clang 10.0.0git

Classes | Public Types | Public Member Functions | Static Public Member Functions | Protected Member Functions | List of all members
clang::ento::ExprEngine Class Reference

`#include "clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h"`

Inheritance diagram for clang::ento::ExprEngine:
[legend]
Collaboration diagram for clang::ento::ExprEngine:
[legend]

## Classes
struct | EvalCallOptions
| Hints for figuring out of a call should be inlined during evalCall(). More...

## Public Types
enum | InliningModes { Inline_Regular = 0, Inline_Minimal = 0x1 }
| The modes of inlining, which override the default analysis-wide settings. More...

## Public Member Functions
| ExprEngine (cross_tu::CrossTranslationUnitContext &CTU, AnalysisManager &mgr, SetOfConstDecls *VisitedCalleesIn, FunctionSummariesTy *FS, InliningModes HowToInlineIn)
| ~ExprEngine () override=default
bool | ExecuteWorkList (const LocationContext *L, unsigned Steps=150000)
| Returns true if there is still simulation state on the worklist. More...
bool | ExecuteWorkListWithInitialState (const LocationContext *L, unsigned Steps, ProgramStateRef InitState, ExplodedNodeSet &Dst)
| Execute the work list with an initial state. More...
ASTContext & | getContext () const
| getContext - Return the ASTContext associated with this analysis. More...
AnalysisManager & | getAnalysisManager () override
AnalysisDeclContextManager & | getAnalysisDeclContextManager ()
CheckerManager & | getCheckerManager () const
SValBuilder & | getSValBuilder ()
BugReporter & | getBugReporter ()
cross_tu::CrossTranslationUnitContext * | getCrossTranslationUnitContext () override
const NodeBuilderContext & | getBuilderContext ()
const Stmt * | getStmt () const
void | GenerateAutoTransition (ExplodedNode *N)
void | enqueueEndOfPath (ExplodedNodeSet &S)
void | GenerateCallExitNode (ExplodedNode *N)
std::string | DumpGraph (bool trim=false, StringRef Filename="")
| Dump graph to the specified filename. More...
std::string | DumpGraph (ArrayRef< const ExplodedNode *> Nodes, StringRef Filename="")
| Dump the graph consisting of the given nodes to a specified filename. More...
void | ViewGraph (bool trim=false)
| Visualize the ExplodedGraph created by executing the simulation. More...
void | ViewGraph (ArrayRef< const ExplodedNode *> Nodes)
| Visualize a trimmed ExplodedGraph that only contains paths to the given nodes. More...
ProgramStateRef | getInitialState (const LocationContext *InitLoc) override
| getInitialState - Return the initial state used for the root vertex in the ExplodedGraph. More...
ExplodedGraph & | getGraph ()
const ExplodedGraph & | getGraph () const
void | removeDead (ExplodedNode *Node, ExplodedNodeSet &Out, const Stmt *ReferenceStmt, const LocationContext *LC, const Stmt *DiagnosticStmt=nullptr, ProgramPoint::Kind K=ProgramPoint::PreStmtPurgeDeadSymbolsKind)
| Run the analyzer's garbage collection - remove dead symbols and bindings from the state. More...
void | processCFGElement (const CFGElement E, ExplodedNode *Pred, unsigned StmtIdx, NodeBuilderContext *Ctx) override
| processCFGElement - Called by CoreEngine. More...
void | ProcessStmt (const Stmt *S, ExplodedNode *Pred)
void | ProcessLoopExit (const Stmt *S, ExplodedNode *Pred)
void | ProcessInitializer (const CFGInitializer I, ExplodedNode *Pred)
void | ProcessImplicitDtor (const CFGImplicitDtor D, ExplodedNode *Pred)
void | ProcessNewAllocator (const CXXNewExpr *NE, ExplodedNode *Pred)
void | ProcessAutomaticObjDtor (const CFGAutomaticObjDtor D, ExplodedNode *Pred, ExplodedNodeSet &Dst)
void | ProcessDeleteDtor (const CFGDeleteDtor D, ExplodedNode *Pred, ExplodedNodeSet &Dst)
void | ProcessBaseDtor (const CFGBaseDtor D, ExplodedNode *Pred, ExplodedNodeSet &Dst)
void | ProcessMemberDtor (const CFGMemberDtor D, ExplodedNode *Pred, ExplodedNodeSet &Dst)
void | ProcessTemporaryDtor (const CFGTemporaryDtor D, ExplodedNode *Pred, ExplodedNodeSet &Dst)
void | processCFGBlockEntrance (const BlockEdge &L, NodeBuilderWithSinks &nodeBuilder, ExplodedNode *Pred) override
| Called by CoreEngine when processing the entrance of a CFGBlock. More...
void | processBranch (const Stmt *Condition, NodeBuilderContext &BuilderCtx, ExplodedNode *Pred, ExplodedNodeSet &Dst, const CFGBlock *DstT, const CFGBlock *DstF) override
| ProcessBranch - Called by CoreEngine. More...
void | processCleanupTemporaryBranch (const CXXBindTemporaryExpr *BTE, NodeBuilderContext &BldCtx, ExplodedNode *Pred, ExplodedNodeSet &Dst, const CFGBlock *DstT, const CFGBlock *DstF) override
| Called by CoreEngine. More...
void | processStaticInitializer (const DeclStmt *DS, NodeBuilderContext &BuilderCtx, ExplodedNode *Pred, ExplodedNodeSet &Dst, const CFGBlock *DstT, const CFGBlock *DstF) override
| Called by CoreEngine. More...
void | processIndirectGoto (IndirectGotoNodeBuilder &builder) override
| processIndirectGoto - Called by CoreEngine. More...
void | processSwitch (SwitchNodeBuilder &builder) override
| ProcessSwitch - Called by CoreEngine. More...
void | processBeginOfFunction (NodeBuilderContext &BC, ExplodedNode *Pred, ExplodedNodeSet &Dst, const BlockEdge &L) override
| Called by CoreEngine. More...
void | processEndOfFunction (NodeBuilderContext &BC, ExplodedNode *Pred, const ReturnStmt *RS=nullptr) override
| Called by CoreEngine. More...
void | removeDeadOnEndOfFunction (NodeBuilderContext &BC, ExplodedNode *Pred, ExplodedNodeSet &Dst)
| Remove dead bindings/symbols before exiting a function. More...
void | processCallEnter (NodeBuilderContext &BC, CallEnter CE, ExplodedNode *Pred) override
| Generate the entry node of the callee. More...
void | processCallExit (ExplodedNode *Pred) override
| Generate the sequence of nodes that simulate the call exit and the post visit for CallExpr. More...
void | processEndWorklist () override
| Called by CoreEngine when the analysis worklist has terminated. More...
ProgramStateRef | processAssume (ProgramStateRef state, SVal cond, bool assumption) override
| evalAssume - Callback function invoked by the ConstraintManager when making assumptions about state values. More...
ProgramStateRef | processRegionChanges (ProgramStateRef state, const InvalidatedSymbols *invalidated, ArrayRef< const MemRegion *> ExplicitRegions, ArrayRef< const MemRegion *> Regions, const LocationContext *LCtx, const CallEvent *Call) override
| processRegionChanges - Called by ProgramStateManager whenever a change is made to the store. More...
void | printJson (raw_ostream &Out, ProgramStateRef State, const LocationContext *LCtx, const char *NL, unsigned int Space, bool IsDot) const override
| printJson - Called by ProgramStateManager to print checker-specific data. More...
ProgramStateManager & | getStateManager () override
StoreManager & | getStoreManager ()
ConstraintManager & | getConstraintManager ()
BasicValueFactory & | getBasicVals ()
SymbolManager & | getSymbolManager ()
MemRegionManager & | getRegionManager ()
NoteTag::Factory & | getNoteTags ()
bool | wasBlocksExhausted () const
bool | hasEmptyWorkList () const
bool | hasWorkRemaining () const
const CoreEngine & | getCoreEngine () const
void | Visit (const Stmt *S, ExplodedNode *Pred, ExplodedNodeSet &Dst)
| Visit - Transfer function logic for all statements. More...
void | VisitArraySubscriptExpr (const ArraySubscriptExpr *Ex, ExplodedNode *Pred, ExplodedNodeSet &Dst)
| VisitArraySubscriptExpr - Transfer function for array accesses. More...
void | VisitGCCAsmStmt (const GCCAsmStmt *A, ExplodedNode *Pred, ExplodedNodeSet &Dst)
| VisitGCCAsmStmt - Transfer function logic for inline asm. More...
void | VisitMSAsmStmt (const MSAsmStmt *A, ExplodedNode *Pred, ExplodedNodeSet &Dst)
| VisitMSAsmStmt - Transfer function logic for MS inline asm. More...
void | VisitBlockExpr (const BlockExpr *BE, ExplodedNode *Pred, ExplodedNodeSet &Dst)
| VisitBlockExpr - Transfer function logic for BlockExprs. More...
void | VisitLambdaExpr (const LambdaExpr *LE, ExplodedNode *Pred, ExplodedNodeSet &Dst)
| VisitLambdaExpr - Transfer function logic for LambdaExprs. More...
void | VisitBinaryOperator (const BinaryOperator *B, ExplodedNode *Pred, ExplodedNodeSet &Dst)
| VisitBinaryOperator - Transfer function logic for binary operators. More...
void | VisitCallExpr (const CallExpr *CE, ExplodedNode *Pred, ExplodedNodeSet &Dst)
| VisitCall - Transfer function for function calls. More...
void | VisitCast (const CastExpr *CastE, const Expr *Ex, ExplodedNode *Pred, ExplodedNodeSet &Dst)
| VisitCast - Transfer function logic for all casts (implicit and explicit). More...
void | VisitCompoundLiteralExpr (const CompoundLiteralExpr *CL, ExplodedNode *Pred, ExplodedNodeSet &Dst)
| VisitCompoundLiteralExpr - Transfer function logic for compound literals. More...
void | VisitCommonDeclRefExpr (const Expr *DR, const NamedDecl *D, ExplodedNode *Pred, ExplodedNodeSet &Dst)
| Transfer function logic for DeclRefExprs and BlockDeclRefExprs. More...
void | VisitDeclStmt (const DeclStmt *DS, ExplodedNode *Pred, ExplodedNodeSet &Dst)
| VisitDeclStmt - Transfer function logic for DeclStmts. More...
void | VisitGuardedExpr (const Expr *Ex, const Expr *L, const Expr *R, ExplodedNode *Pred, ExplodedNodeSet &Dst)
| VisitGuardedExpr - Transfer function logic for ?, __builtin_choose. More...
void | VisitInitListExpr (const InitListExpr *E, ExplodedNode *Pred, ExplodedNodeSet &Dst)
void | VisitLogicalExpr (const BinaryOperator *B, ExplodedNode *Pred, ExplodedNodeSet &Dst)
| VisitLogicalExpr - Transfer function logic for '&&', '||'. More...
void | VisitMemberExpr (const MemberExpr *M, ExplodedNode *Pred, ExplodedNodeSet &Dst)
| VisitMemberExpr - Transfer function for member expressions. More...
void | VisitAtomicExpr (const AtomicExpr *E, ExplodedNode *Pred, ExplodedNodeSet &Dst)
| VisitAtomicExpr - Transfer function for builtin atomic expressions. More...
void | VisitObjCAtSynchronizedStmt (const ObjCAtSynchronizedStmt *S, ExplodedNode *Pred, ExplodedNodeSet &Dst)
| Transfer function logic for ObjCAtSynchronizedStmts. More...
void | VisitLvalObjCIvarRefExpr (const ObjCIvarRefExpr *DR, ExplodedNode *Pred, ExplodedNodeSet &Dst)
| Transfer function logic for computing the lvalue of an Objective-C ivar. More...
void | VisitObjCForCollectionStmt (const ObjCForCollectionStmt *S, ExplodedNode *Pred, ExplodedNodeSet &Dst)
| VisitObjCForCollectionStmt - Transfer function logic for ObjCForCollectionStmt. More...
void | VisitObjCMessage (const ObjCMessageExpr *ME, ExplodedNode *Pred, ExplodedNodeSet &Dst)
void | VisitReturnStmt (const ReturnStmt *R, ExplodedNode *Pred, ExplodedNodeSet &Dst)
| VisitReturnStmt - Transfer function logic for return statements. More...
void | VisitOffsetOfExpr (const OffsetOfExpr *Ex, ExplodedNode *Pred, ExplodedNodeSet &Dst)
| VisitOffsetOfExpr - Transfer function for offsetof. More...
void | VisitUnaryExprOrTypeTraitExpr (const UnaryExprOrTypeTraitExpr *Ex, ExplodedNode *Pred, ExplodedNodeSet &Dst)
| VisitUnaryExprOrTypeTraitExpr - Transfer function for sizeof. More...
void | VisitUnaryOperator (const UnaryOperator *B, ExplodedNode *Pred, ExplodedNodeSet &Dst)
| VisitUnaryOperator - Transfer function logic for unary operators. More...
void | VisitIncrementDecrementOperator (const UnaryOperator *U, ExplodedNode *Pred, ExplodedNodeSet &Dst)
| Handle ++ and – (both pre- and post-increment). More...
void | VisitCXXBindTemporaryExpr (const CXXBindTemporaryExpr *BTE, ExplodedNodeSet &PreVisit, ExplodedNodeSet &Dst)
void | VisitCXXCatchStmt (const CXXCatchStmt *CS, ExplodedNode *Pred, ExplodedNodeSet &Dst)
void | VisitCXXThisExpr (const CXXThisExpr *TE, ExplodedNode *Pred, ExplodedNodeSet &Dst)
void | VisitCXXConstructExpr (const CXXConstructExpr *E, ExplodedNode *Pred, ExplodedNodeSet &Dst)
void | VisitCXXDestructor (QualType ObjectType, const MemRegion *Dest, const Stmt *S, bool IsBaseDtor, ExplodedNode *Pred, ExplodedNodeSet &Dst, EvalCallOptions &Options)
void | VisitCXXNewAllocatorCall (const CXXNewExpr *CNE, ExplodedNode *Pred, ExplodedNodeSet &Dst)
void | VisitCXXNewExpr (const CXXNewExpr *CNE, ExplodedNode *Pred, ExplodedNodeSet &Dst)
void | VisitCXXDeleteExpr (const CXXDeleteExpr *CDE, ExplodedNode *Pred, ExplodedNodeSet &Dst)
void | CreateCXXTemporaryObject (const MaterializeTemporaryExpr *ME, ExplodedNode *Pred, ExplodedNodeSet &Dst)
| Create a C++ temporary object for an rvalue. More...
void | evalEagerlyAssumeBinOpBifurcation (ExplodedNodeSet &Dst, ExplodedNodeSet &Src, const Expr *Ex)
| evalEagerlyAssumeBinOpBifurcation - Given the nodes in 'Src', eagerly assume symbolic expressions of the form 'x != 0' and generate new nodes (stored in Dst) with those assumptions. More...
SVal | evalMinus (SVal X)
SVal | evalComplement (SVal X)
ProgramStateRef | handleLValueBitCast (ProgramStateRef state, const Expr *Ex, const LocationContext *LCtx, QualType T, QualType ExTy, const CastExpr *CastE, StmtNodeBuilder &Bldr, ExplodedNode *Pred)
ProgramStateRef | handleLVectorSplat (ProgramStateRef state, const LocationContext *LCtx, const CastExpr *CastE, StmtNodeBuilder &Bldr, ExplodedNode *Pred)
void | handleUOExtension (ExplodedNodeSet::iterator I, const UnaryOperator *U, StmtNodeBuilder &Bldr)
SVal | evalBinOp (ProgramStateRef state, BinaryOperator::Opcode op, NonLoc L, NonLoc R, QualType T)
SVal | evalBinOp (ProgramStateRef state, BinaryOperator::Opcode op, NonLoc L, SVal R, QualType T)
SVal | evalBinOp (ProgramStateRef ST, BinaryOperator::Opcode Op, SVal LHS, SVal RHS, QualType T)
void | evalLoad (ExplodedNodeSet &Dst, const Expr *NodeEx, const Expr *BoundExpr, ExplodedNode *Pred, ProgramStateRef St, SVal location, const ProgramPointTag *tag=nullptr, QualType LoadTy=QualType())
| Simulate a read of the result of Ex. More...
void | evalStore (ExplodedNodeSet &Dst, const Expr *AssignE, const Expr *StoreE, ExplodedNode *Pred, ProgramStateRef St, SVal TargetLV, SVal Val, const ProgramPointTag *tag=nullptr)
| evalStore - Handle the semantics of a store via an assignment. More...
CFGElement | getCurrentCFGElement ()
| Return the CFG element corresponding to the worklist element that is currently being processed by ExprEngine. More...
ProgramStateRef | bindReturnValue (const CallEvent &Call, const LocationContext *LCtx, ProgramStateRef State)
| Create a new state in which the call return value is binded to the call origin expression. More...
void | evalCall (ExplodedNodeSet &Dst, ExplodedNode *Pred, const CallEvent &Call)
| Evaluate a call, running pre- and post-call checkers and allowing checkers to be responsible for handling the evaluation of the call itself. More...
void | defaultEvalCall (NodeBuilder &B, ExplodedNode *Pred, const CallEvent &Call, const EvalCallOptions &CallOpts={})
| Default implementation of call evaluation. More...
Public Member Functions inherited from clang::ento::SubEngine
virtual | ~SubEngine ()
ProgramStateRef | processRegionChange (ProgramStateRef state, const MemRegion *MR, const LocationContext *LCtx)

## Static Public Member Functions
static std::pair< const ProgramPointTag *, const ProgramPointTag * > | geteagerlyAssumeBinOpBifurcationTags ()
static Optional< SVal > | getObjectUnderConstruction (ProgramStateRef State, const ConstructionContextItem &Item, const LocationContext *LC)
| By looking at a certain item that may be potentially part of an object's ConstructionContext, retrieve such object's location. More...

## Protected Member Functions
void | evalBind (ExplodedNodeSet &Dst, const Stmt *StoreE, ExplodedNode *Pred, SVal location, SVal Val, bool atDeclInit=false, const ProgramPoint *PP=nullptr)
| evalBind - Handle the semantics of binding a value to a specific location. More...
ProgramStateRef | processPointerEscapedOnBind (ProgramStateRef State, ArrayRef< std::pair< SVal, SVal >> LocAndVals, const LocationContext *LCtx, PointerEscapeKind Kind, const CallEvent *Call) override
| Call PointerEscape callback when a value escapes as a result of bind. More...
ProgramStateRef | processPointerEscapedOnBind (ProgramStateRef State, SVal Loc, SVal Val, const LocationContext *LCtx)
ProgramStateRef | notifyCheckersOfPointerEscape (ProgramStateRef State, const InvalidatedSymbols *Invalidated, ArrayRef< const MemRegion *> ExplicitRegions, const CallEvent *Call, RegionAndSymbolInvalidationTraits &ITraits) override
| Call PointerEscape callback when a value escapes as a result of region invalidation. More...
ProgramStateRef | escapeValues (ProgramStateRef State, ArrayRef< SVal > Vs, PointerEscapeKind K, const CallEvent *Call=nullptr) const
| A simple wrapper when you only need to notify checkers of pointer-escape of some values. More...

## Detailed Description

Definition at line 84 of file ExprEngine.h.

## Member Enumeration Documentation

## ◆ InliningModes

enum clang::ento::ExprEngine::InliningModes

The modes of inlining, which override the default analysis-wide settings.

Enumerator
Inline_Regular | Follow the default settings for inlining callees.
Inline_Minimal | Do minimal inlining of callees.

Definition at line 87 of file ExprEngine.h.

## Constructor & Destructor Documentation

## ◆ ExprEngine()

ExprEngine::ExprEngine | ( | cross_tu::CrossTranslationUnitContext & | CTU,
|  | AnalysisManager & | mgr,
|  | SetOfConstDecls * | VisitedCalleesIn,
|  | FunctionSummariesTy * | FS,
|  | InliningModes | HowToInlineIn
| ) |  |

Definition at line 202 of file ExprEngine.cpp.

Referenced by llvm::DOTGraphTraits< ExplodedGraph * >::nodeHasBugReport().

## ◆ ~ExprEngine()

clang::ento::ExprEngine::~ExprEngine | ( |  | ) |
| override default

## Member Function Documentation

## ◆ bindReturnValue()

ProgramStateRef ExprEngine::bindReturnValue | ( | const CallEvent & | Call,
|  | const LocationContext * | LCtx,
|  | ProgramStateRef | State
| ) |  |

Create a new state in which the call return value is binded to the call origin expression.

Definition at line 637 of file ExprEngineCallAndReturn.cpp.

References clang::CFG::BuildOptions::AddImplicitDtors, clang::CFG::BuildOptions::AddInitializers, clang::ento::SVal::castAs(), clang::ento::CE_Block, clang::ento::CE_CXXAllocator, clang::ento::CE_CXXConstructor, clang::ento::CE_CXXDestructor, clang::ento::CE_CXXMember, clang::ento::CE_CXXMemberOperator, clang::ento::CE_Function, clang::ento::CE_ObjCMessage, clang::CIMK_Constructors, clang::CIMK_Destructors, clang::CIMK_MemberFunctions, clang::CXXConstructExpr::CK_Complete, clang::ento::NodeBuilder::generateNode(), clang::LocationContext::getAnalysisDeclContext(), clang::CFGElement::getAs(), clang::ento::SVal::getAsRegion(), clang::AnalysisDeclContext::getCFGBuildOptions(), getCurrentCFGElement(), clang::CXXConstructorCall::getDecl(), clang::AnalyzerOptions::getIPAMode(), clang::ento::CallEvent::getKind(), clang::ento::ExplodedNode::getLocationContext(), clang::ento::CallEvent::getOriginExpr(), clang::CXXConstructorCall::getOriginExpr(), clang::CXXMethodDecl::getParent(), clang::ento::CallEvent::getProgramPoint(), clang::ento::CallEvent::getResultType(), clang::LocationContext::getStackFrame(), clang::Expr::getType(), clang::CXXRecordDecl::hasTrivialDestructor(), clang::ento::CallEvent::invalidateRegions(), clang::IPAK_DynamicDispatch, clang::IPAK_DynamicDispatchBifurcate, clang::ento::ExprEngine::EvalCallOptions::IsArrayCtorOrDtor, clang::ento::ExprEngine::EvalCallOptions::IsCtorOrDtorWithImproperlyModeledTargetRegion, clang::ento::ExprEngine::EvalCallOptions::IsTemporaryCtorOrDtor, clang::ento::ExprEngine::EvalCallOptions::IsTemporaryLifetimeExtendedViaAggregate, clang::AnalyzerOptions::mayInlineCXXMemberFunction(), clang::OMF_autorelease, clang::OMF_retain, clang::OMF_self, clang::ento::RegionAndSymbolInvalidationTraits::setTrait(), State, clang::Target, and clang::ento::RegionAndSymbolInvalidationTraits::TK_DoNotInvalidateSuperRegion.

Referenced by CreateCXXTemporaryObject().

## ◆ CreateCXXTemporaryObject()

void ExprEngine::CreateCXXTemporaryObject | ( | const MaterializeTemporaryExpr * | ME,
|  | ExplodedNode * | Pred,
|  | ExplodedNodeSet & | Dst
| ) |  |

Create a C++ temporary object for an rvalue.

Definition at line 26 of file ExprEngineCXX.cpp.

References clang::ConstructionContext::ArgumentKind, clang::ento::ExplodedNodeSet::begin(), bindReturnValue(), clang::ento::NodeBuilderContext::blockCount(), clang::ento::SValBuilder::conjureSymbolVal(), clang::ConstructionContext::CXX17ElidedCopyConstructorInitializerKind, clang::ConstructionContext::CXX17ElidedCopyReturnedValueKind, clang::ConstructionContext::CXX17ElidedCopyVariableKind, clang::ConstructionContext::ElidedTemporaryObjectKind, clang::ento::ExplodedNodeSet::end(), evalBind(), clang::ento::NodeBuilder::generateNode(), clang::ento::StmtNodeBuilder::generateNode(), clang::ento::AnalysisManager::getAnalyzerOptions(), clang::ento::CallEvent::getArgSVal(), clang::ento::SVal::getAs(), clang::ASTContext::getAsArrayType(), clang::ento::SVal::getAsRegion(), clang::ento::ProgramStateManager::getCallEventManager(), clang::StackFrameContext::getCallSite(), clang::StackFrameContext::getCallSiteBlock(), clang::ento::SValBuilder::getContext(), clang::CallEventManager::getCXXConstructorCall(), clang::ento::MemRegionManager::getCXXStaticTempObjectRegion(), clang::ento::MemRegionManager::getCXXTempObjectRegion(), clang::ento::SValBuilder::getCXXThis(), clang::ento::CallEvent::getDecl(), clang::LocationContext::getDecl(), clang::MaterializeTemporaryExpr::getExtendingDecl(), clang::StackFrameContext::getIndex(), clang::ConstructionContext::getKind(), clang::ento::ExplodedNode::getLocationContext(), clang::CallEventManager::getObjCMethodCall(), getObjectUnderConstruction(), clang::ento::CallEvent::getOriginExpr(), clang::LocationContext::getParent(), clang::DeclContext::getParent(), clang::ASTContext::getPointerType(), clang::ento::SValBuilder::getRegionManager(), clang::CallEventManager::getSimpleCall(), clang::LocationContext::getStackFrame(), clang::ento::ExplodedNode::getState(), getStateManager(), clang::MaterializeTemporaryExpr::getStorageDuration(), getStoreManager(), clang::MaterializeTemporaryExpr::getSubExpr(), getSValBuilder(), clang::Expr::getType(), clang::ValueDecl::getType(), clang::Expr::IgnoreParens(), clang::ento::ExprEngine::EvalCallOptions::IsArrayCtorOrDtor, clang::ento::ExprEngine::EvalCallOptions::IsCtorOrDtorWithImproperlyModeledTargetRegion, clang::CXXRecordDecl::isEmpty(), clang::ento::ExprEngine::EvalCallOptions::IsTemporaryCtorOrDtor, clang::ento::ExprEngine::EvalCallOptions::IsTemporaryLifetimeExtendedViaAggregate, isTrivial(), clang::ento::SVal::isUnknown(), clang::ento::SVal::isUnknownOrUndef(), clang::ento::CallEvent::isVariadic(), clang::ento::SValBuilder::makeZeroArrayIndex(), clang::interp::NE(), clang::ConstructionContext::NewAllocatedObjectKind, clang::SD_FullExpression, clang::SD_Static, clang::SD_Thread, clang::ConstructionContext::SimpleConstructorInitializerKind, clang::ConstructionContext::SimpleReturnedValueKind, clang::ConstructionContext::SimpleTemporaryObjectKind, clang::ConstructionContext::SimpleVariableKind, clang::CodeGen::state, State, clang::ento::NodeBuilder::takeNodes(), and V.

## ◆ defaultEvalCall()

void ExprEngine::defaultEvalCall | ( | NodeBuilder & | B,
|  | ExplodedNode * | Pred,
|  | const CallEvent & | Call,
|  | const EvalCallOptions & | CallOpts = `{}`
| ) |  |

Default implementation of call evaluation.

Definition at line 1038 of file ExprEngineCallAndReturn.cpp.

References clang::ento::CallEvent::cloneWithState(), clang::ento::RuntimeDefinition::getDecl(), getInlineFailedState(), clang::ento::ExplodedNode::getState(), isTrivialObjectAssignment(), and clang::ento::RuntimeDefinition::mayHaveOtherDefinitions().

Referenced by clang::ento::CheckerManager::runCheckersForEvalCall(), VisitCXXConstructExpr(), VisitCXXNewAllocatorCall(), and VisitObjCMessage().

## ◆ DumpGraph() [1/2]

std::string clang::ento::ExprEngine::DumpGraph | ( | bool | trim = `false`,
|  | StringRef | Filename = `""`
| ) |  |

Dump graph to the specified filename.

If filename is empty, generate a temporary one.

Returns
  The filename the graph is written into.

Referenced by nodeHasBugReport().

## ◆ DumpGraph() [2/2]

std::string clang::ento::ExprEngine::DumpGraph | ( | ArrayRef< const ExplodedNode *> | Nodes,
|  | StringRef | Filename = `""`
| ) |  |

Dump the graph consisting of the given nodes to a specified filename.

Generate a temporary filename if it's not provided.

Returns
  The filename the graph is written into.

## ◆ enqueueEndOfPath()

void clang::ento::ExprEngine::enqueueEndOfPath | ( | ExplodedNodeSet & | S | ) |

## ◆ escapeValues()

ProgramStateRef ExprEngine::escapeValues | ( | ProgramStateRef | State,
|  | ArrayRef< SVal > | Vs,
|  | PointerEscapeKind | K,
|  | const CallEvent * | Call = `nullptr`
| ) |  | const
| protected

A simple wrapper when you only need to notify checkers of pointer-escape of some values.

Definition at line 1175 of file ExprEngine.cpp.

References getCheckerManager(), and clang::ento::CheckerManager::runCheckersForPointerEscape().

Referenced by handleLValueBitCast(), and VisitAtomicExpr().

## ◆ evalBind()

void ExprEngine::evalBind | ( | ExplodedNodeSet & | Dst,
|  | const Stmt * | StoreE,
|  | ExplodedNode * | Pred,
|  | SVal | location,
|  | SVal | Val,
|  | bool | atDeclInit = `false`,
|  | const ProgramPoint * | PP = `nullptr`
| ) |  |
| protected

evalBind - Handle the semantics of binding a value to a specific location.

This method is used by evalStore, VisitDeclStmt, and others.

This method is used by evalStore and (soon) VisitDeclStmt, and others.

Definition at line 2791 of file ExprEngine.cpp.

References clang::ento::SVal::castAs(), clang::ento::StmtNodeBuilder::generateNode(), clang::ento::SVal::getAs(), getCheckerManager(), clang::ento::ExplodedNode::getLocationContext(), clang::ento::ExplodedNode::getState(), processPointerEscapedOnBind(), clang::ento::CheckerManager::runCheckersForBind(), and clang::CodeGen::state.

Referenced by CreateCXXTemporaryObject(), evalStore(), ProcessInitializer(), VisitCXXNewExpr(), and VisitDeclStmt().

## ◆ evalBinOp() [1/3]

SVal clang::ento::ExprEngine::evalBinOp | ( | ProgramStateRef | state,
|  | BinaryOperator::Opcode | op,
|  | NonLoc | L,
|  | NonLoc | R,
|  | QualType | T
| ) |  |
| inline

Definition at line 584 of file ExprEngine.h.

References clang::ento::SValBuilder::evalBinOpNN().

Referenced by getInitialState(), and VisitLogicalExpr().

## ◆ evalBinOp() [2/3]

SVal clang::ento::ExprEngine::evalBinOp | ( | ProgramStateRef | state,
|  | BinaryOperator::Opcode | op,
|  | NonLoc | L,
|  | SVal | R,
|  | QualType | T
| ) |  |
| inline

Definition at line 589 of file ExprEngine.h.

References clang::ento::SVal::castAs(), clang::ento::SValBuilder::evalBinOpNN(), and clang::ento::SVal::isValid().

## ◆ evalBinOp() [3/3]

SVal clang::ento::ExprEngine::evalBinOp | ( | ProgramStateRef | ST,
|  | BinaryOperator::Opcode | Op,
|  | SVal | LHS,
|  | SVal | RHS,
|  | QualType | T
| ) |  |
| inline

Definition at line 595 of file ExprEngine.h.

References clang::ento::SValBuilder::evalBinOp().

## ◆ evalCall()

void ExprEngine::evalCall | ( | ExplodedNodeSet & | Dst,
|  | ExplodedNode * | Pred,
|  | const CallEvent & | Call
| ) |  |

Evaluate a call, running pre- and post-call checkers and allowing checkers to be responsible for handling the evaluation of the call itself.

Definition at line 569 of file ExprEngineCallAndReturn.cpp.

References clang::ento::NodeBuilder::generateNode(), clang::ento::CallEvent::getArgSVal(), clang::ento::SVal::getAsRegion(), getCheckerManager(), clang::Type::getPointeeType(), clang::ento::ExplodedNodeSet::insert(), clang::QualType::isConstQualified(), clang::QualType::isNull(), clang::Type::isPointerType(), clang::Type::isReferenceType(), clang::Type::isVoidType(), clang::ento::CallEvent::parameters(), processPointerEscapedOnBind(), clang::ento::PSK_EscapeOutParameters, clang::ento::CheckerManager::runCheckersForEvalCall(), clang::ento::CheckerManager::runCheckersForPostCall(), clang::ento::CheckerManager::runCheckersForPreCall(), and State.

Referenced by VisitCallExpr().

## ◆ evalComplement()

SVal clang::ento::ExprEngine::evalComplement | ( | SVal | X | ) |
| inline

Definition at line 563 of file ExprEngine.h.

References clang::ento::SVal::castAs(), clang::ento::SValBuilder::evalComplement(), clang::ento::SVal::isValid(), and X.

Referenced by VisitUnaryOperator().

## ◆ evalEagerlyAssumeBinOpBifurcation()

void ExprEngine::evalEagerlyAssumeBinOpBifurcation | ( | ExplodedNodeSet & | Dst,
|  | ExplodedNodeSet & | Src,
|  | const Expr * | Ex
| ) |  |

evalEagerlyAssumeBinOpBifurcation - Given the nodes in 'Src', eagerly assume symbolic expressions of the form 'x != 0' and generate new nodes (stored in Dst) with those assumptions.

Definition at line 2955 of file ExprEngine.cpp.

References clang::ProgramPoint::castAs(), clang::ento::StmtNodeBuilder::generateNode(), clang::ento::SVal::getAs(), clang::ProgramPoint::getAs(), geteagerlyAssumeBinOpBifurcationTags(), clang::ento::ExplodedNode::getLocation(), clang::ento::ExplodedNode::getLocationContext(), clang::ento::ExplodedNode::getState(), clang::StmtPoint::getStmt(), clang::Expr::getType(), and P.

## ◆ evalLoad()

void ExprEngine::evalLoad | ( | ExplodedNodeSet & | Dst,
|  | const Expr * | NodeEx,
|  | const Expr * | BoundExpr,
|  | ExplodedNode * | Pred,
|  | ProgramStateRef | St,
|  | SVal | location,
|  | const ProgramPointTag * | tag = `nullptr`,
|  | QualType | LoadTy = `QualType()`
| ) |  |

Simulate a read of the result of Ex.

Definition at line 2871 of file ExprEngine.cpp.

References clang::ento::NodeBuilder::addNodes(), clang::ento::SVal::castAs(), clang::ento::ExplodedNodeSet::empty(), clang::ento::StmtNodeBuilder::generateNode(), clang::ento::SVal::getAs(), getCheckerManager(), clang::ento::ExplodedNode::getState(), clang::Expr::getType(), clang::QualType::isNull(), clang::ento::SVal::isUndef(), clang::ento::SVal::isUnknown(), clang::ento::SVal::isValid(), clang::ProgramPoint::PostLoadKind, clang::ento::CheckerManager::runCheckersForLocation(), clang::CodeGen::state, and clang::ento::NodeBuilder::takeNodes().

Referenced by VisitCast(), VisitIncrementDecrementOperator(), and VisitMemberExpr().

## ◆ evalMinus()

SVal clang::ento::ExprEngine::evalMinus | ( | SVal | X | ) |
| inline

Definition at line 559 of file ExprEngine.h.

References clang::ento::SVal::castAs(), clang::ento::SValBuilder::evalMinus(), clang::ento::SVal::isValid(), and X.

Referenced by handleLValueBitCast(), and VisitUnaryOperator().

## ◆ evalStore()

void ExprEngine::evalStore | ( | ExplodedNodeSet & | Dst,
|  | const Expr * | AssignE,
|  | const Expr * | LocationE,
|  | ExplodedNode * | Pred,
|  | ProgramStateRef | state,
|  | SVal | location,
|  | SVal | Val,
|  | const ProgramPointTag * | tag = `nullptr`
| ) |  |

evalStore - Handle the semantics of a store via an assignment.

Parameters

  Dst | The node set to store generated state nodes
  AssignE | The assignment expression if the store happens in an assignment.
  LocationE | The location expression that is stored to.
  state | The current simulation state
  location | The location to store the value
  Val | The value to be stored

Definition at line 2848 of file ExprEngine.cpp.

References clang::ento::ExplodedNodeSet::empty(), evalBind(), and clang::ento::SVal::isUndef().

Referenced by VisitBinaryOperator(), and VisitIncrementDecrementOperator().

## ◆ ExecuteWorkList()

bool clang::ento::ExprEngine::ExecuteWorkList | ( | const LocationContext * | L,
|  | unsigned | Steps = `150000`
| ) |  |
| inline

Returns true if there is still simulation state on the worklist.

Definition at line 167 of file ExprEngine.h.

References clang::ento::CoreEngine::ExecuteWorkList().

## ◆ ExecuteWorkListWithInitialState()

bool clang::ento::ExprEngine::ExecuteWorkListWithInitialState | ( | const LocationContext * | L,
|  | unsigned | Steps,
|  | ProgramStateRef | InitState,
|  | ExplodedNodeSet & | Dst
| ) |  |
| inline

Execute the work list with an initial state.

Nodes that reaches the exit of the function are added into the Dst set, which represent the exit state of the function call. Returns true if there is still simulation state on the worklist.

Definition at line 175 of file ExprEngine.h.

References clang::ento::CoreEngine::ExecuteWorkListWithInitialState().

## ◆ GenerateAutoTransition()

void clang::ento::ExprEngine::GenerateAutoTransition | ( | ExplodedNode * | N | ) |

## ◆ GenerateCallExitNode()

void clang::ento::ExprEngine::GenerateCallExitNode | ( | ExplodedNode * | N | ) |

## ◆ getAnalysisDeclContextManager()

AnalysisDeclContextManager& clang::ento::ExprEngine::getAnalysisDeclContextManager | ( |  | ) |
| inline

Definition at line 186 of file ExprEngine.h.

References clang::ento::AnalysisManager::getAnalysisDeclContextManager().

## ◆ getAnalysisManager()

AnalysisManager& clang::ento::ExprEngine::getAnalysisManager | ( |  | ) |
| inline override virtual

Implements clang::ento::SubEngine.

Definition at line 184 of file ExprEngine.h.

Referenced by clang::ento::CheckerContext::getAnalysisManager(), isCXXSharedPtrDtor(), ProcessNewAllocator(), and VisitCXXBindTemporaryExpr().

## ◆ getBasicVals()

BasicValueFactory& clang::ento::ExprEngine::getBasicVals | ( |  | ) |
| inline

Definition at line 393 of file ExprEngine.h.

References clang::ento::ProgramStateManager::getBasicVals().

Referenced by VisitCast(), VisitInitListExpr(), and VisitLogicalExpr().

## ◆ getBugReporter()

BugReporter& clang::ento::ExprEngine::getBugReporter | ( |  | ) |
| inline

Definition at line 196 of file ExprEngine.h.

Referenced by clang::ento::CheckerContext::emitReport(), clang::ento::CheckerContext::getBugReporter(), and llvm::DOTGraphTraits< ExplodedGraph * >::nodeHasBugReport().

## ◆ getBuilderContext()

const NodeBuilderContext& clang::ento::ExprEngine::getBuilderContext | ( |  | ) |
| inline

Definition at line 203 of file ExprEngine.h.

Referenced by clang::ento::CheckerManager::runCheckersForEvalCall().

## ◆ getCheckerManager()

CheckerManager& clang::ento::ExprEngine::getCheckerManager | ( |  | ) | const
| inline

Definition at line 190 of file ExprEngine.h.

References clang::ento::AnalysisManager::getCheckerManager().

Referenced by escapeValues(), evalBind(), evalCall(), evalLoad(), notifyCheckersOfPointerEscape(), printJson(), processAssume(), processBeginOfFunction(), processBranch(), processCallExit(), processEndOfFunction(), processEndWorklist(), processRegionChanges(), removeDead(), Visit(), VisitArraySubscriptExpr(), VisitAtomicExpr(), VisitBinaryOperator(), VisitBlockExpr(), VisitCallExpr(), VisitCast(), VisitCXXConstructExpr(), VisitCXXNewAllocatorCall(), VisitDeclStmt(), VisitLambdaExpr(), VisitLvalObjCIvarRefExpr(), VisitMemberExpr(), VisitObjCMessage(), VisitReturnStmt(), VisitUnaryExprOrTypeTraitExpr(), and VisitUnaryOperator().

## ◆ getConstraintManager()

ConstraintManager& clang::ento::ExprEngine::getConstraintManager | ( |  | ) |
| inline

Definition at line 388 of file ExprEngine.h.

References clang::ento::ProgramStateManager::getConstraintManager().

Referenced by clang::ento::CheckerContext::getConstraintManager(), and removeDead().

## ◆ getContext()

ASTContext& clang::ento::ExprEngine::getContext | ( |  | ) | const
| inline

getContext - Return the ASTContext associated with this analysis.

Definition at line 182 of file ExprEngine.h.

References clang::ento::AnalysisManager::getASTContext().

Referenced by clang::ento::CheckerContext::getASTContext(), clang::ento::CheckerContext::getLangOpts(), handleLValueBitCast(), handleLVectorSplat(), processBranch(), processCallExit(), ProcessDeleteDtor(), ProcessInitializer(), ProcessLoopExit(), ProcessStmt(), processSwitch(), ProcessTemporaryDtor(), Visit(), VisitArraySubscriptExpr(), VisitBlockExpr(), VisitCast(), VisitCommonDeclRefExpr(), VisitCXXNewAllocatorCall(), VisitCXXThisExpr(), VisitDeclStmt(), VisitInitListExpr(), and VisitUnaryExprOrTypeTraitExpr().

## ◆ getCoreEngine()

const CoreEngine& clang::ento::ExprEngine::getCoreEngine | ( |  | ) | const
| inline

Definition at line 408 of file ExprEngine.h.

References clang::interp::LE().

Referenced by processCallExit().

## ◆ getCrossTranslationUnitContext()

cross_tu::CrossTranslationUnitContext* clang::ento::ExprEngine::getCrossTranslationUnitContext | ( |  | ) |
| inline override virtual

Implements clang::ento::SubEngine.

Definition at line 199 of file ExprEngine.h.

## ◆ getCurrentCFGElement()

CFGElement clang::ento::ExprEngine::getCurrentCFGElement | ( |  | ) |
| inline

Return the CFG element corresponding to the worklist element that is currently being processed by ExprEngine.

Definition at line 666 of file ExprEngine.h.

References clang::ento::NodeBuilderContext::getBlock(), P, and V.

Referenced by bindReturnValue(), and VisitCXXConstructExpr().

## ◆ geteagerlyAssumeBinOpBifurcationTags()

std::pair< const ProgramPointTag *, const ProgramPointTag * > ExprEngine::geteagerlyAssumeBinOpBifurcationTags | ( |  | ) |
| static

Definition at line 2945 of file ExprEngine.cpp.

Referenced by evalEagerlyAssumeBinOpBifurcation().

## ◆ getGraph() [1/2]

ExplodedGraph& clang::ento::ExprEngine::getGraph | ( |  | ) |
| inline

Definition at line 237 of file ExprEngine.h.

## ◆ getGraph() [2/2]

const ExplodedGraph& clang::ento::ExprEngine::getGraph | ( |  | ) | const
| inline

Definition at line 238 of file ExprEngine.h.

References clang::interp::NE(), Node, clang::ProgramPoint::PreStmtPurgeDeadSymbolsKind, clang::ento::removeDead(), clang::CodeGen::state, and State.

## ◆ getInitialState()

ProgramStateRef ExprEngine::getInitialState | ( | const LocationContext * | InitLoc | ) |
| override virtual

getInitialState - Return the initial state used for the root vertex in the ExplodedGraph.

Implements clang::ento::SubEngine.

Definition at line 232 of file ExprEngine.cpp.

References clang::SubobjectAdjustment::DTB::BasePath, clang::ento::NodeBuilderContext::blockCount(), clang::ento::SVal::castAs(), clang::ento::SValBuilder::conjureSymbolVal(), clang::SubobjectAdjustment::DerivedToBase, clang::SubobjectAdjustment::DerivedToBaseAdjustment, evalBinOp(), clang::ento::StoreManager::evalDerivedToBase(), clang::SubobjectAdjustment::Field, clang::SubobjectAdjustment::FieldAdjustment, clang::ento::SVal::getAs(), clang::ento::SVal::getAsRegion(), clang::ento::SValBuilder::getConditionType(), clang::ento::MemRegionManager::getCXXStaticTempObjectRegion(), clang::ento::MemRegionManager::getCXXTempObjectRegion(), clang::ento::SValBuilder::getCXXThis(), clang::LocationContext::getDecl(), clang::ento::ProgramStateManager::getInitialState(), clang::ento::StoreManager::getLValueField(), clang::IdentifierInfo::getName(), getObjectUnderConstruction(), clang::LocationContext::getParent(), clang::LocationContext::getStackFrame(), getSValBuilder(), clang::Expr::getType(), clang::ValueDecl::getType(), clang::Expr::isGLValue(), clang::ento::Loc::isLocType(), clang::Type::isMemberPointerType(), clang::ento::SVal::isUnknown(), clang::SubobjectAdjustment::Kind, clang::ento::SValBuilder::makeZeroVal(), clang::SubobjectAdjustment::MemberPointerAdjustment, clang::ento::SubEngine::processRegionChange(), clang::SD_Static, clang::SD_Thread, clang::Expr::skipRValueSubobjectAdjustments(), clang::CodeGen::state, State, clang::ConstructionContextItem::TemporaryDestructorKind, and V.

## ◆ getNoteTags()

NoteTag::Factory& clang::ento::ExprEngine::getNoteTags | ( |  | ) |
| inline

Definition at line 400 of file ExprEngine.h.

References clang::ento::CoreEngine::getNoteTags().

Referenced by clang::ento::CheckerContext::getNoteTag().

## ◆ getObjectUnderConstruction()

Optional< SVal > ExprEngine::getObjectUnderConstruction | ( | ProgramStateRef | State,
|  | const ConstructionContextItem & | Item,
|  | const LocationContext * | LC
| ) |  |
| static

By looking at a certain item that may be potentially part of an object's ConstructionContext, retrieve such object's location.

A particular statement can be transparently passed as `Item` in most cases.

Definition at line 474 of file ExprEngine.cpp.

References clang::serialized_diags::create(), clang::LocationContext::getParent(), and clang::LocationContext::getStackFrame().

Referenced by CreateCXXTemporaryObject(), getInitialState(), clang::ento::CallEvent::isArgumentConstructedDirectly(), processCallExit(), processCleanupTemporaryBranch(), ProcessInitializer(), ProcessTemporaryDtor(), VisitCallExpr(), VisitCXXBindTemporaryExpr(), VisitCXXConstructExpr(), VisitCXXNewAllocatorCall(), VisitCXXNewExpr(), and VisitDeclStmt().

## ◆ getRegionManager()

MemRegionManager& clang::ento::ExprEngine::getRegionManager | ( |  | ) |
| inline

Definition at line 398 of file ExprEngine.h.

## ◆ getStateManager()

ProgramStateManager& clang::ento::ExprEngine::getStateManager | ( |  | ) |
| inline override virtual

Implements clang::ento::SubEngine.

Definition at line 384 of file ExprEngine.h.

Referenced by CreateCXXTemporaryObject(), clang::ento::CheckerContext::getStateManager(), processCallExit(), processEndOfFunction(), VisitCallExpr(), VisitCXXConstructExpr(), VisitCXXNewAllocatorCall(), VisitCXXNewExpr(), and VisitObjCMessage().

## ◆ getStmt()

const Stmt* clang::ento::ExprEngine::getStmt | ( |  | ) | const

## ◆ getStoreManager()

StoreManager& clang::ento::ExprEngine::getStoreManager | ( |  | ) |
| inline

Definition at line 386 of file ExprEngine.h.

References clang::ento::ProgramStateManager::getStoreManager().

Referenced by CreateCXXTemporaryObject(), clang::ento::CheckerContext::getStoreManager(), ProcessBaseDtor(), processCallExit(), ProcessDeleteDtor(), removeDead(), VisitCast(), VisitCXXConstructExpr(), and VisitCXXNewExpr().

## ◆ getSValBuilder()

SValBuilder& clang::ento::ExprEngine::getSValBuilder | ( |  | ) |
| inline

Definition at line 194 of file ExprEngine.h.

Referenced by CreateCXXTemporaryObject(), getInitialState(), clang::ento::CheckerContext::getSValBuilder(), ProcessBaseDtor(), ProcessInitializer(), ProcessMemberDtor(), VisitCXXConstructExpr(), and VisitInitListExpr().

## ◆ getSymbolManager()

SymbolManager& clang::ento::ExprEngine::getSymbolManager | ( |  | ) |
| inline

Definition at line 397 of file ExprEngine.h.

## ◆ handleLValueBitCast()

ProgramStateRef ExprEngine::handleLValueBitCast | ( | ProgramStateRef | state,
|  | const Expr * | Ex,
|  | const LocationContext * | LCtx,
|  | QualType | T,
|  | QualType | ExTy,
|  | const CastExpr * | CastE,
|  | StmtNodeBuilder & | Bldr,
|  | ExplodedNode * | Pred
| ) |  |

Definition at line 259 of file ExprEngineC.cpp.

References escapeValues(), clang::ento::SValBuilder::evalCast(), evalMinus(), clang::ento::StmtNodeBuilder::generateNode(), clang::CastExpr::getCastKind(), getContext(), clang::ASTContext::getLValueReferenceType(), clang::ASTContext::getRValueReferenceType(), clang::Expr::getType(), clang::Type::isLValueReferenceType(), clang::Type::isRValueReferenceType(), clang::ento::SVal::isUnknown(), clang::ento::PSK_EscapeOther, clang::CodeGen::state, and V.

Referenced by VisitCast().

## ◆ handleLVectorSplat()

ProgramStateRef ExprEngine::handleLVectorSplat | ( | ProgramStateRef | state,
|  | const LocationContext * | LCtx,
|  | const CastExpr * | CastE,
|  | StmtNodeBuilder & | Bldr,
|  | ExplodedNode * | Pred
| ) |  |

Definition at line 285 of file ExprEngineC.cpp.

References clang::ento::NodeBuilderContext::blockCount(), clang::ento::SValBuilder::conjureSymbolVal(), clang::ento::StmtNodeBuilder::generateNode(), getContext(), clang::ASTContext::getPointerType(), clang::Expr::getType(), clang::Expr::isGLValue(), and clang::CodeGen::state.

Referenced by VisitCast().

## ◆ handleUOExtension()

void ExprEngine::handleUOExtension | ( | ExplodedNodeSet::iterator | I,
|  | const UnaryOperator * | U,
|  | StmtNodeBuilder & | Bldr
| ) |  |

Definition at line 907 of file ExprEngineC.cpp.

References clang::ento::StmtNodeBuilder::generateNode(), clang::UnaryOperator::getSubExpr(), clang::Expr::IgnoreParens(), and clang::CodeGen::state.

Referenced by VisitUnaryOperator().

## ◆ hasEmptyWorkList()

bool clang::ento::ExprEngine::hasEmptyWorkList | ( |  | ) | const
| inline

Definition at line 405 of file ExprEngine.h.

References clang::ento::CoreEngine::getWorkList(), and clang::ento::WorkList::hasWork().

## ◆ hasWorkRemaining()

bool clang::ento::ExprEngine::hasWorkRemaining | ( |  | ) | const
| inline

Definition at line 406 of file ExprEngine.h.

References clang::ento::CoreEngine::hasWorkRemaining().

## ◆ notifyCheckersOfPointerEscape()

ProgramStateRef ExprEngine::notifyCheckersOfPointerEscape | ( | ProgramStateRef | State,
|  | const InvalidatedSymbols * | Invalidated,
|  | ArrayRef< const MemRegion *> | ExplicitRegions,
|  | const CallEvent * | Call,
|  | RegionAndSymbolInvalidationTraits & | ITraits
| ) |  |
| override protected virtual

Call PointerEscape callback when a value escapes as a result of region invalidation.

Parameters

  [in] | ITraits | Specifies invalidation traits for regions/symbols.

Implements clang::ento::SubEngine.

Definition at line 2747 of file ExprEngine.cpp.

References getCheckerManager(), clang::ento::PSK_DirectEscapeOnCall, clang::ento::PSK_EscapeOther, clang::ento::PSK_IndirectEscapeOnCall, clang::ento::CheckerManager::runCheckersForPointerEscape(), and State.

## ◆ printJson()

void ExprEngine::printJson | ( | raw_ostream & | Out,
|  | ProgramStateRef | State,
|  | const LocationContext * | LCtx,
|  | const char * | NL,
|  | unsigned int | Space,
|  | bool | IsDot
| ) |  | const
| override virtual

printJson - Called by ProgramStateManager to print checker-specific data.

Implements clang::ento::SubEngine.

Definition at line 601 of file ExprEngine.cpp.

References getCheckerManager(), clang::Indent(), clang::LocationContext::printJson(), printObjectsUnderConstructionJson(), and clang::ento::CheckerManager::runCheckersForPrintStateJson().

## ◆ processAssume()

ProgramStateRef ExprEngine::processAssume | ( | ProgramStateRef | state,
|  | SVal | cond,
|  | bool | assumption
| ) |  |
| override virtual

evalAssume - Callback function invoked by the ConstraintManager when making assumptions about state values.

evalAssume - Called by ConstraintManager.

Used to call checker-specific logic for handling assumptions on symbolic values.

Implements clang::ento::SubEngine.

Definition at line 537 of file ExprEngine.cpp.

References getCheckerManager(), and clang::ento::CheckerManager::runCheckersForEvalAssume().

## ◆ ProcessAutomaticObjDtor()

void ExprEngine::ProcessAutomaticObjDtor | ( | const CFGAutomaticObjDtor | D,
|  | ExplodedNode * | Pred,
|  | ExplodedNodeSet & | Dst
| ) |  |

Definition at line 951 of file ExprEngine.cpp.

References clang::ento::SVal::castAs(), clang::ento::SVal::getAsRegion(), clang::ento::MemRegion::getBaseRegion(), clang::ento::ExplodedNode::getLocationContext(), clang::ento::ExplodedNode::getState(), clang::CFGAutomaticObjDtor::getTriggerStmt(), clang::ValueDecl::getType(), clang::CFGAutomaticObjDtor::getVarDecl(), clang::ento::ExprEngine::EvalCallOptions::IsArrayCtorOrDtor, clang::Type::isReferenceType(), clang::CodeGen::state, clang::ast_matchers::varDecl, and VisitCXXDestructor().

Referenced by ProcessImplicitDtor().

## ◆ ProcessBaseDtor()

void ExprEngine::ProcessBaseDtor | ( | const CFGBaseDtor | D,
|  | ExplodedNode * | Pred,
|  | ExplodedNodeSet & | Dst
| ) |  |

Definition at line 1025 of file ExprEngine.cpp.

References clang::ento::StoreManager::evalDerivedToBase(), clang::ento::SVal::getAsRegion(), clang::CFGBaseDtor::getBaseSpecifier(), clang::ento::SValBuilder::getCXXThis(), clang::LocationContext::getDecl(), clang::ento::ExplodedNode::getLocationContext(), clang::LocationContext::getStackFrame(), clang::ento::ExplodedNode::getState(), getStoreManager(), getSValBuilder(), clang::CXXBaseSpecifier::getType(), clang::CXXBaseSpecifier::isVirtual(), and VisitCXXDestructor().

Referenced by ProcessImplicitDtor().

## ◆ processBeginOfFunction()

void ExprEngine::processBeginOfFunction | ( | NodeBuilderContext & | BC,
|  | ExplodedNode * | Pred,
|  | ExplodedNodeSet & | Dst,
|  | const BlockEdge & | L
| ) |  |
| override virtual

Called by CoreEngine.

Used to notify checkers that processing a function has begun. Called for both inlined and and top-level functions.

Implements clang::ento::SubEngine.

Definition at line 2265 of file ExprEngine.cpp.

References getCheckerManager(), and clang::ento::CheckerManager::runCheckersForBeginFunction().

Referenced by processCallEnter().

## ◆ processBranch()

void ExprEngine::processBranch | ( | const Stmt * | Condition,
|  | NodeBuilderContext & | BuilderCtx,
|  | ExplodedNode * | Pred,
|  | ExplodedNodeSet & | Dst,
|  | const CFGBlock * | DstT,
|  | const CFGBlock * | DstF
| ) |  |
| override virtual

ProcessBranch - Called by CoreEngine.

Used to generate successor nodes by processing the 'effects' of a branch condition.

Implements clang::ento::SubEngine.

Definition at line 2100 of file ExprEngine.cpp.

References clang::ento::SVal::castAs(), clang::ento::BranchNodeBuilder::generateNode(), clang::Stmt::getBeginLoc(), clang::ento::NodeBuilderContext::getBlock(), getCheckerManager(), getContext(), clang::ento::ExplodedNode::getLocationContext(), clang::ento::ExplodedNode::getState(), clang::ento::BranchNodeBuilder::isFeasible(), clang::ento::SVal::isUnknown(), clang::ento::SVal::isUnknownOrUndef(), clang::ento::BranchNodeBuilder::markInfeasible(), RecoverCastedSymbol(), ResolveCondition(), clang::ento::CheckerManager::runCheckersForBranchCondition(), and X.

## ◆ processCallEnter()

void ExprEngine::processCallEnter | ( | NodeBuilderContext & | BC,
|  | CallEnter | CE,
|  | ExplodedNode * | Pred
| ) |  |
| override virtual

Generate the entry node of the callee.

Implements clang::ento::SubEngine.

Definition at line 40 of file ExprEngineCallAndReturn.cpp.

References clang::ento::ExplodedNode::addPredecessor(), clang::CFGBlock::empty(), clang::ento::CoreEngine::enqueue(), clang::CallEnter::getCalleeContext(), clang::CallEnter::getEntry(), clang::ento::ExplodedGraph::getNode(), clang::ento::ExplodedNode::getState(), Node, processBeginOfFunction(), clang::CodeGen::state, clang::CFGBlock::succ_begin(), and clang::CFGBlock::succ_size().

## ◆ processCallExit()

void ExprEngine::processCallExit | ( | ExplodedNode * | CEBNode | ) |
| override virtual

Generate the sequence of nodes that simulate the call exit and the post visit for CallExpr.

The call exit is simulated with a sequence of nodes, which occur between CallExitBegin and CallExitEnd.

The following operations occur between the two program points:

1. CallExitBegin (triggers the start of call exit sequence)
2. Bind the return value
3. Run Remove dead bindings to clean up the dead symbols from the callee.
4. CallExitEnd (switch to the caller context)
5. PostStmt<CallExpr>

Implements clang::ento::SubEngine.

Definition at line 203 of file ExprEngineCallAndReturn.cpp.

References clang::ento::ExplodedNode::addPredecessor(), adjustReturnValue(), clang::AnalyzerOptions::AnalysisPurgeOpt, clang::ento::ExplodedNodeSet::begin(), clang::ento::SVal::castAs(), clang::ento::CallEventRef< T >::cloneWithState(), clang::ento::ExplodedNodeSet::end(), clang::ento::WorkList::enqueue(), clang::ento::SValBuilder::evalCast(), clang::ento::AnalysisManager::getAnalysisDeclContext(), clang::ento::AnalysisManager::getAnalyzerOptions(), clang::CallEventManager::getCaller(), clang::ento::ProgramStateManager::getCallEventManager(), clang::AnalysisDeclContext::getCFG(), getCheckerManager(), getContext(), getCoreEngine(), clang::ento::SValBuilder::getCXXThis(), clang::ento::CallEvent::getDeclaredResultType(), getLastStmt(), clang::ento::ExplodedNode::getLocationContext(), clang::ento::ExplodedGraph::getNode(), clang::CFG::getNumBlockIDs(), getObjectUnderConstruction(), clang::LocationContext::getParent(), clang::ASTContext::getPointerType(), clang::ento::ExplodedNode::getStackFrame(), clang::LocationContext::getStackFrame(), clang::ento::ExplodedNode::getState(), getStateManager(), getStoreManager(), clang::ento::CoreEngine::getWorkList(), clang::ento::ExplodedNodeSet::insert(), clang::CFG::isLinear(), clang::QualType::isNull(), clang::ento::AnalysisManager::options, clang::ProgramPoint::PostStmtPurgeDeadSymbolsKind, removeDead(), clang::ento::CheckerManager::runCheckersForNewAllocator(), clang::ento::CheckerManager::runCheckersForPostCall(), clang::ento::CheckerManager::runCheckersForPostObjCMessage(), clang::ento::CheckerManager::runCheckersForPostStmt(), clang::CFG::size(), clang::CodeGen::state, clang::interp::This(), V, and wasDifferentDeclUsedForInlining().

## ◆ processCFGBlockEntrance()

void ExprEngine::processCFGBlockEntrance | ( | const BlockEdge & | L,
|  | NodeBuilderWithSinks & | nodeBuilder,
|  | ExplodedNode * | Pred
| ) |  |
| override virtual

Called by CoreEngine when processing the entrance of a CFGBlock.

Block entrance. (Update counters).

Implements clang::ento::SubEngine.

Definition at line 1922 of file ExprEngine.cpp.

References clang::ento::NodeBuilderContext::blockCount(), clang::ento::NodeBuilderWithSinks::generateNode(), clang::ento::NodeBuilderWithSinks::generateSink(), clang::ento::NodeBuilderContext::getBlock(), clang::ento::NodeBuilder::getContext(), clang::LocationContext::getDecl(), clang::ento::ExplodedNode::getLocation(), clang::ento::ExplodedNode::getLocationContext(), clang::ProgramPoint::getLocationContext(), clang::LocationContext::getStackFrame(), clang::ento::ExplodedNode::getState(), clang::CFGBlock::getTerminatorStmt(), clang::ento::getWidenedLoopState(), clang::ento::isUnrolledState(), and clang::ento::updateLoopStack().

## ◆ processCFGElement()

void ExprEngine::processCFGElement | ( | const CFGElement | E,
|  | ExplodedNode * | Pred,
|  | unsigned | StmtIdx,
|  | NodeBuilderContext * | Ctx
| ) |  |
| override virtual

processCFGElement - Called by CoreEngine.

Used to generate new successor nodes by processing the 'effects' of a CFG element.

Implements clang::ento::SubEngine.

Definition at line 627 of file ExprEngine.cpp.

References clang::CFGElement::AutomaticObjectDtor, clang::CFGElement::BaseDtor, clang::CFGElement::castAs(), clang::CFGElement::Constructor, clang::CFGElement::CXXRecordTypedCall, clang::CFGElement::DeleteDtor, clang::CFGNewAllocator::getAllocatorExpr(), clang::CFGElement::getKind(), clang::ento::ExplodedNode::getLocationContext(), clang::CFGLoopExit::getLoopStmt(), clang::CFGStmt::getStmt(), clang::CFGElement::Initializer, clang::CFGElement::LifetimeEnds, clang::CFGElement::LoopExit, clang::CFGElement::MemberDtor, clang::CFGElement::NewAllocator, ProcessImplicitDtor(), ProcessInitializer(), ProcessLoopExit(), ProcessNewAllocator(), ProcessStmt(), clang::CFGElement::ScopeBegin, clang::CFGElement::ScopeEnd, clang::CFGElement::Statement, and clang::CFGElement::TemporaryDtor.

## ◆ processCleanupTemporaryBranch()

void ExprEngine::processCleanupTemporaryBranch | ( | const CXXBindTemporaryExpr * | BTE,
|  | NodeBuilderContext & | BldCtx,
|  | ExplodedNode * | Pred,
|  | ExplodedNodeSet & | Dst,
|  | const CFGBlock * | DstT,
|  | const CFGBlock * | DstF
| ) |  |
| override virtual

Called by CoreEngine.

Used to generate successor nodes for temporary destructors depending on whether the corresponding constructor was visited.

Implements clang::ento::SubEngine.

Definition at line 1130 of file ExprEngine.cpp.

References clang::ento::BranchNodeBuilder::generateNode(), clang::ento::ExplodedNode::getLocationContext(), getObjectUnderConstruction(), clang::ento::ExplodedNode::getState(), and clang::ento::BranchNodeBuilder::markInfeasible().

## ◆ ProcessDeleteDtor()

void ExprEngine::ProcessDeleteDtor | ( | const CFGDeleteDtor | D,
|  | ExplodedNode * | Pred,
|  | ExplodedNodeSet & | Dst
| ) |  |

Definition at line 985 of file ExprEngine.cpp.

References clang::CXXDeleteExpr::getArgument(), clang::ASTContext::getAsArrayType(), clang::Type::getAsCXXRecordDecl(), clang::ento::SVal::getAsRegion(), clang::ASTContext::getBaseElementType(), clang::CXXDeleteExpr::getBeginLoc(), getContext(), clang::CFGDeleteDtor::getDeleteExpr(), clang::CXXDeleteExpr::getDestroyedType(), clang::CXXRecordDecl::getDestructor(), clang::ento::StoreManager::GetElementZeroRegion(), clang::ento::ExplodedNode::getLocationContext(), clang::ento::ExplodedNode::getState(), getStoreManager(), clang::ento::ExprEngine::EvalCallOptions::IsArrayCtorOrDtor, clang::CXXDeleteExpr::isArrayForm(), and VisitCXXDestructor().

Referenced by ProcessImplicitDtor().

## ◆ processEndOfFunction()

void ExprEngine::processEndOfFunction | ( | NodeBuilderContext & | BC,
|  | ExplodedNode * | Pred,
|  | const ReturnStmt * | RS = `nullptr`
| ) |  |
| override virtual

Called by CoreEngine.

ProcessEndPath - Called by CoreEngine.

Used to notify checkers that processing a function has ended. Called for both inlined and and top-level functions.

Used to generate end-of-path nodes when the control reaches the end of a function.

Implements clang::ento::SubEngine.

Definition at line 2275 of file ExprEngine.cpp.

References clang::ConstructionContextItem::ElidedDestructorKind, clang::ento::NodeBuilder::generateNode(), clang::CallEventManager::getCaller(), clang::ento::ProgramStateManager::getCallEventManager(), getCheckerManager(), clang::ento::ExplodedNode::getLocation(), clang::ento::ExplodedNode::getLocationContext(), clang::LocationContext::getParent(), clang::ento::ExplodedNode::getStackFrame(), clang::LocationContext::getStackFrame(), clang::ento::ExplodedNode::getState(), getStateManager(), clang::LocationContext::inTopFrame(), clang::StackFrameContext::inTopFrame(), removeDeadOnEndOfFunction(), clang::ento::CheckerManager::runCheckersForEndFunction(), State, and clang::ConstructionContextItem::TemporaryDestructorKind.

## ◆ processEndWorklist()

void ExprEngine::processEndWorklist | ( |  | ) |
| override virtual

Called by CoreEngine when the analysis worklist has terminated.

Implements clang::ento::SubEngine.

Definition at line 623 of file ExprEngine.cpp.

References getCheckerManager(), and clang::ento::CheckerManager::runCheckersForEndAnalysis().

## ◆ ProcessImplicitDtor()

void ExprEngine::ProcessImplicitDtor | ( | const CFGImplicitDtor | D,
|  | ExplodedNode * | Pred
| ) |  |

Definition at line 905 of file ExprEngine.cpp.

References clang::CFGElement::AutomaticObjectDtor, clang::CFGElement::BaseDtor, clang::CFGElement::castAs(), clang::CFGElement::DeleteDtor, clang::ento::CoreEngine::enqueue(), clang::ento::NodeBuilderContext::getBlock(), clang::CFGElement::getKind(), clang::CFGElement::MemberDtor, ProcessAutomaticObjDtor(), ProcessBaseDtor(), ProcessDeleteDtor(), ProcessMemberDtor(), ProcessTemporaryDtor(), and clang::CFGElement::TemporaryDtor.

Referenced by processCFGElement().

## ◆ processIndirectGoto()

void ExprEngine::processIndirectGoto | ( | IndirectGotoNodeBuilder & | builder | ) |
| override virtual

processIndirectGoto - Called by CoreEngine.

Used to generate successor nodes by processing the 'effects' of a computed goto jump.

Implements clang::ento::SubEngine.

Definition at line 2224 of file ExprEngine.cpp.

References clang::ento::IndirectGotoNodeBuilder::begin(), clang::ento::IndirectGotoNodeBuilder::end(), clang::ento::IndirectGotoNodeBuilder::generateNode(), clang::ento::SVal::getAs(), clang::ento::IndirectGotoNodeBuilder::getLocationContext(), clang::ento::IndirectGotoNodeBuilder::getState(), clang::ento::IndirectGotoNodeBuilder::getTarget(), and clang::CodeGen::state.

## ◆ ProcessInitializer()

void ExprEngine::ProcessInitializer | ( | const CFGInitializer | I,
|  | ExplodedNode * | Pred
| ) |  |

Definition at line 817 of file ExprEngine.cpp.

References clang::ento::NodeBuilderContext::blockCount(), clang::ento::SValBuilder::conjureSymbolVal(), clang::ast_matchers::decl, clang::ento::CoreEngine::enqueue(), evalBind(), clang::ento::NodeBuilder::generateNode(), clang::ento::SVal::getAs(), clang::ento::SVal::getAsRegion(), clang::ArraySubscriptExpr::getBase(), clang::ento::NodeBuilderContext::getBlock(), getContext(), clang::ento::SValBuilder::getCXXThis(), clang::CXXCtorInitializer::getIndirectMember(), clang::CXXCtorInitializer::getInit(), clang::CFGInitializer::getInitializer(), clang::ento::ExplodedNode::getLocationContext(), clang::CXXCtorInitializer::getMember(), getObjectUnderConstruction(), clang::CXXCtorInitializer::getSourceLocation(), clang::ento::ExplodedNode::getState(), getSValBuilder(), clang::Expr::getType(), clang::ValueDecl::getType(), clang::Expr::IgnoreImplicit(), clang::ento::ExplodedNodeSet::insert(), clang::CXXCtorInitializer::isAnyMemberInitializer(), clang::Type::isArrayType(), clang::CXXCtorInitializer::isBaseInitializer(), clang::CXXCtorInitializer::isDelegatingInitializer(), clang::CXXCtorInitializer::isIndirectMemberInitializer(), clang::Type::isReferenceType(), and clang::ento::SVal::isUnknownOrUndef().

Referenced by processCFGElement().

## ◆ ProcessLoopExit()

void ExprEngine::ProcessLoopExit | ( | const Stmt * | S,
|  | ExplodedNode * | Pred
| ) |  |

Definition at line 799 of file ExprEngine.cpp.

References clang::ento::ExplodedNodeSet::Add(), clang::ento::CoreEngine::enqueue(), clang::ento::NodeBuilder::generateNode(), clang::Stmt::getBeginLoc(), clang::ento::NodeBuilderContext::getBlock(), getContext(), clang::ento::ExplodedNode::getLocationContext(), clang::ento::ExplodedNode::getState(), clang::ento::AnalysisManager::options, and clang::ento::processLoopEnd().

Referenced by processCFGElement().

## ◆ ProcessMemberDtor()

void ExprEngine::ProcessMemberDtor | ( | const CFGMemberDtor | D,
|  | ExplodedNode * | Pred,
|  | ExplodedNodeSet & | Dst
| ) |  |

Definition at line 1045 of file ExprEngine.cpp.

References clang::ento::SValBuilder::getCXXThis(), clang::LocationContext::getDecl(), clang::CFGMemberDtor::getFieldDecl(), clang::ento::ExplodedNode::getLocationContext(), clang::LocationContext::getStackFrame(), clang::ento::ExplodedNode::getState(), getSValBuilder(), clang::ValueDecl::getType(), clang::ento::ExprEngine::EvalCallOptions::IsArrayCtorOrDtor, and VisitCXXDestructor().

Referenced by ProcessImplicitDtor().

## ◆ ProcessNewAllocator()

void ExprEngine::ProcessNewAllocator | ( | const CXXNewExpr * | NE,
|  | ExplodedNode * | Pred
| ) |  |

Definition at line 932 of file ExprEngine.cpp.

References clang::ento::CoreEngine::enqueue(), clang::ento::NodeBuilder::generateNode(), getAnalysisManager(), clang::CXXNewExpr::getBeginLoc(), clang::ento::NodeBuilderContext::getBlock(), clang::ento::ExplodedNode::getLocationContext(), clang::CXXNewExpr::getOperatorNew(), clang::ento::ExplodedNode::getState(), clang::ento::AnalysisManager::options, and VisitCXXNewAllocatorCall().

Referenced by processCFGElement().

## ◆ processPointerEscapedOnBind() [1/2]

ProgramStateRef clang::ento::ExprEngine::processPointerEscapedOnBind | ( | ProgramStateRef | State,
|  | ArrayRef< std::pair< SVal, SVal >> | LocAndVals,
|  | const LocationContext * | LCtx,
|  | PointerEscapeKind | Kind,
|  | const CallEvent * | Call
| ) |  |
| override protected virtual

Call PointerEscape callback when a value escapes as a result of bind.

Implements clang::ento::SubEngine.

Referenced by evalBind(), evalCall(), processPointerEscapedOnBind(), and VisitAtomicExpr().

## ◆ processPointerEscapedOnBind() [2/2]

ProgramStateRef ExprEngine::processPointerEscapedOnBind | ( | ProgramStateRef | State,
|  | SVal | Loc,
|  | SVal | Val,
|  | const LocationContext * | LCtx
| ) |  |
| protected

Definition at line 2739 of file ExprEngine.cpp.

References processPointerEscapedOnBind(), and clang::ento::PSK_EscapeOnBind.

## ◆ processRegionChanges()

ProgramStateRef ExprEngine::processRegionChanges | ( | ProgramStateRef | state,
|  | const InvalidatedSymbols * | invalidated,
|  | ArrayRef< const MemRegion *> | ExplicitRegions,
|  | ArrayRef< const MemRegion *> | Regions,
|  | const LocationContext * | LCtx,
|  | const CallEvent * | Call
| ) |  |
| override virtual

processRegionChanges - Called by ProgramStateManager whenever a change is made to the store.

Used to update checkers that track region values.

Implements clang::ento::SubEngine.

Definition at line 543 of file ExprEngine.cpp.

References getCheckerManager(), and clang::ento::CheckerManager::runCheckersForRegionChanges().

## ◆ processStaticInitializer()

void clang::ento::ExprEngine::processStaticInitializer | ( | const DeclStmt * | DS,
|  | NodeBuilderContext & | BuilderCtx,
|  | ExplodedNode * | Pred,
|  | ExplodedNodeSet & | Dst,
|  | const CFGBlock * | DstT,
|  | const CFGBlock * | DstF
| ) |  |
| override virtual

Called by CoreEngine.

Used to processing branching behavior at static initializers.

Implements clang::ento::SubEngine.

## ◆ ProcessStmt()

void ExprEngine::ProcessStmt | ( | const Stmt * | S,
|  | ExplodedNode * | Pred
| ) |  |

Definition at line 769 of file ExprEngine.cpp.

References clang::ento::CoreEngine::enqueue(), clang::Stmt::getBeginLoc(), clang::ento::NodeBuilderContext::getBlock(), getContext(), clang::ento::ExplodedNode::getLocationContext(), clang::ento::ExplodedNodeSet::insert(), clang::ento::ExplodedGraph::reclaimRecentlyAllocatedNodes(), removeDead(), shouldRemoveDeadBindings(), and Visit().

Referenced by processCFGElement().

## ◆ processSwitch()

void ExprEngine::processSwitch | ( | SwitchNodeBuilder & | builder | ) |
| override virtual

ProcessSwitch - Called by CoreEngine.

Used to generate successor nodes by processing the 'effects' of a switch statement.

Implements clang::ento::SubEngine.

Definition at line 2349 of file ExprEngine.cpp.

References clang::ento::SwitchNodeBuilder::begin(), clang::ento::SVal::castAs(), clang::ento::SwitchNodeBuilder::end(), clang::Expr::EvaluateKnownConstInt(), clang::ento::SwitchNodeBuilder::generateCaseStmtNode(), clang::ento::SwitchNodeBuilder::generateDefaultCaseNode(), clang::ento::SVal::getAs(), clang::Type::getAs(), clang::SwitchStmt::getCond(), clang::ento::SwitchNodeBuilder::getCondition(), getContext(), clang::ASTContext::getIntWidth(), clang::CaseStmt::getLHS(), clang::ento::SwitchNodeBuilder::getLocationContext(), clang::CaseStmt::getRHS(), clang::ento::SwitchNodeBuilder::getState(), clang::ento::SwitchNodeBuilder::getSwitch(), clang::Expr::getType(), clang::Expr::IgnoreParenImpCasts(), clang::SwitchStmt::isAllEnumCasesCovered(), clang::ento::SVal::isUndef(), and clang::CodeGen::state.

## ◆ ProcessTemporaryDtor()

void ExprEngine::ProcessTemporaryDtor | ( | const CFGTemporaryDtor | D,
|  | ExplodedNode * | Pred,
|  | ExplodedNodeSet & | Dst
| ) |  |

Definition at line 1069 of file ExprEngine.cpp.

References clang::ento::ExplodedNodeSet::begin(), clang::ento::ExplodedNodeSet::empty(), clang::ento::NodeBuilder::generateNode(), clang::ento::StmtNodeBuilder::generateNode(), clang::ento::SVal::getAsRegion(), clang::CXXBindTemporaryExpr::getBeginLoc(), clang::CFGTemporaryDtor::getBindTemporaryExpr(), getContext(), clang::CFGImplicitDtor::getDestructorDecl(), clang::ento::ExplodedNode::getLocationContext(), getObjectUnderConstruction(), clang::ento::ExplodedNode::getState(), clang::CXXBindTemporaryExpr::getSubExpr(), clang::Expr::getType(), clang::ento::ExprEngine::EvalCallOptions::IsArrayCtorOrDtor, clang::ento::ExprEngine::EvalCallOptions::IsTemporaryCtorOrDtor, clang::ento::ExplodedNodeSet::size(), State, and VisitCXXDestructor().

Referenced by ProcessImplicitDtor().

## ◆ removeDead()

void ExprEngine::removeDead | ( | ExplodedNode * | Node,
|  | ExplodedNodeSet & | Out,
|  | const Stmt * | ReferenceStmt,
|  | const LocationContext * | LC,
|  | const Stmt * | DiagnosticStmt = `nullptr`,
|  | ProgramPoint::Kind | K = `ProgramPoint::PreStmtPurgeDeadSymbolsKind`
| ) |  |

Run the analyzer's garbage collection - remove dead symbols and bindings from the state.

Checkers can participate in this process with two callbacks: `checkLiveSymbols` and `checkDeadSymbols`. See the CheckerDocumentation class for more information.

Parameters

  Node | The predecessor node, from which the processing should start.
  Out | The returned set of output nodes.
  ReferenceStmt | The statement which is about to be processed. Everything needed for this statement should be considered live. A null statement means that everything in child LocationContexts is dead.
  LC | The location context of the `ReferenceStmt`. A null location context means that we have reached the end of analysis and that all statements and local variables should be considered dead.
  DiagnosticStmt | Used as a location for any warnings that should occur while removing the dead (e.g. leaks). By default, the `ReferenceStmt` is used.
  K | Denotes whether this is a pre- or post-statement purge. This must only be ProgramPoint::PostStmtPurgeDeadSymbolsKind if an entire location context is being cleared, in which case the `ReferenceStmt` must either be a ReturnStmt or `NULL`. Otherwise, it must be ProgramPoint::PreStmtPurgeDeadSymbolsKind (the default) and `ReferenceStmt` must be valid (non-null).

Definition at line 689 of file ExprEngine.cpp.

References clang::ento::StmtNodeBuilder::generateNode(), getCheckerManager(), getConstraintManager(), clang::LocationContext::getParent(), clang::ento::ProgramStateManager::getPersistentStateWithGDM(), clang::LocationContext::getStackFrame(), clang::ento::ExplodedNode::getState(), getStoreManager(), clang::ento::ProgramStateManager::haveEqualEnvironments(), clang::ento::ProgramStateManager::haveEqualStores(), clang::ento::SymbolReaper::markLive(), clang::ProgramPoint::PostStmtPurgeDeadSymbolsKind, clang::ProgramPoint::PreStmtPurgeDeadSymbolsKind, clang::ento::ConstraintManager::removeDeadBindings(), clang::ento::ProgramStateManager::removeDeadBindingsFromEnvironmentAndStore(), clang::ento::CheckerManager::runCheckersForDeadSymbols(), and clang::ento::CheckerManager::runCheckersForLiveSymbols().

Referenced by processCallExit(), ProcessStmt(), and removeDeadOnEndOfFunction().

## ◆ removeDeadOnEndOfFunction()

void ExprEngine::removeDeadOnEndOfFunction | ( | NodeBuilderContext & | BC,
|  | ExplodedNode * | Pred,
|  | ExplodedNodeSet & | Dst
| ) |  |

Remove dead bindings/symbols before exiting a function.

Definition at line 161 of file ExprEngineCallAndReturn.cpp.

References clang::ento::ExplodedNodeSet::Add(), clang::LocationContext::getAnalysisDeclContext(), clang::AnalysisDeclContext::getBody(), getLastStmt(), clang::ento::ExplodedNode::getLocationContext(), clang::ProgramPoint::PostStmtPurgeDeadSymbolsKind, and removeDead().

Referenced by processEndOfFunction().

## ◆ ViewGraph() [1/2]

void clang::ento::ExprEngine::ViewGraph | ( | bool | trim = `false` | ) |

Visualize the ExplodedGraph created by executing the simulation.

Referenced by nodeHasBugReport().

## ◆ ViewGraph() [2/2]

void clang::ento::ExprEngine::ViewGraph | ( | ArrayRef< const ExplodedNode *> | Nodes | ) |

Visualize a trimmed ExplodedGraph that only contains paths to the given nodes.

## ◆ Visit()

void ExprEngine::Visit | ( | const Stmt * | S,
|  | ExplodedNode * | Pred,
|  | ExplodedNodeSet & | Dst
| ) |  |

Visit - Transfer function logic for all statements.

Dispatches to other functions that handle specific kinds of statements.

Definition at line 1202 of file ExprEngine.cpp.

References clang::ento::NodeBuilder::addNodes(), clang::ento::StmtNodeBuilder::generateNode(), clang::ento::StmtNodeBuilder::generateSink(), clang::Stmt::getBeginLoc(), getCheckerManager(), getContext(), clang::ento::ExplodedNode::getLocationContext(), clang::ento::ExplodedNode::getState(), clang::Stmt::getStmtClass(), clang::transformer::node(), clang::Stmt::NoStmtClass, clang::ento::CheckerManager::runCheckersForPreStmt(), clang::CodeGen::state, clang::ento::NodeBuilder::takeNodes(), and VisitObjCAtSynchronizedStmt().

Referenced by ProcessStmt().

## ◆ VisitArraySubscriptExpr()

void ExprEngine::VisitArraySubscriptExpr | ( | const ArraySubscriptExpr * | Ex,
|  | ExplodedNode * | Pred,
|  | ExplodedNodeSet & | Dst
| ) |  |

VisitArraySubscriptExpr - Transfer function for array accesses.

Definition at line 2523 of file ExprEngine.cpp.

References clang::ASTContext::CharTy, clang::ento::StmtNodeBuilder::generateNode(), clang::ArraySubscriptExpr::getBase(), getCheckerManager(), getContext(), clang::ArraySubscriptExpr::getIdx(), clang::Expr::getType(), clang::Expr::IgnoreParens(), clang::QualType::isCForbiddenLValueType(), clang::Expr::isGLValue(), clang::Type::isVectorType(), clang::Type::isVoidType(), Node, clang::ProgramPoint::PostLValueKind, clang::ento::CheckerManager::runCheckersForPostStmt(), clang::ento::CheckerManager::runCheckersForPreStmt(), and clang::CodeGen::state.

## ◆ VisitAtomicExpr()

void ExprEngine::VisitAtomicExpr | ( | const AtomicExpr * | E,
|  | ExplodedNode * | Pred,
|  | ExplodedNodeSet & | Dst
| ) |  |

VisitAtomicExpr - Transfer function for builtin atomic expressions.

Definition at line 2654 of file ExprEngine.cpp.

References escapeValues(), clang::ento::StmtNodeBuilder::generateNode(), clang::ento::MemRegion::getBaseRegion(), getCheckerManager(), clang::AtomicExpr::getNumSubExprs(), clang::AtomicExpr::getSubExprs(), clang::ento::MemRegion::hasStackStorage(), clang::ProgramPoint::PostStmtKind, processPointerEscapedOnBind(), clang::ento::CheckerManager::runCheckersForPostStmt(), and clang::ento::CheckerManager::runCheckersForPreStmt().

## ◆ VisitBinaryOperator()

void ExprEngine::VisitBinaryOperator | ( | const BinaryOperator * | B,
|  | ExplodedNode * | Pred,
|  | ExplodedNodeSet & | Dst
| ) |  |

VisitBinaryOperator - Transfer function logic for binary operators.

Definition at line 40 of file ExprEngineC.cpp.

References clang::ento::ExplodedNodeSet::begin(), clang::ento::NodeBuilderContext::blockCount(), conjureOffsetSymbolOnLocation(), clang::ento::SValBuilder::conjureSymbolVal(), clang::ento::ExplodedNodeSet::end(), evalStore(), getCheckerManager(), clang::BinaryOperator::getLHS(), clang::BinaryOperator::getOpcode(), clang::BinaryOperator::getRHS(), clang::Expr::IgnoreParens(), clang::BinaryOperator::isAdditiveOp(), clang::BinaryOperator::isAssignmentOp(), clang::Expr::isGLValue(), clang::ento::SVal::isUnknown(), clang::ento::CheckerManager::runCheckersForPreStmt(), and clang::CodeGen::state.

## ◆ VisitBlockExpr()

void ExprEngine::VisitBlockExpr | ( | const BlockExpr * | BE,
|  | ExplodedNode * | Pred,
|  | ExplodedNodeSet & | Dst
| ) |  |

VisitBlockExpr - Transfer function logic for BlockExprs.

Definition at line 196 of file ExprEngineC.cpp.

References clang::ento::NodeBuilderContext::blockCount(), clang::BlockDecl::capture_begin(), clang::BlockDecl::capture_end(), clang::ento::StmtNodeBuilder::generateNode(), clang::ento::SVal::getAsRegion(), clang::BlockExpr::getBlockDecl(), clang::ento::SValBuilder::getBlockPointer(), clang::ASTContext::getCanonicalType(), clang::ento::BlockDataRegion::referenced_vars_iterator::getCapturedRegion(), getCheckerManager(), getContext(), clang::ento::VarRegion::getDecl(), clang::ento::ExplodedNode::getLocationContext(), clang::ento::BlockDataRegion::referenced_vars_iterator::getOriginalRegion(), clang::ento::ExplodedNode::getState(), clang::Expr::getType(), clang::ProgramPoint::PostLValueKind, clang::ento::CheckerManager::runCheckersForPostStmt(), State, and V.

## ◆ VisitCallExpr()

void ExprEngine::VisitCallExpr | ( | const CallExpr * | CE,
|  | ExplodedNode * | Pred,
|  | ExplodedNodeSet & | Dst
| ) |  |

VisitCall - Transfer function for function calls.

Definition at line 497 of file ExprEngineCallAndReturn.cpp.

References clang::ento::ExplodedNodeSet::begin(), clang::ento::SVal::castAs(), clang::ento::ExplodedNodeSet::end(), evalCall(), clang::ento::NodeBuilder::generateNode(), clang::ento::CallEvent::getASTArgumentIndex(), clang::ento::ProgramStateManager::getCallEventManager(), getCheckerManager(), clang::ento::ExplodedNode::getLocationContext(), clang::ento::CallEvent::getLocationContext(), clang::ento::CallEvent::getNumArgs(), getObjectUnderConstruction(), clang::ento::CallEvent::getOriginExpr(), clang::ento::loc::MemRegionVal::getRegion(), clang::CallEventManager::getSimpleCall(), clang::LocationContext::getStackFrame(), clang::ento::ExplodedNode::getState(), getStateManager(), clang::ento::ExplodedNodeSet::insert(), clang::ento::CheckerManager::runCheckersForPostStmt(), clang::ento::CheckerManager::runCheckersForPreStmt(), State, and V.

## ◆ VisitCast()

void ExprEngine::VisitCast | ( | const CastExpr * | CastE,
|  | const Expr * | Ex,
|  | ExplodedNode * | Pred,
|  | ExplodedNodeSet & | Dst
| ) |  |

VisitCast - Transfer function logic for all casts (implicit and explicit).

Definition at line 301 of file ExprEngineC.cpp.

References clang::ento::StoreManager::attemptDownCast(), clang::ento::ExplodedNodeSet::begin(), clang::ento::NodeBuilderContext::blockCount(), clang::ento::SValBuilder::conjureSymbolVal(), clang::ento::ExplodedNodeSet::end(), clang::ento::StoreManager::evalDerivedToBase(), clang::ento::SValBuilder::evalIntegralCast(), evalLoad(), clang::ento::StmtNodeBuilder::generateNode(), clang::ento::StmtNodeBuilder::generateSink(), clang::ento::SVal::getAs(), getBasicVals(), clang::CastExpr::getCastKind(), getCheckerManager(), getContext(), clang::ento::ExplodedNode::getLocationContext(), clang::ento::SValBuilder::getMemberPointer(), clang::ASTContext::getPointerType(), clang::ento::ExplodedNode::getState(), getStoreManager(), clang::Expr::getType(), handleLValueBitCast(), handleLVectorSplat(), clang::ento::SVal::isConstant(), clang::Expr::isGLValue(), clang::Type::isReferenceType(), clang::ento::SVal::isUndef(), clang::ento::SVal::isUnknown(), clang::ento::SVal::isZeroConstant(), clang::ento::SValBuilder::makeNull(), clang::ento::SValBuilder::makePointerToMember(), clang::ento::SValBuilder::makeTruthVal(), clang::CastExpr::path_begin(), clang::CastExpr::path_end(), clang::ento::CheckerManager::runCheckersForPreStmt(), clang::CodeGen::state, and V.

## ◆ VisitCommonDeclRefExpr()

void ExprEngine::VisitCommonDeclRefExpr | ( | const Expr * | DR,
|  | const NamedDecl * | D,
|  | ExplodedNode * | Pred,
|  | ExplodedNodeSet & | Dst
| ) |  |

Transfer function logic for DeclRefExprs and BlockDeclRefExprs.

Definition at line 2432 of file ExprEngine.cpp.

References clang::ento::SVal::castAs(), clang::ento::StmtNodeBuilder::generateNode(), clang::CXXRecordDecl::getCaptureFields(), getContext(), clang::ento::ExplodedNode::getLocationContext(), clang::DeclContext::getParent(), clang::ento::ExplodedNode::getState(), clang::Expr::isGLValue(), clang::ProgramPoint::PostLValueKind, and clang::CodeGen::state.

Referenced by VisitMemberExpr().

## ◆ VisitCompoundLiteralExpr()

void ExprEngine::VisitCompoundLiteralExpr | ( | const CompoundLiteralExpr * | CL,
|  | ExplodedNode * | Pred,
|  | ExplodedNodeSet & | Dst
| ) |  |

VisitCompoundLiteralExpr - Transfer function logic for compound literals.

Definition at line 549 of file ExprEngineC.cpp.

References clang::ento::StmtNodeBuilder::generateNode(), clang::CompoundLiteralExpr::getInitializer(), clang::ento::ExplodedNode::getLocationContext(), clang::ento::ExplodedNode::getState(), clang::Expr::isGLValue(), State, and V.

## ◆ VisitCXXBindTemporaryExpr()

void ExprEngine::VisitCXXBindTemporaryExpr | ( | const CXXBindTemporaryExpr * | BTE,
|  | ExplodedNodeSet & | PreVisit,
|  | ExplodedNodeSet & | Dst
| ) |  |

Definition at line 1148 of file ExprEngine.cpp.

References clang::ento::StmtNodeBuilder::generateNode(), getAnalysisManager(), getObjectUnderConstruction(), and Node.

## ◆ VisitCXXCatchStmt()

void ExprEngine::VisitCXXCatchStmt | ( | const CXXCatchStmt * | CS,
|  | ExplodedNode * | Pred,
|  | ExplodedNodeSet & | Dst
| ) |  |

Definition at line 854 of file ExprEngineCXX.cpp.

References clang::ento::ExplodedNodeSet::Add(), clang::ento::NodeBuilderContext::blockCount(), clang::ento::SValBuilder::conjureSymbolVal(), clang::ento::StmtNodeBuilder::generateNode(), clang::CXXCatchStmt::getExceptionDecl(), clang::ento::ExplodedNode::getLocationContext(), clang::ento::ExplodedNode::getState(), clang::ValueDecl::getType(), clang::CodeGen::state, and V.

## ◆ VisitCXXConstructExpr()

void ExprEngine::VisitCXXConstructExpr | ( | const CXXConstructExpr * | E,
|  | ExplodedNode * | Pred,
|  | ExplodedNodeSet & | Dst
| ) |  |

Definition at line 395 of file ExprEngineCXX.cpp.

References clang::CFG::BuildOptions::AddTemporaryDtors, clang::ento::NodeBuilder::begin(), clang::ento::ExplodedNodeSet::begin(), clang::CXXConstructExpr::CK_Complete, clang::CXXConstructExpr::CK_Delegating, clang::CXXConstructExpr::CK_NonVirtualBase, clang::CXXConstructExpr::CK_VirtualBase, defaultEvalCall(), clang::ento::ExplodedNodeSet::empty(), clang::ento::ExplodedNodeSet::end(), clang::ento::StoreManager::evalDerivedToBase(), clang::ento::StmtNodeBuilder::generateNode(), clang::ento::StmtNodeBuilder::generateSink(), clang::LocationContext::getAnalysisDeclContext(), clang::CFGElement::getAs(), clang::ento::SVal::getAs(), clang::ento::SVal::getAsRegion(), clang::ento::ProgramStateManager::getCallEventManager(), clang::StackFrameContext::getCallSite(), clang::AnalysisDeclContext::getCFGBuildOptions(), getCheckerManager(), clang::CXXConstructExpr::getConstructionKind(), clang::CXXConstructExpr::getConstructor(), getCurrentCFGElement(), clang::CallEventManager::getCXXConstructorCall(), clang::ento::MemRegionManager::getCXXTempObjectRegion(), clang::ento::SValBuilder::getCXXThis(), clang::LocationContext::getDecl(), clang::ento::ExplodedNode::getLocationContext(), getObjectUnderConstruction(), clang::ParentMap::getParent(), clang::LocationContext::getParentMap(), clang::ento::SValBuilder::getRegionManager(), clang::LocationContext::getStackFrame(), clang::ento::ExplodedNode::getState(), getStateManager(), getStoreManager(), getSValBuilder(), clang::Expr::getType(), clang::ento::ExprEngine::EvalCallOptions::IsArrayCtorOrDtor, clang::CXXConstructorDecl::isCopyOrMoveConstructor(), clang::ento::ExprEngine::EvalCallOptions::IsCtorOrDtorWithImproperlyModeledTargetRegion, clang::FunctionDecl::isTrivial(), clang::ProgramPoint::PreStmtKind, clang::CXXConstructExpr::requiresZeroInitialization(), clang::ento::CheckerManager::runCheckersForPostCall(), clang::ento::CheckerManager::runCheckersForPostStmt(), clang::ento::CheckerManager::runCheckersForPreCall(), clang::ento::CheckerManager::runCheckersForPreStmt(), clang::ento::ExplodedNodeSet::size(), State, and clang::Target.

## ◆ VisitCXXDeleteExpr()

void ExprEngine::VisitCXXDeleteExpr | ( | const CXXDeleteExpr * | CDE,
|  | ExplodedNode * | Pred,
|  | ExplodedNodeSet & | Dst
| ) |  |

Definition at line 847 of file ExprEngineCXX.cpp.

References clang::ento::StmtNodeBuilder::generateNode(), clang::ento::ExplodedNode::getState(), and clang::CodeGen::state.

## ◆ VisitCXXDestructor()

void ExprEngine::VisitCXXDestructor | ( | QualType | ObjectType,
|  | const MemRegion * | Dest,
|  | const Stmt * | S,
|  | bool | IsBaseDtor,
|  | ExplodedNode * | Pred,
|  | ExplodedNodeSet & | Dst,
|  | EvalCallOptions & | Options
| ) |  |

Definition at line 601 of file ExprEngineCXX.cpp.

Referenced by ProcessAutomaticObjDtor(), ProcessBaseDtor(), ProcessDeleteDtor(), ProcessMemberDtor(), and ProcessTemporaryDtor().

## ◆ VisitCXXNewAllocatorCall()

void ExprEngine::VisitCXXNewAllocatorCall | ( | const CXXNewExpr * | CNE,
|  | ExplodedNode * | Pred,
|  | ExplodedNodeSet & | Dst
| ) |  |

Definition at line 668 of file ExprEngineCXX.cpp.

References clang::ento::SVal::castAs(), defaultEvalCall(), clang::ento::StmtNodeBuilder::generateNode(), clang::Type::getAs(), clang::CXXNewExpr::getBeginLoc(), clang::ento::ProgramStateManager::getCallEventManager(), getCheckerManager(), getContext(), clang::ento::ExplodedNode::getLocationContext(), getObjectUnderConstruction(), clang::CXXNewExpr::getOperatorNew(), clang::ento::ExplodedNode::getState(), getStateManager(), clang::ento::CheckerManager::runCheckersForNewAllocator(), clang::ento::CheckerManager::runCheckersForPostCall(), and clang::ento::CheckerManager::runCheckersForPreCall().

Referenced by ProcessNewAllocator().

## ◆ VisitCXXNewExpr()

void ExprEngine::VisitCXXNewExpr | ( | const CXXNewExpr * | CNE,
|  | ExplodedNode * | Pred,
|  | ExplodedNodeSet & | Dst
| ) |  |

Definition at line 737 of file ExprEngineCXX.cpp.

References clang::ento::NodeBuilderContext::blockCount(), clang::ento::SValBuilder::conjureSymbolVal(), evalBind(), clang::ento::SValBuilder::evalCast(), clang::ento::StmtNodeBuilder::generateNode(), clang::ento::AnalysisManager::getAnalyzerOptions(), clang::ento::SVal::getAs(), clang::Type::getAs(), clang::ento::SVal::getAsRegion(), clang::ento::ProgramStateManager::getCallEventManager(), clang::ento::SValBuilder::getConjuredHeapSymbolVal(), clang::CallEventManager::getCXXAllocatorCall(), clang::ento::StoreManager::GetElementZeroRegion(), clang::CXXNewExpr::getInitializer(), clang::ento::ExplodedNode::getLocationContext(), getObjectUnderConstruction(), clang::CXXNewExpr::getOperatorNew(), clang::CXXNewExpr::getPlacementArg(), clang::Type::getPointeeType(), clang::ento::NodeBuilder::getResults(), clang::ento::ExplodedNode::getState(), getStateManager(), getStoreManager(), clang::Expr::getType(), clang::ValueDecl::getType(), clang::CXXNewExpr::isArray(), clang::FunctionDecl::isReplaceableGlobalAllocationFunction(), clang::FunctionDecl::isReservedGlobalPlacementOperator(), clang::ento::SVal::isUnknown(), clang::ento::ExplodedNodeSet::size(), and clang::ento::NodeBuilder::takeNodes().

## ◆ VisitCXXThisExpr()

void ExprEngine::VisitCXXThisExpr | ( | const CXXThisExpr * | TE,
|  | ExplodedNode * | Pred,
|  | ExplodedNodeSet & | Dst
| ) |  |

Definition at line 873 of file ExprEngineCXX.cpp.

References clang::ento::StmtNodeBuilder::generateNode(), getContext(), clang::ento::MemRegionManager::getCXXThisRegion(), clang::ento::ExplodedNode::getLocationContext(), clang::ento::SValBuilder::getRegionManager(), clang::ento::ExplodedNode::getState(), clang::Expr::getType(), clang::CodeGen::state, and V.

## ◆ VisitDeclStmt()

void ExprEngine::VisitDeclStmt | ( | const DeclStmt * | DS,
|  | ExplodedNode * | Pred,
|  | ExplodedNodeSet & | Dst
| ) |  |

VisitDeclStmt - Transfer function logic for DeclStmts.

Definition at line 574 of file ExprEngineC.cpp.

References clang::ento::NodeBuilder::addNodes(), clang::ento::ExplodedNodeSet::begin(), clang::ento::NodeBuilderContext::blockCount(), clang::ento::SValBuilder::conjureSymbolVal(), clang::DeclStmt::decl_begin(), clang::ento::ExplodedNodeSet::end(), evalBind(), clang::ento::StmtNodeBuilder::generateNode(), getCheckerManager(), getContext(), clang::VarDecl::getInit(), clang::ento::ExplodedNode::getLocationContext(), getObjectUnderConstruction(), clang::ASTContext::getPointerType(), clang::ento::NodeBuilder::getResults(), clang::ento::ExplodedNode::getState(), clang::ento::ExplodedNodeSet::insert(), clang::DeclStmt::isSingleDecl(), clang::ento::SVal::isUnknown(), clang::ento::CheckerManager::runCheckersForPostStmt(), clang::ento::CheckerManager::runCheckersForPreStmt(), clang::CodeGen::state, and clang::ento::NodeBuilder::takeNodes().

## ◆ VisitGCCAsmStmt()

void ExprEngine::VisitGCCAsmStmt | ( | const GCCAsmStmt * | A,
|  | ExplodedNode * | Pred,
|  | ExplodedNodeSet & | Dst
| ) |  |

VisitGCCAsmStmt - Transfer function logic for inline asm.

Definition at line 2996 of file ExprEngine.cpp.

References clang::ento::StmtNodeBuilder::generateNode(), clang::ento::SVal::getAs(), clang::ento::ExplodedNode::getLocationContext(), clang::ento::ExplodedNode::getState(), clang::AsmStmt::outputs(), and X.

## ◆ VisitGuardedExpr()

void ExprEngine::VisitGuardedExpr | ( | const Expr * | Ex,
|  | const Expr * | L,
|  | const Expr * | R,
|  | ExplodedNode * | Pred,
|  | ExplodedNodeSet & | Dst
| ) |  |

VisitGuardedExpr - Transfer function logic for ?, __builtin_choose.

Definition at line 781 of file ExprEngineC.cpp.

References clang::ento::NodeBuilderContext::blockCount(), clang::ProgramPoint::castAs(), clang::ento::SValBuilder::conjureSymbolVal(), clang::ento::StmtNodeBuilder::generateNode(), clang::ProgramPoint::getAs(), clang::ento::ExplodedNode::getLocationContext(), clang::ento::ExplodedNode::getState(), clang::Expr::IgnoreParens(), clang::ento::ExplodedNode::pred_begin(), clang::CodeGen::state, V, and VisitOffsetOfExpr().

## ◆ VisitIncrementDecrementOperator()

void ExprEngine::VisitIncrementDecrementOperator | ( | const UnaryOperator * | U,
|  | ExplodedNode * | Pred,
|  | ExplodedNodeSet & | Dst
| ) |  |

Handle ++ and – (both pre- and post-increment).

Definition at line 1060 of file ExprEngineC.cpp.

References clang::ento::NodeBuilder::addNodes(), clang::ento::ExplodedNodeSet::begin(), clang::ento::SVal::castAs(), clang::ento::ExplodedNodeSet::end(), evalLoad(), evalStore(), clang::ento::ExplodedNode::getLocationContext(), clang::ento::ExplodedNode::getState(), clang::UnaryOperator::getSubExpr(), clang::Expr::IgnoreParens(), clang::UnaryOperator::isIncrementDecrementOp(), clang::UnaryOperator::isIncrementOp(), clang::CodeGen::state, and clang::ento::NodeBuilder::takeNodes().

Referenced by VisitUnaryOperator().

## ◆ VisitInitListExpr()

void ExprEngine::VisitInitListExpr | ( | const InitListExpr * | E,
|  | ExplodedNode * | Pred,
|  | ExplodedNodeSet & | Dst
| ) |  |

Definition at line 732 of file ExprEngineC.cpp.

References clang::ento::StmtNodeBuilder::generateNode(), getBasicVals(), clang::ASTContext::getCanonicalType(), getContext(), clang::ento::BasicValueFactory::getEmptySValList(), clang::InitListExpr::getInit(), clang::ento::ExplodedNode::getLocationContext(), clang::InitListExpr::getNumInits(), clang::ento::ExplodedNode::getState(), getSValBuilder(), clang::Expr::getType(), clang::Type::isAnyComplexType(), clang::Type::isArrayType(), clang::Expr::isGLValue(), clang::Type::isRecordType(), clang::InitListExpr::isTransparent(), clang::Type::isVectorType(), clang::ento::SValBuilder::makeCompoundVal(), clang::ento::SValBuilder::makeZeroVal(), clang::ento::BasicValueFactory::prependSVal(), clang::InitListExpr::rbegin(), clang::InitListExpr::rend(), clang::CodeGen::state, and V.

## ◆ VisitLambdaExpr()

void ExprEngine::VisitLambdaExpr | ( | const LambdaExpr * | LE,
|  | ExplodedNode * | Pred,
|  | ExplodedNodeSet & | Dst
| ) |  |

VisitLambdaExpr - Transfer function logic for LambdaExprs.

Definition at line 889 of file ExprEngineCXX.cpp.

References clang::LambdaExpr::capture_init_begin(), clang::LambdaExpr::capture_init_end(), clang::RecordDecl::field_begin(), clang::ento::StmtNodeBuilder::generateNode(), clang::FieldDecl::getCapturedVLAType(), getCheckerManager(), clang::ento::MemRegionManager::getCXXTempObjectRegion(), clang::LambdaExpr::getLambdaClass(), clang::ento::ExplodedNode::getLocationContext(), clang::ento::SValBuilder::getRegionManager(), clang::VariableArrayType::getSizeExpr(), clang::ento::ExplodedNode::getState(), clang::FieldDecl::hasCapturedVLAType(), clang::ProgramPoint::PostLValueKind, clang::ento::CheckerManager::runCheckersForPostStmt(), and V.

## ◆ VisitLogicalExpr()

void ExprEngine::VisitLogicalExpr | ( | const BinaryOperator * | B,
|  | ExplodedNode * | Pred,
|  | ExplodedNodeSet & | Dst
| ) |  |

VisitLogicalExpr - Transfer function logic for '&&', '||'.

Definition at line 638 of file ExprEngineC.cpp.

References clang::CFGElement::castAs(), clang::ProgramPoint::castAs(), clang::CFGBlock::empty(), evalBinOp(), clang::ento::SValBuilder::evalCast(), clang::ProgramPoint::getAs(), getBasicVals(), clang::BlockEdge::getDst(), clang::ento::ExplodedNode::getLocation(), clang::ento::ExplodedNode::getLocationContext(), clang::BinaryOperator::getOpcode(), clang::BlockEdge::getSrc(), clang::ento::ExplodedNode::getState(), clang::CFGTerminator::getStmt(), clang::CFGBlock::getTerminator(), clang::Expr::getType(), getValue(), clang::Type::isVectorType(), clang::ento::SValBuilder::makeIntVal(), P, clang::ento::ExplodedNode::pred_begin(), clang::ento::ExplodedNode::pred_size(), clang::CFGBlock::rbegin(), clang::CodeGen::state, clang::CFGBlock::succ_begin(), clang::CFGBlock::succ_size(), X, and clang::interp::Zero().

## ◆ VisitLvalObjCIvarRefExpr()

void ExprEngine::VisitLvalObjCIvarRefExpr | ( | const ObjCIvarRefExpr * | DR,
|  | ExplodedNode * | Pred,
|  | ExplodedNodeSet & | Dst
| ) |  |

Transfer function logic for computing the lvalue of an Objective-C ivar.

Definition at line 21 of file ExprEngineObjC.cpp.

References clang::ento::StmtNodeBuilder::generateNode(), clang::ObjCIvarRefExpr::getBase(), getCheckerManager(), clang::ObjCIvarRefExpr::getDecl(), clang::ento::ExplodedNode::getLocationContext(), clang::ento::ExplodedNode::getState(), clang::ento::CheckerManager::runCheckersForPostStmt(), and clang::CodeGen::state.

## ◆ VisitMemberExpr()

void ExprEngine::VisitMemberExpr | ( | const MemberExpr * | M,
|  | ExplodedNode * | Pred,
|  | ExplodedNodeSet & | Dst
| ) |  |

VisitMemberExpr - Transfer function for member expressions.

Definition at line 2574 of file ExprEngine.cpp.

References clang::ento::NodeBuilder::addNodes(), evalLoad(), clang::ento::StmtNodeBuilder::generateNode(), clang::MemberExpr::getBase(), getCheckerManager(), clang::MemberExpr::getMemberDecl(), clang::Expr::getType(), clang::Type::isArrayType(), clang::Expr::isGLValue(), clang::ProgramPoint::PostLValueKind, clang::ento::CheckerManager::runCheckersForPostStmt(), clang::ento::CheckerManager::runCheckersForPreStmt(), clang::CodeGen::state, clang::ento::NodeBuilder::takeNodes(), and VisitCommonDeclRefExpr().

## ◆ VisitMSAsmStmt()

void ExprEngine::VisitMSAsmStmt | ( | const MSAsmStmt * | A,
|  | ExplodedNode * | Pred,
|  | ExplodedNodeSet & | Dst
| ) |  |

VisitMSAsmStmt - Transfer function logic for MS inline asm.

Definition at line 3019 of file ExprEngine.cpp.

References clang::ento::StmtNodeBuilder::generateNode(), and clang::ento::ExplodedNode::getState().

## ◆ VisitObjCAtSynchronizedStmt()

void ExprEngine::VisitObjCAtSynchronizedStmt | ( | const ObjCAtSynchronizedStmt * | S,
|  | ExplodedNode * | Pred,
|  | ExplodedNodeSet & | Dst
| ) |  |

Transfer function logic for ObjCAtSynchronizedStmts.

Definition at line 38 of file ExprEngineObjC.cpp.

Referenced by Visit().

## ◆ VisitObjCForCollectionStmt()

void ExprEngine::VisitObjCForCollectionStmt | ( | const ObjCForCollectionStmt * | S,
|  | ExplodedNode * | Pred,
|  | ExplodedNodeSet & | Dst
| ) |  |

VisitObjCForCollectionStmt - Transfer function logic for ObjCForCollectionStmt.

Definition at line 85 of file ExprEngineObjC.cpp.

## ◆ VisitObjCMessage()

void ExprEngine::VisitObjCMessage | ( | const ObjCMessageExpr * | ME,
|  | ExplodedNode * | Pred,
|  | ExplodedNodeSet & | Dst
| ) |  |

Definition at line 150 of file ExprEngineObjC.cpp.

References clang::ento::ExplodedNodeSet::begin(), clang::ento::SVal::castAs(), clang::ento::CallEventRef< T >::cloneWithState(), defaultEvalCall(), clang::ento::ExplodedNodeSet::end(), clang::ento::StmtNodeBuilder::generateNode(), clang::ento::StmtNodeBuilder::generateSink(), clang::ento::ProgramStateManager::getCallEventManager(), getCheckerManager(), clang::ento::ExplodedNode::getLocation(), clang::ento::ExplodedNode::getLocationContext(), clang::CallEventManager::getObjCMethodCall(), clang::ento::ExplodedNode::getState(), getStateManager(), clang::ProgramPoint::getTag(), clang::ObjCNoReturn::isImplicitNoReturn(), clang::ento::SVal::isUndef(), clang::ProgramPoint::PreStmtKind, clang::ento::CheckerManager::runCheckersForObjCMessageNil(), clang::ento::CheckerManager::runCheckersForPostCall(), clang::ento::CheckerManager::runCheckersForPostObjCMessage(), clang::ento::CheckerManager::runCheckersForPreCall(), clang::ento::CheckerManager::runCheckersForPreObjCMessage(), and State.

## ◆ VisitOffsetOfExpr()

void ExprEngine::VisitOffsetOfExpr | ( | const OffsetOfExpr * | Ex,
|  | ExplodedNode * | Pred,
|  | ExplodedNodeSet & | Dst
| ) |  |

VisitOffsetOfExpr - Transfer function for offsetof.

Definition at line 846 of file ExprEngineC.cpp.

Referenced by VisitGuardedExpr().

## ◆ VisitReturnStmt()

void ExprEngine::VisitReturnStmt | ( | const ReturnStmt * | R,
|  | ExplodedNode * | Pred,
|  | ExplodedNodeSet & | Dst
| ) |  |

VisitReturnStmt - Transfer function logic for return statements.

Definition at line 1128 of file ExprEngineCallAndReturn.cpp.

References clang::ento::ExplodedNodeSet::begin(), clang::ento::ExplodedNodeSet::end(), clang::ento::StmtNodeBuilder::generateNode(), getCheckerManager(), clang::ReturnStmt::getRetValue(), and clang::ento::CheckerManager::runCheckersForPreStmt().

## ◆ VisitUnaryExprOrTypeTraitExpr()

void ExprEngine::VisitUnaryExprOrTypeTraitExpr | ( | const UnaryExprOrTypeTraitExpr * | Ex,
|  | ExplodedNode * | Pred,
|  | ExplodedNodeSet & | Dst
| ) |  |

VisitUnaryExprOrTypeTraitExpr - Transfer function for sizeof.

Definition at line 865 of file ExprEngineC.cpp.

References clang::ento::ExplodedNodeSet::begin(), clang::ento::ExplodedNodeSet::end(), clang::Expr::EvaluateKnownConstInt(), clang::CharUnits::fromQuantity(), clang::ento::StmtNodeBuilder::generateNode(), clang::Type::getAs(), getCheckerManager(), getContext(), clang::UnaryExprOrTypeTraitExpr::getKind(), clang::CharUnits::getQuantity(), clang::Expr::getType(), clang::UnaryExprOrTypeTraitExpr::getTypeOfArgument(), clang::Type::isConstantSizeType(), clang::Type::isIncompleteType(), clang::Type::isVariableArrayType(), clang::ento::SValBuilder::makeIntVal(), clang::ento::CheckerManager::runCheckersForPostStmt(), clang::ento::CheckerManager::runCheckersForPreStmt(), clang::CodeGen::state, and clang::UETT_SizeOf.

## ◆ VisitUnaryOperator()

void ExprEngine::VisitUnaryOperator | ( | const UnaryOperator * | B,
|  | ExplodedNode * | Pred,
|  | ExplodedNodeSet & | Dst
| ) |  |

VisitUnaryOperator - Transfer function logic for unary operators.

Definition at line 924 of file ExprEngineC.cpp.

References clang::ento::NodeBuilder::addNodes(), clang::ento::ExplodedNodeSet::begin(), clang::ento::SVal::castAs(), clang::ento::ExplodedNodeSet::end(), evalComplement(), evalMinus(), clang::ento::StmtNodeBuilder::generateNode(), getCheckerManager(), clang::ento::SValBuilder::getMemberPointer(), clang::UnaryOperator::getOpcode(), clang::UnaryOperator::getSubExpr(), clang::Expr::getType(), handleUOExtension(), clang::Expr::IgnoreParens(), clang::Type::isAnyComplexType(), clang::Expr::isGLValue(), clang::ento::SVal::isUnknownOrUndef(), clang::ento::SValBuilder::makeZeroVal(), clang::ento::CheckerManager::runCheckersForPreStmt(), clang::CodeGen::state, State, clang::ento::NodeBuilder::takeNodes(), V, VisitIncrementDecrementOperator(), and X.

## ◆ wasBlocksExhausted()

bool clang::ento::ExprEngine::wasBlocksExhausted | ( |  | ) | const
| inline

Definition at line 404 of file ExprEngine.h.

References clang::ento::CoreEngine::wasBlocksExhausted().

The documentation for this class was generated from the following files:

- include/clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h
- lib/StaticAnalyzer/Core/ExprEngine.cpp
- lib/StaticAnalyzer/Core/ExprEngineC.cpp
- lib/StaticAnalyzer/Core/ExprEngineCallAndReturn.cpp
- lib/StaticAnalyzer/Core/ExprEngineCXX.cpp
- lib/StaticAnalyzer/Core/ExprEngineObjC.cpp