23 using namespace clang;
30 void SValBuilder::anchor() { }
82 const llvm::APSInt& I = CI->getValue();
144 unsigned visitCount) {
159 unsigned VisitCount) {
206 unsigned blockCount) {
232 switch (E->getStmtClass()) {
235 case Stmt::AddrLabelExprClass:
236 return makeLoc(cast<AddrLabelExpr>(E));
238 case Stmt::CXXScalarValueInitExprClass:
239 case Stmt::ImplicitValueInitExprClass:
242 case Stmt::ObjCStringLiteralClass: {
247 case Stmt::StringLiteralClass: {
254 case Stmt::CharacterLiteralClass: {
259 case Stmt::CXXBoolLiteralExprClass:
262 case Stmt::IntegerLiteralClass:
265 case Stmt::ObjCBoolLiteralExprClass:
268 case Stmt::CXXNullPtrLiteralExprClass:
271 case Stmt::ImplicitCastExprClass: {
272 const CastExpr *CE = cast<CastExpr>(E);
308 if (!State->isTainted(RHS) && !State->isTainted(LHS))
315 const unsigned MaxComp = 10000;
317 if (symLHS && symRHS &&
319 return makeNonLoc(symLHS, Op, symRHS, ResultTy);
323 return makeNonLoc(symLHS, Op, rInt->getValue(), ResultTy);
327 return makeNonLoc(lInt->getValue(), Op, symRHS, ResultTy);
383 if (Quals1 != Quals2)
418 return makeNonLoc(Sym,
BO_NE, BVF.getValue(0, Sym->getType()), castTy);
441 if (
const MemRegion *R = LV->getLoc().getAsRegion()) {
461 QualType elemTy = arrayT->getElementType();
const SymExpr * getAsSymExpr() const
CastKind getCastKind() const
const internal::VariadicDynCastAllOfMatcher< Stmt, Expr > expr
Matches expressions.
TypedValueRegion - An abstract class representing regions having a typed value.
nonloc::ConcreteInt makeIntVal(const IntegerLiteral *integer)
DefinedSVal getBlockPointer(const BlockDecl *block, CanQualType locTy, const LocationContext *locContext, unsigned blockCount)
ASTContext & getASTContext() const
MemRegion - The root abstract class for all memory regions.
bool isMemberPointerType() const
const internal::VariadicAllOfMatcher< Stmt > stmt
Matches statements.
const IntSymExpr * getIntSymExpr(const llvm::APSInt &lhs, BinaryOperator::Opcode op, const SymExpr *rhs, QualType t)
virtual QualType getValueType() const =0
SVal makeSymExprValNN(ProgramStateRef state, BinaryOperator::Opcode op, NonLoc lhs, NonLoc rhs, QualType resultTy)
Constructs a symbolic expression for two non-location values.
ProgramStateManager & StateMgr
bool isBooleanType() const
bool isBlockPointerType() const
SVal evalCast(SVal val, QualType castTy, QualType originalType)
Value representing integer constant.
MemRegionManager MemMgr
Manages the creation of memory regions.
virtual SVal dispatchCast(SVal val, QualType castTy)=0
loc::MemRegionVal getCXXThis(const CXXMethodDecl *D, const StackFrameContext *SFC)
Return a memory region for the 'this' object reference.
NonLoc makeNonLoc(const SymExpr *lhs, BinaryOperator::Opcode op, const llvm::APSInt &rhs, QualType type)
QualType getThisType(ASTContext &C) const
Returns the type of the this pointer.
unsigned getValue() const
NullPointerConstantKind isNullPointerConstant(ASTContext &Ctx, NullPointerConstantValueDependence NPC) const
bool isZeroConstant() const
Defines the clang::Expr interface and subclasses for C++ expressions.
const MemRegion * castRegion(const MemRegion *region, QualType CastToTy)
Symbolic value. These values used to capture symbolic execution of the program.
const SymbolDerived * getDerivedSymbol(SymbolRef parentSymbol, const TypedValueRegion *R)
virtual SVal evalCastFromNonLoc(NonLoc val, QualType castTy)=0
virtual SVal evalBinOpLN(ProgramStateRef state, BinaryOperator::Opcode op, Loc lhs, NonLoc rhs, QualType resultTy)=0
MemRegionManager & getRegionManager()
Holds long-lived AST nodes (such as types and decls) that can be referred to throughout the semantic ...
unsigned computeComplexity() const
bool isReferenceType() const
static bool canSymbolicate(QualType T)
const BlockDataRegion * getBlockDataRegion(const BlockTextRegion *bc, const LocationContext *lc, unsigned blockCount)
AnalysisDeclContext * getAnalysisDeclContext() const
DefinedOrUnknownSVal getDerivedRegionValueSymbolVal(SymbolRef parentSymbol, const TypedValueRegion *region)
const FunctionTextRegion * getFunctionTextRegion(const NamedDecl *FD)
const SymbolicRegion * getSymbolicRegion(SymbolRef Sym)
Retrieve or create a "symbolic" memory region.
static bool isLocType(QualType T)
const BlockTextRegion * getBlockTextRegion(const BlockDecl *BD, CanQualType locTy, AnalysisDeclContext *AC)
bool UnwrapSimilarPointerTypes(QualType &T1, QualType &T2)
bool isUnknownOrUndef() const
const SymIntExpr * getSymIntExpr(const SymExpr *lhs, BinaryOperator::Opcode op, const llvm::APSInt &rhs, QualType t)
DefinedOrUnknownSVal getRegionValueSymbolVal(const TypedValueRegion *region)
Make a unique symbol for value of region.
DefinedSVal getFunctionPointer(const FunctionDecl *func)
nonloc::ConcreteInt makeBoolVal(const ObjCBoolLiteralExpr *boolean)
Loc makeLoc(SymbolRef sym)
bool isFunctionPointerType() const
DefinedOrUnknownSVal makeZeroVal(QualType type)
Construct an SVal representing '0' for the specified type.
const Type * getTypeForDecl() const
Optional< T > getAs() const
Convert to the specified SVal type, returning None if this SVal is not of the desired type...
bool isVariableArrayType() const
const QualType ArrayIndexTy
The scalar type to use for array indices.
virtual SVal evalBinOpLL(ProgramStateRef state, BinaryOperator::Opcode op, Loc lhs, Loc rhs, QualType resultTy)=0
bool EvaluateAsInt(llvm::APSInt &Result, const ASTContext &Ctx, SideEffectsKind AllowSideEffects=SE_NoSideEffects) const
SVal evalBinOp(ProgramStateRef state, BinaryOperator::Opcode op, SVal lhs, SVal rhs, QualType type)
StoreManager & getStoreManager()
The result type of a method or function.
QualType getConditionType() const
void removeCVRQualifiers(unsigned mask)
const SymbolCast * getCastSymbol(const SymExpr *Operand, QualType From, QualType To)
const SymSymExpr * getSymSymExpr(const SymExpr *lhs, BinaryOperator::Opcode op, const SymExpr *rhs, QualType t)
bool isIntegralOrEnumerationType() const
Determine whether this type is an integral or enumeration type.
SymbolManager SymMgr
Manages the creation of symbols.
DefinedOrUnknownSVal conjureSymbolVal(const void *symbolTag, const Expr *expr, const LocationContext *LCtx, unsigned count)
Create a new symbol with a unique 'name'.
virtual SVal evalCastFromLoc(Loc val, QualType castTy)=0
Represents a static or instance method of a struct/union/class.
ASTContext & getContext()
const SymbolRegionValue * getRegionValueSymbol(const TypedValueRegion *R)
Make a unique symbol for MemRegion R according to its kind.
const SymbolMetadata * getMetadataSymbol(const MemRegion *R, const Stmt *S, QualType T, unsigned VisitCount, const void *SymbolTag=nullptr)
Creates a metadata symbol associated with a specific region.
Specifies that a value-dependent expression should be considered to never be a null pointer constant...
static bool shouldBeModeledWithNoOp(ASTContext &Context, QualType ToTy, QualType FromTy)
DefinedOrUnknownSVal getConjuredHeapSymbolVal(const Expr *E, const LocationContext *LCtx, unsigned Count)
Conjure a symbol representing heap allocated memory region.
virtual SVal evalBinOpNN(ProgramStateRef state, BinaryOperator::Opcode op, NonLoc lhs, NonLoc rhs, QualType resultTy)=0
const unsigned ArrayIndexWidth
The width of the scalar type used for array indices.
const SymbolicRegion * getSymbolicHeapRegion(SymbolRef sym)
Return a unique symbolic region belonging to heap memory space.
SVal ArrayToPointer(Loc Array, QualType ElementTy)
const internal::VariadicAllOfMatcher< Type > type
Matches Types in the clang AST.
QualType getPointerType(QualType T) const
Return the uniqued reference to the type for a pointer to the specified type.
DefinedSVal getMetadataSymbolVal(const void *symbolTag, const MemRegion *region, const Expr *expr, QualType type, unsigned count)
Represents symbolic expression.
const MemRegion * getAsRegion() const
CanQualType getCanonicalType(QualType T) const
Return the canonical (structural) type corresponding to the specified potentially non-canonical type ...
SVal convertToArrayIndex(SVal val)
const SymbolConjured * conjureSymbol(const Stmt *E, const LocationContext *LCtx, QualType T, unsigned VisitCount, const void *SymbolTag=nullptr)
BasicValueFactory & getBasicValueFactory()
QualType getCanonicalType() const
bool isFunctionType() const
Defines the C++ Decl subclasses, other than those for templates (found in DeclTemplate.h) and friends (in DeclFriend.h).
Represents a C++ struct/union/class.
DefinedOrUnknownSVal evalEQ(ProgramStateRef state, DefinedOrUnknownSVal lhs, DefinedOrUnknownSVal rhs)
Optional< SVal > getConstantVal(const Expr *E)
SymbolRef getAsSymbol(bool IncludeBaseRegions=false) const
If this SVal wraps a symbol return that SymbolRef. Otherwise, return 0.
nonloc::ConcreteInt makeTruthVal(bool b, QualType type)
A boolean literal, per ([C++ lex.bool] Boolean literals).
T castAs() const
Convert to the specified SVal type, asserting that this SVal is of the desired type.
QualType getUnqualifiedArrayType(QualType T, Qualifiers &Quals)
Return this type as a completely-unqualified array type, capturing the qualifiers in Quals...
Expr * IgnoreParens() LLVM_READONLY
bool isPointerType() const