#include "clang/StaticAnalyzer/Core/PathSensitive/SValBuilder.h"

Public Member Functions
	SValBuilder (llvm::BumpPtrAllocator &alloc, ASTContext &context, ProgramStateManager &stateMgr)

virtual	~SValBuilder ()=default

SVal	evalCast (SVal V, QualType CastTy, QualType OriginalTy)
	Cast a given SVal to another SVal using given QualType's.

SVal	evalIntegralCast (ProgramStateRef state, SVal val, QualType castTy, QualType originalType)

SVal	evalMinus (NonLoc val)

SVal	evalComplement (NonLoc val)

virtual SVal	evalBinOpNN (ProgramStateRef state, BinaryOperator::Opcode op, NonLoc lhs, NonLoc rhs, QualType resultTy)=0
	Create a new value which represents a binary expression with two non- location operands.

virtual SVal	evalBinOpLL (ProgramStateRef state, BinaryOperator::Opcode op, Loc lhs, Loc rhs, QualType resultTy)=0
	Create a new value which represents a binary expression with two memory location operands.

virtual SVal	evalBinOpLN (ProgramStateRef state, BinaryOperator::Opcode op, Loc lhs, NonLoc rhs, QualType resultTy)=0
	Create a new value which represents a binary expression with a memory location and non-location operands.

virtual const llvm::APSInt *	getKnownValue (ProgramStateRef state, SVal val)=0
	Evaluates a given SVal.

virtual SVal	simplifySVal (ProgramStateRef State, SVal Val)=0
	Simplify symbolic expressions within a given SVal.

SVal	makeSymExprValNN (BinaryOperator::Opcode op, NonLoc lhs, NonLoc rhs, QualType resultTy)
	Constructs a symbolic expression for two non-location values.

SVal	evalUnaryOp (ProgramStateRef state, UnaryOperator::Opcode opc, SVal operand, QualType type)

SVal	evalBinOp (ProgramStateRef state, BinaryOperator::Opcode op, SVal lhs, SVal rhs, QualType type)

ConditionTruthVal	areEqual (ProgramStateRef state, SVal lhs, SVal rhs)

SVal	evalEQ (ProgramStateRef state, SVal lhs, SVal rhs)

DefinedOrUnknownSVal	evalEQ (ProgramStateRef state, DefinedOrUnknownSVal lhs, DefinedOrUnknownSVal rhs)

ASTContext &	getContext ()

const ASTContext &	getContext () const

ProgramStateManager &	getStateManager ()

QualType	getConditionType () const

QualType	getArrayIndexType () const

BasicValueFactory &	getBasicValueFactory ()

const BasicValueFactory &	getBasicValueFactory () const

SymbolManager &	getSymbolManager ()

const SymbolManager &	getSymbolManager () const

MemRegionManager &	getRegionManager ()

const MemRegionManager &	getRegionManager () const

const AnalyzerOptions &	getAnalyzerOptions () const

const SymbolConjured *	conjureSymbol (const Stmt stmt, const LocationContext LCtx, QualType type, unsigned visitCount, const void *symbolTag=nullptr)

const SymbolConjured *	conjureSymbol (const Expr expr, const LocationContext LCtx, unsigned visitCount, const void *symbolTag=nullptr)

DefinedOrUnknownSVal	makeZeroVal (QualType type)
	Construct an SVal representing '0' for the specified type.

DefinedOrUnknownSVal	getRegionValueSymbolVal (const TypedValueRegion *region)
	Make a unique symbol for value of region.

DefinedOrUnknownSVal	conjureSymbolVal (const void symbolTag, const Expr expr, const LocationContext *LCtx, unsigned count)
	Create a new symbol with a unique 'name'.

DefinedOrUnknownSVal	conjureSymbolVal (const void symbolTag, const Expr expr, const LocationContext *LCtx, QualType type, unsigned count)

DefinedOrUnknownSVal	conjureSymbolVal (const Stmt stmt, const LocationContext LCtx, QualType type, unsigned visitCount)

DefinedOrUnknownSVal	getConjuredHeapSymbolVal (const Expr E, const LocationContext LCtx, unsigned Count)
	Conjure a symbol representing heap allocated memory region.

DefinedOrUnknownSVal	getConjuredHeapSymbolVal (const Expr E, const LocationContext LCtx, QualType type, unsigned Count)
	Conjure a symbol representing heap allocated memory region.

DefinedOrUnknownSVal	getDerivedRegionValueSymbolVal (SymbolRef parentSymbol, const TypedValueRegion *region)

DefinedSVal	getMetadataSymbolVal (const void symbolTag, const MemRegion region, const Expr expr, QualType type, const LocationContext LCtx, unsigned count)

DefinedSVal	getMemberPointer (const NamedDecl *ND)

DefinedSVal	getFunctionPointer (const FunctionDecl *func)

DefinedSVal	getBlockPointer (const BlockDecl block, CanQualType locTy, const LocationContext locContext, unsigned blockCount)

std::optional< SVal >	getConstantVal (const Expr *E)
	Returns the value of `E`, if it can be determined in a non-path-sensitive manner.

NonLoc	makeCompoundVal (QualType type, llvm::ImmutableList< SVal > vals)

NonLoc	makeLazyCompoundVal (const StoreRef &store, const TypedValueRegion *region)

NonLoc	makePointerToMember (const DeclaratorDecl *DD)

NonLoc	makePointerToMember (const PointerToMemberData *PTMD)

NonLoc	makeZeroArrayIndex ()

NonLoc	makeArrayIndex (uint64_t idx)

SVal	convertToArrayIndex (SVal val)

nonloc::ConcreteInt	makeIntVal (const IntegerLiteral *integer)

nonloc::ConcreteInt	makeBoolVal (const ObjCBoolLiteralExpr *boolean)

nonloc::ConcreteInt	makeBoolVal (const CXXBoolLiteralExpr *boolean)

nonloc::ConcreteInt	makeIntVal (const llvm::APSInt &integer)

loc::ConcreteInt	makeIntLocVal (const llvm::APSInt &integer)

NonLoc	makeIntVal (const llvm::APInt &integer, bool isUnsigned)

DefinedSVal	makeIntVal (uint64_t integer, QualType type)

NonLoc	makeIntVal (uint64_t integer, bool isUnsigned)

NonLoc	makeIntValWithWidth (QualType ptrType, uint64_t integer)

NonLoc	makeLocAsInteger (Loc loc, unsigned bits)

nonloc::SymbolVal	makeNonLoc (const SymExpr *lhs, BinaryOperator::Opcode op, const llvm::APSInt &rhs, QualType type)

nonloc::SymbolVal	makeNonLoc (const llvm::APSInt &rhs, BinaryOperator::Opcode op, const SymExpr *lhs, QualType type)

nonloc::SymbolVal	makeNonLoc (const SymExpr lhs, BinaryOperator::Opcode op, const SymExpr rhs, QualType type)

NonLoc	makeNonLoc (const SymExpr *operand, UnaryOperator::Opcode op, QualType type)

nonloc::SymbolVal	makeNonLoc (const SymExpr *operand, QualType fromTy, QualType toTy)
	Create a NonLoc value for cast.

nonloc::ConcreteInt	makeTruthVal (bool b, QualType type)

nonloc::ConcreteInt	makeTruthVal (bool b)

loc::ConcreteInt	makeNullWithType (QualType type)
	Create NULL pointer, with proper pointer bit-width for given address space.

loc::MemRegionVal	makeLoc (SymbolRef sym)

loc::MemRegionVal	makeLoc (const MemRegion *region)

loc::GotoLabel	makeLoc (const AddrLabelExpr *expr)

loc::ConcreteInt	makeLoc (const llvm::APSInt &integer)

std::optional< loc::MemRegionVal >	getCastedMemRegionVal (const MemRegion *region, QualType type)
	Return MemRegionVal on success cast, otherwise return std::nullopt.

DefinedSVal	makeSymbolVal (SymbolRef Sym)
	Make an SVal that represents the given symbol.

loc::MemRegionVal	getCXXThis (const CXXMethodDecl D, const StackFrameContext SFC)
	Return a memory region for the 'this' object reference.

loc::MemRegionVal	getCXXThis (const CXXRecordDecl D, const StackFrameContext SFC)
	Return a memory region for the 'this' object reference.

Protected Attributes
ASTContext &	Context

BasicValueFactory	BasicVals
	Manager of APSInt values.

SymbolManager	SymMgr
	Manages the creation of symbols.

MemRegionManager	MemMgr
	Manages the creation of memory regions.

ProgramStateManager &	StateMgr

const AnalyzerOptions &	AnOpts

const QualType	ArrayIndexTy
	The scalar type to use for array indices.

const unsigned	ArrayIndexWidth
	The width of the scalar type used for array indices.

Detailed Description

Definition at line 53 of file SValBuilder.h.

Constructor & Destructor Documentation

◆ SValBuilder()

SValBuilder::SValBuilder	(	llvm::BumpPtrAllocator &	alloc,
		ASTContext &	context,
		ProgramStateManager &	stateMgr
	)

Definition at line 52 of file SValBuilder.cpp.

◆ ~SValBuilder()

virtual clang::ento::SValBuilder::~SValBuilder ( )

virtualdefault

Member Function Documentation

◆ areEqual()

ConditionTruthVal SValBuilder::areEqual	(	ProgramStateRef	state,
		SVal	lhs,
		SVal	rhs
	)

Returns: Whether values in lhs and rhs are equal at state.

Definition at line 535 of file SValBuilder.cpp.

References evalEQ().

Referenced by clang::ento::ProgramState::areEqual(), and wasRegionOfInterestModifiedAt().

◆ conjureSymbol() [1/2]

const SymbolConjured * clang::ento::SValBuilder::conjureSymbol	(	const Expr *	expr,
		const LocationContext *	LCtx,
		unsigned	visitCount,
		const void *	symbolTag = `nullptr`
	)

inline

Definition at line 170 of file SValBuilder.h.

References clang::ento::SymbolManager::conjureSymbol(), clang::ast_matchers::expr, and SymMgr.

◆ conjureSymbol() [2/2]

const SymbolConjured * clang::ento::SValBuilder::conjureSymbol	(	const Stmt *	stmt,
		const LocationContext *	LCtx,
		QualType	type,
		unsigned	visitCount,
		const void *	symbolTag = `nullptr`
	)

inline

Definition at line 162 of file SValBuilder.h.

References clang::ento::SymbolManager::conjureSymbol(), clang::ast_matchers::stmt, SymMgr, and clang::ast_matchers::type.

◆ conjureSymbolVal() [1/3]

DefinedOrUnknownSVal SValBuilder::conjureSymbolVal	(	const Stmt *	stmt,
		const LocationContext *	LCtx,
		QualType	type,
		unsigned	visitCount
	)

Definition at line 195 of file SValBuilder.cpp.

References clang::ento::SymbolManager::canSymbolicate(), clang::ento::SymbolManager::conjureSymbol(), clang::ento::MemRegionManager::getSymbolicRegion(), clang::ento::Loc::isLocType(), makeZeroVal(), MemMgr, clang::ast_matchers::stmt, SymMgr, and clang::ast_matchers::type.

◆ conjureSymbolVal() [2/3]

DefinedOrUnknownSVal SValBuilder::conjureSymbolVal	(	const void *	symbolTag,
		const Expr *	expr,
		const LocationContext *	LCtx,
		QualType	type,
		unsigned	count
	)

Definition at line 176 of file SValBuilder.cpp.

References clang::ento::SymbolManager::canSymbolicate(), clang::ento::SymbolManager::conjureSymbol(), clang::ast_matchers::expr, clang::ento::MemRegionManager::getSymbolicRegion(), clang::ento::Loc::isLocType(), makeZeroVal(), MemMgr, SymMgr, and clang::ast_matchers::type.

◆ conjureSymbolVal() [3/3]

DefinedOrUnknownSVal SValBuilder::conjureSymbolVal	(	const void *	symbolTag,
		const Expr *	expr,
		const LocationContext *	LCtx,
		unsigned	count
	)

Create a new symbol with a unique 'name'.

We resort to conjured symbols when we cannot construct a derived symbol. The advantage of symbols derived/built from other symbols is that we preserve the relation between related(or even equivalent) expressions, so conjured symbols should be used sparingly.

Definition at line 158 of file SValBuilder.cpp.

References conjureSymbolVal(), clang::LocationContext::getAnalysisDeclContext(), clang::AnalysisDeclContext::getASTContext(), clang::ASTContext::getPointerType(), clang::Expr::getType(), clang::Expr::isGLValue(), clang::Type::isNullPtrType(), and makeZeroVal().

◆ convertToArrayIndex()

SVal SValBuilder::convertToArrayIndex ( SVal val )

Definition at line 121 of file SValBuilder.cpp.

References ArrayIndexTy, ArrayIndexWidth, evalCast(), clang::ento::SVal::getAs(), and clang::ento::SVal::isUnknownOrUndef().

Referenced by clang::ento::StoreManager::getLValueElement().

◆ evalBinOp()

SVal SValBuilder::evalBinOp	(	ProgramStateRef	state,
		BinaryOperator::Opcode	op,
		SVal	lhs,
		SVal	rhs,
		QualType	type
	)

Definition at line 485 of file SValBuilder.cpp.

References clang::ento::SVal::castAs(), evalBinOpLL(), evalBinOpLN(), evalBinOpNN(), clang::ento::SVal::getAs(), clang::ento::SVal::isUndef(), clang::ento::SVal::isUnknown(), makeIntVal(), and clang::ast_matchers::type.

Referenced by assumeCollectionNonEmpty(), clang::ento::ExprEngine::bindReturnValue(), clang::ento::ExprEngine::evalBinOp(), evalComparison(), evalEQ(), and clang::ento::errno_modeling::setErrnoForStdFailure().

◆ evalBinOpLL()

virtual SVal clang::ento::SValBuilder::evalBinOpLL	(	ProgramStateRef	state,
		BinaryOperator::Opcode	op,
		Loc	lhs,
		Loc	rhs,
		QualType	resultTy
	)

pure virtual

Create a new value which represents a binary expression with two memory location operands.

Referenced by evalBinOp().

◆ evalBinOpLN()

virtual SVal clang::ento::SValBuilder::evalBinOpLN	(	ProgramStateRef	state,
		BinaryOperator::Opcode	op,
		Loc	lhs,
		NonLoc	rhs,
		QualType	resultTy
	)

pure virtual

Create a new value which represents a binary expression with a memory location and non-location operands.

For example, this would be used to evaluate a pointer arithmetic operation.

Referenced by evalBinOp().

◆ evalBinOpNN()

virtual SVal clang::ento::SValBuilder::evalBinOpNN	(	ProgramStateRef	state,
		BinaryOperator::Opcode	op,
		NonLoc	lhs,
		NonLoc	rhs,
		QualType	resultTy
	)

pure virtual

Create a new value which represents a binary expression with two non- location operands.

Referenced by clang::ento::ProgramState::assumeInBoundDual(), clang::ento::iterator::assumeNoOverflow(), compareValueToThreshold(), doRearrangeUnchecked(), evalBinOp(), evalIntegralCast(), and isInRelation().

◆ evalCast()

SVal SValBuilder::evalCast	(	SVal	V,
		QualType	CastTy,
		QualType	OriginalTy
	)

Cast a given SVal to another SVal using given QualType's.

Parameters

V	– SVal that should be casted.
CastTy	– QualType that V should be casted according to.
OriginalTy	– QualType which is associated to V. It provides additional information about what type the cast performs from.

Returns: the most appropriate casted SVal. Note: Many cases don't use an exact OriginalTy. It can be extracted from SVal or the cast can performs unconditionaly. Always pass OriginalTy! It can be crucial in certain cases and generates different results. FIXME: If OriginalTy.isNull() is true, then cast performs based on CastTy only. This behavior is uncertain and should be improved.

Definition at line 1091 of file SValBuilder.cpp.

References V.

Referenced by clang::ento::SimpleConstraintManager::assumeInternal(), castArgToParamTypeIfNeeded(), convertToArrayIndex(), evalIntegralCast(), getConstantVal(), clang::ento::CXXInstanceCall::getInitialStackFrameContents(), clang::ento::ExprEngine::handleLValueBitCast(), clang::ento::ExprEngine::processCallExit(), clang::ento::ExprEngine::VisitBinaryOperator(), clang::ento::ExprEngine::VisitCast(), clang::ento::ExprEngine::VisitCXXNewExpr(), and clang::ento::ExprEngine::VisitLogicalExpr().

◆ evalComplement()

SVal SValBuilder::evalComplement ( NonLoc val )

Definition at line 460 of file SValBuilder.cpp.

References Context, clang::ento::nonloc::SymbolVal::getSymbol(), clang::ento::nonloc::ConcreteInt::getValue(), makeIntVal(), makeNonLoc(), and X.

Referenced by evalUnaryOp(), and clang::ento::ExprEngine::VisitUnaryOperator().

◆ evalEQ() [1/2]

DefinedOrUnknownSVal SValBuilder::evalEQ	(	ProgramStateRef	state,
		DefinedOrUnknownSVal	lhs,
		DefinedOrUnknownSVal	rhs
	)

Definition at line 544 of file SValBuilder.cpp.

References clang::ento::SVal::castAs(), and evalEQ().

◆ evalEQ() [2/2]

SVal SValBuilder::evalEQ	(	ProgramStateRef	state,
		SVal	lhs,
		SVal	rhs
	)

Definition at line 540 of file SValBuilder.cpp.

References evalBinOp(), and getConditionType().

Referenced by areEqual(), evalEQ(), mayBeSuccess(), and clang::ento::ExprEngine::VisitIncrementDecrementOperator().

◆ evalIntegralCast()

SVal SValBuilder::evalIntegralCast	(	ProgramStateRef	state,
		SVal	val,
		QualType	castTy,
		QualType	originalType
	)

Definition at line 587 of file SValBuilder.cpp.

References clang::ento::SVal::castAs(), evalBinOpNN(), evalCast(), clang::ento::SVal::getAsSymbol(), getConditionType(), getContext(), clang::ento::APSIntType::getMaxValue(), clang::Type::isUnsignedIntegerType(), makeIntVal(), and makeNonLoc().

Referenced by clang::ento::ExprEngine::VisitCast().

◆ evalMinus()

SVal SValBuilder::evalMinus ( NonLoc val )

Definition at line 448 of file SValBuilder.cpp.

References Context, clang::ento::nonloc::SymbolVal::getSymbol(), clang::ento::nonloc::ConcreteInt::getValue(), makeIntVal(), makeNonLoc(), and X.

Referenced by evalUnaryOp(), clang::ento::ExprEngine::handleLValueBitCast(), and clang::ento::ExprEngine::VisitUnaryOperator().

◆ evalUnaryOp()

SVal SValBuilder::evalUnaryOp	(	ProgramStateRef	state,
		UnaryOperator::Opcode	opc,
		SVal	operand,
		QualType	type
	)

Definition at line 472 of file SValBuilder.cpp.

References evalComplement(), evalMinus(), and clang::ento::SVal::getAs().

◆ getAnalyzerOptions()

const AnalyzerOptions & clang::ento::SValBuilder::getAnalyzerOptions ( ) const

inline

Definition at line 158 of file SValBuilder.h.

References AnOpts.

Referenced by tryRearrange().

◆ getArrayIndexType()

QualType clang::ento::SValBuilder::getArrayIndexType ( ) const

inline

Definition at line 145 of file SValBuilder.h.

References ArrayIndexTy.

Referenced by clang::ento::ProgramState::assumeInBoundDual(), clang::ento::ExprEngine::bindReturnValue(), and clang::ento::MemRegionManager::getStaticSize().

◆ getBasicValueFactory() [1/2]

BasicValueFactory & clang::ento::SValBuilder::getBasicValueFactory ( )

inline

Definition at line 149 of file SValBuilder.h.

References BasicVals.

Referenced by clang::ento::ProgramState::assumeInBoundDual(), clang::ento::iterator::assumeNoOverflow(), doRearrangeUnchecked(), clang::ento::SimpleConstraintManager::getBasicVals(), clang::ento::StoreManager::getLValueElement(), isWithinConstantOverflowBounds(), and processArgument().

◆ getBasicValueFactory() [2/2]

const BasicValueFactory & clang::ento::SValBuilder::getBasicValueFactory ( ) const

inline

Definition at line 150 of file SValBuilder.h.

References BasicVals.

◆ getBlockPointer()

DefinedSVal SValBuilder::getBlockPointer	(	const BlockDecl *	block,
		CanQualType	locTy,
		const LocationContext *	locContext,
		unsigned	blockCount
	)

Definition at line 289 of file SValBuilder.cpp.

References clang::LocationContext::getAnalysisDeclContext(), clang::ento::MemRegionManager::getBlockCodeRegion(), clang::ento::MemRegionManager::getBlockDataRegion(), and MemMgr.

Referenced by clang::ento::ExprEngine::VisitBlockExpr().

◆ getCastedMemRegionVal()

std::optional< loc::MemRegionVal > SValBuilder::getCastedMemRegionVal	(	const MemRegion *	region,
		QualType	type
	)

Return MemRegionVal on success cast, otherwise return std::nullopt.

Definition at line 301 of file SValBuilder.cpp.

References clang::ento::StoreManager::castRegion(), clang::ento::ProgramStateManager::getStoreManager(), and StateMgr.

◆ getConditionType()

QualType clang::ento::SValBuilder::getConditionType ( ) const

inline

Definition at line 141 of file SValBuilder.h.

References clang::ASTContext::BoolTy, Context, clang::ASTContext::getLangOpts(), and clang::ASTContext::IntTy.

Referenced by assumeCollectionNonEmpty(), clang::ento::iterator::assumeNoOverflow(), compareValueToThreshold(), doRearrangeUnchecked(), evalComparison(), evalEQ(), evalIntegralCast(), clang::ento::ExprEngine::getInitialState(), isInRelation(), clang::ento::errno_modeling::setErrnoForStdFailure(), and tryRearrange().

◆ getConjuredHeapSymbolVal() [1/2]

DefinedOrUnknownSVal SValBuilder::getConjuredHeapSymbolVal	(	const Expr *	E,
		const LocationContext *	LCtx,
		QualType	type,
		unsigned	Count
	)

Conjure a symbol representing heap allocated memory region.

Note, now, the expression doesn't need to represent a location. But the type need to!

Definition at line 222 of file SValBuilder.cpp.

References clang::ento::SymbolManager::canSymbolicate(), clang::ento::SymbolManager::conjureSymbol(), clang::ento::MemRegionManager::getSymbolicHeapRegion(), clang::ento::Loc::isLocType(), makeZeroVal(), MemMgr, SymMgr, clang::ast_matchers::type, and VisitCount.

◆ getConjuredHeapSymbolVal() [2/2]

DefinedOrUnknownSVal SValBuilder::getConjuredHeapSymbolVal	(	const Expr *	E,
		const LocationContext *	LCtx,
		unsigned	Count
	)

Conjure a symbol representing heap allocated memory region.

Note, the expression should represent a location.

Definition at line 214 of file SValBuilder.cpp.

References getConjuredHeapSymbolVal(), clang::Expr::getType(), and VisitCount.

Referenced by clang::ento::ExprEngine::bindReturnValue(), getConjuredHeapSymbolVal(), and clang::ento::ExprEngine::VisitCXXNewExpr().

◆ getConstantVal()

std::optional< SVal > SValBuilder::getConstantVal ( const Expr * E )

Returns the value of E, if it can be determined in a non-path-sensitive manner.

If E is not a constant or cannot be modeled, returns std::nullopt.

Definition at line 322 of file SValBuilder.cpp.

References clang::C, evalCast(), clang::Expr::EvaluateAsInt(), getConstantVal(), getContext(), getRegionManager(), clang::Stmt::getStmtClass(), clang::Expr::getType(), clang::Expr::IgnoreParens(), clang::Expr::isGLValue(), clang::ento::Loc::isLocType(), clang::Expr::isNullPointerConstant(), makeBoolVal(), makeIntVal(), makeLoc(), makeNullWithType(), makeTruthVal(), makeZeroVal(), clang::Expr::NPC_ValueDependentIsNotNull, and clang::Result.

Referenced by getConstantVal(), clang::ento::Environment::getSVal(), and clang::ento::ExprEngine::Visit().

◆ getContext() [1/2]

ASTContext & clang::ento::SValBuilder::getContext ( )

inline

Definition at line 136 of file SValBuilder.h.

References Context.

Referenced by clang::ento::ProgramState::assumeInBoundDual(), clang::ento::SimpleConstraintManager::assumeInternal(), collectSubRegionBindings(), compareValueToThreshold(), clang::ento::ExprEngine::computeObjectUnderConstruction(), evalIntegralCast(), getConstantVal(), getCXXThis(), getExistingLazyBinding(), clang::ento::CXXInstanceCall::getInitialStackFrameContents(), clang::ento::StoreManager::MakeElementRegion(), and clang::ento::ExprEngine::VisitCXXNewExpr().

◆ getContext() [2/2]

const ASTContext & clang::ento::SValBuilder::getContext ( ) const

inline

Definition at line 137 of file SValBuilder.h.

References Context.

◆ getCXXThis() [1/2]

loc::MemRegionVal SValBuilder::getCXXThis	(	const CXXMethodDecl *	D,
		const StackFrameContext *	SFC
	)

Return a memory region for the 'this' object reference.

Definition at line 308 of file SValBuilder.cpp.

References getRegionManager(), and clang::CXXMethodDecl::getThisType().

Referenced by clang::ento::ExprEngine::computeObjectUnderConstruction(), clang::ento::CallEventManager::getCaller(), clang::ento::BlockCall::getInitialStackFrameContents(), clang::ento::CXXInstanceCall::getInitialStackFrameContents(), clang::ento::AnyCXXConstructorCall::getInitialStackFrameContents(), clang::ento::ExprEngine::getInitialState(), clang::ento::ExprEngine::ProcessBaseDtor(), clang::ento::ExprEngine::processCallExit(), clang::ento::ExprEngine::ProcessInitializer(), clang::ento::ExprEngine::ProcessMemberDtor(), and clang::ento::ExprEngine::VisitCommonDeclRefExpr().

◆ getCXXThis() [2/2]

loc::MemRegionVal SValBuilder::getCXXThis	(	const CXXRecordDecl *	D,
		const StackFrameContext *	SFC
	)

Return a memory region for the 'this' object reference.

Definition at line 315 of file SValBuilder.cpp.

References getContext(), clang::ASTContext::getPointerType(), getRegionManager(), and clang::TypeDecl::getTypeForDecl().

◆ getDerivedRegionValueSymbolVal()

DefinedOrUnknownSVal SValBuilder::getDerivedRegionValueSymbolVal	(	SymbolRef	parentSymbol,
		const TypedValueRegion *	region
	)

Definition at line 251 of file SValBuilder.cpp.

References clang::ento::SymbolManager::canSymbolicate(), clang::ento::SymbolManager::getDerivedSymbol(), clang::ento::MemRegionManager::getSymbolicRegion(), clang::ento::TypedValueRegion::getValueType(), clang::ento::Loc::isLocType(), clang::Type::isNullPtrType(), makeZeroVal(), MemMgr, and SymMgr.

Referenced by getDerivedSymbolForBinding().

◆ getFunctionPointer()

DefinedSVal SValBuilder::getFunctionPointer ( const FunctionDecl * func )

Definition at line 285 of file SValBuilder.cpp.

References clang::ento::MemRegionManager::getFunctionCodeRegion(), and MemMgr.

Referenced by getMemberPointer(), clang::ento::ExprEngine::VisitCommonDeclRefExpr(), and clang::ento::ExprEngine::VisitMemberExpr().

◆ getKnownValue()

virtual const llvm::APSInt * clang::ento::SValBuilder::getKnownValue	(	ProgramStateRef	state,
		SVal	val
	)

pure virtual

Evaluates a given SVal.

If the SVal has only one possible (integer) value, that value is returned. Otherwise, returns NULL.

◆ getMemberPointer()

DefinedSVal SValBuilder::getMemberPointer ( const NamedDecl * ND )

Definition at line 269 of file SValBuilder.cpp.

References getFunctionPointer().

Referenced by clang::ento::ExprEngine::VisitCast(), and clang::ento::ExprEngine::VisitUnaryOperator().

◆ getMetadataSymbolVal()

DefinedSVal SValBuilder::getMetadataSymbolVal	(	const void *	symbolTag,
		const MemRegion *	region,
		const Expr *	expr,
		QualType	type,
		const LocationContext *	LCtx,
		unsigned	count
	)

Definition at line 234 of file SValBuilder.cpp.

References clang::ento::SymbolManager::canSymbolicate(), clang::ast_matchers::expr, clang::ento::SymbolManager::getMetadataSymbol(), clang::ento::MemRegionManager::getSymbolicRegion(), clang::ento::Loc::isLocType(), MemMgr, SymMgr, and clang::ast_matchers::type.

◆ getRegionManager() [1/2]

MemRegionManager & clang::ento::SValBuilder::getRegionManager ( )

inline

Definition at line 155 of file SValBuilder.h.

References MemMgr.

Referenced by addParameterValuesToBindings(), clang::ento::ExprEngine::computeObjectUnderConstruction(), getConstantVal(), getCXXThis(), clang::ento::ObjCMethodCall::getInitialStackFrameContents(), clang::ento::ExprEngine::VisitCXXThisExpr(), and clang::ento::ExprEngine::VisitLambdaExpr().

◆ getRegionManager() [2/2]

const MemRegionManager & clang::ento::SValBuilder::getRegionManager ( ) const

inline

Definition at line 156 of file SValBuilder.h.

References MemMgr.

◆ getRegionValueSymbolVal()

DefinedOrUnknownSVal SValBuilder::getRegionValueSymbolVal ( const TypedValueRegion * region )

Make a unique symbol for value of region.

Definition at line 141 of file SValBuilder.cpp.

References clang::ento::SymbolManager::canSymbolicate(), clang::ento::SymbolManager::getRegionValueSymbol(), clang::ento::MemRegionManager::getSymbolicRegion(), clang::ento::TypedValueRegion::getValueType(), clang::ento::Loc::isLocType(), clang::Type::isNullPtrType(), makeZeroVal(), MemMgr, and SymMgr.

◆ getStateManager()

ProgramStateManager & clang::ento::SValBuilder::getStateManager ( )

inline

Definition at line 139 of file SValBuilder.h.

References StateMgr.

◆ getSymbolManager() [1/2]

SymbolManager & clang::ento::SValBuilder::getSymbolManager ( )

inline

Definition at line 152 of file SValBuilder.h.

References SymMgr.

Referenced by doRearrangeUnchecked(), clang::ento::MemRegionManager::getStaticSize(), clang::ento::CheckerContext::getSymbolManager(), and clang::ento::SimpleConstraintManager::getSymbolManager().

◆ getSymbolManager() [2/2]

const SymbolManager & clang::ento::SValBuilder::getSymbolManager ( ) const

inline

Definition at line 153 of file SValBuilder.h.

References SymMgr.

◆ makeArrayIndex()

NonLoc clang::ento::SValBuilder::makeArrayIndex ( uint64_t idx )

inline

Definition at line 263 of file SValBuilder.h.

References ArrayIndexTy, and BasicVals.

Referenced by clang::ento::ExprEngine::computeObjectUnderConstruction(), clang::ento::StoreManager::MakeElementRegion(), clang::ento::ExprEngine::ProcessDeleteDtor(), clang::ento::ExprEngine::VisitCXXNewExpr(), and clang::ento::ExprEngine::VisitIncrementDecrementOperator().

◆ makeBoolVal() [1/2]

nonloc::ConcreteInt SValBuilder::makeBoolVal ( const CXXBoolLiteralExpr * boolean )

Definition at line 136 of file SValBuilder.cpp.

References clang::CXXBoolLiteralExpr::getValue(), and makeTruthVal().

◆ makeBoolVal() [2/2]

nonloc::ConcreteInt clang::ento::SValBuilder::makeBoolVal ( const ObjCBoolLiteralExpr * boolean )

inline

Definition at line 275 of file SValBuilder.h.

References clang::Expr::getType(), clang::ObjCBoolLiteralExpr::getValue(), and makeTruthVal().

Referenced by getConstantVal().

◆ makeCompoundVal()

NonLoc clang::ento::SValBuilder::makeCompoundVal	(	QualType	type,
		llvm::ImmutableList< SVal >	vals
	)

inline

Definition at line 241 of file SValBuilder.h.

References BasicVals, clang::ento::BasicValueFactory::getCompoundValData(), and clang::ast_matchers::type.

Referenced by makeZeroVal(), processArgument(), and clang::ento::ExprEngine::VisitInitListExpr().

◆ makeIntLocVal()

loc::ConcreteInt clang::ento::SValBuilder::makeIntLocVal ( const llvm::APSInt & integer )

inline

Definition at line 285 of file SValBuilder.h.

References BasicVals.

◆ makeIntVal() [1/5]

nonloc::ConcreteInt clang::ento::SValBuilder::makeIntVal ( const IntegerLiteral * integer )

inline

Definition at line 269 of file SValBuilder.h.

References BasicVals, clang::Expr::getType(), clang::APIntStorage::getValue(), and clang::Type::isUnsignedIntegerOrEnumerationType().

Referenced by assumeCollectionNonEmpty(), clang::ento::ExprEngine::bindReturnValue(), evalBinOp(), evalComplement(), clang::ento::ExprEngine::evalEagerlyAssumeBinOpBifurcation(), evalIntegralCast(), evalMinus(), getConstantVal(), getSimplifiedOffsets(), clang::ento::MemRegionManager::getStaticSize(), clang::ento::CheckerContext::isGreaterOrEqual(), clang::ento::CheckerContext::isNegative(), makeZeroVal(), mayBeSuccess(), populateObjCForDestinationSet(), clang::ento::ExprEngine::VisitCommonDeclRefExpr(), clang::ento::ExprEngine::VisitIncrementDecrementOperator(), clang::ento::ExprEngine::VisitLogicalExpr(), clang::ento::ExprEngine::VisitOffsetOfExpr(), and clang::ento::ExprEngine::VisitUnaryExprOrTypeTraitExpr().

◆ makeIntVal() [2/5]

NonLoc clang::ento::SValBuilder::makeIntVal	(	const llvm::APInt &	integer,
		bool	isUnsigned
	)

inline

Definition at line 289 of file SValBuilder.h.

References BasicVals.

◆ makeIntVal() [3/5]

nonloc::ConcreteInt clang::ento::SValBuilder::makeIntVal ( const llvm::APSInt & integer )

inline

Definition at line 281 of file SValBuilder.h.

References BasicVals.

◆ makeIntVal() [4/5]

NonLoc clang::ento::SValBuilder::makeIntVal	(	uint64_t	integer,
		bool	isUnsigned
	)

inline

Definition at line 300 of file SValBuilder.h.

References BasicVals, and clang::ento::BasicValueFactory::getIntValue().

◆ makeIntVal() [5/5]

DefinedSVal clang::ento::SValBuilder::makeIntVal	(	uint64_t	integer,
		QualType	type
	)

inline

Definition at line 293 of file SValBuilder.h.

References BasicVals, clang::ento::Loc::isLocType(), and clang::ast_matchers::type.

◆ makeIntValWithWidth()

NonLoc clang::ento::SValBuilder::makeIntValWithWidth	(	QualType	ptrType,
		uint64_t	integer
	)

inline

Definition at line 304 of file SValBuilder.h.

References BasicVals.

Referenced by clang::ento::ExprEngine::Visit().

◆ makeLazyCompoundVal()

NonLoc clang::ento::SValBuilder::makeLazyCompoundVal	(	const StoreRef &	store,
		const TypedValueRegion *	region
	)

inline

Definition at line 245 of file SValBuilder.h.

References BasicVals, and clang::ento::BasicValueFactory::getLazyCompoundValData().

◆ makeLoc() [1/4]

loc::GotoLabel clang::ento::SValBuilder::makeLoc ( const AddrLabelExpr * expr )

inline

Definition at line 364 of file SValBuilder.h.

References clang::ast_matchers::expr.

◆ makeLoc() [2/4]

loc::ConcreteInt clang::ento::SValBuilder::makeLoc ( const llvm::APSInt & integer )

inline

Definition at line 368 of file SValBuilder.h.

References BasicVals.

◆ makeLoc() [3/4]

loc::MemRegionVal clang::ento::SValBuilder::makeLoc ( const MemRegion * region )

inline

Definition at line 360 of file SValBuilder.h.

◆ makeLoc() [4/4]

loc::MemRegionVal clang::ento::SValBuilder::makeLoc ( SymbolRef sym )

inline

Definition at line 356 of file SValBuilder.h.

References clang::ento::MemRegionManager::getSymbolicRegion(), and MemMgr.

Referenced by addParameterValuesToBindings(), clang::ento::ExprEngine::computeObjectUnderConstruction(), getConstantVal(), clang::ento::ObjCMethodCall::getInitialStackFrameContents(), clang::ento::StoreManager::getLValueVar(), makeSymbolVal(), and populateObjCForDestinationSet().

◆ makeLocAsInteger()

NonLoc clang::ento::SValBuilder::makeLocAsInteger	(	Loc	loc,
		unsigned	bits
	)

inline

Definition at line 308 of file SValBuilder.h.

References BasicVals, and clang::ento::BasicValueFactory::getPersistentSValWithData().

◆ makeNonLoc() [1/5]

nonloc::SymbolVal SValBuilder::makeNonLoc	(	const llvm::APSInt &	rhs,
		BinaryOperator::Opcode	op,
		const SymExpr *	lhs,
		QualType	type
	)

Definition at line 89 of file SValBuilder.cpp.

References clang::ento::SymbolManager::getIntSymExpr(), clang::ento::Loc::isLocType(), SymMgr, and clang::ast_matchers::type.

◆ makeNonLoc() [2/5]

nonloc::SymbolVal SValBuilder::makeNonLoc	(	const SymExpr *	lhs,
		BinaryOperator::Opcode	op,
		const llvm::APSInt &	rhs,
		QualType	type
	)

Definition at line 77 of file SValBuilder.cpp.

References clang::ento::SymbolManager::getSymIntExpr(), clang::ento::Loc::isLocType(), SymMgr, and clang::ast_matchers::type.

Referenced by evalComplement(), evalIntegralCast(), evalMinus(), and makeSymExprValNN().

◆ makeNonLoc() [3/5]

nonloc::SymbolVal SValBuilder::makeNonLoc	(	const SymExpr *	lhs,
		BinaryOperator::Opcode	op,
		const SymExpr *	rhs,
		QualType	type
	)

Definition at line 97 of file SValBuilder.cpp.

References clang::ento::SymbolManager::getSymSymExpr(), clang::ento::Loc::isLocType(), SymMgr, and clang::ast_matchers::type.

◆ makeNonLoc() [4/5]

nonloc::SymbolVal SValBuilder::makeNonLoc	(	const SymExpr *	operand,
		QualType	fromTy,
		QualType	toTy
	)

Create a NonLoc value for cast.

Definition at line 112 of file SValBuilder.cpp.

References clang::ento::SymbolManager::getCastSymbol(), clang::ento::Loc::isLocType(), and SymMgr.

◆ makeNonLoc() [5/5]

NonLoc SValBuilder::makeNonLoc	(	const SymExpr *	operand,
		UnaryOperator::Opcode	op,
		QualType	type
	)

Definition at line 105 of file SValBuilder.cpp.

References clang::ento::SymbolManager::getUnarySymExpr(), clang::ento::Loc::isLocType(), SymMgr, and clang::ast_matchers::type.

◆ makeNullWithType()

loc::ConcreteInt clang::ento::SValBuilder::makeNullWithType ( QualType type )

inline

Create NULL pointer, with proper pointer bit-width for given address space.

Parameters

type	pointer type.

Definition at line 340 of file SValBuilder.h.

References BasicVals, Context, clang::ASTContext::getPointerType(), clang::ento::BasicValueFactory::getZeroWithTypeSize(), and clang::ast_matchers::type.

Referenced by getConstantVal(), makeZeroVal(), clang::ento::ExprEngine::VisitCast(), and clang::ento::ExprEngine::VisitUnaryOperator().

◆ makePointerToMember() [1/2]

NonLoc clang::ento::SValBuilder::makePointerToMember ( const DeclaratorDecl * DD )

inline

Definition at line 251 of file SValBuilder.h.

Referenced by clang::ento::ExprEngine::VisitCast().

◆ makePointerToMember() [2/2]

NonLoc clang::ento::SValBuilder::makePointerToMember ( const PointerToMemberData * PTMD )

inline

Definition at line 255 of file SValBuilder.h.

◆ makeSymbolVal()

DefinedSVal clang::ento::SValBuilder::makeSymbolVal ( SymbolRef Sym )

inline

Make an SVal that represents the given symbol.

This follows the convention of representing Loc-type symbols (symbolic pointers and references) as Loc values wrapping the symbol rather than as plain symbol values.

Definition at line 379 of file SValBuilder.h.

References clang::ento::SymExpr::getType(), clang::ento::Loc::isLocType(), and makeLoc().

Referenced by clang::ento::SMTConstraintManager::canReasonAbout(), and clang::ento::simplifyToSVal().

◆ makeSymExprValNN()

SVal SValBuilder::makeSymExprValNN	(	BinaryOperator::Opcode	op,
		NonLoc	lhs,
		NonLoc	rhs,
		QualType	resultTy
	)

Constructs a symbolic expression for two non-location values.

Definition at line 421 of file SValBuilder.cpp.

References AnOpts, clang::ento::SymExpr::computeComplexity(), clang::ento::SVal::getAs(), clang::ento::SVal::getAsSymbol(), and makeNonLoc().

◆ makeTruthVal() [1/2]

nonloc::ConcreteInt clang::ento::SValBuilder::makeTruthVal ( bool b )

inline

Definition at line 333 of file SValBuilder.h.

References b, BasicVals, and clang::ento::BasicValueFactory::getTruthValue().

◆ makeTruthVal() [2/2]

nonloc::ConcreteInt clang::ento::SValBuilder::makeTruthVal	(	bool	b,
		QualType	type
	)

inline

Definition at line 329 of file SValBuilder.h.

References b, BasicVals, clang::ento::BasicValueFactory::getTruthValue(), and clang::ast_matchers::type.

Referenced by getConstantVal(), makeBoolVal(), clang::ento::ExprEngine::VisitCast(), and clang::ento::ExprEngine::VisitIncrementDecrementOperator().

◆ makeZeroArrayIndex()

NonLoc clang::ento::SValBuilder::makeZeroArrayIndex ( )

inline

Definition at line 259 of file SValBuilder.h.

References ArrayIndexTy, and BasicVals.

Referenced by clang::ento::StoreManager::GetElementZeroRegion().

◆ makeZeroVal()

DefinedOrUnknownSVal SValBuilder::makeZeroVal ( QualType type )

Construct an SVal representing '0' for the specified type.

Definition at line 62 of file SValBuilder.cpp.

References BasicVals, clang::ento::BasicValueFactory::getEmptySValList(), clang::ento::Loc::isLocType(), makeCompoundVal(), makeIntVal(), makeNullWithType(), and clang::ast_matchers::type.

Referenced by conjureSymbolVal(), getConjuredHeapSymbolVal(), getConstantVal(), getDerivedRegionValueSymbolVal(), clang::ento::ExprEngine::getInitialState(), getRegionValueSymbolVal(), clang::ento::errno_modeling::setErrnoForStdFailure(), clang::ento::ExprEngine::VisitIncrementDecrementOperator(), clang::ento::ExprEngine::VisitInitListExpr(), and clang::ento::ExprEngine::VisitUnaryOperator().

◆ simplifySVal()

virtual SVal clang::ento::SValBuilder::simplifySVal	(	ProgramStateRef	State,
		SVal	Val
	)

pure virtual

Simplify symbolic expressions within a given SVal.

Return an SVal that represents the same value, but is hopefully easier to work with than the original SVal.

Referenced by clang::ento::ExprEngine::handleLValueBitCast(), and clang::ento::simplifyToSVal().

Member Data Documentation

◆ AnOpts

const AnalyzerOptions& clang::ento::SValBuilder::AnOpts

protected

Definition at line 70 of file SValBuilder.h.

Referenced by getAnalyzerOptions(), and makeSymExprValNN().

◆ ArrayIndexTy

const QualType clang::ento::SValBuilder::ArrayIndexTy

protected

The scalar type to use for array indices.

Definition at line 73 of file SValBuilder.h.

Referenced by convertToArrayIndex(), getArrayIndexType(), makeArrayIndex(), and makeZeroArrayIndex().

◆ ArrayIndexWidth

const unsigned clang::ento::SValBuilder::ArrayIndexWidth

protected

The width of the scalar type used for array indices.

Definition at line 76 of file SValBuilder.h.

Referenced by convertToArrayIndex().

◆ BasicVals

BasicValueFactory clang::ento::SValBuilder::BasicVals

protected

Manager of APSInt values.

Definition at line 60 of file SValBuilder.h.

Referenced by getBasicValueFactory(), makeArrayIndex(), makeCompoundVal(), makeIntLocVal(), makeIntVal(), makeIntValWithWidth(), makeLazyCompoundVal(), makeLoc(), makeLocAsInteger(), makeNullWithType(), makeTruthVal(), makeZeroArrayIndex(), and makeZeroVal().

◆ Context

ASTContext& clang::ento::SValBuilder::Context

protected

Definition at line 57 of file SValBuilder.h.

Referenced by evalComplement(), evalMinus(), getConditionType(), getContext(), and makeNullWithType().

◆ MemMgr

MemRegionManager clang::ento::SValBuilder::MemMgr

protected

Manages the creation of memory regions.

Definition at line 66 of file SValBuilder.h.

Referenced by conjureSymbolVal(), getBlockPointer(), getConjuredHeapSymbolVal(), getDerivedRegionValueSymbolVal(), getFunctionPointer(), getMetadataSymbolVal(), getRegionManager(), getRegionValueSymbolVal(), and makeLoc().

◆ StateMgr

ProgramStateManager& clang::ento::SValBuilder::StateMgr

protected

Definition at line 68 of file SValBuilder.h.

Referenced by getCastedMemRegionVal(), and getStateManager().

◆ SymMgr

SymbolManager clang::ento::SValBuilder::SymMgr

protected

Manages the creation of symbols.

Definition at line 63 of file SValBuilder.h.

Referenced by conjureSymbol(), conjureSymbolVal(), getConjuredHeapSymbolVal(), getDerivedRegionValueSymbolVal(), getMetadataSymbolVal(), getRegionValueSymbolVal(), getSymbolManager(), and makeNonLoc().

The documentation for this class was generated from the following files:

include/clang/StaticAnalyzer/Core/PathSensitive/SValBuilder.h
lib/StaticAnalyzer/Core/SValBuilder.cpp

Public Member Functions

Protected Attributes

Detailed Description

Constructor & Destructor Documentation

◆ SValBuilder()

◆ ~SValBuilder()

Member Function Documentation

◆ areEqual()

◆ conjureSymbol() [1/2]

◆ conjureSymbol() [2/2]

◆ conjureSymbolVal() [1/3]

◆ conjureSymbolVal() [2/3]

◆ conjureSymbolVal() [3/3]

◆ convertToArrayIndex()

◆ evalBinOp()

◆ evalBinOpLL()

◆ evalBinOpLN()

◆ evalBinOpNN()

◆ evalCast()

◆ evalComplement()

◆ evalEQ() [1/2]

◆ evalEQ() [2/2]

◆ evalIntegralCast()

◆ evalMinus()

◆ evalUnaryOp()

◆ getAnalyzerOptions()

◆ getArrayIndexType()

◆ getBasicValueFactory() [1/2]

◆ getBasicValueFactory() [2/2]

◆ getBlockPointer()

◆ getCastedMemRegionVal()

◆ getConditionType()

◆ getConjuredHeapSymbolVal() [1/2]

◆ getConjuredHeapSymbolVal() [2/2]

◆ getConstantVal()

◆ getContext() [1/2]

◆ getContext() [2/2]

◆ getCXXThis() [1/2]

◆ getCXXThis() [2/2]

◆ getDerivedRegionValueSymbolVal()

◆ getFunctionPointer()

◆ getKnownValue()

◆ getMemberPointer()

◆ getMetadataSymbolVal()

◆ getRegionManager() [1/2]

◆ getRegionManager() [2/2]

◆ getRegionValueSymbolVal()

◆ getStateManager()

◆ getSymbolManager() [1/2]

◆ getSymbolManager() [2/2]

◆ makeArrayIndex()

◆ makeBoolVal() [1/2]

◆ makeBoolVal() [2/2]

◆ makeCompoundVal()

◆ makeIntLocVal()

◆ makeIntVal() [1/5]

◆ makeIntVal() [2/5]

◆ makeIntVal() [3/5]

◆ makeIntVal() [4/5]

◆ makeIntVal() [5/5]

◆ makeIntValWithWidth()

◆ makeLazyCompoundVal()

◆ makeLoc() [1/4]

◆ makeLoc() [2/4]

◆ makeLoc() [3/4]

◆ makeLoc() [4/4]

◆ makeLocAsInteger()

◆ makeNonLoc() [1/5]

◆ makeNonLoc() [2/5]

◆ makeNonLoc() [3/5]

◆ makeNonLoc() [4/5]

◆ makeNonLoc() [5/5]

◆ makeNullWithType()

◆ makePointerToMember() [1/2]

◆ makePointerToMember() [2/2]

◆ makeSymbolVal()

◆ makeSymExprValNN()

◆ makeTruthVal() [1/2]

◆ makeTruthVal() [2/2]

◆ makeZeroArrayIndex()