clang  16.0.0git
SymbolManager.h
Go to the documentation of this file.
1 //===- SymbolManager.h - Management of Symbolic Values ----------*- C++ -*-===//
2 //
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6 //
7 //===----------------------------------------------------------------------===//
8 //
9 // This file defines SymbolManager, a class that manages symbolic values
10 // created for use by ExprEngine and related classes.
11 //
12 //===----------------------------------------------------------------------===//
13 
14 #ifndef LLVM_CLANG_STATICANALYZER_CORE_PATHSENSITIVE_SYMBOLMANAGER_H
15 #define LLVM_CLANG_STATICANALYZER_CORE_PATHSENSITIVE_SYMBOLMANAGER_H
16 
17 #include "clang/AST/Expr.h"
18 #include "clang/AST/Type.h"
20 #include "clang/Basic/LLVM.h"
24 #include "llvm/ADT/DenseMap.h"
25 #include "llvm/ADT/DenseSet.h"
26 #include "llvm/ADT/FoldingSet.h"
27 #include "llvm/Support/Allocator.h"
28 #include <cassert>
29 
30 namespace clang {
31 
32 class ASTContext;
33 class Stmt;
34 
35 namespace ento {
36 
37 class BasicValueFactory;
38 class StoreManager;
39 
40 ///A symbol representing the value stored at a MemRegion.
41 class SymbolRegionValue : public SymbolData {
42  const TypedValueRegion *R;
43 
44 public:
46  : SymbolData(SymbolRegionValueKind, sym), R(r) {
47  assert(r);
48  assert(isValidTypeForSymbol(r->getValueType()));
49  }
50 
51  LLVM_ATTRIBUTE_RETURNS_NONNULL
52  const TypedValueRegion* getRegion() const { return R; }
53 
54  static void Profile(llvm::FoldingSetNodeID& profile, const TypedValueRegion* R) {
55  profile.AddInteger((unsigned) SymbolRegionValueKind);
56  profile.AddPointer(R);
57  }
58 
59  void Profile(llvm::FoldingSetNodeID& profile) override {
60  Profile(profile, R);
61  }
62 
63  StringRef getKindStr() const override;
64 
65  void dumpToStream(raw_ostream &os) const override;
66  const MemRegion *getOriginRegion() const override { return getRegion(); }
67 
68  QualType getType() const override;
69 
70  // Implement isa<T> support.
71  static bool classof(const SymExpr *SE) {
72  return SE->getKind() == SymbolRegionValueKind;
73  }
74 };
75 
76 /// A symbol representing the result of an expression in the case when we do
77 /// not know anything about what the expression is.
78 class SymbolConjured : public SymbolData {
79  const Stmt *S;
80  QualType T;
81  unsigned Count;
82  const LocationContext *LCtx;
83  const void *SymbolTag;
84 
85 public:
86  SymbolConjured(SymbolID sym, const Stmt *s, const LocationContext *lctx,
87  QualType t, unsigned count, const void *symbolTag)
88  : SymbolData(SymbolConjuredKind, sym), S(s), T(t), Count(count),
89  LCtx(lctx), SymbolTag(symbolTag) {
90  // FIXME: 's' might be a nullptr if we're conducting invalidation
91  // that was caused by a destructor call on a temporary object,
92  // which has no statement associated with it.
93  // Due to this, we might be creating the same invalidation symbol for
94  // two different invalidation passes (for two different temporaries).
95  assert(lctx);
96  assert(isValidTypeForSymbol(t));
97  }
98 
99  /// It might return null.
100  const Stmt *getStmt() const { return S; }
101  unsigned getCount() const { return Count; }
102  /// It might return null.
103  const void *getTag() const { return SymbolTag; }
104 
105  QualType getType() const override;
106 
107  StringRef getKindStr() const override;
108 
109  void dumpToStream(raw_ostream &os) const override;
110 
111  static void Profile(llvm::FoldingSetNodeID& profile, const Stmt *S,
112  QualType T, unsigned Count, const LocationContext *LCtx,
113  const void *SymbolTag) {
114  profile.AddInteger((unsigned) SymbolConjuredKind);
115  profile.AddPointer(S);
116  profile.AddPointer(LCtx);
117  profile.Add(T);
118  profile.AddInteger(Count);
119  profile.AddPointer(SymbolTag);
120  }
121 
122  void Profile(llvm::FoldingSetNodeID& profile) override {
123  Profile(profile, S, T, Count, LCtx, SymbolTag);
124  }
125 
126  // Implement isa<T> support.
127  static bool classof(const SymExpr *SE) {
128  return SE->getKind() == SymbolConjuredKind;
129  }
130 };
131 
132 /// A symbol representing the value of a MemRegion whose parent region has
133 /// symbolic value.
134 class SymbolDerived : public SymbolData {
135  SymbolRef parentSymbol;
136  const TypedValueRegion *R;
137 
138 public:
140  : SymbolData(SymbolDerivedKind, sym), parentSymbol(parent), R(r) {
141  assert(parent);
142  assert(r);
143  assert(isValidTypeForSymbol(r->getValueType()));
144  }
145 
146  LLVM_ATTRIBUTE_RETURNS_NONNULL
147  SymbolRef getParentSymbol() const { return parentSymbol; }
148  LLVM_ATTRIBUTE_RETURNS_NONNULL
149  const TypedValueRegion *getRegion() const { return R; }
150 
151  QualType getType() const override;
152 
153  StringRef getKindStr() const override;
154 
155  void dumpToStream(raw_ostream &os) const override;
156  const MemRegion *getOriginRegion() const override { return getRegion(); }
157 
158  static void Profile(llvm::FoldingSetNodeID& profile, SymbolRef parent,
159  const TypedValueRegion *r) {
160  profile.AddInteger((unsigned) SymbolDerivedKind);
161  profile.AddPointer(r);
162  profile.AddPointer(parent);
163  }
164 
165  void Profile(llvm::FoldingSetNodeID& profile) override {
166  Profile(profile, parentSymbol, R);
167  }
168 
169  // Implement isa<T> support.
170  static bool classof(const SymExpr *SE) {
171  return SE->getKind() == SymbolDerivedKind;
172  }
173 };
174 
175 /// SymbolExtent - Represents the extent (size in bytes) of a bounded region.
176 /// Clients should not ask the SymbolManager for a region's extent. Always use
177 /// SubRegion::getExtent instead -- the value returned may not be a symbol.
178 class SymbolExtent : public SymbolData {
179  const SubRegion *R;
180 
181 public:
183  : SymbolData(SymbolExtentKind, sym), R(r) {
184  assert(r);
185  }
186 
187  LLVM_ATTRIBUTE_RETURNS_NONNULL
188  const SubRegion *getRegion() const { return R; }
189 
190  QualType getType() const override;
191 
192  StringRef getKindStr() const override;
193 
194  void dumpToStream(raw_ostream &os) const override;
195 
196  static void Profile(llvm::FoldingSetNodeID& profile, const SubRegion *R) {
197  profile.AddInteger((unsigned) SymbolExtentKind);
198  profile.AddPointer(R);
199  }
200 
201  void Profile(llvm::FoldingSetNodeID& profile) override {
202  Profile(profile, R);
203  }
204 
205  // Implement isa<T> support.
206  static bool classof(const SymExpr *SE) {
207  return SE->getKind() == SymbolExtentKind;
208  }
209 };
210 
211 /// SymbolMetadata - Represents path-dependent metadata about a specific region.
212 /// Metadata symbols remain live as long as they are marked as in use before
213 /// dead-symbol sweeping AND their associated regions are still alive.
214 /// Intended for use by checkers.
215 class SymbolMetadata : public SymbolData {
216  const MemRegion* R;
217  const Stmt *S;
218  QualType T;
219  const LocationContext *LCtx;
220  unsigned Count;
221  const void *Tag;
222 
223 public:
224  SymbolMetadata(SymbolID sym, const MemRegion* r, const Stmt *s, QualType t,
225  const LocationContext *LCtx, unsigned count, const void *tag)
226  : SymbolData(SymbolMetadataKind, sym), R(r), S(s), T(t), LCtx(LCtx),
227  Count(count), Tag(tag) {
228  assert(r);
229  assert(s);
230  assert(isValidTypeForSymbol(t));
231  assert(LCtx);
232  assert(tag);
233  }
234 
235  LLVM_ATTRIBUTE_RETURNS_NONNULL
236  const MemRegion *getRegion() const { return R; }
237 
238  LLVM_ATTRIBUTE_RETURNS_NONNULL
239  const Stmt *getStmt() const { return S; }
240 
241  LLVM_ATTRIBUTE_RETURNS_NONNULL
242  const LocationContext *getLocationContext() const { return LCtx; }
243 
244  unsigned getCount() const { return Count; }
245 
246  LLVM_ATTRIBUTE_RETURNS_NONNULL
247  const void *getTag() const { return Tag; }
248 
249  QualType getType() const override;
250 
251  StringRef getKindStr() const override;
252 
253  void dumpToStream(raw_ostream &os) const override;
254 
255  static void Profile(llvm::FoldingSetNodeID &profile, const MemRegion *R,
256  const Stmt *S, QualType T, const LocationContext *LCtx,
257  unsigned Count, const void *Tag) {
258  profile.AddInteger((unsigned)SymbolMetadataKind);
259  profile.AddPointer(R);
260  profile.AddPointer(S);
261  profile.Add(T);
262  profile.AddPointer(LCtx);
263  profile.AddInteger(Count);
264  profile.AddPointer(Tag);
265  }
266 
267  void Profile(llvm::FoldingSetNodeID& profile) override {
268  Profile(profile, R, S, T, LCtx, Count, Tag);
269  }
270 
271  // Implement isa<T> support.
272  static bool classof(const SymExpr *SE) {
273  return SE->getKind() == SymbolMetadataKind;
274  }
275 };
276 
277 /// Represents a cast expression.
278 class SymbolCast : public SymExpr {
279  const SymExpr *Operand;
280 
281  /// Type of the operand.
282  QualType FromTy;
283 
284  /// The type of the result.
285  QualType ToTy;
286 
287 public:
288  SymbolCast(const SymExpr *In, QualType From, QualType To)
289  : SymExpr(SymbolCastKind), Operand(In), FromTy(From), ToTy(To) {
290  assert(In);
291  assert(isValidTypeForSymbol(From));
292  // FIXME: GenericTaintChecker creates symbols of void type.
293  // Otherwise, 'To' should also be a valid type.
294  }
295 
296  unsigned computeComplexity() const override {
297  if (Complexity == 0)
298  Complexity = 1 + Operand->computeComplexity();
299  return Complexity;
300  }
301 
302  QualType getType() const override { return ToTy; }
303 
304  LLVM_ATTRIBUTE_RETURNS_NONNULL
305  const SymExpr *getOperand() const { return Operand; }
306 
307  void dumpToStream(raw_ostream &os) const override;
308 
309  static void Profile(llvm::FoldingSetNodeID& ID,
310  const SymExpr *In, QualType From, QualType To) {
311  ID.AddInteger((unsigned) SymbolCastKind);
312  ID.AddPointer(In);
313  ID.Add(From);
314  ID.Add(To);
315  }
316 
317  void Profile(llvm::FoldingSetNodeID& ID) override {
318  Profile(ID, Operand, FromTy, ToTy);
319  }
320 
321  // Implement isa<T> support.
322  static bool classof(const SymExpr *SE) {
323  return SE->getKind() == SymbolCastKind;
324  }
325 };
326 
327 /// Represents a symbolic expression involving a unary operator.
328 class UnarySymExpr : public SymExpr {
329  const SymExpr *Operand;
331  QualType T;
332 
333 public:
335  : SymExpr(UnarySymExprKind), Operand(In), Op(Op), T(T) {
336  // Note, some unary operators are modeled as a binary operator. E.g. ++x is
337  // modeled as x + 1.
338  assert((Op == UO_Minus || Op == UO_Not) && "non-supported unary expression");
339  // Unary expressions are results of arithmetic. Pointer arithmetic is not
340  // handled by unary expressions, but it is instead handled by applying
341  // sub-regions to regions.
342  assert(isValidTypeForSymbol(T) && "non-valid type for unary symbol");
343  assert(!Loc::isLocType(T) && "unary symbol should be nonloc");
344  }
345 
346  unsigned computeComplexity() const override {
347  if (Complexity == 0)
348  Complexity = 1 + Operand->computeComplexity();
349  return Complexity;
350  }
351 
352  const SymExpr *getOperand() const { return Operand; }
353  UnaryOperator::Opcode getOpcode() const { return Op; }
354  QualType getType() const override { return T; }
355 
356  void dumpToStream(raw_ostream &os) const override;
357 
358  static void Profile(llvm::FoldingSetNodeID &ID, const SymExpr *In,
360  ID.AddInteger((unsigned)UnarySymExprKind);
361  ID.AddPointer(In);
362  ID.AddInteger(Op);
363  ID.Add(T);
364  }
365 
366  void Profile(llvm::FoldingSetNodeID &ID) override {
367  Profile(ID, Operand, Op, T);
368  }
369 
370  // Implement isa<T> support.
371  static bool classof(const SymExpr *SE) {
372  return SE->getKind() == UnarySymExprKind;
373  }
374 };
375 
376 /// Represents a symbolic expression involving a binary operator
377 class BinarySymExpr : public SymExpr {
379  QualType T;
380 
381 protected:
383  : SymExpr(k), Op(op), T(t) {
384  assert(classof(this));
385  // Binary expressions are results of arithmetic. Pointer arithmetic is not
386  // handled by binary expressions, but it is instead handled by applying
387  // sub-regions to regions.
388  assert(isValidTypeForSymbol(t) && !Loc::isLocType(t));
389  }
390 
391 public:
392  // FIXME: We probably need to make this out-of-line to avoid redundant
393  // generation of virtual functions.
394  QualType getType() const override { return T; }
395 
396  BinaryOperator::Opcode getOpcode() const { return Op; }
397 
398  // Implement isa<T> support.
399  static bool classof(const SymExpr *SE) {
400  Kind k = SE->getKind();
401  return k >= BEGIN_BINARYSYMEXPRS && k <= END_BINARYSYMEXPRS;
402  }
403 
404 protected:
405  static unsigned computeOperandComplexity(const SymExpr *Value) {
406  return Value->computeComplexity();
407  }
408  static unsigned computeOperandComplexity(const llvm::APSInt &Value) {
409  return 1;
410  }
411 
412  static const llvm::APSInt *getPointer(const llvm::APSInt &Value) {
413  return &Value;
414  }
415  static const SymExpr *getPointer(const SymExpr *Value) { return Value; }
416 
417  static void dumpToStreamImpl(raw_ostream &os, const SymExpr *Value);
418  static void dumpToStreamImpl(raw_ostream &os, const llvm::APSInt &Value);
419  static void dumpToStreamImpl(raw_ostream &os, BinaryOperator::Opcode op);
420 };
421 
422 /// Template implementation for all binary symbolic expressions
423 template <class LHSTYPE, class RHSTYPE, SymExpr::Kind ClassKind>
425  LHSTYPE LHS;
426  RHSTYPE RHS;
427 
428 public:
429  BinarySymExprImpl(LHSTYPE lhs, BinaryOperator::Opcode op, RHSTYPE rhs,
430  QualType t)
431  : BinarySymExpr(ClassKind, op, t), LHS(lhs), RHS(rhs) {
432  assert(getPointer(lhs));
433  assert(getPointer(rhs));
434  }
435 
436  void dumpToStream(raw_ostream &os) const override {
437  dumpToStreamImpl(os, LHS);
439  dumpToStreamImpl(os, RHS);
440  }
441 
442  LHSTYPE getLHS() const { return LHS; }
443  RHSTYPE getRHS() const { return RHS; }
444 
445  unsigned computeComplexity() const override {
446  if (Complexity == 0)
447  Complexity =
449  return Complexity;
450  }
451 
452  static void Profile(llvm::FoldingSetNodeID &ID, LHSTYPE lhs,
453  BinaryOperator::Opcode op, RHSTYPE rhs, QualType t) {
454  ID.AddInteger((unsigned)ClassKind);
455  ID.AddPointer(getPointer(lhs));
456  ID.AddInteger(op);
457  ID.AddPointer(getPointer(rhs));
458  ID.Add(t);
459  }
460 
461  void Profile(llvm::FoldingSetNodeID &ID) override {
462  Profile(ID, LHS, getOpcode(), RHS, getType());
463  }
464 
465  // Implement isa<T> support.
466  static bool classof(const SymExpr *SE) { return SE->getKind() == ClassKind; }
467 };
468 
469 /// Represents a symbolic expression like 'x' + 3.
470 using SymIntExpr = BinarySymExprImpl<const SymExpr *, const llvm::APSInt &,
471  SymExpr::Kind::SymIntExprKind>;
472 
473 /// Represents a symbolic expression like 3 - 'x'.
474 using IntSymExpr = BinarySymExprImpl<const llvm::APSInt &, const SymExpr *,
475  SymExpr::Kind::IntSymExprKind>;
476 
477 /// Represents a symbolic expression like 'x' + 'y'.
478 using SymSymExpr = BinarySymExprImpl<const SymExpr *, const SymExpr *,
479  SymExpr::Kind::SymSymExprKind>;
480 
482  using DataSetTy = llvm::FoldingSet<SymExpr>;
483  using SymbolDependTy =
484  llvm::DenseMap<SymbolRef, std::unique_ptr<SymbolRefSmallVectorTy>>;
485 
486  DataSetTy DataSet;
487 
488  /// Stores the extra dependencies between symbols: the data should be kept
489  /// alive as long as the key is live.
490  SymbolDependTy SymbolDependencies;
491 
492  unsigned SymbolCounter = 0;
493  llvm::BumpPtrAllocator& BPAlloc;
494  BasicValueFactory &BV;
495  ASTContext &Ctx;
496 
497 public:
499  llvm::BumpPtrAllocator& bpalloc)
500  : SymbolDependencies(16), BPAlloc(bpalloc), BV(bv), Ctx(ctx) {}
501 
502  static bool canSymbolicate(QualType T);
503 
504  /// Make a unique symbol for MemRegion R according to its kind.
506 
507  const SymbolConjured* conjureSymbol(const Stmt *E,
508  const LocationContext *LCtx,
509  QualType T,
510  unsigned VisitCount,
511  const void *SymbolTag = nullptr);
512 
514  const LocationContext *LCtx,
515  unsigned VisitCount,
516  const void *SymbolTag = nullptr) {
517  return conjureSymbol(E, LCtx, E->getType(), VisitCount, SymbolTag);
518  }
519 
520  const SymbolDerived *getDerivedSymbol(SymbolRef parentSymbol,
521  const TypedValueRegion *R);
522 
523  const SymbolExtent *getExtentSymbol(const SubRegion *R);
524 
525  /// Creates a metadata symbol associated with a specific region.
526  ///
527  /// VisitCount can be used to differentiate regions corresponding to
528  /// different loop iterations, thus, making the symbol path-dependent.
529  const SymbolMetadata *getMetadataSymbol(const MemRegion *R, const Stmt *S,
530  QualType T,
531  const LocationContext *LCtx,
532  unsigned VisitCount,
533  const void *SymbolTag = nullptr);
534 
535  const SymbolCast* getCastSymbol(const SymExpr *Operand,
536  QualType From, QualType To);
537 
539  const llvm::APSInt& rhs, QualType t);
540 
542  const llvm::APSInt& rhs, QualType t) {
543  return getSymIntExpr(&lhs, op, rhs, t);
544  }
545 
546  const IntSymExpr *getIntSymExpr(const llvm::APSInt& lhs,
548  const SymExpr *rhs, QualType t);
549 
551  const SymExpr *rhs, QualType t);
552 
553  const UnarySymExpr *getUnarySymExpr(const SymExpr *operand,
555 
556  QualType getType(const SymExpr *SE) const {
557  return SE->getType();
558  }
559 
560  /// Add artificial symbol dependency.
561  ///
562  /// The dependent symbol should stay alive as long as the primary is alive.
563  void addSymbolDependency(const SymbolRef Primary, const SymbolRef Dependent);
564 
566 
567  ASTContext &getContext() { return Ctx; }
568  BasicValueFactory &getBasicVals() { return BV; }
569 };
570 
571 /// A class responsible for cleaning up unused symbols.
573  enum SymbolStatus {
574  NotProcessed,
575  HaveMarkedDependents
576  };
577 
579  using SymbolMapTy = llvm::DenseMap<SymbolRef, SymbolStatus>;
581 
582  SymbolMapTy TheLiving;
583  SymbolSetTy MetadataInUse;
584 
585  RegionSetTy RegionRoots;
586 
587  const StackFrameContext *LCtx;
588  const Stmt *Loc;
589  SymbolManager& SymMgr;
590  StoreRef reapedStore;
591  llvm::DenseMap<const MemRegion *, unsigned> includedRegionCache;
592 
593 public:
594  /// Construct a reaper object, which removes everything which is not
595  /// live before we execute statement s in the given location context.
596  ///
597  /// If the statement is NULL, everything is this and parent contexts is
598  /// considered live.
599  /// If the stack frame context is NULL, everything on stack is considered
600  /// dead.
601  SymbolReaper(const StackFrameContext *Ctx, const Stmt *s,
602  SymbolManager &symmgr, StoreManager &storeMgr)
603  : LCtx(Ctx), Loc(s), SymMgr(symmgr), reapedStore(nullptr, storeMgr) {}
604 
605  /// It might return null.
606  const LocationContext *getLocationContext() const { return LCtx; }
607 
608  bool isLive(SymbolRef sym);
609  bool isLiveRegion(const MemRegion *region);
610  bool isLive(const Expr *ExprVal, const LocationContext *LCtx) const;
611  bool isLive(const VarRegion *VR, bool includeStoreBindings = false) const;
612 
613  /// Unconditionally marks a symbol as live.
614  ///
615  /// This should never be
616  /// used by checkers, only by the state infrastructure such as the store and
617  /// environment. Checkers should instead use metadata symbols and markInUse.
618  void markLive(SymbolRef sym);
619 
620  /// Marks a symbol as important to a checker.
621  ///
622  /// For metadata symbols,
623  /// this will keep the symbol alive as long as its associated region is also
624  /// live. For other symbols, this has no effect; checkers are not permitted
625  /// to influence the life of other symbols. This should be used before any
626  /// symbol marking has occurred, i.e. in the MarkLiveSymbols callback.
627  void markInUse(SymbolRef sym);
628 
629  using region_iterator = RegionSetTy::const_iterator;
630 
631  region_iterator region_begin() const { return RegionRoots.begin(); }
632  region_iterator region_end() const { return RegionRoots.end(); }
633 
634  /// Returns whether or not a symbol has been confirmed dead.
635  ///
636  /// This should only be called once all marking of dead symbols has completed.
637  /// (For checkers, this means only in the checkDeadSymbols callback.)
638  bool isDead(SymbolRef sym) {
639  return !isLive(sym);
640  }
641 
642  void markLive(const MemRegion *region);
643  void markElementIndicesLive(const MemRegion *region);
644 
645  /// Set to the value of the symbolic store after
646  /// StoreManager::removeDeadBindings has been called.
647  void setReapedStore(StoreRef st) { reapedStore = st; }
648 
649 private:
650  /// Mark the symbols dependent on the input symbol as live.
651  void markDependentsLive(SymbolRef sym);
652 };
653 
655 protected:
656  ~SymbolVisitor() = default;
657 
658 public:
659  SymbolVisitor() = default;
660  SymbolVisitor(const SymbolVisitor &) = default;
662 
663  /// A visitor method invoked by ProgramStateManager::scanReachableSymbols.
664  ///
665  /// The method returns \c true if symbols should continue be scanned and \c
666  /// false otherwise.
667  virtual bool VisitSymbol(SymbolRef sym) = 0;
668  virtual bool VisitMemRegion(const MemRegion *) { return true; }
669 };
670 
671 } // namespace ento
672 
673 } // namespace clang
674 
675 #endif // LLVM_CLANG_STATICANALYZER_CORE_PATHSENSITIVE_SYMBOLMANAGER_H
clang::ento::SymbolCast::getOperand
const LLVM_ATTRIBUTE_RETURNS_NONNULL SymExpr * getOperand() const
Definition: SymbolManager.h:305
clang::ento::Loc::isLocType
static bool isLocType(QualType T)
Definition: SVals.h:290
clang::ento::SymbolCast::dumpToStream
void dumpToStream(raw_ostream &os) const override
Definition: SymbolManager.cpp:67
clang::ento::SymbolManager::conjureSymbol
const SymbolConjured * conjureSymbol(const Stmt *E, const LocationContext *LCtx, QualType T, unsigned VisitCount, const void *SymbolTag=nullptr)
clang::ento::BinarySymExprImpl::getLHS
LHSTYPE getLHS() const
Definition: SymbolManager.h:442
clang::ento::SymbolVisitor
Definition: SymbolManager.h:654
clang::ento::BasicValueFactory
Definition: BasicValueFactory.h:113
clang::ento::SymbolManager::getUnarySymExpr
const UnarySymExpr * getUnarySymExpr(const SymExpr *operand, UnaryOperator::Opcode op, QualType t)
Definition: SymbolManager.cpp:322
clang::LocationContext
It wraps the AnalysisDeclContext to represent both the call stack with the help of StackFrameContext ...
Definition: AnalysisDeclContext.h:215
clang::ento::SymExpr::Complexity
unsigned Complexity
Definition: SymExpr.h:51
clang::ento::SymbolCast::Profile
void Profile(llvm::FoldingSetNodeID &ID) override
Definition: SymbolManager.h:317
clang::ento::SymbolConjured::getTag
const void * getTag() const
It might return null.
Definition: SymbolManager.h:103
AnalysisDeclContext.h
clang::ento::SymbolManager::getIntSymExpr
const IntSymExpr * getIntSymExpr(const llvm::APSInt &lhs, BinaryOperator::Opcode op, const SymExpr *rhs, QualType t)
Definition: SymbolManager.cpp:286
llvm::SmallVector
Definition: LLVM.h:38
clang::ento::SymbolDerived::getRegion
const LLVM_ATTRIBUTE_RETURNS_NONNULL TypedValueRegion * getRegion() const
Definition: SymbolManager.h:149
clang::ento::SymbolDerived::getParentSymbol
LLVM_ATTRIBUTE_RETURNS_NONNULL SymbolRef getParentSymbol() const
Definition: SymbolManager.h:147
clang::ento::UnarySymExpr::Profile
static void Profile(llvm::FoldingSetNodeID &ID, const SymExpr *In, UnaryOperator::Opcode Op, QualType T)
Definition: SymbolManager.h:358
clang::ento::SymbolExtent::getRegion
const LLVM_ATTRIBUTE_RETURNS_NONNULL SubRegion * getRegion() const
Definition: SymbolManager.h:188
clang::ento::BinarySymExpr::dumpToStreamImpl
static void dumpToStreamImpl(raw_ostream &os, const SymExpr *Value)
clang::ento::SymbolReaper::region_iterator
RegionSetTy::const_iterator region_iterator
Definition: SymbolManager.h:629
clang::ento::SymbolManager::getSymSymExpr
const SymSymExpr * getSymSymExpr(const SymExpr *lhs, BinaryOperator::Opcode op, const SymExpr *rhs, QualType t)
Definition: SymbolManager.cpp:304
clang::ento::SymbolManager::SymbolManager
SymbolManager(ASTContext &ctx, BasicValueFactory &bv, llvm::BumpPtrAllocator &bpalloc)
Definition: SymbolManager.h:498
clang::QualType
A (possibly-)qualified type.
Definition: Type.h:737
clang::ento::SymbolManager::getBasicVals
BasicValueFactory & getBasicVals()
Definition: SymbolManager.h:568
clang::ento::SymbolDerived::getKindStr
StringRef getKindStr() const override
Get a string representation of the kind of the region.
Definition: SymbolManager.cpp:39
clang::ento::BinarySymExpr
Represents a symbolic expression involving a binary operator.
Definition: SymbolManager.h:377
clang::ento::SymbolCast::getType
QualType getType() const override
Definition: SymbolManager.h:302
clang::ento::SymbolExtent::SymbolExtent
SymbolExtent(SymbolID sym, const SubRegion *r)
Definition: SymbolManager.h:182
clang::ento::SymbolRegionValue::getRegion
const LLVM_ATTRIBUTE_RETURNS_NONNULL TypedValueRegion * getRegion() const
Definition: SymbolManager.h:52
clang::ento::SymbolMetadata::getCount
unsigned getCount() const
Definition: SymbolManager.h:244
clang::ento::BinarySymExprImpl::classof
static bool classof(const SymExpr *SE)
Definition: SymbolManager.h:466
clang::ento::SymbolDerived::dumpToStream
void dumpToStream(raw_ostream &os) const override
Definition: SymbolManager.cpp:92
clang::ento::SymbolManager::conjureSymbol
const SymbolConjured * conjureSymbol(const Expr *E, const LocationContext *LCtx, unsigned VisitCount, const void *SymbolTag=nullptr)
Definition: SymbolManager.h:513
clang::StackFrameContext
It represents a stack frame of the call stack (based on CallEvent).
Definition: AnalysisDeclContext.h:299
clang::ento::BinarySymExprImpl::BinarySymExprImpl
BinarySymExprImpl(LHSTYPE lhs, BinaryOperator::Opcode op, RHSTYPE rhs, QualType t)
Definition: SymbolManager.h:429
clang::ento::SymbolMetadata::dumpToStream
void dumpToStream(raw_ostream &os) const override
Definition: SymbolManager.cpp:101
clang::ento::SymbolConjured
A symbol representing the result of an expression in the case when we do not know anything about what...
Definition: SymbolManager.h:78
clang::ento::UnarySymExpr::getType
QualType getType() const override
Definition: SymbolManager.h:354
clang::ento::StoreManager
Definition: Store.h:53
clang::ento::SymbolMetadata::getLocationContext
const LLVM_ATTRIBUTE_RETURNS_NONNULL LocationContext * getLocationContext() const
Definition: SymbolManager.h:242
clang::ento::SymbolCast
Represents a cast expression.
Definition: SymbolManager.h:278
clang::ento::SymbolVisitor::VisitMemRegion
virtual bool VisitMemRegion(const MemRegion *)
Definition: SymbolManager.h:668
clang::ento::SymbolMetadata::getTag
const LLVM_ATTRIBUTE_RETURNS_NONNULL void * getTag() const
Definition: SymbolManager.h:247
clang::ento::MemRegion
MemRegion - The root abstract class for all memory regions.
Definition: MemRegion.h:95
APSInt
llvm::APSInt APSInt
Definition: ByteCodeEmitter.cpp:19
clang::ento::SymbolManager::getCastSymbol
const SymbolCast * getCastSymbol(const SymExpr *Operand, QualType From, QualType To)
Definition: SymbolManager.cpp:253
SymExpr.h
clang::ento::SymbolReaper::isDead
bool isDead(SymbolRef sym)
Returns whether or not a symbol has been confirmed dead.
Definition: SymbolManager.h:638
clang::ento::SymbolConjured::getCount
unsigned getCount() const
Definition: SymbolManager.h:101
clang::ento::UnarySymExpr::getOpcode
UnaryOperator::Opcode getOpcode() const
Definition: SymbolManager.h:353
clang::ento::SymbolMetadata::SymbolMetadata
SymbolMetadata(SymbolID sym, const MemRegion *r, const Stmt *s, QualType t, const LocationContext *LCtx, unsigned count, const void *tag)
Definition: SymbolManager.h:224
clang::ento::SymbolManager::getContext
ASTContext & getContext()
Definition: SymbolManager.h:567
clang::ento::SymbolExtent::getType
QualType getType() const override
Definition: SymbolManager.cpp:346
clang::ento::SymbolManager::addSymbolDependency
void addSymbolDependency(const SymbolRef Primary, const SymbolRef Dependent)
Add artificial symbol dependency.
Definition: SymbolManager.cpp:374
clang::ento::BinarySymExpr::getType
QualType getType() const override
Definition: SymbolManager.h:394
clang::ento::SymbolManager::getDerivedSymbol
const SymbolDerived * getDerivedSymbol(SymbolRef parentSymbol, const TypedValueRegion *R)
Definition: SymbolManager.cpp:202
clang::ento::SymExpr::getType
virtual QualType getType() const =0
clang::ento::BinarySymExpr::BinarySymExpr
BinarySymExpr(Kind k, BinaryOperator::Opcode op, QualType t)
Definition: SymbolManager.h:382
clang::ento::SymbolReaper::markInUse
void markInUse(SymbolRef sym)
Marks a symbol as important to a checker.
Definition: SymbolManager.cpp:429
clang::ento::SymbolMetadata::getKindStr
StringRef getKindStr() const override
Get a string representation of the kind of the region.
Definition: SymbolManager.cpp:41
clang::ento::UnarySymExpr::Profile
void Profile(llvm::FoldingSetNodeID &ID) override
Definition: SymbolManager.h:366
clang::ASTContext
Holds long-lived AST nodes (such as types and decls) that can be referred to throughout the semantic ...
Definition: ASTContext.h:209
clang::ento::SymbolCast::computeComplexity
unsigned computeComplexity() const override
Definition: SymbolManager.h:296
clang::ento::SymExpr
Symbolic value.
Definition: SymExpr.h:29
clang::ento::StoreRef
Definition: StoreRef.h:29
clang::ento::SymbolDerived::Profile
void Profile(llvm::FoldingSetNodeID &profile) override
Definition: SymbolManager.h:165
clang::ento::SymbolManager::getSymIntExpr
const SymIntExpr * getSymIntExpr(const SymExpr &lhs, BinaryOperator::Opcode op, const llvm::APSInt &rhs, QualType t)
Definition: SymbolManager.h:541
clang::ento::SymbolRegionValue
A symbol representing the value stored at a MemRegion.
Definition: SymbolManager.h:41
clang::ento::SymbolRegionValue::classof
static bool classof(const SymExpr *SE)
Definition: SymbolManager.h:71
clang::ento::BinarySymExpr::getOpcode
BinaryOperator::Opcode getOpcode() const
Definition: SymbolManager.h:396
clang::ento::SymbolConjured::dumpToStream
void dumpToStream(raw_ostream &os) const override
Definition: SymbolManager.cpp:83
clang::ento::VarRegion
Definition: MemRegion.h:940
Type.h
Expr.h
clang::ento::SymbolConjured::classof
static bool classof(const SymExpr *SE)
Definition: SymbolManager.h:127
clang::ento::BinarySymExpr::computeOperandComplexity
static unsigned computeOperandComplexity(const llvm::APSInt &Value)
Definition: SymbolManager.h:408
clang::ento::SymbolReaper::setReapedStore
void setReapedStore(StoreRef st)
Set to the value of the symbolic store after StoreManager::removeDeadBindings has been called.
Definition: SymbolManager.h:647
clang::ento::SymbolReaper
A class responsible for cleaning up unused symbols.
Definition: SymbolManager.h:572
llvm::DenseSet< SymbolRef >
clang::ento::SymbolReaper::markElementIndicesLive
void markElementIndicesLive(const MemRegion *region)
Definition: SymbolManager.cpp:418
clang::ento::SymbolExtent
SymbolExtent - Represents the extent (size in bytes) of a bounded region.
Definition: SymbolManager.h:178
clang::ento::SymExpr::getKind
Kind getKind() const
Definition: SymExpr.h:56
clang::ento::SymbolMetadata::Profile
static void Profile(llvm::FoldingSetNodeID &profile, const MemRegion *R, const Stmt *S, QualType T, const LocationContext *LCtx, unsigned Count, const void *Tag)
Definition: SymbolManager.h:255
clang::ento::SymbolExtent::Profile
void Profile(llvm::FoldingSetNodeID &profile) override
Definition: SymbolManager.h:201
clang::ento::SymbolReaper::isLiveRegion
bool isLiveRegion(const MemRegion *region)
Definition: SymbolManager.cpp:434
clang::ento::BinarySymExprImpl::computeComplexity
unsigned computeComplexity() const override
Definition: SymbolManager.h:445
clang::ento::SymbolVisitor::SymbolVisitor
SymbolVisitor(SymbolVisitor &&)
Definition: SymbolManager.h:661
clang::ento::Loc
Definition: SVals.h:282
clang::ento::SymbolExtent::dumpToStream
void dumpToStream(raw_ostream &os) const override
Definition: SymbolManager.cpp:97
clang::ento::SymbolMetadata::Profile
void Profile(llvm::FoldingSetNodeID &profile) override
Definition: SymbolManager.h:267
clang::ento::SymbolDerived::getType
QualType getType() const override
Definition: SymbolManager.cpp:342
clang::ento::SymbolReaper::region_begin
region_iterator region_begin() const
Definition: SymbolManager.h:631
clang::ento::SymbolRegionValue::SymbolRegionValue
SymbolRegionValue(SymbolID sym, const TypedValueRegion *r)
Definition: SymbolManager.h:45
clang::ento::SymbolManager::getMetadataSymbol
const SymbolMetadata * getMetadataSymbol(const MemRegion *R, const Stmt *S, QualType T, const LocationContext *LCtx, unsigned VisitCount, const void *SymbolTag=nullptr)
Creates a metadata symbol associated with a specific region.
Definition: SymbolManager.cpp:235
clang::ento::SymbolManager::getDependentSymbols
const SymbolRefSmallVectorTy * getDependentSymbols(const SymbolRef Primary)
Definition: SymbolManager.cpp:383
clang::ento::SymbolReaper::getLocationContext
const LocationContext * getLocationContext() const
It might return null.
Definition: SymbolManager.h:606
clang::ento::BinarySymExprImpl
Template implementation for all binary symbolic expressions.
Definition: SymbolManager.h:424
clang::ento::SymbolManager::getSymIntExpr
const SymIntExpr * getSymIntExpr(const SymExpr *lhs, BinaryOperator::Opcode op, const llvm::APSInt &rhs, QualType t)
clang::ento::SymbolMetadata::getType
QualType getType() const override
Definition: SymbolManager.cpp:351
clang::ento::SymbolManager::getRegionValueSymbol
const SymbolRegionValue * getRegionValueSymbol(const TypedValueRegion *R)
Make a unique symbol for MemRegion R according to its kind.
Definition: SymbolManager.cpp:167
clang::ento::BinarySymExpr::getPointer
static const SymExpr * getPointer(const SymExpr *Value)
Definition: SymbolManager.h:415
clang::ento::SymIntExpr
BinarySymExprImpl< const SymExpr *, const llvm::APSInt &, SymExpr::Kind::SymIntExprKind > SymIntExpr
Represents a symbolic expression like 'x' + 3.
Definition: SymbolManager.h:471
clang::ento::SymbolExtent::getKindStr
StringRef getKindStr() const override
Get a string representation of the kind of the region.
Definition: SymbolManager.cpp:40
clang::ento::SymbolRegionValue::getType
QualType getType() const override
Definition: SymbolManager.cpp:355
clang::ento::SymbolExtent::Profile
static void Profile(llvm::FoldingSetNodeID &profile, const SubRegion *R)
Definition: SymbolManager.h:196
clang::ento::BinarySymExprImpl::Profile
void Profile(llvm::FoldingSetNodeID &ID) override
Definition: SymbolManager.h:461
Value
Value
Definition: UninitializedValues.cpp:102
clang::ento::SymbolVisitor::SymbolVisitor
SymbolVisitor()=default
clang::ento::BinarySymExprImpl::Profile
static void Profile(llvm::FoldingSetNodeID &ID, LHSTYPE lhs, BinaryOperator::Opcode op, RHSTYPE rhs, QualType t)
Definition: SymbolManager.h:452
clang::ento::SymbolDerived::classof
static bool classof(const SymExpr *SE)
Definition: SymbolManager.h:170
clang::ento::SymbolConjured::getKindStr
StringRef getKindStr() const override
Get a string representation of the kind of the region.
Definition: SymbolManager.cpp:38
clang::ento::UnarySymExpr
Represents a symbolic expression involving a unary operator.
Definition: SymbolManager.h:328
LLVM.h
clang::ento::SymbolRegionValue::getOriginRegion
const MemRegion * getOriginRegion() const override
Find the region from which this symbol originates.
Definition: SymbolManager.h:66
clang::UnaryOperatorKind
UnaryOperatorKind
Definition: OperationKinds.h:30
clang::ento::SymbolCast::SymbolCast
SymbolCast(const SymExpr *In, QualType From, QualType To)
Definition: SymbolManager.h:288
clang::ento::SymbolDerived::Profile
static void Profile(llvm::FoldingSetNodeID &profile, SymbolRef parent, const TypedValueRegion *r)
Definition: SymbolManager.h:158
clang::ento::SymbolConjured::getStmt
const Stmt * getStmt() const
It might return null.
Definition: SymbolManager.h:100
clang::ento::SymExpr::isValidTypeForSymbol
static bool isValidTypeForSymbol(QualType T)
Definition: SymExpr.h:45
clang::BinaryOperatorKind
BinaryOperatorKind
Definition: OperationKinds.h:25
clang::ento::SymbolConjured::Profile
static void Profile(llvm::FoldingSetNodeID &profile, const Stmt *S, QualType T, unsigned Count, const LocationContext *LCtx, const void *SymbolTag)
Definition: SymbolManager.h:111
clang::ento::SymbolRegionValue::Profile
void Profile(llvm::FoldingSetNodeID &profile) override
Definition: SymbolManager.h:59
clang::ento::SymbolManager::getType
QualType getType(const SymExpr *SE) const
Definition: SymbolManager.h:556
clang::ento::SymbolReaper::markLive
void markLive(SymbolRef sym)
Unconditionally marks a symbol as live.
Definition: SymbolManager.cpp:408
clang::ento::BinarySymExpr::classof
static bool classof(const SymExpr *SE)
Definition: SymbolManager.h:399
clang::ento::TypedValueRegion::getValueType
virtual QualType getValueType() const =0
clang::ento::SymExpr::Kind
Kind
Definition: SymExpr.h:33
clang::Builtin::ID
ID
Definition: Builtins.h:52
clang::ento::SymbolCast::Profile
static void Profile(llvm::FoldingSetNodeID &ID, const SymExpr *In, QualType From, QualType To)
Definition: SymbolManager.h:309
clang::ento::SymbolMetadata
SymbolMetadata - Represents path-dependent metadata about a specific region.
Definition: SymbolManager.h:215
clang
Definition: CalledOnceCheck.h:17
clang::ento::SymbolConjured::Profile
void Profile(llvm::FoldingSetNodeID &profile) override
Definition: SymbolManager.h:122
clang::Stmt
Stmt - This represents one statement.
Definition: Stmt.h:70
clang::ento::SymbolRegionValue::dumpToStream
void dumpToStream(raw_ostream &os) const override
Definition: SymbolManager.cpp:107
clang::ento::SymbolData
A symbol representing data which can be stored in a memory location (region).
Definition: SymExpr.h:117
MemRegion.h
clang::ento::SymbolManager::getExtentSymbol
const SymbolExtent * getExtentSymbol(const SubRegion *R)
Definition: SymbolManager.cpp:219
clang::Expr::getType
QualType getType() const
Definition: Expr.h:141
clang::ento::SymbolDerived::getOriginRegion
const MemRegion * getOriginRegion() const override
Find the region from which this symbol originates.
Definition: SymbolManager.h:156
s
__device__ __2f16 float bool s
Definition: __clang_hip_libdevice_declares.h:315
clang::ento::SymbolReaper::region_end
region_iterator region_end() const
Definition: SymbolManager.h:632
clang::ento::UnarySymExpr::dumpToStream
void dumpToStream(raw_ostream &os) const override
Definition: SymbolManager.cpp:73
unsigned
clang::ento::SymbolRegionValue::getKindStr
StringRef getKindStr() const override
Get a string representation of the kind of the region.
Definition: SymbolManager.cpp:42
clang::ento::BinarySymExprImpl::getRHS
RHSTYPE getRHS() const
Definition: SymbolManager.h:443
clang::ento::SymbolConjured::getType
QualType getType() const override
Definition: SymbolManager.cpp:338
clang::ento::SymbolReaper::isLive
bool isLive(SymbolRef sym)
Definition: SymbolManager.cpp:457
clang::ento::UnarySymExpr::classof
static bool classof(const SymExpr *SE)
Definition: SymbolManager.h:371
clang::ento::BinarySymExpr::getPointer
static const llvm::APSInt * getPointer(const llvm::APSInt &Value)
Definition: SymbolManager.h:412
clang::ento::TypedValueRegion
TypedValueRegion - An abstract class representing regions having a typed value.
Definition: MemRegion.h:531
clang::ento::SubRegion
SubRegion - A region that subsets another larger region.
Definition: MemRegion.h:442
clang::ento::UnarySymExpr::computeComplexity
unsigned computeComplexity() const override
Definition: SymbolManager.h:346
clang::ento::UnarySymExpr::getOperand
const SymExpr * getOperand() const
Definition: SymbolManager.h:352
clang::ento::UnarySymExpr::UnarySymExpr
UnarySymExpr(const SymExpr *In, UnaryOperator::Opcode Op, QualType T)
Definition: SymbolManager.h:334
clang::ento::SymbolVisitor::VisitSymbol
virtual bool VisitSymbol(SymbolRef sym)=0
A visitor method invoked by ProgramStateManager::scanReachableSymbols.
clang::ento::SymbolRegionValue::Profile
static void Profile(llvm::FoldingSetNodeID &profile, const TypedValueRegion *R)
Definition: SymbolManager.h:54
clang::Expr
This represents one expression.
Definition: Expr.h:109
clang::ento::BinarySymExpr::computeOperandComplexity
static unsigned computeOperandComplexity(const SymExpr *Value)
Definition: SymbolManager.h:405
clang::ento::SymbolCast::classof
static bool classof(const SymExpr *SE)
Definition: SymbolManager.h:322
clang::ento::BinarySymExprImpl::dumpToStream
void dumpToStream(raw_ostream &os) const override
Definition: SymbolManager.h:436
clang::ento::SymbolDerived
A symbol representing the value of a MemRegion whose parent region has symbolic value.
Definition: SymbolManager.h:134
StoreRef.h
clang::ento::SymbolManager
Definition: SymbolManager.h:481
clang::ento::SymbolMetadata::classof
static bool classof(const SymExpr *SE)
Definition: SymbolManager.h:272
clang::ento::SymbolMetadata::getStmt
const LLVM_ATTRIBUTE_RETURNS_NONNULL Stmt * getStmt() const
Definition: SymbolManager.h:239
clang::ento::SymbolReaper::SymbolReaper
SymbolReaper(const StackFrameContext *Ctx, const Stmt *s, SymbolManager &symmgr, StoreManager &storeMgr)
Construct a reaper object, which removes everything which is not live before we execute statement s i...
Definition: SymbolManager.h:601
clang::ento::SymbolManager::canSymbolicate
static bool canSymbolicate(QualType T)
Definition: SymbolManager.cpp:359
clang::ento::SymbolExtent::classof
static bool classof(const SymExpr *SE)
Definition: SymbolManager.h:206
clang::ento::SymbolConjured::SymbolConjured
SymbolConjured(SymbolID sym, const Stmt *s, const LocationContext *lctx, QualType t, unsigned count, const void *symbolTag)
Definition: SymbolManager.h:86
clang::ento::SymbolDerived::SymbolDerived
SymbolDerived(SymbolID sym, SymbolRef parent, const TypedValueRegion *r)
Definition: SymbolManager.h:139
clang::ento::SymbolVisitor::~SymbolVisitor
~SymbolVisitor()=default
clang::ento::SymbolMetadata::getRegion
const LLVM_ATTRIBUTE_RETURNS_NONNULL MemRegion * getRegion() const
Definition: SymbolManager.h:236