19 using namespace clang;
30 SVal Symbol, SVal Other,
Expr* Expression, SValBuilder &svalBuilder,
33 if (Other.getAs<Loc>() &&
36 return svalBuilder.conjureSymbolVal(Expression, LCtx, Ty, Count);
59 SVal LeftV = state->getSVal(LHS, LCtx);
60 SVal RightV = state->getSVal(RHS, LCtx);
64 if (Op == BO_Assign) {
75 evalStore(Tmp2, B, LHS, *it, state->BindExpr(B, LCtx, ExprVal),
88 RightV, LeftV, RHS, svalBuilder, Count, LCtx);
90 LeftV, RightV, LHS, svalBuilder, Count, LCtx);
97 state = createTemporaryRegionIfNeeded(state, LCtx, LHS);
103 state = state->BindExpr(B, LCtx, Result);
114 llvm_unreachable(
"Invalid opcode for compound assignment.");
115 case BO_MulAssign: Op = BO_Mul;
break;
116 case BO_DivAssign: Op = BO_Div;
break;
117 case BO_RemAssign: Op = BO_Rem;
break;
118 case BO_AddAssign: Op = BO_Add;
break;
119 case BO_SubAssign: Op = BO_Sub;
break;
120 case BO_ShlAssign: Op = BO_Shl;
break;
121 case BO_ShrAssign: Op = BO_Shr;
break;
122 case BO_AndAssign: Op = BO_And;
break;
123 case BO_XorAssign: Op = BO_Xor;
break;
124 case BO_OrAssign: Op = BO_Or;
break;
130 SVal location = LeftV;
131 evalLoad(Tmp, B, LHS, *it, state, location);
136 state = (*I)->getState();
138 SVal V = state->getSVal(LHS, LCtx);
142 cast<CompoundAssignOperator>(B)->getComputationResultType();
146 cast<CompoundAssignOperator>(B)->getComputationLHSType();
152 V = svalBuilder.
evalCast(V, CLHSTy, LTy);
170 Result = svalBuilder.
evalCast(LHSVal, CTy, LTy);
175 LHSVal = svalBuilder.
evalCast(Result, LTy, CTy);
181 state = state->BindExpr(B, LCtx, location);
183 state = state->BindExpr(B, LCtx, Result);
185 evalStore(Tmp2, B, LHS, *I, state, location, LHSVal);
209 dyn_cast_or_null<BlockDataRegion>(V.
getAsRegion())) {
212 E = BDR->referenced_vars_end();
216 for (; I != E; ++I) {
226 const Expr *copyExpr =
nullptr;
228 assert(CI->getVariable() == capturedR->
getDecl());
229 copyExpr = CI->getCopyExpr();
233 if (capturedR != originalR) {
237 originalV = State->getSVal(copyExpr, LCtx);
268 SVal OrigV = state->getSVal(Ex, LCtx);
271 if (CastE->
getCastKind() == CK_BooleanToSignedIntegral)
273 state = state->BindExpr(CastE, LCtx, V);
292 state = state->BindExpr(CastE, LCtx, result);
310 evalLoad(Dst, CastE, CastE, subExprNode, state, state->getSVal(Ex, LCtx));
319 if (
const ExplicitCastExpr *ExCast=dyn_cast_or_null<ExplicitCastExpr>(CastE))
320 T = ExCast->getTypeAsWritten();
331 case CK_LValueToRValue:
332 llvm_unreachable(
"LValueToRValue casts handled earlier.");
337 case CK_ARCProduceObject:
338 case CK_ARCConsumeObject:
339 case CK_ARCReclaimReturnedObject:
340 case CK_ARCExtendBlockObject:
341 case CK_CopyAndAutoreleaseBlockObject:
345 case CK_AtomicToNonAtomic:
346 case CK_NonAtomicToAtomic:
349 case CK_ConstructorConversion:
350 case CK_UserDefinedConversion:
351 case CK_FunctionToPointerDecay:
352 case CK_BuiltinFnToFnPtr: {
356 SVal V = state->getSVal(Ex, LCtx);
357 state = state->BindExpr(CastE, LCtx, V);
361 case CK_MemberPointerToBoolean:
362 case CK_PointerToBoolean: {
363 SVal V = state->getSVal(Ex, LCtx);
366 V = svalBuilder.
makeTruthVal(!PTMSV->isNullMemberPointer(), ExTy);
368 state = state->BindExpr(CastE, LCtx, V);
378 case CK_ArrayToPointerDecay:
380 case CK_AddressSpaceConversion:
381 case CK_BooleanToSignedIntegral:
382 case CK_NullToPointer:
383 case CK_IntegralToPointer:
384 case CK_PointerToIntegral: {
385 SVal V = state->getSVal(Ex, LCtx);
387 state = state->BindExpr(CastE, LCtx,
UnknownVal());
396 case CK_IntegralToBoolean:
397 case CK_IntegralToFloating:
398 case CK_FloatingToIntegral:
399 case CK_FloatingToBoolean:
400 case CK_FloatingCast:
401 case CK_FloatingRealToComplex:
402 case CK_FloatingComplexToReal:
403 case CK_FloatingComplexToBoolean:
404 case CK_FloatingComplexCast:
405 case CK_FloatingComplexToIntegralComplex:
406 case CK_IntegralRealToComplex:
407 case CK_IntegralComplexToReal:
408 case CK_IntegralComplexToBoolean:
409 case CK_IntegralComplexCast:
410 case CK_IntegralComplexToFloatingComplex:
411 case CK_CPointerToObjCPointerCast:
412 case CK_BlockPointerToObjCPointerCast:
413 case CK_AnyPointerToBlockPointerCast:
414 case CK_ObjCObjectLValueCast:
415 case CK_ZeroToOCLOpaqueType:
416 case CK_IntToOCLSampler:
417 case CK_LValueBitCast:
418 case CK_FixedPointCast:
419 case CK_FixedPointToBoolean: {
424 case CK_IntegralCast: {
426 SVal V = state->getSVal(Ex, LCtx);
428 state = state->BindExpr(CastE, LCtx, V);
432 case CK_DerivedToBase:
433 case CK_UncheckedDerivedToBase: {
435 SVal val = state->getSVal(Ex, LCtx);
437 state = state->BindExpr(CastE, LCtx, val);
443 SVal val = state->getSVal(Ex, LCtx);
467 state = state->BindExpr(CastE, LCtx, svalBuilder.
makeNull());
475 state = state->BindExpr(CastE, LCtx, NewSym);
478 state = state->BindExpr(CastE, LCtx, val);
483 case CK_BaseToDerived: {
484 SVal val = state->getSVal(Ex, LCtx);
501 state = state->BindExpr(CastE, LCtx, val);
505 case CK_NullToMemberPointer: {
507 state = state->BindExpr(CastE, LCtx, V);
511 case CK_DerivedToBaseMemberPointer:
512 case CK_BaseToDerivedMemberPointer:
513 case CK_ReinterpretMemberPointer: {
514 SVal V = state->getSVal(Ex, LCtx);
518 llvm::make_range<CastExpr::path_const_iterator>(
520 state = state->BindExpr(CastE, LCtx, CastedPTMSV);
530 case CK_VectorSplat: {
549 if (isa<CXXConstructExpr>(Init) || isa<CXXStdInitializerListExpr>(Init)) {
552 assert(isa<InitListExpr>(Init));
553 Loc CLLoc = State->getLValue(CL, LCtx);
554 State = State->bindLoc(CLLoc, V, LCtx);
591 SVal InitVal = state->getSVal(InitEx, LC);
595 state = finishObjectConstruction(state, DS, LC);
604 if (InitEx->isGLValue()) {
615 evalBind(Dst2, DS, UpdatedN, state->getLValue(VD, LC), InitVal,
true);
641 Bldr.generateNode(B, Pred, state);
666 assert(Term->isLogicalOp());
676 assert(!SrcBlock->
empty());
678 const Expr *RHS = cast<Expr>(Elem.getStmt());
681 if (RHSVal.isUndef()) {
713 if (NumInitElements == 0) {
720 ei = IE->
rend(); it != ei; ++it) {
721 SVal V = state->getSVal(cast<Expr>(*it), LCtx);
726 state->BindExpr(IE, LCtx,
734 assert(NumInitElements <= 1);
737 if (NumInitElements == 0)
740 V = state->getSVal(IE->
getInit(0), LCtx);
770 SrcState = N->getState();
774 assert(SrcBlock &&
"missing function entry");
778 bool hasValue =
false;
781 for (
CFGElement CE : llvm::reverse(*SrcBlock)) {
783 const Expr *ValEx = cast<Expr>(CS->getStmt());
789 L = OpaqueEx->getSourceExpr();
795 V = SrcState->getSVal(ValEx, LCtx);
806 B.
generateNode(Ex, Pred, state->BindExpr(Ex, LCtx, V,
true));
863 state = state->BindExpr(Ex, (*I)->getLocationContext(),
886 state->getSVal(Ex, LCtx)));
922 state->getSVal(Ex, LCtx)));
944 if (
const DeclRefExpr *DRE = dyn_cast<DeclRefExpr>(Ex)) {
947 if (isa<CXXMethodDecl>(VD) || isa<FieldDecl>(VD)) {
977 SVal V = state->getSVal(Ex, LCtx);
986 llvm_unreachable(
"Invalid Opcode.");
1004 }
else if (Ex->getType()->isFloatingType()) {
1013 state = state->BindExpr(U, LCtx, Result);
1034 SVal loc = state->getSVal(Ex, LCtx);
1038 evalLoad(Tmp, U, Ex, Pred, state, loc);
1044 state = (*I)->getState();
1045 assert(LCtx == (*I)->getLocationContext());
1046 SVal V2_untested = state->getSVal(Ex, LCtx);
1049 if (V2_untested.isUnknownOrUndef()) {
1050 state = state->BindExpr(U, LCtx, V2_untested);
1055 evalStore(Dst3, U, Ex, *I, state, loc, V2_untested);
1101 if (!state->assume(Constraint,
true)) {
1104 Constraint = svalBuilder.
evalEQ(state, SymVal,
1107 state = state->assume(Constraint,
false);
1116 state = state->BindExpr(U, LCtx, loc);
1118 state = state->BindExpr(U, LCtx, U->
isPostfix() ? V2 : Result);
1123 evalStore(Dst3, U, Ex, *I, state, loc, Result);
SVal attemptDownCast(SVal Base, QualType DerivedPtrType, bool &Failed)
Attempts to do a down cast.
const BlockDecl * getBlockDecl() const
nonloc::ConcreteInt makeIntVal(const IntegerLiteral *integer)
DefinedSVal getBlockPointer(const BlockDecl *block, CanQualType locTy, const LocationContext *locContext, unsigned blockCount)
reverse_iterator rbegin()
SVal evalDerivedToBase(SVal Derived, const CastExpr *Cast)
Evaluates a chain of derived-to-base casts through the path specified in Cast.
A (possibly-)qualified type.
succ_iterator succ_begin()
capture_const_iterator capture_begin() const
ImplTy::iterator iterator
const Expr * getInit(unsigned Init) const
unsigned blockCount() const
Returns the number of times the current basic block has been visited on the exploded graph path...
bool EvaluateAsInt(EvalResult &Result, const ASTContext &Ctx, SideEffectsKind AllowSideEffects=SE_NoSideEffects) const
EvaluateAsInt - Return true if this is a constant which we can fold and convert to an integer...
This builder class is useful for generating nodes that resulted from visiting a statement.
bool isRecordType() const
const CFGBlock * getSrc() const
QualType getLValueReferenceType(QualType T, bool SpelledAsLValue=true) const
Return the uniqued reference to the type for an lvalue reference to the specified type...
SVal evalBinOp(ProgramStateRef state, BinaryOperator::Opcode op, NonLoc L, NonLoc R, QualType T)
Represents a point after we ran remove dead bindings BEFORE processing the given statement.
T castAs() const
Convert to the specified CFGElement type, asserting that this CFGElement is of the desired type...
const ProgramStateRef & getState() const
SVal evalCast(SVal val, QualType castTy, QualType originalType)
Value representing integer constant.
capture_const_iterator capture_end() const
unsigned succ_size() const
void VisitUnaryOperator(const UnaryOperator *B, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitUnaryOperator - Transfer function logic for unary operators.
void takeNodes(const ExplodedNodeSet &S)
void handleUOExtension(ExplodedNodeSet::iterator I, const UnaryOperator *U, StmtNodeBuilder &Bldr)
Represents a variable declaration or definition.
CompoundLiteralExpr - [C99 6.5.2.5].
const T * getAs() const
Member-template getAs<specific type>'.
NonLoc makeArrayIndex(uint64_t idx)
static Optional< SVal > getObjectUnderConstruction(ProgramStateRef State, const ConstructionContextItem &Item, const LocationContext *LC)
By looking at a certain item that may be potentially part of an object's ConstructionContext, retrieve such object's location.
void evalStore(ExplodedNodeSet &Dst, const Expr *AssignE, const Expr *StoreE, ExplodedNode *Pred, ProgramStateRef St, SVal TargetLV, SVal Val, const ProgramPointTag *tag=nullptr)
evalStore - Handle the semantics of a store via an assignment.
static bool isAssignmentOp(Opcode Opc)
Defines the clang::Expr interface and subclasses for C++ expressions.
bool isVariableArrayType() const
InitExprsTy::const_reverse_iterator const_reverse_iterator
Represents a class type in Objective C.
Value representing pointer-to-member.
const VarRegion * getOriginalRegion() const
SVal evalIntegralCast(ProgramStateRef state, SVal val, QualType castTy, QualType originalType)
Loc makeNullWithType(QualType type)
Create NULL pointer, with proper pointer bit-width for given address space.
static bool isIncrementDecrementOp(Opcode Op)
bool isReferenceType() const
i32 captured_struct **param SharedsTy A type which contains references the shared variables *param Shareds Context with the list of shared variables from the p *TaskFunction *param Data Additional data for task generation like final * state
bool isIntegralOrEnumerationType() const
Determine whether this type is an integral or enumeration type.
llvm::ImmutableList< SVal > prependSVal(SVal X, llvm::ImmutableList< SVal > L)
static bool isLocType(QualType T)
Describes an C or C++ initializer list.
void VisitOffsetOfExpr(const OffsetOfExpr *Ex, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitOffsetOfExpr - Transfer function for offsetof.
BlockDataRegion - A region that represents a block instance.
ExplodedNode * generateSink(const Stmt *S, ExplodedNode *Pred, ProgramStateRef St, const ProgramPointTag *tag=nullptr, ProgramPoint::Kind K=ProgramPoint::PostStmtKind)
CharUnits - This is an opaque type for sizes expressed in character units.
APValue Val
Val - This is the value the expression can be folded to.
path_iterator path_begin()
const LocationContext * getLocationContext() const
A builtin binary operation expression such as "x + y" or "x <= y".
NonLoc makePointerToMember(const DeclaratorDecl *DD)
static bool isPostfix(Opcode Op)
isPostfix - Return true if this is a postfix operation, like x++.
bool isRValueReferenceType() const
NonLoc makeCompoundVal(QualType type, llvm::ImmutableList< SVal > vals)
CastExpr - Base class for type casts, including both implicit casts (ImplicitCastExpr) and explicit c...
SVal evalComplement(SVal X)
void VisitDeclStmt(const DeclStmt *DS, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitDeclStmt - Transfer function logic for DeclStmts.
unsigned pred_size() const
void evalBind(ExplodedNodeSet &Dst, const Stmt *StoreE, ExplodedNode *Pred, SVal location, SVal Val, bool atDeclInit=false, const ProgramPoint *PP=nullptr)
evalBind - Handle the semantics of binding a value to a specific location.
CheckerManager & getCheckerManager() const
void VisitLogicalExpr(const BinaryOperator *B, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitLogicalExpr - Transfer function logic for '&&', '||'.
const VarRegion * getCapturedRegion() const
UnaryExprOrTypeTraitExpr - expression with either a type or (unevaluated) expression operand...
Represents a single basic block in a source-level CFG.
void VisitInitListExpr(const InitListExpr *E, ExplodedNode *Pred, ExplodedNodeSet &Dst)
QuantityType getQuantity() const
getQuantity - Get the raw integer representation of this quantity.
llvm::APSInt EvaluateKnownConstInt(const ASTContext &Ctx, SmallVectorImpl< PartialDiagnosticAt > *Diag=nullptr) const
EvaluateKnownConstInt - Call EvaluateAsRValue and return the folded integer.
void runCheckersForPostStmt(ExplodedNodeSet &Dst, const ExplodedNodeSet &Src, const Stmt *S, ExprEngine &Eng, bool wasInlined=false)
Run checkers for post-visiting Stmts.
DefinedOrUnknownSVal makeZeroVal(QualType type)
Construct an SVal representing '0' for the specified type.
Pepresents a block literal declaration, which is like an unnamed FunctionDecl.
Represent the declaration of a variable (in which case it is an lvalue) a function (in which case it ...
This represents one expression.
static SVal conjureOffsetSymbolOnLocation(SVal Symbol, SVal Other, Expr *Expression, SValBuilder &svalBuilder, unsigned Count, const LocationContext *LCtx)
Optionally conjure and return a symbol for offset when processing an expression Expression.
void VisitCast(const CastExpr *CastE, const Expr *Ex, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitCast - Transfer function logic for all casts (implicit and explicit).
BlockExpr - Adaptor class for mixing a BlockDecl with expressions.
unsigned getNumInits() const
const ExplodedNodeSet & getResults()
bool isAnyComplexType() const
static CharUnits fromQuantity(QuantityType Quantity)
fromQuantity - Construct a CharUnits quantity from a raw integer type.
static SVal getValue(SVal val, SValBuilder &svalBuilder)
bool isSignedIntegerType() const
Return true if this is an integer type that is signed, according to C99 6.2.5p4 [char, signed char, short, int, long..], or an enum decl which has a signed representation.
const CFGBlock * getDst() const
QualType getTypeOfArgument() const
Gets the argument type, or the type of the argument expression, whichever is appropriate.
The reason for pointer escape is unknown.
ASTContext & getContext() const
getContext - Return the ASTContext associated with this analysis.
UnaryOperator - This represents the unary-expression's (except sizeof and alignof), the postinc/postdec operators from postfix-expression, and various extensions.
void evalLoad(ExplodedNodeSet &Dst, const Expr *NodeEx, const Expr *BoundExpr, ExplodedNode *Pred, ProgramStateRef St, SVal location, const ProgramPointTag *tag=nullptr, QualType LoadTy=QualType())
Simulate a read of the result of Ex.
reverse_iterator rbegin()
Optional< T > getAs() const
Convert to the specified SVal type, returning None if this SVal is not of the desired type...
const VarDecl * getDecl() const
CFGTerminator getTerminator()
OpaqueValueExpr - An expression referring to an opaque object of a fixed type and value class...
bool isBuiltinType() const
Helper methods to distinguish type categories.
void VisitGuardedExpr(const Expr *Ex, const Expr *L, const Expr *R, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitGuardedExpr - Transfer function logic for ?, __builtin_choose.
DefinedOrUnknownSVal conjureSymbolVal(const void *symbolTag, const Expr *expr, const LocationContext *LCtx, unsigned count)
Create a new symbol with a unique 'name'.
Expr * getSubExpr() const
T castAs() const
Convert to the specified ProgramPoint type, asserting that this ProgramPoint is of the desired type...
CastKind getCastKind() const
const MemRegion * getAsRegion() const
DeclStmt - Adaptor class for mixing declarations with statements and expressions. ...
void VisitCompoundLiteralExpr(const CompoundLiteralExpr *CL, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitCompoundLiteralExpr - Transfer function logic for compound literals.
ProgramStateRef handleLVectorSplat(ProgramStateRef state, const LocationContext *LCtx, const CastExpr *CastE, StmtNodeBuilder &Bldr, ExplodedNode *Pred)
ProgramPoint getLocation() const
getLocation - Returns the edge associated with the given node.
SVal - This represents a symbolic expression, which can be either an L-value or an R-value...
UnaryExprOrTypeTrait getKind() const
decl_iterator decl_begin()
void VisitUnaryExprOrTypeTraitExpr(const UnaryExprOrTypeTraitExpr *Ex, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitUnaryExprOrTypeTraitExpr - Transfer function for sizeof.
bool isAnyPointerType() const
BasicValueFactory & getBasicVals()
void runCheckersForPreStmt(ExplodedNodeSet &Dst, const ExplodedNodeSet &Src, const Stmt *S, ExprEngine &Eng)
Run checkers for pre-visiting Stmts.
bool isVectorType() const
void insert(const ExplodedNodeSet &S)
const Expr * getInitializer() const
Dataflow Directional Tag Classes.
void VisitIncrementDecrementOperator(const UnaryOperator *U, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Handle ++ and – (both pre- and post-increment).
SValBuilder & getSValBuilder()
EvalResult is a struct with detailed info about an evaluated expression.
void addNodes(const ExplodedNodeSet &S)
StoreManager & getStoreManager()
bool isZeroConstant() const
const Expr * getInit() const
bool isBooleanType() const
SVal evalEQ(ProgramStateRef state, SVal lhs, SVal rhs)
ExplicitCastExpr - An explicit cast written in the source code.
bool isSingleDecl() const
isSingleDecl - This method returns true if this DeclStmt refers to a single Decl. ...
ProgramStateRef handleLValueBitCast(ProgramStateRef state, const Expr *Ex, const LocationContext *LCtx, QualType T, QualType ExTy, const CastExpr *CastE, StmtNodeBuilder &Bldr, ExplodedNode *Pred)
T castAs() const
Convert to the specified SVal type, asserting that this SVal is of the desired type.
bool isConstantSizeType() const
Return true if this is not a variable sized type, according to the rules of C99 6.7.5p3.
DefinedSVal getMemberPointer(const DeclaratorDecl *DD)
static bool isAdditiveOp(Opcode Opc)
uint64_t getTypeSize(QualType T) const
Return the size of the specified (complete) type T, in bits.
bool isIncompleteType(NamedDecl **Def=nullptr) const
Types are partitioned into 3 broad categories (C99 6.2.5p1): object types, function types...
static bool isIncrementOp(Opcode Op)
CanQualType getCanonicalType(QualType T) const
Return the canonical (structural) type corresponding to the specified potentially non-canonical type ...
bool isLValueReferenceType() const
X
Add a minimal nested name specifier fixit hint to allow lookup of a tag name from an outer enclosing ...
void VisitBlockExpr(const BlockExpr *BE, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitBlockExpr - Transfer function logic for BlockExprs.
Defines the C++ Decl subclasses, other than those for templates (found in DeclTemplate.h) and friends (in DeclFriend.h).
static bool isCompoundAssignmentOp(Opcode Opc)
QualType getRValueReferenceType(QualType T) const
Return the uniqued reference to the type for an rvalue reference to the specified type...
pred_iterator pred_begin()
Represents a top-level expression in a basic block.
QualType getPointerType(QualType T) const
Return the uniqued reference to the type for a pointer to the specified type.
This class is used for builtin types like 'int'.
Represents CFGBlock terminator statement.
ExplodedNode * generateNode(const Stmt *S, ExplodedNode *Pred, ProgramStateRef St, const ProgramPointTag *tag=nullptr, ProgramPoint::Kind K=ProgramPoint::PostStmtKind)
A reference to a declared variable, function, enum, etc.
nonloc::ConcreteInt makeTruthVal(bool b, QualType type)
ProgramStateRef escapeValue(ProgramStateRef State, SVal V, PointerEscapeKind K) const
A simple wrapper when you only need to notify checkers of pointer-escape of a single value...
Optional< T > getAs() const
Convert to the specified ProgramPoint type, returning None if this ProgramPoint is not of the desired...
OffsetOfExpr - [C99 7.17] - This represents an expression of the form offsetof(record-type, member-designator).
void VisitBinaryOperator(const BinaryOperator *B, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitBinaryOperator - Transfer function logic for binary operators.
bool isUnknownOrUndef() const
llvm::ImmutableList< SVal > getEmptySValList()
Expr * IgnoreParens() LLVM_READONLY
IgnoreParens - Ignore parentheses.