22 #include "llvm/ADT/SmallSet.h" 23 #include "llvm/ADT/Statistic.h" 24 #include "llvm/Support/SaveAndRestore.h" 26 using namespace clang;
29 #define DEBUG_TYPE "ExprEngine" 32 "The # of times we split the path due to imprecise dynamic dispatch info");
35 "The # of times we inlined a call");
38 "The # of times we reached inline count maximum");
48 assert(Entry->
empty());
73 static std::pair<
const Stmt*,
75 const Stmt *S =
nullptr;
89 S = CEE->getCalleeContext()->getCallSite();
98 Node = Node->getFirstPred();
100 }
while (!CE || CE->getCalleeContext() != CEE->getCalleeContext());
108 if (CE->getCalleeContext() == SF)
112 if (Node->pred_empty())
113 return std::make_pair(
nullptr,
nullptr);
118 return std::make_pair(S, Blk);
127 StoreManager &StoreMgr) {
135 if (ExpectedTy == ActualTy)
146 if (ExpectedClass && ActualClass) {
151 return StoreMgr.evalDerivedToBase(V, Paths.
front());
165 const Stmt *LastSt =
nullptr;
168 if (!Blk || !LastSt) {
180 removeDead(Pred, Dst, dyn_cast<ReturnStmt>(LastSt), LCtx,
188 const Decl *StaticDecl = Call->getDecl();
189 assert(RuntimeCallee);
213 const Stmt *CE = calleeCtx->getCallSite();
216 const Stmt *LastSt =
nullptr;
229 if (
const ReturnStmt *RS = dyn_cast_or_null<ReturnStmt>(LastSt)) {
231 SVal V = state->getSVal(RS, LCtx);
237 if (!ReturnedTy.
isNull()) {
238 if (
const Expr *Ex = dyn_cast<Expr>(CE)) {
245 state = state->BindExpr(CE, callerCtx, V);
251 svalBuilder.
getCXXThis(CCE->getConstructor()->getParent(), calleeCtx);
252 SVal ThisV = state->getSVal(This);
253 ThisV = state->getSVal(ThisV.
castAs<
Loc>());
254 state = state->BindExpr(CCE, callerCtx, ThisV);
257 if (
const auto *CNE = dyn_cast<CXXNewExpr>(CE)) {
263 SVal AllocV = state->getSVal(CNE, callerCtx);
265 AllocV, CNE->getType(),
268 state = addObjectUnderConstruction(state, CNE, calleeCtx->getParent(),
294 removeDead(BindedRetNode, CleanedNodes,
nullptr, calleeCtx,
295 calleeCtx->getAnalysisDeclContext()->getBody(),
297 currBldrCtx =
nullptr;
299 CleanedNodes.Add(CEBNode);
303 E = CleanedNodes.end(); I != E; ++I) {
327 if (
const CXXNewExpr *CNE = dyn_cast_or_null<CXXNewExpr>(CE)) {
330 CEENode, *UpdatedCall, *
this,
332 for (
auto I : DstPostPostCallCallback) {
336 calleeCtx->getParent()),
337 DstPostCall, I, *
this,
351 !(isa<CXXNewExpr>(CE) &&
363 calleeCtx->getIndex()+1);
380 return Cfg->
size() >= AMgr.
options.MinCFGSizeTreatFunctionsAsLarge;
389 bool &IsRecursive,
unsigned &StackDepth) {
395 const Decl *DI = SFC->getDecl();
408 if (!isSmall(CalleeADC))
423 DynamicDispatchModeInlined = 1,
424 DynamicDispatchModeConservative
429 const MemRegion *,
unsigned)
431 bool ExprEngine::inlineCall(
const CallEvent &Call,
const Decl *D,
432 NodeBuilder &Bldr, ExplodedNode *Pred,
440 !cast<BlockCall>(Call).isConversionFromLambda()) {
441 const BlockDataRegion *BR = cast<BlockCall>(Call).getBlockRegion();
442 assert(BR &&
"If we have the block definition we should have its region");
450 const Expr *CallE = Call.getOriginExpr();
455 CalleeADC->
getStackFrame(ParentOfCallee, CallE, currBldrCtx->getBlock(),
456 currBldrCtx->blockCount(), currStmtIdx);
462 State = State->enterStackFrame(Call, CalleeSFC);
465 if (ExplodedNode *N = G.getNode(Loc, State,
false, &isNew)) {
466 N->addPredecessor(Pred, G);
468 Engine.getWorkList()->enqueue(N);
473 Bldr.takeNodes(Pred);
476 Engine.FunctionSummaries->bumpNumTimesInlined(D);
480 VisitedCallees->insert(D);
487 const void *ReplayState = State->get<ReplayWithoutInlining>();
491 assert(ReplayState == CallE &&
"Backtracked to the wrong call.");
494 return State->remove<ReplayWithoutInlining>();
514 evalCall(dstCallEvaluated, *I, *CallTemplate);
530 if (!E || isa<CXXNewExpr>(E))
534 for (
unsigned CallI = 0, CallN = Call.
getNumArgs(); CallI != CallN; ++CallI) {
541 ->getStackFrame()->getParent()
543 State = finishObjectConstruction(State, {E, I}, LC);
554 ProgramStateRef CleanedState = finishArgumentConstruction(State, Call);
555 if (CleanedState == State) {
564 "Finish argument construction");
593 for (
auto I : dstCallEvaluated)
594 finishArgumentConstruction(dstArgumentCleanup, I, Call);
607 for (
auto I : dstPostCall) {
630 if (State == I->getState())
645 if (
const ObjCMethodCall *Msg = dyn_cast<ObjCMethodCall>(&Call)) {
646 switch (Msg->getMethodFamily()) {
653 return State->BindExpr(E, LCtx, Msg->getReceiverSVal());
657 SVal ThisV = C->getCXXThisVal();
658 ThisV = State->getSVal(ThisV.
castAs<
Loc>());
659 return State->BindExpr(E, LCtx, ThisV);
664 unsigned Count = currBldrCtx->blockCount();
670 std::tie(State, Target) =
672 RTC->getConstructionContext(), CallOpts);
683 State = State->invalidateRegions(TargetR, E, Count, LCtx,
693 bool IsHeapPointer =
false;
694 if (
const auto *CNE = dyn_cast<CXXNewExpr>(E))
695 if (CNE->getOperatorNew()->isReplaceableGlobalAllocationFunction()) {
697 IsHeapPointer =
true;
700 R = IsHeapPointer ? svalBuilder.getConjuredHeapSymbolVal(E, LCtx, Count)
701 : svalBuilder.conjureSymbolVal(
nullptr, E, LCtx, ResultTy,
704 return State->BindExpr(E, LCtx, R);
718 ExprEngine::CallInlinePolicy
731 return CIP_DisallowedAlways;
735 return CIP_DisallowedAlways;
745 if (CC && isa<NewAllocatedObjectConstructionContext>(CC) &&
746 !Opts.MayInlineCXXAllocator)
747 return CIP_DisallowedOnce;
755 return CIP_DisallowedOnce;
769 return CIP_DisallowedAlways;
775 !Opts.ShouldIncludeTemporaryDtorsInCFG)
776 return CIP_DisallowedOnce;
782 return CIP_DisallowedOnce;
787 return CIP_DisallowedOnce;
794 return CIP_DisallowedAlways;
803 return CIP_DisallowedOnce;
807 !Opts.MayInlineCXXTemporaryDtors)
808 return CIP_DisallowedOnce;
814 return CIP_DisallowedOnce;
818 if (Opts.MayInlineCXXAllocator)
822 return CIP_DisallowedAlways;
824 if (!Opts.MayInlineObjCMethod)
825 return CIP_DisallowedAlways;
828 return CIP_DisallowedAlways;
846 return CXXRecordDecl::FindOrdinaryMember(Specifier, Path, DeclName);
885 if (II->isStr(
"shared_ptr"))
907 if (!Opts.MayInlineTemplateFunctions)
912 if (!Opts.MayInlineCXXStandardLibrary)
919 if (!Opts.MayInlineCXXContainerMethods)
920 if (!AMgr.isInCodeFile(FD->getLocation()))
928 if (!Opts.MayInlineCXXSharedPtrDtor)
936 const CFG *CalleeCFG = CalleeADC->
getCFG();
941 if (isHuge(CalleeADC))
952 bool ExprEngine::shouldInlineCall(
const CallEvent &Call,
const Decl *D,
953 const ExplodedNode *Pred,
954 const EvalCallOptions &CallOpts) {
969 if (!AMgr.shouldInlineCall())
973 Optional<bool> MayInline = Engine.FunctionSummaries->mayInline(D);
974 if (MayInline.hasValue()) {
975 if (!MayInline.getValue())
981 if (mayInlineDecl(CalleeADC)) {
982 Engine.FunctionSummaries->markMayInline(D);
984 Engine.FunctionSummaries->markShouldNotInline(D);
993 CallInlinePolicy CIP = mayInlineCallKind(Call, Pred, Opts, CallOpts);
994 if (CIP != CIP_Allowed) {
995 if (CIP == CIP_DisallowedAlways) {
996 assert(!MayInline.hasValue() || MayInline.getValue());
997 Engine.FunctionSummaries->markShouldNotInline(D);
1003 bool IsRecursive =
false;
1004 unsigned StackDepth = 0;
1007 (!isSmall(CalleeADC) || IsRecursive))
1011 if ((Engine.FunctionSummaries->getNumTimesInlined(D) >
1012 Opts.MaxTimesInlineLarge) &&
1013 isLarge(CalleeADC)) {
1014 NumReachedInlineCountMax++;
1018 if (HowToInline ==
Inline_Minimal && (!isSmall(CalleeADC) || IsRecursive))
1047 performTrivialCopy(Bldr, Pred, *Call);
1054 const Expr *E = Call->getOriginExpr();
1057 if (InlinedFailedState) {
1059 State = InlinedFailedState;
1063 if (shouldInlineCall(*Call, D, Pred, CallOpts)) {
1075 conservativeEvalCall(*Call, Bldr, Pred, State);
1081 if (inlineCall(*Call, D, Bldr, Pred, State))
1087 conservativeEvalCall(*Call, Bldr, Pred, State);
1090 void ExprEngine::BifurcateCall(
const MemRegion *BifurReg,
1099 const unsigned *BState =
1100 State->get<DynamicDispatchBifurcationMap>(BifurReg);
1103 if (*BState == DynamicDispatchModeInlined)
1104 if (inlineCall(Call, D, Bldr, Pred, State))
1109 conservativeEvalCall(Call, Bldr, Pred, State);
1116 State->set<DynamicDispatchBifurcationMap>(BifurReg,
1117 DynamicDispatchModeInlined);
1118 inlineCall(Call, D, Bldr, Pred, IState);
1121 State->set<DynamicDispatchBifurcationMap>(BifurReg,
1122 DynamicDispatchModeConservative);
1123 conservativeEvalCall(Call, Bldr, Pred, NoIState);
1125 NumOfDynamicDispatchPathSplits++;
1137 ei = dstPreVisit.
end(); it != ei; ++it) {
Represents a function declaration or definition.
unsigned InlineMaxStackDepth
The inlining stack depth limit.
A (possibly-)qualified type.
MemRegion - The root abstract class for all memory regions.
CallEventRef< T > cloneWithState(ProgramStateRef NewState) const
Returns a copy of this CallEvent, but using the given state.
const CXXConstructorDecl * getDecl() const override
bool IsTemporaryCtorOrDtor
This call is a constructor or a destructor of a temporary value.
Stmt * getBody() const
Get the body of the Declaration.
succ_iterator succ_begin()
ImplTy::iterator iterator
void VisitCallExpr(const CallExpr *CE, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitCall - Transfer function for function calls.
void processCallExit(ExplodedNode *Pred) override
Generate the sequence of nodes that simulate the call exit and the post visit for CallExpr...
Stmt - This represents one statement.
Information about invalidation for a particular region/symbol.
This builder class is useful for generating nodes that resulted from visiting a statement.
ProgramPoint getProgramPoint(bool IsPreVisit=false, const ProgramPointTag *Tag=nullptr) const
Returns an appropriate ProgramPoint for this call.
QualType getPointeeType() const
If this is a pointer, ObjC object pointer, or block pointer, this returns the respective pointee...
unsigned size() const
Return the total number of CFGBlocks within the CFG This is simply a renaming of the getNumBlockIDs()...
Decl - This represents one declaration (or definition), e.g.
Represents a point when we begin processing an inlined call.
Manages the lifetime of CallEvent objects.
static bool isContainerMethod(const ASTContext &Ctx, const FunctionDecl *FD)
Returns true if the given function refers to a method of a C++ container or iterator.
IntrusiveRefCntPtr< const ProgramState > ProgramStateRef
bool isDerivedFrom(const CXXRecordDecl *Base) const
Determine whether this class is derived from the class Base.
Hints for figuring out of a call should be inlined during evalCall().
Represents a call to a C++ constructor.
bool IsArrayCtorOrDtor
This call is a constructor or a destructor for a single element within an array, a part of array cons...
const NestedNameSpecifier * Specifier
CallEventRef getSimpleCall(const CallExpr *E, ProgramStateRef State, const LocationContext *LCtx)
const ProgramStateRef & getState() const
SVal evalCast(SVal val, QualType castTy, QualType originalType)
Represents a path from a specific derived class (which is not represented as part of the path) to a p...
static bool wasDifferentDeclUsedForInlining(CallEventRef<> Call, const StackFrameContext *calleeCtx)
static std::pair< const Stmt *, const CFGBlock * > getLastStmt(const ExplodedNode *Node)
unsigned succ_size() const
const Expr * getOriginExpr() const
Returns the expression whose value will be the result of this call.
ASTContext & getASTContext() const
bool This(InterpState &S, CodePtr OpPC)
loc::MemRegionVal getCXXThis(const CXXMethodDecl *D, const StackFrameContext *SFC)
Return a memory region for the 'this' object reference.
void setTrait(SymbolRef Sym, InvalidationKinds IK)
static Optional< SVal > getObjectUnderConstruction(ProgramStateRef State, const ConstructionContextItem &Item, const LocationContext *LC)
By looking at a certain item that may be potentially part of an object's ConstructionContext, retrieve such object's location.
static bool hasMember(const ASTContext &Ctx, const CXXRecordDecl *RD, StringRef Name)
Returns true if the given C++ class contains a member with the given name.
void enqueue(ExplodedNodeSet &Set)
Enqueue the given set of nodes onto the work list.
void removeDead(ExplodedNode *Node, ExplodedNodeSet &Out, const Stmt *ReferenceStmt, const LocationContext *LC, const Stmt *DiagnosticStmt=nullptr, ProgramPoint::Kind K=ProgramPoint::PreStmtPurgeDeadSymbolsKind)
Run the analyzer's garbage collection - remove dead symbols and bindings from the state...
Represents a parameter to a function.
bool isMoveAssignmentOperator() const
Determine whether this is a move assignment operator.
ProgramStateRef processPointerEscapedOnBind(ProgramStateRef State, ArrayRef< std::pair< SVal, SVal >> LocAndVals, const LocationContext *LCtx, PointerEscapeKind Kind, const CallEvent *Call) override
Call PointerEscape callback when a value escapes as a result of bind.
const CFGBlock * getEntry() const
Returns the entry block in the CFG for the entered function.
DeclarationName getDeclName() const
Get the actual, stored name of the declaration, which may be a special name.
One of these records is kept for each identifier that is lexed.
Holds long-lived AST nodes (such as types and decls) that can be referred to throughout the semantic ...
AnalysisDeclContext contains the context data for the function or method under analysis.
bool isReferenceType() const
void addPredecessor(ExplodedNode *V, ExplodedGraph &G)
addPredeccessor - Adds a predecessor to the current node, and in tandem add this node as a successor ...
void runCheckersForPostObjCMessage(ExplodedNodeSet &Dst, const ExplodedNodeSet &Src, const ObjCMethodCall &msg, ExprEngine &Eng, bool wasInlined=false)
Run checkers for post-visiting obj-c messages.
i32 captured_struct **param SharedsTy A type which contains references the shared variables *param Shareds Context with the list of shared variables from the p *TaskFunction *param Data Additional data for task generation like final * state
const StackFrameContext * getStackFrame() const
STATISTIC(NumOfDynamicDispatchPathSplits, "The # of times we split the path due to imprecise dynamic dispatch info")
Represents any expression that calls an Objective-C method.
virtual Kind getKind() const =0
Returns the kind of call this is.
static bool isInStdNamespace(const Decl *D)
Returns true if the root namespace of the given declaration is the 'std' C++ namespace.
WorkList * getWorkList() const
void runCheckersForPreCall(ExplodedNodeSet &Dst, const ExplodedNodeSet &Src, const CallEvent &Call, ExprEngine &Eng)
Run checkers for pre-visiting obj-c messages.
CFGElement getCurrentCFGElement()
Return the CFG element corresponding to the worklist element that is currently being processed by Exp...
T * getAnalysis()
Return the specified analysis object, lazily running the analysis if necessary.
const LocationContext * getLocationContext() const
const LocationContext * getParent() const
virtual const CXXConstructExpr * getOriginExpr() const
bool isLinear() const
Returns true if the CFG has no branches.
void VisitReturnStmt(const ReturnStmt *R, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitReturnStmt - Transfer function logic for return statements.
const CoreEngine & getCoreEngine() const
bool hasTrivialDestructor() const
Determine whether this class has a trivial destructor (C++ [class.dtor]p3)
void runCheckersForPostCall(ExplodedNodeSet &Dst, const ExplodedNodeSet &Src, const CallEvent &Call, ExprEngine &Eng, bool wasInlined=false)
Run checkers for post-visiting obj-c messages.
static bool isCXXSharedPtrDtor(const FunctionDecl *FD)
Returns true if the given function is the destructor of a class named "shared_ptr".
static bool isVariadic(const Decl *D)
Returns true if the given decl is known to be variadic.
Escape for a new symbol that was generated into a region that the analyzer cannot follow during a con...
virtual Decl * getCanonicalDecl()
Retrieves the "canonical" declaration of the given declaration.
virtual ArrayRef< ParmVarDecl * > parameters() const =0
Return call's formal parameters.
lookup_result lookup(DeclarationName Name) const
lookup - Find the declarations (if any) with the given Name in this context.
AnalysisDeclContext * getAnalysisDeclContext(const Decl *D)
CheckerManager & getCheckerManager() const
void removeDeadOnEndOfFunction(NodeBuilderContext &BC, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Remove dead bindings/symbols before exiting a function.
static bool isTrivialObjectAssignment(const CallEvent &Call)
ProgramStateRef bindReturnValue(const CallEvent &Call, const LocationContext *LCtx, ProgramStateRef State)
Create a new state in which the call return value is binded to the call origin expression.
Represents a non-static C++ member function call, no matter how it is written.
static SVal adjustReturnValue(SVal V, QualType ExpectedTy, QualType ActualTy, StoreManager &StoreMgr)
Adjusts a return value when the called function's return type does not match the caller's expression ...
DeclarationNameTable DeclarationNames
Represents a single basic block in a source-level CFG.
Represents a point when we finish the call exit sequence (for inlined call).
AnalysisDeclContext * getContext(const Decl *D)
void runCheckersForPostStmt(ExplodedNodeSet &Dst, const ExplodedNodeSet &Src, const Stmt *S, ExprEngine &Eng, bool wasInlined=false)
Run checkers for post-visiting Stmts.
const LocationContext * getLocationContext() const
The context in which the call is being evaluated.
void processBeginOfFunction(NodeBuilderContext &BC, ExplodedNode *Pred, ExplodedNodeSet &Dst, const BlockEdge &L) override
Called by CoreEngine.
This represents one expression.
Represents a source-level, intra-procedural CFG that represents the control-flow of a Stmt...
bool isInSystemHeader(SourceLocation Loc) const
Returns if a SourceLocation is in a system header.
const CXXRecordDecl * getPointeeCXXRecordDecl() const
If this is a pointer or reference to a RecordType, return the CXXRecordDecl that the type refers to...
CallEventRef getCaller(const StackFrameContext *CalleeCtx, ProgramStateRef State)
Gets an outside caller given a callee context.
Represents a C++ destructor within a class.
AnalyzerOptions & getAnalyzerOptions() override
This is the simplest builder which generates nodes in the ExplodedGraph.
Represents C++ constructor call.
void Add(ExplodedNode *N)
Refers to regular member function and operator calls.
IdentifierInfo * getAsIdentifierInfo() const
Retrieve the IdentifierInfo * stored in this declaration name, or null if this declaration name isn't...
Refers to constructors (implicit or explicit).
void runCheckersForEvalCall(ExplodedNodeSet &Dst, const ExplodedNodeSet &Src, const CallEvent &CE, ExprEngine &Eng)
Run checkers for evaluating a call.
ASTContext & getContext() const
getContext - Return the ASTContext associated with this analysis.
ReturnStmt - This represents a return, optionally of an expression: return; return 4;...
bool isBodyAutosynthesized() const
Checks if the body of the Decl is generated by the BodyFarm.
ExplodedNode * getNode(const ProgramPoint &L, ProgramStateRef State, bool IsSink=false, bool *IsNew=nullptr)
Retrieve the node associated with a (Location,State) pair, where the 'Location' is a ProgramPoint in ...
bool isTrivial() const
Whether this function is "trivial" in some specialized C++ senses.
Enable inlining of dynamically dispatched methods.
bool isNull() const
Return true if this QualType doesn't point to a type yet.
IPAKind getIPAMode() const
Returns the inter-procedural analysis mode.
const MemRegion * getRegion() const
Get the underlining region.
While alive, includes the current analysis stack in a crash trace.
CanQualType getCanonicalTypeUnqualified() const
bool isConstQualified() const
Determine whether this type is const-qualified.
void runCheckersForNewAllocator(const CXXNewExpr *NE, SVal Target, ExplodedNodeSet &Dst, ExplodedNode *Pred, ExprEngine &Eng, bool wasInlined=false)
Run checkers between C++ operator new and constructor calls.
Defines the runtime definition of the called function.
QualType getCanonicalType() const
const FunctionDecl * getDecl() const override
IdentifierInfo & get(StringRef Name)
Return the identifier token info for the specified named identifier.
AnalysisManager & getAnalysisManager() override
const MemRegion * getAsRegion() const
Represents a new-expression for memory allocation and constructor calls, e.g: "new CXXNewExpr(foo)"...
CallEventManager & getCallEventManager()
REGISTER_MAP_WITH_PROGRAMSTATE(DynamicDispatchBifurcationMap, const MemRegion *, unsigned) bool ExprEngine
void evalCall(ExplodedNodeSet &Dst, ExplodedNode *Pred, const CallEvent &Call)
Evaluate a call, running pre- and post-call checkers and allowing checkers to be responsible for hand...
Represents a static or instance method of a struct/union/class.
bool IsCtorOrDtorWithImproperlyModeledTargetRegion
This call is a constructor or a destructor for which we do not currently compute the this-region corr...
SVal - This represents a symbolic expression, which can be either an L-value or an R-value...
const Decl * getDecl() const
bool isObjCObjectPointerType() const
AnalyzerOptions & options
Do minimal inlining of callees.
unsigned getNumBlockIDs() const
Returns the total number of BlockIDs allocated (which start at 0).
Refers to destructors (implicit or explicit).
void runCheckersForPreStmt(ExplodedNodeSet &Dst, const ExplodedNodeSet &Src, const Stmt *S, ExprEngine &Eng)
Run checkers for pre-visiting Stmts.
static bool isContainerClass(const ASTContext &Ctx, const CXXRecordDecl *RD)
Returns true if the given C++ class is a container or iterator.
const MemRegion * getDispatchRegion()
When other definitions are possible, returns the region whose runtime type determines the method defi...
void insert(const ExplodedNodeSet &S)
Optional< T > getAs() const
Convert to the specified CFGElement type, returning None if this CFGElement is not of the desired typ...
ast_type_traits::DynTypedNode Node
pred_iterator pred_begin()
static ProgramStateRef getInlineFailedState(ProgramStateRef State, const Stmt *CallE)
Dataflow Directional Tag Classes.
CFG::BuildOptions & getCFGBuildOptions()
Return the build options used to construct the CFG.
StoreManager & getStoreManager()
const StackFrameContext * getCalleeContext() const
The name of a declaration.
const CXXRecordDecl * getParent() const
Return the parent of this method declaration, which is the class in which this method is defined...
const MemRegion * StripCasts(bool StripBaseAndDerivedCasts=true) const
bool isAmbiguous(CanQualType BaseType)
Determine whether the path from the most-derived type to the given base type is ambiguous (i...
bool isCopyAssignmentOperator() const
Determine whether this is a copy-assignment operator, regardless of whether it was declared implicitl...
bool mayHaveOtherDefinitions()
Check if the definition we have is precise.
Represents an abstract call to a function or method along a particular path.
ProgramStateManager & getStateManager() override
const Decl * getDecl() const
const StackFrameContext * getStackFrame(LocationContext const *Parent, const Stmt *S, const CFGBlock *Blk, unsigned BlockCount, unsigned Idx)
void defaultEvalCall(NodeBuilder &B, ExplodedNode *Pred, const CallEvent &Call, const EvalCallOptions &CallOpts={})
Default implementation of call evaluation.
bool lookupInBases(BaseMatchesCallback BaseMatches, CXXBasePaths &Paths, bool LookupInDependent=false) const
Look for entities within the base classes of this C++ class, transitively searching all base class su...
T castAs() const
Convert to the specified SVal type, asserting that this SVal is of the desired type.
virtual unsigned getASTArgumentIndex(unsigned CallArgumentIndex) const
Some call event sub-classes conveniently adjust mismatching AST indices to match parameter indices...
static QualType getDeclaredResultType(const Decl *D)
Returns the result type of a function or method declaration.
bool mayInlineCXXMemberFunction(CXXInlineableMemberKind K) const
Returns the option controlling which C++ member functions will be considered for inlining.
const StackFrameContext * getStackFrame() const
Represents a base class of a C++ class.
Stores options for the analyzer from the command line.
SourceManager & getSourceManager()
QualType getResultType() const
Returns the result type, adjusted for references.
ExplodedNode * generateNode(const ProgramPoint &PP, ProgramStateRef State, ExplodedNode *Pred)
Generates a node in the ExplodedGraph.
Defines the C++ Decl subclasses, other than those for templates (found in DeclTemplate.h) and friends (in DeclFriend.h).
ConstructionContext's subclasses describe different ways of constructing an object in C++...
Represents a C++ struct/union/class.
bool IsTemporaryLifetimeExtendedViaAggregate
This call is a constructor for a temporary that is lifetime-extended by binding it to a reference-typ...
virtual unsigned getNumArgs() const =0
Returns the number of arguments (explicit and implicit).
QualType getPointerType(QualType T) const
Return the uniqued reference to the type for a pointer to the specified type.
CallExpr - Represents a function call (C99 6.5.2.2, C++ [expr.call]).
ExplodedNode * generateNode(const Stmt *S, ExplodedNode *Pred, ProgramStateRef St, const ProgramPointTag *tag=nullptr, ProgramPoint::Kind K=ProgramPoint::PostStmtKind)
ProgramStateRef invalidateRegions(unsigned BlockCount, ProgramStateRef Orig=nullptr) const
Returns a new state with all argument regions invalidated.
virtual void enqueue(const WorkListUnit &U)=0
bool isPointerType() const
const BlockInvocationContext * getBlockInvocationContext(const LocationContext *parent, const BlockDecl *BD, const void *ContextData)
BasePaths - Represents the set of paths from a derived class to one of its (direct or indirect) bases...
const StackFrameContext * getStackFrame() const
virtual SVal getArgSVal(unsigned Index) const
Returns the value of a given argument at the time of the call.
AnalysisPurgeMode AnalysisPurgeOpt
Enable inlining of dynamically dispatched methods, bifurcate paths when exact type info is unavailabl...
Optional< T > getAs() const
Convert to the specified ProgramPoint type, returning None if this ProgramPoint is not of the desired...
AnalysisDeclContext * getAnalysisDeclContext() const
Represents a call to a C++ constructor.
const LangOptions & getLangOpts() const
void processCallEnter(NodeBuilderContext &BC, CallEnter CE, ExplodedNode *Pred) override
Generate the entry node of the callee.
CallEventRef< T > cloneWithState(ProgramStateRef State) const