30 #include "llvm/ADT/ImmutableMap.h" 31 #include "llvm/ADT/Optional.h" 32 #include "llvm/Support/raw_ostream.h" 35 using namespace clang;
47 enum { Symbolic = 0x2 };
49 llvm::PointerIntPair<const MemRegion *, 2>
P;
54 explicit BindingKey(
const SubRegion *r,
const SubRegion *
Base,
Kind k)
55 : P(r, k | Symbolic), Data(reinterpret_cast<
uintptr_t>(Base)) {
56 assert(r && Base &&
"Must have known regions.");
57 assert(getConcreteOffsetRegion() == Base &&
"Failed to store base region");
61 explicit BindingKey(
const MemRegion *r, uint64_t offset,
Kind k)
62 : P(r, k), Data(offset) {
63 assert(r &&
"Must have known regions.");
64 assert(getOffset() == offset &&
"Failed to store offset");
65 assert((r == r->getBaseRegion() || isa<ObjCIvarRegion>(r) ||
66 isa <CXXDerivedObjectRegion>(r)) &&
71 bool isDirect()
const {
return P.getInt() & Direct; }
72 bool hasSymbolicOffset()
const {
return P.getInt() & Symbolic; }
74 const MemRegion *getRegion()
const {
return P.getPointer(); }
75 uint64_t getOffset()
const {
76 assert(!hasSymbolicOffset());
80 const SubRegion *getConcreteOffsetRegion()
const {
81 assert(hasSymbolicOffset());
82 return reinterpret_cast<const SubRegion *
>(
static_cast<uintptr_t>(Data));
85 const MemRegion *getBaseRegion()
const {
86 if (hasSymbolicOffset())
87 return getConcreteOffsetRegion()->getBaseRegion();
88 return getRegion()->getBaseRegion();
91 void Profile(llvm::FoldingSetNodeID&
ID)
const {
92 ID.AddPointer(P.getOpaqueValue());
96 static BindingKey
Make(
const MemRegion *R,
Kind k);
99 if (P.getOpaqueValue() < X.P.getOpaqueValue())
101 if (P.getOpaqueValue() > X.P.getOpaqueValue())
103 return Data < X.Data;
107 return P.getOpaqueValue() == X.P.getOpaqueValue() &&
116 const RegionOffset &RO = R->getAsOffset();
117 if (RO.hasSymbolicOffset())
118 return BindingKey(cast<SubRegion>(R), cast<SubRegion>(RO.getRegion()), k);
120 return BindingKey(RO.getRegion(), RO.getOffset(), k);
126 os <<
'(' << K.getRegion();
127 if (!K.hasSymbolicOffset())
128 os <<
',' << K.getOffset();
129 os <<
',' << (K.isDirect() ?
"direct" :
"default")
136 static const bool value =
true;
152 typedef llvm::ImmutableMap<const MemRegion *, ClusterBindings>
156 class RegionBindingsRef :
public llvm::ImmutableMapRef<const MemRegion *,
158 ClusterBindings::Factory *CBFactory;
161 typedef llvm::ImmutableMapRef<const MemRegion *, ClusterBindings>
164 RegionBindingsRef(ClusterBindings::Factory &CBFactory,
165 const RegionBindings::TreeTy *T,
166 RegionBindings::TreeTy::Factory *F)
167 : llvm::ImmutableMapRef<const MemRegion *, ClusterBindings>(T, F),
168 CBFactory(&CBFactory) {}
170 RegionBindingsRef(
const ParentTy &P, ClusterBindings::Factory &CBFactory)
171 : llvm::ImmutableMapRef<const MemRegion *, ClusterBindings>(
P),
172 CBFactory(&CBFactory) {}
174 RegionBindingsRef add(key_type_ref K, data_type_ref D)
const {
175 return RegionBindingsRef(static_cast<const ParentTy *>(
this)->add(K, D),
179 RegionBindingsRef
remove(key_type_ref K)
const {
180 return RegionBindingsRef(static_cast<const ParentTy *>(
this)->
remove(K),
184 RegionBindingsRef addBinding(BindingKey K, SVal V)
const;
186 RegionBindingsRef addBinding(
const MemRegion *R,
187 BindingKey::Kind k, SVal V)
const;
189 const SVal *lookup(BindingKey K)
const;
190 const SVal *lookup(
const MemRegion *R, BindingKey::Kind k)
const;
191 using llvm::ImmutableMapRef<const MemRegion *, ClusterBindings>::lookup;
193 RegionBindingsRef removeBinding(BindingKey K);
195 RegionBindingsRef removeBinding(
const MemRegion *R,
198 RegionBindingsRef removeBinding(
const MemRegion *R) {
199 return removeBinding(R, BindingKey::Direct).
210 Store asStore()
const {
211 return asImmutableMap().getRootWithoutRetain();
214 void dump(raw_ostream &
OS,
const char *nl)
const {
215 for (iterator I = begin(), E = end(); I != E; ++I) {
216 const ClusterBindings &Cluster = I.getData();
217 for (ClusterBindings::iterator CI = Cluster.begin(), CE = Cluster.end();
219 OS <<
' ' << CI.getKey() <<
" : " << CI.getData() << nl;
225 LLVM_DUMP_METHOD
void dump()
const {
dump(llvm::errs(),
"\n"); }
231 Optional<SVal> RegionBindingsRef::getDirectBinding(
const MemRegion *R)
const {
235 Optional<SVal> RegionBindingsRef::getDefaultBinding(
const MemRegion *R)
const {
239 RegionBindingsRef RegionBindingsRef::addBinding(BindingKey K, SVal V)
const {
240 const MemRegion *Base = K.getBaseRegion();
242 const ClusterBindings *ExistingCluster = lookup(Base);
243 ClusterBindings Cluster =
244 (ExistingCluster ? *ExistingCluster : CBFactory->getEmptyMap());
246 ClusterBindings NewCluster = CBFactory->add(Cluster, K, V);
247 return add(Base, NewCluster);
251 RegionBindingsRef RegionBindingsRef::addBinding(
const MemRegion *R,
257 const SVal *RegionBindingsRef::lookup(BindingKey K)
const {
258 const ClusterBindings *Cluster = lookup(K.getBaseRegion());
261 return Cluster->lookup(K);
264 const SVal *RegionBindingsRef::lookup(
const MemRegion *R,
265 BindingKey::Kind k)
const {
269 RegionBindingsRef RegionBindingsRef::removeBinding(BindingKey K) {
270 const MemRegion *Base = K.getBaseRegion();
271 const ClusterBindings *Cluster = lookup(Base);
275 ClusterBindings NewCluster = CBFactory->remove(*Cluster, K);
276 if (NewCluster.isEmpty())
278 return add(Base, NewCluster);
281 RegionBindingsRef RegionBindingsRef::removeBinding(
const MemRegion *R,
291 struct minimal_features_tag {};
292 struct maximal_features_tag {};
294 class RegionStoreFeatures {
297 RegionStoreFeatures(minimal_features_tag) :
298 SupportsFields(
false) {}
300 RegionStoreFeatures(maximal_features_tag) :
301 SupportsFields(
true) {}
303 void enableFields(
bool t) { SupportsFields = t; }
305 bool supportsFields()
const {
return SupportsFields; }
314 class InvalidateRegionsWorker;
316 class RegionStoreManager :
public StoreManager {
318 const RegionStoreFeatures Features;
320 RegionBindings::Factory RBFactory;
321 mutable ClusterBindings::Factory CBFactory;
323 typedef std::vector<SVal> SValListTy;
325 typedef llvm::DenseMap<
const LazyCompoundValData *,
326 SValListTy> LazyBindingsMapTy;
327 LazyBindingsMapTy LazyBindingsMap;
337 unsigned SmallStructLimit;
341 void populateWorkList(InvalidateRegionsWorker &W,
343 InvalidatedRegions *TopLevelRegions);
346 RegionStoreManager(ProgramStateManager& mgr,
const RegionStoreFeatures &f)
347 : StoreManager(mgr), Features(f),
348 RBFactory(mgr.getAllocator()), CBFactory(mgr.getAllocator()),
349 SmallStructLimit(0) {
350 SubEngine &Eng = StateMgr.getOwningEngine();
352 SmallStructLimit = Options.RegionStoreSmallStructLimit;
359 RegionBindingsRef setImplicitDefaultValue(RegionBindingsConstRef B,
368 SVal ArrayToPointer(Loc Array,
QualType ElementTy)
override;
371 return StoreRef(RBFactory.getEmptyMap().getRootWithoutRetain(), *
this);
382 InvalidatedRegions *Invalidated);
384 StoreRef invalidateRegions(
Store store,
386 const Expr *E,
unsigned Count,
390 RegionAndSymbolInvalidationTraits &ITraits,
391 InvalidatedRegions *Invalidated,
392 InvalidatedRegions *InvalidatedTopLevel)
override;
394 bool scanReachableSymbols(
Store S,
const MemRegion *R,
395 ScanReachableSymbols &Callbacks)
override;
397 RegionBindingsRef removeSubRegionBindings(RegionBindingsConstRef B,
402 StoreRef Bind(
Store store, Loc LV, SVal V)
override {
403 return StoreRef(bind(getRegionBindings(store), LV, V).asStore(), *
this);
406 RegionBindingsRef bind(RegionBindingsConstRef B, Loc LV, SVal V);
410 StoreRef BindDefaultInitial(
Store store,
const MemRegion *R,
412 RegionBindingsRef B = getRegionBindings(store);
415 assert(!(B.getDefaultBinding(R) || B.getDirectBinding(R)) &&
416 "Double initialization!");
418 return StoreRef(B.asImmutableMap().getRootWithoutRetain(), *
this);
423 StoreRef BindDefaultZero(
Store store,
const MemRegion *R)
override {
433 if (
const auto *BR = dyn_cast<CXXBaseObjectRegion>(R))
434 if (BR->getDecl()->isEmpty())
435 return StoreRef(store, *
this);
437 RegionBindingsRef B = getRegionBindings(store);
438 SVal V = svalBuilder.makeZeroVal(Ctx.CharTy);
439 B = removeSubRegionBindings(B, cast<SubRegion>(R));
441 return StoreRef(B.asImmutableMap().getRootWithoutRetain(), *
this);
455 const TypedValueRegion *R,
457 nonloc::LazyCompoundVal LCV);
460 RegionBindingsRef bindStruct(RegionBindingsConstRef B,
461 const TypedValueRegion* R, SVal V);
464 RegionBindingsRef bindVector(RegionBindingsConstRef B,
465 const TypedValueRegion* R, SVal V);
467 RegionBindingsRef bindArray(RegionBindingsConstRef B,
468 const TypedValueRegion* R,
473 RegionBindingsRef bindAggregate(RegionBindingsConstRef B,
474 const TypedRegion *R,
480 StoreRef killBinding(
Store ST, Loc L)
override;
482 void incrementReferenceCount(
Store store)
override {
483 getRegionBindings(store).manualRetain();
489 void decrementReferenceCount(
Store store)
override {
490 getRegionBindings(store).manualRelease();
493 bool includedInBindings(
Store store,
const MemRegion *region)
const override;
509 return getBinding(getRegionBindings(S), L, T);
513 RegionBindingsRef B = getRegionBindings(S);
517 return B.getDefaultBinding(R->getBaseRegion());
522 SVal getBindingForElement(RegionBindingsConstRef B,
const ElementRegion *R);
524 SVal getBindingForField(RegionBindingsConstRef B,
const FieldRegion *R);
526 SVal getBindingForObjCIvar(RegionBindingsConstRef B,
const ObjCIvarRegion *R);
528 SVal getBindingForVar(RegionBindingsConstRef B,
const VarRegion *R);
530 SVal getBindingForLazySymbol(
const TypedValueRegion *R);
532 SVal getBindingForFieldOrElementCommon(RegionBindingsConstRef B,
533 const TypedValueRegion *R,
536 SVal getLazyBinding(
const SubRegion *LazyBindingRegion,
537 RegionBindingsRef LazyBinding);
544 SVal getBindingForStruct(RegionBindingsConstRef B,
const TypedValueRegion *R);
545 SVal getBindingForArray(RegionBindingsConstRef B,
const TypedValueRegion *R);
546 NonLoc createLazyBinding(RegionBindingsConstRef B,
const TypedValueRegion *R);
553 Optional<SVal> getBindingForDerivedDefaultValue(RegionBindingsConstRef B,
554 const MemRegion *superR,
555 const TypedValueRegion *R,
562 std::pair<Store, const SubRegion *>
563 findLazyBinding(RegionBindingsConstRef B,
const SubRegion *R,
564 const SubRegion *originalRegion);
572 const SValListTy &getInterestingValues(nonloc::LazyCompoundVal LCV);
581 SymbolReaper& SymReaper)
override;
596 RegionBindingsRef getRegionBindings(
Store store)
const {
597 return RegionBindingsRef(CBFactory,
598 static_cast<const RegionBindings::TreeTy*>(store),
599 RBFactory.getTreeFactory());
602 void print(
Store store, raw_ostream &Out,
const char* nl)
override;
604 void iterBindings(
Store store, BindingsHandler& f)
override {
605 RegionBindingsRef B = getRegionBindings(store);
606 for (RegionBindingsRef::iterator I = B.begin(), E = B.end(); I != E; ++I) {
607 const ClusterBindings &Cluster = I.getData();
608 for (ClusterBindings::iterator CI = Cluster.begin(), CE = Cluster.end();
610 const BindingKey &K = CI.getKey();
613 if (
const SubRegion *R = dyn_cast<SubRegion>(K.getRegion())) {
615 if (!f.HandleBinding(*
this, store, R, CI.getData()))
629 std::unique_ptr<StoreManager>
631 RegionStoreFeatures F = maximal_features_tag();
632 return llvm::make_unique<RegionStoreManager>(StMgr, F);
635 std::unique_ptr<StoreManager>
637 RegionStoreFeatures F = minimal_features_tag();
638 F.enableFields(
true);
639 return llvm::make_unique<RegionStoreManager>(StMgr, F);
659 template <
typename DERIVED>
660 class ClusterAnalysis {
662 typedef llvm::DenseMap<const MemRegion *, const ClusterBindings *> ClusterMap;
663 typedef const MemRegion * WorkListElement;
666 llvm::SmallPtrSet<const ClusterBindings *, 16> Visited;
670 RegionStoreManager &RM;
672 SValBuilder &svalBuilder;
678 const ClusterBindings *getCluster(
const MemRegion *R) {
685 bool includeEntireMemorySpace(
const MemRegion *Base) {
690 ClusterAnalysis(RegionStoreManager &rm, ProgramStateManager &StateMgr,
692 : RM(rm), Ctx(StateMgr.getContext()),
693 svalBuilder(StateMgr.getSValBuilder()), B(std::move(b)) {}
695 RegionBindingsRef getRegionBindings()
const {
return B; }
697 bool isVisited(
const MemRegion *R) {
698 return Visited.count(getCluster(R));
701 void GenerateClusters() {
703 for (RegionBindingsRef::iterator RI = B.begin(), RE = B.end();
705 const MemRegion *Base = RI.getKey();
707 const ClusterBindings &Cluster = RI.getData();
708 assert(!Cluster.isEmpty() &&
"Empty clusters should be removed");
709 static_cast<DERIVED*
>(
this)->VisitAddedToCluster(Base, Cluster);
713 if (static_cast<DERIVED*>(
this)->includeEntireMemorySpace(Base))
714 AddToWorkList(WorkListElement(Base), &Cluster);
718 bool AddToWorkList(WorkListElement E,
const ClusterBindings *C) {
719 if (C && !Visited.insert(C).second)
725 bool AddToWorkList(
const MemRegion *R) {
726 return static_cast<DERIVED*
>(
this)->AddToWorkList(R);
730 while (!WL.empty()) {
731 WorkListElement E = WL.pop_back_val();
732 const MemRegion *BaseR = E;
734 static_cast<DERIVED*
>(
this)->VisitCluster(BaseR, getCluster(BaseR));
738 void VisitAddedToCluster(
const MemRegion *baseR,
const ClusterBindings &C) {}
739 void VisitCluster(
const MemRegion *baseR,
const ClusterBindings *C) {}
741 void VisitCluster(
const MemRegion *BaseR,
const ClusterBindings *C,
743 static_cast<DERIVED*
>(
this)->VisitCluster(BaseR, C);
752 bool RegionStoreManager::scanReachableSymbols(
Store S,
const MemRegion *R,
753 ScanReachableSymbols &Callbacks) {
754 assert(R == R->getBaseRegion() &&
"Should only be called for base regions");
755 RegionBindingsRef B = getRegionBindings(S);
756 const ClusterBindings *Cluster = B.lookup(R);
761 for (ClusterBindings::iterator RI = Cluster->begin(), RE = Cluster->end();
763 if (!Callbacks.scan(RI.getData()))
771 return FR->getDecl()->getParent()->isUnion();
777 assert(K.hasSymbolicOffset() &&
"Not implemented for concrete offset keys");
779 const MemRegion *Base = K.getConcreteOffsetRegion();
780 const MemRegion *R = K.getRegion();
783 if (
const FieldRegion *FR = dyn_cast<FieldRegion>(R))
785 Fields.push_back(FR->getDecl());
787 R = cast<SubRegion>(R)->getSuperRegion();
792 assert(K.hasSymbolicOffset() &&
"Not implemented for concrete offset keys");
797 FieldVector FieldsInBindingKey;
800 ptrdiff_t Delta = FieldsInBindingKey.size() - Fields.size();
802 return std::equal(FieldsInBindingKey.begin() + Delta,
803 FieldsInBindingKey.end(),
806 return std::equal(FieldsInBindingKey.begin(), FieldsInBindingKey.end(),
807 Fields.begin() - Delta);
821 SValBuilder &SVB,
const ClusterBindings &Cluster,
822 const SubRegion *Top, BindingKey TopKey,
823 bool IncludeAllDefaultBindings) {
824 FieldVector FieldsInSymbolicSubregions;
825 if (TopKey.hasSymbolicOffset()) {
827 Top = TopKey.getConcreteOffsetRegion();
832 uint64_t Length = UINT64_MAX;
833 SVal Extent = Top->getExtent(SVB);
835 Extent.getAs<nonloc::ConcreteInt>()) {
836 const llvm::APSInt &ExtentInt = ExtentCI->getValue();
837 assert(ExtentInt.isNonNegative() || ExtentInt.isUnsigned());
839 Length = ExtentInt.getLimitedValue() * SVB.getContext().getCharWidth();
840 }
else if (
const FieldRegion *FR = dyn_cast<FieldRegion>(Top)) {
841 if (FR->getDecl()->isBitField())
842 Length = FR->getDecl()->getBitWidthValue(SVB.getContext());
845 for (ClusterBindings::iterator I = Cluster.begin(), E = Cluster.end();
847 BindingKey NextKey = I.getKey();
848 if (NextKey.getRegion() == TopKey.getRegion()) {
854 if (NextKey.getOffset() > TopKey.getOffset() &&
855 NextKey.getOffset() - TopKey.getOffset() < Length) {
858 Bindings.push_back(*I);
860 }
else if (NextKey.getOffset() == TopKey.getOffset()) {
867 if (IncludeAllDefaultBindings || NextKey.isDirect())
868 Bindings.push_back(*I);
871 }
else if (NextKey.hasSymbolicOffset()) {
872 const MemRegion *Base = NextKey.getConcreteOffsetRegion();
873 if (Top->isSubRegionOf(Base) && Top != Base) {
877 if (IncludeAllDefaultBindings || NextKey.isDirect())
879 Bindings.push_back(*I);
880 }
else if (
const SubRegion *BaseSR = dyn_cast<SubRegion>(Base)) {
883 if (BaseSR->isSubRegionOf(Top))
885 Bindings.push_back(*I);
893 SValBuilder &SVB,
const ClusterBindings &Cluster,
894 const SubRegion *Top,
bool IncludeAllDefaultBindings) {
897 IncludeAllDefaultBindings);
901 RegionStoreManager::removeSubRegionBindings(RegionBindingsConstRef B,
902 const SubRegion *Top) {
904 const MemRegion *ClusterHead = TopKey.getBaseRegion();
906 if (Top == ClusterHead) {
908 return B.remove(Top);
911 const ClusterBindings *Cluster = B.lookup(ClusterHead);
915 if (TopKey.hasSymbolicOffset()) {
916 const SubRegion *Concrete = TopKey.getConcreteOffsetRegion();
926 ClusterBindingsRef Result(*Cluster, CBFactory);
930 Result = Result.remove(I->first);
936 if (TopKey.hasSymbolicOffset()) {
937 const SubRegion *Concrete = TopKey.getConcreteOffsetRegion();
942 if (Result.isEmpty())
943 return B.remove(ClusterHead);
944 return B.add(ClusterHead, Result.asImmutableMap());
948 class InvalidateRegionsWorker :
public ClusterAnalysis<InvalidateRegionsWorker>
954 RegionAndSymbolInvalidationTraits &ITraits;
958 InvalidateRegionsWorker(RegionStoreManager &rm,
959 ProgramStateManager &stateMgr,
961 const Expr *ex,
unsigned count,
964 RegionAndSymbolInvalidationTraits &ITraitsIn,
967 : ClusterAnalysis<InvalidateRegionsWorker>(rm, stateMgr, b),
968 Ex(ex), Count(count), LCtx(lctx), IS(is), ITraits(ITraitsIn), Regions(r),
969 GlobalsFilter(GFK) {}
971 void VisitCluster(
const MemRegion *baseR,
const ClusterBindings *C);
972 void VisitBinding(SVal V);
974 using ClusterAnalysis::AddToWorkList;
976 bool AddToWorkList(
const MemRegion *R);
980 bool includeEntireMemorySpace(
const MemRegion *Base);
984 bool isInitiallyIncludedGlobalRegion(
const MemRegion *R);
988 bool InvalidateRegionsWorker::AddToWorkList(
const MemRegion *R) {
989 bool doNotInvalidateSuperRegion = ITraits.hasTrait(
991 const MemRegion *BaseR = doNotInvalidateSuperRegion ? R : R->getBaseRegion();
992 return AddToWorkList(WorkListElement(BaseR), getCluster(BaseR));
995 void InvalidateRegionsWorker::VisitBinding(SVal V) {
1000 if (
const MemRegion *R = V.getAsRegion()) {
1007 V.getAs<nonloc::LazyCompoundVal>()) {
1009 const RegionStoreManager::SValListTy &Vals = RM.getInterestingValues(*LCS);
1011 for (RegionStoreManager::SValListTy::const_iterator I = Vals.begin(),
1020 void InvalidateRegionsWorker::VisitCluster(
const MemRegion *baseR,
1021 const ClusterBindings *C) {
1023 bool PreserveRegionsContents =
1024 ITraits.hasTrait(baseR,
1028 for (ClusterBindings::iterator I = C->begin(), E = C->end(); I != E; ++I)
1029 VisitBinding(I.getData());
1032 if (!PreserveRegionsContents)
1033 B = B.remove(baseR);
1036 if (
const auto *TO = dyn_cast<TypedValueRegion>(baseR)) {
1037 if (
const auto *RD = TO->getValueType()->getAsCXXRecordDecl()) {
1042 if (RD->isLambda() && RD->getLambdaCallOperator()->getBody()) {
1045 const char *DeclBind =
"DeclBind";
1047 to(
varDecl(hasStaticStorageDuration()).bind(DeclBind)))));
1049 match(RefToStatic, *RD->getLambdaCallOperator()->getBody(),
1050 RD->getASTContext());
1053 auto *VD = Match.getNodeAs<
VarDecl>(DeclBind);
1054 const VarRegion *ToInvalidate =
1055 RM.getRegionManager().getVarRegion(VD, LCtx);
1056 AddToWorkList(ToInvalidate);
1064 if (
const BlockDataRegion *BR = dyn_cast<BlockDataRegion>(baseR)) {
1065 for (BlockDataRegion::referenced_vars_iterator
1066 BI = BR->referenced_vars_begin(), BE = BR->referenced_vars_end() ;
1068 const VarRegion *VR = BI.getCapturedRegion();
1069 const VarDecl *VD = VR->getDecl();
1079 SVal V = RM.getBinding(B, loc::MemRegionVal(VR));
1081 if (
const MemRegion *LR = L->getAsRegion())
1090 if (
const SymbolicRegion *SR = dyn_cast<SymbolicRegion>(baseR))
1091 IS.insert(SR->getSymbol());
1094 if (PreserveRegionsContents)
1099 Regions->push_back(baseR);
1101 if (isa<AllocaRegion>(baseR) || isa<SymbolicRegion>(baseR)) {
1104 DefinedOrUnknownSVal V =
1105 svalBuilder.conjureSymbolVal(baseR, Ex, LCtx, Ctx.IntTy, Count);
1110 if (!baseR->isBoundable())
1113 const TypedValueRegion *TR = cast<TypedValueRegion>(baseR);
1116 if (isInitiallyIncludedGlobalRegion(baseR)) {
1123 if (T->isRecordType()) {
1126 DefinedOrUnknownSVal V = svalBuilder.conjureSymbolVal(baseR, Ex, LCtx,
1132 if (
const ArrayType *AT = Ctx.getAsArrayType(T)) {
1133 bool doNotInvalidateSuperRegion = ITraits.hasTrait(
1137 if (doNotInvalidateSuperRegion) {
1144 NumElements = CAT->getSize().getZExtValue();
1146 goto conjure_default;
1147 QualType ElementTy = AT->getElementType();
1148 uint64_t ElemSize = Ctx.getTypeSize(ElementTy);
1149 const RegionOffset &RO = baseR->getAsOffset();
1150 const MemRegion *SuperR = baseR->getBaseRegion();
1151 if (RO.hasSymbolicOffset()) {
1155 AddToWorkList(SuperR);
1156 goto conjure_default;
1159 uint64_t LowerOffset = RO.getOffset();
1160 uint64_t UpperOffset = LowerOffset + *NumElements * ElemSize;
1161 bool UpperOverflow = UpperOffset < LowerOffset;
1166 goto conjure_default;
1168 const ClusterBindings *C = B.lookup(SuperR);
1170 goto conjure_default;
1172 for (ClusterBindings::iterator I = C->begin(), E = C->end(); I != E;
1174 const BindingKey &BK = I.getKey();
1181 ((*ROffset >= LowerOffset && *ROffset < UpperOffset) ||
1183 (*ROffset >= LowerOffset || *ROffset < UpperOffset)) ||
1184 (LowerOffset == UpperOffset && *ROffset == LowerOffset))) {
1185 B = B.removeBinding(I.getKey());
1188 SVal V = I.getData();
1189 const MemRegion *R = V.getAsRegion();
1190 if (R && isa<SymbolicRegion>(R))
1197 DefinedOrUnknownSVal V =
1198 svalBuilder.conjureSymbolVal(baseR, Ex, LCtx,
1199 AT->getElementType(), Count);
1204 DefinedOrUnknownSVal V = svalBuilder.conjureSymbolVal(baseR, Ex, LCtx,
1207 B = B.addBinding(baseR, BindingKey::Direct, V);
1210 bool InvalidateRegionsWorker::isInitiallyIncludedGlobalRegion(
1211 const MemRegion *R) {
1212 switch (GlobalsFilter) {
1215 case GFK_SystemOnly:
1216 return isa<GlobalSystemSpaceRegion>(R->getMemorySpace());
1218 return isa<NonStaticGlobalSpaceRegion>(R->getMemorySpace());
1221 llvm_unreachable(
"unknown globals filter");
1224 bool InvalidateRegionsWorker::includeEntireMemorySpace(
const MemRegion *Base) {
1225 if (isInitiallyIncludedGlobalRegion(Base))
1228 const MemSpaceRegion *MemSpace = Base->getMemorySpace();
1229 return ITraits.hasTrait(MemSpace,
1238 RegionBindingsRef B,
1239 InvalidatedRegions *Invalidated) {
1242 const GlobalsSpaceRegion *GS = MRMgr.getGlobalsRegion(K);
1243 SVal V = svalBuilder.conjureSymbolVal( (
const void*) GS, Ex, LCtx,
1247 B = B.removeBinding(GS)
1253 Invalidated->push_back(GS);
1258 void RegionStoreManager::populateWorkList(InvalidateRegionsWorker &W,
1260 InvalidatedRegions *TopLevelRegions) {
1262 E = Values.end(); I != E; ++I) {
1265 V.getAs<nonloc::LazyCompoundVal>()) {
1267 const SValListTy &Vals = getInterestingValues(*LCS);
1269 for (SValListTy::const_iterator I = Vals.begin(),
1270 E = Vals.end(); I != E; ++I) {
1273 if (
const MemRegion *R = (*I).getAsRegion())
1279 if (
const MemRegion *R = V.getAsRegion()) {
1280 if (TopLevelRegions)
1281 TopLevelRegions->push_back(R);
1289 RegionStoreManager::invalidateRegions(
Store store,
1291 const Expr *Ex,
unsigned Count,
1295 RegionAndSymbolInvalidationTraits &ITraits,
1296 InvalidatedRegions *TopLevelRegions,
1297 InvalidatedRegions *Invalidated) {
1300 if (Call->isInSystemHeader())
1301 GlobalsFilter = GFK_SystemOnly;
1303 GlobalsFilter = GFK_All;
1305 GlobalsFilter = GFK_None;
1308 RegionBindingsRef B = getRegionBindings(store);
1309 InvalidateRegionsWorker W(*
this, StateMgr, B, Ex, Count, LCtx, IS, ITraits,
1310 Invalidated, GlobalsFilter);
1313 W.GenerateClusters();
1316 populateWorkList(W, Values, TopLevelRegions);
1321 B = W.getRegionBindings();
1327 switch (GlobalsFilter) {
1329 B = invalidateGlobalRegion(MemRegion::GlobalInternalSpaceRegionKind,
1330 Ex, Count, LCtx, B, Invalidated);
1332 case GFK_SystemOnly:
1333 B = invalidateGlobalRegion(MemRegion::GlobalSystemSpaceRegionKind,
1334 Ex, Count, LCtx, B, Invalidated);
1340 return StoreRef(B.asStore(), *
this);
1347 DefinedOrUnknownSVal
1351 SVal Size = cast<SubRegion>(R)->getExtent(svalBuilder);
1352 const llvm::APSInt *SizeInt = svalBuilder.getKnownValue(state, Size);
1354 return UnknownVal();
1358 if (Ctx.getAsVariableArrayType(EleTy)) {
1362 return UnknownVal();
1365 CharUnits EleSize = Ctx.getTypeSizeInChars(EleTy);
1370 return svalBuilder.makeIntVal(RegionSize / EleSize,
1371 svalBuilder.getArrayIndexType());
1384 SVal RegionStoreManager::ArrayToPointer(Loc Array,
QualType T) {
1385 if (Array.getAs<loc::ConcreteInt>())
1388 if (!Array.getAs<loc::MemRegionVal>())
1389 return UnknownVal();
1391 const SubRegion *R =
1392 cast<SubRegion>(Array.castAs<loc::MemRegionVal>().getRegion());
1393 NonLoc ZeroIdx = svalBuilder.makeZeroArrayIndex();
1394 return loc::MemRegionVal(MRMgr.getElementRegion(T, ZeroIdx, R, Ctx));
1401 SVal RegionStoreManager::getBinding(RegionBindingsConstRef B, Loc L,
QualType T) {
1402 assert(!L.getAs<UnknownVal>() &&
"location unknown");
1403 assert(!L.getAs<UndefinedVal>() &&
"location undefined");
1411 if (L.getAs<loc::ConcreteInt>()) {
1412 return UnknownVal();
1414 if (!L.getAs<loc::MemRegionVal>()) {
1415 return UnknownVal();
1418 const MemRegion *MR = L.castAs<loc::MemRegionVal>().getRegion();
1420 if (isa<BlockDataRegion>(MR)) {
1421 return UnknownVal();
1424 if (!isa<TypedValueRegion>(MR)) {
1426 if (
const TypedRegion *TR = dyn_cast<TypedRegion>(MR))
1428 else if (
const SymbolicRegion *SR = dyn_cast<SymbolicRegion>(MR))
1431 assert(!T.
isNull() &&
"Unable to auto-detect binding type!");
1432 assert(!T->
isVoidType() &&
"Attempting to dereference a void pointer!");
1433 MR = GetElementZeroRegion(cast<SubRegion>(MR), T);
1435 T = cast<TypedValueRegion>(MR)->getValueType();
1440 const TypedValueRegion *R = cast<TypedValueRegion>(MR);
1445 if (RTy->isAnyComplexType())
1446 return UnknownVal();
1456 if (RTy->isStructureOrClassType())
1457 return getBindingForStruct(B, R);
1460 if (RTy->isUnionType())
1461 return createLazyBinding(B, R);
1463 if (RTy->isArrayType()) {
1464 if (RTy->isConstantArrayType())
1465 return getBindingForArray(B, R);
1467 return UnknownVal();
1471 if (RTy->isVectorType())
1472 return UnknownVal();
1474 if (
const FieldRegion* FR = dyn_cast<FieldRegion>(R))
1475 return CastRetrievedVal(getBindingForField(B, FR), FR, T);
1477 if (
const ElementRegion* ER = dyn_cast<ElementRegion>(R)) {
1483 return CastRetrievedVal(getBindingForElement(B, ER), ER, T);
1486 if (
const ObjCIvarRegion *IVR = dyn_cast<ObjCIvarRegion>(R)) {
1493 return CastRetrievedVal(getBindingForObjCIvar(B, IVR), IVR, T);
1496 if (
const VarRegion *VR = dyn_cast<VarRegion>(R)) {
1503 return CastRetrievedVal(getBindingForVar(B, VR), VR, T);
1506 const SVal *V = B.lookup(R, BindingKey::Direct);
1515 if (R->hasStackNonParametersStorage()) {
1520 return UndefinedVal();
1524 return svalBuilder.getRegionValueSymbolVal(R);
1529 if (
const TypedValueRegion *TVR = dyn_cast<TypedValueRegion>(R))
1530 RegionTy = TVR->getValueType();
1532 if (
const SymbolicRegion *SR = dyn_cast<SymbolicRegion>(R))
1533 RegionTy = SR->getSymbol()->getType();
1547 const SubRegion *R,
bool AllowSubregionBindings) {
1559 if (!RegionTy.
isNull() &&
1561 QualType SourceRegionTy = LCV->getRegion()->getValueType();
1562 if (!SVB.getContext().hasSameUnqualifiedType(RegionTy, SourceRegionTy))
1566 if (!AllowSubregionBindings) {
1572 if (Bindings.size() > 1)
1580 std::pair<Store, const SubRegion *>
1581 RegionStoreManager::findLazyBinding(RegionBindingsConstRef B,
1583 const SubRegion *originalRegion) {
1584 if (originalRegion != R) {
1587 return std::make_pair(V->getStore(), V->getRegion());
1590 typedef std::pair<Store, const SubRegion *> StoreRegionPair;
1591 StoreRegionPair Result = StoreRegionPair();
1593 if (
const ElementRegion *ER = dyn_cast<ElementRegion>(R)) {
1594 Result = findLazyBinding(B, cast<SubRegion>(ER->getSuperRegion()),
1598 Result.second = MRMgr.getElementRegionWithSuper(ER, Result.second);
1600 }
else if (
const FieldRegion *FR = dyn_cast<FieldRegion>(R)) {
1601 Result = findLazyBinding(B, cast<SubRegion>(FR->getSuperRegion()),
1605 Result.second = MRMgr.getFieldRegionWithSuper(FR, Result.second);
1607 }
else if (
const CXXBaseObjectRegion *BaseReg =
1608 dyn_cast<CXXBaseObjectRegion>(R)) {
1611 Result = findLazyBinding(B, cast<SubRegion>(BaseReg->getSuperRegion()),
1615 Result.second = MRMgr.getCXXBaseObjectRegionWithSuper(BaseReg,
1622 SVal RegionStoreManager::getBindingForElement(RegionBindingsConstRef B,
1623 const ElementRegion* R) {
1625 if (isa<CompoundLiteralRegion>(R->getBaseRegion()))
1626 return UnknownVal();
1632 const MemRegion* superR = R->getSuperRegion();
1635 if (
const StringRegion *StrR = dyn_cast<StringRegion>(superR)) {
1638 QualType T = Ctx.getAsArrayType(StrR->getValueType())->getElementType();
1639 if (!Ctx.hasSameUnqualifiedType(T, R->getElementType()))
1640 return UnknownVal();
1643 SVal Idx = R->getIndex();
1645 int64_t i = CI->getValue().getSExtValue();
1649 return UndefinedVal();
1656 return svalBuilder.makeIntVal(c, T);
1658 }
else if (
const VarRegion *VR = dyn_cast<VarRegion>(superR)) {
1660 const VarDecl *VD = VR->getDecl();
1664 if (
const auto *InitList = dyn_cast<InitListExpr>(Init)) {
1666 if (
auto CI = R->getIndex().getAs<nonloc::ConcreteInt>()) {
1667 int64_t i = CI->getValue().getSExtValue();
1671 return UndefinedVal();
1673 if (
auto CAT = Ctx.getAsConstantArrayType(VD->
getType()))
1674 if (CAT->getSize().sle(i))
1675 return UndefinedVal();
1678 if (i >= InitList->getNumInits())
1679 return svalBuilder.makeZeroVal(R->getElementType());
1681 if (
const Expr *ElemInit = InitList->getInit(i))
1691 if (isa<CodeTextRegion>(superR))
1692 return UnknownVal();
1700 const RegionRawOffset &O = R->getAsArrayOffset();
1704 return UnknownVal();
1706 if (
const TypedValueRegion *baseR =
1707 dyn_cast_or_null<TypedValueRegion>(O.getRegion())) {
1708 QualType baseT = baseR->getValueType();
1710 QualType elemT = R->getElementType();
1712 if (Ctx.getTypeSizeInChars(baseT) >= Ctx.getTypeSizeInChars(elemT)) {
1714 if (
SymbolRef parentSym = V->getAsSymbol())
1715 return svalBuilder.getDerivedRegionValueSymbolVal(parentSym, R);
1717 if (V->isUnknownOrUndef())
1721 return UnknownVal();
1727 return getBindingForFieldOrElementCommon(B, R, R->getElementType());
1730 SVal RegionStoreManager::getBindingForField(RegionBindingsConstRef B,
1731 const FieldRegion* R) {
1746 const MemRegion* superR = R->getSuperRegion();
1747 if (
const auto *VR = dyn_cast<VarRegion>(superR)) {
1748 const VarDecl *VD = VR->getDecl();
1754 if (
const auto *InitList = dyn_cast<InitListExpr>(Init)) {
1755 if (Index < InitList->getNumInits()) {
1756 if (
const Expr *FieldInit = InitList->getInit(Index))
1760 return svalBuilder.makeZeroVal(Ty);
1765 return getBindingForFieldOrElementCommon(B, R, Ty);
1769 RegionStoreManager::getBindingForDerivedDefaultValue(RegionBindingsConstRef B,
1770 const MemRegion *superR,
1771 const TypedValueRegion *R,
1775 const SVal &val = D.getValue();
1776 if (
SymbolRef parentSym = val.getAsSymbol())
1777 return svalBuilder.getDerivedRegionValueSymbolVal(parentSym, R);
1779 if (val.isZeroConstant())
1780 return svalBuilder.makeZeroVal(Ty);
1782 if (val.isUnknownOrUndef())
1787 if (val.getAs<nonloc::LazyCompoundVal>() ||
1788 val.getAs<nonloc::CompoundVal>())
1791 llvm_unreachable(
"Unknown default value");
1797 SVal RegionStoreManager::getLazyBinding(
const SubRegion *LazyBindingRegion,
1798 RegionBindingsRef LazyBinding) {
1800 if (
const ElementRegion *ER = dyn_cast<ElementRegion>(LazyBindingRegion))
1801 Result = getBindingForElement(LazyBinding, ER);
1803 Result = getBindingForField(LazyBinding,
1804 cast<FieldRegion>(LazyBindingRegion));
1820 if (Result.isUndef())
1821 Result = UnknownVal();
1827 RegionStoreManager::getBindingForFieldOrElementCommon(RegionBindingsConstRef B,
1828 const TypedValueRegion *R,
1835 Store lazyBindingStore =
nullptr;
1836 const SubRegion *lazyBindingRegion =
nullptr;
1837 std::tie(lazyBindingStore, lazyBindingRegion) = findLazyBinding(B, R, R);
1838 if (lazyBindingRegion)
1839 return getLazyBinding(lazyBindingRegion,
1840 getRegionBindings(lazyBindingStore));
1844 bool hasSymbolicIndex =
false;
1860 bool hasPartialLazyBinding =
false;
1862 const SubRegion *SR = R;
1864 const MemRegion *Base = SR->getSuperRegion();
1865 if (
Optional<SVal> D = getBindingForDerivedDefaultValue(B, Base, R, Ty)) {
1866 if (D->getAs<nonloc::LazyCompoundVal>()) {
1867 hasPartialLazyBinding =
true;
1874 if (
const ElementRegion *ER = dyn_cast<ElementRegion>(Base)) {
1875 NonLoc index = ER->getIndex();
1876 if (!index.isConstant())
1877 hasSymbolicIndex =
true;
1882 SR = dyn_cast<SubRegion>(Base);
1885 if (R->hasStackNonParametersStorage()) {
1886 if (isa<ElementRegion>(R)) {
1889 if (
const TypedValueRegion *typedSuperR =
1890 dyn_cast<TypedValueRegion>(R->getSuperRegion())) {
1891 if (typedSuperR->getValueType()->isVectorType())
1892 return UnknownVal();
1900 if (hasSymbolicIndex)
1901 return UnknownVal();
1903 if (!hasPartialLazyBinding)
1904 return UndefinedVal();
1908 return svalBuilder.getRegionValueSymbolVal(R);
1911 SVal RegionStoreManager::getBindingForObjCIvar(RegionBindingsConstRef B,
1912 const ObjCIvarRegion* R) {
1917 const MemRegion *superR = R->getSuperRegion();
1921 if (
SymbolRef parentSym = V->getAsSymbol())
1922 return svalBuilder.getDerivedRegionValueSymbolVal(parentSym, R);
1925 return UnknownVal();
1928 return getBindingForLazySymbol(R);
1931 SVal RegionStoreManager::getBindingForVar(RegionBindingsConstRef B,
1932 const VarRegion *R) {
1939 const VarDecl *VD = R->getDecl();
1940 const MemSpaceRegion *MS = R->getMemorySpace();
1943 if (isa<StackArgumentsSpaceRegion>(MS))
1944 return svalBuilder.getRegionValueSymbolVal(R);
1955 return UnknownVal();
1961 if (isa<UnknownSpaceRegion>(MS))
1962 return svalBuilder.getRegionValueSymbolVal(R);
1964 if (isa<GlobalsSpaceRegion>(MS)) {
1971 if (isa<StaticGlobalSpaceRegion>(MS))
1972 return svalBuilder.makeZeroVal(T);
1974 if (
Optional<SVal> V = getBindingForDerivedDefaultValue(B, MS, R, T)) {
1975 assert(!V->getAs<nonloc::LazyCompoundVal>());
1976 return V.getValue();
1979 return svalBuilder.getRegionValueSymbolVal(R);
1982 return UndefinedVal();
1985 SVal RegionStoreManager::getBindingForLazySymbol(
const TypedValueRegion *R) {
1987 return svalBuilder.getRegionValueSymbolVal(R);
1990 const RegionStoreManager::SValListTy &
1991 RegionStoreManager::getInterestingValues(nonloc::LazyCompoundVal LCV) {
1993 LazyBindingsMapTy::iterator I = LazyBindingsMap.find(LCV.getCVData());
1994 if (I != LazyBindingsMap.end())
2000 const SubRegion *LazyR = LCV.getRegion();
2001 RegionBindingsRef B = getRegionBindings(LCV.getStore());
2005 const ClusterBindings *Cluster = B.lookup(LazyR->getBaseRegion());
2007 return (LazyBindingsMap[LCV.getCVData()] = std::move(List));
2016 if (V.isUnknownOrUndef() || V.isConstant())
2020 V.getAs<nonloc::LazyCompoundVal>()) {
2021 const SValListTy &InnerList = getInterestingValues(*InnerLCV);
2022 List.insert(List.end(), InnerList.begin(), InnerList.end());
2029 return (LazyBindingsMap[LCV.getCVData()] = std::move(List));
2032 NonLoc RegionStoreManager::createLazyBinding(RegionBindingsConstRef B,
2033 const TypedValueRegion *R) {
2038 return svalBuilder.makeLazyCompoundVal(StoreRef(B.asStore(), *
this), R);
2045 return CRD->getNumBases() == 0;
2049 SVal RegionStoreManager::getBindingForStruct(RegionBindingsConstRef B,
2050 const TypedValueRegion *R) {
2053 return UnknownVal();
2055 return createLazyBinding(B, R);
2058 SVal RegionStoreManager::getBindingForArray(RegionBindingsConstRef B,
2059 const TypedValueRegion *R) {
2060 assert(Ctx.getAsConstantArrayType(R->getValueType()) &&
2061 "Only constant array types can have compound bindings.");
2063 return createLazyBinding(B, R);
2066 bool RegionStoreManager::includedInBindings(
Store store,
2067 const MemRegion *region)
const {
2068 RegionBindingsRef B = getRegionBindings(store);
2069 region = region->getBaseRegion();
2072 if (B.lookup(region))
2076 for (RegionBindingsRef::iterator RI = B.begin(), RE = B.end(); RI != RE; ++RI) {
2077 const ClusterBindings &Cluster = RI.getData();
2078 for (ClusterBindings::iterator CI = Cluster.begin(), CE = Cluster.end();
2080 const SVal &D = CI.getData();
2081 if (
const MemRegion *R = D.getAsRegion())
2082 if (R->getBaseRegion() == region)
2094 StoreRef RegionStoreManager::killBinding(
Store ST, Loc L) {
2096 if (
const MemRegion* R = LV->getRegion())
2097 return StoreRef(getRegionBindings(ST).removeBinding(R)
2099 .getRootWithoutRetain(),
2102 return StoreRef(ST, *
this);
2106 RegionStoreManager::bind(RegionBindingsConstRef B, Loc L, SVal V) {
2107 if (L.getAs<loc::ConcreteInt>())
2111 const MemRegion *R = L.castAs<loc::MemRegionVal>().getRegion();
2114 if (
const TypedValueRegion* TR = dyn_cast<TypedValueRegion>(R)) {
2117 return bindArray(B, TR, V);
2119 return bindStruct(B, TR, V);
2121 return bindVector(B, TR, V);
2123 return bindAggregate(B, TR, V);
2126 if (
const SymbolicRegion *SR = dyn_cast<SymbolicRegion>(R)) {
2129 QualType T = SR->getSymbol()->getType();
2133 R = GetElementZeroRegion(SR, T);
2136 assert((!isa<CXXThisRegion>(R) || !B.lookup(R)) &&
2137 "'this' pointer is not an l-value and is not assignable");
2140 RegionBindingsRef NewB = removeSubRegionBindings(B, cast<SubRegion>(R));
2145 RegionStoreManager::setImplicitDefaultValue(RegionBindingsConstRef B,
2151 V = svalBuilder.makeNull();
2153 V = svalBuilder.makeZeroVal(T);
2157 V = svalBuilder.makeZeroVal(Ctx.IntTy);
2172 RegionStoreManager::bindArray(RegionBindingsConstRef B,
2173 const TypedValueRegion* R,
2176 const ArrayType *AT =cast<ArrayType>(Ctx.getCanonicalType(R->getValueType()));
2181 Size = CAT->getSize().getZExtValue();
2187 SVal V = getBinding(B.asStore(), *MRV, R->getValueType());
2188 return bindAggregate(B, R, V);
2192 if (Init.getAs<nonloc::LazyCompoundVal>())
2193 return bindAggregate(B, R, Init);
2195 if (Init.isUnknown())
2196 return bindAggregate(B, R, UnknownVal());
2199 const nonloc::CompoundVal& CV = Init.castAs<nonloc::CompoundVal>();
2203 RegionBindingsRef NewB(B);
2205 for (; Size.hasValue() ? i < Size.getValue() :
true ; ++i, ++VI) {
2210 const NonLoc &Idx = svalBuilder.makeArrayIndex(i);
2211 const ElementRegion *ER = MRMgr.getElementRegion(ElementTy, Idx, R, Ctx);
2214 NewB = bindStruct(NewB, ER, *VI);
2216 NewB = bindArray(NewB, ER, *VI);
2218 NewB = bind(NewB, loc::MemRegionVal(ER), *VI);
2224 if (!Size.hasValue() || i < Size.getValue())
2225 NewB = setImplicitDefaultValue(NewB, R, ElementTy);
2230 RegionBindingsRef RegionStoreManager::bindVector(RegionBindingsConstRef B,
2231 const TypedValueRegion* R,
2238 if (V.getAs<nonloc::LazyCompoundVal>() || V.getAs<nonloc::SymbolVal>())
2239 return bindAggregate(B, R, V);
2244 if (!V.getAs<nonloc::CompoundVal>()) {
2245 return bindAggregate(B, R, UnknownVal());
2248 QualType ElemType = VT->getElementType();
2249 nonloc::CompoundVal CV = V.
castAs<nonloc::CompoundVal>();
2251 unsigned index = 0, numElements = VT->getNumElements();
2252 RegionBindingsRef NewB(B);
2254 for ( ; index != numElements ; ++index) {
2258 NonLoc Idx = svalBuilder.makeArrayIndex(index);
2259 const ElementRegion *ER = MRMgr.getElementRegion(ElemType, Idx, R, Ctx);
2262 NewB = bindArray(NewB, ER, *VI);
2264 NewB = bindStruct(NewB, ER, *VI);
2266 NewB = bind(NewB, loc::MemRegionVal(ER), *VI);
2272 RegionStoreManager::tryBindSmallStruct(RegionBindingsConstRef B,
2273 const TypedValueRegion *R,
2275 nonloc::LazyCompoundVal LCV) {
2278 if (
const CXXRecordDecl *Class = dyn_cast<CXXRecordDecl>(RD))
2279 if (Class->getNumBases() != 0 || Class->getNumVBases() != 0)
2282 for (
const auto *FD : RD->
fields()) {
2283 if (FD->isUnnamedBitfield())
2288 if (Fields.size() == SmallStructLimit)
2295 Fields.push_back(FD);
2298 RegionBindingsRef NewB = B;
2300 for (FieldVector::iterator I = Fields.begin(), E = Fields.end(); I != E; ++I){
2301 const FieldRegion *SourceFR = MRMgr.getFieldRegion(*I, LCV.getRegion());
2302 SVal V = getBindingForField(getRegionBindings(LCV.getStore()), SourceFR);
2304 const FieldRegion *DestFR = MRMgr.getFieldRegion(*I, R);
2305 NewB = bind(NewB, loc::MemRegionVal(DestFR), V);
2311 RegionBindingsRef RegionStoreManager::bindStruct(RegionBindingsConstRef B,
2312 const TypedValueRegion* R,
2314 if (!Features.supportsFields())
2323 if (!RD->isCompleteDefinition())
2328 V.getAs<nonloc::LazyCompoundVal>()) {
2331 return bindAggregate(B, R, V);
2333 if (V.getAs<nonloc::SymbolVal>())
2334 return bindAggregate(B, R, V);
2339 if (V.isUnknown() || !V.getAs<nonloc::CompoundVal>())
2340 return bindAggregate(B, R, UnknownVal());
2342 const nonloc::CompoundVal& CV = V.castAs<nonloc::CompoundVal>();
2346 RegionBindingsRef NewB(B);
2348 for (FI = RD->field_begin(), FE = RD->field_end(); FI != FE; ++FI) {
2354 if (FI->isUnnamedBitfield())
2358 const FieldRegion* FR = MRMgr.getFieldRegion(*FI, R);
2361 NewB = bindArray(NewB, FR, *VI);
2363 NewB = bindStruct(NewB, FR, *VI);
2365 NewB = bind(NewB, loc::MemRegionVal(FR), *VI);
2372 svalBuilder.makeIntVal(0,
false));
2379 RegionStoreManager::bindAggregate(RegionBindingsConstRef B,
2380 const TypedRegion *R,
2392 class RemoveDeadBindingsWorker
2393 :
public ClusterAnalysis<RemoveDeadBindingsWorker> {
2395 using MapParentsToDerivedTy = llvm::DenseMap<SymbolRef, ChildrenListTy>;
2397 MapParentsToDerivedTy ParentsToDerived;
2398 SymbolReaper &SymReaper;
2402 RemoveDeadBindingsWorker(RegionStoreManager &rm,
2403 ProgramStateManager &stateMgr,
2404 RegionBindingsRef b, SymbolReaper &symReaper,
2406 : ClusterAnalysis<RemoveDeadBindingsWorker>(rm, stateMgr, b),
2407 SymReaper(symReaper), CurrentLCtx(LCtx) {}
2410 void VisitAddedToCluster(
const MemRegion *baseR,
const ClusterBindings &C);
2411 void VisitCluster(
const MemRegion *baseR,
const ClusterBindings *C);
2412 using ClusterAnalysis<RemoveDeadBindingsWorker>::VisitCluster;
2414 using ClusterAnalysis::AddToWorkList;
2416 bool AddToWorkList(
const MemRegion *R);
2418 void VisitBinding(SVal V);
2421 void populateWorklistFromSymbol(
SymbolRef s);
2425 bool RemoveDeadBindingsWorker::AddToWorkList(
const MemRegion *R) {
2426 const MemRegion *BaseR = R->getBaseRegion();
2427 return AddToWorkList(WorkListElement(BaseR), getCluster(BaseR));
2430 void RemoveDeadBindingsWorker::VisitAddedToCluster(
const MemRegion *baseR,
2431 const ClusterBindings &C) {
2433 if (
const VarRegion *VR = dyn_cast<VarRegion>(baseR)) {
2434 if (SymReaper.isLive(VR))
2435 AddToWorkList(baseR, &C);
2440 if (
const SymbolicRegion *SR = dyn_cast<SymbolicRegion>(baseR)) {
2441 if (SymReaper.isLive(SR->getSymbol())) {
2442 AddToWorkList(SR, &C);
2443 }
else if (
const auto *SD = dyn_cast<SymbolDerived>(SR->getSymbol())) {
2444 ParentsToDerived[SD->getParentSymbol()].push_back(SD);
2450 if (isa<NonStaticGlobalSpaceRegion>(baseR)) {
2451 AddToWorkList(baseR, &C);
2456 if (
const CXXThisRegion *TR = dyn_cast<CXXThisRegion>(baseR)) {
2457 const auto *StackReg =
2458 cast<StackArgumentsSpaceRegion>(TR->getSuperRegion());
2461 (RegCtx == CurrentLCtx || RegCtx->isParentOf(CurrentLCtx)))
2462 AddToWorkList(TR, &C);
2466 void RemoveDeadBindingsWorker::VisitCluster(
const MemRegion *baseR,
2467 const ClusterBindings *C) {
2473 if (
const SymbolicRegion *SymR = dyn_cast<SymbolicRegion>(baseR))
2474 SymReaper.markLive(SymR->getSymbol());
2476 for (ClusterBindings::iterator I = C->begin(), E = C->end(); I != E; ++I) {
2478 SymReaper.markElementIndicesLive(I.getKey().getRegion());
2480 VisitBinding(I.getData());
2484 void RemoveDeadBindingsWorker::VisitBinding(SVal V) {
2487 V.getAs<nonloc::LazyCompoundVal>()) {
2489 const RegionStoreManager::SValListTy &Vals = RM.getInterestingValues(*LCS);
2491 for (RegionStoreManager::SValListTy::const_iterator I = Vals.begin(),
2500 if (
const MemRegion *R = V.getAsRegion()) {
2503 if (
const auto *TVR = dyn_cast<TypedValueRegion>(R)) {
2504 DefinedOrUnknownSVal RVS =
2505 RM.getSValBuilder().getRegionValueSymbolVal(TVR);
2506 if (
const MemRegion *SR = RVS.getAsRegion()) {
2511 SymReaper.markLive(R);
2514 if (
const BlockDataRegion *BR = dyn_cast<BlockDataRegion>(R)) {
2515 BlockDataRegion::referenced_vars_iterator I = BR->referenced_vars_begin(),
2516 E = BR->referenced_vars_end();
2517 for ( ; I != E; ++I)
2518 AddToWorkList(I.getCapturedRegion());
2524 for (
auto SI = V.symbol_begin(), SE = V.symbol_end(); SI != SE; ++SI) {
2525 populateWorklistFromSymbol(*SI);
2527 for (
const auto *SD : ParentsToDerived[*SI])
2528 populateWorklistFromSymbol(SD);
2530 SymReaper.markLive(*SI);
2534 void RemoveDeadBindingsWorker::populateWorklistFromSymbol(
SymbolRef S) {
2535 if (
const auto *SD = dyn_cast<SymbolData>(S)) {
2537 const SymbolicRegion *SR = RM.getRegionManager().getSymbolicRegion(SD);
2542 const SymbolicRegion *SHR =
2543 RM.getRegionManager().getSymbolicHeapRegion(SD);
2544 if (B.contains(SHR))
2550 StoreRef RegionStoreManager::removeDeadBindings(
Store store,
2552 SymbolReaper& SymReaper) {
2553 RegionBindingsRef B = getRegionBindings(store);
2554 RemoveDeadBindingsWorker W(*
this, StateMgr, B, SymReaper, LCtx);
2555 W.GenerateClusters();
2559 E = SymReaper.region_end(); I != E; ++I) {
2560 W.AddToWorkList(*I);
2568 for (RegionBindingsRef::iterator I = B.begin(), E = B.end(); I != E; ++I) {
2569 const MemRegion *Base = I.getKey();
2573 if (!W.isVisited(Base))
2577 return StoreRef(B.asStore(), *
this);
2584 void RegionStoreManager::print(
Store store, raw_ostream &
OS,
2586 RegionBindingsRef B = getRegionBindings(store);
2587 OS <<
"Store (direct and default bindings), "
A (possibly-)qualified type.
static void getSymbolicOffsetFields(BindingKey K, FieldVector &Fields)
const internal::VariadicAllOfMatcher< Stmt > stmt
Matches statements.
bool operator==(CanQual< T > x, CanQual< U > y)
llvm::DenseSet< SymbolRef > InvalidatedSymbols
DominatorTree GraphTraits specialization so the DominatorTree can be iterable by generic graph iterat...
const SymExpr * SymbolRef
internal::Matcher< Stmt > StatementMatcher
QualType getPointeeType() const
If this is a pointer, ObjC object pointer, or block pointer, this returns the respective pointee...
IntrusiveRefCntPtr< const ProgramState > ProgramStateRef
static bool isRecordEmpty(const RecordDecl *RD)
unsigned getFieldIndex() const
Returns the index of this field within its record, as appropriate for passing to ASTRecordLayout::get...
const internal::ArgumentAdaptingMatcherFunc< internal::HasDescendantMatcher > hasDescendant
Matches AST nodes that have descendant AST nodes that match the provided matcher. ...
Represents an array type, per C99 6.7.5.2 - Array Declarators.
static Optional< nonloc::LazyCompoundVal > getExistingLazyBinding(SValBuilder &SVB, RegionBindingsConstRef B, const SubRegion *R, bool AllowSubregionBindings)
Checks to see if store B has a lazy binding for region R.
QualType getElementType() const
Represents a variable declaration or definition.
const T * getAs() const
Member-template getAs<specific type>'.
const void * Store
Store - This opaque type encapsulates an immutable mapping from locations to values.
const internal::VariadicDynCastAllOfMatcher< Decl, VarDecl > varDecl
Matches variable declarations.
std::unique_ptr< StoreManager > CreateFieldsOnlyRegionStoreManager(ProgramStateManager &StMgr)
Represents a struct/union/class.
llvm::ImmutableMap< BindingKey, SVal > ClusterBindings
SmallVector< const FieldDecl *, 8 > FieldVector
Holds long-lived AST nodes (such as types and decls) that can be referred to throughout the semantic ...
llvm::ImmutableList< SVal >::iterator iterator
RecordDecl * getDefinition() const
Returns the RecordDecl that actually defines this struct/union/class.
field_range fields() const
Represents a member of a struct/union/class.
static bool canSymbolicate(QualType T)
bool isReferenceType() const
i32 captured_struct **param SharedsTy A type which contains references the shared variables *param Shareds Context with the list of shared variables from the p *TaskFunction *param Data Additional data for task generation like final * state
bool isIntegralOrEnumerationType() const
Determine whether this type is an integral or enumeration type.
static bool isLocType(QualType T)
unsigned getLength() const
const internal::VariadicDynCastAllOfMatcher< Stmt, DeclRefExpr > declRefExpr
Matches expressions that refer to declarations.
CharUnits - This is an opaque type for sizes expressed in character units.
static void dump(llvm::raw_ostream &OS, StringRef FunctionName, ArrayRef< CounterExpression > Expressions, ArrayRef< CounterMappingRegion > Regions)
RegionSetTy::const_iterator region_iterator
llvm::ImmutableMap< const MemRegion *, ClusterBindings > RegionBindings
SmallVector< const MemRegion *, 8 > InvalidatedRegions
bool isScalarType() const
SmallVector< BoundNodes, 1 > match(MatcherT Matcher, const NodeT &Node, ASTContext &Context)
Returns the results of matching Matcher on Node.
std::unique_ptr< StoreManager > CreateRegionStoreManager(ProgramStateManager &StMgr)
static bool isCompatibleWithFields(BindingKey K, const FieldVector &Fields)
When applied to a MemSpaceRegion, indicates the entire memory space should be invalidated.
static void collectSubRegionBindings(SmallVectorImpl< BindingPair > &Bindings, SValBuilder &SVB, const ClusterBindings &Cluster, const SubRegion *Top, BindingKey TopKey, bool IncludeAllDefaultBindings)
Collects all bindings in Cluster that may refer to bindings within Top.
This represents one expression.
GlobalsFilterKind
Used to determine which global regions are automatically included in the initial worklist of a Cluste...
bool hasLocalStorage() const
Returns true if a variable with function scope is a non-static local variable.
const T * castAs() const
Member-template castAs<specific type>.
uint32_t getCodeUnit(size_t i) const
static CharUnits fromQuantity(QuantityType Quantity)
fromQuantity - Construct a CharUnits quantity from a raw integer type.
Represents a GCC generic vector type.
float __ovld __cnfn length(float p)
Return the length of vector p, i.e., sqrt(p.x2 + p.y 2 + ...)
bool isNull() const
Return true if this QualType doesn't point to a type yet.
__UINTPTR_TYPE__ uintptr_t
An unsigned integer type with the property that any valid pointer to void can be converted to this ty...
llvm::ImmutableMapRef< BindingKey, SVal > ClusterBindingsRef
bool isConstQualified() const
Determine whether this type is const-qualified.
bool isVoidPointerType() const
Maps string IDs to AST nodes matched by parts of a matcher.
bool isStructureOrClassType() const
static QualType getUnderlyingType(const SubRegion *R)
Expr * getInClassInitializer() const
Get the C++11 default member initializer for this member, or null if one has not been set...
bool isAnyPointerType() const
bool operator<(DeclarationName LHS, DeclarationName RHS)
Ordering on two declaration names.
bool isVectorType() const
Tells that a region's contents is not changed.
__PTRDIFF_TYPE__ ptrdiff_t
A signed integer type that is the result of subtracting two pointers.
Dataflow Directional Tag Classes.
raw_ostream & operator<<(raw_ostream &Out, const CheckerBase &Checker)
Dump checker name to stream.
const Expr * getInit() const
std::unique_ptr< DiagnosticConsumer > create(StringRef OutputFile, DiagnosticOptions *Diags, bool MergeChildRecords=false)
Returns a DiagnosticConsumer that serializes diagnostics to a bitcode file.
specific_decl_iterator - Iterates over a subrange of declarations stored in a DeclContext, providing only those that are of type SpecificDecl (or a class derived from it).
A helper class that allows the use of isa/cast/dyncast to detect TagType objects of structs/unions/cl...
Indicates that the tracking object is a descendant of a referenced-counted OSObject, used in the Darwin kernel.
const StackFrameContext * getStackFrame() const
std::pair< BindingKey, SVal > BindingPair
Stores options for the analyzer from the command line.
X
Add a minimal nested name specifier fixit hint to allow lookup of a tag name from an outer enclosing ...
static bool isUnionField(const FieldRegion *FR)
Represents a C++ struct/union/class.
StringLiteral - This represents a string literal expression, e.g.
Defines the clang::TargetInfo interface.
const RegionBindingsRef & RegionBindingsConstRef
Represents the canonical version of C arrays with a specified constant size.