Namespaces
namespace	allocation_state

namespace	bugreporter

namespace	categories

namespace	check

namespace	checker_registry

namespace	cocoa

namespace	coreFoundation

namespace	errno_modeling

namespace	eval

namespace	iterator

namespace	loc

namespace	move

namespace	mpi

namespace	nonloc

namespace	retaincountchecker

namespace	smartptr

namespace	summMgr

namespace	tagged_union_modeling

namespace	taint

Classes
class	AllocaRegion
	AllocaRegion - A region that represents an untyped blob of bytes created by a call to 'alloca'. More...

class	AnalysisAction

class	AnalysisASTConsumer

class	AnalysisManager

class	AnyCXXConstructorCall
	Represents any constructor invocation. More...

class	AnyFunctionCall
	Represents a call to any sort of function that might have a FunctionDecl. More...

class	APSIntType
	A record of the "type" of an APSInt, used for conversions. More...

class	ArgEffect
	An ArgEffect summarizes the retain count behavior on an argument or receiver to a function or method. More...

class	BasicBugReport

class	BasicValueFactory

class	BinarySymExpr
	Represents a symbolic expression involving a binary operator. More...

class	BinarySymExprImpl
	Template implementation for all binary symbolic expressions. More...

class	BlockCall
	Represents a call to a block. More...

class	BlockCodeRegion
	BlockCodeRegion - A region that represents code texts of blocks (closures). More...

class	BlockCounter
	An abstract data type used to count the number of times a given block has been visited along a path analyzed by CoreEngine. More...

class	BlockDataRegion
	BlockDataRegion - A region that represents a block instance. More...

class	BranchNodeBuilder
	BranchNodeBuilder is responsible for constructing the nodes corresponding to the two branches of the if statement - true and false. More...

class	BugReport
	This class provides an interface through which checkers can create individual bug reports. More...

class	BugReportEquivClass

class	BugReporter
	BugReporter is a utility class for generating PathDiagnostics for analysis. More...

class	BugReporterContext

class	BugReporterData

class	BugReporterVisitor
	BugReporterVisitors are used to add custom diagnostics along a path. More...

class	BugSuppression

class	BugType

class	CallDescription
	A `CallDescription` is a pattern that can be used to match calls based on the qualified name and the argument/parameter counts. More...

class	CallDescriptionMap
	An immutable map from CallDescriptions to arbitrary data. More...

class	CallDescriptionSet
	An immutable set of CallDescriptions. More...

class	CallEvent
	Represents an abstract call to a function or method along a particular path. More...

class	CallEventManager
	Manages the lifetime of CallEvent objects. More...

class	CallEventRef

class	Checker

class	Checker< CHECK1 >

class	CheckerBase

class	CheckerContext

class	CheckerDocumentation
	This checker documents the callback functions checkers can use to implement the custom handling of the specific events during path exploration as well as reporting bugs. More...

class	CheckerFn

class	CheckerFn< RET(Ps...)>

struct	CheckerInfo
	Specifies a checker. More...

class	CheckerManager

class	CheckerNameRef
	This wrapper is used to ensure that only StringRefs originating from the CheckerRegistry are used as check names. More...

class	CheckerProgramPointTag
	Tag that can use a checker name as a message provider (see SimpleProgramPointTag). More...

class	CheckerRegistry
	Manages a set of available checkers for running a static analysis. More...

struct	CheckerRegistryData

struct	CmdLineOption
	Specifies a command line option. More...

class	CodeSpaceRegion
	CodeSpaceRegion - The memory space that holds the executable code of functions and blocks. More...

class	CodeTextRegion

class	CompoundLiteralRegion
	CompoundLiteralRegion - A memory region representing a compound literal. More...

class	CompoundValData

class	ConditionBRVisitor
	Visitor that tries to report interesting diagnostics from conditions. More...

class	ConditionTruthVal

class	ConstraintManager

class	CoreEngine
	CoreEngine - Implements the core logic of the graph-reachability analysis. More...

class	CXXAllocatorCall
	Represents the memory allocation call in a C++ new-expression. More...

class	CXXBaseObjectRegion

class	CXXConstructorCall
	Represents a call to a C++ constructor. More...

class	CXXDeallocatorCall
	Represents the memory deallocation call in a C++ delete-expression. More...

class	CXXDerivedObjectRegion

class	CXXDestructorCall
	Represents an implicit call to a C++ destructor. More...

class	CXXInheritedConstructorCall
	Represents a call to a C++ inherited constructor. More...

class	CXXInstanceCall
	Represents a non-static C++ member function call, no matter how it is written. More...

class	CXXLifetimeExtendedObjectRegion

class	CXXMemberCall
	Represents a non-static C++ member function call. More...

class	CXXMemberOperatorCall
	Represents a C++ overloaded operator call where the operator is implemented as a non-static member function. More...

class	CXXStaticOperatorCall
	Represents a static C++ operator call. More...

class	CXXTempObjectRegion

class	CXXThisRegion
	CXXThisRegion - Represents the region for the implicit 'this' parameter in a call to a C++ method. More...

class	DataTag
	The tag that carries some information with it. More...

class	DeclRegion

struct	DefaultProgramStatePartialTraitImpl

class	DefinedOrUnknownSVal

class	DefinedSVal

class	DynamicCastInfo

class	DynamicTypeInfo
	Stores the currently inferred strictest bound on the runtime type of a region in a given state along the analysis path. More...

class	ElementRegion
	ElementRegion is used to represent both array elements and casts. More...

class	Environment
	An immutable map from EnvironemntEntries to SVals. More...

class	EnvironmentEntry
	An entry in the environment consists of a Stmt and an LocationContext. More...

class	EnvironmentManager

struct	EvalCallOptions
	Hints for figuring out of a call should be inlined during evalCall(). More...

class	EventDispatcher

class	ExplodedGraph

class	ExplodedNode

class	ExplodedNodeSet

class	ExprEngine

class	FieldChainInfo
	Represents a field chain. More...

class	FieldNode
	A lightweight polymorphic wrapper around FieldRegion *. More...

class	FieldRegion

class	FindUninitializedFields
	Searches for and stores uninitialized fields in a non-union object. More...

class	FullSValVisitor
	FullSValVisitor - a convenient mixed visitor for all three: SVal, SymExpr and MemRegion subclasses. More...

class	FunctionCodeRegion
	FunctionCodeRegion - A region that represents code texts of function. More...

class	FunctionSummariesTy

class	GlobalImmutableSpaceRegion
	The region containing globals which are considered not to be modified or point to data which could be modified as a result of a function call (system or internal). More...

class	GlobalInternalSpaceRegion
	The region containing globals which can be modified by calls to "internally" defined functions - (for now just) functions other then system calls. More...

class	GlobalsSpaceRegion

class	GlobalSystemSpaceRegion
	The region containing globals which are defined in system/external headers and are considered modifiable by system calls (ex: errno). More...

class	HeapSpaceRegion

struct	ImplicitNullDerefEvent
	We dereferenced a location that may be null. More...

class	IndirectGotoNodeBuilder

class	LazyCompoundValData

class	LikelyFalsePositiveSuppressionBRVisitor
	Suppress reports that might lead to known false positives. More...

class	Loc

class	MemRegion
	MemRegion - The root abstract class for all memory regions. More...

class	MemRegionManager

class	MemRegionVisitor
	MemRegionVisitor - this class implements a simple visitor for MemRegion subclasses. More...

class	MemSpaceRegion
	MemSpaceRegion - A memory region that represents a "memory space"; for example, the set of global variables, the stack frame, etc. More...

class	ModelConsumer
	ASTConsumer to consume model files' AST. More...

class	ModelInjector

class	NilReceiverBRVisitor
	Prints path notes when a message is sent to a nil receiver. More...

class	NodeBuilder
	This is the simplest builder which generates nodes in the ExplodedGraph. More...

class	NodeBuilderContext

class	NodeBuilderWithSinks
	This node builder keeps track of the generated sink nodes. More...

class	NonLoc

class	NonParamVarRegion

class	NonStaticGlobalSpaceRegion
	The region for all the non-static global variables. More...

class	NoOwnershipChangeVisitor

class	NoStateChangeFuncVisitor
	Put a diagnostic on return statement (or on } in its absence) of all inlined functions for which some property remained unchanged. More...

class	NoteTag
	The tag upon which the TagVisitor reacts. More...

class	ObjCIvarRegion

class	ObjCMethodCall
	Represents any expression that calls an Objective-C method. More...

class	ObjCStringRegion
	The region associated with an ObjCStringLiteral. More...

class	ObjCSummaryCache

class	ObjCSummaryKey
	A key identifying a summary. More...

class	OperatorKind

struct	PackageInfo
	Specifies a package. More...

class	ParamVarRegion
	ParamVarRegion - Represents a region for paremters. More...

class	ParseModelFileAction
	Frontend action to parse model files. More...

class	PathDiagnostic
	PathDiagnostic - PathDiagnostic objects represent a single path-sensitive diagnostic. More...

class	PathDiagnosticCallPiece

class	PathDiagnosticConsumer

struct	PathDiagnosticConsumerOptions
	These options tweak the behavior of path diangostic consumers. More...

class	PathDiagnosticControlFlowPiece

class	PathDiagnosticEventPiece

class	PathDiagnosticLocation

class	PathDiagnosticLocationPair

class	PathDiagnosticMacroPiece

class	PathDiagnosticNotePiece

class	PathDiagnosticPiece

class	PathDiagnosticPopUpPiece

class	PathDiagnosticRange

class	PathDiagnosticSpotPiece

class	PathPieces

class	PathSensitiveBugReport

class	PathSensitiveBugReporter
	GRBugReporter is used for generating path-sensitive reports. More...

class	PointerToMemberData

class	PrettyStackTraceLocationContext
	While alive, includes the current analysis stack in a crash trace. More...

class	ProgramState
	ProgramState - This class encapsulates: More...

class	ProgramStateManager

struct	ProgramStatePartialTrait

struct	ProgramStatePartialTrait< llvm::ImmutableList< T > >

struct	ProgramStatePartialTrait< llvm::ImmutableMap< Key, Data, Info > >

struct	ProgramStatePartialTrait< llvm::ImmutableSet< Key, Info > >

struct	ProgramStatePartialTrait< T *, void >

struct	ProgramStatePartialTrait< T, std::enable_if_t< std::is_enum< T >::value > >

struct	ProgramStatePartialTrait< T, std::enable_if_t< std::is_integral< T >::value > >

struct	ProgramStateTrait

struct	ProgramStateTrait< iterator::ContainerMap >

struct	ProgramStateTrait< iterator::IteratorRegionMap >

struct	ProgramStateTrait< iterator::IteratorSymbolMap >

struct	ProgramStateTrait< mpi::RequestMap >

struct	ProgramStateTrait< ReplayWithoutInlining >

class	Range
	A Range represents the closed range [from, to]. More...

class	RangedConstraintManager

class	RangeSet
	persistent set of non-overlapping ranges. More...

class	RegionAndSymbolInvalidationTraits
	Information about invalidation for a particular region/symbol. More...

class	RegionOffset
	Represent a region's offset within the top level base region. More...

class	RegionRawOffset

struct	ReplayWithoutInlining
	Traits for storing the call processing policy inside GDM. More...

class	RetainSummary
	Summary for a function with respect to ownership changes. More...

class	RetainSummaryManager

class	RetainSummaryTemplate

class	RetEffect
	RetEffect summarizes a call's retain/release behavior with respect to its return value. More...

class	RuntimeDefinition
	Defines the runtime definition of the called function. More...

class	ScanReachableSymbols
	A utility class that visits the reachable symbols using a custom SymbolVisitor. More...

class	SimpleConstraintManager

class	SimpleFunctionCall
	Represents a C function or static C++ member function call. More...

class	SMTConstraintManager

class	SMTConv

class	StackArgumentsSpaceRegion

class	StackHintGenerator
	Interface for classes constructing Stack hints. More...

class	StackHintGeneratorForSymbol
	Constructs a Stack hint for the given symbol. More...

class	StackLocalsSpaceRegion

class	StackSpaceRegion

class	StaticGlobalSpaceRegion
	The region of the static variables within the current CodeTextRegion scope. More...

class	StmtNodeBuilder
	This builder class is useful for generating nodes that resulted from visiting a statement. More...

class	StoreManager

class	StoreRef

class	StringRegion
	StringRegion - Region associated with a StringLiteral. More...

class	SubRegion
	SubRegion - A region that subsets another larger region. More...

class	SummaryManager

class	SummaryManagerImpl

class	SuppressInlineDefensiveChecksVisitor

class	SVal
	SVal - This represents a symbolic expression, which can be either an L-value or an R-value. More...

class	SValBuilder

class	SValExplainer

class	SValVisitor
	SValVisitor - this class implements a simple visitor for SVal subclasses. More...

class	SwitchNodeBuilder

class	SymbolCast
	Represents a cast expression. More...

class	SymbolConjured
	A symbol representing the result of an expression in the case when we do not know anything about what the expression is. More...

class	SymbolData
	A symbol representing data which can be stored in a memory location (region). More...

class	SymbolDerived
	A symbol representing the value of a MemRegion whose parent region has symbolic value. More...

class	SymbolExtent
	SymbolExtent - Represents the extent (size in bytes) of a bounded region. More...

class	SymbolicRegion
	SymbolicRegion - A special, "non-concrete" region. More...

class	SymbolManager

class	SymbolMetadata
	SymbolMetadata - Represents path-dependent metadata about a specific region. More...

class	SymbolReaper
	A class responsible for cleaning up unused symbols. More...

class	SymbolRegionValue
	A symbol representing the value stored at a MemRegion. More...

class	SymbolVisitor

class	SymExpr
	Symbolic value. More...

class	SymExprVisitor
	SymExprVisitor - this class implements a simple visitor for SymExpr subclasses. More...

class	TagVisitor
	The visitor detects NoteTags and displays the event notes they contain. More...

class	TrackConstraintBRVisitor

class	TypedRegion
	TypedRegion - An abstract class representing regions that are typed. More...

class	TypedValueRegion
	TypedValueRegion - An abstract class representing regions having a typed value. More...

class	UnarySymExpr
	Represents a symbolic expression involving a unary operator. More...

class	UndefinedVal

class	UndefOrNullArgVisitor
	When a region containing undefined value or '0' value is passed as an argument in a call, marks the call as interesting. More...

struct	UninitObjCheckerOptions

class	UnknownSpaceRegion

class	UnknownVal

class	VarRegion

class	WorkList

class	WorkListUnit

class	Z3CrosscheckOracle
	The oracle will decide if a report should be accepted or rejected based on the results of the Z3 solver and the statistics of the queries of a report equivalenece class. More...

class	Z3CrosscheckVisitor
	The bug visitor will walk all the nodes in a path and collect all the constraints. More...

Typedefs
using	LocationOrAnalysisDeclContext = llvm::PointerUnion< const LocationContext , AnalysisDeclContext >

using	PathDiagnosticPieceRef = std::shared_ptr< PathDiagnosticPiece >

using	FilesToLineNumsMap = std::map< FileID, std::set< unsigned > >
	File IDs mapped to sets of line numbers.

typedef llvm::ImmutableMap< unsigned, ArgEffect >	ArgEffects
	ArgEffects summarizes the effects of a function/method call on all of its arguments.

using	DiagnosticForConsumerMapTy = llvm::DenseMap< PathDiagnosticConsumer *, std::unique_ptr< PathDiagnostic > >
	A mapping from diagnostic consumers to the diagnostics they should consume.

using	RegisterCheckerFn = void(*)(CheckerManager &)
	Initialization functions perform any necessary setup for a checker.

using	ShouldRegisterFunction = bool(*)(const CheckerManager &)

using	CmdLineOptionList = llvm::SmallVector< CmdLineOption, 0 >

using	CheckerInfoList = std::vector< CheckerInfo >

using	CheckerInfoListRange = llvm::iterator_range< CheckerInfoList::iterator >

using	ConstCheckerInfoList = llvm::SmallVector< const CheckerInfo *, 0 >

using	CheckerInfoSet = llvm::SetVector< const CheckerInfo * >

using	StateFromCmdLine = CheckerInfo::StateFromCmdLine

using	PackageInfoList = llvm::SmallVector< PackageInfo, 0 >

typedef std::vector< PathDiagnosticConsumer * >	PathDiagnosticConsumers

using	CDM = CallDescription::Mode
	Enumerators of this enum class are used to construct CallDescription objects; in that context the fully qualified name is needlessly verbose.

using	InterExplodedGraphMap = llvm::DenseMap< const ExplodedNode , const ExplodedNode >

using	SetOfDecls = std::deque< Decl * >

using	SetOfConstDecls = llvm::DenseSet< const Decl * >

typedef std::unique_ptr< ConstraintManager >(*	ConstraintManagerCreator) (ProgramStateManager &, ExprEngine *)

typedef std::unique_ptr< StoreManager >(*	StoreManagerCreator) (ProgramStateManager &)

typedef IntrusiveRefCntPtr< const ProgramState >	ProgramStateRef

using	ConstraintMap = llvm::ImmutableMap< SymbolRef, RangeSet >

using	InvalidatedSymbols = llvm::DenseSet< SymbolRef >

using	Store = const void *
	Store - This opaque type encapsulates an immutable mapping from locations to values.

using	SymIntExpr = BinarySymExprImpl< const SymExpr *, const llvm::APSInt &, SymExpr::Kind::SymIntExprKind >
	Represents a symbolic expression like 'x' + 3.

using	IntSymExpr = BinarySymExprImpl< const llvm::APSInt &, const SymExpr *, SymExpr::Kind::IntSymExprKind >
	Represents a symbolic expression like 3 - 'x'.

using	SymSymExpr = BinarySymExprImpl< const SymExpr , const SymExpr , SymExpr::Kind::SymSymExprKind >
	Represents a symbolic expression like 'x' + 'y'.

using	SymbolRef = const SymExpr *

using	SymbolRefSmallVectorTy = SmallVector< SymbolRef, 2 >

using	SymbolID = unsigned

using	UninitFieldMap = std::map< const FieldRegion *, llvm::SmallString< 50 > >

Enumerations
enum class	ObjKind { CF , ObjC , AnyObj , Generalized , OS }
	Determines the object kind of a tracked object. More...

enum	ArgEffectKind { DoNothing , Autorelease , Dealloc , DecRef , DecRefBridgedTransferred , IncRef , UnretainedOutParameter , RetainedOutParameter , RetainedOutParameterOnZero , RetainedOutParameterOnNonZero , MayEscape , StopTracking , StopTrackingHard , DecRefAndStopTrackingHard }

enum	PointerEscapeKind { PSK_EscapeOnBind , PSK_DirectEscapeOnCall , PSK_IndirectEscapeOnCall , PSK_EscapeOutParameters , PSK_EscapeOther }
	Describes the different reasons a pointer escapes during analysis. More...

enum class	ObjCMessageVisitKind { Pre , Post , MessageNil }

enum	CallEventKind { CE_Function , CE_CXXStaticOperator , CE_CXXMember , CE_CXXMemberOperator , CE_CXXDestructor , CE_BEG_CXX_INSTANCE_CALLS = CE_CXXMember , CE_END_CXX_INSTANCE_CALLS = CE_CXXDestructor , CE_CXXConstructor , CE_CXXInheritedConstructor , CE_BEG_CXX_CONSTRUCTOR_CALLS = CE_CXXConstructor , CE_END_CXX_CONSTRUCTOR_CALLS = CE_CXXInheritedConstructor , CE_CXXAllocator , CE_CXXDeallocator , CE_BEG_FUNCTION_CALLS = CE_Function , CE_END_FUNCTION_CALLS = CE_CXXDeallocator , CE_Block , CE_ObjCMessage }

enum	ObjCMessageKind { OCM_PropertyAccess , OCM_Subscript , OCM_Message }
	Represents the ways an Objective-C message send can occur. More...

enum class	Nullability : char { Contradicted , Nullable , Unspecified , Nonnull }

Functions
raw_ostream &	operator<< (raw_ostream &Out, const CheckerBase &Checker)
	Dump checker name to stream.

bool	containsMacro (const Stmt *S)

bool	containsEnum (const Stmt *S)

bool	containsStaticLocal (const Stmt *S)

bool	containsBuiltinOffsetOf (const Stmt *S)

template<class T >
bool	containsStmt (const Stmt *S)

std::pair< const clang::VarDecl , const clang::Expr >	parseAssignment (const Stmt *S)

Nullability	getNullabilityAnnotation (QualType Type)
	Get nullability annotation for a given type.

std::optional< int >	tryExpandAsInteger (StringRef Macro, const Preprocessor &PP)
	Try to parse the value of a defined preprocessor macro.

OperatorKind	operationKindFromOverloadedOperator (OverloadedOperatorKind OOK, bool IsBinary)

std::optional< SVal >	getPointeeVal (SVal PtrSVal, ProgramStateRef State)

std::unique_ptr< ConstraintManager >	CreateRangeConstraintManager (ProgramStateManager &statemgr, ExprEngine *exprengine)

std::unique_ptr< ConstraintManager >	CreateZ3ConstraintManager (ProgramStateManager &statemgr, ExprEngine *exprengine)

DefinedOrUnknownSVal	getDynamicExtent (ProgramStateRef State, const MemRegion *MR, SValBuilder &SVB)

DefinedOrUnknownSVal	getElementExtent (QualType Ty, SValBuilder &SVB)

DefinedOrUnknownSVal	getDynamicElementCount (ProgramStateRef State, const MemRegion *MR, SValBuilder &SVB, QualType Ty)

ProgramStateRef	setDynamicExtent (ProgramStateRef State, const MemRegion *MR, DefinedOrUnknownSVal Extent, SValBuilder &SVB)
	Set the dynamic extent `Extent` of the region `MR`.

SVal	getDynamicExtentWithOffset (ProgramStateRef State, SVal BufV)
	Get the dynamic extent for a symbolic value that represents a buffer.

DefinedOrUnknownSVal	getDynamicElementCountWithOffset (ProgramStateRef State, SVal BufV, QualType Ty)

DynamicTypeInfo	getDynamicTypeInfo (ProgramStateRef State, const MemRegion *MR)
	Get dynamic type information for the region `MR`.

const DynamicTypeInfo *	getRawDynamicTypeInfo (ProgramStateRef State, const MemRegion *MR)
	Get raw dynamic type information for the region `MR`.

DynamicTypeInfo	getClassObjectDynamicTypeInfo (ProgramStateRef State, SymbolRef Sym)
	Get dynamic type information stored in a class object represented by `Sym`.

const DynamicCastInfo *	getDynamicCastInfo (ProgramStateRef State, const MemRegion *MR, QualType CastFromTy, QualType CastToTy)
	Get dynamic cast information from `CastFromTy` to `CastToTy` of `MR`.

ProgramStateRef	setDynamicTypeInfo (ProgramStateRef State, const MemRegion *MR, DynamicTypeInfo NewTy)
	Set dynamic type information of the region; return the new state.

ProgramStateRef	setDynamicTypeInfo (ProgramStateRef State, const MemRegion *MR, QualType NewTy, bool CanBeSubClassed=true)
	Set dynamic type information of the region; return the new state.

ProgramStateRef	setClassObjectDynamicTypeInfo (ProgramStateRef State, SymbolRef Sym, DynamicTypeInfo NewTy)
	Set constraint on a type contained in a class object; return the new state.

ProgramStateRef	setClassObjectDynamicTypeInfo (ProgramStateRef State, SymbolRef Sym, QualType NewTy, bool CanBeSubClassed=true)
	Set constraint on a type contained in a class object; return the new state.

ProgramStateRef	setDynamicTypeAndCastInfo (ProgramStateRef State, const MemRegion *MR, QualType CastFromTy, QualType CastToTy, bool IsCastSucceeds)
	Set dynamic type and cast information of the region; return the new state.

ProgramStateRef	removeDeadTypes (ProgramStateRef State, SymbolReaper &SR)
	Removes the dead type informations from `State`.

ProgramStateRef	removeDeadCasts (ProgramStateRef State, SymbolReaper &SR)
	Removes the dead cast informations from `State`.

ProgramStateRef	removeDeadClassObjectTypes (ProgramStateRef State, SymbolReaper &SR)
	Removes the dead Class object type informations from `State`.

void	printDynamicTypeInfoJson (raw_ostream &Out, ProgramStateRef State, const char *NL="\n", unsigned int Space=0, bool IsDot=false)

bool	isUnrolledState (ProgramStateRef State)
	Returns if the given State indicates that is inside a completely unrolled loop.

ProgramStateRef	updateLoopStack (const Stmt LoopStmt, ASTContext &ASTCtx, ExplodedNode Pred, unsigned maxVisitOnPath)
	Updates the stack of loops contained by the ProgramState.

ProgramStateRef	processLoopEnd (const Stmt *LoopStmt, ProgramStateRef State)
	Updates the given ProgramState.

ProgramStateRef	getWidenedLoopState (ProgramStateRef PrevState, const LocationContext LCtx, unsigned BlockCount, const Stmt LoopStmt)
	Get the states that result from widening the loop.

raw_ostream &	operator<< (raw_ostream &os, const MemRegion *R)

void	ProgramStateRetain (const ProgramState *state)
	Increments the number of times this state is referenced.

void	ProgramStateRelease (const ProgramState *state)
	Decrement the number of times this state is referenced.

ConstraintMap	getConstraintMap (ProgramStateRef State)

SymbolRef	simplify (ProgramStateRef State, SymbolRef Sym)
	Try to simplify a given symbolic expression based on the constraints in State.

SVal	simplifyToSVal (ProgramStateRef State, SymbolRef Sym)
	Try to simplify a given symbolic expression's associated `SVal` based on the constraints in State.

std::unique_ptr< StoreManager >	CreateRegionStoreManager (ProgramStateManager &StMgr)

SValBuilder *	createSimpleSValBuilder (llvm::BumpPtrAllocator &alloc, ASTContext &context, ProgramStateManager &stateMgr)

raw_ostream &	operator<< (raw_ostream &os, clang::ento::SVal V)

raw_ostream &	operator<< (raw_ostream &os, const clang::ento::SymExpr *SE)

std::unique_ptr< AnalysisASTConsumer >	CreateAnalysisConsumer (CompilerInstance &CI)
	CreateAnalysisConsumer - Creates an ASTConsumer to run various code analysis passes.

void	printCheckerHelp (llvm::raw_ostream &OS, CompilerInstance &CI)

void	printEnabledCheckerList (llvm::raw_ostream &OS, CompilerInstance &CI)

void	printAnalyzerConfigList (llvm::raw_ostream &OS)

void	printCheckerConfigList (llvm::raw_ostream &OS, CompilerInstance &CI)

void	registerCheckerDocumentationChecker (CheckerManager &Mgr)

bool	shouldRegisterCheckerDocumentationChecker (const CheckerManager &)

void	registerInnerPointerCheckerAux (CheckerManager &Mgr)
	Register the part of MallocChecker connected to InnerPointerChecker.

std::string	getVariableName (const FieldDecl *Field)
	Returns with Field's name.

bool	isPrimitiveType (const QualType &T)
	Returns true if T is a primitive type.

bool	isDereferencableType (const QualType &T)

template<class T , class Checker >
std::optional< T >	getConfiguration (CheckerManager &Mgr, Checker *Chk, StringRef Option, StringRef ConfigFile)
	Read the given file from the filesystem and parse it as a yaml file.

static bool	isLoopStmt (const Stmt *S)

static internal::Matcher< Stmt >	simpleCondition (StringRef BindName, StringRef RefName)

static internal::Matcher< Stmt >	changeIntBoundNode (internal::Matcher< Decl > VarNodeMatcher)

static internal::Matcher< Stmt >	callByRef (internal::Matcher< Decl > VarNodeMatcher)

static internal::Matcher< Stmt >	assignedToRef (internal::Matcher< Decl > VarNodeMatcher)

static internal::Matcher< Stmt >	getAddrTo (internal::Matcher< Decl > VarNodeMatcher)

static internal::Matcher< Stmt >	hasSuspiciousStmt (StringRef NodeName)

static internal::Matcher< Stmt >	forLoopMatcher ()

static bool	isCapturedByReference (ExplodedNode N, const DeclRefExpr DR)

static bool	isFoundInStmt (const Stmt S, const VarDecl VD)

static bool	isPossiblyEscaped (ExplodedNode N, const DeclRefExpr DR)

bool	shouldCompletelyUnroll (const Stmt LoopStmt, ASTContext &ASTCtx, ExplodedNode Pred, unsigned &maxStep)

bool	madeNewBranch (ExplodedNode N, const Stmt LoopStmt)

Typedef Documentation

◆ ArgEffects

typedef llvm::ImmutableMap<unsigned, ArgEffect> clang::ento::ArgEffects

ArgEffects summarizes the effects of a function/method call on all of its arguments.

Definition at line 280 of file RetainSummaryManager.h.

◆ CDM

using clang::ento::CDM = typedef CallDescription::Mode

Enumerators of this enum class are used to construct CallDescription objects; in that context the fully qualified name is needlessly verbose.

Definition at line 257 of file CallDescription.h.

◆ CheckerInfoList

using clang::ento::CheckerInfoList = typedef std::vector<CheckerInfo>

Definition at line 87 of file CheckerRegistryData.h.

◆ CheckerInfoListRange

using clang::ento::CheckerInfoListRange = typedef llvm::iterator_range<CheckerInfoList::iterator>

Definition at line 88 of file CheckerRegistryData.h.

◆ CheckerInfoSet

using clang::ento::CheckerInfoSet = typedef llvm::SetVector<const CheckerInfo *>

Definition at line 90 of file CheckerRegistryData.h.

◆ CmdLineOptionList

using clang::ento::CmdLineOptionList = typedef llvm::SmallVector<CmdLineOption, 0>

Definition at line 83 of file CheckerRegistryData.h.

◆ ConstCheckerInfoList

using clang::ento::ConstCheckerInfoList = typedef llvm::SmallVector<const CheckerInfo *, 0>

Definition at line 89 of file CheckerRegistryData.h.

◆ ConstraintManagerCreator

typedef std::unique_ptr< ConstraintManager >(* clang::ento::ConstraintManagerCreator) (ProgramStateManager &, ExprEngine *)

Definition at line 42 of file ProgramState.h.

◆ ConstraintMap

using clang::ento::ConstraintMap = typedef llvm::ImmutableMap<SymbolRef, RangeSet>

Definition at line 404 of file RangedConstraintManager.h.

◆ DiagnosticForConsumerMapTy

using clang::ento::DiagnosticForConsumerMapTy = typedef llvm::DenseMap<PathDiagnosticConsumer *, std::unique_ptr<PathDiagnostic> >

A mapping from diagnostic consumers to the diagnostics they should consume.

Definition at line 70 of file BugReporter.h.

◆ FilesToLineNumsMap

using clang::ento::FilesToLineNumsMap = typedef std::map<FileID, std::set<unsigned> >

File IDs mapped to sets of line numbers.

Definition at line 758 of file PathDiagnostic.h.

◆ InterExplodedGraphMap

using clang::ento::InterExplodedGraphMap = typedef llvm::DenseMap<const ExplodedNode *, const ExplodedNode *>

Definition at line 300 of file ExplodedGraph.h.

◆ IntSymExpr

using clang::ento::IntSymExpr = typedef BinarySymExprImpl<const llvm::APSInt &, const SymExpr *, SymExpr::Kind::IntSymExprKind>

Represents a symbolic expression like 3 - 'x'.

Definition at line 475 of file SymbolManager.h.

◆ InvalidatedSymbols

using clang::ento::InvalidatedSymbols = typedef llvm::DenseSet<SymbolRef>

Definition at line 51 of file Store.h.

◆ LocationOrAnalysisDeclContext

using clang::ento::LocationOrAnalysisDeclContext = typedef llvm::PointerUnion<const LocationContext *, AnalysisDeclContext *>

Definition at line 192 of file PathDiagnostic.h.

◆ PackageInfoList

using clang::ento::PackageInfoList = typedef llvm::SmallVector<PackageInfo, 0>

Definition at line 162 of file CheckerRegistryData.h.

◆ PathDiagnosticConsumers

typedef std::vector<PathDiagnosticConsumer*> clang::ento::PathDiagnosticConsumers

Definition at line 33 of file PathDiagnosticConsumers.h.

◆ PathDiagnosticPieceRef

typedef std::shared_ptr< PathDiagnosticPiece > clang::ento::PathDiagnosticPieceRef

Definition at line 492 of file PathDiagnostic.h.

◆ ProgramStateRef

typedef IntrusiveRefCntPtr<const ProgramState> clang::ento::ProgramStateRef

Definition at line 37 of file ProgramState_Fwd.h.

◆ RegisterCheckerFn

using clang::ento::RegisterCheckerFn = typedef void (*)(CheckerManager &)

Initialization functions perform any necessary setup for a checker.

They should include a call to CheckerManager::registerChecker.

Definition at line 39 of file CheckerRegistryData.h.

◆ SetOfConstDecls

using clang::ento::SetOfConstDecls = typedef llvm::DenseSet<const Decl *>

Definition at line 30 of file FunctionSummary.h.

◆ SetOfDecls

using clang::ento::SetOfDecls = typedef std::deque<Decl *>

Definition at line 29 of file FunctionSummary.h.

◆ ShouldRegisterFunction

using clang::ento::ShouldRegisterFunction = typedef bool (*)(const CheckerManager &)

Definition at line 40 of file CheckerRegistryData.h.

◆ StateFromCmdLine

using clang::ento::StateFromCmdLine = typedef CheckerInfo::StateFromCmdLine

Definition at line 142 of file CheckerRegistryData.h.

◆ Store

using clang::ento::Store = typedef const void *

Store - This opaque type encapsulates an immutable mapping from locations to values.

At a high-level, it represents the symbolic memory model. Different subclasses of StoreManager may choose different types to represent the locations and values.

Definition at line 27 of file StoreRef.h.

◆ StoreManagerCreator

typedef std::unique_ptr< StoreManager >(* clang::ento::StoreManagerCreator) (ProgramStateManager &)

Definition at line 44 of file ProgramState.h.

◆ SymbolID

using clang::ento::SymbolID = typedef unsigned

Definition at line 115 of file SymExpr.h.

◆ SymbolRef

using clang::ento::SymbolRef = typedef const SymExpr *

Definition at line 113 of file SymExpr.h.

◆ SymbolRefSmallVectorTy

using clang::ento::SymbolRefSmallVectorTy = typedef SmallVector<SymbolRef, 2>

Definition at line 114 of file SymExpr.h.

◆ SymIntExpr

using clang::ento::SymIntExpr = typedef BinarySymExprImpl<const SymExpr *, const llvm::APSInt &, SymExpr::Kind::SymIntExprKind>

Represents a symbolic expression like 'x' + 3.

Definition at line 471 of file SymbolManager.h.

◆ SymSymExpr

using clang::ento::SymSymExpr = typedef BinarySymExprImpl<const SymExpr *, const SymExpr *, SymExpr::Kind::SymSymExprKind>

Represents a symbolic expression like 'x' + 'y'.

Definition at line 479 of file SymbolManager.h.

◆ UninitFieldMap

using clang::ento::UninitFieldMap = typedef std::map<const FieldRegion *, llvm::SmallString<50> >

Definition at line 194 of file UninitializedObject.h.

Enumeration Type Documentation

◆ ArgEffectKind

enum clang::ento::ArgEffectKind

Enumerator
DoNothing	There is no effect.
Autorelease	The argument is treated as if an -autorelease message had been sent to the referenced object.
Dealloc	The argument is treated as if the referenced object was deallocated.
DecRef	The argument has its reference count decreased by 1.
DecRefBridgedTransferred	The argument has its reference count decreased by 1 to model a transferred bridge cast under ARC.
IncRef	The argument has its reference count increased by 1.
UnretainedOutParameter	The argument is a pointer to a retain-counted object; on exit, the new value of the pointer is a +0 value.
RetainedOutParameter	The argument is a pointer to a retain-counted object; on exit, the new value of the pointer is a +1 value.
RetainedOutParameterOnZero	The argument is a pointer to a retain-counted object; on exit, the new value of the pointer is a +1 value iff the return code is zero.
RetainedOutParameterOnNonZero	The argument is a pointer to a retain-counted object; on exit, the new value of the pointer is a +1 value iff the return code is non-zero.
MayEscape	The argument is treated as potentially escaping, meaning that even when its reference count hits 0 it should be treated as still possibly being alive as someone else may be holding onto the object.
StopTracking	All typestate tracking of the object ceases. This is usually employed when the effect of the call is completely unknown.
StopTrackingHard	All typestate tracking of the object ceases. Unlike StopTracking, this is also enforced when the method body is inlined. In some cases, we obtain a better summary for this checker by looking at the call site than by inlining the function. Signifies that we should stop tracking the symbol even if the function is inlined.
DecRefAndStopTrackingHard	Performs the combined functionality of DecRef and StopTrackingHard. The models the effect that the called function decrements the reference count of the argument and all typestate tracking on that argument should cease.

Definition at line 54 of file RetainSummaryManager.h.

◆ CallEventKind

enum clang::ento::CallEventKind

Enumerator
CE_Function
CE_CXXStaticOperator
CE_CXXMember
CE_CXXMemberOperator
CE_CXXDestructor
CE_BEG_CXX_INSTANCE_CALLS
CE_END_CXX_INSTANCE_CALLS
CE_CXXConstructor
CE_CXXInheritedConstructor
CE_BEG_CXX_CONSTRUCTOR_CALLS
CE_END_CXX_CONSTRUCTOR_CALLS
CE_CXXAllocator
CE_CXXDeallocator
CE_BEG_FUNCTION_CALLS
CE_END_FUNCTION_CALLS
CE_Block
CE_ObjCMessage

Definition at line 60 of file CallEvent.h.

◆ Nullability

enum class clang::ento::Nullability : char

strong

Enumerator
Contradicted
Nullable
Unspecified
Nonnull

Definition at line 57 of file CheckerHelpers.h.

◆ ObjCMessageKind

enum clang::ento::ObjCMessageKind

Represents the ways an Objective-C message send can occur.

Enumerator
OCM_PropertyAccess
OCM_Subscript
OCM_Message

Definition at line 1238 of file CallEvent.h.

◆ ObjCMessageVisitKind

enum class clang::ento::ObjCMessageVisitKind

strong

Enumerator
Pre
Post
MessageNil

Definition at line 120 of file CheckerManager.h.

◆ ObjKind

enum class clang::ento::ObjKind

strong

Determines the object kind of a tracked object.

Enumerator
CF	Indicates that the tracked object is a CF object.
ObjC	Indicates that the tracked object is an Objective-C object.
AnyObj	Indicates that the tracked object could be a CF or Objective-C object.
Generalized	Indicates that the tracked object is a generalized object.
OS	Indicates that the tracking object is a descendant of a referenced-counted OSObject, used in the Darwin kernel.

Definition at line 36 of file RetainSummaryManager.h.

◆ PointerEscapeKind

enum clang::ento::PointerEscapeKind

Describes the different reasons a pointer escapes during analysis.

Enumerator
PSK_EscapeOnBind	A pointer escapes due to binding its value to a location that the analyzer cannot track.
PSK_DirectEscapeOnCall	The pointer has been passed to a function call directly.
PSK_IndirectEscapeOnCall	The pointer has been passed to a function indirectly. For example, the pointer is accessible through an argument to a function.
PSK_EscapeOutParameters	Escape for a new symbol that was generated into a region that the analyzer cannot follow during a conservative call.
PSK_EscapeOther	The reason for pointer escape is unknown. For example, a region containing this pointer is invalidated.

Definition at line 78 of file CheckerManager.h.

Function Documentation

◆ assignedToRef()

static internal::Matcher< Stmt > clang::ento::assignedToRef ( internal::Matcher< Decl > VarNodeMatcher )

static

Definition at line 118 of file LoopUnrolling.cpp.

References clang::ast_matchers::allOf, clang::ast_matchers::anyOf, clang::ast_matchers::declRefExpr, clang::ast_matchers::declStmt, clang::ast_matchers::has, clang::ast_matchers::hasDescendant, clang::ast_matchers::initListExpr, clang::ast_matchers::referenceType, and clang::ast_matchers::varDecl.

Referenced by hasSuspiciousStmt(), and isPossiblyEscaped().

◆ callByRef()

static internal::Matcher< Stmt > clang::ento::callByRef ( internal::Matcher< Decl > VarNodeMatcher )

static

Definition at line 111 of file LoopUnrolling.cpp.

References clang::ast_matchers::callExpr, clang::ast_matchers::declRefExpr, clang::ast_matchers::parmVarDecl, clang::ast_matchers::qualType, clang::ast_matchers::unless, and clang::ast_matchers::varDecl.

Referenced by hasSuspiciousStmt(), and isPossiblyEscaped().

◆ changeIntBoundNode()

static internal::Matcher< Stmt > clang::ento::changeIntBoundNode ( internal::Matcher< Decl > VarNodeMatcher )

static

Definition at line 100 of file LoopUnrolling.cpp.

References clang::ast_matchers::anyOf, clang::ast_matchers::binaryOperator, clang::ast_matchers::declRefExpr, clang::ast_matchers::unaryOperator, and clang::ast_matchers::varDecl.

Referenced by hasSuspiciousStmt().

◆ containsBuiltinOffsetOf()

bool clang::ento::containsBuiltinOffsetOf ( const Stmt * S )

Definition at line 70 of file CheckerHelpers.cpp.

References containsBuiltinOffsetOf().

Referenced by containsBuiltinOffsetOf().

◆ containsEnum()

bool clang::ento::containsEnum ( const Stmt * S )

Definition at line 40 of file CheckerHelpers.cpp.

References containsEnum(), and clang::DeclRefExpr::getDecl().

Referenced by containsEnum().

◆ containsMacro()

bool clang::ento::containsMacro ( const Stmt * S )

Definition at line 25 of file CheckerHelpers.cpp.

References containsMacro().

Referenced by containsMacro().

◆ containsStaticLocal()

bool clang::ento::containsStaticLocal ( const Stmt * S )

Definition at line 54 of file CheckerHelpers.cpp.

References containsStaticLocal(), and clang::DeclRefExpr::getDecl().

Referenced by containsStaticLocal().

◆ containsStmt()

template<class T >

bool clang::ento::containsStmt ( const Stmt * S )

Definition at line 37 of file CheckerHelpers.h.

◆ CreateAnalysisConsumer()

std::unique_ptr< AnalysisASTConsumer > clang::ento::CreateAnalysisConsumer ( CompilerInstance & CI )

CreateAnalysisConsumer - Creates an ASTConsumer to run various code analysis passes.

(The set of analyses run is controlled by command-line options.)

Definition at line 758 of file AnalysisConsumer.cpp.

References clang::AnalyzerOptions::Config, clang::CompilerInstance::getAnalyzerOpts(), clang::Preprocessor::getDiagnostics(), clang::CompilerInstance::getFrontendOpts(), clang::CompilerInstance::getPreprocessor(), clang::FrontendOptions::OutputFile, clang::FrontendOptions::Plugins, and clang::DiagnosticsEngine::setWarningsAsErrors().

Referenced by clang::ento::AnalysisAction::CreateASTConsumer().

◆ CreateRangeConstraintManager()

std::unique_ptr< ConstraintManager > clang::ento::CreateRangeConstraintManager	(	ProgramStateManager &	statemgr,
		ExprEngine *	exprengine
	)

Definition at line 2260 of file RangeConstraintManager.cpp.

References clang::ento::ProgramStateManager::getSValBuilder().

◆ CreateRegionStoreManager()

std::unique_ptr< StoreManager > clang::ento::CreateRegionStoreManager ( ProgramStateManager & StMgr )

Definition at line 670 of file RegionStore.cpp.

◆ createSimpleSValBuilder()

SValBuilder * clang::ento::createSimpleSValBuilder	(	llvm::BumpPtrAllocator &	alloc,
		ASTContext &	context,
		ProgramStateManager &	stateMgr
	)

Definition at line 100 of file SimpleSValBuilder.cpp.

◆ CreateZ3ConstraintManager()

std::unique_ptr< ConstraintManager > clang::ento::CreateZ3ConstraintManager	(	ProgramStateManager &	statemgr,
		ExprEngine *	exprengine
	)

Definition at line 15 of file SMTConstraintManager.cpp.

References clang::ento::ProgramStateManager::getSValBuilder().

◆ forLoopMatcher()

static internal::Matcher< Stmt > clang::ento::forLoopMatcher ( )

static

Definition at line 145 of file LoopUnrolling.cpp.

References clang::ast_matchers::allOf, clang::ast_matchers::anyOf, clang::ast_matchers::binaryOperator, clang::ast_matchers::declRefExpr, clang::ast_matchers::declStmt, clang::ast_matchers::forStmt, hasSuspiciousStmt(), clang::ast_matchers::integerLiteral, simpleCondition(), clang::ast_matchers::unaryOperator, clang::ast_matchers::unless, and clang::ast_matchers::varDecl.

Referenced by shouldCompletelyUnroll().

◆ getAddrTo()

static internal::Matcher< Stmt > clang::ento::getAddrTo ( internal::Matcher< Decl > VarNodeMatcher )

static

Definition at line 127 of file LoopUnrolling.cpp.

References clang::ast_matchers::declRefExpr, clang::ast_matchers::hasDeclaration(), and clang::ast_matchers::unaryOperator.

Referenced by hasSuspiciousStmt(), and isPossiblyEscaped().

◆ getClassObjectDynamicTypeInfo()

DynamicTypeInfo clang::ento::getClassObjectDynamicTypeInfo	(	ProgramStateRef	State,
		SymbolRef	Sym
	)

Get dynamic type information stored in a class object represented by Sym.

Referenced by clang::ento::ObjCMethodCall::getRuntimeDefinition(), and REGISTER_MAP_WITH_PROGRAMSTATE().

◆ getConfiguration()

template<class T , class Checker >

std::optional< T > clang::ento::getConfiguration	(	CheckerManager &	Mgr,
		Checker *	Chk,
		StringRef	Option,
		StringRef	ConfigFile
	)

Read the given file from the filesystem and parse it as a yaml file.

The template parameter must have a yaml MappingTraits. Emit diagnostic error in case of any failure.

Definition at line 29 of file Yaml.h.

References clang::ento::CheckerManager::reportInvalidCheckerOptionValue(), and clang::T.

◆ getConstraintMap()

ConstraintMap clang::ento::getConstraintMap ( ProgramStateRef State )

Definition at line 2265 of file RangeConstraintManager.cpp.

References clang::Class, and clang::Result.

◆ getDynamicCastInfo()

const DynamicCastInfo * clang::ento::getDynamicCastInfo	(	ProgramStateRef	State,
		const MemRegion *	MR,
		QualType	CastFromTy,
		QualType	CastToTy
	)

Get dynamic cast information from CastFromTy to CastToTy of MR.

Referenced by addCastTransition(), and addInstanceOfTransition().

◆ getDynamicElementCount()

DefinedOrUnknownSVal clang::ento::getDynamicElementCount	(	ProgramStateRef	State,
		const MemRegion *	MR,
		SValBuilder &	SVB,
		QualType	Ty
	)

Returns: The stored element count of the region MR.

Referenced by getElementCountOfArrayBeingDestructed(), isArrayIndexOutOfBounds(), and REGISTER_MAP_WITH_PROGRAMSTATE().

◆ getDynamicElementCountWithOffset()

DefinedOrUnknownSVal clang::ento::getDynamicElementCountWithOffset	(	ProgramStateRef	State,
		SVal	BufV,
		QualType	Ty
	)

Returns: The stored element count of the region represented by a symbolic value BufV.

Referenced by REGISTER_MAP_WITH_PROGRAMSTATE().

◆ getDynamicExtent()

DefinedOrUnknownSVal clang::ento::getDynamicExtent	(	ProgramStateRef	State,
		const MemRegion *	MR,
		SValBuilder &	SVB
	)

Returns: The stored dynamic extent for the region MR.

Referenced by REGISTER_MAP_WITH_PROGRAMSTATE().

◆ getDynamicExtentWithOffset()

SVal clang::ento::getDynamicExtentWithOffset	(	ProgramStateRef	State,
		SVal	BufV
	)

Get the dynamic extent for a symbolic value that represents a buffer.

If there is an offsetting to the underlying buffer we consider that too. Returns with an SVal that represents the extent, this is Unknown if the engine cannot deduce the extent. E.g. char buf[3]; (buf); // extent is 3 (buf + 1); // extent is 2 (buf + 3); // extent is 0 (buf + 4); // extent is -1

char *bufptr; (bufptr) // extent is unknown

Referenced by REGISTER_MAP_WITH_PROGRAMSTATE().

◆ getDynamicTypeInfo()

DynamicTypeInfo clang::ento::getDynamicTypeInfo	(	ProgramStateRef	State,
		const MemRegion *	MR
	)

Get dynamic type information for the region MR.

Referenced by clang::ento::CXXInstanceCall::getRuntimeDefinition(), clang::ento::ObjCMethodCall::getRuntimeDefinition(), and REGISTER_MAP_WITH_PROGRAMSTATE().

◆ getElementExtent()

DefinedOrUnknownSVal clang::ento::getElementExtent	(	QualType	Ty,
		SValBuilder &	SVB
	)

Returns: The element extent of the type Ty.

Referenced by clang::ento::ExprEngine::bindReturnValue(), clang::ento::MemRegionManager::getStaticSize(), and REGISTER_MAP_WITH_PROGRAMSTATE().

◆ getNullabilityAnnotation()

Nullability clang::ento::getNullabilityAnnotation ( QualType Type )

Get nullability annotation for a given type.

Definition at line 104 of file CheckerHelpers.cpp.

References clang::Type::getAs(), Nonnull, Nullable, and Unspecified.

Referenced by checkValueAtLValForInvariantViolation().

◆ getPointeeVal()

std::optional< SVal > clang::ento::getPointeeVal	(	SVal	PtrSVal,
		ProgramStateRef	State
	)

Definition at line 186 of file CheckerHelpers.cpp.

References clang::ento::SVal::getAsRegion().

◆ getRawDynamicTypeInfo()

const DynamicTypeInfo * clang::ento::getRawDynamicTypeInfo	(	ProgramStateRef	State,
		const MemRegion *	MR
	)

Get raw dynamic type information for the region MR.

It might return null.

◆ getVariableName()

std::string clang::ento::getVariableName ( const FieldDecl * Field )

Returns with Field's name.

This is a helper function to get the correct name even if Field is a captured lambda variable.

Definition at line 576 of file UninitializedObjectChecker.cpp.

◆ getWidenedLoopState()

ProgramStateRef clang::ento::getWidenedLoopState	(	ProgramStateRef	PrevState,
		const LocationContext *	LCtx,
		unsigned	BlockCount,
		const Stmt *	LoopStmt
	)

Get the states that result from widening the loop.

Widen the loop by invalidating anything that might be modified by the loop body in any iteration.

Definition at line 46 of file LoopWidening.cpp.

References clang::ast_matchers::findAll(), clang::LocationContext::getAnalysisDeclContext(), clang::AnalysisDeclContext::getASTContext(), clang::Decl::getBody(), clang::ento::MemRegionManager::getCXXThisRegion(), clang::LocationContext::getDecl(), clang::ento::MemRegionManager::getGlobalsRegion(), getLoopCondition(), clang::ento::MemRegionManager::getStackArgumentsRegion(), clang::LocationContext::getStackFrame(), clang::ento::MemRegionManager::getStackLocalsRegion(), clang::CXXMethodDecl::getThisType(), clang::ento::MemRegionManager::getVarRegion(), clang::ast_matchers::hasDescendant, clang::CXXMethodDecl::isImplicitObjectMemberFunction(), clang::ast_matchers::match(), MatchRef, clang::ast_matchers::referenceType, clang::ento::RegionAndSymbolInvalidationTraits::setTrait(), clang::ast_matchers::stmt, clang::ento::RegionAndSymbolInvalidationTraits::TK_EntireMemSpace, clang::ento::RegionAndSymbolInvalidationTraits::TK_PreserveContents, and clang::ast_matchers::varDecl.

Referenced by clang::ento::ExprEngine::processCFGBlockEntrance().

◆ hasSuspiciousStmt()

static internal::Matcher< Stmt > clang::ento::hasSuspiciousStmt ( StringRef NodeName )

static

Definition at line 133 of file LoopUnrolling.cpp.

References clang::ast_matchers::anyOf, assignedToRef(), callByRef(), changeIntBoundNode(), getAddrTo(), clang::ast_matchers::gotoStmt, clang::ast_matchers::hasDescendant, clang::ast_matchers::returnStmt, clang::ast_matchers::stmt, and clang::ast_matchers::switchStmt.

Referenced by forLoopMatcher().

◆ isCapturedByReference()

static bool clang::ento::isCapturedByReference	(	ExplodedNode *	N,
		const DeclRefExpr *	DR
	)

static

Definition at line 169 of file LoopUnrolling.cpp.

References D, clang::Decl::getCanonicalDecl(), clang::CXXRecordDecl::getCaptureFields(), clang::DeclRefExpr::getDecl(), clang::LocationContext::getDecl(), clang::ento::ExplodedNode::getLocationContext(), clang::DeclContext::getParent(), clang::ValueDecl::getType(), clang::Type::isReferenceType(), and clang::DeclRefExpr::refersToEnclosingVariableOrCapture().

Referenced by isPossiblyEscaped().

◆ isDereferencableType()

bool clang::ento::isDereferencableType ( const QualType & T )

inline

Definition at line 330 of file UninitializedObject.h.

References clang::Type::isAnyPointerType(), clang::Type::isReferenceType(), and clang::T.

Referenced by dereference().

◆ isFoundInStmt()

static bool clang::ento::isFoundInStmt	(	const Stmt *	S,
		const VarDecl *	VD
	)

static

Definition at line 193 of file LoopUnrolling.cpp.

References D, and clang::Decl::getCanonicalDecl().

Referenced by isPossiblyEscaped().

◆ isLoopStmt()

static bool clang::ento::isLoopStmt ( const Stmt * S )

static

Definition at line 74 of file LoopUnrolling.cpp.

Referenced by shouldCompletelyUnroll(), and updateLoopStack().

◆ isPossiblyEscaped()

static bool clang::ento::isPossiblyEscaped	(	ExplodedNode *	N,
		const DeclRefExpr *	DR
	)

static

◆ isPrimitiveType()

bool clang::ento::isPrimitiveType ( const QualType & T )

inline

Returns true if T is a primitive type.

An object of a primitive type only needs to be analyzed as much as checking whether their value is undefined.

Definition at line 324 of file UninitializedObject.h.

References clang::Type::isAtomicType(), clang::Type::isBuiltinType(), clang::Type::isEnumeralType(), clang::Type::isFunctionType(), clang::Type::isScalarType(), clang::Type::isVectorType(), and clang::T.

◆ isUnrolledState()

bool clang::ento::isUnrolledState ( ProgramStateRef State )

Returns if the given State indicates that is inside a completely unrolled loop.

Definition at line 357 of file LoopUnrolling.cpp.

Referenced by clang::ento::ExprEngine::processCFGBlockEntrance().

◆ madeNewBranch()

bool clang::ento::madeNewBranch	(	ExplodedNode *	N,
		const Stmt *	LoopStmt
	)

Definition at line 300 of file LoopUnrolling.cpp.

References clang::ento::ExplodedNode::getFirstPred(), clang::ento::ExplodedNode::getLocation(), P, clang::ento::ExplodedNode::pred_empty(), and clang::ento::ExplodedNode::succ_size().

Referenced by updateLoopStack().

◆ operationKindFromOverloadedOperator()

OperatorKind clang::ento::operationKindFromOverloadedOperator	(	OverloadedOperatorKind	OOK,
		bool	IsBinary
	)

Definition at line 152 of file CheckerHelpers.cpp.

◆ operator<<() [1/4]

raw_ostream & clang::ento::operator<<	(	raw_ostream &	os,
		clang::ento::SVal	V
	)

inline

Definition at line 174 of file SVals.h.

References V.

◆ operator<<() [2/4]

raw_ostream & clang::ento::operator<<	(	raw_ostream &	os,
		const clang::ento::SymExpr *	SE
	)

inline

Definition at line 107 of file SymExpr.h.

References clang::ento::SymExpr::dumpToStream().

◆ operator<<() [3/4]

raw_ostream & clang::ento::operator<<	(	raw_ostream &	os,
		const MemRegion *	R
	)

inline

Definition at line 1669 of file MemRegion.h.

References clang::ento::MemRegion::dumpToStream().

◆ operator<<() [4/4]

raw_ostream & clang::ento::operator<<	(	raw_ostream &	Out,
		const CheckerBase &	Checker
	)

Dump checker name to stream.

Definition at line 35 of file Checker.cpp.

References clang::ento::CheckerBase::getCheckerName(), and clang::ento::CheckerNameRef::getName().

◆ parseAssignment()

std::pair< const clang::VarDecl *, const clang::Expr * > clang::ento::parseAssignment ( const Stmt * S )

Definition at line 83 of file CheckerHelpers.cpp.

References clang::VarDecl::getAnyInitializer().

Referenced by getDereferenceExpr().

◆ printAnalyzerConfigList()

void clang::ento::printAnalyzerConfigList ( llvm::raw_ostream & OS )

Referenced by clang::ExecuteCompilerInvocation().

◆ printCheckerConfigList()

void clang::ento::printCheckerConfigList	(	llvm::raw_ostream &	OS,
		CompilerInstance &	CI
	)

Referenced by clang::ExecuteCompilerInvocation().

◆ printCheckerHelp()

void clang::ento::printCheckerHelp	(	llvm::raw_ostream &	OS,
		CompilerInstance &	CI
	)

Referenced by clang::ExecuteCompilerInvocation().

◆ printDynamicTypeInfoJson()

void clang::ento::printDynamicTypeInfoJson	(	raw_ostream &	Out,
		ProgramStateRef	State,
		const char *	NL = `"\n"`,
		unsigned int	Space = `0`,
		bool	IsDot = `false`
	)

Referenced by clang::ento::ProgramState::printJson().

◆ printEnabledCheckerList()

void clang::ento::printEnabledCheckerList	(	llvm::raw_ostream &	OS,
		CompilerInstance &	CI
	)

Referenced by clang::ExecuteCompilerInvocation().

◆ processLoopEnd()

ProgramStateRef clang::ento::processLoopEnd	(	const Stmt *	LoopStmt,
		ProgramStateRef	State
	)

Updates the given ProgramState.

In current implementation it removes the top element of the stack of loops.

Definition at line 78 of file LoopUnrolling.cpp.

Referenced by clang::ento::ExprEngine::ProcessLoopExit().

◆ ProgramStateRelease()

void clang::ento::ProgramStateRelease ( const ProgramState * state )

Decrement the number of times this state is referenced.

Definition at line 35 of file ProgramState.cpp.

Referenced by llvm::IntrusiveRefCntPtrInfo< const clang::ento::ProgramState >::release().

◆ ProgramStateRetain()

void clang::ento::ProgramStateRetain ( const ProgramState * state )

Increments the number of times this state is referenced.

Definition at line 30 of file ProgramState.cpp.

Referenced by llvm::IntrusiveRefCntPtrInfo< const clang::ento::ProgramState >::retain().

◆ registerCheckerDocumentationChecker()

void clang::ento::registerCheckerDocumentationChecker ( CheckerManager & Mgr )

Definition at line 343 of file CheckerDocumentation.cpp.

References clang::ento::CheckerManager::registerChecker().

◆ registerInnerPointerCheckerAux()

void clang::ento::registerInnerPointerCheckerAux ( CheckerManager & Mgr )

Register the part of MallocChecker connected to InnerPointerChecker.

Definition at line 3780 of file MallocChecker.cpp.

References clang::ento::CheckerManager::getChecker(), and clang::ento::CheckerManager::getCurrentCheckerName().

◆ removeDeadCasts()

ProgramStateRef clang::ento::removeDeadCasts	(	ProgramStateRef	State,
		SymbolReaper &	SR
	)

Removes the dead cast informations from State.

◆ removeDeadClassObjectTypes()

ProgramStateRef clang::ento::removeDeadClassObjectTypes	(	ProgramStateRef	State,
		SymbolReaper &	SR
	)

Removes the dead Class object type informations from State.

◆ removeDeadTypes()

ProgramStateRef clang::ento::removeDeadTypes	(	ProgramStateRef	State,
		SymbolReaper &	SR
	)

Removes the dead type informations from State.

◆ setClassObjectDynamicTypeInfo() [1/2]

ProgramStateRef clang::ento::setClassObjectDynamicTypeInfo	(	ProgramStateRef	State,
		SymbolRef	Sym,
		DynamicTypeInfo	NewTy
	)

Set constraint on a type contained in a class object; return the new state.

◆ setClassObjectDynamicTypeInfo() [2/2]

ProgramStateRef clang::ento::setClassObjectDynamicTypeInfo	(	ProgramStateRef	State,
		SymbolRef	Sym,
		QualType	NewTy,
		bool	CanBeSubClassed = `true`
	)

Set constraint on a type contained in a class object; return the new state.

◆ setDynamicExtent()

ProgramStateRef clang::ento::setDynamicExtent	(	ProgramStateRef	State,
		const MemRegion *	MR,
		DefinedOrUnknownSVal	Extent,
		SValBuilder &	SVB
	)

Set the dynamic extent Extent of the region MR.

Referenced by clang::ento::ExprEngine::bindReturnValue(), and REGISTER_MAP_WITH_PROGRAMSTATE().

◆ setDynamicTypeAndCastInfo()

ProgramStateRef clang::ento::setDynamicTypeAndCastInfo	(	ProgramStateRef	State,
		const MemRegion *	MR,
		QualType	CastFromTy,
		QualType	CastToTy,
		bool	IsCastSucceeds
	)

Set dynamic type and cast information of the region; return the new state.

Referenced by addCastTransition(), and addInstanceOfTransition().

◆ setDynamicTypeInfo() [1/2]

ProgramStateRef clang::ento::setDynamicTypeInfo	(	ProgramStateRef	State,
		const MemRegion *	MR,
		DynamicTypeInfo	NewTy
	)

Set dynamic type information of the region; return the new state.

Referenced by recordFixedType().

◆ setDynamicTypeInfo() [2/2]

ProgramStateRef clang::ento::setDynamicTypeInfo	(	ProgramStateRef	State,
		const MemRegion *	MR,
		QualType	NewTy,
		bool	CanBeSubClassed = `true`
	)

Set dynamic type information of the region; return the new state.

◆ shouldCompletelyUnroll()

bool clang::ento::shouldCompletelyUnroll	(	const Stmt *	LoopStmt,
		ASTContext &	ASTCtx,
		ExplodedNode *	Pred,
		unsigned &	maxStep
	)

Definition at line 268 of file LoopUnrolling.cpp.

References abs(), forLoopMatcher(), isLoopStmt(), isPossiblyEscaped(), and clang::ast_matchers::match().

Referenced by updateLoopStack().

◆ shouldRegisterCheckerDocumentationChecker()

bool clang::ento::shouldRegisterCheckerDocumentationChecker ( const CheckerManager & )

Definition at line 347 of file CheckerDocumentation.cpp.

◆ simpleCondition()

static internal::Matcher< Stmt > clang::ento::simpleCondition	(	StringRef	BindName,
		StringRef	RefName
	)

static

Definition at line 85 of file LoopUnrolling.cpp.

References clang::ast_matchers::anyOf, clang::ast_matchers::binaryOperator, clang::ast_matchers::declRefExpr, clang::ast_matchers::integerLiteral, and clang::ast_matchers::varDecl.

Referenced by forLoopMatcher().

◆ simplify()

SymbolRef clang::ento::simplify	(	ProgramStateRef	State,
		SymbolRef	Sym
	)

Try to simplify a given symbolic expression based on the constraints in State.

This is needed because the Environment bindings are not getting updated when a new constraint is added to the State. If the symbol is simplified to a non-symbol (e.g. to a constant) then the original symbol is returned. We use this function in the family of assumeSymNE/EQ/LT/../GE functions where we can work only with symbols. Use the other function (simplifyToSVal) if you are interested in a simplification that may yield a concrete constant value.

Definition at line 240 of file RangedConstraintManager.cpp.

References clang::ento::SVal::getAsSymbol(), and simplifyToSVal().

Referenced by clang::ento::RangedConstraintManager::assumeSym(), clang::ento::RangedConstraintManager::assumeSymInclusiveRange(), and clang::ento::RangedConstraintManager::assumeSymUnsupported().

◆ simplifyToSVal()

SVal clang::ento::simplifyToSVal	(	ProgramStateRef	State,
		SymbolRef	Sym
	)

Try to simplify a given symbolic expression's associated SVal based on the constraints in State.

This is very similar to simplify, but this function always returns the simplified SVal. The simplified SVal might be a single constant (i.e. ConcreteInt).

Definition at line 235 of file RangedConstraintManager.cpp.

References clang::ento::SValBuilder::makeSymbolVal(), and clang::ento::SValBuilder::simplifySVal().

Referenced by simplify().

◆ tryExpandAsInteger()

std::optional< int > clang::ento::tryExpandAsInteger	(	StringRef	Macro,
		const Preprocessor &	PP
	)

Try to parse the value of a defined preprocessor macro.

We can only parse simple expressions that consist of an optional minus sign token and then a token for an integer. If we cannot parse the value then std::nullopt is returned.

Definition at line 115 of file CheckerHelpers.cpp.

References clang::Preprocessor::getIdentifierInfo(), clang::Preprocessor::getMacroInfo(), clang::T, and clang::MacroInfo::tokens().

◆ updateLoopStack()

ProgramStateRef clang::ento::updateLoopStack	(	const Stmt *	LoopStmt,
		ASTContext &	ASTCtx,
		ExplodedNode *	Pred,
		unsigned	maxVisitOnPath
	)

Updates the stack of loops contained by the ProgramState.

Definition at line 320 of file LoopUnrolling.cpp.

References clang::ento::ExplodedNode::getLocationContext(), clang::ento::ExplodedNode::getState(), isLoopStmt(), madeNewBranch(), MAXIMUM_STEP_UNROLLED, and shouldCompletelyUnroll().

Referenced by clang::ento::ExprEngine::processCFGBlockEntrance().

Namespaces

Classes

Typedefs

Enumerations

Functions

Typedef Documentation

◆ ArgEffects

◆ CDM

◆ CheckerInfoList

◆ CheckerInfoListRange

◆ CheckerInfoSet

◆ CmdLineOptionList

◆ ConstCheckerInfoList

◆ ConstraintManagerCreator

◆ ConstraintMap

◆ DiagnosticForConsumerMapTy

◆ FilesToLineNumsMap

◆ InterExplodedGraphMap

◆ IntSymExpr

◆ InvalidatedSymbols

◆ LocationOrAnalysisDeclContext

◆ PackageInfoList

◆ PathDiagnosticConsumers

◆ PathDiagnosticPieceRef

◆ ProgramStateRef

◆ RegisterCheckerFn

◆ SetOfConstDecls

◆ SetOfDecls

◆ ShouldRegisterFunction

◆ StateFromCmdLine

◆ Store

◆ StoreManagerCreator

◆ SymbolID

◆ SymbolRef

◆ SymbolRefSmallVectorTy

◆ SymIntExpr

◆ SymSymExpr

◆ UninitFieldMap

Enumeration Type Documentation

◆ ArgEffectKind

◆ CallEventKind

◆ Nullability

◆ ObjCMessageKind

◆ ObjCMessageVisitKind

◆ ObjKind

◆ PointerEscapeKind

Function Documentation

◆ assignedToRef()

◆ callByRef()

◆ changeIntBoundNode()

◆ containsBuiltinOffsetOf()

◆ containsEnum()

◆ containsMacro()

◆ containsStaticLocal()

◆ containsStmt()

◆ CreateAnalysisConsumer()

◆ CreateRangeConstraintManager()

◆ CreateRegionStoreManager()

◆ createSimpleSValBuilder()

◆ CreateZ3ConstraintManager()

◆ forLoopMatcher()

◆ getAddrTo()

◆ getClassObjectDynamicTypeInfo()

◆ getConfiguration()

◆ getConstraintMap()

◆ getDynamicCastInfo()

◆ getDynamicElementCount()

◆ getDynamicElementCountWithOffset()

◆ getDynamicExtent()

◆ getDynamicExtentWithOffset()

◆ getDynamicTypeInfo()

◆ getElementExtent()

◆ getNullabilityAnnotation()

◆ getPointeeVal()

◆ getRawDynamicTypeInfo()

◆ getVariableName()

◆ getWidenedLoopState()

◆ hasSuspiciousStmt()

◆ isCapturedByReference()

◆ isDereferencableType()