19 using namespace clang;
41 SVal LeftV = state->getSVal(LHS, LCtx);
42 SVal RightV = state->getSVal(RHS, LCtx);
46 if (Op == BO_Assign) {
57 evalStore(Tmp2, B, LHS, *it, state->BindExpr(B, LCtx, ExprVal),
90 state = createTemporaryRegionIfNeeded(state, LCtx, LHS);
100 state = state->BindExpr(B, LCtx, Result);
109 llvm_unreachable(
"Invalid opcode for compound assignment.");
110 case BO_MulAssign: Op = BO_Mul;
break;
111 case BO_DivAssign: Op = BO_Div;
break;
112 case BO_RemAssign: Op = BO_Rem;
break;
113 case BO_AddAssign: Op = BO_Add;
break;
114 case BO_SubAssign: Op = BO_Sub;
break;
115 case BO_ShlAssign: Op = BO_Shl;
break;
116 case BO_ShrAssign: Op = BO_Shr;
break;
117 case BO_AndAssign: Op = BO_And;
break;
118 case BO_XorAssign: Op = BO_Xor;
break;
119 case BO_OrAssign: Op = BO_Or;
break;
125 SVal location = LeftV;
126 evalLoad(Tmp, B, LHS, *it, state, location);
131 state = (*I)->getState();
133 SVal V = state->getSVal(LHS, LCtx);
137 cast<CompoundAssignOperator>(B)->getComputationResultType();
141 cast<CompoundAssignOperator>(B)->getComputationLHSType();
147 V = svalBuilder.
evalCast(V, CLHSTy, LTy);
165 Result = svalBuilder.
evalCast(LHSVal, CTy, LTy);
170 LHSVal = svalBuilder.
evalCast(Result, LTy, CTy);
176 state = state->BindExpr(B, LCtx, location);
178 state = state->BindExpr(B, LCtx, Result);
180 evalStore(Tmp2, B, LHS, *
I, state, location, LHSVal);
204 dyn_cast_or_null<BlockDataRegion>(V.
getAsRegion())) {
207 E = BDR->referenced_vars_end();
211 for (; I !=
E; ++
I) {
221 const Expr *copyExpr =
nullptr;
223 assert(CI->getVariable() == capturedR->
getDecl());
224 copyExpr = CI->getCopyExpr();
228 if (capturedR != originalR) {
232 originalV = State->getSVal(copyExpr, LCtx);
256 SVal V = state->getSVal(Ex, LCtx);
257 V = svalBuilder.
evalCast(V, T, ExTy);
259 if (CastE->
getCastKind() == CK_BooleanToSignedIntegral)
261 state = state->BindExpr(CastE, LCtx, V);
277 state = state->BindExpr(CastE, LCtx, result);
295 evalLoad(Dst, CastE, CastE, subExprNode, state, state->getSVal(Ex, LCtx));
304 if (
const ExplicitCastExpr *ExCast=dyn_cast_or_null<ExplicitCastExpr>(CastE))
305 T = ExCast->getTypeAsWritten();
316 case CK_LValueToRValue:
317 llvm_unreachable(
"LValueToRValue casts handled earlier.");
322 case CK_ARCProduceObject:
323 case CK_ARCConsumeObject:
324 case CK_ARCReclaimReturnedObject:
325 case CK_ARCExtendBlockObject:
326 case CK_CopyAndAutoreleaseBlockObject:
330 case CK_AtomicToNonAtomic:
331 case CK_NonAtomicToAtomic:
334 case CK_ConstructorConversion:
335 case CK_UserDefinedConversion:
336 case CK_FunctionToPointerDecay:
337 case CK_BuiltinFnToFnPtr: {
341 SVal V = state->getSVal(Ex, LCtx);
342 state = state->BindExpr(CastE, LCtx, V);
346 case CK_MemberPointerToBoolean:
347 case CK_PointerToBoolean: {
348 SVal V = state->getSVal(Ex, LCtx);
351 V = svalBuilder.
makeTruthVal(!PTMSV->isNullMemberPointer(), ExTy);
353 state = state->BindExpr(CastE, LCtx, V);
363 case CK_ArrayToPointerDecay:
365 case CK_AddressSpaceConversion:
366 case CK_BooleanToSignedIntegral:
367 case CK_NullToPointer:
368 case CK_IntegralToPointer:
369 case CK_PointerToIntegral: {
370 SVal V = state->getSVal(Ex, LCtx);
372 state = state->BindExpr(CastE, LCtx,
UnknownVal());
381 case CK_IntegralToBoolean:
382 case CK_IntegralToFloating:
383 case CK_FloatingToIntegral:
384 case CK_FloatingToBoolean:
385 case CK_FloatingCast:
386 case CK_FloatingRealToComplex:
387 case CK_FloatingComplexToReal:
388 case CK_FloatingComplexToBoolean:
389 case CK_FloatingComplexCast:
390 case CK_FloatingComplexToIntegralComplex:
391 case CK_IntegralRealToComplex:
392 case CK_IntegralComplexToReal:
393 case CK_IntegralComplexToBoolean:
394 case CK_IntegralComplexCast:
395 case CK_IntegralComplexToFloatingComplex:
396 case CK_CPointerToObjCPointerCast:
397 case CK_BlockPointerToObjCPointerCast:
398 case CK_AnyPointerToBlockPointerCast:
399 case CK_ObjCObjectLValueCast:
400 case CK_ZeroToOCLEvent:
401 case CK_ZeroToOCLQueue:
402 case CK_IntToOCLSampler:
403 case CK_LValueBitCast: {
408 case CK_IntegralCast: {
410 SVal V = state->getSVal(Ex, LCtx);
412 state = state->BindExpr(CastE, LCtx, V);
416 case CK_DerivedToBase:
417 case CK_UncheckedDerivedToBase: {
419 SVal val = state->getSVal(Ex, LCtx);
421 state = state->BindExpr(CastE, LCtx, val);
427 SVal val = state->getSVal(Ex, LCtx);
451 state = state->BindExpr(CastE, LCtx, svalBuilder.
makeNull());
459 state = state->BindExpr(CastE, LCtx, NewSym);
462 state = state->BindExpr(CastE, LCtx, val);
467 case CK_BaseToDerived: {
468 SVal val = state->getSVal(Ex, LCtx);
485 state = state->BindExpr(CastE, LCtx, val);
489 case CK_NullToMemberPointer: {
491 state = state->BindExpr(CastE, LCtx, V);
495 case CK_DerivedToBaseMemberPointer:
496 case CK_BaseToDerivedMemberPointer:
497 case CK_ReinterpretMemberPointer: {
498 SVal V = state->getSVal(Ex, LCtx);
502 llvm::make_range<CastExpr::path_const_iterator>(
504 state = state->BindExpr(CastE, LCtx, CastedPTMSV);
514 case CK_VectorSplat: {
533 if (isa<CXXConstructExpr>(Init)) {
536 assert(isa<InitListExpr>(Init));
537 Loc CLLoc = State->getLValue(CL, LCtx);
538 State = State->bindLoc(CLLoc, V, LCtx);
575 SVal InitVal = state->getSVal(InitEx, LC);
578 if (
auto *CtorExpr = findDirectConstructorForCurrentCFGElement()) {
579 assert(InitEx->IgnoreImplicit() == CtorExpr);
591 InitVal = state->getSVal(M->getRegion());
600 if (InitEx->isGLValue()) {
611 evalBind(Dst2, DS, UpdatedN, state->getLValue(VD, LC), InitVal,
true);
652 assert(Term->isLogicalOp());
662 assert(!SrcBlock->
empty());
664 const Expr *RHS = cast<Expr>(Elem.getStmt());
667 if (RHSVal.isUndef()) {
699 if (NumInitElements == 0) {
706 ei = IE->
rend(); it != ei; ++it) {
707 SVal V = state->getSVal(cast<Expr>(*it), LCtx);
712 state->BindExpr(IE, LCtx,
720 assert(NumInitElements <= 1);
723 if (NumInitElements == 0)
726 V = state->getSVal(IE->
getInit(0), LCtx);
748 assert(N->pred_size() == 1);
752 SrcState = N->getState();
756 assert(SrcBlock &&
"missing function entry");
760 bool hasValue =
false;
763 for (
CFGElement CE : llvm::reverse(*SrcBlock)) {
765 const Expr *ValEx = cast<Expr>(CS->getStmt());
771 L = OpaqueEx->getSourceExpr();
777 V = SrcState->getSVal(ValEx, LCtx);
788 B.
generateNode(Ex, Pred, state->BindExpr(Ex, LCtx, V,
true));
844 state = state->BindExpr(Ex, (*I)->getLocationContext(),
867 state->getSVal(Ex, LCtx)));
903 state->getSVal(Ex, LCtx)));
925 if (
const DeclRefExpr *DRE = dyn_cast<DeclRefExpr>(Ex)) {
928 if (isa<CXXMethodDecl>(VD) || isa<FieldDecl>(VD)) {
958 SVal V = state->getSVal(Ex, LCtx);
967 llvm_unreachable(
"Invalid Opcode.");
985 }
else if (Ex->getType()->isFloatingType()) {
994 state = state->BindExpr(U, LCtx, Result);
1015 SVal loc = state->getSVal(Ex, LCtx);
1019 evalLoad(Tmp, U, Ex, Pred, state, loc);
1025 state = (*I)->getState();
1026 assert(LCtx == (*I)->getLocationContext());
1027 SVal V2_untested = state->getSVal(Ex, LCtx);
1030 if (V2_untested.isUnknownOrUndef()) {
1031 Bldr.
generateNode(U, *
I, state->BindExpr(U, LCtx, V2_untested));
1067 if (!state->assume(Constraint,
true)) {
1070 Constraint = svalBuilder.
evalEQ(state, SymVal,
1074 state = state->assume(Constraint,
false);
1083 state = state->BindExpr(U, LCtx, loc);
1090 evalStore(Dst3, U, U, *
I, state, loc, Result);
SVal attemptDownCast(SVal Base, QualType DerivedPtrType, bool &Failed)
Attempts to do a down cast.
unsigned getNumInits() const
CastKind getCastKind() const
nonloc::ConcreteInt makeIntVal(const IntegerLiteral *integer)
DefinedSVal getBlockPointer(const BlockDecl *block, CanQualType locTy, const LocationContext *locContext, unsigned blockCount)
reverse_iterator rbegin()
SVal evalDerivedToBase(SVal Derived, const CastExpr *Cast)
Evaluates a chain of derived-to-base casts through the path specified in Cast.
A (possibly-)qualified type.
succ_iterator succ_begin()
This builder class is useful for generating nodes that resulted from visiting a statement.
QuantityType getQuantity() const
getQuantity - Get the raw integer representation of this quantity.
bool isRecordType() const
ProgramPoint getLocation() const
getLocation - Returns the edge associated with the given node.
SVal evalBinOp(ProgramStateRef state, BinaryOperator::Opcode op, NonLoc L, NonLoc R, QualType T)
unsigned pred_size() const
Represents a point after we ran remove dead bindings BEFORE processing the given statement.
const Expr * getInit() const
SVal evalCast(SVal val, QualType castTy, QualType originalType)
Value representing integer constant.
void VisitUnaryOperator(const UnaryOperator *B, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitUnaryOperator - Transfer function logic for unary operators.
void takeNodes(const ExplodedNodeSet &S)
void handleUOExtension(ExplodedNodeSet::iterator I, const UnaryOperator *U, StmtNodeBuilder &Bldr)
VarDecl - An instance of this class is created to represent a variable declaration or definition...
CompoundLiteralExpr - [C99 6.5.2.5].
unsigned succ_size() const
NonLoc makeArrayIndex(uint64_t idx)
uint64_t getTypeSize(QualType T) const
Return the size of the specified (complete) type T, in bits.
void evalStore(ExplodedNodeSet &Dst, const Expr *AssignE, const Expr *StoreE, ExplodedNode *Pred, ProgramStateRef St, SVal TargetLV, SVal Val, const ProgramPointTag *tag=nullptr)
evalStore - Handle the semantics of a store via an assignment.
UnaryExprOrTypeTrait getKind() const
static bool isAssignmentOp(Opcode Opc)
bool isZeroConstant() const
Defines the clang::Expr interface and subclasses for C++ expressions.
InitExprsTy::const_reverse_iterator const_reverse_iterator
ImplTy::iterator iterator
Represents a class type in Objective C.
Value representing pointer-to-member.
SVal evalIntegralCast(ProgramStateRef state, SVal val, QualType castTy, QualType originalType)
Loc makeNullWithType(QualType type)
Create NULL pointer, with proper pointer bit-width for given address space.
bool isReferenceType() const
bool isAnyPointerType() const
static bool isIncrementDecrementOp(Opcode Op)
T castAs() const
Convert to the specified CFGElement type, asserting that this CFGElement is of the desired type...
ASTContext & getContext() const
getContext - Return the ASTContext associated with this analysis.
i32 captured_struct **param SharedsTy A type which contains references the shared variables *param Shareds Context with the list of shared variables from the p *TaskFunction *param Data Additional data for task generation like final * state
const VarDecl * getDecl() const
llvm::ImmutableList< SVal > prependSVal(SVal X, llvm::ImmutableList< SVal > L)
static bool isLocType(QualType T)
Describes an C or C++ initializer list.
void VisitOffsetOfExpr(const OffsetOfExpr *Ex, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitOffsetOfExpr - Transfer function for offsetof.
BlockDataRegion - A region that represents a block instance.
ExplodedNode * generateSink(const Stmt *S, ExplodedNode *Pred, ProgramStateRef St, const ProgramPointTag *tag=nullptr, ProgramPoint::Kind K=ProgramPoint::PostStmtKind)
CharUnits - This is an opaque type for sizes expressed in character units.
path_iterator path_begin()
bool isUnknownOrUndef() const
A builtin binary operation expression such as "x + y" or "x <= y".
NonLoc makePointerToMember(const DeclaratorDecl *DD)
static bool isPostfix(Opcode Op)
isPostfix - Return true if this is a postfix operation, like x++.
NonLoc makeCompoundVal(QualType type, llvm::ImmutableList< SVal > vals)
CastExpr - Base class for type casts, including both implicit casts (ImplicitCastExpr) and explicit c...
bool isIncompleteType(NamedDecl **Def=nullptr) const
Types are partitioned into 3 broad categories (C99 6.2.5p1): object types, function types...
SVal evalComplement(SVal X)
void VisitDeclStmt(const DeclStmt *DS, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitDeclStmt - Transfer function logic for DeclStmts.
detail::InMemoryDirectory::const_iterator I
void evalBind(ExplodedNodeSet &Dst, const Stmt *StoreE, ExplodedNode *Pred, SVal location, SVal Val, bool atDeclInit=false, const ProgramPoint *PP=nullptr)
evalBind - Handle the semantics of binding a value to a specific location.
void VisitLogicalExpr(const BinaryOperator *B, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitLogicalExpr - Transfer function logic for '&&', '||'.
const LocationContext * getLocationContext() const
const CFGBlock * getSrc() const
UnaryExprOrTypeTraitExpr - expression with either a type or (unevaluated) expression operand...
CFGBlock - Represents a single basic block in a source-level CFG.
void VisitInitListExpr(const InitListExpr *E, ExplodedNode *Pred, ExplodedNodeSet &Dst)
unsigned blockCount() const
Returns the number of times the current basic block has been visited on the exploded graph path...
CheckerManager & getCheckerManager() const
void runCheckersForPostStmt(ExplodedNodeSet &Dst, const ExplodedNodeSet &Src, const Stmt *S, ExprEngine &Eng, bool wasInlined=false)
Run checkers for post-visiting Stmts.
const CFGBlock * getDst() const
DefinedOrUnknownSVal makeZeroVal(QualType type)
Construct an SVal representing '0' for the specified type.
BlockDecl - This represents a block literal declaration, which is like an unnamed FunctionDecl...
ValueDecl - Represent the declaration of a variable (in which case it is an lvalue) a function (in wh...
Expr - This represents one expression.
const ProgramStateRef & getState() const
bool isAnyComplexType() const
const VarRegion * getCapturedRegion() const
void VisitCast(const CastExpr *CastE, const Expr *Ex, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitCast - Transfer function logic for all casts (implicit and explicit).
BlockExpr - Adaptor class for mixing a BlockDecl with expressions.
capture_const_iterator capture_begin() const
Optional< T > getAs() const
Convert to the specified SVal type, returning None if this SVal is not of the desired type...
bool isVariableArrayType() const
const ExplodedNodeSet & getResults()
static CharUnits fromQuantity(QuantityType Quantity)
fromQuantity - Construct a CharUnits quantity from a raw integer type.
static SVal getValue(SVal val, SValBuilder &svalBuilder)
Expr * getSubExpr() const
T castAs() const
Convert to the specified ProgramPoint type, asserting that this ProgramPoint is of the desired type...
bool EvaluateAsInt(llvm::APSInt &Result, const ASTContext &Ctx, SideEffectsKind AllowSideEffects=SE_NoSideEffects) const
EvaluateAsInt - Return true if this is a constant which we can fold and convert to an integer...
UnaryOperator - This represents the unary-expression's (except sizeof and alignof), the postinc/postdec operators from postfix-expression, and various extensions.
void evalLoad(ExplodedNodeSet &Dst, const Expr *NodeEx, const Expr *BoundExpr, ExplodedNode *Pred, ProgramStateRef St, SVal location, const ProgramPointTag *tag=nullptr, QualType LoadTy=QualType())
Simulate a read of the result of Ex.
reverse_iterator rbegin()
CFGTerminator getTerminator()
OpaqueValueExpr - An expression referring to an opaque object of a fixed type and value class...
bool isIntegralOrEnumerationType() const
Determine whether this type is an integral or enumeration type.
void VisitGuardedExpr(const Expr *Ex, const Expr *L, const Expr *R, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitGuardedExpr - Transfer function logic for ?, __builtin_choose.
DefinedOrUnknownSVal conjureSymbolVal(const void *symbolTag, const Expr *expr, const LocationContext *LCtx, unsigned count)
Create a new symbol with a unique 'name'.
bool isBuiltinType() const
Helper methods to distinguish type categories.
bool isSingleDecl() const
isSingleDecl - This method returns true if this DeclStmt refers to a single Decl. ...
bool isConstantSizeType() const
Return true if this is not a variable sized type, according to the rules of C99 6.7.5p3.
capture_const_iterator capture_end() const
DeclStmt - Adaptor class for mixing declarations with statements and expressions. ...
void VisitCompoundLiteralExpr(const CompoundLiteralExpr *CL, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitCompoundLiteralExpr - Transfer function logic for compound literals.
llvm::APSInt EvaluateKnownConstInt(const ASTContext &Ctx, SmallVectorImpl< PartialDiagnosticAt > *Diag=nullptr) const
EvaluateKnownConstInt - Call EvaluateAsRValue and return the folded integer.
ProgramStateRef handleLVectorSplat(ProgramStateRef state, const LocationContext *LCtx, const CastExpr *CastE, StmtNodeBuilder &Bldr, ExplodedNode *Pred)
const VarRegion * getOriginalRegion() const
SVal - This represents a symbolic expression, which can be either an L-value or an R-value...
decl_iterator decl_begin()
void VisitUnaryExprOrTypeTraitExpr(const UnaryExprOrTypeTraitExpr *Ex, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitUnaryExprOrTypeTraitExpr - Transfer function for sizeof.
bool isVectorType() const
BasicValueFactory & getBasicVals()
void runCheckersForPreStmt(ExplodedNodeSet &Dst, const ExplodedNodeSet &Src, const Stmt *S, ExprEngine &Eng)
Run checkers for pre-visiting Stmts.
const BlockDecl * getBlockDecl() const
void insert(const ExplodedNodeSet &S)
void VisitIncrementDecrementOperator(const UnaryOperator *U, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Handle ++ and – (both pre- and post-increment).
SValBuilder & getSValBuilder()
void addNodes(const ExplodedNodeSet &S)
StoreManager & getStoreManager()
QualType getPointerType(QualType T) const
Return the uniqued reference to the type for a pointer to the specified type.
detail::InMemoryDirectory::const_iterator E
const MemRegion * getAsRegion() const
CanQualType getCanonicalType(QualType T) const
Return the canonical (structural) type corresponding to the specified potentially non-canonical type ...
ExplicitCastExpr - An explicit cast written in the source code.
Optional< T > getAs() const
Convert to the specified ProgramPoint type, returning None if this ProgramPoint is not of the desired...
ProgramStateRef handleLValueBitCast(ProgramStateRef state, const Expr *Ex, const LocationContext *LCtx, QualType T, QualType ExTy, const CastExpr *CastE, StmtNodeBuilder &Bldr, ExplodedNode *Pred)
const T * getAs() const
Member-template getAs<specific type>'.
QualType getTypeOfArgument() const
Gets the argument type, or the type of the argument expression, whichever is appropriate.
DefinedSVal getMemberPointer(const DeclaratorDecl *DD)
static bool isAdditiveOp(Opcode Opc)
const Expr * getInitializer() const
static bool isIncrementOp(Opcode Op)
X
Add a minimal nested name specifier fixit hint to allow lookup of a tag name from an outer enclosing ...
void VisitBlockExpr(const BlockExpr *BE, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitBlockExpr - Transfer function logic for BlockExprs.
Defines the C++ Decl subclasses, other than those for templates (found in DeclTemplate.h) and friends (in DeclFriend.h).
static bool isCompoundAssignmentOp(Opcode Opc)
DefinedOrUnknownSVal evalEQ(ProgramStateRef state, DefinedOrUnknownSVal lhs, DefinedOrUnknownSVal rhs)
pred_iterator pred_begin()
CFGElement - Represents a top-level expression in a basic block.
This class is used for builtin types like 'int'.
CFGTerminator - Represents CFGBlock terminator statement.
ExplodedNode * generateNode(const Stmt *S, ExplodedNode *Pred, ProgramStateRef St, const ProgramPointTag *tag=nullptr, ProgramPoint::Kind K=ProgramPoint::PostStmtKind)
const LangOptions & getLangOpts() const
A reference to a declared variable, function, enum, etc.
nonloc::ConcreteInt makeTruthVal(bool b, QualType type)
const Expr * getInit(unsigned Init) const
OffsetOfExpr - [C99 7.17] - This represents an expression of the form offsetof(record-type, member-designator).
void VisitBinaryOperator(const BinaryOperator *B, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitBinaryOperator - Transfer function logic for binary operators.
bool isSignedIntegerType() const
Return true if this is an integer type that is signed, according to C99 6.2.5p4 [char, signed char, short, int, long..], or an enum decl which has a signed representation.
T castAs() const
Convert to the specified SVal type, asserting that this SVal is of the desired type.
llvm::ImmutableList< SVal > getEmptySValList()
Expr * IgnoreParens() LLVM_READONLY
IgnoreParens - Ignore parentheses.