32 #include "llvm/ADT/APSInt.h" 33 #include "llvm/ADT/Optional.h" 34 #include "llvm/ADT/SmallVector.h" 35 #include "llvm/Support/Casting.h" 36 #include "llvm/Support/ErrorHandling.h" 40 using namespace clang;
44 : svalBuilder(stateMgr.getSValBuilder()), StateMgr(stateMgr),
45 MRMgr(svalBuilder.getRegionManager()), Ctx(stateMgr.getContext()) {}
55 for (
const auto &I : InitialBindings)
87 if (isa<CodeTextRegion>(R) || isa<SymbolicRegion>(R))
106 if (
const auto *TR = dyn_cast<TypedValueRegion>(R)) {
108 if (CanonPointeeTy == ObjTy)
114 case MemRegion::CXXThisRegionKind:
115 case MemRegion::CodeSpaceRegionKind:
116 case MemRegion::StackLocalsSpaceRegionKind:
117 case MemRegion::StackArgumentsSpaceRegionKind:
118 case MemRegion::HeapSpaceRegionKind:
119 case MemRegion::UnknownSpaceRegionKind:
120 case MemRegion::StaticGlobalSpaceRegionKind:
121 case MemRegion::GlobalInternalSpaceRegionKind:
122 case MemRegion::GlobalSystemSpaceRegionKind:
123 case MemRegion::GlobalImmutableSpaceRegionKind: {
124 llvm_unreachable(
"Invalid region cast");
127 case MemRegion::FunctionCodeRegionKind:
128 case MemRegion::BlockCodeRegionKind:
129 case MemRegion::BlockDataRegionKind:
130 case MemRegion::StringRegionKind:
132 case MemRegion::SymbolicRegionKind:
133 case MemRegion::AllocaRegionKind:
134 case MemRegion::CompoundLiteralRegionKind:
135 case MemRegion::FieldRegionKind:
136 case MemRegion::ObjCIvarRegionKind:
137 case MemRegion::ObjCStringRegionKind:
138 case MemRegion::VarRegionKind:
139 case MemRegion::CXXTempObjectRegionKind:
140 case MemRegion::CXXBaseObjectRegionKind:
141 case MemRegion::CXXDerivedObjectRegionKind:
144 case MemRegion::ElementRegionKind: {
166 const MemRegion *baseR = rawOff.getRegion();
179 if (
const auto *TR = dyn_cast<TypedValueRegion>(baseR)) {
182 if (CanonPointeeTy == ObjTy)
197 int64_t newIndex = 0;
204 if (!pointeeTySize.
isZero()) {
208 if (off % pointeeTySize == 0) {
209 newIndex = off / pointeeTySize;
226 llvm_unreachable(
"unreachable");
230 const MemRegion *MR = V.getAsRegion();
234 const auto *TVR = dyn_cast<TypedValueRegion>(MR);
238 const CXXRecordDecl *RD = TVR->getValueType()->getAsCXXRecordDecl();
256 SVal Result = Derived;
267 SVal Result = Derived;
268 for (
const auto &I : Path)
270 I.Base->isVirtual());
283 assert(BaseDecl &&
"not a C++ object?");
285 if (
const auto *AlreadyDerivedReg =
286 dyn_cast<CXXDerivedObjectRegion>(DerivedReg)) {
288 dyn_cast<SymbolicRegion>(AlreadyDerivedReg->getSuperRegion()))
289 if (SR->getSymbol()->getType()->getPointeeCXXRecordDecl() == BaseDecl)
292 DerivedReg = AlreadyDerivedReg->getSuperRegion();
296 BaseDecl, cast<SubRegion>(DerivedReg), IsVirtual);
308 if (
const auto *TVR = dyn_cast<TypedValueRegion>(MR))
309 return TVR->getValueType()->getAsCXXRecordDecl();
310 if (
const auto *SR = dyn_cast<SymbolicRegion>(MR))
311 return SR->getSymbol()->getType()->getPointeeCXXRecordDecl();
325 assert(!TargetType.
isNull());
327 if (!TargetClass && !TargetType->
isVoidType())
334 if (MRClass == TargetClass)
340 if (!TargetType->
isVoidType() && MRClass->hasDefinition()) {
345 if (MRClass->isDerivedFrom(TargetClass, Paths))
349 if (
const auto *BaseR = dyn_cast<CXXBaseObjectRegion>(MR)) {
351 MR = BaseR->getSuperRegion();
368 if (Uncasted == MR) {
383 if (
const auto *SR = dyn_cast<SymbolicRegion>(MR)) {
384 QualType T = SR->getSymbol()->getType();
386 if (TargetClass && SourceClass && TargetClass->
isDerivedFrom(SourceClass))
393 Failed = isa<TypedValueRegion>(MR);
425 if (
const auto *SR = dyn_cast_or_null<SymbolicRegion>(V.
getAsRegion()))
426 if (SR->getSymbol()->getType().getCanonicalType() !=
441 case loc::MemRegionValKind:
445 case loc::GotoLabelKind:
449 case loc::ConcreteIntKind:
463 llvm_unreachable(
"Unhandled Base.");
468 if (
const auto *
ID = dyn_cast<ObjCIvarDecl>(D))
475 return getLValueFieldOrIvar(decl, base);
511 SVal BaseIdx = ElemR->getIndex();
516 const llvm::APSInt &BaseIdxI =
523 if (isa<ElementRegion>(BaseRegion->
StripCasts()))
527 elementType, Offset, cast<SubRegion>(ElemR->getSuperRegion()),
Ctx));
531 assert(BaseIdxI.isSigned());
538 const SubRegion *ArrayR = cast<SubRegion>(ElemR->getSuperRegion());
550 if (!SymV || SymV != Sym)
Defines the clang::ASTContext interface.
SVal attemptDownCast(SVal Base, QualType DerivedPtrType, bool &Failed)
Attempts to do a down cast.
TypedValueRegion - An abstract class representing regions having a typed value.
SVal evalDerivedToBase(SVal Derived, const CastExpr *Cast)
Evaluates a chain of derived-to-base casts through the path specified in Cast.
A (possibly-)qualified type.
MemRegion - The root abstract class for all memory regions.
bool isBlockPointerType() const
QualType getPointeeType() const
If this is a pointer, ObjC object pointer, or block pointer, this returns the respective pointee...
C Language Family Type Representation.
Decl - This represents one declaration (or definition), e.g.
bool isDerivedFrom(const CXXRecordDecl *Base) const
Determine whether this class is derived from the class Base.
bool isZero() const
isZero - Test whether the quantity equals zero.
Represents a path from a specific derived class (which is not represented as part of the path) to a p...
Value representing integer constant.
const ObjCIvarRegion * getObjCIvarRegion(const ObjCIvarDecl *ivd, const SubRegion *superRegion)
getObjCIvarRegion - Retrieve or create the memory region associated with a specified Objective-c inst...
const CXXBaseSpecifier *const * path_const_iterator
SymbolRef getAsLocSymbol(bool IncludeBaseRegions=false) const
If this SVal is a location and wraps a symbol, return that SymbolRef.
virtual SVal dispatchCast(SVal val, QualType castTy)=0
const void * Store
Store - This opaque type encapsulates an immutable mapping from locations to values.
NonLoc makeArrayIndex(uint64_t idx)
const ElementRegion * GetElementZeroRegion(const SubRegion *R, QualType T)
QualType getLocalUnqualifiedType() const
Return this type with all of the instance-specific qualifiers removed, but without removing any quali...
const MemRegion * castRegion(const MemRegion *region, QualType CastToTy)
castRegion - Used by ExprEngine::VisitCast to handle casts from a MemRegion* to a specific location t...
bool HandleBinding(StoreManager &SMgr, Store store, const MemRegion *R, SVal val) override
Holds long-lived AST nodes (such as types and decls) that can be referred to throughout the semantic ...
static bool regionMatchesCXXRecordType(SVal V, QualType Ty)
CharUnits - This is an opaque type for sizes expressed in character units.
Forward-declares and imports various common LLVM datatypes that clang wants to use unqualified...
path_iterator path_begin()
CXXRecordDecl * getCanonicalDecl() override
Retrieves the "canonical" declaration of the given declaration.
CastExpr - Base class for type casts, including both implicit casts (ImplicitCastExpr) and explicit c...
StoreRef enterStackFrame(Store store, const CallEvent &Call, const StackFrameContext *CalleeCtx)
enterStackFrame - Let the StoreManager to do something when execution engine is about to execute into...
virtual QualType getType() const =0
virtual SVal getLValueIvar(const ObjCIvarDecl *decl, SVal base)
SymbolRef getAsSymbol(bool IncludeBaseRegions=false) const
If this SVal wraps a symbol return that SymbolRef.
CXXRecordDecl * getAsCXXRecordDecl() const
Retrieves the CXXRecordDecl that this type refers to, either because the type is a RecordType or beca...
unsigned getSubKind() const
QuantityType getQuantity() const
getQuantity - Get the raw integer representation of this quantity.
SValBuilder & svalBuilder
const CXXRecordDecl * getPointeeCXXRecordDecl() const
If this is a pointer or reference to a RecordType, return the CXXRecordDecl that the type refers to...
const internal::VariadicAllOfMatcher< Decl > decl
Matches declarations.
static SVal getValue(SVal val, SValBuilder &svalBuilder)
ProgramStateManager & StateMgr
virtual StoreRef Bind(Store store, Loc loc, SVal val)=0
Return a store with the specified value bound to the given location.
bool isNull() const
Return true if this QualType doesn't point to a type yet.
NonLoc makeZeroArrayIndex()
Optional< T > getAs() const
Convert to the specified SVal type, returning None if this SVal is not of the desired type...
virtual bool isBoundable() const
bool isVoidPointerType() const
QualType getCanonicalType() const
virtual void getInitialStackFrameContents(const StackFrameContext *CalleeCtx, BindingsTy &Bindings) const =0
Populates the given SmallVector with the bindings in the callee's stack frame at the start of this ca...
const MemRegion * getAsRegion() const
ASTContext & getContext()
SVal - This represents a symbolic expression, which can be either an L-value or an R-value...
const CXXDerivedObjectRegion * getCXXDerivedObjectRegion(const CXXRecordDecl *BaseClass, const SubRegion *Super)
Create a CXXDerivedObjectRegion with the given derived class for region Super.
bool isObjCObjectPointerType() const
virtual ~BindingsHandler()
RegionRawOffset getAsArrayOffset() const
Compute the offset within the array. The array might also be a subobject.
const CXXBaseObjectRegion * getCXXBaseObjectRegion(const CXXRecordDecl *BaseClass, const SubRegion *Super, bool IsVirtual)
Create a CXXBaseObjectRegion with the given base class for region Super.
Dataflow Directional Tag Classes.
const ElementRegion * getElementRegion(QualType elementType, NonLoc Idx, const SubRegion *superRegion, ASTContext &Ctx)
getElementRegion - Retrieve the memory region associated with the associated element type...
const MemRegion * StripCasts(bool StripBaseAndDerivedCasts=true) const
Represents an abstract call to a function or method along a particular path.
SVal convertToArrayIndex(SVal val)
ASTContext & getContext()
T castAs() const
Convert to the specified SVal type, asserting that this SVal is of the desired type.
BasicValueFactory & getBasicValueFactory()
SubRegion - A region that subsets another larger region.
const ElementRegion * MakeElementRegion(const SubRegion *baseRegion, QualType pointeeTy, uint64_t index=0)
SVal CastRetrievedVal(SVal val, const TypedValueRegion *region, QualType castTy)
CastRetrievedVal - Used by subclasses of StoreManager to implement implicit casts that arise from loa...
MemRegionManager & MRMgr
MRMgr - Manages region objects associated with this StoreManager.
bool isIncompleteType(NamedDecl **Def=nullptr) const
Types are partitioned into 3 broad categories (C99 6.2.5p1): object types, function types...
virtual SVal getLValueElement(QualType elementType, NonLoc offset, SVal Base)
CanQualType getCanonicalType(QualType T) const
Return the canonical (structural) type corresponding to the specified potentially non-canonical type ...
Defines the C++ Decl subclasses, other than those for templates (found in DeclTemplate.h) and friends (in DeclFriend.h).
static const CXXRecordDecl * getCXXRecordType(const MemRegion *MR)
Returns the static type of the given region, if it represents a C++ class object. ...
Represents a C++ struct/union/class.
ObjCIvarDecl - Represents an ObjC instance variable.
ElementRegion is used to represent both array elements and casts.
bool isPointerType() const
BasePaths - Represents the set of paths from a derived class to one of its (direct or indirect) bases...
CharUnits getTypeSizeInChars(QualType T) const
Return the size of the specified (complete) type T, in characters.
bool isFloatingType() const
StoreManager(ProgramStateManager &stateMgr)
const FieldRegion * getFieldRegion(const FieldDecl *fd, const SubRegion *superRegion)
getFieldRegion - Retrieve or create the memory region associated with a specified FieldDecl...
bool isUnknownOrUndef() const