|
clang
5.0.0
|
CoreEngine - Implements the core logic of the graph-reachability analysis. More...
#include "clang/StaticAnalyzer/Core/PathSensitive/CoreEngine.h"
Public Types | |
| typedef std::vector< std::pair < BlockEdge, const ExplodedNode * > > | BlocksExhausted |
| typedef std::vector< std::pair < const CFGBlock *, const ExplodedNode * > > | BlocksAborted |
Public Member Functions | |
| CoreEngine (SubEngine &subengine, FunctionSummariesTy *FS) | |
| Construct a CoreEngine object to analyze the provided CFG. More... | |
| ExplodedGraph & | getGraph () |
| getGraph - Returns the exploded graph. More... | |
| bool | ExecuteWorkList (const LocationContext *L, unsigned Steps, ProgramStateRef InitState) |
| ExecuteWorkList - Run the worklist algorithm for a maximum number of steps. More... | |
| bool | ExecuteWorkListWithInitialState (const LocationContext *L, unsigned Steps, ProgramStateRef InitState, ExplodedNodeSet &Dst) |
| Returns true if there is still simulation state on the worklist. More... | |
| void | dispatchWorkItem (ExplodedNode *Pred, ProgramPoint Loc, const WorkListUnit &WU) |
| Dispatch the work list item based on the given location information. More... | |
| bool | wasBlockAborted () const |
| bool | wasBlocksExhausted () const |
| bool | hasWorkRemaining () const |
| void | addAbortedBlock (const ExplodedNode *node, const CFGBlock *block) |
| Inform the CoreEngine that a basic block was aborted because it could not be completely analyzed. More... | |
| WorkList * | getWorkList () const |
| BlocksExhausted::const_iterator | blocks_exhausted_begin () const |
| BlocksExhausted::const_iterator | blocks_exhausted_end () const |
| BlocksAborted::const_iterator | blocks_aborted_begin () const |
| BlocksAborted::const_iterator | blocks_aborted_end () const |
| void | enqueue (ExplodedNodeSet &Set) |
| Enqueue the given set of nodes onto the work list. More... | |
| void | enqueue (ExplodedNodeSet &Set, const CFGBlock *Block, unsigned Idx) |
| Enqueue nodes that were created as a result of processing a statement onto the work list. More... | |
| void | enqueueEndOfFunction (ExplodedNodeSet &Set, const ReturnStmt *RS) |
| enqueue the nodes corresponding to the end of function onto the end of path / work list. More... | |
| void | enqueueStmtNode (ExplodedNode *N, const CFGBlock *Block, unsigned Idx) |
| Enqueue a single node created as a result of statement processing. More... | |
Friends | |
| struct | NodeBuilderContext |
| class | NodeBuilder |
| class | ExprEngine |
| class | CommonNodeBuilder |
| class | IndirectGotoNodeBuilder |
| class | SwitchNodeBuilder |
| class | EndOfFunctionNodeBuilder |
CoreEngine - Implements the core logic of the graph-reachability analysis.
It traverses the CFG and generates the ExplodedGraph. Program "states" are treated as opaque void pointers. The template class CoreEngine (which subclasses CoreEngine) provides the matching component to the engine that knows the actual types for states. Note that this engine only dispatches to transfer functions at the statement and block-level. The analyses themselves must implement any transfer function logic and the sub-expression level (if any).
Definition at line 43 of file CoreEngine.h.
| typedef std::vector<std::pair<const CFGBlock*, const ExplodedNode*> > clang::ento::CoreEngine::BlocksAborted |
Definition at line 56 of file CoreEngine.h.
| typedef std::vector<std::pair<BlockEdge, const ExplodedNode*> > clang::ento::CoreEngine::BlocksExhausted |
Definition at line 53 of file CoreEngine.h.
|
inline |
Construct a CoreEngine object to analyze the provided CFG.
Definition at line 117 of file CoreEngine.h.
|
inline |
Inform the CoreEngine that a basic block was aborted because it could not be completely analyzed.
Definition at line 148 of file CoreEngine.h.
Referenced by clang::ento::ExprEngine::Visit().
|
inline |
Definition at line 160 of file CoreEngine.h.
|
inline |
Definition at line 163 of file CoreEngine.h.
|
inline |
Definition at line 154 of file CoreEngine.h.
|
inline |
Definition at line 157 of file CoreEngine.h.
| void CoreEngine::dispatchWorkItem | ( | ExplodedNode * | Pred, |
| ProgramPoint | Loc, | ||
| const WorkListUnit & | WU | ||
| ) |
Dispatch the work list item based on the given location information.
Use Pred parameter as the predecessor state.
Definition at line 241 of file CoreEngine.cpp.
References clang::ProgramPoint::BlockEdgeKind, clang::ProgramPoint::BlockEntranceKind, clang::ProgramPoint::BlockExitKind, clang::ProgramPoint::CallEnterKind, clang::ProgramPoint::CallExitBeginKind, clang::ProgramPoint::castAs(), clang::ProgramPoint::EpsilonKind, clang::ProgramPoint::getAs(), clang::ento::WorkListUnit::getBlock(), clang::ento::ExplodedNode::getFirstPred(), clang::ento::WorkListUnit::getIndex(), clang::ProgramPoint::getKind(), clang::ento::ExplodedNode::getLocation(), and clang::ento::ExplodedNode::hasSinglePred().
| void CoreEngine::enqueue | ( | ExplodedNodeSet & | Set | ) |
Enqueue the given set of nodes onto the work list.
Definition at line 619 of file CoreEngine.cpp.
References clang::ento::ExplodedNodeSet::begin(), E, clang::ento::ExplodedNodeSet::end(), and I.
Referenced by clang::ento::ExprEngine::processCallEnter(), clang::ento::ExprEngine::ProcessImplicitDtor(), clang::ento::ExprEngine::ProcessInitializer(), clang::ento::ExprEngine::ProcessNewAllocator(), and clang::ento::ExprEngine::ProcessStmt().
| void CoreEngine::enqueue | ( | ExplodedNodeSet & | Set, |
| const CFGBlock * | Block, | ||
| unsigned | Idx | ||
| ) |
Enqueue nodes that were created as a result of processing a statement onto the work list.
Definition at line 626 of file CoreEngine.cpp.
References clang::ento::ExplodedNodeSet::begin(), E, clang::ento::ExplodedNodeSet::end(), and I.
| void CoreEngine::enqueueEndOfFunction | ( | ExplodedNodeSet & | Set, |
| const ReturnStmt * | RS | ||
| ) |
enqueue the nodes corresponding to the end of function onto the end of path / work list.
Definition at line 634 of file CoreEngine.cpp.
References clang::ento::ExplodedNodeSet::begin(), E, clang::ento::ExplodedNodeSet::end(), clang::ento::ExplodedNode::getLocationContext(), clang::LocationContext::getParent(), and I.
Referenced by clang::ento::ExprEngine::processEndOfFunction().
| void CoreEngine::enqueueStmtNode | ( | ExplodedNode * | N, |
| const CFGBlock * | Block, | ||
| unsigned | Idx | ||
| ) |
Enqueue a single node created as a result of statement processing.
Definition at line 554 of file CoreEngine.cpp.
References clang::ento::ExplodedNode::addPredecessor(), clang::CFGElement::castAs(), clang::ProgramPoint::getAs(), getKind(), clang::ento::ExplodedNode::getLocation(), clang::ento::ExplodedNode::getLocationContext(), clang::ento::ExplodedNode::getState(), clang::CFGStmt::getStmt(), clang::ento::ExplodedNode::isSink(), clang::CFGElement::NewAllocator, and clang::ProgramPoint::withTag().
| bool CoreEngine::ExecuteWorkList | ( | const LocationContext * | L, |
| unsigned | Steps, | ||
| ProgramStateRef | InitState | ||
| ) |
ExecuteWorkList - Run the worklist algorithm for a maximum number of steps.
Returns true if there is still simulation state on the worklist.
Definition at line 164 of file CoreEngine.cpp.
References clang::CFGBlock::empty(), clang::ento::WorkList::enqueue(), clang::ento::WorkListUnit::getBlockCounter(), clang::CFGBlock::getBlockID(), clang::LocationContext::getCFG(), clang::LocationContext::getDecl(), clang::BlockEdge::getDst(), clang::CFG::getEntry(), clang::ento::ExplodedNode::getLocation(), clang::ento::WorkListUnit::getNode(), clang::CFG::getNumBlockIDs(), min(), Node, clang::CFGBlock::succ_begin(), and clang::CFGBlock::succ_size().
Referenced by clang::ento::ExprEngine::ExecuteWorkList().
| bool CoreEngine::ExecuteWorkListWithInitialState | ( | const LocationContext * | L, |
| unsigned | Steps, | ||
| ProgramStateRef | InitState, | ||
| ExplodedNodeSet & | Dst | ||
| ) |
Returns true if there is still simulation state on the worklist.
Definition at line 283 of file CoreEngine.cpp.
References clang::ento::ExplodedNodeSet::Add(), E, and I.
Referenced by clang::ento::ExprEngine::ExecuteWorkListWithInitialState().
|
inline |
getGraph - Returns the exploded graph.
Definition at line 122 of file CoreEngine.h.
|
inline |
Definition at line 152 of file CoreEngine.h.
Referenced by clang::ento::ExprEngine::hasEmptyWorkList(), and clang::ento::ExprEngine::processCallExit().
|
inline |
Definition at line 142 of file CoreEngine.h.
References wasBlockAborted(), and wasBlocksExhausted().
Referenced by clang::ento::ExprEngine::hasWorkRemaining().
|
inline |
Definition at line 140 of file CoreEngine.h.
Referenced by hasWorkRemaining().
|
inline |
Definition at line 141 of file CoreEngine.h.
Referenced by hasWorkRemaining(), and clang::ento::ExprEngine::wasBlocksExhausted().
|
friend |
Definition at line 47 of file CoreEngine.h.
|
friend |
Definition at line 50 of file CoreEngine.h.
|
friend |
Definition at line 46 of file CoreEngine.h.
|
friend |
Definition at line 48 of file CoreEngine.h.
|
friend |
Definition at line 45 of file CoreEngine.h.
|
friend |
Definition at line 44 of file CoreEngine.h.
|
friend |
Definition at line 49 of file CoreEngine.h.
1.8.6