29 #include "llvm/ADT/ImmutableList.h"
30 #include "llvm/ADT/Statistic.h"
31 #include "llvm/Support/raw_ostream.h"
34 #include "llvm/Support/GraphWriter.h"
37 using namespace clang;
41 #define DEBUG_TYPE "ExprEngine"
44 "The # of times RemoveDeadBindings is called");
46 "The # of aborted paths due to reaching the maximum block count in "
47 "a top level function");
48 STATISTIC(NumMaxBlockCountReachedInInlined,
49 "The # of aborted paths due to reaching the maximum block count in "
50 "an inlined function");
52 "The # of times we re-evaluated a call without inlining");
54 typedef std::pair<const CXXBindTemporaryExpr *, const StackFrameContext *>
67 static const
char* TagProviderName = "
ExprEngine";
74 AnalysisDeclContexts(mgr.getAnalysisDeclContextManager()),
77 StateMgr(getContext(), mgr.getStoreManagerCreator(),
78 mgr.getConstraintManagerCreator(), G.getAllocator(),
80 SymMgr(StateMgr.getSymbolManager()),
81 svalBuilder(StateMgr.getSValBuilder()),
82 currStmtIdx(0), currBldrCtx(
nullptr),
83 ObjCNoRet(mgr.getASTContext()),
84 ObjCGCEnabled(gcEnabled), BR(mgr, *this),
85 VisitedCallees(VisitedCalleesIn),
86 HowToInline(HowToInlineIn)
88 unsigned TrimInterval = mgr.options.getGraphTrimInterval();
89 if (TrimInterval != 0) {
91 G.enableNodeReclamation(TrimInterval);
112 if (
const FunctionDecl *FD = dyn_cast<FunctionDecl>(D)) {
116 if (!II || !(II->
getName() ==
"main" && FD->getNumParams() > 0))
125 const MemRegion *R = state->getRegion(PD, InitLoc);
151 const MemRegion *R = state->getRegion(SelfD, InitLoc);
156 state = state->assume(*LV,
true);
157 assert(state &&
"'self' cannot be null");
162 if (!MD->isStatic()) {
169 SVal V = state->getSVal(L);
171 state = state->assume(*LV,
true);
172 assert(state &&
"'this' cannot be null");
185 const Expr *Result) {
186 SVal V = State->getSVal(Ex, LC);
210 while (
const CastExpr *CE = dyn_cast<CastExpr>(Inner)) {
214 else if (CE->getCastKind() !=
CK_NoOp)
225 dyn_cast<MaterializeTemporaryExpr>(Result)) {
240 State = State->bindLoc(Reg, V);
249 State = State->BindExpr(Result, LC, Reg);
260 SVal cond,
bool assumption) {
275 Explicits, Regions, Call);
279 const char *NL,
const char *Sep) {
290 currStmtIdx = StmtIdx;
342 const Stmt *ReferenceStmt,
344 const Stmt *DiagnosticStmt,
347 ReferenceStmt ==
nullptr || isa<ReturnStmt>(ReferenceStmt))
348 &&
"PostStmt is not generally supported by the SymbolReaper yet");
349 assert(LC &&
"Must pass the current (or expiring) LocationContext");
351 if (!DiagnosticStmt) {
352 DiagnosticStmt = ReferenceStmt;
353 assert(DiagnosticStmt &&
"Required for clearing a LocationContext");
356 NumRemoveDeadBindings++;
362 if (!ReferenceStmt) {
364 "Use PostStmtPurgeDeadSymbolsKind for clearing a LocationContext");
386 Bldr.
generateNode(DiagnosticStmt, Pred, CleanedState, &cleanupTag, K);
393 DiagnosticStmt, *
this, K);
400 I = CheckedSet.
begin(), E = CheckedSet.
end(); I != E; ++I) {
408 "Checkers are not allowed to modify the Environment as a part of "
409 "checkDeadSymbols processing.");
411 "Checkers are not allowed to modify the Store as a part of "
412 "checkDeadSymbols processing.");
418 Bldr.
generateNode(DiagnosticStmt, *I, CleanedCheckerSt, &cleanupTag, K);
430 currStmt->getLocStart(),
431 "Error evaluating statement");
438 CleanedStates.Add(Pred);
443 E = CleanedStates.end(); I != E; ++I) {
446 Visit(currStmt, *I, DstI);
460 "Error evaluating initializer");
466 cast<CXXConstructorDecl>(stackFrame->getDecl());
469 SVal thisVal = State->getSVal(svalBuilder.
getCXXThis(decl, stackFrame));
479 if (!isa<CXXConstructExpr>(Init)) {
486 FieldLoc = State->getLValue(BMI->
getMember(), thisVal);
494 while ((ASE = dyn_cast<ArraySubscriptExpr>(Init)))
497 SVal LValue = State->getSVal(Init, stackFrame);
499 InitVal = State->getSVal(*LValueLoc);
509 InitVal = State->getSVal(BMI->
getInit(), stackFrame);
512 assert(Tmp.
size() == 1 &&
"have not generated any new nodes yet");
513 assert(*Tmp.
begin() == Pred &&
"have not generated any new nodes yet");
517 evalBind(Tmp, Init, Pred, FieldLoc, InitVal,
true, &PP);
558 llvm_unreachable(
"Unexpected dtor kind.");
596 Region = state->getSVal(Region).getAsRegion();
610 SVal ArgVal = State->getSVal(Arg, LCtx);
614 if (State->isNull(ArgVal).isConstrainedTrue()) {
622 Bldr.generateNode(PP, Pred->
getState(), Pred);
648 CurDtor->
getBody(),
true, Pred, Dst);
661 State->getLValue(Member, State->getSVal(ThisVal).castAs<
Loc>());
665 CurDtor->
getBody(),
false, Pred, Dst);
674 if (State->contains<InitializedTemporariesSet>(
678 State = State->remove<InitializedTemporariesSet>(
686 assert(CleanDtorState.
size() <= 1);
688 CleanDtorState.
empty() ? Pred : *CleanDtorState.
begin();
692 false, CleanPred, Dst);
702 if (Pred->
getState()->contains<InitializedTemporariesSet>(
725 if (!State->contains<InitializedTemporariesSet>(
726 std::make_pair(BTE,
Node->getStackFrame()))) {
731 State = State->add<InitializedTemporariesSet>(
732 std::make_pair(BTE,
Node->getStackFrame()));
742 "Error evaluating statement");
746 assert(!isa<Expr>(S) || S == cast<Expr>(S)->IgnoreParens());
748 switch (S->getStmtClass()) {
750 case Expr::ObjCIndirectCopyRestoreExprClass:
751 case Stmt::CXXDependentScopeMemberExprClass:
752 case Stmt::CXXTryStmtClass:
753 case Stmt::CXXTypeidExprClass:
754 case Stmt::CXXUuidofExprClass:
755 case Stmt::CXXFoldExprClass:
756 case Stmt::MSPropertyRefExprClass:
757 case Stmt::CXXUnresolvedConstructExprClass:
758 case Stmt::DependentScopeDeclRefExprClass:
759 case Stmt::TypeTraitExprClass:
760 case Stmt::ArrayTypeTraitExprClass:
761 case Stmt::ExpressionTraitExprClass:
762 case Stmt::UnresolvedLookupExprClass:
763 case Stmt::UnresolvedMemberExprClass:
764 case Stmt::TypoExprClass:
765 case Stmt::CXXNoexceptExprClass:
766 case Stmt::PackExpansionExprClass:
767 case Stmt::SubstNonTypeTemplateParmPackExprClass:
768 case Stmt::FunctionParmPackExprClass:
769 case Stmt::SEHTryStmtClass:
770 case Stmt::SEHExceptStmtClass:
771 case Stmt::SEHLeaveStmtClass:
772 case Stmt::LambdaExprClass:
773 case Stmt::SEHFinallyStmtClass: {
779 case Stmt::ParenExprClass:
780 llvm_unreachable(
"ParenExprs already handled.");
781 case Stmt::GenericSelectionExprClass:
782 llvm_unreachable(
"GenericSelectionExprs already handled.");
785 case Stmt::BreakStmtClass:
786 case Stmt::CaseStmtClass:
787 case Stmt::CompoundStmtClass:
788 case Stmt::ContinueStmtClass:
789 case Stmt::CXXForRangeStmtClass:
790 case Stmt::DefaultStmtClass:
791 case Stmt::DoStmtClass:
792 case Stmt::ForStmtClass:
793 case Stmt::GotoStmtClass:
794 case Stmt::IfStmtClass:
795 case Stmt::IndirectGotoStmtClass:
796 case Stmt::LabelStmtClass:
797 case Stmt::NoStmtClass:
798 case Stmt::NullStmtClass:
799 case Stmt::SwitchStmtClass:
800 case Stmt::WhileStmtClass:
801 case Expr::MSDependentExistsStmtClass:
802 case Stmt::CapturedStmtClass:
803 case Stmt::OMPParallelDirectiveClass:
804 case Stmt::OMPSimdDirectiveClass:
805 case Stmt::OMPForDirectiveClass:
806 case Stmt::OMPForSimdDirectiveClass:
807 case Stmt::OMPSectionsDirectiveClass:
808 case Stmt::OMPSectionDirectiveClass:
809 case Stmt::OMPSingleDirectiveClass:
810 case Stmt::OMPMasterDirectiveClass:
811 case Stmt::OMPCriticalDirectiveClass:
812 case Stmt::OMPParallelForDirectiveClass:
813 case Stmt::OMPParallelForSimdDirectiveClass:
814 case Stmt::OMPParallelSectionsDirectiveClass:
815 case Stmt::OMPTaskDirectiveClass:
816 case Stmt::OMPTaskyieldDirectiveClass:
817 case Stmt::OMPBarrierDirectiveClass:
818 case Stmt::OMPTaskwaitDirectiveClass:
819 case Stmt::OMPTaskgroupDirectiveClass:
820 case Stmt::OMPFlushDirectiveClass:
821 case Stmt::OMPOrderedDirectiveClass:
822 case Stmt::OMPAtomicDirectiveClass:
823 case Stmt::OMPTargetDirectiveClass:
824 case Stmt::OMPTeamsDirectiveClass:
825 case Stmt::OMPCancellationPointDirectiveClass:
826 case Stmt::OMPCancelDirectiveClass:
827 llvm_unreachable(
"Stmt should not be in analyzer evaluation loop");
829 case Stmt::ObjCSubscriptRefExprClass:
830 case Stmt::ObjCPropertyRefExprClass:
831 llvm_unreachable(
"These are handled by PseudoObjectExpr");
833 case Stmt::GNUNullExprClass: {
842 case Stmt::ObjCAtSynchronizedStmtClass:
848 case Stmt::ExprWithCleanupsClass:
852 case Stmt::CXXBindTemporaryExprClass: {
864 case Stmt::DesignatedInitExprClass:
865 case Stmt::DesignatedInitUpdateExprClass:
866 case Stmt::ExtVectorElementExprClass:
867 case Stmt::ImaginaryLiteralClass:
868 case Stmt::ObjCAtCatchStmtClass:
869 case Stmt::ObjCAtFinallyStmtClass:
870 case Stmt::ObjCAtTryStmtClass:
871 case Stmt::ObjCAutoreleasePoolStmtClass:
872 case Stmt::ObjCEncodeExprClass:
873 case Stmt::ObjCIsaExprClass:
874 case Stmt::ObjCProtocolExprClass:
875 case Stmt::ObjCSelectorExprClass:
876 case Stmt::ParenListExprClass:
877 case Stmt::ShuffleVectorExprClass:
878 case Stmt::ConvertVectorExprClass:
879 case Stmt::VAArgExprClass:
880 case Stmt::CUDAKernelCallExprClass:
881 case Stmt::OpaqueValueExprClass:
882 case Stmt::AsTypeExprClass:
883 case Stmt::AtomicExprClass:
888 case Stmt::PredefinedExprClass:
889 case Stmt::AddrLabelExprClass:
890 case Stmt::AttributedStmtClass:
891 case Stmt::IntegerLiteralClass:
892 case Stmt::CharacterLiteralClass:
893 case Stmt::ImplicitValueInitExprClass:
894 case Stmt::CXXScalarValueInitExprClass:
895 case Stmt::CXXBoolLiteralExprClass:
896 case Stmt::ObjCBoolLiteralExprClass:
897 case Stmt::FloatingLiteralClass:
898 case Stmt::NoInitExprClass:
899 case Stmt::SizeOfPackExprClass:
900 case Stmt::StringLiteralClass:
901 case Stmt::ObjCStringLiteralClass:
902 case Stmt::CXXPseudoDestructorExprClass:
903 case Stmt::SubstNonTypeTemplateParmExprClass:
904 case Stmt::CXXNullPtrLiteralExprClass: {
913 case Stmt::CXXDefaultArgExprClass:
914 case Stmt::CXXDefaultInitExprClass: {
924 ArgE = DefE->getExpr();
926 ArgE = DefE->getExpr();
928 llvm_unreachable(
"unknown constant wrapper kind");
930 bool IsTemporary =
false;
932 dyn_cast<MaterializeTemporaryExpr>(ArgE)) {
933 ArgE = MTE->GetTemporaryExpr();
945 State = State->BindExpr(S, LCtx, *ConstantVal);
947 State = createTemporaryRegionIfNeeded(State, LCtx,
959 case Stmt::CXXStdInitializerListExprClass:
960 case Expr::ObjCArrayLiteralClass:
961 case Expr::ObjCDictionaryLiteralClass:
962 case Expr::ObjCBoxedExprClass: {
971 const Expr *Ex = cast<Expr>(
S);
990 case Stmt::ArraySubscriptExprClass:
996 case Stmt::GCCAsmStmtClass:
1002 case Stmt::MSAsmStmtClass:
1008 case Stmt::BlockExprClass:
1014 case Stmt::BinaryOperatorClass: {
1026 state->getSVal(B->
getRHS(),
1046 case Stmt::CXXOperatorCallExprClass: {
1052 if (
const CXXMethodDecl *MD = dyn_cast_or_null<CXXMethodDecl>(Callee)) {
1053 if (MD->isInstance()) {
1057 createTemporaryRegionIfNeeded(State, LCtx, OCE->
getArg(0));
1058 if (NewState != State) {
1069 case Stmt::CallExprClass:
1070 case Stmt::CXXMemberCallExprClass:
1071 case Stmt::UserDefinedLiteralClass: {
1078 case Stmt::CXXCatchStmtClass: {
1085 case Stmt::CXXTemporaryObjectExprClass:
1086 case Stmt::CXXConstructExprClass: {
1093 case Stmt::CXXNewExprClass: {
1102 case Stmt::CXXDeleteExprClass: {
1109 e = PreVisit.
end(); i != e ; ++i)
1118 case Stmt::ChooseExprClass: {
1126 case Stmt::CompoundAssignOperatorClass:
1132 case Stmt::CompoundLiteralExprClass:
1138 case Stmt::BinaryConditionalOperatorClass:
1139 case Stmt::ConditionalOperatorClass: {
1142 = cast<AbstractConditionalOperator>(
S);
1148 case Stmt::CXXThisExprClass:
1154 case Stmt::DeclRefExprClass: {
1162 case Stmt::DeclStmtClass:
1168 case Stmt::ImplicitCastExprClass:
1169 case Stmt::CStyleCastExprClass:
1170 case Stmt::CXXStaticCastExprClass:
1171 case Stmt::CXXDynamicCastExprClass:
1172 case Stmt::CXXReinterpretCastExprClass:
1173 case Stmt::CXXConstCastExprClass:
1174 case Stmt::CXXFunctionalCastExprClass:
1175 case Stmt::ObjCBridgedCastExprClass: {
1185 e = dstPrevisit.end(); i != e ; ++i) {
1195 case Expr::MaterializeTemporaryExprClass: {
1203 case Stmt::InitListExprClass:
1209 case Stmt::MemberExprClass:
1215 case Stmt::ObjCIvarRefExprClass:
1221 case Stmt::ObjCForCollectionStmtClass:
1227 case Stmt::ObjCMessageExprClass:
1233 case Stmt::ObjCAtThrowStmtClass:
1234 case Stmt::CXXThrowExprClass:
1240 case Stmt::ReturnStmtClass:
1246 case Stmt::OffsetOfExprClass:
1252 case Stmt::UnaryExprOrTypeTraitExprClass:
1259 case Stmt::StmtExprClass: {
1265 &&
"Empty statement expression must have void type.");
1273 state->getSVal(LastExpr,
1279 case Stmt::UnaryOperatorClass: {
1293 case Stmt::PseudoObjectExprClass: {
1313 bool ExprEngine::replayWithoutInlining(
ExplodedNode *N,
1317 assert(CalleeSF && CallerSF);
1324 BeforeProcessingCall = N;
1339 if (SP->getStmt() == CE)
1344 if (!BeforeProcessingCall)
1372 NumTimesRetriedWithoutInlining++;
1393 (*G.
roots_begin())->getLocation().getLocationContext();
1402 replayWithoutInlining(Pred, CalleeLC)))
1404 NumMaxBlockCountReachedInInlined++;
1406 NumMaxBlockCountReached++;
1409 Engine.blocksExhausted.push_back(std::make_pair(L, Sink));
1424 const Stmt *Condition,
1428 const Expr *Ex = dyn_cast<
Expr>(Condition);
1433 bool bitsInit =
false;
1435 while (
const CastExpr *CE = dyn_cast<CastExpr>(Ex)) {
1442 if (!bitsInit || newBits < bits) {
1447 Ex = CE->getSubExpr();
1457 return state->getSVal(Ex, LCtx);
1489 if (
const Expr *Ex = dyn_cast<Expr>(Condition))
1497 "Temporary destructor branches handled by processBindTemporary.");
1508 for (; I != E; ++I) {
1513 const Stmt *LastStmt = CS->getStmt();
1517 llvm_unreachable(
"could not resolve condition");
1526 assert((!Condition || !isa<CXXBindTemporaryExpr>(Condition)) &&
1527 "CXXBindTemporaryExprs are handled by processBindTemporary.");
1530 currBldrCtx = &BldCtx;
1541 if (
const Expr *Ex = dyn_cast<Expr>(Condition))
1546 Condition->getLocStart(),
1547 "Error evaluating branch");
1553 if (CheckersOutSet.empty())
1558 E = CheckersOutSet.end(); E != I; ++I) {
1569 if (
const Expr *Ex = dyn_cast<Expr>(Condition)) {
1576 PrevState, Condition,
1597 std::tie(StTrue, StFalse) = PrevState->assume(V);
1615 currBldrCtx =
nullptr;
1630 currBldrCtx = &BuilderCtx;
1632 const VarDecl *VD = cast<VarDecl>(DS->getSingleDecl());
1634 bool initHasRun = state->contains<InitializedGlobalsSet>(VD);
1638 state = state->add<InitializedGlobalsSet>(VD);
1641 builder.generateNode(state, initHasRun, Pred);
1642 builder.markInfeasible(!initHasRun);
1644 currBldrCtx =
nullptr;
1666 for (iterator I = builder.
begin(), E = builder.
end(); I != E; ++I) {
1667 if (I.getLabel() == L) {
1673 llvm_unreachable(
"No block with label.");
1687 for (iterator I=builder.
begin(), E=builder.
end(); I != E; ++I)
1692 static bool stackFrameDoesNotContainInitializedTemporaries(
ExplodedNode &Pred) {
1695 Pred.
getState()->get<InitializedTemporariesSet>();
1696 return std::find_if(Set.begin(), Set.end(),
1698 if (Ctx.second == Frame) {
1700 llvm::errs() <<
"\n";
1702 return Ctx.second == Frame;
1725 E = AfterRemovedDead.
end(); I != E; ++I) {
1743 if (CondV_untested.
isUndef()) {
1754 iterator I = builder.
begin(), EI = builder.
end();
1755 bool defaultIsFeasible = I == EI;
1757 for ( ; I != EI; ++I) {
1762 const CaseStmt *Case = I.getCase();
1799 defaultIsFeasible =
true;
1800 DefaultSt = stateNew;
1803 defaultIsFeasible =
false;
1804 DefaultSt =
nullptr;
1818 if (!defaultIsFeasible)
1850 if (
const VarDecl *VD = dyn_cast<VarDecl>(D)) {
1853 assert(Ex->
isGLValue() || VD->getType()->isVoidType());
1858 if (VD->getType()->isReferenceType()) {
1859 if (
const MemRegion *R = V.getAsRegion())
1860 V = state->getSVal(R);
1865 Bldr.
generateNode(Ex, Pred, state->BindExpr(Ex, LCtx, V),
nullptr,
1872 Bldr.
generateNode(Ex, Pred, state->BindExpr(Ex, LCtx, V));
1875 if (
const FunctionDecl *FD = dyn_cast<FunctionDecl>(D)) {
1877 Bldr.
generateNode(Ex, Pred, state->BindExpr(Ex, LCtx, V),
nullptr,
1881 if (isa<FieldDecl>(D)) {
1888 Bldr.
generateNode(Ex, Pred, state->BindExpr(Ex, LCtx, V),
nullptr,
1893 llvm_unreachable(
"Support for this Decl not implemented.");
1914 ei = checkerPreStmt.
end(); it != ei; ++it) {
1918 state->getSVal(Idx, LCtx),
1919 state->getSVal(Base, LCtx));
1920 Bldr.
generateNode(A, *it, state->BindExpr(A, LCtx, V),
nullptr,
1938 if (isa<VarDecl>(Member) || isa<EnumConstantDecl>(Member)) {
1955 if (
const CXXMethodDecl *MD = dyn_cast<CXXMethodDecl>(Member)) {
1956 if (MD->isInstance())
1957 state = createTemporaryRegionIfNeeded(state, LCtx, BaseExpr);
1960 state = state->BindExpr(M, LCtx, MDVal);
1967 state = createTemporaryRegionIfNeeded(state, LCtx, BaseExpr);
1968 SVal baseExprVal = state->getSVal(BaseExpr, LCtx);
1970 FieldDecl *field = cast<FieldDecl>(Member);
1971 SVal L = state->getLValue(field, baseExprVal);
1983 llvm_unreachable(
"should always be wrapped in ArrayToPointerDecay");
1988 if (
const MemRegion *R = L.getAsRegion())
1989 L = state->getSVal(R);
1994 Bldr.
generateNode(M, *I, state->BindExpr(M, LCtx, L),
nullptr,
2008 class CollectReachableSymbolsCallback :
public SymbolVisitor {
2014 bool VisitSymbol(
SymbolRef Sym)
override {
2015 Symbols.insert(Sym);
2029 bool escapes =
true;
2033 escapes = !regionLoc->getRegion()->hasStackStorage();
2041 SVal StoredVal = State->getSVal(regionLoc->getRegion());
2042 if (StoredVal != Val)
2043 escapes = (State == (State->bindLoc(*regionLoc, Val)));
2055 CollectReachableSymbolsCallback Scanner =
2056 State->scanReachableSymbols<CollectReachableSymbolsCallback>(Val);
2075 if (!Invalidated || Invalidated->empty())
2089 E = ExplicitRegions.end(); I != E; ++I) {
2091 SymbolsDirectlyInvalidated.insert(R->getSymbol());
2095 for (InvalidatedSymbols::const_iterator I=Invalidated->begin(),
2096 E = Invalidated->end(); I!=E; ++I) {
2098 if (SymbolsDirectlyInvalidated.count(sym))
2100 SymbolsIndirectlyInvalidated.insert(sym);
2103 if (!SymbolsDirectlyInvalidated.empty())
2108 if (!SymbolsIndirectlyInvalidated.empty())
2130 StoreE, *
this, *PP);
2157 state = state->bindLoc(location.
castAs<
Loc>(),
2163 LocReg = LocRegVal->getRegion();
2180 const Expr *LocationE,
2186 const Expr *StoreE = AssignE ? AssignE : LocationE;
2190 evalLocation(Tmp, AssignE, LocationE, Pred, state, location, tag,
false);
2199 evalBind(Dst, StoreE, *NI, location, Val,
false);
2204 const Expr *BoundEx,
2211 assert(!location.
getAs<
NonLoc>() &&
"location cannot be a NonLoc.");
2217 dyn_cast_or_null<TypedValueRegion>(location.
getAsRegion())) {
2222 loadReferenceTag(TagProviderName,
"Load Reference");
2224 evalLoadCommon(Tmp, NodeEx, BoundEx, Pred, state,
2225 location, &loadReferenceTag,
2226 getContext().getPointerType(RT->getPointeeType()));
2230 state = (*I)->getState();
2231 location = state->getSVal(BoundEx, (*I)->getLocationContext());
2232 evalLoadCommon(Dst, NodeEx, BoundEx, *I, state, location, tag, LoadTy);
2238 evalLoadCommon(Dst, NodeEx, BoundEx, Pred, state, location, tag, LoadTy);
2243 const Expr *BoundEx,
2253 evalLocation(Tmp, NodeEx, BoundEx, Pred, state, location, tag,
true);
2263 state = (*NI)->getState();
2270 V = state->getSVal(location.
castAs<
Loc>(), LoadTy);
2273 Bldr.generateNode(NodeEx, *NI, state->BindExpr(BoundEx, LCtx, V), tag,
2280 const Stmt *BoundEx,
2293 BldrTop.takeNodes(Pred);
2306 Bldr.generateNode(NodeEx, Pred, state, &tag);
2310 NodeEx, BoundEx, *
this);
2311 BldrTop.addNodes(Tmp);
2314 std::pair<const ProgramPointTag *, const ProgramPointTag*>
2317 eagerlyAssumeBinOpBifurcationTrue(TagProviderName,
2318 "Eagerly Assume True"),
2319 eagerlyAssumeBinOpBifurcationFalse(TagProviderName,
2320 "Eagerly Assume False");
2321 return std::make_pair(&eagerlyAssumeBinOpBifurcationTrue,
2322 &eagerlyAssumeBinOpBifurcationFalse);
2343 if (SEV && SEV->isExpression()) {
2344 const std::pair<const ProgramPointTag *, const ProgramPointTag*> &tags =
2348 std::tie(StateTrue, StateFalse) = state->assume(*SEV);
2426 return "color=\"red\",style=\"filled\"";
2429 return "color=\"blue\",style=\"filled\"";
2447 llvm::raw_string_ostream Out(sbuf);
2454 Out <<
"Block Entrance: B"
2474 Out <<
"CallExitBegin";
2478 Out <<
"CallExitEnd";
2482 Out <<
"PostStmtPurgeDeadSymbols";
2486 Out <<
"PreStmtPurgeDeadSymbols";
2490 Out <<
"Epsilon Point";
2505 Out <<
"PostCall: ";
2514 Out <<
"PostInitializer: ";
2536 Out <<
"\\|Terminator: ";
2547 if (isa<SwitchStmt>(T)) {
2551 if (
const CaseStmt *
C = dyn_cast<CaseStmt>(Label)) {
2557 if (
const Stmt *RHS =
C->getRHS()) {
2565 assert (isa<DefaultStmt>(Label));
2566 Out <<
"\\ldefault:";
2570 Out <<
"\\l(implicit) default:";
2572 else if (isa<IndirectGotoStmt>(T)) {
2576 Out <<
"\\lCondition: ";
2590 Out <<
"\\|Control-flow based on\\lUndefined value.\\l";
2598 assert(S !=
nullptr &&
"Expecting non-null Stmt");
2600 Out << S->getStmtClassName() <<
' ' << (
const void*) S <<
' ';
2603 printLocation(Out, S->getLocStart());
2606 Out <<
"\\lPreStmt\\l;";
2608 Out <<
"\\lPostLoad\\l;";
2610 Out <<
"\\lPostStore\\l";
2612 Out <<
"\\lPostLValue\\l";
2618 Out <<
"\\|Implicit-Null Dereference.\\l";
2620 Out <<
"\\|Explicit-Null Dereference.\\l";
2622 Out <<
"\\|Dereference of undefialied value.\\l";
2624 Out <<
"\\|Store to Undefined Loc.";
2626 Out <<
"\\|Result of operation is undefined.";
2628 Out <<
"\\|Call to function marked \"noreturn\".";
2630 Out <<
"\\|Call to NULL/Undefined.";
2632 Out <<
"\\|Argument in call is undefined";
2640 Out <<
"\\|StateID: " << (
const void*) state.get()
2641 <<
" NodeID: " << (
const void*) N <<
"\\|";
2642 state->printDOT(Out);
2659 std::vector<const ExplodedNode*> Src;
2664 const_cast<BugType*>(*I)->FlushReports(BR);
2670 if (N) Src.push_back(N);
2692 std::unique_ptr<ExplodedGraph> TrimmedG(G.
trim(Nodes));
2694 if (!TrimmedG.get())
2695 llvm::errs() <<
"warning: Trimmed ExplodedGraph is empty.\n";
2697 llvm::ViewGraph(*TrimmedG->roots_begin(),
"TrimmedExprEngine");
A call to an overloaded operator written using operator syntax.
ValueDecl * getMemberDecl() const
Retrieve the member declaration to which this expression refers.
unsigned getNumArrayIndices() const
Determine the number of implicit array indices used while described an array member initialization...
CFGNewAllocator - Represents C++ allocator call.
TypedValueRegion - An abstract class representing regions having a typed value.
nonloc::ConcreteInt makeIntVal(const IntegerLiteral *integer)
void ProcessInitializer(const CFGInitializer I, ExplodedNode *Pred)
STATISTIC(NumRemoveDeadBindings,"The # of times RemoveDeadBindings is called")
ProgramStateRef getState() const
SVal evalDerivedToBase(SVal Derived, const CastExpr *Cast)
const CXXNewExpr * getAllocatorExpr() const
MemRegion - The root abstract class for all memory regions.
bool isVirtual() const
Determines whether the base class is a virtual base class (or not).
void markInfeasible(bool branch)
Expr * getArg(unsigned Arg)
getArg - Return the specified argument.
bool hasDeadSymbols() const
bool isMemberPointerType() const
QualType getType() const
Retrieves the type of the base class.
succ_iterator succ_begin()
CompoundStmt * getSubStmt()
void VisitCallExpr(const CallExpr *CE, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitCall - Transfer function for function calls.
Information about invalidation for a particular region/symbol.
const Expr * getCondition() const
This builder class is useful for generating nodes that resulted from visiting a statement. The main difference from its parent NodeBuilder is that it creates a statement specific ProgramPoint.
void VisitCXXBindTemporaryExpr(const CXXBindTemporaryExpr *BTE, ExplodedNodeSet &PreVisit, ExplodedNodeSet &Dst)
bool haveEqualStores(ProgramStateRef S1, ProgramStateRef S2)
Defines the SourceManager interface.
virtual bool inTopFrame() const
Return true if the current LocationContext has no caller context.
const LocationContext * getLocationContext() const
static const Stmt * getRightmostLeaf(const Stmt *Condition)
ProgramPoint getLocation() const
getLocation - Returns the edge associated with the given node.
void VisitMSAsmStmt(const MSAsmStmt *A, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitMSAsmStmt - Transfer function logic for MS inline asm.
virtual QualType getValueType() const =0
SourceLocation getLocStart() const LLVM_READONLY
Defines the PrettyStackTraceEntry class, which is used to make crashes give more contextual informati...
void runCheckersForEndFunction(NodeBuilderContext &BC, ExplodedNodeSet &Dst, ExplodedNode *Pred, ExprEngine &Eng)
Run checkers on end of function.
void printState(raw_ostream &Out, ProgramStateRef State, const char *NL, const char *Sep) override
printState - Called by ProgramStateManager to print checker-specific data.
const RegionTy * getAs() const
SVal evalBinOp(ProgramStateRef state, BinaryOperator::Opcode op, NonLoc L, NonLoc R, QualType T)
static ExprEngine * GraphPrintCheckerState
void processCleanupTemporaryBranch(const CXXBindTemporaryExpr *BTE, NodeBuilderContext &BldCtx, ExplodedNode *Pred, ExplodedNodeSet &Dst, const CFGBlock *DstT, const CFGBlock *DstF) override
const CXXDeleteExpr * getDeleteExpr() const
void ProcessMemberDtor(const CFGMemberDtor D, ExplodedNode *Pred, ExplodedNodeSet &Dst)
StorageDuration
The storage duration for an object (per C++ [basic.stc]).
static std::string getNodeLabel(const ExplodedNode *N, void *)
bool isCForbiddenLValueType() const
Determine whether expressions of the given type are forbidden from being lvalues in C...
Represents a C++ constructor within a class.
Represents a prvalue temporary that is written into memory so that a reference can bind to it...
Value representing integer constant.
void processCFGBlockEntrance(const BlockEdge &L, NodeBuilderWithSinks &nodeBuilder, ExplodedNode *Pred) override
Called by CoreEngine when processing the entrance of a CFGBlock.
bool haveEqualEnvironments(ProgramStateRef S1, ProgramStateRef S2)
const FieldDecl * getFieldDecl() const
ProgramStateRef getInitialState(const LocationContext *InitLoc) override
ImplTy::const_iterator const_iterator
void VisitUnaryOperator(const UnaryOperator *B, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitUnaryOperator - Transfer function logic for unary operators.
void takeNodes(const ExplodedNodeSet &S)
void markReachedMaxBlockCount(const Decl *D)
Expr * getInit() const
Get the initializer.
void printTerminator(raw_ostream &OS, const LangOptions &LO) const
printTerminator - A simple pretty printer of the terminator of a CFGBlock.
void ProcessDeleteDtor(const CFGDeleteDtor D, ExplodedNode *Pred, ExplodedNodeSet &Dst)
loc::MemRegionVal getCXXThis(const CXXMethodDecl *D, const StackFrameContext *SFC)
Return a memory region for the 'this' object reference.
uint64_t getTypeSize(QualType T) const
Return the size of the specified (complete) type T, in bits.
Expr * IgnoreImplicit() LLVM_READONLY
const internal::VariadicDynCastAllOfMatcher< Decl, VarDecl > varDecl
Matches variable declarations.
void evalStore(ExplodedNodeSet &Dst, const Expr *AssignE, const Expr *StoreE, ExplodedNode *Pred, ProgramStateRef St, SVal TargetLV, SVal Val, const ProgramPointTag *tag=nullptr)
void enqueue(ExplodedNodeSet &Set)
Enqueue the given set of nodes onto the work list.
roots_iterator roots_begin()
Describes how types, statements, expressions, and declarations should be printed. ...
Defines the Objective-C statement AST node classes.
void removeDead(ExplodedNode *Node, ExplodedNodeSet &Out, const Stmt *ReferenceStmt, const LocationContext *LC, const Stmt *DiagnosticStmt=nullptr, ProgramPoint::Kind K=ProgramPoint::PreStmtPurgeDeadSymbolsKind)
Run the analyzer's garbage collection - remove dead symbols and bindings from the state...
ProgramStateRef removeDeadBindings(ProgramStateRef St, const StackFrameContext *LCtx, SymbolReaper &SymReaper)
ParmVarDecl - Represents a parameter to a function.
void VisitCXXThisExpr(const CXXThisExpr *TE, ExplodedNode *Pred, ExplodedNodeSet &Dst)
BoundNodesTreeBuilder Nodes
void ProcessTemporaryDtor(const CFGTemporaryDtor D, ExplodedNode *Pred, ExplodedNodeSet &Dst)
bool isBaseInitializer() const
Determine whether this initializer is initializing a base class.
const Expr * getTarget() const
void runCheckersForLocation(ExplodedNodeSet &Dst, const ExplodedNodeSet &Src, SVal location, bool isLoad, const Stmt *NodeEx, const Stmt *BoundEx, ExprEngine &Eng)
Run checkers for load/store of a location.
Symbolic value. These values used to capture symbolic execution of the program.
const SwitchStmt * getSwitch() const
ProgramStateRef runCheckersForPointerEscape(ProgramStateRef State, const InvalidatedSymbols &Escaped, const CallEvent *Call, PointerEscapeKind Kind, RegionAndSymbolInvalidationTraits *ITraits)
Run checkers when pointers escape.
ImplTy::iterator iterator
Holds long-lived AST nodes (such as types and decls) that can be referred to throughout the semantic ...
void runCheckersForLiveSymbols(ProgramStateRef state, SymbolReaper &SymReaper)
Run checkers for live symbols.
bool isReferenceType() const
Represents a program point after a store evaluation.
void VisitCXXDestructor(QualType ObjectType, const MemRegion *Dest, const Stmt *S, bool IsBaseDtor, ExplodedNode *Pred, ExplodedNodeSet &Dst)
MemRegionManager & getRegionManager()
AnalysisDeclContext * getAnalysisDeclContext() const
const internal::VariadicAllOfMatcher< Decl > decl
Matches declarations.
T castAs() const
Convert to the specified CFGElement type, asserting that this CFGElement is of the desired type...
ASTContext & getContext() const
getContext - Return the ASTContext associated with this analysis.
void ProcessImplicitDtor(const CFGImplicitDtor D, ExplodedNode *Pred)
void addPredecessor(ExplodedNode *V, ExplodedGraph &G)
Keeps track of the various options that can be enabled, which controls the dialect of C or C++ that i...
void EndPath(ProgramStateRef St)
unsigned eagerlyAssumeBinOpBifurcation
The flag regulates if we should eagerly assume evaluations of conditionals, thus, bifurcating the pat...
const CXXBindTemporaryExpr * getBindTemporaryExpr() const
unsigned getExpansionColumnNumber(SourceLocation Loc, bool *Invalid=nullptr) const
static std::string getNodeAttributes(const ExplodedNode *N, void *)
static bool isRelationalOp(Opcode Opc)
static bool isLocType(QualType T)
void VisitOffsetOfExpr(const OffsetOfExpr *Ex, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitOffsetOfExpr - Transfer function for offsetof.
void processEndOfFunction(NodeBuilderContext &BC, ExplodedNode *Pred) override
ExplodedNodeSet::iterator iterator
static bool isEqualityOp(Opcode Opc)
ExplodedNode * generateSink(const Stmt *S, ExplodedNode *Pred, ProgramStateRef St, const ProgramPointTag *tag=nullptr, ProgramPoint::Kind K=ProgramPoint::PostStmtKind)
Expr * getTrueExpr() const
IndirectFieldDecl * getIndirectMember() const
unsigned getIndex() const
const VarDecl * getVarDecl() const
const CFGBlock * getCallSiteBlock() const
ExplodedNode * generateCaseStmtNode(const iterator &I, ProgramStateRef State)
bool isUnknownOrUndef() const
A builtin binary operation expression such as "x + y" or "x <= y".
const Stmt * getCallSite() const
llvm::FoldingSet< BugReportEquivClass >::iterator EQClasses_iterator
Iterator over the set of BugReports tracked by the BugReporter.
bool wantsRegionChangeUpdate(ProgramStateRef state)
True if at least one checker wants to check region changes.
void VisitReturnStmt(const ReturnStmt *R, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitReturnStmt - Transfer function logic for return statements.
DefinedSVal getFunctionPointer(const FunctionDecl *func)
bool isDelegatingInitializer() const
Determine whether this initializer is creating a delegating constructor.
void ProcessStmt(const CFGStmt S, ExplodedNode *Pred)
NonLoc makeIntValWithPtrWidth(uint64_t integer, bool isUnsigned)
void ProcessNewAllocator(const CXXNewExpr *NE, ExplodedNode *Pred)
void ProcessAutomaticObjDtor(const CFGAutomaticObjDtor D, ExplodedNode *Pred, ExplodedNodeSet &Dst)
QualType getDestroyedType() const
Retrieve the type being destroyed.
Represents binding an expression to a temporary.
ProgramStateRef getState() const
void VisitDeclStmt(const DeclStmt *DS, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitDeclStmt - Transfer function logic for DeclStmts.
const Stmt * getTriggerStmt() const
A default argument (C++ [dcl.fct.default]).
void evalBind(ExplodedNodeSet &Dst, const Stmt *StoreE, ExplodedNode *Pred, SVal location, SVal Val, bool atDeclInit=false, const ProgramPoint *PP=nullptr)
void VisitLogicalExpr(const BinaryOperator *B, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitLogicalExpr - Transfer function logic for '&&', '||'.
const LocationContext * getLocationContext() const
const CFGBlock * getSrc() const
void runCheckersForPrintState(raw_ostream &Out, ProgramStateRef State, const char *NL, const char *Sep)
Run checkers for debug-printing a ProgramState.
void removeDeadOnEndOfFunction(NodeBuilderContext &BC, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Remove dead bindings/symbols before exiting a function.
void runCheckersForBind(ExplodedNodeSet &Dst, const ExplodedNodeSet &Src, SVal location, SVal val, const Stmt *S, ExprEngine &Eng, const ProgramPoint &PP)
Run checkers for binding of a value to a location.
static SourceManager * GraphPrintSourceManager
void VisitCXXCatchStmt(const CXXCatchStmt *CS, ExplodedNode *Pred, ExplodedNodeSet &Dst)
void VisitInitListExpr(const InitListExpr *E, ExplodedNode *Pred, ExplodedNodeSet &Dst)
unsigned blockCount() const
Returns the number of times the current basic block has been visited on the exploded graph path...
const MemRegion * StripCasts(bool StripBaseCasts=true) const
CheckerManager & getCheckerManager() const
QualType getPointeeType() const
InliningModes
The modes of inlining, which override the default analysis-wide settings.
void runCheckersForPostStmt(ExplodedNodeSet &Dst, const ExplodedNodeSet &Src, const Stmt *S, ExprEngine &Eng, bool wasInlined=false)
Run checkers for post-visiting Stmts.
const CFGBlock * getDst() const
void ProcessBaseDtor(const CFGBaseDtor D, ExplodedNode *Pred, ExplodedNodeSet &Dst)
DefinedOrUnknownSVal makeZeroVal(QualType type)
Construct an SVal representing '0' for the specified type.
void processSwitch(SwitchNodeBuilder &builder) override
const ProgramStateRef & getState() const
void VisitLvalObjCIvarRefExpr(const ObjCIvarRefExpr *DR, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Transfer function logic for computing the lvalue of an Objective-C ivar.
StringRef getName() const
Return the actual identifier string.
void VisitCXXNewExpr(const CXXNewExpr *CNE, ExplodedNode *Pred, ExplodedNodeSet &Dst)
void VisitCXXNewAllocatorCall(const CXXNewExpr *CNE, ExplodedNode *Pred, ExplodedNodeSet &Dst)
const Stmt * getStmt() const
void VisitCast(const CastExpr *CastE, const Expr *Ex, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitCast - Transfer function logic for all casts (implicit and explicit).
Represents a C++ destructor within a class.
This is the simplest builder which generates nodes in the ExplodedGraph.
CXXCtorInitializer * getInitializer() const
Optional< T > getAs() const
Convert to the specified SVal type, returning None if this SVal is not of the desired type...
The pointer has been passed to a function call directly.
std::pair< const CXXBindTemporaryExpr *, const StackFrameContext * > CXXBindTemporaryContext
virtual StringRef getTagDescription() const =0
unsigned getExpansionLineNumber(SourceLocation Loc, bool *Invalid=nullptr) const
void Visit(const Stmt *S, ExplodedNode *Pred, ExplodedNodeSet &Dst)
static SVal getValue(SVal val, SValBuilder &svalBuilder)
void FlushReports()
Generate and flush diagnostics for all bug reports.
std::pair< const ProgramPointTag *, const ProgramPointTag * > geteagerlyAssumeBinOpBifurcationTags()
void print(raw_ostream &OS, const PrintingPolicy &Policy, const Twine &PlaceHolder=Twine()) const
void enqueueStmtNode(ExplodedNode *N, const CFGBlock *Block, unsigned Idx)
Enqueue a single node created as a result of statement processing.
bool isIndirectMemberInitializer() const
T castAs() const
Convert to the specified ProgramPoint type, asserting that this ProgramPoint is of the desired type...
const LocationContext * getLocationContext() const
unsigned getBlockID() const
StoreManager & getStoreManager()
ExplodedNode * getNode(const ProgramPoint &L, ProgramStateRef State, bool IsSink=false, bool *IsNew=nullptr)
Retrieve the node associated with a (Location,State) pair, where the 'Location' is a ProgramPoint in ...
void evalLoad(ExplodedNodeSet &Dst, const Expr *NodeEx, const Expr *BoundExpr, ExplodedNode *Pred, ProgramStateRef St, SVal location, const ProgramPointTag *tag=nullptr, QualType LoadTy=QualType())
Simulate a read of the result of Ex.
QualType getConditionType() const
reverse_iterator rbegin()
virtual ProgramStateRef removeDeadBindings(ProgramStateRef state, SymbolReaper &SymReaper)=0
ExplodedNode * generateNode(const iterator &I, ProgramStateRef State, bool isSink=false)
void VisitLvalArraySubscriptExpr(const ArraySubscriptExpr *Ex, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitArraySubscriptExpr - Transfer function for array accesses.
Stmt * getBody(const FunctionDecl *&Definition) const
static const Stmt * ResolveCondition(const Stmt *Condition, const CFGBlock *B)
void enqueueEndOfFunction(ExplodedNodeSet &Set)
enqueue the nodes corresponding to the end of function onto the end of path / work list...
bool isConsumedExpr(Expr *E) const
CFGTerminator getTerminator()
bool wantsRegionChangeUpdate(ProgramStateRef state) override
void processCFGElement(const CFGElement E, ExplodedNode *Pred, unsigned StmtIdx, NodeBuilderContext *Ctx) override
bool isIntegralOrEnumerationType() const
Determine whether this type is an integral or enumeration type.
ProgramStateRef getInitialState(const LocationContext *InitLoc)
ProgramStateRef processPointerEscapedOnBind(ProgramStateRef State, SVal Loc, SVal Val) override
Call PointerEscape callback when a value escapes as a result of bind.
void VisitGuardedExpr(const Expr *Ex, const Expr *L, const Expr *R, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitGuardedExpr - Transfer function logic for ?, __builtin_choose.
EQClasses_iterator EQClasses_begin()
Encodes a location in the source. The SourceManager can decode this to get at the full include stack...
DefinedOrUnknownSVal conjureSymbolVal(const void *symbolTag, const Expr *expr, const LocationContext *LCtx, unsigned count)
Create a new symbol with a unique 'name'.
const StackFrameContext * getCurrentStackFrame() const
void runCheckersForBranchCondition(const Stmt *condition, ExplodedNodeSet &Dst, ExplodedNode *Pred, ExprEngine &Eng)
Run checkers for branch condition.
FieldDecl * getAnyMember() const
static bool isCallStmt(const Stmt *S)
Returns true if this is a statement is a function or method call of some kind.
AnalysisManager & getAnalysisManager() override
void evalEagerlyAssumeBinOpBifurcation(ExplodedNodeSet &Dst, ExplodedNodeSet &Src, const Expr *Ex)
Represents a new-expression for memory allocation and constructor calls, e.g: "new CXXNewExpr(foo)"...
void VisitCompoundLiteralExpr(const CompoundLiteralExpr *CL, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitCompoundLiteralExpr - Transfer function logic for compound literals.
const Expr * getCond() const
bool isTemporaryDtorsBranch() const
llvm::APSInt EvaluateKnownConstInt(const ASTContext &Ctx, SmallVectorImpl< PartialDiagnosticAt > *Diag=nullptr) const
static void printLocation(raw_ostream &Out, SourceLocation SLoc)
void processIndirectGoto(IndirectGotoNodeBuilder &builder) override
const CXXTempObjectRegion * getCXXTempObjectRegion(Expr const *Ex, LocationContext const *LC)
SourceLocation getLocStart() const LLVM_READONLY
Represents a static or instance method of a struct/union/class.
BugTypesTy::iterator iterator
Iterator over the set of BugTypes tracked by the BugReporter.
const Stmt * getStmt() const
void VisitCXXDeleteExpr(const CXXDeleteExpr *CDE, ExplodedNode *Pred, ExplodedNodeSet &Dst)
SourceLocation getSourceLocation() const
Determine the source location of the initializer.
void processBranch(const Stmt *Condition, const Stmt *Term, NodeBuilderContext &BuilderCtx, ExplodedNode *Pred, ExplodedNodeSet &Dst, const CFGBlock *DstT, const CFGBlock *DstF) override
void VisitUnaryExprOrTypeTraitExpr(const UnaryExprOrTypeTraitExpr *Ex, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitUnaryExprOrTypeTraitExpr - Transfer function for sizeof.
ProgramStateRef runCheckersForEvalAssume(ProgramStateRef state, SVal Cond, bool Assumption)
Run checkers for handling assumptions on symbolic values.
AnalyzerOptions & options
void VisitObjCForCollectionStmt(const ObjCForCollectionStmt *S, ExplodedNode *Pred, ExplodedNodeSet &Dst)
const Decl * getDecl() const
A class responsible for cleaning up unused symbols.
bool isAllEnumCasesCovered() const
static bool isLogicalOp(Opcode Opc)
BasicValueFactory & getBasicVals()
void runCheckersForPreStmt(ExplodedNodeSet &Dst, const ExplodedNodeSet &Src, const Stmt *S, ExprEngine &Eng)
Run checkers for pre-visiting Stmts.
ProgramStateRef getPersistentStateWithGDM(ProgramStateRef FromState, ProgramStateRef GDMState)
QualType getType() const
Return the type wrapped by this type source info.
void insert(const ExplodedNodeSet &S)
unsigned maxBlockVisitOnPath
The maximum number of times the analyzer visits a block.
std::unique_ptr< ExplodedGraph > trim(ArrayRef< const NodeTy * > Nodes, InterExplodedGraphMap *ForwardMap=nullptr, InterExplodedGraphMap *InverseMap=nullptr) const
ast_type_traits::DynTypedNode Node
Expr * getResultExpr()
Return the result-bearing expression, or null if there is none.
TypeSourceInfo * getTypeSourceInfo() const
Returns the declarator information for a base class or delegating initializer.
void runCheckersForDeadSymbols(ExplodedNodeSet &Dst, const ExplodedNodeSet &Src, SymbolReaper &SymReaper, const Stmt *S, ExprEngine &Eng, ProgramPoint::Kind K)
Run checkers for dead symbols.
const LocationContext * getParent() const
ExplodedNode * generateDefaultCaseNode(ProgramStateRef State, bool isSink=false)
SValBuilder & getSValBuilder()
Represents a delete expression for memory deallocation and destructor calls, e.g. "delete[] pArray"...
void addNodes(const ExplodedNodeSet &S)
StoreManager & getStoreManager()
const LocationContext * getLocationContext() const
CXXDestructorDecl * getDestructor() const
Returns the destructor decl for this class.
const NodeBuilderContext & getContext()
This node builder keeps track of the generated sink nodes.
bool isPurgeKind()
Is this a program point corresponding to purge/removal of dead symbols and bindings.
void reclaimRecentlyAllocatedNodes()
SourceLocation getLocation() const
Represents symbolic expression.
ProgramStateRef notifyCheckersOfPointerEscape(ProgramStateRef State, const InvalidatedSymbols *Invalidated, ArrayRef< const MemRegion * > ExplicitRegions, ArrayRef< const MemRegion * > Regions, const CallEvent *Call, RegionAndSymbolInvalidationTraits &ITraits) override
DOTGraphTraits(bool isSimple=false)
const MemRegion * getAsRegion() const
BranchNodeBuilder is responsible for constructing the nodes corresponding to the two branches of the ...
FieldDecl * getMember() const
If this is a member initializer, returns the declaration of the non-static data member being initiali...
Represents an abstract call to a function or method along a particular path.
Optional< T > getAs() const
Convert to the specified ProgramPoint type, returning None if this ProgramPoint is not of the desired...
ProgramStateManager & getStateManager() override
const CFGBlock * getBlock() const
Return the CFGBlock associated with this builder.
Expr * IgnoreParenImpCasts() LLVM_READONLY
const CXXTempObjectRegion * getCXXStaticTempObjectRegion(const Expr *Ex)
QualType getLocalUnqualifiedType() const
Return this type with all of the instance-specific qualifiers removed, but without removing any quali...
const Decl * getDecl() const
void print(raw_ostream &Out, unsigned Indentation=0, bool PrintInstantiation=false) const
void runCheckersForEndAnalysis(ExplodedGraph &G, BugReporter &BR, ExprEngine &Eng)
Run checkers for end of analysis.
FunctionDecl * getOperatorNew() const
Expr * getFalseExpr() const
ArraySubscriptExpr - [C99 6.5.2.1] Array Subscripting.
ExplodedNode * generateSink(ProgramStateRef State, ExplodedNode *Pred, const ProgramPointTag *Tag=nullptr)
Represents a C++ base or member initializer.
void VisitCXXConstructExpr(const CXXConstructExpr *E, ExplodedNode *Pred, ExplodedNodeSet &Dst)
void VisitObjCAtSynchronizedStmt(const ObjCAtSynchronizedStmt *S, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Transfer function logic for ObjCAtSynchronizedStmts.
void VisitObjCMessage(const ObjCMessageExpr *ME, ExplodedNode *Pred, ExplodedNodeSet &Dst)
EQClasses_iterator EQClasses_end()
CXXRecordDecl * getAsCXXRecordDecl() const
Retrieves the CXXRecordDecl that this type refers to, either because the type is a RecordType or beca...
Represents a base class of a C++ class.
bool isAnyMemberInitializer() const
SourceManager & getSourceManager()
void addAbortedBlock(const ExplodedNode *node, const CFGBlock *block)
const StackFrameContext * getStackFrame() const
A use of a default initializer in a constructor or in aggregate initialization.
ExplodedNode * generateNode(const ProgramPoint &PP, ProgramStateRef State, ExplodedNode *Pred)
Generates a node in the ExplodedGraph.
void VisitBlockExpr(const BlockExpr *BE, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitBlockExpr - Transfer function logic for BlockExprs.
REGISTER_TRAIT_WITH_PROGRAMSTATE(InitializedTemporariesSet, llvm::ImmutableSet< CXXBindTemporaryContext >) static const char *TagProviderName
const ProgramPointTag * getTag() const
unsigned NoRetryExhausted
Do not re-analyze paths leading to exhausted nodes with a different strategy. We get better code cove...
ProgramStateRef runCheckersForRegionChanges(ProgramStateRef state, const InvalidatedSymbols *invalidated, ArrayRef< const MemRegion * > ExplicitRegions, ArrayRef< const MemRegion * > Regions, const CallEvent *Call)
Run checkers for region changes.
Represents a C++ struct/union/class.
DefinedOrUnknownSVal evalEQ(ProgramStateRef state, DefinedOrUnknownSVal lhs, DefinedOrUnknownSVal rhs)
reverse_body_iterator body_rbegin()
Optional< SVal > getConstantVal(const Expr *E)
pred_iterator pred_begin()
ExplodedNode * generateNode(ProgramStateRef State, bool branch, ExplodedNode *Pred)
CFGElement - Represents a top-level expression in a basic block.
ProgramStateRef processAssume(ProgramStateRef state, SVal cond, bool assumption) override
ExplodedNode * generateNode(const Stmt *S, ExplodedNode *Pred, ProgramStateRef St, const ProgramPointTag *tag=nullptr, ProgramPoint::Kind K=ProgramPoint::PostStmtKind)
void processEndWorklist(bool hasWorkRemaining) override
Called by CoreEngine when the analysis worklist has terminated.
void VisitCommonDeclRefExpr(const Expr *DR, const NamedDecl *D, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Transfer function logic for DeclRefExprs and BlockDeclRefExprs.
const LangOptions & getLangOpts() const
A reference to a declared variable, function, enum, etc. [C99 6.5.1p2].
static bool shouldRemoveDeadBindings(AnalysisManager &AMgr, const CFGStmt S, const ExplodedNode *Pred, const LocationContext *LC)
const Expr * getSubExpr() const
void VisitGCCAsmStmt(const GCCAsmStmt *A, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitGCCAsmStmt - Transfer function logic for inline asm.
bool mayInlineCXXAllocator()
void VisitMemberExpr(const MemberExpr *M, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitMemberExpr - Transfer function for member expressions.
ParentMap & getParentMap()
AnalysisPurgeMode AnalysisPurgeOpt
void ViewGraph(bool trim=false)
Visualize the ExplodedGraph created by executing the simulation.
ConstraintManager & getConstraintManager()
void VisitBinaryOperator(const BinaryOperator *B, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitBinaryOperator - Transfer function logic for binary operators.
const CXXBaseSpecifier * getBaseSpecifier() const
bool isNull() const
isNull - Return true if this QualType doesn't point to a type yet.
bool isFeasible(bool branch)
T castAs() const
Convert to the specified SVal type, asserting that this SVal is of the desired type.
static SVal RecoverCastedSymbol(ProgramStateManager &StateMgr, ProgramStateRef state, const Stmt *Condition, const LocationContext *LCtx, ASTContext &Ctx)
void CreateCXXTemporaryObject(const MaterializeTemporaryExpr *ME, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Create a C++ temporary object for an rvalue.
const MemRegion * getRegion() const
Get the underlining region.
This class handles loading and caching of source files into memory.
QualType getBaseElementType(const ArrayType *VAT) const
Return the innermost element type of an array type.
Defines enum values for all the target-independent builtin functions.
Optional< T > getAs() const
Convert to the specified CFGElement type, returning None if this CFGElement is not of the desired typ...
Expr * IgnoreParens() LLVM_READONLY
ProgramStateRef processRegionChanges(ProgramStateRef state, const InvalidatedSymbols *invalidated, ArrayRef< const MemRegion * > ExplicitRegions, ArrayRef< const MemRegion * > Regions, const CallEvent *Call) override