23 #include "llvm/ADT/SmallString.h"
24 #include "llvm/ADT/StringExtras.h"
25 #include "llvm/Support/raw_ostream.h"
27 using namespace clang;
30 using llvm::FoldingSetNodeID;
37 if (
const DeclRefExpr *DRE = dyn_cast<DeclRefExpr>(E)) {
38 return DRE->getDecl()->getType()->isReferenceType();
53 assert(B->isAssignmentOp());
57 else if (
const UnaryOperator *U = dyn_cast<UnaryOperator>(E)) {
61 else if (
const MemberExpr *ME = dyn_cast<MemberExpr>(E)) {
70 else if (
const ObjCIvarRefExpr *IvarRef = dyn_cast<ObjCIvarRefExpr>(E)) {
94 if (
const ReturnStmt *RS = dyn_cast<ReturnStmt>(S))
95 return RS->getRetValue();
103 std::unique_ptr<PathDiagnosticPiece>
118 auto P = llvm::make_unique<PathDiagnosticEventPiece>(
143 bool EnableNullFPSuppression;
147 : StackFrame(Frame), Mode(Initial), EnableNullFPSuppression(Suppressed) {}
149 static void *getTag() {
151 return static_cast<void *
>(&Tag);
154 void Profile(llvm::FoldingSetNodeID &
ID)
const override {
155 ID.AddPointer(ReturnVisitor::getTag());
156 ID.AddPointer(StackFrame);
157 ID.AddBoolean(EnableNullFPSuppression);
169 bool InEnableNullFPSuppression) {
176 if (CEE->getCalleeContext()->getCallSite() ==
S)
179 if (SP->getStmt() ==
S)
205 if (cast<Expr>(S)->isGLValue())
207 RetVal = State->getSVal(*LValue);
210 SubEngine *Eng = State->getStateManager().getOwningEngine();
211 assert(Eng &&
"Cannot file a bug report without an owning engine");
214 bool EnableNullFPSuppression =
false;
217 EnableNullFPSuppression = State->isNull(*RetLoc).isConstrainedTrue();
220 BR.
addVisitor(llvm::make_unique<ReturnVisitor>(CalleeContext,
221 EnableNullFPSuppression));
249 SVal V = State->getSVal(Ret, StackFrame);
257 assert(RetE &&
"Tracking a return value for a void function");
263 SVal RValue = State->getRawSVal(*LValue, RetE->
getType());
278 if (!State->isNull(V).isConstrainedTrue()) {
280 ReturnVisitor::addVisitorIfNecessary(N, RetE, BR,
281 EnableNullFPSuppression);
287 EnableNullFPSuppression);
291 llvm::raw_svector_ostream Out(Msg);
299 if (EnableNullFPSuppression && hasCounterSuppression(Options))
300 Mode = MaybeUnsuppress;
303 Out <<
"Returning nil";
305 Out <<
"Returning null pointer";
307 Out <<
"Returning zero";
311 if (
const MemRegion *MR = LValue->getAsRegion()) {
312 if (MR->canPrintPretty()) {
313 Out <<
" (reference to ";
314 MR->printPretty(Out);
320 if (
const DeclRefExpr *DR = dyn_cast<DeclRefExpr>(RetE))
321 if (
const DeclaratorDecl *DD = dyn_cast<DeclaratorDecl>(DR->getDecl()))
322 Out <<
" (loaded from '" << *DD <<
"')";
336 assert(hasCounterSuppression(Options));
344 if (CE->getCalleeContext() != StackFrame)
357 for (
unsigned I = 0, E = Call->getNumArgs(); I != E; ++I) {
362 const Expr *ArgE = Call->getArgExpr(I);
367 if (!State->isNull(*ArgV).isConstrainedTrue())
371 EnableNullFPSuppression))
388 return visitNodeInitial(N, PrevN, BRC, BR);
389 case MaybeUnsuppress:
390 return visitNodeMaybeUnsuppress(N, PrevN, BRC, BR);
395 llvm_unreachable(
"Invalid visit mode!");
401 if (EnableNullFPSuppression)
402 BR.
markInvalid(ReturnVisitor::getTag(), StackFrame);
414 ID.AddBoolean(EnableNullFPSuppression);
455 const Expr *InitE =
nullptr;
456 bool IsParam =
false;
459 if (
const VarRegion *VR = dyn_cast<VarRegion>(R)) {
462 InitE = VR->getDecl()->getInit();
470 if (FieldReg && FieldReg == R) {
472 InitE = PIP->getInitializer()->getInit();
482 if (Succ->
getState()->getSVal(R) != V)
485 if (Pred->
getState()->getSVal(R) == V) {
487 if (!PS || PS->getLocationValue() != R)
497 if (BO->isAssignmentOp())
498 InitE = BO->getRHS();
505 if (
const VarRegion *VR = dyn_cast<VarRegion>(R)) {
506 const ParmVarDecl *Param = cast<ParmVarDecl>(VR->getDecl());
521 InitE = TmpR->getExpr();
536 EnableNullFPSuppression);
539 BR, EnableNullFPSuppression);
545 llvm::raw_svector_ostream os(sbuf);
548 const Stmt *S = PS->getStmt();
549 const char *action =
nullptr;
556 }
else if (isa<BlockExpr>(S)) {
558 "Captured by block as ";
562 SVal V = State->getSVal(S, PS->getLocationContext());
564 dyn_cast_or_null<BlockDataRegion>(V.
getAsRegion())) {
565 if (
const VarRegion *OriginalR = BDR->getOriginalRegion(VR)) {
567 State->getSVal(OriginalR).getAs<
KnownSVal>())
568 BR.
addVisitor(llvm::make_unique<FindLastStoreBRVisitor>(
569 *KV, OriginalR, EnableNullFPSuppression));
585 if (TR->getValueType()->isObjCObjectPointerType()) {
586 os << action <<
"nil";
593 os << action <<
"a null pointer value";
596 os << action << CVal->getValue();
600 if (isa<VarRegion>(R)) {
604 <<
" to a garbage value";
607 <<
" without an initial value";
618 if (
const VarRegion *VR = dyn_cast<VarRegion>(R)) {
619 const ParmVarDecl *Param = cast<ParmVarDecl>(VR->getDecl());
625 os <<
"nil object reference";
627 os <<
"null pointer value";
629 os <<
"uninitialized value";
632 os <<
"the value " << CI->getValue();
639 os <<
" via " << Idx << llvm::getOrdinalSuffix(Idx) <<
" parameter";
647 if (os.str().empty()) {
652 if (TR->getValueType()->isObjCObjectPointerType()) {
653 os <<
"nil object reference stored";
660 os <<
"Null pointer value stored";
662 os <<
"Storing null pointer value";
667 os <<
"Uninitialized value stored";
669 os <<
"Storing uninitialized value";
674 os <<
"The value " << CV->getValue() <<
" is assigned";
676 os <<
"Assigning " << CV->getValue();
680 os <<
"Value assigned";
682 os <<
"Assigning value";
710 ID.AddBoolean(Assumption);
717 return "TrackConstraintBRVisitor";
720 bool TrackConstraintBRVisitor::isUnderconstrained(
const ExplodedNode *N)
const {
722 return N->
getState()->isNull(Constraint).isUnderconstrained();
723 return (
bool)N->
getState()->assume(Constraint, !Assumption);
736 if (!IsTrackingTurnedOn)
737 if (!isUnderconstrained(N))
738 IsTrackingTurnedOn =
true;
739 if (!IsTrackingTurnedOn)
744 if (isUnderconstrained(PrevN)) {
751 assert(!isUnderconstrained(N));
756 llvm::raw_svector_ostream os(sbuf);
759 os <<
"Assuming pointer value is ";
760 os << (Assumption ?
"non-null" :
"null");
763 if (os.str().empty())
783 : V(Value), IsSatisfied(
false), IsTrackingTurnedOn(
false) {
787 assert(Eng &&
"Cannot file a bug report without an owning engine");
792 assert(N->
getState()->isNull(V).isConstrainedTrue() &&
793 "The visitor only tracks the cases where V is constrained to 0");
815 if (!IsTrackingTurnedOn)
816 if (Succ->
getState()->isNull(V).isConstrainedTrue())
817 IsTrackingTurnedOn =
true;
818 if (!IsTrackingTurnedOn)
823 if (!Pred->
getState()->isNull(V).isConstrainedTrue()) {
826 assert(Succ->
getState()->isNull(V).isConstrainedTrue());
831 if (CurLC != ReportLC && !CurLC->
isParentOf(ReportLC))
839 if (
const DeclRefExpr *DR = dyn_cast<DeclRefExpr>(E)) {
840 if (
const VarDecl *VD = dyn_cast<VarDecl>(DR->getDecl())) {
841 if (!VD->getType()->isReferenceType())
874 const CFGBlock *srcBlk = BE->getSrc();
877 bool TookTrueBranch = (*(srcBlk->
succ_begin()) == BE->getDst());
894 bool EnableNullFPSuppression) {
898 if (
const Expr *Ex = dyn_cast<Expr>(S)) {
899 Ex = Ex->IgnoreParenCasts();
905 const Expr *Inner =
nullptr;
906 if (
const Expr *Ex = dyn_cast<Expr>(S)) {
912 if (IsArg && !Inner) {
921 if (ps->getStmt() == S || ps->getStmt() == Inner)
924 if (CEE->getCalleeContext()->getCallSite() == S ||
925 CEE->getCalleeContext()->getCallSite() == Inner)
954 if (
P->getStmt() == Inner)
959 assert(LVNode &&
"Unable to find the lvalue node.");
963 if (LVState->isNull(LVal).isConstrainedTrue()) {
978 report.
addVisitor(llvm::make_unique<FindLastStoreBRVisitor>(
979 *KV, RR, EnableNullFPSuppression));
989 report.
addVisitor(llvm::make_unique<UndefOrNullArgVisitor>(R));
993 report.
addVisitor(llvm::make_unique<TrackConstraintBRVisitor>(
998 if (!DV->isZeroConstant() && LVState->isNull(*DV).isConstrainedTrue() &&
999 EnableNullFPSuppression) {
1001 llvm::make_unique<SuppressInlineDefensiveChecksVisitor>(*DV,
1007 report.
addVisitor(llvm::make_unique<FindLastStoreBRVisitor>(
1008 *KV, R, EnableNullFPSuppression));
1019 if (
const Expr *E = dyn_cast<Expr>(S))
1020 S = E->IgnoreParenCasts();
1022 ReturnVisitor::addVisitorIfNecessary(N, S, report, EnableNullFPSuppression);
1033 if (
const Expr *E = dyn_cast<Expr>(S))
1034 RVal = state->getRawSVal(L.getValue(), E->getType());
1036 RVal = state->getSVal(L->getRegion());
1039 report.
addVisitor(llvm::make_unique<UndefOrNullArgVisitor>(L->getRegion()));
1041 if (RegionRVal && isa<SymbolicRegion>(RegionRVal)) {
1043 report.
addVisitor(llvm::make_unique<TrackConstraintBRVisitor>(
1059 if (state->isNull(V).isConstrainedTrue())
1073 const Stmt *S = P->getStmt();
1079 llvm::raw_svector_ostream OS(Buf);
1083 ME->getSelector().print(OS);
1084 OS <<
"' not called";
1087 OS <<
"No method is called";
1089 OS <<
" because the receiver is nil";
1105 bool EnableNullFPSuppression) {
1108 WorkList.push_back(S);
1110 while (!WorkList.empty()) {
1111 const Stmt *Head = WorkList.front();
1112 WorkList.pop_front();
1117 if (
const DeclRefExpr *DR = dyn_cast<DeclRefExpr>(Head)) {
1118 if (
const VarDecl *VD = dyn_cast<VarDecl>(DR->getDecl())) {
1127 BR.
addVisitor(llvm::make_unique<FindLastStoreBRVisitor>(
1133 for (
const Stmt *SubStmt : Head->children())
1134 WorkList.push_back(SubStmt);
1145 return "ConditionBRVisitor";
1156 ev->setPrunable(
true,
false);
1173 if (CurrentState->getGDM().getRoot() ==
1174 PrevState->getGDM().getRoot())
1180 const CFGBlock *srcBlk = BE->getSrc();
1189 const std::pair<const ProgramPointTag *, const ProgramPointTag *> &tags =
1191 getEngine().geteagerlyAssumeBinOpBifurcationTags();
1194 if (tag == tags.first)
1197 if (tag == tags.second)
1214 const Expr *Cond =
nullptr;
1216 switch (Term->getStmtClass()) {
1219 case Stmt::IfStmtClass:
1220 Cond = cast<IfStmt>(Term)->getCond();
1222 case Stmt::ConditionalOperatorClass:
1223 Cond = cast<ConditionalOperator>(Term)->getCond();
1229 const bool tookTrue = *(srcBlk->
succ_begin()) == dstBlk;
1240 const Expr *Ex = Cond;
1244 switch (Ex->getStmtClass()) {
1247 case Stmt::BinaryOperatorClass:
1248 return VisitTrueTest(Cond, cast<BinaryOperator>(Ex), tookTrue, BRC,
1250 case Stmt::DeclRefExprClass:
1251 return VisitTrueTest(Cond, cast<DeclRefExpr>(Ex), tookTrue, BRC,
1253 case Stmt::UnaryOperatorClass: {
1256 tookTrue = !tookTrue;
1271 const Expr *OriginalExpr = Ex;
1274 if (
const DeclRefExpr *DR = dyn_cast<DeclRefExpr>(Ex)) {
1275 const bool quotes = isa<VarDecl>(DR->getDecl());
1292 Out << DR->getDecl()->getDeclName().getAsString();
1301 if (IL->getValue() == 0) {
1307 if (IL->getValue() == 0) {
1313 Out << IL->getValue();
1323 const bool tookTrue,
1328 bool shouldInvert =
false;
1333 llvm::raw_svector_ostream OutLHS(LhsString), OutRHS(RhsString);
1339 shouldInvert = !isVarLHS && isVarRHS;
1353 if (LhsString.empty() || RhsString.empty() ||
1359 llvm::raw_svector_ostream Out(buf);
1360 Out <<
"Assuming " << (shouldInvert ? RhsString : LhsString) <<
" is ";
1389 Out <<
"not equal to ";
1396 Out << (shouldInvert ? LhsString : RhsString);
1400 new PathDiagnosticEventPiece(
Loc, Out.str());
1401 if (shouldPrune.hasValue())
1408 const Expr *CondVarExpr,
1409 const bool tookTrue,
1417 llvm::raw_svector_ostream Out(buf);
1418 Out <<
"Assuming " << LhsString <<
" is ";
1423 Out << (tookTrue ?
"not null" :
"null");
1425 Out << (tookTrue ?
"not nil" :
"nil");
1427 Out << (tookTrue ?
"true" :
"false");
1429 Out << (tookTrue ?
"non-zero" :
"zero");
1436 new PathDiagnosticEventPiece(
Loc, Out.str());
1438 if (
const DeclRefExpr *DR = dyn_cast<DeclRefExpr>(CondVarExpr)) {
1439 if (
const VarDecl *VD = dyn_cast<VarDecl>(DR->getDecl())) {
1443 event->setPrunable(
false);
1454 const bool tookTrue,
1464 llvm::raw_svector_ostream Out(Buf);
1466 Out <<
"Assuming '" << VD->
getDeclName() <<
"' is ";
1471 Out << (tookTrue ?
"non-null" :
"null");
1473 Out << (tookTrue ?
"non-nil" :
"nil");
1475 Out << (tookTrue ?
"not equal to 0" :
"0");
1482 new PathDiagnosticEventPiece(
Loc, Out.str());
1485 if (
const MemRegion *R = state->getLValue(VD, LCtx).getAsRegion()) {
1487 event->setPrunable(
false);
1489 SVal V = state->getSVal(R);
1491 event->setPrunable(
false);
1511 std::unique_ptr<PathDiagnosticPiece>
1539 if (CD->
getName() ==
"list") {
1558 if (CD->
getName() ==
"basic_string") {
1572 if (SM.
getFilename(Loc).endswith(
"sys/queue.h")) {
1602 I != E; ++I, ++Idx) {
1603 const MemRegion *ArgReg = Call->getArgSVal(Idx).getAsRegion();
1611 assert(ParamDecl &&
"Formal parameter has no decl?");
1626 SVal BoundVal = State->getSVal(R);
TypedValueRegion - An abstract class representing regions having a typed value.
const Expr * getDerefExpr(const Stmt *S)
StringRef getName() const
void setTag(const char *tag)
Tag this PathDiagnosticPiece with the given C-string.
MemRegion - The root abstract class for all memory regions.
bool isInteresting(SymbolRef sym)
succ_iterator succ_begin()
virtual bool canPrintPretty() const
Returns true if this region can be printed in a user-friendly way.
const ExplodedNode * getErrorNode() const
virtual PathDiagnosticLocation getLocation(const SourceManager &SM) const
Return the "definitive" location of the reported bug.
bool shouldSuppressNullReturnPaths()
PathDiagnosticPiece * VisitNode(const ExplodedNode *N, const ExplodedNode *PrevN, BugReporterContext &BRC, BugReport &BR) override
Return a diagnostic piece which should be associated with the given node.
unsigned getFunctionScopeIndex() const
Returns the index of this parameter in its prototype or method scope.
ProgramPoint getLocation() const
getLocation - Returns the edge associated with the given node.
virtual bool isBoundable() const
Manages the lifetime of CallEvent objects.
PathDiagnosticPiece * VisitNode(const ExplodedNode *N, const ExplodedNode *PrevN, BugReporterContext &BRC, BugReport &BR) override
Return a diagnostic piece which should be associated with the given node.
bool isStdNamespace() const
const Expr * getInit() const
NamespaceDecl - Represent a C++ namespace.
bool isBooleanType() const
void setPrunable(bool isPrunable, bool override=false)
PathDiagnosticPiece * VisitNode(const ExplodedNode *N, const ExplodedNode *Prev, BugReporterContext &BRC, BugReport &BR) override
Return a diagnostic piece which should be associated with the given node.
bool shouldAvoidSuppressingNullArgumentPaths()
const Stmt * GetDenomExpr(const ExplodedNode *N)
Value representing integer constant.
unsigned succ_size() const
static const Expr * peelOffOuterExpr(const Expr *Ex, const ExplodedNode *N)
ParmVarDecl - Represents a parameter to a function.
bool isZeroConstant() const
FullSourceLoc asLocation() const
bool isComparisonOp() const
const MemSpaceRegion * getMemorySpace() const
void Profile(llvm::FoldingSetNodeID &ID) const override
bool isScalarType() const
bool isReferenceType() const
bool isAnyPointerType() const
Represents a program point after a store evaluation.
MemRegionManager & getRegionManager()
SymbolRef getAsLocSymbol(bool IncludeBaseRegions=false) const
If this SVal is a location and wraps a symbol, return that SymbolRef. Otherwise return 0...
Optional< T > getLocationAs() const LLVM_LVALUE_FUNCTION
bool patternMatch(const Expr *Ex, raw_ostream &Out, BugReporterContext &BRC, BugReport &R, const ExplodedNode *N, Optional< bool > &prunable)
const VarDecl * getDecl() const
virtual llvm::iterator_range< ranges_iterator > getRanges()
Get the SourceRanges associated with the report.
std::unique_ptr< PathDiagnosticPiece > getEndPath(BugReporterContext &BRC, const ExplodedNode *N, BugReport &BR) override
Provide custom definition for the final diagnostic piece on the path - the piece, which is displayed ...
virtual std::unique_ptr< PathDiagnosticPiece > getEndPath(BugReporterContext &BRC, const ExplodedNode *N, BugReport &BR)
Provide custom definition for the final diagnostic piece on the path - the piece, which is displayed ...
DeclContext * getEnclosingNamespaceContext()
Retrieve the nearest enclosing namespace context.
const CXXRecordDecl * getParent() const
bool isUnknownOrUndef() const
A builtin binary operation expression such as "x + y" or "x <= y".
const Stmt * getCallSite() const
bool isParentOf(const LocationContext *LC) const
Expr * IgnoreParenCasts() LLVM_READONLY
static void registerStatementVarDecls(BugReport &BR, const Stmt *S, bool EnableNullFPSuppression)
static PathDiagnosticLocation create(const Decl *D, const SourceManager &SM)
Create a location corresponding to the given declaration.
static const MemRegion * getLocationRegionIfReference(const Expr *E, const ExplodedNode *N)
StringRef getDescription() const
ExplodedNode * getFirstPred()
bool isStaticLocal() const
void addVisitor(std::unique_ptr< BugReporterVisitor > visitor)
Add custom or predefined bug report visitors to this report.
const LocationContext * getLocationContext() const
const StackFrameContext * getStackFrame() const
bool isAssignmentOp() const
bool shouldSuppressInlinedDefensiveChecks()
Represents a ValueDecl that came out of a declarator. Contains type source information through TypeSo...
StringRef getFilename(SourceLocation SpellingLoc) const
Return the filename of the file containing a SourceLocation.
const MemRegion * StripCasts(bool StripBaseCasts=true) const
static const char * getTag()
ID
Defines the set of possible language-specific address spaces.
QualType getPointeeType() const
const ProgramStateRef & getState() const
CallEventRef getCaller(const StackFrameContext *CalleeCtx, ProgramStateRef State)
SVal getSVal(const Stmt *S, const LocationContext *LCtx) const
Returns the SVal bound to the statement 'S' in the state's environment.
Optional< T > getAs() const
Convert to the specified SVal type, returning None if this SVal is not of the desired type...
DeclContext * getDeclContext()
static const Expr * getNilReceiver(const Stmt *S, const ExplodedNode *N)
static bool isInStdNamespace(const Decl *D)
void Profile(llvm::FoldingSetNodeID &ID) const override
SuppressInlineDefensiveChecksVisitor(DefinedSVal Val, const ExplodedNode *N)
Expr * getSubExpr() const
DeclContext * getParent()
getParent - Returns the containing DeclContext.
An expression that sends a message to the given Objective-C object or class.
DeclarationName getDeclName() const
void markInteresting(SymbolRef sym)
PathDiagnosticPiece * VisitTerminator(const Stmt *Term, const ExplodedNode *N, const CFGBlock *srcBlk, const CFGBlock *dstBlk, BugReport &R, BugReporterContext &BRC)
const MatchFinder::MatchFinderOptions & Options
CFGTerminator getTerminator()
static std::unique_ptr< PathDiagnosticPiece > getDefaultEndPath(BugReporterContext &BRC, const ExplodedNode *N, BugReport &BR)
Generates the default final diagnostic piece.
bool isIntegralOrEnumerationType() const
Determine whether this type is an integral or enumeration type.
const StackFrameContext * getCurrentStackFrame() const
static bool isCallStmt(const Stmt *S)
Returns true if this is a statement is a function or method call of some kind.
AnalysisManager & getAnalysisManager() override
void Profile(llvm::FoldingSetNodeID &ID) const override
bool isValid() const
Return true if this is a valid SourceLocation object.
CallEventManager & getCallEventManager()
PathDiagnosticPiece * VisitNode(const ExplodedNode *N, const ExplodedNode *PrevN, BugReporterContext &BRC, BugReport &BR) override
Return a diagnostic piece which should be associated with the given node.
Represents a static or instance method of a struct/union/class.
PathDiagnosticPiece * VisitNode(const ExplodedNode *N, const ExplodedNode *PrevN, BugReporterContext &BRC, BugReport &BR) override
Return a diagnostic piece which should be associated with the given node.
PathDiagnosticPiece * VisitTrueTest(const Expr *Cond, bool tookTrue, BugReporterContext &BRC, BugReport &R, const ExplodedNode *N)
AnalyzerOptions & options
const Decl * getDecl() const
virtual void printPretty(raw_ostream &os) const
Print the region for use in diagnostics.
PathDiagnosticPiece * VisitConditionVariable(StringRef LhsString, const Expr *CondVarExpr, const bool tookTrue, BugReporterContext &BRC, BugReport &R, const ExplodedNode *N)
const Decl * getSingleDecl() const
Expr * getInstanceReceiver()
Returns the object expression (receiver) for an instance message, or null for a message that is not a...
ast_type_traits::DynTypedNode Node
bool isDeclRefExprToReference(const Expr *E)
const LocationContext * getParent() const
StringRef getOpcodeStr() const
const LocationContext * getLocationContext() const
const VarRegion * getVarRegion(const VarDecl *D, const LocationContext *LC)
static const char * getTag()
GRBugReporter & getBugReporter()
const Stmt * GetRetValExpr(const ExplodedNode *N)
const MemRegion * getAsRegion() const
const Expr * getRetValue() const
Optional< T > getAs() const
Convert to the specified ProgramPoint type, returning None if this ProgramPoint is not of the desired...
Represents an SVal that is guaranteed to not be UnknownVal.
ArraySubscriptExpr - [C99 6.5.2.1] Array Subscripting.
ProgramStateManager & getStateManager()
bool shouldSuppressFromCXXStandardLibrary()
ObjCIvarRefExpr - A reference to an ObjC instance variable.
Represents a C++ struct/union/class.
bool isObjCObjectPointerType() const
PathDiagnosticPiece * VisitNode(const ExplodedNode *Succ, const ExplodedNode *Pred, BugReporterContext &BRC, BugReport &BR) override
Return a diagnostic piece which should be associated with the given node.
bool trackNullOrUndefValue(const ExplodedNode *N, const Stmt *S, BugReport &R, bool IsArg=false, bool EnableNullFPSuppression=true)
PathDiagnosticPiece * VisitNodeImpl(const ExplodedNode *N, const ExplodedNode *Prev, BugReporterContext &BRC, BugReport &BR)
static PathDiagnosticLocation createEndOfPath(const ExplodedNode *N, const SourceManager &SM)
void removeInvalidation(const void *Tag, const void *Data)
void markInvalid(const void *Tag, const void *Data)
static bool isInitializationOfVar(const ExplodedNode *N, const VarRegion *VR)
Loc getLValue(const VarDecl *D, const LocationContext *LC) const
Get the lvalue for a variable reference.
A SourceLocation and its associated SourceManager.
A reference to a declared variable, function, enum, etc. [C99 6.5.1p2].
virtual bool isSubRegionOf(const MemRegion *R) const
Check if the region is a subregion of the given region.
A trivial tuple used to represent a source range.
bool isConstQualified() const
Determine whether this type is const-qualified.
T castAs() const
Convert to the specified SVal type, asserting that this SVal is of the desired type.
static bool isInterestingLValueExpr(const Expr *Ex)
Returns true if nodes for the given expression kind are always kept around.
This class handles loading and caching of source files into memory.
SourceManager & getSourceManager()
bool hasLocalStorage() const
FullSourceLoc getSpellingLoc() const
virtual AnalysisManager & getAnalysisManager()=0
static const char * getTag()
bool isPointerType() const