clang  3.7.0
CoreEngine.h
Go to the documentation of this file.
1 //==- CoreEngine.h - Path-Sensitive Dataflow Engine ----------------*- C++ -*-//
2 //
3 // The LLVM Compiler Infrastructure
4 //
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
7 //
8 //===----------------------------------------------------------------------===//
9 //
10 // This file defines a generic engine for intraprocedural, path-sensitive,
11 // dataflow analysis via graph reachability.
12 //
13 //===----------------------------------------------------------------------===//
14 
15 #ifndef LLVM_CLANG_STATICANALYZER_CORE_PATHSENSITIVE_COREENGINE_H
16 #define LLVM_CLANG_STATICANALYZER_CORE_PATHSENSITIVE_COREENGINE_H
17 
18 #include "clang/AST/Expr.h"
24 #include <memory>
25 
26 namespace clang {
27 
28 class ProgramPointTag;
29 
30 namespace ento {
31 
32 class NodeBuilder;
33 
34 //===----------------------------------------------------------------------===//
35 /// CoreEngine - Implements the core logic of the graph-reachability
36 /// analysis. It traverses the CFG and generates the ExplodedGraph.
37 /// Program "states" are treated as opaque void pointers.
38 /// The template class CoreEngine (which subclasses CoreEngine)
39 /// provides the matching component to the engine that knows the actual types
40 /// for states. Note that this engine only dispatches to transfer functions
41 /// at the statement and block-level. The analyses themselves must implement
42 /// any transfer function logic and the sub-expression level (if any).
43 class CoreEngine {
44  friend struct NodeBuilderContext;
45  friend class NodeBuilder;
46  friend class ExprEngine;
47  friend class CommonNodeBuilder;
49  friend class SwitchNodeBuilder;
51 public:
52  typedef std::vector<std::pair<BlockEdge, const ExplodedNode*> >
54 
55  typedef std::vector<std::pair<const CFGBlock*, const ExplodedNode*> >
57 
58 private:
59 
60  SubEngine& SubEng;
61 
62  /// G - The simulation graph. Each node is a (location,state) pair.
63  mutable ExplodedGraph G;
64 
65  /// WList - A set of queued nodes that need to be processed by the
66  /// worklist algorithm. It is up to the implementation of WList to decide
67  /// the order that nodes are processed.
68  std::unique_ptr<WorkList> WList;
69 
70  /// BCounterFactory - A factory object for created BlockCounter objects.
71  /// These are used to record for key nodes in the ExplodedGraph the
72  /// number of times different CFGBlocks have been visited along a path.
73  BlockCounter::Factory BCounterFactory;
74 
75  /// The locations where we stopped doing work because we visited a location
76  /// too many times.
77  BlocksExhausted blocksExhausted;
78 
79  /// The locations where we stopped because the engine aborted analysis,
80  /// usually because it could not reason about something.
81  BlocksAborted blocksAborted;
82 
83  /// The information about functions shared by the whole translation unit.
84  /// (This data is owned by AnalysisConsumer.)
85  FunctionSummariesTy *FunctionSummaries;
86 
87  void generateNode(const ProgramPoint &Loc,
89  ExplodedNode *Pred);
90 
91  void HandleBlockEdge(const BlockEdge &E, ExplodedNode *Pred);
92  void HandleBlockEntrance(const BlockEntrance &E, ExplodedNode *Pred);
93  void HandleBlockExit(const CFGBlock *B, ExplodedNode *Pred);
94  void HandlePostStmt(const CFGBlock *B, unsigned StmtIdx, ExplodedNode *Pred);
95 
96  void HandleBranch(const Stmt *Cond, const Stmt *Term, const CFGBlock *B,
97  ExplodedNode *Pred);
98  void HandleCleanupTemporaryBranch(const CXXBindTemporaryExpr *BTE,
99  const CFGBlock *B, ExplodedNode *Pred);
100 
101  /// Handle conditional logic for running static initializers.
102  void HandleStaticInit(const DeclStmt *DS, const CFGBlock *B,
103  ExplodedNode *Pred);
104 
105 private:
106  CoreEngine(const CoreEngine &) = delete;
107  void operator=(const CoreEngine &) = delete;
108 
109  ExplodedNode *generateCallExitBeginNode(ExplodedNode *N);
110 
111 public:
112  /// Construct a CoreEngine object to analyze the provided CFG.
114  : SubEng(subengine), WList(WorkList::makeDFS()),
115  BCounterFactory(G.getAllocator()), FunctionSummaries(FS) {}
116 
117  /// getGraph - Returns the exploded graph.
118  ExplodedGraph &getGraph() { return G; }
119 
120  /// ExecuteWorkList - Run the worklist algorithm for a maximum number of
121  /// steps. Returns true if there is still simulation state on the worklist.
122  bool ExecuteWorkList(const LocationContext *L, unsigned Steps,
123  ProgramStateRef InitState);
124  /// Returns true if there is still simulation state on the worklist.
126  unsigned Steps,
127  ProgramStateRef InitState,
128  ExplodedNodeSet &Dst);
129 
130  /// Dispatch the work list item based on the given location information.
131  /// Use Pred parameter as the predecessor state.
133  const WorkListUnit& WU);
134 
135  // Functions for external checking of whether we have unfinished work
136  bool wasBlockAborted() const { return !blocksAborted.empty(); }
137  bool wasBlocksExhausted() const { return !blocksExhausted.empty(); }
138  bool hasWorkRemaining() const { return wasBlocksExhausted() ||
139  WList->hasWork() ||
140  wasBlockAborted(); }
141 
142  /// Inform the CoreEngine that a basic block was aborted because
143  /// it could not be completely analyzed.
144  void addAbortedBlock(const ExplodedNode *node, const CFGBlock *block) {
145  blocksAborted.push_back(std::make_pair(block, node));
146  }
147 
148  WorkList *getWorkList() const { return WList.get(); }
149 
150  BlocksExhausted::const_iterator blocks_exhausted_begin() const {
151  return blocksExhausted.begin();
152  }
153  BlocksExhausted::const_iterator blocks_exhausted_end() const {
154  return blocksExhausted.end();
155  }
156  BlocksAborted::const_iterator blocks_aborted_begin() const {
157  return blocksAborted.begin();
158  }
159  BlocksAborted::const_iterator blocks_aborted_end() const {
160  return blocksAborted.end();
161  }
162 
163  /// \brief Enqueue the given set of nodes onto the work list.
164  void enqueue(ExplodedNodeSet &Set);
165 
166  /// \brief Enqueue nodes that were created as a result of processing
167  /// a statement onto the work list.
168  void enqueue(ExplodedNodeSet &Set, const CFGBlock *Block, unsigned Idx);
169 
170  /// \brief enqueue the nodes corresponding to the end of function onto the
171  /// end of path / work list.
173 
174  /// \brief Enqueue a single node created as a result of statement processing.
175  void enqueueStmtNode(ExplodedNode *N, const CFGBlock *Block, unsigned Idx);
176 };
177 
178 // TODO: Turn into a calss.
180  const CoreEngine &Eng;
181  const CFGBlock *Block;
184  : Eng(E), Block(B), LC(N->getLocationContext()) { assert(B); }
185 
186  /// \brief Return the CFGBlock associated with this builder.
187  const CFGBlock *getBlock() const { return Block; }
188 
189  /// \brief Returns the number of times the current basic block has been
190  /// visited on the exploded graph path.
191  unsigned blockCount() const {
192  return Eng.WList->getBlockCounter().getNumVisited(
194  Block->getBlockID());
195  }
196 };
197 
198 /// \class NodeBuilder
199 /// \brief This is the simplest builder which generates nodes in the
200 /// ExplodedGraph.
201 ///
202 /// The main benefit of the builder is that it automatically tracks the
203 /// frontier nodes (or destination set). This is the set of nodes which should
204 /// be propagated to the next step / builder. They are the nodes which have been
205 /// added to the builder (either as the input node set or as the newly
206 /// constructed nodes) but did not have any outgoing transitions added.
207 class NodeBuilder {
208  virtual void anchor();
209 protected:
211 
212  /// Specifies if the builder results have been finalized. For example, if it
213  /// is set to false, autotransitions are yet to be generated.
214  bool Finalized;
216  /// \brief The frontier set - a set of nodes which need to be propagated after
217  /// the builder dies.
219 
220  /// Checkes if the results are ready.
221  virtual bool checkResults() {
222  if (!Finalized)
223  return false;
224  return true;
225  }
226 
228  for (iterator I = Frontier.begin(), E = Frontier.end(); I != E; ++I) {
229  if ((*I)->isSink())
230  return false;
231  }
232  return true;
233  }
234 
235  /// Allow subclasses to finalize results before result_begin() is executed.
236  virtual void finalizeResults() {}
237 
240  ExplodedNode *Pred,
241  bool MarkAsSink = false);
242 
243 public:
245  const NodeBuilderContext &Ctx, bool F = true)
246  : C(Ctx), Finalized(F), HasGeneratedNodes(false), Frontier(DstSet) {
247  Frontier.Add(SrcNode);
248  }
249 
251  const NodeBuilderContext &Ctx, bool F = true)
252  : C(Ctx), Finalized(F), HasGeneratedNodes(false), Frontier(DstSet) {
253  Frontier.insert(SrcSet);
254  assert(hasNoSinksInFrontier());
255  }
256 
257  virtual ~NodeBuilder() {}
258 
259  /// \brief Generates a node in the ExplodedGraph.
262  ExplodedNode *Pred) {
263  return generateNodeImpl(PP, State, Pred, false);
264  }
265 
266  /// \brief Generates a sink in the ExplodedGraph.
267  ///
268  /// When a node is marked as sink, the exploration from the node is stopped -
269  /// the node becomes the last node on the path and certain kinds of bugs are
270  /// suppressed.
273  ExplodedNode *Pred) {
274  return generateNodeImpl(PP, State, Pred, true);
275  }
276 
278  finalizeResults();
279  assert(checkResults());
280  return Frontier;
281  }
282 
284  /// \brief Iterators through the results frontier.
285  inline iterator begin() {
286  finalizeResults();
287  assert(checkResults());
288  return Frontier.begin();
289  }
290  inline iterator end() {
291  finalizeResults();
292  return Frontier.end();
293  }
294 
295  const NodeBuilderContext &getContext() { return C; }
297 
298  void takeNodes(const ExplodedNodeSet &S) {
299  for (ExplodedNodeSet::iterator I = S.begin(), E = S.end(); I != E; ++I )
300  Frontier.erase(*I);
301  }
303  void addNodes(const ExplodedNodeSet &S) { Frontier.insert(S); }
305 };
306 
307 /// \class NodeBuilderWithSinks
308 /// \brief This node builder keeps track of the generated sink nodes.
310  void anchor() override;
311 protected:
314 
315 public:
317  const NodeBuilderContext &Ctx, ProgramPoint &L)
318  : NodeBuilder(Pred, DstSet, Ctx), Location(L) {}
319 
321  ExplodedNode *Pred,
322  const ProgramPointTag *Tag = nullptr) {
323  const ProgramPoint &LocalLoc = (Tag ? Location.withTag(Tag) : Location);
324  return NodeBuilder::generateNode(LocalLoc, State, Pred);
325  }
326 
328  const ProgramPointTag *Tag = nullptr) {
329  const ProgramPoint &LocalLoc = (Tag ? Location.withTag(Tag) : Location);
330  ExplodedNode *N = NodeBuilder::generateSink(LocalLoc, State, Pred);
331  if (N && N->isSink())
332  sinksGenerated.push_back(N);
333  return N;
334  }
335 
337  return sinksGenerated;
338  }
339 };
340 
341 /// \class StmtNodeBuilder
342 /// \brief This builder class is useful for generating nodes that resulted from
343 /// visiting a statement. The main difference from its parent NodeBuilder is
344 /// that it creates a statement specific ProgramPoint.
346  NodeBuilder *EnclosingBldr;
347 public:
348 
349  /// \brief Constructs a StmtNodeBuilder. If the builder is going to process
350  /// nodes currently owned by another builder(with larger scope), use
351  /// Enclosing builder to transfer ownership.
353  const NodeBuilderContext &Ctx,
354  NodeBuilder *Enclosing = nullptr)
355  : NodeBuilder(SrcNode, DstSet, Ctx), EnclosingBldr(Enclosing) {
356  if (EnclosingBldr)
357  EnclosingBldr->takeNodes(SrcNode);
358  }
359 
361  const NodeBuilderContext &Ctx,
362  NodeBuilder *Enclosing = nullptr)
363  : NodeBuilder(SrcSet, DstSet, Ctx), EnclosingBldr(Enclosing) {
364  if (EnclosingBldr)
365  for (ExplodedNodeSet::iterator I = SrcSet.begin(),
366  E = SrcSet.end(); I != E; ++I )
367  EnclosingBldr->takeNodes(*I);
368  }
369 
370  ~StmtNodeBuilder() override;
371 
374 
376  ExplodedNode *Pred,
377  ProgramStateRef St,
378  const ProgramPointTag *tag = nullptr,
381  Pred->getLocationContext(), tag);
382  return NodeBuilder::generateNode(L, St, Pred);
383  }
384 
386  ExplodedNode *Pred,
387  ProgramStateRef St,
388  const ProgramPointTag *tag = nullptr,
391  Pred->getLocationContext(), tag);
392  return NodeBuilder::generateSink(L, St, Pred);
393  }
394 };
395 
396 /// \brief BranchNodeBuilder is responsible for constructing the nodes
397 /// corresponding to the two branches of the if statement - true and false.
399  void anchor() override;
400  const CFGBlock *DstT;
401  const CFGBlock *DstF;
402 
403  bool InFeasibleTrue;
404  bool InFeasibleFalse;
405 
406 public:
408  const NodeBuilderContext &C,
409  const CFGBlock *dstT, const CFGBlock *dstF)
410  : NodeBuilder(SrcNode, DstSet, C), DstT(dstT), DstF(dstF),
411  InFeasibleTrue(!DstT), InFeasibleFalse(!DstF) {
412  // The branch node builder does not generate autotransitions.
413  // If there are no successors it means that both branches are infeasible.
414  takeNodes(SrcNode);
415  }
416 
418  const NodeBuilderContext &C,
419  const CFGBlock *dstT, const CFGBlock *dstF)
420  : NodeBuilder(SrcSet, DstSet, C), DstT(dstT), DstF(dstF),
421  InFeasibleTrue(!DstT), InFeasibleFalse(!DstF) {
422  takeNodes(SrcSet);
423  }
424 
426  ExplodedNode *Pred);
427 
428  const CFGBlock *getTargetBlock(bool branch) const {
429  return branch ? DstT : DstF;
430  }
431 
432  void markInfeasible(bool branch) {
433  if (branch)
434  InFeasibleTrue = true;
435  else
436  InFeasibleFalse = true;
437  }
438 
439  bool isFeasible(bool branch) {
440  return branch ? !InFeasibleTrue : !InFeasibleFalse;
441  }
442 };
443 
445  CoreEngine& Eng;
446  const CFGBlock *Src;
447  const CFGBlock &DispatchBlock;
448  const Expr *E;
449  ExplodedNode *Pred;
450 
451 public:
453  const Expr *e, const CFGBlock *dispatch, CoreEngine* eng)
454  : Eng(*eng), Src(src), DispatchBlock(*dispatch), E(e), Pred(pred) {}
455 
456  class iterator {
458 
461  public:
462 
463  iterator &operator++() { ++I; return *this; }
464  bool operator!=(const iterator &X) const { return I != X.I; }
465 
466  const LabelDecl *getLabel() const {
467  return cast<LabelStmt>((*I)->getLabel())->getDecl();
468  }
469 
470  const CFGBlock *getBlock() const {
471  return *I;
472  }
473  };
474 
475  iterator begin() { return iterator(DispatchBlock.succ_begin()); }
476  iterator end() { return iterator(DispatchBlock.succ_end()); }
477 
478  ExplodedNode *generateNode(const iterator &I,
480  bool isSink = false);
481 
482  const Expr *getTarget() const { return E; }
483 
484  ProgramStateRef getState() const { return Pred->State; }
485 
487  return Pred->getLocationContext();
488  }
489 };
490 
492  CoreEngine& Eng;
493  const CFGBlock *Src;
494  const Expr *Condition;
495  ExplodedNode *Pred;
496 
497 public:
499  const Expr *condition, CoreEngine* eng)
500  : Eng(*eng), Src(src), Condition(condition), Pred(pred) {}
501 
502  class iterator {
504 
505  friend class SwitchNodeBuilder;
507 
508  public:
509  iterator &operator++() { ++I; return *this; }
510  bool operator!=(const iterator &X) const { return I != X.I; }
511  bool operator==(const iterator &X) const { return I == X.I; }
512 
513  const CaseStmt *getCase() const {
514  return cast<CaseStmt>((*I)->getLabel());
515  }
516 
517  const CFGBlock *getBlock() const {
518  return *I;
519  }
520  };
521 
522  iterator begin() { return iterator(Src->succ_rbegin()+1); }
523  iterator end() { return iterator(Src->succ_rend()); }
524 
525  const SwitchStmt *getSwitch() const {
526  return cast<SwitchStmt>(Src->getTerminator());
527  }
528 
529  ExplodedNode *generateCaseStmtNode(const iterator &I,
531 
533  bool isSink = false);
534 
535  const Expr *getCondition() const { return Condition; }
536 
537  ProgramStateRef getState() const { return Pred->State; }
538 
540  return Pred->getLocationContext();
541  }
542 };
543 
544 } // end ento namespace
545 } // end clang namespace
546 
547 #endif
succ_reverse_iterator succ_rbegin()
Definition: CFG.h:547
ProgramStateRef getState() const
Definition: CoreEngine.h:484
void markInfeasible(bool branch)
Definition: CoreEngine.h:432
succ_iterator succ_begin()
Definition: CFG.h:542
CoreEngine(SubEngine &subengine, FunctionSummariesTy *FS)
Construct a CoreEngine object to analyze the provided CFG.
Definition: CoreEngine.h:113
bool ExecuteWorkList(const LocationContext *L, unsigned Steps, ProgramStateRef InitState)
ExecuteWorkList - Run the worklist algorithm for a maximum number of steps.
Definition: CoreEngine.cpp:165
const Expr * getCondition() const
Definition: CoreEngine.h:535
This builder class is useful for generating nodes that resulted from visiting a statement. The main difference from its parent NodeBuilder is that it creates a statement specific ProgramPoint.
Definition: CoreEngine.h:345
const LocationContext * getLocationContext() const
Definition: CoreEngine.h:486
IndirectGotoNodeBuilder(ExplodedNode *pred, const CFGBlock *src, const Expr *e, const CFGBlock *dispatch, CoreEngine *eng)
Definition: CoreEngine.h:452
BlocksExhausted::const_iterator blocks_exhausted_end() const
Definition: CoreEngine.h:153
NodeBuilderWithSinks(ExplodedNode *Pred, ExplodedNodeSet &DstSet, const NodeBuilderContext &Ctx, ProgramPoint &L)
Definition: CoreEngine.h:316
BranchNodeBuilder(ExplodedNode *SrcNode, ExplodedNodeSet &DstSet, const NodeBuilderContext &C, const CFGBlock *dstT, const CFGBlock *dstF)
Definition: CoreEngine.h:407
const CFGBlock * getTargetBlock(bool branch) const
Definition: CoreEngine.h:428
void takeNodes(const ExplodedNodeSet &S)
Definition: CoreEngine.h:298
virtual void finalizeResults()
Allow subclasses to finalize results before result_begin() is executed.
Definition: CoreEngine.h:236
BlocksAborted::const_iterator blocks_aborted_end() const
Definition: CoreEngine.h:159
void enqueue(ExplodedNodeSet &Set)
Enqueue the given set of nodes onto the work list.
Definition: CoreEngine.cpp:591
bool ExecuteWorkListWithInitialState(const LocationContext *L, unsigned Steps, ProgramStateRef InitState, ExplodedNodeSet &Dst)
Returns true if there is still simulation state on the worklist.
Definition: CoreEngine.cpp:272
const Expr * getTarget() const
Definition: CoreEngine.h:482
const SwitchStmt * getSwitch() const
Definition: CoreEngine.h:525
static ProgramPoint getProgramPoint(const Stmt *S, ProgramPoint::Kind K, const LocationContext *LC, const ProgramPointTag *tag)
BlocksExhausted::const_iterator blocks_exhausted_begin() const
Definition: CoreEngine.h:150
LineState State
friend class CommonNodeBuilder
Definition: CoreEngine.h:47
ExplodedNodeSet::iterator iterator
Definition: CoreEngine.h:283
ExplodedNode * generateSink(const Stmt *S, ExplodedNode *Pred, ProgramStateRef St, const ProgramPointTag *tag=nullptr, ProgramPoint::Kind K=ProgramPoint::PostStmtKind)
Definition: CoreEngine.h:385
ExplodedNode * generateNodeImpl(const ProgramPoint &PP, ProgramStateRef State, ExplodedNode *Pred, bool MarkAsSink=false)
Definition: CoreEngine.cpp:625
void addNodes(ExplodedNode *N)
Definition: CoreEngine.h:304
ExplodedNode * generateCaseStmtNode(const iterator &I, ProgramStateRef State)
Definition: CoreEngine.cpp:689
ExplodedNodeSet & Frontier
The frontier set - a set of nodes which need to be propagated after the builder dies.
Definition: CoreEngine.h:218
BlocksAborted::const_iterator blocks_aborted_begin() const
Definition: CoreEngine.h:156
Represents binding an expression to a temporary.
Definition: ExprCXX.h:1032
ProgramStateRef getState() const
Definition: CoreEngine.h:537
const LocationContext * getLocationContext() const
StmtNodeBuilder(ExplodedNodeSet &SrcSet, ExplodedNodeSet &DstSet, const NodeBuilderContext &Ctx, NodeBuilder *Enclosing=nullptr)
Definition: CoreEngine.h:360
unsigned blockCount() const
Returns the number of times the current basic block has been visited on the exploded graph path...
Definition: CoreEngine.h:191
ExplodedNode * generateSink(const ProgramPoint &PP, ProgramStateRef State, ExplodedNode *Pred)
Generates a sink in the ExplodedGraph.
Definition: CoreEngine.h:271
ExplodedGraph & getGraph()
getGraph - Returns the exploded graph.
Definition: CoreEngine.h:118
This is the simplest builder which generates nodes in the ExplodedGraph.
Definition: CoreEngine.h:207
bool hasWorkRemaining() const
Definition: CoreEngine.h:138
void Add(ExplodedNode *N)
const ExplodedNodeSet & getResults()
Definition: CoreEngine.h:277
bool wasBlockAborted() const
Definition: CoreEngine.h:136
SmallVector< ExplodedNode *, 2 > sinksGenerated
Definition: CoreEngine.h:312
void enqueueStmtNode(ExplodedNode *N, const CFGBlock *Block, unsigned Idx)
Enqueue a single node created as a result of statement processing.
Definition: CoreEngine.cpp:527
const LocationContext * getLocationContext() const
Definition: CoreEngine.h:539
unsigned getBlockID() const
Definition: CFG.h:639
virtual bool checkResults()
Checkes if the results are ready.
Definition: CoreEngine.h:221
ExplodedNode * generateNode(const iterator &I, ProgramStateRef State, bool isSink=false)
Definition: CoreEngine.cpp:669
void enqueueEndOfFunction(ExplodedNodeSet &Set)
enqueue the nodes corresponding to the end of function onto the end of path / work list...
Definition: CoreEngine.cpp:606
CFGTerminator getTerminator()
Definition: CFG.h:623
bool wasBlocksExhausted() const
Definition: CoreEngine.h:137
#define false
Definition: stdbool.h:33
const StackFrameContext * getCurrentStackFrame() const
ExplodedNode * generateNode(ProgramStateRef State, ExplodedNode *Pred, const ProgramPointTag *Tag=nullptr)
Definition: CoreEngine.h:320
void dispatchWorkItem(ExplodedNode *Pred, ProgramPoint Loc, const WorkListUnit &WU)
Definition: CoreEngine.cpp:229
succ_reverse_iterator succ_rend()
Definition: CFG.h:548
ProgramPoint withTag(const ProgramPointTag *tag) const
Definition: ProgramPoint.h:108
std::vector< std::pair< const CFGBlock *, const ExplodedNode * > > BlocksAborted
Definition: CoreEngine.h:56
succ_iterator succ_end()
Definition: CFG.h:543
const CaseStmt * getCase() const
Definition: CoreEngine.h:513
AdjacentBlocks::const_iterator const_succ_iterator
Definition: CFG.h:528
void insert(const ExplodedNodeSet &S)
ExplodedNode * generateDefaultCaseNode(ProgramStateRef State, bool isSink=false)
Definition: CoreEngine.cpp:706
void takeNodes(ExplodedNode *N)
Definition: CoreEngine.h:302
void addNodes(const ExplodedNodeSet &S)
Definition: CoreEngine.h:303
const NodeBuilderContext & getContext()
Definition: CoreEngine.h:295
bool operator!=(const iterator &X) const
Definition: CoreEngine.h:510
BranchNodeBuilder(const ExplodedNodeSet &SrcSet, ExplodedNodeSet &DstSet, const NodeBuilderContext &C, const CFGBlock *dstT, const CFGBlock *dstF)
Definition: CoreEngine.h:417
This node builder keeps track of the generated sink nodes.
Definition: CoreEngine.h:309
BranchNodeBuilder is responsible for constructing the nodes corresponding to the two branches of the ...
Definition: CoreEngine.h:398
NodeBuilderContext(const CoreEngine &E, const CFGBlock *B, ExplodedNode *N)
Definition: CoreEngine.h:183
const CFGBlock * getBlock() const
Return the CFGBlock associated with this builder.
Definition: CoreEngine.h:187
friend class EndOfFunctionNodeBuilder
Definition: CoreEngine.h:50
ExplodedNode * generateSink(ProgramStateRef State, ExplodedNode *Pred, const ProgramPointTag *Tag=nullptr)
Definition: CoreEngine.h:327
WorkList * getWorkList() const
Definition: CoreEngine.h:148
std::vector< std::pair< BlockEdge, const ExplodedNode * > > BlocksExhausted
Definition: CoreEngine.h:53
bool operator!=(const iterator &X) const
Definition: CoreEngine.h:464
void addAbortedBlock(const ExplodedNode *node, const CFGBlock *block)
Definition: CoreEngine.h:144
bool erase(ExplodedNode *N)
const NodeBuilderContext & C
Definition: CoreEngine.h:210
X
Definition: SemaDecl.cpp:11429
ExplodedNode * generateNode(const ProgramPoint &PP, ProgramStateRef State, ExplodedNode *Pred)
Generates a node in the ExplodedGraph.
Definition: CoreEngine.h:260
SwitchNodeBuilder(ExplodedNode *pred, const CFGBlock *src, const Expr *condition, CoreEngine *eng)
Definition: CoreEngine.h:498
StmtNodeBuilder(ExplodedNode *SrcNode, ExplodedNodeSet &DstSet, const NodeBuilderContext &Ctx, NodeBuilder *Enclosing=nullptr)
Constructs a StmtNodeBuilder. If the builder is going to process nodes currently owned by another bui...
Definition: CoreEngine.h:352
const CFGBlock * getBlock() const
Definition: CoreEngine.h:517
ExplodedNode * generateNode(ProgramStateRef State, bool branch, ExplodedNode *Pred)
Definition: CoreEngine.cpp:655
AdjacentBlocks::const_reverse_iterator const_succ_reverse_iterator
Definition: CFG.h:530
NodeBuilder(ExplodedNode *SrcNode, ExplodedNodeSet &DstSet, const NodeBuilderContext &Ctx, bool F=true)
Definition: CoreEngine.h:244
bool operator==(const iterator &X) const
Definition: CoreEngine.h:511
ExplodedNode * generateNode(const Stmt *S, ExplodedNode *Pred, ProgramStateRef St, const ProgramPointTag *tag=nullptr, ProgramPoint::Kind K=ProgramPoint::PostStmtKind)
Definition: CoreEngine.h:375
iterator begin()
Iterators through the results frontier.
Definition: CoreEngine.h:285
NodeBuilder(const ExplodedNodeSet &SrcSet, ExplodedNodeSet &DstSet, const NodeBuilderContext &Ctx, bool F=true)
Definition: CoreEngine.h:250
const SmallVectorImpl< ExplodedNode * > & getSinks() const
Definition: CoreEngine.h:336
bool isFeasible(bool branch)
Definition: CoreEngine.h:439
const LocationContext * LC
Definition: CoreEngine.h:182