clang
6.0.0
|
CoreEngine - Implements the core logic of the graph-reachability analysis. More...
#include "clang/StaticAnalyzer/Core/PathSensitive/CoreEngine.h"
Public Types | |
typedef std::vector< std::pair< BlockEdge, const ExplodedNode * > > | BlocksExhausted |
typedef std::vector< std::pair< const CFGBlock *, const ExplodedNode * > > | BlocksAborted |
Public Member Functions | |
CoreEngine (SubEngine &subengine, FunctionSummariesTy *FS) | |
Construct a CoreEngine object to analyze the provided CFG. More... | |
ExplodedGraph & | getGraph () |
getGraph - Returns the exploded graph. More... | |
bool | ExecuteWorkList (const LocationContext *L, unsigned Steps, ProgramStateRef InitState) |
ExecuteWorkList - Run the worklist algorithm for a maximum number of steps. More... | |
bool | ExecuteWorkListWithInitialState (const LocationContext *L, unsigned Steps, ProgramStateRef InitState, ExplodedNodeSet &Dst) |
Returns true if there is still simulation state on the worklist. More... | |
void | dispatchWorkItem (ExplodedNode *Pred, ProgramPoint Loc, const WorkListUnit &WU) |
Dispatch the work list item based on the given location information. More... | |
bool | wasBlockAborted () const |
bool | wasBlocksExhausted () const |
bool | hasWorkRemaining () const |
void | addAbortedBlock (const ExplodedNode *node, const CFGBlock *block) |
Inform the CoreEngine that a basic block was aborted because it could not be completely analyzed. More... | |
WorkList * | getWorkList () const |
BlocksExhausted::const_iterator | blocks_exhausted_begin () const |
BlocksExhausted::const_iterator | blocks_exhausted_end () const |
BlocksAborted::const_iterator | blocks_aborted_begin () const |
BlocksAborted::const_iterator | blocks_aborted_end () const |
void | enqueue (ExplodedNodeSet &Set) |
Enqueue the given set of nodes onto the work list. More... | |
void | enqueue (ExplodedNodeSet &Set, const CFGBlock *Block, unsigned Idx) |
Enqueue nodes that were created as a result of processing a statement onto the work list. More... | |
void | enqueueEndOfFunction (ExplodedNodeSet &Set, const ReturnStmt *RS) |
enqueue the nodes corresponding to the end of function onto the end of path / work list. More... | |
void | enqueueStmtNode (ExplodedNode *N, const CFGBlock *Block, unsigned Idx) |
Enqueue a single node created as a result of statement processing. More... | |
Friends | |
struct | NodeBuilderContext |
class | NodeBuilder |
class | ExprEngine |
class | CommonNodeBuilder |
class | IndirectGotoNodeBuilder |
class | SwitchNodeBuilder |
class | EndOfFunctionNodeBuilder |
CoreEngine - Implements the core logic of the graph-reachability analysis.
It traverses the CFG and generates the ExplodedGraph. Program "states" are treated as opaque void pointers. The template class CoreEngine (which subclasses CoreEngine) provides the matching component to the engine that knows the actual types for states. Note that this engine only dispatches to transfer functions at the statement and block-level. The analyses themselves must implement any transfer function logic and the sub-expression level (if any).
Definition at line 43 of file CoreEngine.h.
typedef std::vector<std::pair<const CFGBlock*, const ExplodedNode*> > clang::ento::CoreEngine::BlocksAborted |
Definition at line 56 of file CoreEngine.h.
typedef std::vector<std::pair<BlockEdge, const ExplodedNode*> > clang::ento::CoreEngine::BlocksExhausted |
Definition at line 53 of file CoreEngine.h.
|
inline |
Construct a CoreEngine object to analyze the provided CFG.
Definition at line 117 of file CoreEngine.h.
|
inline |
Inform the CoreEngine that a basic block was aborted because it could not be completely analyzed.
Definition at line 148 of file CoreEngine.h.
|
inline |
Definition at line 160 of file CoreEngine.h.
|
inline |
Definition at line 163 of file CoreEngine.h.
References enqueue(), enqueueEndOfFunction(), and enqueueStmtNode().
|
inline |
Definition at line 154 of file CoreEngine.h.
|
inline |
Definition at line 157 of file CoreEngine.h.
void CoreEngine::dispatchWorkItem | ( | ExplodedNode * | Pred, |
ProgramPoint | Loc, | ||
const WorkListUnit & | WU | ||
) |
Dispatch the work list item based on the given location information.
Use Pred parameter as the predecessor state.
Definition at line 241 of file CoreEngine.cpp.
References clang::ProgramPoint::BlockEdgeKind, clang::ProgramPoint::BlockEntranceKind, clang::ProgramPoint::BlockExitKind, clang::ProgramPoint::CallEnterKind, clang::ProgramPoint::CallExitBeginKind, clang::ProgramPoint::castAs(), clang::ProgramPoint::EpsilonKind, clang::ProgramPoint::getAs(), clang::ento::WorkListUnit::getBlock(), clang::ento::ExplodedNode::getFirstPred(), clang::ento::WorkListUnit::getIndex(), clang::ProgramPoint::getKind(), clang::ento::ExplodedNode::getLocation(), and clang::ento::ExplodedNode::hasSinglePred().
Referenced by getGraph().
void CoreEngine::enqueue | ( | ExplodedNodeSet & | Set | ) |
Enqueue the given set of nodes onto the work list.
Definition at line 621 of file CoreEngine.cpp.
Referenced by blocks_aborted_end(), clang::ento::ExprEngine::processCallEnter(), clang::ento::ExprEngine::ProcessImplicitDtor(), and clang::ento::ExprEngine::ProcessNewAllocator().
void CoreEngine::enqueue | ( | ExplodedNodeSet & | Set, |
const CFGBlock * | Block, | ||
unsigned | Idx | ||
) |
Enqueue nodes that were created as a result of processing a statement onto the work list.
Definition at line 628 of file CoreEngine.cpp.
void CoreEngine::enqueueEndOfFunction | ( | ExplodedNodeSet & | Set, |
const ReturnStmt * | RS | ||
) |
enqueue the nodes corresponding to the end of function onto the end of path / work list.
Definition at line 636 of file CoreEngine.cpp.
Referenced by blocks_aborted_end().
void CoreEngine::enqueueStmtNode | ( | ExplodedNode * | N, |
const CFGBlock * | Block, | ||
unsigned | Idx | ||
) |
Enqueue a single node created as a result of statement processing.
Definition at line 555 of file CoreEngine.cpp.
References clang::ento::ExplodedNode::addPredecessor(), clang::CFGElement::castAs(), clang::ProgramPoint::getAs(), getKind(), clang::ento::ExplodedNode::getLocation(), clang::ento::ExplodedNode::getLocationContext(), clang::ento::ExplodedNode::getState(), clang::CFGStmt::getStmt(), clang::ento::ExplodedNode::isSink(), clang::CFGElement::NewAllocator, Node, and clang::ProgramPoint::withTag().
Referenced by blocks_aborted_end().
bool CoreEngine::ExecuteWorkList | ( | const LocationContext * | L, |
unsigned | Steps, | ||
ProgramStateRef | InitState | ||
) |
ExecuteWorkList - Run the worklist algorithm for a maximum number of steps.
Returns true if there is still simulation state on the worklist.
Definition at line 164 of file CoreEngine.cpp.
References clang::CFGBlock::empty(), clang::ento::WorkList::enqueue(), clang::ento::WorkListUnit::getBlockCounter(), clang::CFGBlock::getBlockID(), clang::LocationContext::getCFG(), clang::LocationContext::getDecl(), clang::BlockEdge::getDst(), clang::CFG::getEntry(), clang::ento::ExplodedNode::getLocation(), clang::ento::WorkListUnit::getNode(), clang::CFG::getNumBlockIDs(), min(), Node, clang::CFGBlock::succ_begin(), and clang::CFGBlock::succ_size().
Referenced by clang::ento::ExprEngine::ExecuteWorkList(), and getGraph().
bool CoreEngine::ExecuteWorkListWithInitialState | ( | const LocationContext * | L, |
unsigned | Steps, | ||
ProgramStateRef | InitState, | ||
ExplodedNodeSet & | Dst | ||
) |
Returns true if there is still simulation state on the worklist.
Definition at line 284 of file CoreEngine.cpp.
Referenced by clang::ento::ExprEngine::ExecuteWorkListWithInitialState(), and getGraph().
|
inline |
getGraph - Returns the exploded graph.
Definition at line 122 of file CoreEngine.h.
References dispatchWorkItem(), ExecuteWorkList(), and ExecuteWorkListWithInitialState().
|
inline |
Definition at line 152 of file CoreEngine.h.
Referenced by clang::ento::ExprEngine::hasEmptyWorkList().
|
inline |
Definition at line 142 of file CoreEngine.h.
References wasBlockAborted(), and wasBlocksExhausted().
Referenced by clang::ento::ExprEngine::hasWorkRemaining().
|
inline |
Definition at line 140 of file CoreEngine.h.
Referenced by hasWorkRemaining().
|
inline |
Definition at line 141 of file CoreEngine.h.
Referenced by hasWorkRemaining(), and clang::ento::ExprEngine::wasBlocksExhausted().
|
friend |
Definition at line 47 of file CoreEngine.h.
|
friend |
Definition at line 50 of file CoreEngine.h.
|
friend |
Definition at line 46 of file CoreEngine.h.
|
friend |
Definition at line 48 of file CoreEngine.h.
|
friend |
Definition at line 45 of file CoreEngine.h.
|
friend |
Definition at line 44 of file CoreEngine.h.
|
friend |
Definition at line 49 of file CoreEngine.h.