clang  15.0.0git
ProgramState.cpp
Go to the documentation of this file.
1 //= ProgramState.cpp - Path-Sensitive "State" for tracking values --*- C++ -*--=
2 //
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6 //
7 //===----------------------------------------------------------------------===//
8 //
9 // This file implements ProgramState and ProgramStateManager.
10 //
11 //===----------------------------------------------------------------------===//
12 
14 #include "clang/Analysis/CFG.h"
21 #include "llvm/Support/raw_ostream.h"
22 
23 using namespace clang;
24 using namespace ento;
25 
26 namespace clang { namespace ento {
27 /// Increments the number of times this state is referenced.
28 
30  ++const_cast<ProgramState*>(state)->refCount;
31 }
32 
33 /// Decrement the number of times this state is referenced.
35  assert(state->refCount > 0);
36  ProgramState *s = const_cast<ProgramState*>(state);
37  if (--s->refCount == 0) {
38  ProgramStateManager &Mgr = s->getStateManager();
39  Mgr.StateSet.RemoveNode(s);
40  s->~ProgramState();
41  Mgr.freeStates.push_back(s);
42  }
43 }
44 }}
45 
47  StoreRef st, GenericDataMap gdm)
48  : stateMgr(mgr),
49  Env(env),
50  store(st.getStore()),
51  GDM(gdm),
52  refCount(0) {
53  stateMgr->getStoreManager().incrementReferenceCount(store);
54 }
55 
57  : stateMgr(RHS.stateMgr), Env(RHS.Env), store(RHS.store), GDM(RHS.GDM),
58  PosteriorlyOverconstrained(RHS.PosteriorlyOverconstrained), refCount(0) {
59  stateMgr->getStoreManager().incrementReferenceCount(store);
60 }
61 
63  if (store)
64  stateMgr->getStoreManager().decrementReferenceCount(store);
65 }
66 
68  return getStateManager().Alloc.identifyKnownAlignedObject<ProgramState>(this);
69 }
70 
72  StoreManagerCreator CreateSMgr,
73  ConstraintManagerCreator CreateCMgr,
74  llvm::BumpPtrAllocator &alloc,
75  ExprEngine *ExprEng)
76  : Eng(ExprEng), EnvMgr(alloc), GDMFactory(alloc),
77  svalBuilder(createSimpleSValBuilder(alloc, Ctx, *this)),
78  CallEventMgr(new CallEventManager(alloc)), Alloc(alloc) {
79  StoreMgr = (*CreateSMgr)(*this);
80  ConstraintMgr = (*CreateCMgr)(*this, ExprEng);
81 }
82 
83 
85  for (GDMContextsTy::iterator I=GDMContexts.begin(), E=GDMContexts.end();
86  I!=E; ++I)
87  I->second.second(I->second.first);
88 }
89 
92  SymbolReaper &SymReaper) {
93 
94  // This code essentially performs a "mark-and-sweep" of the VariableBindings.
95  // The roots are any Block-level exprs and Decls that our liveness algorithm
96  // tells us are live. We then see what Decls they may reference, and keep
97  // those around. This code more than likely can be made faster, and the
98  // frequency of which this method is called should be experimented with
99  // for optimum performance.
100  ProgramState NewState = *state;
101 
102  NewState.Env = EnvMgr.removeDeadBindings(NewState.Env, SymReaper, state);
103 
104  // Clean up the store.
105  StoreRef newStore = StoreMgr->removeDeadBindings(NewState.getStore(), LCtx,
106  SymReaper);
107  NewState.setStore(newStore);
108  SymReaper.setReapedStore(newStore);
109 
110  return getPersistentState(NewState);
111 }
112 
114  SVal V,
115  const LocationContext *LCtx,
116  bool notifyChanges) const {
118  ProgramStateRef newState = makeWithStore(Mgr.StoreMgr->Bind(getStore(),
119  LV, V));
120  const MemRegion *MR = LV.getAsRegion();
121  if (MR && notifyChanges)
122  return Mgr.getOwningEngine().processRegionChange(newState, MR, LCtx);
123 
124  return newState;
125 }
126 
129  const LocationContext *LCtx) const {
131  const MemRegion *R = loc.castAs<loc::MemRegionVal>().getRegion();
132  const StoreRef &newStore = Mgr.StoreMgr->BindDefaultInitial(getStore(), R, V);
133  ProgramStateRef new_state = makeWithStore(newStore);
134  return Mgr.getOwningEngine().processRegionChange(new_state, R, LCtx);
135 }
136 
140  const MemRegion *R = loc.castAs<loc::MemRegionVal>().getRegion();
141  const StoreRef &newStore = Mgr.StoreMgr->BindDefaultZero(getStore(), R);
142  ProgramStateRef new_state = makeWithStore(newStore);
143  return Mgr.getOwningEngine().processRegionChange(new_state, R, LCtx);
144 }
145 
146 typedef ArrayRef<const MemRegion *> RegionList;
147 typedef ArrayRef<SVal> ValueList;
148 
151  const Expr *E, unsigned Count,
152  const LocationContext *LCtx,
153  bool CausedByPointerEscape,
154  InvalidatedSymbols *IS,
155  const CallEvent *Call,
156  RegionAndSymbolInvalidationTraits *ITraits) const {
157  SmallVector<SVal, 8> Values;
158  for (RegionList::const_iterator I = Regions.begin(),
159  End = Regions.end(); I != End; ++I)
160  Values.push_back(loc::MemRegionVal(*I));
161 
162  return invalidateRegionsImpl(Values, E, Count, LCtx, CausedByPointerEscape,
163  IS, ITraits, Call);
164 }
165 
168  const Expr *E, unsigned Count,
169  const LocationContext *LCtx,
170  bool CausedByPointerEscape,
171  InvalidatedSymbols *IS,
172  const CallEvent *Call,
173  RegionAndSymbolInvalidationTraits *ITraits) const {
174 
175  return invalidateRegionsImpl(Values, E, Count, LCtx, CausedByPointerEscape,
176  IS, ITraits, Call);
177 }
178 
180 ProgramState::invalidateRegionsImpl(ValueList Values,
181  const Expr *E, unsigned Count,
182  const LocationContext *LCtx,
183  bool CausedByPointerEscape,
184  InvalidatedSymbols *IS,
185  RegionAndSymbolInvalidationTraits *ITraits,
186  const CallEvent *Call) const {
188  ExprEngine &Eng = Mgr.getOwningEngine();
189 
190  InvalidatedSymbols InvalidatedSyms;
191  if (!IS)
192  IS = &InvalidatedSyms;
193 
194  RegionAndSymbolInvalidationTraits ITraitsLocal;
195  if (!ITraits)
196  ITraits = &ITraitsLocal;
197 
198  StoreManager::InvalidatedRegions TopLevelInvalidated;
200  const StoreRef &newStore
201  = Mgr.StoreMgr->invalidateRegions(getStore(), Values, E, Count, LCtx, Call,
202  *IS, *ITraits, &TopLevelInvalidated,
203  &Invalidated);
204 
205  ProgramStateRef newState = makeWithStore(newStore);
206 
207  if (CausedByPointerEscape) {
208  newState = Eng.notifyCheckersOfPointerEscape(newState, IS,
209  TopLevelInvalidated,
210  Call,
211  *ITraits);
212  }
213 
214  return Eng.processRegionChanges(newState, IS, TopLevelInvalidated,
215  Invalidated, LCtx, Call);
216 }
217 
219  assert(!isa<loc::MemRegionVal>(LV) && "Use invalidateRegion instead.");
220 
221  Store OldStore = getStore();
222  const StoreRef &newStore =
223  getStateManager().StoreMgr->killBinding(OldStore, LV);
224 
225  if (newStore.getStore() == OldStore)
226  return this;
227 
228  return makeWithStore(newStore);
229 }
230 
233  const StackFrameContext *CalleeCtx) const {
234  const StoreRef &NewStore =
235  getStateManager().StoreMgr->enterStackFrame(getStore(), Call, CalleeCtx);
236  return makeWithStore(NewStore);
237 }
238 
240  const ImplicitParamDecl *SelfDecl = LCtx->getSelfDecl();
241  if (!SelfDecl)
242  return SVal();
243  return getSVal(getRegion(SelfDecl, LCtx));
244 }
245 
247  // We only want to do fetches from regions that we can actually bind
248  // values. For example, SymbolicRegions of type 'id<...>' cannot
249  // have direct bindings (but their can be bindings on their subregions).
250  if (!R->isBoundable())
251  return UnknownVal();
252 
253  if (const TypedValueRegion *TR = dyn_cast<TypedValueRegion>(R)) {
254  QualType T = TR->getValueType();
256  return getSVal(R);
257  }
258 
259  return UnknownVal();
260 }
261 
262 SVal ProgramState::getSVal(Loc location, QualType T) const {
263  SVal V = getRawSVal(location, T);
264 
265  // If 'V' is a symbolic value that is *perfectly* constrained to
266  // be a constant value, use that value instead to lessen the burden
267  // on later analysis stages (so we have less symbolic values to reason
268  // about).
269  // We only go into this branch if we can convert the APSInt value we have
270  // to the type of T, which is not always the case (e.g. for void).
271  if (!T.isNull() && (T->isIntegralOrEnumerationType() || Loc::isLocType(T))) {
272  if (SymbolRef sym = V.getAsSymbol()) {
273  if (const llvm::APSInt *Int = getStateManager()
275  .getSymVal(this, sym)) {
276  // FIXME: Because we don't correctly model (yet) sign-extension
277  // and truncation of symbolic values, we need to convert
278  // the integer value to the correct signedness and bitwidth.
279  //
280  // This shows up in the following:
281  //
282  // char foo();
283  // unsigned x = foo();
284  // if (x == 54)
285  // ...
286  //
287  // The symbolic value stored to 'x' is actually the conjured
288  // symbol for the call to foo(); the type of that symbol is 'char',
289  // not unsigned.
290  const llvm::APSInt &NewV = getBasicVals().Convert(T, *Int);
291 
292  if (V.getAs<Loc>())
293  return loc::ConcreteInt(NewV);
294  else
295  return nonloc::ConcreteInt(NewV);
296  }
297  }
298  }
299 
300  return V;
301 }
302 
304  const LocationContext *LCtx,
305  SVal V, bool Invalidate) const{
306  Environment NewEnv =
307  getStateManager().EnvMgr.bindExpr(Env, EnvironmentEntry(S, LCtx), V,
308  Invalidate);
309  if (NewEnv == Env)
310  return this;
311 
312  ProgramState NewSt = *this;
313  NewSt.Env = NewEnv;
314  return getStateManager().getPersistentState(NewSt);
315 }
316 
317 LLVM_NODISCARD std::pair<ProgramStateRef, ProgramStateRef>
319  DefinedOrUnknownSVal UpperBound,
320  QualType indexTy) const {
321  if (Idx.isUnknown() || UpperBound.isUnknown())
322  return {this, this};
323 
324  // Build an expression for 0 <= Idx < UpperBound.
325  // This is the same as Idx + MIN < UpperBound + MIN, if overflow is allowed.
326  // FIXME: This should probably be part of SValBuilder.
328  SValBuilder &svalBuilder = SM.getSValBuilder();
329  ASTContext &Ctx = svalBuilder.getContext();
330 
331  // Get the offset: the minimum value of the array index type.
332  BasicValueFactory &BVF = svalBuilder.getBasicValueFactory();
333  if (indexTy.isNull())
334  indexTy = svalBuilder.getArrayIndexType();
335  nonloc::ConcreteInt Min(BVF.getMinValue(indexTy));
336 
337  // Adjust the index.
338  SVal newIdx = svalBuilder.evalBinOpNN(this, BO_Add,
339  Idx.castAs<NonLoc>(), Min, indexTy);
340  if (newIdx.isUnknownOrUndef())
341  return {this, this};
342 
343  // Adjust the upper bound.
344  SVal newBound =
345  svalBuilder.evalBinOpNN(this, BO_Add, UpperBound.castAs<NonLoc>(),
346  Min, indexTy);
347 
348  if (newBound.isUnknownOrUndef())
349  return {this, this};
350 
351  // Build the actual comparison.
352  SVal inBound = svalBuilder.evalBinOpNN(this, BO_LT, newIdx.castAs<NonLoc>(),
353  newBound.castAs<NonLoc>(), Ctx.IntTy);
354  if (inBound.isUnknownOrUndef())
355  return {this, this};
356 
357  // Finally, let the constraint manager take care of it.
358  ConstraintManager &CM = SM.getConstraintManager();
359  return CM.assumeDual(this, inBound.castAs<DefinedSVal>());
360 }
361 
363  DefinedOrUnknownSVal UpperBound,
364  bool Assumption,
365  QualType indexTy) const {
366  std::pair<ProgramStateRef, ProgramStateRef> R =
367  assumeInBoundDual(Idx, UpperBound, indexTy);
368  return Assumption ? R.first : R.second;
369 }
370 
372  ConditionTruthVal IsNull = isNull(V);
373  if (IsNull.isUnderconstrained())
374  return IsNull;
375  return ConditionTruthVal(!IsNull.getValue());
376 }
377 
379  return stateMgr->getSValBuilder().areEqual(this, Lhs, Rhs);
380 }
381 
383  if (V.isZeroConstant())
384  return true;
385 
386  if (V.isConstant())
387  return false;
388 
389  SymbolRef Sym = V.getAsSymbol(/* IncludeBaseRegion */ true);
390  if (!Sym)
391  return ConditionTruthVal();
392 
393  return getStateManager().ConstraintMgr->isNull(this, Sym);
394 }
395 
397  ProgramState State(this,
398  EnvMgr.getInitialEnvironment(),
399  StoreMgr->getInitialStore(InitLoc),
400  GDMFactory.getEmptyMap());
401 
402  return getPersistentState(State);
403 }
404 
406  ProgramStateRef FromState,
407  ProgramStateRef GDMState) {
408  ProgramState NewState(*FromState);
409  NewState.GDM = GDMState->GDM;
410  return getPersistentState(NewState);
411 }
412 
414 
415  llvm::FoldingSetNodeID ID;
416  State.Profile(ID);
417  void *InsertPos;
418 
419  if (ProgramState *I = StateSet.FindNodeOrInsertPos(ID, InsertPos))
420  return I;
421 
422  ProgramState *newState = nullptr;
423  if (!freeStates.empty()) {
424  newState = freeStates.back();
425  freeStates.pop_back();
426  }
427  else {
428  newState = (ProgramState*) Alloc.Allocate<ProgramState>();
429  }
430  new (newState) ProgramState(State);
431  StateSet.InsertNode(newState, InsertPos);
432  return newState;
433 }
434 
435 ProgramStateRef ProgramState::makeWithStore(const StoreRef &store) const {
436  ProgramState NewSt(*this);
437  NewSt.setStore(store);
438  return getStateManager().getPersistentState(NewSt);
439 }
440 
441 ProgramStateRef ProgramState::cloneAsPosteriorlyOverconstrained() const {
442  ProgramState NewSt(*this);
443  NewSt.PosteriorlyOverconstrained = true;
444  return getStateManager().getPersistentState(NewSt);
445 }
446 
447 void ProgramState::setStore(const StoreRef &newStore) {
448  Store newStoreStore = newStore.getStore();
449  if (newStoreStore)
450  stateMgr->getStoreManager().incrementReferenceCount(newStoreStore);
451  if (store)
452  stateMgr->getStoreManager().decrementReferenceCount(store);
453  store = newStoreStore;
454 }
455 
456 //===----------------------------------------------------------------------===//
457 // State pretty-printing.
458 //===----------------------------------------------------------------------===//
459 
460 void ProgramState::printJson(raw_ostream &Out, const LocationContext *LCtx,
461  const char *NL, unsigned int Space,
462  bool IsDot) const {
463  Indent(Out, Space, IsDot) << "\"program_state\": {" << NL;
464  ++Space;
465 
467 
468  // Print the store.
469  Mgr.getStoreManager().printJson(Out, getStore(), NL, Space, IsDot);
470 
471  // Print out the environment.
472  Env.printJson(Out, Mgr.getContext(), LCtx, NL, Space, IsDot);
473 
474  // Print out the constraints.
475  Mgr.getConstraintManager().printJson(Out, this, NL, Space, IsDot);
476 
477  // Print out the tracked dynamic types.
478  printDynamicTypeInfoJson(Out, this, NL, Space, IsDot);
479 
480  // Print checker-specific data.
481  Mgr.getOwningEngine().printJson(Out, this, LCtx, NL, Space, IsDot);
482 
483  --Space;
484  Indent(Out, Space, IsDot) << '}';
485 }
486 
487 void ProgramState::printDOT(raw_ostream &Out, const LocationContext *LCtx,
488  unsigned int Space) const {
489  printJson(Out, LCtx, /*NL=*/"\\l", Space, /*IsDot=*/true);
490 }
491 
492 LLVM_DUMP_METHOD void ProgramState::dump() const {
493  printJson(llvm::errs());
494 }
495 
497  return stateMgr->getOwningEngine().getAnalysisManager();
498 }
499 
500 //===----------------------------------------------------------------------===//
501 // Generic Data Map.
502 //===----------------------------------------------------------------------===//
503 
504 void *const* ProgramState::FindGDM(void *K) const {
505  return GDM.lookup(K);
506 }
507 
508 void*
510  void *(*CreateContext)(llvm::BumpPtrAllocator&),
511  void (*DeleteContext)(void*)) {
512 
513  std::pair<void*, void (*)(void*)>& p = GDMContexts[K];
514  if (!p.first) {
515  p.first = CreateContext(Alloc);
516  p.second = DeleteContext;
517  }
518 
519  return p.first;
520 }
521 
523  ProgramState::GenericDataMap M1 = St->getGDM();
524  ProgramState::GenericDataMap M2 = GDMFactory.add(M1, Key, Data);
525 
526  if (M1 == M2)
527  return St;
528 
529  ProgramState NewSt = *St;
530  NewSt.GDM = M2;
531  return getPersistentState(NewSt);
532 }
533 
535  ProgramState::GenericDataMap OldM = state->getGDM();
536  ProgramState::GenericDataMap NewM = GDMFactory.remove(OldM, Key);
537 
538  if (NewM == OldM)
539  return state;
540 
541  ProgramState NewState = *state;
542  NewState.GDM = NewM;
543  return getPersistentState(NewState);
544 }
545 
547  bool wasVisited = !visited.insert(val.getCVData()).second;
548  if (wasVisited)
549  return true;
550 
551  StoreManager &StoreMgr = state->getStateManager().getStoreManager();
552  // FIXME: We don't really want to use getBaseRegion() here because pointer
553  // arithmetic doesn't apply, but scanReachableSymbols only accepts base
554  // regions right now.
555  const MemRegion *R = val.getRegion()->getBaseRegion();
556  return StoreMgr.scanReachableSymbols(val.getStore(), R, *this);
557 }
558 
560  for (nonloc::CompoundVal::iterator I=val.begin(), E=val.end(); I!=E; ++I)
561  if (!scan(*I))
562  return false;
563 
564  return true;
565 }
566 
568  for (SymExpr::symbol_iterator SI = sym->symbol_begin(),
569  SE = sym->symbol_end();
570  SI != SE; ++SI) {
571  bool wasVisited = !visited.insert(*SI).second;
572  if (wasVisited)
573  continue;
574 
575  if (!visitor.VisitSymbol(*SI))
576  return false;
577  }
578 
579  return true;
580 }
581 
584  return scan(X->getRegion());
585 
588  return scan(*X);
589 
591  return scan(X->getLoc());
592 
593  if (SymbolRef Sym = val.getAsSymbol())
594  return scan(Sym);
595 
597  return scan(*X);
598 
599  return true;
600 }
601 
603  if (isa<MemSpaceRegion>(R))
604  return true;
605 
606  bool wasVisited = !visited.insert(R).second;
607  if (wasVisited)
608  return true;
609 
610  if (!visitor.VisitMemRegion(R))
611  return false;
612 
613  // If this is a symbolic region, visit the symbol for the region.
614  if (const SymbolicRegion *SR = dyn_cast<SymbolicRegion>(R))
615  if (!visitor.VisitSymbol(SR->getSymbol()))
616  return false;
617 
618  // If this is a subregion, also visit the parent regions.
619  if (const SubRegion *SR = dyn_cast<SubRegion>(R)) {
620  const MemRegion *Super = SR->getSuperRegion();
621  if (!scan(Super))
622  return false;
623 
624  // When we reach the topmost region, scan all symbols in it.
625  if (isa<MemSpaceRegion>(Super)) {
626  StoreManager &StoreMgr = state->getStateManager().getStoreManager();
627  if (!StoreMgr.scanReachableSymbols(state->getStore(), SR, *this))
628  return false;
629  }
630  }
631 
632  // Regions captured by a block are also implicitly reachable.
633  if (const BlockDataRegion *BDR = dyn_cast<BlockDataRegion>(R)) {
634  BlockDataRegion::referenced_vars_iterator I = BDR->referenced_vars_begin(),
635  E = BDR->referenced_vars_end();
636  for ( ; I != E; ++I) {
637  if (!scan(I.getCapturedRegion()))
638  return false;
639  }
640  }
641 
642  return true;
643 }
644 
646  ScanReachableSymbols S(this, visitor);
647  return S.scan(val);
648 }
649 
651  llvm::iterator_range<region_iterator> Reachable,
652  SymbolVisitor &visitor) const {
653  ScanReachableSymbols S(this, visitor);
654  for (const MemRegion *R : Reachable) {
655  if (!S.scan(R))
656  return false;
657  }
658  return true;
659 }
clang::ento::ProgramState::scanReachableSymbols
bool scanReachableSymbols(SVal val, SymbolVisitor &visitor) const
Visits the symbols reachable from the given SVal using the provided SymbolVisitor.
Definition: ProgramState.cpp:645
clang::ento::ProgramStateManager::getOwningEngine
ExprEngine & getOwningEngine()
Definition: ProgramState.h:581
clang::ento::Loc::isLocType
static bool isLocType(QualType T)
Definition: SVals.h:286
clang::ento::ProgramState::killBinding
LLVM_NODISCARD ProgramStateRef killBinding(Loc LV) const
Definition: ProgramState.cpp:218
clang::ento::ProgramState::assumeInBound
LLVM_NODISCARD ProgramStateRef assumeInBound(DefinedOrUnknownSVal idx, DefinedOrUnknownSVal upperBound, bool assumption, QualType IndexType=QualType()) const
Definition: ProgramState.cpp:362
clang::ento::SymbolVisitor
Definition: SymbolManager.h:654
clang::ento::ProgramStateManager::ProgramStateManager
ProgramStateManager(ASTContext &Ctx, StoreManagerCreator CreateStoreManager, ConstraintManagerCreator CreateConstraintManager, llvm::BumpPtrAllocator &alloc, ExprEngine *expreng)
Definition: ProgramState.cpp:71
clang::ento::BasicValueFactory
Definition: BasicValueFactory.h:113
clang::LocationContext
It wraps the AnalysisDeclContext to represent both the call stack with the help of StackFrameContext ...
Definition: AnalysisDeclContext.h:215
clang::ento::SymExpr::symbol_iterator
Iterator over symbols that the current symbol depends on.
Definition: SymExpr.h:70
clang::ento::nonloc::CompoundVal
Definition: SVals.h:373
clang::ento::SVal::castAs
T castAs() const
Convert to the specified SVal type, asserting that this SVal is of the desired type.
Definition: SVals.h:101
clang::ento::NonLoc
Definition: SVals.h:262
clang::ento::SVal::getAsRegion
const MemRegion * getAsRegion() const
Definition: SVals.cpp:112
clang::ento::ConstraintManager
Definition: ConstraintManager.h:73
clang::ento::ProgramState::getSelfSVal
SVal getSelfSVal(const LocationContext *LC) const
Return the value of 'self' if available in the given context.
Definition: ProgramState.cpp:239
clang::ento::StoreManagerCreator
std::unique_ptr< StoreManager >(* StoreManagerCreator)(ProgramStateManager &)
Definition: ProgramState.h:43
clang::ento::ConstraintManager::printJson
virtual void printJson(raw_ostream &Out, ProgramStateRef State, const char *NL, unsigned int Space, bool IsDot) const =0
clang::ento::DefinedOrUnknownSVal
Definition: SVals.h:217
llvm::SmallVector
Definition: LLVM.h:38
clang::if
if(T->getSizeExpr()) TRY_TO(TraverseStmt(T -> getSizeExpr()))
Definition: RecursiveASTVisitor.h:1098
clang::ento::createSimpleSValBuilder
SValBuilder * createSimpleSValBuilder(llvm::BumpPtrAllocator &alloc, ASTContext &context, ProgramStateManager &stateMgr)
Definition: SimpleSValBuilder.cpp:85
clang::ento::ProgramStateManager::getSValBuilder
SValBuilder & getSValBuilder()
Definition: ProgramState.h:553
clang::ento::ProgramStateRef
IntrusiveRefCntPtr< const ProgramState > ProgramStateRef
Definition: ProgramState_Fwd.h:37
clang::QualType
A (possibly-)qualified type.
Definition: Type.h:731
clang::ento::EnvironmentManager::bindExpr
Environment bindExpr(Environment Env, const EnvironmentEntry &E, SVal V, bool Invalidate)
Bind a symbolic value to the given environment entry.
Definition: Environment.cpp:136
clang::ento::SValBuilder::getArrayIndexType
QualType getArrayIndexType() const
Definition: SValBuilder.h:178
clang::ento::StoreManager::InvalidatedRegions
SmallVector< const MemRegion *, 8 > InvalidatedRegions
Definition: Store.h:202
clang::ento::ProgramState::GenericDataMap
llvm::ImmutableMap< void *, void * > GenericDataMap
Definition: ProgramState.h:75
llvm::Optional
Definition: LLVM.h:40
clang::ento::ProgramState::assumeInBoundDual
LLVM_NODISCARD std::pair< ProgramStateRef, ProgramStateRef > assumeInBoundDual(DefinedOrUnknownSVal idx, DefinedOrUnknownSVal upperBound, QualType IndexType=QualType()) const
Definition: ProgramState.cpp:318
clang::StackFrameContext
It represents a stack frame of the call stack (based on CallEvent).
Definition: AnalysisDeclContext.h:299
clang::ento::nonloc::ConcreteInt
Value representing integer constant.
Definition: SVals.h:326
clang::tooling::X
static ToolExecutorPluginRegistry::Add< AllTUsToolExecutorPlugin > X("all-TUs", "Runs FrontendActions on all TUs in the compilation database. " "Tool results are stored in memory.")
clang::ento::UnknownVal
Definition: SVals.h:232
clang::ento::loc::MemRegionVal
Definition: SVals.h:502
clang::ento::loc::ConcreteInt
Definition: SVals.h:536
clang::ento::Store
const void * Store
Store - This opaque type encapsulates an immutable mapping from locations to values.
Definition: StoreRef.h:27
clang::ento::ProgramState
Definition: ProgramState.h:72
End
SourceLocation End
Definition: USRLocFinder.cpp:167
clang::ento::StoreManager
Definition: Store.h:53
clang::ento::printDynamicTypeInfoJson
void printDynamicTypeInfoJson(raw_ostream &Out, ProgramStateRef State, const char *NL="\n", unsigned int Space=0, bool IsDot=false)
clang::ento::SVal::getAs
Optional< T > getAs() const
Convert to the specified SVal type, returning None if this SVal is not of the desired type.
Definition: SVals.h:105
clang::ento::ProgramStateManager::addGDM
ProgramStateRef addGDM(ProgramStateRef St, void *Key, void *Data)
Definition: ProgramState.cpp:522
clang::ento::SymbolVisitor::VisitMemRegion
virtual bool VisitMemRegion(const MemRegion *)
Definition: SymbolManager.h:668
clang::ento::BlockDataRegion::referenced_vars_iterator::getCapturedRegion
const LLVM_ATTRIBUTE_RETURNS_NONNULL VarRegion * getCapturedRegion() const
Definition: MemRegion.h:718
CallEvent.h
clang::ento::ProgramState::bindLoc
LLVM_NODISCARD ProgramStateRef bindLoc(Loc location, SVal V, const LocationContext *LCtx, bool notifyChanges=true) const
clang::ento::MemRegion
MemRegion - The root abstract class for all memory regions.
Definition: MemRegion.h:95
clang::ento::ConditionTruthVal
Definition: ConstraintManager.h:38
APSInt
llvm::APSInt APSInt
Definition: ByteCodeEmitter.cpp:19
clang::ento::ProgramState::~ProgramState
~ProgramState()
Definition: ProgramState.cpp:62
clang::ento::ProgramStateManager::getPersistentStateWithGDM
ProgramStateRef getPersistentStateWithGDM(ProgramStateRef FromState, ProgramStateRef GDMState)
Definition: ProgramState.cpp:405
JsonSupport.h
V
#define V(N, I)
Definition: ASTContext.h:3176
clang::ento::DefinedSVal
Definition: SVals.h:239
clang::ento::StoreRef::getStore
Store getStore() const
Definition: StoreRef.h:46
clang::ento::ProgramState::enterStackFrame
LLVM_NODISCARD ProgramStateRef enterStackFrame(const CallEvent &Call, const StackFrameContext *CalleeCtx) const
enterStackFrame - Returns the state for entry to the given stack frame, preserving the current state.
Definition: ProgramState.cpp:232
clang::ento::ProgramStateManager::getContext
ASTContext & getContext()
Definition: ProgramState.h:546
clang::ento::MemRegion::isBoundable
virtual bool isBoundable() const
Definition: MemRegion.h:179
clang::ento::BasicValueFactory::Convert
const llvm::APSInt & Convert(const llvm::APSInt &To, const llvm::APSInt &From)
Convert - Create a new persistent APSInt with the same value as 'From' but with the bitwidth and sign...
Definition: BasicValueFactory.h:162
clang::ento::BlockDataRegion::referenced_vars_iterator
Definition: MemRegion.h:708
clang::ento::SValBuilder::getContext
ASTContext & getContext()
Definition: SValBuilder.h:169
clang::ento::ProgramStateManager::removeDeadBindingsFromEnvironmentAndStore
ProgramStateRef removeDeadBindingsFromEnvironmentAndStore(ProgramStateRef St, const StackFrameContext *LCtx, SymbolReaper &SymReaper)
Definition: ProgramState.cpp:90
clang::ento::StoreManager::printJson
virtual void printJson(raw_ostream &Out, Store S, const char *NL, unsigned int Space, bool IsDot) const =0
clang::ento::ProgramState::getID
int64_t getID() const
Definition: ProgramState.cpp:67
clang::ASTContext
Holds long-lived AST nodes (such as types and decls) that can be referred to throughout the semantic ...
Definition: ASTContext.h:208
clang::ento::SymExpr
Symbolic value.
Definition: SymExpr.h:29
clang::ento::StoreRef
Definition: StoreRef.h:29
clang::ento::ProgramState::isNonNull
ConditionTruthVal isNonNull(SVal V) const
Check if the given SVal is not constrained to zero and is not a zero constant.
Definition: ProgramState.cpp:371
clang::ento::nonloc::LazyCompoundVal::getStore
const void * getStore() const
It might return null.
Definition: SVals.cpp:183
clang::LocationContext::getSelfDecl
const ImplicitParamDecl * getSelfDecl() const
Definition: AnalysisDeclContext.h:260
clang::ento::ProgramState::getStore
Store getStore() const
Return the store associated with this state.
Definition: ProgramState.h:163
clang::ento::ProgramState::getAnalysisManager
AnalysisManager & getAnalysisManager() const
Definition: ProgramState.cpp:496
clang::ento::ProgramState::printJson
void printJson(raw_ostream &Out, const LocationContext *LCtx=nullptr, const char *NL="\n", unsigned int Space=0, bool IsDot=false) const
Definition: ProgramState.cpp:460
clang::ento::BlockDataRegion
BlockDataRegion - A region that represents a block instance.
Definition: MemRegion.h:674
clang::ImplicitParamDecl
Definition: Decl.h:1613
clang::ento::SValBuilder::getBasicValueFactory
BasicValueFactory & getBasicValueFactory()
Definition: SValBuilder.h:182
ValueList
ArrayRef< SVal > ValueList
Definition: ProgramState.cpp:147
clang::ento::SymbolReaper::setReapedStore
void setReapedStore(StoreRef st)
Set to the value of the symbolic store after StoreManager::removeDeadBindings has been called.
Definition: SymbolManager.h:647
clang::ento::ProgramStateManager::removeGDM
ProgramStateRef removeGDM(ProgramStateRef state, void *Key)
Definition: ProgramState.cpp:534
clang::ento::ProgramState::getConstraintManager
ConstraintManager & getConstraintManager() const
Return the ConstraintManager.
Definition: ProgramState.h:696
clang::ento::SymbolReaper
A class responsible for cleaning up unused symbols.
Definition: SymbolManager.h:572
clang::ento::ProgramState::bindDefaultInitial
LLVM_NODISCARD ProgramStateRef bindDefaultInitial(SVal loc, SVal V, const LocationContext *LCtx) const
Initializes the region of memory represented by loc with an initial value.
Definition: ProgramState.cpp:128
clang::ento::StoreManager::decrementReferenceCount
virtual void decrementReferenceCount(Store store)
If the StoreManager supports it, decrement the reference count of the specified Store object.
Definition: Store.h:200
clang::ento::nonloc::LazyCompoundVal
Definition: SVals.h:398
clang::ento::SymbolicRegion
SymbolicRegion - A special, "non-concrete" region.
Definition: MemRegion.h:770
state
and static some checkers Checker The latter are built on top of the former via the Checker and CheckerVisitor and attempts to isolate them from much of the gore of the internal analysis the analyzer is basically a source code simulator that traces out possible paths of execution The state of the and the combination of state and program point is a node in an exploded which has the entry program point and initial state
Definition: README.txt:30
clang::ento::Loc
Definition: SVals.h:278
clang::ento::EnvironmentManager::removeDeadBindings
Environment removeDeadBindings(Environment Env, SymbolReaper &SymReaper, ProgramStateRef state)
Definition: Environment.cpp:178
clang::ento::SValBuilder
Definition: SValBuilder.h:53
clang::ento::ProgramState::getStateManager
ProgramStateManager & getStateManager() const
Return the ProgramStateManager associated with this state.
Definition: ProgramState.h:148
clang::ento::ProgramState::getBasicVals
BasicValueFactory & getBasicVals() const
Definition: ProgramState.h:834
clang::ento::ConstraintManager::assumeDual
ProgramStatePair assumeDual(ProgramStateRef State, DefinedSVal Cond)
Returns a pair of states (StTrue, StFalse) where the given condition is assumed to be true or false,...
Definition: ConstraintManager.cpp:93
clang::ento::ProgramState::invalidateRegions
LLVM_NODISCARD ProgramStateRef invalidateRegions(ArrayRef< const MemRegion * > Regions, const Expr *E, unsigned BlockCount, const LocationContext *LCtx, bool CausesPointerEscape, InvalidatedSymbols *IS=nullptr, const CallEvent *Call=nullptr, RegionAndSymbolInvalidationTraits *ITraits=nullptr) const
Returns the state with bindings for the given regions cleared from the store.
clang::ento::ProgramStateManager::getPersistentState
ProgramStateRef getPersistentState(ProgramState &Impl)
Definition: ProgramState.cpp:413
clang::Indent
raw_ostream & Indent(raw_ostream &Out, const unsigned int Space, bool IsDot)
Definition: JsonSupport.h:21
clang::ento::ExprEngine::printJson
void printJson(raw_ostream &Out, ProgramStateRef State, const LocationContext *LCtx, const char *NL, unsigned int Space, bool IsDot) const
printJson - Called by ProgramStateManager to print checker-specific data.
Definition: ExprEngine.cpp:585
clang::ento::ProgramState::BindExpr
LLVM_NODISCARD ProgramStateRef BindExpr(const Stmt *S, const LocationContext *LCtx, SVal V, bool Invalidate=true) const
Create a new state by binding the value 'V' to the statement 'S' in the state's environment.
Definition: ProgramState.cpp:303
clang::ento::nonloc::CompoundVal::iterator
llvm::ImmutableList< SVal >::iterator iterator
Definition: SVals.h:386
clang::ento::CallEventManager
Manages the lifetime of CallEvent objects.
Definition: CallEvent.h:1233
clang::ento::ProgramStateManager
Definition: ProgramState.h:503
clang::ento::StoreManager::scanReachableSymbols
virtual bool scanReachableSymbols(Store S, const MemRegion *R, ScanReachableSymbols &Visitor)=0
Finds the transitive closure of symbols within the given region.
clang::ASTContext::IntTy
CanQualType IntTy
Definition: ASTContext.h:1105
clang::ento::ProgramState::printDOT
void printDOT(raw_ostream &Out, const LocationContext *LCtx=nullptr, unsigned int Space=0) const
Definition: ProgramState.cpp:487
clang::ento::ProgramStateManager::getInitialState
ProgramStateRef getInitialState(const LocationContext *InitLoc)
Definition: ProgramState.cpp:396
clang::ento::SValBuilder::evalBinOpNN
virtual SVal evalBinOpNN(ProgramStateRef state, BinaryOperator::Opcode op, NonLoc lhs, NonLoc rhs, QualType resultTy)=0
Create a new value which represents a binary expression with two non- location operands.
clang::QualType::isNull
bool isNull() const
Return true if this QualType doesn't point to a type yet.
Definition: Type.h:796
llvm::ArrayRef
Definition: LLVM.h:34
clang::ento::nonloc::CompoundVal::end
iterator end() const
Definition: SVals.cpp:217
clang::ento::ProgramStateManager::ProgramState
friend class ProgramState
Definition: ProgramState.h:504
clang::ento::ScanReachableSymbols
Definition: ProgramState.h:905
RegionList
ArrayRef< const MemRegion * > RegionList
Definition: ProgramState.cpp:146
clang::ento::ProgramState::isNull
ConditionTruthVal isNull(SVal V) const
Check if the given SVal is constrained to zero or is a zero constant.
Definition: ProgramState.cpp:382
clang::ento::ProgramState::getSVal
SVal getSVal(const Stmt *S, const LocationContext *LCtx) const
Returns the SVal bound to the statement 'S' in the state's environment.
Definition: ProgramState.h:805
State
LineState State
Definition: UnwrappedLineFormatter.cpp:1126
clang::ento::nonloc::LazyCompoundVal::getRegion
const LLVM_ATTRIBUTE_RETURNS_NONNULL TypedValueRegion * getRegion() const
Definition: SVals.cpp:187
clang::ento::AnalysisManager
Definition: AnalysisManager.h:31
clang::ento::StoreManager::incrementReferenceCount
virtual void incrementReferenceCount(Store store)
If the StoreManager supports it, increment the reference count of the specified Store object.
Definition: Store.h:195
clang::ento::ProgramState::bindDefaultZero
LLVM_NODISCARD ProgramStateRef bindDefaultZero(SVal loc, const LocationContext *LCtx) const
Performs C++ zero-initialization procedure on the region of memory represented by loc.
Definition: ProgramState.cpp:138
clang::ento::ExprEngine::getAnalysisManager
AnalysisManager & getAnalysisManager()
Definition: ExprEngine.h:205
clang::ento::BasicValueFactory::getMinValue
const llvm::APSInt & getMinValue(const llvm::APSInt &v)
Definition: BasicValueFactory.h:192
clang::ento::nonloc::LazyCompoundVal::getCVData
const LLVM_ATTRIBUTE_RETURNS_NONNULL LazyCompoundValData * getCVData() const
Definition: SVals.h:408
clang::ento::ExprEngine
Definition: ExprEngine.h:123
ProgramState.h
int64_t
long int64_t
Definition: hlsl_basic_types.h:25
clang::ento::ProgramStateManager::getStoreManager
StoreManager & getStoreManager()
Definition: ProgramState.h:579
clang::ento::ProgramState::FindGDM
void *const * FindGDM(void *K) const
Definition: ProgramState.cpp:504
clang::ento::ExprEngine::processRegionChange
ProgramStateRef processRegionChange(ProgramStateRef state, const MemRegion *MR, const LocationContext *LCtx)
Definition: ExprEngine.h:406
clang::ento::ProgramStateManager::FindGDMContext
void * FindGDMContext(void *index, void *(*CreateContext)(llvm::BumpPtrAllocator &), void(*DeleteContext)(void *))
Definition: ProgramState.cpp:509
ExprEngine.h
clang::ento::SValBuilder::areEqual
ConditionTruthVal areEqual(ProgramStateRef state, SVal lhs, SVal rhs)
Definition: SValBuilder.cpp:531
clang::ento::ProgramState::getSValAsScalarOrLoc
SVal getSValAsScalarOrLoc(const Stmt *Ex, const LocationContext *LCtx) const
Definition: ProgramState.h:812
clang::Builtin::ID
ID
Definition: Builtins.h:52
clang::ento::ScanReachableSymbols::scan
bool scan(nonloc::LazyCompoundVal val)
Definition: ProgramState.cpp:546
clang::ento::nonloc::LocAsInteger
Definition: SVals.h:341
clang
Definition: CalledOnceCheck.h:17
clang::ento::nonloc::CompoundVal::begin
iterator begin() const
Definition: SVals.cpp:213
CFG.h
clang::ento::ProgramStateManager::~ProgramStateManager
~ProgramStateManager()
Definition: ProgramState.cpp:84
clang::ento::SVal::isUnknownOrUndef
bool isUnknownOrUndef() const
Definition: SVals.h:134
clang::ento::ProgramStateRelease
void ProgramStateRelease(const ProgramState *state)
Decrement the number of times this state is referenced.
Definition: ProgramState.cpp:34
clang::Stmt
Stmt - This represents one statement.
Definition: Stmt.h:69
clang::ento::CallEvent
Represents an abstract call to a function or method along a particular path.
Definition: CallEvent.h:148
clang::ento::SVal::isUnknown
bool isUnknown() const
Definition: SVals.h:126
clang::ento::Environment::printJson
void printJson(raw_ostream &Out, const ASTContext &Ctx, const LocationContext *LCtx=nullptr, const char *NL="\n", unsigned int Space=0, bool IsDot=false) const
Definition: Environment.cpp:215
s
__device__ __2f16 float bool s
Definition: __clang_hip_libdevice_declares.h:315
clang::ento::ProgramState::getRegion
const LLVM_ATTRIBUTE_RETURNS_NONNULL VarRegion * getRegion(const VarDecl *D, const LocationContext *LC) const
Utility method for getting regions.
Definition: ProgramState.h:700
clang::ento::SymExpr::symbol_begin
symbol_iterator symbol_begin() const
Definition: SymExpr.h:86
clang::ento::ProgramState::areEqual
ConditionTruthVal areEqual(SVal Lhs, SVal Rhs) const
Definition: ProgramState.cpp:378
clang::ento::ProgramStateManager::getConstraintManager
ConstraintManager & getConstraintManager()
Definition: ProgramState.h:580
clang::ento::ProgramStateRetain
void ProgramStateRetain(const ProgramState *state)
Increments the number of times this state is referenced.
Definition: ProgramState.cpp:29
clang::ento::SVal
SVal - This represents a symbolic expression, which can be either an L-value or an R-value.
Definition: SVals.h:74
clang::ento::ProgramState::dump
void dump() const
Definition: ProgramState.cpp:492
clang::ento::ConditionTruthVal::isUnderconstrained
bool isUnderconstrained() const
Return true if the constrained is underconstrained and we do not know if the constraint is true of va...
Definition: ConstraintManager.h:68
clang::ento::TypedValueRegion
TypedValueRegion - An abstract class representing regions having a typed value.
Definition: MemRegion.h:531
clang::ento::SubRegion
SubRegion - A region that subsets another larger region.
Definition: MemRegion.h:442
clang::ento::SymbolVisitor::VisitSymbol
virtual bool VisitSymbol(SymbolRef sym)=0
A visitor method invoked by ProgramStateManager::scanReachableSymbols.
DynamicType.h
clang::ento::Environment
An immutable map from EnvironemntEntries to SVals.
Definition: Environment.h:56
clang::ento::MemRegion::getBaseRegion
const LLVM_ATTRIBUTE_RETURNS_NONNULL MemRegion * getBaseRegion() const
Definition: MemRegion.cpp:1287
ProgramStateTrait.h
clang::Expr
This represents one expression.
Definition: Expr.h:109
clang::ento::ConstraintManagerCreator
std::unique_ptr< ConstraintManager >(* ConstraintManagerCreator)(ProgramStateManager &, ExprEngine *)
Definition: ProgramState.h:41
clang::ento::SVal::getAsSymbol
SymbolRef getAsSymbol(bool IncludeBaseRegions=false) const
If this SVal wraps a symbol return that SymbolRef.
Definition: SVals.cpp:104
SM
#define SM(sm)
Definition: Cuda.cpp:81
clang::ento::InvalidatedSymbols
llvm::DenseSet< SymbolRef > InvalidatedSymbols
Definition: Store.h:51
clang::ento::ConditionTruthVal::getValue
bool getValue() const
Definition: ConstraintManager.h:51
AnalysisManager.h
clang::ento::EnvironmentManager::getInitialEnvironment
Environment getInitialEnvironment()
Definition: Environment.h:108
clang::ento::ProgramState::ProgramState
ProgramState(ProgramStateManager *mgr, const Environment &env, StoreRef st, GenericDataMap gdm)
This ctor is used when creating the first ProgramState object.
Definition: ProgramState.cpp:46
clang::ento::ProgramState::getRawSVal
SVal getRawSVal(Loc LV, QualType T=QualType()) const
Returns the "raw" SVal bound to LV before any value simplfication.
Definition: ProgramState.h:824
clang::ento::EnvironmentEntry
An entry in the environment consists of a Stmt and an LocationContext.
Definition: Environment.h:35
clang::ento::SymExpr::symbol_end
static symbol_iterator symbol_end()
Definition: SymExpr.h:87
llvm::IntrusiveRefCntPtr< const ProgramState >
clang::Type::isIntegralOrEnumerationType
bool isIntegralOrEnumerationType() const
Determine whether this type is an integral or enumeration type.
Definition: Type.h:7199
clang::ento::ProgramState::ProgramStateManager
friend class ProgramStateManager
Definition: ProgramState.h:80