ProgramState - This class encapsulates: More...

#include "clang/StaticAnalyzer/Core/PathSensitive/ProgramState.h"

Inheritance diagram for clang::ento::ProgramState:

Collaboration diagram for clang::ento::ProgramState:

Public Types
typedef llvm::ImmutableSet< llvm::APSInt * >	IntSetTy

typedef llvm::ImmutableMap< void , void >	GenericDataMap

Public Member Functions
	ProgramState (ProgramStateManager *mgr, const Environment &env, StoreRef st, GenericDataMap gdm)
	This ctor is used when creating the first ProgramState object. More...

	ProgramState (const ProgramState &RHS)
	Copy ctor - We must explicitly define this or else the "Next" ptr in FoldingSetNode will also get copied. More...

	~ProgramState ()

ProgramStateManager &	getStateManager () const
	Return the ProgramStateManager associated with this state. More...

ConstraintManager &	getConstraintManager () const
	Return the ConstraintManager. More...

const Environment &	getEnvironment () const
	getEnvironment - Return the environment associated with this state. More...

Store	getStore () const
	Return the store associated with this state. More...

GenericDataMap	getGDM () const
	getGDM - Return the generic data map associated with this state. More...

void	setGDM (GenericDataMap gdm)

void	Profile (llvm::FoldingSetNodeID &ID) const
	Profile - Used to profile the contents of this object for inclusion in a FoldingSet. More...

BasicValueFactory &	getBasicVals () const

SymbolManager &	getSymbolManager () const

LLVM_NODISCARD ProgramStateRef	assume (DefinedOrUnknownSVal cond, bool assumption) const
	Assumes that the value of `cond` is zero (if `assumption` is "false") or non-zero (if `assumption` is "true"). More...

LLVM_NODISCARD std::pair< ProgramStateRef, ProgramStateRef >	assume (DefinedOrUnknownSVal cond) const
	Assumes both "true" and "false" for `cond`, and returns both corresponding states (respectively). More...

LLVM_NODISCARD ProgramStateRef	assumeInBound (DefinedOrUnknownSVal idx, DefinedOrUnknownSVal upperBound, bool assumption, QualType IndexType=QualType()) const

LLVM_NODISCARD ProgramStateRef	assumeInclusiveRange (DefinedOrUnknownSVal Val, const llvm::APSInt &From, const llvm::APSInt &To, bool assumption) const
	Assumes that the value of `Val` is bounded with [`From`; `To`] (if `assumption` is "true") or it is fully out of this range (if `assumption` is "false"). More...

LLVM_NODISCARD std::pair< ProgramStateRef, ProgramStateRef >	assumeInclusiveRange (DefinedOrUnknownSVal Val, const llvm::APSInt &From, const llvm::APSInt &To) const
	Assumes given range both "true" and "false" for `Val`, and returns both corresponding states (respectively). More...

ConditionTruthVal	isNonNull (SVal V) const
	Check if the given SVal is not constrained to zero and is not a zero constant. More...

ConditionTruthVal	isNull (SVal V) const
	Check if the given SVal is constrained to zero or is a zero constant. More...

ConditionTruthVal	areEqual (SVal Lhs, SVal Rhs) const

const VarRegion *	getRegion (const VarDecl D, const LocationContext LC) const
	Utility method for getting regions. More...

LLVM_NODISCARD ProgramStateRef	BindExpr (const Stmt S, const LocationContext LCtx, SVal V, bool Invalidate=true) const
	Create a new state by binding the value 'V' to the statement 'S' in the state's environment. More...

LLVM_NODISCARD ProgramStateRef	bindLoc (Loc location, SVal V, const LocationContext *LCtx, bool notifyChanges=true) const

LLVM_NODISCARD ProgramStateRef	bindLoc (SVal location, SVal V, const LocationContext *LCtx) const

LLVM_NODISCARD ProgramStateRef	bindDefaultInitial (SVal loc, SVal V, const LocationContext *LCtx) const
	Initializes the region of memory represented by `loc` with an initial value. More...

LLVM_NODISCARD ProgramStateRef	bindDefaultZero (SVal loc, const LocationContext *LCtx) const
	Performs C++ zero-initialization procedure on the region of memory represented by `loc`. More...

LLVM_NODISCARD ProgramStateRef	killBinding (Loc LV) const

LLVM_NODISCARD ProgramStateRef	invalidateRegions (ArrayRef< const MemRegion > Regions, const Expr E, unsigned BlockCount, const LocationContext LCtx, bool CausesPointerEscape, InvalidatedSymbols IS=nullptr, const CallEvent Call=nullptr, RegionAndSymbolInvalidationTraits ITraits=nullptr) const
	Returns the state with bindings for the given regions cleared from the store. More...

LLVM_NODISCARD ProgramStateRef	invalidateRegions (ArrayRef< SVal > Regions, const Expr E, unsigned BlockCount, const LocationContext LCtx, bool CausesPointerEscape, InvalidatedSymbols IS=nullptr, const CallEvent Call=nullptr, RegionAndSymbolInvalidationTraits *ITraits=nullptr) const

LLVM_NODISCARD ProgramStateRef	enterStackFrame (const CallEvent &Call, const StackFrameContext *CalleeCtx) const
	enterStackFrame - Returns the state for entry to the given stack frame, preserving the current state. More...

Loc	getLValue (const CXXBaseSpecifier &BaseSpec, const SubRegion *Super) const
	Get the lvalue for a base class object reference. More...

Loc	getLValue (const CXXRecordDecl BaseClass, const SubRegion Super, bool IsVirtual) const
	Get the lvalue for a base class object reference. More...

Loc	getLValue (const VarDecl D, const LocationContext LC) const
	Get the lvalue for a variable reference. More...

Loc	getLValue (const CompoundLiteralExpr literal, const LocationContext LC) const

SVal	getLValue (const ObjCIvarDecl *decl, SVal base) const
	Get the lvalue for an ivar reference. More...

SVal	getLValue (const FieldDecl *decl, SVal Base) const
	Get the lvalue for a field reference. More...

SVal	getLValue (const IndirectFieldDecl *decl, SVal Base) const
	Get the lvalue for an indirect field reference. More...

SVal	getLValue (QualType ElementType, SVal Idx, SVal Base) const
	Get the lvalue for an array index. More...

SVal	getSVal (const Stmt S, const LocationContext LCtx) const
	Returns the SVal bound to the statement 'S' in the state's environment. More...

SVal	getSValAsScalarOrLoc (const Stmt Ex, const LocationContext LCtx) const

SVal	getSVal (Loc LV, QualType T=QualType()) const
	Return the value bound to the specified location. More...

SVal	getRawSVal (Loc LV, QualType T=QualType()) const
	Returns the "raw" SVal bound to LV before any value simplfication. More...

SVal	getSVal (const MemRegion *R, QualType T=QualType()) const
	Return the value bound to the specified location. More...

SVal	getSValAsScalarOrLoc (const MemRegion *R) const
	Return the value bound to the specified location, assuming that the value is a scalar integer or an enumeration or a pointer. More...

bool	scanReachableSymbols (SVal val, SymbolVisitor &visitor) const
	Visits the symbols reachable from the given SVal using the provided SymbolVisitor. More...

bool	scanReachableSymbols (const SVal I, const SVal E, SymbolVisitor &visitor) const
	Visits the symbols reachable from the SVals in the given range using the provided SymbolVisitor. More...

bool	scanReachableSymbols (const MemRegion const I, const MemRegion const E, SymbolVisitor &visitor) const
	Visits the symbols reachable from the regions in the given MemRegions range using the provided SymbolVisitor. More...

template<typename CB >
CB	scanReachableSymbols (SVal val) const

template<typename CB >
CB	scanReachableSymbols (const SVal beg, const SVal end) const

template<typename CB >
CB	scanReachableSymbols (const MemRegion const beg, const MemRegion const end) const

LLVM_NODISCARD ProgramStateRef	addTaint (const Stmt S, const LocationContext LCtx, TaintTagType Kind=TaintTagGeneric) const
	Create a new state in which the statement is marked as tainted. More...

LLVM_NODISCARD ProgramStateRef	addTaint (SVal V, TaintTagType Kind=TaintTagGeneric) const
	Create a new state in which the value is marked as tainted. More...

LLVM_NODISCARD ProgramStateRef	addTaint (SymbolRef S, TaintTagType Kind=TaintTagGeneric) const
	Create a new state in which the symbol is marked as tainted. More...

LLVM_NODISCARD ProgramStateRef	addTaint (const MemRegion *R, TaintTagType Kind=TaintTagGeneric) const
	Create a new state in which the region symbol is marked as tainted. More...

LLVM_NODISCARD ProgramStateRef	addPartialTaint (SymbolRef ParentSym, const SubRegion *SubRegion, TaintTagType Kind=TaintTagGeneric) const
	Create a new state in a which a sub-region of a given symbol is tainted. More...

bool	isTainted (const Stmt S, const LocationContext LCtx, TaintTagType Kind=TaintTagGeneric) const
	Check if the statement is tainted in the current state. More...

bool	isTainted (SVal V, TaintTagType Kind=TaintTagGeneric) const

bool	isTainted (SymbolRef Sym, TaintTagType Kind=TaintTagGeneric) const

bool	isTainted (const MemRegion *Reg, TaintTagType Kind=TaintTagGeneric) const

void const	FindGDM (void *K) const

template<typename T >
LLVM_NODISCARD ProgramStateRef	add (typename ProgramStateTrait< T >::key_type K) const

template<typename T >
ProgramStateTrait< T >::data_type	get () const

template<typename T >
ProgramStateTrait< T >::lookup_type	get (typename ProgramStateTrait< T >::key_type key) const

template<typename T >
ProgramStateTrait< T >::context_type	get_context () const

template<typename T >
LLVM_NODISCARD ProgramStateRef	remove (typename ProgramStateTrait< T >::key_type K) const

template<typename T >
LLVM_NODISCARD ProgramStateRef	remove (typename ProgramStateTrait< T >::key_type K, typename ProgramStateTrait< T >::context_type C) const

template<typename T >
LLVM_NODISCARD ProgramStateRef	remove () const

template<typename T >
LLVM_NODISCARD ProgramStateRef	set (typename ProgramStateTrait< T >::data_type D) const

template<typename T >
LLVM_NODISCARD ProgramStateRef	set (typename ProgramStateTrait< T >::key_type K, typename ProgramStateTrait< T >::value_type E) const

template<typename T >
LLVM_NODISCARD ProgramStateRef	set (typename ProgramStateTrait< T >::key_type K, typename ProgramStateTrait< T >::value_type E, typename ProgramStateTrait< T >::context_type C) const

template<typename T >
bool	contains (typename ProgramStateTrait< T >::key_type key) const

void	print (raw_ostream &Out, const char nl="\, const char sep="", const LocationContext *CurrentLC=nullptr) const

void	printDOT (raw_ostream &Out, const LocationContext *CurrentLC=nullptr) const

void	printTaint (raw_ostream &Out, const char nl="\, const char sep="") const

void	dump () const

void	dumpTaint () const

template<typename T >
ProgramStateRef	add (typename ProgramStateTrait< T >::key_type K) const

template<typename T >
ProgramStateRef	remove (typename ProgramStateTrait< T >::key_type K) const

template<typename T >
ProgramStateRef	remove (typename ProgramStateTrait< T >::key_type K, typename ProgramStateTrait< T >::context_type C) const

template<typename T >
ProgramStateRef	remove () const

template<typename T >
ProgramStateRef	set (typename ProgramStateTrait< T >::data_type D) const

template<typename T >
ProgramStateRef	set (typename ProgramStateTrait< T >::key_type K, typename ProgramStateTrait< T >::value_type E) const

template<typename T >
ProgramStateRef	set (typename ProgramStateTrait< T >::key_type K, typename ProgramStateTrait< T >::value_type E, typename ProgramStateTrait< T >::context_type C) const

Static Public Member Functions
static void	Profile (llvm::FoldingSetNodeID &ID, const ProgramState *V)
	Profile - Profile the contents of a ProgramState object for use in a FoldingSet. More...

Friends
class	ProgramStateManager

class	ExplodedGraph

class	ExplodedNode

void	ProgramStateRetain (const ProgramState *state)
	Increments the number of times this state is referenced. More...

void	ProgramStateRelease (const ProgramState *state)
	Decrement the number of times this state is referenced. More...

Detailed Description

ProgramState - This class encapsulates:

A mapping from expressions to values (Environment)
A mapping from locations to values (Store)
Constraints on symbolic values (GenericDataMap)

Together these represent the "abstract state" of a program.

ProgramState is intended to be used as a functional object; that is, once it is created and made "persistent" in a FoldingSet, its values will never change.

Definition at line 74 of file ProgramState.h.

Member Typedef Documentation

◆ GenericDataMap

typedef llvm::ImmutableMap<void*, void*> clang::ento::ProgramState::GenericDataMap

Definition at line 77 of file ProgramState.h.

◆ IntSetTy

typedef llvm::ImmutableSet<llvm::APSInt*> clang::ento::ProgramState::IntSetTy

Definition at line 76 of file ProgramState.h.

Constructor & Destructor Documentation

◆ ProgramState() [1/2]

ProgramState::ProgramState	(	ProgramStateManager *	mgr,
		const Environment &	env,
		StoreRef	st,
		GenericDataMap	gdm
	)

This ctor is used when creating the first ProgramState object.

Definition at line 46 of file ProgramState.cpp.

References clang::ento::ProgramStateManager::getStoreManager(), and clang::ento::StoreManager::incrementReferenceCount().

◆ ProgramState() [2/2]

ProgramState::ProgramState ( const ProgramState & RHS )

Copy ctor - We must explicitly define this or else the "Next" ptr in FoldingSetNode will also get copied.

Definition at line 56 of file ProgramState.cpp.

References clang::ento::ProgramStateManager::getStoreManager(), and clang::ento::StoreManager::incrementReferenceCount().

◆ ~ProgramState()

ProgramState::~ProgramState ( )

Definition at line 66 of file ProgramState.cpp.

References clang::ento::StoreManager::decrementReferenceCount(), and clang::ento::ProgramStateManager::getStoreManager().

Referenced by clang::ento::ProgramStateRelease().

Member Function Documentation

◆ add() [1/2]

template<typename T >

LLVM_NODISCARD ProgramStateRef clang::ento::ProgramState::add ( typename ProgramStateTrait< T >::key_type K ) const

◆ add() [2/2]

template<typename T >

ProgramStateRef clang::ento::ProgramState::add ( typename ProgramStateTrait< T >::key_type K ) const

Definition at line 831 of file ProgramState.h.

References clang::T.

◆ addPartialTaint()

ProgramStateRef ProgramState::addPartialTaint	(	SymbolRef	ParentSym,
		const SubRegion *	SubRegion,
		TaintTagType	Kind = `TaintTagGeneric`
	)		const

Create a new state in a which a sub-region of a given symbol is tainted.

This might be necessary when referring to regions that can not have an individual symbol, e.g. if they are represented by the default binding of a LazyCompoundVal.

Definition at line 726 of file ProgramState.cpp.

References clang::ento::MemRegion::getBaseRegion().

◆ addTaint() [1/4]

ProgramStateRef ProgramState::addTaint	(	const Stmt *	S,
		const LocationContext *	LCtx,
		TaintTagType	Kind = `TaintTagGeneric`
	)		const

Create a new state in which the statement is marked as tainted.

Definition at line 672 of file ProgramState.cpp.

◆ addTaint() [2/4]

ProgramStateRef ProgramState::addTaint	(	SVal	V,
		TaintTagType	Kind = `TaintTagGeneric`
	)		const

Create a new state in which the value is marked as tainted.

Definition at line 681 of file ProgramState.cpp.

References clang::ento::SVal::getAs(), clang::ento::SVal::getAsRegion(), and clang::ento::SVal::getAsSymbol().

◆ addTaint() [3/4]

ProgramStateRef ProgramState::addTaint	(	SymbolRef	S,
		TaintTagType	Kind = `TaintTagGeneric`
	)		const

Create a new state in which the symbol is marked as tainted.

Definition at line 714 of file ProgramState.cpp.

◆ addTaint() [4/4]

ProgramStateRef ProgramState::addTaint	(	const MemRegion *	R,
		TaintTagType	Kind = `TaintTagGeneric`
	)		const

Create a new state in which the region symbol is marked as tainted.

Definition at line 707 of file ProgramState.cpp.

◆ areEqual()

ConditionTruthVal ProgramState::areEqual	(	SVal	Lhs,
		SVal	Rhs
	)		const

Returns: Whether values Lhs and Rhs are equal.

Definition at line 376 of file ProgramState.cpp.

◆ assume() [1/2]

ProgramStateRef clang::ento::ProgramState::assume	(	DefinedOrUnknownSVal	cond,
		bool	assumption
	)		const

inline

Assumes that the value of cond is zero (if assumption is "false") or non-zero (if assumption is "true").

This returns a new state with the added constraint on cond. If no new state is feasible, NULL is returned.

Definition at line 694 of file ProgramState.h.

References clang::ento::SVal::castAs(), and clang::ento::SVal::isUnknown().

◆ assume() [2/2]

std::pair< ProgramStateRef, ProgramStateRef > clang::ento::ProgramState::assume ( DefinedOrUnknownSVal cond ) const

inline

Assumes both "true" and "false" for cond, and returns both corresponding states (respectively).

This is more efficient than calling assume() twice. Note that one (but not both) of the returned states may be NULL.

Definition at line 704 of file ProgramState.h.

References clang::ento::SVal::castAs(), and clang::ento::SVal::isUnknown().

◆ assumeInBound()

ProgramStateRef ProgramState::assumeInBound	(	DefinedOrUnknownSVal	idx,
		DefinedOrUnknownSVal	upperBound,
		bool	assumption,
		QualType	IndexType = `QualType()`
	)		const

Definition at line 323 of file ProgramState.cpp.

References clang::ento::ConstraintManager::assume(), clang::ento::SVal::castAs(), clang::ento::SValBuilder::evalBinOpNN(), clang::ento::SValBuilder::getBasicValueFactory(), clang::ento::ProgramStateManager::getConstraintManager(), clang::ento::SValBuilder::getContext(), clang::ento::BasicValueFactory::getMinValue(), clang::ento::ProgramStateManager::getSValBuilder(), clang::ASTContext::IntTy, clang::QualType::isNull(), clang::ento::SVal::isUnknown(), clang::ento::SVal::isUnknownOrUndef(), and SM.

◆ assumeInclusiveRange() [1/2]

ProgramStateRef clang::ento::ProgramState::assumeInclusiveRange	(	DefinedOrUnknownSVal	Val,
		const llvm::APSInt &	From,
		const llvm::APSInt &	To,
		bool	assumption
	)		const

inline

Assumes that the value of Val is bounded with [From; To] (if assumption is "true") or it is fully out of this range (if assumption is "false").

This returns a new state with the added constraint on cond. If no new state is feasible, NULL is returned.

Definition at line 712 of file ProgramState.h.

References clang::ento::SVal::castAs(), clang::ento::SVal::getAs(), and clang::ento::SVal::isUnknown().

◆ assumeInclusiveRange() [2/2]

std::pair< ProgramStateRef, ProgramStateRef > clang::ento::ProgramState::assumeInclusiveRange	(	DefinedOrUnknownSVal	Val,
		const llvm::APSInt &	From,
		const llvm::APSInt &	To
	)		const

inline

Assumes given range both "true" and "false" for Val, and returns both corresponding states (respectively).

This is more efficient than calling assume() twice. Note that one (but not both) of the returned states may be NULL.

Definition at line 725 of file ProgramState.h.

References clang::ento::SVal::castAs(), clang::ento::SVal::getAs(), and clang::ento::SVal::isUnknown().

◆ bindDefaultInitial()

ProgramStateRef ProgramState::bindDefaultInitial	(	SVal	loc,
		SVal	V,
		const LocationContext *	LCtx
	)		const

Initializes the region of memory represented by loc with an initial value.

Once initialized, all values loaded from any sub-regions of that region will be equal to V, unless overwritten later by the program. This method should not be used on regions that are already initialized. If you need to indicate that memory contents have suddenly become unknown within a certain region of memory, consider invalidateRegions().

Definition at line 130 of file ProgramState.cpp.

References clang::ento::SVal::castAs(), clang::ento::ProgramStateManager::getOwningEngine(), and clang::ento::SubEngine::processRegionChange().

◆ bindDefaultZero()

ProgramStateRef ProgramState::bindDefaultZero	(	SVal	loc,
		const LocationContext *	LCtx
	)		const

Performs C++ zero-initialization procedure on the region of memory represented by loc.

Definition at line 142 of file ProgramState.cpp.

References clang::ento::SVal::castAs(), clang::ento::ProgramStateManager::getOwningEngine(), and clang::ento::SubEngine::processRegionChange().

◆ BindExpr()

ProgramStateRef ProgramState::BindExpr	(	const Stmt *	S,
		const LocationContext *	LCtx,
		SVal	V,
		bool	Invalidate = `true`
	)		const

Create a new state by binding the value 'V' to the statement 'S' in the state's environment.

Definition at line 309 of file ProgramState.cpp.

◆ bindLoc() [1/2]

ProgramStateRef ProgramState::bindLoc	(	Loc	location,
		SVal	V,
		const LocationContext *	LCtx,
		bool	notifyChanges = `true`
	)		const

Definition at line 115 of file ProgramState.cpp.

References clang::ento::SVal::getAsRegion(), clang::ento::ProgramStateManager::getOwningEngine(), and clang::ento::SubEngine::processRegionChange().

◆ bindLoc() [2/2]

ProgramStateRef clang::ento::ProgramState::bindLoc	(	SVal	location,
		SVal	V,
		const LocationContext *	LCtx
	)		const

inline

Definition at line 737 of file ProgramState.h.

References clang::ento::SVal::getAs().

◆ contains()

template<typename T >

bool clang::ento::ProgramState::contains ( typename ProgramStateTrait< T >::key_type key ) const

inline

Definition at line 459 of file ProgramState.h.

References dump(), clang::ento::ProgramStateRelease(), clang::ento::ProgramStateRetain(), and clang::CodeGen::state.

◆ dump()

LLVM_DUMP_METHOD void ProgramState::dump ( ) const

Definition at line 478 of file ProgramState.cpp.

◆ dumpTaint()

void ProgramState::dumpTaint ( ) const

Definition at line 494 of file ProgramState.cpp.

◆ enterStackFrame()

ProgramStateRef ProgramState::enterStackFrame	(	const CallEvent &	Call,
		const StackFrameContext *	CalleeCtx
	)		const

enterStackFrame - Returns the state for entry to the given stack frame, preserving the current state.

Definition at line 245 of file ProgramState.cpp.

◆ FindGDM()

void *const * ProgramState::FindGDM ( void * K ) const

Definition at line 502 of file ProgramState.cpp.

◆ get() [1/2]

template<typename T >

ProgramStateTrait<T>::data_type clang::ento::ProgramState::get ( ) const

inline

Definition at line 418 of file ProgramState.h.

◆ get() [2/2]

template<typename T >

ProgramStateTrait<T>::lookup_type clang::ento::ProgramState::get ( typename ProgramStateTrait< T >::key_type key ) const

inline

Definition at line 424 of file ProgramState.h.

References AttributeLangSupport::C.

◆ get_context()

template<typename T >

ProgramStateTrait< T >::context_type clang::ento::ProgramState::get_context ( ) const

Definition at line 836 of file ProgramState.h.

References clang::T.

◆ getBasicVals()

BasicValueFactory & clang::ento::ProgramState::getBasicVals ( ) const

inline

Definition at line 822 of file ProgramState.h.

◆ getConstraintManager()

ConstraintManager & clang::ento::ProgramState::getConstraintManager ( ) const

inline

Return the ConstraintManager.

Definition at line 684 of file ProgramState.h.

◆ getEnvironment()

const Environment& clang::ento::ProgramState::getEnvironment ( ) const

inline

getEnvironment - Return the environment associated with this state.

The environment is the mapping from expressions to values.

Definition at line 119 of file ProgramState.h.

◆ getGDM()

GenericDataMap clang::ento::ProgramState::getGDM ( ) const

inline

getGDM - Return the generic data map associated with this state.

Definition at line 127 of file ProgramState.h.

◆ getLValue() [1/8]

Loc clang::ento::ProgramState::getLValue	(	const CXXBaseSpecifier &	BaseSpec,
		const SubRegion *	Super
	)		const

inline

Get the lvalue for a base class object reference.

Definition at line 743 of file ProgramState.h.

References clang::Type::getAsCXXRecordDecl(), clang::CXXBaseSpecifier::getType(), and clang::CXXBaseSpecifier::isVirtual().

Referenced by clang::ento::ConditionBRVisitor::patternMatch(), reversePropagateInterestingSymbols(), and clang::ento::ConditionBRVisitor::VisitConditionVariable().

◆ getLValue() [2/8]

Loc clang::ento::ProgramState::getLValue	(	const CXXRecordDecl *	BaseClass,
		const SubRegion *	Super,
		bool	IsVirtual
	)		const

inline

Get the lvalue for a base class object reference.

Definition at line 751 of file ProgramState.h.

◆ getLValue() [3/8]

Loc clang::ento::ProgramState::getLValue	(	const VarDecl *	D,
		const LocationContext *	LC
	)		const

inline

Get the lvalue for a variable reference.

Definition at line 759 of file ProgramState.h.

◆ getLValue() [4/8]

Loc clang::ento::ProgramState::getLValue	(	const CompoundLiteralExpr *	literal,
		const LocationContext *	LC
	)		const

inline

Definition at line 764 of file ProgramState.h.

◆ getLValue() [5/8]

SVal clang::ento::ProgramState::getLValue	(	const ObjCIvarDecl *	decl,
		SVal	base
	)		const

inline

Get the lvalue for an ivar reference.

Definition at line 769 of file ProgramState.h.

◆ getLValue() [6/8]

SVal clang::ento::ProgramState::getLValue	(	const FieldDecl *	decl,
		SVal	Base
	)		const

inline

Get the lvalue for a field reference.

Definition at line 773 of file ProgramState.h.

◆ getLValue() [7/8]

SVal clang::ento::ProgramState::getLValue	(	const IndirectFieldDecl *	decl,
		SVal	Base
	)		const

inline

Get the lvalue for an indirect field reference.

Definition at line 777 of file ProgramState.h.

References SM.

◆ getLValue() [8/8]

SVal clang::ento::ProgramState::getLValue	(	QualType	ElementType,
		SVal	Idx,
		SVal	Base
	)		const

inline

Get the lvalue for an array index.

Definition at line 787 of file ProgramState.h.

References clang::ento::SVal::getAs().

◆ getRawSVal()

SVal clang::ento::ProgramState::getRawSVal	(	Loc	LV,
		QualType	T = `QualType()`
	)		const

inline

Returns the "raw" SVal bound to LV before any value simplfication.

Definition at line 812 of file ProgramState.h.

Referenced by reversePropagateInterestingSymbols().

◆ getRegion()

const VarRegion * clang::ento::ProgramState::getRegion	(	const VarDecl *	D,
		const LocationContext *	LC
	)		const

inline

Utility method for getting regions.

Definition at line 688 of file ProgramState.h.

◆ getStateManager()

ProgramStateManager& clang::ento::ProgramState::getStateManager ( ) const

inline

Return the ProgramStateManager associated with this state.

Definition at line 110 of file ProgramState.h.

Referenced by clang::ento::ProgramStateRelease().

◆ getStore()

Store clang::ento::ProgramState::getStore ( ) const

inline

Return the store associated with this state.

The store is a mapping from locations to values.

Definition at line 123 of file ProgramState.h.

Referenced by clang::ento::ProgramStateManager::removeDeadBindings().

◆ getSVal() [1/3]

SVal clang::ento::ProgramState::getSVal	(	const Stmt *	S,
		const LocationContext *	LCtx
	)		const

inline

Returns the SVal bound to the statement 'S' in the state's environment.

Definition at line 793 of file ProgramState.h.

Referenced by clang::ento::ConditionBRVisitor::patternMatch(), and reversePropagateIntererstingSymbols().

◆ getSVal() [2/3]

SVal ProgramState::getSVal	(	Loc	LV,
		QualType	T = `QualType()`
	)		const

Return the value bound to the specified location.

Returns UnknownVal() if none found.

Definition at line 268 of file ProgramState.cpp.

References clang::ento::BasicValueFactory::Convert(), clang::ento::SVal::getAs(), clang::ento::SVal::getAsSymbol(), clang::ento::ProgramStateManager::getBasicVals(), clang::Type::isIntegralOrEnumerationType(), clang::ento::Loc::isLocType(), and clang::QualType::isNull().

◆ getSVal() [3/3]

SVal clang::ento::ProgramState::getSVal	(	const MemRegion *	R,
		QualType	T = `QualType()`
	)		const

inline

Return the value bound to the specified location.

Returns UnknownVal() if none found.

Definition at line 816 of file ProgramState.h.

◆ getSValAsScalarOrLoc() [1/2]

SVal clang::ento::ProgramState::getSValAsScalarOrLoc	(	const Stmt *	Ex,
		const LocationContext *	LCtx
	)		const

inline

Definition at line 800 of file ProgramState.h.

◆ getSValAsScalarOrLoc() [2/2]

SVal ProgramState::getSValAsScalarOrLoc ( const MemRegion * R ) const

Return the value bound to the specified location, assuming that the value is a scalar integer or an enumeration or a pointer.

Returns UnknownVal() if none found or the region is not known to hold a value of such type.

Definition at line 252 of file ProgramState.cpp.

References clang::ento::MemRegion::isBoundable(), clang::Type::isIntegralOrEnumerationType(), clang::ento::Loc::isLocType(), and clang::T.

◆ getSymbolManager()

SymbolManager & clang::ento::ProgramState::getSymbolManager ( ) const

inline

Definition at line 826 of file ProgramState.h.

◆ invalidateRegions() [1/2]

LLVM_NODISCARD ProgramStateRef clang::ento::ProgramState::invalidateRegions	(	ArrayRef< const MemRegion *>	Regions,
		const Expr *	E,
		unsigned	BlockCount,
		const LocationContext *	LCtx,
		bool	CausesPointerEscape,
		InvalidatedSymbols *	IS = `nullptr`,
		const CallEvent *	Call = `nullptr`,
		RegionAndSymbolInvalidationTraits *	ITraits = `nullptr`
	)		const

Returns the state with bindings for the given regions cleared from the store.

Optionally invalidates global regions as well.

Parameters

Regions	the set of regions to be invalidated.
E	the expression that caused the invalidation.
BlockCount	The number of times the current basic block has been
CausesPointerEscape	the flag is set to true when the invalidation entails escape of a symbol (representing a pointer). For example, due to it being passed as an argument in a call.
IS	the set of invalidated symbols.
Call	if non-null, the invalidated regions represent parameters to the call and should be considered directly invalidated.
ITraits	information about special handling for a particular region/symbol.

◆ invalidateRegions() [2/2]

LLVM_NODISCARD ProgramStateRef clang::ento::ProgramState::invalidateRegions	(	ArrayRef< SVal >	Regions,
		const Expr *	E,
		unsigned	BlockCount,
		const LocationContext *	LCtx,
		bool	CausesPointerEscape,
		InvalidatedSymbols *	IS = `nullptr`,
		const CallEvent *	Call = `nullptr`,
		RegionAndSymbolInvalidationTraits *	ITraits = `nullptr`
	)		const

◆ isNonNull()

ConditionTruthVal ProgramState::isNonNull ( SVal V ) const

Check if the given SVal is not constrained to zero and is not a zero constant.

Definition at line 369 of file ProgramState.cpp.

References clang::ento::ConditionTruthVal::getValue(), and clang::ento::ConditionTruthVal::isUnderconstrained().

◆ isNull()

ConditionTruthVal ProgramState::isNull ( SVal V ) const

Check if the given SVal is constrained to zero or is a zero constant.

Definition at line 380 of file ProgramState.cpp.

References clang::ento::SVal::getAsSymbol(), clang::ento::SVal::isConstant(), and clang::ento::SVal::isZeroConstant().

◆ isTainted() [1/4]

bool ProgramState::isTainted	(	const Stmt *	S,
		const LocationContext *	LCtx,
		TaintTagType	Kind = `TaintTagGeneric`
	)		const

Check if the statement is tainted in the current state.

Definition at line 747 of file ProgramState.cpp.

◆ isTainted() [2/4]

bool ProgramState::isTainted	(	SVal	V,
		TaintTagType	Kind = `TaintTagGeneric`
	)		const

Definition at line 756 of file ProgramState.cpp.

References clang::ento::SVal::getAsRegion(), and clang::ento::SVal::getAsSymExpr().

◆ isTainted() [3/4]

bool ProgramState::isTainted	(	SymbolRef	Sym,
		TaintTagType	Kind = `TaintTagGeneric`
	)		const

Definition at line 782 of file ProgramState.cpp.

References clang::ento::SymExpr::symbol_begin(), and clang::ento::SymExpr::symbol_end().

◆ isTainted() [4/4]

bool ProgramState::isTainted	(	const MemRegion *	Reg,
		TaintTagType	Kind = `TaintTagGeneric`
	)		const

Definition at line 764 of file ProgramState.cpp.

◆ killBinding()

ProgramStateRef ProgramState::killBinding ( Loc LV ) const

Definition at line 231 of file ProgramState.cpp.

References clang::ento::SVal::getAs(), and clang::ento::StoreRef::getStore().

◆ print()

void ProgramState::print	(	raw_ostream &	Out,
		const char *	nl = `"\n"`,
		const char *	sep = `""`,
		const LocationContext *	CurrentLC = `nullptr`
	)		const

Definition at line 452 of file ProgramState.cpp.

References clang::ento::ProgramStateManager::getConstraintManager(), clang::ento::ProgramStateManager::getOwningEngine(), clang::ento::ProgramStateManager::getStoreManager(), clang::ento::ConstraintManager::print(), clang::ento::StoreManager::print(), clang::ento::printDynamicTypeInfo(), and clang::ento::SubEngine::printState().

◆ printDOT()

void ProgramState::printDOT	(	raw_ostream &	Out,
		const LocationContext *	CurrentLC = `nullptr`
	)		const

Definition at line 474 of file ProgramState.cpp.

◆ printTaint()

void ProgramState::printTaint	(	raw_ostream &	Out,
		const char *	nl = `"\n"`,
		const char *	sep = `""`
	)		const

Definition at line 482 of file ProgramState.cpp.

◆ Profile() [1/2]

static void clang::ento::ProgramState::Profile	(	llvm::FoldingSetNodeID &	ID,
		const ProgramState *	V
	)

inlinestatic

Profile - Profile the contents of a ProgramState object for use in a FoldingSet.

Two ProgramState objects are considered equal if they have the same Environment, Store, and GenericDataMap.

Definition at line 134 of file ProgramState.h.

References clang::ento::Environment::Profile().

Referenced by clang::ento::ProgramStateManager::getPersistentState().

◆ Profile() [2/2]

void clang::ento::ProgramState::Profile ( llvm::FoldingSetNodeID & ID ) const

inline

Profile - Used to profile the contents of this object for inclusion in a FoldingSet.

Definition at line 142 of file ProgramState.h.

◆ remove() [1/6]

template<typename T >

LLVM_NODISCARD ProgramStateRef clang::ento::ProgramState::remove ( typename ProgramStateTrait< T >::key_type K ) const

◆ remove() [2/6]

template<typename T >

LLVM_NODISCARD ProgramStateRef clang::ento::ProgramState::remove	(	typename ProgramStateTrait< T >::key_type	K,
		typename ProgramStateTrait< T >::context_type	C
	)		const

◆ remove() [3/6]

template<typename T >

LLVM_NODISCARD ProgramStateRef clang::ento::ProgramState::remove ( ) const

◆ remove() [4/6]

template<typename T >

ProgramStateRef clang::ento::ProgramState::remove ( typename ProgramStateTrait< T >::key_type K ) const

Definition at line 841 of file ProgramState.h.

References clang::T.

◆ remove() [5/6]

template<typename T >

ProgramStateRef clang::ento::ProgramState::remove	(	typename ProgramStateTrait< T >::key_type	K,
		typename ProgramStateTrait< T >::context_type	C
	)		const

Definition at line 846 of file ProgramState.h.

References AttributeLangSupport::C, and clang::T.

◆ remove() [6/6]

template<typename T >

ProgramStateRef clang::ento::ProgramState::remove ( ) const

Definition at line 852 of file ProgramState.h.

References clang::T.

◆ scanReachableSymbols() [1/6]

bool ProgramState::scanReachableSymbols	(	SVal	val,
		SymbolVisitor &	visitor
	)		const

Visits the symbols reachable from the given SVal using the provided SymbolVisitor.

This is a convenience API. Consider using ScanReachableSymbols class directly when making multiple scans on the same state with the same visitor to avoid repeated initialization cost.

See also: ScanReachableSymbols

Definition at line 646 of file ProgramState.cpp.

◆ scanReachableSymbols() [2/6]

bool ProgramState::scanReachableSymbols	(	const SVal *	I,
		const SVal *	E,
		SymbolVisitor &	visitor
	)		const

Visits the symbols reachable from the SVals in the given range using the provided SymbolVisitor.

Definition at line 651 of file ProgramState.cpp.

◆ scanReachableSymbols() [3/6]

bool ProgramState::scanReachableSymbols	(	const MemRegion const	I,
		const MemRegion const	E,
		SymbolVisitor &	visitor
	)		const

Visits the symbols reachable from the regions in the given MemRegions range using the provided SymbolVisitor.

Definition at line 661 of file ProgramState.cpp.

◆ scanReachableSymbols() [4/6]

template<typename CB >

CB clang::ento::ProgramState::scanReachableSymbols ( SVal val ) const

Definition at line 875 of file ProgramState.h.

◆ scanReachableSymbols() [5/6]

template<typename CB >

CB clang::ento::ProgramState::scanReachableSymbols	(	const SVal *	beg,
		const SVal *	end
	)		const

Definition at line 882 of file ProgramState.h.

◆ scanReachableSymbols() [6/6]

template<typename CB >

CB clang::ento::ProgramState::scanReachableSymbols	(	const MemRegion const	beg,
		const MemRegion const	end
	)		const

Definition at line 889 of file ProgramState.h.

◆ set() [1/6]

template<typename T >

LLVM_NODISCARD ProgramStateRef clang::ento::ProgramState::set ( typename ProgramStateTrait< T >::data_type D ) const

◆ set() [2/6]

template<typename T >

LLVM_NODISCARD ProgramStateRef clang::ento::ProgramState::set	(	typename ProgramStateTrait< T >::key_type	K,
		typename ProgramStateTrait< T >::value_type	E
	)		const

◆ set() [3/6]

template<typename T >

LLVM_NODISCARD ProgramStateRef clang::ento::ProgramState::set	(	typename ProgramStateTrait< T >::key_type	K,
		typename ProgramStateTrait< T >::value_type	E,
		typename ProgramStateTrait< T >::context_type	C
	)		const

◆ set() [4/6]

template<typename T >

ProgramStateRef clang::ento::ProgramState::set ( typename ProgramStateTrait< T >::data_type D ) const

Definition at line 857 of file ProgramState.h.

References clang::T.

◆ set() [5/6]

template<typename T >

ProgramStateRef clang::ento::ProgramState::set	(	typename ProgramStateTrait< T >::key_type	K,
		typename ProgramStateTrait< T >::value_type	E
	)		const

Definition at line 862 of file ProgramState.h.

◆ set() [6/6]

template<typename T >

ProgramStateRef clang::ento::ProgramState::set	(	typename ProgramStateTrait< T >::key_type	K,
		typename ProgramStateTrait< T >::value_type	E,
		typename ProgramStateTrait< T >::context_type	C
	)		const

Definition at line 868 of file ProgramState.h.

◆ setGDM()

void clang::ento::ProgramState::setGDM ( GenericDataMap gdm )

inline

Definition at line 129 of file ProgramState.h.

Friends And Related Function Documentation

◆ ExplodedGraph

friend class ExplodedGraph

friend

Definition at line 83 of file ProgramState.h.

◆ ExplodedNode

friend class ExplodedNode

friend

Definition at line 84 of file ProgramState.h.

◆ ProgramStateManager

friend class ProgramStateManager

friend

Definition at line 82 of file ProgramState.h.

◆ ProgramStateRelease

void ProgramStateRelease ( const ProgramState * state )

friend

Decrement the number of times this state is referenced.

Definition at line 34 of file ProgramState.cpp.

◆ ProgramStateRetain

void ProgramStateRetain ( const ProgramState * state )

friend

Increments the number of times this state is referenced.

Definition at line 29 of file ProgramState.cpp.

The documentation for this class was generated from the following files:

include/clang/StaticAnalyzer/Core/PathSensitive/ProgramState.h
lib/StaticAnalyzer/Core/ProgramState.cpp

Public Types

Public Member Functions

Static Public Member Functions

Friends

Detailed Description

Member Typedef Documentation

◆ GenericDataMap

◆ IntSetTy

Constructor & Destructor Documentation

◆ ProgramState() [1/2]

◆ ProgramState() [2/2]

◆ ~ProgramState()

Member Function Documentation

◆ add() [1/2]

◆ add() [2/2]

◆ addPartialTaint()

◆ addTaint() [1/4]

◆ addTaint() [2/4]

◆ addTaint() [3/4]

◆ addTaint() [4/4]

◆ areEqual()

◆ assume() [1/2]

◆ assume() [2/2]

◆ assumeInBound()

◆ assumeInclusiveRange() [1/2]

◆ assumeInclusiveRange() [2/2]

◆ bindDefaultInitial()

◆ bindDefaultZero()

◆ BindExpr()

◆ bindLoc() [1/2]

◆ bindLoc() [2/2]

◆ contains()

◆ dump()

◆ dumpTaint()

◆ enterStackFrame()

◆ FindGDM()

◆ get() [1/2]

◆ get() [2/2]

◆ get_context()

◆ getBasicVals()

◆ getConstraintManager()

◆ getEnvironment()

◆ getGDM()

◆ getLValue() [1/8]

◆ getLValue() [2/8]

◆ getLValue() [3/8]

◆ getLValue() [4/8]

◆ getLValue() [5/8]

◆ getLValue() [6/8]

◆ getLValue() [7/8]

◆ getLValue() [8/8]

◆ getRawSVal()

◆ getRegion()

◆ getStateManager()

◆ getStore()

◆ getSVal() [1/3]

◆ getSVal() [2/3]

◆ getSVal() [3/3]

◆ getSValAsScalarOrLoc() [1/2]

◆ getSValAsScalarOrLoc() [2/2]

◆ getSymbolManager()

◆ invalidateRegions() [1/2]

◆ invalidateRegions() [2/2]

◆ isNonNull()

◆ isNull()

◆ isTainted() [1/4]

◆ isTainted() [2/4]

◆ isTainted() [3/4]

◆ isTainted() [4/4]

◆ killBinding()

◆ print()

◆ printDOT()

◆ printTaint()

◆ Profile() [1/2]

◆ Profile() [2/2]

◆ remove() [1/6]

◆ remove() [2/6]

◆ remove() [3/6]

◆ remove() [4/6]

◆ remove() [5/6]