19 using namespace clang;
59 SVal LeftV = state->getSVal(LHS, LCtx);
60 SVal RightV = state->getSVal(RHS, LCtx);
64 if (Op == BO_Assign) {
75 evalStore(Tmp2, B, LHS, *it, state->BindExpr(B, LCtx, ExprVal),
88 RightV, LeftV, RHS, svalBuilder, Count, LCtx);
90 LeftV, RightV, LHS, svalBuilder, Count, LCtx);
97 state = createTemporaryRegionIfNeeded(state, LCtx, LHS);
103 state = state->BindExpr(B, LCtx, Result);
114 llvm_unreachable(
"Invalid opcode for compound assignment.");
115 case BO_MulAssign: Op = BO_Mul;
break;
116 case BO_DivAssign: Op = BO_Div;
break;
117 case BO_RemAssign: Op = BO_Rem;
break;
118 case BO_AddAssign: Op = BO_Add;
break;
119 case BO_SubAssign: Op = BO_Sub;
break;
120 case BO_ShlAssign: Op = BO_Shl;
break;
121 case BO_ShrAssign: Op = BO_Shr;
break;
122 case BO_AndAssign: Op = BO_And;
break;
123 case BO_XorAssign: Op = BO_Xor;
break;
124 case BO_OrAssign: Op = BO_Or;
break;
130 SVal location = LeftV;
131 evalLoad(Tmp, B, LHS, *it, state, location);
136 state = (*I)->getState();
138 SVal V = state->getSVal(LHS, LCtx);
142 cast<CompoundAssignOperator>(B)->getComputationResultType();
146 cast<CompoundAssignOperator>(B)->getComputationLHSType();
152 V = svalBuilder.
evalCast(V, CLHSTy, LTy);
170 Result = svalBuilder.
evalCast(LHSVal, CTy, LTy);
175 LHSVal = svalBuilder.
evalCast(Result, LTy, CTy);
181 state = state->BindExpr(B, LCtx, location);
183 state = state->BindExpr(B, LCtx, Result);
185 evalStore(Tmp2, B, LHS, *I, state, location, LHSVal);
209 dyn_cast_or_null<BlockDataRegion>(V.
getAsRegion())) {
212 E = BDR->referenced_vars_end();
216 for (; I != E; ++I) {
226 const Expr *copyExpr =
nullptr;
228 assert(CI->getVariable() == capturedR->
getDecl());
229 copyExpr = CI->getCopyExpr();
233 if (capturedR != originalR) {
237 originalV = State->getSVal(copyExpr, LCtx);
261 SVal V = state->getSVal(Ex, LCtx);
262 V = svalBuilder.
evalCast(V, T, ExTy);
264 if (CastE->
getCastKind() == CK_BooleanToSignedIntegral)
266 state = state->BindExpr(CastE, LCtx, V);
282 state = state->BindExpr(CastE, LCtx, result);
300 evalLoad(Dst, CastE, CastE, subExprNode, state, state->getSVal(Ex, LCtx));
309 if (
const ExplicitCastExpr *ExCast=dyn_cast_or_null<ExplicitCastExpr>(CastE))
310 T = ExCast->getTypeAsWritten();
321 case CK_LValueToRValue:
322 llvm_unreachable(
"LValueToRValue casts handled earlier.");
327 case CK_ARCProduceObject:
328 case CK_ARCConsumeObject:
329 case CK_ARCReclaimReturnedObject:
330 case CK_ARCExtendBlockObject:
331 case CK_CopyAndAutoreleaseBlockObject:
335 case CK_AtomicToNonAtomic:
336 case CK_NonAtomicToAtomic:
339 case CK_ConstructorConversion:
340 case CK_UserDefinedConversion:
341 case CK_FunctionToPointerDecay:
342 case CK_BuiltinFnToFnPtr: {
346 SVal V = state->getSVal(Ex, LCtx);
347 state = state->BindExpr(CastE, LCtx, V);
351 case CK_MemberPointerToBoolean:
352 case CK_PointerToBoolean: {
353 SVal V = state->getSVal(Ex, LCtx);
356 V = svalBuilder.
makeTruthVal(!PTMSV->isNullMemberPointer(), ExTy);
358 state = state->BindExpr(CastE, LCtx, V);
368 case CK_ArrayToPointerDecay:
370 case CK_AddressSpaceConversion:
371 case CK_BooleanToSignedIntegral:
372 case CK_NullToPointer:
373 case CK_IntegralToPointer:
374 case CK_PointerToIntegral: {
375 SVal V = state->getSVal(Ex, LCtx);
377 state = state->BindExpr(CastE, LCtx,
UnknownVal());
386 case CK_IntegralToBoolean:
387 case CK_IntegralToFloating:
388 case CK_FloatingToIntegral:
389 case CK_FloatingToBoolean:
390 case CK_FloatingCast:
391 case CK_FloatingRealToComplex:
392 case CK_FloatingComplexToReal:
393 case CK_FloatingComplexToBoolean:
394 case CK_FloatingComplexCast:
395 case CK_FloatingComplexToIntegralComplex:
396 case CK_IntegralRealToComplex:
397 case CK_IntegralComplexToReal:
398 case CK_IntegralComplexToBoolean:
399 case CK_IntegralComplexCast:
400 case CK_IntegralComplexToFloatingComplex:
401 case CK_CPointerToObjCPointerCast:
402 case CK_BlockPointerToObjCPointerCast:
403 case CK_AnyPointerToBlockPointerCast:
404 case CK_ObjCObjectLValueCast:
405 case CK_ZeroToOCLEvent:
406 case CK_ZeroToOCLQueue:
407 case CK_IntToOCLSampler:
408 case CK_LValueBitCast: {
413 case CK_IntegralCast: {
415 SVal V = state->getSVal(Ex, LCtx);
417 state = state->BindExpr(CastE, LCtx, V);
421 case CK_DerivedToBase:
422 case CK_UncheckedDerivedToBase: {
424 SVal val = state->getSVal(Ex, LCtx);
426 state = state->BindExpr(CastE, LCtx, val);
432 SVal val = state->getSVal(Ex, LCtx);
456 state = state->BindExpr(CastE, LCtx, svalBuilder.
makeNull());
464 state = state->BindExpr(CastE, LCtx, NewSym);
467 state = state->BindExpr(CastE, LCtx, val);
472 case CK_BaseToDerived: {
473 SVal val = state->getSVal(Ex, LCtx);
490 state = state->BindExpr(CastE, LCtx, val);
494 case CK_NullToMemberPointer: {
496 state = state->BindExpr(CastE, LCtx, V);
500 case CK_DerivedToBaseMemberPointer:
501 case CK_BaseToDerivedMemberPointer:
502 case CK_ReinterpretMemberPointer: {
503 SVal V = state->getSVal(Ex, LCtx);
507 llvm::make_range<CastExpr::path_const_iterator>(
509 state = state->BindExpr(CastE, LCtx, CastedPTMSV);
519 case CK_VectorSplat: {
538 if (isa<CXXConstructExpr>(Init) || isa<CXXStdInitializerListExpr>(Init)) {
541 assert(isa<InitListExpr>(Init));
542 Loc CLLoc = State->getLValue(CL, LCtx);
543 State = State->bindLoc(CLLoc, V, LCtx);
580 SVal InitVal = state->getSVal(InitEx, LC);
583 if (
auto *CtorExpr = findDirectConstructorForCurrentCFGElement()) {
584 assert(InitEx->IgnoreImplicit() == CtorExpr);
596 InitVal = state->getSVal(M->getRegion());
605 if (InitEx->isGLValue()) {
616 evalBind(Dst2, DS, UpdatedN, state->getLValue(VD, LC), InitVal,
true);
642 Bldr.generateNode(B, Pred, state);
667 assert(Term->isLogicalOp());
677 assert(!SrcBlock->
empty());
679 const Expr *RHS = cast<Expr>(Elem.getStmt());
682 if (RHSVal.isUndef()) {
714 if (NumInitElements == 0) {
721 ei = IE->
rend(); it != ei; ++it) {
722 SVal V = state->getSVal(cast<Expr>(*it), LCtx);
727 state->BindExpr(IE, LCtx,
735 assert(NumInitElements <= 1);
738 if (NumInitElements == 0)
741 V = state->getSVal(IE->
getInit(0), LCtx);
763 assert(N->pred_size() == 1);
767 SrcState = N->getState();
771 assert(SrcBlock &&
"missing function entry");
775 bool hasValue =
false;
778 for (
CFGElement CE : llvm::reverse(*SrcBlock)) {
780 const Expr *ValEx = cast<Expr>(CS->getStmt());
786 L = OpaqueEx->getSourceExpr();
792 V = SrcState->getSVal(ValEx, LCtx);
803 B.
generateNode(Ex, Pred, state->BindExpr(Ex, LCtx, V,
true));
859 state = state->BindExpr(Ex, (*I)->getLocationContext(),
882 state->getSVal(Ex, LCtx)));
918 state->getSVal(Ex, LCtx)));
940 if (
const DeclRefExpr *DRE = dyn_cast<DeclRefExpr>(Ex)) {
943 if (isa<CXXMethodDecl>(VD) || isa<FieldDecl>(VD)) {
973 SVal V = state->getSVal(Ex, LCtx);
982 llvm_unreachable(
"Invalid Opcode.");
1000 }
else if (Ex->getType()->isFloatingType()) {
1009 state = state->BindExpr(U, LCtx, Result);
1030 SVal loc = state->getSVal(Ex, LCtx);
1034 evalLoad(Tmp, U, Ex, Pred, state, loc);
1040 state = (*I)->getState();
1041 assert(LCtx == (*I)->getLocationContext());
1042 SVal V2_untested = state->getSVal(Ex, LCtx);
1045 if (V2_untested.isUnknownOrUndef()) {
1046 state = state->BindExpr(U, LCtx, V2_untested);
1051 evalStore(Dst3, U, U, *I, state, loc, V2_untested);
1089 if (!state->assume(Constraint,
true)) {
1092 Constraint = svalBuilder.
evalEQ(state, SymVal,
1096 state = state->assume(Constraint,
false);
1105 state = state->BindExpr(U, LCtx, loc);
1107 state = state->BindExpr(U, LCtx, U->
isPostfix() ? V2 : Result);
1112 evalStore(Dst3, U, U, *I, state, loc, Result);
SVal attemptDownCast(SVal Base, QualType DerivedPtrType, bool &Failed)
Attempts to do a down cast.
const BlockDecl * getBlockDecl() const
nonloc::ConcreteInt makeIntVal(const IntegerLiteral *integer)
DefinedSVal getBlockPointer(const BlockDecl *block, CanQualType locTy, const LocationContext *locContext, unsigned blockCount)
reverse_iterator rbegin()
SVal evalDerivedToBase(SVal Derived, const CastExpr *Cast)
Evaluates a chain of derived-to-base casts through the path specified in Cast.
A (possibly-)qualified type.
succ_iterator succ_begin()
capture_const_iterator capture_begin() const
const Expr * getInit(unsigned Init) const
unsigned blockCount() const
Returns the number of times the current basic block has been visited on the exploded graph path...
This builder class is useful for generating nodes that resulted from visiting a statement.
bool isRecordType() const
const CFGBlock * getSrc() const
SVal evalBinOp(ProgramStateRef state, BinaryOperator::Opcode op, NonLoc L, NonLoc R, QualType T)
Represents a point after we ran remove dead bindings BEFORE processing the given statement.
T castAs() const
Convert to the specified CFGElement type, asserting that this CFGElement is of the desired type...
const ProgramStateRef & getState() const
SVal evalCast(SVal val, QualType castTy, QualType originalType)
Value representing integer constant.
capture_const_iterator capture_end() const
unsigned succ_size() const
void VisitUnaryOperator(const UnaryOperator *B, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitUnaryOperator - Transfer function logic for unary operators.
void takeNodes(const ExplodedNodeSet &S)
bool EvaluateAsInt(llvm::APSInt &Result, const ASTContext &Ctx, SideEffectsKind AllowSideEffects=SE_NoSideEffects) const
EvaluateAsInt - Return true if this is a constant which we can fold and convert to an integer...
void handleUOExtension(ExplodedNodeSet::iterator I, const UnaryOperator *U, StmtNodeBuilder &Bldr)
VarDecl - An instance of this class is created to represent a variable declaration or definition...
CompoundLiteralExpr - [C99 6.5.2.5].
const T * getAs() const
Member-template getAs<specific type>'.
NonLoc makeArrayIndex(uint64_t idx)
void evalStore(ExplodedNodeSet &Dst, const Expr *AssignE, const Expr *StoreE, ExplodedNode *Pred, ProgramStateRef St, SVal TargetLV, SVal Val, const ProgramPointTag *tag=nullptr)
evalStore - Handle the semantics of a store via an assignment.
static bool isAssignmentOp(Opcode Opc)
Defines the clang::Expr interface and subclasses for C++ expressions.
bool isVariableArrayType() const
InitExprsTy::const_reverse_iterator const_reverse_iterator
ImplTy::iterator iterator
Represents a class type in Objective C.
Value representing pointer-to-member.
const VarRegion * getOriginalRegion() const
SVal evalIntegralCast(ProgramStateRef state, SVal val, QualType castTy, QualType originalType)
Loc makeNullWithType(QualType type)
Create NULL pointer, with proper pointer bit-width for given address space.
static bool isIncrementDecrementOp(Opcode Op)
bool isReferenceType() const
i32 captured_struct **param SharedsTy A type which contains references the shared variables *param Shareds Context with the list of shared variables from the p *TaskFunction *param Data Additional data for task generation like final * state
bool isIntegralOrEnumerationType() const
Determine whether this type is an integral or enumeration type.
llvm::ImmutableList< SVal > prependSVal(SVal X, llvm::ImmutableList< SVal > L)
static bool isLocType(QualType T)
Describes an C or C++ initializer list.
void VisitOffsetOfExpr(const OffsetOfExpr *Ex, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitOffsetOfExpr - Transfer function for offsetof.
BlockDataRegion - A region that represents a block instance.
ExplodedNode * generateSink(const Stmt *S, ExplodedNode *Pred, ProgramStateRef St, const ProgramPointTag *tag=nullptr, ProgramPoint::Kind K=ProgramPoint::PostStmtKind)
CharUnits - This is an opaque type for sizes expressed in character units.
path_iterator path_begin()
const LocationContext * getLocationContext() const
A builtin binary operation expression such as "x + y" or "x <= y".
NonLoc makePointerToMember(const DeclaratorDecl *DD)
static bool isPostfix(Opcode Op)
isPostfix - Return true if this is a postfix operation, like x++.
NonLoc makeCompoundVal(QualType type, llvm::ImmutableList< SVal > vals)
CastExpr - Base class for type casts, including both implicit casts (ImplicitCastExpr) and explicit c...
SVal evalComplement(SVal X)
void VisitDeclStmt(const DeclStmt *DS, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitDeclStmt - Transfer function logic for DeclStmts.
unsigned pred_size() const
void evalBind(ExplodedNodeSet &Dst, const Stmt *StoreE, ExplodedNode *Pred, SVal location, SVal Val, bool atDeclInit=false, const ProgramPoint *PP=nullptr)
evalBind - Handle the semantics of binding a value to a specific location.
CheckerManager & getCheckerManager() const
void VisitLogicalExpr(const BinaryOperator *B, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitLogicalExpr - Transfer function logic for '&&', '||'.
const VarRegion * getCapturedRegion() const
UnaryExprOrTypeTraitExpr - expression with either a type or (unevaluated) expression operand...
CFGBlock - Represents a single basic block in a source-level CFG.
void VisitInitListExpr(const InitListExpr *E, ExplodedNode *Pred, ExplodedNodeSet &Dst)
QuantityType getQuantity() const
getQuantity - Get the raw integer representation of this quantity.
llvm::APSInt EvaluateKnownConstInt(const ASTContext &Ctx, SmallVectorImpl< PartialDiagnosticAt > *Diag=nullptr) const
EvaluateKnownConstInt - Call EvaluateAsRValue and return the folded integer.
void runCheckersForPostStmt(ExplodedNodeSet &Dst, const ExplodedNodeSet &Src, const Stmt *S, ExprEngine &Eng, bool wasInlined=false)
Run checkers for post-visiting Stmts.
DefinedOrUnknownSVal makeZeroVal(QualType type)
Construct an SVal representing '0' for the specified type.
BlockDecl - This represents a block literal declaration, which is like an unnamed FunctionDecl...
ValueDecl - Represent the declaration of a variable (in which case it is an lvalue) a function (in wh...
Expr - This represents one expression.
static SVal conjureOffsetSymbolOnLocation(SVal Symbol, SVal Other, Expr *Expression, SValBuilder &svalBuilder, unsigned Count, const LocationContext *LCtx)
Optionally conjure and return a symbol for offset when processing an expression Expression.
const FunctionProtoType * T
void VisitCast(const CastExpr *CastE, const Expr *Ex, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitCast - Transfer function logic for all casts (implicit and explicit).
BlockExpr - Adaptor class for mixing a BlockDecl with expressions.
unsigned getNumInits() const
const ExplodedNodeSet & getResults()
bool isAnyComplexType() const
static CharUnits fromQuantity(QuantityType Quantity)
fromQuantity - Construct a CharUnits quantity from a raw integer type.
static SVal getValue(SVal val, SValBuilder &svalBuilder)
bool isSignedIntegerType() const
Return true if this is an integer type that is signed, according to C99 6.2.5p4 [char, signed char, short, int, long..], or an enum decl which has a signed representation.
const CFGBlock * getDst() const
QualType getTypeOfArgument() const
Gets the argument type, or the type of the argument expression, whichever is appropriate.
ASTContext & getContext() const
getContext - Return the ASTContext associated with this analysis.
UnaryOperator - This represents the unary-expression's (except sizeof and alignof), the postinc/postdec operators from postfix-expression, and various extensions.
void evalLoad(ExplodedNodeSet &Dst, const Expr *NodeEx, const Expr *BoundExpr, ExplodedNode *Pred, ProgramStateRef St, SVal location, const ProgramPointTag *tag=nullptr, QualType LoadTy=QualType())
Simulate a read of the result of Ex.
reverse_iterator rbegin()
const VarDecl * getDecl() const
Optional< T > getAs() const
Convert to the specified SVal type, returning None if this SVal is not of the desired type...
CFGTerminator getTerminator()
OpaqueValueExpr - An expression referring to an opaque object of a fixed type and value class...
bool isBuiltinType() const
Helper methods to distinguish type categories.
void VisitGuardedExpr(const Expr *Ex, const Expr *L, const Expr *R, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitGuardedExpr - Transfer function logic for ?, __builtin_choose.
DefinedOrUnknownSVal conjureSymbolVal(const void *symbolTag, const Expr *expr, const LocationContext *LCtx, unsigned count)
Create a new symbol with a unique 'name'.
Expr * getSubExpr() const
T castAs() const
Convert to the specified ProgramPoint type, asserting that this ProgramPoint is of the desired type...
CastKind getCastKind() const
const MemRegion * getAsRegion() const
DeclStmt - Adaptor class for mixing declarations with statements and expressions. ...
void VisitCompoundLiteralExpr(const CompoundLiteralExpr *CL, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitCompoundLiteralExpr - Transfer function logic for compound literals.
ProgramStateRef handleLVectorSplat(ProgramStateRef state, const LocationContext *LCtx, const CastExpr *CastE, StmtNodeBuilder &Bldr, ExplodedNode *Pred)
ProgramPoint getLocation() const
getLocation - Returns the edge associated with the given node.
SVal - This represents a symbolic expression, which can be either an L-value or an R-value...
UnaryExprOrTypeTrait getKind() const
decl_iterator decl_begin()
void VisitUnaryExprOrTypeTraitExpr(const UnaryExprOrTypeTraitExpr *Ex, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitUnaryExprOrTypeTraitExpr - Transfer function for sizeof.
bool isAnyPointerType() const
BasicValueFactory & getBasicVals()
void runCheckersForPreStmt(ExplodedNodeSet &Dst, const ExplodedNodeSet &Src, const Stmt *S, ExprEngine &Eng)
Run checkers for pre-visiting Stmts.
bool isVectorType() const
void insert(const ExplodedNodeSet &S)
const Expr * getInitializer() const
Dataflow Directional Tag Classes.
void VisitIncrementDecrementOperator(const UnaryOperator *U, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Handle ++ and – (both pre- and post-increment).
SValBuilder & getSValBuilder()
void addNodes(const ExplodedNodeSet &S)
StoreManager & getStoreManager()
bool isZeroConstant() const
const Expr * getInit() const
const LangOptions & getLangOpts() const
ExplicitCastExpr - An explicit cast written in the source code.
bool isSingleDecl() const
isSingleDecl - This method returns true if this DeclStmt refers to a single Decl. ...
ProgramStateRef handleLValueBitCast(ProgramStateRef state, const Expr *Ex, const LocationContext *LCtx, QualType T, QualType ExTy, const CastExpr *CastE, StmtNodeBuilder &Bldr, ExplodedNode *Pred)
T castAs() const
Convert to the specified SVal type, asserting that this SVal is of the desired type.
bool isConstantSizeType() const
Return true if this is not a variable sized type, according to the rules of C99 6.7.5p3.
DefinedSVal getMemberPointer(const DeclaratorDecl *DD)
static bool isAdditiveOp(Opcode Opc)
uint64_t getTypeSize(QualType T) const
Return the size of the specified (complete) type T, in bits.
bool isIncompleteType(NamedDecl **Def=nullptr) const
Types are partitioned into 3 broad categories (C99 6.2.5p1): object types, function types...
static bool isIncrementOp(Opcode Op)
CanQualType getCanonicalType(QualType T) const
Return the canonical (structural) type corresponding to the specified potentially non-canonical type ...
X
Add a minimal nested name specifier fixit hint to allow lookup of a tag name from an outer enclosing ...
void VisitBlockExpr(const BlockExpr *BE, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitBlockExpr - Transfer function logic for BlockExprs.
Defines the C++ Decl subclasses, other than those for templates (found in DeclTemplate.h) and friends (in DeclFriend.h).
static bool isCompoundAssignmentOp(Opcode Opc)
DefinedOrUnknownSVal evalEQ(ProgramStateRef state, DefinedOrUnknownSVal lhs, DefinedOrUnknownSVal rhs)
pred_iterator pred_begin()
CFGElement - Represents a top-level expression in a basic block.
QualType getPointerType(QualType T) const
Return the uniqued reference to the type for a pointer to the specified type.
This class is used for builtin types like 'int'.
CFGTerminator - Represents CFGBlock terminator statement.
ExplodedNode * generateNode(const Stmt *S, ExplodedNode *Pred, ProgramStateRef St, const ProgramPointTag *tag=nullptr, ProgramPoint::Kind K=ProgramPoint::PostStmtKind)
A reference to a declared variable, function, enum, etc.
nonloc::ConcreteInt makeTruthVal(bool b, QualType type)
Optional< T > getAs() const
Convert to the specified ProgramPoint type, returning None if this ProgramPoint is not of the desired...
OffsetOfExpr - [C99 7.17] - This represents an expression of the form offsetof(record-type, member-designator).
void VisitBinaryOperator(const BinaryOperator *B, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitBinaryOperator - Transfer function logic for binary operators.
bool isUnknownOrUndef() const
llvm::ImmutableList< SVal > getEmptySValList()
Expr * IgnoreParens() LLVM_READONLY
IgnoreParens - Ignore parentheses.