clang 8.0.0

CoreEngine.h
Go to the documentation of this file.
1 //===- CoreEngine.h - Path-Sensitive Dataflow Engine ------------*- C++ -*-===//
2 //
3 // The LLVM Compiler Infrastructure
4 //
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
7 //
8 //===----------------------------------------------------------------------===//
9 //
10 // This file defines a generic engine for intraprocedural, path-sensitive,
11 // dataflow analysis via graph reachability.
12 //
13 //===----------------------------------------------------------------------===//
14
15 #ifndef LLVM_CLANG_STATICANALYZER_CORE_PATHSENSITIVE_COREENGINE_H
16 #define LLVM_CLANG_STATICANALYZER_CORE_PATHSENSITIVE_COREENGINE_H
17
18 #include "clang/AST/Stmt.h"
19 #include "clang/Analysis/AnalysisDeclContext.h"
20 #include "clang/Analysis/CFG.h"
21 #include "clang/Analysis/ProgramPoint.h"
22 #include "clang/Basic/LLVM.h"
23 #include "clang/StaticAnalyzer/Core/PathSensitive/BlockCounter.h"
24 #include "clang/StaticAnalyzer/Core/PathSensitive/ExplodedGraph.h"
25 #include "clang/StaticAnalyzer/Core/PathSensitive/ProgramState_Fwd.h"
26 #include "clang/StaticAnalyzer/Core/PathSensitive/WorkList.h"
27 #include "llvm/ADT/SmallVector.h"
28 #include "llvm/Support/Casting.h"
29 #include <cassert>
30 #include <memory>
31 #include <utility>
32 #include <vector>
33
34 namespace clang {
35
36 class AnalyzerOptions;
37 class CXXBindTemporaryExpr;
38 class Expr;
39 class LabelDecl;
40
41 namespace ento {
42
43 class FunctionSummariesTy;
44 class SubEngine;
45
46 //===----------------------------------------------------------------------===//
47 /// CoreEngine - Implements the core logic of the graph-reachability
48 /// analysis. It traverses the CFG and generates the ExplodedGraph.
49 /// Program "states" are treated as opaque void pointers.
50 /// The template class CoreEngine (which subclasses CoreEngine)
51 /// provides the matching component to the engine that knows the actual types
52 /// for states. Note that this engine only dispatches to transfer functions
53 /// at the statement and block-level. The analyses themselves must implement
54 /// any transfer function logic and the sub-expression level (if any).
55 class CoreEngine {
56 friend class CommonNodeBuilder;
57 friend class EndOfFunctionNodeBuilder;
58 friend class ExprEngine;
59 friend class IndirectGotoNodeBuilder;
60 friend class NodeBuilder;
61 friend struct NodeBuilderContext;
62 friend class SwitchNodeBuilder;
63
64 public:
65 using BlocksExhausted =
66 std::vector<std::pair<BlockEdge, const ExplodedNode *>>;
67
68 using BlocksAborted =
69 std::vector<std::pair<const CFGBlock *, const ExplodedNode *>>;
70
71 private:
72 SubEngine &SubEng;
73
74 /// G - The simulation graph. Each node is a (location,state) pair.
75 mutable ExplodedGraph G;
76
77 /// WList - A set of queued nodes that need to be processed by the
78 /// worklist algorithm. It is up to the implementation of WList to decide
79 /// the order that nodes are processed.
80 std::unique_ptr<WorkList> WList;
81
82 /// BCounterFactory - A factory object for created BlockCounter objects.
83 /// These are used to record for key nodes in the ExplodedGraph the
84 /// number of times different CFGBlocks have been visited along a path.
85 BlockCounter::Factory BCounterFactory;
86
87 /// The locations where we stopped doing work because we visited a location
88 /// too many times.
89 BlocksExhausted blocksExhausted;
90
91 /// The locations where we stopped because the engine aborted analysis,
92 /// usually because it could not reason about something.
93 BlocksAborted blocksAborted;
94
95 /// The information about functions shared by the whole translation unit.
96 /// (This data is owned by AnalysisConsumer.)
97 FunctionSummariesTy *FunctionSummaries;
98
99 void generateNode(const ProgramPoint &Loc,
100 ProgramStateRef State,
101 ExplodedNode *Pred);
102
103 void HandleBlockEdge(const BlockEdge &E, ExplodedNode *Pred);
104 void HandleBlockEntrance(const BlockEntrance &E, ExplodedNode *Pred);
105 void HandleBlockExit(const CFGBlock *B, ExplodedNode *Pred);
106
107 void HandleCallEnter(const CallEnter &CE, ExplodedNode *Pred);
108
109 void HandlePostStmt(const CFGBlock *B, unsigned StmtIdx, ExplodedNode *Pred);
110
111 void HandleBranch(const Stmt *Cond, const Stmt *Term, const CFGBlock *B,
112 ExplodedNode *Pred);
113 void HandleCleanupTemporaryBranch(const CXXBindTemporaryExpr *BTE,
114 const CFGBlock *B, ExplodedNode *Pred);
115
116 /// Handle conditional logic for running static initializers.
117 void HandleStaticInit(const DeclStmt *DS, const CFGBlock *B,
118 ExplodedNode *Pred);
119
120 private:
121 ExplodedNode *generateCallExitBeginNode(ExplodedNode *N,
122 const ReturnStmt *RS);
123
124 public:
125 /// Construct a CoreEngine object to analyze the provided CFG.
126 CoreEngine(SubEngine &subengine,
127 FunctionSummariesTy *FS,
128 AnalyzerOptions &Opts);
129
130 CoreEngine(const CoreEngine &) = delete;
131 CoreEngine &operator=(const CoreEngine &) = delete;
132
133 /// getGraph - Returns the exploded graph.
134 ExplodedGraph &getGraph() { return G; }
135
136 /// ExecuteWorkList - Run the worklist algorithm for a maximum number of
137 /// steps. Returns true if there is still simulation state on the worklist.
138 bool ExecuteWorkList(const LocationContext *L, unsigned Steps,
139 ProgramStateRef InitState);
140
141 /// Returns true if there is still simulation state on the worklist.
142 bool ExecuteWorkListWithInitialState(const LocationContext *L,
143 unsigned Steps,
144 ProgramStateRef InitState,
145 ExplodedNodeSet &Dst);
146
147 /// Dispatch the work list item based on the given location information.
148 /// Use Pred parameter as the predecessor state.
149 void dispatchWorkItem(ExplodedNode* Pred, ProgramPoint Loc,
150 const WorkListUnit& WU);
151
152 // Functions for external checking of whether we have unfinished work
153 bool wasBlockAborted() const { return !blocksAborted.empty(); }
154 bool wasBlocksExhausted() const { return !blocksExhausted.empty(); }
155 bool hasWorkRemaining() const { return wasBlocksExhausted() ||
156 WList->hasWork() ||
157 wasBlockAborted(); }
158
159 /// Inform the CoreEngine that a basic block was aborted because
160 /// it could not be completely analyzed.
161 void addAbortedBlock(const ExplodedNode *node, const CFGBlock *block) {
162 blocksAborted.push_back(std::make_pair(block, node));
163 }
164
165 WorkList *getWorkList() const { return WList.get(); }
166
167 BlocksExhausted::const_iterator blocks_exhausted_begin() const {
168 return blocksExhausted.begin();
169 }
170
171 BlocksExhausted::const_iterator blocks_exhausted_end() const {
172 return blocksExhausted.end();
173 }
174
175 BlocksAborted::const_iterator blocks_aborted_begin() const {
176 return blocksAborted.begin();
177 }
178
179 BlocksAborted::const_iterator blocks_aborted_end() const {
180 return blocksAborted.end();
181 }
182
183 /// Enqueue the given set of nodes onto the work list.
184 void enqueue(ExplodedNodeSet &Set);
185
186 /// Enqueue nodes that were created as a result of processing
187 /// a statement onto the work list.
188 void enqueue(ExplodedNodeSet &Set, const CFGBlock *Block, unsigned Idx);
189
190 /// enqueue the nodes corresponding to the end of function onto the
191 /// end of path / work list.
192 void enqueueEndOfFunction(ExplodedNodeSet &Set, const ReturnStmt *RS);
193
194 /// Enqueue a single node created as a result of statement processing.
195 void enqueueStmtNode(ExplodedNode *N, const CFGBlock *Block, unsigned Idx);
196 };
197
198 // TODO: Turn into a calss.
199 struct NodeBuilderContext {
200 const CoreEngine &Eng;
201 const CFGBlock *Block;
202 const LocationContext *LC;
203
204 NodeBuilderContext(const CoreEngine &E, const CFGBlock *B, ExplodedNode *N)
205 : Eng(E), Block(B), LC(N->getLocationContext()) { assert(B); }
206
207 /// Return the CFGBlock associated with this builder.
208 const CFGBlock *getBlock() const { return Block; }
209
210 /// Returns the number of times the current basic block has been
211 /// visited on the exploded graph path.
212 unsigned blockCount() const {
213 return Eng.WList->getBlockCounter().getNumVisited(
214 LC->getStackFrame(),
215 Block->getBlockID());
216 }
217 };
218
219 /// \class NodeBuilder
220 /// This is the simplest builder which generates nodes in the
221 /// ExplodedGraph.
222 ///
223 /// The main benefit of the builder is that it automatically tracks the
224 /// frontier nodes (or destination set). This is the set of nodes which should
225 /// be propagated to the next step / builder. They are the nodes which have been
226 /// added to the builder (either as the input node set or as the newly
227 /// constructed nodes) but did not have any outgoing transitions added.
228 class NodeBuilder {
229 virtual void anchor();
230
231 protected:
232 const NodeBuilderContext &C;
233
234 /// Specifies if the builder results have been finalized. For example, if it
235 /// is set to false, autotransitions are yet to be generated.
236 bool Finalized;
237
238 bool HasGeneratedNodes = false;
239
240 /// The frontier set - a set of nodes which need to be propagated after
241 /// the builder dies.
242 ExplodedNodeSet &Frontier;
243
244 /// Checks if the results are ready.
245 virtual bool checkResults() {
246 return Finalized;
247 }
248
249 bool hasNoSinksInFrontier() {
250 for (const auto I : Frontier)
251 if (I->isSink())
252 return false;
253 return true;
254 }
255
256 /// Allow subclasses to finalize results before result_begin() is executed.
257 virtual void finalizeResults() {}
258
259 ExplodedNode *generateNodeImpl(const ProgramPoint &PP,
260 ProgramStateRef State,
261 ExplodedNode *Pred,
262 bool MarkAsSink = false);
263
264 public:
265 NodeBuilder(ExplodedNode *SrcNode, ExplodedNodeSet &DstSet,
266 const NodeBuilderContext &Ctx, bool F = true)
267 : C(Ctx), Finalized(F), Frontier(DstSet) {
268 Frontier.Add(SrcNode);
269 }
270
271 NodeBuilder(const ExplodedNodeSet &SrcSet, ExplodedNodeSet &DstSet,
272 const NodeBuilderContext &Ctx, bool F = true)
273 : C(Ctx), Finalized(F), Frontier(DstSet) {
274 Frontier.insert(SrcSet);
275 assert(hasNoSinksInFrontier());
276 }
277
278 virtual ~NodeBuilder() = default;
279
280 /// Generates a node in the ExplodedGraph.
281 ExplodedNode *generateNode(const ProgramPoint &PP,
282 ProgramStateRef State,
283 ExplodedNode *Pred) {
284 return generateNodeImpl(PP, State, Pred, false);
285 }
286
287 /// Generates a sink in the ExplodedGraph.
288 ///
289 /// When a node is marked as sink, the exploration from the node is stopped -
290 /// the node becomes the last node on the path and certain kinds of bugs are
291 /// suppressed.
292 ExplodedNode *generateSink(const ProgramPoint &PP,
293 ProgramStateRef State,
294 ExplodedNode *Pred) {
295 return generateNodeImpl(PP, State, Pred, true);
296 }
297
298 const ExplodedNodeSet &getResults() {
299 finalizeResults();
300 assert(checkResults());
301 return Frontier;
302 }
303
304 using iterator = ExplodedNodeSet::iterator;
305
306 /// Iterators through the results frontier.
307 iterator begin() {
308 finalizeResults();
309 assert(checkResults());
310 return Frontier.begin();
311 }
312
313 iterator end() {
314 finalizeResults();
315 return Frontier.end();
316 }
317
318 const NodeBuilderContext &getContext() { return C; }
319 bool hasGeneratedNodes() { return HasGeneratedNodes; }
320
321 void takeNodes(const ExplodedNodeSet &S) {
322 for (const auto I : S)
323 Frontier.erase(I);
324 }
325
326 void takeNodes(ExplodedNode *N) { Frontier.erase(N); }
327 void addNodes(const ExplodedNodeSet &S) { Frontier.insert(S); }
328 void addNodes(ExplodedNode *N) { Frontier.Add(N); }
329 };
330
331 /// \class NodeBuilderWithSinks
332 /// This node builder keeps track of the generated sink nodes.
333 class NodeBuilderWithSinks: public NodeBuilder {
334 void anchor() override;
335
336 protected:
337 SmallVector<ExplodedNode*, 2> sinksGenerated;
338 ProgramPoint &Location;
339
340 public:
341 NodeBuilderWithSinks(ExplodedNode *Pred, ExplodedNodeSet &DstSet,
342 const NodeBuilderContext &Ctx, ProgramPoint &L)
343 : NodeBuilder(Pred, DstSet, Ctx), Location(L) {}
344
345 ExplodedNode *generateNode(ProgramStateRef State,
346 ExplodedNode *Pred,
347 const ProgramPointTag *Tag = nullptr) {
348 const ProgramPoint &LocalLoc = (Tag ? Location.withTag(Tag) : Location);
349 return NodeBuilder::generateNode(LocalLoc, State, Pred);
350 }
351
352 ExplodedNode *generateSink(ProgramStateRef State, ExplodedNode *Pred,
353 const ProgramPointTag *Tag = nullptr) {
354 const ProgramPoint &LocalLoc = (Tag ? Location.withTag(Tag) : Location);
355 ExplodedNode *N = NodeBuilder::generateSink(LocalLoc, State, Pred);
356 if (N && N->isSink())
357 sinksGenerated.push_back(N);
358 return N;
359 }
360
361 const SmallVectorImpl<ExplodedNode*> &getSinks() const {
362 return sinksGenerated;
363 }
364 };
365
366 /// \class StmtNodeBuilder
367 /// This builder class is useful for generating nodes that resulted from
368 /// visiting a statement. The main difference from its parent NodeBuilder is
369 /// that it creates a statement specific ProgramPoint.
370 class StmtNodeBuilder: public NodeBuilder {
371 NodeBuilder *EnclosingBldr;
372
373 public:
374 /// Constructs a StmtNodeBuilder. If the builder is going to process
375 /// nodes currently owned by another builder(with larger scope), use
376 /// Enclosing builder to transfer ownership.
377 StmtNodeBuilder(ExplodedNode *SrcNode, ExplodedNodeSet &DstSet,
378 const NodeBuilderContext &Ctx,
379 NodeBuilder *Enclosing = nullptr)
380 : NodeBuilder(SrcNode, DstSet, Ctx), EnclosingBldr(Enclosing) {
381 if (EnclosingBldr)
382 EnclosingBldr->takeNodes(SrcNode);
383 }
384
385 StmtNodeBuilder(ExplodedNodeSet &SrcSet, ExplodedNodeSet &DstSet,
386 const NodeBuilderContext &Ctx,
387 NodeBuilder *Enclosing = nullptr)
388 : NodeBuilder(SrcSet, DstSet, Ctx), EnclosingBldr(Enclosing) {
389 if (EnclosingBldr)
390 for (const auto I : SrcSet)
391 EnclosingBldr->takeNodes(I);
392 }
393
394 ~StmtNodeBuilder() override;
395
396 using NodeBuilder::generateNode;
397 using NodeBuilder::generateSink;
398
399 ExplodedNode *generateNode(const Stmt *S,
400 ExplodedNode *Pred,
401 ProgramStateRef St,
402 const ProgramPointTag *tag = nullptr,
403 ProgramPoint::Kind K = ProgramPoint::PostStmtKind){
404 const ProgramPoint &L = ProgramPoint::getProgramPoint(S, K,
405 Pred->getLocationContext(), tag);
406 return NodeBuilder::generateNode(L, St, Pred);
407 }
408
409 ExplodedNode *generateSink(const Stmt *S,
410 ExplodedNode *Pred,
411 ProgramStateRef St,
412 const ProgramPointTag *tag = nullptr,
413 ProgramPoint::Kind K = ProgramPoint::PostStmtKind){
414 const ProgramPoint &L = ProgramPoint::getProgramPoint(S, K,
415 Pred->getLocationContext(), tag);
416 return NodeBuilder::generateSink(L, St, Pred);
417 }
418 };
419
420 /// BranchNodeBuilder is responsible for constructing the nodes
421 /// corresponding to the two branches of the if statement - true and false.
422 class BranchNodeBuilder: public NodeBuilder {
423 const CFGBlock *DstT;
424 const CFGBlock *DstF;
425
426 bool InFeasibleTrue;
427 bool InFeasibleFalse;
428
429 void anchor() override;
430
431 public:
432 BranchNodeBuilder(ExplodedNode *SrcNode, ExplodedNodeSet &DstSet,
433 const NodeBuilderContext &C,
434 const CFGBlock *dstT, const CFGBlock *dstF)
435 : NodeBuilder(SrcNode, DstSet, C), DstT(dstT), DstF(dstF),
436 InFeasibleTrue(!DstT), InFeasibleFalse(!DstF) {
437 // The branch node builder does not generate autotransitions.
438 // If there are no successors it means that both branches are infeasible.
439 takeNodes(SrcNode);
440 }
441
442 BranchNodeBuilder(const ExplodedNodeSet &SrcSet, ExplodedNodeSet &DstSet,
443 const NodeBuilderContext &C,
444 const CFGBlock *dstT, const CFGBlock *dstF)
445 : NodeBuilder(SrcSet, DstSet, C), DstT(dstT), DstF(dstF),
446 InFeasibleTrue(!DstT), InFeasibleFalse(!DstF) {
447 takeNodes(SrcSet);
448 }
449
450 ExplodedNode *generateNode(ProgramStateRef State, bool branch,
451 ExplodedNode *Pred);
452
453 const CFGBlock *getTargetBlock(bool branch) const {
454 return branch ? DstT : DstF;
455 }
456
457 void markInfeasible(bool branch) {
458 if (branch)
459 InFeasibleTrue = true;
460 else
461 InFeasibleFalse = true;
462 }
463
464 bool isFeasible(bool branch) {
465 return branch ? !InFeasibleTrue : !InFeasibleFalse;
466 }
467 };
468
469 class IndirectGotoNodeBuilder {
470 CoreEngine& Eng;
471 const CFGBlock *Src;
472 const CFGBlock &DispatchBlock;
473 const Expr *E;
474 ExplodedNode *Pred;
475
476 public:
477 IndirectGotoNodeBuilder(ExplodedNode *pred, const CFGBlock *src,
478 const Expr *e, const CFGBlock *dispatch, CoreEngine* eng)
479 : Eng(*eng), Src(src), DispatchBlock(*dispatch), E(e), Pred(pred) {}
480
481 class iterator {
482 friend class IndirectGotoNodeBuilder;
483
484 CFGBlock::const_succ_iterator I;
485
486 iterator(CFGBlock::const_succ_iterator i) : I(i) {}
487
488 public:
489 iterator &operator++() { ++I; return *this; }
490 bool operator!=(const iterator &X) const { return I != X.I; }
491
492 const LabelDecl *getLabel() const {
493 return cast<LabelStmt>((*I)->getLabel())->getDecl();
494 }
495
496 const CFGBlock *getBlock() const {
497 return *I;
498 }
499 };
500
501 iterator begin() { return iterator(DispatchBlock.succ_begin()); }
502 iterator end() { return iterator(DispatchBlock.succ_end()); }
503
504 ExplodedNode *generateNode(const iterator &I,
505 ProgramStateRef State,
506 bool isSink = false);
507
508 const Expr *getTarget() const { return E; }
509
510 ProgramStateRef getState() const { return Pred->State; }
511
512 const LocationContext *getLocationContext() const {
513 return Pred->getLocationContext();
514 }
515 };
516
517 class SwitchNodeBuilder {
518 CoreEngine& Eng;
519 const CFGBlock *Src;
520 const Expr *Condition;
521 ExplodedNode *Pred;
522
523 public:
524 SwitchNodeBuilder(ExplodedNode *pred, const CFGBlock *src,
525 const Expr *condition, CoreEngine* eng)
526 : Eng(*eng), Src(src), Condition(condition), Pred(pred) {}
527
528 class iterator {
529 friend class SwitchNodeBuilder;
530
531 CFGBlock::const_succ_reverse_iterator I;
532
533 iterator(CFGBlock::const_succ_reverse_iterator i) : I(i) {}
534
535 public:
536 iterator &operator++() { ++I; return *this; }
537 bool operator!=(const iterator &X) const { return I != X.I; }
538 bool operator==(const iterator &X) const { return I == X.I; }
539
540 const CaseStmt *getCase() const {
541 return cast<CaseStmt>((*I)->getLabel());
542 }
543
544 const CFGBlock *getBlock() const {
545 return *I;
546 }
547 };
548
549 iterator begin() { return iterator(Src->succ_rbegin()+1); }
550 iterator end() { return iterator(Src->succ_rend()); }
551
552 const SwitchStmt *getSwitch() const {
553 return cast<SwitchStmt>(Src->getTerminator());
554 }
555
556 ExplodedNode *generateCaseStmtNode(const iterator &I,
557 ProgramStateRef State);
558
559 ExplodedNode *generateDefaultCaseNode(ProgramStateRef State,
560 bool isSink = false);
561
562 const Expr *getCondition() const { return Condition; }
563
564 ProgramStateRef getState() const { return Pred->State; }
565
566 const LocationContext *getLocationContext() const {
567 return Pred->getLocationContext();
568 }
569 };
570
571 } // namespace ento
572
573 } // namespace clang
574
575 #endif // LLVM_CLANG_STATICANALYZER_CORE_PATHSENSITIVE_COREENGINE_H
clang::ento::SwitchNodeBuilder::iterator::operator!=
bool operator!=(const iterator &X) const
Definition: CoreEngine.h:537
ento
clang::CFGBlock::succ_rbegin
succ_reverse_iterator succ_rbegin()
Definition: CFG.h:756
clang::ento::SubEngine
Definition: SubEngine.h:47
clang::ento::IndirectGotoNodeBuilder::iterator::operator++
iterator & operator++()
Definition: CoreEngine.h:489
clang::ento::SwitchNodeBuilder::iterator::operator++
iterator & operator++()
Definition: CoreEngine.h:536
clang::ento::FunctionSummariesTy
Definition: FunctionSummary.h:34
clang::ento::SwitchNodeBuilder::begin
iterator begin()
Definition: CoreEngine.h:549
clang::ento::IndirectGotoNodeBuilder
Definition: CoreEngine.h:469
clang::ento::IndirectGotoNodeBuilder::iterator::getLabel
const LabelDecl * getLabel() const
Definition: CoreEngine.h:492
clang::ProgramPoint::Kind
Kind
Definition: ProgramPoint.h:63
clang::ento::BranchNodeBuilder::markInfeasible
void markInfeasible(bool branch)
Definition: CoreEngine.h:457
clang::CFGBlock::succ_begin
succ_iterator succ_begin()
Definition: CFG.h:751
clang::ento::ExplodedNodeSet::iterator
ImplTy::iterator iterator
Definition: ExplodedGraph.h:438
clang::ento::NodeBuilderContext::blockCount
unsigned blockCount() const
Returns the number of times the current basic block has been visited on the exploded graph path...
Definition: CoreEngine.h:212
clang::ento::CoreEngine::ExecuteWorkList
bool ExecuteWorkList(const LocationContext *L, unsigned Steps, ProgramStateRef InitState)
ExecuteWorkList - Run the worklist algorithm for a maximum number of steps.
Definition: CoreEngine.cpp:81
clang::Stmt
Stmt - This represents one statement.
Definition: Stmt.h:66
BlockCounter.h
clang::ento::NodeBuilder::iterator
ExplodedNodeSet::iterator iterator
Definition: CoreEngine.h:304
clang::ento::StmtNodeBuilder
This builder class is useful for generating nodes that resulted from visiting a statement.
Definition: CoreEngine.h:370
clang::ento::CoreEngine::wasBlockAborted
bool wasBlockAborted() const
Definition: CoreEngine.h:153
clang::CFGBlock::getBlockID
unsigned getBlockID() const
Definition: CFG.h:856
clang::ento::NodeBuilderContext
Definition: CoreEngine.h:199
clang::CallEnter
Represents a point when we begin processing an inlined call.
Definition: ProgramPoint.h:632
clang::ento::NodeBuilderContext::Block
const CFGBlock * Block
Definition: CoreEngine.h:201
clang::ProgramPoint::withTag
ProgramPoint withTag(const ProgramPointTag *tag) const
Create a new ProgramPoint object that is the same as the original except for using the specified tag ...
Definition: ProgramPoint.h:134
clang::ento::IndirectGotoNodeBuilder::IndirectGotoNodeBuilder
IndirectGotoNodeBuilder(ExplodedNode *pred, const CFGBlock *src, const Expr *e, const CFGBlock *dispatch, CoreEngine *eng)
Definition: CoreEngine.h:477
clang::ento::SwitchNodeBuilder::iterator::getCase
const CaseStmt * getCase() const
Definition: CoreEngine.h:540
clang::LocationContext
Definition: AnalysisDeclContext.h:218
clang::ento::SwitchNodeBuilder::iterator
Definition: CoreEngine.h:528
clang::ento::NodeBuilderContext::Eng
const CoreEngine & Eng
Definition: CoreEngine.h:200
clang::ento::NodeBuilderWithSinks::NodeBuilderWithSinks
NodeBuilderWithSinks(ExplodedNode *Pred, ExplodedNodeSet &DstSet, const NodeBuilderContext &Ctx, ProgramPoint &L)
Definition: CoreEngine.h:341
clang::ento::BranchNodeBuilder::BranchNodeBuilder
BranchNodeBuilder(ExplodedNode *SrcNode, ExplodedNodeSet &DstSet, const NodeBuilderContext &C, const CFGBlock *dstT, const CFGBlock *dstF)
Definition: CoreEngine.h:432
clang::BlockEntrance
Definition: ProgramPoint.h:227
clang::ento::ExplodedNodeSet::end
iterator end()
Definition: ExplodedGraph.h:456
clang::ento::NodeBuilder::takeNodes
void takeNodes(const ExplodedNodeSet &S)
Definition: CoreEngine.h:321
clang::ento::NodeBuilder::finalizeResults
virtual void finalizeResults()
Allow subclasses to finalize results before result_begin() is executed.
Definition: CoreEngine.h:257
clang::ento::NodeBuilder::end
iterator end()
Definition: CoreEngine.h:313
clang::ento::ExplodedGraph
Definition: ExplodedGraph.h:264
clang::ento::CoreEngine::blocks_aborted_begin
BlocksAborted::const_iterator blocks_aborted_begin() const
Definition: CoreEngine.h:175
clang::ento::CoreEngine::enqueue
void enqueue(ExplodedNodeSet &Set)
Enqueue the given set of nodes onto the work list.
Definition: CoreEngine.cpp:526
clang::ento::CoreEngine::ExecuteWorkListWithInitialState
bool ExecuteWorkListWithInitialState(const LocationContext *L, unsigned Steps, ProgramStateRef InitState, ExplodedNodeSet &Dst)
Returns true if there is still simulation state on the worklist.
Definition: CoreEngine.cpp:198
clang::ProgramPoint::getProgramPoint
static ProgramPoint getProgramPoint(const Stmt *S, ProgramPoint::Kind K, const LocationContext *LC, const ProgramPointTag *tag)
Definition: ProgramPoint.cpp:21
clang::ento::SwitchNodeBuilder
Definition: CoreEngine.h:517
clang::ento::CoreEngine::blocks_exhausted_end
BlocksExhausted::const_iterator blocks_exhausted_end() const
Definition: CoreEngine.h:171
clang::ento::BranchNodeBuilder::getTargetBlock
const CFGBlock * getTargetBlock(bool branch) const
Definition: CoreEngine.h:453
clang::ento::CoreEngine::hasWorkRemaining
bool hasWorkRemaining() const
Definition: CoreEngine.h:155
clang::ento::SwitchNodeBuilder::iterator::operator==
bool operator==(const iterator &X) const
Definition: CoreEngine.h:538
clang::ento::NodeBuilder::Finalized
bool Finalized
Specifies if the builder results have been finalized.
Definition: CoreEngine.h:236
State
LineState State
Definition: UnwrappedLineFormatter.cpp:877
ProgramState_Fwd.h
clang::ento::CoreEngine::CoreEngine
CoreEngine(SubEngine &subengine, FunctionSummariesTy *FS, AnalyzerOptions &Opts)
Construct a CoreEngine object to analyze the provided CFG.
Definition: CoreEngine.cpp:75
clang::ento::CoreEngine::blocks_exhausted_begin
BlocksExhausted::const_iterator blocks_exhausted_begin() const
Definition: CoreEngine.h:167
clang::ento::CoreEngine::CommonNodeBuilder
friend class CommonNodeBuilder
Definition: CoreEngine.h:56
clang::ento::ExplodedNode
Definition: ExplodedGraph.h:66
llvm::SmallVectorImpl
Definition: LLVM.h:37
clang::CFGBlock::const_succ_iterator
AdjacentBlocks::const_iterator const_succ_iterator
Definition: CFG.h:727
clang::ento::StmtNodeBuilder::generateSink
ExplodedNode * generateSink(const Stmt *S, ExplodedNode *Pred, ProgramStateRef St, const ProgramPointTag *tag=nullptr, ProgramPoint::Kind K=ProgramPoint::PostStmtKind)
Definition: CoreEngine.h:409
clang::ento::CoreEngine::getWorkList
WorkList * getWorkList() const
Definition: CoreEngine.h:165
clang::ento::NodeBuilder::addNodes
void addNodes(ExplodedNode *N)
Definition: CoreEngine.h:328
LLVM.h
Forward-declares and imports various common LLVM datatypes that clang wants to use unqualified...
clang::ento::ExplodedNode::getLocationContext
const LocationContext * getLocationContext() const
Definition: ExplodedGraph.h:145
clang::ento::SwitchNodeBuilder::iterator::getBlock
const CFGBlock * getBlock() const
Definition: CoreEngine.h:544
clang::ento::NodeBuilder::Frontier
ExplodedNodeSet & Frontier
The frontier set - a set of nodes which need to be propagated after the builder dies.
Definition: CoreEngine.h:242
clang::ento::NodeBuilderWithSinks::getSinks
const SmallVectorImpl< ExplodedNode * > & getSinks() const
Definition: CoreEngine.h:361
clang::CaseStmt
CaseStmt - Represent a case statement.
Definition: Stmt.h:1394
clang::CXXBindTemporaryExpr
Represents binding an expression to a temporary.
Definition: ExprCXX.h:1217
ProgramPoint.h
clang::ProgramPoint::PostStmtKind
Definition: ProgramPoint.h:69
clang::ento::NodeBuilderWithSinks::Location
ProgramPoint & Location
Definition: CoreEngine.h:338
clang::ento::StmtNodeBuilder::StmtNodeBuilder
StmtNodeBuilder(ExplodedNodeSet &SrcSet, ExplodedNodeSet &DstSet, const NodeBuilderContext &Ctx, NodeBuilder *Enclosing=nullptr)
Definition: CoreEngine.h:385
clang::CFGBlock
Represents a single basic block in a source-level CFG.
Definition: CFG.h:552
clang::ento::NodeBuilder::generateSink
ExplodedNode * generateSink(const ProgramPoint &PP, ProgramStateRef State, ExplodedNode *Pred)
Generates a sink in the ExplodedGraph.
Definition: CoreEngine.h:292
clang::Expr
This represents one expression.
Definition: Expr.h:106
clang::ento::CoreEngine::getGraph
ExplodedGraph & getGraph()
getGraph - Returns the exploded graph.
Definition: CoreEngine.h:134
clang::ento::SwitchNodeBuilder::end
iterator end()
Definition: CoreEngine.h:550
clang::ento::SwitchNodeBuilder::getCondition
const Expr * getCondition() const
Definition: CoreEngine.h:562
clang::ento::CoreEngine::BlocksAborted
std::vector< std::pair< const CFGBlock *, const ExplodedNode * > > BlocksAborted
Definition: CoreEngine.h:69
clang::ento::NodeBuilder
This is the simplest builder which generates nodes in the ExplodedGraph.
Definition: CoreEngine.h:228
clang::ento::ExplodedNodeSet::Add
void Add(ExplodedNode *N)
Definition: ExplodedGraph.h:434
clang::ento::NodeBuilder::getResults
const ExplodedNodeSet & getResults()
Definition: CoreEngine.h:298
clang::ento::SwitchNodeBuilder::getLocationContext
const LocationContext * getLocationContext() const
Definition: CoreEngine.h:566
clang::ento::NodeBuilderWithSinks::sinksGenerated
SmallVector< ExplodedNode *, 2 > sinksGenerated
Definition: CoreEngine.h:337
clang::ento::IndirectGotoNodeBuilder::iterator
Definition: CoreEngine.h:481
clang::ento::CoreEngine::enqueueStmtNode
void enqueueStmtNode(ExplodedNode *N, const CFGBlock *Block, unsigned Idx)
Enqueue a single node created as a result of statement processing.
Definition: CoreEngine.cpp:462
Stmt.h
clang::ReturnStmt
ReturnStmt - This represents a return, optionally of an expression: return; return 4;...
Definition: Stmt.h:2443
clang::ento::ExplodedNode::isSink
bool isSink() const
Definition: ExplodedGraph.h:199
clang::BlockEdge
Definition: ProgramPoint.h:505
clang::ento::NodeBuilder::hasNoSinksInFrontier
bool hasNoSinksInFrontier()
Definition: CoreEngine.h:249
clang::ento::SwitchNodeBuilder::getSwitch
const SwitchStmt * getSwitch() const
Definition: CoreEngine.h:552
clang::ento::NodeBuilder::checkResults
virtual bool checkResults()
Checks if the results are ready.
Definition: CoreEngine.h:245
clang::ento::CoreEngine::blocks_aborted_end
BlocksAborted::const_iterator blocks_aborted_end() const
Definition: CoreEngine.h:179
AnalysisDeclContext.h
clang::ento::IndirectGotoNodeBuilder::end
iterator end()
Definition: CoreEngine.h:502
clang::CFGBlock::getTerminator
CFGTerminator getTerminator()
Definition: CFG.h:840
clang::ento::IndirectGotoNodeBuilder::getLocationContext
const LocationContext * getLocationContext() const
Definition: CoreEngine.h:512
clang::ento::Loc
Definition: SVals.h:318
llvm::IntrusiveRefCntPtr
Definition: LLVM.h:45
clang::ento::ExplodedNodeSet
Definition: ExplodedGraph.h:422
clang::ProgramPointTag
ProgramPoints can be "tagged" as representing points specific to a given analysis entity...
Definition: ProgramPoint.h:40
clang::ento::CoreEngine::wasBlocksExhausted
bool wasBlocksExhausted() const
Definition: CoreEngine.h:154
clang::DeclStmt
DeclStmt - Adaptor class for mixing declarations with statements and expressions. ...
Definition: Stmt.h:1143
clang::LabelDecl
Represents the declaration of a label.
Definition: Decl.h:469
clang::ento::NodeBuilderWithSinks::generateNode
ExplodedNode * generateNode(ProgramStateRef State, ExplodedNode *Pred, const ProgramPointTag *Tag=nullptr)
Definition: CoreEngine.h:345
clang::ento::CoreEngine::dispatchWorkItem
void dispatchWorkItem(ExplodedNode *Pred, ProgramPoint Loc, const WorkListUnit &WU)
Dispatch the work list item based on the given location information.
Definition: CoreEngine.cpp:155
clang::CFGBlock::succ_rend
succ_reverse_iterator succ_rend()
Definition: CFG.h:757
ExplodedGraph.h
llvm::SmallVector
Definition: LLVM.h:36
clang::CFGBlock::succ_end
succ_iterator succ_end()
Definition: CFG.h:752
clang::ento::IndirectGotoNodeBuilder::iterator::operator!=
bool operator!=(const iterator &X) const
Definition: CoreEngine.h:490
clang::ento::ExplodedNodeSet::insert
void insert(const ExplodedNodeSet &S)
Definition: ExplodedGraph.h:447
clang::ento::CoreEngine::BlocksExhausted
std::vector< std::pair< BlockEdge, const ExplodedNode * > > BlocksExhausted
Definition: CoreEngine.h:66
clang::ento::CoreEngine
CoreEngine - Implements the core logic of the graph-reachability analysis.
Definition: CoreEngine.h:55
clang
Dataflow Directional Tag Classes.
Definition: CFGReachabilityAnalysis.h:22
clang::ento::NodeBuilder::takeNodes
void takeNodes(ExplodedNode *N)
Definition: CoreEngine.h:326
clang::ento::NodeBuilder::addNodes
void addNodes(const ExplodedNodeSet &S)
Definition: CoreEngine.h:327
clang::ento::ExplodedNodeSet::begin
iterator begin()
Definition: ExplodedGraph.h:455
clang::ento::NodeBuilder::getContext
const NodeBuilderContext & getContext()
Definition: CoreEngine.h:318
clang::ento::WorkListUnit
Definition: WorkList.h:28
clang::ento::NodeBuilder::hasGeneratedNodes
bool hasGeneratedNodes()
Definition: CoreEngine.h:319
clang::ento::BranchNodeBuilder::BranchNodeBuilder
BranchNodeBuilder(const ExplodedNodeSet &SrcSet, ExplodedNodeSet &DstSet, const NodeBuilderContext &C, const CFGBlock *dstT, const CFGBlock *dstF)
Definition: CoreEngine.h:442
clang::ento::NodeBuilderWithSinks
This node builder keeps track of the generated sink nodes.
Definition: CoreEngine.h:333
clang::ento::BranchNodeBuilder
BranchNodeBuilder is responsible for constructing the nodes corresponding to the two branches of the ...
Definition: CoreEngine.h:422
clang::ento::SwitchNodeBuilder::getState
ProgramStateRef getState() const
Definition: CoreEngine.h:564
clang::ento::NodeBuilderContext::NodeBuilderContext
NodeBuilderContext(const CoreEngine &E, const CFGBlock *B, ExplodedNode *N)
Definition: CoreEngine.h:204
clang::SwitchStmt
SwitchStmt - This represents a &#39;switch&#39; stmt.
Definition: Stmt.h:1886
clang::ento::CoreEngine::EndOfFunctionNodeBuilder
friend class EndOfFunctionNodeBuilder
Definition: CoreEngine.h:57
clang::ProgramPoint
Definition: ProgramPoint.h:61
clang::ento::NodeBuilderWithSinks::generateSink
ExplodedNode * generateSink(ProgramStateRef State, ExplodedNode *Pred, const ProgramPointTag *Tag=nullptr)
Definition: CoreEngine.h:352
WorkList.h
clang::LocationContext::getStackFrame
const StackFrameContext * getStackFrame() const
Definition: AnalysisDeclContext.cpp:440
clang::CFGBlock::const_succ_reverse_iterator
AdjacentBlocks::const_reverse_iterator const_succ_reverse_iterator
Definition: CFG.h:729
clang::AnalyzerOptions
Stores options for the analyzer from the command line.
Definition: AnalyzerOptions.h:163
clang::ento::CoreEngine::addAbortedBlock
void addAbortedBlock(const ExplodedNode *node, const CFGBlock *block)
Inform the CoreEngine that a basic block was aborted because it could not be completely analyzed...
Definition: CoreEngine.h:161
clang::ento::ExplodedNodeSet::erase
bool erase(ExplodedNode *N)
Definition: ExplodedGraph.h:443
clang::ento::NodeBuilder::C
const NodeBuilderContext & C
Definition: CoreEngine.h:232
clang::ento::CoreEngine::enqueueEndOfFunction
void enqueueEndOfFunction(ExplodedNodeSet &Set, const ReturnStmt *RS)
enqueue the nodes corresponding to the end of function onto the end of path / work list...
Definition: CoreEngine.cpp:537
X
X
Add a minimal nested name specifier fixit hint to allow lookup of a tag name from an outer enclosing ...
Definition: SemaDecl.cpp:13954
clang::ento::NodeBuilder::generateNode
ExplodedNode * generateNode(const ProgramPoint &PP, ProgramStateRef State, ExplodedNode *Pred)
Generates a node in the ExplodedGraph.
Definition: CoreEngine.h:281
CFG.h
clang::ento::SwitchNodeBuilder::SwitchNodeBuilder
SwitchNodeBuilder(ExplodedNode *pred, const CFGBlock *src, const Expr *condition, CoreEngine *eng)
Definition: CoreEngine.h:524
clang::ento::StmtNodeBuilder::StmtNodeBuilder
StmtNodeBuilder(ExplodedNode *SrcNode, ExplodedNodeSet &DstSet, const NodeBuilderContext &Ctx, NodeBuilder *Enclosing=nullptr)
Constructs a StmtNodeBuilder.
Definition: CoreEngine.h:377
clang::ento::WorkList
Definition: WorkList.h:61
clang::ento::IndirectGotoNodeBuilder::getState
ProgramStateRef getState() const
Definition: CoreEngine.h:510
clang::ento::CoreEngine::operator=
CoreEngine & operator=(const CoreEngine &)=delete
clang::ento::NodeBuilder::NodeBuilder
NodeBuilder(ExplodedNode *SrcNode, ExplodedNodeSet &DstSet, const NodeBuilderContext &Ctx, bool F=true)
Definition: CoreEngine.h:265
clang::ento::StmtNodeBuilder::generateNode
ExplodedNode * generateNode(const Stmt *S, ExplodedNode *Pred, ProgramStateRef St, const ProgramPointTag *tag=nullptr, ProgramPoint::Kind K=ProgramPoint::PostStmtKind)
Definition: CoreEngine.h:399
clang::ento::NodeBuilder::begin
iterator begin()
Iterators through the results frontier.
Definition: CoreEngine.h:307
clang::ento::NodeBuilder::NodeBuilder
NodeBuilder(const ExplodedNodeSet &SrcSet, ExplodedNodeSet &DstSet, const NodeBuilderContext &Ctx, bool F=true)
Definition: CoreEngine.h:271
clang::ento::IndirectGotoNodeBuilder::iterator::getBlock
const CFGBlock * getBlock() const
Definition: CoreEngine.h:496
clang::ento::ExprEngine
Definition: ExprEngine.h:84
clang::ento::BranchNodeBuilder::isFeasible
bool isFeasible(bool branch)
Definition: CoreEngine.h:464
clang::ento::IndirectGotoNodeBuilder::begin
iterator begin()
Definition: CoreEngine.h:501
clang::ento::IndirectGotoNodeBuilder::getTarget
const Expr * getTarget() const
Definition: CoreEngine.h:508
clang::ento::NodeBuilderContext::getBlock
const CFGBlock * getBlock() const
Return the CFGBlock associated with this builder.
Definition: CoreEngine.h:208
clang::ento::NodeBuilderContext::LC
const LocationContext * LC
Definition: CoreEngine.h:202
clang::ento::BlockCounter::Factory
Definition: BlockCounter.h:41