63 #include "llvm/ADT/APSInt.h" 64 #include "llvm/ADT/DenseMap.h" 65 #include "llvm/ADT/ImmutableMap.h" 66 #include "llvm/ADT/ImmutableSet.h" 67 #include "llvm/ADT/Optional.h" 68 #include "llvm/ADT/SmallVector.h" 69 #include "llvm/ADT/Statistic.h" 70 #include "llvm/Support/Casting.h" 71 #include "llvm/Support/Compiler.h" 72 #include "llvm/Support/DOTGraphTraits.h" 73 #include "llvm/Support/ErrorHandling.h" 74 #include "llvm/Support/GraphWriter.h" 75 #include "llvm/Support/SaveAndRestore.h" 76 #include "llvm/Support/raw_ostream.h" 85 using namespace clang;
88 #define DEBUG_TYPE "ExprEngine" 91 "The # of times RemoveDeadBindings is called");
93 "The # of aborted paths due to reaching the maximum block count in " 94 "a top level function");
95 STATISTIC(NumMaxBlockCountReachedInInlined,
96 "The # of aborted paths due to reaching the maximum block count in " 97 "an inlined function");
99 "The # of times we re-evaluated a call without inlining");
120 class ConstructedObjectKey {
121 typedef std::pair<ConstructionContextItem, const LocationContext *>
122 ConstructedObjectKeyImpl;
124 const ConstructedObjectKeyImpl Impl;
126 const void *getAnyASTNodePtr()
const {
127 if (
const Stmt *S = getItem().getStmtOrNull())
130 return getItem().getCXXCtorInitializer();
139 const LocationContext *getLocationContext()
const {
return Impl.second; }
142 return getLocationContext()->getDecl()->getASTContext();
145 void printJson(llvm::raw_ostream &Out,
PrinterHelper *Helper,
147 const Stmt *S = getItem().getStmtOrNull();
150 I = getItem().getCXXCtorInitializer();
153 Out <<
"\"stmt_id\": " << S->
getID(getASTContext());
155 Out <<
"\"init_id\": " << I->
getID(getASTContext());
158 Out <<
", \"kind\": \"" << getItem().getKindAsString()
159 <<
"\", \"argument_index\": ";
162 Out << getItem().getIndex();
167 Out <<
", \"pretty\": ";
176 void Profile(llvm::FoldingSetNodeID &
ID)
const {
178 ID.AddPointer(Impl.second);
181 bool operator==(
const ConstructedObjectKey &RHS)
const {
182 return Impl == RHS.Impl;
185 bool operator<(
const ConstructedObjectKey &RHS)
const {
186 return Impl < RHS.Impl;
191 typedef llvm::ImmutableMap<ConstructedObjectKey, SVal>
200 static const char* TagProviderName =
"ExprEngine";
207 : CTU(CTU), AMgr(mgr),
208 AnalysisDeclContexts(mgr.getAnalysisDeclContextManager()),
209 Engine(*this, FS, mgr.getAnalyzerOptions()), G(Engine.getGraph()),
210 StateMgr(getContext(), mgr.getStoreManagerCreator(),
211 mgr.getConstraintManagerCreator(), G.getAllocator(),
213 SymMgr(StateMgr.getSymbolManager()),
214 MRMgr(StateMgr.getRegionManager()),
215 svalBuilder(StateMgr.getSValBuilder()),
216 ObjCNoRet(mgr.getASTContext()),
218 VisitedCallees(VisitedCalleesIn),
219 HowToInline(HowToInlineIn)
221 unsigned TrimInterval = mgr.
options.GraphTrimInterval;
222 if (TrimInterval != 0) {
240 if (
const auto *FD = dyn_cast<FunctionDecl>(D)) {
244 if (!II || !(II->
getName() ==
"main" && FD->getNumParams() > 0))
250 if (!BT || !BT->isInteger())
253 const MemRegion *R = state->getRegion(PD, InitLoc);
275 if (
const auto *MD = dyn_cast<ObjCMethodDecl>(D)) {
279 const MemRegion *R = state->getRegion(SelfD, InitLoc);
284 state = state->assume(*LV,
true);
285 assert(state &&
"'self' cannot be null");
289 if (
const auto *MD = dyn_cast<CXXMethodDecl>(D)) {
290 if (!MD->isStatic()) {
297 SVal V = state->getSVal(L);
299 state = state->assume(*LV,
true);
300 assert(state &&
"'this' cannot be null");
311 const Expr *InitWithAdjustments,
const Expr *Result,
312 const SubRegion **OutRegionWithAdjustments) {
318 SVal InitValWithAdjustments = State->getSVal(InitWithAdjustments, LC);
323 if (OutRegionWithAdjustments)
324 *OutRegionWithAdjustments =
nullptr;
327 Result = InitWithAdjustments;
331 assert(!InitValWithAdjustments.
getAs<
Loc>() ||
365 CommaLHSs, Adjustments);
373 if (
const auto *MT = dyn_cast<MaterializeTemporaryExpr>(Result)) {
375 State = finishObjectConstruction(State, MT, LC);
376 State = State->BindExpr(Result, LC, *
V);
396 for (
auto I = Adjustments.rbegin(), E = Adjustments.rend(); I != E; ++I) {
407 State = State->invalidateRegions(Reg, InitWithAdjustments,
409 nullptr,
nullptr,
nullptr);
422 SVal InitVal = State->getSVal(Init, LC);
426 State = State->bindLoc(BaseReg.
castAs<
Loc>(), InitVal, LC,
false);
430 if (InitValWithAdjustments.
isUnknown()) {
434 Result, LC, InitWithAdjustments->
getType(),
438 State->bindLoc(Reg.
castAs<
Loc>(), InitValWithAdjustments, LC,
false);
440 State = State->bindLoc(BaseReg.
castAs<
Loc>(), InitVal, LC,
false);
447 State = State->BindExpr(Result, LC, Reg);
449 State = State->BindExpr(Result, LC, InitValWithAdjustments);
455 if (OutRegionWithAdjustments)
456 *OutRegionWithAdjustments = cast<SubRegion>(Reg.
getAsRegion());
467 assert(!State->get<ObjectsUnderConstruction>(Key) ||
468 Key.getItem().getKind() ==
470 return State->set<ObjectsUnderConstruction>(Key,
V);
486 assert(State->contains<ObjectsUnderConstruction>(Key));
487 return State->remove<ObjectsUnderConstruction>(Key);
493 ConstructedObjectKey Key({BTE,
true}, LC);
496 return State->set<ObjectsUnderConstruction>(Key,
UnknownVal());
503 ConstructedObjectKey Key({BTE,
true}, LC);
504 assert(State->contains<ObjectsUnderConstruction>(Key));
505 return State->remove<ObjectsUnderConstruction>(Key);
511 ConstructedObjectKey Key({BTE,
true}, LC);
512 return State->contains<ObjectsUnderConstruction>(Key);
520 assert(LC &&
"ToLC must be a parent of FromLC!");
521 for (
auto I : State->get<ObjectsUnderConstruction>())
522 if (I.first.getLocationContext() == LC)
538 SVal cond,
bool assumption) {
557 unsigned int Space = 0,
bool IsDot =
false) {
562 bool HasItem =
false;
565 const ConstructedObjectKey *LastKey =
nullptr;
566 for (
const auto &I : State->get<ObjectsUnderConstruction>()) {
567 const ConstructedObjectKey &Key = I.first;
568 if (Key.getLocationContext() != LCtx)
579 for (
const auto &I : State->get<ObjectsUnderConstruction>()) {
580 const ConstructedObjectKey &Key = I.first;
581 SVal
Value = I.second;
582 if (Key.getLocationContext() != LCtx)
585 Indent(Out, Space, IsDot) <<
"{ ";
586 Key.printJson(Out,
nullptr, PP);
587 Out <<
", \"value\": \"" << Value <<
"\" }";
595 Indent(Out, --Space, IsDot) <<
']';
603 unsigned int Space,
bool IsDot)
const {
604 Indent(Out, Space, IsDot) <<
"\"constructing_objects\": ";
606 if (LCtx && !State->get<ObjectsUnderConstruction>().isEmpty()) {
614 Indent(Out, Space, IsDot) <<
"]," << NL;
616 Out <<
"null," << NL;
630 currStmtIdx = StmtIdx;
665 const ExplodedNode *Pred,
668 if (AMgr.options.AnalysisPurgeOpt == PurgeNone)
690 const Stmt *ReferenceStmt,
692 const Stmt *DiagnosticStmt,
695 ReferenceStmt ==
nullptr || isa<ReturnStmt>(ReferenceStmt))
696 &&
"PostStmt is not generally supported by the SymbolReaper yet");
697 assert(LC &&
"Must pass the current (or expiring) LocationContext");
699 if (!DiagnosticStmt) {
700 DiagnosticStmt = ReferenceStmt;
701 assert(DiagnosticStmt &&
"Required for clearing a LocationContext");
704 NumRemoveDeadBindings++;
710 if (!ReferenceStmt) {
712 "Use PostStmtPurgeDeadSymbolsKind for clearing a LocationContext");
719 for (
auto I : CleanedState->get<ObjectsUnderConstruction>()) {
720 if (
SymbolRef Sym = I.second.getAsSymbol())
722 if (
const MemRegion *MR = I.second.getAsRegion())
732 CleanedState, SFC, SymReaper);
741 DiagnosticStmt, *
this, K);
747 for (
const auto I : CheckedSet) {
755 "Checkers are not allowed to modify the Environment as a part of " 756 "checkDeadSymbols processing.");
758 "Checkers are not allowed to modify the Store as a part of " 759 "checkDeadSymbols processing.");
765 Bldr.
generateNode(DiagnosticStmt, I, CleanedCheckerSt, &cleanupTag, K);
775 "Error evaluating statement");
784 CleanedStates.Add(Pred);
788 for (
const auto I : CleanedStates) {
791 Visit(currStmt, I, DstI);
802 "Error evaluating end of the loop");
808 if(AMgr.
options.ShouldUnrollLoops)
825 "Error evaluating initializer");
829 const auto *
decl = cast<CXXConstructorDecl>(stackFrame->getDecl());
832 SVal thisVal = State->getSVal(svalBuilder.
getCXXThis(decl, stackFrame));
844 State = finishObjectConstruction(State, BMI, LC);
846 PostStore PS(Init, LC,
nullptr,
nullptr);
855 FieldLoc = State->getLValue(BMI->
getMember(), thisVal);
863 while ((ASE = dyn_cast<ArraySubscriptExpr>(Init)))
866 SVal LValue = State->getSVal(Init, stackFrame);
869 InitVal = State->getSVal(*LValueLoc);
879 InitVal = State->getSVal(BMI->
getInit(), stackFrame);
883 evalBind(Tmp, Init, Pred, FieldLoc, InitVal,
true, &PP);
896 for (
const auto I : Tmp) {
925 llvm_unreachable(
"Unexpected dtor kind.");
940 if (Opts.MayInlineCXXAllocator)
962 const MemRegion *ValueRegion = state->getSVal(Region).getAsRegion();
971 varType = cast<TypedValueRegion>(Region)->getValueType();
982 false, Pred, Dst, CallOpts);
993 SVal ArgVal = State->getSVal(Arg, LCtx);
997 if (State->isNull(ArgVal).isConstrainedTrue()) {
1004 Bldr.generateNode(PP, Pred->
getState(), Pred);
1017 DTy = AT->getElementType();
1029 const auto *CurDtor = cast<CXXDestructorDecl>(LCtx->
getDecl());
1042 true, Pred, Dst, CallOpts);
1052 const auto *CurDtor = cast<CXXDestructorDecl>(LCtx->
getDecl());
1053 Loc ThisStorageLoc =
1055 Loc ThisLoc = State->getSVal(ThisStorageLoc).castAs<
Loc>();
1056 SVal FieldVal = State->getLValue(Member, ThisLoc);
1062 FieldVal = makeZeroElementRegion(State, FieldVal, T,
1066 false, Pred, Dst, CallOpts);
1090 if (isDestructorElided(State, BTE, LC)) {
1091 State = cleanupElidedDestructor(State, BTE, LC);
1107 assert(CleanDtorState.
size() <= 1);
1109 CleanDtorState.
empty() ? Pred : *CleanDtorState.
begin();
1118 T = AT->getElementType();
1127 false, CleanPred, Dst, CallOpts);
1169 State = addObjectUnderConstruction(State, BTE, LC,
UnknownVal());
1179 class CollectReachableSymbolsCallback final :
public SymbolVisitor {
1184 : Symbols(Symbols) {}
1188 bool VisitSymbol(
SymbolRef Sym)
override {
1189 Symbols.insert(Sym);
1194 CollectReachableSymbolsCallback CallBack(Symbols);
1196 State->scanReachableSymbols(V, CallBack);
1199 State, CallBack.getSymbols(), Call, K,
nullptr);
1209 assert(!isa<Expr>(S) || S == cast<Expr>(S)->IgnoreParens());
1213 case Expr::ObjCIndirectCopyRestoreExprClass:
1214 case Stmt::CXXDependentScopeMemberExprClass:
1215 case Stmt::CXXInheritedCtorInitExprClass:
1216 case Stmt::CXXTryStmtClass:
1217 case Stmt::CXXTypeidExprClass:
1218 case Stmt::CXXUuidofExprClass:
1219 case Stmt::CXXFoldExprClass:
1220 case Stmt::MSPropertyRefExprClass:
1221 case Stmt::MSPropertySubscriptExprClass:
1222 case Stmt::CXXUnresolvedConstructExprClass:
1223 case Stmt::DependentScopeDeclRefExprClass:
1224 case Stmt::ArrayTypeTraitExprClass:
1225 case Stmt::ExpressionTraitExprClass:
1226 case Stmt::UnresolvedLookupExprClass:
1227 case Stmt::UnresolvedMemberExprClass:
1228 case Stmt::TypoExprClass:
1229 case Stmt::CXXNoexceptExprClass:
1230 case Stmt::PackExpansionExprClass:
1231 case Stmt::SubstNonTypeTemplateParmPackExprClass:
1232 case Stmt::FunctionParmPackExprClass:
1233 case Stmt::CoroutineBodyStmtClass:
1234 case Stmt::CoawaitExprClass:
1235 case Stmt::DependentCoawaitExprClass:
1236 case Stmt::CoreturnStmtClass:
1237 case Stmt::CoyieldExprClass:
1238 case Stmt::SEHTryStmtClass:
1239 case Stmt::SEHExceptStmtClass:
1240 case Stmt::SEHLeaveStmtClass:
1241 case Stmt::SEHFinallyStmtClass:
1242 case Stmt::OMPParallelDirectiveClass:
1243 case Stmt::OMPSimdDirectiveClass:
1244 case Stmt::OMPForDirectiveClass:
1245 case Stmt::OMPForSimdDirectiveClass:
1246 case Stmt::OMPSectionsDirectiveClass:
1247 case Stmt::OMPSectionDirectiveClass:
1248 case Stmt::OMPSingleDirectiveClass:
1249 case Stmt::OMPMasterDirectiveClass:
1250 case Stmt::OMPCriticalDirectiveClass:
1251 case Stmt::OMPParallelForDirectiveClass:
1252 case Stmt::OMPParallelForSimdDirectiveClass:
1253 case Stmt::OMPParallelSectionsDirectiveClass:
1254 case Stmt::OMPParallelMasterDirectiveClass:
1255 case Stmt::OMPTaskDirectiveClass:
1256 case Stmt::OMPTaskyieldDirectiveClass:
1257 case Stmt::OMPBarrierDirectiveClass:
1258 case Stmt::OMPTaskwaitDirectiveClass:
1259 case Stmt::OMPTaskgroupDirectiveClass:
1260 case Stmt::OMPFlushDirectiveClass:
1261 case Stmt::OMPOrderedDirectiveClass:
1262 case Stmt::OMPAtomicDirectiveClass:
1263 case Stmt::OMPTargetDirectiveClass:
1264 case Stmt::OMPTargetDataDirectiveClass:
1265 case Stmt::OMPTargetEnterDataDirectiveClass:
1266 case Stmt::OMPTargetExitDataDirectiveClass:
1267 case Stmt::OMPTargetParallelDirectiveClass:
1268 case Stmt::OMPTargetParallelForDirectiveClass:
1269 case Stmt::OMPTargetUpdateDirectiveClass:
1270 case Stmt::OMPTeamsDirectiveClass:
1271 case Stmt::OMPCancellationPointDirectiveClass:
1272 case Stmt::OMPCancelDirectiveClass:
1273 case Stmt::OMPTaskLoopDirectiveClass:
1274 case Stmt::OMPTaskLoopSimdDirectiveClass:
1275 case Stmt::OMPMasterTaskLoopDirectiveClass:
1276 case Stmt::OMPMasterTaskLoopSimdDirectiveClass:
1277 case Stmt::OMPParallelMasterTaskLoopDirectiveClass:
1278 case Stmt::OMPParallelMasterTaskLoopSimdDirectiveClass:
1279 case Stmt::OMPDistributeDirectiveClass:
1280 case Stmt::OMPDistributeParallelForDirectiveClass:
1281 case Stmt::OMPDistributeParallelForSimdDirectiveClass:
1282 case Stmt::OMPDistributeSimdDirectiveClass:
1283 case Stmt::OMPTargetParallelForSimdDirectiveClass:
1284 case Stmt::OMPTargetSimdDirectiveClass:
1285 case Stmt::OMPTeamsDistributeDirectiveClass:
1286 case Stmt::OMPTeamsDistributeSimdDirectiveClass:
1287 case Stmt::OMPTeamsDistributeParallelForSimdDirectiveClass:
1288 case Stmt::OMPTeamsDistributeParallelForDirectiveClass:
1289 case Stmt::OMPTargetTeamsDirectiveClass:
1290 case Stmt::OMPTargetTeamsDistributeDirectiveClass:
1291 case Stmt::OMPTargetTeamsDistributeParallelForDirectiveClass:
1292 case Stmt::OMPTargetTeamsDistributeParallelForSimdDirectiveClass:
1293 case Stmt::OMPTargetTeamsDistributeSimdDirectiveClass:
1294 case Stmt::CapturedStmtClass: {
1296 Engine.addAbortedBlock(node, currBldrCtx->getBlock());
1300 case Stmt::ParenExprClass:
1301 llvm_unreachable(
"ParenExprs already handled.");
1302 case Stmt::GenericSelectionExprClass:
1303 llvm_unreachable(
"GenericSelectionExprs already handled.");
1306 case Stmt::BreakStmtClass:
1307 case Stmt::CaseStmtClass:
1308 case Stmt::CompoundStmtClass:
1309 case Stmt::ContinueStmtClass:
1310 case Stmt::CXXForRangeStmtClass:
1311 case Stmt::DefaultStmtClass:
1312 case Stmt::DoStmtClass:
1313 case Stmt::ForStmtClass:
1314 case Stmt::GotoStmtClass:
1315 case Stmt::IfStmtClass:
1316 case Stmt::IndirectGotoStmtClass:
1317 case Stmt::LabelStmtClass:
1319 case Stmt::NullStmtClass:
1320 case Stmt::SwitchStmtClass:
1321 case Stmt::WhileStmtClass:
1322 case Expr::MSDependentExistsStmtClass:
1323 llvm_unreachable(
"Stmt should not be in analyzer evaluation loop");
1324 case Stmt::ImplicitValueInitExprClass:
1328 llvm_unreachable(
"Should be pruned from CFG");
1330 case Stmt::ObjCSubscriptRefExprClass:
1331 case Stmt::ObjCPropertyRefExprClass:
1332 llvm_unreachable(
"These are handled by PseudoObjectExpr");
1334 case Stmt::GNUNullExprClass: {
1338 svalBuilder.makeIntValWithPtrWidth(0,
false));
1343 case Stmt::ObjCAtSynchronizedStmtClass:
1349 case Expr::ConstantExprClass:
1350 case Stmt::ExprWithCleanupsClass:
1354 case Stmt::CXXBindTemporaryExprClass: {
1366 case Stmt::DesignatedInitExprClass:
1367 case Stmt::DesignatedInitUpdateExprClass:
1368 case Stmt::ArrayInitLoopExprClass:
1369 case Stmt::ArrayInitIndexExprClass:
1370 case Stmt::ExtVectorElementExprClass:
1371 case Stmt::ImaginaryLiteralClass:
1372 case Stmt::ObjCAtCatchStmtClass:
1373 case Stmt::ObjCAtFinallyStmtClass:
1374 case Stmt::ObjCAtTryStmtClass:
1375 case Stmt::ObjCAutoreleasePoolStmtClass:
1376 case Stmt::ObjCEncodeExprClass:
1377 case Stmt::ObjCIsaExprClass:
1378 case Stmt::ObjCProtocolExprClass:
1379 case Stmt::ObjCSelectorExprClass:
1380 case Stmt::ParenListExprClass:
1381 case Stmt::ShuffleVectorExprClass:
1382 case Stmt::ConvertVectorExprClass:
1383 case Stmt::VAArgExprClass:
1384 case Stmt::CUDAKernelCallExprClass:
1385 case Stmt::OpaqueValueExprClass:
1386 case Stmt::AsTypeExprClass:
1387 case Stmt::ConceptSpecializationExprClass:
1388 case Stmt::CXXRewrittenBinaryOperatorClass:
1389 case Stmt::RequiresExprClass:
1394 case Stmt::PredefinedExprClass:
1395 case Stmt::AddrLabelExprClass:
1396 case Stmt::AttributedStmtClass:
1397 case Stmt::IntegerLiteralClass:
1398 case Stmt::FixedPointLiteralClass:
1399 case Stmt::CharacterLiteralClass:
1400 case Stmt::CXXScalarValueInitExprClass:
1401 case Stmt::CXXBoolLiteralExprClass:
1402 case Stmt::ObjCBoolLiteralExprClass:
1403 case Stmt::ObjCAvailabilityCheckExprClass:
1404 case Stmt::FloatingLiteralClass:
1405 case Stmt::NoInitExprClass:
1406 case Stmt::SizeOfPackExprClass:
1407 case Stmt::StringLiteralClass:
1408 case Stmt::SourceLocExprClass:
1409 case Stmt::ObjCStringLiteralClass:
1410 case Stmt::CXXPseudoDestructorExprClass:
1411 case Stmt::SubstNonTypeTemplateParmExprClass:
1412 case Stmt::CXXNullPtrLiteralExprClass:
1413 case Stmt::OMPArraySectionExprClass:
1414 case Stmt::TypeTraitExprClass: {
1423 case Stmt::CXXDefaultArgExprClass:
1424 case Stmt::CXXDefaultInitExprClass: {
1433 if (
const auto *DefE = dyn_cast<CXXDefaultArgExpr>(S))
1434 ArgE = DefE->getExpr();
1435 else if (
const auto *DefE = dyn_cast<CXXDefaultInitExpr>(S))
1436 ArgE = DefE->getExpr();
1438 llvm_unreachable(
"unknown constant wrapper kind");
1440 bool IsTemporary =
false;
1441 if (
const auto *MTE = dyn_cast<MaterializeTemporaryExpr>(ArgE)) {
1442 ArgE = MTE->getSubExpr();
1451 for (
const auto I : PreVisit) {
1453 State = State->BindExpr(S, LCtx, *ConstantVal);
1455 State = createTemporaryRegionIfNeeded(State, LCtx,
1467 case Stmt::CXXStdInitializerListExprClass:
1468 case Expr::ObjCArrayLiteralClass:
1469 case Expr::ObjCDictionaryLiteralClass:
1470 case Expr::ObjCBoxedExprClass: {
1479 const auto *Ex = cast<Expr>(S);
1480 QualType resultType = Ex->getType();
1482 for (
const auto N : preVisit) {
1484 SVal result = svalBuilder.conjureSymbolVal(
nullptr, Ex, LCtx,
1486 currBldrCtx->blockCount());
1491 if (!(isa<ObjCBoxedExpr>(Ex) &&
1492 !cast<ObjCBoxedExpr>(Ex)->getSubExpr()
1494 for (
auto Child : Ex->children()) {
1496 SVal Val = State->getSVal(Child, LCtx);
1508 case Stmt::ArraySubscriptExprClass:
1514 case Stmt::GCCAsmStmtClass:
1520 case Stmt::MSAsmStmtClass:
1526 case Stmt::BlockExprClass:
1532 case Stmt::LambdaExprClass:
1533 if (AMgr.options.ShouldInlineLambdas) {
1539 Engine.addAbortedBlock(node, currBldrCtx->getBlock());
1543 case Stmt::BinaryOperatorClass: {
1544 const auto *B = cast<BinaryOperator>(S);
1545 if (B->isLogicalOp()) {
1551 else if (B->getOpcode() == BO_Comma) {
1555 state->getSVal(B->getRHS(),
1562 if (AMgr.options.ShouldEagerlyAssume &&
1563 (B->isRelationalOp() || B->isEqualityOp())) {
1575 case Stmt::CXXOperatorCallExprClass: {
1576 const auto *OCE = cast<CXXOperatorCallExpr>(S);
1580 const Decl *Callee = OCE->getCalleeDecl();
1581 if (
const auto *MD = dyn_cast_or_null<CXXMethodDecl>(Callee)) {
1582 if (MD->isInstance()) {
1586 createTemporaryRegionIfNeeded(State, LCtx, OCE->getArg(0));
1587 if (NewState != State) {
1600 case Stmt::CallExprClass:
1601 case Stmt::CXXMemberCallExprClass:
1602 case Stmt::UserDefinedLiteralClass:
1608 case Stmt::CXXCatchStmtClass:
1614 case Stmt::CXXTemporaryObjectExprClass:
1615 case Stmt::CXXConstructExprClass:
1621 case Stmt::CXXNewExprClass: {
1628 for (
const auto i : PreVisit)
1636 case Stmt::CXXDeleteExprClass: {
1639 const auto *CDE = cast<CXXDeleteExpr>(S);
1642 for (
const auto i : PreVisit)
1651 case Stmt::ChooseExprClass: {
1653 const auto *C = cast<ChooseExpr>(S);
1659 case Stmt::CompoundAssignOperatorClass:
1665 case Stmt::CompoundLiteralExprClass:
1671 case Stmt::BinaryConditionalOperatorClass:
1672 case Stmt::ConditionalOperatorClass: {
1674 const auto *C = cast<AbstractConditionalOperator>(S);
1680 case Stmt::CXXThisExprClass:
1686 case Stmt::DeclRefExprClass: {
1688 const auto *DE = cast<DeclRefExpr>(S);
1694 case Stmt::DeclStmtClass:
1700 case Stmt::ImplicitCastExprClass:
1701 case Stmt::CStyleCastExprClass:
1702 case Stmt::CXXStaticCastExprClass:
1703 case Stmt::CXXDynamicCastExprClass:
1704 case Stmt::CXXReinterpretCastExprClass:
1705 case Stmt::CXXConstCastExprClass:
1706 case Stmt::CXXFunctionalCastExprClass:
1707 case Stmt::BuiltinBitCastExprClass:
1708 case Stmt::ObjCBridgedCastExprClass: {
1710 const auto *C = cast<CastExpr>(S);
1712 VisitCast(C, C->getSubExpr(), Pred, dstExpr);
1720 case Expr::MaterializeTemporaryExprClass: {
1722 const auto *MTE = cast<MaterializeTemporaryExpr>(S);
1726 for (
const auto i : dstPrevisit)
1733 case Stmt::InitListExprClass:
1739 case Stmt::MemberExprClass:
1745 case Stmt::AtomicExprClass:
1751 case Stmt::ObjCIvarRefExprClass:
1757 case Stmt::ObjCForCollectionStmtClass:
1763 case Stmt::ObjCMessageExprClass:
1769 case Stmt::ObjCAtThrowStmtClass:
1770 case Stmt::CXXThrowExprClass:
1776 case Stmt::ReturnStmtClass:
1782 case Stmt::OffsetOfExprClass: {
1788 for (
const auto Node : PreVisit)
1796 case Stmt::UnaryExprOrTypeTraitExprClass:
1803 case Stmt::StmtExprClass: {
1804 const auto *SE = cast<StmtExpr>(S);
1806 if (SE->getSubStmt()->body_empty()) {
1809 &&
"Empty statement expression must have void type.");
1813 if (
const auto *LastExpr =
1814 dyn_cast<Expr>(*SE->getSubStmt()->body_rbegin())) {
1818 state->getSVal(LastExpr,
1824 case Stmt::UnaryOperatorClass: {
1826 const auto *U = cast<UnaryOperator>(S);
1827 if (AMgr.options.ShouldEagerlyAssume && (U->getOpcode() == UO_LNot)) {
1838 case Stmt::PseudoObjectExprClass: {
1841 const auto *PE = cast<PseudoObjectExpr>(S);
1842 if (
const Expr *Result = PE->getResultExpr()) {
1858 bool ExprEngine::replayWithoutInlining(
ExplodedNode *N,
1862 assert(CalleeSF && CallerSF);
1869 BeforeProcessingCall = N;
1884 if (SP->getStmt() == CE)
1889 if (!BeforeProcessingCall)
1906 ExplodedNode *NewNode = G.getNode(NewNodeLoc, NewNodeState,
false, &IsNew);
1917 NumTimesRetriedWithoutInlining++;
1928 if(AMgr.options.ShouldUnrollLoops) {
1929 unsigned maxBlockVisitOnPath = AMgr.options.maxBlockVisitOnPath;
1933 Pred, maxBlockVisitOnPath);
1934 if (NewState != Pred->
getState()) {
1949 if (BlockCount == AMgr.options.maxBlockVisitOnPath - 1 &&
1950 AMgr.options.ShouldWidenLoops) {
1953 (isa<ForStmt>(Term) || isa<WhileStmt>(Term) || isa<DoStmt>(Term))))
1964 if (BlockCount >= AMgr.options.maxBlockVisitOnPath) {
1974 (*G.roots_begin())->getLocation().getLocationContext();
1976 Engine.FunctionSummaries->markReachedMaxBlockCount(CalleeSF->
getDecl());
1982 if ((!AMgr.options.NoRetryExhausted &&
1983 replayWithoutInlining(Pred, CalleeLC)))
1985 NumMaxBlockCountReachedInInlined++;
1987 NumMaxBlockCountReached++;
1990 Engine.blocksExhausted.push_back(std::make_pair(L, Sink));
2004 const Stmt *Condition,
2008 const auto *Ex = dyn_cast<
Expr>(Condition);
2010 return UnknownVal();
2013 bool bitsInit =
false;
2015 while (
const auto *CE = dyn_cast<CastExpr>(Ex)) {
2019 return UnknownVal();
2022 if (!bitsInit || newBits < bits) {
2027 Ex = CE->getSubExpr();
2035 return UnknownVal();
2037 return state->getSVal(Ex, LCtx);
2044 if (!BO || !BO->isLogicalOp()) {
2047 Condition = BO->getRHS()->IgnoreParens();
2069 if (
const auto *Ex = dyn_cast<Expr>(Condition))
2070 Condition = Ex->IgnoreParens();
2073 if (!BO || !BO->isLogicalOp())
2077 "Other kinds of branches are handled separately!");
2088 for (; I != E; ++I) {
2093 const Stmt *LastStmt = CS->getStmt();
2097 llvm_unreachable(
"could not resolve condition");
2106 assert((!Condition || !isa<CXXBindTemporaryExpr>(Condition)) &&
2107 "CXXBindTemporaryExprs are handled by processBindTemporary.");
2110 currBldrCtx = &BldCtx;
2120 if (
const auto *Ex = dyn_cast<Expr>(Condition))
2121 Condition = Ex->IgnoreParens();
2126 "Error evaluating branch");
2132 if (CheckersOutSet.empty())
2136 for (
const auto PredI : CheckersOutSet) {
2137 if (PredI->isSink())
2141 SVal X = PrevState->getSVal(Condition, PredI->getLocationContext());
2145 if (
const auto *Ex = dyn_cast<Expr>(Condition)) {
2146 if (Ex->getType()->isIntegralOrEnumerationType()) {
2152 PredI->getLocationContext(),
2172 std::tie(StTrue, StFalse) = PrevState->assume(V);
2190 currBldrCtx =
nullptr;
2196 llvm::ImmutableSet<const VarDecl *>)
2199 NodeBuilderContext &BuilderCtx,
2201 ExplodedNodeSet &Dst,
2204 PrettyStackTraceLocationContext CrashInfo(Pred->getLocationContext());
2205 currBldrCtx = &BuilderCtx;
2209 bool initHasRun = state->contains<InitializedGlobalsSet>(VD);
2210 BranchNodeBuilder builder(Pred, Dst, BuilderCtx, DstT, DstF);
2213 state = state->add<InitializedGlobalsSet>(VD);
2216 builder.generateNode(state, initHasRun, Pred);
2217 builder.markInfeasible(!initHasRun);
2219 currBldrCtx =
nullptr;
2241 if (I.getLabel() == L) {
2247 llvm_unreachable(
"No block with label.");
2281 State = finishArgumentConstruction(
2296 while (LC != ToLC) {
2297 assert(LC &&
"ToLC must be a parent of FromLC!");
2298 for (
auto I : State->get<ObjectsUnderConstruction>())
2299 if (I.first.getLocationContext() == LC) {
2303 assert(I.first.getItem().getKind() ==
2305 I.first.getItem().getKind() ==
2307 State = State->remove<ObjectsUnderConstruction>(I.first);
2325 assert(areAllObjectsFullyConstructed(Pred->
getState(),
2338 for (
const auto I : AfterRemovedDead)
2344 Engine.enqueueEndOfFunction(Dst, RS);
2356 if (CondV_untested.
isUndef()) {
2368 bool defaultIsFeasible = I == EI;
2370 for ( ; I != EI; ++I) {
2375 const CaseStmt *Case = I.getCase();
2390 std::tie(StateCase, DefaultSt) =
2391 DefaultSt->assumeInclusiveRange(*NL, V1, V2);
2393 StateCase = DefaultSt;
2401 defaultIsFeasible =
true;
2403 defaultIsFeasible =
false;
2408 if (!defaultIsFeasible)
2440 if (
const auto *VD = dyn_cast<VarDecl>(D)) {
2443 assert(Ex->
isGLValue() || VD->getType()->isVoidType());
2445 const Decl *D = LocCtxt->getDecl();
2446 const auto *MD = dyn_cast_or_null<CXXMethodDecl>(D);
2447 const auto *DeclRefEx = dyn_cast<
DeclRefExpr>(Ex);
2450 if (AMgr.options.ShouldInlineLambdas && DeclRefEx &&
2451 DeclRefEx->refersToEnclosingVariableOrCapture() && MD &&
2452 MD->getParent()->isLambda()) {
2455 llvm::DenseMap<const VarDecl *, FieldDecl *> LambdaCaptureFields;
2461 if (
const FieldDecl *FD = LambdaCaptureFields[VD]) {
2463 svalBuilder.getCXXThis(MD, LocCtxt->getStackFrame());
2464 SVal CXXThisVal = state->getSVal(CXXThis);
2465 VInfo = std::make_pair(state->getLValue(FD, CXXThisVal), FD->getType());
2470 VInfo = std::make_pair(state->getLValue(VD, LocCtxt), VD->getType());
2472 SVal V = VInfo->first;
2473 bool IsReference = VInfo->second->isReferenceType();
2478 if (
const MemRegion *R = V.getAsRegion())
2479 V = state->getSVal(R);
2484 Bldr.
generateNode(Ex, Pred, state->BindExpr(Ex, LCtx, V),
nullptr,
2488 if (
const auto *ED = dyn_cast<EnumConstantDecl>(D)) {
2490 SVal V = svalBuilder.makeIntVal(ED->getInitVal());
2491 Bldr.
generateNode(Ex, Pred, state->BindExpr(Ex, LCtx, V));
2494 if (
const auto *FD = dyn_cast<FunctionDecl>(D)) {
2495 SVal V = svalBuilder.getFunctionPointer(FD);
2496 Bldr.
generateNode(Ex, Pred, state->BindExpr(Ex, LCtx, V),
nullptr,
2500 if (isa<FieldDecl>(D) || isa<IndirectFieldDecl>(D)) {
2506 SVal V = svalBuilder.conjureSymbolVal(Ex, LCtx,
getContext().VoidPtrTy,
2507 currBldrCtx->blockCount());
2509 Bldr.
generateNode(Ex, Pred, state->BindExpr(Ex, LCtx, V),
nullptr,
2513 if (isa<BindingDecl>(D)) {
2519 llvm_unreachable(
"Support for this Decl not implemented.");
2543 for (
auto *
Node : CheckerPreStmt) {
2547 if (IsGLValueLike) {
2556 SVal V = state->getLValue(T,
2557 state->getSVal(Idx, LCtx),
2558 state->getSVal(Base, LCtx));
2561 }
else if (IsVectorType) {
2565 llvm_unreachable(
"Array subscript should be an lValue when not \ 2566 a vector and not a forbidden lvalue type");
2585 if (isa<VarDecl>(Member) || isa<EnumConstantDecl>(Member)) {
2586 for (
const auto I : CheckedSet)
2592 for (
const auto I : CheckedSet) {
2598 if (
const auto *MD = dyn_cast<CXXMethodDecl>(Member)) {
2599 if (MD->isInstance())
2600 state = createTemporaryRegionIfNeeded(state, LCtx, BaseExpr);
2602 SVal MDVal = svalBuilder.getFunctionPointer(MD);
2603 state = state->BindExpr(M, LCtx, MDVal);
2611 state = createTemporaryRegionIfNeeded(state, LCtx, BaseExpr,
2617 const auto *field = cast<FieldDecl>(Member);
2618 SVal L = state->getLValue(field, baseExprVal);
2629 if (!PE || PE->getCastKind() != CK_ArrayToPointerDecay) {
2630 llvm_unreachable(
"should always be wrapped in ArrayToPointerDecay");
2634 if (field->getType()->isReferenceType()) {
2635 if (
const MemRegion *R = L.getAsRegion())
2636 L = state->getSVal(R);
2641 Bldr.
generateNode(M, I, state->BindExpr(M, LCtx, L),
nullptr,
2665 for (
const auto I : AfterPreSet) {
2670 for (
unsigned SI = 0, Count = AE->
getNumSubExprs(); SI != Count; SI++) {
2672 SVal SubExprVal = State->getSVal(SubExpr, LCtx);
2673 ValuesToInvalidate.push_back(SubExprVal);
2676 State = State->invalidateRegions(ValuesToInvalidate, AE,
2677 currBldrCtx->blockCount(),
2683 State = State->BindExpr(AE, LCtx, ResultVal);
2703 for (
const std::pair<SVal, SVal> &LocAndVal : LocAndVals) {
2705 const MemRegion *MR = LocAndVal.first.getAsRegion();
2707 Escaped.push_back(LocAndVal.second);
2712 if (
const auto *VR = dyn_cast<VarRegion>(MR->
getBaseRegion()))
2713 if (VR->hasStackParametersStorage() && VR->getStackFrame()->inTopFrame())
2714 if (
const auto *RD = VR->getValueType()->getAsCXXRecordDecl())
2715 if (!RD->hasTrivialDestructor()) {
2716 Escaped.push_back(LocAndVal.second);
2725 SVal StoredVal = State->getSVal(MR);
2726 if (StoredVal != LocAndVal.second)
2729 Escaped.push_back(LocAndVal.second);
2732 if (Escaped.empty())
2741 std::pair<SVal, SVal> LocAndVal(Loc, Val);
2752 if (!Invalidated || Invalidated->empty())
2765 for (
const auto I : ExplicitRegions) {
2767 SymbolsDirectlyInvalidated.insert(R->getSymbol());
2771 for (
const auto &sym : *Invalidated) {
2772 if (SymbolsDirectlyInvalidated.count(sym))
2774 SymbolsIndirectlyInvalidated.insert(sym);
2777 if (!SymbolsDirectlyInvalidated.empty())
2782 if (!SymbolsIndirectlyInvalidated.empty())
2803 StoreE, *
this, *PP);
2818 for (
const auto PredI : CheckedSet) {
2826 state = state->bindLoc(location.
castAs<
Loc>(),
2827 Val, LC, !atDeclInit);
2832 LocReg = LocRegVal->getRegion();
2849 const Expr *LocationE,
2855 const Expr *StoreE = AssignE ? AssignE : LocationE;
2859 evalLocation(Tmp, AssignE, LocationE, Pred, state, location,
false);
2867 for (
const auto I : Tmp)
2868 evalBind(Dst, StoreE, I, location, Val,
false);
2873 const Expr *BoundEx,
2879 assert(!location.
getAs<
NonLoc>() &&
"location cannot be a NonLoc.");
2884 evalLocation(Tmp, NodeEx, BoundEx, Pred, state, location,
true);
2893 for (
const auto I : Tmp) {
2894 state = I->getState();
2901 V = state->getSVal(location.
castAs<
Loc>(), LoadTy);
2904 Bldr.
generateNode(NodeEx, I, state->BindExpr(BoundEx, LCtx, V), tag,
2911 const Stmt *BoundEx,
2940 NodeEx, BoundEx, *
this);
2944 std::pair<const ProgramPointTag *, const ProgramPointTag*>
2947 eagerlyAssumeBinOpBifurcationTrue(TagProviderName,
2948 "Eagerly Assume True"),
2949 eagerlyAssumeBinOpBifurcationFalse(TagProviderName,
2950 "Eagerly Assume False");
2951 return std::make_pair(&eagerlyAssumeBinOpBifurcationTrue,
2952 &eagerlyAssumeBinOpBifurcationFalse);
2960 for (
const auto Pred : Src) {
2972 if (SEV && SEV->isExpression()) {
2973 const std::pair<const ProgramPointTag *, const ProgramPointTag*> &tags =
2977 std::tie(StateTrue, StateFalse) = state->assume(*SEV);
2981 SVal Val = svalBuilder.makeIntVal(1U, Ex->
getType());
2988 SVal Val = svalBuilder.makeIntVal(0U, Ex->
getType());
3038 N->getState()->getStateManager().getOwningEngine()).
getBugReporter();
3040 const auto EQClasses =
3041 llvm::make_range(BR.EQClasses_begin(), BR.EQClasses_end());
3043 for (
const auto &
EQ : EQClasses) {
3044 for (
const auto &I :
EQ.getReports()) {
3045 const auto *PR = dyn_cast<PathSensitiveBugReport>(I.get());
3048 const ExplodedNode *EN = PR->getErrorNode();
3049 if (EN->getState() == N->getState() &&
3050 EN->getLocation() == N->getLocation())
3061 static bool traverseHiddenNodes(
3062 const ExplodedNode *N,
3063 llvm::function_ref<
void(
const ExplodedNode *)> PreCallback,
3064 llvm::function_ref<
void(
const ExplodedNode *)> PostCallback,
3065 llvm::function_ref<
bool(
const ExplodedNode *)> Stop) {
3071 if (N->succ_size() != 1 || !isNodeHidden(N->getFirstSucc()))
3075 N = N->getFirstSucc();
3080 static bool isNodeHidden(
const ExplodedNode *N) {
3081 return N->isTrivial();
3084 static std::string getNodeLabel(
const ExplodedNode *N, ExplodedGraph *G){
3086 llvm::raw_string_ostream Out(Buf);
3088 const bool IsDot =
true;
3089 const unsigned int Space = 1;
3092 Out <<
"{ \"state_id\": " << State->getID()
3095 Indent(Out, Space, IsDot) <<
"\"program_points\": [\\l";
3098 traverseHiddenNodes(
3100 [&](
const ExplodedNode *OtherNode) {
3101 Indent(Out, Space + 1, IsDot) <<
"{ ";
3102 OtherNode->getLocation().printJson(Out,
"\\l");
3103 Out <<
", \"tag\": ";
3105 Out <<
'\"' << Tag->getTagDescription() <<
"\"";
3108 Out <<
", \"node_id\": " << OtherNode->getID() <<
3109 ", \"is_sink\": " << OtherNode->isSink() <<
3113 [&](
const ExplodedNode *) { Out <<
",\\l"; },
3114 [&](
const ExplodedNode *) {
return false; });
3117 Indent(Out, Space, IsDot) <<
"],\\l";
3119 State->printDOT(Out, N->getLocationContext(), Space);
3132 llvm::DisplayGraph(Filename,
false, llvm::GraphProgram::DOT);
3134 llvm::errs() <<
"Warning: viewing graph requires assertions" <<
"\n";
3141 llvm::DisplayGraph(Filename,
false, llvm::GraphProgram::DOT);
3143 llvm::errs() <<
"Warning: viewing graph requires assertions" <<
"\n";
3149 std::vector<const ExplodedNode *> Src;
3153 EI = BR.EQClasses_begin(), EE = BR.EQClasses_end(); EI != EE; ++EI) {
3155 dyn_cast<PathSensitiveBugReport>(EI->getReports()[0].get());
3158 const auto *N =
const_cast<ExplodedNode *
>(R->getErrorNode());
3163 return llvm::WriteGraph(&G,
"ExprEngine",
false,
3164 "Exploded Graph", Filename);
3167 llvm::errs() <<
"Warning: dumping graph requires assertions" <<
"\n";
3172 StringRef Filename) {
3174 std::unique_ptr<ExplodedGraph> TrimmedG(G.trim(Nodes));
3176 if (!TrimmedG.get()) {
3177 llvm::errs() <<
"warning: Trimmed ExplodedGraph is empty.\n";
3179 return llvm::WriteGraph(TrimmedG.get(),
"TrimmedExprEngine",
3181 "Trimmed Exploded Graph",
3185 llvm::errs() <<
"Warning: dumping graph requires assertions" <<
"\n";
3190 static int index = 0;
void processEndWorklist() override
Called by CoreEngine when the analysis worklist has terminated.
bool isBaseInitializer() const
Determine whether this initializer is initializing a base class.
Defines the clang::ASTContext interface.
Represents C++ allocator call.
This represents a GCC inline-assembly statement extension.
TypedValueRegion - An abstract class representing regions having a typed value.
ProgramStateRef processRegionChange(ProgramStateRef state, const MemRegion *MR, const LocationContext *LCtx)
Expr * getInit() const
Get the initializer.
void VisitArraySubscriptExpr(const ArraySubscriptExpr *Ex, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitArraySubscriptExpr - Transfer function for array accesses.
void ProcessInitializer(const CFGInitializer I, ExplodedNode *Pred)
SVal evalDerivedToBase(SVal Derived, const CastExpr *Cast)
Evaluates a chain of derived-to-base casts through the path specified in Cast.
A (possibly-)qualified type.
MemRegion - The root abstract class for all memory regions.
void markLive(SymbolRef sym)
Unconditionally marks a symbol as live.
enum clang::SubobjectAdjustment::@49 Kind
bool isMemberPointerType() const
ValueDecl * getMemberDecl() const
Retrieve the member declaration to which this expression refers.
void markInfeasible(bool branch)
const Expr * skipRValueSubobjectAdjustments(SmallVectorImpl< const Expr *> &CommaLHS, SmallVectorImpl< SubobjectAdjustment > &Adjustments) const
Walk outwards from an expression we want to bind a reference to and find the expression whose lifetim...
const Stmt * getStmt() const
bool IsTemporaryCtorOrDtor
This call is a constructor or a destructor of a temporary value.
bool operator==(CanQual< T > x, CanQual< U > y)
static bool nodeHasBugReport(const ExplodedNode *N)
bool isCForbiddenLValueType() const
Determine whether expressions of the given type are forbidden from being lvalues in C...
unsigned blockCount() const
Returns the number of times the current basic block has been visited on the exploded graph path...
Specialize PointerLikeTypeTraits to allow LazyGenerationalUpdatePtr to be placed into a PointerUnion...
void VisitCallExpr(const CallExpr *CE, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitCall - Transfer function for function calls.
Stmt - This represents one statement.
Information about invalidation for a particular region/symbol.
This builder class is useful for generating nodes that resulted from visiting a statement.
void VisitCXXBindTemporaryExpr(const CXXBindTemporaryExpr *BTE, ExplodedNodeSet &PreVisit, ExplodedNodeSet &Dst)
C Language Family Type Representation.
Defines the SourceManager interface.
static bool nodeHasBugReport(const ExplodedNode *N)
static const Stmt * getRightmostLeaf(const Stmt *Condition)
void VisitMSAsmStmt(const MSAsmStmt *A, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitMSAsmStmt - Transfer function logic for MS inline asm.
Decl - This represents one declaration (or definition), e.g.
Represents a point when we begin processing an inlined call.
Defines the PrettyStackTraceEntry class, which is used to make crashes give more contextual informati...
FunctionDecl * getOperatorNew() const
bool isVirtual() const
Determines whether the base class is a virtual base class (or not).
IntrusiveRefCntPtr< const ProgramState > ProgramStateRef
ExprEngine(cross_tu::CrossTranslationUnitContext &CTU, AnalysisManager &mgr, SetOfConstDecls *VisitedCalleesIn, FunctionSummariesTy *FS, InliningModes HowToInlineIn)
const CastExpr * BasePath
SVal evalBinOp(ProgramStateRef state, BinaryOperator::Opcode op, NonLoc L, NonLoc R, QualType T)
void processBranch(const Stmt *Condition, NodeBuilderContext &BuilderCtx, ExplodedNode *Pred, ExplodedNodeSet &Dst, const CFGBlock *DstT, const CFGBlock *DstF) override
ProcessBranch - Called by CoreEngine.
The pointer has been passed to a function indirectly.
void ViewGraph(bool trim=false)
Visualize the ExplodedGraph created by executing the simulation.
void processCleanupTemporaryBranch(const CXXBindTemporaryExpr *BTE, NodeBuilderContext &BldCtx, ExplodedNode *Pred, ExplodedNodeSet &Dst, const CFGBlock *DstT, const CFGBlock *DstF) override
Called by CoreEngine.
Represents C++ object destructor generated from a call to delete.
ProgramStateRef removeDeadBindingsFromEnvironmentAndStore(ProgramStateRef St, const StackFrameContext *LCtx, SymbolReaper &SymReaper)
Represents an array type, per C99 6.7.5.2 - Array Declarators.
Hints for figuring out of a call should be inlined during evalCall().
Represents a program point just before an implicit call event.
bool IsArrayCtorOrDtor
This call is a constructor or a destructor for a single element within an array, a part of array cons...
void ProcessMemberDtor(const CFGMemberDtor D, ExplodedNode *Pred, ExplodedNodeSet &Dst)
StorageDuration
The storage duration for an object (per C++ [basic.stc]).
void runCheckersForPrintStateJson(raw_ostream &Out, ProgramStateRef State, const char *NL="\, unsigned int Space=0, bool IsDot=false) const
Run checkers for debug-printing a ProgramState.
T castAs() const
Convert to the specified CFGElement type, asserting that this CFGElement is of the desired type...
const ProgramStateRef & getState() const
DOTGraphTraits(bool isSimple=false)
void processCFGBlockEntrance(const BlockEdge &L, NodeBuilderWithSinks &nodeBuilder, ExplodedNode *Pred) override
Called by CoreEngine when processing the entrance of a CFGBlock.
Represents a point when we exit a loop.
ProgramStateRef getInitialState(const LocationContext *InitLoc) override
getInitialState - Return the initial state used for the root vertex in the ExplodedGraph.
const CXXDestructorDecl * getDestructorDecl(ASTContext &astContext) const
static void printObjectsUnderConstructionJson(raw_ostream &Out, ProgramStateRef State, const char *NL, const LocationContext *LCtx, unsigned int Space=0, bool IsDot=false)
bool isIndirectMemberInitializer() const
bool isConsumedExpr(Expr *E) const
void VisitUnaryOperator(const UnaryOperator *B, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitUnaryOperator - Transfer function logic for unary operators.
void takeNodes(const ExplodedNodeSet &S)
Represents a variable declaration or definition.
ProgramStateRef notifyCheckersOfPointerEscape(ProgramStateRef State, const InvalidatedSymbols *Invalidated, ArrayRef< const MemRegion *> ExplicitRegions, const CallEvent *Call, RegionAndSymbolInvalidationTraits &ITraits) override
Call PointerEscape callback when a value escapes as a result of region invalidation.
ASTContext & getASTContext() const
REGISTER_TRAIT_WITH_PROGRAMSTATE(ObjectsUnderConstruction, ObjectsUnderConstructionMap) static const char *TagProviderName
const T * getAs() const
Member-template getAs<specific type>'.
void ProcessDeleteDtor(const CFGDeleteDtor D, ExplodedNode *Pred, ExplodedNodeSet &Dst)
loc::MemRegionVal getCXXThis(const CXXMethodDecl *D, const StackFrameContext *SFC)
Return a memory region for the 'this' object reference.
static Optional< SVal > getObjectUnderConstruction(ProgramStateRef State, const ConstructionContextItem &Item, const LocationContext *LC)
By looking at a certain item that may be potentially part of an object's ConstructionContext, retrieve such object's location.
void evalStore(ExplodedNodeSet &Dst, const Expr *AssignE, const Expr *StoreE, ExplodedNode *Pred, ProgramStateRef St, SVal TargetLV, SVal Val, const ProgramPointTag *tag=nullptr)
evalStore - Handle the semantics of a store via an assignment.
bool isUnrolledState(ProgramStateRef State)
Returns if the given State indicates that is inside a completely unrolled loop.
const ElementRegion * GetElementZeroRegion(const SubRegion *R, QualType T)
void enqueue(ExplodedNodeSet &Set)
Enqueue the given set of nodes onto the work list.
const internal::VariadicDynCastAllOfMatcher< Decl, VarDecl > varDecl
Matches variable declarations.
const Stmt * getTriggerStmt() const
Describes how types, statements, expressions, and declarations should be printed. ...
Defines the Objective-C statement AST node classes.
void removeDead(ExplodedNode *Node, ExplodedNodeSet &Out, const Stmt *ReferenceStmt, const LocationContext *LC, const Stmt *DiagnosticStmt=nullptr, ProgramPoint::Kind K=ProgramPoint::PreStmtPurgeDeadSymbolsKind)
Run the analyzer's garbage collection - remove dead symbols and bindings from the state...
Represents a parameter to a function.
Defines the clang::Expr interface and subclasses for C++ expressions.
void VisitCXXThisExpr(const CXXThisExpr *TE, ExplodedNode *Pred, ExplodedNodeSet &Dst)
BoundNodesTreeBuilder Nodes
static bool shouldRemoveDeadBindings(AnalysisManager &AMgr, const Stmt *S, const ExplodedNode *Pred, const LocationContext *LC)
void ProcessTemporaryDtor(const CFGTemporaryDtor D, ExplodedNode *Pred, ExplodedNodeSet &Dst)
void ProcessLoopExit(const Stmt *S, ExplodedNode *Pred)
void runCheckersForLocation(ExplodedNodeSet &Dst, const ExplodedNodeSet &Src, SVal location, bool isLoad, const Stmt *NodeEx, const Stmt *BoundEx, ExprEngine &Eng)
Run checkers for load/store of a location.
bool haveEqualEnvironments(ProgramStateRef S1, ProgramStateRef S2) const
ProgramStateRef runCheckersForPointerEscape(ProgramStateRef State, const InvalidatedSymbols &Escaped, const CallEvent *Call, PointerEscapeKind Kind, RegionAndSymbolInvalidationTraits *ITraits)
Run checkers when pointers escape.
ProgramStateRef processPointerEscapedOnBind(ProgramStateRef State, ArrayRef< std::pair< SVal, SVal >> LocAndVals, const LocationContext *LCtx, PointerEscapeKind Kind, const CallEvent *Call) override
Call PointerEscape callback when a value escapes as a result of bind.
One of these records is kept for each identifier that is lexed.
A pointer escapes due to binding its value to a location that the analyzer cannot track...
Holds long-lived AST nodes (such as types and decls) that can be referred to throughout the semantic ...
void runCheckersForLiveSymbols(ProgramStateRef state, SymbolReaper &SymReaper)
Run checkers for live symbols.
void printJson(raw_ostream &Out, PrinterHelper *Helper, const PrintingPolicy &Policy, bool AddQuotes) const
Pretty-prints in JSON format.
SourceLocation getBeginLoc() const LLVM_READONLY
Represents a member of a struct/union/class.
Represents a program point after a store evaluation.
Represents C++ object destructor implicitly generated for automatic object or temporary bound to cons...
bool haveEqualStores(ProgramStateRef S1, ProgramStateRef S2) const
ProgramStateRef processLoopEnd(const Stmt *LoopStmt, ProgramStateRef State)
Updates the given ProgramState.
bool isReferenceType() const
void ProcessImplicitDtor(const CFGImplicitDtor D, ExplodedNode *Pred)
bool isAllEnumCasesCovered() const
Returns true if the SwitchStmt is a switch of an enum value and all cases have been explicitly covere...
void addPredecessor(ExplodedNode *V, ExplodedGraph &G)
addPredeccessor - Adds a predecessor to the current node, and in tandem add this node as a successor ...
i32 captured_struct **param SharedsTy A type which contains references the shared variables *param Shareds Context with the list of shared variables from the p *TaskFunction *param Data Additional data for task generation like final * state
const StackFrameContext * getStackFrame() const
ProgramStateRef escapeValues(ProgramStateRef State, ArrayRef< SVal > Vs, PointerEscapeKind K, const CallEvent *Call=nullptr) const
A simple wrapper when you only need to notify checkers of pointer-escape of some values.
bool isIntegralOrEnumerationType() const
Determine whether this type is an integral or enumeration type.
void enableNodeReclamation(unsigned Interval)
Enable tracking of recently allocated nodes for potential reclamation when calling reclaimRecentlyAll...
static bool isLocType(QualType T)
void VisitOffsetOfExpr(const OffsetOfExpr *Ex, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitOffsetOfExpr - Transfer function for offsetof.
This is a meta program point, which should be skipped by all the diagnostic reasoning etc...
ProgramStateRef updateLoopStack(const Stmt *LoopStmt, ASTContext &ASTCtx, ExplodedNode *Pred, unsigned maxVisitOnPath)
Updates the stack of loops contained by the ProgramState.
ExplodedNode * generateSink(const Stmt *S, ExplodedNode *Pred, ProgramStateRef St, const ProgramPointTag *tag=nullptr, ProgramPoint::Kind K=ProgramPoint::PostStmtKind)
SourceLocation getBeginLoc() const LLVM_READONLY
Forward-declares and imports various common LLVM datatypes that clang wants to use unqualified...
STATISTIC(NumRemoveDeadBindings, "The # of times RemoveDeadBindings is called")
const LocationContext * getLocationContext() const
ExplodedNode * generateCaseStmtNode(const iterator &I, ProgramStateRef State)
virtual bool inTopFrame() const
Return true if the current LocationContext has no caller context.
const clang::PrintingPolicy & getPrintingPolicy() const
static bool isRecordType(QualType T)
const LocationContext * getParent() const
A builtin binary operation expression such as "x + y" or "x <= y".
If a crash happens while one of these objects are live, the message is printed out along with the spe...
void VisitReturnStmt(const ReturnStmt *R, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitReturnStmt - Transfer function logic for return statements.
const VarDecl * getVarDecl() const
CaseStmt - Represent a case statement.
const CXXBaseSpecifier * getBaseSpecifier() const
bool isAnyMemberInitializer() const
An adjustment to be made to the temporary created when emitting a reference binding, which accesses a particular subobject of that temporary.
void ProcessNewAllocator(const CXXNewExpr *NE, ExplodedNode *Pred)
void ProcessAutomaticObjDtor(const CFGAutomaticObjDtor D, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Represents binding an expression to a temporary.
virtual SVal getLValueField(const FieldDecl *D, SVal Base)
FieldDecl * getAnyMember() const
void VisitDeclStmt(const DeclStmt *DS, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitDeclStmt - Transfer function logic for DeclStmts.
CXXDestructorDecl * getDestructor() const
Returns the destructor decl for this class.
FieldDecl * getMember() const
If this is a member initializer, returns the declaration of the non-static data member being initiali...
void runCheckersForEndFunction(NodeBuilderContext &BC, ExplodedNodeSet &Dst, ExplodedNode *Pred, ExprEngine &Eng, const ReturnStmt *RS)
Run checkers on end of function.
void processStaticInitializer(const DeclStmt *DS, NodeBuilderContext &BuilderCtx, ExplodedNode *Pred, ExplodedNodeSet &Dst, const CFGBlock *DstT, const CFGBlock *DstF) override
Called by CoreEngine.
const CFGBlock * getCallSiteBlock() const
void evalBind(ExplodedNodeSet &Dst, const Stmt *StoreE, ExplodedNode *Pred, SVal location, SVal Val, bool atDeclInit=false, const ProgramPoint *PP=nullptr)
evalBind - Handle the semantics of binding a value to a specific location.
CheckerManager & getCheckerManager() const
void VisitLogicalExpr(const BinaryOperator *B, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitLogicalExpr - Transfer function logic for '&&', '||'.
CXXCtorInitializer * getInitializer() const
void removeDeadOnEndOfFunction(NodeBuilderContext &BC, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Remove dead bindings/symbols before exiting a function.
void runCheckersForBind(ExplodedNodeSet &Dst, const ExplodedNodeSet &Src, SVal location, SVal val, const Stmt *S, ExprEngine &Eng, const ProgramPoint &PP)
Run checkers for binding of a value to a location.
CXXRecordDecl * getAsCXXRecordDecl() const
Retrieves the CXXRecordDecl that this type refers to, either because the type is a RecordType or beca...
const FieldDecl * getFieldDecl() const
const Stmt * getCallSite() const
void VisitCXXCatchStmt(const CXXCatchStmt *CS, ExplodedNode *Pred, ExplodedNodeSet &Dst)
bool isDelegatingInitializer() const
Determine whether this initializer is creating a delegating constructor.
const CXXBindTemporaryExpr * getBindTemporaryExpr() const
Represents a single basic block in a source-level CFG.
void VisitInitListExpr(const InitListExpr *E, ExplodedNode *Pred, ExplodedNodeSet &Dst)
llvm::APSInt EvaluateKnownConstInt(const ASTContext &Ctx, SmallVectorImpl< PartialDiagnosticAt > *Diag=nullptr) const
EvaluateKnownConstInt - Call EvaluateAsRValue and return the folded integer.
InliningModes
The modes of inlining, which override the default analysis-wide settings.
SymbolicRegion - A special, "non-concrete" region.
void runCheckersForPostStmt(ExplodedNodeSet &Dst, const ExplodedNodeSet &Src, const Stmt *S, ExprEngine &Eng, bool wasInlined=false)
Run checkers for post-visiting Stmts.
static unsigned getNumSubExprs(AtomicOp Op)
Determine the number of arguments the specified atomic builtin should have.
void ProcessBaseDtor(const CFGBaseDtor D, ExplodedNode *Pred, ExplodedNodeSet &Dst)
DefinedOrUnknownSVal makeZeroVal(QualType type)
Construct an SVal representing '0' for the specified type.
void processSwitch(SwitchNodeBuilder &builder) override
ProcessSwitch - Called by CoreEngine.
void processBeginOfFunction(NodeBuilderContext &BC, ExplodedNode *Pred, ExplodedNodeSet &Dst, const BlockEdge &L) override
Called by CoreEngine.
Represent the declaration of a variable (in which case it is an lvalue) a function (in which case it ...
This represents one expression.
Defines the clang::LangOptions interface.
void VisitLvalObjCIvarRefExpr(const ObjCIvarRefExpr *DR, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Transfer function logic for computing the lvalue of an Objective-C ivar.
void VisitCXXNewExpr(const CXXNewExpr *CNE, ExplodedNode *Pred, ExplodedNodeSet &Dst)
void VisitCXXNewAllocatorCall(const CXXNewExpr *CNE, ExplodedNode *Pred, ExplodedNodeSet &Dst)
const Expr * getCondition() const
CallEventRef getCaller(const StackFrameContext *CalleeCtx, ProgramStateRef State)
Gets an outside caller given a callee context.
void VisitCast(const CastExpr *CastE, const Expr *Ex, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitCast - Transfer function logic for all casts (implicit and explicit).
Represents a C++ destructor within a class.
const internal::VariadicAllOfMatcher< Decl > decl
Matches declarations.
This is the simplest builder which generates nodes in the ExplodedGraph.
void Add(ExplodedNode *N)
The pointer has been passed to a function call directly.
QualType getConditionType() const
const LocationContext * getLocationContext() const
bool inTopFrame() const override
Return true if the current LocationContext has no caller context.
void Visit(const Stmt *S, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Visit - Transfer function logic for all statements.
Defines the clang::IdentifierInfo, clang::IdentifierTable, and clang::Selector interfaces.
static std::pair< const ProgramPointTag *, const ProgramPointTag * > geteagerlyAssumeBinOpBifurcationTags()
The reason for pointer escape is unknown.
ASTContext & getContext() const
getContext - Return the ASTContext associated with this analysis.
Traits for storing the call processing policy inside GDM.
DeclContext * getParent()
getParent - Returns the containing DeclContext.
ReturnStmt - This represents a return, optionally of an expression: return; return 4;...
void VisitAtomicExpr(const AtomicExpr *E, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitAtomicExpr - Transfer function for builtin atomic expressions.
This represents a Microsoft inline-assembly statement extension.
const SwitchStmt * getSwitch() const
void evalLoad(ExplodedNodeSet &Dst, const Expr *NodeEx, const Expr *BoundExpr, ExplodedNode *Pred, ProgramStateRef St, SVal location, const ProgramPointTag *tag=nullptr, QualType LoadTy=QualType())
Simulate a read of the result of Ex.
Represents C++ object destructor implicitly generated for base object in destructor.
QualType getDestroyedType() const
Retrieve the type being destroyed.
const Expr * getSubExpr() const
bool isNull() const
Return true if this QualType doesn't point to a type yet.
reverse_iterator rbegin()
virtual ProgramStateRef removeDeadBindings(ProgramStateRef state, SymbolReaper &SymReaper)=0
Scan all symbols referenced by the constraints.
Optional< T > getAs() const
Convert to the specified SVal type, returning None if this SVal is not of the desired type...
ExplodedNode * generateNode(const iterator &I, ProgramStateRef State, bool isSink=false)
While alive, includes the current analysis stack in a crash trace.
void processEndOfFunction(NodeBuilderContext &BC, ExplodedNode *Pred, const ReturnStmt *RS=nullptr) override
Called by CoreEngine.
static const Stmt * ResolveCondition(const Stmt *Condition, const CFGBlock *B)
void processCFGElement(const CFGElement E, ExplodedNode *Pred, unsigned StmtIdx, NodeBuilderContext *Ctx) override
processCFGElement - Called by CoreEngine.
ProgramStateRef getInitialState(const LocationContext *InitLoc)
const LocationContext * getLocationContext() const
const Stmt * getStmt() const
void VisitGuardedExpr(const Expr *Ex, const Expr *L, const Expr *R, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitGuardedExpr - Transfer function logic for ?, __builtin_choose.
void printJson(raw_ostream &Out, ProgramStateRef State, const LocationContext *LCtx, const char *NL, unsigned int Space, bool IsDot) const override
printJson - Called by ProgramStateManager to print checker-specific data.
DefinedOrUnknownSVal conjureSymbolVal(const void *symbolTag, const Expr *expr, const LocationContext *LCtx, unsigned count)
Create a new symbol with a unique 'name'.
ProgramStateRef getWidenedLoopState(ProgramStateRef PrevState, const LocationContext *LCtx, unsigned BlockCount, const Stmt *LoopStmt)
Get the states that result from widening the loop.
A helper class that allows the use of isa/cast/dyncast to detect TagType objects of enums...
void runCheckersForBranchCondition(const Stmt *condition, ExplodedNodeSet &Dst, ExplodedNode *Pred, ExprEngine &Eng)
Run checkers for branch condition.
T castAs() const
Convert to the specified ProgramPoint type, asserting that this ProgramPoint is of the desired type...
static bool isCallStmt(const Stmt *S)
Returns true if this is a statement is a function or method call of some kind.
DOTGraphTraits(bool isSimple=false)
ProgramPoints can be "tagged" as representing points specific to a given analysis entity...
AnalysisManager & getAnalysisManager() override
std::string getNameAsString() const
Get a human-readable name for the declaration, even if it is one of the special kinds of names (C++ c...
void evalEagerlyAssumeBinOpBifurcation(ExplodedNodeSet &Dst, ExplodedNodeSet &Src, const Expr *Ex)
evalEagerlyAssumeBinOpBifurcation - Given the nodes in 'Src', eagerly assume symbolic expressions of ...
const MemRegion * getAsRegion() const
Represents a new-expression for memory allocation and constructor calls, e.g: "new CXXNewExpr(foo)"...
SourceLocation getBeginLoc() const
CallEventManager & getCallEventManager()
DeclStmt - Adaptor class for mixing declarations with statements and expressions. ...
void VisitCompoundLiteralExpr(const CompoundLiteralExpr *CL, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitCompoundLiteralExpr - Transfer function logic for compound literals.
Represents the declaration of a label.
ExplodedNode * generateNode(ProgramStateRef State, ExplodedNode *Pred, const ProgramPointTag *Tag=nullptr)
void processIndirectGoto(IndirectGotoNodeBuilder &builder) override
processIndirectGoto - Called by CoreEngine.
QualType getBaseElementType(const ArrayType *VAT) const
Return the innermost element type of an array type.
const CXXTempObjectRegion * getCXXTempObjectRegion(Expr const *Ex, LocationContext const *LC)
void VisitCXXDeleteExpr(const CXXDeleteExpr *CDE, ExplodedNode *Pred, ExplodedNodeSet &Dst)
ProgramPoint getLocation() const
getLocation - Returns the edge associated with the given node.
SVal - This represents a symbolic expression, which can be either an L-value or an R-value...
int64_t getID(const ASTContext &Context) const
const ArrayType * getAsArrayType(QualType T) const
Type Query functions.
AtomicExpr - Variadic atomic builtins: __atomic_exchange, __atomic_fetch_*, __atomic_load, __atomic_store, and __atomic_compare_exchange_*, for the similarly-named C++11 instructions, and __c11 variants for <stdatomic.h>, and corresponding __opencl_atomic_* for OpenCL 2.0.
void VisitUnaryExprOrTypeTraitExpr(const UnaryExprOrTypeTraitExpr *Ex, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitUnaryExprOrTypeTraitExpr - Transfer function for sizeof.
ProgramStateRef runCheckersForEvalAssume(ProgramStateRef state, SVal Cond, bool Assumption)
Run checkers for handling assumptions on symbolic values.
AnalyzerOptions & options
ImplicitCastExpr - Allows us to explicitly represent implicit type conversions, which have no direct ...
BugReporter & getBugReporter()
void VisitObjCForCollectionStmt(const ObjCForCollectionStmt *S, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitObjCForCollectionStmt - Transfer function logic for ObjCForCollectionStmt.
A class responsible for cleaning up unused symbols.
bool operator<(DeclarationName LHS, DeclarationName RHS)
Ordering on two declaration names.
void runCheckersForPreStmt(ExplodedNodeSet &Dst, const ExplodedNodeSet &Src, const Stmt *S, ExprEngine &Eng)
Run checkers for pre-visiting Stmts.
bool isVectorType() const
bool isStmtBranch() const
ProgramStateRef getPersistentStateWithGDM(ProgramStateRef FromState, ProgramStateRef GDMState)
void insert(const ExplodedNodeSet &S)
Optional< T > getAs() const
Convert to the specified CFGElement type, returning None if this CFGElement is not of the desired typ...
Defines various enumerations that describe declaration and type specifiers.
StringRef getName() const
Return the actual identifier string.
ast_type_traits::DynTypedNode Node
void runCheckersForDeadSymbols(ExplodedNodeSet &Dst, const ExplodedNodeSet &Src, SymbolReaper &SymReaper, const Stmt *S, ExprEngine &Eng, ProgramPoint::Kind K)
Run checkers for dead symbols.
Dataflow Directional Tag Classes.
void ProcessStmt(const Stmt *S, ExplodedNode *Pred)
ExplodedNode * generateDefaultCaseNode(ProgramStateRef State, bool isSink=false)
SValBuilder & getSValBuilder()
Represents a delete expression for memory deallocation and destructor calls, e.g. ...
void addNodes(const ExplodedNodeSet &S)
StoreManager & getStoreManager()
Represents a program point just after an implicit call event.
bool NE(InterpState &S, CodePtr OpPC)
ProgramStateRef processRegionChanges(ProgramStateRef state, const InvalidatedSymbols *invalidated, ArrayRef< const MemRegion *> ExplicitRegions, ArrayRef< const MemRegion *> Regions, const LocationContext *LCtx, const CallEvent *Call) override
processRegionChanges - Called by ProgramStateManager whenever a change is made to the store...
SourceLocation getSourceLocation() const
Determine the source location of the initializer.
const NodeBuilderContext & getContext()
std::unique_ptr< DiagnosticConsumer > create(StringRef OutputFile, DiagnosticOptions *Diags, bool MergeChildRecords=false)
Returns a DiagnosticConsumer that serializes diagnostics to a bitcode file.
This node builder keeps track of the generated sink nodes.
bool isPurgeKind()
Is this a program point corresponding to purge/removal of dead symbols and bindings.
StmtClass getStmtClass() const
void reclaimRecentlyAllocatedNodes()
Reclaim "uninteresting" nodes created since the last time this method was called. ...
void VisitLambdaExpr(const LambdaExpr *LE, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitLambdaExpr - Transfer function logic for LambdaExprs.
const Decl * getSingleDecl() const
Represents symbolic expression that isn't a location.
Stmt * getTerminatorStmt()
BranchNodeBuilder is responsible for constructing the nodes corresponding to the two branches of the ...
Represents an abstract call to a function or method along a particular path.
ProgramStateRef getState() const
const Stmt * getLoopStmt() const
ProgramStateManager & getStateManager() override
This class is used for tools that requires cross translation unit capability.
const Decl * getDecl() const
const CXXDeleteExpr * getDeleteExpr() const
Represents a single point (AST node) in the program that requires attention during construction of an...
Expr * IgnoreParenImpCasts() LLVM_READONLY
Skip past any parentheses and implicit casts which might surround this expression until reaching a fi...
const CXXTempObjectRegion * getCXXStaticTempObjectRegion(const Expr *Ex)
Create a CXXTempObjectRegion for temporaries which are lifetime-extended by static references...
PointerEscapeKind
Describes the different reasons a pointer escapes during analysis.
SwitchStmt - This represents a 'switch' stmt.
void VisitCXXDestructor(QualType ObjectType, const MemRegion *Dest, const Stmt *S, bool IsBaseDtor, ExplodedNode *Pred, ExplodedNodeSet &Dst, EvalCallOptions &Options)
SourceLocation getBeginLoc() const
unsigned getIntWidth(QualType T) const
Expr * IgnoreImplicit() LLVM_READONLY
Skip past any implicit AST nodes which might surround this expression until reaching a fixed point...
void runCheckersForEndAnalysis(ExplodedGraph &G, BugReporter &BR, ExprEngine &Eng)
Run checkers for end of analysis.
T castAs() const
Convert to the specified SVal type, asserting that this SVal is of the desired type.
ArraySubscriptExpr - [C99 6.5.2.1] Array Subscripting.
ExplodedNode * generateSink(ProgramStateRef State, ExplodedNode *Pred, const ProgramPointTag *Tag=nullptr)
SubRegion - A region that subsets another larger region.
Represents a C++ base or member initializer.
void VisitCXXConstructExpr(const CXXConstructExpr *E, ExplodedNode *Pred, ExplodedNodeSet &Dst)
unsigned getIndex() const
void VisitObjCAtSynchronizedStmt(const ObjCAtSynchronizedStmt *S, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Transfer function logic for ObjCAtSynchronizedStmts.
IndirectFieldDecl * getIndirectMember() const
const LocationContext * getLocationContext() const
void VisitObjCMessage(const ObjCMessageExpr *ME, ExplodedNode *Pred, ExplodedNodeSet &Dst)
bool hasStackStorage() const
const StackFrameContext * getStackFrame() const
void printJson(raw_ostream &Out, const char *NL="\, unsigned int Space=0, bool IsDot=false, std::function< void(const LocationContext *)> printMoreInfoPerContext=[](const LocationContext *) {}) const
llvm::FoldingSet< BugReportEquivClass >::iterator EQClasses_iterator
Iterator over the set of BugReports tracked by the BugReporter.
Represents a base class of a C++ class.
Stores options for the analyzer from the command line.
void getCaptureFields(llvm::DenseMap< const VarDecl *, FieldDecl *> &Captures, FieldDecl *&ThisCapture) const
For a closure type, retrieve the mapping from captured variables and this to the non-static data memb...
uint64_t getTypeSize(QualType T) const
Return the size of the specified (complete) type T, in bits.
X
Add a minimal nested name specifier fixit hint to allow lookup of a tag name from an outer enclosing ...
ExplodedNode * generateNode(const ProgramPoint &PP, ProgramStateRef State, ExplodedNode *Pred)
Generates a node in the ExplodedGraph.
const CXXNewExpr * getAllocatorExpr() const
void VisitBlockExpr(const BlockExpr *BE, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitBlockExpr - Transfer function logic for BlockExprs.
Defines the C++ Decl subclasses, other than those for templates (found in DeclTemplate.h) and friends (in DeclFriend.h).
MemberExpr - [C99 6.5.2.3] Structure and Union Members.
Defines the clang::SourceLocation class and associated facilities.
Represents a C++ struct/union/class.
Represents C++ object destructor implicitly generated by compiler on various occasions.
ProgramStateRef getState() const
pred_iterator pred_begin()
ExplodedNode * generateNode(ProgramStateRef State, bool branch, ExplodedNode *Pred)
Represents a top-level expression in a basic block.
This class is used for builtin types like 'int'.
ProgramStateRef processAssume(ProgramStateRef state, SVal cond, bool assumption) override
evalAssume - Callback function invoked by the ConstraintManager when making assumptions about state v...
Represents C++ object destructor implicitly generated for member object in destructor.
const MemRegion * getBaseRegion() const
ExplodedNode * generateNode(const Stmt *S, ExplodedNode *Pred, ProgramStateRef St, const ProgramPointTag *tag=nullptr, ProgramPoint::Kind K=ProgramPoint::PostStmtKind)
static Decl::Kind getKind(const Decl *D)
ProgramStateRef runCheckersForRegionChanges(ProgramStateRef state, const InvalidatedSymbols *invalidated, ArrayRef< const MemRegion *> ExplicitRegions, ArrayRef< const MemRegion *> Regions, const LocationContext *LCtx, const CallEvent *Call)
Run checkers for region changes.
std::string DumpGraph(bool trim=false, StringRef Filename="")
Dump graph to the specified filename.
void runCheckersForBeginFunction(ExplodedNodeSet &Dst, const BlockEdge &L, ExplodedNode *Pred, ExprEngine &Eng)
Run checkers on beginning of function.
void VisitCommonDeclRefExpr(const Expr *DR, const NamedDecl *D, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Transfer function logic for DeclRefExprs and BlockDeclRefExprs.
raw_ostream & Indent(raw_ostream &Out, const unsigned int Space, bool IsDot)
A reference to a declared variable, function, enum, etc.
Represents C++ base or member initializer from constructor's initialization list. ...
void VisitGCCAsmStmt(const GCCAsmStmt *A, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitGCCAsmStmt - Transfer function logic for inline asm.
const StackFrameContext * getStackFrame() const
void VisitMemberExpr(const MemberExpr *M, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitMemberExpr - Transfer function for member expressions.
ParentMap & getParentMap()
llvm::ImmutableMap< ConstructedObjectKey, SVal > ObjectsUnderConstructionMap
This represents a decl that may have a name.
Optional< T > getAs() const
Convert to the specified ProgramPoint type, returning None if this ProgramPoint is not of the desired...
ConstraintManager & getConstraintManager()
void VisitBinaryOperator(const BinaryOperator *B, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitBinaryOperator - Transfer function logic for binary operators.
CFGTerminator getTerminator() const
AnalysisDeclContext * getAnalysisDeclContext() const
bool isFeasible(bool branch)
void CreateCXXTemporaryObject(const MaterializeTemporaryExpr *ME, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Create a C++ temporary object for an rvalue.
static SVal RecoverCastedSymbol(ProgramStateRef state, const Stmt *Condition, const LocationContext *LCtx, ASTContext &Ctx)
RecoverCastedSymbol - A helper function for ProcessBranch that is used to try to recover some path-se...
const Expr * getTarget() const
Represents C++ object destructor implicitly generated at the end of full expression for temporary obj...
const CFGBlock * getBlock() const
Return the CFGBlock associated with this builder.
int64_t getID(const ASTContext &Context) const
bool isUnknownOrUndef() const
bool EQ(InterpState &S, CodePtr OpPC)
Expr * IgnoreParens() LLVM_READONLY
Skip past any parentheses which might surround this expression until reaching a fixed point...
QualType getType() const
Retrieves the type of the base class.
Represents the point where a loop ends.