63 #include "llvm/ADT/APSInt.h" 64 #include "llvm/ADT/DenseMap.h" 65 #include "llvm/ADT/ImmutableMap.h" 66 #include "llvm/ADT/ImmutableSet.h" 67 #include "llvm/ADT/Optional.h" 68 #include "llvm/ADT/SmallVector.h" 69 #include "llvm/ADT/Statistic.h" 70 #include "llvm/Support/Casting.h" 71 #include "llvm/Support/Compiler.h" 72 #include "llvm/Support/DOTGraphTraits.h" 73 #include "llvm/Support/ErrorHandling.h" 74 #include "llvm/Support/GraphWriter.h" 75 #include "llvm/Support/SaveAndRestore.h" 76 #include "llvm/Support/raw_ostream.h" 85 using namespace clang;
88 #define DEBUG_TYPE "ExprEngine" 91 "The # of times RemoveDeadBindings is called");
93 "The # of aborted paths due to reaching the maximum block count in " 94 "a top level function");
95 STATISTIC(NumMaxBlockCountReachedInInlined,
96 "The # of aborted paths due to reaching the maximum block count in " 97 "an inlined function");
99 "The # of times we re-evaluated a call without inlining");
120 typedef std::pair<ConstructionContextItem, const LocationContext *>
121 ConstructedObjectKeyImpl;
123 const ConstructedObjectKeyImpl Impl;
125 const void *getAnyASTNodePtr()
const {
126 if (
const Stmt *S = getItem().getStmtOrNull())
129 return getItem().getCXXCtorInitializer();
141 OS <<
'(' << getLocationContext() <<
',' << getAnyASTNodePtr() <<
',' 142 << getItem().getKindAsString();
144 OS <<
" #" << getItem().getIndex();
146 if (
const Stmt *S = getItem().getStmtOrNull()) {
147 S->printPretty(OS, Helper, PP);
156 ID.AddPointer(Impl.second);
160 return Impl == RHS.Impl;
164 return Impl < RHS.Impl;
168 typedef llvm::ImmutableMap<ConstructedObjectKey, SVal>
177 static const char* TagProviderName =
"ExprEngine";
184 : CTU(CTU), AMgr(mgr),
185 AnalysisDeclContexts(mgr.getAnalysisDeclContextManager()),
186 Engine(*this, FS, mgr.getAnalyzerOptions()), G(Engine.getGraph()),
187 StateMgr(getContext(), mgr.getStoreManagerCreator(),
188 mgr.getConstraintManagerCreator(), G.getAllocator(),
190 SymMgr(StateMgr.getSymbolManager()),
191 svalBuilder(StateMgr.getSValBuilder()), ObjCNoRet(mgr.getASTContext()),
192 ObjCGCEnabled(gcEnabled), BR(mgr, *this),
193 VisitedCallees(VisitedCalleesIn), HowToInline(HowToInlineIn) {
195 if (TrimInterval != 0) {
217 if (
const auto *FD = dyn_cast<FunctionDecl>(D)) {
221 if (!II || !(II->
getName() ==
"main" && FD->getNumParams() > 0))
227 if (!BT || !BT->isInteger())
230 const MemRegion *R = state->getRegion(PD, InitLoc);
252 if (
const auto *MD = dyn_cast<ObjCMethodDecl>(D)) {
256 const MemRegion *R = state->getRegion(SelfD, InitLoc);
261 state = state->assume(*LV,
true);
262 assert(state &&
"'self' cannot be null");
266 if (
const auto *MD = dyn_cast<CXXMethodDecl>(D)) {
267 if (!MD->isStatic()) {
274 SVal V = state->getSVal(L);
276 state = state->assume(*LV,
true);
277 assert(state &&
"'this' cannot be null");
289 const Expr *InitWithAdjustments,
290 const Expr *Result) {
296 SVal InitValWithAdjustments = State->getSVal(InitWithAdjustments, LC);
302 Result = InitWithAdjustments;
306 assert(!InitValWithAdjustments.
getAs<
Loc>() ||
340 CommaLHSs, Adjustments);
348 if (
const auto *MT = dyn_cast<MaterializeTemporaryExpr>(Result)) {
350 State = finishObjectConstruction(State, MT, LC);
351 State = State->BindExpr(Result, LC, *V);
371 for (
auto I = Adjustments.rbegin(), E = Adjustments.rend(); I != E; ++I) {
382 State = State->invalidateRegions(Reg, InitWithAdjustments,
384 nullptr,
nullptr,
nullptr);
397 SVal InitVal = State->getSVal(Init, LC);
401 State = State->bindLoc(BaseReg.
castAs<
Loc>(), InitVal, LC,
false);
405 if (InitValWithAdjustments.
isUnknown()) {
409 Result, LC, InitWithAdjustments->
getType(),
413 State->bindLoc(Reg.
castAs<
Loc>(), InitValWithAdjustments, LC,
false);
415 State = State->bindLoc(BaseReg.
castAs<
Loc>(), InitVal, LC,
false);
421 State = State->BindExpr(Result, LC, Reg);
436 assert(!State->get<ObjectsUnderConstruction>(Key) ||
437 Key.getItem().getKind() ==
439 return State->set<ObjectsUnderConstruction>(Key, V);
455 assert(State->contains<ObjectsUnderConstruction>(Key));
456 return State->remove<ObjectsUnderConstruction>(Key);
465 return State->set<ObjectsUnderConstruction>(Key,
UnknownVal());
473 assert(State->contains<ObjectsUnderConstruction>(Key));
474 return State->remove<ObjectsUnderConstruction>(Key);
481 return State->contains<ObjectsUnderConstruction>(Key);
489 assert(LC &&
"ToLC must be a parent of FromLC!");
490 for (
auto I : State->get<ObjectsUnderConstruction>())
491 if (I.first.getLocationContext() == LC)
507 SVal cond,
bool assumption) {
530 for (
auto I : State->get<ObjectsUnderConstruction>()) {
535 Key.
print(Out,
nullptr, PP);
536 Out <<
" : " << Value << NL;
541 const char *NL,
const char *Sep,
544 if (!State->get<ObjectsUnderConstruction>().isEmpty()) {
545 Out << Sep <<
"Objects under construction:" << NL;
563 currStmtIdx = StmtIdx;
623 const Stmt *ReferenceStmt,
625 const Stmt *DiagnosticStmt,
628 ReferenceStmt ==
nullptr || isa<ReturnStmt>(ReferenceStmt))
629 &&
"PostStmt is not generally supported by the SymbolReaper yet");
630 assert(LC &&
"Must pass the current (or expiring) LocationContext");
632 if (!DiagnosticStmt) {
633 DiagnosticStmt = ReferenceStmt;
634 assert(DiagnosticStmt &&
"Required for clearing a LocationContext");
637 NumRemoveDeadBindings++;
643 if (!ReferenceStmt) {
645 "Use PostStmtPurgeDeadSymbolsKind for clearing a LocationContext");
652 for (
auto I : CleanedState->get<ObjectsUnderConstruction>()) {
653 if (
SymbolRef Sym = I.second.getAsSymbol())
655 if (
const MemRegion *MR = I.second.getAsRegion())
674 Bldr.
generateNode(DiagnosticStmt, Pred, CleanedState, &cleanupTag, K);
681 DiagnosticStmt, *
this, K);
687 for (
const auto I : CheckedSet) {
695 "Checkers are not allowed to modify the Environment as a part of " 696 "checkDeadSymbols processing.");
698 "Checkers are not allowed to modify the Store as a part of " 699 "checkDeadSymbols processing.");
705 Bldr.
generateNode(DiagnosticStmt, I, CleanedCheckerSt, &cleanupTag, K);
716 "Error evaluating statement");
725 CleanedStates.Add(Pred);
729 for (
const auto I : CleanedStates) {
732 Visit(currStmt, I, DstI);
743 "Error evaluating end of the loop");
766 "Error evaluating initializer");
770 const auto *
decl = cast<CXXConstructorDecl>(stackFrame->getDecl());
773 SVal thisVal = State->getSVal(svalBuilder.
getCXXThis(decl, stackFrame));
785 State = finishObjectConstruction(State, BMI, LC);
787 PostStore PS(Init, LC,
nullptr,
nullptr);
796 FieldLoc = State->getLValue(BMI->
getMember(), thisVal);
804 while ((ASE = dyn_cast<ArraySubscriptExpr>(Init)))
807 SVal LValue = State->getSVal(Init, stackFrame);
810 InitVal = State->getSVal(*LValueLoc);
820 InitVal = State->getSVal(BMI->
getInit(), stackFrame);
824 evalBind(Tmp, Init, Pred, FieldLoc, InitVal,
true, &PP);
837 for (
const auto I : Tmp) {
866 llvm_unreachable(
"Unexpected dtor kind.");
903 const MemRegion *ValueRegion = state->getSVal(Region).getAsRegion();
912 varType = cast<TypedValueRegion>(Region)->getValueType();
923 Pred, Dst, CallOpts);
934 SVal ArgVal = State->getSVal(Arg, LCtx);
938 if (State->isNull(ArgVal).isConstrainedTrue()) {
945 Bldr.generateNode(PP, Pred->
getState(), Pred);
958 DTy = AT->getElementType();
970 const auto *CurDtor = cast<CXXDestructorDecl>(LCtx->
getDecl());
982 CurDtor->getBody(),
true, Pred, Dst, {});
992 const auto *CurDtor = cast<CXXDestructorDecl>(LCtx->
getDecl());
996 State->getLValue(Member, State->getSVal(ThisVal).castAs<
Loc>());
1002 FieldVal = makeZeroElementRegion(State, FieldVal, T,
1006 CurDtor->getBody(),
false, Pred, Dst, CallOpts);
1030 if (isDestructorElided(State, BTE, LC)) {
1031 State = cleanupElidedDestructor(State, BTE, LC);
1047 assert(CleanDtorState.
size() <= 1);
1049 CleanDtorState.
empty() ? Pred : *CleanDtorState.
begin();
1060 T = AT->getElementType();
1069 false, CleanPred, Dst, CallOpts);
1111 State = addObjectUnderConstruction(State, BTE, LC,
UnknownVal());
1119 class CollectReachableSymbolsCallback final :
public SymbolVisitor {
1127 bool VisitSymbol(
SymbolRef Sym)
override {
1128 Symbols.insert(Sym);
1133 const CollectReachableSymbolsCallback &Scanner =
1134 State->scanReachableSymbols<CollectReachableSymbolsCallback>(V);
1136 State, Scanner.getSymbols(),
nullptr, K,
nullptr);
1143 "Error evaluating statement");
1147 assert(!isa<Expr>(S) || S == cast<Expr>(S)->IgnoreParens());
1151 case Expr::ObjCIndirectCopyRestoreExprClass:
1152 case Stmt::CXXDependentScopeMemberExprClass:
1153 case Stmt::CXXInheritedCtorInitExprClass:
1154 case Stmt::CXXTryStmtClass:
1155 case Stmt::CXXTypeidExprClass:
1156 case Stmt::CXXUuidofExprClass:
1157 case Stmt::CXXFoldExprClass:
1158 case Stmt::MSPropertyRefExprClass:
1159 case Stmt::MSPropertySubscriptExprClass:
1160 case Stmt::CXXUnresolvedConstructExprClass:
1161 case Stmt::DependentScopeDeclRefExprClass:
1162 case Stmt::ArrayTypeTraitExprClass:
1163 case Stmt::ExpressionTraitExprClass:
1164 case Stmt::UnresolvedLookupExprClass:
1165 case Stmt::UnresolvedMemberExprClass:
1166 case Stmt::TypoExprClass:
1167 case Stmt::CXXNoexceptExprClass:
1168 case Stmt::PackExpansionExprClass:
1169 case Stmt::SubstNonTypeTemplateParmPackExprClass:
1170 case Stmt::FunctionParmPackExprClass:
1171 case Stmt::CoroutineBodyStmtClass:
1172 case Stmt::CoawaitExprClass:
1173 case Stmt::DependentCoawaitExprClass:
1174 case Stmt::CoreturnStmtClass:
1175 case Stmt::CoyieldExprClass:
1176 case Stmt::SEHTryStmtClass:
1177 case Stmt::SEHExceptStmtClass:
1178 case Stmt::SEHLeaveStmtClass:
1179 case Stmt::SEHFinallyStmtClass:
1180 case Stmt::OMPParallelDirectiveClass:
1181 case Stmt::OMPSimdDirectiveClass:
1182 case Stmt::OMPForDirectiveClass:
1183 case Stmt::OMPForSimdDirectiveClass:
1184 case Stmt::OMPSectionsDirectiveClass:
1185 case Stmt::OMPSectionDirectiveClass:
1186 case Stmt::OMPSingleDirectiveClass:
1187 case Stmt::OMPMasterDirectiveClass:
1188 case Stmt::OMPCriticalDirectiveClass:
1189 case Stmt::OMPParallelForDirectiveClass:
1190 case Stmt::OMPParallelForSimdDirectiveClass:
1191 case Stmt::OMPParallelSectionsDirectiveClass:
1192 case Stmt::OMPTaskDirectiveClass:
1193 case Stmt::OMPTaskyieldDirectiveClass:
1194 case Stmt::OMPBarrierDirectiveClass:
1195 case Stmt::OMPTaskwaitDirectiveClass:
1196 case Stmt::OMPTaskgroupDirectiveClass:
1197 case Stmt::OMPFlushDirectiveClass:
1198 case Stmt::OMPOrderedDirectiveClass:
1199 case Stmt::OMPAtomicDirectiveClass:
1200 case Stmt::OMPTargetDirectiveClass:
1201 case Stmt::OMPTargetDataDirectiveClass:
1202 case Stmt::OMPTargetEnterDataDirectiveClass:
1203 case Stmt::OMPTargetExitDataDirectiveClass:
1204 case Stmt::OMPTargetParallelDirectiveClass:
1205 case Stmt::OMPTargetParallelForDirectiveClass:
1206 case Stmt::OMPTargetUpdateDirectiveClass:
1207 case Stmt::OMPTeamsDirectiveClass:
1208 case Stmt::OMPCancellationPointDirectiveClass:
1209 case Stmt::OMPCancelDirectiveClass:
1210 case Stmt::OMPTaskLoopDirectiveClass:
1211 case Stmt::OMPTaskLoopSimdDirectiveClass:
1212 case Stmt::OMPDistributeDirectiveClass:
1213 case Stmt::OMPDistributeParallelForDirectiveClass:
1214 case Stmt::OMPDistributeParallelForSimdDirectiveClass:
1215 case Stmt::OMPDistributeSimdDirectiveClass:
1216 case Stmt::OMPTargetParallelForSimdDirectiveClass:
1217 case Stmt::OMPTargetSimdDirectiveClass:
1218 case Stmt::OMPTeamsDistributeDirectiveClass:
1219 case Stmt::OMPTeamsDistributeSimdDirectiveClass:
1220 case Stmt::OMPTeamsDistributeParallelForSimdDirectiveClass:
1221 case Stmt::OMPTeamsDistributeParallelForDirectiveClass:
1222 case Stmt::OMPTargetTeamsDirectiveClass:
1223 case Stmt::OMPTargetTeamsDistributeDirectiveClass:
1224 case Stmt::OMPTargetTeamsDistributeParallelForDirectiveClass:
1225 case Stmt::OMPTargetTeamsDistributeParallelForSimdDirectiveClass:
1226 case Stmt::OMPTargetTeamsDistributeSimdDirectiveClass:
1227 case Stmt::CapturedStmtClass: {
1229 Engine.addAbortedBlock(node, currBldrCtx->getBlock());
1233 case Stmt::ParenExprClass:
1234 llvm_unreachable(
"ParenExprs already handled.");
1235 case Stmt::GenericSelectionExprClass:
1236 llvm_unreachable(
"GenericSelectionExprs already handled.");
1239 case Stmt::BreakStmtClass:
1240 case Stmt::CaseStmtClass:
1241 case Stmt::CompoundStmtClass:
1242 case Stmt::ContinueStmtClass:
1243 case Stmt::CXXForRangeStmtClass:
1244 case Stmt::DefaultStmtClass:
1245 case Stmt::DoStmtClass:
1246 case Stmt::ForStmtClass:
1247 case Stmt::GotoStmtClass:
1248 case Stmt::IfStmtClass:
1249 case Stmt::IndirectGotoStmtClass:
1250 case Stmt::LabelStmtClass:
1252 case Stmt::NullStmtClass:
1253 case Stmt::SwitchStmtClass:
1254 case Stmt::WhileStmtClass:
1255 case Expr::MSDependentExistsStmtClass:
1256 llvm_unreachable(
"Stmt should not be in analyzer evaluation loop");
1258 case Stmt::ObjCSubscriptRefExprClass:
1259 case Stmt::ObjCPropertyRefExprClass:
1260 llvm_unreachable(
"These are handled by PseudoObjectExpr");
1262 case Stmt::GNUNullExprClass: {
1266 svalBuilder.makeIntValWithPtrWidth(0,
false));
1271 case Stmt::ObjCAtSynchronizedStmtClass:
1277 case Stmt::ExprWithCleanupsClass:
1281 case Stmt::CXXBindTemporaryExprClass: {
1293 case Stmt::DesignatedInitExprClass:
1294 case Stmt::DesignatedInitUpdateExprClass:
1295 case Stmt::ArrayInitLoopExprClass:
1296 case Stmt::ArrayInitIndexExprClass:
1297 case Stmt::ExtVectorElementExprClass:
1298 case Stmt::ImaginaryLiteralClass:
1299 case Stmt::ObjCAtCatchStmtClass:
1300 case Stmt::ObjCAtFinallyStmtClass:
1301 case Stmt::ObjCAtTryStmtClass:
1302 case Stmt::ObjCAutoreleasePoolStmtClass:
1303 case Stmt::ObjCEncodeExprClass:
1304 case Stmt::ObjCIsaExprClass:
1305 case Stmt::ObjCProtocolExprClass:
1306 case Stmt::ObjCSelectorExprClass:
1307 case Stmt::ParenListExprClass:
1308 case Stmt::ShuffleVectorExprClass:
1309 case Stmt::ConvertVectorExprClass:
1310 case Stmt::VAArgExprClass:
1311 case Stmt::CUDAKernelCallExprClass:
1312 case Stmt::OpaqueValueExprClass:
1313 case Stmt::AsTypeExprClass:
1318 case Stmt::PredefinedExprClass:
1319 case Stmt::AddrLabelExprClass:
1320 case Stmt::AttributedStmtClass:
1321 case Stmt::IntegerLiteralClass:
1322 case Stmt::FixedPointLiteralClass:
1323 case Stmt::CharacterLiteralClass:
1324 case Stmt::ImplicitValueInitExprClass:
1325 case Stmt::CXXScalarValueInitExprClass:
1326 case Stmt::CXXBoolLiteralExprClass:
1327 case Stmt::ObjCBoolLiteralExprClass:
1328 case Stmt::ObjCAvailabilityCheckExprClass:
1329 case Stmt::FloatingLiteralClass:
1330 case Stmt::NoInitExprClass:
1331 case Stmt::SizeOfPackExprClass:
1332 case Stmt::StringLiteralClass:
1333 case Stmt::ObjCStringLiteralClass:
1334 case Stmt::CXXPseudoDestructorExprClass:
1335 case Stmt::SubstNonTypeTemplateParmExprClass:
1336 case Stmt::CXXNullPtrLiteralExprClass:
1337 case Stmt::OMPArraySectionExprClass:
1338 case Stmt::TypeTraitExprClass: {
1347 case Stmt::CXXDefaultArgExprClass:
1348 case Stmt::CXXDefaultInitExprClass: {
1357 if (
const auto *DefE = dyn_cast<CXXDefaultArgExpr>(S))
1358 ArgE = DefE->getExpr();
1359 else if (
const auto *DefE = dyn_cast<CXXDefaultInitExpr>(S))
1360 ArgE = DefE->getExpr();
1362 llvm_unreachable(
"unknown constant wrapper kind");
1364 bool IsTemporary =
false;
1365 if (
const auto *MTE = dyn_cast<MaterializeTemporaryExpr>(ArgE)) {
1366 ArgE = MTE->GetTemporaryExpr();
1375 for (
const auto I : PreVisit) {
1377 State = State->BindExpr(S, LCtx, *ConstantVal);
1379 State = createTemporaryRegionIfNeeded(State, LCtx,
1391 case Stmt::CXXStdInitializerListExprClass:
1392 case Expr::ObjCArrayLiteralClass:
1393 case Expr::ObjCDictionaryLiteralClass:
1394 case Expr::ObjCBoxedExprClass: {
1403 const auto *Ex = cast<Expr>(S);
1404 QualType resultType = Ex->getType();
1406 for (
const auto N : preVisit) {
1408 SVal result = svalBuilder.conjureSymbolVal(
nullptr, Ex, LCtx,
1410 currBldrCtx->blockCount());
1415 if (!(isa<ObjCBoxedExpr>(Ex) &&
1416 !cast<ObjCBoxedExpr>(Ex)->getSubExpr()
1418 for (
auto Child : Ex->children()) {
1420 SVal Val = State->getSVal(Child, LCtx);
1432 case Stmt::ArraySubscriptExprClass:
1438 case Stmt::GCCAsmStmtClass:
1444 case Stmt::MSAsmStmtClass:
1450 case Stmt::BlockExprClass:
1456 case Stmt::LambdaExprClass:
1457 if (AMgr.options.shouldInlineLambdas()) {
1463 Engine.addAbortedBlock(node, currBldrCtx->getBlock());
1467 case Stmt::BinaryOperatorClass: {
1468 const auto *B = cast<BinaryOperator>(S);
1469 if (B->isLogicalOp()) {
1475 else if (B->getOpcode() == BO_Comma) {
1479 state->getSVal(B->getRHS(),
1486 if (AMgr.options.eagerlyAssumeBinOpBifurcation &&
1487 (B->isRelationalOp() || B->isEqualityOp())) {
1499 case Stmt::CXXOperatorCallExprClass: {
1500 const auto *OCE = cast<CXXOperatorCallExpr>(S);
1504 const Decl *Callee = OCE->getCalleeDecl();
1505 if (
const auto *MD = dyn_cast_or_null<CXXMethodDecl>(Callee)) {
1506 if (MD->isInstance()) {
1510 createTemporaryRegionIfNeeded(State, LCtx, OCE->getArg(0));
1511 if (NewState != State) {
1524 case Stmt::CallExprClass:
1525 case Stmt::CXXMemberCallExprClass:
1526 case Stmt::UserDefinedLiteralClass:
1532 case Stmt::CXXCatchStmtClass:
1538 case Stmt::CXXTemporaryObjectExprClass:
1539 case Stmt::CXXConstructExprClass:
1545 case Stmt::CXXNewExprClass: {
1552 for (
const auto i : PreVisit)
1560 case Stmt::CXXDeleteExprClass: {
1563 const auto *CDE = cast<CXXDeleteExpr>(S);
1566 for (
const auto i : PreVisit)
1575 case Stmt::ChooseExprClass: {
1577 const auto *C = cast<ChooseExpr>(S);
1583 case Stmt::CompoundAssignOperatorClass:
1589 case Stmt::CompoundLiteralExprClass:
1595 case Stmt::BinaryConditionalOperatorClass:
1596 case Stmt::ConditionalOperatorClass: {
1598 const auto *C = cast<AbstractConditionalOperator>(S);
1604 case Stmt::CXXThisExprClass:
1610 case Stmt::DeclRefExprClass: {
1612 const auto *DE = cast<DeclRefExpr>(S);
1618 case Stmt::DeclStmtClass:
1624 case Stmt::ImplicitCastExprClass:
1625 case Stmt::CStyleCastExprClass:
1626 case Stmt::CXXStaticCastExprClass:
1627 case Stmt::CXXDynamicCastExprClass:
1628 case Stmt::CXXReinterpretCastExprClass:
1629 case Stmt::CXXConstCastExprClass:
1630 case Stmt::CXXFunctionalCastExprClass:
1631 case Stmt::ObjCBridgedCastExprClass: {
1633 const auto *C = cast<CastExpr>(S);
1635 VisitCast(C, C->getSubExpr(), Pred, dstExpr);
1643 case Expr::MaterializeTemporaryExprClass: {
1645 const auto *MTE = cast<MaterializeTemporaryExpr>(S);
1649 for (
const auto i : dstPrevisit)
1656 case Stmt::InitListExprClass:
1662 case Stmt::MemberExprClass:
1668 case Stmt::AtomicExprClass:
1674 case Stmt::ObjCIvarRefExprClass:
1680 case Stmt::ObjCForCollectionStmtClass:
1686 case Stmt::ObjCMessageExprClass:
1692 case Stmt::ObjCAtThrowStmtClass:
1693 case Stmt::CXXThrowExprClass:
1699 case Stmt::ReturnStmtClass:
1705 case Stmt::OffsetOfExprClass: {
1711 for (
const auto Node : PreVisit)
1719 case Stmt::UnaryExprOrTypeTraitExprClass:
1726 case Stmt::StmtExprClass: {
1727 const auto *SE = cast<StmtExpr>(S);
1729 if (SE->getSubStmt()->body_empty()) {
1732 &&
"Empty statement expression must have void type.");
1736 if (
const auto *LastExpr =
1737 dyn_cast<Expr>(*SE->getSubStmt()->body_rbegin())) {
1741 state->getSVal(LastExpr,
1747 case Stmt::UnaryOperatorClass: {
1749 const auto *U = cast<UnaryOperator>(S);
1750 if (AMgr.options.eagerlyAssumeBinOpBifurcation && (U->getOpcode() == UO_LNot)) {
1761 case Stmt::PseudoObjectExprClass: {
1764 const auto *PE = cast<PseudoObjectExpr>(S);
1765 if (
const Expr *Result = PE->getResultExpr()) {
1781 bool ExprEngine::replayWithoutInlining(
ExplodedNode *N,
1785 assert(CalleeSF && CallerSF);
1792 BeforeProcessingCall = N;
1807 if (SP->getStmt() == CE)
1812 if (!BeforeProcessingCall)
1829 ExplodedNode *NewNode = G.getNode(NewNodeLoc, NewNodeState,
false, &IsNew);
1840 NumTimesRetriedWithoutInlining++;
1851 if(AMgr.options.shouldUnrollLoops()) {
1852 unsigned maxBlockVisitOnPath = AMgr.options.maxBlockVisitOnPath;
1856 Pred, maxBlockVisitOnPath);
1857 if (NewState != Pred->
getState()) {
1872 if (BlockCount == AMgr.options.maxBlockVisitOnPath - 1 &&
1873 AMgr.options.shouldWidenLoops()) {
1876 (isa<ForStmt>(Term) || isa<WhileStmt>(Term) || isa<DoStmt>(Term))))
1887 if (BlockCount >= AMgr.options.maxBlockVisitOnPath) {
1897 (*G.roots_begin())->getLocation().getLocationContext();
1899 Engine.FunctionSummaries->markReachedMaxBlockCount(CalleeSF->
getDecl());
1905 if ((!AMgr.options.NoRetryExhausted &&
1906 replayWithoutInlining(Pred, CalleeLC)))
1908 NumMaxBlockCountReachedInInlined++;
1910 NumMaxBlockCountReached++;
1913 Engine.blocksExhausted.push_back(std::make_pair(L, Sink));
1928 const Stmt *Condition,
1932 const auto *Ex = dyn_cast<
Expr>(Condition);
1937 bool bitsInit =
false;
1939 while (
const auto *CE = dyn_cast<CastExpr>(Ex)) {
1946 if (!bitsInit || newBits < bits) {
1951 Ex = CE->getSubExpr();
1961 return state->getSVal(Ex, LCtx);
1968 if (!BO || !BO->isLogicalOp()) {
1971 Condition = BO->getRHS()->IgnoreParens();
1993 if (
const auto *Ex = dyn_cast<Expr>(Condition))
1994 Condition = Ex->IgnoreParens();
1997 if (!BO || !BO->isLogicalOp())
2001 "Temporary destructor branches handled by processBindTemporary.");
2012 for (; I != E; ++I) {
2017 const Stmt *LastStmt = CS->getStmt();
2021 llvm_unreachable(
"could not resolve condition");
2030 assert((!Condition || !isa<CXXBindTemporaryExpr>(Condition)) &&
2031 "CXXBindTemporaryExprs are handled by processBindTemporary.");
2034 currBldrCtx = &BldCtx;
2044 if (
const auto *Ex = dyn_cast<Expr>(Condition))
2045 Condition = Ex->IgnoreParens();
2050 "Error evaluating branch");
2056 if (CheckersOutSet.empty())
2060 for (
const auto PredI : CheckersOutSet) {
2061 if (PredI->isSink())
2065 SVal X = PrevState->getSVal(Condition, PredI->getLocationContext());
2069 if (
const auto *Ex = dyn_cast<Expr>(Condition)) {
2070 if (Ex->getType()->isIntegralOrEnumerationType()) {
2076 PrevState, Condition,
2077 PredI->getLocationContext(),
2097 std::tie(StTrue, StFalse) = PrevState->assume(V);
2115 currBldrCtx =
nullptr;
2121 llvm::ImmutableSet<const VarDecl *>)
2130 currBldrCtx = &BuilderCtx;
2134 bool initHasRun = state->contains<InitializedGlobalsSet>(VD);
2138 state = state->add<InitializedGlobalsSet>(VD);
2141 builder.generateNode(state, initHasRun, Pred);
2142 builder.markInfeasible(!initHasRun);
2144 currBldrCtx =
nullptr;
2165 for (iterator I = builder.
begin(), E = builder.
end(); I != E; ++I) {
2166 if (I.getLabel() == L) {
2172 llvm_unreachable(
"No block with label.");
2186 for (iterator I = builder.
begin(), E = builder.
end(); I != E; ++I)
2217 while (LC != ToLC) {
2218 assert(LC &&
"ToLC must be a parent of FromLC!");
2219 for (
auto I : State->get<ObjectsUnderConstruction>())
2220 if (I.first.getLocationContext() == LC) {
2224 assert(I.first.getItem().getKind() ==
2226 I.first.getItem().getKind() ==
2228 State = State->remove<ObjectsUnderConstruction>(I.first);
2241 assert(areAllObjectsFullyConstructed(Pred->
getState(),
2246 StateMgr.EndPath(Pred->
getState());
2255 for (
const auto I : AfterRemovedDead)
2261 Engine.enqueueEndOfFunction(Dst, RS);
2273 if (CondV_untested.
isUndef()) {
2284 iterator I = builder.
begin(), EI = builder.
end();
2285 bool defaultIsFeasible = I == EI;
2287 for ( ; I != EI; ++I) {
2292 const CaseStmt *Case = I.getCase();
2307 std::tie(StateCase, DefaultSt) =
2308 DefaultSt->assumeInclusiveRange(*NL, V1, V2);
2310 StateCase = DefaultSt;
2318 defaultIsFeasible =
true;
2320 defaultIsFeasible =
false;
2325 if (!defaultIsFeasible)
2357 if (
const auto *VD = dyn_cast<VarDecl>(D)) {
2360 assert(Ex->
isGLValue() || VD->getType()->isVoidType());
2362 const Decl *D = LocCtxt->getDecl();
2363 const auto *MD = dyn_cast_or_null<CXXMethodDecl>(D);
2364 const auto *DeclRefEx = dyn_cast<
DeclRefExpr>(Ex);
2367 if (AMgr.options.shouldInlineLambdas() && DeclRefEx &&
2368 DeclRefEx->refersToEnclosingVariableOrCapture() && MD &&
2369 MD->getParent()->isLambda()) {
2372 llvm::DenseMap<const VarDecl *, FieldDecl *> LambdaCaptureFields;
2378 if (
const FieldDecl *FD = LambdaCaptureFields[VD]) {
2380 svalBuilder.getCXXThis(MD, LocCtxt->getStackFrame());
2381 SVal CXXThisVal = state->getSVal(CXXThis);
2382 VInfo = std::make_pair(state->getLValue(FD, CXXThisVal), FD->getType());
2387 VInfo = std::make_pair(state->getLValue(VD, LocCtxt), VD->getType());
2389 SVal V = VInfo->first;
2390 bool IsReference = VInfo->second->isReferenceType();
2395 if (
const MemRegion *R = V.getAsRegion())
2396 V = state->getSVal(R);
2401 Bldr.
generateNode(Ex, Pred, state->BindExpr(Ex, LCtx, V),
nullptr,
2405 if (
const auto *ED = dyn_cast<EnumConstantDecl>(D)) {
2407 SVal V = svalBuilder.makeIntVal(ED->getInitVal());
2408 Bldr.
generateNode(Ex, Pred, state->BindExpr(Ex, LCtx, V));
2411 if (
const auto *FD = dyn_cast<FunctionDecl>(D)) {
2412 SVal V = svalBuilder.getFunctionPointer(FD);
2413 Bldr.
generateNode(Ex, Pred, state->BindExpr(Ex, LCtx, V),
nullptr,
2417 if (isa<FieldDecl>(D) || isa<IndirectFieldDecl>(D)) {
2423 SVal V = svalBuilder.conjureSymbolVal(Ex, LCtx,
getContext().VoidPtrTy,
2424 currBldrCtx->blockCount());
2426 Bldr.
generateNode(Ex, Pred, state->BindExpr(Ex, LCtx, V),
nullptr,
2430 if (isa<BindingDecl>(D)) {
2436 llvm_unreachable(
"Support for this Decl not implemented.");
2460 for (
auto *
Node : CheckerPreStmt) {
2464 if (IsGLValueLike) {
2473 SVal V = state->getLValue(T,
2474 state->getSVal(Idx, LCtx),
2475 state->getSVal(Base, LCtx));
2478 }
else if (IsVectorType) {
2482 llvm_unreachable(
"Array subscript should be an lValue when not \ 2483 a vector and not a forbidden lvalue type");
2502 if (isa<VarDecl>(Member) || isa<EnumConstantDecl>(Member)) {
2503 for (
const auto I : CheckedSet)
2509 for (
const auto I : CheckedSet) {
2515 if (
const auto *MD = dyn_cast<CXXMethodDecl>(Member)) {
2516 if (MD->isInstance())
2517 state = createTemporaryRegionIfNeeded(state, LCtx, BaseExpr);
2519 SVal MDVal = svalBuilder.getFunctionPointer(MD);
2520 state = state->BindExpr(M, LCtx, MDVal);
2527 state = createTemporaryRegionIfNeeded(state, LCtx, BaseExpr);
2528 SVal baseExprVal = state->getSVal(BaseExpr, LCtx);
2530 const auto *field = cast<FieldDecl>(Member);
2531 SVal L = state->getLValue(field, baseExprVal);
2542 if (!PE || PE->getCastKind() != CK_ArrayToPointerDecay) {
2543 llvm_unreachable(
"should always be wrapped in ArrayToPointerDecay");
2547 if (field->getType()->isReferenceType()) {
2548 if (
const MemRegion *R = L.getAsRegion())
2549 L = state->getSVal(R);
2554 Bldr.
generateNode(M, I, state->BindExpr(M, LCtx, L),
nullptr,
2578 for (
const auto I : AfterPreSet) {
2583 for (
unsigned SI = 0, Count = AE->
getNumSubExprs(); SI != Count; SI++) {
2585 SVal SubExprVal = State->getSVal(SubExpr, LCtx);
2586 ValuesToInvalidate.push_back(SubExprVal);
2589 State = State->invalidateRegions(ValuesToInvalidate, AE,
2590 currBldrCtx->blockCount(),
2596 State = State->BindExpr(AE, LCtx, ResultVal);
2614 bool escapes =
true;
2618 escapes = !regionLoc->getRegion()->hasStackStorage();
2626 SVal StoredVal = State->getSVal(regionLoc->getRegion());
2627 if (StoredVal != Val)
2628 escapes = (State == (State->bindLoc(*regionLoc, Val, LCtx)));
2651 if (!Invalidated || Invalidated->empty())
2664 for (
const auto I : ExplicitRegions) {
2666 SymbolsDirectlyInvalidated.insert(R->getSymbol());
2670 for (
const auto &sym : *Invalidated) {
2671 if (SymbolsDirectlyInvalidated.count(sym))
2673 SymbolsIndirectlyInvalidated.insert(sym);
2676 if (!SymbolsDirectlyInvalidated.empty())
2681 if (!SymbolsIndirectlyInvalidated.empty())
2702 StoreE, *
this, *PP);
2717 for (
const auto PredI : CheckedSet) {
2725 state = state->bindLoc(location.
castAs<
Loc>(),
2726 Val, LC, !atDeclInit);
2731 LocReg = LocRegVal->getRegion();
2748 const Expr *LocationE,
2754 const Expr *StoreE = AssignE ? AssignE : LocationE;
2758 evalLocation(Tmp, AssignE, LocationE, Pred, state, location, tag,
false);
2766 for (
const auto I : Tmp)
2767 evalBind(Dst, StoreE, I, location, Val,
false);
2772 const Expr *BoundEx,
2778 assert(!location.
getAs<
NonLoc>() &&
"location cannot be a NonLoc.");
2783 evalLocation(Tmp, NodeEx, BoundEx, Pred, state, location, tag,
true);
2792 for (
const auto I : Tmp) {
2793 state = I->getState();
2800 V = state->getSVal(location.
castAs<
Loc>(), LoadTy);
2803 Bldr.
generateNode(NodeEx, I, state->BindExpr(BoundEx, LCtx, V), tag,
2810 const Stmt *BoundEx,
2840 NodeEx, BoundEx, *
this);
2844 std::pair<const ProgramPointTag *, const ProgramPointTag*>
2847 eagerlyAssumeBinOpBifurcationTrue(TagProviderName,
2848 "Eagerly Assume True"),
2849 eagerlyAssumeBinOpBifurcationFalse(TagProviderName,
2850 "Eagerly Assume False");
2851 return std::make_pair(&eagerlyAssumeBinOpBifurcationTrue,
2852 &eagerlyAssumeBinOpBifurcationFalse);
2860 for (
const auto Pred : Src) {
2872 if (SEV && SEV->isExpression()) {
2873 const std::pair<const ProgramPointTag *, const ProgramPointTag*> &tags =
2877 std::tie(StateTrue, StateFalse) = state->assume(*SEV);
2881 SVal Val = svalBuilder.makeIntVal(1U, Ex->
getType());
2888 SVal Val = svalBuilder.makeIntVal(0U, Ex->
getType());
2958 llvm::raw_string_ostream Out(sbuf);
2965 Out <<
"Block Entrance: B" 2978 Out <<
"CallExitBegin";
2982 Out <<
"CallExitEnd";
2986 Out <<
"PostStmtPurgeDeadSymbols";
2990 Out <<
"PreStmtPurgeDeadSymbols";
2994 Out <<
"Epsilon Point";
3015 Out <<
"PostCall: ";
3024 Out <<
"PostInitializer: ";
3046 Out <<
"\\|Terminator: ";
3057 if (isa<SwitchStmt>(T)) {
3061 if (
const auto *
C = dyn_cast<CaseStmt>(Label)) {
3067 if (
const Stmt *RHS =
C->getRHS()) {
3075 assert(isa<DefaultStmt>(Label));
3076 Out <<
"\\ldefault:";
3080 Out <<
"\\l(implicit) default:";
3082 else if (isa<IndirectGotoStmt>(T)) {
3086 Out <<
"\\lCondition: ";
3101 assert(S !=
nullptr &&
"Expecting non-null Stmt");
3109 Out <<
"\\lPreStmt\\l;";
3111 Out <<
"\\lPostLoad\\l;";
3113 Out <<
"\\lPostStore\\l";
3115 Out <<
"\\lPostLValue\\l";
3117 Out <<
"\\lPostAllocatorCall\\l";
3124 Out <<
"\\|StateID: " << (
const void*) state.get()
3125 <<
" NodeID: " << (
const void*) N <<
"\\|";
3145 std::vector<const ExplodedNode *> Src;
3149 for (
const auto I : BR)
3150 const_cast<BugType *
>(I)->FlushReports(BR);
3154 EI = BR.EQClasses_begin(), EE = BR.EQClasses_end(); EI != EE; ++EI) {
3155 const auto *N =
const_cast<ExplodedNode *
>(EI->begin()->getErrorNode());
3156 if (N) Src.push_back(N);
3162 GraphPrintCheckerState =
this;
3165 llvm::ViewGraph(*G.roots_begin(),
"ExprEngine");
3167 GraphPrintCheckerState =
nullptr;
3168 GraphPrintSourceManager =
nullptr;
3175 GraphPrintCheckerState =
this;
3178 std::unique_ptr<ExplodedGraph> TrimmedG(G.trim(Nodes));
3180 if (!TrimmedG.get())
3181 llvm::errs() <<
"warning: Trimmed ExplodedGraph is empty.\n";
3183 llvm::ViewGraph(*TrimmedG->roots_begin(),
"TrimmedExprEngine");
3185 GraphPrintCheckerState =
nullptr;
3186 GraphPrintSourceManager =
nullptr;
SourceLocation getLocStart() const LLVM_READONLY
bool isBaseInitializer() const
Determine whether this initializer is initializing a base class.
Defines the clang::ASTContext interface.
Represents C++ allocator call.
This represents a GCC inline-assembly statement extension.
TypedValueRegion - An abstract class representing regions having a typed value.
ProgramStateRef processRegionChange(ProgramStateRef state, const MemRegion *MR, const LocationContext *LCtx)
Expr * getInit() const
Get the initializer.
void VisitArraySubscriptExpr(const ArraySubscriptExpr *Ex, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitArraySubscriptExpr - Transfer function for array accesses.
void ProcessInitializer(const CFGInitializer I, ExplodedNode *Pred)
SVal evalDerivedToBase(SVal Derived, const CastExpr *Cast)
Evaluates a chain of derived-to-base casts through the path specified in Cast.
A (possibly-)qualified type.
MemRegion - The root abstract class for all memory regions.
void markLive(SymbolRef sym)
Unconditionally marks a symbol as live.
bool isMemberPointerType() const
ValueDecl * getMemberDecl() const
Retrieve the member declaration to which this expression refers.
void markInfeasible(bool branch)
const Expr * skipRValueSubobjectAdjustments(SmallVectorImpl< const Expr *> &CommaLHS, SmallVectorImpl< SubobjectAdjustment > &Adjustments) const
Walk outwards from an expression we want to bind a reference to and find the expression whose lifetim...
void print(raw_ostream &OS, const PrintingPolicy &Policy, const Twine &PlaceHolder=Twine(), unsigned Indentation=0) const
const Stmt * getStmt() const
bool IsTemporaryCtorOrDtor
This call is a constructor or a destructor of a temporary value.
succ_iterator succ_begin()
ProgramStateRef notifyCheckersOfPointerEscape(ProgramStateRef State, const InvalidatedSymbols *Invalidated, ArrayRef< const MemRegion *> ExplicitRegions, ArrayRef< const MemRegion *> Regions, const CallEvent *Call, RegionAndSymbolInvalidationTraits &ITraits) override
Call PointerEscape callback when a value escapes as a result of region invalidation.
bool isCForbiddenLValueType() const
Determine whether expressions of the given type are forbidden from being lvalues in C...
unsigned blockCount() const
Returns the number of times the current basic block has been visited on the exploded graph path...
DominatorTree GraphTraits specialization so the DominatorTree can be iterable by generic graph iterat...
void VisitCallExpr(const CallExpr *CE, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitCall - Transfer function for function calls.
Stmt - This represents one statement.
Information about invalidation for a particular region/symbol.
This builder class is useful for generating nodes that resulted from visiting a statement.
void VisitCXXBindTemporaryExpr(const CXXBindTemporaryExpr *BTE, ExplodedNodeSet &PreVisit, ExplodedNodeSet &Dst)
bool haveEqualStores(ProgramStateRef S1, ProgramStateRef S2)
C Language Family Type Representation.
Defines the SourceManager interface.
static const Stmt * getRightmostLeaf(const Stmt *Condition)
static void printObjectsUnderConstructionForContext(raw_ostream &Out, ProgramStateRef State, const char *NL, const char *Sep, const LocationContext *LC)
unsigned getBlockID() const
const CFGBlock * getSrc() const
void VisitMSAsmStmt(const MSAsmStmt *A, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitMSAsmStmt - Transfer function logic for MS inline asm.
Decl - This represents one declaration (or definition), e.g.
Represents a point when we begin processing an inlined call.
SourceLocation getLocStart() const LLVM_READONLY
Defines the PrettyStackTraceEntry class, which is used to make crashes give more contextual informati...
FunctionDecl * getOperatorNew() const
bool isVirtual() const
Determines whether the base class is a virtual base class (or not).
const CastExpr * BasePath
SVal evalBinOp(ProgramStateRef state, BinaryOperator::Opcode op, NonLoc L, NonLoc R, QualType T)
static ExprEngine * GraphPrintCheckerState
The pointer has been passed to a function indirectly.
void processCleanupTemporaryBranch(const CXXBindTemporaryExpr *BTE, NodeBuilderContext &BldCtx, ExplodedNode *Pred, ExplodedNodeSet &Dst, const CFGBlock *DstT, const CFGBlock *DstF) override
Called by CoreEngine.
Represents C++ object destructor generated from a call to delete.
Represents an array type, per C99 6.7.5.2 - Array Declarators.
Hints for figuring out of a call should be inlined during evalCall().
Represents a program point just before an implicit call event.
bool IsArrayCtorOrDtor
This call is a constructor or a destructor for a single element within an array, a part of array cons...
void ProcessMemberDtor(const CFGMemberDtor D, ExplodedNode *Pred, ExplodedNodeSet &Dst)
StorageDuration
The storage duration for an object (per C++ [basic.stc]).
static std::string getNodeLabel(const ExplodedNode *N, void *)
T castAs() const
Convert to the specified CFGElement type, asserting that this CFGElement is of the desired type...
const ProgramStateRef & getState() const
ExprEngine(cross_tu::CrossTranslationUnitContext &CTU, AnalysisManager &mgr, bool gcEnabled, SetOfConstDecls *VisitedCalleesIn, FunctionSummariesTy *FS, InliningModes HowToInlineIn)
void processCFGBlockEntrance(const BlockEdge &L, NodeBuilderWithSinks &nodeBuilder, ExplodedNode *Pred) override
Called by CoreEngine when processing the entrance of a CFGBlock.
bool haveEqualEnvironments(ProgramStateRef S1, ProgramStateRef S2)
Represents a point when we exit a loop.
ProgramStateRef getInitialState(const LocationContext *InitLoc) override
getInitialState - Return the initial state used for the root vertex in the ExplodedGraph.
Represents an implicit call event.
const CXXDestructorDecl * getDestructorDecl(ASTContext &astContext) const
bool isIndirectMemberInitializer() const
bool isConsumedExpr(Expr *E) const
void VisitUnaryOperator(const UnaryOperator *B, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitUnaryOperator - Transfer function logic for unary operators.
void takeNodes(const ExplodedNodeSet &S)
Represents a variable declaration or definition.
ASTContext & getASTContext() const
REGISTER_TRAIT_WITH_PROGRAMSTATE(ObjectsUnderConstruction, ObjectsUnderConstructionMap) static const char *TagProviderName
const T * getAs() const
Member-template getAs<specific type>'.
void ProcessDeleteDtor(const CFGDeleteDtor D, ExplodedNode *Pred, ExplodedNodeSet &Dst)
loc::MemRegionVal getCXXThis(const CXXMethodDecl *D, const StackFrameContext *SFC)
Return a memory region for the 'this' object reference.
static Optional< SVal > getObjectUnderConstruction(ProgramStateRef State, const ConstructionContextItem &Item, const LocationContext *LC)
By looking at a certain item that may be potentially part of an object's ConstructionContext, retrieve such object's location.
bool operator<(const ConstructedObjectKey &RHS) const
Expr * IgnoreImplicit() LLVM_READONLY
IgnoreImplicit - Skip past any implicit AST nodes which might surround this expression.
void evalStore(ExplodedNodeSet &Dst, const Expr *AssignE, const Expr *StoreE, ExplodedNode *Pred, ProgramStateRef St, SVal TargetLV, SVal Val, const ProgramPointTag *tag=nullptr)
evalStore - Handle the semantics of a store via an assignment.
bool isUnrolledState(ProgramStateRef State)
Returns if the given State indicates that is inside a completely unrolled loop.
const ElementRegion * GetElementZeroRegion(const SubRegion *R, QualType T)
void enqueue(ExplodedNodeSet &Set)
Enqueue the given set of nodes onto the work list.
const internal::VariadicDynCastAllOfMatcher< Decl, VarDecl > varDecl
Matches variable declarations.
const Stmt * getTriggerStmt() const
Describes how types, statements, expressions, and declarations should be printed. ...
Defines the Objective-C statement AST node classes.
void removeDead(ExplodedNode *Node, ExplodedNodeSet &Out, const Stmt *ReferenceStmt, const LocationContext *LC, const Stmt *DiagnosticStmt=nullptr, ProgramPoint::Kind K=ProgramPoint::PreStmtPurgeDeadSymbolsKind)
Run the analyzer's garbage collection - remove dead symbols and bindings from the state...
ProgramStateRef removeDeadBindings(ProgramStateRef St, const StackFrameContext *LCtx, SymbolReaper &SymReaper)
Represents a parameter to a function.
QualType getLocalUnqualifiedType() const
Return this type with all of the instance-specific qualifiers removed, but without removing any quali...
Defines the clang::Expr interface and subclasses for C++ expressions.
void VisitCXXThisExpr(const CXXThisExpr *TE, ExplodedNode *Pred, ExplodedNodeSet &Dst)
BoundNodesTreeBuilder Nodes
static bool shouldRemoveDeadBindings(AnalysisManager &AMgr, const Stmt *S, const ExplodedNode *Pred, const LocationContext *LC)
void ProcessTemporaryDtor(const CFGTemporaryDtor D, ExplodedNode *Pred, ExplodedNodeSet &Dst)
void ProcessLoopExit(const Stmt *S, ExplodedNode *Pred)
void runCheckersForLocation(ExplodedNodeSet &Dst, const ExplodedNodeSet &Src, SVal location, bool isLoad, const Stmt *NodeEx, const Stmt *BoundEx, ExprEngine &Eng)
Run checkers for load/store of a location.
const char * getStmtClassName() const
ProgramStateRef runCheckersForPointerEscape(ProgramStateRef State, const InvalidatedSymbols &Escaped, const CallEvent *Call, PointerEscapeKind Kind, RegionAndSymbolInvalidationTraits *ITraits)
Run checkers when pointers escape.
One of these records is kept for each identifier that is lexed.
void print(raw_ostream &Out, unsigned Indentation=0, bool PrintInstantiation=false) const
A pointer escapes due to binding its value to a location that the analyzer cannot track...
Holds long-lived AST nodes (such as types and decls) that can be referred to throughout the semantic ...
void runCheckersForLiveSymbols(ProgramStateRef state, SymbolReaper &SymReaper)
Run checkers for live symbols.
Represents a member of a struct/union/class.
TypeSourceInfo * getTypeSourceInfo() const
Returns the declarator information for a base class or delegating initializer.
void printTerminator(raw_ostream &OS, const LangOptions &LO) const
printTerminator - A simple pretty printer of the terminator of a CFGBlock.
Represents a program point after a store evaluation.
Represents C++ object destructor implicitly generated for automatic object or temporary bound to cons...
const LocationContext * getLocationContext() const
ProgramStateRef processLoopEnd(const Stmt *LoopStmt, ProgramStateRef State)
Updates the given ProgramState.
bool isReferenceType() const
void dumpStack(raw_ostream &OS, StringRef Indent={}, const char *NL="\, const char *Sep="", std::function< void(const LocationContext *)> printMoreInfoPerContext=[](const LocationContext *) {}) const
void ProcessImplicitDtor(const CFGImplicitDtor D, ExplodedNode *Pred)
bool isAllEnumCasesCovered() const
Returns true if the SwitchStmt is a switch of an enum value and all cases have been explicitly covere...
void addPredecessor(ExplodedNode *V, ExplodedGraph &G)
addPredeccessor - Adds a predecessor to the current node, and in tandem add this node as a successor ...
Keeps track of the various options that can be enabled, which controls the dialect of C or C++ that i...
i32 captured_struct **param SharedsTy A type which contains references the shared variables *param Shareds Context with the list of shared variables from the p *TaskFunction *param Data Additional data for task generation like final * state
const StackFrameContext * getStackFrame() const
bool isIntegralOrEnumerationType() const
Determine whether this type is an integral or enumeration type.
void enableNodeReclamation(unsigned Interval)
Enable tracking of recently allocated nodes for potential reclamation when calling reclaimRecentlyAll...
static std::string getNodeAttributes(const ExplodedNode *N, void *)
SourceLocation getLocation() const
ProgramStateRef processPointerEscapedOnBind(ProgramStateRef State, SVal Loc, SVal Val, const LocationContext *LCtx) override
Call PointerEscape callback when a value escapes as a result of bind.
static bool isLocType(QualType T)
void VisitOffsetOfExpr(const OffsetOfExpr *Ex, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitOffsetOfExpr - Transfer function for offsetof.
This is a meta program point, which should be skipped by all the diagnostic reasoning etc...
ProgramStateRef updateLoopStack(const Stmt *LoopStmt, ASTContext &ASTCtx, ExplodedNode *Pred, unsigned maxVisitOnPath)
Updates the stack of loops contained by the ProgramState.
ExplodedNode * generateSink(const Stmt *S, ExplodedNode *Pred, ProgramStateRef St, const ProgramPointTag *tag=nullptr, ProgramPoint::Kind K=ProgramPoint::PostStmtKind)
Forward-declares and imports various common LLVM datatypes that clang wants to use unqualified...
STATISTIC(NumRemoveDeadBindings, "The # of times RemoveDeadBindings is called")
const LocationContext * getLocationContext() const
ExplodedNode * generateCaseStmtNode(const iterator &I, ProgramStateRef State)
virtual bool inTopFrame() const
Return true if the current LocationContext has no caller context.
const clang::PrintingPolicy & getPrintingPolicy() const
static bool isRecordType(QualType T)
const LocationContext * getParent() const
A builtin binary operation expression such as "x + y" or "x <= y".
const Stmt * getStmt() const
If a crash happens while one of these objects are live, the message is printed out along with the spe...
void VisitReturnStmt(const ReturnStmt *R, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitReturnStmt - Transfer function logic for return statements.
void printPretty(raw_ostream &OS, PrinterHelper *Helper, const PrintingPolicy &Policy, unsigned Indentation=0, const ASTContext *Context=nullptr) const
const VarDecl * getVarDecl() const
bool shouldUnrollLoops()
Returns true if the analysis should try to unroll loops with known bounds.
const CXXBaseSpecifier * getBaseSpecifier() const
bool isAnyMemberInitializer() const
An adjustment to be made to the temporary created when emitting a reference binding, which accesses a particular subobject of that temporary.
void ProcessNewAllocator(const CXXNewExpr *NE, ExplodedNode *Pred)
void ProcessAutomaticObjDtor(const CFGAutomaticObjDtor D, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Represents binding an expression to a temporary.
virtual SVal getLValueField(const FieldDecl *D, SVal Base)
FieldDecl * getAnyMember() const
void VisitDeclStmt(const DeclStmt *DS, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitDeclStmt - Transfer function logic for DeclStmts.
CXXDestructorDecl * getDestructor() const
Returns the destructor decl for this class.
FieldDecl * getMember() const
If this is a member initializer, returns the declaration of the non-static data member being initiali...
void runCheckersForEndFunction(NodeBuilderContext &BC, ExplodedNodeSet &Dst, ExplodedNode *Pred, ExprEngine &Eng, const ReturnStmt *RS)
Run checkers on end of function.
void Profile(llvm::FoldingSetNodeID &ID) const
void processStaticInitializer(const DeclStmt *DS, NodeBuilderContext &BuilderCtx, ExplodedNode *Pred, ExplodedNodeSet &Dst, const CFGBlock *DstT, const CFGBlock *DstF) override
Called by CoreEngine.
const CFGBlock * getCallSiteBlock() const
void evalBind(ExplodedNodeSet &Dst, const Stmt *StoreE, ExplodedNode *Pred, SVal location, SVal Val, bool atDeclInit=false, const ProgramPoint *PP=nullptr)
evalBind - Handle the semantics of binding a value to a specific location.
CheckerManager & getCheckerManager() const
void VisitLogicalExpr(const BinaryOperator *B, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitLogicalExpr - Transfer function logic for '&&', '||'.
CXXCtorInitializer * getInitializer() const
void runCheckersForPrintState(raw_ostream &Out, ProgramStateRef State, const char *NL, const char *Sep)
Run checkers for debug-printing a ProgramState.
void removeDeadOnEndOfFunction(NodeBuilderContext &BC, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Remove dead bindings/symbols before exiting a function.
void runCheckersForBind(ExplodedNodeSet &Dst, const ExplodedNodeSet &Src, SVal location, SVal val, const Stmt *S, ExprEngine &Eng, const ProgramPoint &PP)
Run checkers for binding of a value to a location.
static SourceManager * GraphPrintSourceManager
CXXRecordDecl * getAsCXXRecordDecl() const
Retrieves the CXXRecordDecl that this type refers to, either because the type is a RecordType or beca...
const FieldDecl * getFieldDecl() const
const Stmt * getCallSite() const
void VisitCXXCatchStmt(const CXXCatchStmt *CS, ExplodedNode *Pred, ExplodedNodeSet &Dst)
bool isDelegatingInitializer() const
Determine whether this initializer is creating a delegating constructor.
const CXXBindTemporaryExpr * getBindTemporaryExpr() const
Represents a single basic block in a source-level CFG.
void VisitInitListExpr(const InitListExpr *E, ExplodedNode *Pred, ExplodedNodeSet &Dst)
bool hasDeadSymbols() const
llvm::APSInt EvaluateKnownConstInt(const ASTContext &Ctx, SmallVectorImpl< PartialDiagnosticAt > *Diag=nullptr) const
EvaluateKnownConstInt - Call EvaluateAsRValue and return the folded integer.
InliningModes
The modes of inlining, which override the default analysis-wide settings.
SymbolicRegion - A special, "non-concrete" region.
void runCheckersForPostStmt(ExplodedNodeSet &Dst, const ExplodedNodeSet &Src, const Stmt *S, ExprEngine &Eng, bool wasInlined=false)
Run checkers for post-visiting Stmts.
static void printLocation(raw_ostream &OS, const SourceManager &SM, SourceLocation SLoc)
static unsigned getNumSubExprs(AtomicOp Op)
Determine the number of arguments the specified atomic builtin should have.
void ProcessBaseDtor(const CFGBaseDtor D, ExplodedNode *Pred, ExplodedNodeSet &Dst)
DefinedOrUnknownSVal makeZeroVal(QualType type)
Construct an SVal representing '0' for the specified type.
void processSwitch(SwitchNodeBuilder &builder) override
ProcessSwitch - Called by CoreEngine.
void printState(raw_ostream &Out, ProgramStateRef State, const char *NL, const char *Sep, const LocationContext *LCtx=nullptr) override
printState - Called by ProgramStateManager to print checker-specific data.
void processBeginOfFunction(NodeBuilderContext &BC, ExplodedNode *Pred, ExplodedNodeSet &Dst, const BlockEdge &L) override
Called by CoreEngine.
Represent the declaration of a variable (in which case it is an lvalue) a function (in which case it ...
Expr - This represents one expression.
Defines the clang::LangOptions interface.
void VisitLvalObjCIvarRefExpr(const ObjCIvarRefExpr *DR, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Transfer function logic for computing the lvalue of an Objective-C ivar.
void VisitCXXNewExpr(const CXXNewExpr *CNE, ExplodedNode *Pred, ExplodedNodeSet &Dst)
void VisitCXXNewAllocatorCall(const CXXNewExpr *CNE, ExplodedNode *Pred, ExplodedNodeSet &Dst)
const Expr * getCondition() const
void VisitCast(const CastExpr *CastE, const Expr *Ex, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitCast - Transfer function logic for all casts (implicit and explicit).
Represents a C++ destructor within a class.
const internal::VariadicAllOfMatcher< Decl > decl
Matches declarations.
This is the simplest builder which generates nodes in the ExplodedGraph.
void Add(ExplodedNode *N)
The pointer has been passed to a function call directly.
virtual StringRef getTagDescription() const =0
QualType getConditionType() const
const LocationContext * getLocationContext() const
bool isTemporaryDtorsBranch() const
void Visit(const Stmt *S, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Visit - Transfer function logic for all statements.
void FlushReports()
Generate and flush diagnostics for all bug reports.
const CFGBlock * getDst() const
Defines the clang::IdentifierInfo, clang::IdentifierTable, and clang::Selector interfaces.
static std::pair< const ProgramPointTag *, const ProgramPointTag * > geteagerlyAssumeBinOpBifurcationTags()
The reason for pointer escape is unknown.
ASTContext & getContext() const
getContext - Return the ASTContext associated with this analysis.
Traits for storing the call processing policy inside GDM.
DeclContext * getParent()
getParent - Returns the containing DeclContext.
ReturnStmt - This represents a return, optionally of an expression: return; return 4;...
void VisitAtomicExpr(const AtomicExpr *E, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitAtomicExpr - Transfer function for builtin atomic expressions.
This represents a Microsoft inline-assembly statement extension.
const SwitchStmt * getSwitch() const
void evalLoad(ExplodedNodeSet &Dst, const Expr *NodeEx, const Expr *BoundExpr, ExplodedNode *Pred, ProgramStateRef St, SVal location, const ProgramPointTag *tag=nullptr, QualType LoadTy=QualType())
Simulate a read of the result of Ex.
Represents C++ object destructor implicitly generated for base object in destructor.
unsigned getExpansionLineNumber(SourceLocation Loc, bool *Invalid=nullptr) const
QualType getDestroyedType() const
Retrieve the type being destroyed.
const Expr * getSubExpr() const
bool isNull() const
Return true if this QualType doesn't point to a type yet.
reverse_iterator rbegin()
virtual ProgramStateRef removeDeadBindings(ProgramStateRef state, SymbolReaper &SymReaper)=0
Scan all symbols referenced by the constraints.
Optional< T > getAs() const
Convert to the specified SVal type, returning None if this SVal is not of the desired type...
const MemRegion * getRegion() const
Get the underlining region.
ExplodedNode * generateNode(const iterator &I, ProgramStateRef State, bool isSink=false)
While alive, includes the current analysis stack in a crash trace.
void processEndOfFunction(NodeBuilderContext &BC, ExplodedNode *Pred, const ReturnStmt *RS=nullptr) override
Called by CoreEngine.
ConstructedObjectKey(const ConstructionContextItem &Item, const LocationContext *LC)
static const Stmt * ResolveCondition(const Stmt *Condition, const CFGBlock *B)
CFGTerminator getTerminator()
void processCFGElement(const CFGElement E, ExplodedNode *Pred, unsigned StmtIdx, NodeBuilderContext *Ctx) override
processCFGElement - Called by CoreEngine.
bool operator==(const ConstructedObjectKey &RHS) const
ProgramStateRef getInitialState(const LocationContext *InitLoc)
const LocationContext * getLocationContext() const
const Stmt * getStmt() const
void VisitGuardedExpr(const Expr *Ex, const Expr *L, const Expr *R, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitGuardedExpr - Transfer function logic for ?, __builtin_choose.
const Stmt * getLoopStmt() const
ProgramStateRef getWidenedLoopState(ProgramStateRef PrevState, const LocationContext *LCtx, unsigned BlockCount, const Stmt *LoopStmt)
Get the states that result from widening the loop.
Encodes a location in the source.
DefinedOrUnknownSVal conjureSymbolVal(const void *symbolTag, const Expr *expr, const LocationContext *LCtx, unsigned count)
Create a new symbol with a unique 'name'.
A helper class that allows the use of isa/cast/dyncast to detect TagType objects of enums...
void runCheckersForBranchCondition(const Stmt *condition, ExplodedNodeSet &Dst, ExplodedNode *Pred, ExprEngine &Eng)
Run checkers for branch condition.
T castAs() const
Convert to the specified ProgramPoint type, asserting that this ProgramPoint is of the desired type...
static bool isCallStmt(const Stmt *S)
Returns true if this is a statement is a function or method call of some kind.
ProgramPoints can be "tagged" as representing points specific to a given analysis entity...
AnalysisManager & getAnalysisManager() override
std::string getNameAsString() const
Get a human-readable name for the declaration, even if it is one of the special kinds of names (C++ c...
void evalEagerlyAssumeBinOpBifurcation(ExplodedNodeSet &Dst, ExplodedNodeSet &Src, const Expr *Ex)
evalEagerlyAssumeBinOpBifurcation - Given the nodes in 'Src', eagerly assume symbolic expressions of ...
const MemRegion * getAsRegion() const
Represents a new-expression for memory allocation and constructor calls, e.g: "new CXXNewExpr(foo)"...
SourceLocation getLocStart() const LLVM_READONLY
DeclStmt - Adaptor class for mixing declarations with statements and expressions. ...
void VisitCompoundLiteralExpr(const CompoundLiteralExpr *CL, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitCompoundLiteralExpr - Transfer function logic for compound literals.
Represents the declaration of a label.
ExplodedNode * generateNode(ProgramStateRef State, ExplodedNode *Pred, const ProgramPointTag *Tag=nullptr)
static void printLocation(raw_ostream &Out, SourceLocation SLoc)
void processIndirectGoto(IndirectGotoNodeBuilder &builder) override
processIndirectGoto - Called by CoreEngine.
QualType getBaseElementType(const ArrayType *VAT) const
Return the innermost element type of an array type.
const CXXTempObjectRegion * getCXXTempObjectRegion(Expr const *Ex, LocationContext const *LC)
SourceLocation getLocStart() const LLVM_READONLY
void VisitCXXDeleteExpr(const CXXDeleteExpr *CDE, ExplodedNode *Pred, ExplodedNodeSet &Dst)
void processBranch(const Stmt *Condition, const Stmt *Term, NodeBuilderContext &BuilderCtx, ExplodedNode *Pred, ExplodedNodeSet &Dst, const CFGBlock *DstT, const CFGBlock *DstF) override
ProcessBranch - Called by CoreEngine.
bool IsCtorOrDtorWithImproperlyModeledTargetRegion
This call is a constructor or a destructor for which we do not currently compute the this-region corr...
ProgramPoint getLocation() const
getLocation - Returns the edge associated with the given node.
SVal - This represents a symbolic expression, which can be either an L-value or an R-value...
const ArrayType * getAsArrayType(QualType T) const
Type Query functions.
AtomicExpr - Variadic atomic builtins: __atomic_exchange, __atomic_fetch_*, __atomic_load, __atomic_store, and __atomic_compare_exchange_*, for the similarly-named C++11 instructions, and __c11 variants for <stdatomic.h>, and corresponding __opencl_atomic_* for OpenCL 2.0.
void VisitUnaryExprOrTypeTraitExpr(const UnaryExprOrTypeTraitExpr *Ex, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitUnaryExprOrTypeTraitExpr - Transfer function for sizeof.
ProgramStateRef runCheckersForEvalAssume(ProgramStateRef state, SVal Cond, bool Assumption)
Run checkers for handling assumptions on symbolic values.
AnalyzerOptions & options
ImplicitCastExpr - Allows us to explicitly represent implicit type conversions, which have no direct ...
void VisitObjCForCollectionStmt(const ObjCForCollectionStmt *S, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitObjCForCollectionStmt - Transfer function logic for ObjCForCollectionStmt.
A class responsible for cleaning up unused symbols.
const Decl * getDecl() const
void runCheckersForPreStmt(ExplodedNodeSet &Dst, const ExplodedNodeSet &Src, const Stmt *S, ExprEngine &Eng)
Run checkers for pre-visiting Stmts.
bool isVectorType() const
ProgramStateRef getPersistentStateWithGDM(ProgramStateRef FromState, ProgramStateRef GDMState)
void insert(const ExplodedNodeSet &S)
Optional< T > getAs() const
Convert to the specified CFGElement type, returning None if this CFGElement is not of the desired typ...
Defines various enumerations that describe declaration and type specifiers.
StringRef getName() const
Return the actual identifier string.
ast_type_traits::DynTypedNode Node
unsigned getExpansionColumnNumber(SourceLocation Loc, bool *Invalid=nullptr) const
void runCheckersForDeadSymbols(ExplodedNodeSet &Dst, const ExplodedNodeSet &Src, SymbolReaper &SymReaper, const Stmt *S, ExprEngine &Eng, ProgramPoint::Kind K)
Run checkers for dead symbols.
Dataflow Directional Tag Classes.
void ProcessStmt(const Stmt *S, ExplodedNode *Pred)
ExplodedNode * generateDefaultCaseNode(ProgramStateRef State, bool isSink=false)
SValBuilder & getSValBuilder()
Represents a delete expression for memory deallocation and destructor calls, e.g. ...
void addNodes(const ExplodedNodeSet &S)
StoreManager & getStoreManager()
Represents a program point just after an implicit call event.
ProgramStateRef processRegionChanges(ProgramStateRef state, const InvalidatedSymbols *invalidated, ArrayRef< const MemRegion *> ExplicitRegions, ArrayRef< const MemRegion *> Regions, const LocationContext *LCtx, const CallEvent *Call) override
processRegionChanges - Called by ProgramStateManager whenever a change is made to the store...
SourceLocation getSourceLocation() const
Determine the source location of the initializer.
void VisitCXXDestructor(QualType ObjectType, const MemRegion *Dest, const Stmt *S, bool IsBaseDtor, ExplodedNode *Pred, ExplodedNodeSet &Dst, const EvalCallOptions &Options)
const NodeBuilderContext & getContext()
unsigned getGraphTrimInterval()
Returns how often nodes in the ExplodedGraph should be recycled to save memory.
std::unique_ptr< DiagnosticConsumer > create(StringRef OutputFile, DiagnosticOptions *Diags, bool MergeChildRecords=false)
Returns a DiagnosticConsumer that serializes diagnostics to a bitcode file.
bool hasWorkRemaining() const
This node builder keeps track of the generated sink nodes.
bool isPurgeKind()
Is this a program point corresponding to purge/removal of dead symbols and bindings.
StmtClass getStmtClass() const
void reclaimRecentlyAllocatedNodes()
Reclaim "uninteresting" nodes created since the last time this method was called. ...
enum clang::SubobjectAdjustment::@36 Kind
void VisitLambdaExpr(const LambdaExpr *LE, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitLambdaExpr - Transfer function logic for LambdaExprs.
const Decl * getSingleDecl() const
const ProgramPointTag * getTag() const
Represents symbolic expression that isn't a location.
DOTGraphTraits(bool isSimple=false)
BranchNodeBuilder is responsible for constructing the nodes corresponding to the two branches of the ...
Represents an abstract call to a function or method along a particular path.
ProgramStateRef getState() const
const Stmt * getLoopStmt() const
ProgramStateManager & getStateManager() override
This class is used for tools that requires cross translation unit capability.
const Decl * getDecl() const
const CXXDeleteExpr * getDeleteExpr() const
Represents a single point (AST node) in the program that requires attention during construction of an...
Expr * IgnoreParenImpCasts() LLVM_READONLY
IgnoreParenImpCasts - Ignore parentheses and implicit casts.
const CXXTempObjectRegion * getCXXStaticTempObjectRegion(const Expr *Ex)
Create a CXXTempObjectRegion for temporaries which are lifetime-extended by static references...
PointerEscapeKind
Describes the different reasons a pointer escapes during analysis.
SwitchStmt - This represents a 'switch' stmt.
unsigned getIntWidth(QualType T) const
void runCheckersForEndAnalysis(ExplodedGraph &G, BugReporter &BR, ExprEngine &Eng)
Run checkers for end of analysis.
T castAs() const
Convert to the specified SVal type, asserting that this SVal is of the desired type.
ArraySubscriptExpr - [C99 6.5.2.1] Array Subscripting.
ExplodedNode * generateSink(ProgramStateRef State, ExplodedNode *Pred, const ProgramPointTag *Tag=nullptr)
Represents a C++ base or member initializer.
void VisitCXXConstructExpr(const CXXConstructExpr *E, ExplodedNode *Pred, ExplodedNodeSet &Dst)
unsigned getIndex() const
void VisitObjCAtSynchronizedStmt(const ObjCAtSynchronizedStmt *S, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Transfer function logic for ObjCAtSynchronizedStmts.
IndirectFieldDecl * getIndirectMember() const
const LocationContext * getLocationContext() const
void VisitObjCMessage(const ObjCMessageExpr *ME, ExplodedNode *Pred, ExplodedNodeSet &Dst)
const StackFrameContext * getStackFrame() const
llvm::FoldingSet< BugReportEquivClass >::iterator EQClasses_iterator
Iterator over the set of BugReports tracked by the BugReporter.
Represents a base class of a C++ class.
void getCaptureFields(llvm::DenseMap< const VarDecl *, FieldDecl *> &Captures, FieldDecl *&ThisCapture) const
For a closure type, retrieve the mapping from captured variables and this to the non-static data memb...
uint64_t getTypeSize(QualType T) const
Return the size of the specified (complete) type T, in bits.
SourceManager & getSourceManager()
X
Add a minimal nested name specifier fixit hint to allow lookup of a tag name from an outer enclosing ...
ExplodedNode * generateNode(const ProgramPoint &PP, ProgramStateRef State, ExplodedNode *Pred)
Generates a node in the ExplodedGraph.
const CXXNewExpr * getAllocatorExpr() const
void VisitBlockExpr(const BlockExpr *BE, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitBlockExpr - Transfer function logic for BlockExprs.
Defines the C++ Decl subclasses, other than those for templates (found in DeclTemplate.h) and friends (in DeclFriend.h).
MemberExpr - [C99 6.5.2.3] Structure and Union Members.
Defines the clang::SourceLocation class and associated facilities.
Represents a C++ struct/union/class.
const ConstructionContextItem & getItem() const
Represents C++ object destructor implicitly generated by compiler on various occasions.
ProgramStateRef getState() const
pred_iterator pred_begin()
ExplodedNode * generateNode(ProgramStateRef State, bool branch, ExplodedNode *Pred)
Represents a top-level expression in a basic block.
This class is used for builtin types like 'int'.
ProgramStateRef processAssume(ProgramStateRef state, SVal cond, bool assumption) override
evalAssume - Callback function invoked by the ConstraintManager when making assumptions about state v...
Represents C++ object destructor implicitly generated for member object in destructor.
const MemRegion * getBaseRegion() const
ExplodedNode * generateNode(const Stmt *S, ExplodedNode *Pred, ProgramStateRef St, const ProgramPointTag *tag=nullptr, ProgramPoint::Kind K=ProgramPoint::PostStmtKind)
void processEndWorklist(bool hasWorkRemaining) override
Called by CoreEngine when the analysis worklist has terminated.
static Decl::Kind getKind(const Decl *D)
ProgramStateRef runCheckersForRegionChanges(ProgramStateRef state, const InvalidatedSymbols *invalidated, ArrayRef< const MemRegion *> ExplicitRegions, ArrayRef< const MemRegion *> Regions, const LocationContext *LCtx, const CallEvent *Call)
Run checkers for region changes.
void runCheckersForBeginFunction(ExplodedNodeSet &Dst, const BlockEdge &L, ExplodedNode *Pred, ExprEngine &Eng)
Run checkers on beginning of function.
void VisitCommonDeclRefExpr(const Expr *DR, const NamedDecl *D, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Transfer function logic for DeclRefExprs and BlockDeclRefExprs.
A reference to a declared variable, function, enum, etc.
Represents C++ base or member initializer from constructor's initialization list. ...
void VisitGCCAsmStmt(const GCCAsmStmt *A, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitGCCAsmStmt - Transfer function logic for inline asm.
const StackFrameContext * getStackFrame() const
bool mayInlineCXXAllocator()
Returns whether or not allocator call may be considered for inlining.
void VisitMemberExpr(const MemberExpr *M, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitMemberExpr - Transfer function for member expressions.
ParentMap & getParentMap()
ProgramStateRef escapeValue(ProgramStateRef State, SVal V, PointerEscapeKind K) const
A simple wrapper when you only need to notify checkers of pointer-escape of a single value...
AnalysisPurgeMode AnalysisPurgeOpt
llvm::ImmutableMap< ConstructedObjectKey, SVal > ObjectsUnderConstructionMap
This represents a decl that may have a name.
void ViewGraph(bool trim=false)
Visualize the ExplodedGraph created by executing the simulation.
Optional< T > getAs() const
Convert to the specified ProgramPoint type, returning None if this ProgramPoint is not of the desired...
ConstraintManager & getConstraintManager()
void VisitBinaryOperator(const BinaryOperator *B, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitBinaryOperator - Transfer function logic for binary operators.
AnalysisDeclContext * getAnalysisDeclContext() const
bool isFeasible(bool branch)
const Expr * getCond() const
static SVal RecoverCastedSymbol(ProgramStateManager &StateMgr, ProgramStateRef state, const Stmt *Condition, const LocationContext *LCtx, ASTContext &Ctx)
RecoverCastedSymbol - A helper function for ProcessBranch that is used to try to recover some path-se...
ConstructedObjectKey is used for being able to find the path-sensitive memory region of a freshly con...
void CreateCXXTemporaryObject(const MaterializeTemporaryExpr *ME, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Create a C++ temporary object for an rvalue.
const Expr * getTarget() const
This class handles loading and caching of source files into memory.
Represents C++ object destructor implicitly generated at the end of full expression for temporary obj...
const CFGBlock * getBlock() const
Return the CFGBlock associated with this builder.
bool isUnknownOrUndef() const
QualType getType() const
Return the type wrapped by this type source info.
void print(llvm::raw_ostream &OS, PrinterHelper *Helper, PrintingPolicy &PP)
Expr * IgnoreParens() LLVM_READONLY
IgnoreParens - Ignore parentheses.
QualType getType() const
Retrieves the type of the base class.
Represents the point where a loop ends.