clang
9.0.0
|
This is the simplest builder which generates nodes in the ExplodedGraph. More...
#include "clang/StaticAnalyzer/Core/PathSensitive/CoreEngine.h"
Public Types | |
using | iterator = ExplodedNodeSet::iterator |
Public Member Functions | |
NodeBuilder (ExplodedNode *SrcNode, ExplodedNodeSet &DstSet, const NodeBuilderContext &Ctx, bool F=true) | |
NodeBuilder (const ExplodedNodeSet &SrcSet, ExplodedNodeSet &DstSet, const NodeBuilderContext &Ctx, bool F=true) | |
virtual | ~NodeBuilder ()=default |
ExplodedNode * | generateNode (const ProgramPoint &PP, ProgramStateRef State, ExplodedNode *Pred) |
Generates a node in the ExplodedGraph. More... | |
ExplodedNode * | generateSink (const ProgramPoint &PP, ProgramStateRef State, ExplodedNode *Pred) |
Generates a sink in the ExplodedGraph. More... | |
const ExplodedNodeSet & | getResults () |
iterator | begin () |
Iterators through the results frontier. More... | |
iterator | end () |
const NodeBuilderContext & | getContext () |
bool | hasGeneratedNodes () |
void | takeNodes (const ExplodedNodeSet &S) |
void | takeNodes (ExplodedNode *N) |
void | addNodes (const ExplodedNodeSet &S) |
void | addNodes (ExplodedNode *N) |
Protected Member Functions | |
virtual bool | checkResults () |
Checks if the results are ready. More... | |
bool | hasNoSinksInFrontier () |
virtual void | finalizeResults () |
Allow subclasses to finalize results before result_begin() is executed. More... | |
ExplodedNode * | generateNodeImpl (const ProgramPoint &PP, ProgramStateRef State, ExplodedNode *Pred, bool MarkAsSink=false) |
Protected Attributes | |
const NodeBuilderContext & | C |
bool | Finalized |
Specifies if the builder results have been finalized. More... | |
bool | HasGeneratedNodes = false |
ExplodedNodeSet & | Frontier |
The frontier set - a set of nodes which need to be propagated after the builder dies. More... | |
This is the simplest builder which generates nodes in the ExplodedGraph.
The main benefit of the builder is that it automatically tracks the frontier nodes (or destination set). This is the set of nodes which should be propagated to the next step / builder. They are the nodes which have been added to the builder (either as the input node set or as the newly constructed nodes) but did not have any outgoing transitions added.
Definition at line 236 of file CoreEngine.h.
Definition at line 312 of file CoreEngine.h.
|
inline |
Definition at line 273 of file CoreEngine.h.
References clang::ento::ExplodedNodeSet::Add().
|
inline |
Definition at line 279 of file CoreEngine.h.
References clang::ento::ExplodedNodeSet::insert().
|
virtualdefault |
|
inline |
Definition at line 335 of file CoreEngine.h.
Referenced by clang::ento::ExprEngine::evalLoad(), clang::ento::ExprEngine::Visit(), clang::ento::ExprEngine::VisitDeclStmt(), clang::ento::ExprEngine::VisitIncrementDecrementOperator(), clang::ento::ExprEngine::VisitMemberExpr(), and clang::ento::ExprEngine::VisitUnaryOperator().
|
inline |
Definition at line 336 of file CoreEngine.h.
References clang::ento::ExplodedNodeSet::Add().
|
inline |
Iterators through the results frontier.
Definition at line 315 of file CoreEngine.h.
References clang::ento::ExplodedNodeSet::begin().
Referenced by clang::ento::ExprEngine::VisitCXXConstructExpr().
|
inlineprotectedvirtual |
Checks if the results are ready.
Definition at line 253 of file CoreEngine.h.
|
inline |
Definition at line 321 of file CoreEngine.h.
References clang::ento::ExplodedNodeSet::end().
|
inlineprotectedvirtual |
Allow subclasses to finalize results before result_begin() is executed.
Definition at line 265 of file CoreEngine.h.
References State.
|
inline |
Generates a node in the ExplodedGraph.
Definition at line 289 of file CoreEngine.h.
Referenced by clang::ento::ExprEngine::bindReturnValue(), clang::ento::ExprEngine::CreateCXXTemporaryObject(), clang::ento::CoreEngine::ExecuteWorkListWithInitialState(), clang::ento::NodeBuilderWithSinks::generateNode(), clang::ento::ExprEngine::processEndOfFunction(), clang::ento::ExprEngine::ProcessInitializer(), clang::ento::ExprEngine::ProcessLoopExit(), clang::ento::ExprEngine::ProcessNewAllocator(), clang::ento::ExprEngine::ProcessTemporaryDtor(), clang::ento::StmtNodeBuilder::StmtNodeBuilder(), and clang::ento::ExprEngine::VisitCallExpr().
|
protected |
Definition at line 605 of file CoreEngine.cpp.
References clang::ento::ExplodedNode::addPredecessor().
|
inline |
Generates a sink in the ExplodedGraph.
When a node is marked as sink, the exploration from the node is stopped - the node becomes the last node on the path and certain kinds of bugs are suppressed.
Definition at line 300 of file CoreEngine.h.
Referenced by clang::ento::NodeBuilderWithSinks::generateSink(), and clang::ento::StmtNodeBuilder::StmtNodeBuilder().
|
inline |
Definition at line 326 of file CoreEngine.h.
Referenced by clang::ento::CheckerContext::blockCount(), clang::ento::CheckerContext::getBlockID(), and clang::ento::ExprEngine::processCFGBlockEntrance().
|
inline |
Definition at line 306 of file CoreEngine.h.
Referenced by clang::ento::ExprEngine::VisitCXXNewExpr(), and clang::ento::ExprEngine::VisitDeclStmt().
|
inline |
Definition at line 327 of file CoreEngine.h.
|
inlineprotected |
Definition at line 257 of file CoreEngine.h.
|
inline |
Definition at line 329 of file CoreEngine.h.
Referenced by clang::ento::ExprEngine::CreateCXXTemporaryObject(), clang::ento::ExprEngine::evalLoad(), clang::ento::StmtNodeBuilder::StmtNodeBuilder(), clang::ento::ExprEngine::Visit(), clang::ento::ExprEngine::VisitCXXNewExpr(), clang::ento::ExprEngine::VisitDeclStmt(), clang::ento::ExprEngine::VisitIncrementDecrementOperator(), clang::ento::ExprEngine::VisitMemberExpr(), and clang::ento::ExprEngine::VisitUnaryOperator().
|
inline |
Definition at line 334 of file CoreEngine.h.
References clang::ento::ExplodedNodeSet::erase().
|
protected |
Definition at line 240 of file CoreEngine.h.
|
protected |
Specifies if the builder results have been finalized.
For example, if it is set to false, autotransitions are yet to be generated.
Definition at line 244 of file CoreEngine.h.
|
protected |
The frontier set - a set of nodes which need to be propagated after the builder dies.
Definition at line 250 of file CoreEngine.h.
Definition at line 246 of file CoreEngine.h.