clang  14.0.0git
Store.cpp
Go to the documentation of this file.
1 //===- Store.cpp - Interface for maps from Locations to Values ------------===//
2 //
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6 //
7 //===----------------------------------------------------------------------===//
8 //
9 // This file defined the types Store and StoreManager.
10 //
11 //===----------------------------------------------------------------------===//
12 
14 #include "clang/AST/ASTContext.h"
16 #include "clang/AST/CharUnits.h"
17 #include "clang/AST/Decl.h"
18 #include "clang/AST/DeclCXX.h"
19 #include "clang/AST/DeclObjC.h"
20 #include "clang/AST/Expr.h"
21 #include "clang/AST/Type.h"
22 #include "clang/Basic/LLVM.h"
31 #include "llvm/ADT/APSInt.h"
32 #include "llvm/ADT/Optional.h"
33 #include "llvm/ADT/SmallVector.h"
34 #include "llvm/Support/Casting.h"
35 #include "llvm/Support/ErrorHandling.h"
36 #include <cassert>
37 #include <cstdint>
38 
39 using namespace clang;
40 using namespace ento;
41 
43  : svalBuilder(stateMgr.getSValBuilder()), StateMgr(stateMgr),
44  MRMgr(svalBuilder.getRegionManager()), Ctx(stateMgr.getContext()) {}
45 
47  const CallEvent &Call,
48  const StackFrameContext *LCtx) {
49  StoreRef Store = StoreRef(OldStore, *this);
50 
52  Call.getInitialStackFrameContents(LCtx, InitialBindings);
53 
54  for (const auto &I : InitialBindings)
55  Store = Bind(Store.getStore(), I.first.castAs<Loc>(), I.second);
56 
57  return Store;
58 }
59 
61  QualType EleTy,
62  uint64_t index) {
63  NonLoc idx = svalBuilder.makeArrayIndex(index);
64  return MRMgr.getElementRegion(EleTy, idx, Base, svalBuilder.getContext());
65 }
66 
68  QualType T) {
70  assert(!T.isNull());
71  return MRMgr.getElementRegion(T, idx, R, Ctx);
72 }
73 
75  QualType CastToTy) {
77 
78  // Handle casts to Objective-C objects.
79  if (CastToTy->isObjCObjectPointerType())
80  return R->StripCasts();
81 
82  if (CastToTy->isBlockPointerType()) {
83  // FIXME: We may need different solutions, depending on the symbol
84  // involved. Blocks can be casted to/from 'id', as they can be treated
85  // as Objective-C objects. This could possibly be handled by enhancing
86  // our reasoning of downcasts of symbolic objects.
87  if (isa<CodeTextRegion, SymbolicRegion>(R))
88  return R;
89 
90  // We don't know what to make of it. Return a NULL region, which
91  // will be interpreted as UnknownVal.
92  return None;
93  }
94 
95  // Now assume we are casting from pointer to pointer. Other cases should
96  // already be handled.
97  QualType PointeeTy = CastToTy->getPointeeType();
98  QualType CanonPointeeTy = Ctx.getCanonicalType(PointeeTy);
99 
100  // Handle casts to void*. We just pass the region through.
101  if (CanonPointeeTy.getLocalUnqualifiedType() == Ctx.VoidTy)
102  return R;
103 
104  // Handle casts from compatible types.
105  if (R->isBoundable())
106  if (const auto *TR = dyn_cast<TypedValueRegion>(R)) {
107  QualType ObjTy = Ctx.getCanonicalType(TR->getValueType());
108  if (CanonPointeeTy == ObjTy)
109  return R;
110  }
111 
112  // Process region cast according to the kind of the region being cast.
113  switch (R->getKind()) {
114  case MemRegion::CXXThisRegionKind:
115  case MemRegion::CodeSpaceRegionKind:
116  case MemRegion::StackLocalsSpaceRegionKind:
117  case MemRegion::StackArgumentsSpaceRegionKind:
118  case MemRegion::HeapSpaceRegionKind:
119  case MemRegion::UnknownSpaceRegionKind:
120  case MemRegion::StaticGlobalSpaceRegionKind:
121  case MemRegion::GlobalInternalSpaceRegionKind:
122  case MemRegion::GlobalSystemSpaceRegionKind:
123  case MemRegion::GlobalImmutableSpaceRegionKind: {
124  llvm_unreachable("Invalid region cast");
125  }
126 
127  case MemRegion::FunctionCodeRegionKind:
128  case MemRegion::BlockCodeRegionKind:
129  case MemRegion::BlockDataRegionKind:
130  case MemRegion::StringRegionKind:
131  // FIXME: Need to handle arbitrary downcasts.
132  case MemRegion::SymbolicRegionKind:
133  case MemRegion::AllocaRegionKind:
134  case MemRegion::CompoundLiteralRegionKind:
135  case MemRegion::FieldRegionKind:
136  case MemRegion::ObjCIvarRegionKind:
137  case MemRegion::ObjCStringRegionKind:
138  case MemRegion::NonParamVarRegionKind:
139  case MemRegion::ParamVarRegionKind:
140  case MemRegion::CXXTempObjectRegionKind:
141  case MemRegion::CXXBaseObjectRegionKind:
142  case MemRegion::CXXDerivedObjectRegionKind:
143  return MakeElementRegion(cast<SubRegion>(R), PointeeTy);
144 
145  case MemRegion::ElementRegionKind: {
146  // If we are casting from an ElementRegion to another type, the
147  // algorithm is as follows:
148  //
149  // (1) Compute the "raw offset" of the ElementRegion from the
150  // base region. This is done by calling 'getAsRawOffset()'.
151  //
152  // (2a) If we get a 'RegionRawOffset' after calling
153  // 'getAsRawOffset()', determine if the absolute offset
154  // can be exactly divided into chunks of the size of the
155  // casted-pointee type. If so, create a new ElementRegion with
156  // the pointee-cast type as the new ElementType and the index
157  // being the offset divded by the chunk size. If not, create
158  // a new ElementRegion at offset 0 off the raw offset region.
159  //
160  // (2b) If we don't a get a 'RegionRawOffset' after calling
161  // 'getAsRawOffset()', it means that we are at offset 0.
162  //
163  // FIXME: Handle symbolic raw offsets.
164 
165  const ElementRegion *elementR = cast<ElementRegion>(R);
166  const RegionRawOffset &rawOff = elementR->getAsArrayOffset();
167  const MemRegion *baseR = rawOff.getRegion();
168 
169  // If we cannot compute a raw offset, throw up our hands and return
170  // a NULL MemRegion*.
171  if (!baseR)
172  return None;
173 
174  CharUnits off = rawOff.getOffset();
175 
176  if (off.isZero()) {
177  // Edge case: we are at 0 bytes off the beginning of baseR. We
178  // check to see if type we are casting to is the same as the base
179  // region. If so, just return the base region.
180  if (const auto *TR = dyn_cast<TypedValueRegion>(baseR)) {
181  QualType ObjTy = Ctx.getCanonicalType(TR->getValueType());
182  QualType CanonPointeeTy = Ctx.getCanonicalType(PointeeTy);
183  if (CanonPointeeTy == ObjTy)
184  return baseR;
185  }
186 
187  // Otherwise, create a new ElementRegion at offset 0.
188  return MakeElementRegion(cast<SubRegion>(baseR), PointeeTy);
189  }
190 
191  // We have a non-zero offset from the base region. We want to determine
192  // if the offset can be evenly divided by sizeof(PointeeTy). If so,
193  // we create an ElementRegion whose index is that value. Otherwise, we
194  // create two ElementRegions, one that reflects a raw offset and the other
195  // that reflects the cast.
196 
197  // Compute the index for the new ElementRegion.
198  int64_t newIndex = 0;
199  const MemRegion *newSuperR = nullptr;
200 
201  // We can only compute sizeof(PointeeTy) if it is a complete type.
202  if (!PointeeTy->isIncompleteType()) {
203  // Compute the size in **bytes**.
204  CharUnits pointeeTySize = Ctx.getTypeSizeInChars(PointeeTy);
205  if (!pointeeTySize.isZero()) {
206  // Is the offset a multiple of the size? If so, we can layer the
207  // ElementRegion (with elementType == PointeeTy) directly on top of
208  // the base region.
209  if (off % pointeeTySize == 0) {
210  newIndex = off / pointeeTySize;
211  newSuperR = baseR;
212  }
213  }
214  }
215 
216  if (!newSuperR) {
217  // Create an intermediate ElementRegion to represent the raw byte.
218  // This will be the super region of the final ElementRegion.
219  newSuperR = MakeElementRegion(cast<SubRegion>(baseR), Ctx.CharTy,
220  off.getQuantity());
221  }
222 
223  return MakeElementRegion(cast<SubRegion>(newSuperR), PointeeTy, newIndex);
224  }
225  }
226 
227  llvm_unreachable("unreachable");
228 }
229 
230 static bool regionMatchesCXXRecordType(SVal V, QualType Ty) {
231  const MemRegion *MR = V.getAsRegion();
232  if (!MR)
233  return true;
234 
235  const auto *TVR = dyn_cast<TypedValueRegion>(MR);
236  if (!TVR)
237  return true;
238 
239  const CXXRecordDecl *RD = TVR->getValueType()->getAsCXXRecordDecl();
240  if (!RD)
241  return true;
242 
244  if (!Expected)
246 
247  return Expected->getCanonicalDecl() == RD->getCanonicalDecl();
248 }
249 
251  // Sanity check to avoid doing the wrong thing in the face of
252  // reinterpret_cast.
253  if (!regionMatchesCXXRecordType(Derived, Cast->getSubExpr()->getType()))
254  return UnknownVal();
255 
256  // Walk through the cast path to create nested CXXBaseRegions.
257  SVal Result = Derived;
258  for (CastExpr::path_const_iterator I = Cast->path_begin(),
259  E = Cast->path_end();
260  I != E; ++I) {
261  Result = evalDerivedToBase(Result, (*I)->getType(), (*I)->isVirtual());
262  }
263  return Result;
264 }
265 
267  // Walk through the path to create nested CXXBaseRegions.
268  SVal Result = Derived;
269  for (const auto &I : Path)
270  Result = evalDerivedToBase(Result, I.Base->getType(),
271  I.Base->isVirtual());
272  return Result;
273 }
274 
275 SVal StoreManager::evalDerivedToBase(SVal Derived, QualType BaseType,
276  bool IsVirtual) {
277  const MemRegion *DerivedReg = Derived.getAsRegion();
278  if (!DerivedReg)
279  return Derived;
280 
281  const CXXRecordDecl *BaseDecl = BaseType->getPointeeCXXRecordDecl();
282  if (!BaseDecl)
283  BaseDecl = BaseType->getAsCXXRecordDecl();
284  assert(BaseDecl && "not a C++ object?");
285 
286  if (const auto *AlreadyDerivedReg =
287  dyn_cast<CXXDerivedObjectRegion>(DerivedReg)) {
288  if (const auto *SR =
289  dyn_cast<SymbolicRegion>(AlreadyDerivedReg->getSuperRegion()))
290  if (SR->getSymbol()->getType()->getPointeeCXXRecordDecl() == BaseDecl)
291  return loc::MemRegionVal(SR);
292 
293  DerivedReg = AlreadyDerivedReg->getSuperRegion();
294  }
295 
296  const MemRegion *BaseReg = MRMgr.getCXXBaseObjectRegion(
297  BaseDecl, cast<SubRegion>(DerivedReg), IsVirtual);
298 
299  return loc::MemRegionVal(BaseReg);
300 }
301 
302 /// Returns the static type of the given region, if it represents a C++ class
303 /// object.
304 ///
305 /// This handles both fully-typed regions, where the dynamic type is known, and
306 /// symbolic regions, where the dynamic type is merely bounded (and even then,
307 /// only ostensibly!), but does not take advantage of any dynamic type info.
308 static const CXXRecordDecl *getCXXRecordType(const MemRegion *MR) {
309  if (const auto *TVR = dyn_cast<TypedValueRegion>(MR))
310  return TVR->getValueType()->getAsCXXRecordDecl();
311  if (const auto *SR = dyn_cast<SymbolicRegion>(MR))
312  return SR->getSymbol()->getType()->getPointeeCXXRecordDecl();
313  return nullptr;
314 }
315 
317  bool &Failed) {
318  Failed = false;
319 
320  const MemRegion *MR = Base.getAsRegion();
321  if (!MR)
322  return UnknownVal();
323 
324  // Assume the derived class is a pointer or a reference to a CXX record.
325  TargetType = TargetType->getPointeeType();
326  assert(!TargetType.isNull());
327  const CXXRecordDecl *TargetClass = TargetType->getAsCXXRecordDecl();
328  if (!TargetClass && !TargetType->isVoidType())
329  return UnknownVal();
330 
331  // Drill down the CXXBaseObject chains, which represent upcasts (casts from
332  // derived to base).
333  while (const CXXRecordDecl *MRClass = getCXXRecordType(MR)) {
334  // If found the derived class, the cast succeeds.
335  if (MRClass == TargetClass)
336  return loc::MemRegionVal(MR);
337 
338  // We skip over incomplete types. They must be the result of an earlier
339  // reinterpret_cast, as one can only dynamic_cast between types in the same
340  // class hierarchy.
341  if (!TargetType->isVoidType() && MRClass->hasDefinition()) {
342  // Static upcasts are marked as DerivedToBase casts by Sema, so this will
343  // only happen when multiple or virtual inheritance is involved.
344  CXXBasePaths Paths(/*FindAmbiguities=*/false, /*RecordPaths=*/true,
345  /*DetectVirtual=*/false);
346  if (MRClass->isDerivedFrom(TargetClass, Paths))
347  return evalDerivedToBase(loc::MemRegionVal(MR), Paths.front());
348  }
349 
350  if (const auto *BaseR = dyn_cast<CXXBaseObjectRegion>(MR)) {
351  // Drill down the chain to get the derived classes.
352  MR = BaseR->getSuperRegion();
353  continue;
354  }
355 
356  // If this is a cast to void*, return the region.
357  if (TargetType->isVoidType())
358  return loc::MemRegionVal(MR);
359 
360  // Strange use of reinterpret_cast can give us paths we don't reason
361  // about well, by putting in ElementRegions where we'd expect
362  // CXXBaseObjectRegions. If it's a valid reinterpret_cast (i.e. if the
363  // derived class has a zero offset from the base class), then it's safe
364  // to strip the cast; if it's invalid, -Wreinterpret-base-class should
365  // catch it. In the interest of performance, the analyzer will silently
366  // do the wrong thing in the invalid case (because offsets for subregions
367  // will be wrong).
368  const MemRegion *Uncasted = MR->StripCasts(/*IncludeBaseCasts=*/false);
369  if (Uncasted == MR) {
370  // We reached the bottom of the hierarchy and did not find the derived
371  // class. We must be casting the base to derived, so the cast should
372  // fail.
373  break;
374  }
375 
376  MR = Uncasted;
377  }
378 
379  // If we're casting a symbolic base pointer to a derived class, use
380  // CXXDerivedObjectRegion to represent the cast. If it's a pointer to an
381  // unrelated type, it must be a weird reinterpret_cast and we have to
382  // be fine with ElementRegion. TODO: Should we instead make
383  // Derived{TargetClass, Element{SourceClass, SR}}?
384  if (const auto *SR = dyn_cast<SymbolicRegion>(MR)) {
385  QualType T = SR->getSymbol()->getType();
386  const CXXRecordDecl *SourceClass = T->getPointeeCXXRecordDecl();
387  if (TargetClass && SourceClass && TargetClass->isDerivedFrom(SourceClass))
388  return loc::MemRegionVal(
389  MRMgr.getCXXDerivedObjectRegion(TargetClass, SR));
390  return loc::MemRegionVal(GetElementZeroRegion(SR, TargetType));
391  }
392 
393  // We failed if the region we ended up with has perfect type info.
394  Failed = isa<TypedValueRegion>(MR);
395  return UnknownVal();
396 }
397 
398 SVal StoreManager::getLValueFieldOrIvar(const Decl *D, SVal Base) {
399  if (Base.isUnknownOrUndef())
400  return Base;
401 
402  Loc BaseL = Base.castAs<Loc>();
403  const SubRegion* BaseR = nullptr;
404 
405  switch (BaseL.getSubKind()) {
406  case loc::MemRegionValKind:
407  BaseR = cast<SubRegion>(BaseL.castAs<loc::MemRegionVal>().getRegion());
408  break;
409 
410  case loc::GotoLabelKind:
411  // These are anormal cases. Flag an undefined value.
412  return UndefinedVal();
413 
414  case loc::ConcreteIntKind:
415  // While these seem funny, this can happen through casts.
416  // FIXME: What we should return is the field offset, not base. For example,
417  // add the field offset to the integer value. That way things
418  // like this work properly: &(((struct foo *) 0xa)->f)
419  // However, that's not easy to fix without reducing our abilities
420  // to catch null pointer dereference. Eg., ((struct foo *)0x0)->f = 7
421  // is a null dereference even though we're dereferencing offset of f
422  // rather than null. Coming up with an approach that computes offsets
423  // over null pointers properly while still being able to catch null
424  // dereferences might be worth it.
425  return Base;
426 
427  default:
428  llvm_unreachable("Unhandled Base.");
429  }
430 
431  // NOTE: We must have this check first because ObjCIvarDecl is a subclass
432  // of FieldDecl.
433  if (const auto *ID = dyn_cast<ObjCIvarDecl>(D))
434  return loc::MemRegionVal(MRMgr.getObjCIvarRegion(ID, BaseR));
435 
436  return loc::MemRegionVal(MRMgr.getFieldRegion(cast<FieldDecl>(D), BaseR));
437 }
438 
440  return getLValueFieldOrIvar(decl, base);
441 }
442 
444  SVal Base) {
445 
446  // Special case, if index is 0, return the same type as if
447  // this was not an array dereference.
448  if (Offset.isZeroConstant()) {
449  QualType BT = Base.getType(this->Ctx);
450  if (!BT.isNull() && !elementType.isNull()) {
451  QualType PointeeTy = BT->getPointeeType();
452  if (!PointeeTy.isNull() &&
453  PointeeTy.getCanonicalType() == elementType.getCanonicalType())
454  return Base;
455  }
456  }
457 
458  // If the base is an unknown or undefined value, just return it back.
459  // FIXME: For absolute pointer addresses, we just return that value back as
460  // well, although in reality we should return the offset added to that
461  // value. See also the similar FIXME in getLValueFieldOrIvar().
462  if (Base.isUnknownOrUndef() || Base.getAs<loc::ConcreteInt>())
463  return Base;
464 
465  if (Base.getAs<loc::GotoLabel>())
466  return UnknownVal();
467 
468  const SubRegion *BaseRegion =
469  Base.castAs<loc::MemRegionVal>().getRegionAs<SubRegion>();
470 
471  // Pointer of any type can be cast and used as array base.
472  const auto *ElemR = dyn_cast<ElementRegion>(BaseRegion);
473 
474  // Convert the offset to the appropriate size and signedness.
476 
477  if (!ElemR) {
478  // If the base region is not an ElementRegion, create one.
479  // This can happen in the following example:
480  //
481  // char *p = __builtin_alloc(10);
482  // p[1] = 8;
483  //
484  // Observe that 'p' binds to an AllocaRegion.
485  return loc::MemRegionVal(MRMgr.getElementRegion(elementType, Offset,
486  BaseRegion, Ctx));
487  }
488 
489  SVal BaseIdx = ElemR->getIndex();
490 
491  if (!BaseIdx.getAs<nonloc::ConcreteInt>())
492  return UnknownVal();
493 
494  const llvm::APSInt &BaseIdxI =
495  BaseIdx.castAs<nonloc::ConcreteInt>().getValue();
496 
497  // Only allow non-integer offsets if the base region has no offset itself.
498  // FIXME: This is a somewhat arbitrary restriction. We should be using
499  // SValBuilder here to add the two offsets without checking their types.
500  if (!Offset.getAs<nonloc::ConcreteInt>()) {
501  if (isa<ElementRegion>(BaseRegion->StripCasts()))
502  return UnknownVal();
503 
505  elementType, Offset, cast<SubRegion>(ElemR->getSuperRegion()), Ctx));
506  }
507 
508  const llvm::APSInt& OffI = Offset.castAs<nonloc::ConcreteInt>().getValue();
509  assert(BaseIdxI.isSigned());
510 
511  // Compute the new index.
512  nonloc::ConcreteInt NewIdx(svalBuilder.getBasicValueFactory().getValue(BaseIdxI +
513  OffI));
514 
515  // Construct the new ElementRegion.
516  const SubRegion *ArrayR = cast<SubRegion>(ElemR->getSuperRegion());
517  return loc::MemRegionVal(MRMgr.getElementRegion(elementType, NewIdx, ArrayR,
518  Ctx));
519 }
520 
522 
524  Store store,
525  const MemRegion* R,
526  SVal val) {
527  SymbolRef SymV = val.getAsLocSymbol();
528  if (!SymV || SymV != Sym)
529  return true;
530 
531  if (Binding) {
532  First = false;
533  return false;
534  }
535  else
536  Binding = R;
537 
538  return true;
539 }
clang::ASTContext::getTypeSizeInChars
CharUnits getTypeSizeInChars(QualType T) const
Return the size of the specified (complete) type T, in characters.
Definition: ASTContext.cpp:2450
clang::ento::StoreManager::Ctx
ASTContext & Ctx
Definition: Store.h:60
clang::ento::UndefinedVal
Definition: SVals.h:224
clang::ento::MemRegionManager::getObjCIvarRegion
const ObjCIvarRegion * getObjCIvarRegion(const ObjCIvarDecl *ivd, const SubRegion *superRegion)
getObjCIvarRegion - Retrieve or create the memory region associated with a specified Objective-c inst...
Definition: MemRegion.cpp:1172
clang::ento::StoreManager::getLValueElement
virtual SVal getLValueElement(QualType elementType, NonLoc offset, SVal Base)
Definition: Store.cpp:443
clang::Type::isBlockPointerType
bool isBlockPointerType() const
Definition: Type.h:6680
SVals.h
clang::ento::SVal::castAs
T castAs() const
Convert to the specified SVal type, asserting that this SVal is of the desired type.
Definition: SVals.h:103
clang::ento::NonLoc
Definition: SVals.h:305
clang::ento::SVal::getAsRegion
const MemRegion * getAsRegion() const
Definition: SVals.cpp:131
clang::ASTContext::VoidTy
CanQualType VoidTy
Definition: ASTContext.h:1075
llvm::SmallVector
Definition: LLVM.h:38
clang::ento::MemRegion::StripCasts
const MemRegion * StripCasts(bool StripBaseAndDerivedCasts=true) const
Definition: MemRegion.cpp:1328
CXXInheritance.h
clang::ento::StoreManager::StoreManager
StoreManager(ProgramStateManager &stateMgr)
Definition: Store.cpp:42
clang::QualType
A (possibly-)qualified type.
Definition: Type.h:673
clang::QualType::getCanonicalType
QualType getCanonicalType() const
Definition: Type.h:6463
DeclCXX.h
regionMatchesCXXRecordType
static bool regionMatchesCXXRecordType(SVal V, QualType Ty)
Definition: Store.cpp:230
clang::ento::StoreManager::enterStackFrame
StoreRef enterStackFrame(Store store, const CallEvent &Call, const StackFrameContext *CalleeCtx)
enterStackFrame - Let the StoreManager to do something when execution engine is about to execute into...
Definition: Store.cpp:46
clang::ento::loc::GotoLabel
Definition: SVals.h:582
llvm::Optional
Definition: LLVM.h:40
clang::StackFrameContext
It represents a stack frame of the call stack (based on CallEvent).
Definition: AnalysisDeclContext.h:295
clang::Type::isVoidType
bool isVoidType() const
Definition: Type.h:6955
clang::ento::nonloc::ConcreteInt
Value representing integer constant.
Definition: SVals.h:386
clang::ento::MemRegionManager::getCXXDerivedObjectRegion
const CXXDerivedObjectRegion * getCXXDerivedObjectRegion(const CXXRecordDecl *BaseClass, const SubRegion *Super)
Create a CXXDerivedObjectRegion with the given derived class for region Super.
Definition: MemRegion.cpp:1228
llvm::Expected
Definition: LLVM.h:41
clang::ento::StoreManager::evalDerivedToBase
SVal evalDerivedToBase(SVal Derived, const CastExpr *Cast)
Evaluates a chain of derived-to-base casts through the path specified in Cast.
Definition: Store.cpp:250
clang::ento::UnknownVal
Definition: SVals.h:257
clang::ento::loc::MemRegionVal
Definition: SVals.h:606
clang::ento::loc::ConcreteInt
Definition: SVals.h:648
clang::ento::Store
const void * Store
Store - This opaque type encapsulates an immutable mapping from locations to values.
Definition: StoreRef.h:27
clang::ento::StoreManager
Definition: Store.h:53
clang::ento::SVal::getAs
Optional< T > getAs() const
Convert to the specified SVal type, returning None if this SVal is not of the desired type.
Definition: SVals.h:111
getValue
static SVal getValue(SVal val, SValBuilder &svalBuilder)
Definition: ArrayBoundCheckerV2.cpp:277
Decl.h
clang::ento::MemRegionManager::getCXXBaseObjectRegion
const CXXBaseObjectRegion * getCXXBaseObjectRegion(const CXXRecordDecl *BaseClass, const SubRegion *Super, bool IsVirtual)
Create a CXXBaseObjectRegion with the given base class for region Super.
Definition: MemRegion.cpp:1208
CallEvent.h
DeclObjC.h
Offset
unsigned Offset
Definition: Format.cpp:2335
clang::ento::MemRegion
MemRegion - The root abstract class for all memory regions.
Definition: MemRegion.h:94
APSInt
llvm::APSInt APSInt
Definition: ByteCodeEmitter.cpp:19
clang::ento::SVal::getAsLocSymbol
SymbolRef getAsLocSymbol(bool IncludeBaseRegions=false) const
If this SVal is a location and wraps a symbol, return that SymbolRef.
Definition: SVals.cpp:87
clang::ento::MemRegionManager::getFieldRegion
const FieldRegion * getFieldRegion(const FieldDecl *fd, const SubRegion *superRegion)
getFieldRegion - Retrieve or create the memory region associated with a specified FieldDecl.
Definition: MemRegion.cpp:1166
clang::ento::StoreManager::BindingsHandler::~BindingsHandler
virtual ~BindingsHandler()
SymExpr.h
V
#define V(N, I)
Definition: ASTContext.h:3121
clang::ento::ProgramStateManager::getContext
ASTContext & getContext()
Definition: ProgramState.h:506
clang::ento::MemRegion::isBoundable
virtual bool isBoundable() const
Definition: MemRegion.h:174
clang::ento::SValBuilder::getContext
ASTContext & getContext()
Definition: SValBuilder.h:168
clang::ento::StoreManager::FindUniqueBinding::HandleBinding
bool HandleBinding(StoreManager &SMgr, Store store, const MemRegion *R, SVal val) override
Definition: Store.cpp:523
clang::ASTContext
Holds long-lived AST nodes (such as types and decls) that can be referred to throughout the semantic ...
Definition: ASTContext.h:212
clang::ento::SymExpr
Symbolic value.
Definition: SymExpr.h:29
clang::ento::StoreRef
Definition: StoreRef.h:29
Store.h
clang::ento::SValBuilder::makeZeroArrayIndex
NonLoc makeZeroArrayIndex()
Definition: SValBuilder.h:291
clang::ento::SValBuilder::convertToArrayIndex
SVal convertToArrayIndex(SVal val)
Definition: SValBuilder.cpp:109
clang::Type::getPointeeCXXRecordDecl
const CXXRecordDecl * getPointeeCXXRecordDecl() const
If this is a pointer or reference to a RecordType, return the CXXRecordDecl that the type refers to.
Definition: Type.cpp:1745
clang::ento::MemRegionManager::getElementRegion
const ElementRegion * getElementRegion(QualType elementType, NonLoc Idx, const SubRegion *superRegion, ASTContext &Ctx)
getElementRegion - Retrieve the memory region associated with the associated element type,...
Definition: MemRegion.cpp:1123
Type.h
Expr.h
clang::interp::Cast
bool Cast(InterpState &S, CodePtr OpPC)
Definition: Interp.h:802
ASTContext.h
clang::ento::SValBuilder::getBasicValueFactory
BasicValueFactory & getBasicValueFactory()
Definition: SValBuilder.h:181
clang::Type::getPointeeType
QualType getPointeeType() const
If this is a pointer, ObjC object pointer, or block pointer, this returns the respective pointee.
Definition: Type.cpp:625
clang::ASTContext::getCanonicalType
CanQualType getCanonicalType(QualType T) const
Return the canonical (structural) type corresponding to the specified potentially non-canonical type ...
Definition: ASTContext.h:2468
clang::CXXRecordDecl::isDerivedFrom
bool isDerivedFrom(const CXXRecordDecl *Base) const
Determine whether this class is derived from the class Base.
Definition: CXXInheritance.cpp:68
clang::Type::getAsCXXRecordDecl
CXXRecordDecl * getAsCXXRecordDecl() const
Retrieves the CXXRecordDecl that this type refers to, either because the type is a RecordType or beca...
Definition: Type.cpp:1760
clang::ento::RegionRawOffset::getOffset
CharUnits getOffset() const
Definition: MemRegion.h:1133
clang::ento::MemRegion::getKind
Kind getKind() const
Definition: MemRegion.h:169
clang::ento::ElementRegion
ElementRegion is used to represent both array elements and casts.
Definition: MemRegion.h:1141
Base
BasicValueFactory.h
clang::ento::Loc
Definition: SVals.h:327
CharUnits.h
clang::Type::isObjCObjectPointerType
bool isObjCObjectPointerType() const
Definition: Type.h:6794
clang::CXXRecordDecl
Represents a C++ struct/union/class.
Definition: DeclCXX.h:255
clang::ento::StoreManager::getLValueIvar
virtual SVal getLValueIvar(const ObjCIvarDecl *decl, SVal base)
Definition: Store.cpp:439
clang::ast_matchers::decl
const internal::VariadicAllOfMatcher< Decl > decl
Matches declarations.
Definition: ASTMatchersInternal.cpp:734
clang::CastExpr::path_const_iterator
const typedef CXXBaseSpecifier *const * path_const_iterator
Definition: Expr.h:3541
clang::ento::StoreManager::MakeElementRegion
const ElementRegion * MakeElementRegion(const SubRegion *baseRegion, QualType pointeeTy, uint64_t index=0)
Definition: Store.cpp:60
clang::ento::ProgramStateManager
Definition: ProgramState.h:463
SValBuilder.h
clang::QualType::getLocalUnqualifiedType
QualType getLocalUnqualifiedType() const
Return this type with all of the instance-specific qualifiers removed, but without removing any quali...
Definition: Type.h:912
clang::ento::StoreManager::svalBuilder
SValBuilder & svalBuilder
Definition: Store.h:55
clang::CharUnits::isZero
bool isZero() const
isZero - Test whether the quantity equals zero.
Definition: CharUnits.h:116
clang::QualType::isNull
bool isNull() const
Return true if this QualType doesn't point to a type yet.
Definition: Type.h:738
clang::Decl
Decl - This represents one declaration (or definition), e.g.
Definition: DeclBase.h:89
LLVM.h
clang::ASTContext::CharTy
CanQualType CharTy
Definition: ASTContext.h:1077
clang::ento::RegionRawOffset
Definition: MemRegion.h:1122
clang::ento::SVal::getSubKind
unsigned getSubKind() const
Definition: SVals.h:119
clang::ento::StoreManager::castRegion
Optional< const MemRegion * > castRegion(const MemRegion *region, QualType CastToTy)
castRegion - Used by ExprEngine::VisitCast to handle casts from a MemRegion* to a specific location t...
Definition: Store.cpp:74
getCXXRecordType
static const CXXRecordDecl * getCXXRecordType(const MemRegion *MR)
Returns the static type of the given region, if it represents a C++ class object.
Definition: Store.cpp:308
clang::ento::StoreManager::Bind
virtual StoreRef Bind(Store store, Loc loc, SVal val)=0
Return a store with the specified value bound to the given location.
clang::ento::StoreManager::StateMgr
ProgramStateManager & StateMgr
Definition: Store.h:56
ProgramState.h
clang::ento::RegionRawOffset::getRegion
const MemRegion * getRegion() const
Definition: MemRegion.h:1134
clang::Builtin::ID
ID
Definition: Builtins.h:48
clang::CXXBasePath
Represents a path from a specific derived class (which is not represented as part of the path) to a p...
Definition: CXXInheritance.h:70
clang
Definition: CalledOnceCheck.h:17
clang::ento::StoreManager::attemptDownCast
SVal attemptDownCast(SVal Base, QualType DerivedPtrType, bool &Failed)
Attempts to do a down cast.
Definition: Store.cpp:316
clang::ObjCIvarDecl
ObjCIvarDecl - Represents an ObjC instance variable.
Definition: DeclObjC.h:1924
clang::CXXRecordDecl::getCanonicalDecl
CXXRecordDecl * getCanonicalDecl() override
Retrieves the "canonical" declaration of the given declaration.
Definition: DeclCXX.h:494
clang::ento::CallEvent
Represents an abstract call to a function or method along a particular path.
Definition: CallEvent.h:143
MemRegion.h
clang::ento::SValBuilder::makeArrayIndex
NonLoc makeArrayIndex(uint64_t idx)
Definition: SValBuilder.h:295
clang::CXXBasePaths
BasePaths - Represents the set of paths from a derived class to one of its (direct or indirect) bases...
Definition: CXXInheritance.h:117
clang::ento::SVal
SVal - This represents a symbolic expression, which can be either an L-value or an R-value.
Definition: SVals.h:75
clang::CharUnits
CharUnits - This is an opaque type for sizes expressed in character units.
Definition: CharUnits.h:38
clang::ento::SubRegion
SubRegion - A region that subsets another larger region.
Definition: MemRegion.h:435
clang::Type::isIncompleteType
bool isIncompleteType(NamedDecl **Def=nullptr) const
Types are partitioned into 3 broad categories (C99 6.2.5p1): object types, function types,...
Definition: Type.cpp:2217
clang::CastExpr
CastExpr - Base class for type casts, including both implicit casts (ImplicitCastExpr) and explicit c...
Definition: Expr.h:3473
clang::ento::StoreManager::GetElementZeroRegion
const ElementRegion * GetElementZeroRegion(const SubRegion *R, QualType T)
Definition: Store.cpp:67
StoreRef.h
clang::CharUnits::getQuantity
QuantityType getQuantity() const
getQuantity - Get the raw integer representation of this quantity.
Definition: CharUnits.h:179
clang::ento::ElementRegion::getAsArrayOffset
RegionRawOffset getAsArrayOffset() const
Compute the offset within the array. The array might also be a subobject.
Definition: MemRegion.cpp:1362
clang::ento::loc::MemRegionVal::getRegion
const MemRegion * getRegion() const
Get the underlining region.
Definition: SVals.h:613
clang::ento::StoreManager::MRMgr
MemRegionManager & MRMgr
MRMgr - Manages region objects associated with this StoreManager.
Definition: Store.h:59