clang 20.0.0git
Public Member Functions | Protected Attributes | List of all members
clang::ento::SValBuilder Class Referenceabstract

#include "clang/StaticAnalyzer/Core/PathSensitive/SValBuilder.h"

Public Member Functions

 SValBuilder (llvm::BumpPtrAllocator &alloc, ASTContext &context, ProgramStateManager &stateMgr)
 
virtual ~SValBuilder ()=default
 
SVal evalCast (SVal V, QualType CastTy, QualType OriginalTy)
 Cast a given SVal to another SVal using given QualType's.
 
SVal evalIntegralCast (ProgramStateRef state, SVal val, QualType castTy, QualType originalType)
 
SVal evalMinus (NonLoc val)
 
SVal evalComplement (NonLoc val)
 
virtual SVal evalBinOpNN (ProgramStateRef state, BinaryOperator::Opcode op, NonLoc lhs, NonLoc rhs, QualType resultTy)=0
 Create a new value which represents a binary expression with two non- location operands.
 
virtual SVal evalBinOpLL (ProgramStateRef state, BinaryOperator::Opcode op, Loc lhs, Loc rhs, QualType resultTy)=0
 Create a new value which represents a binary expression with two memory location operands.
 
virtual SVal evalBinOpLN (ProgramStateRef state, BinaryOperator::Opcode op, Loc lhs, NonLoc rhs, QualType resultTy)=0
 Create a new value which represents a binary expression with a memory location and non-location operands.
 
virtual const llvm::APSInt * getKnownValue (ProgramStateRef state, SVal val)=0
 Evaluates a given SVal.
 
virtual const llvm::APSInt * getMinValue (ProgramStateRef state, SVal val)=0
 Tries to get the minimal possible (integer) value of a given SVal.
 
virtual const llvm::APSInt * getMaxValue (ProgramStateRef state, SVal val)=0
 Tries to get the maximal possible (integer) value of a given SVal.
 
virtual SVal simplifySVal (ProgramStateRef State, SVal Val)=0
 Simplify symbolic expressions within a given SVal.
 
SVal makeSymExprValNN (BinaryOperator::Opcode op, NonLoc lhs, NonLoc rhs, QualType resultTy)
 Constructs a symbolic expression for two non-location values.
 
SVal evalUnaryOp (ProgramStateRef state, UnaryOperator::Opcode opc, SVal operand, QualType type)
 
SVal evalBinOp (ProgramStateRef state, BinaryOperator::Opcode op, SVal lhs, SVal rhs, QualType type)
 
ConditionTruthVal areEqual (ProgramStateRef state, SVal lhs, SVal rhs)
 
SVal evalEQ (ProgramStateRef state, SVal lhs, SVal rhs)
 
DefinedOrUnknownSVal evalEQ (ProgramStateRef state, DefinedOrUnknownSVal lhs, DefinedOrUnknownSVal rhs)
 
ASTContext & getContext ()
 
const ASTContext & getContext () const
 
ProgramStateManager & getStateManager ()
 
QualType getConditionType () const
 
QualType getArrayIndexType () const
 
BasicValueFactory & getBasicValueFactory ()
 
const BasicValueFactory & getBasicValueFactory () const
 
SymbolManager & getSymbolManager ()
 
const SymbolManager & getSymbolManager () const
 
MemRegionManager & getRegionManager ()
 
const MemRegionManager & getRegionManager () const
 
const AnalyzerOptions & getAnalyzerOptions () const
 
const SymbolConjured * conjureSymbol (const Stmt *stmt, const LocationContext *LCtx, QualType type, unsigned visitCount, const void *symbolTag=nullptr)
 
const SymbolConjured * conjureSymbol (const Expr *expr, const LocationContext *LCtx, unsigned visitCount, const void *symbolTag=nullptr)
 
DefinedOrUnknownSVal makeZeroVal (QualType type)
 Construct an SVal representing '0' for the specified type.
 
DefinedOrUnknownSVal getRegionValueSymbolVal (const TypedValueRegion *region)
 Make a unique symbol for value of region.
 
DefinedOrUnknownSVal conjureSymbolVal (const void *symbolTag, const Expr *expr, const LocationContext *LCtx, unsigned count)
 Create a new symbol with a unique 'name'.
 
DefinedOrUnknownSVal conjureSymbolVal (const void *symbolTag, const Stmt *S, const LocationContext *LCtx, QualType type, unsigned count)
 
DefinedOrUnknownSVal conjureSymbolVal (const Stmt *stmt, const LocationContext *LCtx, QualType type, unsigned visitCount)
 
DefinedSVal getConjuredHeapSymbolVal (const Expr *E, const LocationContext *LCtx, unsigned Count)
 Conjure a symbol representing heap allocated memory region.
 
DefinedSVal getConjuredHeapSymbolVal (const Expr *E, const LocationContext *LCtx, QualType type, unsigned Count)
 Conjure a symbol representing heap allocated memory region.
 
loc::MemRegionVal getAllocaRegionVal (const Expr *E, const LocationContext *LCtx, unsigned Count)
 Create an SVal representing the result of an alloca()-like call, that is, an AllocaRegion on the stack.
 
DefinedOrUnknownSVal getDerivedRegionValueSymbolVal (SymbolRef parentSymbol, const TypedValueRegion *region)
 
DefinedSVal getMetadataSymbolVal (const void *symbolTag, const MemRegion *region, const Expr *expr, QualType type, const LocationContext *LCtx, unsigned count)
 
DefinedSVal getMemberPointer (const NamedDecl *ND)
 
DefinedSVal getFunctionPointer (const FunctionDecl *func)
 
DefinedSVal getBlockPointer (const BlockDecl *block, CanQualType locTy, const LocationContext *locContext, unsigned blockCount)
 
std::optional< SVal > getConstantVal (const Expr *E)
 Returns the value of E, if it can be determined in a non-path-sensitive manner.
 
NonLoc makeCompoundVal (QualType type, llvm::ImmutableList< SVal > vals)
 
NonLoc makeLazyCompoundVal (const StoreRef &store, const TypedValueRegion *region)
 
NonLoc makePointerToMember (const DeclaratorDecl *DD)
 
NonLoc makePointerToMember (const PointerToMemberData *PTMD)
 
NonLoc makeZeroArrayIndex ()
 
NonLoc makeArrayIndex (uint64_t idx)
 
SVal convertToArrayIndex (SVal val)
 
nonloc::ConcreteInt makeIntVal (const IntegerLiteral *integer)
 
nonloc::ConcreteInt makeBoolVal (const ObjCBoolLiteralExpr *boolean)
 
nonloc::ConcreteInt makeBoolVal (const CXXBoolLiteralExpr *boolean)
 
nonloc::ConcreteInt makeIntVal (const llvm::APSInt &integer)
 
loc::ConcreteInt makeIntLocVal (const llvm::APSInt &integer)
 
NonLoc makeIntVal (const llvm::APInt &integer, bool isUnsigned)
 
DefinedSVal makeIntVal (uint64_t integer, QualType type)
 
NonLoc makeIntVal (uint64_t integer, bool isUnsigned)
 
NonLoc makeIntValWithWidth (QualType ptrType, uint64_t integer)
 
NonLoc makeLocAsInteger (Loc loc, unsigned bits)
 
nonloc::SymbolVal makeNonLoc (const SymExpr *lhs, BinaryOperator::Opcode op, APSIntPtr rhs, QualType type)
 
nonloc::SymbolVal makeNonLoc (APSIntPtr rhs, BinaryOperator::Opcode op, const SymExpr *lhs, QualType type)
 
nonloc::SymbolVal makeNonLoc (const SymExpr *lhs, BinaryOperator::Opcode op, const SymExpr *rhs, QualType type)
 
NonLoc makeNonLoc (const SymExpr *operand, UnaryOperator::Opcode op, QualType type)
 
nonloc::SymbolVal makeNonLoc (const SymExpr *operand, QualType fromTy, QualType toTy)
 Create a NonLoc value for cast.
 
nonloc::ConcreteInt makeTruthVal (bool b, QualType type)
 
nonloc::ConcreteInt makeTruthVal (bool b)
 
loc::ConcreteInt makeNullWithType (QualType type)
 Create NULL pointer, with proper pointer bit-width for given address space.
 
loc::MemRegionVal makeLoc (SymbolRef sym)
 
loc::MemRegionVal makeLoc (const MemRegion *region)
 
loc::GotoLabel makeLoc (const AddrLabelExpr *expr)
 
loc::ConcreteInt makeLoc (const llvm::APSInt &integer)
 
std::optional< loc::MemRegionVal > getCastedMemRegionVal (const MemRegion *region, QualType type)
 Return MemRegionVal on success cast, otherwise return std::nullopt.
 
DefinedSVal makeSymbolVal (SymbolRef Sym)
 Make an SVal that represents the given symbol.
 
loc::MemRegionVal getCXXThis (const CXXMethodDecl *D, const StackFrameContext *SFC)
 Return a memory region for the 'this' object reference.
 
loc::MemRegionVal getCXXThis (const CXXRecordDecl *D, const StackFrameContext *SFC)
 Return a memory region for the 'this' object reference.
 

Protected Attributes

ASTContext & Context
 
BasicValueFactory BasicVals
 Manager of APSInt values.
 
SymbolManager SymMgr
 Manages the creation of symbols.
 
MemRegionManager MemMgr
 Manages the creation of memory regions.
 
ProgramStateManager & StateMgr
 
const AnalyzerOptions & AnOpts
 
const QualType ArrayIndexTy
 The scalar type to use for array indices.
 
const unsigned ArrayIndexWidth
 The width of the scalar type used for array indices.
 

Detailed Description

Definition at line 53 of file SValBuilder.h.

Constructor & Destructor Documentation

◆ SValBuilder()

SValBuilder::SValBuilder ( llvm::BumpPtrAllocator &  alloc,
ASTContext &  context,
ProgramStateManager &  stateMgr 
)

Definition at line 52 of file SValBuilder.cpp.

◆ ~SValBuilder()

virtual clang::ento::SValBuilder::~SValBuilder ( )
virtualdefault

Member Function Documentation

◆ areEqual()

ConditionTruthVal SValBuilder::areEqual ( ProgramStateRef  state,
SVal  lhs,
SVal  rhs 
)
Returns
Whether values in lhs and rhs are equal at state.

Definition at line 541 of file SValBuilder.cpp.

References evalEQ().

Referenced by clang::ento::ProgramState::areEqual(), and wasRegionOfInterestModifiedAt().

◆ conjureSymbol() [1/2]

const SymbolConjured * clang::ento::SValBuilder::conjureSymbol ( const Expr *  expr,
const LocationContext *  LCtx,
unsigned  visitCount,
const void *  symbolTag = nullptr 
)
inline

Definition at line 182 of file SValBuilder.h.

References clang::ento::SymbolManager::conjureSymbol(), clang::ast_matchers::expr, and SymMgr.

◆ conjureSymbol() [2/2]

const SymbolConjured * clang::ento::SValBuilder::conjureSymbol ( const Stmt *  stmt,
const LocationContext *  LCtx,
QualType  type,
unsigned  visitCount,
const void *  symbolTag = nullptr 
)
inline

Definition at line 174 of file SValBuilder.h.

References clang::ento::SymbolManager::conjureSymbol(), clang::ast_matchers::stmt, SymMgr, and clang::ast_matchers::type.

◆ conjureSymbolVal() [1/3]

DefinedOrUnknownSVal SValBuilder::conjureSymbolVal ( const Stmt *  stmt,
const LocationContext *  LCtx,
QualType  type,
unsigned  visitCount 
)

Definition at line 191 of file SValBuilder.cpp.

References clang::ento::SymbolManager::canSymbolicate(), clang::ento::SymbolManager::conjureSymbol(), clang::ento::MemRegionManager::getSymbolicRegion(), clang::ento::Loc::isLocType(), makeZeroVal(), MemMgr, clang::ast_matchers::stmt, SymMgr, and clang::ast_matchers::type.

◆ conjureSymbolVal() [2/3]

DefinedOrUnknownSVal SValBuilder::conjureSymbolVal ( const void *  symbolTag,
const Expr *  expr,
const LocationContext *  LCtx,
unsigned  count 
)

Create a new symbol with a unique 'name'.

We resort to conjured symbols when we cannot construct a derived symbol. The advantage of symbols derived/built from other symbols is that we preserve the relation between related(or even equivalent) expressions, so conjured symbols should be used sparingly.

Definition at line 154 of file SValBuilder.cpp.

References conjureSymbolVal(), clang::LocationContext::getAnalysisDeclContext(), clang::AnalysisDeclContext::getASTContext(), clang::ASTContext::getPointerType(), clang::Expr::getType(), clang::Expr::isGLValue(), clang::Type::isNullPtrType(), makeZeroVal(), and clang::T.

Referenced by clang::ento::ExprEngine::bindReturnValue(), clang::ento::ExprEngine::computeObjectUnderConstruction(), conjureOffsetSymbolOnLocation(), conjureSymbolVal(), clang::ento::retaincountchecker::RetainCountChecker::evalCall(), clang::ento::ExprEngine::ProcessInitializer(), clang::ento::ExprEngine::Visit(), clang::ento::ExprEngine::VisitBinaryOperator(), clang::ento::ExprEngine::VisitCast(), clang::ento::ExprEngine::VisitCXXCatchStmt(), clang::ento::ExprEngine::VisitCXXNewExpr(), clang::ento::ExprEngine::VisitDeclStmt(), clang::ento::ExprEngine::VisitGuardedExpr(), and clang::ento::ExprEngine::VisitIncrementDecrementOperator().

◆ conjureSymbolVal() [3/3]

DefinedOrUnknownSVal SValBuilder::conjureSymbolVal ( const void *  symbolTag,
const Stmt *  S,
const LocationContext *  LCtx,
QualType  type,
unsigned  count 
)

Definition at line 172 of file SValBuilder.cpp.

References clang::ento::SymbolManager::canSymbolicate(), clang::ento::SymbolManager::conjureSymbol(), clang::ento::MemRegionManager::getSymbolicRegion(), clang::ento::Loc::isLocType(), makeZeroVal(), MemMgr, SymMgr, and clang::ast_matchers::type.

◆ convertToArrayIndex()

SVal SValBuilder::convertToArrayIndex ( SVal  val)

Definition at line 117 of file SValBuilder.cpp.

References ArrayIndexTy, ArrayIndexWidth, evalCast(), clang::ento::SVal::getAs(), and clang::ento::SVal::isUnknownOrUndef().

Referenced by clang::ento::StoreManager::getLValueElement().

◆ evalBinOp()

SVal SValBuilder::evalBinOp ( ProgramStateRef  state,
BinaryOperator::Opcode  op,
SVal  lhs,
SVal  rhs,
QualType  type 
)

Definition at line 491 of file SValBuilder.cpp.

References clang::ento::SVal::castAs(), evalBinOpLL(), evalBinOpLN(), evalBinOpNN(), clang::ento::SVal::getAs(), clang::ento::SVal::isUndef(), clang::ento::SVal::isUnknown(), makeIntVal(), and clang::ast_matchers::type.

Referenced by assumeCollectionNonEmpty(), clang::ento::ExprEngine::bindReturnValue(), clang::ento::ExprEngine::evalBinOp(), evalComparison(), evalEQ(), and clang::ento::errno_modeling::setErrnoForStdFailure().

◆ evalBinOpLL()

virtual SVal clang::ento::SValBuilder::evalBinOpLL ( ProgramStateRef  state,
BinaryOperator::Opcode  op,
Loc  lhs,
Loc  rhs,
QualType  resultTy 
)
pure virtual

Create a new value which represents a binary expression with two memory location operands.

Referenced by evalBinOp().

◆ evalBinOpLN()

virtual SVal clang::ento::SValBuilder::evalBinOpLN ( ProgramStateRef  state,
BinaryOperator::Opcode  op,
Loc  lhs,
NonLoc  rhs,
QualType  resultTy 
)
pure virtual

Create a new value which represents a binary expression with a memory location and non-location operands.

For example, this would be used to evaluate a pointer arithmetic operation.

Referenced by evalBinOp().

◆ evalBinOpNN()

virtual SVal clang::ento::SValBuilder::evalBinOpNN ( ProgramStateRef  state,
BinaryOperator::Opcode  op,
NonLoc  lhs,
NonLoc  rhs,
QualType  resultTy 
)
pure virtual

Create a new value which represents a binary expression with two non- location operands.

Referenced by clang::ento::ProgramState::assumeInBoundDual(), clang::ento::iterator::assumeNoOverflow(), compareValueToThreshold(), computeOffset(), doRearrangeUnchecked(), evalBinOp(), evalIntegralCast(), getIndex(), and isInRelation().

◆ evalCast()

SVal SValBuilder::evalCast ( SVal  V,
QualType  CastTy,
QualType  OriginalTy 
)

Cast a given SVal to another SVal using given QualType's.

Parameters
V– SVal that should be casted.
CastTy– QualType that V should be casted according to.
OriginalTy– QualType which is associated to V. It provides additional information about what type the cast performs from.
Returns
the most appropriate casted SVal. Note: Many cases don't use an exact OriginalTy. It can be extracted from SVal or the cast can performs unconditionaly. Always pass OriginalTy! It can be crucial in certain cases and generates different results. FIXME: If OriginalTy.isNull() is true, then cast performs based on CastTy only. This behavior is uncertain and should be improved.

Definition at line 1102 of file SValBuilder.cpp.

References V.

Referenced by clang::ento::SimpleConstraintManager::assumeInternal(), castArgToParamTypeIfNeeded(), convertToArrayIndex(), evalIntegralCast(), getConstantVal(), clang::ento::CXXInstanceCall::getCXXThisVal(), clang::ento::CXXInstanceCall::getInitialStackFrameContents(), clang::ento::ExprEngine::handleLValueBitCast(), clang::ento::ExprEngine::processCallExit(), clang::ento::ExprEngine::VisitBinaryOperator(), clang::ento::ExprEngine::VisitCast(), clang::ento::ExprEngine::VisitCXXNewExpr(), and clang::ento::ExprEngine::VisitLogicalExpr().

◆ evalComplement()

SVal SValBuilder::evalComplement ( NonLoc  val)

Definition at line 466 of file SValBuilder.cpp.

References Context, clang::ento::nonloc::SymbolVal::getSymbol(), clang::ento::nonloc::ConcreteInt::getValue(), makeIntVal(), makeNonLoc(), and X.

Referenced by evalUnaryOp(), and clang::ento::ExprEngine::VisitUnaryOperator().

◆ evalEQ() [1/2]

DefinedOrUnknownSVal SValBuilder::evalEQ ( ProgramStateRef  state,
DefinedOrUnknownSVal  lhs,
DefinedOrUnknownSVal  rhs 
)

Definition at line 550 of file SValBuilder.cpp.

References clang::ento::SVal::castAs(), and evalEQ().

◆ evalEQ() [2/2]

SVal SValBuilder::evalEQ ( ProgramStateRef  state,
SVal  lhs,
SVal  rhs 
)

Definition at line 546 of file SValBuilder.cpp.

References evalBinOp(), and getConditionType().

Referenced by areEqual(), evalEQ(), mayBeSuccess(), and clang::ento::ExprEngine::VisitIncrementDecrementOperator().

◆ evalIntegralCast()

SVal SValBuilder::evalIntegralCast ( ProgramStateRef  state,
SVal  val,
QualType  castTy,
QualType  originalType 
)

Definition at line 593 of file SValBuilder.cpp.

References clang::ento::SVal::castAs(), evalBinOpNN(), evalCast(), clang::ento::SVal::getAs(), clang::ento::SVal::getAsSymbol(), getConditionType(), getContext(), clang::ento::APSIntType::getMaxValue(), clang::Type::isUnsignedIntegerType(), makeIntVal(), and makeNonLoc().

Referenced by clang::ento::ExprEngine::VisitCast().

◆ evalMinus()

SVal SValBuilder::evalMinus ( NonLoc  val)

Definition at line 454 of file SValBuilder.cpp.

References Context, clang::ento::nonloc::SymbolVal::getSymbol(), clang::ento::nonloc::ConcreteInt::getValue(), makeIntVal(), makeNonLoc(), and X.

Referenced by evalUnaryOp(), clang::ento::ExprEngine::handleLValueBitCast(), and clang::ento::ExprEngine::VisitUnaryOperator().

◆ evalUnaryOp()

SVal SValBuilder::evalUnaryOp ( ProgramStateRef  state,
UnaryOperator::Opcode  opc,
SVal  operand,
QualType  type 
)

Definition at line 478 of file SValBuilder.cpp.

References evalComplement(), evalMinus(), and clang::ento::SVal::getAs().

◆ getAllocaRegionVal()

loc::MemRegionVal SValBuilder::getAllocaRegionVal ( const Expr *  E,
const LocationContext *  LCtx,
unsigned  Count 
)

Create an SVal representing the result of an alloca()-like call, that is, an AllocaRegion on the stack.

After calling this function, it's a good idea to set the extent of the returned AllocaRegion.

Definition at line 232 of file SValBuilder.cpp.

References E, clang::ento::MemRegionManager::getAllocaRegion(), getRegionManager(), and VisitCount.

◆ getAnalyzerOptions()

const AnalyzerOptions & clang::ento::SValBuilder::getAnalyzerOptions ( ) const
inline

Definition at line 170 of file SValBuilder.h.

References AnOpts.

Referenced by tryRearrange().

◆ getArrayIndexType()

QualType clang::ento::SValBuilder::getArrayIndexType ( ) const
inline

Definition at line 157 of file SValBuilder.h.

References ArrayIndexTy.

Referenced by clang::ento::ProgramState::assumeInBoundDual(), clang::ento::ExprEngine::bindReturnValue(), computeOffset(), and clang::ento::MemRegionManager::getStaticSize().

◆ getBasicValueFactory() [1/2]

BasicValueFactory & clang::ento::SValBuilder::getBasicValueFactory ( )
inline

Definition at line 161 of file SValBuilder.h.

References BasicVals.

Referenced by clang::ento::ProgramState::assumeInBoundDual(), clang::ento::iterator::assumeNoOverflow(), doRearrangeUnchecked(), clang::ento::SimpleConstraintManager::getBasicVals(), clang::ento::StoreManager::getLValueElement(), getStartIndex(), isInRelation(), isWithinConstantOverflowBounds(), and processArgument().

◆ getBasicValueFactory() [2/2]

const BasicValueFactory & clang::ento::SValBuilder::getBasicValueFactory ( ) const
inline

Definition at line 162 of file SValBuilder.h.

References BasicVals.

◆ getBlockPointer()

DefinedSVal SValBuilder::getBlockPointer ( const BlockDecl *  block,
CanQualType  locTy,
const LocationContext *  locContext,
unsigned  blockCount 
)

Definition at line 295 of file SValBuilder.cpp.

References clang::LocationContext::getAnalysisDeclContext(), clang::ento::MemRegionManager::getBlockCodeRegion(), clang::ento::MemRegionManager::getBlockDataRegion(), and MemMgr.

Referenced by clang::ento::ExprEngine::VisitBlockExpr().

◆ getCastedMemRegionVal()

std::optional< loc::MemRegionVal > SValBuilder::getCastedMemRegionVal ( const MemRegion *  region,
QualType  type 
)

Return MemRegionVal on success cast, otherwise return std::nullopt.

Definition at line 307 of file SValBuilder.cpp.

References clang::ento::StoreManager::castRegion(), clang::ento::ProgramStateManager::getStoreManager(), and StateMgr.

◆ getConditionType()

QualType clang::ento::SValBuilder::getConditionType ( ) const
inline

Definition at line 153 of file SValBuilder.h.

References clang::ASTContext::BoolTy, Context, clang::ASTContext::getLangOpts(), and clang::ASTContext::IntTy.

Referenced by assumeCollectionNonEmpty(), clang::ento::iterator::assumeNoOverflow(), compareValueToThreshold(), doRearrangeUnchecked(), evalComparison(), evalEQ(), evalIntegralCast(), clang::ento::ExprEngine::getInitialState(), isInRelation(), clang::ento::errno_modeling::setErrnoForStdFailure(), and tryRearrange().

◆ getConjuredHeapSymbolVal() [1/2]

DefinedSVal SValBuilder::getConjuredHeapSymbolVal ( const Expr *  E,
const LocationContext *  LCtx,
QualType  type,
unsigned  Count 
)

Conjure a symbol representing heap allocated memory region.

Note, now, the expression doesn't need to represent a location. But the type need to!

Definition at line 216 of file SValBuilder.cpp.

References clang::ento::SymbolManager::canSymbolicate(), clang::ento::SVal::castAs(), clang::ento::SymbolManager::conjureSymbol(), E, clang::ento::MemRegionManager::getSymbolicHeapRegion(), clang::ento::Loc::isLocType(), makeZeroVal(), MemMgr, SymMgr, clang::ast_matchers::type, and VisitCount.

◆ getConjuredHeapSymbolVal() [2/2]

DefinedSVal SValBuilder::getConjuredHeapSymbolVal ( const Expr *  E,
const LocationContext *  LCtx,
unsigned  Count 
)

Conjure a symbol representing heap allocated memory region.

Note, the expression should represent a location.

Definition at line 209 of file SValBuilder.cpp.

References E, getConjuredHeapSymbolVal(), clang::Expr::getType(), clang::T, and VisitCount.

Referenced by clang::ento::ExprEngine::bindReturnValue(), getConjuredHeapSymbolVal(), and clang::ento::ExprEngine::VisitCXXNewExpr().

◆ getConstantVal()

std::optional< SVal > SValBuilder::getConstantVal ( const Expr *  E)

Returns the value of E, if it can be determined in a non-path-sensitive manner.

If E is not a constant or cannot be modeled, returns std::nullopt.

Definition at line 328 of file SValBuilder.cpp.

References clang::C, E, evalCast(), clang::Expr::EvaluateAsInt(), getConstantVal(), getContext(), getRegionManager(), clang::Stmt::getStmtClass(), clang::Expr::getType(), clang::Expr::IgnoreParens(), clang::Expr::isGLValue(), clang::ento::Loc::isLocType(), clang::Expr::isNullPointerConstant(), makeBoolVal(), makeIntVal(), makeLoc(), makeNullWithType(), makeTruthVal(), makeZeroVal(), clang::Expr::NPC_ValueDependentIsNotNull, and clang::Result.

Referenced by getConstantVal(), clang::ento::Environment::getSVal(), and clang::ento::ExprEngine::Visit().

◆ getContext() [1/2]

ASTContext & clang::ento::SValBuilder::getContext ( )
inline

Definition at line 148 of file SValBuilder.h.

References Context.

Referenced by clang::ento::ProgramState::assumeInBoundDual(), clang::ento::SimpleConstraintManager::assumeInternal(), bindRequiredArrayElementToEnvironment(), collectSubRegionBindings(), clang::ento::ExprEngine::computeObjectUnderConstruction(), computeOffset(), evalIntegralCast(), getConstantVal(), getCXXThis(), clang::ento::CXXInstanceCall::getCXXThisVal(), getExistingLazyBinding(), getIndex(), clang::ento::CXXInstanceCall::getInitialStackFrameContents(), isUnsigned(), clang::ento::StoreManager::MakeElementRegion(), and clang::ento::ExprEngine::VisitCXXNewExpr().

◆ getContext() [2/2]

const ASTContext & clang::ento::SValBuilder::getContext ( ) const
inline

Definition at line 149 of file SValBuilder.h.

References Context.

◆ getCXXThis() [1/2]

loc::MemRegionVal SValBuilder::getCXXThis ( const CXXMethodDecl *  D,
const StackFrameContext *  SFC 
)

Return a memory region for the 'this' object reference.

Definition at line 314 of file SValBuilder.cpp.

References D, and getRegionManager().

Referenced by clang::ento::ExprEngine::computeObjectUnderConstruction(), clang::ento::CallEventManager::getCaller(), clang::ento::BlockCall::getInitialStackFrameContents(), clang::ento::CXXInstanceCall::getInitialStackFrameContents(), clang::ento::AnyCXXConstructorCall::getInitialStackFrameContents(), clang::ento::ExprEngine::getInitialState(), clang::ento::ExprEngine::ProcessBaseDtor(), clang::ento::ExprEngine::processCallExit(), clang::ento::ExprEngine::ProcessInitializer(), clang::ento::ExprEngine::ProcessMemberDtor(), and clang::ento::ExprEngine::VisitCommonDeclRefExpr().

◆ getCXXThis() [2/2]

loc::MemRegionVal SValBuilder::getCXXThis ( const CXXRecordDecl *  D,
const StackFrameContext *  SFC 
)

Return a memory region for the 'this' object reference.

Definition at line 321 of file SValBuilder.cpp.

References D, getContext(), clang::ASTContext::getPointerType(), getRegionManager(), and clang::T.

◆ getDerivedRegionValueSymbolVal()

DefinedOrUnknownSVal SValBuilder::getDerivedRegionValueSymbolVal ( SymbolRef  parentSymbol,
const TypedValueRegion *  region 
)

Definition at line 257 of file SValBuilder.cpp.

References clang::ento::SymbolManager::acquire(), clang::ento::SymbolManager::canSymbolicate(), clang::ento::MemRegionManager::getSymbolicRegion(), clang::ento::TypedValueRegion::getValueType(), clang::ento::Loc::isLocType(), clang::Type::isNullPtrType(), makeZeroVal(), MemMgr, SymMgr, and clang::T.

Referenced by getDerivedSymbolForBinding().

◆ getFunctionPointer()

DefinedSVal SValBuilder::getFunctionPointer ( const FunctionDecl *  func)

Definition at line 291 of file SValBuilder.cpp.

References clang::ento::MemRegionManager::getFunctionCodeRegion(), and MemMgr.

Referenced by getMemberPointer(), clang::ento::ExprEngine::VisitCommonDeclRefExpr(), and clang::ento::ExprEngine::VisitMemberExpr().

◆ getKnownValue()

virtual const llvm::APSInt * clang::ento::SValBuilder::getKnownValue ( ProgramStateRef  state,
SVal  val 
)
pure virtual

Evaluates a given SVal.

If the SVal has only one possible (integer) value, that value is returned. Otherwise, returns NULL.

Referenced by getKnownValue().

◆ getMaxValue()

virtual const llvm::APSInt * clang::ento::SValBuilder::getMaxValue ( ProgramStateRef  state,
SVal  val 
)
pure virtual

Tries to get the maximal possible (integer) value of a given SVal.

This always returns the value of a ConcreteInt, but may return NULL if the value is symbolic and the constraint manager cannot provide a useful answer.

Referenced by isNegative().

◆ getMemberPointer()

DefinedSVal SValBuilder::getMemberPointer ( const NamedDecl *  ND)

Definition at line 275 of file SValBuilder.cpp.

References getFunctionPointer().

Referenced by clang::ento::ExprEngine::VisitCast(), and clang::ento::ExprEngine::VisitUnaryOperator().

◆ getMetadataSymbolVal()

DefinedSVal SValBuilder::getMetadataSymbolVal ( const void *  symbolTag,
const MemRegion *  region,
const Expr *  expr,
QualType  type,
const LocationContext *  LCtx,
unsigned  count 
)

Definition at line 240 of file SValBuilder.cpp.

References clang::ento::SymbolManager::acquire(), clang::ento::SymbolManager::canSymbolicate(), clang::ast_matchers::expr, clang::ento::MemRegionManager::getSymbolicRegion(), clang::ento::Loc::isLocType(), MemMgr, SymMgr, and clang::ast_matchers::type.

◆ getMinValue()

virtual const llvm::APSInt * clang::ento::SValBuilder::getMinValue ( ProgramStateRef  state,
SVal  val 
)
pure virtual

Tries to get the minimal possible (integer) value of a given SVal.

This always returns the value of a ConcreteInt, but may return NULL if the value is symbolic and the constraint manager cannot provide a useful answer.

◆ getRegionManager() [1/2]

MemRegionManager & clang::ento::SValBuilder::getRegionManager ( )
inline

Definition at line 167 of file SValBuilder.h.

References MemMgr.

Referenced by addParameterValuesToBindings(), bindRequiredArrayElementToEnvironment(), clang::ento::ExprEngine::computeObjectUnderConstruction(), getAllocaRegionVal(), getConstantVal(), getCXXThis(), clang::ento::ObjCMethodCall::getInitialStackFrameContents(), clang::ento::ExprEngine::VisitCXXThisExpr(), and clang::ento::ExprEngine::VisitLambdaExpr().

◆ getRegionManager() [2/2]

const MemRegionManager & clang::ento::SValBuilder::getRegionManager ( ) const
inline

Definition at line 168 of file SValBuilder.h.

References MemMgr.

◆ getRegionValueSymbolVal()

DefinedOrUnknownSVal SValBuilder::getRegionValueSymbolVal ( const TypedValueRegion *  region)

Make a unique symbol for value of region.

Definition at line 137 of file SValBuilder.cpp.

References clang::ento::SymbolManager::acquire(), clang::ento::SymbolManager::canSymbolicate(), clang::ento::MemRegionManager::getSymbolicRegion(), clang::ento::TypedValueRegion::getValueType(), clang::ento::Loc::isLocType(), clang::Type::isNullPtrType(), makeZeroVal(), MemMgr, SymMgr, and clang::T.

◆ getStateManager()

ProgramStateManager & clang::ento::SValBuilder::getStateManager ( )
inline

Definition at line 151 of file SValBuilder.h.

References StateMgr.

◆ getSymbolManager() [1/2]

SymbolManager & clang::ento::SValBuilder::getSymbolManager ( )
inline

Definition at line 164 of file SValBuilder.h.

References SymMgr.

Referenced by doRearrangeUnchecked(), clang::ento::MemRegionManager::getStaticSize(), clang::ento::CheckerContext::getSymbolManager(), and clang::ento::SimpleConstraintManager::getSymbolManager().

◆ getSymbolManager() [2/2]

const SymbolManager & clang::ento::SValBuilder::getSymbolManager ( ) const
inline

Definition at line 165 of file SValBuilder.h.

References SymMgr.

◆ makeArrayIndex()

NonLoc clang::ento::SValBuilder::makeArrayIndex ( uint64_t  idx)
inline

Definition at line 282 of file SValBuilder.h.

References ArrayIndexTy, and BasicVals.

Referenced by clang::ento::ExprEngine::computeObjectUnderConstruction(), computeOffset(), escapeByStartIndexAndCount(), clang::ento::StoreManager::MakeElementRegion(), clang::ento::ExprEngine::ProcessDeleteDtor(), clang::ento::ExprEngine::VisitCXXNewExpr(), and clang::ento::ExprEngine::VisitIncrementDecrementOperator().

◆ makeBoolVal() [1/2]

nonloc::ConcreteInt SValBuilder::makeBoolVal ( const CXXBoolLiteralExpr *  boolean)

Definition at line 132 of file SValBuilder.cpp.

References clang::CXXBoolLiteralExpr::getValue(), and makeTruthVal().

◆ makeBoolVal() [2/2]

nonloc::ConcreteInt clang::ento::SValBuilder::makeBoolVal ( const ObjCBoolLiteralExpr *  boolean)
inline

Definition at line 294 of file SValBuilder.h.

References clang::Expr::getType(), clang::ObjCBoolLiteralExpr::getValue(), and makeTruthVal().

Referenced by getConstantVal().

◆ makeCompoundVal()

NonLoc clang::ento::SValBuilder::makeCompoundVal ( QualType  type,
llvm::ImmutableList< SVal >  vals 
)
inline

Definition at line 260 of file SValBuilder.h.

References BasicVals, clang::ento::BasicValueFactory::getCompoundValData(), and clang::ast_matchers::type.

Referenced by makeZeroVal(), processArgument(), and clang::ento::ExprEngine::VisitInitListExpr().

◆ makeIntLocVal()

loc::ConcreteInt clang::ento::SValBuilder::makeIntLocVal ( const llvm::APSInt &  integer)
inline

Definition at line 304 of file SValBuilder.h.

References BasicVals.

◆ makeIntVal() [1/5]

nonloc::ConcreteInt clang::ento::SValBuilder::makeIntVal ( const IntegerLiteral *  integer)
inline

Definition at line 288 of file SValBuilder.h.

References BasicVals, clang::Expr::getType(), clang::APIntStorage::getValue(), and clang::Type::isUnsignedIntegerOrEnumerationType().

Referenced by assumeCollectionNonEmpty(), clang::ento::ExprEngine::bindReturnValue(), evalBinOp(), evalComplement(), evalIntegralCast(), evalMinus(), getConstantVal(), getIndex(), getSimplifiedOffsets(), clang::ento::MemRegionManager::getStaticSize(), clang::ento::CheckerContext::isGreaterOrEqual(), clang::ento::CheckerContext::isNegative(), makeZeroVal(), mayBeSuccess(), populateObjCForDestinationSet(), REGISTER_TRAIT_WITH_PROGRAMSTATE(), clang::ento::ExprEngine::VisitCommonDeclRefExpr(), clang::ento::ExprEngine::VisitIncrementDecrementOperator(), clang::ento::ExprEngine::VisitLogicalExpr(), clang::ento::ExprEngine::VisitOffsetOfExpr(), and clang::ento::ExprEngine::VisitUnaryExprOrTypeTraitExpr().

◆ makeIntVal() [2/5]

NonLoc clang::ento::SValBuilder::makeIntVal ( const llvm::APInt &  integer,
bool  isUnsigned 
)
inline

Definition at line 308 of file SValBuilder.h.

References BasicVals, and isUnsigned().

◆ makeIntVal() [3/5]

nonloc::ConcreteInt clang::ento::SValBuilder::makeIntVal ( const llvm::APSInt &  integer)
inline

Definition at line 300 of file SValBuilder.h.

References BasicVals.

◆ makeIntVal() [4/5]

NonLoc clang::ento::SValBuilder::makeIntVal ( uint64_t  integer,
bool  isUnsigned 
)
inline

Definition at line 319 of file SValBuilder.h.

References BasicVals, clang::ento::BasicValueFactory::getIntValue(), and isUnsigned().

◆ makeIntVal() [5/5]

DefinedSVal clang::ento::SValBuilder::makeIntVal ( uint64_t  integer,
QualType  type 
)
inline

Definition at line 312 of file SValBuilder.h.

References BasicVals, clang::ento::Loc::isLocType(), and clang::ast_matchers::type.

◆ makeIntValWithWidth()

NonLoc clang::ento::SValBuilder::makeIntValWithWidth ( QualType  ptrType,
uint64_t  integer 
)
inline

Definition at line 323 of file SValBuilder.h.

References BasicVals.

Referenced by clang::ento::ExprEngine::Visit().

◆ makeLazyCompoundVal()

NonLoc clang::ento::SValBuilder::makeLazyCompoundVal ( const StoreRef &  store,
const TypedValueRegion *  region 
)
inline

Definition at line 264 of file SValBuilder.h.

References BasicVals, and clang::ento::BasicValueFactory::getLazyCompoundValData().

◆ makeLoc() [1/4]

loc::GotoLabel clang::ento::SValBuilder::makeLoc ( const AddrLabelExpr *  expr)
inline

Definition at line 382 of file SValBuilder.h.

References clang::ast_matchers::expr.

◆ makeLoc() [2/4]

loc::ConcreteInt clang::ento::SValBuilder::makeLoc ( const llvm::APSInt &  integer)
inline

Definition at line 386 of file SValBuilder.h.

References BasicVals.

◆ makeLoc() [3/4]

loc::MemRegionVal clang::ento::SValBuilder::makeLoc ( const MemRegion *  region)
inline

Definition at line 378 of file SValBuilder.h.

◆ makeLoc() [4/4]

loc::MemRegionVal clang::ento::SValBuilder::makeLoc ( SymbolRef  sym)
inline

Definition at line 374 of file SValBuilder.h.

References clang::ento::MemRegionManager::getSymbolicRegion(), and MemMgr.

Referenced by addParameterValuesToBindings(), clang::ento::ExprEngine::computeObjectUnderConstruction(), getConstantVal(), clang::ento::ObjCMethodCall::getInitialStackFrameContents(), clang::ento::StoreManager::getLValueVar(), makeSymbolVal(), and populateObjCForDestinationSet().

◆ makeLocAsInteger()

NonLoc clang::ento::SValBuilder::makeLocAsInteger ( Loc  loc,
unsigned  bits 
)
inline

Definition at line 327 of file SValBuilder.h.

References BasicVals, and clang::ento::BasicValueFactory::getPersistentSValWithData().

◆ makeNonLoc() [1/5]

nonloc::SymbolVal SValBuilder::makeNonLoc ( APSIntPtr  rhs,
BinaryOperator::Opcode  op,
const SymExpr *  lhs,
QualType  type 
)

Definition at line 85 of file SValBuilder.cpp.

References clang::ento::SymbolManager::acquire(), clang::ento::Loc::isLocType(), SymMgr, and clang::ast_matchers::type.

◆ makeNonLoc() [2/5]

nonloc::SymbolVal SValBuilder::makeNonLoc ( const SymExpr *  lhs,
BinaryOperator::Opcode  op,
APSIntPtr  rhs,
QualType  type 
)

Definition at line 77 of file SValBuilder.cpp.

References clang::ento::SymbolManager::acquire(), clang::ento::Loc::isLocType(), SymMgr, and clang::ast_matchers::type.

Referenced by evalComplement(), evalIntegralCast(), evalMinus(), and makeSymExprValNN().

◆ makeNonLoc() [3/5]

nonloc::SymbolVal SValBuilder::makeNonLoc ( const SymExpr *  lhs,
BinaryOperator::Opcode  op,
const SymExpr *  rhs,
QualType  type 
)

Definition at line 93 of file SValBuilder.cpp.

References clang::ento::SymbolManager::acquire(), clang::ento::Loc::isLocType(), SymMgr, and clang::ast_matchers::type.

◆ makeNonLoc() [4/5]

nonloc::SymbolVal SValBuilder::makeNonLoc ( const SymExpr *  operand,
QualType  fromTy,
QualType  toTy 
)

Create a NonLoc value for cast.

Definition at line 108 of file SValBuilder.cpp.

References clang::ento::SymbolManager::acquire(), clang::ento::Loc::isLocType(), and SymMgr.

◆ makeNonLoc() [5/5]

NonLoc SValBuilder::makeNonLoc ( const SymExpr *  operand,
UnaryOperator::Opcode  op,
QualType  type 
)

Definition at line 101 of file SValBuilder.cpp.

References clang::ento::SymbolManager::acquire(), clang::ento::Loc::isLocType(), SymMgr, and clang::ast_matchers::type.

◆ makeNullWithType()

loc::ConcreteInt clang::ento::SValBuilder::makeNullWithType ( QualType  type)
inline

Create NULL pointer, with proper pointer bit-width for given address space.

Parameters
typepointer type.

Definition at line 358 of file SValBuilder.h.

References BasicVals, Context, clang::ASTContext::getPointerType(), clang::ento::BasicValueFactory::getZeroWithTypeSize(), and clang::ast_matchers::type.

Referenced by getConstantVal(), makeZeroVal(), clang::ento::ExprEngine::VisitCast(), and clang::ento::ExprEngine::VisitUnaryOperator().

◆ makePointerToMember() [1/2]

NonLoc clang::ento::SValBuilder::makePointerToMember ( const DeclaratorDecl *  DD)
inline

Definition at line 270 of file SValBuilder.h.

Referenced by clang::ento::ExprEngine::VisitCast().

◆ makePointerToMember() [2/2]

NonLoc clang::ento::SValBuilder::makePointerToMember ( const PointerToMemberData *  PTMD)
inline

Definition at line 274 of file SValBuilder.h.

◆ makeSymbolVal()

DefinedSVal clang::ento::SValBuilder::makeSymbolVal ( SymbolRef  Sym)
inline

Make an SVal that represents the given symbol.

This follows the convention of representing Loc-type symbols (symbolic pointers and references) as Loc values wrapping the symbol rather than as plain symbol values.

Definition at line 397 of file SValBuilder.h.

References clang::ento::SymExpr::getType(), clang::ento::Loc::isLocType(), and makeLoc().

Referenced by clang::ento::SMTConstraintManager::canReasonAbout(), and clang::ento::simplifyToSVal().

◆ makeSymExprValNN()

SVal SValBuilder::makeSymExprValNN ( BinaryOperator::Opcode  op,
NonLoc  lhs,
NonLoc  rhs,
QualType  resultTy 
)

Constructs a symbolic expression for two non-location values.

Definition at line 427 of file SValBuilder.cpp.

References AnOpts, clang::ento::SymExpr::computeComplexity(), clang::ento::SVal::getAs(), clang::ento::SVal::getAsSymbol(), and makeNonLoc().

◆ makeTruthVal() [1/2]

nonloc::ConcreteInt clang::ento::SValBuilder::makeTruthVal ( bool  b)
inline

Definition at line 351 of file SValBuilder.h.

References b, BasicVals, and clang::ento::BasicValueFactory::getTruthValue().

◆ makeTruthVal() [2/2]

nonloc::ConcreteInt clang::ento::SValBuilder::makeTruthVal ( bool  b,
QualType  type 
)
inline

Definition at line 347 of file SValBuilder.h.

References b, BasicVals, clang::ento::BasicValueFactory::getTruthValue(), and clang::ast_matchers::type.

Referenced by getConstantVal(), makeBoolVal(), clang::ento::ExprEngine::VisitCast(), and clang::ento::ExprEngine::VisitIncrementDecrementOperator().

◆ makeZeroArrayIndex()

NonLoc clang::ento::SValBuilder::makeZeroArrayIndex ( )
inline

Definition at line 278 of file SValBuilder.h.

References ArrayIndexTy, and BasicVals.

Referenced by computeOffset(), and clang::ento::StoreManager::GetElementZeroRegion().

◆ makeZeroVal()

DefinedOrUnknownSVal SValBuilder::makeZeroVal ( QualType  type)

Construct an SVal representing '0' for the specified type.

Definition at line 62 of file SValBuilder.cpp.

References BasicVals, clang::ento::BasicValueFactory::getEmptySValList(), clang::ento::Loc::isLocType(), makeCompoundVal(), makeIntVal(), makeNullWithType(), and clang::ast_matchers::type.

Referenced by conjureSymbolVal(), getConjuredHeapSymbolVal(), getConstantVal(), getDerivedRegionValueSymbolVal(), clang::ento::ExprEngine::getInitialState(), getRegionValueSymbolVal(), clang::ento::errno_modeling::setErrnoForStdFailure(), clang::ento::ExprEngine::VisitIncrementDecrementOperator(), clang::ento::ExprEngine::VisitInitListExpr(), and clang::ento::ExprEngine::VisitUnaryOperator().

◆ simplifySVal()

virtual SVal clang::ento::SValBuilder::simplifySVal ( ProgramStateRef  State,
SVal  Val 
)
pure virtual

Simplify symbolic expressions within a given SVal.

Return an SVal that represents the same value, but is hopefully easier to work with than the original SVal.

Referenced by clang::ento::ExprEngine::handleLValueBitCast(), and clang::ento::simplifyToSVal().

Member Data Documentation

◆ AnOpts

const AnalyzerOptions& clang::ento::SValBuilder::AnOpts
protected

Definition at line 70 of file SValBuilder.h.

Referenced by getAnalyzerOptions(), and makeSymExprValNN().

◆ ArrayIndexTy

const QualType clang::ento::SValBuilder::ArrayIndexTy
protected

The scalar type to use for array indices.

Definition at line 73 of file SValBuilder.h.

Referenced by convertToArrayIndex(), getArrayIndexType(), makeArrayIndex(), and makeZeroArrayIndex().

◆ ArrayIndexWidth

const unsigned clang::ento::SValBuilder::ArrayIndexWidth
protected

The width of the scalar type used for array indices.

Definition at line 76 of file SValBuilder.h.

Referenced by convertToArrayIndex().

◆ BasicVals

BasicValueFactory clang::ento::SValBuilder::BasicVals
protected

Manager of APSInt values.

Definition at line 60 of file SValBuilder.h.

Referenced by getBasicValueFactory(), makeArrayIndex(), makeCompoundVal(), makeIntLocVal(), makeIntVal(), makeIntValWithWidth(), makeLazyCompoundVal(), makeLoc(), makeLocAsInteger(), makeNullWithType(), makeTruthVal(), makeZeroArrayIndex(), and makeZeroVal().

◆ Context

ASTContext& clang::ento::SValBuilder::Context
protected

Definition at line 57 of file SValBuilder.h.

Referenced by evalComplement(), evalMinus(), getConditionType(), getContext(), and makeNullWithType().

◆ MemMgr

MemRegionManager clang::ento::SValBuilder::MemMgr
protected

Manages the creation of memory regions.

Definition at line 66 of file SValBuilder.h.

Referenced by conjureSymbolVal(), getBlockPointer(), getConjuredHeapSymbolVal(), getDerivedRegionValueSymbolVal(), getFunctionPointer(), getMetadataSymbolVal(), getRegionManager(), getRegionValueSymbolVal(), and makeLoc().

◆ StateMgr

ProgramStateManager& clang::ento::SValBuilder::StateMgr
protected

Definition at line 68 of file SValBuilder.h.

Referenced by getCastedMemRegionVal(), and getStateManager().

◆ SymMgr

SymbolManager clang::ento::SValBuilder::SymMgr
protected

Manages the creation of symbols.

Definition at line 63 of file SValBuilder.h.

Referenced by conjureSymbol(), conjureSymbolVal(), getConjuredHeapSymbolVal(), getDerivedRegionValueSymbolVal(), getMetadataSymbolVal(), getRegionValueSymbolVal(), getSymbolManager(), and makeNonLoc().

The documentation for this class was generated from the following files:
Generated on Thu May 15 2025 02:25:50 for clang by doxygen 1.9.6