN, if overflow is allowed.
326  // FIXME: This should probably be part of SValBuilder.
328  SValBuilder &svalBuilder = SM.getSValBuilder();
329  ASTContext &Ctx = svalBuilder.getContext();
330 
331  // Get the offset: the minimum value of the array index type.
332  BasicValueFactory &BVF = svalBuilder.getBasicValueFactory();
333  if (indexTy.isNull())
334  indexTy = svalBuilder.getArrayIndexType();
335  nonloc::ConcreteInt Min(BVF.getMinValue(indexTy));
336 
337  // Adjust the index.
338  SVal newIdx = svalBuilder.evalBinOpNN(this, BO_Add,
339  Idx.castAs<NonLoc>(), Min, indexTy);
340  if (newIdx.isUnknownOrUndef())
341  return this;
342 
343  // Adjust the upper bound.
344  SVal newBound =
345  svalBuilder.evalBinOpNN(this, BO_Add, UpperBound.castAs<NonLoc>(),
346  Min, indexTy);
347 
348  if (newBound.isUnknownOrUndef())
349  return this;
350 
351  // Build the actual comparison.
352  SVal inBound = svalBuilder.evalBinOpNN(this, BO_LT, newIdx.castAs<NonLoc>(),
353  newBound.castAs<NonLoc>(), Ctx.IntTy);
354  if (inBound.isUnknownOrUndef())
355  return this;
356 
357  // Finally, let the constraint manager take care of it.
358  ConstraintManager &CM = SM.getConstraintManager();
359  return CM.assume(this, inBound.castAs<DefinedSVal>(), Assumption);
360 }
361 
363  ConditionTruthVal IsNull = isNull(V);
364  if (IsNull.isUnderconstrained())
365  return IsNull;
366  return ConditionTruthVal(!IsNull.getValue());
367 }
368 
370  return stateMgr->getSValBuilder().areEqual(this, Lhs, Rhs);
371 }
372 
374  if (V.isZeroConstant())
375  return true;
376 
377  if (V.isConstant())
378  return false;
379 
380  SymbolRef Sym = V.getAsSymbol(/* IncludeBaseRegion */ true);
381  if (!Sym)
382  return ConditionTruthVal();
383 
384  return getStateManager().ConstraintMgr->isNull(this, Sym);
385 }
386 
388  ProgramState State(this,
389  EnvMgr.getInitialEnvironment(),
390  StoreMgr->getInitialStore(InitLoc),
391  GDMFactory.getEmptyMap());
392 
393  return getPersistentState(State);
394 }
395 
397  ProgramStateRef FromState,
398  ProgramStateRef GDMState) {
399  ProgramState NewState(*FromState);
400  NewState.GDM = GDMState->GDM;
401  return getPersistentState(NewState);
402 }
403 
405 
406  llvm::FoldingSetNodeID ID;
407  State.Profile(ID);
408  void *InsertPos;
409 
410  if (ProgramState *I = StateSet.FindNodeOrInsertPos(ID, InsertPos))
411  return I;
412 
413  ProgramState *newState = nullptr;
414  if (!freeStates.empty()) {
415  newState = freeStates.back();
416  freeStates.pop_back();
417  }
418  else {
419  newState = (ProgramState*) Alloc.Allocate<ProgramState>();
420  }
421  new (newState) ProgramState(State);
422  StateSet.InsertNode(newState, InsertPos);
423  return newState;
424 }
425 
426 ProgramStateRef ProgramState::makeWithStore(const StoreRef &store) const {
427  ProgramState NewSt(*this);
428  NewSt.setStore(store);
429  return getStateManager().getPersistentState(NewSt);
430 }
431 
432 void ProgramState::setStore(const StoreRef &newStore) {
433  Store newStoreStore = newStore.getStore();
434  if (newStoreStore)
435  stateMgr->getStoreManager().incrementReferenceCount(newStoreStore);
436  if (store)
437  stateMgr->getStoreManager().decrementReferenceCount(store);
438  store = newStoreStore;
439 }
440 
441 //===----------------------------------------------------------------------===//
442 // State pretty-printing.
443 //===----------------------------------------------------------------------===//
444 
445 void ProgramState::printJson(raw_ostream &Out, const LocationContext *LCtx,
446  const char *NL, unsigned int Space,
447  bool IsDot) const {
448  Indent(Out, Space, IsDot) << "\"program_state\": {" << NL;
449  ++Space;
450 
452 
453  // Print the store.
454  Mgr.getStoreManager().printJson(Out, getStore(), NL, Space, IsDot);
455 
456  // Print out the environment.
457  Env.printJson(Out, Mgr.getContext(), LCtx, NL, Space, IsDot);
458 
459  // Print out the constraints.
460  Mgr.getConstraintManager().printJson(Out, this, NL, Space, IsDot);
461 
462  // Print out the tracked dynamic types.
463  printDynamicTypeInfoJson(Out, this, NL, Space, IsDot);
464 
465  // Print checker-specific data.
466  Mgr.getOwningEngine().printJson(Out, this, LCtx, NL, Space, IsDot);
467 
468  --Space;
469  Indent(Out, Space, IsDot) << '}';
470 }
471 
472 void ProgramState::printDOT(raw_ostream &Out, const LocationContext *LCtx,
473  unsigned int Space) const {
474  printJson(Out, LCtx, /*NL=*/"\\l", Space, /*IsDot=*/true);
475 }
476 
477 LLVM_DUMP_METHOD void ProgramState::dump() const {
478  printJson(llvm::errs());
479 }
480 
482  return stateMgr->getOwningEngine().getAnalysisManager();
483 }
484 
485 //===----------------------------------------------------------------------===//
486 // Generic Data Map.
487 //===----------------------------------------------------------------------===//
488 
489 void *const* ProgramState::FindGDM(void *K) const {
490  return GDM.lookup(K);
491 }
492 
493 void*
495  void *(*CreateContext)(llvm::BumpPtrAllocator&),
496  void (*DeleteContext)(void*)) {
497 
498  std::pair<void*, void (*)(void*)>& p = GDMContexts[K];
499  if (!p.first) {
500  p.first = CreateContext(Alloc);
501  p.second = DeleteContext;
502  }
503 
504  return p.first;
505 }
506 
508  ProgramState::GenericDataMap M1 = St->getGDM();
509  ProgramState::GenericDataMap M2 = GDMFactory.add(M1, Key, Data);
510 
511  if (M1 == M2)
512  return St;
513 
514  ProgramState NewSt = *St;
515  NewSt.GDM = M2;
516  return getPersistentState(NewSt);
517 }
518 
520  ProgramState::GenericDataMap OldM = state->getGDM();
521  ProgramState::GenericDataMap NewM = GDMFactory.remove(OldM, Key);
522 
523  if (NewM == OldM)
524  return state;
525 
526  ProgramState NewState = *state;
527  NewState.GDM = NewM;
528  return getPersistentState(NewState);
529 }
530 
532  bool wasVisited = !visited.insert(val.getCVData()).second;
533  if (wasVisited)
534  return true;
535 
536  StoreManager &StoreMgr = state->getStateManager().getStoreManager();
537  // FIXME: We don't really want to use getBaseRegion() here because pointer
538  // arithmetic doesn't apply, but scanReachableSymbols only accepts base
539  // regions right now.
540  const MemRegion *R = val.getRegion()->getBaseRegion();
541  return StoreMgr.scanReachableSymbols(val.getStore(), R, *this);
542 }
543 
545  for (nonloc::CompoundVal::iterator I=val.begin(), E=val.end(); I!=E; ++I)
546  if (!scan(*I))
547  return false;
548 
549  return true;
550 }
551 
553  for (SymExpr::symbol_iterator SI = sym->symbol_begin(),
554  SE = sym->symbol_end();
555  SI != SE; ++SI) {
556  bool wasVisited = !visited.insert(*SI).second;
557  if (wasVisited)
558  continue;
559 
560  if (!visitor.VisitSymbol(*SI))
561  return false;
562  }
563 
564  return true;
565 }
566 
569  return scan(X->getRegion());
570 
573  return scan(*X);
574 
576  return scan(X->getLoc());
577 
578  if (SymbolRef Sym = val.getAsSymbol())
579  return scan(Sym);
580 
582  return scan(*X);
583 
584  return true;
585 }
586 
588  if (isa<MemSpaceRegion>(R))
589  return true;
590 
591  bool wasVisited = !visited.insert(R).second;
592  if (wasVisited)
593  return true;
594 
595  if (!visitor.VisitMemRegion(R))
596  return false;
597 
598  // If this is a symbolic region, visit the symbol for the region.
599  if (const SymbolicRegion *SR = dyn_cast<SymbolicRegion>(R))
600  if (!visitor.VisitSymbol(SR->getSymbol()))
601  return false;
602 
603  // If this is a subregion, also visit the parent regions.
604  if (const SubRegion *SR = dyn_cast<SubRegion>(R)) {
605  const MemRegion *Super = SR->getSuperRegion();
606  if (!scan(Super))
607  return false;
608 
609  // When we reach the topmost region, scan all symbols in it.
610  if (isa<MemSpaceRegion>(Super)) {
611  StoreManager &StoreMgr = state->getStateManager().getStoreManager();
612  if (!StoreMgr.scanReachableSymbols(state->getStore(), SR, *this))
613  return false;
614  }
615  }
616 
617  // Regions captured by a block are also implicitly reachable.
618  if (const BlockDataRegion *BDR = dyn_cast<BlockDataRegion>(R)) {
619  BlockDataRegion::referenced_vars_iterator I = BDR->referenced_vars_begin(),
620  E = BDR->referenced_vars_end();
621  for ( ; I != E; ++I) {
622  if (!scan(I.getCapturedRegion()))
623  return false;
624  }
625  }
626 
627  return true;
628 }
629 
631  ScanReachableSymbols S(this, visitor);
632  return S.scan(val);
633 }
634 
636  llvm::iterator_range<region_iterator> Reachable,
637  SymbolVisitor &visitor) const {
638  ScanReachableSymbols S(this, visitor);
639  for (const MemRegion *R : Reachable) {
640  if (!S.scan(R))
641  return false;
642  }
643  return true;
644 }
clang::ento::ProgramState::scanReachableSymbols
bool scanReachableSymbols(SVal val, SymbolVisitor &visitor) const
Visits the symbols reachable from the given SVal using the provided SymbolVisitor.
Definition: ProgramState.cpp:630
clang::ento::ProgramStateManager::getOwningEngine
ExprEngine & getOwningEngine()
Definition: ProgramState.h:539
clang::ento::Loc::isLocType
static bool isLocType(QualType T)
Definition: SVals.h:335
clang::ento::ProgramState::killBinding
LLVM_NODISCARD ProgramStateRef killBinding(Loc LV) const
Definition: ProgramState.cpp:218
clang::ento::ProgramState::assumeInBound
LLVM_NODISCARD ProgramStateRef assumeInBound(DefinedOrUnknownSVal idx, DefinedOrUnknownSVal upperBound, bool assumption, QualType IndexType=QualType()) const
Definition: ProgramState.cpp:317
clang::ento::SymbolVisitor
Definition: SymbolManager.h:586
clang::ento::ProgramStateManager::ProgramStateManager
ProgramStateManager(ASTContext &Ctx, StoreManagerCreator CreateStoreManager, ConstraintManagerCreator CreateConstraintManager, llvm::BumpPtrAllocator &alloc, ExprEngine *expreng)
Definition: ProgramState.cpp:71
clang::ento::BasicValueFactory
Definition: BasicValueFactory.h:107
clang::LocationContext
It wraps the AnalysisDeclContext to represent both the call stack with the help of StackFrameContext ...
Definition: AnalysisDeclContext.h:215
clang::ento::SymExpr::symbol_iterator
Iterator over symbols that the current symbol depends on.
Definition: SymExpr.h:70
clang::ento::nonloc::CompoundVal
Definition: SVals.h:463
clang::ento::SVal::castAs
T castAs() const
Convert to the specified SVal type, asserting that this SVal is of the desired type.
Definition: SVals.h:102
clang::ento::NonLoc
Definition: SVals.h:304
clang::ento::SVal::getAsRegion
const MemRegion * getAsRegion() const
Definition: SVals.cpp:131
clang::ento::ConstraintManager
Definition: ConstraintManager.h:77
clang::ento::ProgramState::getSelfSVal
SVal getSelfSVal(const LocationContext *LC) const
Return the value of 'self' if available in the given context.
Definition: ProgramState.cpp:239
clang::ento::StoreManagerCreator
std::unique_ptr< StoreManager >(* StoreManagerCreator)(ProgramStateManager &)
Definition: ProgramState.h:43
clang::ento::ConstraintManager::printJson
virtual void printJson(raw_ostream &Out, ProgramStateRef State, const char *NL, unsigned int Space, bool IsDot) const =0
clang::ento::DefinedOrUnknownSVal
Definition: SVals.h:235
llvm::SmallVector
Definition: LLVM.h:38
clang::if
if(T->getSizeExpr()) TRY_TO(TraverseStmt(T -> getSizeExpr()))
Definition: RecursiveASTVisitor.h:1003
clang::ento::createSimpleSValBuilder
SValBuilder * createSimpleSValBuilder(llvm::BumpPtrAllocator &alloc, ASTContext &context, ProgramStateManager &stateMgr)
Definition: SimpleSValBuilder.cpp:79
clang::ento::ProgramStateManager::getSValBuilder
SValBuilder & getSValBuilder()
Definition: ProgramState.h:511
clang::ento::ConstraintManager::assume
virtual ProgramStateRef assume(ProgramStateRef state, DefinedSVal Cond, bool Assumption)=0
clang::ento::ProgramStateRef
IntrusiveRefCntPtr< const ProgramState > ProgramStateRef
Definition: ProgramState_Fwd.h:37
clang::QualType
A (possibly-)qualified type.
Definition: Type.h:674
clang::ento::EnvironmentManager::bindExpr
Environment bindExpr(Environment Env, const EnvironmentEntry &E, SVal V, bool Invalidate)
Bind a symbolic value to the given environment entry.
Definition: Environment.cpp:136
clang::ento::SValBuilder::getArrayIndexType
QualType getArrayIndexType() const
Definition: SValBuilder.h:176
clang::ento::StoreManager::InvalidatedRegions
SmallVector< const MemRegion *, 8 > InvalidatedRegions
Definition: Store.h:202
clang::ento::ProgramState::GenericDataMap
llvm::ImmutableMap< void *, void * > GenericDataMap
Definition: ProgramState.h:73
llvm::Optional
Definition: LLVM.h:40
clang::StackFrameContext
It represents a stack frame of the call stack (based on CallEvent).
Definition: AnalysisDeclContext.h:295
clang::ento::nonloc::ConcreteInt
Value representing integer constant.
Definition: SVals.h:385
clang::tooling::X
static ToolExecutorPluginRegistry::Add< AllTUsToolExecutorPlugin > X("all-TUs", "Runs FrontendActions on all TUs in the compilation database. " "Tool results are stored in memory.")
clang::ento::UnknownVal
Definition: SVals.h:256
clang::ento::loc::MemRegionVal
Definition: SVals.h:605
clang::ento::loc::ConcreteInt
Definition: SVals.h:647
clang::ento::Store
const void * Store
Store - This opaque type encapsulates an immutable mapping from locations to values.
Definition: StoreRef.h:27
clang::ento::ProgramState
Definition: ProgramState.h:70
End
SourceLocation End
Definition: USRLocFinder.cpp:167
clang::ento::StoreManager
Definition: Store.h:53
clang::ento::printDynamicTypeInfoJson
void printDynamicTypeInfoJson(raw_ostream &Out, ProgramStateRef State, const char *NL="\n", unsigned int Space=0, bool IsDot=false)
clang::ento::SVal::getAs
Optional< T > getAs() const
Convert to the specified SVal type, returning None if this SVal is not of the desired type.
Definition: SVals.h:110
clang::ento::ProgramStateManager::addGDM
ProgramStateRef addGDM(ProgramStateRef St, void *Key, void *Data)
Definition: ProgramState.cpp:507
clang::ento::SymbolVisitor::VisitMemRegion
virtual bool VisitMemRegion(const MemRegion *)
Definition: SymbolManager.h:600
CallEvent.h
clang::ento::ProgramState::bindLoc
LLVM_NODISCARD ProgramStateRef bindLoc(Loc location, SVal V, const LocationContext *LCtx, bool notifyChanges=true) const
clang::ento::MemRegion
MemRegion - The root abstract class for all memory regions.
Definition: MemRegion.h:94
clang::ento::ConditionTruthVal
Definition: ConstraintManager.h:38
APSInt
llvm::APSInt APSInt
Definition: ByteCodeEmitter.cpp:19
clang::ento::ProgramState::~ProgramState
~ProgramState()
Definition: ProgramState.cpp:62
clang::ento::ProgramStateManager::getPersistentStateWithGDM
ProgramStateRef getPersistentStateWithGDM(ProgramStateRef FromState, ProgramStateRef GDMState)
Definition: ProgramState.cpp:396
JsonSupport.h
V
#define V(N, I)
Definition: ASTContext.h:3127
clang::ento::DefinedSVal
Definition: SVals.h:268
clang::ento::StoreRef::getStore
Store getStore() const
Definition: StoreRef.h:46
clang::ento::ProgramState::enterStackFrame
LLVM_NODISCARD ProgramStateRef enterStackFrame(const CallEvent &Call, const StackFrameContext *CalleeCtx) const
enterStackFrame - Returns the state for entry to the given stack frame, preserving the current state.
Definition: ProgramState.cpp:232
clang::ento::ProgramStateManager::getContext
ASTContext & getContext()
Definition: ProgramState.h:504
clang::ento::MemRegion::isBoundable
virtual bool isBoundable() const
Definition: MemRegion.h:174
clang::ento::BasicValueFactory::Convert
const llvm::APSInt & Convert(const llvm::APSInt &To, const llvm::APSInt &From)
Convert - Create a new persistent APSInt with the same value as 'From' but with the bitwidth and sign...
Definition: BasicValueFactory.h:156
clang::ento::BlockDataRegion::referenced_vars_iterator
Definition: MemRegion.h:694
clang::ento::SValBuilder::getContext
ASTContext & getContext()
Definition: SValBuilder.h:167
clang::ento::ProgramStateManager::removeDeadBindingsFromEnvironmentAndStore
ProgramStateRef removeDeadBindingsFromEnvironmentAndStore(ProgramStateRef St, const StackFrameContext *LCtx, SymbolReaper &SymReaper)
Definition: ProgramState.cpp:90
clang::ento::StoreManager::printJson
virtual void printJson(raw_ostream &Out, Store S, const char *NL, unsigned int Space, bool IsDot) const =0
clang::ento::ProgramState::getID
int64_t getID() const
Definition: ProgramState.cpp:67
clang::ASTContext
Holds long-lived AST nodes (such as types and decls) that can be referred to throughout the semantic ...
Definition: ASTContext.h:209
clang::ento::SymExpr
Symbolic value.
Definition: SymExpr.h:29
clang::ento::StoreRef
Definition: StoreRef.h:29
clang::ento::ProgramState::isNonNull
ConditionTruthVal isNonNull(SVal V) const
Check if the given SVal is not constrained to zero and is not a zero constant.
Definition: ProgramState.cpp:362
clang::ento::nonloc::LazyCompoundVal::getStore
const void * getStore() const
Definition: SVals.cpp:203
clang::LocationContext::getSelfDecl
const ImplicitParamDecl * getSelfDecl() const
Definition: AnalysisDeclContext.h:256
clang::ento::ProgramState::getStore
Store getStore() const
Return the store associated with this state.
Definition: ProgramState.h:123
clang::ento::ProgramState::getAnalysisManager
AnalysisManager & getAnalysisManager() const
Definition: ProgramState.cpp:481
clang::ento::ProgramState::printJson
void printJson(raw_ostream &Out, const LocationContext *LCtx=nullptr, const char *NL="\n", unsigned int Space=0, bool IsDot=false) const
Definition: ProgramState.cpp:445
clang::ento::BlockDataRegion
BlockDataRegion - A region that represents a block instance.
Definition: MemRegion.h:663
clang::ImplicitParamDecl
Definition: Decl.h:1599
clang::ento::SValBuilder::getBasicValueFactory
BasicValueFactory & getBasicValueFactory()
Definition: SValBuilder.h:180
ValueList
ArrayRef< SVal > ValueList
Definition: ProgramState.cpp:147
clang::ento::SymbolReaper::setReapedStore
void setReapedStore(StoreRef st)
Set to the value of the symbolic store after StoreManager::removeDeadBindings has been called.
Definition: SymbolManager.h:579
clang::ento::ProgramStateManager::removeGDM
ProgramStateRef removeGDM(ProgramStateRef state, void *Key)
Definition: ProgramState.cpp:519
clang::ento::ProgramState::getConstraintManager
ConstraintManager & getConstraintManager() const
Return the ConstraintManager.
Definition: ProgramState.h:654
clang::ento::SymbolReaper
A class responsible for cleaning up unused symbols.
Definition: SymbolManager.h:505
clang::ento::ProgramState::bindDefaultInitial
LLVM_NODISCARD ProgramStateRef bindDefaultInitial(SVal loc, SVal V, const LocationContext *LCtx) const
Initializes the region of memory represented by loc with an initial value.
Definition: ProgramState.cpp:128
clang::ento::StoreManager::decrementReferenceCount
virtual void decrementReferenceCount(Store store)
If the StoreManager supports it, decrement the reference count of the specified Store object.
Definition: Store.h:200
clang::ento::nonloc::LazyCompoundVal
Definition: SVals.h:492
clang::ento::SymbolicRegion
SymbolicRegion - A special, "non-concrete" region.
Definition: MemRegion.h:754
state
and static some checkers Checker The latter are built on top of the former via the Checker and CheckerVisitor and attempts to isolate them from much of the gore of the internal analysis the analyzer is basically a source code simulator that traces out possible paths of execution The state of the and the combination of state and program point is a node in an exploded which has the entry program point and initial state
Definition: README.txt:30
clang::ento::Loc
Definition: SVals.h:326
clang::ento::EnvironmentManager::removeDeadBindings
Environment removeDeadBindings(Environment Env, SymbolReaper &SymReaper, ProgramStateRef state)
Definition: Environment.cpp:178
clang::ento::SValBuilder
Definition: SValBuilder.h:53
clang::ento::ProgramState::getStateManager
ProgramStateManager & getStateManager() const
Return the ProgramStateManager associated with this state.
Definition: ProgramState.h:108
clang::ento::ProgramState::getBasicVals
BasicValueFactory & getBasicVals() const
Definition: ProgramState.h:792
clang::ento::ProgramState::invalidateRegions
LLVM_NODISCARD ProgramStateRef invalidateRegions(ArrayRef< const MemRegion * > Regions, const Expr *E, unsigned BlockCount, const LocationContext *LCtx, bool CausesPointerEscape, InvalidatedSymbols *IS=nullptr, const CallEvent *Call=nullptr, RegionAndSymbolInvalidationTraits *ITraits=nullptr) const
Returns the state with bindings for the given regions cleared from the store.
clang::ento::ProgramStateManager::getPersistentState
ProgramStateRef getPersistentState(ProgramState &Impl)
Definition: ProgramState.cpp:404
clang::Indent
raw_ostream & Indent(raw_ostream &Out, const unsigned int Space, bool IsDot)
Definition: JsonSupport.h:21
clang::ento::ExprEngine::printJson
void printJson(raw_ostream &Out, ProgramStateRef State, const LocationContext *LCtx, const char *NL, unsigned int Space, bool IsDot) const
printJson - Called by ProgramStateManager to print checker-specific data.
Definition: ExprEngine.cpp:600
clang::ento::ProgramState::BindExpr
LLVM_NODISCARD ProgramStateRef BindExpr(const Stmt *S, const LocationContext *LCtx, SVal V, bool Invalidate=true) const
Create a new state by binding the value 'V' to the statement 'S' in the state's environment.
Definition: ProgramState.cpp:303
clang::ento::nonloc::CompoundVal::iterator
llvm::ImmutableList< SVal >::iterator iterator
Definition: SVals.h:473
clang::ento::CallEventManager
Manages the lifetime of CallEvent objects.
Definition: CallEvent.h:1220
clang::ento::ProgramStateManager
Definition: ProgramState.h:461
clang::ento::StoreManager::scanReachableSymbols
virtual bool scanReachableSymbols(Store S, const MemRegion *R, ScanReachableSymbols &Visitor)=0
Finds the transitive closure of symbols within the given region.
clang::ASTContext::IntTy
CanQualType IntTy
Definition: ASTContext.h:1082
clang::ento::ProgramState::printDOT
void printDOT(raw_ostream &Out, const LocationContext *LCtx=nullptr, unsigned int Space=0) const
Definition: ProgramState.cpp:472
clang::ento::ProgramStateManager::getInitialState
ProgramStateRef getInitialState(const LocationContext *InitLoc)
Definition: ProgramState.cpp:387
clang::ento::SValBuilder::evalBinOpNN
virtual SVal evalBinOpNN(ProgramStateRef state, BinaryOperator::Opcode op, NonLoc lhs, NonLoc rhs, QualType resultTy)=0
Create a new value which represents a binary expression with two non- location operands.
clang::QualType::isNull
bool isNull() const
Return true if this QualType doesn't point to a type yet.
Definition: Type.h:739
llvm::ArrayRef
Definition: LLVM.h:34
clang::ento::nonloc::CompoundVal::end
iterator end() const
Definition: SVals.cpp:237
clang::ento::ProgramStateManager::ProgramState
friend class ProgramState
Definition: ProgramState.h:462
clang::ento::ScanReachableSymbols
Definition: ProgramState.h:863
RegionList
ArrayRef< const MemRegion * > RegionList
Definition: ProgramState.cpp:146
clang::ento::ProgramState::isNull
ConditionTruthVal isNull(SVal V) const
Check if the given SVal is constrained to zero or is a zero constant.
Definition: ProgramState.cpp:373
clang::ento::ProgramState::getSVal
SVal getSVal(const Stmt *S, const LocationContext *LCtx) const
Returns the SVal bound to the statement 'S' in the state's environment.
Definition: ProgramState.h:763
State
LineState State
Definition: UnwrappedLineFormatter.cpp:1052
clang::ento::nonloc::LazyCompoundVal::getRegion
const TypedValueRegion * getRegion() const
Definition: SVals.cpp:207
clang::ento::AnalysisManager
Definition: AnalysisManager.h:31
clang::ento::StoreManager::incrementReferenceCount
virtual void incrementReferenceCount(Store store)
If the StoreManager supports it, increment the reference count of the specified Store object.
Definition: Store.h:195
clang::ento::ProgramState::bindDefaultZero
LLVM_NODISCARD ProgramStateRef bindDefaultZero(SVal loc, const LocationContext *LCtx) const
Performs C++ zero-initialization procedure on the region of memory represented by loc.
Definition: ProgramState.cpp:138
clang::ento::ExprEngine::getAnalysisManager
AnalysisManager & getAnalysisManager()
Definition: ExprEngine.h:204
clang::ento::BasicValueFactory::getMinValue
const llvm::APSInt & getMinValue(const llvm::APSInt &v)
Definition: BasicValueFactory.h:186
clang::ento::ExprEngine
Definition: ExprEngine.h:123
ProgramState.h
clang::ento::ProgramStateManager::getStoreManager
StoreManager & getStoreManager()
Definition: ProgramState.h:537
clang::ento::ProgramState::FindGDM
void *const * FindGDM(void *K) const
Definition: ProgramState.cpp:489
clang::ento::ExprEngine::processRegionChange
ProgramStateRef processRegionChange(ProgramStateRef state, const MemRegion *MR, const LocationContext *LCtx)
Definition: ExprEngine.h:400
clang::ento::ProgramStateManager::FindGDMContext
void * FindGDMContext(void *index, void *(*CreateContext)(llvm::BumpPtrAllocator &), void(*DeleteContext)(void *))
Definition: ProgramState.cpp:494
ExprEngine.h
clang::ento::SValBuilder::areEqual
ConditionTruthVal areEqual(ProgramStateRef state, SVal lhs, SVal rhs)
Definition: SValBuilder.cpp:485
clang::ento::ProgramState::getSValAsScalarOrLoc
SVal getSValAsScalarOrLoc(const Stmt *Ex, const LocationContext *LCtx) const
Definition: ProgramState.h:770
clang::Builtin::ID
ID
Definition: Builtins.h:48
clang::ento::ScanReachableSymbols::scan
bool scan(nonloc::LazyCompoundVal val)
Definition: ProgramState.cpp:531
clang::ento::nonloc::LocAsInteger
Definition: SVals.h:416
clang
Definition: CalledOnceCheck.h:17
clang::ento::nonloc::CompoundVal::begin
iterator begin() const
Definition: SVals.cpp:233
CFG.h
clang::ento::ProgramStateManager::~ProgramStateManager
~ProgramStateManager()
Definition: ProgramState.cpp:84
clang::ento::SVal::isUnknownOrUndef
bool isUnknownOrUndef() const
Definition: SVals.h:143
clang::ento::ProgramStateRelease
void ProgramStateRelease(const ProgramState *state)
Decrement the number of times this state is referenced.
Definition: ProgramState.cpp:34
clang::Stmt
Stmt - This represents one statement.
Definition: Stmt.h:69
clang::ento::CallEvent
Represents an abstract call to a function or method along a particular path.
Definition: CallEvent.h:142
clang::ento::SVal::isUnknown
bool isUnknown() const
Definition: SVals.h:135
clang::ento::Environment::printJson
void printJson(raw_ostream &Out, const ASTContext &Ctx, const LocationContext *LCtx=nullptr, const char *NL="\n", unsigned int Space=0, bool IsDot=false) const
Definition: Environment.cpp:215
s
__device__ __2f16 float bool s
Definition: __clang_hip_libdevice_declares.h:315
clang::ento::ProgramState::getRegion
const VarRegion * getRegion(const VarDecl *D, const LocationContext *LC) const
Utility method for getting regions.
Definition: ProgramState.h:658
clang::ento::SymExpr::symbol_begin
symbol_iterator symbol_begin() const
Definition: SymExpr.h:86
clang::ento::ProgramState::areEqual
ConditionTruthVal areEqual(SVal Lhs, SVal Rhs) const
Definition: ProgramState.cpp:369
clang::ento::ProgramStateManager::getConstraintManager
ConstraintManager & getConstraintManager()
Definition: ProgramState.h:538
clang::ento::ProgramStateRetain
void ProgramStateRetain(const ProgramState *state)
Increments the number of times this state is referenced.
Definition: ProgramState.cpp:29
clang::ento::SVal
SVal - This represents a symbolic expression, which can be either an L-value or an R-value.
Definition: SVals.h:74
clang::ento::ProgramState::dump
void dump() const
Definition: ProgramState.cpp:477
clang::ento::ConditionTruthVal::isUnderconstrained
bool isUnderconstrained() const
Return true if the constrained is underconstrained and we do not know if the constraint is true of va...
Definition: ConstraintManager.h:72
clang::ento::TypedValueRegion
TypedValueRegion - An abstract class representing regions having a typed value.
Definition: MemRegion.h:522
clang::ento::SubRegion
SubRegion - A region that subsets another larger region.
Definition: MemRegion.h:435
clang::ento::SymbolVisitor::VisitSymbol
virtual bool VisitSymbol(SymbolRef sym)=0
A visitor method invoked by ProgramStateManager::scanReachableSymbols.
DynamicType.h
clang::ento::Environment
An immutable map from EnvironemntEntries to SVals.
Definition: Environment.h:56
clang::ento::MemRegion::getBaseRegion
const MemRegion * getBaseRegion() const
Definition: MemRegion.cpp:1292
ProgramStateTrait.h
clang::Expr
This represents one expression.
Definition: Expr.h:109
clang::ento::ConstraintManagerCreator
std::unique_ptr< ConstraintManager >(* ConstraintManagerCreator)(ProgramStateManager &, ExprEngine *)
Definition: ProgramState.h:41
clang::ento::SVal::getAsSymbol
SymbolRef getAsSymbol(bool IncludeBaseRegions=false) const
If this SVal wraps a symbol return that SymbolRef.
Definition: SVals.cpp:123
SM
#define SM(sm)
Definition: Cuda.cpp:81
clang::ento::InvalidatedSymbols
llvm::DenseSet< SymbolRef > InvalidatedSymbols
Definition: Store.h:51
clang::ento::ConditionTruthVal::getValue
bool getValue() const
Definition: ConstraintManager.h:51
AnalysisManager.h
clang::ento::nonloc::LazyCompoundVal::getCVData
const LazyCompoundValData * getCVData() const
Definition: SVals.h:499
clang::ento::EnvironmentManager::getInitialEnvironment
Environment getInitialEnvironment()
Definition: Environment.h:108
clang::ento::ProgramState::ProgramState
ProgramState(ProgramStateManager *mgr, const Environment &env, StoreRef st, GenericDataMap gdm)
This ctor is used when creating the first ProgramState object.
Definition: ProgramState.cpp:46
clang::ento::ProgramState::getRawSVal
SVal getRawSVal(Loc LV, QualType T=QualType()) const
Returns the "raw" SVal bound to LV before any value simplfication.
Definition: ProgramState.h:782
clang::ento::EnvironmentEntry
An entry in the environment consists of a Stmt and an LocationContext.
Definition: Environment.h:35
clang::ento::SymExpr::symbol_end
static symbol_iterator symbol_end()
Definition: SymExpr.h:87
llvm::IntrusiveRefCntPtr< const ProgramState >
clang::Type::isIntegralOrEnumerationType
bool isIntegralOrEnumerationType() const
Determine whether this type is an integral or enumeration type.
Definition: Type.h:7084
clang::ento::BlockDataRegion::referenced_vars_iterator::getCapturedRegion
const VarRegion * getCapturedRegion() const
Definition: MemRegion.h:703
clang::ento::ProgramState::ProgramStateManager
friend class ProgramStateManager
Definition: ProgramState.h:78