20 #include "llvm/Support/raw_ostream.h"
22 using namespace clang;
25 namespace clang {
namespace ento {
34 assert(state->refCount > 0);
36 if (--s->refCount == 0) {
38 Mgr.StateSet.RemoveNode(s);
40 Mgr.freeStates.push_back(s);
56 : llvm::FoldingSetNode(),
57 stateMgr(RHS.stateMgr),
73 llvm::BumpPtrAllocator &alloc,
75 : Eng(SubEng), EnvMgr(alloc), GDMFactory(alloc),
78 StoreMgr = (*CreateSMgr)(*this);
79 ConstraintMgr = (*CreateCMgr)(*
this, SubEng);
84 for (GDMContextsTy::iterator
I=GDMContexts.begin(),
E=GDMContexts.end();
86 I->second.second(
I->second.first);
107 NewState.setStore(newStore);
111 return ConstraintMgr->removeDeadBindings(Result, SymReaper);
117 bool notifyChanges)
const {
145 const Expr *
E,
unsigned Count,
147 bool CausedByPointerEscape,
152 for (RegionList::const_iterator
I = Regions.begin(),
156 return invalidateRegionsImpl(Values, E, Count, LCtx, CausedByPointerEscape,
162 const Expr *
E,
unsigned Count,
164 bool CausedByPointerEscape,
169 return invalidateRegionsImpl(Values, E, Count, LCtx, CausedByPointerEscape,
174 ProgramState::invalidateRegionsImpl(
ValueList Values,
175 const Expr *
E,
unsigned Count,
177 bool CausedByPointerEscape,
190 ITraits = &ITraitsLocal;
196 = Mgr.StoreMgr->invalidateRegions(
getStore(), Values, E, Count, LCtx, Call,
197 *IS, *ITraits, &TopLevelInvalidated,
202 if (CausedByPointerEscape) {
210 Invalidated, LCtx, Call);
214 Mgr.StoreMgr->invalidateRegions(
getStore(), Values, E, Count, LCtx, Call,
215 *IS, *ITraits,
nullptr,
nullptr);
216 return makeWithStore(newStore);
226 if (newStore.
getStore() == OldStore)
229 return makeWithStore(newStore);
237 return makeWithStore(NewStore);
297 SVal V,
bool Invalidate)
const{
372 StoreMgr->getInitialStore(InitLoc),
373 GDMFactory.getEmptyMap());
382 NewState.GDM = GDMState->GDM;
388 llvm::FoldingSetNodeID
ID;
392 if (
ProgramState *
I = StateSet.FindNodeOrInsertPos(ID, InsertPos))
396 if (!freeStates.empty()) {
397 newState = freeStates.back();
398 freeStates.pop_back();
404 StateSet.InsertNode(newState, InsertPos);
410 NewSt.setStore(store);
414 void ProgramState::setStore(
const StoreRef &newStore) {
420 store = newStoreStore;
428 const char *NL,
const char *Sep)
const {
434 Env.
print(Out, NL, Sep);
444 print(Out,
"\\l",
"\\|");
452 const char *NL,
const char *Sep)
const {
456 Out <<
"Tainted Symbols:" << NL;
458 for (TaintMapImpl::iterator
I = TM.begin(), E = TM.end();
I !=
E; ++
I) {
459 Out <<
I->first <<
" : " <<
I->second << NL;
472 return GDM.lookup(K);
477 void *(*CreateContext)(llvm::BumpPtrAllocator&),
478 void (*DeleteContext)(
void*)) {
480 std::pair<void*, void (*)(void*)>& p = GDMContexts[K];
482 p.first = CreateContext(Alloc);
483 p.second = DeleteContext;
514 bool wasVisited = !visited.insert(val.
getCVData()).second;
518 StoreManager &StoreMgr = state->getStateManager().getStoreManager();
538 bool wasVisited = !visited.insert(*SI).second;
551 return scan(
X->getRegion());
558 return scan(
X->getLoc());
573 if (isa<MemSpaceRegion>(R))
576 bool wasVisited = !visited.insert(R).second;
589 if (
const SubRegion *SR = dyn_cast<SubRegion>(R)) {
590 const MemRegion *Super = SR->getSuperRegion();
595 if (isa<MemSpaceRegion>(Super)) {
596 StoreManager &StoreMgr = state->getStateManager().getStoreManager();
605 E = BDR->referenced_vars_end();
606 for ( ; I !=
E; ++
I) {
623 for ( ; I !=
E; ++
I) {
634 for ( ; I !=
E; ++
I) {
644 if (
const Expr *E = dyn_cast_or_null<Expr>(S))
667 if (
SymbolRef Sym = binding->getAsSymbol())
678 if (
const SymbolicRegion *SR = dyn_cast_or_null<SymbolicRegion>(R))
687 while (
const SymbolCast *SC = dyn_cast<SymbolCast>(Sym))
688 Sym = SC->getOperand();
699 if (contains<TaintMap>(ParentSym) && *get<TaintMap>(ParentSym) == Kind)
708 SavedRegs ? *SavedRegs : stateMgr->TSRFactory.getEmptyMap();
710 Regs = stateMgr->TSRFactory.add(Regs, SubRegion, Kind);
718 if (
const Expr *E = dyn_cast_or_null<Expr>(S))
745 if (
const SubRegion *ER = dyn_cast<SubRegion>(Reg))
746 return isTainted(ER->getSuperRegion(), K);
758 if (!isa<SymbolData>(*SI))
766 if (
const SymbolDerived *SD = dyn_cast<SymbolDerived>(*SI)) {
775 get<DerivedSymTaint>(SD->getParentSymbol())) {
777 for (
auto I : *Regs) {
782 if (Kind ==
I.second &&
796 if (
const SymbolCast *SC = dyn_cast<SymbolCast>(*SI)) {
virtual ProgramStateRef assume(ProgramStateRef state, DefinedSVal Cond, bool Assumption)=0
ProgramStateRef addGDM(ProgramStateRef St, void *Key, void *Data)
const SymExpr * getAsSymExpr() const
ProgramStateManager & getStateManager() const
Return the ProgramStateManager associated with this state.
ProgramStateRef enterStackFrame(const CallEvent &Call, const StackFrameContext *CalleeCtx) const
enterStackFrame - Returns the state for entry to the given stack frame, preserving the current state...
TypedValueRegion - An abstract class representing regions having a typed value.
ProgramStateRef processRegionChange(ProgramStateRef state, const MemRegion *MR, const LocationContext *LCtx)
A (possibly-)qualified type.
MemRegion - The root abstract class for all memory regions.
void print(raw_ostream &Out, const char *NL, const char *Sep) const
ProgramStateRef bindDefault(SVal loc, SVal V, const LocationContext *LCtx) const
SValBuilder * createSimpleSValBuilder(llvm::BumpPtrAllocator &alloc, ASTContext &context, ProgramStateManager &stateMgr)
Stmt - This represents one statement.
Information about invalidation for a particular region/symbol.
SVal getRawSVal(Loc LV, QualType T=QualType()) const
Returns the "raw" SVal bound to LV before any value simplfication.
ProgramStateRef addTaint(const Stmt *S, const LocationContext *LCtx, TaintTagType Kind=TaintTagGeneric) const
Create a new state in which the statement is marked as tainted.
virtual bool isBoundable() const
Manages the lifetime of CallEvent objects.
Store getStore() const
Return the store associated with this state.
const void * Store
Store - This opaque type encapsulates an immutable mapping from locations to values.
Value representing integer constant.
A utility class that visits the reachable symbols using a custom SymbolVisitor.
ProgramStateRef bindLoc(Loc location, SVal V, const LocationContext *LCtx, bool notifyChanges=true) const
friend class ProgramState
std::unique_ptr< ConstraintManager >(* ConstraintManagerCreator)(ProgramStateManager &, SubEngine *)
const MemRegion * getBaseRegion() const
ProgramStateRef removeDeadBindings(ProgramStateRef St, const StackFrameContext *LCtx, SymbolReaper &SymReaper)
bool isZeroConstant() const
bool isTainted(const Stmt *S, const LocationContext *LCtx, TaintTagType Kind=TaintTagGeneric) const
Check if the statement is tainted in the current state.
Holds long-lived AST nodes (such as types and decls) that can be referred to throughout the semantic ...
SubEngine * getOwningEngine()
Environment bindExpr(Environment Env, const EnvironmentEntry &E, SVal V, bool Invalidate)
Bind a symbolic value to the given environment entry.
SValBuilder & getSValBuilder()
i32 captured_struct **param SharedsTy A type which contains references the shared variables *param Shareds Context with the list of shared variables from the p *TaskFunction *param Data Additional data for task generation like final * state
void setReapedStore(StoreRef st)
Set to the value of the symbolic store after StoreManager::removeDeadBindings has been called...
const llvm::APSInt & Convert(const llvm::APSInt &To, const llvm::APSInt &From)
Convert - Create a new persistent APSInt with the same value as 'From' but with the bitwidth and sign...
static bool isLocType(QualType T)
BlockDataRegion - A region that represents a block instance.
void *const * FindGDM(void *K) const
bool isUnknownOrUndef() const
virtual void decrementReferenceCount(Store store)
If the StoreManager supports it, decrement the reference count of the specified Store object...
A symbol representing the value of a MemRegion whose parent region has symbolic value.
detail::InMemoryDirectory::const_iterator I
SVal getSValAsScalarOrLoc(const Stmt *Ex, const LocationContext *LCtx) const
virtual void print(ProgramStateRef state, raw_ostream &Out, const char *nl, const char *sep)=0
ProgramStateRef addPartialTaint(SymbolRef ParentSym, const SubRegion *SubRegion, TaintTagType Kind=TaintTagGeneric) const
Create a new state in a which a sub-region of a given symbol is tainted.
llvm::ImmutableList< SVal >::iterator iterator
SymbolicRegion - A special, "non-concrete" region.
ProgramStateRef invalidateRegions(ArrayRef< const MemRegion * > Regions, const Expr *E, unsigned BlockCount, const LocationContext *LCtx, bool CausesPointerEscape, InvalidatedSymbols *IS=nullptr, const CallEvent *Call=nullptr, RegionAndSymbolInvalidationTraits *ITraits=nullptr) const
Returns the state with bindings for the given regions cleared from the store.
ProgramState - This class encapsulates:
Expr - This represents one expression.
const VarRegion * getCapturedRegion() const
SVal getSVal(const Stmt *S, const LocationContext *LCtx) const
Returns the SVal bound to the statement 'S' in the state's environment.
Optional< T > getAs() const
Convert to the specified SVal type, returning None if this SVal is not of the desired type...
Represents a cast expression.
StoreManager & getStoreManager()
const LazyCompoundValData * getCVData() const
ProgramStateRef BindExpr(const Stmt *S, const LocationContext *LCtx, SVal V, bool Invalidate=true) const
Create a new state by binding the value 'V' to the statement 'S' in the state's environment.
ProgramStateRef removeGDM(ProgramStateRef state, void *Key)
virtual bool VisitMemRegion(const MemRegion *region)
bool scan(nonloc::LazyCompoundVal val)
Environment getInitialEnvironment()
bool isIntegralOrEnumerationType() const
Determine whether this type is an integral or enumeration type.
ProgramStateRef getInitialState(const LocationContext *InitLoc)
ProgramStateRef assumeInBound(DefinedOrUnknownSVal idx, DefinedOrUnknownSVal upperBound, bool assumption, QualType IndexType=QualType()) const
bool isSubRegionOf(const MemRegion *R) const override
Check if the region is a subregion of the given region.
An entry in the environment consists of a Stmt and an LocationContext.
ASTContext & getContext()
SVal - This represents a symbolic expression, which can be either an L-value or an R-value...
A class responsible for cleaning up unused symbols.
const VarRegion * getRegion(const VarDecl *D, const LocationContext *LC) const
Utility method for getting regions.
ConditionTruthVal isNull(SVal V) const
Check if the given SVal is constrained to zero or is a zero constant.
void printDOT(raw_ostream &Out) const
ProgramStateRef getPersistentStateWithGDM(ProgramStateRef FromState, ProgramStateRef GDMState)
virtual SVal evalBinOpNN(ProgramStateRef state, BinaryOperator::Opcode op, NonLoc lhs, NonLoc rhs, QualType resultTy)=0
Create a new value which represents a binary expression with two non- location operands.
An immutable map from EnvironemntEntries to SVals.
if(T->getSizeExpr()) TRY_TO(TraverseStmt(T-> getSizeExpr()))
A symbol representing the value stored at a MemRegion.
virtual bool VisitSymbol(SymbolRef sym)=0
A visitor method invoked by ProgramStateManager::scanReachableSymbols.
void ProgramStateRelease(const ProgramState *state)
Decrement the number of times this state is referenced.
ArrayRef< const MemRegion * > RegionList
static symbol_iterator symbol_end()
detail::InMemoryDirectory::const_iterator E
const MemRegion * getAsRegion() const
virtual void print(Store store, raw_ostream &Out, const char *nl, const char *sep)=0
ProgramStateRef killBinding(Loc LV) const
Represents an abstract call to a function or method along a particular path.
virtual bool scanReachableSymbols(Store S, const MemRegion *R, ScanReachableSymbols &Visitor)=0
Finds the transitive closure of symbols within the given region.
const llvm::APSInt & getMinValue(const llvm::APSInt &v)
ConstraintManager & getConstraintManager()
BasicValueFactory & getBasicValueFactory()
SubRegion - A region that subsets another larger region.
const TypedValueRegion * getRegion() const
ProgramState(ProgramStateManager *mgr, const Environment &env, StoreRef st, GenericDataMap gdm)
This ctor is used when creating the first ProgramState object.
void ProgramStateRetain(const ProgramState *state)
Increments the number of times this state is referenced.
X
Add a minimal nested name specifier fixit hint to allow lookup of a tag name from an outer enclosing ...
ProgramStateManager(ASTContext &Ctx, StoreManagerCreator CreateStoreManager, ConstraintManagerCreator CreateConstraintManager, llvm::BumpPtrAllocator &alloc, SubEngine *subeng)
void print(raw_ostream &Out, const char *nl="\n", const char *sep="") const
Environment removeDeadBindings(Environment Env, SymbolReaper &SymReaper, ProgramStateRef state)
void * FindGDMContext(void *index, void *(*CreateContext)(llvm::BumpPtrAllocator &), void(*DeleteContext)(void *))
SymbolRef getAsSymbol(bool IncludeBaseRegions=false) const
If this SVal wraps a symbol return that SymbolRef.
virtual void incrementReferenceCount(Store store)
If the StoreManager supports it, increment the reference count of the specified Store object...
symbol_iterator symbol_begin() const
ElementRegin is used to represent both array elements and casts.
virtual ProgramStateRef notifyCheckersOfPointerEscape(ProgramStateRef State, const InvalidatedSymbols *Invalidated, ArrayRef< const MemRegion * > ExplicitRegions, ArrayRef< const MemRegion * > Regions, const CallEvent *Call, RegionAndSymbolInvalidationTraits &HTraits)=0
virtual void printState(raw_ostream &Out, ProgramStateRef State, const char *NL, const char *Sep)=0
printState - Called by ProgramStateManager to print checker-specific data.
static void Profile(llvm::FoldingSetNodeID &ID, const ProgramState *V)
Profile - Profile the contents of a ProgramState object for use in a FoldingSet.
virtual const llvm::APSInt * getSymVal(ProgramStateRef state, SymbolRef sym) const
If a symbol is perfectly constrained to a constant, attempt to return the concrete value...
const SymExpr * getAsSymbolicExpression() const
getAsSymbolicExpression - If this Sval wraps a symbolic expression then return that expression...
ProgramStateRef getPersistentState(ProgramState &Impl)
BasicValueFactory & getBasicVals() const
virtual ProgramStateRef processRegionChanges(ProgramStateRef state, const InvalidatedSymbols *invalidated, ArrayRef< const MemRegion * > ExplicitRegions, ArrayRef< const MemRegion * > Regions, const LocationContext *LCtx, const CallEvent *Call)=0
processRegionChanges - Called by ProgramStateManager whenever a change is made to the store...
bool isNull() const
Return true if this QualType doesn't point to a type yet.
T castAs() const
Convert to the specified SVal type, asserting that this SVal is of the desired type.
void printTaint(raw_ostream &Out, const char *nl="\n", const char *sep="") const
ArrayRef< SVal > ValueList
Expr * IgnoreParens() LLVM_READONLY
IgnoreParens - Ignore parentheses.
bool scanReachableSymbols(SVal val, SymbolVisitor &visitor) const
Visits the symbols reachable from the given SVal using the provided SymbolVisitor.
std::unique_ptr< StoreManager >(* StoreManagerCreator)(ProgramStateManager &)
Iterator over symbols that the current symbol depends on.
const void * getStore() const