Dataflow Directional Tag Classes. More...

Classes
class	AggregateStorageLocation
	A storage location which is subdivided into smaller storage locations that can be traced independently by abstract interpretation. More...

struct	AnalysisContext
	Holds data structures required for running dataflow analysis. More...

class	ASTMatchSwitchBuilder
	Collects cases of a "match switch": a collection of matchers paired with callbacks, which together define a switch that can be applied to a node whose type derives from `BaseT`. More...

class	AtomicBoolValue
	Models an atomic boolean. More...

struct	backward_analysis_tag

class	BiconditionalValue
	Models a boolean biconditional. More...

struct	BooleanFormula
	A boolean formula in conjunctive normal form. More...

class	BoolValue
	Models a boolean. More...

class	CFGMatchSwitchBuilder
	Collects cases of a "match switch": a collection of matchers paired with callbacks, which together define a switch that can be applied to an AST node contained in a CFG element. More...

class	ChromiumCheckModel
	Models the behavior of Chromium's CHECK, DCHECK, etc. More...

class	ConjunctionValue
	Models a boolean conjunction. More...

struct	ContextSensitiveOptions

class	ControlFlowContext
	Holds CFG and other derived context that is needed to perform dataflow analysis. More...

class	DataflowAnalysis
	Base class template for dataflow analyses built on a single lattice type. More...

class	DataflowAnalysisContext
	Owns objects that encompass the state of a program and stores context that is used during dataflow analysis. More...

struct	DataflowAnalysisOptions

struct	DataflowAnalysisState

class	DataflowModel
	Abstract base class for dataflow "models": reusable analysis components that model a particular aspect of program semantics in the `Environment`. More...

class	DisjunctionValue
	Models a boolean disjunction. More...

class	Environment
	Holds the state of the program (store and heap) at a given program point. More...

struct	forward_analysis_tag

class	ImplicationValue
	Models a boolean implication. More...

class	IntegerValue
	Models an integer. More...

class	MapLattice
	A lattice that maps keys to individual lattice elements. More...

class	NegationValue
	Models a boolean negation. More...

class	NoopAnalysis

class	NoopLattice
	Trivial lattice for dataflow analysis with exactly one element. More...

class	PointerValue
	Models a symbolic pointer. Specifically, any value of type `T*`. More...

class	ReferenceValue
	Models a dereferenced pointer. More...

class	ScalarStorageLocation
	A storage location that is not subdivided further for the purposes of abstract interpretation. More...

class	Solver
	An interface for a SAT solver that can be used by dataflow analyses. More...

class	StmtToEnvMap
	Maps statements to the environments of basic blocks that contain them. More...

class	StmtToEnvMapImpl

class	StorageLocation
	Base class for elements of the local variable store and of the heap. More...

class	StructValue
	Models a value of `struct` or `class` type, with a flat map of fields to child storage locations, containing all accessible members of base struct and class types. More...

class	TerminatorVisitor
	Extends the flow condition of an environment based on a terminator statement. More...

class	TopBoolValue
	Models the trivially true formula, which is Top in the lattice of boolean formulas. More...

struct	TransferState
	A common form of state shared between the cases of a transfer function. More...

struct	TransferStateForDiagnostics
	A read-only version of TransferState. More...

class	TransferVisitor

class	TypeErasedDataflowAnalysis
	Type-erased base class for dataflow analyses built on a single lattice type. More...

struct	TypeErasedDataflowAnalysisState
	Type-erased model of the program at a given program point. More...

struct	TypeErasedLattice
	Type-erased lattice element container. More...

class	UncheckedOptionalAccessDiagnoser

class	UncheckedOptionalAccessModel
	Dataflow analysis that models whether optionals hold values or not. More...

struct	UncheckedOptionalAccessModelOptions

class	Value
	Base class for all values computed by abstract interpretation. More...

class	WatchedLiteralsSolver
	A SAT solver that is an implementation of Algorithm D from Knuth's The Art of Computer Programming Volume 4: Satisfiability, Fascicle 6. More...

class	WatchedLiteralsSolverImpl

Typedefs
template<typename State , typename Result = void>
using	CFGMatchSwitch = std::function< Result(const CFGElement &, ASTContext &, State &)>

template<typename ElementLattice >
using	VarMapLattice = MapLattice< const clang::VarDecl *, ElementLattice >
	Convenience alias that captures the common use of map lattices to model in-scope variables. More...

template<typename T >
using	MatchSwitchMatcher = ast_matchers::internal::Matcher< T >

template<typename T , typename State , typename Result = void>
using	MatchSwitchAction = std::function< Result(const T *, const ast_matchers::MatchFinder::MatchResult &, State &)>

template<typename BaseT , typename State , typename Result = void>
using	ASTMatchSwitch = std::function< Result(const BaseT &, ASTContext &, State &)>

template<typename State , typename Result = void>
using	MatchSwitch = ASTMatchSwitch< Stmt, State, Result >

template<typename State , typename Result = void>
using	MatchSwitchBuilder = ASTMatchSwitchBuilder< Stmt, State, Result >

using	TerminatorVisitorRetTy = std::pair< const Expr *, bool >

using	Variable = uint32_t
	Boolean variables are represented as positive integers. More...

using	Literal = uint32_t
	Literals are represented as positive integers. More...

using	ClauseID = uint32_t
	Clause identifiers are represented as positive integers. More...

Enumerations
enum	SkipPast { SkipPast::None, SkipPast::Reference, SkipPast::ReferenceThenPointer }
	Indicates what kind of indirections should be skipped past when retrieving storage locations or values. More...

enum	ComparisonResult { ComparisonResult::Same, ComparisonResult::Different, ComparisonResult::Unknown }
	Indicates the result of a tentative comparison. More...

enum	LatticeJoinEffect { LatticeJoinEffect::Unchanged, LatticeJoinEffect::Changed }
	Effect indicating whether a lattice join operation resulted in a new value. More...

Functions
template<typename AnalysisT >
llvm::Expected< std::vector< std::optional< DataflowAnalysisState< typename AnalysisT::Lattice > > > >	runDataflowAnalysis (const ControlFlowContext &CFCtx, AnalysisT &Analysis, const Environment &InitEnv, std::function< void(const CFGElement &, const DataflowAnalysisState< typename AnalysisT::Lattice > &)> PostVisitCFG=nullptr)
	Performs dataflow analysis and returns a mapping from basic block IDs to dataflow analysis states that model the respective basic blocks. More...

const Expr &	ignoreCFGOmittedNodes (const Expr &E)
	Skip past nodes that the CFG does not emit. More...

const Stmt &	ignoreCFGOmittedNodes (const Stmt &S)

llvm::DenseSet< const FieldDecl * >	getObjectFields (QualType Type)
	Returns the set of all fields in the type. More...

llvm::StringRef	debugString (Value::Kind Kind)
	Returns a string representation of a value kind. More...

llvm::StringRef	debugString (Solver::Result::Assignment Assignment)
	Returns a string representation of a boolean assignment to true or false. More...

llvm::StringRef	debugString (Solver::Result::Status Status)
	Returns a string representation of the result status of a SAT check. More...

std::string	debugString (const BoolValue &B, llvm::DenseMap< const AtomicBoolValue *, std::string > AtomNames={{}})
	Returns a string representation for the boolean value `B`. More...

std::string	debugString (const llvm::DenseSet< BoolValue * > &Constraints, llvm::DenseMap< const AtomicBoolValue *, std::string > AtomNames={{}})
	Returns a string representation for `Constraints` - a collection of boolean formulas. More...

std::string	debugString (ArrayRef< BoolValue * > Constraints, const Solver::Result &Result, llvm::DenseMap< const AtomicBoolValue *, std::string > AtomNames={{}})
	Returns a string representation for `Constraints` - a collection of boolean formulas and the `Result` of satisfiability checking. More...

std::string	debugString (const llvm::DenseSet< BoolValue * > &Constraints, const Solver::Result &Result, llvm::DenseMap< const AtomicBoolValue *, std::string > AtomNames={{}})

template<typename Key , typename ElementLattice >
std::ostream &	operator<< (std::ostream &Os, const clang::dataflow::MapLattice< Key, ElementLattice > &M)

template<typename ElementLattice >
std::ostream &	operator<< (std::ostream &Os, const clang::dataflow::VarMapLattice< ElementLattice > &M)

std::ostream &	operator<< (std::ostream &OS, const NoopLattice &)

void	transfer (const StmtToEnvMap &StmtToEnv, const Stmt &S, Environment &Env)
	Evaluates `S` and updates `Env` accordingly. More...

TypeErasedDataflowAnalysisState	transferBlock (const ControlFlowContext &CFCtx, llvm::ArrayRef< std::optional< TypeErasedDataflowAnalysisState >> BlockStates, const CFGBlock &Block, const Environment &InitEnv, TypeErasedDataflowAnalysis &Analysis, std::function< void(const CFGElement &, const TypeErasedDataflowAnalysisState &)> PostVisitCFG=nullptr)
	Transfers the state of a basic block by evaluating each of its elements in the context of `Analysis` and the states of its predecessors that are available in `BlockStates`. More...

llvm::Expected< std::vector< std::optional< TypeErasedDataflowAnalysisState > > >	runTypeErasedDataflowAnalysis (const ControlFlowContext &CFCtx, TypeErasedDataflowAnalysis &Analysis, const Environment &InitEnv, std::function< void(const CFGElement &, const TypeErasedDataflowAnalysisState &)> PostVisitCFG=nullptr)
	Performs dataflow analysis and returns a mapping from basic block IDs to dataflow analysis states that model the respective basic blocks. More...

bool	areEquivalentValues (const Value &Val1, const Value &Val2)
	An equivalence relation for values. More...

raw_ostream &	operator<< (raw_ostream &OS, const Value &Val)

static llvm::DenseMap< const Stmt , const CFGBlock >	buildStmtToBasicBlockMap (const CFG &Cfg)
	Returns a map from statements to basic blocks that contain them. More...

static std::pair< BoolValue , BoolValue >	makeCanonicalBoolValuePair (BoolValue &LHS, BoolValue &RHS)

template<typename K , typename V >
llvm::DenseMap< K, V >	intersectDenseMaps (const llvm::DenseMap< K, V > &Map1, const llvm::DenseMap< K, V > &Map2)
	Returns a map consisting of key-value entries that are present in both maps. More...

static bool	compareDistinctValues (QualType Type, Value &Val1, const Environment &Env1, Value &Val2, const Environment &Env2, Environment::ValueModel &Model)

static Value *	mergeDistinctValues (QualType Type, Value &Val1, const Environment &Env1, Value &Val2, const Environment &Env2, Environment &MergedEnv, Environment::ValueModel &Model)
	Attempts to merge distinct values `Val1` and `Val2` in `Env1` and `Env2`, respectively, of the same type `Type`. More...

static Value &	widenDistinctValues (QualType Type, Value &Prev, const Environment &PrevEnv, Value &Current, Environment &CurrentEnv, Environment::ValueModel &Model)

static void	insertIfGlobal (const Decl &D, llvm::DenseSet< const FieldDecl * > &Fields, llvm::DenseSet< const VarDecl * > &Vars)
	Initializes a global storage value. More...

static void	getFieldsAndGlobalVars (const Decl &D, llvm::DenseSet< const FieldDecl * > &Fields, llvm::DenseSet< const VarDecl * > &Vars)

static void	getFieldsAndGlobalVars (const Stmt &S, llvm::DenseSet< const FieldDecl * > &Fields, llvm::DenseSet< const VarDecl * > &Vars)
	Traverses `S` and inserts into `Vars` any global storage values that are declared in or referenced from sub-statements. More...

bool	isCheckLikeMethod (llvm::SmallDenseSet< const CXXMethodDecl * > &CheckDecls, const CXXMethodDecl &D)
	Determines whether `D` is one of the methods used to implement Chromium's `CHECK` macros. More...

static BoolValue &	evaluateBooleanEquality (const Expr &LHS, const Expr &RHS, Environment &Env)

static BoolValue &	unpackValue (BoolValue &V, Environment &Env)

template<typename Derived , typename M >
BoolValue &	unpackBinaryBoolValue (Environment &Env, BoolValue &B, M build)

static Value *	maybeUnpackLValueExpr (const Expr &E, Environment &Env)

static int	blockIndexInPredecessor (const CFGBlock &Pred, const CFGBlock &Block)
	Returns the index of `Block` in the successors of `Pred`. More...

static bool	isLoopHead (const CFGBlock &B)

static TypeErasedDataflowAnalysisState	computeBlockInputState (const CFGBlock &Block, AnalysisContext &AC)
	Computes the input state for a given basic block by joining the output states of its predecessors. More...

void	builtinTransferStatement (const CFGStmt &Elt, TypeErasedDataflowAnalysisState &InputState, AnalysisContext &AC)
	Built-in transfer function for `CFGStmt`. More...

void	builtinTransferInitializer (const CFGInitializer &Elt, TypeErasedDataflowAnalysisState &InputState)
	Built-in transfer function for `CFGInitializer`. More...

void	builtinTransfer (const CFGElement &Elt, TypeErasedDataflowAnalysisState &State, AnalysisContext &AC)

TypeErasedDataflowAnalysisState	transferCFGBlock (const CFGBlock &Block, AnalysisContext &AC, std::function< void(const CFGElement &, const TypeErasedDataflowAnalysisState &)> PostVisitCFG=nullptr)
	Transfers `State` by evaluating each element in the `Block` based on the `AC.Analysis` specified. More...

static bool	areEquivalentIndirectionValues (const Value &Val1, const Value &Val2)

static constexpr Literal	posLit (Variable V)
	Returns the positive literal `V`. More...

static constexpr Literal	negLit (Variable V)
	Returns the negative literal `!V`. More...

static constexpr Literal	notLit (Literal L)
	Returns the negated literal `!L`. More...

static constexpr Variable	var (Literal L)
	Returns the variable of `L`. More...

BooleanFormula	buildBooleanFormula (const llvm::DenseSet< BoolValue * > &Vals)
	Converts the conjunction of `Vals` into a formula in conjunctive normal form where each clause has at least one and at most three literals. More...

Variables
static constexpr int	MaxCompositeValueDepth = 3

static constexpr int	MaxCompositeValueSize = 1000

static constexpr Variable	NullVar = 0
	A null boolean variable is used as a placeholder in various data structures and algorithms. More...

static constexpr Literal	NullLit = 0
	A null literal is used as a placeholder in various data structures and algorithms. More...

static constexpr ClauseID	NullClause = 0
	A null clause identifier is used as a placeholder in various data structures and algorithms. More...

Detailed Description

Dataflow Directional Tag Classes.

These are used for tag dispatching within the dataflow solver/transfer functions to determine what direction a dataflow analysis flows.

Typedef Documentation

◆ ASTMatchSwitch

template<typename BaseT , typename State , typename Result = void>

using clang::dataflow::ASTMatchSwitch = typedef std::function<Result(const BaseT &, ASTContext &, State &)>

Definition at line 70 of file MatchSwitch.h.

◆ CFGMatchSwitch

template<typename State , typename Result = void>

using clang::dataflow::CFGMatchSwitch = typedef std::function<Result(const CFGElement &, ASTContext &, State &)>

Definition at line 34 of file CFGMatchSwitch.h.

◆ ClauseID

using clang::dataflow::ClauseID = typedef uint32_t

Clause identifiers are represented as positive integers.

Definition at line 74 of file WatchedLiteralsSolver.cpp.

◆ Literal

using clang::dataflow::Literal = typedef uint32_t

Literals are represented as positive integers.

Specifically, for a boolean variable V that is represented as the positive integer I, the positive literal V is represented as the integer 2*I and the negative literal !V is represented as the integer 2*I+1.

Definition at line 55 of file WatchedLiteralsSolver.cpp.

◆ MatchSwitch

template<typename State , typename Result = void>

using clang::dataflow::MatchSwitch = typedef ASTMatchSwitch<Stmt, State, Result>

Definition at line 75 of file MatchSwitch.h.

◆ MatchSwitchAction

template<typename T , typename State , typename Result = void>

using clang::dataflow::MatchSwitchAction = typedef std::function<Result( const T *, const ast_matchers::MatchFinder::MatchResult &, State &)>

Definition at line 66 of file MatchSwitch.h.

◆ MatchSwitchBuilder

template<typename State , typename Result = void>

using clang::dataflow::MatchSwitchBuilder = typedef ASTMatchSwitchBuilder<Stmt, State, Result>

Definition at line 177 of file MatchSwitch.h.

◆ MatchSwitchMatcher

template<typename T >

using clang::dataflow::MatchSwitchMatcher = typedef ast_matchers::internal::Matcher<T>

Definition at line 62 of file MatchSwitch.h.

◆ TerminatorVisitorRetTy

using clang::dataflow::TerminatorVisitorRetTy = typedef std::pair<const Expr *, bool>

Definition at line 92 of file TypeErasedDataflowAnalysis.cpp.

◆ Variable

using clang::dataflow::Variable = typedef uint32_t

Boolean variables are represented as positive integers.

Definition at line 45 of file WatchedLiteralsSolver.cpp.

◆ VarMapLattice

template<typename ElementLattice >

using clang::dataflow::VarMapLattice = typedef MapLattice<const clang::VarDecl *, ElementLattice>

Convenience alias that captures the common use of map lattices to model in-scope variables.

Definition at line 112 of file MapLattice.h.

Enumeration Type Documentation

◆ ComparisonResult

enum clang::dataflow::ComparisonResult

strong

Indicates the result of a tentative comparison.

Enumerator
Same
Different
Unknown

Definition at line 53 of file DataflowEnvironment.h.

◆ LatticeJoinEffect

enum clang::dataflow::LatticeJoinEffect

strong

Effect indicating whether a lattice join operation resulted in a new value.

Enumerator
Unchanged
Changed

Definition at line 23 of file DataflowLattice.h.

◆ SkipPast

enum clang::dataflow::SkipPast

strong

Indicates what kind of indirections should be skipped past when retrieving storage locations or values.

FIXME: Consider renaming this or replacing it with a more appropriate model. See the discussion in https://reviews.llvm.org/D116596 for context.

Enumerator
None	No indirections should be skipped past.
Reference	An optional reference should be skipped past.
ReferenceThenPointer	An optional reference should be skipped past, then an optional pointer should be skipped past.

Definition at line 42 of file DataflowEnvironment.h.

Function Documentation

◆ areEquivalentIndirectionValues()

static bool clang::dataflow::areEquivalentIndirectionValues	(	const Value &	Val1,
		const Value &	Val2
	)

static

Definition at line 20 of file Value.cpp.

Referenced by areEquivalentValues().

◆ areEquivalentValues()

bool clang::dataflow::areEquivalentValues	(	const Value &	Val1,
		const Value &	Val2
	)

An equivalence relation for values.

It obeys reflexivity, symmetry and transitivity. It does not include comparison of Properties.

Computes equivalence for these subclasses:

ReferenceValue, PointerValue – pointee locations are equal. Does not compute deep equality of Value at said location.
TopBoolValue – both are TopBoolValues.

Otherwise, falls back to pointer equality.

Definition at line 33 of file Value.cpp.

References areEquivalentIndirectionValues(), and clang::dataflow::Value::getKind().

Referenced by clang::dataflow::Environment::equivalentTo(), clang::dataflow::Environment::join(), and clang::dataflow::Environment::widen().

◆ blockIndexInPredecessor()

static int clang::dataflow::blockIndexInPredecessor	(	const CFGBlock &	Pred,
		const CFGBlock &	Block
	)

static

Returns the index of Block in the successors of Pred.

Definition at line 65 of file TypeErasedDataflowAnalysis.cpp.

References clang::Block, clang::CFGBlock::succ_begin(), and clang::CFGBlock::succs().

Referenced by computeBlockInputState().

◆ buildBooleanFormula()

BooleanFormula clang::dataflow::buildBooleanFormula ( const llvm::DenseSet< BoolValue * > & Vals )

Converts the conjunction of Vals into a formula in conjunctive normal form where each clause has at least one and at most three literals.

Definition at line 180 of file WatchedLiteralsSolver.cpp.

References clang::dataflow::BooleanFormula::addClause(), clang::dataflow::Value::AtomicBool, clang::dataflow::Value::Biconditional, clang::dataflow::Value::Conjunction, clang::dataflow::Value::Disjunction, clang::dataflow::Value::getKind(), clang::dataflow::Value::Implication, clang::dataflow::Value::Negation, negLit(), posLit(), and clang::dataflow::Value::TopBool.

◆ buildStmtToBasicBlockMap()

static llvm::DenseMap<const Stmt *, const CFGBlock *> clang::dataflow::buildStmtToBasicBlockMap ( const CFG & Cfg )

static

Returns a map from statements to basic blocks that contain them.

Definition at line 28 of file ControlFlowContext.cpp.

References clang::Block.

◆ builtinTransfer()

void clang::dataflow::builtinTransfer	(	const CFGElement &	Elt,
		TypeErasedDataflowAnalysisState &	State,
		AnalysisContext &	AC
	)

Definition at line 340 of file TypeErasedDataflowAnalysis.cpp.

References builtinTransferInitializer(), builtinTransferStatement(), clang::CFGElement::castAs(), clang::CFGElement::getKind(), clang::CFGElement::Initializer, State, and clang::CFGElement::Statement.

Referenced by transferCFGBlock().

◆ builtinTransferInitializer()

void clang::dataflow::builtinTransferInitializer	(	const CFGInitializer &	Elt,
		TypeErasedDataflowAnalysisState &	InputState
	)

Built-in transfer function for CFGInitializer.

Definition at line 305 of file TypeErasedDataflowAnalysis.cpp.

References clang::dataflow::TypeErasedDataflowAnalysisState::Env, clang::CFGInitializer::getInitializer(), clang::Member, and Reference.

Referenced by builtinTransfer().

◆ builtinTransferStatement()

void clang::dataflow::builtinTransferStatement	(	const CFGStmt &	Elt,
		TypeErasedDataflowAnalysisState &	InputState,
		AnalysisContext &	AC
	)

Built-in transfer function for CFGStmt.

Definition at line 296 of file TypeErasedDataflowAnalysis.cpp.

Referenced by builtinTransfer().

◆ compareDistinctValues()

static bool clang::dataflow::compareDistinctValues	(	QualType	Type,
		Value &	Val1,
		const Environment &	Env1,
		Value &	Val2,
		const Environment &	Env2,
		Environment::ValueModel &	Model
	)

static

Definition at line 52 of file DataflowEnvironment.cpp.

References clang::dataflow::Environment::ValueModel::compare(), Different, clang::dataflow::Value::getKind(), clang::dataflow::Value::Integer, clang::dataflow::Value::Pointer, clang::dataflow::Value::Reference, Same, clang::dataflow::Value::Struct, and Unknown.

Referenced by clang::dataflow::Environment::equivalentTo().

◆ computeBlockInputState()

static TypeErasedDataflowAnalysisState clang::dataflow::computeBlockInputState	(	const CFGBlock &	Block,
		AnalysisContext &	AC
	)

static

Computes the input state for a given basic block by joining the output states of its predecessors.

Requirements:

All predecessors of Block except those with loop back edges must have already been transferred. States in AC.BlockStates that are set to std::nullopt represent basic blocks that are not evaluated yet.

Definition at line 214 of file TypeErasedDataflowAnalysis.cpp.

References clang::dataflow::AnalysisContext::Analysis, clang::Block, blockIndexInPredecessor(), clang::dataflow::AnalysisContext::BlockStates, clang::dataflow::AnalysisContext::CFCtx, clang::dataflow::TypeErasedDataflowAnalysisState::Env, clang::dataflow::ControlFlowContext::getStmtToBlock(), clang::dataflow::AnalysisContext::InitEnv, clang::dataflow::TypeErasedDataflowAnalysisState::Lattice, and clang::StmtVisitorBase< Ptr, ImplClass, RetTy, ParamTys >::Visit().

Referenced by transferCFGBlock().

◆ debugString() [1/7]

std::string clang::dataflow::debugString	(	ArrayRef< BoolValue * >	Constraints,
		const Solver::Result &	Result,
		llvm::DenseMap< const AtomicBoolValue *, std::string >	AtomNames = `{{}}`
	)

Returns a string representation for Constraints - a collection of boolean formulas and the Result of satisfiability checking.

Atomic booleans appearing in Constraints and Result are assigned to labels either specified in AtomNames or created by default rules as B0, B1, ...

Requirements:

Names assigned to atoms should not be repeated in AtomNames.

Definition at line 252 of file DebugSupport.cpp.

◆ debugString() [2/7]

std::string clang::dataflow::debugString	(	const BoolValue &	B,
		llvm::DenseMap< const AtomicBoolValue *, std::string >	AtomNames = `{{}}`
	)

Returns a string representation for the boolean value B.

Atomic booleans appearing in the boolean value B are assigned to labels either specified in AtomNames or created by default rules as B0, B1, ...

Requirements:

Names assigned to atoms should not be repeated in AtomNames.

Definition at line 240 of file DebugSupport.cpp.

◆ debugString() [3/7]

std::string clang::dataflow::debugString	(	const llvm::DenseSet< BoolValue * > &	Constraints,
		const Solver::Result &	Result,
		llvm::DenseMap< const AtomicBoolValue *, std::string >	AtomNames = `{{}}`
	)

inline

Definition at line 76 of file DebugSupport.h.

◆ debugString() [4/7]

std::string clang::dataflow::debugString	(	const llvm::DenseSet< BoolValue * > &	Constraints,
		llvm::DenseMap< const AtomicBoolValue *, std::string >	AtomNames = `{{}}`
	)

Returns a string representation for Constraints - a collection of boolean formulas.

Atomic booleans appearing in the boolean value Constraints are assigned to labels either specified in AtomNames or created by default rules as B0, B1, ...

Requirements:

Names assigned to atoms should not be repeated in AtomNames.

Definition at line 246 of file DebugSupport.cpp.

◆ debugString() [5/7]

llvm::StringRef clang::dataflow::debugString ( Solver::Result::Assignment Assignment )

Returns a string representation of a boolean assignment to true or false.

Definition at line 63 of file DebugSupport.cpp.

References clang::dataflow::Solver::Result::AssignedFalse, clang::dataflow::Solver::Result::AssignedTrue, and clang::prec::Assignment.

◆ debugString() [6/7]

llvm::StringRef clang::dataflow::debugString ( Solver::Result::Status Status )

Returns a string representation of the result status of a SAT check.

Definition at line 73 of file DebugSupport.cpp.

◆ debugString() [7/7]

llvm::StringRef clang::dataflow::debugString ( Value::Kind Kind )

Returns a string representation of a value kind.

Definition at line 35 of file DebugSupport.cpp.

References clang::dataflow::Value::AtomicBool, clang::dataflow::Value::Biconditional, clang::dataflow::Value::Conjunction, clang::dataflow::Value::Disjunction, clang::dataflow::Value::Implication, clang::dataflow::Value::Integer, clang::dataflow::Value::Negation, clang::dataflow::Value::Pointer, clang::dataflow::Value::Reference, clang::dataflow::Value::Struct, and clang::dataflow::Value::TopBool.

Referenced by operator<<().

◆ evaluateBooleanEquality()

static BoolValue& clang::dataflow::evaluateBooleanEquality	(	const Expr &	LHS,
		const Expr &	RHS,
		Environment &	Env
	)

static

Definition at line 39 of file Transfer.cpp.

References clang::dataflow::Environment::getValue(), clang::dataflow::Environment::makeAtomicBoolValue(), clang::dataflow::Environment::makeIff(), and Reference.

◆ getFieldsAndGlobalVars() [1/2]

static void clang::dataflow::getFieldsAndGlobalVars	(	const Decl &	D,
		llvm::DenseSet< const FieldDecl * > &	Fields,
		llvm::DenseSet< const VarDecl * > &	Vars
	)

static

Definition at line 166 of file DataflowEnvironment.cpp.

References insertIfGlobal().

Referenced by clang::dataflow::Environment::Environment().

◆ getFieldsAndGlobalVars() [2/2]

static void clang::dataflow::getFieldsAndGlobalVars	(	const Stmt &	S,
		llvm::DenseSet< const FieldDecl * > &	Fields,
		llvm::DenseSet< const VarDecl * > &	Vars
	)

static

Traverses S and inserts into Vars any global storage values that are declared in or referenced from sub-statements.

Definition at line 180 of file DataflowEnvironment.cpp.

◆ getObjectFields()

llvm::DenseSet< const FieldDecl * > clang::dataflow::getObjectFields ( QualType Type )

Returns the set of all fields in the type.

Gets the set of all fields in the type.

Definition at line 418 of file DataflowAnalysisContext.cpp.

References getFieldsFromClassHierarchy().

Referenced by clang::dataflow::DataflowAnalysisContext::createStorageLocation().

◆ ignoreCFGOmittedNodes() [1/2]

const Expr & clang::dataflow::ignoreCFGOmittedNodes ( const Expr & E )

Skip past nodes that the CFG does not emit.

These nodes are invisible to flow-sensitive analysis, and should be ignored as they will effectively not exist.

ParenExpr - The CFG takes the operator precedence into account, but otherwise omits the node afterwards.
ExprWithCleanups - The CFG will generate the appropriate calls to destructors and then omit the node.

Definition at line 383 of file DataflowAnalysisContext.cpp.

Referenced by clang::dataflow::DataflowAnalysisContext::getStorageLocation(), clang::dataflow::Environment::getStorageLocation(), clang::dataflow::DataflowAnalysisContext::setStorageLocation(), and clang::dataflow::Environment::setStorageLocation().

◆ ignoreCFGOmittedNodes() [2/2]

const Stmt & clang::dataflow::ignoreCFGOmittedNodes ( const Stmt & S )

Definition at line 394 of file DataflowAnalysisContext.cpp.

◆ insertIfGlobal()

static void clang::dataflow::insertIfGlobal	(	const Decl &	D,
		llvm::DenseSet< const FieldDecl * > &	Fields,
		llvm::DenseSet< const VarDecl * > &	Vars
	)

static

Initializes a global storage value.

Definition at line 158 of file DataflowEnvironment.cpp.

References V.

Referenced by getFieldsAndGlobalVars().

◆ intersectDenseMaps()

template<typename K , typename V >

llvm::DenseMap<K, V> clang::dataflow::intersectDenseMaps	(	const llvm::DenseMap< K, V > &	Map1,
		const llvm::DenseMap< K, V > &	Map2
	)

Returns a map consisting of key-value entries that are present in both maps.

Definition at line 41 of file DataflowEnvironment.cpp.

Referenced by clang::dataflow::Environment::join().

◆ isCheckLikeMethod()

bool clang::dataflow::isCheckLikeMethod	(	llvm::SmallDenseSet< const CXXMethodDecl * > &	CheckDecls,
		const CXXMethodDecl &	D
	)

Determines whether D is one of the methods used to implement Chromium's CHECK macros.

Populates CheckDecls, if empty.

Definition at line 19 of file ChromiumCheckModel.cpp.

References clang::Decl::getDeclContext(), clang::NamedDecl::getDeclName(), clang::NamedDecl::getName(), clang::CXXMethodDecl::getParent(), clang::DeclarationName::isIdentifier(), clang::CXXMethodDecl::isStatic(), and clang::CXXRecordDecl::methods().

Referenced by clang::dataflow::ChromiumCheckModel::transfer().

◆ isLoopHead()

static bool clang::dataflow::isLoopHead ( const CFGBlock & B )

static

Definition at line 74 of file TypeErasedDataflowAnalysis.cpp.

References clang::CFGBlock::getTerminatorStmt().

Referenced by runTypeErasedDataflowAnalysis().

◆ makeCanonicalBoolValuePair()

static std::pair<BoolValue , BoolValue > clang::dataflow::makeCanonicalBoolValuePair	(	BoolValue &	LHS,
		BoolValue &	RHS
	)

static

Definition at line 93 of file DataflowAnalysisContext.cpp.

Referenced by clang::dataflow::DataflowAnalysisContext::getOrCreateConjunction(), clang::dataflow::DataflowAnalysisContext::getOrCreateDisjunction(), and clang::dataflow::DataflowAnalysisContext::getOrCreateIff().

◆ maybeUnpackLValueExpr()

static Value* clang::dataflow::maybeUnpackLValueExpr	(	const Expr &	E,
		Environment &	Env
	)

static

Definition at line 112 of file Transfer.cpp.

References clang::dataflow::Environment::getStorageLocation(), clang::dataflow::Environment::getValue(), Reference, clang::dataflow::Environment::setValue(), and unpackValue().

◆ mergeDistinctValues()

static Value* clang::dataflow::mergeDistinctValues	(	QualType	Type,
		Value &	Val1,
		const Environment &	Env1,
		Value &	Val2,
		const Environment &	Env2,
		Environment &	MergedEnv,
		Environment::ValueModel &	Model
	)

static

Attempts to merge distinct values Val1 and Val2 in Env1 and Env2, respectively, of the same type Type.

Merging generally produces a single value that (soundly) approximates the two inputs, although the actual meaning depends on Model.

Definition at line 89 of file DataflowEnvironment.cpp.

References clang::dataflow::Environment::addToFlowCondition(), clang::dataflow::Environment::createValue(), clang::dataflow::Environment::getFlowConditionToken(), clang::dataflow::Environment::makeAnd(), clang::dataflow::Environment::makeAtomicBoolValue(), clang::dataflow::Environment::makeIff(), clang::dataflow::Environment::makeOr(), and clang::dataflow::Environment::ValueModel::merge().

Referenced by clang::dataflow::Environment::join().

◆ negLit()

static constexpr Literal clang::dataflow::negLit ( Variable V )

staticconstexpr

Returns the negative literal !V.

Definition at line 65 of file WatchedLiteralsSolver.cpp.

References V.

Referenced by buildBooleanFormula(), clang::dataflow::WatchedLiteralsSolverImpl::solve(), and clang::dataflow::WatchedLiteralsSolverImpl::WatchedLiteralsSolverImpl().

◆ notLit()

static constexpr Literal clang::dataflow::notLit ( Literal L )

staticconstexpr

Returns the negated literal !L.

Definition at line 68 of file WatchedLiteralsSolver.cpp.

◆ operator<<() [1/4]

raw_ostream & clang::dataflow::operator<<	(	raw_ostream &	OS,
		const Value &	Val
	)

Definition at line 39 of file Value.cpp.

References debugString(), clang::dataflow::Value::getKind(), clang::dataflow::Value::Pointer, and clang::dataflow::Value::Reference.

◆ operator<<() [2/4]

template<typename Key , typename ElementLattice >

std::ostream& clang::dataflow::operator<<	(	std::ostream &	Os,
		const clang::dataflow::MapLattice< Key, ElementLattice > &	M
	)

Definition at line 116 of file MapLattice.h.

References string().

◆ operator<<() [3/4]

template<typename ElementLattice >

std::ostream& clang::dataflow::operator<<	(	std::ostream &	Os,
		const clang::dataflow::VarMapLattice< ElementLattice > &	M
	)

Definition at line 129 of file MapLattice.h.

References string().

◆ operator<<() [4/4]

std::ostream& clang::dataflow::operator<<	(	std::ostream &	OS,
		const NoopLattice &
	)

inline

Definition at line 34 of file NoopLattice.h.

◆ posLit()

static constexpr Literal clang::dataflow::posLit ( Variable V )

staticconstexpr

Returns the positive literal V.

Definition at line 62 of file WatchedLiteralsSolver.cpp.

References V.

Referenced by buildBooleanFormula(), clang::dataflow::WatchedLiteralsSolverImpl::solve(), and clang::dataflow::WatchedLiteralsSolverImpl::WatchedLiteralsSolverImpl().

◆ runDataflowAnalysis()

template<typename AnalysisT >

llvm::Expected<std::vector< std::optional<DataflowAnalysisState<typename AnalysisT::Lattice> > > > clang::dataflow::runDataflowAnalysis	(	const ControlFlowContext &	CFCtx,
		AnalysisT &	Analysis,
		const Environment &	InitEnv,
		std::function< void(const CFGElement &, const DataflowAnalysisState< typename AnalysisT::Lattice > &)>	PostVisitCFG = `nullptr`
	)

Performs dataflow analysis and returns a mapping from basic block IDs to dataflow analysis states that model the respective basic blocks.

The returned vector, if any, will have the same size as the number of CFG blocks, with indices corresponding to basic block IDs. Returns an error if the dataflow analysis cannot be performed successfully. Otherwise, calls PostVisitCFG on each CFG element with the final analysis results at that program point.

Definition at line 193 of file DataflowAnalysis.h.

References runTypeErasedDataflowAnalysis(), and State.

◆ runTypeErasedDataflowAnalysis()

llvm::Expected< std::vector< std::optional< TypeErasedDataflowAnalysisState > > > clang::dataflow::runTypeErasedDataflowAnalysis	(	const ControlFlowContext &	CFCtx,
		TypeErasedDataflowAnalysis &	Analysis,
		const Environment &	InitEnv,
		std::function< void(const CFGElement &, const TypeErasedDataflowAnalysisState &)>	PostVisitCFG = `nullptr`
	)

Performs dataflow analysis and returns a mapping from basic block IDs to dataflow analysis states that model the respective basic blocks.

Indices of the returned vector correspond to basic block IDs. Returns an error if the dataflow analysis cannot be performed successfully. Otherwise, calls PostVisitCFG on each CFG element with the final analysis results at that program point.

Definition at line 400 of file TypeErasedDataflowAnalysis.cpp.

References clang::Block, clang::DataflowWorklistBase< Comp, QueueSize >::dequeue(), clang::dataflow::Environment::dump(), clang::ForwardDataflowWorklist::enqueueSuccessors(), clang::dataflow::TypeErasedDataflowAnalysisState::Env, clang::CFGBlock::getBlockID(), clang::dataflow::ControlFlowContext::getCFG(), clang::CFG::getEntry(), clang::dataflow::TypeErasedDataflowAnalysis::isEqualTypeErased(), isLoopHead(), clang::dataflow::TypeErasedDataflowAnalysisState::Lattice, min(), clang::CFG::size(), transferCFGBlock(), clang::dataflow::TypeErasedDataflowAnalysis::typeErasedInitialElement(), Unchanged, clang::dataflow::Environment::widen(), and clang::dataflow::TypeErasedDataflowAnalysis::widenTypeErased().

Referenced by runDataflowAnalysis().

◆ transfer()

void clang::dataflow::transfer	(	const StmtToEnvMap &	StmtToEnv,
		const Stmt &	S,
		Environment &	Env
	)

Evaluates S and updates Env accordingly.

Requirements:

S must not be ParenExpr or ExprWithCleanups.

Definition at line 834 of file Transfer.cpp.

Referenced by clang::dataflow::DataflowAnalysis< NoopAnalysis, NoopLattice >::transferTypeErased().

◆ transferBlock()

TypeErasedDataflowAnalysisState clang::dataflow::transferBlock	(	const ControlFlowContext &	CFCtx,
		llvm::ArrayRef< std::optional< TypeErasedDataflowAnalysisState >>	BlockStates,
		const CFGBlock &	Block,
		const Environment &	InitEnv,
		TypeErasedDataflowAnalysis &	Analysis,
		std::function< void(const CFGElement &, const TypeErasedDataflowAnalysisState &)>	PostVisitCFG = `nullptr`
	)

Transfers the state of a basic block by evaluating each of its elements in the context of Analysis and the states of its predecessors that are available in BlockStates.

PostVisitCFG (if provided) will be applied to each element in the block, after it is evaluated.

Requirements:

All predecessors of Block except those with loop back edges must have already been transferred. States in BlockStates that are set to std::nullopt represent basic blocks that are not evaluated yet.

Definition at line 387 of file TypeErasedDataflowAnalysis.cpp.

References clang::Block, and transferCFGBlock().

◆ transferCFGBlock()

TypeErasedDataflowAnalysisState clang::dataflow::transferCFGBlock	(	const CFGBlock &	Block,
		AnalysisContext &	AC,
		std::function< void(const CFGElement &, const TypeErasedDataflowAnalysisState &)>	PostVisitCFG = `nullptr`
	)

Transfers State by evaluating each element in the Block based on the AC.Analysis specified.

Built-in transfer functions (if the option for ApplyBuiltinTransfer is set by the analysis) will be applied to the element before evaluation by the user-specified analysis. PostVisitCFG (if provided) will be applied to the element after evaluation by the user-specified analysis.

Definition at line 365 of file TypeErasedDataflowAnalysis.cpp.

References clang::dataflow::AnalysisContext::Analysis, clang::Block, clang::dataflow::TypeErasedDataflowAnalysis::builtinOptions(), builtinTransfer(), computeBlockInputState(), State, and clang::dataflow::TypeErasedDataflowAnalysis::transferTypeErased().

Referenced by runTypeErasedDataflowAnalysis(), and transferBlock().

◆ unpackBinaryBoolValue()

template<typename Derived , typename M >

BoolValue& clang::dataflow::unpackBinaryBoolValue	(	Environment &	Env,
		BoolValue &	B,
		M	build
	)

Definition at line 57 of file Transfer.cpp.

References unpackValue(), and V.

◆ unpackValue()

static BoolValue & clang::dataflow::unpackValue	(	BoolValue &	V,
		Environment &	Env
	)

static

◆ var()

static constexpr Variable clang::dataflow::var ( Literal L )

staticconstexpr

Returns the variable of L.

Definition at line 71 of file WatchedLiteralsSolver.cpp.

Referenced by clang::Sema::ActOnBlockStmtExpr(), clang::Sema::ActOnForEachDeclStmt(), clang::Sema::CheckCompleteVariableDeclaration(), considerVariable(), drillIntoBlockVariable(), emitArgumentDemotion(), clang::CodeGen::CodeGenFunction::emitAutoVarTypeCleanup(), EmitAutoVarWithLifetime(), clang::CodeGen::CodeGenFunction::emitBlockByrefAddress(), clang::CodeGen::CodeGenFunction::EmitDeclRefLValue(), clang::CodeGen::CodeGenFunction::EmitStaticVarDecl(), clang::CodeGen::CodeGenFunction::GenerateBlockFunction(), clang::CodeGen::CGBlockInfo::getCapture(), clang::CFGImplicitDtor::getDestructorDecl(), clang::Sema::inferObjCARCLifetime(), isAccessedBy(), isBlockVarRef(), isInvalidICRSource(), clang::CodeGen::ConstantEmitter::setInConstantContext(), SetupCleanupBlockActivation(), shouldExtendReceiverForInnerPointerMessage(), clang::arcmt::trans::BlockObjCVariableTraverser::traverseBody(), tryCaptureAsConstant(), and clang::CodeGen::CodeGenFunction::tryEmitAsConstant().

◆ widenDistinctValues()

static Value& clang::dataflow::widenDistinctValues	(	QualType	Type,
		Value &	Prev,
		const Environment &	PrevEnv,
		Value &	Current,
		Environment &	CurrentEnv,
		Environment::ValueModel &	Model
	)

static

Definition at line 133 of file DataflowEnvironment.cpp.

Referenced by clang::dataflow::Environment::widen().

Variable Documentation

◆ MaxCompositeValueDepth

constexpr int clang::dataflow::MaxCompositeValueDepth = 3

staticconstexpr

Definition at line 36 of file DataflowEnvironment.cpp.

◆ MaxCompositeValueSize

constexpr int clang::dataflow::MaxCompositeValueSize = 1000

staticconstexpr

Definition at line 37 of file DataflowEnvironment.cpp.

Referenced by clang::dataflow::Environment::createValue().

◆ NullClause

constexpr ClauseID clang::dataflow::NullClause = 0

staticconstexpr

A null clause identifier is used as a placeholder in various data structures and algorithms.

Definition at line 78 of file WatchedLiteralsSolver.cpp.

◆ NullLit

constexpr Literal clang::dataflow::NullLit = 0

staticconstexpr

A null literal is used as a placeholder in various data structures and algorithms.

Definition at line 59 of file WatchedLiteralsSolver.cpp.

Referenced by clang::dataflow::BooleanFormula::addClause().

◆ NullVar

constexpr Variable clang::dataflow::NullVar = 0

staticconstexpr

A null boolean variable is used as a placeholder in various data structures and algorithms.

Definition at line 49 of file WatchedLiteralsSolver.cpp.

Referenced by clang::dataflow::WatchedLiteralsSolverImpl::WatchedLiteralsSolverImpl().

Classes

Typedefs

Enumerations

Functions

Variables

Detailed Description

Typedef Documentation

◆ ASTMatchSwitch

◆ CFGMatchSwitch

◆ ClauseID

◆ Literal

◆ MatchSwitch

◆ MatchSwitchAction

◆ MatchSwitchBuilder

◆ MatchSwitchMatcher

◆ TerminatorVisitorRetTy

◆ Variable

◆ VarMapLattice

Enumeration Type Documentation

◆ ComparisonResult

◆ LatticeJoinEffect

◆ SkipPast

Function Documentation

◆ areEquivalentIndirectionValues()

◆ areEquivalentValues()

◆ blockIndexInPredecessor()

◆ buildBooleanFormula()

◆ buildStmtToBasicBlockMap()

◆ builtinTransfer()

◆ builtinTransferInitializer()

◆ builtinTransferStatement()

◆ compareDistinctValues()

◆ computeBlockInputState()

◆ debugString() [1/7]

◆ debugString() [2/7]

◆ debugString() [3/7]

◆ debugString() [4/7]

◆ debugString() [5/7]

◆ debugString() [6/7]

◆ debugString() [7/7]

◆ evaluateBooleanEquality()

◆ getFieldsAndGlobalVars() [1/2]

◆ getFieldsAndGlobalVars() [2/2]

◆ getObjectFields()

◆ ignoreCFGOmittedNodes() [1/2]

◆ ignoreCFGOmittedNodes() [2/2]

◆ insertIfGlobal()

◆ intersectDenseMaps()

◆ isCheckLikeMethod()

◆ isLoopHead()

◆ makeCanonicalBoolValuePair()

◆ maybeUnpackLValueExpr()

◆ mergeDistinctValues()

◆ negLit()

◆ notLit()

◆ operator<<() [1/4]

◆ operator<<() [2/4]

◆ operator<<() [3/4]

◆ operator<<() [4/4]

◆ posLit()

◆ runDataflowAnalysis()

◆ runTypeErasedDataflowAnalysis()

◆ transfer()

◆ transferBlock()

◆ transferCFGBlock()

◆ unpackBinaryBoolValue()

◆ unpackValue()

◆ var()

◆ widenDistinctValues()

Variable Documentation

◆ MaxCompositeValueDepth

◆ MaxCompositeValueSize

◆ NullClause

◆ NullLit

◆ NullVar