20 using namespace clang;
25 class BuiltinFunctionChecker :
public Checker<eval::Call> {
27 bool evalCall(
const CallExpr *CE, CheckerContext &C)
const;
32 bool BuiltinFunctionChecker::evalCall(
const CallExpr *CE,
33 CheckerContext &C)
const {
44 case Builtin::BI__builtin_assume: {
46 SVal ArgSVal = C.getSVal(CE->
getArg(0));
47 if (ArgSVal.isUndef())
50 state = state->assume(ArgSVal.castAs<DefinedOrUnknownSVal>(),
true);
54 C.generateSink(C.getState(), C.getPredecessor());
58 C.addTransition(state);
62 case Builtin::BI__builtin_unpredictable:
63 case Builtin::BI__builtin_expect:
64 case Builtin::BI__builtin_assume_aligned:
65 case Builtin::BI__builtin_addressof: {
72 C.addTransition(state->BindExpr(CE, LCtx, X));
76 case Builtin::BI__builtin_alloca_with_align:
77 case Builtin::BI__builtin_alloca: {
79 MemRegionManager& RM = C.getStoreManager().getRegionManager();
80 const AllocaRegion* R =
81 RM.getAllocaRegion(CE, C.blockCount(), C.getLocationContext());
86 auto Size = C.getSVal(*(CE->
arg_begin())).castAs<DefinedOrUnknownSVal>();
88 SValBuilder& svalBuilder = C.getSValBuilder();
89 DefinedOrUnknownSVal Extent = R->getExtent(svalBuilder);
90 DefinedOrUnknownSVal extentMatchesSizeArg =
91 svalBuilder.evalEQ(state, Extent, Size);
92 state = state->assume(extentMatchesSizeArg,
true);
93 assert(state &&
"The region should not have any previous constraints");
95 C.addTransition(state->BindExpr(CE, LCtx, loc::MemRegionVal(R)));
99 case Builtin::BI__builtin_object_size:
100 case Builtin::BI__builtin_constant_p: {
103 SVal V = UnknownVal();
107 llvm::APSInt Result = EVResult.
Val.
getInt();
108 SValBuilder &SVB = C.getSValBuilder();
109 BasicValueFactory &BVF = SVB.getBasicValueFactory();
110 BVF.getAPSIntType(CE->
getType()).apply(Result);
111 V = SVB.makeIntVal(Result);
114 C.addTransition(state->BindExpr(CE, LCtx, V));
120 void ento::registerBuiltinFunctionChecker(CheckerManager &mgr) {
121 mgr.registerChecker<BuiltinFunctionChecker>();
Represents a function declaration or definition.
Expr * getArg(unsigned Arg)
getArg - Return the specified argument.
bool EvaluateAsInt(EvalResult &Result, const ASTContext &Ctx, SideEffectsKind AllowSideEffects=SE_NoSideEffects) const
EvaluateAsInt - Return true if this is a constant which we can fold and convert to an integer...
IntrusiveRefCntPtr< const ProgramState > ProgramStateRef
Strictly evaluate the expression.
i32 captured_struct **param SharedsTy A type which contains references the shared variables *param Shareds Context with the list of shared variables from the p *TaskFunction *param Data Additional data for task generation like final * state
APValue Val
Val - This is the value the expression can be folded to.
Dataflow Directional Tag Classes.
EvalResult is a struct with detailed info about an evaluated expression.
X
Add a minimal nested name specifier fixit hint to allow lookup of a tag name from an outer enclosing ...
unsigned getBuiltinID() const
Returns a value indicating whether this function corresponds to a builtin function.
CallExpr - Represents a function call (C99 6.5.2.2, C++ [expr.call]).
Defines enum values for all the target-independent builtin functions.