18 using namespace clang;
40 SVal LeftV = state->getSVal(LHS, LCtx);
41 SVal RightV = state->getSVal(RHS, LCtx);
56 evalStore(Tmp2, B, LHS, *it, state->BindExpr(B, LCtx, ExprVal),
89 state = createTemporaryRegionIfNeeded(state, LCtx, LHS);
99 state = state->BindExpr(B, LCtx, Result);
108 llvm_unreachable(
"Invalid opcode for compound assignment.");
124 SVal location = LeftV;
125 evalLoad(Tmp, B, LHS, *it, state, location);
130 state = (*I)->getState();
132 SVal V = state->getSVal(LHS, LCtx);
136 cast<CompoundAssignOperator>(B)->getComputationResultType();
140 cast<CompoundAssignOperator>(B)->getComputationLHSType();
146 V = svalBuilder.
evalCast(V, CLHSTy, LTy);
164 Result = svalBuilder.
evalCast(LHSVal, CTy, LTy);
169 LHSVal = svalBuilder.
evalCast(Result, LTy, CTy);
175 state = state->BindExpr(B, LCtx, location);
177 state = state->BindExpr(B, LCtx, Result);
179 evalStore(Tmp2, B, LHS, *
I, state, location, LHSVal);
203 dyn_cast_or_null<BlockDataRegion>(V.
getAsRegion())) {
206 E = BDR->referenced_vars_end();
210 for (; I !=
E; ++
I) {
220 const Expr *copyExpr =
nullptr;
222 assert(CI->getVariable() == capturedR->
getDecl());
223 copyExpr = CI->getCopyExpr();
227 if (capturedR != originalR) {
261 evalLoad(Dst, CastE, CastE, subExprNode, state, state->getSVal(Ex, LCtx));
270 if (
const ExplicitCastExpr *ExCast=dyn_cast_or_null<ExplicitCastExpr>(CastE))
271 T = ExCast->getTypeAsWritten();
283 llvm_unreachable(
"LValueToRValue casts handled earlier.");
307 SVal V = state->getSVal(Ex, LCtx);
308 state = state->BindExpr(CastE, LCtx, V);
346 SVal V = state->getSVal(Ex, LCtx);
347 V = svalBuilder.
evalCast(V, T, ExTy);
351 state = state->BindExpr(CastE, LCtx, V);
357 SVal V = state->getSVal(Ex, LCtx);
359 state = state->BindExpr(CastE, LCtx, V);
366 SVal val = state->getSVal(Ex, LCtx);
368 state = state->BindExpr(CastE, LCtx, val);
374 SVal val = state->getSVal(Ex, LCtx);
398 state = state->BindExpr(CastE, LCtx, svalBuilder.
makeNull());
406 state = state->BindExpr(CastE, LCtx, NewSym);
409 state = state->BindExpr(CastE, LCtx, val);
417 state = state->BindExpr(CastE, LCtx, V);
435 state = state->BindExpr(CastE, LCtx, result);
454 if (isa<CXXConstructExpr>(Init)) {
457 assert(isa<InitListExpr>(Init));
458 Loc CLLoc = State->getLValue(CL, LCtx);
459 State = State->bindLoc(CLLoc, V);
504 SVal InitVal = state->getSVal(InitEx, LC);
507 if (
auto *CtorExpr = findDirectConstructorForCurrentCFGElement()) {
508 assert(InitEx->IgnoreImplicit() == CtorExpr);
520 InitVal = state->getSVal(M->getRegion());
529 if (InitEx->isGLValue()) {
540 evalBind(Dst2, DS, UpdatedN, state->getLValue(VD, LC), InitVal,
true);
581 assert(Term->isLogicalOp());
591 assert(!SrcBlock->
empty());
593 const Expr *RHS = cast<Expr>(Elem.getStmt());
596 if (RHSVal.isUndef()) {
601 std::tie(StTrue, StFalse) = N->getState()->assume(DefinedRHS);
613 assert(StFalse &&
"Infeasible path!");
638 if (NumInitElements == 0) {
645 ei = IE->
rend(); it != ei; ++it) {
646 SVal V = state->getSVal(cast<Expr>(*it), LCtx);
651 state->BindExpr(IE, LCtx,
659 assert(NumInitElements <= 1);
662 if (NumInitElements == 0)
665 V = state->getSVal(IE->
getInit(0), LCtx);
687 assert(N->pred_size() == 1);
691 SrcState = N->getState();
695 assert(SrcBlock &&
"missing function entry");
699 bool hasValue =
false;
702 for (
CFGElement CE : llvm::reverse(*SrcBlock)) {
704 const Expr *ValEx = cast<Expr>(CS->getStmt());
710 L = OpaqueEx->getSourceExpr();
716 V = SrcState->getSVal(ValEx, LCtx);
727 B.
generateNode(Ex, Pred, state->BindExpr(Ex, LCtx, V,
true));
783 state = state->BindExpr(Ex, (*I)->getLocationContext(),
826 state->getSVal(Ex, LCtx)));
862 state->getSVal(Ex, LCtx)));
875 SVal V = state->getSVal(Ex, LCtx);
884 llvm_unreachable(
"Invalid Opcode.");
903 else if (Ex->getType()->isFloatingType()) {
912 state = state->BindExpr(U, LCtx, Result);
933 SVal loc = state->getSVal(Ex, LCtx);
937 evalLoad(Tmp, U, Ex, Pred, state, loc);
943 state = (*I)->getState();
944 assert(LCtx == (*I)->getLocationContext());
945 SVal V2_untested = state->getSVal(Ex, LCtx);
948 if (V2_untested.isUnknownOrUndef()) {
949 Bldr.
generateNode(U, *
I, state->BindExpr(U, LCtx, V2_untested));
985 if (!state->assume(Constraint,
true)) {
988 Constraint = svalBuilder.
evalEQ(state, SymVal,
992 state = state->assume(Constraint,
false);
1001 state = state->BindExpr(U, LCtx, loc);
1003 state = state->BindExpr(U, LCtx, U->
isPostfix() ? V2 : Result);
1008 evalStore(Dst3, U, U, *
I, state, loc, Result);
unsigned getNumInits() const
CastKind getCastKind() const
CK_LValueToRValue - A conversion which causes the extraction of an r-value from the operand gl-value...
nonloc::ConcreteInt makeIntVal(const IntegerLiteral *integer)
DefinedSVal getBlockPointer(const BlockDecl *block, CanQualType locTy, const LocationContext *locContext, unsigned blockCount)
reverse_iterator rbegin()
SVal evalDerivedToBase(SVal Derived, const CastExpr *Cast)
Evaluates a chain of derived-to-base casts through the path specified in Cast.
SVal evalDynamicCast(SVal Base, QualType DerivedPtrType, bool &Failed)
Evaluates C++ dynamic_cast cast.
A (possibly-)qualified type.
succ_iterator succ_begin()
This builder class is useful for generating nodes that resulted from visiting a statement.
QuantityType getQuantity() const
getQuantity - Get the raw integer representation of this quantity.
bool isRecordType() const
ProgramPoint getLocation() const
getLocation - Returns the edge associated with the given node.
CK_ToUnion - The GCC cast-to-union extension.
SVal evalBinOp(ProgramStateRef state, BinaryOperator::Opcode op, NonLoc L, NonLoc R, QualType T)
unsigned pred_size() const
CK_BaseToDerivedMemberPointer - Member pointer in base class to member pointer in derived class...
Represents a point after we ran remove dead bindings BEFORE processing the given statement.
const Expr * getInit() const
CK_FloatingToIntegral - Floating point to integral.
SVal evalCast(SVal val, QualType castTy, QualType originalType)
[ARC] Consumes a retainable object pointer that has just been produced, e.g.
Value representing integer constant.
CK_IntegralToFloating - Integral to floating point.
void VisitUnaryOperator(const UnaryOperator *B, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitUnaryOperator - Transfer function logic for unary operators.
void takeNodes(const ExplodedNodeSet &S)
VarDecl - An instance of this class is created to represent a variable declaration or definition...
CK_IntegralCast - A cast between integral types (other than to boolean).
CompoundLiteralExpr - [C99 6.5.2.5].
unsigned succ_size() const
NonLoc makeArrayIndex(uint64_t idx)
uint64_t getTypeSize(QualType T) const
Return the size of the specified (complete) type T, in bits.
CK_Dynamic - A C++ dynamic_cast.
void evalStore(ExplodedNodeSet &Dst, const Expr *AssignE, const Expr *StoreE, ExplodedNode *Pred, ProgramStateRef St, SVal TargetLV, SVal Val, const ProgramPointTag *tag=nullptr)
evalStore - Handle the semantics of a store via an assignment.
UnaryExprOrTypeTrait getKind() const
CK_Dependent - A conversion which cannot yet be analyzed because either the expression or target type...
capture_iterator capture_begin()
static bool isAssignmentOp(Opcode Opc)
bool isZeroConstant() const
Defines the clang::Expr interface and subclasses for C++ expressions.
InitExprsTy::const_reverse_iterator const_reverse_iterator
ImplTy::iterator iterator
Represents a class type in Objective C.
Converts between different integral complex types.
SVal evalIntegralCast(ProgramStateRef state, SVal val, QualType castTy, QualType originalType)
bool isReferenceType() const
bool isAnyPointerType() const
llvm::ImmutableList< SVal > consVals(SVal X, llvm::ImmutableList< SVal > L)
static bool isIncrementDecrementOp(Opcode Op)
Converting between two Objective-C object types, which can occur when performing reference binding to...
CK_FloatingCast - Casting between floating types of different size.
[ARC] Causes a value of block type to be copied to the heap, if it is not already there...
T castAs() const
Convert to the specified CFGElement type, asserting that this CFGElement is of the desired type...
CK_VectorSplat - A conversion from an arithmetic type to a vector of that element type...
ASTContext & getContext() const
getContext - Return the ASTContext associated with this analysis.
CK_NullToPointer - Null pointer constant to pointer, ObjC pointer, or block pointer.
CK_PointerToIntegral - Pointer to integral.
CK_IntegralToPointer - Integral to pointer.
const VarDecl * getDecl() const
Converts a floating point complex to bool by comparing against 0+0i.
static bool isLocType(QualType T)
Describes an C or C++ initializer list.
CK_IntegralToBoolean - Integral to boolean.
void VisitOffsetOfExpr(const OffsetOfExpr *Ex, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitOffsetOfExpr - Transfer function for offsetof.
BlockDataRegion - A region that represents a block instance.
ExplodedNode * generateSink(const Stmt *S, ExplodedNode *Pred, ProgramStateRef St, const ProgramPointTag *tag=nullptr, ProgramPoint::Kind K=ProgramPoint::PostStmtKind)
CharUnits - This is an opaque type for sizes expressed in character units.
bool isUnknownOrUndef() const
A builtin binary operation expression such as "x + y" or "x <= y".
static bool isPostfix(Opcode Op)
isPostfix - Return true if this is a postfix operation, like x++.
NonLoc makeCompoundVal(QualType type, llvm::ImmutableList< SVal > vals)
CastExpr - Base class for type casts, including both implicit casts (ImplicitCastExpr) and explicit c...
bool isIncompleteType(NamedDecl **Def=nullptr) const
Types are partitioned into 3 broad categories (C99 6.2.5p1): object types, function types...
SVal evalComplement(SVal X)
void VisitDeclStmt(const DeclStmt *DS, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitDeclStmt - Transfer function logic for DeclStmts.
detail::InMemoryDirectory::const_iterator I
void evalBind(ExplodedNodeSet &Dst, const Stmt *StoreE, ExplodedNode *Pred, SVal location, SVal Val, bool atDeclInit=false, const ProgramPoint *PP=nullptr)
evalBind - Handle the semantics of binding a value to a specific location.
void VisitLogicalExpr(const BinaryOperator *B, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitLogicalExpr - Transfer function logic for '&&', '||'.
const LocationContext * getLocationContext() const
CK_AnyPointerToBlockPointerCast - Casting any non-block pointer to a block pointer.
const CFGBlock * getSrc() const
Causes a block literal to by copied to the heap and then autoreleased.
UnaryExprOrTypeTraitExpr - expression with either a type or (unevaluated) expression operand...
CFGBlock - Represents a single basic block in a source-level CFG.
void VisitInitListExpr(const InitListExpr *E, ExplodedNode *Pred, ExplodedNodeSet &Dst)
unsigned blockCount() const
Returns the number of times the current basic block has been visited on the exploded graph path...
CheckerManager & getCheckerManager() const
CK_FunctionToPointerDecay - Function to pointer decay.
Converts between different floating point complex types.
void runCheckersForPostStmt(ExplodedNodeSet &Dst, const ExplodedNodeSet &Src, const Stmt *S, ExprEngine &Eng, bool wasInlined=false)
Run checkers for post-visiting Stmts.
capture_iterator capture_end()
const CFGBlock * getDst() const
DefinedOrUnknownSVal makeZeroVal(QualType type)
Construct an SVal representing '0' for the specified type.
BlockDecl - This represents a block literal declaration, which is like an unnamed FunctionDecl...
Expr - This represents one expression.
const ProgramStateRef & getState() const
CK_PointerToBoolean - Pointer to boolean conversion.
Converts an integral complex to an integral real of the source's element type by discarding the imagi...
CK_BitCast - A conversion which causes a bit pattern of one type to be reinterpreted as a bit pattern...
bool isAnyComplexType() const
const VarRegion * getCapturedRegion() const
void VisitCast(const CastExpr *CastE, const Expr *Ex, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitCast - Transfer function logic for all casts (implicit and explicit).
BlockExpr - Adaptor class for mixing a BlockDecl with expressions.
Optional< T > getAs() const
Convert to the specified SVal type, returning None if this SVal is not of the desired type...
bool isVariableArrayType() const
const ExplodedNodeSet & getResults()
static CharUnits fromQuantity(QuantityType Quantity)
fromQuantity - Construct a CharUnits quantity from a raw integer type.
static SVal getValue(SVal val, SValBuilder &svalBuilder)
Expr * getSubExpr() const
T castAs() const
Convert to the specified ProgramPoint type, asserting that this ProgramPoint is of the desired type...
CK_ConstructorConversion - Conversion by constructor.
bool EvaluateAsInt(llvm::APSInt &Result, const ASTContext &Ctx, SideEffectsKind AllowSideEffects=SE_NoSideEffects) const
EvaluateAsInt - Return true if this is a constant which we can fold and convert to an integer...
Converts from an integral complex to a floating complex.
UnaryOperator - This represents the unary-expression's (except sizeof and alignof), the postinc/postdec operators from postfix-expression, and various extensions.
void evalLoad(ExplodedNodeSet &Dst, const Expr *NodeEx, const Expr *BoundExpr, ExplodedNode *Pred, ProgramStateRef St, SVal location, const ProgramPointTag *tag=nullptr, QualType LoadTy=QualType())
Simulate a read of the result of Ex.
The result type of a method or function.
reverse_iterator rbegin()
CK_ArrayToPointerDecay - Array to pointer decay.
CK_CPointerToObjCPointerCast - Casting a C pointer kind to an Objective-C pointer.
CFGTerminator getTerminator()
OpaqueValueExpr - An expression referring to an opaque object of a fixed type and value class...
bool isIntegralOrEnumerationType() const
Determine whether this type is an integral or enumeration type.
CK_UserDefinedConversion - Conversion using a user defined type conversion function.
void VisitGuardedExpr(const Expr *Ex, const Expr *L, const Expr *R, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitGuardedExpr - Transfer function logic for ?, __builtin_choose.
DefinedOrUnknownSVal conjureSymbolVal(const void *symbolTag, const Expr *expr, const LocationContext *LCtx, unsigned count)
Create a new symbol with a unique 'name'.
bool isBuiltinType() const
Helper methods to distinguish type categories.
bool isSingleDecl() const
isSingleDecl - This method returns true if this DeclStmt refers to a single Decl. ...
bool isConstantSizeType() const
Return true if this is not a variable sized type, according to the rules of C99 6.7.5p3.
CK_NullToMemberPointer - Null pointer constant to member pointer.
DeclStmt - Adaptor class for mixing declarations with statements and expressions. ...
void VisitCompoundLiteralExpr(const CompoundLiteralExpr *CL, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitCompoundLiteralExpr - Transfer function logic for compound literals.
llvm::APSInt EvaluateKnownConstInt(const ASTContext &Ctx, SmallVectorImpl< PartialDiagnosticAt > *Diag=nullptr) const
EvaluateKnownConstInt - Call EvaluateAsRValue and return the folded integer.
CK_ReinterpretMemberPointer - Reinterpret a member pointer as a different kind of member pointer...
CK_DerivedToBase - A conversion from a C++ class pointer to a base class pointer. ...
const VarRegion * getOriginalRegion() const
SVal - This represents a symbolic expression, which can be either an L-value or an R-value...
decl_iterator decl_begin()
void VisitUnaryExprOrTypeTraitExpr(const UnaryExprOrTypeTraitExpr *Ex, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitUnaryExprOrTypeTraitExpr - Transfer function for sizeof.
Converts from an integral real to an integral complex whose element type matches the source...
bool isVectorType() const
BasicValueFactory & getBasicVals()
void runCheckersForPreStmt(ExplodedNodeSet &Dst, const ExplodedNodeSet &Src, const Stmt *S, ExprEngine &Eng)
Run checkers for pre-visiting Stmts.
const BlockDecl * getBlockDecl() const
void insert(const ExplodedNodeSet &S)
Converts a floating point complex to floating point real of the source's element type.
void VisitIncrementDecrementOperator(const UnaryOperator *U, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Handle ++ and – (both pre- and post-increment).
SValBuilder & getSValBuilder()
void addNodes(const ExplodedNodeSet &S)
StoreManager & getStoreManager()
Converts an integral complex to bool by comparing against 0+0i.
CK_BaseToDerived - A conversion from a C++ class pointer/reference to a derived class pointer/referen...
QualType getPointerType(QualType T) const
Return the uniqued reference to the type for a pointer to the specified type.
CK_BlockPointerToObjCPointerCast - Casting a block pointer to an ObjC pointer.
detail::InMemoryDirectory::const_iterator E
const MemRegion * getAsRegion() const
A conversion of a floating point real to a floating point complex of the original type...
CanQualType getCanonicalType(QualType T) const
Return the canonical (structural) type corresponding to the specified potentially non-canonical type ...
CK_MemberPointerToBoolean - Member pointer to boolean.
ExplicitCastExpr - An explicit cast written in the source code.
Optional< T > getAs() const
Convert to the specified ProgramPoint type, returning None if this ProgramPoint is not of the desired...
[ARC] Reclaim a retainable object pointer object that may have been produced and autoreleased as part...
const T * getAs() const
Member-template getAs<specific type>'.
QualType getTypeOfArgument() const
Gets the argument type, or the type of the argument expression, whichever is appropriate.
[ARC] Produces a retainable object pointer so that it may be consumed, e.g.
CK_LValueBitCast - A conversion which reinterprets the address of an l-value as an l-value of a diffe...
Converts from T to _Atomic(T).
static bool isAdditiveOp(Opcode Opc)
Converts from a floating complex to an integral complex.
const Expr * getInitializer() const
CK_UncheckedDerivedToBase - A conversion from a C++ class pointer/reference to a base class that can ...
static bool isIncrementOp(Opcode Op)
X
Add a minimal nested name specifier fixit hint to allow lookup of a tag name from an outer enclosing ...
void VisitBlockExpr(const BlockExpr *BE, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitBlockExpr - Transfer function logic for BlockExprs.
static bool isCompoundAssignmentOp(Opcode Opc)
DefinedOrUnknownSVal evalEQ(ProgramStateRef state, DefinedOrUnknownSVal lhs, DefinedOrUnknownSVal rhs)
pred_iterator pred_begin()
CFGElement - Represents a top-level expression in a basic block.
This class is used for builtin types like 'int'.
CFGTerminator - Represents CFGBlock terminator statement.
Converts from _Atomic(T) to T.
ExplodedNode * generateNode(const Stmt *S, ExplodedNode *Pred, ProgramStateRef St, const ProgramPointTag *tag=nullptr, ProgramPoint::Kind K=ProgramPoint::PostStmtKind)
const LangOptions & getLangOpts() const
CK_NoOp - A conversion which does not affect the type other than (possibly) adding qualifiers...
CK_DerivedToBaseMemberPointer - Member pointer in derived class to member pointer in base class...
const Expr * getInit(unsigned Init) const
OffsetOfExpr - [C99 7.17] - This represents an expression of the form offsetof(record-type, member-designator).
void VisitBinaryOperator(const BinaryOperator *B, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitBinaryOperator - Transfer function logic for binary operators.
bool isSignedIntegerType() const
Return true if this is an integer type that is signed, according to C99 6.2.5p4 [char, signed char, short, int, long..], or an enum decl which has a signed representation.
T castAs() const
Convert to the specified SVal type, asserting that this SVal is of the desired type.
CK_ToVoid - Cast to void, discarding the computed value.
llvm::ImmutableList< SVal > getEmptySValList()
Expr * IgnoreParens() LLVM_READONLY
IgnoreParens - Ignore parentheses.
CK_FloatingToBoolean - Floating point to boolean.