19 using namespace clang;
59 SVal LeftV = state->getSVal(LHS, LCtx);
60 SVal RightV = state->getSVal(RHS, LCtx);
64 if (Op == BO_Assign) {
75 evalStore(Tmp2, B, LHS, *it, state->BindExpr(B, LCtx, ExprVal),
88 RightV, LeftV, RHS, svalBuilder, Count, LCtx);
90 LeftV, RightV, LHS, svalBuilder, Count, LCtx);
97 state = createTemporaryRegionIfNeeded(state, LCtx, LHS);
103 state = state->BindExpr(B, LCtx, Result);
114 llvm_unreachable(
"Invalid opcode for compound assignment.");
115 case BO_MulAssign: Op = BO_Mul;
break;
116 case BO_DivAssign: Op = BO_Div;
break;
117 case BO_RemAssign: Op = BO_Rem;
break;
118 case BO_AddAssign: Op = BO_Add;
break;
119 case BO_SubAssign: Op = BO_Sub;
break;
120 case BO_ShlAssign: Op = BO_Shl;
break;
121 case BO_ShrAssign: Op = BO_Shr;
break;
122 case BO_AndAssign: Op = BO_And;
break;
123 case BO_XorAssign: Op = BO_Xor;
break;
124 case BO_OrAssign: Op = BO_Or;
break;
130 SVal location = LeftV;
131 evalLoad(Tmp, B, LHS, *it, state, location);
136 state = (*I)->getState();
138 SVal V = state->getSVal(LHS, LCtx);
142 cast<CompoundAssignOperator>(B)->getComputationResultType();
146 cast<CompoundAssignOperator>(B)->getComputationLHSType();
152 V = svalBuilder.
evalCast(V, CLHSTy, LTy);
170 Result = svalBuilder.
evalCast(LHSVal, CTy, LTy);
175 LHSVal = svalBuilder.
evalCast(Result, LTy, CTy);
181 state = state->BindExpr(B, LCtx, location);
183 state = state->BindExpr(B, LCtx, Result);
185 evalStore(Tmp2, B, LHS, *I, state, location, LHSVal);
209 dyn_cast_or_null<BlockDataRegion>(V.
getAsRegion())) {
212 E = BDR->referenced_vars_end();
216 for (; I != E; ++I) {
226 const Expr *copyExpr =
nullptr;
228 assert(CI->getVariable() == capturedR->
getDecl());
229 copyExpr = CI->getCopyExpr();
233 if (capturedR != originalR) {
237 originalV = State->getSVal(copyExpr, LCtx);
268 SVal OrigV = state->getSVal(Ex, LCtx);
271 if (CastE->
getCastKind() == CK_BooleanToSignedIntegral)
273 state = state->BindExpr(CastE, LCtx, V);
292 state = state->BindExpr(CastE, LCtx, result);
310 evalLoad(Dst, CastE, CastE, subExprNode, state, state->getSVal(Ex, LCtx));
319 if (
const ExplicitCastExpr *ExCast=dyn_cast_or_null<ExplicitCastExpr>(CastE))
320 T = ExCast->getTypeAsWritten();
331 case CK_LValueToRValue:
332 llvm_unreachable(
"LValueToRValue casts handled earlier.");
337 case CK_ARCProduceObject:
338 case CK_ARCConsumeObject:
339 case CK_ARCReclaimReturnedObject:
340 case CK_ARCExtendBlockObject:
341 case CK_CopyAndAutoreleaseBlockObject:
345 case CK_AtomicToNonAtomic:
346 case CK_NonAtomicToAtomic:
349 case CK_ConstructorConversion:
350 case CK_UserDefinedConversion:
351 case CK_FunctionToPointerDecay:
352 case CK_BuiltinFnToFnPtr: {
356 SVal V = state->getSVal(Ex, LCtx);
357 state = state->BindExpr(CastE, LCtx, V);
361 case CK_MemberPointerToBoolean:
362 case CK_PointerToBoolean: {
363 SVal V = state->getSVal(Ex, LCtx);
366 V = svalBuilder.
makeTruthVal(!PTMSV->isNullMemberPointer(), ExTy);
368 state = state->BindExpr(CastE, LCtx, V);
378 case CK_ArrayToPointerDecay:
380 case CK_AddressSpaceConversion:
381 case CK_BooleanToSignedIntegral:
382 case CK_NullToPointer:
383 case CK_IntegralToPointer:
384 case CK_PointerToIntegral: {
385 SVal V = state->getSVal(Ex, LCtx);
387 state = state->BindExpr(CastE, LCtx,
UnknownVal());
396 case CK_IntegralToBoolean:
397 case CK_IntegralToFloating:
398 case CK_FloatingToIntegral:
399 case CK_FloatingToBoolean:
400 case CK_FloatingCast:
401 case CK_FloatingRealToComplex:
402 case CK_FloatingComplexToReal:
403 case CK_FloatingComplexToBoolean:
404 case CK_FloatingComplexCast:
405 case CK_FloatingComplexToIntegralComplex:
406 case CK_IntegralRealToComplex:
407 case CK_IntegralComplexToReal:
408 case CK_IntegralComplexToBoolean:
409 case CK_IntegralComplexCast:
410 case CK_IntegralComplexToFloatingComplex:
411 case CK_CPointerToObjCPointerCast:
412 case CK_BlockPointerToObjCPointerCast:
413 case CK_AnyPointerToBlockPointerCast:
414 case CK_ObjCObjectLValueCast:
415 case CK_ZeroToOCLEvent:
416 case CK_ZeroToOCLQueue:
417 case CK_IntToOCLSampler:
418 case CK_LValueBitCast: {
423 case CK_IntegralCast: {
425 SVal V = state->getSVal(Ex, LCtx);
427 state = state->BindExpr(CastE, LCtx, V);
431 case CK_DerivedToBase:
432 case CK_UncheckedDerivedToBase: {
434 SVal val = state->getSVal(Ex, LCtx);
436 state = state->BindExpr(CastE, LCtx, val);
442 SVal val = state->getSVal(Ex, LCtx);
466 state = state->BindExpr(CastE, LCtx, svalBuilder.
makeNull());
474 state = state->BindExpr(CastE, LCtx, NewSym);
477 state = state->BindExpr(CastE, LCtx, val);
482 case CK_BaseToDerived: {
483 SVal val = state->getSVal(Ex, LCtx);
500 state = state->BindExpr(CastE, LCtx, val);
504 case CK_NullToMemberPointer: {
506 state = state->BindExpr(CastE, LCtx, V);
510 case CK_DerivedToBaseMemberPointer:
511 case CK_BaseToDerivedMemberPointer:
512 case CK_ReinterpretMemberPointer: {
513 SVal V = state->getSVal(Ex, LCtx);
517 llvm::make_range<CastExpr::path_const_iterator>(
519 state = state->BindExpr(CastE, LCtx, CastedPTMSV);
529 case CK_VectorSplat: {
548 if (isa<CXXConstructExpr>(Init) || isa<CXXStdInitializerListExpr>(Init)) {
551 assert(isa<InitListExpr>(Init));
552 Loc CLLoc = State->getLValue(CL, LCtx);
553 State = State->bindLoc(CLLoc, V, LCtx);
590 SVal InitVal = state->getSVal(InitEx, LC);
594 state = finishObjectConstruction(state, DS, LC);
603 if (InitEx->isGLValue()) {
614 evalBind(Dst2, DS, UpdatedN, state->getLValue(VD, LC), InitVal,
true);
640 Bldr.generateNode(B, Pred, state);
665 assert(Term->isLogicalOp());
675 assert(!SrcBlock->
empty());
677 const Expr *RHS = cast<Expr>(Elem.getStmt());
680 if (RHSVal.isUndef()) {
712 if (NumInitElements == 0) {
719 ei = IE->
rend(); it != ei; ++it) {
720 SVal V = state->getSVal(cast<Expr>(*it), LCtx);
725 state->BindExpr(IE, LCtx,
733 assert(NumInitElements <= 1);
736 if (NumInitElements == 0)
739 V = state->getSVal(IE->
getInit(0), LCtx);
769 SrcState = N->getState();
773 assert(SrcBlock &&
"missing function entry");
777 bool hasValue =
false;
780 for (
CFGElement CE : llvm::reverse(*SrcBlock)) {
782 const Expr *ValEx = cast<Expr>(CS->getStmt());
788 L = OpaqueEx->getSourceExpr();
794 V = SrcState->getSVal(ValEx, LCtx);
805 B.
generateNode(Ex, Pred, state->BindExpr(Ex, LCtx, V,
true));
861 state = state->BindExpr(Ex, (*I)->getLocationContext(),
884 state->getSVal(Ex, LCtx)));
920 state->getSVal(Ex, LCtx)));
942 if (
const DeclRefExpr *DRE = dyn_cast<DeclRefExpr>(Ex)) {
945 if (isa<CXXMethodDecl>(VD) || isa<FieldDecl>(VD)) {
975 SVal V = state->getSVal(Ex, LCtx);
984 llvm_unreachable(
"Invalid Opcode.");
1002 }
else if (Ex->getType()->isFloatingType()) {
1011 state = state->BindExpr(U, LCtx, Result);
1032 SVal loc = state->getSVal(Ex, LCtx);
1036 evalLoad(Tmp, U, Ex, Pred, state, loc);
1042 state = (*I)->getState();
1043 assert(LCtx == (*I)->getLocationContext());
1044 SVal V2_untested = state->getSVal(Ex, LCtx);
1047 if (V2_untested.isUnknownOrUndef()) {
1048 state = state->BindExpr(U, LCtx, V2_untested);
1053 evalStore(Dst3, U, U, *I, state, loc, V2_untested);
1099 if (!state->assume(Constraint,
true)) {
1102 Constraint = svalBuilder.
evalEQ(state, SymVal,
1105 state = state->assume(Constraint,
false);
1114 state = state->BindExpr(U, LCtx, loc);
1116 state = state->BindExpr(U, LCtx, U->
isPostfix() ? V2 : Result);
1121 evalStore(Dst3, U, U, *I, state, loc, Result);
SVal attemptDownCast(SVal Base, QualType DerivedPtrType, bool &Failed)
Attempts to do a down cast.
const BlockDecl * getBlockDecl() const
nonloc::ConcreteInt makeIntVal(const IntegerLiteral *integer)
DefinedSVal getBlockPointer(const BlockDecl *block, CanQualType locTy, const LocationContext *locContext, unsigned blockCount)
reverse_iterator rbegin()
SVal evalDerivedToBase(SVal Derived, const CastExpr *Cast)
Evaluates a chain of derived-to-base casts through the path specified in Cast.
A (possibly-)qualified type.
succ_iterator succ_begin()
capture_const_iterator capture_begin() const
ImplTy::iterator iterator
const Expr * getInit(unsigned Init) const
unsigned blockCount() const
Returns the number of times the current basic block has been visited on the exploded graph path...
This builder class is useful for generating nodes that resulted from visiting a statement.
bool isRecordType() const
const CFGBlock * getSrc() const
QualType getLValueReferenceType(QualType T, bool SpelledAsLValue=true) const
Return the uniqued reference to the type for an lvalue reference to the specified type...
SVal evalBinOp(ProgramStateRef state, BinaryOperator::Opcode op, NonLoc L, NonLoc R, QualType T)
Represents a point after we ran remove dead bindings BEFORE processing the given statement.
T castAs() const
Convert to the specified CFGElement type, asserting that this CFGElement is of the desired type...
const ProgramStateRef & getState() const
SVal evalCast(SVal val, QualType castTy, QualType originalType)
Value representing integer constant.
capture_const_iterator capture_end() const
unsigned succ_size() const
void VisitUnaryOperator(const UnaryOperator *B, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitUnaryOperator - Transfer function logic for unary operators.
void takeNodes(const ExplodedNodeSet &S)
bool EvaluateAsInt(llvm::APSInt &Result, const ASTContext &Ctx, SideEffectsKind AllowSideEffects=SE_NoSideEffects) const
EvaluateAsInt - Return true if this is a constant which we can fold and convert to an integer...
void handleUOExtension(ExplodedNodeSet::iterator I, const UnaryOperator *U, StmtNodeBuilder &Bldr)
Represents a variable declaration or definition.
CompoundLiteralExpr - [C99 6.5.2.5].
const T * getAs() const
Member-template getAs<specific type>'.
NonLoc makeArrayIndex(uint64_t idx)
static Optional< SVal > getObjectUnderConstruction(ProgramStateRef State, const ConstructionContextItem &Item, const LocationContext *LC)
By looking at a certain item that may be potentially part of an object's ConstructionContext, retrieve such object's location.
void evalStore(ExplodedNodeSet &Dst, const Expr *AssignE, const Expr *StoreE, ExplodedNode *Pred, ProgramStateRef St, SVal TargetLV, SVal Val, const ProgramPointTag *tag=nullptr)
evalStore - Handle the semantics of a store via an assignment.
static bool isAssignmentOp(Opcode Opc)
Defines the clang::Expr interface and subclasses for C++ expressions.
bool isVariableArrayType() const
InitExprsTy::const_reverse_iterator const_reverse_iterator
Represents a class type in Objective C.
Value representing pointer-to-member.
const VarRegion * getOriginalRegion() const
SVal evalIntegralCast(ProgramStateRef state, SVal val, QualType castTy, QualType originalType)
Loc makeNullWithType(QualType type)
Create NULL pointer, with proper pointer bit-width for given address space.
static bool isIncrementDecrementOp(Opcode Op)
bool isReferenceType() const
i32 captured_struct **param SharedsTy A type which contains references the shared variables *param Shareds Context with the list of shared variables from the p *TaskFunction *param Data Additional data for task generation like final * state
bool isIntegralOrEnumerationType() const
Determine whether this type is an integral or enumeration type.
llvm::ImmutableList< SVal > prependSVal(SVal X, llvm::ImmutableList< SVal > L)
static bool isLocType(QualType T)
Describes an C or C++ initializer list.
void VisitOffsetOfExpr(const OffsetOfExpr *Ex, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitOffsetOfExpr - Transfer function for offsetof.
BlockDataRegion - A region that represents a block instance.
ExplodedNode * generateSink(const Stmt *S, ExplodedNode *Pred, ProgramStateRef St, const ProgramPointTag *tag=nullptr, ProgramPoint::Kind K=ProgramPoint::PostStmtKind)
CharUnits - This is an opaque type for sizes expressed in character units.
path_iterator path_begin()
const LocationContext * getLocationContext() const
A builtin binary operation expression such as "x + y" or "x <= y".
NonLoc makePointerToMember(const DeclaratorDecl *DD)
static bool isPostfix(Opcode Op)
isPostfix - Return true if this is a postfix operation, like x++.
bool isRValueReferenceType() const
NonLoc makeCompoundVal(QualType type, llvm::ImmutableList< SVal > vals)
CastExpr - Base class for type casts, including both implicit casts (ImplicitCastExpr) and explicit c...
SVal evalComplement(SVal X)
void VisitDeclStmt(const DeclStmt *DS, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitDeclStmt - Transfer function logic for DeclStmts.
unsigned pred_size() const
void evalBind(ExplodedNodeSet &Dst, const Stmt *StoreE, ExplodedNode *Pred, SVal location, SVal Val, bool atDeclInit=false, const ProgramPoint *PP=nullptr)
evalBind - Handle the semantics of binding a value to a specific location.
CheckerManager & getCheckerManager() const
void VisitLogicalExpr(const BinaryOperator *B, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitLogicalExpr - Transfer function logic for '&&', '||'.
const VarRegion * getCapturedRegion() const
UnaryExprOrTypeTraitExpr - expression with either a type or (unevaluated) expression operand...
Represents a single basic block in a source-level CFG.
void VisitInitListExpr(const InitListExpr *E, ExplodedNode *Pred, ExplodedNodeSet &Dst)
QuantityType getQuantity() const
getQuantity - Get the raw integer representation of this quantity.
llvm::APSInt EvaluateKnownConstInt(const ASTContext &Ctx, SmallVectorImpl< PartialDiagnosticAt > *Diag=nullptr) const
EvaluateKnownConstInt - Call EvaluateAsRValue and return the folded integer.
void runCheckersForPostStmt(ExplodedNodeSet &Dst, const ExplodedNodeSet &Src, const Stmt *S, ExprEngine &Eng, bool wasInlined=false)
Run checkers for post-visiting Stmts.
DefinedOrUnknownSVal makeZeroVal(QualType type)
Construct an SVal representing '0' for the specified type.
Pepresents a block literal declaration, which is like an unnamed FunctionDecl.
Represent the declaration of a variable (in which case it is an lvalue) a function (in which case it ...
Expr - This represents one expression.
static SVal conjureOffsetSymbolOnLocation(SVal Symbol, SVal Other, Expr *Expression, SValBuilder &svalBuilder, unsigned Count, const LocationContext *LCtx)
Optionally conjure and return a symbol for offset when processing an expression Expression.
void VisitCast(const CastExpr *CastE, const Expr *Ex, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitCast - Transfer function logic for all casts (implicit and explicit).
BlockExpr - Adaptor class for mixing a BlockDecl with expressions.
unsigned getNumInits() const
const ExplodedNodeSet & getResults()
bool isAnyComplexType() const
static CharUnits fromQuantity(QuantityType Quantity)
fromQuantity - Construct a CharUnits quantity from a raw integer type.
static SVal getValue(SVal val, SValBuilder &svalBuilder)
bool isSignedIntegerType() const
Return true if this is an integer type that is signed, according to C99 6.2.5p4 [char, signed char, short, int, long..], or an enum decl which has a signed representation.
const CFGBlock * getDst() const
QualType getTypeOfArgument() const
Gets the argument type, or the type of the argument expression, whichever is appropriate.
The reason for pointer escape is unknown.
ASTContext & getContext() const
getContext - Return the ASTContext associated with this analysis.
UnaryOperator - This represents the unary-expression's (except sizeof and alignof), the postinc/postdec operators from postfix-expression, and various extensions.
void evalLoad(ExplodedNodeSet &Dst, const Expr *NodeEx, const Expr *BoundExpr, ExplodedNode *Pred, ProgramStateRef St, SVal location, const ProgramPointTag *tag=nullptr, QualType LoadTy=QualType())
Simulate a read of the result of Ex.
reverse_iterator rbegin()
const VarDecl * getDecl() const
Optional< T > getAs() const
Convert to the specified SVal type, returning None if this SVal is not of the desired type...
CFGTerminator getTerminator()
OpaqueValueExpr - An expression referring to an opaque object of a fixed type and value class...
bool isBuiltinType() const
Helper methods to distinguish type categories.
void VisitGuardedExpr(const Expr *Ex, const Expr *L, const Expr *R, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitGuardedExpr - Transfer function logic for ?, __builtin_choose.
DefinedOrUnknownSVal conjureSymbolVal(const void *symbolTag, const Expr *expr, const LocationContext *LCtx, unsigned count)
Create a new symbol with a unique 'name'.
Expr * getSubExpr() const
T castAs() const
Convert to the specified ProgramPoint type, asserting that this ProgramPoint is of the desired type...
CastKind getCastKind() const
const MemRegion * getAsRegion() const
DeclStmt - Adaptor class for mixing declarations with statements and expressions. ...
void VisitCompoundLiteralExpr(const CompoundLiteralExpr *CL, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitCompoundLiteralExpr - Transfer function logic for compound literals.
ProgramStateRef handleLVectorSplat(ProgramStateRef state, const LocationContext *LCtx, const CastExpr *CastE, StmtNodeBuilder &Bldr, ExplodedNode *Pred)
ProgramPoint getLocation() const
getLocation - Returns the edge associated with the given node.
SVal - This represents a symbolic expression, which can be either an L-value or an R-value...
UnaryExprOrTypeTrait getKind() const
decl_iterator decl_begin()
void VisitUnaryExprOrTypeTraitExpr(const UnaryExprOrTypeTraitExpr *Ex, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitUnaryExprOrTypeTraitExpr - Transfer function for sizeof.
bool isAnyPointerType() const
BasicValueFactory & getBasicVals()
void runCheckersForPreStmt(ExplodedNodeSet &Dst, const ExplodedNodeSet &Src, const Stmt *S, ExprEngine &Eng)
Run checkers for pre-visiting Stmts.
bool isVectorType() const
void insert(const ExplodedNodeSet &S)
const Expr * getInitializer() const
Dataflow Directional Tag Classes.
void VisitIncrementDecrementOperator(const UnaryOperator *U, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Handle ++ and – (both pre- and post-increment).
SValBuilder & getSValBuilder()
void addNodes(const ExplodedNodeSet &S)
StoreManager & getStoreManager()
bool isZeroConstant() const
const Expr * getInit() const
bool isBooleanType() const
SVal evalEQ(ProgramStateRef state, SVal lhs, SVal rhs)
ExplicitCastExpr - An explicit cast written in the source code.
bool isSingleDecl() const
isSingleDecl - This method returns true if this DeclStmt refers to a single Decl. ...
ProgramStateRef handleLValueBitCast(ProgramStateRef state, const Expr *Ex, const LocationContext *LCtx, QualType T, QualType ExTy, const CastExpr *CastE, StmtNodeBuilder &Bldr, ExplodedNode *Pred)
T castAs() const
Convert to the specified SVal type, asserting that this SVal is of the desired type.
bool isConstantSizeType() const
Return true if this is not a variable sized type, according to the rules of C99 6.7.5p3.
DefinedSVal getMemberPointer(const DeclaratorDecl *DD)
static bool isAdditiveOp(Opcode Opc)
uint64_t getTypeSize(QualType T) const
Return the size of the specified (complete) type T, in bits.
bool isIncompleteType(NamedDecl **Def=nullptr) const
Types are partitioned into 3 broad categories (C99 6.2.5p1): object types, function types...
static bool isIncrementOp(Opcode Op)
CanQualType getCanonicalType(QualType T) const
Return the canonical (structural) type corresponding to the specified potentially non-canonical type ...
bool isLValueReferenceType() const
X
Add a minimal nested name specifier fixit hint to allow lookup of a tag name from an outer enclosing ...
void VisitBlockExpr(const BlockExpr *BE, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitBlockExpr - Transfer function logic for BlockExprs.
Defines the C++ Decl subclasses, other than those for templates (found in DeclTemplate.h) and friends (in DeclFriend.h).
static bool isCompoundAssignmentOp(Opcode Opc)
QualType getRValueReferenceType(QualType T) const
Return the uniqued reference to the type for an rvalue reference to the specified type...
pred_iterator pred_begin()
Represents a top-level expression in a basic block.
QualType getPointerType(QualType T) const
Return the uniqued reference to the type for a pointer to the specified type.
This class is used for builtin types like 'int'.
Represents CFGBlock terminator statement.
ExplodedNode * generateNode(const Stmt *S, ExplodedNode *Pred, ProgramStateRef St, const ProgramPointTag *tag=nullptr, ProgramPoint::Kind K=ProgramPoint::PostStmtKind)
A reference to a declared variable, function, enum, etc.
nonloc::ConcreteInt makeTruthVal(bool b, QualType type)
ProgramStateRef escapeValue(ProgramStateRef State, SVal V, PointerEscapeKind K) const
A simple wrapper when you only need to notify checkers of pointer-escape of a single value...
Optional< T > getAs() const
Convert to the specified ProgramPoint type, returning None if this ProgramPoint is not of the desired...
OffsetOfExpr - [C99 7.17] - This represents an expression of the form offsetof(record-type, member-designator).
void VisitBinaryOperator(const BinaryOperator *B, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitBinaryOperator - Transfer function logic for binary operators.
bool isUnknownOrUndef() const
llvm::ImmutableList< SVal > getEmptySValList()
Expr * IgnoreParens() LLVM_READONLY
IgnoreParens - Ignore parentheses.