clang  15.0.0git
SValBuilder.cpp
Go to the documentation of this file.
1 //===- SValBuilder.cpp - Basic class for all SValBuilder implementations --===//
2 //
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6 //
7 //===----------------------------------------------------------------------===//
8 //
9 // This file defines SValBuilder, the base class for all (complete) SValBuilder
10 // implementations.
11 //
12 //===----------------------------------------------------------------------===//
13 
15 #include "clang/AST/ASTContext.h"
16 #include "clang/AST/Decl.h"
17 #include "clang/AST/DeclCXX.h"
18 #include "clang/AST/ExprCXX.h"
19 #include "clang/AST/ExprObjC.h"
20 #include "clang/AST/Stmt.h"
21 #include "clang/AST/Type.h"
22 #include "clang/Basic/LLVM.h"
35 #include "llvm/ADT/APSInt.h"
36 #include "llvm/ADT/None.h"
37 #include "llvm/ADT/Optional.h"
38 #include "llvm/Support/Casting.h"
39 #include "llvm/Support/Compiler.h"
40 #include <cassert>
41 #include <tuple>
42 
43 using namespace clang;
44 using namespace ento;
45 
46 //===----------------------------------------------------------------------===//
47 // Basic SVal creation.
48 //===----------------------------------------------------------------------===//
49 
50 void SValBuilder::anchor() {}
51 
52 SValBuilder::SValBuilder(llvm::BumpPtrAllocator &alloc, ASTContext &context,
53  ProgramStateManager &stateMgr)
54  : Context(context), BasicVals(context, alloc),
55  SymMgr(context, BasicVals, alloc), MemMgr(context, alloc),
56  StateMgr(stateMgr),
57  AnOpts(
58  stateMgr.getOwningEngine().getAnalysisManager().getAnalyzerOptions()),
59  ArrayIndexTy(context.LongLongTy),
60  ArrayIndexWidth(context.getTypeSize(ArrayIndexTy)) {}
61 
63  if (Loc::isLocType(type))
64  return makeNullWithType(type);
65 
66  if (type->isIntegralOrEnumerationType())
67  return makeIntVal(0, type);
68 
69  if (type->isArrayType() || type->isRecordType() || type->isVectorType() ||
70  type->isAnyComplexType())
72 
73  // FIXME: Handle floats.
74  return UnknownVal();
75 }
76 
79  const llvm::APSInt &rhs,
80  QualType type) {
81  // The Environment ensures we always get a persistent APSInt in
82  // BasicValueFactory, so we don't need to get the APSInt from
83  // BasicValueFactory again.
84  assert(lhs);
85  assert(!Loc::isLocType(type));
86  return nonloc::SymbolVal(SymMgr.getSymIntExpr(lhs, op, rhs, type));
87 }
88 
91  const SymExpr *rhs, QualType type) {
92  assert(rhs);
93  assert(!Loc::isLocType(type));
94  return nonloc::SymbolVal(SymMgr.getIntSymExpr(lhs, op, rhs, type));
95 }
96 
99  const SymExpr *rhs, QualType type) {
100  assert(lhs && rhs);
101  assert(!Loc::isLocType(type));
102  return nonloc::SymbolVal(SymMgr.getSymSymExpr(lhs, op, rhs, type));
103 }
104 
106  QualType fromTy, QualType toTy) {
107  assert(operand);
108  assert(!Loc::isLocType(toTy));
109  return nonloc::SymbolVal(SymMgr.getCastSymbol(operand, fromTy, toTy));
110 }
111 
113  if (val.isUnknownOrUndef())
114  return val;
115 
116  // Common case: we have an appropriately sized integer.
118  const llvm::APSInt& I = CI->getValue();
119  if (I.getBitWidth() == ArrayIndexWidth && I.isSigned())
120  return val;
121  }
122 
123  return evalCast(val, ArrayIndexTy, QualType{});
124 }
125 
127  return makeTruthVal(boolean->getValue());
128 }
129 
132  QualType T = region->getValueType();
133 
134  if (T->isNullPtrType())
135  return makeZeroVal(T);
136 
138  return UnknownVal();
139 
140  SymbolRef sym = SymMgr.getRegionValueSymbol(region);
141 
142  if (Loc::isLocType(T))
144 
145  return nonloc::SymbolVal(sym);
146 }
147 
149  const Expr *Ex,
150  const LocationContext *LCtx,
151  unsigned Count) {
152  QualType T = Ex->getType();
153 
154  if (T->isNullPtrType())
155  return makeZeroVal(T);
156 
157  // Compute the type of the result. If the expression is not an R-value, the
158  // result should be a location.
159  QualType ExType = Ex->getType();
160  if (Ex->isGLValue())
161  T = LCtx->getAnalysisDeclContext()->getASTContext().getPointerType(ExType);
162 
163  return conjureSymbolVal(SymbolTag, Ex, LCtx, T, Count);
164 }
165 
167  const Expr *expr,
168  const LocationContext *LCtx,
169  QualType type,
170  unsigned count) {
171  if (type->isNullPtrType())
172  return makeZeroVal(type);
173 
175  return UnknownVal();
176 
177  SymbolRef sym = SymMgr.conjureSymbol(expr, LCtx, type, count, symbolTag);
178 
179  if (Loc::isLocType(type))
181 
182  return nonloc::SymbolVal(sym);
183 }
184 
186  const LocationContext *LCtx,
187  QualType type,
188  unsigned visitCount) {
189  if (type->isNullPtrType())
190  return makeZeroVal(type);
191 
193  return UnknownVal();
194 
195  SymbolRef sym = SymMgr.conjureSymbol(stmt, LCtx, type, visitCount);
196 
197  if (Loc::isLocType(type))
199 
200  return nonloc::SymbolVal(sym);
201 }
202 
205  const LocationContext *LCtx,
206  unsigned VisitCount) {
207  QualType T = E->getType();
208  return getConjuredHeapSymbolVal(E, LCtx, T, VisitCount);
209 }
210 
211 DefinedOrUnknownSVal
213  const LocationContext *LCtx,
214  QualType type, unsigned VisitCount) {
215  assert(Loc::isLocType(type));
217  if (type->isNullPtrType())
218  return makeZeroVal(type);
219 
220  SymbolRef sym = SymMgr.conjureSymbol(E, LCtx, type, VisitCount);
221  return loc::MemRegionVal(MemMgr.getSymbolicHeapRegion(sym));
222 }
223 
225  const MemRegion *region,
226  const Expr *expr, QualType type,
227  const LocationContext *LCtx,
228  unsigned count) {
229  assert(SymbolManager::canSymbolicate(type) && "Invalid metadata symbol type");
230 
231  SymbolRef sym =
232  SymMgr.getMetadataSymbol(region, expr, type, LCtx, count, symbolTag);
233 
234  if (Loc::isLocType(type))
236 
237  return nonloc::SymbolVal(sym);
238 }
239 
242  const TypedValueRegion *region) {
243  QualType T = region->getValueType();
244 
245  if (T->isNullPtrType())
246  return makeZeroVal(T);
247 
249  return UnknownVal();
250 
251  SymbolRef sym = SymMgr.getDerivedSymbol(parentSymbol, region);
252 
253  if (Loc::isLocType(T))
255 
256  return nonloc::SymbolVal(sym);
257 }
258 
260  assert(!ND || (isa<CXXMethodDecl, FieldDecl, IndirectFieldDecl>(ND)));
261 
262  if (const auto *MD = dyn_cast_or_null<CXXMethodDecl>(ND)) {
263  // Sema treats pointers to static member functions as have function pointer
264  // type, so return a function pointer for the method.
265  // We don't need to play a similar trick for static member fields
266  // because these are represented as plain VarDecls and not FieldDecls
267  // in the AST.
268  if (MD->isStatic())
269  return getFunctionPointer(MD);
270  }
271 
272  return nonloc::PointerToMember(ND);
273 }
274 
277 }
278 
280  CanQualType locTy,
281  const LocationContext *locContext,
282  unsigned blockCount) {
283  const BlockCodeRegion *BC =
284  MemMgr.getBlockCodeRegion(block, locTy, locContext->getAnalysisDeclContext());
285  const BlockDataRegion *BD = MemMgr.getBlockDataRegion(BC, locContext,
286  blockCount);
287  return loc::MemRegionVal(BD);
288 }
289 
292  if (auto OptR = StateMgr.getStoreManager().castRegion(R, Ty))
293  return loc::MemRegionVal(*OptR);
294  return None;
295 }
296 
297 /// Return a memory region for the 'this' object reference.
299  const StackFrameContext *SFC) {
300  return loc::MemRegionVal(
301  getRegionManager().getCXXThisRegion(D->getThisType(), SFC));
302 }
303 
304 /// Return a memory region for the 'this' object reference.
306  const StackFrameContext *SFC) {
307  const Type *T = D->getTypeForDecl();
309  return loc::MemRegionVal(getRegionManager().getCXXThisRegion(PT, SFC));
310 }
311 
313  E = E->IgnoreParens();
314 
315  switch (E->getStmtClass()) {
316  // Handle expressions that we treat differently from the AST's constant
317  // evaluator.
318  case Stmt::AddrLabelExprClass:
319  return makeLoc(cast<AddrLabelExpr>(E));
320 
321  case Stmt::CXXScalarValueInitExprClass:
322  case Stmt::ImplicitValueInitExprClass:
323  return makeZeroVal(E->getType());
324 
325  case Stmt::ObjCStringLiteralClass: {
326  const auto *SL = cast<ObjCStringLiteral>(E);
327  return makeLoc(getRegionManager().getObjCStringRegion(SL));
328  }
329 
330  case Stmt::StringLiteralClass: {
331  const auto *SL = cast<StringLiteral>(E);
332  return makeLoc(getRegionManager().getStringRegion(SL));
333  }
334 
335  case Stmt::PredefinedExprClass: {
336  const auto *PE = cast<PredefinedExpr>(E);
337  assert(PE->getFunctionName() &&
338  "Since we analyze only instantiated functions, PredefinedExpr "
339  "should have a function name.");
340  return makeLoc(getRegionManager().getStringRegion(PE->getFunctionName()));
341  }
342 
343  // Fast-path some expressions to avoid the overhead of going through the AST's
344  // constant evaluator
345  case Stmt::CharacterLiteralClass: {
346  const auto *C = cast<CharacterLiteral>(E);
347  return makeIntVal(C->getValue(), C->getType());
348  }
349 
350  case Stmt::CXXBoolLiteralExprClass:
351  return makeBoolVal(cast<CXXBoolLiteralExpr>(E));
352 
353  case Stmt::TypeTraitExprClass: {
354  const auto *TE = cast<TypeTraitExpr>(E);
355  return makeTruthVal(TE->getValue(), TE->getType());
356  }
357 
358  case Stmt::IntegerLiteralClass:
359  return makeIntVal(cast<IntegerLiteral>(E));
360 
361  case Stmt::ObjCBoolLiteralExprClass:
362  return makeBoolVal(cast<ObjCBoolLiteralExpr>(E));
363 
364  case Stmt::CXXNullPtrLiteralExprClass:
365  return makeNullWithType(E->getType());
366 
367  case Stmt::CStyleCastExprClass:
368  case Stmt::CXXFunctionalCastExprClass:
369  case Stmt::CXXConstCastExprClass:
370  case Stmt::CXXReinterpretCastExprClass:
371  case Stmt::CXXStaticCastExprClass:
372  case Stmt::ImplicitCastExprClass: {
373  const auto *CE = cast<CastExpr>(E);
374  switch (CE->getCastKind()) {
375  default:
376  break;
377  case CK_ArrayToPointerDecay:
378  case CK_IntegralToPointer:
379  case CK_NoOp:
380  case CK_BitCast: {
381  const Expr *SE = CE->getSubExpr();
382  Optional<SVal> Val = getConstantVal(SE);
383  if (!Val)
384  return None;
385  return evalCast(*Val, CE->getType(), SE->getType());
386  }
387  }
388  // FALLTHROUGH
389  LLVM_FALLTHROUGH;
390  }
391 
392  // If we don't have a special case, fall back to the AST's constant evaluator.
393  default: {
394  // Don't try to come up with a value for materialized temporaries.
395  if (E->isGLValue())
396  return None;
397 
398  ASTContext &Ctx = getContext();
399  Expr::EvalResult Result;
400  if (E->EvaluateAsInt(Result, Ctx))
401  return makeIntVal(Result.Val.getInt());
402 
403  if (Loc::isLocType(E->getType()))
405  return makeNullWithType(E->getType());
406 
407  return None;
408  }
409  }
410 }
411 
413  NonLoc LHS, NonLoc RHS,
414  QualType ResultTy) {
415  SymbolRef symLHS = LHS.getAsSymbol();
416  SymbolRef symRHS = RHS.getAsSymbol();
417 
418  // TODO: When the Max Complexity is reached, we should conjure a symbol
419  // instead of generating an Unknown value and propagate the taint info to it.
420  const unsigned MaxComp = AnOpts.MaxSymbolComplexity;
421 
422  if (symLHS && symRHS &&
423  (symLHS->computeComplexity() + symRHS->computeComplexity()) < MaxComp)
424  return makeNonLoc(symLHS, Op, symRHS, ResultTy);
425 
426  if (symLHS && symLHS->computeComplexity() < MaxComp)
428  return makeNonLoc(symLHS, Op, rInt->getValue(), ResultTy);
429 
430  if (symRHS && symRHS->computeComplexity() < MaxComp)
432  return makeNonLoc(lInt->getValue(), Op, symRHS, ResultTy);
433 
434  return UnknownVal();
435 }
436 
438  SVal lhs, SVal rhs, QualType type) {
439  if (lhs.isUndef() || rhs.isUndef())
440  return UndefinedVal();
441 
442  if (lhs.isUnknown() || rhs.isUnknown())
443  return UnknownVal();
444 
445  if (lhs.getAs<nonloc::LazyCompoundVal>() ||
447  return UnknownVal();
448  }
449 
450  if (op == BinaryOperatorKind::BO_Cmp) {
451  // We can't reason about C++20 spaceship operator yet.
452  //
453  // FIXME: Support C++20 spaceship operator.
454  // The main problem here is that the result is not integer.
455  return UnknownVal();
456  }
457 
458  if (Optional<Loc> LV = lhs.getAs<Loc>()) {
459  if (Optional<Loc> RV = rhs.getAs<Loc>())
460  return evalBinOpLL(state, op, *LV, *RV, type);
461 
462  return evalBinOpLN(state, op, *LV, rhs.castAs<NonLoc>(), type);
463  }
464 
465  if (const Optional<Loc> RV = rhs.getAs<Loc>()) {
466  const auto IsCommutative = [](BinaryOperatorKind Op) {
467  return Op == BO_Mul || Op == BO_Add || Op == BO_And || Op == BO_Xor ||
468  Op == BO_Or;
469  };
470 
471  if (IsCommutative(op)) {
472  // Swap operands.
473  return evalBinOpLN(state, op, *RV, lhs.castAs<NonLoc>(), type);
474  }
475 
476  // If the right operand is a concrete int location then we have nothing
477  // better but to treat it as a simple nonloc.
478  if (auto RV = rhs.getAs<loc::ConcreteInt>()) {
479  const nonloc::ConcreteInt RhsAsLoc = makeIntVal(RV->getValue());
480  return evalBinOpNN(state, op, lhs.castAs<NonLoc>(), RhsAsLoc, type);
481  }
482  }
483 
484  return evalBinOpNN(state, op, lhs.castAs<NonLoc>(), rhs.castAs<NonLoc>(),
485  type);
486 }
487 
489  SVal rhs) {
490  return state->isNonNull(evalEQ(state, lhs, rhs));
491 }
492 
494  return evalBinOp(state, BO_EQ, lhs, rhs, getConditionType());
495 }
496 
499  DefinedOrUnknownSVal rhs) {
500  return evalEQ(state, static_cast<SVal>(lhs), static_cast<SVal>(rhs))
502 }
503 
504 /// Recursively check if the pointer types are equal modulo const, volatile,
505 /// and restrict qualifiers. Also, assume that all types are similar to 'void'.
506 /// Assumes the input types are canonical.
507 static bool shouldBeModeledWithNoOp(ASTContext &Context, QualType ToTy,
508  QualType FromTy) {
509  while (Context.UnwrapSimilarTypes(ToTy, FromTy)) {
510  Qualifiers Quals1, Quals2;
511  ToTy = Context.getUnqualifiedArrayType(ToTy, Quals1);
512  FromTy = Context.getUnqualifiedArrayType(FromTy, Quals2);
513 
514  // Make sure that non-cvr-qualifiers the other qualifiers (e.g., address
515  // spaces) are identical.
516  Quals1.removeCVRQualifiers();
517  Quals2.removeCVRQualifiers();
518  if (Quals1 != Quals2)
519  return false;
520  }
521 
522  // If we are casting to void, the 'From' value can be used to represent the
523  // 'To' value.
524  //
525  // FIXME: Doing this after unwrapping the types doesn't make any sense. A
526  // cast from 'int**' to 'void**' is not special in the way that a cast from
527  // 'int*' to 'void*' is.
528  if (ToTy->isVoidType())
529  return true;
530 
531  if (ToTy != FromTy)
532  return false;
533 
534  return true;
535 }
536 
537 // Handles casts of type CK_IntegralCast.
538 // At the moment, this function will redirect to evalCast, except when the range
539 // of the original value is known to be greater than the max of the target type.
541  QualType castTy, QualType originalTy) {
542  // No truncations if target type is big enough.
543  if (getContext().getTypeSize(castTy) >= getContext().getTypeSize(originalTy))
544  return evalCast(val, castTy, originalTy);
545 
546  SymbolRef se = val.getAsSymbol();
547  if (!se) // Let evalCast handle non symbolic expressions.
548  return evalCast(val, castTy, originalTy);
549 
550  // Find the maximum value of the target type.
551  APSIntType ToType(getContext().getTypeSize(castTy),
552  castTy->isUnsignedIntegerType());
553  llvm::APSInt ToTypeMax = ToType.getMaxValue();
554  NonLoc ToTypeMaxVal =
555  makeIntVal(ToTypeMax.isUnsigned() ? ToTypeMax.getZExtValue()
556  : ToTypeMax.getSExtValue(),
557  castTy)
558  .castAs<NonLoc>();
559  // Check the range of the symbol being casted against the maximum value of the
560  // target type.
561  NonLoc FromVal = val.castAs<NonLoc>();
562  QualType CmpTy = getConditionType();
563  NonLoc CompVal =
564  evalBinOpNN(state, BO_LE, FromVal, ToTypeMaxVal, CmpTy).castAs<NonLoc>();
565  ProgramStateRef IsNotTruncated, IsTruncated;
566  std::tie(IsNotTruncated, IsTruncated) = state->assume(CompVal);
567  if (!IsNotTruncated && IsTruncated) {
568  // Symbol is truncated so we evaluate it as a cast.
569  return makeNonLoc(se, originalTy, castTy);
570  }
571  return evalCast(val, castTy, originalTy);
572 }
573 
574 //===----------------------------------------------------------------------===//
575 // Cast methods.
576 // `evalCast` is the main method
577 // `evalCastKind` and `evalCastSubKind` are helpers
578 //===----------------------------------------------------------------------===//
579 
580 /// Cast a given SVal to another SVal using given QualType's.
581 /// \param V -- SVal that should be casted.
582 /// \param CastTy -- QualType that V should be casted according to.
583 /// \param OriginalTy -- QualType which is associated to V. It provides
584 /// additional information about what type the cast performs from.
585 /// \returns the most appropriate casted SVal.
586 /// Note: Many cases don't use an exact OriginalTy. It can be extracted
587 /// from SVal or the cast can performs unconditionaly. Always pass OriginalTy!
588 /// It can be crucial in certain cases and generates different results.
589 /// FIXME: If `OriginalTy.isNull()` is true, then cast performs based on CastTy
590 /// only. This behavior is uncertain and should be improved.
592  if (CastTy.isNull())
593  return V;
594 
595  CastTy = Context.getCanonicalType(CastTy);
596 
597  const bool IsUnknownOriginalType = OriginalTy.isNull();
598  if (!IsUnknownOriginalType) {
599  OriginalTy = Context.getCanonicalType(OriginalTy);
600 
601  if (CastTy == OriginalTy)
602  return V;
603 
604  // FIXME: Move this check to the most appropriate
605  // evalCastKind/evalCastSubKind function. For const casts, casts to void,
606  // just propagate the value.
607  if (!CastTy->isVariableArrayType() && !OriginalTy->isVariableArrayType())
609  Context.getPointerType(OriginalTy)))
610  return V;
611  }
612 
613  // Cast SVal according to kinds.
614  switch (V.getBaseKind()) {
615  case SVal::UndefinedValKind:
616  return evalCastKind(V.castAs<UndefinedVal>(), CastTy, OriginalTy);
617  case SVal::UnknownValKind:
618  return evalCastKind(V.castAs<UnknownVal>(), CastTy, OriginalTy);
619  case SVal::LocKind:
620  return evalCastKind(V.castAs<Loc>(), CastTy, OriginalTy);
621  case SVal::NonLocKind:
622  return evalCastKind(V.castAs<NonLoc>(), CastTy, OriginalTy);
623  }
624 
625  llvm_unreachable("Unknown SVal kind");
626 }
627 
629  QualType OriginalTy) {
630  return V;
631 }
632 
634  QualType OriginalTy) {
635  return V;
636 }
637 
639  switch (V.getSubKind()) {
640  case loc::ConcreteIntKind:
641  return evalCastSubKind(V.castAs<loc::ConcreteInt>(), CastTy, OriginalTy);
642  case loc::GotoLabelKind:
643  return evalCastSubKind(V.castAs<loc::GotoLabel>(), CastTy, OriginalTy);
644  case loc::MemRegionValKind:
645  return evalCastSubKind(V.castAs<loc::MemRegionVal>(), CastTy, OriginalTy);
646  }
647 
648  llvm_unreachable("Unknown SVal kind");
649 }
650 
652  switch (V.getSubKind()) {
653  case nonloc::CompoundValKind:
654  return evalCastSubKind(V.castAs<nonloc::CompoundVal>(), CastTy, OriginalTy);
655  case nonloc::ConcreteIntKind:
656  return evalCastSubKind(V.castAs<nonloc::ConcreteInt>(), CastTy, OriginalTy);
657  case nonloc::LazyCompoundValKind:
658  return evalCastSubKind(V.castAs<nonloc::LazyCompoundVal>(), CastTy,
659  OriginalTy);
660  case nonloc::LocAsIntegerKind:
661  return evalCastSubKind(V.castAs<nonloc::LocAsInteger>(), CastTy,
662  OriginalTy);
663  case nonloc::SymbolValKind:
664  return evalCastSubKind(V.castAs<nonloc::SymbolVal>(), CastTy, OriginalTy);
665  case nonloc::PointerToMemberKind:
666  return evalCastSubKind(V.castAs<nonloc::PointerToMember>(), CastTy,
667  OriginalTy);
668  }
669 
670  llvm_unreachable("Unknown SVal kind");
671 }
672 
674  QualType OriginalTy) {
675  // Pointer to bool.
676  if (CastTy->isBooleanType())
677  return makeTruthVal(V.getValue().getBoolValue(), CastTy);
678 
679  // Pointer to integer.
680  if (CastTy->isIntegralOrEnumerationType()) {
681  llvm::APSInt Value = V.getValue();
683  return makeIntVal(Value);
684  }
685 
686  // Pointer to any pointer.
687  if (Loc::isLocType(CastTy)) {
688  llvm::APSInt Value = V.getValue();
690  return loc::ConcreteInt(BasicVals.getValue(Value));
691  }
692 
693  // Pointer to whatever else.
694  return UnknownVal();
695 }
696 
698  QualType OriginalTy) {
699  // Pointer to bool.
700  if (CastTy->isBooleanType())
701  // Labels are always true.
702  return makeTruthVal(true, CastTy);
703 
704  // Pointer to integer.
705  if (CastTy->isIntegralOrEnumerationType()) {
706  const unsigned BitWidth = Context.getIntWidth(CastTy);
707  return makeLocAsInteger(V, BitWidth);
708  }
709 
710  const bool IsUnknownOriginalType = OriginalTy.isNull();
711  if (!IsUnknownOriginalType) {
712  // Array to pointer.
713  if (isa<ArrayType>(OriginalTy))
714  if (CastTy->isPointerType() || CastTy->isReferenceType())
715  return UnknownVal();
716  }
717 
718  // Pointer to any pointer.
719  if (Loc::isLocType(CastTy))
720  return V;
721 
722  // Pointer to whatever else.
723  return UnknownVal();
724 }
725 
727  return ty1->getPointeeType().getCanonicalType().getTypePtr() ==
729 }
730 
732  QualType OriginalTy) {
733  // Pointer to bool.
734  if (CastTy->isBooleanType()) {
735  const MemRegion *R = V.getRegion();
736  if (const FunctionCodeRegion *FTR = dyn_cast<FunctionCodeRegion>(R))
737  if (const FunctionDecl *FD = dyn_cast<FunctionDecl>(FTR->getDecl()))
738  if (FD->isWeak())
739  // FIXME: Currently we are using an extent symbol here,
740  // because there are no generic region address metadata
741  // symbols to use, only content metadata.
743 
744  if (const SymbolicRegion *SymR = R->getSymbolicBase()) {
745  SymbolRef Sym = SymR->getSymbol();
746  QualType Ty = Sym->getType();
747  // This change is needed for architectures with varying
748  // pointer widths. See the amdgcn opencl reproducer with
749  // this change as an example: solver-sym-simplification-ptr-bool.cl
750  if (!Ty->isReferenceType())
751  return makeNonLoc(Sym, BO_NE, BasicVals.getZeroWithTypeSize(Ty),
752  CastTy);
753  }
754  // Non-symbolic memory regions are always true.
755  return makeTruthVal(true, CastTy);
756  }
757 
758  const bool IsUnknownOriginalType = OriginalTy.isNull();
759  // Try to cast to array
760  const auto *ArrayTy =
761  IsUnknownOriginalType
762  ? nullptr
763  : dyn_cast<ArrayType>(OriginalTy.getCanonicalType());
764 
765  // Pointer to integer.
766  if (CastTy->isIntegralOrEnumerationType()) {
767  SVal Val = V;
768  // Array to integer.
769  if (ArrayTy) {
770  // We will always decay to a pointer.
771  QualType ElemTy = ArrayTy->getElementType();
772  Val = StateMgr.ArrayToPointer(V, ElemTy);
773  // FIXME: Keep these here for now in case we decide soon that we
774  // need the original decayed type.
775  // QualType elemTy = cast<ArrayType>(originalTy)->getElementType();
776  // QualType pointerTy = C.getPointerType(elemTy);
777  }
778  const unsigned BitWidth = Context.getIntWidth(CastTy);
779  return makeLocAsInteger(Val.castAs<Loc>(), BitWidth);
780  }
781 
782  // Pointer to pointer.
783  if (Loc::isLocType(CastTy)) {
784 
785  if (IsUnknownOriginalType) {
786  // When retrieving symbolic pointer and expecting a non-void pointer,
787  // wrap them into element regions of the expected type if necessary.
788  // It is necessary to make sure that the retrieved value makes sense,
789  // because there's no other cast in the AST that would tell us to cast
790  // it to the correct pointer type. We might need to do that for non-void
791  // pointers as well.
792  // FIXME: We really need a single good function to perform casts for us
793  // correctly every time we need it.
794  const MemRegion *R = V.getRegion();
795  if (CastTy->isPointerType() && !CastTy->isVoidPointerType()) {
796  if (const auto *SR = dyn_cast<SymbolicRegion>(R)) {
797  QualType SRTy = SR->getSymbol()->getType();
798  if (!hasSameUnqualifiedPointeeType(SRTy, CastTy)) {
799  if (auto OptMemRegV = getCastedMemRegionVal(SR, CastTy))
800  return *OptMemRegV;
801  }
802  }
803  }
804  // Next fixes pointer dereference using type different from its initial
805  // one. See PR37503 and PR49007 for details.
806  if (const auto *ER = dyn_cast<ElementRegion>(R)) {
807  if (auto OptMemRegV = getCastedMemRegionVal(ER, CastTy))
808  return *OptMemRegV;
809  }
810 
811  return V;
812  }
813 
814  if (OriginalTy->isIntegralOrEnumerationType() ||
815  OriginalTy->isBlockPointerType() || OriginalTy->isFunctionPointerType())
816  return V;
817 
818  // Array to pointer.
819  if (ArrayTy) {
820  // Are we casting from an array to a pointer? If so just pass on
821  // the decayed value.
822  if (CastTy->isPointerType() || CastTy->isReferenceType()) {
823  // We will always decay to a pointer.
824  QualType ElemTy = ArrayTy->getElementType();
825  return StateMgr.ArrayToPointer(V, ElemTy);
826  }
827  // Are we casting from an array to an integer? If so, cast the decayed
828  // pointer value to an integer.
829  assert(CastTy->isIntegralOrEnumerationType());
830  }
831 
832  // Other pointer to pointer.
833  assert(Loc::isLocType(OriginalTy) || OriginalTy->isFunctionType() ||
834  CastTy->isReferenceType());
835 
836  // We get a symbolic function pointer for a dereference of a function
837  // pointer, but it is of function type. Example:
838 
839  // struct FPRec {
840  // void (*my_func)(int * x);
841  // };
842  //
843  // int bar(int x);
844  //
845  // int f1_a(struct FPRec* foo) {
846  // int x;
847  // (*foo->my_func)(&x);
848  // return bar(x)+1; // no-warning
849  // }
850 
851  // Get the result of casting a region to a different type.
852  const MemRegion *R = V.getRegion();
853  if (auto OptMemRegV = getCastedMemRegionVal(R, CastTy))
854  return *OptMemRegV;
855  }
856 
857  // Pointer to whatever else.
858  // FIXME: There can be gross cases where one casts the result of a
859  // function (that returns a pointer) to some other value that happens to
860  // fit within that pointer value. We currently have no good way to model
861  // such operations. When this happens, the underlying operation is that
862  // the caller is reasoning about bits. Conceptually we are layering a
863  // "view" of a location on top of those bits. Perhaps we need to be more
864  // lazy about mutual possible views, even on an SVal? This may be
865  // necessary for bit-level reasoning as well.
866  return UnknownVal();
867 }
868 
870  QualType OriginalTy) {
871  // Compound to whatever.
872  return UnknownVal();
873 }
874 
876  QualType OriginalTy) {
877  auto CastedValue = [V, CastTy, this]() {
878  llvm::APSInt Value = V.getValue();
880  return Value;
881  };
882 
883  // Integer to bool.
884  if (CastTy->isBooleanType())
885  return makeTruthVal(V.getValue().getBoolValue(), CastTy);
886 
887  // Integer to pointer.
888  if (CastTy->isIntegralOrEnumerationType())
889  return makeIntVal(CastedValue());
890 
891  // Integer to pointer.
892  if (Loc::isLocType(CastTy))
893  return makeIntLocVal(CastedValue());
894 
895  // Pointer to whatever else.
896  return UnknownVal();
897 }
898 
900  QualType OriginalTy) {
901  // Compound to whatever.
902  return UnknownVal();
903 }
904 
906  QualType OriginalTy) {
907  Loc L = V.getLoc();
908 
909  // Pointer as integer to bool.
910  if (CastTy->isBooleanType())
911  // Pass to Loc function.
912  return evalCastKind(L, CastTy, OriginalTy);
913 
914  const bool IsUnknownOriginalType = OriginalTy.isNull();
915  // Pointer as integer to pointer.
916  if (!IsUnknownOriginalType && Loc::isLocType(CastTy) &&
917  OriginalTy->isIntegralOrEnumerationType()) {
918  if (const MemRegion *R = L.getAsRegion())
919  if (auto OptMemRegV = getCastedMemRegionVal(R, CastTy))
920  return *OptMemRegV;
921  return L;
922  }
923 
924  // Pointer as integer with region to integer/pointer.
925  const MemRegion *R = L.getAsRegion();
926  if (!IsUnknownOriginalType && R) {
927  if (CastTy->isIntegralOrEnumerationType())
928  return evalCastSubKind(loc::MemRegionVal(R), CastTy, OriginalTy);
929 
930  if (Loc::isLocType(CastTy)) {
931  assert(Loc::isLocType(OriginalTy) || OriginalTy->isFunctionType() ||
932  CastTy->isReferenceType());
933  // Delegate to store manager to get the result of casting a region to a
934  // different type. If the MemRegion* returned is NULL, this expression
935  // Evaluates to UnknownVal.
936  if (auto OptMemRegV = getCastedMemRegionVal(R, CastTy))
937  return *OptMemRegV;
938  }
939  } else {
940  if (Loc::isLocType(CastTy)) {
941  if (IsUnknownOriginalType)
942  return evalCastSubKind(loc::MemRegionVal(R), CastTy, OriginalTy);
943  return L;
944  }
945 
946  SymbolRef SE = nullptr;
947  if (R) {
948  if (const SymbolicRegion *SR =
949  dyn_cast<SymbolicRegion>(R->StripCasts())) {
950  SE = SR->getSymbol();
951  }
952  }
953 
954  if (!CastTy->isFloatingType() || !SE || SE->getType()->isFloatingType()) {
955  // FIXME: Correctly support promotions/truncations.
956  const unsigned CastSize = Context.getIntWidth(CastTy);
957  if (CastSize == V.getNumBits())
958  return V;
959 
960  return makeLocAsInteger(L, CastSize);
961  }
962  }
963 
964  // Pointer as integer to whatever else.
965  return UnknownVal();
966 }
967 
969  QualType OriginalTy) {
970  SymbolRef SE = V.getSymbol();
971 
972  const bool IsUnknownOriginalType = OriginalTy.isNull();
973  // Symbol to bool.
974  if (!IsUnknownOriginalType && CastTy->isBooleanType()) {
975  // Non-float to bool.
976  if (Loc::isLocType(OriginalTy) ||
977  OriginalTy->isIntegralOrEnumerationType() ||
978  OriginalTy->isMemberPointerType()) {
980  return makeNonLoc(SE, BO_NE, BVF.getValue(0, SE->getType()), CastTy);
981  }
982  } else {
983  // Symbol to integer, float.
985 
986  // Produce SymbolCast if CastTy and T are different integers.
987  // NOTE: In the end the type of SymbolCast shall be equal to CastTy.
990  AnalyzerOptions &Opts =
992  // If appropriate option is disabled, ignore the cast.
993  // NOTE: ShouldSupportSymbolicIntegerCasts is `false` by default.
994  if (!Opts.ShouldSupportSymbolicIntegerCasts)
995  return V;
996  return simplifySymbolCast(V, CastTy);
997  }
998  if (!Loc::isLocType(CastTy))
999  if (!IsUnknownOriginalType || !CastTy->isFloatingType() ||
1000  T->isFloatingType())
1001  return makeNonLoc(SE, T, CastTy);
1002  }
1003 
1004  // Symbol to pointer and whatever else.
1005  return UnknownVal();
1006 }
1007 
1009  QualType OriginalTy) {
1010  // Member pointer to whatever.
1011  return V;
1012 }
1013 
1015  QualType CastTy) {
1016  // We use seven conditions to recognize a simplification case.
1017  // For the clarity let `CastTy` be `C`, SE->getType() - `T`, root type - `R`,
1018  // prefix `u` for unsigned, `s` for signed, no prefix - any sign:
1019  // E.g. (char)(short)(uint x)
1020  // ( sC )( sT )( uR x)
1021  //
1022  // C === R (the same type)
1023  // (char)(char x) -> (char x)
1024  // (long)(long x) -> (long x)
1025  // Note: Comparisons operators below are for bit width.
1026  // C == T
1027  // (short)(short)(int x) -> (short)(int x)
1028  // (int)(long)(char x) -> (int)(char x) (sizeof(long) == sizeof(int))
1029  // (long)(ullong)(char x) -> (long)(char x) (sizeof(long) == sizeof(ullong))
1030  // C < T
1031  // (short)(int)(char x) -> (short)(char x)
1032  // (char)(int)(short x) -> (char)(short x)
1033  // (short)(int)(short x) -> (short x)
1034  // C > T > uR
1035  // (int)(short)(uchar x) -> (int)(uchar x)
1036  // (uint)(short)(uchar x) -> (uint)(uchar x)
1037  // (int)(ushort)(uchar x) -> (int)(uchar x)
1038  // C > sT > sR
1039  // (int)(short)(char x) -> (int)(char x)
1040  // (uint)(short)(char x) -> (uint)(char x)
1041  // C > sT == sR
1042  // (int)(char)(char x) -> (int)(char x)
1043  // (uint)(short)(short x) -> (uint)(short x)
1044  // C > uT == uR
1045  // (int)(uchar)(uchar x) -> (int)(uchar x)
1046  // (uint)(ushort)(ushort x) -> (uint)(ushort x)
1047  // (llong)(ulong)(uint x) -> (llong)(uint x) (sizeof(ulong) == sizeof(uint))
1048 
1049  SymbolRef SE = V.getSymbol();
1051 
1052  if (T == CastTy)
1053  return V;
1054 
1055  if (!isa<SymbolCast>(SE))
1056  return makeNonLoc(SE, T, CastTy);
1057 
1058  SymbolRef RootSym = cast<SymbolCast>(SE)->getOperand();
1059  QualType RT = RootSym->getType().getCanonicalType();
1060 
1062  APSIntType CTy = BVF.getAPSIntType(CastTy);
1063  APSIntType TTy = BVF.getAPSIntType(T);
1064 
1065  const auto WC = CTy.getBitWidth();
1066  const auto WT = TTy.getBitWidth();
1067 
1068  if (WC <= WT) {
1069  const bool isSameType = (RT == CastTy);
1070  if (isSameType)
1071  return nonloc::SymbolVal(RootSym);
1072  return makeNonLoc(RootSym, RT, CastTy);
1073  }
1074 
1075  APSIntType RTy = BVF.getAPSIntType(RT);
1076  const auto WR = RTy.getBitWidth();
1077  const bool UT = TTy.isUnsigned();
1078  const bool UR = RTy.isUnsigned();
1079 
1080  if (((WT > WR) && (UR || !UT)) || ((WT == WR) && (UT == UR)))
1081  return makeNonLoc(RootSym, RT, CastTy);
1082 
1083  return makeNonLoc(SE, T, CastTy);
1084 }
clang::CXXMethodDecl::getThisType
QualType getThisType() const
Return the type of the this pointer.
Definition: DeclCXX.cpp:2452
clang::ento::ProgramStateManager::getOwningEngine
ExprEngine & getOwningEngine()
Definition: ProgramState.h:576
clang::ento::SValBuilder::evalBinOp
SVal evalBinOp(ProgramStateRef state, BinaryOperator::Opcode op, SVal lhs, SVal rhs, QualType type)
Definition: SValBuilder.cpp:437
clang::ento::Loc::isLocType
static bool isLocType(QualType T)
Definition: SVals.h:335
clang::ento::UndefinedVal
Definition: SVals.h:223
clang::AnalysisDeclContext::getASTContext
ASTContext & getASTContext() const
Definition: AnalysisDeclContext.h:104
clang::CXXBoolLiteralExpr
A boolean literal, per ([C++ lex.bool] Boolean literals).
Definition: ExprCXX.h:721
clang::ento::BasicValueFactory::getEmptySValList
llvm::ImmutableList< SVal > getEmptySValList()
Definition: BasicValueFactory.h:242
clang::Type::isBlockPointerType
bool isBlockPointerType() const
Definition: Type.h:6756
clang::ento::SymbolManager::conjureSymbol
const SymbolConjured * conjureSymbol(const Stmt *E, const LocationContext *LCtx, QualType T, unsigned VisitCount, const void *SymbolTag=nullptr)
clang::ento::BasicValueFactory
Definition: BasicValueFactory.h:107
type
clang::LocationContext
It wraps the AnalysisDeclContext to represent both the call stack with the help of StackFrameContext ...
Definition: AnalysisDeclContext.h:215
SVals.h
clang::ento::nonloc::CompoundVal
Definition: SVals.h:456
clang::ast_matchers::stmt
const internal::VariadicAllOfMatcher< Stmt > stmt
Matches statements.
Definition: ASTMatchersInternal.cpp:810
clang::Type::isVoidPointerType
bool isVoidPointerType() const
Definition: Type.cpp:589
clang::ento::SVal::castAs
T castAs() const
Convert to the specified SVal type, asserting that this SVal is of the desired type.
Definition: SVals.h:102
clang::ento::SValBuilder::StateMgr
ProgramStateManager & StateMgr
Definition: SValBuilder.h:68
clang::ento::SValBuilder::getMetadataSymbolVal
DefinedSVal getMetadataSymbolVal(const void *symbolTag, const MemRegion *region, const Expr *expr, QualType type, const LocationContext *LCtx, unsigned count)
Definition: SValBuilder.cpp:224
clang::ento::SVal::isUndef
bool isUndef() const
Definition: SVals.h:139
clang::ento::NonLoc
Definition: SVals.h:304
clang::ento::SVal::getAsRegion
const MemRegion * getAsRegion() const
Definition: SVals.cpp:131
clang::ento::SValBuilder::makeLocAsInteger
NonLoc makeLocAsInteger(Loc loc, unsigned bits)
Definition: SValBuilder.h:339
AnalysisDeclContext.h
clang::ento::DefinedOrUnknownSVal
Definition: SVals.h:235
clang::ento::SymbolManager::getIntSymExpr
const IntSymExpr * getIntSymExpr(const llvm::APSInt &lhs, BinaryOperator::Opcode op, const SymExpr *rhs, QualType t)
Definition: SymbolManager.cpp:273
clang::ento::MemRegion::StripCasts
const MemRegion * StripCasts(bool StripBaseAndDerivedCasts=true) const
Definition: MemRegion.cpp:1333
clang::ASTContext::getIntWidth
unsigned getIntWidth(QualType T) const
Definition: ASTContext.cpp:10684
clang::NamedDecl
This represents a decl that may have a name.
Definition: Decl.h:247
clang::ento::SymExpr::computeComplexity
virtual unsigned computeComplexity() const =0
clang::ento::SymbolManager::getSymSymExpr
const SymSymExpr * getSymSymExpr(const SymExpr *lhs, BinaryOperator::Opcode op, const SymExpr *rhs, QualType t)
Definition: SymbolManager.cpp:291
clang::ento::SValBuilder::makeNullWithType
loc::ConcreteInt makeNullWithType(QualType type)
Create NULL pointer, with proper pointer bit-width for given address space.
Definition: SValBuilder.h:368
clang::QualType
A (possibly-)qualified type.
Definition: Type.h:675
clang::TypeDecl::getTypeForDecl
const Type * getTypeForDecl() const
Definition: Decl.h:3182
clang::ento::MemRegionManager::getSymbolicHeapRegion
const SymbolicRegion * getSymbolicHeapRegion(SymbolRef sym)
Return a unique symbolic region belonging to heap memory space.
Definition: MemRegion.cpp:1166
clang::QualType::getCanonicalType
QualType getCanonicalType() const
Definition: Type.h:6539
clang::Type::isFloatingType
bool isFloatingType() const
Definition: Type.cpp:2121
clang::Qualifiers
The collection of all-type qualifiers we support.
Definition: Type.h:147
DeclCXX.h
clang::ento::SValBuilder::getDerivedRegionValueSymbolVal
DefinedOrUnknownSVal getDerivedRegionValueSymbolVal(SymbolRef parentSymbol, const TypedValueRegion *region)
Definition: SValBuilder.cpp:241
ProgramState_Fwd.h
SymbolManager.h
clang::ento::SymbolRef
const SymExpr * SymbolRef
Definition: SymExpr.h:110
clang::ento::loc::GotoLabel
Definition: SVals.h:574
clang::ento::MemRegionManager::getBlockDataRegion
const BlockDataRegion * getBlockDataRegion(const BlockCodeRegion *bc, const LocationContext *lc, unsigned blockCount)
getBlockDataRegion - Get the memory region associated with an instance of a block.
Definition: MemRegion.cpp:1075
llvm::Optional
Definition: LLVM.h:40
clang::ento::SValBuilder::makeZeroVal
DefinedOrUnknownSVal makeZeroVal(QualType type)
Construct an SVal representing '0' for the specified type.
Definition: SValBuilder.cpp:62
clang::Type::isVariableArrayType
bool isVariableArrayType() const
Definition: Type.h:6826
clang::StackFrameContext
It represents a stack frame of the call stack (based on CallEvent).
Definition: AnalysisDeclContext.h:295
clang::Type::isVoidType
bool isVoidType() const
Definition: Type.h:7037
clang::ento::nonloc::ConcreteInt
Value representing integer constant.
Definition: SVals.h:385
clang::ento::UnknownVal
Definition: SVals.h:256
clang::ento::MemRegionManager::getFunctionCodeRegion
const FunctionCodeRegion * getFunctionCodeRegion(const NamedDecl *FD)
Definition: MemRegion.cpp:1147
clang::ento::loc::MemRegionVal
Definition: SVals.h:598
clang::ento::loc::ConcreteInt
Definition: SVals.h:640
clang::ento::SValBuilder::getConjuredHeapSymbolVal
DefinedOrUnknownSVal getConjuredHeapSymbolVal(const Expr *E, const LocationContext *LCtx, unsigned Count)
Conjure a symbol representing heap allocated memory region.
clang::ento::APSIntType::isUnsigned
bool isUnsigned() const
Definition: APSIntType.h:31
clang::Expr::isGLValue
bool isGLValue() const
Definition: Expr.h:273
clang::ento::APSIntType::getMaxValue
llvm::APSInt getMaxValue() const LLVM_READONLY
Returns the maximum value for this type.
Definition: APSIntType.h:65
clang::ento::BlockCodeRegion
BlockCodeRegion - A region that represents code texts of blocks (closures).
Definition: MemRegion.h:618
clang::Type
The base class of the type hierarchy.
Definition: Type.h:1500
clang::ento::SVal::getAs
Optional< T > getAs() const
Convert to the specified SVal type, returning None if this SVal is not of the desired type.
Definition: SVals.h:110
Decl.h
clang::ento::MemRegion
MemRegion - The root abstract class for all memory regions.
Definition: MemRegion.h:94
clang::ento::ConditionTruthVal
Definition: ConstraintManager.h:38
APSInt
llvm::APSInt APSInt
Definition: ByteCodeEmitter.cpp:19
clang::ento::SymbolManager::getCastSymbol
const SymbolCast * getCastSymbol(const SymExpr *Operand, QualType From, QualType To)
Definition: SymbolManager.cpp:240
clang::ento::AnalysisManager::getAnalyzerOptions
AnalyzerOptions & getAnalyzerOptions() override
Definition: AnalysisManager.h:72
SymExpr.h
clang::Type::isReferenceType
bool isReferenceType() const
Definition: Type.h:6760
V
#define V(N, I)
Definition: ASTContext.h:3176
clang::ast_matchers::expr
const internal::VariadicDynCastAllOfMatcher< Stmt, Expr > expr
Matches expressions.
Definition: ASTMatchersInternal.cpp:890
clang::ento::DefinedSVal
Definition: SVals.h:268
clang::ento::MemRegion::getSymbolicBase
const SymbolicRegion * getSymbolicBase() const
If this is a symbolic region, returns the region.
Definition: MemRegion.cpp:1356
clang::CXXBoolLiteralExpr::getValue
bool getValue() const
Definition: ExprCXX.h:733
clang::ento::SValBuilder::AnOpts
const AnalyzerOptions & AnOpts
Definition: SValBuilder.h:70
clang::ento::SymbolManager::getDerivedSymbol
const SymbolDerived * getDerivedSymbol(SymbolRef parentSymbol, const TypedValueRegion *R)
Definition: SymbolManager.cpp:189
clang::ento::SymExpr::getType
virtual QualType getType() const =0
clang::BlockDecl
Represents a block literal declaration, which is like an unnamed FunctionDecl.
Definition: Decl.h:4201
clang::LocationContext::getAnalysisDeclContext
AnalysisDeclContext * getAnalysisDeclContext() const
Definition: AnalysisDeclContext.h:241
clang::ento::SValBuilder::getRegionValueSymbolVal
DefinedOrUnknownSVal getRegionValueSymbolVal(const TypedValueRegion *region)
Make a unique symbol for value of region.
Definition: SValBuilder.cpp:131
clang::ento::SValBuilder::getContext
ASTContext & getContext()
Definition: SValBuilder.h:167
clang::Type::isNullPtrType
bool isNullPtrType() const
Definition: Type.h:7062
clang::ento::SValBuilder::Context
ASTContext & Context
Definition: SValBuilder.h:57
clang::ento::MemRegionManager::getBlockCodeRegion
const BlockCodeRegion * getBlockCodeRegion(const BlockDecl *BD, CanQualType locTy, AnalysisDeclContext *AC)
Definition: MemRegion.cpp:1153
clang::Type::isFunctionPointerType
bool isFunctionPointerType() const
Definition: Type.h:6782
clang::ento::ProgramStateManager::ArrayToPointer
SVal ArrayToPointer(Loc Array, QualType ElementTy)
Definition: ProgramState.h:585
clang::ASTContext
Holds long-lived AST nodes (such as types and decls) that can be referred to throughout the semantic ...
Definition: ASTContext.h:208
clang::ento::SValBuilder::getCXXThis
loc::MemRegionVal getCXXThis(const CXXMethodDecl *D, const StackFrameContext *SFC)
Return a memory region for the 'this' object reference.
Definition: SValBuilder.cpp:298
clang::ento::SymExpr
Symbolic value.
Definition: SymExpr.h:29
clang::ento::SValBuilder::SValBuilder
SValBuilder(llvm::BumpPtrAllocator &alloc, ASTContext &context, ProgramStateManager &stateMgr)
Definition: SValBuilder.cpp:52
Store.h
clang::ento::SValBuilder::convertToArrayIndex
SVal convertToArrayIndex(SVal val)
Definition: SValBuilder.cpp:112
clang::ento::SValBuilder::getRegionManager
MemRegionManager & getRegionManager()
Definition: SValBuilder.h:186
clang::ento::nonloc::PointerToMember
Value representing pointer-to-member.
Definition: SVals.h:524
clang::Expr::NPC_ValueDependentIsNotNull
@ NPC_ValueDependentIsNotNull
Specifies that a value-dependent expression should be considered to never be a null pointer constant.
Definition: Expr.h:790
clang::ento::BlockDataRegion
BlockDataRegion - A region that represents a block instance.
Definition: MemRegion.h:663
clang::Type::isFunctionType
bool isFunctionType() const
Definition: Type.h:6744
Type.h
clang::ASTContext::UnwrapSimilarTypes
bool UnwrapSimilarTypes(QualType &T1, QualType &T2, bool AllowPiMismatch=true)
Attempt to unwrap two types that may be similar (C++ [conv.qual]).
Definition: ASTContext.cpp:6019
clang::ento::SValBuilder::getConstantVal
Optional< SVal > getConstantVal(const Expr *E)
Returns the value of E, if it can be determined in a non-path-sensitive manner.
Definition: SValBuilder.cpp:312
clang::Expr::EvalResult
EvalResult is a struct with detailed info about an evaluated expression.
Definition: Expr.h:612
ASTContext.h
clang::ento::SValBuilder::getBasicValueFactory
BasicValueFactory & getBasicValueFactory()
Definition: SValBuilder.h:180
clang::Type::getPointeeType
QualType getPointeeType() const
If this is a pointer, ObjC object pointer, or block pointer, this returns the respective pointee.
Definition: Type.cpp:625
clang::ento::APSIntType::getBitWidth
uint32_t getBitWidth() const
Definition: APSIntType.h:30
clang::ASTContext::getCanonicalType
CanQualType getCanonicalType(QualType T) const
Return the canonical (structural) type corresponding to the specified potentially non-canonical type ...
Definition: ASTContext.h:2508
hasSameUnqualifiedPointeeType
static bool hasSameUnqualifiedPointeeType(QualType ty1, QualType ty2)
Definition: SValBuilder.cpp:726
ExprObjC.h
clang::ento::SValBuilder::evalBinOpLN
virtual SVal evalBinOpLN(ProgramStateRef state, BinaryOperator::Opcode op, Loc lhs, NonLoc rhs, QualType resultTy)=0
Create a new value which represents a binary expression with a memory location and non-location opera...
clang::CanQual< Type >
ExprCXX.h
BasicValueFactory.h
clang::ento::nonloc::LazyCompoundVal
Definition: SVals.h:485
clang::prec::PointerToMember
@ PointerToMember
Definition: OperatorPrecedence.h:42
clang::ento::SymbolicRegion
SymbolicRegion - A special, "non-concrete" region.
Definition: MemRegion.h:754
clang::ento::APSIntType
A record of the "type" of an APSInt, used for conversions.
Definition: APSIntType.h:19
state
and static some checkers Checker The latter are built on top of the former via the Checker and CheckerVisitor and attempts to isolate them from much of the gore of the internal analysis the analyzer is basically a source code simulator that traces out possible paths of execution The state of the and the combination of state and program point is a node in an exploded which has the entry program point and initial state
Definition: README.txt:30
clang::ento::Loc
Definition: SVals.h:326
clang::ento::SValBuilder::getCastedMemRegionVal
Optional< loc::MemRegionVal > getCastedMemRegionVal(const MemRegion *region, QualType type)
Return MemRegionVal on success cast, otherwise return None.
Definition: SValBuilder.cpp:291
clang::ento::SValBuilder::makeSymExprValNN
SVal makeSymExprValNN(BinaryOperator::Opcode op, NonLoc lhs, NonLoc rhs, QualType resultTy)
Constructs a symbolic expression for two non-location values.
Definition: SValBuilder.cpp:412
clang::ento::SymbolManager::getMetadataSymbol
const SymbolMetadata * getMetadataSymbol(const MemRegion *R, const Stmt *S, QualType T, const LocationContext *LCtx, unsigned VisitCount, const void *SymbolTag=nullptr)
Creates a metadata symbol associated with a specific region.
Definition: SymbolManager.cpp:222
clang::CXXRecordDecl
Represents a C++ struct/union/class.
Definition: DeclCXX.h:254
clang::ento::SValBuilder::makeCompoundVal
NonLoc makeCompoundVal(QualType type, llvm::ImmutableList< SVal > vals)
Definition: SValBuilder.h:272
clang::ento::SValBuilder::makeLoc
loc::MemRegionVal makeLoc(SymbolRef sym)
Definition: SValBuilder.h:384
clang::Type::isMemberPointerType
bool isMemberPointerType() const
Definition: Type.h:6796
clang::ento::SymbolManager::getSymIntExpr
const SymIntExpr * getSymIntExpr(const SymExpr *lhs, BinaryOperator::Opcode op, const llvm::APSInt &rhs, QualType t)
clang::ento::SymbolManager::getRegionValueSymbol
const SymbolRegionValue * getRegionValueSymbol(const TypedValueRegion *R)
Make a unique symbol for MemRegion R according to its kind.
Definition: SymbolManager.cpp:154
clang::Stmt::getStmtClass
StmtClass getStmtClass() const
Definition: Stmt.h:1160
clang::Type::isPointerType
bool isPointerType() const
Definition: Type.h:6748
shouldBeModeledWithNoOp
static bool shouldBeModeledWithNoOp(ASTContext &Context, QualType ToTy, QualType FromTy)
Recursively check if the pointer types are equal modulo const, volatile, and restrict qualifiers.
Definition: SValBuilder.cpp:507
clang::ento::ProgramStateManager
Definition: ProgramState.h:498
clang::ento::SValBuilder::evalCast
SVal evalCast(SVal V, QualType CastTy, QualType OriginalTy)
Cast a given SVal to another SVal using given QualType's.
Definition: SValBuilder.cpp:591
SValBuilder.h
clang::ASTContext::getUnqualifiedArrayType
QualType getUnqualifiedArrayType(QualType T, Qualifiers &Quals)
Return this type as a completely-unqualified array type, capturing the qualifiers in Quals.
Definition: ASTContext.cpp:5906
clang::ento::APSIntType::apply
void apply(llvm::APSInt &Value) const
Convert a given APSInt, in place, to match this type.
Definition: APSIntType.h:37
clang::ento::SValBuilder::evalBinOpNN
virtual SVal evalBinOpNN(ProgramStateRef state, BinaryOperator::Opcode op, NonLoc lhs, NonLoc rhs, QualType resultTy)=0
Create a new value which represents a binary expression with two non- location operands.
clang::QualType::isNull
bool isNull() const
Return true if this QualType doesn't point to a type yet.
Definition: Type.h:740
Value
Value
Definition: UninitializedValues.cpp:102
clang::ento::FunctionCodeRegion
FunctionCodeRegion - A region that represents code texts of function.
Definition: MemRegion.h:571
clang::ento::SValBuilder::makeIntVal
nonloc::ConcreteInt makeIntVal(const IntegerLiteral *integer)
Definition: SValBuilder.h:300
clang::ento::SValBuilder::makeIntLocVal
loc::ConcreteInt makeIntLocVal(const llvm::APSInt &integer)
Definition: SValBuilder.h:316
LLVM.h
clang::AnalyzerOptions
Stores options for the analyzer from the command line.
Definition: AnalyzerOptions.h:165
APSIntType.h
clang::ento::SValBuilder::getFunctionPointer
DefinedSVal getFunctionPointer(const FunctionDecl *func)
Definition: SValBuilder.cpp:275
clang::ento::StoreManager::castRegion
Optional< const MemRegion * > castRegion(const MemRegion *region, QualType CastToTy)
castRegion - Used by ExprEngine::VisitCast to handle casts from a MemRegion* to a specific location t...
Definition: Store.cpp:74
clang::BinaryOperatorKind
BinaryOperatorKind
Definition: OperationKinds.h:25
clang::ento::ExprEngine::getAnalysisManager
AnalysisManager & getAnalysisManager()
Definition: ExprEngine.h:205
clang::Expr::EvaluateAsInt
bool EvaluateAsInt(EvalResult &Result, const ASTContext &Ctx, SideEffectsKind AllowSideEffects=SE_NoSideEffects, bool InConstantContext=false) const
EvaluateAsInt - Return true if this is a constant which we can fold and convert to an integer,...
Definition: ExprConstant.cpp:14994
clang::Expr::isNullPointerConstant
NullPointerConstantKind isNullPointerConstant(ASTContext &Ctx, NullPointerConstantValueDependence NPC) const
isNullPointerConstant - C99 6.3.2.3p3 - Test if this reduces down to a Null pointer constant.
Definition: Expr.cpp:3773
clang::ento::SValBuilder::getBlockPointer
DefinedSVal getBlockPointer(const BlockDecl *block, CanQualType locTy, const LocationContext *locContext, unsigned blockCount)
Definition: SValBuilder.cpp:279
clang::Type::isBooleanType
bool isBooleanType() const
Definition: Type.h:7153
clang::ento::SValBuilder::ArrayIndexWidth
const unsigned ArrayIndexWidth
The width of the scalar type used for array indices.
Definition: SValBuilder.h:76
ProgramState.h
clang::ento::ProgramStateManager::getStoreManager
StoreManager & getStoreManager()
Definition: ProgramState.h:574
clang::ento::nonloc::SymbolVal
Represents symbolic expression that isn't a location.
Definition: SVals.h:355
clang::ento::SValBuilder::makeTruthVal
nonloc::ConcreteInt makeTruthVal(bool b, QualType type)
Definition: SValBuilder.h:357
ExprEngine.h
clang::ento::SValBuilder::areEqual
ConditionTruthVal areEqual(ProgramStateRef state, SVal lhs, SVal rhs)
Definition: SValBuilder.cpp:488
clang::ento::TypedValueRegion::getValueType
virtual QualType getValueType() const =0
clang::ento::nonloc::LocAsInteger
Definition: SVals.h:416
clang::Expr::IgnoreParens
Expr * IgnoreParens() LLVM_READONLY
Skip past any parentheses which might surround this expression until reaching a fixed point.
Definition: Expr.cpp:2943
clang
Definition: CalledOnceCheck.h:17
clang::Type::isIntegralOrUnscopedEnumerationType
bool isIntegralOrUnscopedEnumerationType() const
Determine whether this type is an integral or unscoped enumeration type.
Definition: Type.cpp:1943
clang::ento::SVal::isUnknownOrUndef
bool isUnknownOrUndef() const
Definition: SVals.h:143
clang::Stmt
Stmt - This represents one statement.
Definition: Stmt.h:69
clang::ento::SValBuilder::evalIntegralCast
SVal evalIntegralCast(ProgramStateRef state, SVal val, QualType castTy, QualType originalType)
Definition: SValBuilder.cpp:540
clang::ento::SValBuilder::BasicVals
BasicValueFactory BasicVals
Manager of APSInt values.
Definition: SValBuilder.h:60
clang::ento::SValBuilder::evalCastSubKind
SVal evalCastSubKind(loc::ConcreteInt V, QualType CastTy, QualType OriginalTy)
Definition: SValBuilder.cpp:673
clang::ento::SVal::isUnknown
bool isUnknown() const
Definition: SVals.h:135
MemRegion.h
clang::ento::SymbolManager::getExtentSymbol
const SymbolExtent * getExtentSymbol(const SubRegion *R)
Definition: SymbolManager.cpp:206
clang::Expr::getType
QualType getType() const
Definition: Expr.h:141
clang::ento::SValBuilder::makeBoolVal
nonloc::ConcreteInt makeBoolVal(const ObjCBoolLiteralExpr *boolean)
Definition: SValBuilder.h:306
clang::ento::SValBuilder::simplifySymbolCast
nonloc::SymbolVal simplifySymbolCast(nonloc::SymbolVal V, QualType CastTy)
Reduce cast expression by removing redundant intermediate casts.
Definition: SValBuilder.cpp:1014
clang::ento::SValBuilder::evalCastKind
SVal evalCastKind(UndefinedVal V, QualType CastTy, QualType OriginalTy)
Definition: SValBuilder.cpp:628
clang::ento::SValBuilder::SymMgr
SymbolManager SymMgr
Manages the creation of symbols.
Definition: SValBuilder.h:63
clang::ento::SValBuilder::ArrayIndexTy
const QualType ArrayIndexTy
The scalar type to use for array indices.
Definition: SValBuilder.h:73
clang::Qualifiers::removeCVRQualifiers
void removeCVRQualifiers(unsigned mask)
Definition: Type.h:287
clang::QualType::getTypePtr
const Type * getTypePtr() const
Retrieves a pointer to the underlying (unqualified) type.
Definition: Type.h:6500
clang::ASTContext::getPointerType
QualType getPointerType(QualType T) const
Return the uniqued reference to the type for a pointer to the specified type.
Definition: ASTContext.cpp:3260
clang::ento::SVal
SVal - This represents a symbolic expression, which can be either an L-value or an R-value.
Definition: SVals.h:74
clang::ento::SValBuilder::makeNonLoc
nonloc::SymbolVal makeNonLoc(const SymExpr *lhs, BinaryOperator::Opcode op, const llvm::APSInt &rhs, QualType type)
Definition: SValBuilder.cpp:77
Stmt.h
clang::ento::TypedValueRegion
TypedValueRegion - An abstract class representing regions having a typed value.
Definition: MemRegion.h:522
clang::ento::MemRegionManager::getSymbolicRegion
const SymbolicRegion * getSymbolicRegion(SymbolRef Sym, const MemSpaceRegion *MemSpace=nullptr)
Retrieve or create a "symbolic" memory region.
Definition: MemRegion.cpp:1159
clang::ento::SValBuilder::evalEQ
SVal evalEQ(ProgramStateRef state, SVal lhs, SVal rhs)
Definition: SValBuilder.cpp:493
clang::Expr
This represents one expression.
Definition: Expr.h:109
clang::ento::SVal::getAsSymbol
SymbolRef getAsSymbol(bool IncludeBaseRegions=false) const
If this SVal wraps a symbol return that SymbolRef.
Definition: SVals.cpp:123
clang::ento::SValBuilder::conjureSymbolVal
DefinedOrUnknownSVal conjureSymbolVal(const void *symbolTag, const Expr *expr, const LocationContext *LCtx, unsigned count)
Create a new symbol with a unique 'name'.
clang::Type::isUnsignedIntegerType
bool isUnsignedIntegerType() const
Return true if this is an integer type that is unsigned, according to C99 6.2.5p6 [which returns true...
Definition: Type.cpp:2068
clang::ento::SValBuilder::getConditionType
QualType getConditionType() const
Definition: SValBuilder.h:172
clang::ento::SValBuilder::getMemberPointer
DefinedSVal getMemberPointer(const NamedDecl *ND)
Definition: SValBuilder.cpp:259
AnalysisManager.h
clang::FunctionDecl
Represents a function declaration or definition.
Definition: Decl.h:1872
clang::ento::SValBuilder::evalBinOpLL
virtual SVal evalBinOpLL(ProgramStateRef state, BinaryOperator::Opcode op, Loc lhs, Loc rhs, QualType resultTy)=0
Create a new value which represents a binary expression with two memory location operands.
clang::ento::BasicValueFactory::getAPSIntType
APSIntType getAPSIntType(QualType T) const
Returns the type of the APSInt used to store values of the given QualType.
Definition: BasicValueFactory.h:142
clang::ento::BasicValueFactory::getZeroWithTypeSize
const llvm::APSInt & getZeroWithTypeSize(QualType T)
Definition: BasicValueFactory.h:218
llvm::IntrusiveRefCntPtr< const ProgramState >
clang::Type::isIntegralOrEnumerationType
bool isIntegralOrEnumerationType() const
Determine whether this type is an integral or enumeration type.
Definition: Type.h:7140
clang::ento::SymbolManager::canSymbolicate
static bool canSymbolicate(QualType T)
Definition: SymbolManager.cpp:330
clang::CXXMethodDecl
Represents a static or instance method of a struct/union/class.
Definition: DeclCXX.h:1968
clang::ento::SValBuilder::MemMgr
MemRegionManager MemMgr
Manages the creation of memory regions.
Definition: SValBuilder.h:66