clang 23.0.0git
Public Member Functions | Protected Attributes | List of all members
clang::ento::NodeBuilder Class Reference

This is the simplest builder which generates nodes in the ExplodedGraph. More...

#include "clang/StaticAnalyzer/Core/PathSensitive/CoreEngine.h"

Inheritance diagram for clang::ento::NodeBuilder:
[legend]

Public Member Functions

 NodeBuilder (ExplodedNodeSet &DstSet, const NodeBuilderContext &Ctx)
 NodeBuilder (ExplodedNode *SrcNode, ExplodedNodeSet &DstSet, const NodeBuilderContext &Ctx)
 NodeBuilder (const ExplodedNodeSet &SrcSet, ExplodedNodeSet &DstSet, const NodeBuilderContext &Ctx)
ExplodedNode * generateNode (const ProgramPoint &PP, ProgramStateRef State, ExplodedNode *Pred, bool MarkAsSink=false)
 Generates a node in the ExplodedGraph.
ExplodedNode * generateSink (const ProgramPoint &PP, ProgramStateRef State, ExplodedNode *Pred)
 Generates a sink in the ExplodedGraph.
ExplodedNode * generateNode (const Stmt *S, ExplodedNode *Pred, ProgramStateRef St, const ProgramPointTag *tag=nullptr, ProgramPoint::Kind K=ProgramPoint::PostStmtKind)
ExplodedNode * generateSink (const Stmt *S, ExplodedNode *Pred, ProgramStateRef St, const ProgramPointTag *tag=nullptr, ProgramPoint::Kind K=ProgramPoint::PostStmtKind)
const ExplodedNodeSet & getResults () const
const NodeBuilderContext & getContext () const
bool hasGeneratedNodes () const
void takeNodes (const ExplodedNodeSet &S)
void takeNodes (ExplodedNode *N)
void addNodes (const ExplodedNodeSet &S)
void addNodes (ExplodedNode *N)

Protected Attributes

const NodeBuilderContext & C
bool HasGeneratedNodes = false
ExplodedNodeSet & Frontier
 The frontier set - a set of nodes which need to be propagated after the builder dies.

Detailed Description

This is the simplest builder which generates nodes in the ExplodedGraph.

The main benefit of the builder is that it automatically tracks the frontier nodes (or destination set). This is the set of nodes which should be propagated to the next step / builder. They are the nodes which have been added to the builder (either as the input node set or as the newly constructed nodes) but did not have any outgoing transitions added.

TODO: This "main benefit" is often useless, in fact the only significant use is within CheckerManager::ExpandGraphWithCheckers. There this logic ensures that if a checker performs multiple transitions on the same path, then only the last of them is "built upon" by other checkers or the engine.

However, there are also many short-lived temporary NodeBuilder instances where the generateNode is called in a very predictable manner (once, or once for each source node) and the frontier management is overkill. These locations should be gradually simplified by using the method CoreEngine::makeNode() instead of the temporary NodeBuilders.

Definition at line 246 of file CoreEngine.h.

Constructor & Destructor Documentation

◆ NodeBuilder() [1/3]

clang::ento::NodeBuilder::NodeBuilder ( ExplodedNodeSet & DstSet,
const NodeBuilderContext & Ctx )
inline

Definition at line 257 of file CoreEngine.h.

References C, and Frontier.

Referenced by clang::ento::BranchNodeBuilder::BranchNodeBuilder(), clang::ento::IndirectGotoNodeBuilder::generateNode(), clang::ento::IndirectGotoNodeBuilder::IndirectGotoNodeBuilder(), NodeBuilder(), NodeBuilder(), and clang::ento::SwitchNodeBuilder::SwitchNodeBuilder().

◆ NodeBuilder() [2/3]

clang::ento::NodeBuilder::NodeBuilder ( ExplodedNode * SrcNode,
ExplodedNodeSet & DstSet,
const NodeBuilderContext & Ctx )
inline

Definition at line 260 of file CoreEngine.h.

References Frontier, and NodeBuilder().

◆ NodeBuilder() [3/3]

clang::ento::NodeBuilder::NodeBuilder ( const ExplodedNodeSet & SrcSet,
ExplodedNodeSet & DstSet,
const NodeBuilderContext & Ctx )
inline

Definition at line 266 of file CoreEngine.h.

References Frontier, and NodeBuilder().

Member Function Documentation

◆ addNodes() [1/2]

void clang::ento::NodeBuilder::addNodes ( const ExplodedNodeSet & S)
inline

Definition at line 318 of file CoreEngine.h.

References Frontier.

Referenced by clang::ento::ExprEngine::Visit(), clang::ento::ExprEngine::VisitCXXNewExpr(), clang::ento::ExprEngine::VisitDeclStmt(), clang::ento::ExprEngine::VisitIncrementDecrementOperator(), clang::ento::ExprEngine::VisitMemberExpr(), and clang::ento::ExprEngine::VisitUnaryOperator().

◆ addNodes() [2/2]

void clang::ento::NodeBuilder::addNodes ( ExplodedNode * N)
inline

Definition at line 319 of file CoreEngine.h.

References Frontier.

◆ generateNode() [1/2]

ExplodedNode * NodeBuilder::generateNode ( const ProgramPoint & PP,
ProgramStateRef State,
ExplodedNode * Pred,
bool MarkAsSink = false )

Generates a node in the ExplodedGraph.

Definition at line 682 of file CoreEngine.cpp.

References C, Frontier, and HasGeneratedNodes.

Referenced by clang::ento::ExprEngine::ConstructInitList(), clang::ento::ExprEngine::CreateCXXTemporaryObject(), clang::ento::ExprEngine::evalCall(), clang::ento::ExprEngine::evalLoad(), clang::ento::SwitchNodeBuilder::generateCaseStmtNode(), clang::ento::SwitchNodeBuilder::generateDefaultCaseNode(), clang::ento::BranchNodeBuilder::generateNode(), clang::ento::IndirectGotoNodeBuilder::generateNode(), generateNode(), generateSink(), clang::ento::ExprEngine::handleLValueBitCast(), clang::ento::ExprEngine::handleUOExtension(), populateObjCForDestinationSet(), clang::ento::ExprEngine::ProcessAutomaticObjDtor(), clang::ento::ExprEngine::ProcessDeleteDtor(), clang::ento::ExprEngine::processEndOfFunction(), clang::ento::ExprEngine::ProcessMemberDtor(), clang::ento::ExprEngine::ProcessTemporaryDtor(), REGISTER_TRAIT_WITH_PROGRAMSTATE(), clang::ento::ExprEngine::removeDead(), clang::ento::ExprEngine::Visit(), clang::ento::ExprEngine::VisitArrayInitLoopExpr(), clang::ento::ExprEngine::VisitArraySubscriptExpr(), clang::ento::ExprEngine::VisitAtomicExpr(), clang::ento::ExprEngine::VisitBinaryOperator(), clang::ento::ExprEngine::VisitBlockExpr(), clang::ento::ExprEngine::VisitCast(), clang::ento::ExprEngine::VisitCommonDeclRefExpr(), clang::ento::ExprEngine::VisitCompoundLiteralExpr(), clang::ento::ExprEngine::VisitCXXCatchStmt(), clang::ento::ExprEngine::VisitCXXDestructor(), clang::ento::ExprEngine::VisitCXXNewAllocatorCall(), clang::ento::ExprEngine::VisitCXXNewExpr(), clang::ento::ExprEngine::VisitCXXThisExpr(), clang::ento::ExprEngine::VisitDeclStmt(), clang::ento::ExprEngine::VisitGCCAsmStmt(), clang::ento::ExprEngine::VisitGuardedExpr(), clang::ento::ExprEngine::VisitLambdaExpr(), clang::ento::ExprEngine::VisitLogicalExpr(), clang::ento::ExprEngine::VisitLvalObjCIvarRefExpr(), clang::ento::ExprEngine::VisitMemberExpr(), clang::ento::ExprEngine::VisitMSAsmStmt(), clang::ento::ExprEngine::VisitObjCMessage(), clang::ento::ExprEngine::VisitOffsetOfExpr(), clang::ento::ExprEngine::VisitReturnStmt(), clang::ento::ExprEngine::VisitUnaryExprOrTypeTraitExpr(), and clang::ento::ExprEngine::VisitUnaryOperator().

◆ generateNode() [2/2]

ExplodedNode * clang::ento::NodeBuilder::generateNode ( const Stmt * S,
ExplodedNode * Pred,
ProgramStateRef St,
const ProgramPointTag * tag = nullptr,
ProgramPoint::Kind K = ProgramPoint::PostStmtKind )
inline

Definition at line 287 of file CoreEngine.h.

References generateNode(), clang::ento::ExplodedNode::getLocationContext(), clang::ProgramPoint::getProgramPoint(), and clang::ProgramPoint::PostStmtKind.

◆ generateSink() [1/2]

ExplodedNode * clang::ento::NodeBuilder::generateSink ( const ProgramPoint & PP,
ProgramStateRef State,
ExplodedNode * Pred )
inline

Generates a sink in the ExplodedGraph.

When a node is marked as sink, the exploration from the node is stopped - the node becomes the last node on the path and certain kinds of bugs are suppressed.

Definition at line 281 of file CoreEngine.h.

References generateNode().

Referenced by generateSink(), clang::ento::ExprEngine::ProcessAutomaticObjDtor(), clang::ento::ExprEngine::ProcessMemberDtor(), clang::ento::ExprEngine::Visit(), clang::ento::ExprEngine::VisitCast(), clang::ento::ExprEngine::VisitCXXDestructor(), and clang::ento::ExprEngine::VisitObjCMessage().

◆ generateSink() [2/2]

ExplodedNode * clang::ento::NodeBuilder::generateSink ( const Stmt * S,
ExplodedNode * Pred,
ProgramStateRef St,
const ProgramPointTag * tag = nullptr,
ProgramPoint::Kind K = ProgramPoint::PostStmtKind )
inline

Definition at line 297 of file CoreEngine.h.

References generateSink(), clang::ento::ExplodedNode::getLocationContext(), clang::ProgramPoint::getProgramPoint(), and clang::ProgramPoint::PostStmtKind.

◆ getContext()

const NodeBuilderContext & clang::ento::NodeBuilder::getContext ( ) const
inline

Definition at line 309 of file CoreEngine.h.

References C.

◆ getResults()

const ExplodedNodeSet & clang::ento::NodeBuilder::getResults ( ) const
inline

Definition at line 307 of file CoreEngine.h.

References Frontier.

Referenced by clang::ento::ExprEngine::VisitCXXNewExpr(), and clang::ento::ExprEngine::VisitDeclStmt().

◆ hasGeneratedNodes()

bool clang::ento::NodeBuilder::hasGeneratedNodes ( ) const
inline

Definition at line 310 of file CoreEngine.h.

References HasGeneratedNodes.

◆ takeNodes() [1/2]

void clang::ento::NodeBuilder::takeNodes ( const ExplodedNodeSet & S)
inline

Definition at line 312 of file CoreEngine.h.

References Frontier.

Referenced by clang::ento::ExprEngine::ProcessAutomaticObjDtor(), clang::ento::ExprEngine::ProcessDeleteDtor(), clang::ento::ExprEngine::ProcessMemberDtor(), clang::ento::ExprEngine::Visit(), clang::ento::ExprEngine::VisitCXXNewExpr(), clang::ento::ExprEngine::VisitDeclStmt(), clang::ento::ExprEngine::VisitIncrementDecrementOperator(), clang::ento::ExprEngine::VisitMemberExpr(), and clang::ento::ExprEngine::VisitUnaryOperator().

◆ takeNodes() [2/2]

void clang::ento::NodeBuilder::takeNodes ( ExplodedNode * N)
inline

Definition at line 317 of file CoreEngine.h.

References Frontier.

Member Data Documentation

◆ C

const NodeBuilderContext& clang::ento::NodeBuilder::C
protected

Definition at line 248 of file CoreEngine.h.

Referenced by clang::ento::SwitchNodeBuilder::begin(), clang::ento::BranchNodeBuilder::BranchNodeBuilder(), clang::ento::SwitchNodeBuilder::end(), clang::ento::SwitchNodeBuilder::generateCaseStmtNode(), clang::ento::SwitchNodeBuilder::generateDefaultCaseNode(), clang::ento::BranchNodeBuilder::generateNode(), clang::ento::IndirectGotoNodeBuilder::generateNode(), generateNode(), getContext(), clang::ento::IndirectGotoNodeBuilder::getLocationContext(), and NodeBuilder().

◆ Frontier

ExplodedNodeSet& clang::ento::NodeBuilder::Frontier
protected

The frontier set - a set of nodes which need to be propagated after the builder dies.

Definition at line 254 of file CoreEngine.h.

Referenced by addNodes(), addNodes(), generateNode(), getResults(), NodeBuilder(), NodeBuilder(), NodeBuilder(), takeNodes(), and takeNodes().

◆ HasGeneratedNodes

bool clang::ento::NodeBuilder::HasGeneratedNodes = false
protected

Definition at line 250 of file CoreEngine.h.

Referenced by generateNode(), and hasGeneratedNodes().

The documentation for this class was generated from the following files:
Generated on for clang by doxygen 1.14.0