clang 10.0.0git

Store.cpp
Go to the documentation of this file.
1 //===- Store.cpp - Interface for maps from Locations to Values ------------===//
2 //
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6 //
7 //===----------------------------------------------------------------------===//
8 //
9 // This file defined the types Store and StoreManager.
10 //
11 //===----------------------------------------------------------------------===//
12
13 #include "clang/StaticAnalyzer/Core/PathSensitive/Store.h"
14 #include "clang/AST/ASTContext.h"
15 #include "clang/AST/CXXInheritance.h"
16 #include "clang/AST/CharUnits.h"
17 #include "clang/AST/Decl.h"
18 #include "clang/AST/DeclCXX.h"
19 #include "clang/AST/DeclObjC.h"
20 #include "clang/AST/Expr.h"
21 #include "clang/AST/Type.h"
22 #include "clang/Basic/LLVM.h"
23 #include "clang/StaticAnalyzer/Core/PathSensitive/BasicValueFactory.h"
24 #include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
25 #include "clang/StaticAnalyzer/Core/PathSensitive/MemRegion.h"
26 #include "clang/StaticAnalyzer/Core/PathSensitive/ProgramState.h"
27 #include "clang/StaticAnalyzer/Core/PathSensitive/SValBuilder.h"
28 #include "clang/StaticAnalyzer/Core/PathSensitive/SVals.h"
29 #include "clang/StaticAnalyzer/Core/PathSensitive/StoreRef.h"
30 #include "clang/StaticAnalyzer/Core/PathSensitive/SymExpr.h"
31 #include "llvm/ADT/APSInt.h"
32 #include "llvm/ADT/Optional.h"
33 #include "llvm/ADT/SmallVector.h"
34 #include "llvm/Support/Casting.h"
35 #include "llvm/Support/ErrorHandling.h"
36 #include <cassert>
37 #include <cstdint>
38
39 using namespace clang;
40 using namespace ento;
41
42 StoreManager::StoreManager(ProgramStateManager &stateMgr)
43 : svalBuilder(stateMgr.getSValBuilder()), StateMgr(stateMgr),
44 MRMgr(svalBuilder.getRegionManager()), Ctx(stateMgr.getContext()) {}
45
46 StoreRef StoreManager::enterStackFrame(Store OldStore,
47 const CallEvent &Call,
48 const StackFrameContext *LCtx) {
49 StoreRef Store = StoreRef(OldStore, *this);
50
51 SmallVector<CallEvent::FrameBindingTy, 16> InitialBindings;
52 Call.getInitialStackFrameContents(LCtx, InitialBindings);
53
54 for (const auto &I : InitialBindings)
55 Store = Bind(Store.getStore(), I.first.castAs<Loc>(), I.second);
56
57 return Store;
58 }
59
60 const ElementRegion *StoreManager::MakeElementRegion(const SubRegion *Base,
61 QualType EleTy,
62 uint64_t index) {
63 NonLoc idx = svalBuilder.makeArrayIndex(index);
64 return MRMgr.getElementRegion(EleTy, idx, Base, svalBuilder.getContext());
65 }
66
67 const ElementRegion *StoreManager::GetElementZeroRegion(const SubRegion *R,
68 QualType T) {
69 NonLoc idx = svalBuilder.makeZeroArrayIndex();
70 assert(!T.isNull());
71 return MRMgr.getElementRegion(T, idx, R, Ctx);
72 }
73
74 const MemRegion *StoreManager::castRegion(const MemRegion *R, QualType CastToTy) {
75 ASTContext &Ctx = StateMgr.getContext();
76
77 // Handle casts to Objective-C objects.
78 if (CastToTy->isObjCObjectPointerType())
79 return R->StripCasts();
80
81 if (CastToTy->isBlockPointerType()) {
82 // FIXME: We may need different solutions, depending on the symbol
83 // involved. Blocks can be casted to/from 'id', as they can be treated
84 // as Objective-C objects. This could possibly be handled by enhancing
85 // our reasoning of downcasts of symbolic objects.
86 if (isa<CodeTextRegion>(R) || isa<SymbolicRegion>(R))
87 return R;
88
89 // We don't know what to make of it. Return a NULL region, which
90 // will be interpreted as UnknownVal.
91 return nullptr;
92 }
93
94 // Now assume we are casting from pointer to pointer. Other cases should
95 // already be handled.
96 QualType PointeeTy = CastToTy->getPointeeType();
97 QualType CanonPointeeTy = Ctx.getCanonicalType(PointeeTy);
98
99 // Handle casts to void*. We just pass the region through.
100 if (CanonPointeeTy.getLocalUnqualifiedType() == Ctx.VoidTy)
101 return R;
102
103 // Handle casts from compatible types.
104 if (R->isBoundable())
105 if (const auto *TR = dyn_cast<TypedValueRegion>(R)) {
106 QualType ObjTy = Ctx.getCanonicalType(TR->getValueType());
107 if (CanonPointeeTy == ObjTy)
108 return R;
109 }
110
111 // Process region cast according to the kind of the region being cast.
112 switch (R->getKind()) {
113 case MemRegion::CXXThisRegionKind:
114 case MemRegion::CodeSpaceRegionKind:
115 case MemRegion::StackLocalsSpaceRegionKind:
116 case MemRegion::StackArgumentsSpaceRegionKind:
117 case MemRegion::HeapSpaceRegionKind:
118 case MemRegion::UnknownSpaceRegionKind:
119 case MemRegion::StaticGlobalSpaceRegionKind:
120 case MemRegion::GlobalInternalSpaceRegionKind:
121 case MemRegion::GlobalSystemSpaceRegionKind:
122 case MemRegion::GlobalImmutableSpaceRegionKind: {
123 llvm_unreachable("Invalid region cast");
124 }
125
126 case MemRegion::FunctionCodeRegionKind:
127 case MemRegion::BlockCodeRegionKind:
128 case MemRegion::BlockDataRegionKind:
129 case MemRegion::StringRegionKind:
130 // FIXME: Need to handle arbitrary downcasts.
131 case MemRegion::SymbolicRegionKind:
132 case MemRegion::AllocaRegionKind:
133 case MemRegion::CompoundLiteralRegionKind:
134 case MemRegion::FieldRegionKind:
135 case MemRegion::ObjCIvarRegionKind:
136 case MemRegion::ObjCStringRegionKind:
137 case MemRegion::VarRegionKind:
138 case MemRegion::CXXTempObjectRegionKind:
139 case MemRegion::CXXBaseObjectRegionKind:
140 case MemRegion::CXXDerivedObjectRegionKind:
141 return MakeElementRegion(cast<SubRegion>(R), PointeeTy);
142
143 case MemRegion::ElementRegionKind: {
144 // If we are casting from an ElementRegion to another type, the
145 // algorithm is as follows:
146 //
147 // (1) Compute the "raw offset" of the ElementRegion from the
148 // base region. This is done by calling 'getAsRawOffset()'.
149 //
150 // (2a) If we get a 'RegionRawOffset' after calling
151 // 'getAsRawOffset()', determine if the absolute offset
152 // can be exactly divided into chunks of the size of the
153 // casted-pointee type. If so, create a new ElementRegion with
154 // the pointee-cast type as the new ElementType and the index
155 // being the offset divded by the chunk size. If not, create
156 // a new ElementRegion at offset 0 off the raw offset region.
157 //
158 // (2b) If we don't a get a 'RegionRawOffset' after calling
159 // 'getAsRawOffset()', it means that we are at offset 0.
160 //
161 // FIXME: Handle symbolic raw offsets.
162
163 const ElementRegion *elementR = cast<ElementRegion>(R);
164 const RegionRawOffset &rawOff = elementR->getAsArrayOffset();
165 const MemRegion *baseR = rawOff.getRegion();
166
167 // If we cannot compute a raw offset, throw up our hands and return
168 // a NULL MemRegion*.
169 if (!baseR)
170 return nullptr;
171
172 CharUnits off = rawOff.getOffset();
173
174 if (off.isZero()) {
175 // Edge case: we are at 0 bytes off the beginning of baseR. We
176 // check to see if type we are casting to is the same as the base
177 // region. If so, just return the base region.
178 if (const auto *TR = dyn_cast<TypedValueRegion>(baseR)) {
179 QualType ObjTy = Ctx.getCanonicalType(TR->getValueType());
180 QualType CanonPointeeTy = Ctx.getCanonicalType(PointeeTy);
181 if (CanonPointeeTy == ObjTy)
182 return baseR;
183 }
184
185 // Otherwise, create a new ElementRegion at offset 0.
186 return MakeElementRegion(cast<SubRegion>(baseR), PointeeTy);
187 }
188
189 // We have a non-zero offset from the base region. We want to determine
190 // if the offset can be evenly divided by sizeof(PointeeTy). If so,
191 // we create an ElementRegion whose index is that value. Otherwise, we
192 // create two ElementRegions, one that reflects a raw offset and the other
193 // that reflects the cast.
194
195 // Compute the index for the new ElementRegion.
196 int64_t newIndex = 0;
197 const MemRegion *newSuperR = nullptr;
198
199 // We can only compute sizeof(PointeeTy) if it is a complete type.
200 if (!PointeeTy->isIncompleteType()) {
201 // Compute the size in **bytes**.
202 CharUnits pointeeTySize = Ctx.getTypeSizeInChars(PointeeTy);
203 if (!pointeeTySize.isZero()) {
204 // Is the offset a multiple of the size? If so, we can layer the
205 // ElementRegion (with elementType == PointeeTy) directly on top of
206 // the base region.
207 if (off % pointeeTySize == 0) {
208 newIndex = off / pointeeTySize;
209 newSuperR = baseR;
210 }
211 }
212 }
213
214 if (!newSuperR) {
215 // Create an intermediate ElementRegion to represent the raw byte.
216 // This will be the super region of the final ElementRegion.
217 newSuperR = MakeElementRegion(cast<SubRegion>(baseR), Ctx.CharTy,
218 off.getQuantity());
219 }
220
221 return MakeElementRegion(cast<SubRegion>(newSuperR), PointeeTy, newIndex);
222 }
223 }
224
225 llvm_unreachable("unreachable");
226 }
227
228 static bool regionMatchesCXXRecordType(SVal V, QualType Ty) {
229 const MemRegion *MR = V.getAsRegion();
230 if (!MR)
231 return true;
232
233 const auto *TVR = dyn_cast<TypedValueRegion>(MR);
234 if (!TVR)
235 return true;
236
237 const CXXRecordDecl *RD = TVR->getValueType()->getAsCXXRecordDecl();
238 if (!RD)
239 return true;
240
241 const CXXRecordDecl *Expected = Ty->getPointeeCXXRecordDecl();
242 if (!Expected)
243 Expected = Ty->getAsCXXRecordDecl();
244
245 return Expected->getCanonicalDecl() == RD->getCanonicalDecl();
246 }
247
248 SVal StoreManager::evalDerivedToBase(SVal Derived, const CastExpr *Cast) {
249 // Sanity check to avoid doing the wrong thing in the face of
250 // reinterpret_cast.
251 if (!regionMatchesCXXRecordType(Derived, Cast->getSubExpr()->getType()))
252 return UnknownVal();
253
254 // Walk through the cast path to create nested CXXBaseRegions.
255 SVal Result = Derived;
256 for (CastExpr::path_const_iterator I = Cast->path_begin(),
257 E = Cast->path_end();
258 I != E; ++I) {
259 Result = evalDerivedToBase(Result, (*I)->getType(), (*I)->isVirtual());
260 }
261 return Result;
262 }
263
264 SVal StoreManager::evalDerivedToBase(SVal Derived, const CXXBasePath &Path) {
265 // Walk through the path to create nested CXXBaseRegions.
266 SVal Result = Derived;
267 for (const auto &I : Path)
268 Result = evalDerivedToBase(Result, I.Base->getType(),
269 I.Base->isVirtual());
270 return Result;
271 }
272
273 SVal StoreManager::evalDerivedToBase(SVal Derived, QualType BaseType,
274 bool IsVirtual) {
275 const MemRegion *DerivedReg = Derived.getAsRegion();
276 if (!DerivedReg)
277 return Derived;
278
279 const CXXRecordDecl *BaseDecl = BaseType->getPointeeCXXRecordDecl();
280 if (!BaseDecl)
281 BaseDecl = BaseType->getAsCXXRecordDecl();
282 assert(BaseDecl && "not a C++ object?");
283
284 if (const auto *AlreadyDerivedReg =
285 dyn_cast<CXXDerivedObjectRegion>(DerivedReg)) {
286 if (const auto *SR =
287 dyn_cast<SymbolicRegion>(AlreadyDerivedReg->getSuperRegion()))
288 if (SR->getSymbol()->getType()->getPointeeCXXRecordDecl() == BaseDecl)
289 return loc::MemRegionVal(SR);
290
291 DerivedReg = AlreadyDerivedReg->getSuperRegion();
292 }
293
294 const MemRegion *BaseReg = MRMgr.getCXXBaseObjectRegion(
295 BaseDecl, cast<SubRegion>(DerivedReg), IsVirtual);
296
297 return loc::MemRegionVal(BaseReg);
298 }
299
300 /// Returns the static type of the given region, if it represents a C++ class
301 /// object.
302 ///
303 /// This handles both fully-typed regions, where the dynamic type is known, and
304 /// symbolic regions, where the dynamic type is merely bounded (and even then,
305 /// only ostensibly!), but does not take advantage of any dynamic type info.
306 static const CXXRecordDecl *getCXXRecordType(const MemRegion *MR) {
307 if (const auto *TVR = dyn_cast<TypedValueRegion>(MR))
308 return TVR->getValueType()->getAsCXXRecordDecl();
309 if (const auto *SR = dyn_cast<SymbolicRegion>(MR))
310 return SR->getSymbol()->getType()->getPointeeCXXRecordDecl();
311 return nullptr;
312 }
313
314 SVal StoreManager::attemptDownCast(SVal Base, QualType TargetType,
315 bool &Failed) {
316 Failed = false;
317
318 const MemRegion *MR = Base.getAsRegion();
319 if (!MR)
320 return UnknownVal();
321
322 // Assume the derived class is a pointer or a reference to a CXX record.
323 TargetType = TargetType->getPointeeType();
324 assert(!TargetType.isNull());
325 const CXXRecordDecl *TargetClass = TargetType->getAsCXXRecordDecl();
326 if (!TargetClass && !TargetType->isVoidType())
327 return UnknownVal();
328
329 // Drill down the CXXBaseObject chains, which represent upcasts (casts from
330 // derived to base).
331 while (const CXXRecordDecl *MRClass = getCXXRecordType(MR)) {
332 // If found the derived class, the cast succeeds.
333 if (MRClass == TargetClass)
334 return loc::MemRegionVal(MR);
335
336 // We skip over incomplete types. They must be the result of an earlier
337 // reinterpret_cast, as one can only dynamic_cast between types in the same
338 // class hierarchy.
339 if (!TargetType->isVoidType() && MRClass->hasDefinition()) {
340 // Static upcasts are marked as DerivedToBase casts by Sema, so this will
341 // only happen when multiple or virtual inheritance is involved.
342 CXXBasePaths Paths(/*FindAmbiguities=*/false, /*RecordPaths=*/true,
343 /*DetectVirtual=*/false);
344 if (MRClass->isDerivedFrom(TargetClass, Paths))
345 return evalDerivedToBase(loc::MemRegionVal(MR), Paths.front());
346 }
347
348 if (const auto *BaseR = dyn_cast<CXXBaseObjectRegion>(MR)) {
349 // Drill down the chain to get the derived classes.
350 MR = BaseR->getSuperRegion();
351 continue;
352 }
353
354 // If this is a cast to void*, return the region.
355 if (TargetType->isVoidType())
356 return loc::MemRegionVal(MR);
357
358 // Strange use of reinterpret_cast can give us paths we don't reason
359 // about well, by putting in ElementRegions where we'd expect
360 // CXXBaseObjectRegions. If it's a valid reinterpret_cast (i.e. if the
361 // derived class has a zero offset from the base class), then it's safe
362 // to strip the cast; if it's invalid, -Wreinterpret-base-class should
363 // catch it. In the interest of performance, the analyzer will silently
364 // do the wrong thing in the invalid case (because offsets for subregions
365 // will be wrong).
366 const MemRegion *Uncasted = MR->StripCasts(/*IncludeBaseCasts=*/false);
367 if (Uncasted == MR) {
368 // We reached the bottom of the hierarchy and did not find the derived
369 // class. We must be casting the base to derived, so the cast should
370 // fail.
371 break;
372 }
373
374 MR = Uncasted;
375 }
376
377 // If we're casting a symbolic base pointer to a derived class, use
378 // CXXDerivedObjectRegion to represent the cast. If it's a pointer to an
379 // unrelated type, it must be a weird reinterpret_cast and we have to
380 // be fine with ElementRegion. TODO: Should we instead make
381 // Derived{TargetClass, Element{SourceClass, SR}}?
382 if (const auto *SR = dyn_cast<SymbolicRegion>(MR)) {
383 QualType T = SR->getSymbol()->getType();
384 const CXXRecordDecl *SourceClass = T->getPointeeCXXRecordDecl();
385 if (TargetClass && SourceClass && TargetClass->isDerivedFrom(SourceClass))
386 return loc::MemRegionVal(
387 MRMgr.getCXXDerivedObjectRegion(TargetClass, SR));
388 return loc::MemRegionVal(GetElementZeroRegion(SR, TargetType));
389 }
390
391 // We failed if the region we ended up with has perfect type info.
392 Failed = isa<TypedValueRegion>(MR);
393 return UnknownVal();
394 }
395
396 static bool hasSameUnqualifiedPointeeType(QualType ty1, QualType ty2) {
397 return ty1->getPointeeType().getCanonicalType().getTypePtr() ==
398 ty2->getPointeeType().getCanonicalType().getTypePtr();
399 }
400
401 /// CastRetrievedVal - Used by subclasses of StoreManager to implement
402 /// implicit casts that arise from loads from regions that are reinterpreted
403 /// as another region.
404 SVal StoreManager::CastRetrievedVal(SVal V, const TypedValueRegion *R,
405 QualType castTy) {
406 if (castTy.isNull() || V.isUnknownOrUndef())
407 return V;
408
409 // The dispatchCast() call below would convert the int into a float.
410 // What we want, however, is a bit-by-bit reinterpretation of the int
411 // as a float, which usually yields nothing garbage. For now skip casts
412 // from ints to floats.
413 // TODO: What other combinations of types are affected?
414 if (castTy->isFloatingType()) {
415 SymbolRef Sym = V.getAsSymbol();
416 if (Sym && !Sym->getType()->isFloatingType())
417 return UnknownVal();
418 }
419
420 // When retrieving symbolic pointer and expecting a non-void pointer,
421 // wrap them into element regions of the expected type if necessary.
422 // SValBuilder::dispatchCast() doesn't do that, but it is necessary to
423 // make sure that the retrieved value makes sense, because there's no other
424 // cast in the AST that would tell us to cast it to the correct pointer type.
425 // We might need to do that for non-void pointers as well.
426 // FIXME: We really need a single good function to perform casts for us
427 // correctly every time we need it.
428 if (castTy->isPointerType() && !castTy->isVoidPointerType())
429 if (const auto *SR = dyn_cast_or_null<SymbolicRegion>(V.getAsRegion())) {
430 QualType sr = SR->getSymbol()->getType();
431 if (!hasSameUnqualifiedPointeeType(sr, castTy))
432 return loc::MemRegionVal(castRegion(SR, castTy));
433 }
434
435 return svalBuilder.dispatchCast(V, castTy);
436 }
437
438 SVal StoreManager::getLValueFieldOrIvar(const Decl *D, SVal Base) {
439 if (Base.isUnknownOrUndef())
440 return Base;
441
442 Loc BaseL = Base.castAs<Loc>();
443 const SubRegion* BaseR = nullptr;
444
445 switch (BaseL.getSubKind()) {
446 case loc::MemRegionValKind:
447 BaseR = cast<SubRegion>(BaseL.castAs<loc::MemRegionVal>().getRegion());
448 break;
449
450 case loc::GotoLabelKind:
451 // These are anormal cases. Flag an undefined value.
452 return UndefinedVal();
453
454 case loc::ConcreteIntKind:
455 // While these seem funny, this can happen through casts.
456 // FIXME: What we should return is the field offset, not base. For example,
457 // add the field offset to the integer value. That way things
458 // like this work properly: &(((struct foo *) 0xa)->f)
459 // However, that's not easy to fix without reducing our abilities
460 // to catch null pointer dereference. Eg., ((struct foo *)0x0)->f = 7
461 // is a null dereference even though we're dereferencing offset of f
462 // rather than null. Coming up with an approach that computes offsets
463 // over null pointers properly while still being able to catch null
464 // dereferences might be worth it.
465 return Base;
466
467 default:
468 llvm_unreachable("Unhandled Base.");
469 }
470
471 // NOTE: We must have this check first because ObjCIvarDecl is a subclass
472 // of FieldDecl.
473 if (const auto *ID = dyn_cast<ObjCIvarDecl>(D))
474 return loc::MemRegionVal(MRMgr.getObjCIvarRegion(ID, BaseR));
475
476 return loc::MemRegionVal(MRMgr.getFieldRegion(cast<FieldDecl>(D), BaseR));
477 }
478
479 SVal StoreManager::getLValueIvar(const ObjCIvarDecl *decl, SVal base) {
480 return getLValueFieldOrIvar(decl, base);
481 }
482
483 SVal StoreManager::getLValueElement(QualType elementType, NonLoc Offset,
484 SVal Base) {
485 // If the base is an unknown or undefined value, just return it back.
486 // FIXME: For absolute pointer addresses, we just return that value back as
487 // well, although in reality we should return the offset added to that
488 // value. See also the similar FIXME in getLValueFieldOrIvar().
489 if (Base.isUnknownOrUndef() || Base.getAs<loc::ConcreteInt>())
490 return Base;
491
492 if (Base.getAs<loc::GotoLabel>())
493 return UnknownVal();
494
495 const SubRegion *BaseRegion =
496 Base.castAs<loc::MemRegionVal>().getRegionAs<SubRegion>();
497
498 // Pointer of any type can be cast and used as array base.
499 const auto *ElemR = dyn_cast<ElementRegion>(BaseRegion);
500
501 // Convert the offset to the appropriate size and signedness.
502 Offset = svalBuilder.convertToArrayIndex(Offset).castAs<NonLoc>();
503
504 if (!ElemR) {
505 // If the base region is not an ElementRegion, create one.
506 // This can happen in the following example:
507 //
508 // char *p = __builtin_alloc(10);
509 // p[1] = 8;
510 //
511 // Observe that 'p' binds to an AllocaRegion.
512 return loc::MemRegionVal(MRMgr.getElementRegion(elementType, Offset,
513 BaseRegion, Ctx));
514 }
515
516 SVal BaseIdx = ElemR->getIndex();
517
518 if (!BaseIdx.getAs<nonloc::ConcreteInt>())
519 return UnknownVal();
520
521 const llvm::APSInt &BaseIdxI =
522 BaseIdx.castAs<nonloc::ConcreteInt>().getValue();
523
524 // Only allow non-integer offsets if the base region has no offset itself.
525 // FIXME: This is a somewhat arbitrary restriction. We should be using
526 // SValBuilder here to add the two offsets without checking their types.
527 if (!Offset.getAs<nonloc::ConcreteInt>()) {
528 if (isa<ElementRegion>(BaseRegion->StripCasts()))
529 return UnknownVal();
530
531 return loc::MemRegionVal(MRMgr.getElementRegion(
532 elementType, Offset, cast<SubRegion>(ElemR->getSuperRegion()), Ctx));
533 }
534
535 const llvm::APSInt& OffI = Offset.castAs<nonloc::ConcreteInt>().getValue();
536 assert(BaseIdxI.isSigned());
537
538 // Compute the new index.
539 nonloc::ConcreteInt NewIdx(svalBuilder.getBasicValueFactory().getValue(BaseIdxI +
540 OffI));
541
542 // Construct the new ElementRegion.
543 const SubRegion *ArrayR = cast<SubRegion>(ElemR->getSuperRegion());
544 return loc::MemRegionVal(MRMgr.getElementRegion(elementType, NewIdx, ArrayR,
545 Ctx));
546 }
547
548 StoreManager::BindingsHandler::~BindingsHandler() = default;
549
550 bool StoreManager::FindUniqueBinding::HandleBinding(StoreManager& SMgr,
551 Store store,
552 const MemRegion* R,
553 SVal val) {
554 SymbolRef SymV = val.getAsLocSymbol();
555 if (!SymV || SymV != Sym)
556 return true;
557
558 if (Binding) {
559 First = false;
560 return false;
561 }
562 else
563 Binding = R;
564
565 return true;
566 }
StoreRef.h
clang::Builtin::ID
ID
Definition: Builtins.h:46
ASTContext.h
Defines the clang::ASTContext interface.
ento
clang::ento::StoreManager::attemptDownCast
SVal attemptDownCast(SVal Base, QualType DerivedPtrType, bool &Failed)
Attempts to do a down cast.
Definition: Store.cpp:314
SVals.h
clang::ento::TypedValueRegion
TypedValueRegion - An abstract class representing regions having a typed value.
Definition: MemRegion.h:530
clang::interp::Cast
bool Cast(InterpState &S, CodePtr OpPC)
Definition: Interp.h:800
clang::ento::StoreManager::evalDerivedToBase
SVal evalDerivedToBase(SVal Derived, const CastExpr *Cast)
Evaluates a chain of derived-to-base casts through the path specified in Cast.
Definition: Store.cpp:248
clang::QualType
A (possibly-)qualified type.
Definition: Type.h:654
clang::ento::MemRegion
MemRegion - The root abstract class for all memory regions.
Definition: MemRegion.h:94
clang::Type::isBlockPointerType
bool isBlockPointerType() const
Definition: Type.h:6512
clang::ento::StoreRef::getStore
Store getStore() const
Definition: StoreRef.h:46
clang::Type::getPointeeType
QualType getPointeeType() const
If this is a pointer, ObjC object pointer, or block pointer, this returns the respective pointee...
Definition: Type.cpp:557
Base
Type.h
C Language Family Type Representation.
clang::Decl
Decl - This represents one declaration (or definition), e.g.
Definition: DeclBase.h:88
clang::CXXRecordDecl::isDerivedFrom
bool isDerivedFrom(const CXXRecordDecl *Base) const
Determine whether this class is derived from the class Base.
Definition: CXXInheritance.cpp:91
CXXInheritance.h
clang::CharUnits::isZero
bool isZero() const
isZero - Test whether the quantity equals zero.
Definition: CharUnits.h:116
DeclObjC.h
MemRegion.h
clang::CXXBasePath
Represents a path from a specific derived class (which is not represented as part of the path) to a p...
Definition: CXXInheritance.h:70
clang::ento::nonloc::ConcreteInt
Value representing integer constant.
Definition: SVals.h:379
clang::ento::MemRegionManager::getObjCIvarRegion
const ObjCIvarRegion * getObjCIvarRegion(const ObjCIvarDecl *ivd, const SubRegion *superRegion)
getObjCIvarRegion - Retrieve or create the memory region associated with a specified Objective-c inst...
Definition: MemRegion.cpp:1038
clang::CastExpr::path_const_iterator
const CXXBaseSpecifier *const * path_const_iterator
Definition: Expr.h:3219
clang::ento::SVal::getAsLocSymbol
SymbolRef getAsLocSymbol(bool IncludeBaseRegions=false) const
If this SVal is a location and wraps a symbol, return that SymbolRef.
Definition: SVals.cpp:85
clang::ento::SValBuilder::dispatchCast
virtual SVal dispatchCast(SVal val, QualType castTy)=0
clang::ento::Store
const void * Store
Store - This opaque type encapsulates an immutable mapping from locations to values.
Definition: StoreRef.h:27
clang::ento::SValBuilder::makeArrayIndex
NonLoc makeArrayIndex(uint64_t idx)
Definition: SValBuilder.h:272
clang::ento::UndefinedVal
Definition: SVals.h:217
clang::ento::StoreManager::GetElementZeroRegion
const ElementRegion * GetElementZeroRegion(const SubRegion *R, QualType T)
Definition: Store.cpp:67
clang::QualType::getLocalUnqualifiedType
QualType getLocalUnqualifiedType() const
Return this type with all of the instance-specific qualifiers removed, but without removing any quali...
Definition: Type.h:893
clang::ento::StoreManager::castRegion
const MemRegion * castRegion(const MemRegion *region, QualType CastToTy)
castRegion - Used by ExprEngine::VisitCast to handle casts from a MemRegion* to a specific location t...
Definition: Store.cpp:74
clang::ento::StoreManager::Ctx
ASTContext & Ctx
Definition: Store.h:60
clang::ento::SymExpr
Symbolic value.
Definition: SymExpr.h:29
clang::ento::StoreManager::FindUniqueBinding::HandleBinding
bool HandleBinding(StoreManager &SMgr, Store store, const MemRegion *R, SVal val) override
Definition: Store.cpp:550
clang::ASTContext
Holds long-lived AST nodes (such as types and decls) that can be referred to throughout the semantic ...
Definition: ASTContext.h:168
regionMatchesCXXRecordType
static bool regionMatchesCXXRecordType(SVal V, QualType Ty)
Definition: Store.cpp:228
Store.h
clang::CastExpr::getSubExpr
Expr * getSubExpr()
Definition: Expr.h:3202
CharUnits.h
llvm::Expected
Definition: LLVM.h:38
clang::CharUnits
CharUnits - This is an opaque type for sizes expressed in character units.
Definition: CharUnits.h:38
LLVM.h
Forward-declares and imports various common LLVM datatypes that clang wants to use unqualified...
clang::ComparisonCategoryType::First
clang::CastExpr::path_begin
path_iterator path_begin()
Definition: Expr.h:3222
clang::QualType::getTypePtr
const Type * getTypePtr() const
Retrieves a pointer to the underlying (unqualified) type.
Definition: Type.h:6256
clang::CXXRecordDecl::getCanonicalDecl
CXXRecordDecl * getCanonicalDecl() override
Retrieves the "canonical" declaration of the given declaration.
Definition: DeclCXX.h:492
clang::CastExpr
CastExpr - Base class for type casts, including both implicit casts (ImplicitCastExpr) and explicit c...
Definition: Expr.h:3150
BasicValueFactory.h
clang::ento::StoreManager::enterStackFrame
StoreRef enterStackFrame(Store store, const CallEvent &Call, const StackFrameContext *CalleeCtx)
enterStackFrame - Let the StoreManager to do something when execution engine is about to execute into...
Definition: Store.cpp:46
clang::ento::loc::GotoLabel
Definition: SVals.h:574
clang::ento::SymExpr::getType
virtual QualType getType() const =0
clang::ento::StoreManager::getLValueIvar
virtual SVal getLValueIvar(const ObjCIvarDecl *decl, SVal base)
Definition: Store.cpp:479
clang::ento::SVal::getAsSymbol
SymbolRef getAsSymbol(bool IncludeBaseRegions=false) const
If this SVal wraps a symbol return that SymbolRef.
Definition: SVals.cpp:127
clang::Type::getAsCXXRecordDecl
CXXRecordDecl * getAsCXXRecordDecl() const
Retrieves the CXXRecordDecl that this type refers to, either because the type is a RecordType or beca...
Definition: Type.cpp:1690
clang::ento::SVal::getSubKind
unsigned getSubKind() const
Definition: SVals.h:119
clang::ento::StoreManager
Definition: Store.h:53
clang::CharUnits::getQuantity
QuantityType getQuantity() const
getQuantity - Get the raw integer representation of this quantity.
Definition: CharUnits.h:179
Offset
unsigned Offset
Definition: Format.cpp:1827
clang::ento::StoreManager::svalBuilder
SValBuilder & svalBuilder
Definition: Store.h:55
clang::Type::getPointeeCXXRecordDecl
const CXXRecordDecl * getPointeeCXXRecordDecl() const
If this is a pointer or reference to a RecordType, return the CXXRecordDecl that the type refers to...
Definition: Type.cpp:1675
V
#define V(N, I)
Definition: ASTContext.h:2941
clang::ast_matchers::decl
const internal::VariadicAllOfMatcher< Decl > decl
Matches declarations.
Definition: ASTMatchersInternal.cpp:607
ProgramState.h
clang::ento::StoreRef
Definition: StoreRef.h:29
getValue
static SVal getValue(SVal val, SValBuilder &svalBuilder)
Definition: ArrayBoundCheckerV2.cpp:277
clang::Expr::getType
QualType getType() const
Definition: Expr.h:137
clang::ento::StoreManager::StateMgr
ProgramStateManager & StateMgr
Definition: Store.h:56
clang::ento::StoreManager::Bind
virtual StoreRef Bind(Store store, Loc loc, SVal val)=0
Return a store with the specified value bound to the given location.
clang::ento::NonLoc
Definition: SVals.h:298
clang::QualType::isNull
bool isNull() const
Return true if this QualType doesn&#39;t point to a type yet.
Definition: Type.h:719
clang::ento::SValBuilder::makeZeroArrayIndex
NonLoc makeZeroArrayIndex()
Definition: SValBuilder.h:268
clang::ento::SVal::getAs
Optional< T > getAs() const
Convert to the specified SVal type, returning None if this SVal is not of the desired type...
Definition: SVals.h:111
clang::ento::MemRegion::isBoundable
virtual bool isBoundable() const
Definition: MemRegion.h:174
clang::Type::isVoidPointerType
bool isVoidPointerType() const
Definition: Type.cpp:521
clang::ento::loc::ConcreteInt
Definition: SVals.h:640
clang::ento::MemRegion::getKind
Kind getKind() const
Definition: MemRegion.h:169
clang::QualType::getCanonicalType
QualType getCanonicalType() const
Definition: Type.h:6295
hasSameUnqualifiedPointeeType
static bool hasSameUnqualifiedPointeeType(QualType ty1, QualType ty2)
Definition: Store.cpp:396
clang::ento::Loc
Definition: SVals.h:320
APSInt
llvm::APSInt APSInt
Definition: ByteCodeEmitter.cpp:18
clang::ento::CallEvent::getInitialStackFrameContents
virtual void getInitialStackFrameContents(const StackFrameContext *CalleeCtx, BindingsTy &Bindings) const =0
Populates the given SmallVector with the bindings in the callee&#39;s stack frame at the start of this ca...
clang::ento::SVal::getAsRegion
const MemRegion * getAsRegion() const
Definition: SVals.cpp:151
clang::ento::SValBuilder::getContext
ASTContext & getContext()
Definition: SValBuilder.h:155
clang::ento::SVal
SVal - This represents a symbolic expression, which can be either an L-value or an R-value...
Definition: SVals.h:75
clang::ASTContext::VoidTy
CanQualType VoidTy
Definition: ASTContext.h:1016
clang::ento::MemRegionManager::getCXXDerivedObjectRegion
const CXXDerivedObjectRegion * getCXXDerivedObjectRegion(const CXXRecordDecl *BaseClass, const SubRegion *Super)
Create a CXXDerivedObjectRegion with the given derived class for region Super.
Definition: MemRegion.cpp:1094
llvm::SmallVector
Definition: LLVM.h:35
clang::Type::isObjCObjectPointerType
bool isObjCObjectPointerType() const
Definition: Type.h:6618
clang::ento::StoreManager::BindingsHandler::~BindingsHandler
virtual ~BindingsHandler()
clang::ento::ProgramStateManager
Definition: ProgramState.h:456
SValBuilder.h
clang::ento::ElementRegion::getAsArrayOffset
RegionRawOffset getAsArrayOffset() const
Compute the offset within the array. The array might also be a subobject.
Definition: MemRegion.cpp:1230
clang::ento::MemRegionManager::getCXXBaseObjectRegion
const CXXBaseObjectRegion * getCXXBaseObjectRegion(const CXXRecordDecl *BaseClass, const SubRegion *Super, bool IsVirtual)
Create a CXXBaseObjectRegion with the given base class for region Super.
Definition: MemRegion.cpp:1074
clang::ASTContext::CharTy
CanQualType CharTy
Definition: ASTContext.h:1018
Decl.h
clang
Dataflow Directional Tag Classes.
Definition: CFGReachabilityAnalysis.h:21
clang::ento::RegionRawOffset
Definition: MemRegion.h:1064
clang::ento::MemRegionManager::getElementRegion
const ElementRegion * getElementRegion(QualType elementType, NonLoc Idx, const SubRegion *superRegion, ASTContext &Ctx)
getElementRegion - Retrieve the memory region associated with the associated element type...
Definition: MemRegion.cpp:989
clang::ento::MemRegion::StripCasts
const MemRegion * StripCasts(bool StripBaseAndDerivedCasts=true) const
Definition: MemRegion.cpp:1196
clang::ento::CallEvent
Represents an abstract call to a function or method along a particular path.
Definition: CallEvent.h:138
clang::ento::SValBuilder::convertToArrayIndex
SVal convertToArrayIndex(SVal val)
Definition: SValBuilder.cpp:99
clang::ento::ProgramStateManager::getContext
ASTContext & getContext()
Definition: ProgramState.h:499
clang::CastExpr::path_end
path_iterator path_end()
Definition: Expr.h:3223
clang::ento::SVal::castAs
T castAs() const
Convert to the specified SVal type, asserting that this SVal is of the desired type.
Definition: SVals.h:103
clang::ento::SValBuilder::getBasicValueFactory
BasicValueFactory & getBasicValueFactory()
Definition: SValBuilder.h:168
SymExpr.h
clang::ento::SubRegion
SubRegion - A region that subsets another larger region.
Definition: MemRegion.h:436
clang::ento::StoreManager::MakeElementRegion
const ElementRegion * MakeElementRegion(const SubRegion *baseRegion, QualType pointeeTy, uint64_t index=0)
Definition: Store.cpp:60
clang::ento::StoreManager::CastRetrievedVal
SVal CastRetrievedVal(SVal val, const TypedValueRegion *region, QualType castTy)
CastRetrievedVal - Used by subclasses of StoreManager to implement implicit casts that arise from loa...
Definition: Store.cpp:404
clang::CXXBasePaths::front
CXXBasePath & front()
Definition: CXXInheritance.h:196
clang::ento::StoreManager::MRMgr
MemRegionManager & MRMgr
MRMgr - Manages region objects associated with this StoreManager.
Definition: Store.h:59
clang::StackFrameContext
Definition: AnalysisDeclContext.h:296
clang::Type::isIncompleteType
bool isIncompleteType(NamedDecl **Def=nullptr) const
Types are partitioned into 3 broad categories (C99 6.2.5p1): object types, function types...
Definition: Type.cpp:2115
clang::ento::StoreManager::getLValueElement
virtual SVal getLValueElement(QualType elementType, NonLoc offset, SVal Base)
Definition: Store.cpp:483
clang::ASTContext::getCanonicalType
CanQualType getCanonicalType(QualType T) const
Return the canonical (structural) type corresponding to the specified potentially non-canonical type ...
Definition: ASTContext.h:2305
DeclCXX.h
Defines the C++ Decl subclasses, other than those for templates (found in DeclTemplate.h) and friends (in DeclFriend.h).
getCXXRecordType
static const CXXRecordDecl * getCXXRecordType(const MemRegion *MR)
Returns the static type of the given region, if it represents a C++ class object. ...
Definition: Store.cpp:306
clang::CXXRecordDecl
Represents a C++ struct/union/class.
Definition: DeclCXX.h:253
clang::Type::isVoidType
bool isVoidType() const
Definition: Type.h:6777
clang::ObjCIvarDecl
ObjCIvarDecl - Represents an ObjC instance variable.
Definition: DeclObjC.h:1959
Expr.h
clang::ento::UnknownVal
Definition: SVals.h:250
clang::ento::ElementRegion
ElementRegion is used to represent both array elements and casts.
Definition: MemRegion.h:1083
clang::Type::isPointerType
bool isPointerType() const
Definition: Type.h:6504
clang::CXXBasePaths
BasePaths - Represents the set of paths from a derived class to one of its (direct or indirect) bases...
Definition: CXXInheritance.h:118
clang::ASTContext::getTypeSizeInChars
CharUnits getTypeSizeInChars(QualType T) const
Return the size of the specified (complete) type T, in characters.
Definition: ASTContext.cpp:2383
clang::Type::isFloatingType
bool isFloatingType() const
Definition: Type.cpp:2005
clang::ento::StoreManager::StoreManager
StoreManager(ProgramStateManager &stateMgr)
Definition: Store.cpp:42
clang::ento::loc::MemRegionVal
Definition: SVals.h:598
CallEvent.h
clang::ento::MemRegionManager::getFieldRegion
const FieldRegion * getFieldRegion(const FieldDecl *fd, const SubRegion *superRegion)
getFieldRegion - Retrieve or create the memory region associated with a specified FieldDecl...
Definition: MemRegion.cpp:1032
clang::ento::SVal::isUnknownOrUndef
bool isUnknownOrUndef() const
Definition: SVals.h:144