clang 17.0.0git
|
Dataflow Directional Tag Classes. More...
Classes | |
class | AggregateStorageLocation |
A storage location which is subdivided into smaller storage locations that can be traced independently by abstract interpretation. More... | |
class | Arena |
The Arena owns the objects that model data within an analysis. More... | |
class | ASTMatchSwitchBuilder |
Collects cases of a "match switch": a collection of matchers paired with callbacks, which together define a switch that can be applied to a node whose type derives from BaseT . More... | |
class | AtomicBoolValue |
Models an atomic boolean. More... | |
struct | backward_analysis_tag |
class | BiconditionalValue |
Models a boolean biconditional. More... | |
struct | BooleanFormula |
A boolean formula in conjunctive normal form. More... | |
class | BoolValue |
Models a boolean. More... | |
class | CFGMatchSwitchBuilder |
Collects cases of a "match switch": a collection of matchers paired with callbacks, which together define a switch that can be applied to an AST node contained in a CFG element. More... | |
class | ChromiumCheckModel |
Models the behavior of Chromium's CHECK, DCHECK, etc. More... | |
class | ConjunctionValue |
Models a boolean conjunction. More... | |
struct | ContextSensitiveOptions |
class | ControlFlowContext |
Holds CFG and other derived context that is needed to perform dataflow analysis. More... | |
class | DataflowAnalysis |
Base class template for dataflow analyses built on a single lattice type. More... | |
class | DataflowAnalysisContext |
Owns objects that encompass the state of a program and stores context that is used during dataflow analysis. More... | |
struct | DataflowAnalysisOptions |
struct | DataflowAnalysisState |
class | DataflowModel |
Abstract base class for dataflow "models": reusable analysis components that model a particular aspect of program semantics in the Environment . More... | |
class | DisjunctionValue |
Models a boolean disjunction. More... | |
class | Environment |
Holds the state of the program (store and heap) at a given program point. More... | |
struct | forward_analysis_tag |
class | ImplicationValue |
Models a boolean implication. More... | |
class | IntegerValue |
Models an integer. More... | |
class | Logger |
A logger is notified as the analysis progresses. More... | |
class | MapLattice |
A lattice that maps keys to individual lattice elements. More... | |
class | NegationValue |
Models a boolean negation. More... | |
class | NoopAnalysis |
class | NoopLattice |
Trivial lattice for dataflow analysis with exactly one element. More... | |
class | PointerValue |
Models a symbolic pointer. Specifically, any value of type T* . More... | |
class | ReferenceValue |
Models a dereferenced pointer. More... | |
class | ScalarStorageLocation |
A storage location that is not subdivided further for the purposes of abstract interpretation. More... | |
class | Solver |
An interface for a SAT solver that can be used by dataflow analyses. More... | |
class | StmtToEnvMap |
Maps statements to the environments of basic blocks that contain them. More... | |
class | StorageLocation |
Base class for elements of the local variable store and of the heap. More... | |
class | StructValue |
Models a value of struct or class type, with a flat map of fields to child storage locations, containing all accessible members of base struct and class types. More... | |
class | TopBoolValue |
Models the trivially true formula, which is Top in the lattice of boolean formulas. More... | |
struct | TransferState |
A common form of state shared between the cases of a transfer function. More... | |
struct | TransferStateForDiagnostics |
A read-only version of TransferState. More... | |
class | TypeErasedDataflowAnalysis |
Type-erased base class for dataflow analyses built on a single lattice type. More... | |
struct | TypeErasedDataflowAnalysisState |
Type-erased model of the program at a given program point. More... | |
struct | TypeErasedLattice |
Type-erased lattice element container. More... | |
class | UncheckedOptionalAccessDiagnoser |
class | UncheckedOptionalAccessModel |
Dataflow analysis that models whether optionals hold values or not. More... | |
struct | UncheckedOptionalAccessModelOptions |
class | Value |
Base class for all values computed by abstract interpretation. More... | |
class | WatchedLiteralsSolver |
A SAT solver that is an implementation of Algorithm D from Knuth's The Art of Computer Programming Volume 4: Satisfiability, Fascicle 6. More... | |
class | WatchedLiteralsSolverImpl |
Typedefs | |
template<typename State , typename Result = void> | |
using | CFGMatchSwitch = std::function< Result(const CFGElement &, ASTContext &, State &)> |
template<typename ElementLattice > | |
using | VarMapLattice = MapLattice< const clang::VarDecl *, ElementLattice > |
Convenience alias that captures the common use of map lattices to model in-scope variables. | |
template<typename T > | |
using | MatchSwitchMatcher = ast_matchers::internal::Matcher< T > |
template<typename T , typename State , typename Result = void> | |
using | MatchSwitchAction = std::function< Result(const T *, const ast_matchers::MatchFinder::MatchResult &, State &)> |
template<typename BaseT , typename State , typename Result = void> | |
using | ASTMatchSwitch = std::function< Result(const BaseT &, ASTContext &, State &)> |
using | Variable = uint32_t |
Boolean variables are represented as positive integers. | |
using | Literal = uint32_t |
Literals are represented as positive integers. | |
using | ClauseID = uint32_t |
Clause identifiers are represented as positive integers. | |
Enumerations | |
enum class | SkipPast { None , Reference } |
Indicates what kind of indirections should be skipped past when retrieving storage locations or values. More... | |
enum class | ComparisonResult { Same , Different , Unknown } |
Indicates the result of a tentative comparison. More... | |
enum class | LatticeJoinEffect { Unchanged , Changed } |
Effect indicating whether a lattice join operation resulted in a new value. More... | |
Functions | |
template<typename AnalysisT > | |
llvm::Expected< std::vector< std::optional< DataflowAnalysisState< typename AnalysisT::Lattice > > > > | runDataflowAnalysis (const ControlFlowContext &CFCtx, AnalysisT &Analysis, const Environment &InitEnv, std::function< void(const CFGElement &, const DataflowAnalysisState< typename AnalysisT::Lattice > &)> PostVisitCFG=nullptr) |
Performs dataflow analysis and returns a mapping from basic block IDs to dataflow analysis states that model the respective basic blocks. | |
const Expr & | ignoreCFGOmittedNodes (const Expr &E) |
Skip past nodes that the CFG does not emit. | |
const Stmt & | ignoreCFGOmittedNodes (const Stmt &S) |
llvm::DenseSet< const FieldDecl * > | getObjectFields (QualType Type) |
Returns the set of all fields in the type. | |
AggregateStorageLocation * | getImplicitObjectLocation (const CXXMemberCallExpr &MCE, const Environment &Env) |
Returns the storage location for the implicit object of a CXXMemberCallExpr , or null if none is defined in the environment. | |
AggregateStorageLocation * | getBaseObjectLocation (const MemberExpr &ME, const Environment &Env) |
Returns the storage location for the base object of a MemberExpr , or null if none is defined in the environment. | |
llvm::StringRef | debugString (Value::Kind Kind) |
Returns a string representation of a value kind. | |
llvm::StringRef | debugString (Solver::Result::Assignment Assignment) |
Returns a string representation of a boolean assignment to true or false. | |
llvm::StringRef | debugString (Solver::Result::Status Status) |
Returns a string representation of the result status of a SAT check. | |
std::string | debugString (const BoolValue &B, llvm::DenseMap< const AtomicBoolValue *, std::string > AtomNames={{}}) |
Returns a string representation for the boolean value B . | |
std::string | debugString (const llvm::DenseSet< BoolValue * > &Constraints, llvm::DenseMap< const AtomicBoolValue *, std::string > AtomNames={{}}) |
Returns a string representation for Constraints - a collection of boolean formulas. | |
std::string | debugString (ArrayRef< BoolValue * > Constraints, const Solver::Result &Result, llvm::DenseMap< const AtomicBoolValue *, std::string > AtomNames={{}}) |
Returns a string representation for Constraints - a collection of boolean formulas and the Result of satisfiability checking. | |
std::string | debugString (const llvm::DenseSet< BoolValue * > &Constraints, const Solver::Result &Result, llvm::DenseMap< const AtomicBoolValue *, std::string > AtomNames={{}}) |
template<typename Key , typename ElementLattice > | |
std::ostream & | operator<< (std::ostream &Os, const clang::dataflow::MapLattice< Key, ElementLattice > &M) |
template<typename ElementLattice > | |
std::ostream & | operator<< (std::ostream &Os, const clang::dataflow::VarMapLattice< ElementLattice > &M) |
std::ostream & | operator<< (std::ostream &OS, const NoopLattice &) |
void | transfer (const StmtToEnvMap &StmtToEnv, const Stmt &S, Environment &Env) |
Evaluates S and updates Env accordingly. | |
TypeErasedDataflowAnalysisState | transferBlock (const ControlFlowContext &CFCtx, llvm::ArrayRef< std::optional< TypeErasedDataflowAnalysisState > > BlockStates, const CFGBlock &Block, const Environment &InitEnv, TypeErasedDataflowAnalysis &Analysis, std::function< void(const CFGElement &, const TypeErasedDataflowAnalysisState &)> PostVisitCFG=nullptr) |
Transfers the state of a basic block by evaluating each of its elements in the context of Analysis and the states of its predecessors that are available in BlockStates . | |
llvm::Expected< std::vector< std::optional< TypeErasedDataflowAnalysisState > > > | runTypeErasedDataflowAnalysis (const ControlFlowContext &CFCtx, TypeErasedDataflowAnalysis &Analysis, const Environment &InitEnv, std::function< void(const CFGElement &, const TypeErasedDataflowAnalysisState &)> PostVisitCFG=nullptr) |
Performs dataflow analysis and returns a mapping from basic block IDs to dataflow analysis states that model the respective basic blocks. | |
bool | areEquivalentValues (const Value &Val1, const Value &Val2) |
An equivalence relation for values. | |
raw_ostream & | operator<< (raw_ostream &OS, const Value &Val) |
static std::pair< BoolValue *, BoolValue * > | makeCanonicalBoolValuePair (BoolValue &LHS, BoolValue &RHS) |
static llvm::DenseMap< const Stmt *, const CFGBlock * > | buildStmtToBasicBlockMap (const CFG &Cfg) |
Returns a map from statements to basic blocks that contain them. | |
static llvm::BitVector | findReachableBlocks (const CFG &Cfg) |
static std::unique_ptr< Logger > | makeLoggerFromCommandLine () |
template<typename K , typename V > | |
llvm::DenseMap< K, V > | intersectDenseMaps (const llvm::DenseMap< K, V > &Map1, const llvm::DenseMap< K, V > &Map2) |
Returns a map consisting of key-value entries that are present in both maps. | |
static bool | compareDistinctValues (QualType Type, Value &Val1, const Environment &Env1, Value &Val2, const Environment &Env2, Environment::ValueModel &Model) |
static Value * | mergeDistinctValues (QualType Type, Value &Val1, const Environment &Env1, Value &Val2, const Environment &Env2, Environment &MergedEnv, Environment::ValueModel &Model) |
Attempts to merge distinct values Val1 and Val2 in Env1 and Env2 , respectively, of the same type Type . | |
static Value & | widenDistinctValues (QualType Type, Value &Prev, const Environment &PrevEnv, Value &Current, Environment &CurrentEnv, Environment::ValueModel &Model) |
static void | insertIfGlobal (const Decl &D, llvm::DenseSet< const VarDecl * > &Vars) |
Initializes a global storage value. | |
static void | insertIfFunction (const Decl &D, llvm::DenseSet< const FunctionDecl * > &Funcs) |
static void | getFieldsGlobalsAndFuncs (const Decl &D, llvm::DenseSet< const FieldDecl * > &Fields, llvm::DenseSet< const VarDecl * > &Vars, llvm::DenseSet< const FunctionDecl * > &Funcs) |
static void | getFieldsGlobalsAndFuncs (const Stmt &S, llvm::DenseSet< const FieldDecl * > &Fields, llvm::DenseSet< const VarDecl * > &Vars, llvm::DenseSet< const FunctionDecl * > &Funcs) |
Traverses S and inserts into Fields , Vars and Funcs any fields, global variables and functions that are declared in or referenced from sub-statements. | |
bool | isCheckLikeMethod (llvm::SmallDenseSet< const CXXMethodDecl * > &CheckDecls, const CXXMethodDecl &D) |
Determines whether D is one of the methods used to implement Chromium's CHECK macros. | |
static bool | isTopLevelNamespaceWithName (const NamespaceDecl &NS, llvm::StringRef Name) |
static bool | hasOptionalClassName (const CXXRecordDecl &RD) |
static BoolValue & | evaluateBooleanEquality (const Expr &LHS, const Expr &RHS, Environment &Env) |
static BoolValue & | unpackValue (BoolValue &V, Environment &Env) |
template<typename Derived , typename M > | |
BoolValue & | unpackBinaryBoolValue (Environment &Env, BoolValue &B, M build) |
static Value * | maybeUnpackLValueExpr (const Expr &E, Environment &Env) |
static void | propagateValue (const Expr &From, const Expr &To, Environment &Env) |
static void | propagateStorageLocation (const Expr &From, const Expr &To, Environment &Env) |
static void | propagateValueOrStorageLocation (const Expr &From, const Expr &To, Environment &Env) |
static int | blockIndexInPredecessor (const CFGBlock &Pred, const CFGBlock &Block) |
Returns the index of Block in the successors of Pred . | |
static bool | isLoopHead (const CFGBlock &B) |
static TypeErasedDataflowAnalysisState | computeBlockInputState (const CFGBlock &Block, AnalysisContext &AC) |
Computes the input state for a given basic block by joining the output states of its predecessors. | |
static void | builtinTransferStatement (const CFGStmt &Elt, TypeErasedDataflowAnalysisState &InputState, AnalysisContext &AC) |
Built-in transfer function for CFGStmt . | |
static void | builtinTransferInitializer (const CFGInitializer &Elt, TypeErasedDataflowAnalysisState &InputState) |
Built-in transfer function for CFGInitializer . | |
static void | builtinTransfer (const CFGElement &Elt, TypeErasedDataflowAnalysisState &State, AnalysisContext &AC) |
static TypeErasedDataflowAnalysisState | transferCFGBlock (const CFGBlock &Block, AnalysisContext &AC, std::function< void(const CFGElement &, const TypeErasedDataflowAnalysisState &)> PostVisitCFG=nullptr) |
Transfers State by evaluating each element in the Block based on the AC.Analysis specified. | |
static bool | areEquivalentIndirectionValues (const Value &Val1, const Value &Val2) |
static constexpr Literal | posLit (Variable V) |
Returns the positive literal V . | |
static constexpr Literal | negLit (Variable V) |
Returns the negative literal !V . | |
static constexpr Literal | notLit (Literal L) |
Returns the negated literal !L . | |
static constexpr Variable | var (Literal L) |
Returns the variable of L . | |
BooleanFormula | buildBooleanFormula (const llvm::DenseSet< BoolValue * > &Vals) |
Converts the conjunction of Vals into a formula in conjunctive normal form where each clause has at least one and at most three literals. | |
Variables | |
static constexpr int | MaxCompositeValueDepth = 3 |
static constexpr int | MaxCompositeValueSize = 1000 |
static constexpr Variable | NullVar = 0 |
A null boolean variable is used as a placeholder in various data structures and algorithms. | |
static constexpr Literal | NullLit = 0 |
A null literal is used as a placeholder in various data structures and algorithms. | |
static constexpr ClauseID | NullClause = 0 |
A null clause identifier is used as a placeholder in various data structures and algorithms. | |
Dataflow Directional Tag Classes.
These are used for tag dispatching within the dataflow solver/transfer functions to determine what direction a dataflow analysis flows.
using clang::dataflow::ASTMatchSwitch = typedef std::function<Result(const BaseT &, ASTContext &, State &)> |
Definition at line 68 of file MatchSwitch.h.
using clang::dataflow::CFGMatchSwitch = typedef std::function<Result(const CFGElement &, ASTContext &, State &)> |
Definition at line 33 of file CFGMatchSwitch.h.
using clang::dataflow::ClauseID = typedef uint32_t |
Clause identifiers are represented as positive integers.
Definition at line 74 of file WatchedLiteralsSolver.cpp.
using clang::dataflow::Literal = typedef uint32_t |
Literals are represented as positive integers.
Specifically, for a boolean variable V
that is represented as the positive integer I
, the positive literal V
is represented as the integer 2*I
and the negative literal !V
is represented as the integer 2*I+1
.
Definition at line 55 of file WatchedLiteralsSolver.cpp.
using clang::dataflow::MatchSwitchAction = typedef std::function<Result( const T *, const ast_matchers::MatchFinder::MatchResult &, State &)> |
Definition at line 64 of file MatchSwitch.h.
using clang::dataflow::MatchSwitchMatcher = typedef ast_matchers::internal::Matcher<T> |
Definition at line 61 of file MatchSwitch.h.
using clang::dataflow::Variable = typedef uint32_t |
Boolean variables are represented as positive integers.
Definition at line 45 of file WatchedLiteralsSolver.cpp.
using clang::dataflow::VarMapLattice = typedef MapLattice<const clang::VarDecl *, ElementLattice> |
Convenience alias that captures the common use of map lattices to model in-scope variables.
Definition at line 112 of file MapLattice.h.
|
strong |
Indicates the result of a tentative comparison.
Enumerator | |
---|---|
Same | |
Different | |
Unknown |
Definition at line 52 of file DataflowEnvironment.h.
|
strong |
Effect indicating whether a lattice join operation resulted in a new value.
Enumerator | |
---|---|
Unchanged | |
Changed |
Definition at line 23 of file DataflowLattice.h.
|
strong |
Indicates what kind of indirections should be skipped past when retrieving storage locations or values.
FIXME: Consider renaming this or replacing it with a more appropriate model. See the discussion in https://reviews.llvm.org/D116596 for context.
Enumerator | |
---|---|
None | No indirections should be skipped past. |
Reference | An optional reference should be skipped past. |
Definition at line 44 of file DataflowEnvironment.h.
|
static |
Definition at line 20 of file Value.cpp.
Referenced by areEquivalentValues().
An equivalence relation for values.
It obeys reflexivity, symmetry and transitivity. It does not include comparison of Properties
.
Computes equivalence for these subclasses:
Value
at said location.TopBoolValue
s.Otherwise, falls back to pointer equality.
Definition at line 33 of file Value.cpp.
References areEquivalentIndirectionValues(), and clang::dataflow::Value::getKind().
Referenced by clang::dataflow::Environment::equivalentTo(), clang::dataflow::Environment::join(), and clang::dataflow::Environment::widen().
|
static |
Returns the index of Block
in the successors of Pred
.
Definition at line 44 of file TypeErasedDataflowAnalysis.cpp.
References clang::Block, clang::CFGBlock::succ_begin(), and clang::CFGBlock::succs().
Referenced by computeBlockInputState().
BooleanFormula clang::dataflow::buildBooleanFormula | ( | const llvm::DenseSet< BoolValue * > & | Vals | ) |
Converts the conjunction of Vals
into a formula in conjunctive normal form where each clause has at least one and at most three literals.
Definition at line 180 of file WatchedLiteralsSolver.cpp.
References clang::dataflow::BooleanFormula::addClause(), clang::dataflow::Value::AtomicBool, clang::dataflow::Value::Biconditional, clang::C, clang::dataflow::Value::Conjunction, clang::dataflow::Value::Disjunction, clang::dataflow::Value::getKind(), clang::dataflow::Value::Implication, clang::dataflow::Value::Negation, negLit(), posLit(), and clang::dataflow::Value::TopBool.
|
static |
Returns a map from statements to basic blocks that contain them.
Definition at line 29 of file ControlFlowContext.cpp.
References clang::Block.
Referenced by clang::dataflow::ControlFlowContext::build().
|
static |
Definition at line 317 of file TypeErasedDataflowAnalysis.cpp.
References builtinTransferInitializer(), builtinTransferStatement(), clang::CFGElement::castAs(), clang::CFGElement::getKind(), clang::CFGElement::Initializer, and clang::CFGElement::Statement.
Referenced by transferCFGBlock().
|
static |
Built-in transfer function for CFGInitializer
.
Definition at line 287 of file TypeErasedDataflowAnalysis.cpp.
References clang::dataflow::Environment::create(), clang::dataflow::TypeErasedDataflowAnalysisState::Env, Env, clang::CFGInitializer::getInitializer(), clang::dataflow::Environment::getStorageLocationStrict(), clang::dataflow::Environment::getThisPointeeStorageLocation(), clang::dataflow::Environment::getValueStrict(), clang::Member, and clang::dataflow::Environment::setValue().
Referenced by builtinTransfer().
|
static |
Built-in transfer function for CFGStmt
.
Definition at line 277 of file TypeErasedDataflowAnalysis.cpp.
References clang::dataflow::TypeErasedDataflowAnalysisState::Env, clang::CFGStmt::getStmt(), and transfer().
Referenced by builtinTransfer().
|
static |
Definition at line 52 of file DataflowEnvironment.cpp.
References clang::dataflow::Environment::ValueModel::compare(), Different, clang::dataflow::Value::getKind(), clang::dataflow::Value::Integer, clang::dataflow::Value::Pointer, clang::dataflow::Value::Reference, Same, clang::dataflow::Value::Struct, and Unknown.
Referenced by clang::dataflow::Environment::equivalentTo().
|
static |
Computes the input state for a given basic block by joining the output states of its predecessors.
Requirements:
All predecessors of Block
except those with loop back edges must have already been transferred. States in AC.BlockStates
that are set to std::nullopt
represent basic blocks that are not evaluated yet.
Definition at line 193 of file TypeErasedDataflowAnalysis.cpp.
References Analysis, clang::Block, blockIndexInPredecessor(), clang::dataflow::TypeErasedDataflowAnalysis::builtinOptions(), clang::dataflow::TypeErasedDataflowAnalysisState::Env, clang::dataflow::TypeErasedDataflowAnalysis::joinTypeErased(), clang::dataflow::TypeErasedDataflowAnalysisState::Lattice, clang::dataflow::TypeErasedDataflowAnalysis::transferBranchTypeErased(), and clang::dataflow::TypeErasedDataflowAnalysis::typeErasedInitialElement().
Referenced by transferCFGBlock().
std::string clang::dataflow::debugString | ( | ArrayRef< BoolValue * > | Constraints, |
const Solver::Result & | Result, | ||
llvm::DenseMap< const AtomicBoolValue *, std::string > | AtomNames = {{}} |
||
) |
Returns a string representation for Constraints
- a collection of boolean formulas and the Result
of satisfiability checking.
Atomic booleans appearing in Constraints
and Result
are assigned to labels either specified in AtomNames
or created by default rules as B0, B1, ...
Requirements:
Names assigned to atoms should not be repeated in AtomNames
.
Definition at line 256 of file DebugSupport.cpp.
References clang::Result.
std::string clang::dataflow::debugString | ( | const BoolValue & | B, |
llvm::DenseMap< const AtomicBoolValue *, std::string > | AtomNames = {{}} |
||
) |
Returns a string representation for the boolean value B
.
Atomic booleans appearing in the boolean value B
are assigned to labels either specified in AtomNames
or created by default rules as B0, B1, ...
Requirements:
Names assigned to atoms should not be repeated in AtomNames
.
Definition at line 244 of file DebugSupport.cpp.
|
inline |
Definition at line 76 of file DebugSupport.h.
std::string clang::dataflow::debugString | ( | const llvm::DenseSet< BoolValue * > & | Constraints, |
llvm::DenseMap< const AtomicBoolValue *, std::string > | AtomNames = {{}} |
||
) |
Returns a string representation for Constraints
- a collection of boolean formulas.
Atomic booleans appearing in the boolean value Constraints
are assigned to labels either specified in AtomNames
or created by default rules as B0, B1, ...
Requirements:
Names assigned to atoms should not be repeated in AtomNames
.
Definition at line 250 of file DebugSupport.cpp.
llvm::StringRef clang::dataflow::debugString | ( | Solver::Result::Assignment | Assignment | ) |
Returns a string representation of a boolean assignment to true or false.
Definition at line 63 of file DebugSupport.cpp.
References clang::dataflow::Solver::Result::AssignedFalse, and clang::dataflow::Solver::Result::AssignedTrue.
llvm::StringRef clang::dataflow::debugString | ( | Solver::Result::Status | Status | ) |
Returns a string representation of the result status of a SAT check.
Definition at line 73 of file DebugSupport.cpp.
References clang::dataflow::Solver::Result::Satisfiable, clang::dataflow::Solver::Result::TimedOut, and clang::dataflow::Solver::Result::Unsatisfiable.
llvm::StringRef clang::dataflow::debugString | ( | Value::Kind | Kind | ) |
Returns a string representation of a value kind.
Definition at line 35 of file DebugSupport.cpp.
References clang::dataflow::Value::AtomicBool, clang::dataflow::Value::Biconditional, clang::dataflow::Value::Conjunction, clang::dataflow::Value::Disjunction, clang::dataflow::Value::Implication, clang::dataflow::Value::Integer, clang::dataflow::Value::Negation, clang::dataflow::Value::Pointer, clang::dataflow::Value::Reference, clang::dataflow::Value::Struct, and clang::dataflow::Value::TopBool.
Referenced by clang::dataflow::DataflowAnalysisContext::dumpFlowCondition(), and operator<<().
|
static |
Definition at line 49 of file Transfer.cpp.
References Env, clang::dataflow::Environment::getValueStrict(), clang::dataflow::Environment::makeAtomicBoolValue(), and clang::dataflow::Environment::makeIff().
|
static |
Definition at line 48 of file ControlFlowContext.cpp.
References clang::Block, clang::CFG::getEntry(), and clang::CFG::getNumBlockIDs().
Referenced by clang::dataflow::ControlFlowContext::build().
AggregateStorageLocation * clang::dataflow::getBaseObjectLocation | ( | const MemberExpr & | ME, |
const Environment & | Env | ||
) |
Returns the storage location for the base object of a MemberExpr
, or null if none is defined in the environment.
Dereferences the pointer if the member expression was written using ->
.
Definition at line 938 of file DataflowEnvironment.cpp.
References Env, clang::MemberExpr::getBase(), clang::dataflow::Environment::getStorageLocation(), clang::dataflow::Environment::getValue(), clang::MemberExpr::isArrow(), and Reference.
|
static |
Definition at line 172 of file DataflowEnvironment.cpp.
References insertIfFunction(), and insertIfGlobal().
Referenced by getFieldsGlobalsAndFuncs().
|
static |
Traverses S
and inserts into Fields
, Vars
and Funcs
any fields, global variables and functions that are declared in or referenced from sub-statements.
Definition at line 190 of file DataflowEnvironment.cpp.
References getFieldsGlobalsAndFuncs(), insertIfFunction(), and insertIfGlobal().
AggregateStorageLocation * clang::dataflow::getImplicitObjectLocation | ( | const CXXMemberCallExpr & | MCE, |
const Environment & | Env | ||
) |
Returns the storage location for the implicit object of a CXXMemberCallExpr
, or null if none is defined in the environment.
Dereferences the pointer if the member call expression was written using ->
.
Definition at line 921 of file DataflowEnvironment.cpp.
References Env, clang::CXXMemberCallExpr::getImplicitObjectArgument(), clang::dataflow::Environment::getStorageLocation(), clang::Expr::getType(), clang::dataflow::Environment::getValue(), clang::Type::isPointerType(), and Reference.
llvm::DenseSet< const FieldDecl * > clang::dataflow::getObjectFields | ( | QualType | Type | ) |
Returns the set of all fields in the type.
Gets the set of all fields in the type.
Definition at line 312 of file DataflowAnalysisContext.cpp.
References getFieldsFromClassHierarchy().
Referenced by clang::dataflow::DataflowAnalysisContext::createStorageLocation().
|
static |
Definition at line 47 of file UncheckedOptionalAccessModel.cpp.
References clang::Decl::getDeclContext(), clang::NamedDecl::getDeclName(), clang::NamedDecl::getName(), clang::DeclarationName::isIdentifier(), and isTopLevelNamespaceWithName().
Skip past nodes that the CFG does not emit.
These nodes are invisible to flow-sensitive analysis, and should be ignored as they will effectively not exist.
ParenExpr
- The CFG takes the operator precedence into account, but otherwise omits the node afterwards.ExprWithCleanups
- The CFG will generate the appropriate calls to destructors and then omit the node. Definition at line 277 of file DataflowAnalysisContext.cpp.
Referenced by clang::dataflow::StmtToEnvMap::getEnvironment(), clang::dataflow::DataflowAnalysisContext::getStorageLocation(), clang::dataflow::Environment::getStorageLocation(), ignoreCFGOmittedNodes(), clang::dataflow::DataflowAnalysisContext::setStorageLocation(), and clang::dataflow::Environment::setStorageLocation().
Definition at line 288 of file DataflowAnalysisContext.cpp.
References ignoreCFGOmittedNodes().
|
static |
Definition at line 165 of file DataflowEnvironment.cpp.
Referenced by getFieldsGlobalsAndFuncs().
|
static |
Initializes a global storage value.
Definition at line 158 of file DataflowEnvironment.cpp.
References V.
Referenced by getFieldsGlobalsAndFuncs().
llvm::DenseMap< K, V > clang::dataflow::intersectDenseMaps | ( | const llvm::DenseMap< K, V > & | Map1, |
const llvm::DenseMap< K, V > & | Map2 | ||
) |
Returns a map consisting of key-value entries that are present in both maps.
Definition at line 41 of file DataflowEnvironment.cpp.
References clang::Result.
Referenced by clang::dataflow::Environment::join().
bool clang::dataflow::isCheckLikeMethod | ( | llvm::SmallDenseSet< const CXXMethodDecl * > & | CheckDecls, |
const CXXMethodDecl & | D | ||
) |
Determines whether D
is one of the methods used to implement Chromium's CHECK
macros.
Populates CheckDecls
, if empty.
Definition at line 19 of file ChromiumCheckModel.cpp.
References clang::Decl::getDeclContext(), clang::NamedDecl::getDeclName(), clang::NamedDecl::getName(), clang::CXXMethodDecl::getParent(), clang::DeclarationName::isIdentifier(), clang::CXXMethodDecl::isStatic(), and clang::CXXRecordDecl::methods().
Referenced by clang::dataflow::ChromiumCheckModel::transfer().
Definition at line 53 of file TypeErasedDataflowAnalysis.cpp.
References clang::CFGBlock::getTerminatorStmt().
Referenced by runTypeErasedDataflowAnalysis().
|
static |
Definition at line 41 of file UncheckedOptionalAccessModel.cpp.
References clang::NamedDecl::getDeclName(), clang::NamedDecl::getName(), clang::DeclContext::getParent(), clang::DeclarationName::isIdentifier(), and clang::DeclContext::isTranslationUnit().
Referenced by hasOptionalClassName().
|
static |
Definition at line 14 of file Arena.cpp.
Referenced by clang::dataflow::Arena::makeAnd(), clang::dataflow::Arena::makeEquals(), and clang::dataflow::Arena::makeOr().
|
static |
Definition at line 224 of file DataflowAnalysisContext.cpp.
References DataflowLog(), clang::File, clang::dataflow::Logger::html(), and clang::dataflow::Logger::textual().
Referenced by clang::dataflow::DataflowAnalysisContext::DataflowAnalysisContext().
|
static |
Definition at line 121 of file Transfer.cpp.
References Env, clang::dataflow::Environment::getStorageLocationStrict(), clang::dataflow::Environment::getValue(), clang::dataflow::Environment::setValue(), and unpackValue().
|
static |
Attempts to merge distinct values Val1
and Val2
in Env1
and Env2
, respectively, of the same type Type
.
Merging generally produces a single value that (soundly) approximates the two inputs, although the actual meaning depends on Model
.
Definition at line 89 of file DataflowEnvironment.cpp.
References clang::dataflow::Environment::addToFlowCondition(), clang::dataflow::Environment::createValue(), clang::dataflow::Environment::getFlowConditionToken(), clang::dataflow::Environment::makeAnd(), clang::dataflow::Environment::makeAtomicBoolValue(), clang::dataflow::Environment::makeIff(), clang::dataflow::Environment::makeOr(), and clang::dataflow::Environment::ValueModel::merge().
Referenced by clang::dataflow::Environment::join().
Returns the negative literal !V
.
Definition at line 65 of file WatchedLiteralsSolver.cpp.
References V.
Referenced by buildBooleanFormula(), clang::dataflow::WatchedLiteralsSolverImpl::solve(), and clang::dataflow::WatchedLiteralsSolverImpl::WatchedLiteralsSolverImpl().
Returns the negated literal !L
.
Definition at line 68 of file WatchedLiteralsSolver.cpp.
raw_ostream & clang::dataflow::operator<< | ( | raw_ostream & | OS, |
const Value & | Val | ||
) |
Definition at line 39 of file Value.cpp.
References debugString(), clang::dataflow::Value::getKind(), clang::dataflow::Value::Pointer, and clang::dataflow::Value::Reference.
std::ostream & clang::dataflow::operator<< | ( | std::ostream & | Os, |
const clang::dataflow::MapLattice< Key, ElementLattice > & | M | ||
) |
Definition at line 115 of file MapLattice.h.
std::ostream & clang::dataflow::operator<< | ( | std::ostream & | Os, |
const clang::dataflow::VarMapLattice< ElementLattice > & | M | ||
) |
Definition at line 128 of file MapLattice.h.
|
inline |
Definition at line 34 of file NoopLattice.h.
Returns the positive literal V
.
Definition at line 62 of file WatchedLiteralsSolver.cpp.
References V.
Referenced by buildBooleanFormula(), clang::dataflow::WatchedLiteralsSolverImpl::solve(), and clang::dataflow::WatchedLiteralsSolverImpl::WatchedLiteralsSolverImpl().
|
static |
Definition at line 143 of file Transfer.cpp.
References Env, clang::dataflow::Environment::getStorageLocationStrict(), and clang::dataflow::Environment::setStorageLocationStrict().
Referenced by propagateValueOrStorageLocation().
|
static |
Definition at line 138 of file Transfer.cpp.
References Env, clang::dataflow::Environment::getValueStrict(), and clang::dataflow::Environment::setValueStrict().
Referenced by propagateValueOrStorageLocation().
|
static |
Definition at line 152 of file Transfer.cpp.
References Env, clang::Expr::isGLValue(), propagateStorageLocation(), and propagateValue().
llvm::Expected< std::vector< std::optional< DataflowAnalysisState< typename AnalysisT::Lattice > > > > clang::dataflow::runDataflowAnalysis | ( | const ControlFlowContext & | CFCtx, |
AnalysisT & | Analysis, | ||
const Environment & | InitEnv, | ||
std::function< void(const CFGElement &, const DataflowAnalysisState< typename AnalysisT::Lattice > &)> | PostVisitCFG = nullptr |
||
) |
Performs dataflow analysis and returns a mapping from basic block IDs to dataflow analysis states that model the respective basic blocks.
The returned vector, if any, will have the same size as the number of CFG blocks, with indices corresponding to basic block IDs. Returns an error if the dataflow analysis cannot be performed successfully. Otherwise, calls PostVisitCFG
on each CFG element with the final analysis results at that program point.
Definition at line 193 of file DataflowAnalysis.h.
References Analysis, BlockStates, CFCtx, InitEnv, and runTypeErasedDataflowAnalysis().
llvm::Expected< std::vector< std::optional< TypeErasedDataflowAnalysisState > > > clang::dataflow::runTypeErasedDataflowAnalysis | ( | const ControlFlowContext & | CFCtx, |
TypeErasedDataflowAnalysis & | Analysis, | ||
const Environment & | InitEnv, | ||
std::function< void(const CFGElement &, const TypeErasedDataflowAnalysisState &)> | PostVisitCFG = nullptr |
||
) |
Performs dataflow analysis and returns a mapping from basic block IDs to dataflow analysis states that model the respective basic blocks.
Indices of the returned vector correspond to basic block IDs. Returns an error if the dataflow analysis cannot be performed successfully. Otherwise, calls PostVisitCFG
on each CFG element with the final analysis results at that program point.
Definition at line 392 of file TypeErasedDataflowAnalysis.cpp.
References Analysis, clang::Block, BlockStates, CFCtx, clang::DataflowWorklistBase< Comp, QueueSize >::dequeue(), clang::dataflow::Environment::dump(), clang::ForwardDataflowWorklist::enqueueSuccessors(), clang::dataflow::TypeErasedDataflowAnalysisState::Env, clang::CFGBlock::getBlockID(), clang::dataflow::ControlFlowContext::getCFG(), clang::CFG::getEntry(), InitEnv, clang::dataflow::TypeErasedDataflowAnalysis::isEqualTypeErased(), isLoopHead(), clang::dataflow::TypeErasedDataflowAnalysisState::Lattice, clang::CFG::size(), transferCFGBlock(), clang::dataflow::TypeErasedDataflowAnalysis::typeErasedInitialElement(), Unchanged, clang::dataflow::Environment::widen(), and clang::dataflow::TypeErasedDataflowAnalysis::widenTypeErased().
Referenced by runDataflowAnalysis().
void clang::dataflow::transfer | ( | const StmtToEnvMap & | StmtToEnv, |
const Stmt & | S, | ||
Environment & | Env | ||
) |
Evaluates S
and updates Env
accordingly.
Requirements:
S
must not be ParenExpr
or ExprWithCleanups
.
Definition at line 869 of file Transfer.cpp.
References Env.
Referenced by builtinTransferStatement(), and clang::dataflow::DataflowAnalysis< Derived, LatticeT >::transferTypeErased().
TypeErasedDataflowAnalysisState clang::dataflow::transferBlock | ( | const ControlFlowContext & | CFCtx, |
llvm::ArrayRef< std::optional< TypeErasedDataflowAnalysisState > > | BlockStates, | ||
const CFGBlock & | Block, | ||
const Environment & | InitEnv, | ||
TypeErasedDataflowAnalysis & | Analysis, | ||
std::function< void(const CFGElement &, const TypeErasedDataflowAnalysisState &)> | PostVisitCFG = nullptr |
||
) |
Transfers the state of a basic block by evaluating each of its elements in the context of Analysis
and the states of its predecessors that are available in BlockStates
.
PostVisitCFG
(if provided) will be applied to each element in the block, after it is evaluated.
Requirements:
All predecessors of Block
except those with loop back edges must have already been transferred. States in BlockStates
that are set to std::nullopt
represent basic blocks that are not evaluated yet.
Definition at line 379 of file TypeErasedDataflowAnalysis.cpp.
References Analysis, clang::Block, BlockStates, CFCtx, InitEnv, and transferCFGBlock().
|
static |
Transfers State
by evaluating each element in the Block
based on the AC.Analysis
specified.
Built-in transfer functions (if the option for ApplyBuiltinTransfer
is set by the analysis) will be applied to the element before evaluation by the user-specified analysis. PostVisitCFG
(if provided) will be applied to the element after evaluation by the user-specified analysis.
Definition at line 353 of file TypeErasedDataflowAnalysis.cpp.
References clang::Block, builtinTransfer(), and computeBlockInputState().
Referenced by runTypeErasedDataflowAnalysis(), and transferBlock().
BoolValue & clang::dataflow::unpackBinaryBoolValue | ( | Environment & | Env, |
BoolValue & | B, | ||
M | build | ||
) |
Definition at line 65 of file Transfer.cpp.
References Env, unpackValue(), and V.
|
static |
Definition at line 78 of file Transfer.cpp.
References clang::dataflow::Value::AtomicBool, clang::dataflow::Value::Biconditional, clang::dataflow::Value::Conjunction, clang::dataflow::Value::Disjunction, Env, clang::dataflow::Value::Implication, clang::dataflow::Value::Integer, clang::dataflow::Environment::makeAnd(), clang::dataflow::Environment::makeAtomicBoolValue(), clang::dataflow::Environment::makeIff(), clang::dataflow::Environment::makeImplication(), clang::dataflow::Environment::makeNot(), clang::dataflow::Environment::makeOr(), clang::dataflow::Value::Negation, clang::dataflow::Value::Pointer, clang::dataflow::Value::Reference, clang::dataflow::Value::Struct, clang::dataflow::Value::TopBool, unpackValue(), and V.
Referenced by maybeUnpackLValueExpr(), unpackBinaryBoolValue(), and unpackValue().
Returns the variable of L
.
Definition at line 71 of file WatchedLiteralsSolver.cpp.
|
static |
Definition at line 133 of file DataflowEnvironment.cpp.
References clang::dataflow::Environment::makeTopBoolValue(), and clang::dataflow::Environment::ValueModel::widen().
Referenced by clang::dataflow::Environment::widen().
|
staticconstexpr |
Definition at line 36 of file DataflowEnvironment.cpp.
|
staticconstexpr |
Definition at line 37 of file DataflowEnvironment.cpp.
Referenced by clang::dataflow::Environment::createValue().
|
staticconstexpr |
A null clause identifier is used as a placeholder in various data structures and algorithms.
Definition at line 78 of file WatchedLiteralsSolver.cpp.
|
staticconstexpr |
A null literal is used as a placeholder in various data structures and algorithms.
Definition at line 59 of file WatchedLiteralsSolver.cpp.
Referenced by clang::dataflow::BooleanFormula::addClause().
|
staticconstexpr |
A null boolean variable is used as a placeholder in various data structures and algorithms.
Definition at line 49 of file WatchedLiteralsSolver.cpp.
Referenced by clang::dataflow::WatchedLiteralsSolverImpl::WatchedLiteralsSolverImpl().