18 using namespace clang;
40 SVal LeftV = state->getSVal(LHS, LCtx);
41 SVal RightV = state->getSVal(RHS, LCtx);
56 evalStore(Tmp2, B, LHS, *it, state->BindExpr(B, LCtx, ExprVal),
89 state = createTemporaryRegionIfNeeded(state, LCtx, LHS);
99 state = state->BindExpr(B, LCtx, Result);
108 llvm_unreachable(
"Invalid opcode for compound assignment.");
124 SVal location = LeftV;
125 evalLoad(Tmp, B, LHS, *it, state, location);
130 state = (*I)->getState();
132 SVal V = state->getSVal(LHS, LCtx);
136 cast<CompoundAssignOperator>(B)->getComputationResultType();
140 cast<CompoundAssignOperator>(B)->getComputationLHSType();
146 V = svalBuilder.
evalCast(V, CLHSTy, LTy);
164 Result = svalBuilder.
evalCast(LHSVal, CTy, LTy);
169 LHSVal = svalBuilder.
evalCast(Result, LTy, CTy);
175 state = state->BindExpr(B, LCtx, location);
177 state = state->BindExpr(B, LCtx, Result);
179 evalStore(Tmp2, B, LHS, *I, state, location, LHSVal);
202 dyn_cast_or_null<BlockDataRegion>(V.
getAsRegion())) {
205 E = BDR->referenced_vars_end();
207 for (; I != E; ++I) {
210 if (capturedR != originalR) {
239 evalLoad(Dst, CastE, CastE, subExprNode, state, state->getSVal(Ex, LCtx));
248 if (
const ExplicitCastExpr *ExCast=dyn_cast_or_null<ExplicitCastExpr>(CastE))
249 T = ExCast->getTypeAsWritten();
261 llvm_unreachable(
"LValueToRValue casts handled earlier.");
285 SVal V = state->getSVal(Ex, LCtx);
286 state = state->BindExpr(CastE, LCtx, V);
324 SVal V = state->getSVal(Ex, LCtx);
325 V = svalBuilder.
evalCast(V, T, ExTy);
326 state = state->BindExpr(CastE, LCtx, V);
333 SVal val = state->getSVal(Ex, LCtx);
335 state = state->BindExpr(CastE, LCtx, val);
341 SVal val = state->getSVal(Ex, LCtx);
365 state = state->BindExpr(CastE, LCtx, svalBuilder.
makeNull());
373 state = state->BindExpr(CastE, LCtx, NewSym);
376 state = state->BindExpr(CastE, LCtx, val);
384 state = state->BindExpr(CastE, LCtx, V);
402 state = state->BindExpr(CastE, LCtx, result);
421 if (isa<CXXConstructExpr>(Init)) {
424 assert(isa<InitListExpr>(Init));
425 Loc CLLoc = State->getLValue(CL, LCtx);
426 State = State->bindLoc(CLLoc, V);
471 SVal InitVal = state->getSVal(InitEx, LC);
473 if (isa<CXXConstructExpr>(InitEx->IgnoreImplicit())) {
484 InitVal = state->getSVal(M->getRegion());
493 if (InitEx->isGLValue()) {
504 evalBind(Dst2, DS, UpdatedN, state->getLValue(VD, LC), InitVal,
true);
545 assert(Term->isLogicalOp());
555 assert(!SrcBlock->
empty());
557 const Expr *RHS = cast<Expr>(Elem.getStmt());
560 if (RHSVal.isUndef()) {
565 std::tie(StTrue, StFalse) = N->getState()->assume(DefinedRHS);
577 assert(StFalse &&
"Infeasible path!");
602 if (NumInitElements == 0) {
609 ei = IE->
rend(); it != ei; ++it) {
610 SVal V = state->getSVal(cast<Expr>(*it), LCtx);
615 state->BindExpr(IE, LCtx,
623 assert(NumInitElements <= 1);
626 if (NumInitElements == 0)
629 V = state->getSVal(IE->
getInit(0), LCtx);
651 assert(N->pred_size() == 1);
655 SrcState = N->getState();
659 assert(SrcBlock &&
"missing function entry");
663 bool hasValue =
false;
667 E = SrcBlock->
rend(); I != E; ++I) {
670 const Expr *ValEx = cast<Expr>(CS->getStmt());
676 L = OpaqueEx->getSourceExpr();
682 V = SrcState->getSVal(ValEx, LCtx);
693 B.
generateNode(Ex, Pred, state->BindExpr(Ex, LCtx, V,
true));
749 state = state->BindExpr(Ex, (*I)->getLocationContext(),
792 state->getSVal(Ex, LCtx)));
828 state->getSVal(Ex, LCtx)));
841 SVal V = state->getSVal(Ex, LCtx);
850 llvm_unreachable(
"Invalid Opcode.");
869 else if (Ex->getType()->isFloatingType()) {
878 state = state->BindExpr(U, LCtx, Result);
899 SVal loc = state->getSVal(Ex, LCtx);
903 evalLoad(Tmp, U, Ex, Pred, state, loc);
909 state = (*I)->getState();
910 assert(LCtx == (*I)->getLocationContext());
911 SVal V2_untested = state->getSVal(Ex, LCtx);
914 if (V2_untested.isUnknownOrUndef()) {
915 Bldr.
generateNode(U, *I, state->BindExpr(U, LCtx, V2_untested));
951 if (!state->assume(Constraint,
true)) {
954 Constraint = svalBuilder.
evalEQ(state, SymVal,
958 state = state->assume(Constraint,
false);
967 state = state->BindExpr(U, LCtx, loc);
969 state = state->BindExpr(U, LCtx, U->
isPostfix() ? V2 : Result);
974 evalStore(Dst3, U, U, *I, state, loc, Result);
unsigned getNumInits() const
CastKind getCastKind() const
nonloc::ConcreteInt makeIntVal(const IntegerLiteral *integer)
DefinedSVal getBlockPointer(const BlockDecl *block, CanQualType locTy, const LocationContext *locContext, unsigned blockCount)
reverse_iterator rbegin()
SVal evalDerivedToBase(SVal Derived, const CastExpr *Cast)
SVal evalDynamicCast(SVal Base, QualType DerivedPtrType, bool &Failed)
Evaluates C++ dynamic_cast cast. The callback may result in the following 3 scenarios: ...
MemRegion - The root abstract class for all memory regions.
succ_iterator succ_begin()
This builder class is useful for generating nodes that resulted from visiting a statement. The main difference from its parent NodeBuilder is that it creates a statement specific ProgramPoint.
QuantityType getQuantity() const
getQuantity - Get the raw integer representation of this quantity.
bool isRecordType() const
ProgramPoint getLocation() const
getLocation - Returns the edge associated with the given node.
SVal evalBinOp(ProgramStateRef state, BinaryOperator::Opcode op, NonLoc L, NonLoc R, QualType T)
unsigned pred_size() const
const Expr * getInit() const
SVal evalCast(SVal val, QualType castTy, QualType originalType)
[ARC] Consumes a retainable object pointer that has just been produced, e.g. as the return value of a...
Value representing integer constant.
void VisitUnaryOperator(const UnaryOperator *B, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitUnaryOperator - Transfer function logic for unary operators.
void takeNodes(const ExplodedNodeSet &S)
unsigned succ_size() const
NonLoc makeArrayIndex(uint64_t idx)
uint64_t getTypeSize(QualType T) const
Return the size of the specified (complete) type T, in bits.
CK_Dynamic - A C++ dynamic_cast.
void evalStore(ExplodedNodeSet &Dst, const Expr *AssignE, const Expr *StoreE, ExplodedNode *Pred, ProgramStateRef St, SVal TargetLV, SVal Val, const ProgramPointTag *tag=nullptr)
UnaryExprOrTypeTrait getKind() const
static bool isAssignmentOp(Opcode Opc)
bool isZeroConstant() const
Defines the clang::Expr interface and subclasses for C++ expressions.
InitExprsTy::const_reverse_iterator const_reverse_iterator
ImplTy::iterator iterator
Converts between different integral complex types. _Complex char -> _Complex long long _Complex unsig...
bool isReferenceType() const
bool isAnyPointerType() const
llvm::ImmutableList< SVal > consVals(SVal X, llvm::ImmutableList< SVal > L)
static bool isIncrementDecrementOp(Opcode Op)
Converting between two Objective-C object types, which can occur when performing reference binding to...
[ARC] Causes a value of block type to be copied to the heap, if it is not already there...
T castAs() const
Convert to the specified CFGElement type, asserting that this CFGElement is of the desired type...
ASTContext & getContext() const
getContext - Return the ASTContext associated with this analysis.
Converts a floating point complex to bool by comparing against 0+0i.
static bool isLocType(QualType T)
Describes an C or C++ initializer list.
void VisitOffsetOfExpr(const OffsetOfExpr *Ex, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitOffsetOfExpr - Transfer function for offsetof.
ExplodedNode * generateSink(const Stmt *S, ExplodedNode *Pred, ProgramStateRef St, const ProgramPointTag *tag=nullptr, ProgramPoint::Kind K=ProgramPoint::PostStmtKind)
bool isUnknownOrUndef() const
A builtin binary operation expression such as "x + y" or "x <= y".
static bool isPostfix(Opcode Op)
isPostfix - Return true if this is a postfix operation, like x++.
NonLoc makeCompoundVal(QualType type, llvm::ImmutableList< SVal > vals)
bool isIncompleteType(NamedDecl **Def=nullptr) const
Def If non-NULL, and the type refers to some kind of declaration that can be completed (such as a C s...
SVal evalComplement(SVal X)
void VisitDeclStmt(const DeclStmt *DS, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitDeclStmt - Transfer function logic for DeclStmts.
void evalBind(ExplodedNodeSet &Dst, const Stmt *StoreE, ExplodedNode *Pred, SVal location, SVal Val, bool atDeclInit=false, const ProgramPoint *PP=nullptr)
void VisitLogicalExpr(const BinaryOperator *B, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitLogicalExpr - Transfer function logic for '&&', '||'.
const LocationContext * getLocationContext() const
const CFGBlock * getSrc() const
Causes a block literal to by copied to the heap and then autoreleased.
void VisitInitListExpr(const InitListExpr *E, ExplodedNode *Pred, ExplodedNodeSet &Dst)
unsigned blockCount() const
Returns the number of times the current basic block has been visited on the exploded graph path...
CheckerManager & getCheckerManager() const
Converts between different floating point complex types. _Complex float -> _Complex double...
void runCheckersForPostStmt(ExplodedNodeSet &Dst, const ExplodedNodeSet &Src, const Stmt *S, ExprEngine &Eng, bool wasInlined=false)
Run checkers for post-visiting Stmts.
const CFGBlock * getDst() const
DefinedOrUnknownSVal makeZeroVal(QualType type)
Construct an SVal representing '0' for the specified type.
const ProgramStateRef & getState() const
Converts an integral complex to an integral real of the source's element type by discarding the imagi...
bool isAnyComplexType() const
const VarRegion * getCapturedRegion() const
void VisitCast(const CastExpr *CastE, const Expr *Ex, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitCast - Transfer function logic for all casts (implicit and explicit).
Optional< T > getAs() const
Convert to the specified SVal type, returning None if this SVal is not of the desired type...
bool isVariableArrayType() const
const ExplodedNodeSet & getResults()
static CharUnits fromQuantity(QuantityType Quantity)
fromQuantity - Construct a CharUnits quantity from a raw integer type.
static SVal getValue(SVal val, SValBuilder &svalBuilder)
Expr * getSubExpr() const
T castAs() const
Convert to the specified ProgramPoint type, asserting that this ProgramPoint is of the desired type...
bool EvaluateAsInt(llvm::APSInt &Result, const ASTContext &Ctx, SideEffectsKind AllowSideEffects=SE_NoSideEffects) const
Converts from an integral complex to a floating complex. _Complex unsigned -> _Complex float...
void evalLoad(ExplodedNodeSet &Dst, const Expr *NodeEx, const Expr *BoundExpr, ExplodedNode *Pred, ProgramStateRef St, SVal location, const ProgramPointTag *tag=nullptr, QualType LoadTy=QualType())
Simulate a read of the result of Ex.
The result type of a method or function.
reverse_iterator rbegin()
CFGTerminator getTerminator()
bool isIntegralOrEnumerationType() const
Determine whether this type is an integral or enumeration type.
void VisitGuardedExpr(const Expr *Ex, const Expr *L, const Expr *R, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitGuardedExpr - Transfer function logic for ?, __builtin_choose.
DefinedOrUnknownSVal conjureSymbolVal(const void *symbolTag, const Expr *expr, const LocationContext *LCtx, unsigned count)
Create a new symbol with a unique 'name'.
bool isBuiltinType() const
isBuiltinType - returns true if the type is a builtin type.
bool isConstantSizeType() const
void VisitCompoundLiteralExpr(const CompoundLiteralExpr *CL, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitCompoundLiteralExpr - Transfer function logic for compound literals.
llvm::APSInt EvaluateKnownConstInt(const ASTContext &Ctx, SmallVectorImpl< PartialDiagnosticAt > *Diag=nullptr) const
const VarRegion * getOriginalRegion() const
decl_iterator decl_begin()
void VisitUnaryExprOrTypeTraitExpr(const UnaryExprOrTypeTraitExpr *Ex, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitUnaryExprOrTypeTraitExpr - Transfer function for sizeof.
Converts from an integral real to an integral complex whose element type matches the source...
bool isVectorType() const
BasicValueFactory & getBasicVals()
void runCheckersForPreStmt(ExplodedNodeSet &Dst, const ExplodedNodeSet &Src, const Stmt *S, ExprEngine &Eng)
Run checkers for pre-visiting Stmts.
const BlockDecl * getBlockDecl() const
void insert(const ExplodedNodeSet &S)
Converts a floating point complex to floating point real of the source's element type. Just discards the imaginary component. _Complex long double -> long double.
void VisitIncrementDecrementOperator(const UnaryOperator *U, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Handle ++ and – (both pre- and post-increment).
SValBuilder & getSValBuilder()
void addNodes(const ExplodedNodeSet &S)
StoreManager & getStoreManager()
Converts an integral complex to bool by comparing against 0+0i.
QualType getPointerType(QualType T) const
Return the uniqued reference to the type for a pointer to the specified type.
const MemRegion * getAsRegion() const
A conversion of a floating point real to a floating point complex of the original type...
CanQualType getCanonicalType(QualType T) const
Return the canonical (structural) type corresponding to the specified potentially non-canonical type ...
Optional< T > getAs() const
Convert to the specified ProgramPoint type, returning None if this ProgramPoint is not of the desired...
[ARC] Reclaim a retainable object pointer object that may have been produced and autoreleased as part...
QualType getTypeOfArgument() const
[ARC] Produces a retainable object pointer so that it may be consumed, e.g. by being passed to a cons...
Converts from T to _Atomic(T).
static bool isAdditiveOp(Opcode Opc)
Converts from a floating complex to an integral complex. _Complex float -> _Complex int...
const Expr * getInitializer() const
static bool isIncrementOp(Opcode Op)
void VisitBlockExpr(const BlockExpr *BE, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitBlockExpr - Transfer function logic for BlockExprs.
static bool isCompoundAssignmentOp(Opcode Opc)
DefinedOrUnknownSVal evalEQ(ProgramStateRef state, DefinedOrUnknownSVal lhs, DefinedOrUnknownSVal rhs)
pred_iterator pred_begin()
CFGElement - Represents a top-level expression in a basic block.
Converts from _Atomic(T) to T.
ExplodedNode * generateNode(const Stmt *S, ExplodedNode *Pred, ProgramStateRef St, const ProgramPointTag *tag=nullptr, ProgramPoint::Kind K=ProgramPoint::PostStmtKind)
const LangOptions & getLangOpts() const
const Expr * getInit(unsigned Init) const
void VisitBinaryOperator(const BinaryOperator *B, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitBinaryOperator - Transfer function logic for binary operators.
bool isSignedIntegerType() const
T castAs() const
Convert to the specified SVal type, asserting that this SVal is of the desired type.
Optional< T > getAs() const
Convert to the specified CFGElement type, returning None if this CFGElement is not of the desired typ...
llvm::ImmutableList< SVal > getEmptySValList()
Expr * IgnoreParens() LLVM_READONLY