clang
7.0.0
|
CoreEngine - Implements the core logic of the graph-reachability analysis. More...
#include "clang/StaticAnalyzer/Core/PathSensitive/CoreEngine.h"
Public Types | |
using | BlocksExhausted = std::vector< std::pair< BlockEdge, const ExplodedNode * > > |
using | BlocksAborted = std::vector< std::pair< const CFGBlock *, const ExplodedNode * > > |
Public Member Functions | |
CoreEngine (SubEngine &subengine, FunctionSummariesTy *FS, AnalyzerOptions &Opts) | |
Construct a CoreEngine object to analyze the provided CFG. More... | |
CoreEngine (const CoreEngine &)=delete | |
CoreEngine & | operator= (const CoreEngine &)=delete |
ExplodedGraph & | getGraph () |
getGraph - Returns the exploded graph. More... | |
bool | ExecuteWorkList (const LocationContext *L, unsigned Steps, ProgramStateRef InitState) |
ExecuteWorkList - Run the worklist algorithm for a maximum number of steps. More... | |
bool | ExecuteWorkListWithInitialState (const LocationContext *L, unsigned Steps, ProgramStateRef InitState, ExplodedNodeSet &Dst) |
Returns true if there is still simulation state on the worklist. More... | |
void | dispatchWorkItem (ExplodedNode *Pred, ProgramPoint Loc, const WorkListUnit &WU) |
Dispatch the work list item based on the given location information. More... | |
bool | wasBlockAborted () const |
bool | wasBlocksExhausted () const |
bool | hasWorkRemaining () const |
void | addAbortedBlock (const ExplodedNode *node, const CFGBlock *block) |
Inform the CoreEngine that a basic block was aborted because it could not be completely analyzed. More... | |
WorkList * | getWorkList () const |
BlocksExhausted::const_iterator | blocks_exhausted_begin () const |
BlocksExhausted::const_iterator | blocks_exhausted_end () const |
BlocksAborted::const_iterator | blocks_aborted_begin () const |
BlocksAborted::const_iterator | blocks_aborted_end () const |
void | enqueue (ExplodedNodeSet &Set) |
Enqueue the given set of nodes onto the work list. More... | |
void | enqueue (ExplodedNodeSet &Set, const CFGBlock *Block, unsigned Idx) |
Enqueue nodes that were created as a result of processing a statement onto the work list. More... | |
void | enqueueEndOfFunction (ExplodedNodeSet &Set, const ReturnStmt *RS) |
enqueue the nodes corresponding to the end of function onto the end of path / work list. More... | |
void | enqueueStmtNode (ExplodedNode *N, const CFGBlock *Block, unsigned Idx) |
Enqueue a single node created as a result of statement processing. More... | |
Friends | |
class | CommonNodeBuilder |
class | EndOfFunctionNodeBuilder |
class | ExprEngine |
class | IndirectGotoNodeBuilder |
class | NodeBuilder |
struct | NodeBuilderContext |
class | SwitchNodeBuilder |
CoreEngine - Implements the core logic of the graph-reachability analysis.
It traverses the CFG and generates the ExplodedGraph. Program "states" are treated as opaque void pointers. The template class CoreEngine (which subclasses CoreEngine) provides the matching component to the engine that knows the actual types for states. Note that this engine only dispatches to transfer functions at the statement and block-level. The analyses themselves must implement any transfer function logic and the sub-expression level (if any).
Definition at line 55 of file CoreEngine.h.
using clang::ento::CoreEngine::BlocksAborted = std::vector<std::pair<const CFGBlock *, const ExplodedNode *> > |
Definition at line 69 of file CoreEngine.h.
using clang::ento::CoreEngine::BlocksExhausted = std::vector<std::pair<BlockEdge, const ExplodedNode *> > |
Definition at line 66 of file CoreEngine.h.
CoreEngine::CoreEngine | ( | SubEngine & | subengine, |
FunctionSummariesTy * | FS, | ||
AnalyzerOptions & | Opts | ||
) |
Construct a CoreEngine object to analyze the provided CFG.
Definition at line 73 of file CoreEngine.cpp.
|
delete |
|
inline |
Inform the CoreEngine that a basic block was aborted because it could not be completely analyzed.
Definition at line 161 of file CoreEngine.h.
|
inline |
Definition at line 175 of file CoreEngine.h.
|
inline |
Definition at line 179 of file CoreEngine.h.
References enqueue(), enqueueEndOfFunction(), and enqueueStmtNode().
|
inline |
Definition at line 167 of file CoreEngine.h.
|
inline |
Definition at line 171 of file CoreEngine.h.
void CoreEngine::dispatchWorkItem | ( | ExplodedNode * | Pred, |
ProgramPoint | Loc, | ||
const WorkListUnit & | WU | ||
) |
Dispatch the work list item based on the given location information.
Use Pred parameter as the predecessor state.
Definition at line 153 of file CoreEngine.cpp.
References clang::ProgramPoint::BlockEdgeKind, clang::ProgramPoint::BlockEntranceKind, clang::ProgramPoint::BlockExitKind, clang::ProgramPoint::CallEnterKind, clang::ProgramPoint::CallExitBeginKind, clang::ProgramPoint::castAs(), clang::ProgramPoint::EpsilonKind, clang::ProgramPoint::getAs(), clang::ento::WorkListUnit::getBlock(), clang::ento::ExplodedNode::getFirstPred(), clang::ento::WorkListUnit::getIndex(), clang::ProgramPoint::getKind(), clang::ento::ExplodedNode::getLocation(), clang::ento::ExplodedNode::hasSinglePred(), and clang::ento::SubEngine::processCallExit().
Referenced by ExecuteWorkList(), and getGraph().
void CoreEngine::enqueue | ( | ExplodedNodeSet & | Set | ) |
Enqueue the given set of nodes onto the work list.
Definition at line 520 of file CoreEngine.cpp.
Referenced by blocks_aborted_end(), ExecuteWorkList(), clang::ento::ExprEngine::processCallEnter(), clang::ento::ExprEngine::ProcessImplicitDtor(), and clang::ento::ExprEngine::ProcessNewAllocator().
void CoreEngine::enqueue | ( | ExplodedNodeSet & | Set, |
const CFGBlock * | Block, | ||
unsigned | Idx | ||
) |
Enqueue nodes that were created as a result of processing a statement onto the work list.
Definition at line 525 of file CoreEngine.cpp.
void CoreEngine::enqueueEndOfFunction | ( | ExplodedNodeSet & | Set, |
const ReturnStmt * | RS | ||
) |
enqueue the nodes corresponding to the end of function onto the end of path / work list.
Definition at line 531 of file CoreEngine.cpp.
Referenced by blocks_aborted_end().
void CoreEngine::enqueueStmtNode | ( | ExplodedNode * | N, |
const CFGBlock * | Block, | ||
unsigned | Idx | ||
) |
Enqueue a single node created as a result of statement processing.
Definition at line 456 of file CoreEngine.cpp.
References clang::ento::ExplodedNode::addPredecessor(), clang::CFGElement::castAs(), clang::ProgramPoint::getAs(), getKind(), clang::ento::ExplodedNode::getLocation(), clang::ento::ExplodedNode::getLocationContext(), clang::ento::ExplodedGraph::getNode(), clang::ento::ExplodedNode::getState(), clang::CFGStmt::getStmt(), clang::ento::ExplodedNode::isSink(), clang::CFGElement::NewAllocator, Node, and clang::ProgramPoint::withTag().
Referenced by blocks_aborted_end().
bool CoreEngine::ExecuteWorkList | ( | const LocationContext * | L, |
unsigned | Steps, | ||
ProgramStateRef | InitState | ||
) |
ExecuteWorkList - Run the worklist algorithm for a maximum number of steps.
Returns true if there is still simulation state on the worklist.
Definition at line 79 of file CoreEngine.cpp.
References clang::ento::ExplodedGraph::addRoot(), dispatchWorkItem(), clang::CFGBlock::empty(), enqueue(), clang::ento::WorkListUnit::getBlockCounter(), clang::CFGBlock::getBlockID(), clang::LocationContext::getCFG(), clang::LocationContext::getDecl(), clang::BlockEdge::getDst(), clang::ento::BlockCounter::Factory::GetEmptyCounter(), clang::CFG::getEntry(), clang::ento::SubEngine::getInitialState(), clang::ento::ExplodedNode::getLocation(), clang::ento::WorkListUnit::getNode(), clang::ento::ExplodedGraph::getNode(), clang::CFG::getNumBlockIDs(), hasWorkRemaining(), clang::ento::FunctionSummariesTy::markVisitedBasicBlock(), min(), Node, clang::ento::ExplodedGraph::num_roots(), clang::ento::SubEngine::processBeginOfFunction(), clang::ento::SubEngine::processEndWorklist(), clang::ento::ExplodedGraph::reserve(), clang::CFGBlock::succ_begin(), and clang::CFGBlock::succ_size().
Referenced by clang::ento::ExprEngine::ExecuteWorkList(), ExecuteWorkListWithInitialState(), and getGraph().
bool CoreEngine::ExecuteWorkListWithInitialState | ( | const LocationContext * | L, |
unsigned | Steps, | ||
ProgramStateRef | InitState, | ||
ExplodedNodeSet & | Dst | ||
) |
Returns true if there is still simulation state on the worklist.
Definition at line 196 of file CoreEngine.cpp.
References ExecuteWorkList().
Referenced by clang::ento::ExprEngine::ExecuteWorkListWithInitialState(), and getGraph().
|
inline |
getGraph - Returns the exploded graph.
Definition at line 134 of file CoreEngine.h.
References dispatchWorkItem(), ExecuteWorkList(), and ExecuteWorkListWithInitialState().
|
inline |
Definition at line 165 of file CoreEngine.h.
Referenced by clang::ento::ExprEngine::hasEmptyWorkList().
|
inline |
Definition at line 155 of file CoreEngine.h.
References wasBlockAborted(), and wasBlocksExhausted().
Referenced by ExecuteWorkList(), and clang::ento::ExprEngine::hasWorkRemaining().
|
delete |
|
inline |
Definition at line 153 of file CoreEngine.h.
Referenced by hasWorkRemaining().
|
inline |
Definition at line 154 of file CoreEngine.h.
Referenced by hasWorkRemaining(), and clang::ento::ExprEngine::wasBlocksExhausted().
|
friend |
Definition at line 56 of file CoreEngine.h.
|
friend |
Definition at line 57 of file CoreEngine.h.
|
friend |
Definition at line 58 of file CoreEngine.h.
|
friend |
Definition at line 59 of file CoreEngine.h.
|
friend |
Definition at line 60 of file CoreEngine.h.
|
friend |
Definition at line 61 of file CoreEngine.h.
|
friend |
Definition at line 62 of file CoreEngine.h.