clang
10.0.0git
|
CoreEngine - Implements the core logic of the graph-reachability analysis. More...
#include "clang/StaticAnalyzer/Core/PathSensitive/CoreEngine.h"
Public Types | |
using | BlocksExhausted = std::vector< std::pair< BlockEdge, const ExplodedNode * > > |
using | BlocksAborted = std::vector< std::pair< const CFGBlock *, const ExplodedNode * > > |
Public Member Functions | |
CoreEngine (SubEngine &subengine, FunctionSummariesTy *FS, AnalyzerOptions &Opts) | |
Construct a CoreEngine object to analyze the provided CFG. More... | |
CoreEngine (const CoreEngine &)=delete | |
CoreEngine & | operator= (const CoreEngine &)=delete |
ExplodedGraph & | getGraph () |
getGraph - Returns the exploded graph. More... | |
bool | ExecuteWorkList (const LocationContext *L, unsigned Steps, ProgramStateRef InitState) |
ExecuteWorkList - Run the worklist algorithm for a maximum number of steps. More... | |
bool | ExecuteWorkListWithInitialState (const LocationContext *L, unsigned Steps, ProgramStateRef InitState, ExplodedNodeSet &Dst) |
Returns true if there is still simulation state on the worklist. More... | |
void | dispatchWorkItem (ExplodedNode *Pred, ProgramPoint Loc, const WorkListUnit &WU) |
Dispatch the work list item based on the given location information. More... | |
bool | wasBlockAborted () const |
bool | wasBlocksExhausted () const |
bool | hasWorkRemaining () const |
void | addAbortedBlock (const ExplodedNode *node, const CFGBlock *block) |
Inform the CoreEngine that a basic block was aborted because it could not be completely analyzed. More... | |
WorkList * | getWorkList () const |
BlocksExhausted::const_iterator | blocks_exhausted_begin () const |
BlocksExhausted::const_iterator | blocks_exhausted_end () const |
BlocksAborted::const_iterator | blocks_aborted_begin () const |
BlocksAborted::const_iterator | blocks_aborted_end () const |
void | enqueue (ExplodedNodeSet &Set) |
Enqueue the given set of nodes onto the work list. More... | |
void | enqueue (ExplodedNodeSet &Set, const CFGBlock *Block, unsigned Idx) |
Enqueue nodes that were created as a result of processing a statement onto the work list. More... | |
void | enqueueEndOfFunction (ExplodedNodeSet &Set, const ReturnStmt *RS) |
enqueue the nodes corresponding to the end of function onto the end of path / work list. More... | |
void | enqueueStmtNode (ExplodedNode *N, const CFGBlock *Block, unsigned Idx) |
Enqueue a single node created as a result of statement processing. More... | |
NoteTag::Factory & | getNoteTags () |
Friends | |
class | CommonNodeBuilder |
class | EndOfFunctionNodeBuilder |
class | ExprEngine |
class | IndirectGotoNodeBuilder |
class | NodeBuilder |
struct | NodeBuilderContext |
class | SwitchNodeBuilder |
CoreEngine - Implements the core logic of the graph-reachability analysis.
It traverses the CFG and generates the ExplodedGraph. Program "states" are treated as opaque void pointers. The template class CoreEngine (which subclasses CoreEngine) provides the matching component to the engine that knows the actual types for states. Note that this engine only dispatches to transfer functions at the statement and block-level. The analyses themselves must implement any transfer function logic and the sub-expression level (if any).
Definition at line 55 of file CoreEngine.h.
using clang::ento::CoreEngine::BlocksAborted = std::vector<std::pair<const CFGBlock *, const ExplodedNode *> > |
Definition at line 69 of file CoreEngine.h.
using clang::ento::CoreEngine::BlocksExhausted = std::vector<std::pair<BlockEdge, const ExplodedNode *> > |
Definition at line 66 of file CoreEngine.h.
CoreEngine::CoreEngine | ( | SubEngine & | subengine, |
FunctionSummariesTy * | FS, | ||
AnalyzerOptions & | Opts | ||
) |
Construct a CoreEngine object to analyze the provided CFG.
Definition at line 74 of file CoreEngine.cpp.
|
delete |
|
inline |
Inform the CoreEngine that a basic block was aborted because it could not be completely analyzed.
Definition at line 167 of file CoreEngine.h.
|
inline |
Definition at line 181 of file CoreEngine.h.
|
inline |
Definition at line 185 of file CoreEngine.h.
References enqueue(), enqueueEndOfFunction(), and enqueueStmtNode().
|
inline |
Definition at line 173 of file CoreEngine.h.
|
inline |
Definition at line 177 of file CoreEngine.h.
void CoreEngine::dispatchWorkItem | ( | ExplodedNode * | Pred, |
ProgramPoint | Loc, | ||
const WorkListUnit & | WU | ||
) |
Dispatch the work list item based on the given location information.
Use Pred parameter as the predecessor state.
Definition at line 154 of file CoreEngine.cpp.
References clang::ProgramPoint::BlockEdgeKind, clang::ProgramPoint::BlockEntranceKind, clang::ProgramPoint::BlockExitKind, clang::ProgramPoint::CallEnterKind, clang::ProgramPoint::CallExitBeginKind, clang::ProgramPoint::castAs(), clang::ProgramPoint::EpsilonKind, clang::ProgramPoint::getAs(), clang::ento::WorkListUnit::getBlock(), clang::ento::ExplodedNode::getFirstPred(), clang::ento::WorkListUnit::getIndex(), clang::ProgramPoint::getKind(), clang::ento::ExplodedNode::getLocation(), clang::ento::ExplodedNode::hasSinglePred(), and clang::ento::SubEngine::processCallExit().
Referenced by ExecuteWorkList(), and getGraph().
void CoreEngine::enqueue | ( | ExplodedNodeSet & | Set | ) |
Enqueue the given set of nodes onto the work list.
Definition at line 577 of file CoreEngine.cpp.
Referenced by blocks_aborted_end(), ExecuteWorkList(), ExecuteWorkListWithInitialState(), clang::ento::ExprEngine::processCallEnter(), clang::ento::ExprEngine::ProcessImplicitDtor(), clang::ento::ExprEngine::ProcessInitializer(), clang::ento::ExprEngine::ProcessLoopExit(), clang::ento::ExprEngine::ProcessNewAllocator(), and clang::ento::ExprEngine::ProcessStmt().
void CoreEngine::enqueue | ( | ExplodedNodeSet & | Set, |
const CFGBlock * | Block, | ||
unsigned | Idx | ||
) |
Enqueue nodes that were created as a result of processing a statement onto the work list.
Definition at line 582 of file CoreEngine.cpp.
References enqueueStmtNode().
void CoreEngine::enqueueEndOfFunction | ( | ExplodedNodeSet & | Set, |
const ReturnStmt * | RS | ||
) |
enqueue the nodes corresponding to the end of function onto the end of path / work list.
Definition at line 588 of file CoreEngine.cpp.
References clang::ento::ExplodedGraph::addEndOfPath().
Referenced by blocks_aborted_end().
void CoreEngine::enqueueStmtNode | ( | ExplodedNode * | N, |
const CFGBlock * | Block, | ||
unsigned | Idx | ||
) |
Enqueue a single node created as a result of statement processing.
Definition at line 513 of file CoreEngine.cpp.
References clang::ento::ExplodedNode::addPredecessor(), clang::CFGElement::castAs(), clang::ProgramPoint::getAs(), getKind(), clang::ento::ExplodedNode::getLocation(), clang::ento::ExplodedNode::getLocationContext(), clang::ento::ExplodedGraph::getNode(), clang::ento::ExplodedNode::getState(), clang::CFGStmt::getStmt(), clang::ento::ExplodedNode::isSink(), clang::CFGElement::NewAllocator, Node, and clang::ProgramPoint::withTag().
Referenced by blocks_aborted_end(), and enqueue().
bool CoreEngine::ExecuteWorkList | ( | const LocationContext * | L, |
unsigned | Steps, | ||
ProgramStateRef | InitState | ||
) |
ExecuteWorkList - Run the worklist algorithm for a maximum number of steps.
Returns true if there is still simulation state on the worklist.
Definition at line 80 of file CoreEngine.cpp.
References clang::ento::ExplodedGraph::addRoot(), dispatchWorkItem(), clang::CFGBlock::empty(), enqueue(), clang::ento::WorkListUnit::getBlockCounter(), clang::CFGBlock::getBlockID(), clang::LocationContext::getCFG(), clang::LocationContext::getDecl(), clang::BlockEdge::getDst(), clang::ento::BlockCounter::Factory::GetEmptyCounter(), clang::CFG::getEntry(), clang::ento::SubEngine::getInitialState(), clang::ento::ExplodedNode::getLocation(), clang::ento::WorkListUnit::getNode(), clang::ento::ExplodedGraph::getNode(), clang::CFG::getNumBlockIDs(), clang::ento::FunctionSummariesTy::markVisitedBasicBlock(), min(), Node, clang::ento::ExplodedGraph::num_roots(), clang::ento::SubEngine::processBeginOfFunction(), clang::ento::SubEngine::processEndWorklist(), clang::ento::ExplodedGraph::reserve(), clang::CFGBlock::succ_begin(), and clang::CFGBlock::succ_size().
Referenced by clang::ento::ExprEngine::ExecuteWorkList(), ExecuteWorkListWithInitialState(), and getGraph().
bool CoreEngine::ExecuteWorkListWithInitialState | ( | const LocationContext * | L, |
unsigned | Steps, | ||
ProgramStateRef | InitState, | ||
ExplodedNodeSet & | Dst | ||
) |
Returns true if there is still simulation state on the worklist.
Definition at line 197 of file CoreEngine.cpp.
References clang::ento::ExplodedNodeSet::Add(), clang::ento::ExplodedNode::addPredecessor(), clang::ento::ExplodedGraph::addRoot(), clang::CFGBlock::back(), clang::CXXConstructExpr::CK_NonVirtualBase, clang::CXXConstructExpr::CK_VirtualBase, clang::CFGBlock::empty(), enqueue(), clang::ento::ExplodedGraph::eop_begin(), clang::ento::ExplodedGraph::eop_end(), ExecuteWorkList(), clang::ento::NodeBuilder::generateNode(), clang::CFGElement::getAs(), clang::BlockEntrance::getBlock(), clang::CFGBlock::getBlockID(), clang::StackFrameContext::getCallSite(), clang::LocationContext::getCFG(), clang::LocationContext::getDecl(), clang::BlockEdge::getDst(), clang::CallEnter::getEntry(), clang::CFG::getExit(), clang::BlockEntrance::getFirstElement(), clang::ento::ExplodedNode::getLocationContext(), clang::ProgramPoint::getLocationContext(), clang::ento::ExplodedGraph::getNode(), getNoteTags(), clang::CFG::getNumBlockIDs(), clang::BlockEdge::getSrc(), clang::LocationContext::getStackFrame(), clang::ento::ExplodedNode::getState(), clang::CFGBlock::getTerminator(), clang::CFGBlock::getTerminatorStmt(), clang::ento::BlockCounter::Factory::IncrementCount(), clang::CFGTerminator::isVirtualBaseBranch(), clang::ento::FunctionSummariesTy::markVisitedBasicBlock(), Node, P, clang::ento::SubEngine::processBranch(), clang::ento::SubEngine::processCallEnter(), clang::ento::SubEngine::processCFGBlockEntrance(), clang::ento::SubEngine::processCFGElement(), clang::ento::SubEngine::processCleanupTemporaryBranch(), clang::ento::SubEngine::processEndOfFunction(), clang::ento::SubEngine::processIndirectGoto(), clang::ento::SubEngine::processStaticInitializer(), clang::ento::SubEngine::processSwitch(), clang::CFGBlock::size(), State, clang::CFGBlock::succ_begin(), clang::CFGBlock::succ_end(), clang::CFGBlock::succ_size(), and clang::ProgramPoint::withTag().
Referenced by clang::ento::ExprEngine::ExecuteWorkListWithInitialState(), and getGraph().
|
inline |
getGraph - Returns the exploded graph.
Definition at line 140 of file CoreEngine.h.
References dispatchWorkItem(), ExecuteWorkList(), and ExecuteWorkListWithInitialState().
|
inline |
Definition at line 203 of file CoreEngine.h.
Referenced by ExecuteWorkListWithInitialState(), and clang::ento::ExprEngine::getNoteTags().
|
inline |
Definition at line 171 of file CoreEngine.h.
Referenced by clang::ento::ExprEngine::hasEmptyWorkList(), and clang::ento::ExprEngine::processCallExit().
|
inline |
Definition at line 161 of file CoreEngine.h.
References wasBlockAborted(), and wasBlocksExhausted().
Referenced by clang::ento::ExprEngine::hasWorkRemaining().
|
delete |
|
inline |
Definition at line 159 of file CoreEngine.h.
Referenced by hasWorkRemaining().
|
inline |
Definition at line 160 of file CoreEngine.h.
Referenced by hasWorkRemaining(), and clang::ento::ExprEngine::wasBlocksExhausted().
|
friend |
Definition at line 56 of file CoreEngine.h.
|
friend |
Definition at line 57 of file CoreEngine.h.
|
friend |
Definition at line 58 of file CoreEngine.h.
|
friend |
Definition at line 59 of file CoreEngine.h.
|
friend |
Definition at line 60 of file CoreEngine.h.
|
friend |
Definition at line 61 of file CoreEngine.h.
|
friend |
Definition at line 62 of file CoreEngine.h.