clang 17.0.0git
SValBuilder.cpp
Go to the documentation of this file.
1//===- SValBuilder.cpp - Basic class for all SValBuilder implementations --===//
2//
3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4// See https://llvm.org/LICENSE.txt for license information.
5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6//
7//===----------------------------------------------------------------------===//
8//
9// This file defines SValBuilder, the base class for all (complete) SValBuilder
10// implementations.
11//
12//===----------------------------------------------------------------------===//
13
16#include "clang/AST/Decl.h"
17#include "clang/AST/DeclCXX.h"
18#include "clang/AST/ExprCXX.h"
19#include "clang/AST/ExprObjC.h"
20#include "clang/AST/Stmt.h"
21#include "clang/AST/Type.h"
23#include "clang/Basic/LLVM.h"
36#include "llvm/ADT/APSInt.h"
37#include "llvm/Support/Casting.h"
38#include "llvm/Support/Compiler.h"
39#include <cassert>
40#include <optional>
41#include <tuple>
42
43using namespace clang;
44using namespace ento;
45
46//===----------------------------------------------------------------------===//
47// Basic SVal creation.
48//===----------------------------------------------------------------------===//
49
50void SValBuilder::anchor() {}
51
52SValBuilder::SValBuilder(llvm::BumpPtrAllocator &alloc, ASTContext &context,
53 ProgramStateManager &stateMgr)
54 : Context(context), BasicVals(context, alloc),
55 SymMgr(context, BasicVals, alloc), MemMgr(context, alloc),
56 StateMgr(stateMgr),
57 AnOpts(
58 stateMgr.getOwningEngine().getAnalysisManager().getAnalyzerOptions()),
59 ArrayIndexTy(context.LongLongTy),
60 ArrayIndexWidth(context.getTypeSize(ArrayIndexTy)) {}
61
64 return makeNullWithType(type);
65
66 if (type->isIntegralOrEnumerationType())
67 return makeIntVal(0, type);
68
69 if (type->isArrayType() || type->isRecordType() || type->isVectorType() ||
70 type->isAnyComplexType())
72
73 // FIXME: Handle floats.
74 return UnknownVal();
75}
76
79 const llvm::APSInt &rhs,
80 QualType type) {
81 // The Environment ensures we always get a persistent APSInt in
82 // BasicValueFactory, so we don't need to get the APSInt from
83 // BasicValueFactory again.
84 assert(lhs);
85 assert(!Loc::isLocType(type));
86 return nonloc::SymbolVal(SymMgr.getSymIntExpr(lhs, op, rhs, type));
87}
88
91 const SymExpr *rhs, QualType type) {
92 assert(rhs);
93 assert(!Loc::isLocType(type));
94 return nonloc::SymbolVal(SymMgr.getIntSymExpr(lhs, op, rhs, type));
95}
96
99 const SymExpr *rhs, QualType type) {
100 assert(lhs && rhs);
101 assert(!Loc::isLocType(type));
102 return nonloc::SymbolVal(SymMgr.getSymSymExpr(lhs, op, rhs, type));
103}
104
106 QualType type) {
107 assert(operand);
108 assert(!Loc::isLocType(type));
109 return nonloc::SymbolVal(SymMgr.getUnarySymExpr(operand, op, type));
110}
111
113 QualType fromTy, QualType toTy) {
114 assert(operand);
115 assert(!Loc::isLocType(toTy));
116 if (fromTy == toTy)
117 return operand;
118 return nonloc::SymbolVal(SymMgr.getCastSymbol(operand, fromTy, toTy));
119}
120
122 if (val.isUnknownOrUndef())
123 return val;
124
125 // Common case: we have an appropriately sized integer.
126 if (std::optional<nonloc::ConcreteInt> CI =
127 val.getAs<nonloc::ConcreteInt>()) {
128 const llvm::APSInt& I = CI->getValue();
129 if (I.getBitWidth() == ArrayIndexWidth && I.isSigned())
130 return val;
131 }
132
133 return evalCast(val, ArrayIndexTy, QualType{});
134}
135
137 return makeTruthVal(boolean->getValue());
138}
139
142 QualType T = region->getValueType();
143
144 if (T->isNullPtrType())
145 return makeZeroVal(T);
146
148 return UnknownVal();
149
151
152 if (Loc::isLocType(T))
154
155 return nonloc::SymbolVal(sym);
156}
157
159 const Expr *Ex,
160 const LocationContext *LCtx,
161 unsigned Count) {
162 QualType T = Ex->getType();
163
164 if (T->isNullPtrType())
165 return makeZeroVal(T);
166
167 // Compute the type of the result. If the expression is not an R-value, the
168 // result should be a location.
169 QualType ExType = Ex->getType();
170 if (Ex->isGLValue())
172
173 return conjureSymbolVal(SymbolTag, Ex, LCtx, T, Count);
174}
175
177 const Expr *expr,
178 const LocationContext *LCtx,
180 unsigned count) {
181 if (type->isNullPtrType())
182 return makeZeroVal(type);
183
185 return UnknownVal();
186
187 SymbolRef sym = SymMgr.conjureSymbol(expr, LCtx, type, count, symbolTag);
188
189 if (Loc::isLocType(type))
191
192 return nonloc::SymbolVal(sym);
193}
194
196 const LocationContext *LCtx,
198 unsigned visitCount) {
199 if (type->isNullPtrType())
200 return makeZeroVal(type);
201
203 return UnknownVal();
204
205 SymbolRef sym = SymMgr.conjureSymbol(stmt, LCtx, type, visitCount);
206
207 if (Loc::isLocType(type))
209
210 return nonloc::SymbolVal(sym);
211}
212
215 const LocationContext *LCtx,
216 unsigned VisitCount) {
217 QualType T = E->getType();
218 return getConjuredHeapSymbolVal(E, LCtx, T, VisitCount);
219}
220
223 const LocationContext *LCtx,
224 QualType type, unsigned VisitCount) {
225 assert(Loc::isLocType(type));
227 if (type->isNullPtrType())
228 return makeZeroVal(type);
229
230 SymbolRef sym = SymMgr.conjureSymbol(E, LCtx, type, VisitCount);
232}
233
235 const MemRegion *region,
236 const Expr *expr, QualType type,
237 const LocationContext *LCtx,
238 unsigned count) {
239 assert(SymbolManager::canSymbolicate(type) && "Invalid metadata symbol type");
240
241 SymbolRef sym =
242 SymMgr.getMetadataSymbol(region, expr, type, LCtx, count, symbolTag);
243
244 if (Loc::isLocType(type))
246
247 return nonloc::SymbolVal(sym);
248}
249
252 const TypedValueRegion *region) {
253 QualType T = region->getValueType();
254
255 if (T->isNullPtrType())
256 return makeZeroVal(T);
257
259 return UnknownVal();
260
261 SymbolRef sym = SymMgr.getDerivedSymbol(parentSymbol, region);
262
263 if (Loc::isLocType(T))
265
266 return nonloc::SymbolVal(sym);
267}
268
270 assert(!ND || (isa<CXXMethodDecl, FieldDecl, IndirectFieldDecl>(ND)));
271
272 if (const auto *MD = dyn_cast_or_null<CXXMethodDecl>(ND)) {
273 // Sema treats pointers to static member functions as have function pointer
274 // type, so return a function pointer for the method.
275 // We don't need to play a similar trick for static member fields
276 // because these are represented as plain VarDecls and not FieldDecls
277 // in the AST.
278 if (MD->isStatic())
279 return getFunctionPointer(MD);
280 }
281
282 return nonloc::PointerToMember(ND);
283}
284
287}
288
290 CanQualType locTy,
291 const LocationContext *locContext,
292 unsigned blockCount) {
293 const BlockCodeRegion *BC =
294 MemMgr.getBlockCodeRegion(block, locTy, locContext->getAnalysisDeclContext());
295 const BlockDataRegion *BD = MemMgr.getBlockDataRegion(BC, locContext,
296 blockCount);
297 return loc::MemRegionVal(BD);
298}
299
300std::optional<loc::MemRegionVal>
302 if (auto OptR = StateMgr.getStoreManager().castRegion(R, Ty))
303 return loc::MemRegionVal(*OptR);
304 return std::nullopt;
305}
306
307/// Return a memory region for the 'this' object reference.
309 const StackFrameContext *SFC) {
310 return loc::MemRegionVal(
311 getRegionManager().getCXXThisRegion(D->getThisType(), SFC));
312}
313
314/// Return a memory region for the 'this' object reference.
316 const StackFrameContext *SFC) {
317 const Type *T = D->getTypeForDecl();
319 return loc::MemRegionVal(getRegionManager().getCXXThisRegion(PT, SFC));
320}
321
322std::optional<SVal> SValBuilder::getConstantVal(const Expr *E) {
323 E = E->IgnoreParens();
324
325 switch (E->getStmtClass()) {
326 // Handle expressions that we treat differently from the AST's constant
327 // evaluator.
328 case Stmt::AddrLabelExprClass:
329 return makeLoc(cast<AddrLabelExpr>(E));
330
331 case Stmt::CXXScalarValueInitExprClass:
332 case Stmt::ImplicitValueInitExprClass:
333 return makeZeroVal(E->getType());
334
335 case Stmt::ObjCStringLiteralClass: {
336 const auto *SL = cast<ObjCStringLiteral>(E);
337 return makeLoc(getRegionManager().getObjCStringRegion(SL));
338 }
339
340 case Stmt::StringLiteralClass: {
341 const auto *SL = cast<StringLiteral>(E);
342 return makeLoc(getRegionManager().getStringRegion(SL));
343 }
344
345 case Stmt::PredefinedExprClass: {
346 const auto *PE = cast<PredefinedExpr>(E);
347 assert(PE->getFunctionName() &&
348 "Since we analyze only instantiated functions, PredefinedExpr "
349 "should have a function name.");
350 return makeLoc(getRegionManager().getStringRegion(PE->getFunctionName()));
351 }
352
353 // Fast-path some expressions to avoid the overhead of going through the AST's
354 // constant evaluator
355 case Stmt::CharacterLiteralClass: {
356 const auto *C = cast<CharacterLiteral>(E);
357 return makeIntVal(C->getValue(), C->getType());
358 }
359
360 case Stmt::CXXBoolLiteralExprClass:
361 return makeBoolVal(cast<CXXBoolLiteralExpr>(E));
362
363 case Stmt::TypeTraitExprClass: {
364 const auto *TE = cast<TypeTraitExpr>(E);
365 return makeTruthVal(TE->getValue(), TE->getType());
366 }
367
368 case Stmt::IntegerLiteralClass:
369 return makeIntVal(cast<IntegerLiteral>(E));
370
371 case Stmt::ObjCBoolLiteralExprClass:
372 return makeBoolVal(cast<ObjCBoolLiteralExpr>(E));
373
374 case Stmt::CXXNullPtrLiteralExprClass:
375 return makeNullWithType(E->getType());
376
377 case Stmt::CStyleCastExprClass:
378 case Stmt::CXXFunctionalCastExprClass:
379 case Stmt::CXXConstCastExprClass:
380 case Stmt::CXXReinterpretCastExprClass:
381 case Stmt::CXXStaticCastExprClass:
382 case Stmt::ImplicitCastExprClass: {
383 const auto *CE = cast<CastExpr>(E);
384 switch (CE->getCastKind()) {
385 default:
386 break;
387 case CK_ArrayToPointerDecay:
388 case CK_IntegralToPointer:
389 case CK_NoOp:
390 case CK_BitCast: {
391 const Expr *SE = CE->getSubExpr();
392 std::optional<SVal> Val = getConstantVal(SE);
393 if (!Val)
394 return std::nullopt;
395 return evalCast(*Val, CE->getType(), SE->getType());
396 }
397 }
398 // FALLTHROUGH
399 [[fallthrough]];
400 }
401
402 // If we don't have a special case, fall back to the AST's constant evaluator.
403 default: {
404 // Don't try to come up with a value for materialized temporaries.
405 if (E->isGLValue())
406 return std::nullopt;
407
408 ASTContext &Ctx = getContext();
410 if (E->EvaluateAsInt(Result, Ctx))
411 return makeIntVal(Result.Val.getInt());
412
413 if (Loc::isLocType(E->getType()))
415 return makeNullWithType(E->getType());
416
417 return std::nullopt;
418 }
419 }
420}
421
423 NonLoc LHS, NonLoc RHS,
424 QualType ResultTy) {
425 SymbolRef symLHS = LHS.getAsSymbol();
426 SymbolRef symRHS = RHS.getAsSymbol();
427
428 // TODO: When the Max Complexity is reached, we should conjure a symbol
429 // instead of generating an Unknown value and propagate the taint info to it.
430 const unsigned MaxComp = AnOpts.MaxSymbolComplexity;
431
432 if (symLHS && symRHS &&
433 (symLHS->computeComplexity() + symRHS->computeComplexity()) < MaxComp)
434 return makeNonLoc(symLHS, Op, symRHS, ResultTy);
435
436 if (symLHS && symLHS->computeComplexity() < MaxComp)
437 if (std::optional<nonloc::ConcreteInt> rInt =
439 return makeNonLoc(symLHS, Op, rInt->getValue(), ResultTy);
440
441 if (symRHS && symRHS->computeComplexity() < MaxComp)
442 if (std::optional<nonloc::ConcreteInt> lInt =
444 return makeNonLoc(lInt->getValue(), Op, symRHS, ResultTy);
445
446 return UnknownVal();
447}
448
450 switch (X.getSubKind()) {
451 case nonloc::ConcreteIntKind:
452 return makeIntVal(-X.castAs<nonloc::ConcreteInt>().getValue());
453 case nonloc::SymbolValKind:
454 return makeNonLoc(X.castAs<nonloc::SymbolVal>().getSymbol(), UO_Minus,
455 X.getType(Context));
456 default:
457 return UnknownVal();
458 }
459}
460
462 switch (X.getSubKind()) {
463 case nonloc::ConcreteIntKind:
464 return makeIntVal(~X.castAs<nonloc::ConcreteInt>().getValue());
465 case nonloc::SymbolValKind:
466 return makeNonLoc(X.castAs<nonloc::SymbolVal>().getSymbol(), UO_Not,
467 X.getType(Context));
468 default:
469 return UnknownVal();
470 }
471}
472
474 SVal operand, QualType type) {
475 auto OpN = operand.getAs<NonLoc>();
476 if (!OpN)
477 return UnknownVal();
478
479 if (opc == UO_Minus)
480 return evalMinus(*OpN);
481 if (opc == UO_Not)
482 return evalComplement(*OpN);
483 llvm_unreachable("Unexpected unary operator");
484}
485
487 SVal lhs, SVal rhs, QualType type) {
488 if (lhs.isUndef() || rhs.isUndef())
489 return UndefinedVal();
490
491 if (lhs.isUnknown() || rhs.isUnknown())
492 return UnknownVal();
493
494 if (isa<nonloc::LazyCompoundVal>(lhs) || isa<nonloc::LazyCompoundVal>(rhs)) {
495 return UnknownVal();
496 }
497
498 if (op == BinaryOperatorKind::BO_Cmp) {
499 // We can't reason about C++20 spaceship operator yet.
500 //
501 // FIXME: Support C++20 spaceship operator.
502 // The main problem here is that the result is not integer.
503 return UnknownVal();
504 }
505
506 if (std::optional<Loc> LV = lhs.getAs<Loc>()) {
507 if (std::optional<Loc> RV = rhs.getAs<Loc>())
508 return evalBinOpLL(state, op, *LV, *RV, type);
509
510 return evalBinOpLN(state, op, *LV, rhs.castAs<NonLoc>(), type);
511 }
512
513 if (const std::optional<Loc> RV = rhs.getAs<Loc>()) {
514 const auto IsCommutative = [](BinaryOperatorKind Op) {
515 return Op == BO_Mul || Op == BO_Add || Op == BO_And || Op == BO_Xor ||
516 Op == BO_Or;
517 };
518
519 if (IsCommutative(op)) {
520 // Swap operands.
521 return evalBinOpLN(state, op, *RV, lhs.castAs<NonLoc>(), type);
522 }
523
524 // If the right operand is a concrete int location then we have nothing
525 // better but to treat it as a simple nonloc.
526 if (auto RV = rhs.getAs<loc::ConcreteInt>()) {
527 const nonloc::ConcreteInt RhsAsLoc = makeIntVal(RV->getValue());
528 return evalBinOpNN(state, op, lhs.castAs<NonLoc>(), RhsAsLoc, type);
529 }
530 }
531
532 return evalBinOpNN(state, op, lhs.castAs<NonLoc>(), rhs.castAs<NonLoc>(),
533 type);
534}
535
537 SVal rhs) {
538 return state->isNonNull(evalEQ(state, lhs, rhs));
539}
540
542 return evalBinOp(state, BO_EQ, lhs, rhs, getConditionType());
543}
544
548 return evalEQ(state, static_cast<SVal>(lhs), static_cast<SVal>(rhs))
550}
551
552/// Recursively check if the pointer types are equal modulo const, volatile,
553/// and restrict qualifiers. Also, assume that all types are similar to 'void'.
554/// Assumes the input types are canonical.
555static bool shouldBeModeledWithNoOp(ASTContext &Context, QualType ToTy,
556 QualType FromTy) {
557 while (Context.UnwrapSimilarTypes(ToTy, FromTy)) {
558 Qualifiers Quals1, Quals2;
559 ToTy = Context.getUnqualifiedArrayType(ToTy, Quals1);
560 FromTy = Context.getUnqualifiedArrayType(FromTy, Quals2);
561
562 // Make sure that non-cvr-qualifiers the other qualifiers (e.g., address
563 // spaces) are identical.
564 Quals1.removeCVRQualifiers();
565 Quals2.removeCVRQualifiers();
566 if (Quals1 != Quals2)
567 return false;
568 }
569
570 // If we are casting to void, the 'From' value can be used to represent the
571 // 'To' value.
572 //
573 // FIXME: Doing this after unwrapping the types doesn't make any sense. A
574 // cast from 'int**' to 'void**' is not special in the way that a cast from
575 // 'int*' to 'void*' is.
576 if (ToTy->isVoidType())
577 return true;
578
579 if (ToTy != FromTy)
580 return false;
581
582 return true;
583}
584
585// Handles casts of type CK_IntegralCast.
586// At the moment, this function will redirect to evalCast, except when the range
587// of the original value is known to be greater than the max of the target type.
589 QualType castTy, QualType originalTy) {
590 // No truncations if target type is big enough.
591 if (getContext().getTypeSize(castTy) >= getContext().getTypeSize(originalTy))
592 return evalCast(val, castTy, originalTy);
593
594 SymbolRef se = val.getAsSymbol();
595 if (!se) // Let evalCast handle non symbolic expressions.
596 return evalCast(val, castTy, originalTy);
597
598 // Find the maximum value of the target type.
599 APSIntType ToType(getContext().getTypeSize(castTy),
600 castTy->isUnsignedIntegerType());
601 llvm::APSInt ToTypeMax = ToType.getMaxValue();
602 NonLoc ToTypeMaxVal =
603 makeIntVal(ToTypeMax.isUnsigned() ? ToTypeMax.getZExtValue()
604 : ToTypeMax.getSExtValue(),
605 castTy)
606 .castAs<NonLoc>();
607 // Check the range of the symbol being casted against the maximum value of the
608 // target type.
609 NonLoc FromVal = val.castAs<NonLoc>();
610 QualType CmpTy = getConditionType();
611 NonLoc CompVal =
612 evalBinOpNN(state, BO_LE, FromVal, ToTypeMaxVal, CmpTy).castAs<NonLoc>();
613 ProgramStateRef IsNotTruncated, IsTruncated;
614 std::tie(IsNotTruncated, IsTruncated) = state->assume(CompVal);
615 if (!IsNotTruncated && IsTruncated) {
616 // Symbol is truncated so we evaluate it as a cast.
617 return makeNonLoc(se, originalTy, castTy);
618 }
619 return evalCast(val, castTy, originalTy);
620}
621
622//===----------------------------------------------------------------------===//
623// Cast method.
624// `evalCast` and its helper `EvalCastVisitor`
625//===----------------------------------------------------------------------===//
626
627namespace {
628class EvalCastVisitor : public SValVisitor<EvalCastVisitor, SVal> {
629private:
630 SValBuilder &VB;
631 ASTContext &Context;
632 QualType CastTy, OriginalTy;
633
634public:
635 EvalCastVisitor(SValBuilder &VB, QualType CastTy, QualType OriginalTy)
636 : VB(VB), Context(VB.getContext()), CastTy(CastTy),
637 OriginalTy(OriginalTy) {}
638
639 SVal Visit(SVal V) {
640 if (CastTy.isNull())
641 return V;
642
643 CastTy = Context.getCanonicalType(CastTy);
644
645 const bool IsUnknownOriginalType = OriginalTy.isNull();
646 if (!IsUnknownOriginalType) {
647 OriginalTy = Context.getCanonicalType(OriginalTy);
648
649 if (CastTy == OriginalTy)
650 return V;
651
652 // FIXME: Move this check to the most appropriate
653 // evalCastKind/evalCastSubKind function. For const casts, casts to void,
654 // just propagate the value.
655 if (!CastTy->isVariableArrayType() && !OriginalTy->isVariableArrayType())
656 if (shouldBeModeledWithNoOp(Context, Context.getPointerType(CastTy),
657 Context.getPointerType(OriginalTy)))
658 return V;
659 }
660 return SValVisitor::Visit(V);
661 }
662 SVal VisitUndefinedVal(UndefinedVal V) { return V; }
663 SVal VisitUnknownVal(UnknownVal V) { return V; }
664 SVal VisitLocConcreteInt(loc::ConcreteInt V) {
665 // Pointer to bool.
666 if (CastTy->isBooleanType())
667 return VB.makeTruthVal(V.getValue().getBoolValue(), CastTy);
668
669 // Pointer to integer.
670 if (CastTy->isIntegralOrEnumerationType()) {
671 llvm::APSInt Value = V.getValue();
673 return VB.makeIntVal(Value);
674 }
675
676 // Pointer to any pointer.
677 if (Loc::isLocType(CastTy)) {
678 llvm::APSInt Value = V.getValue();
680 return loc::ConcreteInt(VB.getBasicValueFactory().getValue(Value));
681 }
682
683 // Pointer to whatever else.
684 return UnknownVal();
685 }
686 SVal VisitLocGotoLabel(loc::GotoLabel V) {
687 // Pointer to bool.
688 if (CastTy->isBooleanType())
689 // Labels are always true.
690 return VB.makeTruthVal(true, CastTy);
691
692 // Pointer to integer.
693 if (CastTy->isIntegralOrEnumerationType()) {
694 const unsigned BitWidth = Context.getIntWidth(CastTy);
695 return VB.makeLocAsInteger(V, BitWidth);
696 }
697
698 const bool IsUnknownOriginalType = OriginalTy.isNull();
699 if (!IsUnknownOriginalType) {
700 // Array to pointer.
701 if (isa<ArrayType>(OriginalTy))
702 if (CastTy->isPointerType() || CastTy->isReferenceType())
703 return UnknownVal();
704 }
705
706 // Pointer to any pointer.
707 if (Loc::isLocType(CastTy))
708 return V;
709
710 // Pointer to whatever else.
711 return UnknownVal();
712 }
713 SVal VisitLocMemRegionVal(loc::MemRegionVal V) {
714 // Pointer to bool.
715 if (CastTy->isBooleanType()) {
716 const MemRegion *R = V.getRegion();
717 if (const FunctionCodeRegion *FTR = dyn_cast<FunctionCodeRegion>(R))
718 if (const FunctionDecl *FD = dyn_cast<FunctionDecl>(FTR->getDecl()))
719 if (FD->isWeak())
720 // FIXME: Currently we are using an extent symbol here,
721 // because there are no generic region address metadata
722 // symbols to use, only content metadata.
723 return nonloc::SymbolVal(
725
726 if (const SymbolicRegion *SymR = R->getSymbolicBase()) {
727 SymbolRef Sym = SymR->getSymbol();
728 QualType Ty = Sym->getType();
729 // This change is needed for architectures with varying
730 // pointer widths. See the amdgcn opencl reproducer with
731 // this change as an example: solver-sym-simplification-ptr-bool.cl
732 if (!Ty->isReferenceType())
733 return VB.makeNonLoc(
734 Sym, BO_NE, VB.getBasicValueFactory().getZeroWithTypeSize(Ty),
735 CastTy);
736 }
737 // Non-symbolic memory regions are always true.
738 return VB.makeTruthVal(true, CastTy);
739 }
740
741 const bool IsUnknownOriginalType = OriginalTy.isNull();
742 // Try to cast to array
743 const auto *ArrayTy =
744 IsUnknownOriginalType
745 ? nullptr
746 : dyn_cast<ArrayType>(OriginalTy.getCanonicalType());
747
748 // Pointer to integer.
749 if (CastTy->isIntegralOrEnumerationType()) {
750 SVal Val = V;
751 // Array to integer.
752 if (ArrayTy) {
753 // We will always decay to a pointer.
754 QualType ElemTy = ArrayTy->getElementType();
755 Val = VB.getStateManager().ArrayToPointer(V, ElemTy);
756 // FIXME: Keep these here for now in case we decide soon that we
757 // need the original decayed type.
758 // QualType elemTy = cast<ArrayType>(originalTy)->getElementType();
759 // QualType pointerTy = C.getPointerType(elemTy);
760 }
761 const unsigned BitWidth = Context.getIntWidth(CastTy);
762 return VB.makeLocAsInteger(Val.castAs<Loc>(), BitWidth);
763 }
764
765 // Pointer to pointer.
766 if (Loc::isLocType(CastTy)) {
767
768 if (IsUnknownOriginalType) {
769 // When retrieving symbolic pointer and expecting a non-void pointer,
770 // wrap them into element regions of the expected type if necessary.
771 // It is necessary to make sure that the retrieved value makes sense,
772 // because there's no other cast in the AST that would tell us to cast
773 // it to the correct pointer type. We might need to do that for non-void
774 // pointers as well.
775 // FIXME: We really need a single good function to perform casts for us
776 // correctly every time we need it.
777 const MemRegion *R = V.getRegion();
778 if (CastTy->isPointerType() && !CastTy->isVoidPointerType()) {
779 if (const auto *SR = dyn_cast<SymbolicRegion>(R)) {
780 QualType SRTy = SR->getSymbol()->getType();
781
782 auto HasSameUnqualifiedPointeeType = [](QualType ty1,
783 QualType ty2) {
784 return ty1->getPointeeType().getCanonicalType().getTypePtr() ==
786 };
787 if (!HasSameUnqualifiedPointeeType(SRTy, CastTy)) {
788 if (auto OptMemRegV = VB.getCastedMemRegionVal(SR, CastTy))
789 return *OptMemRegV;
790 }
791 }
792 }
793 // Next fixes pointer dereference using type different from its initial
794 // one. See PR37503 and PR49007 for details.
795 if (const auto *ER = dyn_cast<ElementRegion>(R)) {
796 if (auto OptMemRegV = VB.getCastedMemRegionVal(ER, CastTy))
797 return *OptMemRegV;
798 }
799
800 return V;
801 }
802
803 if (OriginalTy->isIntegralOrEnumerationType() ||
804 OriginalTy->isBlockPointerType() ||
805 OriginalTy->isFunctionPointerType())
806 return V;
807
808 // Array to pointer.
809 if (ArrayTy) {
810 // Are we casting from an array to a pointer? If so just pass on
811 // the decayed value.
812 if (CastTy->isPointerType() || CastTy->isReferenceType()) {
813 // We will always decay to a pointer.
814 QualType ElemTy = ArrayTy->getElementType();
815 return VB.getStateManager().ArrayToPointer(V, ElemTy);
816 }
817 // Are we casting from an array to an integer? If so, cast the decayed
818 // pointer value to an integer.
819 assert(CastTy->isIntegralOrEnumerationType());
820 }
821
822 // Other pointer to pointer.
823 assert(Loc::isLocType(OriginalTy) || OriginalTy->isFunctionType() ||
824 CastTy->isReferenceType());
825
826 // We get a symbolic function pointer for a dereference of a function
827 // pointer, but it is of function type. Example:
828
829 // struct FPRec {
830 // void (*my_func)(int * x);
831 // };
832 //
833 // int bar(int x);
834 //
835 // int f1_a(struct FPRec* foo) {
836 // int x;
837 // (*foo->my_func)(&x);
838 // return bar(x)+1; // no-warning
839 // }
840
841 // Get the result of casting a region to a different type.
842 const MemRegion *R = V.getRegion();
843 if (auto OptMemRegV = VB.getCastedMemRegionVal(R, CastTy))
844 return *OptMemRegV;
845 }
846
847 // Pointer to whatever else.
848 // FIXME: There can be gross cases where one casts the result of a
849 // function (that returns a pointer) to some other value that happens to
850 // fit within that pointer value. We currently have no good way to model
851 // such operations. When this happens, the underlying operation is that
852 // the caller is reasoning about bits. Conceptually we are layering a
853 // "view" of a location on top of those bits. Perhaps we need to be more
854 // lazy about mutual possible views, even on an SVal? This may be
855 // necessary for bit-level reasoning as well.
856 return UnknownVal();
857 }
858 SVal VisitNonLocCompoundVal(nonloc::CompoundVal V) {
859 // Compound to whatever.
860 return UnknownVal();
861 }
862 SVal VisitNonLocConcreteInt(nonloc::ConcreteInt V) {
863 auto CastedValue = [V, this]() {
864 llvm::APSInt Value = V.getValue();
866 return Value;
867 };
868
869 // Integer to bool.
870 if (CastTy->isBooleanType())
871 return VB.makeTruthVal(V.getValue().getBoolValue(), CastTy);
872
873 // Integer to pointer.
874 if (CastTy->isIntegralOrEnumerationType())
875 return VB.makeIntVal(CastedValue());
876
877 // Integer to pointer.
878 if (Loc::isLocType(CastTy))
879 return VB.makeIntLocVal(CastedValue());
880
881 // Pointer to whatever else.
882 return UnknownVal();
883 }
884 SVal VisitNonLocLazyCompoundVal(nonloc::LazyCompoundVal V) {
885 // LazyCompound to whatever.
886 return UnknownVal();
887 }
888 SVal VisitNonLocLocAsInteger(nonloc::LocAsInteger V) {
889 Loc L = V.getLoc();
890
891 // Pointer as integer to bool.
892 if (CastTy->isBooleanType())
893 // Pass to Loc function.
894 return Visit(L);
895
896 const bool IsUnknownOriginalType = OriginalTy.isNull();
897 // Pointer as integer to pointer.
898 if (!IsUnknownOriginalType && Loc::isLocType(CastTy) &&
899 OriginalTy->isIntegralOrEnumerationType()) {
900 if (const MemRegion *R = L.getAsRegion())
901 if (auto OptMemRegV = VB.getCastedMemRegionVal(R, CastTy))
902 return *OptMemRegV;
903 return L;
904 }
905
906 // Pointer as integer with region to integer/pointer.
907 const MemRegion *R = L.getAsRegion();
908 if (!IsUnknownOriginalType && R) {
909 if (CastTy->isIntegralOrEnumerationType())
910 return VisitLocMemRegionVal(loc::MemRegionVal(R));
911
912 if (Loc::isLocType(CastTy)) {
913 assert(Loc::isLocType(OriginalTy) || OriginalTy->isFunctionType() ||
914 CastTy->isReferenceType());
915 // Delegate to store manager to get the result of casting a region to a
916 // different type. If the MemRegion* returned is NULL, this expression
917 // Evaluates to UnknownVal.
918 if (auto OptMemRegV = VB.getCastedMemRegionVal(R, CastTy))
919 return *OptMemRegV;
920 }
921 } else {
922 if (Loc::isLocType(CastTy)) {
923 if (IsUnknownOriginalType)
924 return VisitLocMemRegionVal(loc::MemRegionVal(R));
925 return L;
926 }
927
928 SymbolRef SE = nullptr;
929 if (R) {
930 if (const SymbolicRegion *SR =
931 dyn_cast<SymbolicRegion>(R->StripCasts())) {
932 SE = SR->getSymbol();
933 }
934 }
935
936 if (!CastTy->isFloatingType() || !SE || SE->getType()->isFloatingType()) {
937 // FIXME: Correctly support promotions/truncations.
938 const unsigned CastSize = Context.getIntWidth(CastTy);
939 if (CastSize == V.getNumBits())
940 return V;
941
942 return VB.makeLocAsInteger(L, CastSize);
943 }
944 }
945
946 // Pointer as integer to whatever else.
947 return UnknownVal();
948 }
949 SVal VisitNonLocSymbolVal(nonloc::SymbolVal V) {
950 SymbolRef SE = V.getSymbol();
951
952 const bool IsUnknownOriginalType = OriginalTy.isNull();
953 // Symbol to bool.
954 if (!IsUnknownOriginalType && CastTy->isBooleanType()) {
955 // Non-float to bool.
956 if (Loc::isLocType(OriginalTy) ||
957 OriginalTy->isIntegralOrEnumerationType() ||
958 OriginalTy->isMemberPointerType()) {
960 return VB.makeNonLoc(SE, BO_NE, BVF.getValue(0, SE->getType()), CastTy);
961 }
962 } else {
963 // Symbol to integer, float.
964 QualType T = Context.getCanonicalType(SE->getType());
965
966 // Produce SymbolCast if CastTy and T are different integers.
967 // NOTE: In the end the type of SymbolCast shall be equal to CastTy.
974 // If appropriate option is disabled, ignore the cast.
975 // NOTE: ShouldSupportSymbolicIntegerCasts is `false` by default.
976 if (!Opts.ShouldSupportSymbolicIntegerCasts)
977 return V;
978 return simplifySymbolCast(V, CastTy);
979 }
980 if (!Loc::isLocType(CastTy))
981 if (!IsUnknownOriginalType || !CastTy->isFloatingType() ||
982 T->isFloatingType())
983 return VB.makeNonLoc(SE, T, CastTy);
984 }
985
986 // Symbol to pointer and whatever else.
987 return UnknownVal();
988 }
989 SVal VisitNonLocPointerToMember(nonloc::PointerToMember V) {
990 // Member pointer to whatever.
991 return V;
992 }
993
994 /// Reduce cast expression by removing redundant intermediate casts.
995 /// E.g.
996 /// - (char)(short)(int x) -> (char)(int x)
997 /// - (int)(int x) -> int x
998 ///
999 /// \param V -- SymbolVal, which pressumably contains SymbolCast or any symbol
1000 /// that is applicable for cast operation.
1001 /// \param CastTy -- QualType, which `V` shall be cast to.
1002 /// \return SVal with simplified cast expression.
1003 /// \note: Currently only support integral casts.
1004 nonloc::SymbolVal simplifySymbolCast(nonloc::SymbolVal V, QualType CastTy) {
1005 // We use seven conditions to recognize a simplification case.
1006 // For the clarity let `CastTy` be `C`, SE->getType() - `T`, root type -
1007 // `R`, prefix `u` for unsigned, `s` for signed, no prefix - any sign: E.g.
1008 // (char)(short)(uint x)
1009 // ( sC )( sT )( uR x)
1010 //
1011 // C === R (the same type)
1012 // (char)(char x) -> (char x)
1013 // (long)(long x) -> (long x)
1014 // Note: Comparisons operators below are for bit width.
1015 // C == T
1016 // (short)(short)(int x) -> (short)(int x)
1017 // (int)(long)(char x) -> (int)(char x) (sizeof(long) == sizeof(int))
1018 // (long)(ullong)(char x) -> (long)(char x) (sizeof(long) ==
1019 // sizeof(ullong))
1020 // C < T
1021 // (short)(int)(char x) -> (short)(char x)
1022 // (char)(int)(short x) -> (char)(short x)
1023 // (short)(int)(short x) -> (short x)
1024 // C > T > uR
1025 // (int)(short)(uchar x) -> (int)(uchar x)
1026 // (uint)(short)(uchar x) -> (uint)(uchar x)
1027 // (int)(ushort)(uchar x) -> (int)(uchar x)
1028 // C > sT > sR
1029 // (int)(short)(char x) -> (int)(char x)
1030 // (uint)(short)(char x) -> (uint)(char x)
1031 // C > sT == sR
1032 // (int)(char)(char x) -> (int)(char x)
1033 // (uint)(short)(short x) -> (uint)(short x)
1034 // C > uT == uR
1035 // (int)(uchar)(uchar x) -> (int)(uchar x)
1036 // (uint)(ushort)(ushort x) -> (uint)(ushort x)
1037 // (llong)(ulong)(uint x) -> (llong)(uint x) (sizeof(ulong) ==
1038 // sizeof(uint))
1039
1040 SymbolRef SE = V.getSymbol();
1041 QualType T = Context.getCanonicalType(SE->getType());
1042
1043 if (T == CastTy)
1044 return V;
1045
1046 if (!isa<SymbolCast>(SE))
1047 return VB.makeNonLoc(SE, T, CastTy);
1048
1049 SymbolRef RootSym = cast<SymbolCast>(SE)->getOperand();
1050 QualType RT = RootSym->getType().getCanonicalType();
1051
1052 // FIXME support simplification from non-integers.
1053 if (!RT->isIntegralOrEnumerationType())
1054 return VB.makeNonLoc(SE, T, CastTy);
1055
1057 APSIntType CTy = BVF.getAPSIntType(CastTy);
1058 APSIntType TTy = BVF.getAPSIntType(T);
1059
1060 const auto WC = CTy.getBitWidth();
1061 const auto WT = TTy.getBitWidth();
1062
1063 if (WC <= WT) {
1064 const bool isSameType = (RT == CastTy);
1065 if (isSameType)
1066 return nonloc::SymbolVal(RootSym);
1067 return VB.makeNonLoc(RootSym, RT, CastTy);
1068 }
1069
1070 APSIntType RTy = BVF.getAPSIntType(RT);
1071 const auto WR = RTy.getBitWidth();
1072 const bool UT = TTy.isUnsigned();
1073 const bool UR = RTy.isUnsigned();
1074
1075 if (((WT > WR) && (UR || !UT)) || ((WT == WR) && (UT == UR)))
1076 return VB.makeNonLoc(RootSym, RT, CastTy);
1077
1078 return VB.makeNonLoc(SE, T, CastTy);
1079 }
1080};
1081} // end anonymous namespace
1082
1083/// Cast a given SVal to another SVal using given QualType's.
1084/// \param V -- SVal that should be casted.
1085/// \param CastTy -- QualType that V should be casted according to.
1086/// \param OriginalTy -- QualType which is associated to V. It provides
1087/// additional information about what type the cast performs from.
1088/// \returns the most appropriate casted SVal.
1089/// Note: Many cases don't use an exact OriginalTy. It can be extracted
1090/// from SVal or the cast can performs unconditionaly. Always pass OriginalTy!
1091/// It can be crucial in certain cases and generates different results.
1092/// FIXME: If `OriginalTy.isNull()` is true, then cast performs based on CastTy
1093/// only. This behavior is uncertain and should be improved.
1095 EvalCastVisitor TRV{*this, CastTy, OriginalTy};
1096 return TRV.Visit(V);
1097}
Defines the clang::ASTContext interface.
#define V(N, I)
Definition: ASTContext.h:3217
This file defines AnalysisDeclContext, a class that manages the analysis context data for context sen...
static CompilationDatabasePluginRegistry::Add< FixedCompilationDatabasePlugin > X("fixed-compilation-database", "Reads plain-text flags file")
Defines the C++ Decl subclasses, other than those for templates (found in DeclTemplate....
Defines the clang::Expr interface and subclasses for C++ expressions.
Forward-declares and imports various common LLVM datatypes that clang wants to use unqualified.
static bool shouldBeModeledWithNoOp(ASTContext &Context, QualType ToTy, QualType FromTy)
Recursively check if the pointer types are equal modulo const, volatile, and restrict qualifiers.
C Language Family Type Representation.
Holds long-lived AST nodes (such as types and decls) that can be referred to throughout the semantic ...
Definition: ASTContext.h:182
unsigned getIntWidth(QualType T) const
CanQualType getCanonicalType(QualType T) const
Return the canonical (structural) type corresponding to the specified potentially non-canonical type ...
Definition: ASTContext.h:2505
QualType getPointerType(QualType T) const
Return the uniqued reference to the type for a pointer to the specified type.
QualType getUnqualifiedArrayType(QualType T, Qualifiers &Quals)
Return this type as a completely-unqualified array type, capturing the qualifiers in Quals.
bool UnwrapSimilarTypes(QualType &T1, QualType &T2, bool AllowPiMismatch=true)
Attempt to unwrap two types that may be similar (C++ [conv.qual]).
ASTContext & getASTContext() const
Stores options for the analyzer from the command line.
Represents a block literal declaration, which is like an unnamed FunctionDecl.
Definition: Decl.h:4334
A boolean literal, per ([C++ lex.bool] Boolean literals).
Definition: ExprCXX.h:720
bool getValue() const
Definition: ExprCXX.h:737
Represents a static or instance method of a struct/union/class.
Definition: DeclCXX.h:2014
QualType getThisType() const
Return the type of the this pointer.
Definition: DeclCXX.cpp:2502
Represents a C++ struct/union/class.
Definition: DeclCXX.h:254
This represents one expression.
Definition: Expr.h:110
bool EvaluateAsInt(EvalResult &Result, const ASTContext &Ctx, SideEffectsKind AllowSideEffects=SE_NoSideEffects, bool InConstantContext=false) const
EvaluateAsInt - Return true if this is a constant which we can fold and convert to an integer,...
bool isGLValue() const
Definition: Expr.h:274
Expr * IgnoreParens() LLVM_READONLY
Skip past any parentheses which might surround this expression until reaching a fixed point.
Definition: Expr.cpp:3042
@ NPC_ValueDependentIsNotNull
Specifies that a value-dependent expression should be considered to never be a null pointer constant.
Definition: Expr.h:801
NullPointerConstantKind isNullPointerConstant(ASTContext &Ctx, NullPointerConstantValueDependence NPC) const
isNullPointerConstant - C99 6.3.2.3p3 - Test if this reduces down to a Null pointer constant.
Definition: Expr.cpp:3873
QualType getType() const
Definition: Expr.h:142
Represents a function declaration or definition.
Definition: Decl.h:1917
It wraps the AnalysisDeclContext to represent both the call stack with the help of StackFrameContext ...
LLVM_ATTRIBUTE_RETURNS_NONNULL AnalysisDeclContext * getAnalysisDeclContext() const
This represents a decl that may have a name.
Definition: Decl.h:247
A (possibly-)qualified type.
Definition: Type.h:736
bool isNull() const
Return true if this QualType doesn't point to a type yet.
Definition: Type.h:803
const Type * getTypePtr() const
Retrieves a pointer to the underlying (unqualified) type.
Definition: Type.h:6649
QualType getCanonicalType() const
Definition: Type.h:6701
The collection of all-type qualifiers we support.
Definition: Type.h:146
void removeCVRQualifiers(unsigned mask)
Definition: Type.h:301
It represents a stack frame of the call stack (based on CallEvent).
Stmt - This represents one statement.
Definition: Stmt.h:72
StmtClass getStmtClass() const
Definition: Stmt.h:1177
const Type * getTypeForDecl() const
Definition: Decl.h:3272
The base class of the type hierarchy.
Definition: Type.h:1566
bool isBlockPointerType() const
Definition: Type.h:6918
bool isVoidType() const
Definition: Type.h:7218
bool isBooleanType() const
Definition: Type.h:7334
bool isIntegralOrUnscopedEnumerationType() const
Determine whether this type is an integral or unscoped enumeration type.
Definition: Type.cpp:1967
bool isVoidPointerType() const
Definition: Type.cpp:593
bool isFunctionPointerType() const
Definition: Type.h:6944
bool isPointerType() const
Definition: Type.h:6910
bool isReferenceType() const
Definition: Type.h:6922
bool isVariableArrayType() const
Definition: Type.h:6988
QualType getPointeeType() const
If this is a pointer, ObjC object pointer, or block pointer, this returns the respective pointee.
Definition: Type.cpp:629
bool isIntegralOrEnumerationType() const
Determine whether this type is an integral or enumeration type.
Definition: Type.h:7321
bool isMemberPointerType() const
Definition: Type.h:6958
bool isFunctionType() const
Definition: Type.h:6906
bool isFloatingType() const
Definition: Type.cpp:2145
bool isUnsignedIntegerType() const
Return true if this is an integer type that is unsigned, according to C99 6.2.5p6 [which returns true...
Definition: Type.cpp:2092
bool isNullPtrType() const
Definition: Type.h:7243
A record of the "type" of an APSInt, used for conversions.
Definition: APSIntType.h:19
bool isUnsigned() const
Definition: APSIntType.h:31
uint32_t getBitWidth() const
Definition: APSIntType.h:30
llvm::APSInt getMaxValue() const LLVM_READONLY
Returns the maximum value for this type.
Definition: APSIntType.h:65
void apply(llvm::APSInt &Value) const
Convert a given APSInt, in place, to match this type.
Definition: APSIntType.h:37
AnalyzerOptions & getAnalyzerOptions() override
APSIntType getAPSIntType(QualType T) const
Returns the type of the APSInt used to store values of the given QualType.
llvm::ImmutableList< SVal > getEmptySValList()
const llvm::APSInt & getZeroWithTypeSize(QualType T)
BlockCodeRegion - A region that represents code texts of blocks (closures).
Definition: MemRegion.h:627
BlockDataRegion - A region that represents a block instance.
Definition: MemRegion.h:674
AnalysisManager & getAnalysisManager()
Definition: ExprEngine.h:206
FunctionCodeRegion - A region that represents code texts of function.
Definition: MemRegion.h:580
static bool isLocType(QualType T)
Definition: SVals.h:289
const BlockCodeRegion * getBlockCodeRegion(const BlockDecl *BD, CanQualType locTy, AnalysisDeclContext *AC)
Definition: MemRegion.cpp:1163
const SymbolicRegion * getSymbolicHeapRegion(SymbolRef sym)
Return a unique symbolic region belonging to heap memory space.
Definition: MemRegion.cpp:1176
const SymbolicRegion * getSymbolicRegion(SymbolRef Sym, const MemSpaceRegion *MemSpace=nullptr)
Retrieve or create a "symbolic" memory region.
Definition: MemRegion.cpp:1169
const FunctionCodeRegion * getFunctionCodeRegion(const NamedDecl *FD)
Definition: MemRegion.cpp:1157
const BlockDataRegion * getBlockDataRegion(const BlockCodeRegion *bc, const LocationContext *lc, unsigned blockCount)
getBlockDataRegion - Get the memory region associated with an instance of a block.
Definition: MemRegion.cpp:1081
MemRegion - The root abstract class for all memory regions.
Definition: MemRegion.h:95
LLVM_ATTRIBUTE_RETURNS_NONNULL const MemRegion * StripCasts(bool StripBaseAndDerivedCasts=true) const
Definition: MemRegion.cpp:1342
const SymbolicRegion * getSymbolicBase() const
If this is a symbolic region, returns the region.
Definition: MemRegion.cpp:1365
SVal ArrayToPointer(Loc Array, QualType ElementTy)
Definition: ProgramState.h:590
DefinedOrUnknownSVal makeZeroVal(QualType type)
Construct an SVal representing '0' for the specified type.
Definition: SValBuilder.cpp:62
DefinedSVal getMemberPointer(const NamedDecl *ND)
SVal evalMinus(NonLoc val)
SVal evalComplement(NonLoc val)
BasicValueFactory & getBasicValueFactory()
Definition: SValBuilder.h:149
NonLoc makeCompoundVal(QualType type, llvm::ImmutableList< SVal > vals)
Definition: SValBuilder.h:241
SymbolManager SymMgr
Manages the creation of symbols.
Definition: SValBuilder.h:63
virtual SVal evalBinOpLN(ProgramStateRef state, BinaryOperator::Opcode op, Loc lhs, NonLoc rhs, QualType resultTy)=0
Create a new value which represents a binary expression with a memory location and non-location opera...
DefinedSVal getMetadataSymbolVal(const void *symbolTag, const MemRegion *region, const Expr *expr, QualType type, const LocationContext *LCtx, unsigned count)
MemRegionManager & getRegionManager()
Definition: SValBuilder.h:155
ProgramStateManager & getStateManager()
Definition: SValBuilder.h:139
SVal makeSymExprValNN(BinaryOperator::Opcode op, NonLoc lhs, NonLoc rhs, QualType resultTy)
Constructs a symbolic expression for two non-location values.
virtual SVal evalBinOpLL(ProgramStateRef state, BinaryOperator::Opcode op, Loc lhs, Loc rhs, QualType resultTy)=0
Create a new value which represents a binary expression with two memory location operands.
nonloc::SymbolVal makeNonLoc(const SymExpr *lhs, BinaryOperator::Opcode op, const llvm::APSInt &rhs, QualType type)
Definition: SValBuilder.cpp:77
const unsigned ArrayIndexWidth
The width of the scalar type used for array indices.
Definition: SValBuilder.h:76
DefinedSVal getBlockPointer(const BlockDecl *block, CanQualType locTy, const LocationContext *locContext, unsigned blockCount)
DefinedSVal getFunctionPointer(const FunctionDecl *func)
const QualType ArrayIndexTy
The scalar type to use for array indices.
Definition: SValBuilder.h:73
ASTContext & getContext()
Definition: SValBuilder.h:136
nonloc::ConcreteInt makeIntVal(const IntegerLiteral *integer)
Definition: SValBuilder.h:269
SVal convertToArrayIndex(SVal val)
loc::MemRegionVal makeLoc(SymbolRef sym)
Definition: SValBuilder.h:356
virtual SVal evalBinOpNN(ProgramStateRef state, BinaryOperator::Opcode op, NonLoc lhs, NonLoc rhs, QualType resultTy)=0
Create a new value which represents a binary expression with two non- location operands.
SVal evalCast(SVal V, QualType CastTy, QualType OriginalTy)
Cast a given SVal to another SVal using given QualType's.
DefinedOrUnknownSVal conjureSymbolVal(const void *symbolTag, const Expr *expr, const LocationContext *LCtx, unsigned count)
Create a new symbol with a unique 'name'.
BasicValueFactory BasicVals
Manager of APSInt values.
Definition: SValBuilder.h:60
ConditionTruthVal areEqual(ProgramStateRef state, SVal lhs, SVal rhs)
QualType getConditionType() const
Definition: SValBuilder.h:141
MemRegionManager MemMgr
Manages the creation of memory regions.
Definition: SValBuilder.h:66
SVal evalEQ(ProgramStateRef state, SVal lhs, SVal rhs)
SVal evalUnaryOp(ProgramStateRef state, UnaryOperator::Opcode opc, SVal operand, QualType type)
DefinedOrUnknownSVal getDerivedRegionValueSymbolVal(SymbolRef parentSymbol, const TypedValueRegion *region)
loc::MemRegionVal getCXXThis(const CXXMethodDecl *D, const StackFrameContext *SFC)
Return a memory region for the 'this' object reference.
nonloc::ConcreteInt makeTruthVal(bool b, QualType type)
Definition: SValBuilder.h:329
loc::ConcreteInt makeNullWithType(QualType type)
Create NULL pointer, with proper pointer bit-width for given address space.
Definition: SValBuilder.h:340
ProgramStateManager & StateMgr
Definition: SValBuilder.h:68
std::optional< SVal > getConstantVal(const Expr *E)
Returns the value of E, if it can be determined in a non-path-sensitive manner.
NonLoc makeLocAsInteger(Loc loc, unsigned bits)
Definition: SValBuilder.h:308
SVal evalIntegralCast(ProgramStateRef state, SVal val, QualType castTy, QualType originalType)
SymbolManager & getSymbolManager()
Definition: SValBuilder.h:152
DefinedOrUnknownSVal getRegionValueSymbolVal(const TypedValueRegion *region)
Make a unique symbol for value of region.
SVal evalBinOp(ProgramStateRef state, BinaryOperator::Opcode op, SVal lhs, SVal rhs, QualType type)
loc::ConcreteInt makeIntLocVal(const llvm::APSInt &integer)
Definition: SValBuilder.h:285
const AnalyzerOptions & AnOpts
Definition: SValBuilder.h:70
std::optional< loc::MemRegionVal > getCastedMemRegionVal(const MemRegion *region, QualType type)
Return MemRegionVal on success cast, otherwise return std::nullopt.
nonloc::ConcreteInt makeBoolVal(const ObjCBoolLiteralExpr *boolean)
Definition: SValBuilder.h:275
SValBuilder(llvm::BumpPtrAllocator &alloc, ASTContext &context, ProgramStateManager &stateMgr)
Definition: SValBuilder.cpp:52
DefinedOrUnknownSVal getConjuredHeapSymbolVal(const Expr *E, const LocationContext *LCtx, unsigned Count)
Conjure a symbol representing heap allocated memory region.
SValVisitor - this class implements a simple visitor for SVal subclasses.
Definition: SValVisitor.h:27
SVal - This represents a symbolic expression, which can be either an L-value or an R-value.
Definition: SVals.h:72
bool isUndef() const
Definition: SVals.h:128
bool isUnknownOrUndef() const
Definition: SVals.h:132
SymbolRef getAsSymbol(bool IncludeBaseRegions=false) const
If this SVal wraps a symbol return that SymbolRef.
Definition: SVals.cpp:104
std::optional< T > getAs() const
Convert to the specified SVal type, returning std::nullopt if this SVal is not of the desired type.
Definition: SVals.h:103
const MemRegion * getAsRegion() const
Definition: SVals.cpp:120
T castAs() const
Convert to the specified SVal type, asserting that this SVal is of the desired type.
Definition: SVals.h:99
bool isUnknown() const
Definition: SVals.h:124
std::optional< const MemRegion * > castRegion(const MemRegion *region, QualType CastToTy)
castRegion - Used by ExprEngine::VisitCast to handle casts from a MemRegion* to a specific location t...
Definition: Store.cpp:74
Symbolic value.
Definition: SymExpr.h:29
virtual QualType getType() const =0
virtual unsigned computeComplexity() const =0
const SymbolExtent * getExtentSymbol(const SubRegion *R)
const SymbolDerived * getDerivedSymbol(SymbolRef parentSymbol, const TypedValueRegion *R)
const SymbolMetadata * getMetadataSymbol(const MemRegion *R, const Stmt *S, QualType T, const LocationContext *LCtx, unsigned VisitCount, const void *SymbolTag=nullptr)
Creates a metadata symbol associated with a specific region.
const SymbolRegionValue * getRegionValueSymbol(const TypedValueRegion *R)
Make a unique symbol for MemRegion R according to its kind.
const SymbolConjured * conjureSymbol(const Stmt *E, const LocationContext *LCtx, QualType T, unsigned VisitCount, const void *SymbolTag=nullptr)
const SymIntExpr * getSymIntExpr(const SymExpr *lhs, BinaryOperator::Opcode op, const llvm::APSInt &rhs, QualType t)
const SymbolCast * getCastSymbol(const SymExpr *Operand, QualType From, QualType To)
const UnarySymExpr * getUnarySymExpr(const SymExpr *operand, UnaryOperator::Opcode op, QualType t)
static bool canSymbolicate(QualType T)
const SymSymExpr * getSymSymExpr(const SymExpr *lhs, BinaryOperator::Opcode op, const SymExpr *rhs, QualType t)
const IntSymExpr * getIntSymExpr(const llvm::APSInt &lhs, BinaryOperator::Opcode op, const SymExpr *rhs, QualType t)
SymbolicRegion - A special, "non-concrete" region.
Definition: MemRegion.h:770
TypedValueRegion - An abstract class representing regions having a typed value.
Definition: MemRegion.h:531
virtual QualType getValueType() const =0
Value representing integer constant.
Definition: SVals.h:329
const llvm::APSInt & getValue() const
Definition: SVals.h:333
Value representing pointer-to-member.
Definition: SVals.h:441
Represents symbolic expression that isn't a location.
Definition: SVals.h:304
LLVM_ATTRIBUTE_RETURNS_NONNULL SymbolRef getSymbol() const
Definition: SVals.h:313
const internal::VariadicAllOfMatcher< Type > type
Matches Types in the clang AST.
const internal::VariadicAllOfMatcher< Stmt > stmt
Matches statements.
const internal::VariadicDynCastAllOfMatcher< Stmt, Expr > expr
Matches expressions.
BinaryOperatorKind
@ C
Languages that the frontend can parse and compile.
@ Result
The result type of a method or function.
UnaryOperatorKind
EvalResult is a struct with detailed info about an evaluated expression.
Definition: Expr.h:623