clang  14.0.0git
SValBuilder.cpp
Go to the documentation of this file.
1 //===- SValBuilder.cpp - Basic class for all SValBuilder implementations --===//
2 //
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6 //
7 //===----------------------------------------------------------------------===//
8 //
9 // This file defines SValBuilder, the base class for all (complete) SValBuilder
10 // implementations.
11 //
12 //===----------------------------------------------------------------------===//
13 
15 #include "clang/AST/ASTContext.h"
16 #include "clang/AST/Decl.h"
17 #include "clang/AST/DeclCXX.h"
18 #include "clang/AST/ExprCXX.h"
19 #include "clang/AST/ExprObjC.h"
20 #include "clang/AST/Stmt.h"
21 #include "clang/AST/Type.h"
22 #include "clang/Basic/LLVM.h"
35 #include "llvm/ADT/APSInt.h"
36 #include "llvm/ADT/None.h"
37 #include "llvm/ADT/Optional.h"
38 #include "llvm/Support/Casting.h"
39 #include "llvm/Support/Compiler.h"
40 #include <cassert>
41 #include <tuple>
42 
43 using namespace clang;
44 using namespace ento;
45 
46 //===----------------------------------------------------------------------===//
47 // Basic SVal creation.
48 //===----------------------------------------------------------------------===//
49 
50 void SValBuilder::anchor() {}
51 
52 SValBuilder::SValBuilder(llvm::BumpPtrAllocator &alloc, ASTContext &context,
53  ProgramStateManager &stateMgr)
54  : Context(context), BasicVals(context, alloc),
55  SymMgr(context, BasicVals, alloc), MemMgr(context, alloc),
56  StateMgr(stateMgr),
57  AnOpts(
58  stateMgr.getOwningEngine().getAnalysisManager().getAnalyzerOptions()),
59  ArrayIndexTy(context.LongLongTy),
60  ArrayIndexWidth(context.getTypeSize(ArrayIndexTy)) {}
61 
63  if (Loc::isLocType(type))
64  return makeNull();
65 
66  if (type->isIntegralOrEnumerationType())
67  return makeIntVal(0, type);
68 
69  if (type->isArrayType() || type->isRecordType() || type->isVectorType() ||
70  type->isAnyComplexType())
72 
73  // FIXME: Handle floats.
74  return UnknownVal();
75 }
76 
78  const llvm::APSInt& rhs, QualType type) {
79  // The Environment ensures we always get a persistent APSInt in
80  // BasicValueFactory, so we don't need to get the APSInt from
81  // BasicValueFactory again.
82  assert(lhs);
83  assert(!Loc::isLocType(type));
84  return nonloc::SymbolVal(SymMgr.getSymIntExpr(lhs, op, rhs, type));
85 }
86 
88  BinaryOperator::Opcode op, const SymExpr *rhs,
89  QualType type) {
90  assert(rhs);
91  assert(!Loc::isLocType(type));
92  return nonloc::SymbolVal(SymMgr.getIntSymExpr(lhs, op, rhs, type));
93 }
94 
96  const SymExpr *rhs, QualType type) {
97  assert(lhs && rhs);
98  assert(!Loc::isLocType(type));
99  return nonloc::SymbolVal(SymMgr.getSymSymExpr(lhs, op, rhs, type));
100 }
101 
103  QualType fromTy, QualType toTy) {
104  assert(operand);
105  assert(!Loc::isLocType(toTy));
106  return nonloc::SymbolVal(SymMgr.getCastSymbol(operand, fromTy, toTy));
107 }
108 
110  if (val.isUnknownOrUndef())
111  return val;
112 
113  // Common case: we have an appropriately sized integer.
115  const llvm::APSInt& I = CI->getValue();
116  if (I.getBitWidth() == ArrayIndexWidth && I.isSigned())
117  return val;
118  }
119 
120  return evalCast(val, ArrayIndexTy, QualType{});
121 }
122 
124  return makeTruthVal(boolean->getValue());
125 }
126 
129  QualType T = region->getValueType();
130 
131  if (T->isNullPtrType())
132  return makeZeroVal(T);
133 
135  return UnknownVal();
136 
137  SymbolRef sym = SymMgr.getRegionValueSymbol(region);
138 
139  if (Loc::isLocType(T))
141 
142  return nonloc::SymbolVal(sym);
143 }
144 
146  const Expr *Ex,
147  const LocationContext *LCtx,
148  unsigned Count) {
149  QualType T = Ex->getType();
150 
151  if (T->isNullPtrType())
152  return makeZeroVal(T);
153 
154  // Compute the type of the result. If the expression is not an R-value, the
155  // result should be a location.
156  QualType ExType = Ex->getType();
157  if (Ex->isGLValue())
158  T = LCtx->getAnalysisDeclContext()->getASTContext().getPointerType(ExType);
159 
160  return conjureSymbolVal(SymbolTag, Ex, LCtx, T, Count);
161 }
162 
164  const Expr *expr,
165  const LocationContext *LCtx,
166  QualType type,
167  unsigned count) {
168  if (type->isNullPtrType())
169  return makeZeroVal(type);
170 
172  return UnknownVal();
173 
174  SymbolRef sym = SymMgr.conjureSymbol(expr, LCtx, type, count, symbolTag);
175 
176  if (Loc::isLocType(type))
178 
179  return nonloc::SymbolVal(sym);
180 }
181 
183  const LocationContext *LCtx,
184  QualType type,
185  unsigned visitCount) {
186  if (type->isNullPtrType())
187  return makeZeroVal(type);
188 
190  return UnknownVal();
191 
192  SymbolRef sym = SymMgr.conjureSymbol(stmt, LCtx, type, visitCount);
193 
194  if (Loc::isLocType(type))
196 
197  return nonloc::SymbolVal(sym);
198 }
199 
202  const LocationContext *LCtx,
203  unsigned VisitCount) {
204  QualType T = E->getType();
205  return getConjuredHeapSymbolVal(E, LCtx, T, VisitCount);
206 }
207 
208 DefinedOrUnknownSVal
210  const LocationContext *LCtx,
211  QualType type, unsigned VisitCount) {
212  assert(Loc::isLocType(type));
214  if (type->isNullPtrType())
215  return makeZeroVal(type);
216 
217  SymbolRef sym = SymMgr.conjureSymbol(E, LCtx, type, VisitCount);
218  return loc::MemRegionVal(MemMgr.getSymbolicHeapRegion(sym));
219 }
220 
222  const MemRegion *region,
223  const Expr *expr, QualType type,
224  const LocationContext *LCtx,
225  unsigned count) {
226  assert(SymbolManager::canSymbolicate(type) && "Invalid metadata symbol type");
227 
228  SymbolRef sym =
229  SymMgr.getMetadataSymbol(region, expr, type, LCtx, count, symbolTag);
230 
231  if (Loc::isLocType(type))
233 
234  return nonloc::SymbolVal(sym);
235 }
236 
239  const TypedValueRegion *region) {
240  QualType T = region->getValueType();
241 
242  if (T->isNullPtrType())
243  return makeZeroVal(T);
244 
246  return UnknownVal();
247 
248  SymbolRef sym = SymMgr.getDerivedSymbol(parentSymbol, region);
249 
250  if (Loc::isLocType(T))
252 
253  return nonloc::SymbolVal(sym);
254 }
255 
257  assert(!ND || (isa<CXXMethodDecl, FieldDecl, IndirectFieldDecl>(ND)));
258 
259  if (const auto *MD = dyn_cast_or_null<CXXMethodDecl>(ND)) {
260  // Sema treats pointers to static member functions as have function pointer
261  // type, so return a function pointer for the method.
262  // We don't need to play a similar trick for static member fields
263  // because these are represented as plain VarDecls and not FieldDecls
264  // in the AST.
265  if (MD->isStatic())
266  return getFunctionPointer(MD);
267  }
268 
269  return nonloc::PointerToMember(ND);
270 }
271 
274 }
275 
277  CanQualType locTy,
278  const LocationContext *locContext,
279  unsigned blockCount) {
280  const BlockCodeRegion *BC =
281  MemMgr.getBlockCodeRegion(block, locTy, locContext->getAnalysisDeclContext());
282  const BlockDataRegion *BD = MemMgr.getBlockDataRegion(BC, locContext,
283  blockCount);
284  return loc::MemRegionVal(BD);
285 }
286 
289  if (auto OptR = StateMgr.getStoreManager().castRegion(R, Ty))
290  return loc::MemRegionVal(*OptR);
291  return None;
292 }
293 
294 /// Return a memory region for the 'this' object reference.
296  const StackFrameContext *SFC) {
297  return loc::MemRegionVal(
298  getRegionManager().getCXXThisRegion(D->getThisType(), SFC));
299 }
300 
301 /// Return a memory region for the 'this' object reference.
303  const StackFrameContext *SFC) {
304  const Type *T = D->getTypeForDecl();
306  return loc::MemRegionVal(getRegionManager().getCXXThisRegion(PT, SFC));
307 }
308 
310  E = E->IgnoreParens();
311 
312  switch (E->getStmtClass()) {
313  // Handle expressions that we treat differently from the AST's constant
314  // evaluator.
315  case Stmt::AddrLabelExprClass:
316  return makeLoc(cast<AddrLabelExpr>(E));
317 
318  case Stmt::CXXScalarValueInitExprClass:
319  case Stmt::ImplicitValueInitExprClass:
320  return makeZeroVal(E->getType());
321 
322  case Stmt::ObjCStringLiteralClass: {
323  const auto *SL = cast<ObjCStringLiteral>(E);
324  return makeLoc(getRegionManager().getObjCStringRegion(SL));
325  }
326 
327  case Stmt::StringLiteralClass: {
328  const auto *SL = cast<StringLiteral>(E);
329  return makeLoc(getRegionManager().getStringRegion(SL));
330  }
331 
332  case Stmt::PredefinedExprClass: {
333  const auto *PE = cast<PredefinedExpr>(E);
334  assert(PE->getFunctionName() &&
335  "Since we analyze only instantiated functions, PredefinedExpr "
336  "should have a function name.");
337  return makeLoc(getRegionManager().getStringRegion(PE->getFunctionName()));
338  }
339 
340  // Fast-path some expressions to avoid the overhead of going through the AST's
341  // constant evaluator
342  case Stmt::CharacterLiteralClass: {
343  const auto *C = cast<CharacterLiteral>(E);
344  return makeIntVal(C->getValue(), C->getType());
345  }
346 
347  case Stmt::CXXBoolLiteralExprClass:
348  return makeBoolVal(cast<CXXBoolLiteralExpr>(E));
349 
350  case Stmt::TypeTraitExprClass: {
351  const auto *TE = cast<TypeTraitExpr>(E);
352  return makeTruthVal(TE->getValue(), TE->getType());
353  }
354 
355  case Stmt::IntegerLiteralClass:
356  return makeIntVal(cast<IntegerLiteral>(E));
357 
358  case Stmt::ObjCBoolLiteralExprClass:
359  return makeBoolVal(cast<ObjCBoolLiteralExpr>(E));
360 
361  case Stmt::CXXNullPtrLiteralExprClass:
362  return makeNull();
363 
364  case Stmt::CStyleCastExprClass:
365  case Stmt::CXXFunctionalCastExprClass:
366  case Stmt::CXXConstCastExprClass:
367  case Stmt::CXXReinterpretCastExprClass:
368  case Stmt::CXXStaticCastExprClass:
369  case Stmt::ImplicitCastExprClass: {
370  const auto *CE = cast<CastExpr>(E);
371  switch (CE->getCastKind()) {
372  default:
373  break;
374  case CK_ArrayToPointerDecay:
375  case CK_IntegralToPointer:
376  case CK_NoOp:
377  case CK_BitCast: {
378  const Expr *SE = CE->getSubExpr();
379  Optional<SVal> Val = getConstantVal(SE);
380  if (!Val)
381  return None;
382  return evalCast(*Val, CE->getType(), SE->getType());
383  }
384  }
385  // FALLTHROUGH
386  LLVM_FALLTHROUGH;
387  }
388 
389  // If we don't have a special case, fall back to the AST's constant evaluator.
390  default: {
391  // Don't try to come up with a value for materialized temporaries.
392  if (E->isGLValue())
393  return None;
394 
395  ASTContext &Ctx = getContext();
396  Expr::EvalResult Result;
397  if (E->EvaluateAsInt(Result, Ctx))
398  return makeIntVal(Result.Val.getInt());
399 
400  if (Loc::isLocType(E->getType()))
402  return makeNull();
403 
404  return None;
405  }
406  }
407 }
408 
410  NonLoc LHS, NonLoc RHS,
411  QualType ResultTy) {
412  SymbolRef symLHS = LHS.getAsSymbol();
413  SymbolRef symRHS = RHS.getAsSymbol();
414 
415  // TODO: When the Max Complexity is reached, we should conjure a symbol
416  // instead of generating an Unknown value and propagate the taint info to it.
417  const unsigned MaxComp = AnOpts.MaxSymbolComplexity;
418 
419  if (symLHS && symRHS &&
420  (symLHS->computeComplexity() + symRHS->computeComplexity()) < MaxComp)
421  return makeNonLoc(symLHS, Op, symRHS, ResultTy);
422 
423  if (symLHS && symLHS->computeComplexity() < MaxComp)
425  return makeNonLoc(symLHS, Op, rInt->getValue(), ResultTy);
426 
427  if (symRHS && symRHS->computeComplexity() < MaxComp)
429  return makeNonLoc(lInt->getValue(), Op, symRHS, ResultTy);
430 
431  return UnknownVal();
432 }
433 
435  SVal lhs, SVal rhs, QualType type) {
436  if (lhs.isUndef() || rhs.isUndef())
437  return UndefinedVal();
438 
439  if (lhs.isUnknown() || rhs.isUnknown())
440  return UnknownVal();
441 
442  if (lhs.getAs<nonloc::LazyCompoundVal>() ||
444  return UnknownVal();
445  }
446 
447  if (op == BinaryOperatorKind::BO_Cmp) {
448  // We can't reason about C++20 spaceship operator yet.
449  //
450  // FIXME: Support C++20 spaceship operator.
451  // The main problem here is that the result is not integer.
452  return UnknownVal();
453  }
454 
455  if (Optional<Loc> LV = lhs.getAs<Loc>()) {
456  if (Optional<Loc> RV = rhs.getAs<Loc>())
457  return evalBinOpLL(state, op, *LV, *RV, type);
458 
459  return evalBinOpLN(state, op, *LV, rhs.castAs<NonLoc>(), type);
460  }
461 
462  if (Optional<Loc> RV = rhs.getAs<Loc>()) {
463  // Support pointer arithmetic where the addend is on the left
464  // and the pointer on the right.
465  assert(op == BO_Add);
466 
467  // Commute the operands.
468  return evalBinOpLN(state, op, *RV, lhs.castAs<NonLoc>(), type);
469  }
470 
471  return evalBinOpNN(state, op, lhs.castAs<NonLoc>(), rhs.castAs<NonLoc>(),
472  type);
473 }
474 
476  SVal rhs) {
477  return state->isNonNull(evalEQ(state, lhs, rhs));
478 }
479 
481  return evalBinOp(state, BO_EQ, lhs, rhs, getConditionType());
482 }
483 
486  DefinedOrUnknownSVal rhs) {
487  return evalEQ(state, static_cast<SVal>(lhs), static_cast<SVal>(rhs))
489 }
490 
491 /// Recursively check if the pointer types are equal modulo const, volatile,
492 /// and restrict qualifiers. Also, assume that all types are similar to 'void'.
493 /// Assumes the input types are canonical.
494 static bool shouldBeModeledWithNoOp(ASTContext &Context, QualType ToTy,
495  QualType FromTy) {
496  while (Context.UnwrapSimilarTypes(ToTy, FromTy)) {
497  Qualifiers Quals1, Quals2;
498  ToTy = Context.getUnqualifiedArrayType(ToTy, Quals1);
499  FromTy = Context.getUnqualifiedArrayType(FromTy, Quals2);
500 
501  // Make sure that non-cvr-qualifiers the other qualifiers (e.g., address
502  // spaces) are identical.
503  Quals1.removeCVRQualifiers();
504  Quals2.removeCVRQualifiers();
505  if (Quals1 != Quals2)
506  return false;
507  }
508 
509  // If we are casting to void, the 'From' value can be used to represent the
510  // 'To' value.
511  //
512  // FIXME: Doing this after unwrapping the types doesn't make any sense. A
513  // cast from 'int**' to 'void**' is not special in the way that a cast from
514  // 'int*' to 'void*' is.
515  if (ToTy->isVoidType())
516  return true;
517 
518  if (ToTy != FromTy)
519  return false;
520 
521  return true;
522 }
523 
524 // Handles casts of type CK_IntegralCast.
525 // At the moment, this function will redirect to evalCast, except when the range
526 // of the original value is known to be greater than the max of the target type.
528  QualType castTy, QualType originalTy) {
529  // No truncations if target type is big enough.
530  if (getContext().getTypeSize(castTy) >= getContext().getTypeSize(originalTy))
531  return evalCast(val, castTy, originalTy);
532 
533  SymbolRef se = val.getAsSymbol();
534  if (!se) // Let evalCast handle non symbolic expressions.
535  return evalCast(val, castTy, originalTy);
536 
537  // Find the maximum value of the target type.
538  APSIntType ToType(getContext().getTypeSize(castTy),
539  castTy->isUnsignedIntegerType());
540  llvm::APSInt ToTypeMax = ToType.getMaxValue();
541  NonLoc ToTypeMaxVal =
542  makeIntVal(ToTypeMax.isUnsigned() ? ToTypeMax.getZExtValue()
543  : ToTypeMax.getSExtValue(),
544  castTy)
545  .castAs<NonLoc>();
546  // Check the range of the symbol being casted against the maximum value of the
547  // target type.
548  NonLoc FromVal = val.castAs<NonLoc>();
549  QualType CmpTy = getConditionType();
550  NonLoc CompVal =
551  evalBinOpNN(state, BO_LE, FromVal, ToTypeMaxVal, CmpTy).castAs<NonLoc>();
552  ProgramStateRef IsNotTruncated, IsTruncated;
553  std::tie(IsNotTruncated, IsTruncated) = state->assume(CompVal);
554  if (!IsNotTruncated && IsTruncated) {
555  // Symbol is truncated so we evaluate it as a cast.
556  NonLoc CastVal = makeNonLoc(se, originalTy, castTy);
557  return CastVal;
558  }
559  return evalCast(val, castTy, originalTy);
560 }
561 
562 //===----------------------------------------------------------------------===//
563 // Cast methods.
564 // `evalCast` is the main method
565 // `evalCastKind` and `evalCastSubKind` are helpers
566 //===----------------------------------------------------------------------===//
567 
568 /// Cast a given SVal to another SVal using given QualType's.
569 /// \param V -- SVal that should be casted.
570 /// \param CastTy -- QualType that V should be casted according to.
571 /// \param OriginalTy -- QualType which is associated to V. It provides
572 /// additional information about what type the cast performs from.
573 /// \returns the most appropriate casted SVal.
574 /// Note: Many cases don't use an exact OriginalTy. It can be extracted
575 /// from SVal or the cast can performs unconditionaly. Always pass OriginalTy!
576 /// It can be crucial in certain cases and generates different results.
577 /// FIXME: If `OriginalTy.isNull()` is true, then cast performs based on CastTy
578 /// only. This behavior is uncertain and should be improved.
580  if (CastTy.isNull())
581  return V;
582 
583  CastTy = Context.getCanonicalType(CastTy);
584 
585  const bool IsUnknownOriginalType = OriginalTy.isNull();
586  if (!IsUnknownOriginalType) {
587  OriginalTy = Context.getCanonicalType(OriginalTy);
588 
589  if (CastTy == OriginalTy)
590  return V;
591 
592  // FIXME: Move this check to the most appropriate
593  // evalCastKind/evalCastSubKind function. For const casts, casts to void,
594  // just propagate the value.
595  if (!CastTy->isVariableArrayType() && !OriginalTy->isVariableArrayType())
597  Context.getPointerType(OriginalTy)))
598  return V;
599  }
600 
601  // Cast SVal according to kinds.
602  switch (V.getBaseKind()) {
603  case SVal::UndefinedValKind:
604  return evalCastKind(V.castAs<UndefinedVal>(), CastTy, OriginalTy);
605  case SVal::UnknownValKind:
606  return evalCastKind(V.castAs<UnknownVal>(), CastTy, OriginalTy);
607  case SVal::LocKind:
608  return evalCastKind(V.castAs<Loc>(), CastTy, OriginalTy);
609  case SVal::NonLocKind:
610  return evalCastKind(V.castAs<NonLoc>(), CastTy, OriginalTy);
611  }
612 
613  llvm_unreachable("Unknown SVal kind");
614 }
615 
617  QualType OriginalTy) {
618  return V;
619 }
620 
622  QualType OriginalTy) {
623  return V;
624 }
625 
627  switch (V.getSubKind()) {
628  case loc::ConcreteIntKind:
629  return evalCastSubKind(V.castAs<loc::ConcreteInt>(), CastTy, OriginalTy);
630  case loc::GotoLabelKind:
631  return evalCastSubKind(V.castAs<loc::GotoLabel>(), CastTy, OriginalTy);
632  case loc::MemRegionValKind:
633  return evalCastSubKind(V.castAs<loc::MemRegionVal>(), CastTy, OriginalTy);
634  }
635 
636  llvm_unreachable("Unknown SVal kind");
637 }
638 
640  switch (V.getSubKind()) {
641  case nonloc::CompoundValKind:
642  return evalCastSubKind(V.castAs<nonloc::CompoundVal>(), CastTy, OriginalTy);
643  case nonloc::ConcreteIntKind:
644  return evalCastSubKind(V.castAs<nonloc::ConcreteInt>(), CastTy, OriginalTy);
645  case nonloc::LazyCompoundValKind:
646  return evalCastSubKind(V.castAs<nonloc::LazyCompoundVal>(), CastTy,
647  OriginalTy);
648  case nonloc::LocAsIntegerKind:
649  return evalCastSubKind(V.castAs<nonloc::LocAsInteger>(), CastTy,
650  OriginalTy);
651  case nonloc::SymbolValKind:
652  return evalCastSubKind(V.castAs<nonloc::SymbolVal>(), CastTy, OriginalTy);
653  case nonloc::PointerToMemberKind:
654  return evalCastSubKind(V.castAs<nonloc::PointerToMember>(), CastTy,
655  OriginalTy);
656  }
657 
658  llvm_unreachable("Unknown SVal kind");
659 }
660 
662  QualType OriginalTy) {
663  // Pointer to bool.
664  if (CastTy->isBooleanType())
665  return makeTruthVal(V.getValue().getBoolValue(), CastTy);
666 
667  // Pointer to integer.
668  if (CastTy->isIntegralOrEnumerationType()) {
669  llvm::APSInt Value = V.getValue();
671  return makeIntVal(Value);
672  }
673 
674  // Pointer to any pointer.
675  if (Loc::isLocType(CastTy))
676  return V;
677 
678  // Pointer to whatever else.
679  return UnknownVal();
680 }
681 
683  QualType OriginalTy) {
684  // Pointer to bool.
685  if (CastTy->isBooleanType())
686  // Labels are always true.
687  return makeTruthVal(true, CastTy);
688 
689  // Pointer to integer.
690  if (CastTy->isIntegralOrEnumerationType()) {
691  const unsigned BitWidth = Context.getIntWidth(CastTy);
692  return makeLocAsInteger(V, BitWidth);
693  }
694 
695  const bool IsUnknownOriginalType = OriginalTy.isNull();
696  if (!IsUnknownOriginalType) {
697  // Array to pointer.
698  if (isa<ArrayType>(OriginalTy))
699  if (CastTy->isPointerType() || CastTy->isReferenceType())
700  return UnknownVal();
701  }
702 
703  // Pointer to any pointer.
704  if (Loc::isLocType(CastTy))
705  return V;
706 
707  // Pointer to whatever else.
708  return UnknownVal();
709 }
710 
712  return ty1->getPointeeType().getCanonicalType().getTypePtr() ==
714 }
715 
717  QualType OriginalTy) {
718  // Pointer to bool.
719  if (CastTy->isBooleanType()) {
720  const MemRegion *R = V.getRegion();
721  if (const FunctionCodeRegion *FTR = dyn_cast<FunctionCodeRegion>(R))
722  if (const FunctionDecl *FD = dyn_cast<FunctionDecl>(FTR->getDecl()))
723  if (FD->isWeak())
724  // FIXME: Currently we are using an extent symbol here,
725  // because there are no generic region address metadata
726  // symbols to use, only content metadata.
728 
729  if (const SymbolicRegion *SymR = R->getSymbolicBase()) {
730  SymbolRef Sym = SymR->getSymbol();
731  QualType Ty = Sym->getType();
732  // This change is needed for architectures with varying
733  // pointer widths. See the amdgcn opencl reproducer with
734  // this change as an example: solver-sym-simplification-ptr-bool.cl
735  // FIXME: Cleanup remainder of `getZeroWithPtrWidth ()`
736  // and `getIntWithPtrWidth()` functions to prevent future
737  // confusion
738  if (!Ty->isReferenceType())
739  return makeNonLoc(Sym, BO_NE, BasicVals.getZeroWithTypeSize(Ty),
740  CastTy);
741  }
742  // Non-symbolic memory regions are always true.
743  return makeTruthVal(true, CastTy);
744  }
745 
746  const bool IsUnknownOriginalType = OriginalTy.isNull();
747  // Try to cast to array
748  const auto *ArrayTy =
749  IsUnknownOriginalType
750  ? nullptr
751  : dyn_cast<ArrayType>(OriginalTy.getCanonicalType());
752 
753  // Pointer to integer.
754  if (CastTy->isIntegralOrEnumerationType()) {
755  SVal Val = V;
756  // Array to integer.
757  if (ArrayTy) {
758  // We will always decay to a pointer.
759  QualType ElemTy = ArrayTy->getElementType();
760  Val = StateMgr.ArrayToPointer(V, ElemTy);
761  // FIXME: Keep these here for now in case we decide soon that we
762  // need the original decayed type.
763  // QualType elemTy = cast<ArrayType>(originalTy)->getElementType();
764  // QualType pointerTy = C.getPointerType(elemTy);
765  }
766  const unsigned BitWidth = Context.getIntWidth(CastTy);
767  return makeLocAsInteger(Val.castAs<Loc>(), BitWidth);
768  }
769 
770  // Pointer to pointer.
771  if (Loc::isLocType(CastTy)) {
772 
773  if (IsUnknownOriginalType) {
774  // When retrieving symbolic pointer and expecting a non-void pointer,
775  // wrap them into element regions of the expected type if necessary.
776  // It is necessary to make sure that the retrieved value makes sense,
777  // because there's no other cast in the AST that would tell us to cast
778  // it to the correct pointer type. We might need to do that for non-void
779  // pointers as well.
780  // FIXME: We really need a single good function to perform casts for us
781  // correctly every time we need it.
782  const MemRegion *R = V.getRegion();
783  if (CastTy->isPointerType() && !CastTy->isVoidPointerType()) {
784  if (const auto *SR = dyn_cast<SymbolicRegion>(R)) {
785  QualType SRTy = SR->getSymbol()->getType();
786  if (!hasSameUnqualifiedPointeeType(SRTy, CastTy)) {
787  if (auto OptMemRegV = getCastedMemRegionVal(SR, CastTy))
788  return *OptMemRegV;
789  }
790  }
791  }
792  // Next fixes pointer dereference using type different from its initial
793  // one. See PR37503 and PR49007 for details.
794  if (const auto *ER = dyn_cast<ElementRegion>(R)) {
795  if (auto OptMemRegV = getCastedMemRegionVal(ER, CastTy))
796  return *OptMemRegV;
797  }
798 
799  return V;
800  }
801 
802  if (OriginalTy->isIntegralOrEnumerationType() ||
803  OriginalTy->isBlockPointerType() || OriginalTy->isFunctionPointerType())
804  return V;
805 
806  // Array to pointer.
807  if (ArrayTy) {
808  // Are we casting from an array to a pointer? If so just pass on
809  // the decayed value.
810  if (CastTy->isPointerType() || CastTy->isReferenceType()) {
811  // We will always decay to a pointer.
812  QualType ElemTy = ArrayTy->getElementType();
813  return StateMgr.ArrayToPointer(V, ElemTy);
814  }
815  // Are we casting from an array to an integer? If so, cast the decayed
816  // pointer value to an integer.
817  assert(CastTy->isIntegralOrEnumerationType());
818  }
819 
820  // Other pointer to pointer.
821  assert(Loc::isLocType(OriginalTy) || OriginalTy->isFunctionType() ||
822  CastTy->isReferenceType());
823 
824  // We get a symbolic function pointer for a dereference of a function
825  // pointer, but it is of function type. Example:
826 
827  // struct FPRec {
828  // void (*my_func)(int * x);
829  // };
830  //
831  // int bar(int x);
832  //
833  // int f1_a(struct FPRec* foo) {
834  // int x;
835  // (*foo->my_func)(&x);
836  // return bar(x)+1; // no-warning
837  // }
838 
839  // Get the result of casting a region to a different type.
840  const MemRegion *R = V.getRegion();
841  if (auto OptMemRegV = getCastedMemRegionVal(R, CastTy))
842  return *OptMemRegV;
843  }
844 
845  // Pointer to whatever else.
846  // FIXME: There can be gross cases where one casts the result of a
847  // function (that returns a pointer) to some other value that happens to
848  // fit within that pointer value. We currently have no good way to model
849  // such operations. When this happens, the underlying operation is that
850  // the caller is reasoning about bits. Conceptually we are layering a
851  // "view" of a location on top of those bits. Perhaps we need to be more
852  // lazy about mutual possible views, even on an SVal? This may be
853  // necessary for bit-level reasoning as well.
854  return UnknownVal();
855 }
856 
858  QualType OriginalTy) {
859  // Compound to whatever.
860  return UnknownVal();
861 }
862 
864  QualType OriginalTy) {
865  auto CastedValue = [V, CastTy, this]() {
866  llvm::APSInt Value = V.getValue();
868  return Value;
869  };
870 
871  // Integer to bool.
872  if (CastTy->isBooleanType())
873  return makeTruthVal(V.getValue().getBoolValue(), CastTy);
874 
875  // Integer to pointer.
876  if (CastTy->isIntegralOrEnumerationType())
877  return makeIntVal(CastedValue());
878 
879  // Integer to pointer.
880  if (Loc::isLocType(CastTy))
881  return makeIntLocVal(CastedValue());
882 
883  // Pointer to whatever else.
884  return UnknownVal();
885 }
886 
888  QualType OriginalTy) {
889  // Compound to whatever.
890  return UnknownVal();
891 }
892 
894  QualType OriginalTy) {
895  Loc L = V.getLoc();
896 
897  // Pointer as integer to bool.
898  if (CastTy->isBooleanType())
899  // Pass to Loc function.
900  return evalCastKind(L, CastTy, OriginalTy);
901 
902  const bool IsUnknownOriginalType = OriginalTy.isNull();
903  // Pointer as integer to pointer.
904  if (!IsUnknownOriginalType && Loc::isLocType(CastTy) &&
905  OriginalTy->isIntegralOrEnumerationType()) {
906  if (const MemRegion *R = L.getAsRegion())
907  if (auto OptMemRegV = getCastedMemRegionVal(R, CastTy))
908  return *OptMemRegV;
909  return L;
910  }
911 
912  // Pointer as integer with region to integer/pointer.
913  const MemRegion *R = L.getAsRegion();
914  if (!IsUnknownOriginalType && R) {
915  if (CastTy->isIntegralOrEnumerationType())
916  return evalCastSubKind(loc::MemRegionVal(R), CastTy, OriginalTy);
917 
918  if (Loc::isLocType(CastTy)) {
919  assert(Loc::isLocType(OriginalTy) || OriginalTy->isFunctionType() ||
920  CastTy->isReferenceType());
921  // Delegate to store manager to get the result of casting a region to a
922  // different type. If the MemRegion* returned is NULL, this expression
923  // Evaluates to UnknownVal.
924  if (auto OptMemRegV = getCastedMemRegionVal(R, CastTy))
925  return *OptMemRegV;
926  }
927  } else {
928  if (Loc::isLocType(CastTy)) {
929  if (IsUnknownOriginalType)
930  return evalCastSubKind(loc::MemRegionVal(R), CastTy, OriginalTy);
931  return L;
932  }
933 
934  SymbolRef SE = nullptr;
935  if (R) {
936  if (const SymbolicRegion *SR =
937  dyn_cast<SymbolicRegion>(R->StripCasts())) {
938  SE = SR->getSymbol();
939  }
940  }
941 
942  if (!CastTy->isFloatingType() || !SE || SE->getType()->isFloatingType()) {
943  // FIXME: Correctly support promotions/truncations.
944  const unsigned CastSize = Context.getIntWidth(CastTy);
945  if (CastSize == V.getNumBits())
946  return V;
947 
948  return makeLocAsInteger(L, CastSize);
949  }
950  }
951 
952  // Pointer as integer to whatever else.
953  return UnknownVal();
954 }
955 
957  QualType OriginalTy) {
958  SymbolRef SE = V.getSymbol();
959 
960  const bool IsUnknownOriginalType = OriginalTy.isNull();
961  // Symbol to bool.
962  if (!IsUnknownOriginalType && CastTy->isBooleanType()) {
963  // Non-float to bool.
964  if (Loc::isLocType(OriginalTy) ||
965  OriginalTy->isIntegralOrEnumerationType() ||
966  OriginalTy->isMemberPointerType()) {
968  return makeNonLoc(SE, BO_NE, BVF.getValue(0, SE->getType()), CastTy);
969  }
970  } else {
971  // Symbol to integer, float.
973  // If types are the same or both are integers, ignore the cast.
974  // FIXME: Remove this hack when we support symbolic truncation/extension.
975  // HACK: If both castTy and T are integers, ignore the cast. This is
976  // not a permanent solution. Eventually we want to precisely handle
977  // extension/truncation of symbolic integers. This prevents us from losing
978  // precision when we assign 'x = y' and 'y' is symbolic and x and y are
979  // different integer types.
980  if (haveSameType(T, CastTy))
981  return V;
982  if (!Loc::isLocType(CastTy))
983  if (!IsUnknownOriginalType || !CastTy->isFloatingType() ||
984  T->isFloatingType())
985  return makeNonLoc(SE, T, CastTy);
986  }
987 
988  // Symbol to pointer and whatever else.
989  return UnknownVal();
990 }
991 
993  QualType OriginalTy) {
994  // Member pointer to whatever.
995  return V;
996 }
clang::CXXMethodDecl::getThisType
QualType getThisType() const
Return the type of the this pointer.
Definition: DeclCXX.cpp:2451
clang::ento::SValBuilder::evalBinOp
SVal evalBinOp(ProgramStateRef state, BinaryOperator::Opcode op, SVal lhs, SVal rhs, QualType type)
Definition: SValBuilder.cpp:434
clang::ento::Loc::isLocType
static bool isLocType(QualType T)
Definition: SVals.h:336
clang::ento::UndefinedVal
Definition: SVals.h:224
clang::AnalysisDeclContext::getASTContext
ASTContext & getASTContext() const
Definition: AnalysisDeclContext.h:104
clang::CXXBoolLiteralExpr
A boolean literal, per ([C++ lex.bool] Boolean literals).
Definition: ExprCXX.h:721
clang::ento::BasicValueFactory::getEmptySValList
llvm::ImmutableList< SVal > getEmptySValList()
Definition: BasicValueFactory.h:251
clang::Type::isBlockPointerType
bool isBlockPointerType() const
Definition: Type.h:6680
clang::ento::SymbolManager::conjureSymbol
const SymbolConjured * conjureSymbol(const Stmt *E, const LocationContext *LCtx, QualType T, unsigned VisitCount, const void *SymbolTag=nullptr)
clang::ento::BasicValueFactory
Definition: BasicValueFactory.h:108
type
clang::LocationContext
It wraps the AnalysisDeclContext to represent both the call stack with the help of StackFrameContext ...
Definition: AnalysisDeclContext.h:215
SVals.h
clang::ento::nonloc::CompoundVal
Definition: SVals.h:464
clang::ast_matchers::stmt
const internal::VariadicAllOfMatcher< Stmt > stmt
Matches statements.
Definition: ASTMatchersInternal.cpp:809
clang::Type::isVoidPointerType
bool isVoidPointerType() const
Definition: Type.cpp:589
clang::ento::SVal::castAs
T castAs() const
Convert to the specified SVal type, asserting that this SVal is of the desired type.
Definition: SVals.h:103
clang::ento::SValBuilder::StateMgr
ProgramStateManager & StateMgr
Definition: SValBuilder.h:68
clang::ento::SValBuilder::getMetadataSymbolVal
DefinedSVal getMetadataSymbolVal(const void *symbolTag, const MemRegion *region, const Expr *expr, QualType type, const LocationContext *LCtx, unsigned count)
Definition: SValBuilder.cpp:221
clang::ento::SVal::isUndef
bool isUndef() const
Definition: SVals.h:140
clang::ento::NonLoc
Definition: SVals.h:305
clang::ento::SVal::getAsRegion
const MemRegion * getAsRegion() const
Definition: SVals.cpp:131
clang::ento::SValBuilder::makeLocAsInteger
NonLoc makeLocAsInteger(Loc loc, unsigned bits)
Definition: SValBuilder.h:341
AnalysisDeclContext.h
clang::ento::DefinedOrUnknownSVal
Definition: SVals.h:236
clang::ento::SymbolManager::getIntSymExpr
const IntSymExpr * getIntSymExpr(const llvm::APSInt &lhs, BinaryOperator::Opcode op, const SymExpr *rhs, QualType t)
Definition: SymbolManager.cpp:276
clang::ento::MemRegion::StripCasts
const MemRegion * StripCasts(bool StripBaseAndDerivedCasts=true) const
Definition: MemRegion.cpp:1328
clang::ASTContext::getIntWidth
unsigned getIntWidth(QualType T) const
Definition: ASTContext.cpp:10220
clang::NamedDecl
This represents a decl that may have a name.
Definition: Decl.h:249
clang::ento::SymExpr::computeComplexity
virtual unsigned computeComplexity() const =0
clang::ento::SymbolManager::getSymSymExpr
const SymSymExpr * getSymSymExpr(const SymExpr *lhs, BinaryOperator::Opcode op, const SymExpr *rhs, QualType t)
Definition: SymbolManager.cpp:294
clang::QualType
A (possibly-)qualified type.
Definition: Type.h:673
clang::TypeDecl::getTypeForDecl
const Type * getTypeForDecl() const
Definition: Decl.h:3162
clang::ento::MemRegionManager::getSymbolicHeapRegion
const SymbolicRegion * getSymbolicHeapRegion(SymbolRef sym)
Return a unique symbolic region belonging to heap memory space.
Definition: MemRegion.cpp:1161
clang::QualType::getCanonicalType
QualType getCanonicalType() const
Definition: Type.h:6463
clang::Type::isFloatingType
bool isFloatingType() const
Definition: Type.cpp:2104
clang::Qualifiers
The collection of all-type qualifiers we support.
Definition: Type.h:145
DeclCXX.h
clang::ento::SValBuilder::getDerivedRegionValueSymbolVal
DefinedOrUnknownSVal getDerivedRegionValueSymbolVal(SymbolRef parentSymbol, const TypedValueRegion *region)
Definition: SValBuilder.cpp:238
ProgramState_Fwd.h
SymbolManager.h
clang::ento::SymbolRef
const SymExpr * SymbolRef
Definition: SymExpr.h:110
clang::ento::loc::GotoLabel
Definition: SVals.h:582
clang::ento::MemRegionManager::getBlockDataRegion
const BlockDataRegion * getBlockDataRegion(const BlockCodeRegion *bc, const LocationContext *lc, unsigned blockCount)
getBlockDataRegion - Get the memory region associated with an instance of a block.
Definition: MemRegion.cpp:1073
llvm::Optional
Definition: LLVM.h:40
clang::ento::SValBuilder::makeZeroVal
DefinedOrUnknownSVal makeZeroVal(QualType type)
Construct an SVal representing '0' for the specified type.
Definition: SValBuilder.cpp:62
clang::Type::isVariableArrayType
bool isVariableArrayType() const
Definition: Type.h:6750
clang::StackFrameContext
It represents a stack frame of the call stack (based on CallEvent).
Definition: AnalysisDeclContext.h:295
clang::Type::isVoidType
bool isVoidType() const
Definition: Type.h:6955
clang::ento::nonloc::ConcreteInt
Value representing integer constant.
Definition: SVals.h:386
clang::ento::UnknownVal
Definition: SVals.h:257
clang::ento::MemRegionManager::getFunctionCodeRegion
const FunctionCodeRegion * getFunctionCodeRegion(const NamedDecl *FD)
Definition: MemRegion.cpp:1145
clang::ento::loc::MemRegionVal
Definition: SVals.h:606
clang::ento::loc::ConcreteInt
Definition: SVals.h:648
clang::ento::SValBuilder::getConjuredHeapSymbolVal
DefinedOrUnknownSVal getConjuredHeapSymbolVal(const Expr *E, const LocationContext *LCtx, unsigned Count)
Conjure a symbol representing heap allocated memory region.
clang::Expr::isGLValue
bool isGLValue() const
Definition: Expr.h:273
clang::ento::APSIntType::getMaxValue
llvm::APSInt getMaxValue() const LLVM_READONLY
Returns the maximum value for this type.
Definition: APSIntType.h:65
clang::ento::BlockCodeRegion
BlockCodeRegion - A region that represents code texts of blocks (closures).
Definition: MemRegion.h:618
clang::Type
The base class of the type hierarchy.
Definition: Type.h:1490
clang::ento::SValBuilder::haveSameType
bool haveSameType(const SymExpr *Sym1, const SymExpr *Sym2)
Definition: SValBuilder.h:106
clang::ento::SVal::getAs
Optional< T > getAs() const
Convert to the specified SVal type, returning None if this SVal is not of the desired type.
Definition: SVals.h:111
Decl.h
clang::ento::MemRegion
MemRegion - The root abstract class for all memory regions.
Definition: MemRegion.h:94
clang::ento::ConditionTruthVal
Definition: ConstraintManager.h:38
APSInt
llvm::APSInt APSInt
Definition: ByteCodeEmitter.cpp:19
clang::ento::SymbolManager::getCastSymbol
const SymbolCast * getCastSymbol(const SymExpr *Operand, QualType From, QualType To)
Definition: SymbolManager.cpp:243
clang::ento::SValBuilder::makeNonLoc
NonLoc makeNonLoc(const SymExpr *lhs, BinaryOperator::Opcode op, const llvm::APSInt &rhs, QualType type)
Definition: SValBuilder.cpp:77
SymExpr.h
clang::Type::isReferenceType
bool isReferenceType() const
Definition: Type.h:6684
V
#define V(N, I)
Definition: ASTContext.h:3121
clang::ast_matchers::expr
const internal::VariadicDynCastAllOfMatcher< Stmt, Expr > expr
Matches expressions.
Definition: ASTMatchersInternal.cpp:889
clang::ento::DefinedSVal
Definition: SVals.h:269
clang::ento::MemRegion::getSymbolicBase
const SymbolicRegion * getSymbolicBase() const
If this is a symbolic region, returns the region.
Definition: MemRegion.cpp:1351
clang::CXXBoolLiteralExpr::getValue
bool getValue() const
Definition: ExprCXX.h:733
clang::ento::SValBuilder::AnOpts
const AnalyzerOptions & AnOpts
Definition: SValBuilder.h:70
clang::ento::SymbolManager::getDerivedSymbol
const SymbolDerived * getDerivedSymbol(SymbolRef parentSymbol, const TypedValueRegion *R)
Definition: SymbolManager.cpp:192
clang::ento::SymExpr::getType
virtual QualType getType() const =0
clang::BlockDecl
Represents a block literal declaration, which is like an unnamed FunctionDecl.
Definition: Decl.h:4153
clang::LocationContext::getAnalysisDeclContext
AnalysisDeclContext * getAnalysisDeclContext() const
Definition: AnalysisDeclContext.h:241
clang::ento::SValBuilder::getRegionValueSymbolVal
DefinedOrUnknownSVal getRegionValueSymbolVal(const TypedValueRegion *region)
Make a unique symbol for value of region.
Definition: SValBuilder.cpp:128
clang::ento::SValBuilder::getContext
ASTContext & getContext()
Definition: SValBuilder.h:168
clang::Type::isNullPtrType
bool isNullPtrType() const
Definition: Type.h:6980
clang::ento::SValBuilder::Context
ASTContext & Context
Definition: SValBuilder.h:57
clang::ento::MemRegionManager::getBlockCodeRegion
const BlockCodeRegion * getBlockCodeRegion(const BlockDecl *BD, CanQualType locTy, AnalysisDeclContext *AC)
Definition: MemRegion.cpp:1151
clang::Type::isFunctionPointerType
bool isFunctionPointerType() const
Definition: Type.h:6706
clang::ento::ProgramStateManager::ArrayToPointer
SVal ArrayToPointer(Loc Array, QualType ElementTy)
Definition: ProgramState.h:550
clang::ASTContext
Holds long-lived AST nodes (such as types and decls) that can be referred to throughout the semantic ...
Definition: ASTContext.h:212
clang::ento::SValBuilder::getCXXThis
loc::MemRegionVal getCXXThis(const CXXMethodDecl *D, const StackFrameContext *SFC)
Return a memory region for the 'this' object reference.
Definition: SValBuilder.cpp:295
clang::ento::SymExpr
Symbolic value.
Definition: SymExpr.h:29
clang::ento::SValBuilder::SValBuilder
SValBuilder(llvm::BumpPtrAllocator &alloc, ASTContext &context, ProgramStateManager &stateMgr)
Definition: SValBuilder.cpp:52
Store.h
clang::ento::SValBuilder::convertToArrayIndex
SVal convertToArrayIndex(SVal val)
Definition: SValBuilder.cpp:109
clang::ento::SValBuilder::getRegionManager
MemRegionManager & getRegionManager()
Definition: SValBuilder.h:187
clang::ento::nonloc::PointerToMember
Value representing pointer-to-member.
Definition: SVals.h:532
clang::Expr::NPC_ValueDependentIsNotNull
@ NPC_ValueDependentIsNotNull
Specifies that a value-dependent expression should be considered to never be a null pointer constant.
Definition: Expr.h:784
clang::ento::BlockDataRegion
BlockDataRegion - A region that represents a block instance.
Definition: MemRegion.h:663
clang::Type::isFunctionType
bool isFunctionType() const
Definition: Type.h:6668
Type.h
clang::ASTContext::UnwrapSimilarTypes
bool UnwrapSimilarTypes(QualType &T1, QualType &T2, bool AllowPiMismatch=true)
Attempt to unwrap two types that may be similar (C++ [conv.qual]).
Definition: ASTContext.cpp:5908
clang::ento::SValBuilder::getConstantVal
Optional< SVal > getConstantVal(const Expr *E)
Returns the value of E, if it can be determined in a non-path-sensitive manner.
Definition: SValBuilder.cpp:309
clang::Expr::EvalResult
EvalResult is a struct with detailed info about an evaluated expression.
Definition: Expr.h:606
ASTContext.h
clang::ento::SValBuilder::getBasicValueFactory
BasicValueFactory & getBasicValueFactory()
Definition: SValBuilder.h:181
clang::Type::getPointeeType
QualType getPointeeType() const
If this is a pointer, ObjC object pointer, or block pointer, this returns the respective pointee.
Definition: Type.cpp:625
clang::ASTContext::getCanonicalType
CanQualType getCanonicalType(QualType T) const
Return the canonical (structural) type corresponding to the specified potentially non-canonical type ...
Definition: ASTContext.h:2468
hasSameUnqualifiedPointeeType
static bool hasSameUnqualifiedPointeeType(QualType ty1, QualType ty2)
Definition: SValBuilder.cpp:711
ExprObjC.h
clang::ento::SValBuilder::evalBinOpLN
virtual SVal evalBinOpLN(ProgramStateRef state, BinaryOperator::Opcode op, Loc lhs, NonLoc rhs, QualType resultTy)=0
Create a new value which represents a binary expression with a memory location and non-location opera...
clang::CanQual< Type >
ExprCXX.h
BasicValueFactory.h
clang::ento::nonloc::LazyCompoundVal
Definition: SVals.h:493
clang::prec::PointerToMember
@ PointerToMember
Definition: OperatorPrecedence.h:42
clang::ento::SymbolicRegion
SymbolicRegion - A special, "non-concrete" region.
Definition: MemRegion.h:754
clang::ento::APSIntType
A record of the "type" of an APSInt, used for conversions.
Definition: APSIntType.h:19
state
and static some checkers Checker The latter are built on top of the former via the Checker and CheckerVisitor and attempts to isolate them from much of the gore of the internal analysis the analyzer is basically a source code simulator that traces out possible paths of execution The state of the and the combination of state and program point is a node in an exploded which has the entry program point and initial state
Definition: README.txt:30
clang::ento::Loc
Definition: SVals.h:327
clang::ento::SValBuilder::getCastedMemRegionVal
Optional< loc::MemRegionVal > getCastedMemRegionVal(const MemRegion *region, QualType type)
Return MemRegionVal on success cast, otherwise return None.
Definition: SValBuilder.cpp:288
clang::ento::SValBuilder::makeSymExprValNN
SVal makeSymExprValNN(BinaryOperator::Opcode op, NonLoc lhs, NonLoc rhs, QualType resultTy)
Constructs a symbolic expression for two non-location values.
Definition: SValBuilder.cpp:409
clang::ento::SymbolManager::getMetadataSymbol
const SymbolMetadata * getMetadataSymbol(const MemRegion *R, const Stmt *S, QualType T, const LocationContext *LCtx, unsigned VisitCount, const void *SymbolTag=nullptr)
Creates a metadata symbol associated with a specific region.
Definition: SymbolManager.cpp:225
clang::CXXRecordDecl
Represents a C++ struct/union/class.
Definition: DeclCXX.h:255
clang::ento::SValBuilder::makeCompoundVal
NonLoc makeCompoundVal(QualType type, llvm::ImmutableList< SVal > vals)
Definition: SValBuilder.h:273
clang::Type::isMemberPointerType
bool isMemberPointerType() const
Definition: Type.h:6720
clang::ento::SymbolManager::getSymIntExpr
const SymIntExpr * getSymIntExpr(const SymExpr *lhs, BinaryOperator::Opcode op, const llvm::APSInt &rhs, QualType t)
clang::ento::SymbolManager::getRegionValueSymbol
const SymbolRegionValue * getRegionValueSymbol(const TypedValueRegion *R)
Make a unique symbol for MemRegion R according to its kind.
Definition: SymbolManager.cpp:157
clang::ento::MemRegionManager::getSymbolicRegion
const SymbolicRegion * getSymbolicRegion(SymbolRef Sym)
Retrieve or create a "symbolic" memory region.
Definition: MemRegion.cpp:1157
clang::Stmt::getStmtClass
StmtClass getStmtClass() const
Definition: Stmt.h:1163
clang::Type::isPointerType
bool isPointerType() const
Definition: Type.h:6672
shouldBeModeledWithNoOp
static bool shouldBeModeledWithNoOp(ASTContext &Context, QualType ToTy, QualType FromTy)
Recursively check if the pointer types are equal modulo const, volatile, and restrict qualifiers.
Definition: SValBuilder.cpp:494
clang::ento::ProgramStateManager
Definition: ProgramState.h:463
clang::ento::SValBuilder::evalCast
SVal evalCast(SVal V, QualType CastTy, QualType OriginalTy)
Cast a given SVal to another SVal using given QualType's.
Definition: SValBuilder.cpp:579
SValBuilder.h
clang::ASTContext::getUnqualifiedArrayType
QualType getUnqualifiedArrayType(QualType T, Qualifiers &Quals)
Return this type as a completely-unqualified array type, capturing the qualifiers in Quals.
Definition: ASTContext.cpp:5795
clang::ento::SValBuilder::makeNull
Loc makeNull()
Definition: SValBuilder.h:372
clang::ento::APSIntType::apply
void apply(llvm::APSInt &Value) const
Convert a given APSInt, in place, to match this type.
Definition: APSIntType.h:37
clang::ento::SValBuilder::evalBinOpNN
virtual SVal evalBinOpNN(ProgramStateRef state, BinaryOperator::Opcode op, NonLoc lhs, NonLoc rhs, QualType resultTy)=0
Create a new value which represents a binary expression with two non- location operands.
clang::QualType::isNull
bool isNull() const
Return true if this QualType doesn't point to a type yet.
Definition: Type.h:738
Value
Value
Definition: UninitializedValues.cpp:102
clang::ento::FunctionCodeRegion
FunctionCodeRegion - A region that represents code texts of function.
Definition: MemRegion.h:571
clang::ento::SValBuilder::makeIntVal
nonloc::ConcreteInt makeIntVal(const IntegerLiteral *integer)
Definition: SValBuilder.h:301
clang::ento::SValBuilder::makeIntLocVal
loc::ConcreteInt makeIntLocVal(const llvm::APSInt &integer)
Definition: SValBuilder.h:317
LLVM.h
APSIntType.h
clang::ento::SValBuilder::getFunctionPointer
DefinedSVal getFunctionPointer(const FunctionDecl *func)
Definition: SValBuilder.cpp:272
clang::ento::StoreManager::castRegion
Optional< const MemRegion * > castRegion(const MemRegion *region, QualType CastToTy)
castRegion - Used by ExprEngine::VisitCast to handle casts from a MemRegion* to a specific location t...
Definition: Store.cpp:74
clang::BinaryOperatorKind
BinaryOperatorKind
Definition: OperationKinds.h:25
clang::Expr::EvaluateAsInt
bool EvaluateAsInt(EvalResult &Result, const ASTContext &Ctx, SideEffectsKind AllowSideEffects=SE_NoSideEffects, bool InConstantContext=false) const
EvaluateAsInt - Return true if this is a constant which we can fold and convert to an integer,...
Definition: ExprConstant.cpp:14735
clang::Expr::isNullPointerConstant
NullPointerConstantKind isNullPointerConstant(ASTContext &Ctx, NullPointerConstantValueDependence NPC) const
isNullPointerConstant - C99 6.3.2.3p3 - Test if this reduces down to a Null pointer constant.
Definition: Expr.cpp:3741
clang::ento::SValBuilder::getBlockPointer
DefinedSVal getBlockPointer(const BlockDecl *block, CanQualType locTy, const LocationContext *locContext, unsigned blockCount)
Definition: SValBuilder.cpp:276
clang::Type::isBooleanType
bool isBooleanType() const
Definition: Type.h:7071
clang::ento::SValBuilder::ArrayIndexWidth
const unsigned ArrayIndexWidth
The width of the scalar type used for array indices.
Definition: SValBuilder.h:76
ProgramState.h
clang::ento::ProgramStateManager::getStoreManager
StoreManager & getStoreManager()
Definition: ProgramState.h:539
clang::ento::nonloc::SymbolVal
Represents symbolic expression that isn't a location.
Definition: SVals.h:356
clang::ento::SValBuilder::makeTruthVal
nonloc::ConcreteInt makeTruthVal(bool b, QualType type)
Definition: SValBuilder.h:357
ExprEngine.h
clang::ento::SValBuilder::areEqual
ConditionTruthVal areEqual(ProgramStateRef state, SVal lhs, SVal rhs)
Definition: SValBuilder.cpp:475
clang::ento::TypedValueRegion::getValueType
virtual QualType getValueType() const =0
clang::ento::nonloc::LocAsInteger
Definition: SVals.h:417
clang::Expr::IgnoreParens
Expr * IgnoreParens() LLVM_READONLY
Skip past any parentheses which might surround this expression until reaching a fixed point.
Definition: Expr.cpp:2915
clang
Definition: CalledOnceCheck.h:17
clang::ento::SVal::isUnknownOrUndef
bool isUnknownOrUndef() const
Definition: SVals.h:144
clang::Stmt
Stmt - This represents one statement.
Definition: Stmt.h:69
clang::ento::SValBuilder::evalIntegralCast
SVal evalIntegralCast(ProgramStateRef state, SVal val, QualType castTy, QualType originalType)
Definition: SValBuilder.cpp:527
clang::ento::SValBuilder::BasicVals
BasicValueFactory BasicVals
Manager of APSInt values.
Definition: SValBuilder.h:60
clang::ento::SValBuilder::evalCastSubKind
SVal evalCastSubKind(loc::ConcreteInt V, QualType CastTy, QualType OriginalTy)
Definition: SValBuilder.cpp:661
clang::ento::SVal::isUnknown
bool isUnknown() const
Definition: SVals.h:136
MemRegion.h
clang::ento::SymbolManager::getExtentSymbol
const SymbolExtent * getExtentSymbol(const SubRegion *R)
Definition: SymbolManager.cpp:209
clang::Expr::getType
QualType getType() const
Definition: Expr.h:141
clang::ento::SValBuilder::makeBoolVal
nonloc::ConcreteInt makeBoolVal(const ObjCBoolLiteralExpr *boolean)
Definition: SValBuilder.h:307
clang::ento::SValBuilder::evalCastKind
SVal evalCastKind(UndefinedVal V, QualType CastTy, QualType OriginalTy)
Definition: SValBuilder.cpp:616
clang::ento::SValBuilder::SymMgr
SymbolManager SymMgr
Manages the creation of symbols.
Definition: SValBuilder.h:63
clang::ento::SValBuilder::ArrayIndexTy
const QualType ArrayIndexTy
The scalar type to use for array indices.
Definition: SValBuilder.h:73
clang::Qualifiers::removeCVRQualifiers
void removeCVRQualifiers(unsigned mask)
Definition: Type.h:285
clang::QualType::getTypePtr
const Type * getTypePtr() const
Retrieves a pointer to the underlying (unqualified) type.
Definition: Type.h:6424
clang::ASTContext::getPointerType
QualType getPointerType(QualType T) const
Return the uniqued reference to the type for a pointer to the specified type.
Definition: ASTContext.cpp:3249
clang::ento::SVal
SVal - This represents a symbolic expression, which can be either an L-value or an R-value.
Definition: SVals.h:75
Stmt.h
clang::ento::TypedValueRegion
TypedValueRegion - An abstract class representing regions having a typed value.
Definition: MemRegion.h:522
clang::ento::SValBuilder::evalEQ
SVal evalEQ(ProgramStateRef state, SVal lhs, SVal rhs)
Definition: SValBuilder.cpp:480
clang::Expr
This represents one expression.
Definition: Expr.h:109
clang::ento::SVal::getAsSymbol
SymbolRef getAsSymbol(bool IncludeBaseRegions=false) const
If this SVal wraps a symbol return that SymbolRef.
Definition: SVals.cpp:123
clang::ento::SValBuilder::conjureSymbolVal
DefinedOrUnknownSVal conjureSymbolVal(const void *symbolTag, const Expr *expr, const LocationContext *LCtx, unsigned count)
Create a new symbol with a unique 'name'.
clang::Type::isUnsignedIntegerType
bool isUnsignedIntegerType() const
Return true if this is an integer type that is unsigned, according to C99 6.2.5p6 [which returns true...
Definition: Type.cpp:2060
clang::ento::SValBuilder::getConditionType
QualType getConditionType() const
Definition: SValBuilder.h:173
clang::ento::SValBuilder::getMemberPointer
DefinedSVal getMemberPointer(const NamedDecl *ND)
Definition: SValBuilder.cpp:256
AnalysisManager.h
clang::FunctionDecl
Represents a function declaration or definition.
Definition: Decl.h:1856
clang::ento::SValBuilder::evalBinOpLL
virtual SVal evalBinOpLL(ProgramStateRef state, BinaryOperator::Opcode op, Loc lhs, Loc rhs, QualType resultTy)=0
Create a new value which represents a binary expression with two memory location operands.
clang::ento::BasicValueFactory::getAPSIntType
APSIntType getAPSIntType(QualType T) const
Returns the type of the APSInt used to store values of the given QualType.
Definition: BasicValueFactory.h:143
clang::ento::BasicValueFactory::getZeroWithTypeSize
const llvm::APSInt & getZeroWithTypeSize(QualType T)
Definition: BasicValueFactory.h:219
llvm::IntrusiveRefCntPtr< const ProgramState >
clang::Type::isIntegralOrEnumerationType
bool isIntegralOrEnumerationType() const
Determine whether this type is an integral or enumeration type.
Definition: Type.h:7058
clang::ento::SymbolManager::canSymbolicate
static bool canSymbolicate(QualType T)
Definition: SymbolManager.cpp:333
clang::ento::SValBuilder::makeLoc
Loc makeLoc(SymbolRef sym)
Definition: SValBuilder.h:376
clang::CXXMethodDecl
Represents a static or instance method of a struct/union/class.
Definition: DeclCXX.h:1948
clang::ento::SValBuilder::MemMgr
MemRegionManager MemMgr
Manages the creation of memory regions.
Definition: SValBuilder.h:66