|
clang
5.0.0
|
#include "clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h"
Public Types | |
| enum | InliningModes { Inline_Regular = 0, Inline_Minimal = 0x1 } |
| The modes of inlining, which override the default analysis-wide settings. More... | |
Public Member Functions | |
| ExprEngine (AnalysisManager &mgr, bool gcEnabled, SetOfConstDecls *VisitedCalleesIn, FunctionSummariesTy *FS, InliningModes HowToInlineIn) | |
| ~ExprEngine () override | |
| bool | ExecuteWorkList (const LocationContext *L, unsigned Steps=150000) |
| Returns true if there is still simulation state on the worklist. More... | |
| bool | ExecuteWorkListWithInitialState (const LocationContext *L, unsigned Steps, ProgramStateRef InitState, ExplodedNodeSet &Dst) |
| Execute the work list with an initial state. More... | |
| ASTContext & | getContext () const |
| getContext - Return the ASTContext associated with this analysis. More... | |
| AnalysisManager & | getAnalysisManager () override |
| CheckerManager & | getCheckerManager () const |
| SValBuilder & | getSValBuilder () |
| BugReporter & | getBugReporter () |
| const NodeBuilderContext & | getBuilderContext () |
| bool | isObjCGCEnabled () |
| const Stmt * | getStmt () const |
| void | GenerateAutoTransition (ExplodedNode *N) |
| void | enqueueEndOfPath (ExplodedNodeSet &S) |
| void | GenerateCallExitNode (ExplodedNode *N) |
| void | ViewGraph (bool trim=false) |
| Visualize the ExplodedGraph created by executing the simulation. More... | |
| void | ViewGraph (ArrayRef< const ExplodedNode * > Nodes) |
| Visualize a trimmed ExplodedGraph that only contains paths to the given nodes. More... | |
| ProgramStateRef | getInitialState (const LocationContext *InitLoc) override |
| getInitialState - Return the initial state used for the root vertex in the ExplodedGraph. More... | |
| ExplodedGraph & | getGraph () |
| const ExplodedGraph & | getGraph () const |
| void | removeDead (ExplodedNode *Node, ExplodedNodeSet &Out, const Stmt *ReferenceStmt, const LocationContext *LC, const Stmt *DiagnosticStmt=nullptr, ProgramPoint::Kind K=ProgramPoint::PreStmtPurgeDeadSymbolsKind) |
| Run the analyzer's garbage collection - remove dead symbols and bindings from the state. More... | |
| void | processCFGElement (const CFGElement E, ExplodedNode *Pred, unsigned StmtIdx, NodeBuilderContext *Ctx) override |
| processCFGElement - Called by CoreEngine. More... | |
| void | ProcessStmt (const CFGStmt S, ExplodedNode *Pred) |
| void | ProcessInitializer (const CFGInitializer I, ExplodedNode *Pred) |
| void | ProcessImplicitDtor (const CFGImplicitDtor D, ExplodedNode *Pred) |
| void | ProcessNewAllocator (const CXXNewExpr *NE, ExplodedNode *Pred) |
| void | ProcessAutomaticObjDtor (const CFGAutomaticObjDtor D, ExplodedNode *Pred, ExplodedNodeSet &Dst) |
| void | ProcessDeleteDtor (const CFGDeleteDtor D, ExplodedNode *Pred, ExplodedNodeSet &Dst) |
| void | ProcessBaseDtor (const CFGBaseDtor D, ExplodedNode *Pred, ExplodedNodeSet &Dst) |
| void | ProcessMemberDtor (const CFGMemberDtor D, ExplodedNode *Pred, ExplodedNodeSet &Dst) |
| void | ProcessTemporaryDtor (const CFGTemporaryDtor D, ExplodedNode *Pred, ExplodedNodeSet &Dst) |
| void | processCFGBlockEntrance (const BlockEdge &L, NodeBuilderWithSinks &nodeBuilder, ExplodedNode *Pred) override |
| Called by CoreEngine when processing the entrance of a CFGBlock. More... | |
| void | processBranch (const Stmt *Condition, const Stmt *Term, NodeBuilderContext &BuilderCtx, ExplodedNode *Pred, ExplodedNodeSet &Dst, const CFGBlock *DstT, const CFGBlock *DstF) override |
| ProcessBranch - Called by CoreEngine. More... | |
| void | processCleanupTemporaryBranch (const CXXBindTemporaryExpr *BTE, NodeBuilderContext &BldCtx, ExplodedNode *Pred, ExplodedNodeSet &Dst, const CFGBlock *DstT, const CFGBlock *DstF) override |
| Called by CoreEngine. More... | |
| void | processStaticInitializer (const DeclStmt *DS, NodeBuilderContext &BuilderCtx, ExplodedNode *Pred, ExplodedNodeSet &Dst, const CFGBlock *DstT, const CFGBlock *DstF) override |
| Called by CoreEngine. More... | |
| void | processIndirectGoto (IndirectGotoNodeBuilder &builder) override |
| processIndirectGoto - Called by CoreEngine. More... | |
| void | processSwitch (SwitchNodeBuilder &builder) override |
| ProcessSwitch - Called by CoreEngine. More... | |
| void | processBeginOfFunction (NodeBuilderContext &BC, ExplodedNode *Pred, ExplodedNodeSet &Dst, const BlockEdge &L) override |
| Called by CoreEngine. More... | |
| void | processEndOfFunction (NodeBuilderContext &BC, ExplodedNode *Pred, const ReturnStmt *RS=nullptr) override |
| Called by CoreEngine. More... | |
| void | removeDeadOnEndOfFunction (NodeBuilderContext &BC, ExplodedNode *Pred, ExplodedNodeSet &Dst) |
| Remove dead bindings/symbols before exiting a function. More... | |
| void | processCallEnter (NodeBuilderContext &BC, CallEnter CE, ExplodedNode *Pred) override |
| Generate the entry node of the callee. More... | |
| void | processCallExit (ExplodedNode *Pred) override |
| Generate the sequence of nodes that simulate the call exit and the post visit for CallExpr. More... | |
| void | processEndWorklist (bool hasWorkRemaining) override |
| Called by CoreEngine when the analysis worklist has terminated. More... | |
| ProgramStateRef | processAssume (ProgramStateRef state, SVal cond, bool assumption) override |
| evalAssume - Callback function invoked by the ConstraintManager when making assumptions about state values. More... | |
| ProgramStateRef | processRegionChanges (ProgramStateRef state, const InvalidatedSymbols *invalidated, ArrayRef< const MemRegion * > ExplicitRegions, ArrayRef< const MemRegion * > Regions, const LocationContext *LCtx, const CallEvent *Call) override |
| processRegionChanges - Called by ProgramStateManager whenever a change is made to the store. More... | |
| void | printState (raw_ostream &Out, ProgramStateRef State, const char *NL, const char *Sep) override |
| printState - Called by ProgramStateManager to print checker-specific data. More... | |
| ProgramStateManager & | getStateManager () override |
| StoreManager & | getStoreManager () |
| ConstraintManager & | getConstraintManager () |
| BasicValueFactory & | getBasicVals () |
| SymbolManager & | getSymbolManager () |
| const SymbolManager & | getSymbolManager () const |
| bool | wasBlocksExhausted () const |
| bool | hasEmptyWorkList () const |
| bool | hasWorkRemaining () const |
| const CoreEngine & | getCoreEngine () const |
| void | Visit (const Stmt *S, ExplodedNode *Pred, ExplodedNodeSet &Dst) |
| Visit - Transfer function logic for all statements. More... | |
| void | VisitLvalArraySubscriptExpr (const ArraySubscriptExpr *Ex, ExplodedNode *Pred, ExplodedNodeSet &Dst) |
| VisitArraySubscriptExpr - Transfer function for array accesses. More... | |
| void | VisitGCCAsmStmt (const GCCAsmStmt *A, ExplodedNode *Pred, ExplodedNodeSet &Dst) |
| VisitGCCAsmStmt - Transfer function logic for inline asm. More... | |
| void | VisitMSAsmStmt (const MSAsmStmt *A, ExplodedNode *Pred, ExplodedNodeSet &Dst) |
| VisitMSAsmStmt - Transfer function logic for MS inline asm. More... | |
| void | VisitBlockExpr (const BlockExpr *BE, ExplodedNode *Pred, ExplodedNodeSet &Dst) |
| VisitBlockExpr - Transfer function logic for BlockExprs. More... | |
| void | VisitLambdaExpr (const LambdaExpr *LE, ExplodedNode *Pred, ExplodedNodeSet &Dst) |
| VisitLambdaExpr - Transfer function logic for LambdaExprs. More... | |
| void | VisitBinaryOperator (const BinaryOperator *B, ExplodedNode *Pred, ExplodedNodeSet &Dst) |
| VisitBinaryOperator - Transfer function logic for binary operators. More... | |
| void | VisitCallExpr (const CallExpr *CE, ExplodedNode *Pred, ExplodedNodeSet &Dst) |
| VisitCall - Transfer function for function calls. More... | |
| void | VisitCast (const CastExpr *CastE, const Expr *Ex, ExplodedNode *Pred, ExplodedNodeSet &Dst) |
| VisitCast - Transfer function logic for all casts (implicit and explicit). More... | |
| void | VisitCompoundLiteralExpr (const CompoundLiteralExpr *CL, ExplodedNode *Pred, ExplodedNodeSet &Dst) |
| VisitCompoundLiteralExpr - Transfer function logic for compound literals. More... | |
| void | VisitCommonDeclRefExpr (const Expr *DR, const NamedDecl *D, ExplodedNode *Pred, ExplodedNodeSet &Dst) |
| Transfer function logic for DeclRefExprs and BlockDeclRefExprs. More... | |
| void | VisitDeclStmt (const DeclStmt *DS, ExplodedNode *Pred, ExplodedNodeSet &Dst) |
| VisitDeclStmt - Transfer function logic for DeclStmts. More... | |
| void | VisitGuardedExpr (const Expr *Ex, const Expr *L, const Expr *R, ExplodedNode *Pred, ExplodedNodeSet &Dst) |
| VisitGuardedExpr - Transfer function logic for ?, __builtin_choose. More... | |
| void | VisitInitListExpr (const InitListExpr *E, ExplodedNode *Pred, ExplodedNodeSet &Dst) |
| void | VisitLogicalExpr (const BinaryOperator *B, ExplodedNode *Pred, ExplodedNodeSet &Dst) |
| VisitLogicalExpr - Transfer function logic for '&&', '||'. More... | |
| void | VisitMemberExpr (const MemberExpr *M, ExplodedNode *Pred, ExplodedNodeSet &Dst) |
| VisitMemberExpr - Transfer function for member expressions. More... | |
| void | VisitAtomicExpr (const AtomicExpr *E, ExplodedNode *Pred, ExplodedNodeSet &Dst) |
| VisitMemberExpr - Transfer function for builtin atomic expressions. More... | |
| void | VisitObjCAtSynchronizedStmt (const ObjCAtSynchronizedStmt *S, ExplodedNode *Pred, ExplodedNodeSet &Dst) |
| Transfer function logic for ObjCAtSynchronizedStmts. More... | |
| void | VisitLvalObjCIvarRefExpr (const ObjCIvarRefExpr *DR, ExplodedNode *Pred, ExplodedNodeSet &Dst) |
| Transfer function logic for computing the lvalue of an Objective-C ivar. More... | |
| void | VisitObjCForCollectionStmt (const ObjCForCollectionStmt *S, ExplodedNode *Pred, ExplodedNodeSet &Dst) |
| VisitObjCForCollectionStmt - Transfer function logic for ObjCForCollectionStmt. More... | |
| void | VisitObjCMessage (const ObjCMessageExpr *ME, ExplodedNode *Pred, ExplodedNodeSet &Dst) |
| void | VisitReturnStmt (const ReturnStmt *R, ExplodedNode *Pred, ExplodedNodeSet &Dst) |
| VisitReturnStmt - Transfer function logic for return statements. More... | |
| void | VisitOffsetOfExpr (const OffsetOfExpr *Ex, ExplodedNode *Pred, ExplodedNodeSet &Dst) |
| VisitOffsetOfExpr - Transfer function for offsetof. More... | |
| void | VisitUnaryExprOrTypeTraitExpr (const UnaryExprOrTypeTraitExpr *Ex, ExplodedNode *Pred, ExplodedNodeSet &Dst) |
| VisitUnaryExprOrTypeTraitExpr - Transfer function for sizeof. More... | |
| void | VisitUnaryOperator (const UnaryOperator *B, ExplodedNode *Pred, ExplodedNodeSet &Dst) |
| VisitUnaryOperator - Transfer function logic for unary operators. More... | |
| void | VisitIncrementDecrementOperator (const UnaryOperator *U, ExplodedNode *Pred, ExplodedNodeSet &Dst) |
| Handle ++ and – (both pre- and post-increment). More... | |
| void | VisitCXXBindTemporaryExpr (const CXXBindTemporaryExpr *BTE, ExplodedNodeSet &PreVisit, ExplodedNodeSet &Dst) |
| void | VisitCXXCatchStmt (const CXXCatchStmt *CS, ExplodedNode *Pred, ExplodedNodeSet &Dst) |
| void | VisitCXXThisExpr (const CXXThisExpr *TE, ExplodedNode *Pred, ExplodedNodeSet &Dst) |
| void | VisitCXXConstructExpr (const CXXConstructExpr *E, ExplodedNode *Pred, ExplodedNodeSet &Dst) |
| void | VisitCXXDestructor (QualType ObjectType, const MemRegion *Dest, const Stmt *S, bool IsBaseDtor, ExplodedNode *Pred, ExplodedNodeSet &Dst) |
| void | VisitCXXNewAllocatorCall (const CXXNewExpr *CNE, ExplodedNode *Pred, ExplodedNodeSet &Dst) |
| void | VisitCXXNewExpr (const CXXNewExpr *CNE, ExplodedNode *Pred, ExplodedNodeSet &Dst) |
| void | VisitCXXDeleteExpr (const CXXDeleteExpr *CDE, ExplodedNode *Pred, ExplodedNodeSet &Dst) |
| void | CreateCXXTemporaryObject (const MaterializeTemporaryExpr *ME, ExplodedNode *Pred, ExplodedNodeSet &Dst) |
| Create a C++ temporary object for an rvalue. More... | |
| void | evalEagerlyAssumeBinOpBifurcation (ExplodedNodeSet &Dst, ExplodedNodeSet &Src, const Expr *Ex) |
| evalEagerlyAssumeBinOpBifurcation - Given the nodes in 'Src', eagerly assume symbolic expressions of the form 'x != 0' and generate new nodes (stored in Dst) with those assumptions. More... | |
| std::pair< const ProgramPointTag *, const ProgramPointTag * > | geteagerlyAssumeBinOpBifurcationTags () |
| SVal | evalMinus (SVal X) |
| SVal | evalComplement (SVal X) |
| ProgramStateRef | handleLValueBitCast (ProgramStateRef state, const Expr *Ex, const LocationContext *LCtx, QualType T, QualType ExTy, const CastExpr *CastE, StmtNodeBuilder &Bldr, ExplodedNode *Pred) |
| ProgramStateRef | handleLVectorSplat (ProgramStateRef state, const LocationContext *LCtx, const CastExpr *CastE, StmtNodeBuilder &Bldr, ExplodedNode *Pred) |
| void | handleUOExtension (ExplodedNodeSet::iterator I, const UnaryOperator *U, StmtNodeBuilder &Bldr) |
| SVal | evalBinOp (ProgramStateRef state, BinaryOperator::Opcode op, NonLoc L, NonLoc R, QualType T) |
| SVal | evalBinOp (ProgramStateRef state, BinaryOperator::Opcode op, NonLoc L, SVal R, QualType T) |
| SVal | evalBinOp (ProgramStateRef ST, BinaryOperator::Opcode Op, SVal LHS, SVal RHS, QualType T) |
| void | evalLoad (ExplodedNodeSet &Dst, const Expr *NodeEx, const Expr *BoundExpr, ExplodedNode *Pred, ProgramStateRef St, SVal location, const ProgramPointTag *tag=nullptr, QualType LoadTy=QualType()) |
| Simulate a read of the result of Ex. More... | |
| void | evalStore (ExplodedNodeSet &Dst, const Expr *AssignE, const Expr *StoreE, ExplodedNode *Pred, ProgramStateRef St, SVal TargetLV, SVal Val, const ProgramPointTag *tag=nullptr) |
| evalStore - Handle the semantics of a store via an assignment. More... | |
| ProgramStateRef | bindReturnValue (const CallEvent &Call, const LocationContext *LCtx, ProgramStateRef State) |
| Create a new state in which the call return value is binded to the call origin expression. More... | |
| void | evalCall (ExplodedNodeSet &Dst, ExplodedNode *Pred, const CallEvent &Call) |
| Evaluate a call, running pre- and post-call checks and allowing checkers to be responsible for handling the evaluation of the call itself. More... | |
| void | defaultEvalCall (NodeBuilder &B, ExplodedNode *Pred, const CallEvent &Call) |
| Default implementation of call evaluation. More... | |
Public Member Functions inherited from clang::ento::SubEngine | |
| virtual | ~SubEngine () |
| ProgramStateRef | processRegionChange (ProgramStateRef state, const MemRegion *MR, const LocationContext *LCtx) |
Protected Member Functions | |
| void | evalBind (ExplodedNodeSet &Dst, const Stmt *StoreE, ExplodedNode *Pred, SVal location, SVal Val, bool atDeclInit=false, const ProgramPoint *PP=nullptr) |
| evalBind - Handle the semantics of binding a value to a specific location. More... | |
| ProgramStateRef | processPointerEscapedOnBind (ProgramStateRef State, SVal Loc, SVal Val, const LocationContext *LCtx) override |
| Call PointerEscape callback when a value escapes as a result of bind. More... | |
| ProgramStateRef | notifyCheckersOfPointerEscape (ProgramStateRef State, const InvalidatedSymbols *Invalidated, ArrayRef< const MemRegion * > ExplicitRegions, ArrayRef< const MemRegion * > Regions, const CallEvent *Call, RegionAndSymbolInvalidationTraits &ITraits) override |
| Call PointerEscape callback when a value escapes as a result of region invalidation. More... | |
Definition at line 48 of file ExprEngine.h.
The modes of inlining, which override the default analysis-wide settings.
| Enumerator | |
|---|---|
| Inline_Regular |
Follow the default settings for inlining callees. |
| Inline_Minimal |
Do minimal inlining of callees. |
Definition at line 51 of file ExprEngine.h.
| ExprEngine::ExprEngine | ( | AnalysisManager & | mgr, |
| bool | gcEnabled, | ||
| SetOfConstDecls * | VisitedCalleesIn, | ||
| FunctionSummariesTy * | FS, | ||
| InliningModes | HowToInlineIn | ||
| ) |
Definition at line 70 of file ExprEngine.cpp.
|
override |
Definition at line 96 of file ExprEngine.cpp.
References clang::ento::BugReporter::FlushReports().
| ProgramStateRef ExprEngine::bindReturnValue | ( | const CallEvent & | Call, |
| const LocationContext * | LCtx, | ||
| ProgramStateRef | State | ||
| ) |
Create a new state in which the call return value is binded to the call origin expression.
Definition at line 524 of file ExprEngineCallAndReturn.cpp.
References clang::ento::NodeBuilderContext::blockCount(), clang::ento::SVal::castAs(), clang::ento::SValBuilder::conjureSymbolVal(), E, clang::ento::CallEvent::getOriginExpr(), clang::ento::CallEvent::getResultType(), getSValBuilder(), isTemporaryPRValue(), clang::OMF_autorelease, clang::OMF_retain, clang::OMF_self, and State.
| void ExprEngine::CreateCXXTemporaryObject | ( | const MaterializeTemporaryExpr * | ME, |
| ExplodedNode * | Pred, | ||
| ExplodedNodeSet & | Dst | ||
| ) |
Create a C++ temporary object for an rvalue.
Definition at line 25 of file ExprEngineCXX.cpp.
References clang::ento::StmtNodeBuilder::generateNode(), clang::ento::ExplodedNode::getLocationContext(), clang::ento::ExplodedNode::getState(), clang::MaterializeTemporaryExpr::GetTemporaryExpr(), clang::Expr::IgnoreParens(), and clang::CodeGen::state.
Referenced by Visit().
| void ExprEngine::defaultEvalCall | ( | NodeBuilder & | B, |
| ExplodedNode * | Pred, | ||
| const CallEvent & | Call | ||
| ) |
Default implementation of call evaluation.
Definition at line 889 of file ExprEngineCallAndReturn.cpp.
References clang::ento::CallEvent::cloneWithState(), E, clang::ento::RuntimeDefinition::getDecl(), clang::ento::RuntimeDefinition::getDispatchRegion(), getInlineFailedState(), clang::AnalyzerOptions::getIPAMode(), clang::ento::ExplodedNode::getState(), clang::IPAK_DynamicDispatch, clang::IPAK_DynamicDispatchBifurcate, isTrivialObjectAssignment(), clang::ento::RuntimeDefinition::mayHaveOtherDefinitions(), and Options.
Referenced by clang::ento::CheckerManager::runCheckersForEvalCall(), VisitCXXConstructExpr(), VisitCXXDestructor(), VisitCXXNewAllocatorCall(), and VisitObjCMessage().
| void clang::ento::ExprEngine::enqueueEndOfPath | ( | ExplodedNodeSet & | S | ) |
|
protected |
evalBind - Handle the semantics of binding a value to a specific location.
This method is used by evalStore, VisitDeclStmt, and others.
This method is used by evalStore and (soon) VisitDeclStmt, and others.
Definition at line 2311 of file ExprEngine.cpp.
References clang::ento::ExplodedNodeSet::begin(), clang::ento::SVal::castAs(), E, clang::ento::ExplodedNodeSet::end(), clang::ento::StmtNodeBuilder::generateNode(), clang::ento::SVal::getAs(), getCheckerManager(), clang::ento::ExplodedNode::getLocationContext(), clang::ento::ExplodedNode::getState(), I, processPointerEscapedOnBind(), clang::ento::CheckerManager::runCheckersForBind(), and clang::CodeGen::state.
Referenced by evalStore(), ProcessInitializer(), VisitCXXNewExpr(), and VisitDeclStmt().
|
inline |
Definition at line 501 of file ExprEngine.h.
References clang::ento::SValBuilder::evalBinOpNN().
Referenced by getInitialState(), VisitBinaryOperator(), VisitIncrementDecrementOperator(), VisitLogicalExpr(), and VisitUnaryOperator().
|
inline |
Definition at line 506 of file ExprEngine.h.
References clang::ento::SVal::castAs(), clang::ento::SValBuilder::evalBinOpNN(), and clang::ento::SVal::isValid().
|
inline |
Definition at line 512 of file ExprEngine.h.
References clang::ento::SValBuilder::evalBinOp().
| void ExprEngine::evalCall | ( | ExplodedNodeSet & | Dst, |
| ExplodedNode * | Pred, | ||
| const CallEvent & | Call | ||
| ) |
Evaluate a call, running pre- and post-call checks and allowing checkers to be responsible for handling the evaluation of the call itself.
Definition at line 499 of file ExprEngineCallAndReturn.cpp.
References getCheckerManager(), clang::ento::CheckerManager::runCheckersForEvalCall(), clang::ento::CheckerManager::runCheckersForPostCall(), and clang::ento::CheckerManager::runCheckersForPreCall().
Referenced by VisitCallExpr().
Definition at line 479 of file ExprEngine.h.
References clang::ento::SVal::castAs(), clang::ento::SValBuilder::evalComplement(), clang::ento::SVal::isValid(), and X.
Referenced by VisitUnaryOperator().
| void ExprEngine::evalEagerlyAssumeBinOpBifurcation | ( | ExplodedNodeSet & | Dst, |
| ExplodedNodeSet & | Src, | ||
| const Expr * | Ex | ||
| ) |
evalEagerlyAssumeBinOpBifurcation - Given the nodes in 'Src', eagerly assume symbolic expressions of the form 'x != 0' and generate new nodes (stored in Dst) with those assumptions.
Definition at line 2517 of file ExprEngine.cpp.
References clang::ento::ExplodedNodeSet::begin(), clang::ProgramPoint::castAs(), E, clang::ento::ExplodedNodeSet::end(), clang::ento::StmtNodeBuilder::generateNode(), clang::ento::SVal::getAs(), clang::ProgramPoint::getAs(), geteagerlyAssumeBinOpBifurcationTags(), clang::ento::ExplodedNode::getLocation(), clang::ento::ExplodedNode::getLocationContext(), clang::ento::ExplodedNode::getState(), clang::StmtPoint::getStmt(), clang::Expr::getType(), I, clang::ento::SValBuilder::makeIntVal(), and P.
Referenced by Visit().
| void ExprEngine::evalLoad | ( | ExplodedNodeSet & | Dst, |
| const Expr * | NodeEx, | ||
| const Expr * | BoundExpr, | ||
| ExplodedNode * | Pred, | ||
| ProgramStateRef | St, | ||
| SVal | location, | ||
| const ProgramPointTag * | tag = nullptr, |
||
| QualType | LoadTy = QualType() |
||
| ) |
Simulate a read of the result of Ex.
Definition at line 2394 of file ExprEngine.cpp.
References clang::ento::ExplodedNodeSet::begin(), E, clang::ento::ExplodedNodeSet::end(), clang::ento::SVal::getAs(), clang::Type::getAs(), clang::ento::SVal::getAsRegion(), getContext(), clang::ento::TypedValueRegion::getValueType(), and I.
Referenced by VisitBinaryOperator(), VisitCast(), VisitIncrementDecrementOperator(), and VisitMemberExpr().
Definition at line 475 of file ExprEngine.h.
References clang::ento::SVal::castAs(), clang::ento::SValBuilder::evalMinus(), clang::ento::SVal::isValid(), and X.
Referenced by handleLValueBitCast(), and VisitUnaryOperator().
| void ExprEngine::evalStore | ( | ExplodedNodeSet & | Dst, |
| const Expr * | AssignE, | ||
| const Expr * | LocationE, | ||
| ExplodedNode * | Pred, | ||
| ProgramStateRef | state, | ||
| SVal | location, | ||
| SVal | Val, | ||
| const ProgramPointTag * | tag = nullptr |
||
| ) |
evalStore - Handle the semantics of a store via an assignment.
| Dst | The node set to store generated state nodes |
| AssignE | The assignment expression if the store happens in an assignment. |
| LocationE | The location expression that is stored to. |
| state | The current simulation state |
| location | The location to store the value |
| Val | The value to be stored |
Definition at line 2371 of file ExprEngine.cpp.
References clang::ento::ExplodedNodeSet::begin(), clang::ento::ExplodedNodeSet::empty(), clang::ento::ExplodedNodeSet::end(), evalBind(), and clang::ento::SVal::isUndef().
Referenced by VisitBinaryOperator(), and VisitIncrementDecrementOperator().
|
inline |
Returns true if there is still simulation state on the worklist.
Definition at line 108 of file ExprEngine.h.
References clang::ento::CoreEngine::ExecuteWorkList().
|
inline |
Execute the work list with an initial state.
Nodes that reaches the exit of the function are added into the Dst set, which represent the exit state of the function call. Returns true if there is still simulation state on the worklist.
Definition at line 116 of file ExprEngine.h.
References clang::ento::CoreEngine::ExecuteWorkListWithInitialState().
| void clang::ento::ExprEngine::GenerateAutoTransition | ( | ExplodedNode * | N | ) |
| void clang::ento::ExprEngine::GenerateCallExitNode | ( | ExplodedNode * | N | ) |
|
inlineoverridevirtual |
Implements clang::ento::SubEngine.
Definition at line 125 of file ExprEngine.h.
Referenced by clang::ento::CheckerContext::getAnalysisManager(), clang::ento::LikelyFalsePositiveSuppressionBRVisitor::getEndPath(), ProcessNewAllocator(), and VisitCXXBindTemporaryExpr().
|
inline |
Definition at line 312 of file ExprEngine.h.
References clang::ento::ProgramStateManager::getBasicVals().
Referenced by VisitCast(), VisitInitListExpr(), VisitLogicalExpr(), and VisitUnaryOperator().
|
inline |
Definition at line 133 of file ExprEngine.h.
Referenced by clang::ento::CheckerContext::emitReport(), and clang::ento::CheckerContext::getBugReporter().
|
inline |
Definition at line 135 of file ExprEngine.h.
Referenced by clang::ento::CheckerManager::runCheckersForEvalCall().
|
inline |
Definition at line 127 of file ExprEngine.h.
References clang::ento::AnalysisManager::getCheckerManager().
Referenced by evalBind(), evalCall(), notifyCheckersOfPointerEscape(), printState(), processAssume(), processBeginOfFunction(), processBranch(), processCallExit(), processEndOfFunction(), processEndWorklist(), processPointerEscapedOnBind(), processRegionChanges(), removeDead(), Visit(), VisitAtomicExpr(), VisitBinaryOperator(), VisitBlockExpr(), VisitCallExpr(), VisitCast(), VisitCXXConstructExpr(), VisitCXXDestructor(), VisitCXXNewAllocatorCall(), VisitDeclStmt(), VisitLambdaExpr(), VisitLvalArraySubscriptExpr(), VisitLvalObjCIvarRefExpr(), VisitMemberExpr(), VisitObjCAtSynchronizedStmt(), VisitObjCForCollectionStmt(), VisitObjCMessage(), VisitUnaryExprOrTypeTraitExpr(), and VisitUnaryOperator().
|
inline |
Definition at line 307 of file ExprEngine.h.
References clang::ento::ProgramStateManager::getConstraintManager().
Referenced by clang::ento::CheckerContext::getConstraintManager(), and removeDead().
|
inline |
getContext - Return the ASTContext associated with this analysis.
Definition at line 123 of file ExprEngine.h.
References clang::ento::AnalysisManager::getASTContext().
Referenced by evalLoad(), clang::ento::CheckerContext::getASTContext(), clang::ento::CheckerContext::getLangOpts(), handleLVectorSplat(), processBranch(), ProcessDeleteDtor(), ProcessInitializer(), ProcessStmt(), processSwitch(), ViewGraph(), Visit(), VisitBinaryOperator(), VisitBlockExpr(), VisitCast(), VisitCommonDeclRefExpr(), VisitCXXConstructExpr(), VisitCXXDestructor(), VisitCXXNewAllocatorCall(), VisitCXXNewExpr(), VisitCXXThisExpr(), VisitDeclStmt(), VisitInitListExpr(), VisitOffsetOfExpr(), and VisitUnaryExprOrTypeTraitExpr().
|
inline |
Definition at line 325 of file ExprEngine.h.
Referenced by processCallExit().
| std::pair< const ProgramPointTag *, const ProgramPointTag * > ExprEngine::geteagerlyAssumeBinOpBifurcationTags | ( | ) |
Definition at line 2507 of file ExprEngine.cpp.
Referenced by evalEagerlyAssumeBinOpBifurcation().
|
inline |
Definition at line 159 of file ExprEngine.h.
|
inline |
Definition at line 160 of file ExprEngine.h.
|
overridevirtual |
getInitialState - Return the initial state used for the root vertex in the ExplodedGraph.
Implements clang::ento::SubEngine.
Definition at line 104 of file ExprEngine.cpp.
References evalBinOp(), clang::ento::SVal::getAs(), clang::ento::SValBuilder::getConditionType(), clang::LocationContext::getCurrentStackFrame(), clang::ento::SValBuilder::getCXXThis(), clang::LocationContext::getDecl(), clang::ento::ProgramStateManager::getInitialState(), clang::IdentifierInfo::getName(), clang::LocationContext::getParent(), clang::ValueDecl::getType(), clang::BuiltinType::isInteger(), clang::ento::SValBuilder::makeZeroVal(), and clang::CodeGen::state.
|
inlineoverridevirtual |
Implements clang::ento::SubEngine.
Definition at line 303 of file ExprEngine.h.
Referenced by clang::ento::CheckerContext::getStateManager(), processBranch(), processCallExit(), VisitCallExpr(), VisitCXXConstructExpr(), VisitCXXDestructor(), VisitCXXNewAllocatorCall(), VisitCXXNewExpr(), and VisitObjCMessage().
| const Stmt* clang::ento::ExprEngine::getStmt | ( | ) | const |
|
inline |
Definition at line 305 of file ExprEngine.h.
References clang::ento::ProgramStateManager::getStoreManager().
Referenced by clang::ento::CheckerContext::getStoreManager(), ProcessBaseDtor(), processCallExit(), removeDead(), VisitCast(), VisitCXXConstructExpr(), and VisitCXXNewExpr().
|
inline |
Definition at line 131 of file ExprEngine.h.
Referenced by bindReturnValue(), clang::ento::CheckerContext::getSValBuilder(), ProcessBaseDtor(), ProcessInitializer(), ProcessMemberDtor(), VisitCXXConstructExpr(), and VisitInitListExpr().
|
inline |
Definition at line 317 of file ExprEngine.h.
|
inline |
Definition at line 318 of file ExprEngine.h.
| ProgramStateRef ExprEngine::handleLValueBitCast | ( | ProgramStateRef | state, |
| const Expr * | Ex, | ||
| const LocationContext * | LCtx, | ||
| QualType | T, | ||
| QualType | ExTy, | ||
| const CastExpr * | CastE, | ||
| StmtNodeBuilder & | Bldr, | ||
| ExplodedNode * | Pred | ||
| ) |
Definition at line 251 of file ExprEngineC.cpp.
References clang::ento::SValBuilder::evalCast(), evalMinus(), clang::ento::StmtNodeBuilder::generateNode(), clang::CastExpr::getCastKind(), and clang::CodeGen::state.
Referenced by VisitCast().
| ProgramStateRef ExprEngine::handleLVectorSplat | ( | ProgramStateRef | state, |
| const LocationContext * | LCtx, | ||
| const CastExpr * | CastE, | ||
| StmtNodeBuilder & | Bldr, | ||
| ExplodedNode * | Pred | ||
| ) |
Definition at line 267 of file ExprEngineC.cpp.
References clang::ento::NodeBuilderContext::blockCount(), clang::ento::SValBuilder::conjureSymbolVal(), clang::ento::StmtNodeBuilder::generateNode(), getContext(), clang::ASTContext::getPointerType(), clang::Expr::getType(), clang::Expr::isGLValue(), and clang::CodeGen::state.
Referenced by VisitCast().
| void ExprEngine::handleUOExtension | ( | ExplodedNodeSet::iterator | I, |
| const UnaryOperator * | U, | ||
| StmtNodeBuilder & | Bldr | ||
| ) |
Definition at line 853 of file ExprEngineC.cpp.
References clang::ento::StmtNodeBuilder::generateNode(), clang::UnaryOperator::getSubExpr(), clang::Expr::IgnoreParens(), and clang::CodeGen::state.
Referenced by VisitUnaryOperator().
|
inline |
Definition at line 322 of file ExprEngine.h.
References clang::ento::CoreEngine::getWorkList(), and clang::ento::WorkList::hasWork().
|
inline |
Definition at line 323 of file ExprEngine.h.
References clang::ento::CoreEngine::hasWorkRemaining().
|
inline |
Definition at line 140 of file ExprEngine.h.
Referenced by clang::ento::CheckerContext::isObjCGCEnabled().
|
overrideprotectedvirtual |
Call PointerEscape callback when a value escapes as a result of region invalidation.
| [in] | ITraits | Specifies invalidation traits for regions/symbols. |
Implements clang::ento::SubEngine.
Definition at line 2262 of file ExprEngine.cpp.
References E, clang::ento::MemRegion::getAs(), getCheckerManager(), I, clang::ento::PSK_DirectEscapeOnCall, clang::ento::PSK_EscapeOther, clang::ento::PSK_IndirectEscapeOnCall, clang::ento::CheckerManager::runCheckersForPointerEscape(), State, and clang::ento::MemRegion::StripCasts().
|
overridevirtual |
printState - Called by ProgramStateManager to print checker-specific data.
Implements clang::ento::SubEngine.
Definition at line 332 of file ExprEngine.cpp.
References getCheckerManager(), and clang::ento::CheckerManager::runCheckersForPrintState().
|
overridevirtual |
evalAssume - Callback function invoked by the ConstraintManager when making assumptions about state values.
evalAssume - Called by ConstraintManager.
Used to call checker-specific logic for handling assumptions on symbolic values.
Implements clang::ento::SubEngine.
Definition at line 315 of file ExprEngine.cpp.
References getCheckerManager(), and clang::ento::CheckerManager::runCheckersForEvalAssume().
| void ExprEngine::ProcessAutomaticObjDtor | ( | const CFGAutomaticObjDtor | D, |
| ExplodedNode * | Pred, | ||
| ExplodedNodeSet & | Dst | ||
| ) |
Definition at line 645 of file ExprEngine.cpp.
References clang::ento::SVal::castAs(), clang::ento::MemRegion::getBaseRegion(), clang::ento::ExplodedNode::getLocationContext(), clang::ento::ExplodedNode::getState(), clang::CFGAutomaticObjDtor::getTriggerStmt(), clang::ValueDecl::getType(), clang::CFGAutomaticObjDtor::getVarDecl(), clang::Type::isReferenceType(), clang::CodeGen::state, clang::ast_matchers::varDecl, and VisitCXXDestructor().
Referenced by ProcessImplicitDtor().
| void ExprEngine::ProcessBaseDtor | ( | const CFGBaseDtor | D, |
| ExplodedNode * | Pred, | ||
| ExplodedNodeSet & | Dst | ||
| ) |
Definition at line 701 of file ExprEngine.cpp.
References clang::ento::SVal::castAs(), clang::ento::StoreManager::evalDerivedToBase(), clang::CFGBaseDtor::getBaseSpecifier(), clang::FunctionDecl::getBody(), clang::LocationContext::getCurrentStackFrame(), clang::ento::SValBuilder::getCXXThis(), clang::LocationContext::getDecl(), clang::ento::ExplodedNode::getLocationContext(), clang::ento::loc::MemRegionVal::getRegion(), clang::ento::ExplodedNode::getState(), getStoreManager(), getSValBuilder(), clang::CXXBaseSpecifier::getType(), clang::CXXBaseSpecifier::isVirtual(), and VisitCXXDestructor().
Referenced by ProcessImplicitDtor().
|
overridevirtual |
Called by CoreEngine.
Used to notify checkers that processing a function has begun. Called for both inlined and and top-level functions.
Implements clang::ento::SubEngine.
Definition at line 1842 of file ExprEngine.cpp.
References getCheckerManager(), and clang::ento::CheckerManager::runCheckersForBeginFunction().
Referenced by processCallEnter().
|
overridevirtual |
ProcessBranch - Called by CoreEngine.
Used to generate successor nodes by processing the 'effects' of a branch condition.
Implements clang::ento::SubEngine.
Definition at line 1656 of file ExprEngine.cpp.
References clang::ento::SVal::castAs(), E, clang::ento::BranchNodeBuilder::generateNode(), clang::ento::NodeBuilderContext::getBlock(), getCheckerManager(), getContext(), clang::ento::ExplodedNode::getLocationContext(), clang::Stmt::getLocStart(), clang::ento::ExplodedNode::getState(), getStateManager(), I, clang::ento::BranchNodeBuilder::isFeasible(), clang::ento::ExplodedNode::isSink(), clang::ento::SVal::isUnknown(), clang::ento::SVal::isUnknownOrUndef(), clang::ento::BranchNodeBuilder::markInfeasible(), RecoverCastedSymbol(), ResolveCondition(), clang::ento::CheckerManager::runCheckersForBranchCondition(), and X.
|
overridevirtual |
Generate the entry node of the callee.
Implements clang::ento::SubEngine.
Definition at line 40 of file ExprEngineCallAndReturn.cpp.
References clang::ento::ExplodedNode::addPredecessor(), clang::CFGBlock::empty(), clang::ento::CoreEngine::enqueue(), clang::CallEnter::getCalleeContext(), clang::CallEnter::getEntry(), clang::ento::ExplodedGraph::getNode(), clang::ento::ExplodedNode::getState(), Node, processBeginOfFunction(), clang::CodeGen::state, clang::CFGBlock::succ_begin(), and clang::CFGBlock::succ_size().
|
overridevirtual |
Generate the sequence of nodes that simulate the call exit and the post visit for CallExpr.
The call exit is simulated with a sequence of nodes, which occur between CallExitBegin and CallExitEnd.
The following operations occur between the two program points:
Implements clang::ento::SubEngine.
Definition at line 221 of file ExprEngineCallAndReturn.cpp.
References clang::ento::ExplodedNodeSet::Add(), clang::ento::ExplodedNode::addPredecessor(), adjustReturnValue(), clang::AnalyzerOptions::AnalysisPurgeOpt, clang::ento::ExplodedNodeSet::begin(), clang::ento::SVal::castAs(), clang::ento::CallEventRef< T >::cloneWithState(), E, clang::ento::ExplodedNodeSet::end(), clang::ento::WorkList::enqueue(), clang::CallEventManager::getCaller(), clang::ento::ProgramStateManager::getCallEventManager(), getCheckerManager(), getCoreEngine(), clang::LocationContext::getCurrentStackFrame(), clang::ento::SValBuilder::getCXXThis(), clang::ento::CallEvent::getDeclaredResultType(), getLastStmt(), clang::ento::ExplodedNode::getLocationContext(), clang::ento::ExplodedGraph::getNode(), clang::LocationContext::getParent(), clang::ento::ExplodedNode::getState(), getStateManager(), getStoreManager(), clang::ento::CoreEngine::getWorkList(), I, clang::ento::ExplodedNodeSet::insert(), clang::QualType::isNull(), isTemporaryPRValue(), clang::ento::AnalysisManager::options, clang::ProgramPoint::PostStmtPurgeDeadSymbolsKind, removeDead(), clang::ento::CheckerManager::runCheckersForPostCall(), clang::ento::CheckerManager::runCheckersForPostObjCMessage(), clang::ento::CheckerManager::runCheckersForPostStmt(), clang::CodeGen::state, and wasDifferentDeclUsedForInlining().
|
overridevirtual |
Called by CoreEngine when processing the entrance of a CFGBlock.
Block entrance. (Update counters).
Implements clang::ento::SubEngine.
Definition at line 1496 of file ExprEngine.cpp.
References clang::ento::NodeBuilderContext::blockCount(), clang::ento::NodeBuilderWithSinks::generateNode(), clang::ento::NodeBuilderWithSinks::generateSink(), clang::ento::NodeBuilderContext::getBlock(), clang::ento::NodeBuilder::getContext(), clang::LocationContext::getCurrentStackFrame(), clang::LocationContext::getDecl(), clang::ento::ExplodedNode::getLocation(), clang::ento::ExplodedNode::getLocationContext(), clang::ProgramPoint::getLocationContext(), clang::ento::ExplodedNode::getState(), clang::CFGBlock::getTerminator(), clang::ento::getWidenedLoopState(), clang::ento::FunctionSummariesTy::markReachedMaxBlockCount(), clang::AnalyzerOptions::maxBlockVisitOnPath, clang::AnalyzerOptions::NoRetryExhausted, clang::ento::AnalysisManager::options, clang::ento::ExplodedGraph::roots_begin(), and clang::AnalyzerOptions::shouldWidenLoops().
|
overridevirtual |
processCFGElement - Called by CoreEngine.
Used to generate new successor nodes by processing the 'effects' of a CFG element.
Implements clang::ento::SubEngine.
Definition at line 341 of file ExprEngine.cpp.
References clang::CFGElement::AutomaticObjectDtor, clang::CFGElement::BaseDtor, clang::CFGElement::castAs(), clang::CFGElement::DeleteDtor, clang::CFGNewAllocator::getAllocatorExpr(), clang::CFGInitializer::getInitializer(), clang::CFGElement::getKind(), clang::ento::ExplodedNode::getLocationContext(), clang::CFGStmt::getStmt(), clang::CFGElement::Initializer, clang::CFGElement::LifetimeEnds, clang::CFGElement::MemberDtor, clang::CFGElement::NewAllocator, ProcessImplicitDtor(), ProcessInitializer(), ProcessNewAllocator(), ProcessStmt(), clang::CFGElement::Statement, and clang::CFGElement::TemporaryDtor.
|
overridevirtual |
Called by CoreEngine.
Used to generate successor nodes for temporary destructors depending on whether the corresponding constructor was visited.
Implements clang::ento::SubEngine.
Definition at line 764 of file ExprEngine.cpp.
References clang::ento::BranchNodeBuilder::generateNode(), clang::ento::ExplodedNode::getStackFrame(), clang::ento::ExplodedNode::getState(), and clang::ento::BranchNodeBuilder::markInfeasible().
| void ExprEngine::ProcessDeleteDtor | ( | const CFGDeleteDtor | D, |
| ExplodedNode * | Pred, | ||
| ExplodedNodeSet & | Dst | ||
| ) |
Definition at line 672 of file ExprEngine.cpp.
References clang::CXXDeleteExpr::getArgument(), clang::Type::getAsCXXRecordDecl(), clang::ento::SVal::getAsRegion(), clang::ASTContext::getBaseElementType(), getContext(), clang::CFGDeleteDtor::getDeleteExpr(), clang::CXXDeleteExpr::getDestroyedType(), clang::CXXRecordDecl::getDestructor(), clang::ento::ExplodedNode::getLocationContext(), clang::CXXDeleteExpr::getLocStart(), clang::ento::ExplodedNode::getState(), and VisitCXXDestructor().
Referenced by ProcessImplicitDtor().
|
overridevirtual |
Called by CoreEngine.
ProcessEndPath - Called by CoreEngine.
Used to notify checkers that processing a function has ended. Called for both inlined and and top-level functions.
Used to generate end-of-path nodes when the control reaches the end of a function.
Implements clang::ento::SubEngine.
Definition at line 1852 of file ExprEngine.cpp.
References clang::ento::ExplodedNodeSet::begin(), E, clang::ento::ExplodedNodeSet::end(), clang::ento::ProgramStateManager::EndPath(), clang::ento::CoreEngine::enqueueEndOfFunction(), getCheckerManager(), clang::ento::ExplodedNode::getLocationContext(), clang::ento::ExplodedNode::getState(), I, clang::LocationContext::inTopFrame(), removeDeadOnEndOfFunction(), and clang::ento::CheckerManager::runCheckersForEndFunction().
|
overridevirtual |
Called by CoreEngine when the analysis worklist has terminated.
Implements clang::ento::SubEngine.
Definition at line 337 of file ExprEngine.cpp.
References getCheckerManager(), and clang::ento::CheckerManager::runCheckersForEndAnalysis().
| void ExprEngine::ProcessImplicitDtor | ( | const CFGImplicitDtor | D, |
| ExplodedNode * | Pred | ||
| ) |
Definition at line 599 of file ExprEngine.cpp.
References clang::CFGElement::AutomaticObjectDtor, clang::CFGElement::BaseDtor, clang::CFGElement::castAs(), clang::CFGElement::DeleteDtor, clang::ento::CoreEngine::enqueue(), clang::ento::NodeBuilderContext::getBlock(), clang::CFGElement::getKind(), clang::CFGElement::MemberDtor, ProcessAutomaticObjDtor(), ProcessBaseDtor(), ProcessDeleteDtor(), ProcessMemberDtor(), ProcessTemporaryDtor(), and clang::CFGElement::TemporaryDtor.
Referenced by processCFGElement().
|
overridevirtual |
processIndirectGoto - Called by CoreEngine.
Used to generate successor nodes by processing the 'effects' of a computed goto jump.
Implements clang::ento::SubEngine.
Definition at line 1784 of file ExprEngine.cpp.
References clang::ento::IndirectGotoNodeBuilder::begin(), E, clang::ento::IndirectGotoNodeBuilder::end(), clang::ento::IndirectGotoNodeBuilder::generateNode(), clang::ento::SVal::getAs(), clang::ento::IndirectGotoNodeBuilder::getLocationContext(), clang::ento::IndirectGotoNodeBuilder::getState(), clang::ento::IndirectGotoNodeBuilder::getTarget(), I, and clang::CodeGen::state.
| void ExprEngine::ProcessInitializer | ( | const CFGInitializer | I, |
| ExplodedNode * | Pred | ||
| ) |
Definition at line 510 of file ExprEngine.cpp.
References clang::ento::ExplodedNodeSet::begin(), clang::ento::NodeBuilderContext::blockCount(), clang::ento::ExplodedNodeSet::clear(), clang::ento::SValBuilder::conjureSymbolVal(), clang::ast_matchers::decl, E, clang::ento::ExplodedNodeSet::end(), clang::ento::CoreEngine::enqueue(), evalBind(), clang::ento::NodeBuilder::generateNode(), clang::ento::SVal::getAs(), clang::ento::SVal::getAsRegion(), clang::ArraySubscriptExpr::getBase(), clang::ento::NodeBuilderContext::getBlock(), getContext(), clang::ento::SValBuilder::getCXXThis(), clang::CXXCtorInitializer::getIndirectMember(), clang::CXXCtorInitializer::getInit(), clang::CFGInitializer::getInitializer(), clang::ento::ExplodedNode::getLocationContext(), clang::CXXCtorInitializer::getMember(), clang::CXXCtorInitializer::getSourceLocation(), clang::ento::ExplodedNode::getState(), getSValBuilder(), clang::Expr::getType(), clang::ValueDecl::getType(), I, clang::Expr::IgnoreImplicit(), clang::CXXCtorInitializer::isAnyMemberInitializer(), clang::Type::isArrayType(), clang::CXXCtorInitializer::isBaseInitializer(), clang::CXXCtorInitializer::isDelegatingInitializer(), clang::CXXCtorInitializer::isIndirectMemberInitializer(), clang::Type::isReferenceType(), clang::ento::SVal::isUnknownOrUndef(), and clang::ento::ExplodedNodeSet::size().
Referenced by processCFGElement().
| void ExprEngine::ProcessMemberDtor | ( | const CFGMemberDtor | D, |
| ExplodedNode * | Pred, | ||
| ExplodedNodeSet & | Dst | ||
| ) |
Definition at line 720 of file ExprEngine.cpp.
References clang::ento::SVal::castAs(), clang::FunctionDecl::getBody(), clang::LocationContext::getCurrentStackFrame(), clang::ento::SValBuilder::getCXXThis(), clang::LocationContext::getDecl(), clang::CFGMemberDtor::getFieldDecl(), clang::ento::ExplodedNode::getLocationContext(), clang::ento::ExplodedNode::getState(), getSValBuilder(), clang::ValueDecl::getType(), and VisitCXXDestructor().
Referenced by ProcessImplicitDtor().
| void ExprEngine::ProcessNewAllocator | ( | const CXXNewExpr * | NE, |
| ExplodedNode * | Pred | ||
| ) |
Definition at line 626 of file ExprEngine.cpp.
References clang::ento::CoreEngine::enqueue(), clang::ento::NodeBuilder::generateNode(), getAnalysisManager(), clang::ento::NodeBuilderContext::getBlock(), clang::ento::ExplodedNode::getLocationContext(), clang::CXXNewExpr::getLocStart(), clang::CXXNewExpr::getOperatorNew(), clang::ento::ExplodedNode::getState(), clang::AnalyzerOptions::mayInlineCXXAllocator(), clang::ento::AnalysisManager::options, and VisitCXXNewAllocatorCall().
Referenced by processCFGElement().
|
overrideprotectedvirtual |
Call PointerEscape callback when a value escapes as a result of bind.
Implements clang::ento::SubEngine.
Definition at line 2218 of file ExprEngine.cpp.
References clang::ento::SVal::getAs(), getCheckerManager(), clang::ento::PSK_EscapeOnBind, clang::ento::CheckerManager::runCheckersForPointerEscape(), and State.
Referenced by evalBind().
|
overridevirtual |
processRegionChanges - Called by ProgramStateManager whenever a change is made to the store.
Used to update checkers that track region values.
Implements clang::ento::SubEngine.
Definition at line 321 of file ExprEngine.cpp.
References getCheckerManager(), and clang::ento::CheckerManager::runCheckersForRegionChanges().
|
overridevirtual |
Called by CoreEngine.
Used to processing branching behavior at static initializers.
Implements clang::ento::SubEngine.
| void ExprEngine::ProcessStmt | ( | const CFGStmt | S, |
| ExplodedNode * | Pred | ||
| ) |
Definition at line 479 of file ExprEngine.cpp.
References E, clang::ento::CoreEngine::enqueue(), clang::ento::NodeBuilderContext::getBlock(), getContext(), clang::ento::ExplodedNode::getLocationContext(), clang::Stmt::getLocStart(), clang::CFGStmt::getStmt(), I, clang::ento::ExplodedNodeSet::insert(), clang::ento::ExplodedGraph::reclaimRecentlyAllocatedNodes(), removeDead(), shouldRemoveDeadBindings(), and Visit().
Referenced by processCFGElement().
|
overridevirtual |
ProcessSwitch - Called by CoreEngine.
Used to generate successor nodes by processing the 'effects' of a switch statement.
Implements clang::ento::SubEngine.
Definition at line 1881 of file ExprEngine.cpp.
References clang::ento::SwitchNodeBuilder::begin(), clang::ento::SVal::castAs(), E, clang::ento::SwitchNodeBuilder::end(), clang::Expr::EvaluateKnownConstInt(), clang::ento::SwitchNodeBuilder::generateCaseStmtNode(), clang::ento::SwitchNodeBuilder::generateDefaultCaseNode(), clang::ento::SVal::getAs(), clang::Type::getAs(), clang::SwitchStmt::getCond(), clang::ento::SwitchNodeBuilder::getCondition(), getContext(), clang::ASTContext::getIntWidth(), clang::CaseStmt::getLHS(), clang::ento::SwitchNodeBuilder::getLocationContext(), clang::CaseStmt::getRHS(), clang::ento::SwitchNodeBuilder::getState(), clang::ento::SwitchNodeBuilder::getSwitch(), clang::Expr::getType(), I, clang::Expr::IgnoreParenImpCasts(), clang::SwitchStmt::isAllEnumCasesCovered(), clang::ento::SVal::isUndef(), and clang::CodeGen::state.
| void ExprEngine::ProcessTemporaryDtor | ( | const CFGTemporaryDtor | D, |
| ExplodedNode * | Pred, | ||
| ExplodedNodeSet & | Dst | ||
| ) |
Definition at line 737 of file ExprEngine.cpp.
References clang::ento::ExplodedNodeSet::begin(), clang::ento::ExplodedNodeSet::empty(), clang::ento::StmtNodeBuilder::generateNode(), clang::CFGTemporaryDtor::getBindTemporaryExpr(), clang::ento::ExplodedNode::getStackFrame(), clang::ento::ExplodedNode::getState(), clang::CXXBindTemporaryExpr::getSubExpr(), clang::Expr::getType(), clang::ento::ExplodedNodeSet::size(), State, and VisitCXXDestructor().
Referenced by ProcessImplicitDtor().
| void ExprEngine::removeDead | ( | ExplodedNode * | Node, |
| ExplodedNodeSet & | Out, | ||
| const Stmt * | ReferenceStmt, | ||
| const LocationContext * | LC, | ||
| const Stmt * | DiagnosticStmt = nullptr, |
||
| ProgramPoint::Kind | K = ProgramPoint::PreStmtPurgeDeadSymbolsKind |
||
| ) |
Run the analyzer's garbage collection - remove dead symbols and bindings from the state.
Checkers can participate in this process with two callbacks: checkLiveSymbols and checkDeadSymbols. See the CheckerDocumentation class for more information.
| Node | The predecessor node, from which the processing should start. |
| Out | The returned set of output nodes. |
| ReferenceStmt | The statement which is about to be processed. Everything needed for this statement should be considered live. A null statement means that everything in child LocationContexts is dead. |
| LC | The location context of the ReferenceStmt. A null location context means that we have reached the end of analysis and that all statements and local variables should be considered dead. |
| DiagnosticStmt | Used as a location for any warnings that should occur while removing the dead (e.g. leaks). By default, the ReferenceStmt is used. |
| K | Denotes whether this is a pre- or post-statement purge. This must only be ProgramPoint::PostStmtPurgeDeadSymbolsKind if an entire location context is being cleared, in which case the ReferenceStmt must either be a ReturnStmt or NULL. Otherwise, it must be ProgramPoint::PreStmtPurgeDeadSymbolsKind (the default) and ReferenceStmt must be valid (non-null). |
Definition at line 397 of file ExprEngine.cpp.
References clang::ento::ExplodedNodeSet::begin(), E, clang::ento::ExplodedNodeSet::end(), clang::ento::StmtNodeBuilder::generateNode(), getCheckerManager(), getConstraintManager(), clang::LocationContext::getCurrentStackFrame(), clang::LocationContext::getParent(), clang::ento::ProgramStateManager::getPersistentStateWithGDM(), clang::ento::ExplodedNode::getState(), getStoreManager(), clang::ento::SymbolReaper::hasDeadSymbols(), clang::ento::ProgramStateManager::haveEqualEnvironments(), clang::ento::ProgramStateManager::haveEqualStores(), I, clang::ProgramPoint::PostStmtPurgeDeadSymbolsKind, clang::ProgramPoint::PreStmtPurgeDeadSymbolsKind, clang::ento::ConstraintManager::removeDeadBindings(), clang::ento::ProgramStateManager::removeDeadBindings(), clang::ento::CheckerManager::runCheckersForDeadSymbols(), and clang::ento::CheckerManager::runCheckersForLiveSymbols().
Referenced by processCallExit(), ProcessStmt(), and removeDeadOnEndOfFunction().
| void ExprEngine::removeDeadOnEndOfFunction | ( | NodeBuilderContext & | BC, |
| ExplodedNode * | Pred, | ||
| ExplodedNodeSet & | Dst | ||
| ) |
Remove dead bindings/symbols before exiting a function.
Definition at line 162 of file ExprEngineCallAndReturn.cpp.
References clang::ento::ExplodedNodeSet::Add(), clang::LocationContext::getAnalysisDeclContext(), clang::AnalysisDeclContext::getBody(), getLastStmt(), clang::ento::ExplodedNode::getLocationContext(), clang::ProgramPoint::PostStmtPurgeDeadSymbolsKind, and removeDead().
Referenced by processEndOfFunction().
Visualize the ExplodedGraph created by executing the simulation.
Definition at line 2838 of file ExprEngine.cpp.
References clang::ento::BugReporter::begin(), E, clang::ento::BugReporter::end(), clang::ento::BugReporter::EQClasses_begin(), clang::ento::BugReporter::EQClasses_end(), getContext(), clang::ASTContext::getSourceManager(), GraphPrintCheckerState, GraphPrintSourceManager, I, and clang::ento::ExplodedGraph::roots_begin().
| void ExprEngine::ViewGraph | ( | ArrayRef< const ExplodedNode * > | Nodes | ) |
Visualize a trimmed ExplodedGraph that only contains paths to the given nodes.
Definition at line 2869 of file ExprEngine.cpp.
References getContext(), clang::ASTContext::getSourceManager(), GraphPrintCheckerState, GraphPrintSourceManager, and clang::ento::ExplodedGraph::trim().
| void ExprEngine::Visit | ( | const Stmt * | S, |
| ExplodedNode * | Pred, | ||
| ExplodedNodeSet & | Dst | ||
| ) |
Visit - Transfer function logic for all statements.
Dispatches to other functions that handle specific kinds of statements.
Definition at line 807 of file ExprEngine.cpp.
References clang::ento::CoreEngine::addAbortedBlock(), clang::ento::NodeBuilder::addNodes(), clang::ento::ExplodedNodeSet::begin(), clang::ento::NodeBuilderContext::blockCount(), clang::CompoundStmt::body_empty(), clang::CompoundStmt::body_rbegin(), clang::ento::SValBuilder::conjureSymbolVal(), CreateCXXTemporaryObject(), E, clang::AnalyzerOptions::eagerlyAssumeBinOpBifurcation, clang::ento::ExplodedNodeSet::end(), evalEagerlyAssumeBinOpBifurcation(), clang::ento::StmtNodeBuilder::generateNode(), clang::ento::StmtNodeBuilder::generateSink(), clang::CallExpr::getArg(), clang::ento::NodeBuilderContext::getBlock(), clang::CallExpr::getCalleeDecl(), getCheckerManager(), clang::ento::SValBuilder::getConstantVal(), getContext(), clang::DeclRefExpr::getDecl(), clang::AbstractConditionalOperator::getFalseExpr(), clang::ChooseExpr::getLHS(), clang::ento::ExplodedNode::getLocationContext(), clang::Stmt::getLocStart(), clang::UnaryOperator::getOpcode(), clang::BinaryOperator::getOpcode(), clang::PseudoObjectExpr::getResultExpr(), clang::BinaryOperator::getRHS(), clang::ChooseExpr::getRHS(), clang::ento::ExplodedNode::getState(), clang::Stmt::getStmtClass(), clang::CastExpr::getSubExpr(), clang::StmtExpr::getSubStmt(), clang::AbstractConditionalOperator::getTrueExpr(), clang::Expr::getType(), I, clang::BinaryOperator::isEqualityOp(), clang::BinaryOperator::isLogicalOp(), clang::BinaryOperator::isRelationalOp(), clang::ento::SValBuilder::makeIntValWithPtrWidth(), Next, clang::Stmt::NoStmtClass, clang::ento::AnalysisManager::options, clang::ProgramPoint::PreStmtKind, clang::ento::CheckerManager::runCheckersForPostStmt(), clang::ento::CheckerManager::runCheckersForPreStmt(), S, clang::AnalyzerOptions::shouldInlineLambdas(), clang::CodeGen::state, clang::ento::NodeBuilder::takeNodes(), VisitAtomicExpr(), VisitBinaryOperator(), VisitBlockExpr(), VisitCallExpr(), VisitCast(), VisitCommonDeclRefExpr(), VisitCompoundLiteralExpr(), VisitCXXBindTemporaryExpr(), VisitCXXCatchStmt(), VisitCXXConstructExpr(), VisitCXXDeleteExpr(), VisitCXXNewExpr(), VisitCXXThisExpr(), VisitDeclStmt(), VisitGCCAsmStmt(), VisitGuardedExpr(), VisitInitListExpr(), VisitLambdaExpr(), VisitLogicalExpr(), VisitLvalArraySubscriptExpr(), VisitLvalObjCIvarRefExpr(), VisitMemberExpr(), VisitMSAsmStmt(), VisitObjCAtSynchronizedStmt(), VisitObjCForCollectionStmt(), VisitObjCMessage(), VisitOffsetOfExpr(), VisitReturnStmt(), VisitUnaryExprOrTypeTraitExpr(), VisitUnaryOperator(), and clang::ASTContext::VoidTy.
Referenced by ProcessStmt().
| void ExprEngine::VisitAtomicExpr | ( | const AtomicExpr * | E, |
| ExplodedNode * | Pred, | ||
| ExplodedNodeSet & | Dst | ||
| ) |
VisitMemberExpr - Transfer function for builtin atomic expressions.
Definition at line 2160 of file ExprEngine.cpp.
References clang::ento::ExplodedNodeSet::begin(), clang::ento::NodeBuilderContext::blockCount(), E, clang::ento::ExplodedNodeSet::end(), clang::ento::StmtNodeBuilder::generateNode(), getCheckerManager(), clang::AtomicExpr::getNumSubExprs(), clang::AtomicExpr::getSubExprs(), I, clang::ProgramPoint::PostStmtKind, clang::ento::CheckerManager::runCheckersForPostStmt(), and clang::ento::CheckerManager::runCheckersForPreStmt().
Referenced by Visit().
| void ExprEngine::VisitBinaryOperator | ( | const BinaryOperator * | B, |
| ExplodedNode * | Pred, | ||
| ExplodedNodeSet & | Dst | ||
| ) |
VisitBinaryOperator - Transfer function logic for binary operators.
Definition at line 23 of file ExprEngineC.cpp.
References clang::ento::ExplodedNodeSet::begin(), clang::ento::NodeBuilderContext::blockCount(), clang::ento::SValBuilder::conjureSymbolVal(), E, clang::ento::ExplodedNodeSet::end(), evalBinOp(), clang::ento::SValBuilder::evalCast(), evalLoad(), evalStore(), clang::ento::StmtNodeBuilder::generateNode(), clang::ento::SVal::getAs(), clang::ASTContext::getCanonicalType(), getCheckerManager(), getContext(), clang::BinaryOperator::getLHS(), clang::BinaryOperator::getOpcode(), clang::BinaryOperator::getRHS(), clang::Expr::getType(), I, clang::Expr::IgnoreParens(), clang::BinaryOperator::isAdditiveOp(), clang::BinaryOperator::isAssignmentOp(), clang::BinaryOperator::isCompoundAssignmentOp(), clang::Expr::isGLValue(), clang::Type::isIntegralOrEnumerationType(), clang::ento::SVal::isUnknown(), Result, clang::ento::CheckerManager::runCheckersForPostStmt(), clang::ento::CheckerManager::runCheckersForPreStmt(), and clang::CodeGen::state.
Referenced by Visit().
| void ExprEngine::VisitBlockExpr | ( | const BlockExpr * | BE, |
| ExplodedNode * | Pred, | ||
| ExplodedNodeSet & | Dst | ||
| ) |
VisitBlockExpr - Transfer function logic for BlockExprs.
Definition at line 188 of file ExprEngineC.cpp.
References clang::ento::NodeBuilderContext::blockCount(), clang::BlockDecl::capture_begin(), clang::BlockDecl::capture_end(), E, clang::ento::StmtNodeBuilder::generateNode(), clang::ento::SVal::getAsRegion(), clang::BlockExpr::getBlockDecl(), clang::ento::SValBuilder::getBlockPointer(), clang::ASTContext::getCanonicalType(), clang::ento::BlockDataRegion::referenced_vars_iterator::getCapturedRegion(), getCheckerManager(), getContext(), clang::ento::VarRegion::getDecl(), clang::ento::ExplodedNode::getLocationContext(), clang::ento::BlockDataRegion::referenced_vars_iterator::getOriginalRegion(), clang::ento::ExplodedNode::getState(), clang::Expr::getType(), I, clang::ProgramPoint::PostLValueKind, clang::ento::CheckerManager::runCheckersForPostStmt(), and State.
Referenced by Visit().
| void ExprEngine::VisitCallExpr | ( | const CallExpr * | CE, |
| ExplodedNode * | Pred, | ||
| ExplodedNodeSet & | Dst | ||
| ) |
VisitCall - Transfer function for function calls.
Definition at line 471 of file ExprEngineCallAndReturn.cpp.
References clang::ento::ExplodedNodeSet::begin(), E, clang::ento::ExplodedNodeSet::end(), evalCall(), clang::ento::ProgramStateManager::getCallEventManager(), getCheckerManager(), clang::ento::ExplodedNode::getLocationContext(), clang::CallEventManager::getSimpleCall(), clang::ento::ExplodedNode::getState(), getStateManager(), I, clang::ento::CheckerManager::runCheckersForPostStmt(), and clang::ento::CheckerManager::runCheckersForPreStmt().
Referenced by Visit().
| void ExprEngine::VisitCast | ( | const CastExpr * | CastE, |
| const Expr * | Ex, | ||
| ExplodedNode * | Pred, | ||
| ExplodedNodeSet & | Dst | ||
| ) |
VisitCast - Transfer function logic for all casts (implicit and explicit).
Definition at line 283 of file ExprEngineC.cpp.
References clang::ento::StoreManager::attemptDownCast(), clang::ento::ExplodedNodeSet::begin(), clang::ento::NodeBuilderContext::blockCount(), clang::ento::SValBuilder::conjureSymbolVal(), E, clang::ento::ExplodedNodeSet::end(), clang::ento::StoreManager::evalDerivedToBase(), clang::ento::SValBuilder::evalIntegralCast(), evalLoad(), clang::ento::StmtNodeBuilder::generateNode(), clang::ento::StmtNodeBuilder::generateSink(), clang::ento::SVal::getAs(), getBasicVals(), clang::CastExpr::getCastKind(), getCheckerManager(), getContext(), clang::ento::ExplodedNode::getLocationContext(), clang::ento::SValBuilder::getMemberPointer(), clang::ASTContext::getPointerType(), clang::ento::ExplodedNode::getState(), getStoreManager(), clang::Expr::getType(), handleLValueBitCast(), handleLVectorSplat(), I, clang::ento::SVal::isConstant(), clang::Expr::isGLValue(), clang::Type::isReferenceType(), clang::ento::SVal::isUndef(), clang::ento::SVal::isUnknown(), clang::ento::SVal::isZeroConstant(), clang::ento::SValBuilder::makeNull(), clang::ento::SValBuilder::makePointerToMember(), clang::ento::SValBuilder::makeTruthVal(), clang::CastExpr::path_begin(), clang::CastExpr::path_end(), clang::ento::CheckerManager::runCheckersForPreStmt(), and clang::CodeGen::state.
Referenced by Visit().
| void ExprEngine::VisitCommonDeclRefExpr | ( | const Expr * | DR, |
| const NamedDecl * | D, | ||
| ExplodedNode * | Pred, | ||
| ExplodedNodeSet & | Dst | ||
| ) |
Transfer function logic for DeclRefExprs and BlockDeclRefExprs.
Definition at line 1963 of file ExprEngine.cpp.
References clang::ento::NodeBuilderContext::blockCount(), clang::ento::SVal::castAs(), clang::ento::SValBuilder::conjureSymbolVal(), clang::ento::StmtNodeBuilder::generateNode(), clang::CXXRecordDecl::getCaptureFields(), getContext(), clang::ento::SValBuilder::getCXXThis(), clang::ento::SValBuilder::getFunctionPointer(), clang::ento::ExplodedNode::getLocationContext(), clang::DeclContext::getParent(), clang::ento::ExplodedNode::getState(), clang::ValueDecl::getType(), clang::Expr::isGLValue(), clang::Type::isReferenceType(), clang::ento::SValBuilder::makeIntVal(), clang::ento::AnalysisManager::options, clang::ProgramPoint::PostLValueKind, clang::AnalyzerOptions::shouldInlineLambdas(), and clang::CodeGen::state.
Referenced by Visit(), and VisitMemberExpr().
| void ExprEngine::VisitCompoundLiteralExpr | ( | const CompoundLiteralExpr * | CL, |
| ExplodedNode * | Pred, | ||
| ExplodedNodeSet & | Dst | ||
| ) |
VisitCompoundLiteralExpr - Transfer function logic for compound literals.
Definition at line 522 of file ExprEngineC.cpp.
References clang::ento::StmtNodeBuilder::generateNode(), clang::CompoundLiteralExpr::getInitializer(), clang::ento::ExplodedNode::getLocationContext(), clang::ento::ExplodedNode::getState(), clang::Expr::isGLValue(), and State.
Referenced by Visit().
| void ExprEngine::VisitCXXBindTemporaryExpr | ( | const CXXBindTemporaryExpr * | BTE, |
| ExplodedNodeSet & | PreVisit, | ||
| ExplodedNodeSet & | Dst | ||
| ) |
Definition at line 781 of file ExprEngine.cpp.
References clang::ento::StmtNodeBuilder::generateNode(), getAnalysisManager(), and Node.
Referenced by Visit().
| void ExprEngine::VisitCXXCatchStmt | ( | const CXXCatchStmt * | CS, |
| ExplodedNode * | Pred, | ||
| ExplodedNodeSet & | Dst | ||
| ) |
Definition at line 563 of file ExprEngineCXX.cpp.
References clang::ento::ExplodedNodeSet::Add(), clang::ento::NodeBuilderContext::blockCount(), clang::ento::SValBuilder::conjureSymbolVal(), clang::ento::StmtNodeBuilder::generateNode(), clang::CXXCatchStmt::getExceptionDecl(), clang::ento::ExplodedNode::getLocationContext(), clang::ento::ExplodedNode::getState(), clang::ValueDecl::getType(), and clang::CodeGen::state.
Referenced by Visit().
| void ExprEngine::VisitCXXConstructExpr | ( | const CXXConstructExpr * | E, |
| ExplodedNode * | Pred, | ||
| ExplodedNodeSet & | Dst | ||
| ) |
Definition at line 233 of file ExprEngineCXX.cpp.
References clang::ento::ExplodedNodeSet::Add(), clang::CFG::BuildOptions::AddTemporaryDtors, clang::ento::ExplodedNodeSet::begin(), clang::CXXConstructExpr::CK_Complete, clang::CXXConstructExpr::CK_Delegating, clang::CXXConstructExpr::CK_NonVirtualBase, clang::CXXConstructExpr::CK_VirtualBase, defaultEvalCall(), E, clang::ento::ExplodedNodeSet::end(), clang::ento::StoreManager::evalDerivedToBase(), clang::ento::StmtNodeBuilder::generateNode(), clang::ento::StmtNodeBuilder::generateSink(), clang::LocationContext::getAnalysisDeclContext(), clang::ento::SVal::getAsRegion(), clang::ento::ProgramStateManager::getCallEventManager(), clang::StackFrameContext::getCallSite(), clang::AnalysisDeclContext::getCFGBuildOptions(), getCheckerManager(), clang::CXXConstructExpr::getConstructionKind(), clang::CXXConstructExpr::getConstructor(), getContext(), clang::LocationContext::getCurrentStackFrame(), clang::CallEventManager::getCXXConstructorCall(), clang::ento::SValBuilder::getCXXThis(), clang::LocationContext::getDecl(), clang::ento::ExplodedNode::getLocationContext(), clang::ento::ExplodedNode::getState(), getStateManager(), getStoreManager(), getSValBuilder(), clang::Expr::getType(), I, clang::CXXConstructorDecl::isCopyOrMoveConstructor(), clang::FunctionDecl::isTrivial(), clang::ento::SValBuilder::makeZeroVal(), clang::ProgramPoint::PreStmtKind, clang::CXXConstructExpr::requiresZeroInitialization(), clang::ento::CheckerManager::runCheckersForPostCall(), clang::ento::CheckerManager::runCheckersForPostStmt(), clang::ento::CheckerManager::runCheckersForPreCall(), and clang::ento::CheckerManager::runCheckersForPreStmt().
Referenced by Visit().
| void ExprEngine::VisitCXXDeleteExpr | ( | const CXXDeleteExpr * | CDE, |
| ExplodedNode * | Pred, | ||
| ExplodedNodeSet & | Dst | ||
| ) |
Definition at line 556 of file ExprEngineCXX.cpp.
References clang::ento::StmtNodeBuilder::generateNode(), clang::ento::ExplodedNode::getState(), and clang::CodeGen::state.
Referenced by Visit().
| void ExprEngine::VisitCXXDestructor | ( | QualType | ObjectType, |
| const MemRegion * | Dest, | ||
| const Stmt * | S, | ||
| bool | IsBaseDtor, | ||
| ExplodedNode * | Pred, | ||
| ExplodedNodeSet & | Dst | ||
| ) |
Definition at line 379 of file ExprEngineCXX.cpp.
References defaultEvalCall(), E, clang::Type::getAsCXXRecordDecl(), clang::ento::SVal::getAsRegion(), clang::ento::ProgramStateManager::getCallEventManager(), getCheckerManager(), getContext(), clang::CallEventManager::getCXXDestructorCall(), clang::CXXRecordDecl::getDestructor(), clang::ento::ExplodedNode::getLocationContext(), clang::ento::ExplodedNode::getState(), getStateManager(), I, makeZeroElementRegion(), clang::ento::CheckerManager::runCheckersForPostCall(), and clang::ento::CheckerManager::runCheckersForPreCall().
Referenced by ProcessAutomaticObjDtor(), ProcessBaseDtor(), ProcessDeleteDtor(), ProcessMemberDtor(), and ProcessTemporaryDtor().
| void ExprEngine::VisitCXXNewAllocatorCall | ( | const CXXNewExpr * | CNE, |
| ExplodedNode * | Pred, | ||
| ExplodedNodeSet & | Dst | ||
| ) |
Definition at line 424 of file ExprEngineCXX.cpp.
References clang::ento::ExplodedNodeSet::begin(), defaultEvalCall(), E, clang::ento::ExplodedNodeSet::end(), clang::ento::ProgramStateManager::getCallEventManager(), getCheckerManager(), getContext(), clang::ento::ExplodedNode::getLocationContext(), clang::CXXNewExpr::getStartLoc(), clang::ento::ExplodedNode::getState(), getStateManager(), I, clang::ento::CheckerManager::runCheckersForPostCall(), and clang::ento::CheckerManager::runCheckersForPreCall().
Referenced by ProcessNewAllocator().
| void ExprEngine::VisitCXXNewExpr | ( | const CXXNewExpr * | CNE, |
| ExplodedNode * | Pred, | ||
| ExplodedNodeSet & | Dst | ||
| ) |
Definition at line 450 of file ExprEngineCXX.cpp.
References clang::ento::NodeBuilderContext::blockCount(), clang::ento::SVal::castAs(), clang::ento::SValBuilder::conjureSymbolVal(), evalBind(), clang::ento::SValBuilder::evalCast(), clang::ento::StmtNodeBuilder::generateNode(), clang::Type::getAs(), clang::QualType::getBaseTypeIdentifier(), clang::ento::ProgramStateManager::getCallEventManager(), clang::ento::SValBuilder::getConjuredHeapSymbolVal(), getContext(), clang::CallEventManager::getCXXAllocatorCall(), clang::ento::StoreManager::GetElementZeroRegion(), clang::CXXNewExpr::getInitializer(), clang::ento::ExplodedNode::getLocationContext(), clang::FunctionDecl::getNumParams(), clang::CXXNewExpr::getOperatorNew(), clang::FunctionDecl::getParamDecl(), clang::CXXNewExpr::getPlacementArg(), clang::ento::NodeBuilder::getResults(), clang::ento::ExplodedNode::getState(), getStateManager(), getStoreManager(), clang::Expr::getType(), clang::ValueDecl::getType(), clang::CXXNewExpr::isArray(), clang::FunctionDecl::isReservedGlobalPlacementOperator(), clang::FunctionDecl::isVariadic(), Result, clang::ento::ExplodedNodeSet::size(), and clang::ento::NodeBuilder::takeNodes().
Referenced by Visit().
| void ExprEngine::VisitCXXThisExpr | ( | const CXXThisExpr * | TE, |
| ExplodedNode * | Pred, | ||
| ExplodedNodeSet & | Dst | ||
| ) |
Definition at line 582 of file ExprEngineCXX.cpp.
References clang::ento::StmtNodeBuilder::generateNode(), getContext(), clang::ento::MemRegionManager::getCXXThisRegion(), clang::ento::ExplodedNode::getLocationContext(), clang::ento::SValBuilder::getRegionManager(), clang::ento::ExplodedNode::getState(), clang::Expr::getType(), and clang::CodeGen::state.
Referenced by Visit().
| void ExprEngine::VisitDeclStmt | ( | const DeclStmt * | DS, |
| ExplodedNode * | Pred, | ||
| ExplodedNodeSet & | Dst | ||
| ) |
VisitDeclStmt - Transfer function logic for DeclStmts.
Definition at line 547 of file ExprEngineC.cpp.
References clang::ento::NodeBuilder::addNodes(), clang::ento::ExplodedNodeSet::begin(), clang::ento::NodeBuilderContext::blockCount(), clang::ento::SValBuilder::conjureSymbolVal(), clang::DeclStmt::decl_begin(), E, clang::ento::ExplodedNodeSet::end(), evalBind(), clang::ento::StmtNodeBuilder::generateNode(), clang::ento::SVal::getAs(), getCheckerManager(), getContext(), clang::VarDecl::getInit(), clang::ento::AnalysisManager::getLangOpts(), clang::ento::ExplodedNode::getLocationContext(), clang::ASTContext::getPointerType(), clang::ento::NodeBuilder::getResults(), clang::ento::ExplodedNode::getState(), clang::ValueDecl::getType(), I, clang::ento::ExplodedNodeSet::insert(), clang::Type::isRecordType(), clang::Type::isReferenceType(), clang::DeclStmt::isSingleDecl(), clang::ento::SVal::isUnknown(), clang::ento::CheckerManager::runCheckersForPostStmt(), clang::ento::CheckerManager::runCheckersForPreStmt(), clang::CodeGen::state, and clang::ento::NodeBuilder::takeNodes().
Referenced by Visit().
| void ExprEngine::VisitGCCAsmStmt | ( | const GCCAsmStmt * | A, |
| ExplodedNode * | Pred, | ||
| ExplodedNodeSet & | Dst | ||
| ) |
VisitGCCAsmStmt - Transfer function logic for inline asm.
Definition at line 2559 of file ExprEngine.cpp.
References clang::ento::StmtNodeBuilder::generateNode(), clang::ento::SVal::getAs(), clang::ento::ExplodedNode::getLocationContext(), clang::ento::ExplodedNode::getState(), clang::AsmStmt::outputs(), and X.
Referenced by Visit().
| void ExprEngine::VisitGuardedExpr | ( | const Expr * | Ex, |
| const Expr * | L, | ||
| const Expr * | R, | ||
| ExplodedNode * | Pred, | ||
| ExplodedNodeSet & | Dst | ||
| ) |
VisitGuardedExpr - Transfer function logic for ?, __builtin_choose.
Definition at line 731 of file ExprEngineC.cpp.
References clang::ento::NodeBuilderContext::blockCount(), clang::ProgramPoint::castAs(), clang::ento::SValBuilder::conjureSymbolVal(), clang::ento::StmtNodeBuilder::generateNode(), clang::ProgramPoint::getAs(), clang::ento::ExplodedNode::getLocationContext(), clang::ento::ExplodedNode::getState(), clang::Expr::IgnoreParens(), clang::ento::ExplodedNode::pred_begin(), and clang::CodeGen::state.
Referenced by Visit().
| void ExprEngine::VisitIncrementDecrementOperator | ( | const UnaryOperator * | U, |
| ExplodedNode * | Pred, | ||
| ExplodedNodeSet & | Dst | ||
| ) |
Handle ++ and – (both pre- and post-increment).
Definition at line 1006 of file ExprEngineC.cpp.
References clang::ento::NodeBuilder::addNodes(), clang::ento::ExplodedNodeSet::begin(), clang::ento::NodeBuilderContext::blockCount(), clang::ento::SVal::castAs(), clang::ento::SValBuilder::conjureSymbolVal(), E, clang::ento::ExplodedNodeSet::end(), evalBinOp(), clang::ento::SValBuilder::evalEQ(), evalLoad(), evalStore(), clang::ento::StmtNodeBuilder::generateNode(), clang::ento::ExplodedNode::getLocationContext(), clang::ento::ExplodedNode::getState(), clang::UnaryOperator::getSubExpr(), clang::Expr::getType(), I, clang::Expr::IgnoreParens(), clang::ento::ExplodedNodeSet::insert(), clang::Type::isAnyPointerType(), clang::Expr::isGLValue(), clang::UnaryOperator::isIncrementDecrementOp(), clang::UnaryOperator::isIncrementOp(), clang::Type::isIntegralOrEnumerationType(), clang::ento::Loc::isLocType(), clang::UnaryOperator::isPostfix(), clang::ento::SVal::isUnknown(), clang::ento::SValBuilder::makeArrayIndex(), clang::ento::SValBuilder::makeIntVal(), clang::ento::SValBuilder::makeZeroVal(), Result, clang::CodeGen::state, and clang::ento::NodeBuilder::takeNodes().
Referenced by VisitUnaryOperator().
| void ExprEngine::VisitInitListExpr | ( | const InitListExpr * | E, |
| ExplodedNode * | Pred, | ||
| ExplodedNodeSet & | Dst | ||
| ) |
Definition at line 682 of file ExprEngineC.cpp.
References clang::ento::StmtNodeBuilder::generateNode(), getBasicVals(), clang::ASTContext::getCanonicalType(), getContext(), clang::ento::BasicValueFactory::getEmptySValList(), clang::InitListExpr::getInit(), clang::ento::ExplodedNode::getLocationContext(), clang::InitListExpr::getNumInits(), clang::ento::ExplodedNode::getState(), getSValBuilder(), clang::Expr::getType(), clang::Type::isAnyComplexType(), clang::Type::isArrayType(), clang::Expr::isGLValue(), clang::Type::isRecordType(), clang::Type::isVectorType(), clang::ento::SValBuilder::makeCompoundVal(), clang::ento::SValBuilder::makeZeroVal(), clang::ento::BasicValueFactory::prependSVal(), clang::InitListExpr::rbegin(), clang::InitListExpr::rend(), and clang::CodeGen::state.
Referenced by Visit().
| void ExprEngine::VisitLambdaExpr | ( | const LambdaExpr * | LE, |
| ExplodedNode * | Pred, | ||
| ExplodedNodeSet & | Dst | ||
| ) |
VisitLambdaExpr - Transfer function logic for LambdaExprs.
Definition at line 598 of file ExprEngineCXX.cpp.
References clang::LambdaExpr::capture_init_begin(), clang::LambdaExpr::capture_init_end(), clang::RecordDecl::field_begin(), clang::ento::StmtNodeBuilder::generateNode(), clang::FieldDecl::getCapturedVLAType(), getCheckerManager(), clang::ento::MemRegionManager::getCXXTempObjectRegion(), clang::LambdaExpr::getLambdaClass(), clang::ento::ExplodedNode::getLocationContext(), clang::ento::SValBuilder::getRegionManager(), clang::VariableArrayType::getSizeExpr(), clang::ento::ExplodedNode::getState(), clang::FieldDecl::hasCapturedVLAType(), clang::ProgramPoint::PostLValueKind, and clang::ento::CheckerManager::runCheckersForPostStmt().
Referenced by Visit().
| void ExprEngine::VisitLogicalExpr | ( | const BinaryOperator * | B, |
| ExplodedNode * | Pred, | ||
| ExplodedNodeSet & | Dst | ||
| ) |
VisitLogicalExpr - Transfer function logic for '&&', '||'.
Definition at line 623 of file ExprEngineC.cpp.
References clang::CFGElement::castAs(), clang::ProgramPoint::castAs(), clang::CFGBlock::empty(), evalBinOp(), clang::ento::SValBuilder::evalCast(), clang::ProgramPoint::getAs(), getBasicVals(), clang::BlockEdge::getDst(), clang::ento::ExplodedNode::getLocation(), clang::ento::ExplodedNode::getLocationContext(), clang::BinaryOperator::getOpcode(), clang::BlockEdge::getSrc(), clang::ento::ExplodedNode::getState(), clang::CFGTerminator::getStmt(), clang::CFGBlock::getTerminator(), clang::Expr::getType(), getValue(), clang::ento::SValBuilder::makeIntVal(), P, clang::ento::ExplodedNode::pred_begin(), clang::ento::ExplodedNode::pred_size(), clang::CFGBlock::rbegin(), clang::CodeGen::state, clang::CFGBlock::succ_begin(), clang::CFGBlock::succ_size(), and X.
Referenced by Visit().
| void ExprEngine::VisitLvalArraySubscriptExpr | ( | const ArraySubscriptExpr * | Ex, |
| ExplodedNode * | Pred, | ||
| ExplodedNodeSet & | Dst | ||
| ) |
VisitArraySubscriptExpr - Transfer function for array accesses.
Definition at line 2049 of file ExprEngine.cpp.
References clang::ento::StmtNodeBuilder::generateNode(), clang::ArraySubscriptExpr::getBase(), getCheckerManager(), clang::ArraySubscriptExpr::getIdx(), clang::ento::AnalysisManager::getLangOpts(), clang::Expr::getType(), clang::Expr::IgnoreParens(), clang::QualType::isCForbiddenLValueType(), clang::Expr::isGLValue(), Node, clang::ProgramPoint::PostLValueKind, clang::ento::CheckerManager::runCheckersForPostStmt(), clang::ento::CheckerManager::runCheckersForPreStmt(), and clang::CodeGen::state.
Referenced by Visit().
| void ExprEngine::VisitLvalObjCIvarRefExpr | ( | const ObjCIvarRefExpr * | DR, |
| ExplodedNode * | Pred, | ||
| ExplodedNodeSet & | Dst | ||
| ) |
Transfer function logic for computing the lvalue of an Objective-C ivar.
Definition at line 22 of file ExprEngineObjC.cpp.
References clang::ento::StmtNodeBuilder::generateNode(), clang::ObjCIvarRefExpr::getBase(), getCheckerManager(), clang::ObjCIvarRefExpr::getDecl(), clang::ento::ExplodedNode::getLocationContext(), clang::ento::ExplodedNode::getState(), clang::ento::CheckerManager::runCheckersForPostStmt(), and clang::CodeGen::state.
Referenced by Visit().
| void ExprEngine::VisitMemberExpr | ( | const MemberExpr * | M, |
| ExplodedNode * | Pred, | ||
| ExplodedNodeSet & | Dst | ||
| ) |
VisitMemberExpr - Transfer function for member expressions.
Definition at line 2079 of file ExprEngine.cpp.
References clang::ento::NodeBuilder::addNodes(), clang::ento::ExplodedNodeSet::begin(), E, clang::ento::ExplodedNodeSet::end(), evalLoad(), clang::ento::StmtNodeBuilder::generateNode(), clang::MemberExpr::getBase(), getCheckerManager(), clang::ento::SValBuilder::getFunctionPointer(), clang::MemberExpr::getMemberDecl(), clang::Expr::getType(), clang::ValueDecl::getType(), I, clang::Type::isArrayType(), clang::Expr::isGLValue(), clang::Type::isReferenceType(), clang::ProgramPoint::PostLValueKind, clang::ento::CheckerManager::runCheckersForPostStmt(), clang::ento::CheckerManager::runCheckersForPreStmt(), clang::CodeGen::state, clang::ento::NodeBuilder::takeNodes(), and VisitCommonDeclRefExpr().
Referenced by Visit().
| void ExprEngine::VisitMSAsmStmt | ( | const MSAsmStmt * | A, |
| ExplodedNode * | Pred, | ||
| ExplodedNodeSet & | Dst | ||
| ) |
VisitMSAsmStmt - Transfer function logic for MS inline asm.
Definition at line 2582 of file ExprEngine.cpp.
References clang::ento::StmtNodeBuilder::generateNode(), and clang::ento::ExplodedNode::getState().
Referenced by Visit().
| void ExprEngine::VisitObjCAtSynchronizedStmt | ( | const ObjCAtSynchronizedStmt * | S, |
| ExplodedNode * | Pred, | ||
| ExplodedNodeSet & | Dst | ||
| ) |
Transfer function logic for ObjCAtSynchronizedStmts.
Definition at line 39 of file ExprEngineObjC.cpp.
References getCheckerManager(), and clang::ento::CheckerManager::runCheckersForPreStmt().
Referenced by Visit().
| void ExprEngine::VisitObjCForCollectionStmt | ( | const ObjCForCollectionStmt * | S, |
| ExplodedNode * | Pred, | ||
| ExplodedNodeSet & | Dst | ||
| ) |
VisitObjCForCollectionStmt - Transfer function logic for ObjCForCollectionStmt.
Definition at line 45 of file ExprEngineObjC.cpp.
References clang::ento::ExplodedNodeSet::begin(), clang::ento::NodeBuilderContext::blockCount(), clang::ento::SymbolManager::conjureSymbol(), clang::ento::ExplodedNodeSet::end(), clang::ento::StmtNodeBuilder::generateNode(), clang::ento::SVal::getAs(), getCheckerManager(), clang::ObjCForCollectionStmt::getElement(), clang::VarDecl::getInit(), clang::ento::ExplodedNode::getLocationContext(), clang::ento::ExplodedNode::getState(), clang::ento::Loc::isLocType(), clang::ento::SValBuilder::makeIntVal(), clang::ento::SValBuilder::makeLoc(), clang::ento::SValBuilder::makeTruthVal(), clang::ento::CheckerManager::runCheckersForPostStmt(), and clang::CodeGen::state.
Referenced by Visit().
| void ExprEngine::VisitObjCMessage | ( | const ObjCMessageExpr * | ME, |
| ExplodedNode * | Pred, | ||
| ExplodedNodeSet & | Dst | ||
| ) |
Definition at line 135 of file ExprEngineObjC.cpp.
References clang::ento::ExplodedNodeSet::begin(), clang::ento::SVal::castAs(), clang::ento::CallEventRef< T >::cloneWithState(), defaultEvalCall(), clang::ento::ExplodedNodeSet::end(), clang::ento::StmtNodeBuilder::generateNode(), clang::ento::StmtNodeBuilder::generateSink(), clang::ento::ProgramStateManager::getCallEventManager(), getCheckerManager(), clang::ento::ExplodedNode::getLocation(), clang::ento::ExplodedNode::getLocationContext(), clang::CallEventManager::getObjCMethodCall(), clang::ento::ExplodedNode::getState(), getStateManager(), clang::ProgramPoint::getTag(), clang::ObjCNoReturn::isImplicitNoReturn(), clang::ento::SVal::isUndef(), clang::ProgramPoint::PreStmtKind, clang::ento::CheckerManager::runCheckersForObjCMessageNil(), clang::ento::CheckerManager::runCheckersForPostCall(), clang::ento::CheckerManager::runCheckersForPostObjCMessage(), clang::ento::CheckerManager::runCheckersForPreCall(), clang::ento::CheckerManager::runCheckersForPreObjCMessage(), and State.
Referenced by Visit().
| void ExprEngine::VisitOffsetOfExpr | ( | const OffsetOfExpr * | Ex, |
| ExplodedNode * | Pred, | ||
| ExplodedNodeSet & | Dst | ||
| ) |
VisitOffsetOfExpr - Transfer function for offsetof.
Definition at line 792 of file ExprEngineC.cpp.
References clang::Expr::EvaluateAsInt(), clang::ento::StmtNodeBuilder::generateNode(), clang::Type::getAs(), getContext(), clang::ento::ExplodedNode::getLocationContext(), clang::ento::ExplodedNode::getState(), clang::Expr::getType(), clang::ASTContext::getTypeSize(), clang::Type::isBuiltinType(), clang::Type::isSignedIntegerType(), clang::ento::SValBuilder::makeIntVal(), and X.
Referenced by Visit().
| void ExprEngine::VisitReturnStmt | ( | const ReturnStmt * | R, |
| ExplodedNode * | Pred, | ||
| ExplodedNodeSet & | Dst | ||
| ) |
VisitReturnStmt - Transfer function logic for return statements.
Definition at line 978 of file ExprEngineCallAndReturn.cpp.
References clang::ento::ExplodedNodeSet::begin(), clang::ento::ExplodedNodeSet::end(), clang::ento::StmtNodeBuilder::generateNode(), and clang::ReturnStmt::getRetValue().
Referenced by Visit().
| void ExprEngine::VisitUnaryExprOrTypeTraitExpr | ( | const UnaryExprOrTypeTraitExpr * | Ex, |
| ExplodedNode * | Pred, | ||
| ExplodedNodeSet & | Dst | ||
| ) |
VisitUnaryExprOrTypeTraitExpr - Transfer function for sizeof.
Definition at line 811 of file ExprEngineC.cpp.
References clang::ento::ExplodedNodeSet::begin(), E, clang::ento::ExplodedNodeSet::end(), clang::Expr::EvaluateKnownConstInt(), clang::CharUnits::fromQuantity(), clang::ento::StmtNodeBuilder::generateNode(), clang::Type::getAs(), getCheckerManager(), getContext(), clang::UnaryExprOrTypeTraitExpr::getKind(), clang::CharUnits::getQuantity(), clang::Expr::getType(), clang::UnaryExprOrTypeTraitExpr::getTypeOfArgument(), I, clang::Type::isConstantSizeType(), clang::Type::isIncompleteType(), clang::Type::isVariableArrayType(), clang::ento::SValBuilder::makeIntVal(), clang::ento::CheckerManager::runCheckersForPostStmt(), clang::ento::CheckerManager::runCheckersForPreStmt(), clang::CodeGen::state, and clang::UETT_SizeOf.
Referenced by Visit().
| void ExprEngine::VisitUnaryOperator | ( | const UnaryOperator * | B, |
| ExplodedNode * | Pred, | ||
| ExplodedNodeSet & | Dst | ||
| ) |
VisitUnaryOperator - Transfer function logic for unary operators.
Definition at line 870 of file ExprEngineC.cpp.
References clang::ento::NodeBuilder::addNodes(), clang::ento::ExplodedNodeSet::begin(), clang::ento::SVal::castAs(), E, clang::ento::ExplodedNodeSet::end(), evalBinOp(), evalComplement(), evalMinus(), clang::ento::StmtNodeBuilder::generateNode(), clang::ento::SVal::getAs(), getBasicVals(), getCheckerManager(), clang::ento::SValBuilder::getMemberPointer(), clang::UnaryOperator::getOpcode(), clang::UnaryOperator::getSubExpr(), clang::Expr::getType(), getValue(), handleUOExtension(), I, clang::Expr::IgnoreParens(), clang::Type::isAnyComplexType(), clang::Expr::isGLValue(), clang::ento::SVal::isUnknownOrUndef(), clang::ento::SValBuilder::makeNullWithType(), clang::ento::SValBuilder::makeZeroVal(), Result, clang::ento::CheckerManager::runCheckersForPostStmt(), clang::ento::CheckerManager::runCheckersForPreStmt(), clang::CodeGen::state, State, clang::ento::NodeBuilder::takeNodes(), VisitIncrementDecrementOperator(), and X.
Referenced by Visit().
|
inline |
Definition at line 321 of file ExprEngine.h.
References clang::ento::CoreEngine::wasBlocksExhausted().
1.8.6