|
clang
16.0.0git
|
Functions | |
| and static some checkers Checker The latter are built on top of the former via the Checker and CheckerVisitor | interfaces (Checker.h and CheckerVisitor.h). The Checker interface is designed to be minimal and simple for checker writers |
| and static some checkers Checker The latter are built on top of the former via the Checker and CheckerVisitor and attempts to isolate them from much of the gore of the internal analysis the analyzer is basically a source code simulator that traces out possible paths of execution The state of the | program (values of variables and expressions) is encapsulated by the state(ProgramState). A location in the program is called a program point(ProgramPoint) |
| and static some checkers Checker The latter are built on top of the former via the Checker and CheckerVisitor and attempts to isolate them from much of the gore of the internal analysis the analyzer is basically a source code simulator that traces out possible paths of execution The state of the and the combination of state and program point is a node in an exploded | graph (ExplodedGraph). The term "exploded" comes from exploding the control-flow edges in the control-flow graph(CFG). Conceptually the analyzer does a reachability analysis through the ExplodedGraph. We start at a root node |
| and static some checkers Checker The latter are built on top of the former via the Checker and CheckerVisitor and attempts to isolate them from much of the gore of the internal analysis the analyzer is basically a source code simulator that traces out possible paths of execution The state of the and the combination of state and program point is a node in an exploded which has the entry program point and initial and then simulate transitions by analyzing individual expressions The analysis of an expression can cause the state to resulting in a new node in the ExplodedGraph with an updated program point and an updated state A bug is found by hitting a node that satisfies some bug condition(basically a violation of a checking invariant). The analyzer traces out multiple paths by reasoning about branches and then bifurcating the state it can contain cycles as paths loop back onto each other and cache out ProgramState and ExplodedNodes are basically immutable once created Once one creates a you need to create a new one to get a new ProgramState This immutability is key since the ExplodedGraph represents the behavior of the analyzed program from the entry point To represent these we use functional data | structures (e.g., ImmutableMaps) which share data between instances. Finally |
| and static some checkers Checker The latter are built on top of the former via the Checker and CheckerVisitor and attempts to isolate them from much of the gore of the internal analysis the analyzer is basically a source code simulator that traces out possible paths of execution The state of the and the combination of state and program point is a node in an exploded which has the entry program point and initial and then simulate transitions by analyzing individual expressions The analysis of an expression can cause the state to resulting in a new node in the ExplodedGraph with an updated program point and an updated state A bug is found by hitting a node that satisfies some bug condition(basically a violation of a checking invariant). The analyzer traces out multiple paths by reasoning about branches and then bifurcating the state it can contain cycles as paths loop back onto each other and cache out ProgramState and ExplodedNodes are basically immutable once created Once one creates a you need to create a new one to get a new ProgramState This immutability is key since the ExplodedGraph represents the behavior of the analyzed program from the entry point To represent these we use functional data individual Checkers work by also manipulating the analysis state The analyzer engine talks to them via a visitor interface For the | PreVisitCallExpr () method is called by ExprEngine to tell the Checker that we are about to analyze a CallExpr |
Variables | |
| and static some checkers Checker The latter are built on top of the former via the Checker and CheckerVisitor and attempts to isolate them from much of the gore of the internal analysis | engine |
| and static some checkers Checker The latter are built on top of the former via the Checker and CheckerVisitor and attempts to isolate them from much of the gore of the internal analysis the analyzer is basically a source code simulator that traces out possible paths of execution The state of the and the combination of state and program point is a node in an exploded which has the entry program point and initial | state |
| and static some checkers Checker The latter are built on top of the former via the Checker and CheckerVisitor and attempts to isolate them from much of the gore of the internal analysis the analyzer is basically a source code simulator that traces out possible paths of execution The state of the and the combination of state and program point is a node in an exploded which has the entry program point and initial and then simulate transitions by analyzing individual expressions The analysis of an expression can cause the state to | change |
| and static some checkers Checker The latter are built on top of the former via the Checker and CheckerVisitor and attempts to isolate them from much of the gore of the internal analysis the analyzer is basically a source code simulator that traces out possible paths of execution The state of the and the combination of state and program point is a node in an exploded which has the entry program point and initial and then simulate transitions by analyzing individual expressions The analysis of an expression can cause the state to resulting in a new node in the ExplodedGraph with an updated program point and an updated state A bug is found by hitting a node that satisfies some bug condition(basically a violation of a checking invariant). The analyzer traces out multiple paths by reasoning about branches and then bifurcating the state it can contain cycles as paths loop back onto each other and cache out ProgramState and ExplodedNodes are basically immutable once created Once one creates a | ProgramState |
| and static some checkers Checker The latter are built on top of the former via the Checker and CheckerVisitor and attempts to isolate them from much of the gore of the internal analysis the analyzer is basically a source code simulator that traces out possible paths of execution The state of the and the combination of state and program point is a node in an exploded which has the entry program point and initial and then simulate transitions by analyzing individual expressions The analysis of an expression can cause the state to resulting in a new node in the ExplodedGraph with an updated program point and an updated state A bug is found by hitting a node that satisfies some bug condition(basically a violation of a checking invariant). The analyzer traces out multiple paths by reasoning about branches and then bifurcating the state it can contain cycles as paths loop back onto each other and cache out ProgramState and ExplodedNodes are basically immutable once created Once one creates a you need to create a new one to get a new ProgramState This immutability is key since the ExplodedGraph represents the behavior of the analyzed program from the entry point To represent these | efficiently |
| and static some checkers Checker The latter are built on top of the former via the Checker and CheckerVisitor and attempts to isolate them from much of the gore of the internal analysis the analyzer is basically a source code simulator that traces out possible paths of execution The state of the and the combination of state and program point is a node in an exploded which has the entry program point and initial and then simulate transitions by analyzing individual expressions The analysis of an expression can cause the state to resulting in a new node in the ExplodedGraph with an updated program point and an updated state A bug is found by hitting a node that satisfies some bug condition(basically a violation of a checking invariant). The analyzer traces out multiple paths by reasoning about branches and then bifurcating the state it can contain cycles as paths loop back onto each other and cache out ProgramState and ExplodedNodes are basically immutable once created Once one creates a you need to create a new one to get a new ProgramState This immutability is key since the ExplodedGraph represents the behavior of the analyzed program from the entry point To represent these we use functional data individual Checkers work by also manipulating the analysis state The analyzer engine talks to them via a visitor interface For | example |
| and static some checkers Checker The latter are built on top of the former via the Checker and CheckerVisitor and attempts to isolate them from much of the gore of the internal analysis the analyzer is basically a source code simulator that traces out possible paths of execution The state of the and the combination of state and program point is a node in an exploded which has the entry program point and initial and then simulate transitions by analyzing individual expressions The analysis of an expression can cause the state to resulting in a new node in the ExplodedGraph with an updated program point and an updated state A bug is found by hitting a node that satisfies some bug condition(basically a violation of a checking invariant). The analyzer traces out multiple paths by reasoning about branches and then bifurcating the state it can contain cycles as paths loop back onto each other and cache out ProgramState and ExplodedNodes are basically immutable once created Once one creates a you need to create a new one to get a new ProgramState This immutability is key since the ExplodedGraph represents the behavior of the analyzed program from the entry point To represent these we use functional data individual Checkers work by also manipulating the analysis state The analyzer engine talks to them via a visitor interface For the and the checker is asked to check for any preconditions that might not be satisfied The checker can do | nothing |
| and static some checkers Checker The latter are built on top of the former via the Checker and CheckerVisitor and attempts to isolate them from much of the gore of the internal analysis the analyzer is basically a source code simulator that traces out possible paths of execution The state of the and the combination of state and program point is a node in an exploded which has the entry program point and initial and then simulate transitions by analyzing individual expressions The analysis of an expression can cause the state to resulting in a new node in the ExplodedGraph with an updated program point and an updated state A bug is found by hitting a node that satisfies some bug condition(basically a violation of a checking invariant). The analyzer traces out multiple paths by reasoning about branches and then bifurcating the state it can contain cycles as paths loop back onto each other and cache out ProgramState and ExplodedNodes are basically immutable once created Once one creates a you need to create a new one to get a new ProgramState This immutability is key since the ExplodedGraph represents the behavior of the analyzed program from the entry point To represent these we use functional data individual Checkers work by also manipulating the analysis state The analyzer engine talks to them via a visitor interface For the and the checker is asked to check for any preconditions that might not be satisfied The checker can do or it can generate a new ProgramState and ExplodedNode which contains updated checker state If it finds a | bug |
| and static some checkers Checker The latter are built on top of the former via the Checker and CheckerVisitor and attempts to isolate them from much of the gore of the internal analysis the analyzer is basically a source code simulator that traces out possible paths of execution The state of the and the combination of state and program point is a node in an exploded which has the entry program point and initial and then simulate transitions by analyzing individual expressions The analysis of an expression can cause the state to resulting in a new node in the ExplodedGraph with an updated program point and an updated state A bug is found by hitting a node that satisfies some bug condition(basically a violation of a checking invariant). The analyzer traces out multiple paths by reasoning about branches and then bifurcating the state it can contain cycles as paths loop back onto each other and cache out ProgramState and ExplodedNodes are basically immutable once created Once one creates a you need to create a new one to get a new ProgramState This immutability is key since the ExplodedGraph represents the behavior of the analyzed program from the entry point To represent these we use functional data individual Checkers work by also manipulating the analysis state The analyzer engine talks to them via a visitor interface For the and the checker is asked to check for any preconditions that might not be satisfied The checker can do or it can generate a new ProgramState and ExplodedNode which contains updated checker state If it finds a it can tell the BugReporter object about the providing it an ExplodedNode which is the last node in the path that triggered the | problem |
| and static some checkers Checker The latter are built on top of the former via the Checker and CheckerVisitor and attempts to isolate them from much of the gore of the internal analysis the analyzer is basically a source code simulator that traces out possible paths of execution The state of the and the combination of state and program point is a node in an exploded graph | ( | ExplodedGraph | ) |
|
static |
| and static some checkers Checker The latter are built on top of the former via the Checker and CheckerVisitor and attempts to isolate them from much of the gore of the internal analysis the analyzer is basically a source code simulator that traces out possible paths of execution The state of the and the combination of state and program point is a node in an exploded which has the entry program point and initial and then simulate transitions by analyzing individual expressions The analysis of an expression can cause the state to resulting in a new node in the ExplodedGraph with an updated program point and an updated state A bug is found by hitting a node that satisfies some bug condition (basically a violation of a checking invariant). The analyzer traces out multiple paths by reasoning about branches and then bifurcating the state it can contain cycles as paths loop back onto each other and cache out ProgramState and ExplodedNodes are basically immutable once created Once one creates a you need to create a new one to get a new ProgramState This immutability is key since the ExplodedGraph represents the behavior of the analyzed program from the entry point To represent these we use functional data individual Checkers work by also manipulating the analysis state The analyzer engine talks to them via a visitor interface For the PreVisitCallExpr | ( | ) |
| and static some checkers Checker The latter are built on top of the former via the Checker and CheckerVisitor and attempts to isolate them from much of the gore of the internal analysis the analyzer is basically a source code simulator that traces out possible paths of execution The state of the program | ( | values of variables and | expressions | ) |
| and static some checkers Checker The latter are built on top of the former via the Checker and CheckerVisitor and attempts to isolate them from much of the gore of the internal analysis the analyzer is basically a source code simulator that traces out possible paths of execution The state of the and the combination of state and program point is a node in an exploded which has the entry program point and initial and then simulate transitions by analyzing individual expressions The analysis of an expression can cause the state to resulting in a new node in the ExplodedGraph with an updated program point and an updated state A bug is found by hitting a node that satisfies some bug condition (basically a violation of a checking invariant). The analyzer traces out multiple paths by reasoning about branches and then bifurcating the state it can contain cycles as paths loop back onto each other and cache out ProgramState and ExplodedNodes are basically immutable once created Once one creates a you need to create a new one to get a new ProgramState This immutability is key since the ExplodedGraph represents the behavior of the analyzed program from the entry point To represent these we use functional data structures | ( | e. | g., |
| ImmutableMaps | |||
| ) |
| and static some checkers Checker The latter are built on top of the former via the Checker and CheckerVisitor and attempts to isolate them from much of the gore of the internal analysis the analyzer is basically a source code simulator that traces out possible paths of execution The state of the and the combination of state and program point is a node in an exploded which has the entry program point and initial and then simulate transitions by analyzing individual expressions The analysis of an expression can cause the state to resulting in a new node in the ExplodedGraph with an updated program point and an updated state A bug is found by hitting a node that satisfies some bug condition (basically a violation of a checking invariant). The analyzer traces out multiple paths by reasoning about branches and then bifurcating the state it can contain cycles as paths loop back onto each other and cache out ProgramState and ExplodedNodes are basically immutable once created Once one creates a you need to create a new one to get a new ProgramState This immutability is key since the ExplodedGraph represents the behavior of the analyzed program from the entry point To represent these we use functional data individual Checkers work by also manipulating the analysis state The analyzer engine talks to them via a visitor interface For the and the checker is asked to check for any preconditions that might not be satisfied The checker can do or it can generate a new ProgramState and ExplodedNode which contains updated checker state If it finds a it can tell the BugReporter object about the bug |
Definition at line 66 of file README.txt.
| and static some checkers Checker The latter are built on top of the former via the Checker and CheckerVisitor and attempts to isolate them from much of the gore of the internal analysis the analyzer is basically a source code simulator that traces out possible paths of execution The state of the and the combination of state and program point is a node in an exploded which has the entry program point and initial and then simulate transitions by analyzing individual expressions The analysis of an expression can cause the state to change |
Definition at line 32 of file README.txt.
| and static some checkers Checker The latter are built on top of the former via the Checker and CheckerVisitor and attempts to isolate them from much of the gore of the internal analysis the analyzer is basically a source code simulator that traces out possible paths of execution The state of the and the combination of state and program point is a node in an exploded which has the entry program point and initial and then simulate transitions by analyzing individual expressions The analysis of an expression can cause the state to resulting in a new node in the ExplodedGraph with an updated program point and an updated state A bug is found by hitting a node that satisfies some bug condition (basically a violation of a checking invariant). The analyzer traces out multiple paths by reasoning about branches and then bifurcating the state it can contain cycles as paths loop back onto each other and cache out ProgramState and ExplodedNodes are basically immutable once created Once one creates a you need to create a new one to get a new ProgramState This immutability is key since the ExplodedGraph represents the behavior of the analyzed program from the entry point To represent these efficiently |
Definition at line 56 of file README.txt.
| and static some checkers Checker The latter are built on top of the former via the Checker and CheckerVisitor and attempts to isolate them from much of the gore of the internal analysis engine |
Definition at line 15 of file README.txt.
| and static some checkers Checker The latter are built on top of the former via the Checker and CheckerVisitor and attempts to isolate them from much of the gore of the internal analysis the analyzer is basically a source code simulator that traces out possible paths of execution The state of the and the combination of state and program point is a node in an exploded which has the entry program point and initial and then simulate transitions by analyzing individual expressions The analysis of an expression can cause the state to resulting in a new node in the ExplodedGraph with an updated program point and an updated state A bug is found by hitting a node that satisfies some bug condition (basically a violation of a checking invariant). The analyzer traces out multiple paths by reasoning about branches and then bifurcating the state it can contain cycles as paths loop back onto each other and cache out ProgramState and ExplodedNodes are basically immutable once created Once one creates a you need to create a new one to get a new ProgramState This immutability is key since the ExplodedGraph represents the behavior of the analyzed program from the entry point To represent these we use functional data individual Checkers work by also manipulating the analysis state The analyzer engine talks to them via a visitor interface For example |
Definition at line 61 of file README.txt.
| and static some checkers Checker The latter are built on top of the former via the Checker and CheckerVisitor and attempts to isolate them from much of the gore of the internal analysis the analyzer is basically a source code simulator that traces out possible paths of execution The state of the and the combination of state and program point is a node in an exploded which has the entry program point and initial and then simulate transitions by analyzing individual expressions The analysis of an expression can cause the state to resulting in a new node in the ExplodedGraph with an updated program point and an updated state A bug is found by hitting a node that satisfies some bug condition (basically a violation of a checking invariant). The analyzer traces out multiple paths by reasoning about branches and then bifurcating the state it can contain cycles as paths loop back onto each other and cache out ProgramState and ExplodedNodes are basically immutable once created Once one creates a you need to create a new one to get a new ProgramState This immutability is key since the ExplodedGraph represents the behavior of the analyzed program from the entry point To represent these we use functional data individual Checkers work by also manipulating the analysis state The analyzer engine talks to them via a visitor interface For the and the checker is asked to check for any preconditions that might not be satisfied The checker can do nothing |
Definition at line 64 of file README.txt.
| and static some checkers Checker The latter are built on top of the former via the Checker and CheckerVisitor and attempts to isolate them from much of the gore of the internal analysis the analyzer is basically a source code simulator that traces out possible paths of execution The state of the and the combination of state and program point is a node in an exploded which has the entry program point and initial and then simulate transitions by analyzing individual expressions The analysis of an expression can cause the state to resulting in a new node in the ExplodedGraph with an updated program point and an updated state A bug is found by hitting a node that satisfies some bug condition (basically a violation of a checking invariant). The analyzer traces out multiple paths by reasoning about branches and then bifurcating the state it can contain cycles as paths loop back onto each other and cache out ProgramState and ExplodedNodes are basically immutable once created Once one creates a you need to create a new one to get a new ProgramState This immutability is key since the ExplodedGraph represents the behavior of the analyzed program from the entry point To represent these we use functional data individual Checkers work by also manipulating the analysis state The analyzer engine talks to them via a visitor interface For the and the checker is asked to check for any preconditions that might not be satisfied The checker can do or it can generate a new ProgramState and ExplodedNode which contains updated checker state If it finds a it can tell the BugReporter object about the providing it an ExplodedNode which is the last node in the path that triggered the problem |
Definition at line 70 of file README.txt.
| and static some checkers Checker The latter are built on top of the former via the Checker and CheckerVisitor and attempts to isolate them from much of the gore of the internal analysis the analyzer is basically a source code simulator that traces out possible paths of execution The state of the and the combination of state and program point is a node in an exploded which has the entry program point and initial and then simulate transitions by analyzing individual expressions The analysis of an expression can cause the state to resulting in a new node in the ExplodedGraph with an updated program point and an updated state A bug is found by hitting a node that satisfies some bug condition (basically a violation of a checking invariant). The analyzer traces out multiple paths by reasoning about branches and then bifurcating the state it can contain cycles as paths loop back onto each other and cache out ProgramState and ExplodedNodes are basically immutable once created Once one creates a ProgramState |
Definition at line 34 of file README.txt.
| and static some checkers Checker The latter are built on top of the former via the Checker and CheckerVisitor and attempts to isolate them from much of the gore of the internal analysis the analyzer is basically a source code simulator that traces out possible paths of execution The state of the and the combination of state and program point is a node in an exploded which has the entry program point and initial state |
Definition at line 30 of file README.txt.
Referenced by addSelfFlag(), addValue(), clang::ento::SValBuilder::areEqual(), clang::ento::retaincountchecker::RetainCountChecker::checkBeginFunction(), clang::ento::retaincountchecker::RetainCountChecker::checkDeadSymbols(), clang::ento::retaincountchecker::RetainCountChecker::checkEndFunction(), clang::ento::retaincountchecker::RetainCountChecker::checkPostStmt(), clang::ento::retaincountchecker::RetainCountChecker::checkRegionChanges(), clang::ento::retaincountchecker::RetainCountChecker::checkSummary(), clang::ento::ExprEngine::CreateCXXTemporaryObject(), distributeFunctionTypeAttr(), distributeFunctionTypeAttrFromDeclarator(), distributeFunctionTypeAttrFromDeclSpec(), distributeFunctionTypeAttrToInnermost(), distributeNullabilityTypeAttr(), distributeObjCPointerTypeAttr(), distributeObjCPointerTypeAttrFromDeclarator(), distributeTypeAttrsFromDeclarator(), clang::CodeGen::ConstantEmitter::emitAbstract(), clang::ento::retaincountchecker::RetainCountChecker::evalAssume(), clang::ento::SValBuilder::evalBinOp(), clang::ento::retaincountchecker::RetainCountChecker::evalCall(), clang::ento::ExprEngine::evalEagerlyAssumeBinOpBifurcation(), clang::ento::SValBuilder::evalEQ(), clang::ento::SValBuilder::evalIntegralCast(), clang::ento::ExprEngine::evalLoad(), clang::ento::ExprEngine::evalStore(), GetDeclSpecTypeForDeclarator(), GetFullTypeForDeclarator(), clang::ento::ExprEngine::getInitialState(), getSelfFlags(), clang::Sema::GetTypeForDeclaratorCast(), clang::ento::ExprEngine::handleLValueBitCast(), handleObjCOwnershipTypeAttr(), handleObjCPointerTypeAttr(), clang::ento::retaincountchecker::RetainCountChecker::handleSymbolDeath(), clang::ento::ExprEngine::handleUOExtension(), hasFlag(), isArrayIndexOutOfBounds(), IsZeroByteAllocation(), clang::ento::ProgramStateManager::iterBindings(), maybeSynthesizeBlockSignature(), clang::Sema::PopParsingClass(), clang::Sema::PopParsingDeclaration(), clang::Sema::DelayedDiagnostics::popUndelayed(), clang::Sema::DelayedDiagnostics::popWithoutEmitting(), clang::ento::ExprEngine::processAssume(), clang::ento::ExprEngine::ProcessAutomaticObjDtor(), clang::ento::ExprEngine::processCallEnter(), clang::ento::ExprEngine::processCallExit(), clang::ento::ExprEngine::processIndirectGoto(), clang::ento::retaincountchecker::RetainCountChecker::processLeaks(), clang::ento::retaincountchecker::RetainCountChecker::processObjCLiterals(), clang::ento::ExprEngine::processRegionChange(), clang::ento::ExprEngine::processRegionChanges(), clang::ento::retaincountchecker::RetainCountChecker::processSummaryOfInlined(), clang::ento::ExprEngine::processSwitch(), processTypeAttrs(), clang::ento::ExplodedNode::Profile(), clang::ento::ProgramStateRelease(), clang::ento::ProgramStateRetain(), clang::Sema::DelayedDiagnostics::push(), clang::Sema::DelayedDiagnostics::pushUndelayed(), RecoverCastedSymbol(), REGISTER_TRAIT_WITH_PROGRAMSTATE(), llvm::IntrusiveRefCntPtrInfo< const clang::ento::ProgramState >::release(), clang::ento::ProgramStateManager::removeDeadBindingsFromEnvironmentAndStore(), clang::ento::ProgramStateManager::removeGDM(), llvm::IntrusiveRefCntPtrInfo< const clang::ento::ProgramState >::retain(), clang::ento::CheckerManager::runCheckersForEvalAssume(), clang::ento::CheckerManager::runCheckersForLiveSymbols(), clang::ento::CheckerManager::runCheckersForRegionChanges(), scaleValue(), clang::ento::ScanReachableSymbols::ScanReachableSymbols(), setFlag(), clang::CodeGen::ConstantEmitter::tryEmitAbstract(), clang::CodeGen::ConstantEmitter::tryEmitAbstractForInitializer(), clang::ento::retaincountchecker::RetainCountChecker::updateSymbol(), clang::ento::ExprEngine::VisitArrayInitLoopExpr(), clang::ento::ExprEngine::VisitArraySubscriptExpr(), clang::ento::ExprEngine::VisitBinaryOperator(), clang::ento::ExprEngine::VisitCast(), clang::ento::ExprEngine::VisitCommonDeclRefExpr(), clang::ento::ExprEngine::VisitCXXCatchStmt(), clang::ento::ExprEngine::VisitCXXThisExpr(), clang::ento::ExprEngine::VisitDeclStmt(), clang::ento::ExprEngine::VisitGCCAsmStmt(), clang::ento::ExprEngine::VisitGuardedExpr(), clang::ento::ExprEngine::VisitIncrementDecrementOperator(), clang::ento::ExprEngine::VisitInitListExpr(), clang::ento::ExprEngine::VisitLogicalExpr(), clang::ento::ExprEngine::VisitLvalObjCIvarRefExpr(), clang::ento::ExprEngine::VisitMemberExpr(), clang::ento::ExprEngine::VisitUnaryExprOrTypeTraitExpr(), and clang::ento::ExprEngine::VisitUnaryOperator().
1.8.17