63 #include "llvm/ADT/APSInt.h" 64 #include "llvm/ADT/DenseMap.h" 65 #include "llvm/ADT/ImmutableMap.h" 66 #include "llvm/ADT/ImmutableSet.h" 67 #include "llvm/ADT/Optional.h" 68 #include "llvm/ADT/SmallVector.h" 69 #include "llvm/ADT/Statistic.h" 70 #include "llvm/Support/Casting.h" 71 #include "llvm/Support/Compiler.h" 72 #include "llvm/Support/DOTGraphTraits.h" 73 #include "llvm/Support/ErrorHandling.h" 74 #include "llvm/Support/GraphWriter.h" 75 #include "llvm/Support/SaveAndRestore.h" 76 #include "llvm/Support/raw_ostream.h" 85 using namespace clang;
88 #define DEBUG_TYPE "ExprEngine" 91 "The # of times RemoveDeadBindings is called");
93 "The # of aborted paths due to reaching the maximum block count in " 94 "a top level function");
95 STATISTIC(NumMaxBlockCountReachedInInlined,
96 "The # of aborted paths due to reaching the maximum block count in " 97 "an inlined function");
99 "The # of times we re-evaluated a call without inlining");
120 class ConstructedObjectKey {
121 typedef std::pair<ConstructionContextItem, const LocationContext *>
122 ConstructedObjectKeyImpl;
124 const ConstructedObjectKeyImpl Impl;
126 const void *getAnyASTNodePtr()
const {
127 if (
const Stmt *S = getItem().getStmtOrNull())
130 return getItem().getCXXCtorInitializer();
139 const LocationContext *getLocationContext()
const {
return Impl.second; }
142 return getLocationContext()->getDecl()->getASTContext();
145 void printJson(llvm::raw_ostream &Out,
PrinterHelper *Helper,
147 const Stmt *S = getItem().getStmtOrNull();
150 I = getItem().getCXXCtorInitializer();
153 Out <<
"\"stmt_id\": " << S->
getID(getASTContext());
155 Out <<
"\"init_id\": " << I->
getID(getASTContext());
158 Out <<
", \"kind\": \"" << getItem().getKindAsString()
159 <<
"\", \"argument_index\": ";
162 Out << getItem().getIndex();
167 Out <<
", \"pretty\": ";
176 void Profile(llvm::FoldingSetNodeID &
ID)
const {
178 ID.AddPointer(Impl.second);
181 bool operator==(
const ConstructedObjectKey &RHS)
const {
182 return Impl == RHS.Impl;
185 bool operator<(
const ConstructedObjectKey &RHS)
const {
186 return Impl < RHS.Impl;
191 typedef llvm::ImmutableMap<ConstructedObjectKey, SVal>
200 static const char* TagProviderName =
"ExprEngine";
207 : CTU(CTU), AMgr(mgr),
208 AnalysisDeclContexts(mgr.getAnalysisDeclContextManager()),
209 Engine(*this, FS, mgr.getAnalyzerOptions()), G(Engine.getGraph()),
210 StateMgr(getContext(), mgr.getStoreManagerCreator(),
211 mgr.getConstraintManagerCreator(), G.getAllocator(),
213 SymMgr(StateMgr.getSymbolManager()),
214 MRMgr(StateMgr.getRegionManager()),
215 svalBuilder(StateMgr.getSValBuilder()),
216 ObjCNoRet(mgr.getASTContext()),
218 VisitedCallees(VisitedCalleesIn),
219 HowToInline(HowToInlineIn)
221 unsigned TrimInterval = mgr.
options.GraphTrimInterval;
222 if (TrimInterval != 0) {
240 if (
const auto *FD = dyn_cast<FunctionDecl>(D)) {
244 if (!II || !(II->
getName() ==
"main" && FD->getNumParams() > 0))
250 if (!BT || !BT->isInteger())
253 const MemRegion *R = state->getRegion(PD, InitLoc);
275 if (
const auto *MD = dyn_cast<ObjCMethodDecl>(D)) {
279 const MemRegion *R = state->getRegion(SelfD, InitLoc);
284 state = state->assume(*LV,
true);
285 assert(state &&
"'self' cannot be null");
289 if (
const auto *MD = dyn_cast<CXXMethodDecl>(D)) {
290 if (!MD->isStatic()) {
297 SVal V = state->getSVal(L);
299 state = state->assume(*LV,
true);
300 assert(state &&
"'this' cannot be null");
311 const Expr *InitWithAdjustments,
const Expr *Result,
312 const SubRegion **OutRegionWithAdjustments) {
318 SVal InitValWithAdjustments = State->getSVal(InitWithAdjustments, LC);
323 if (OutRegionWithAdjustments)
324 *OutRegionWithAdjustments =
nullptr;
327 Result = InitWithAdjustments;
331 assert(!InitValWithAdjustments.
getAs<
Loc>() ||
365 CommaLHSs, Adjustments);
373 if (
const auto *MT = dyn_cast<MaterializeTemporaryExpr>(Result)) {
375 State = finishObjectConstruction(State, MT, LC);
376 State = State->BindExpr(Result, LC, *
V);
396 for (
auto I = Adjustments.rbegin(), E = Adjustments.rend(); I != E; ++I) {
407 State = State->invalidateRegions(Reg, InitWithAdjustments,
409 nullptr,
nullptr,
nullptr);
422 SVal InitVal = State->getSVal(Init, LC);
426 State = State->bindLoc(BaseReg.
castAs<
Loc>(), InitVal, LC,
false);
430 if (InitValWithAdjustments.
isUnknown()) {
434 Result, LC, InitWithAdjustments->
getType(),
438 State->bindLoc(Reg.
castAs<
Loc>(), InitValWithAdjustments, LC,
false);
440 State = State->bindLoc(BaseReg.
castAs<
Loc>(), InitVal, LC,
false);
447 State = State->BindExpr(Result, LC, Reg);
449 State = State->BindExpr(Result, LC, InitValWithAdjustments);
455 if (OutRegionWithAdjustments)
456 *OutRegionWithAdjustments = cast<SubRegion>(Reg.
getAsRegion());
467 assert(!State->get<ObjectsUnderConstruction>(Key) ||
468 Key.getItem().getKind() ==
470 return State->set<ObjectsUnderConstruction>(Key,
V);
486 assert(State->contains<ObjectsUnderConstruction>(Key));
487 return State->remove<ObjectsUnderConstruction>(Key);
493 ConstructedObjectKey Key({BTE,
true}, LC);
496 return State->set<ObjectsUnderConstruction>(Key,
UnknownVal());
503 ConstructedObjectKey Key({BTE,
true}, LC);
504 assert(State->contains<ObjectsUnderConstruction>(Key));
505 return State->remove<ObjectsUnderConstruction>(Key);
511 ConstructedObjectKey Key({BTE,
true}, LC);
512 return State->contains<ObjectsUnderConstruction>(Key);
520 assert(LC &&
"ToLC must be a parent of FromLC!");
521 for (
auto I : State->get<ObjectsUnderConstruction>())
522 if (I.first.getLocationContext() == LC)
538 SVal cond,
bool assumption) {
557 unsigned int Space = 0,
bool IsDot =
false) {
562 bool HasItem =
false;
565 const ConstructedObjectKey *LastKey =
nullptr;
566 for (
const auto &I : State->get<ObjectsUnderConstruction>()) {
567 const ConstructedObjectKey &Key = I.first;
568 if (Key.getLocationContext() != LCtx)
579 for (
const auto &I : State->get<ObjectsUnderConstruction>()) {
580 const ConstructedObjectKey &Key = I.first;
581 SVal
Value = I.second;
582 if (Key.getLocationContext() != LCtx)
585 Indent(Out, Space, IsDot) <<
"{ ";
586 Key.printJson(Out,
nullptr, PP);
587 Out <<
", \"value\": \"" << Value <<
"\" }";
595 Indent(Out, --Space, IsDot) <<
']';
603 unsigned int Space,
bool IsDot)
const {
604 Indent(Out, Space, IsDot) <<
"\"constructing_objects\": ";
606 if (LCtx && !State->get<ObjectsUnderConstruction>().isEmpty()) {
614 Indent(Out, Space, IsDot) <<
"]," << NL;
616 Out <<
"null," << NL;
630 currStmtIdx = StmtIdx;
665 const ExplodedNode *Pred,
668 if (AMgr.options.AnalysisPurgeOpt == PurgeNone)
690 const Stmt *ReferenceStmt,
692 const Stmt *DiagnosticStmt,
695 ReferenceStmt ==
nullptr || isa<ReturnStmt>(ReferenceStmt))
696 &&
"PostStmt is not generally supported by the SymbolReaper yet");
697 assert(LC &&
"Must pass the current (or expiring) LocationContext");
699 if (!DiagnosticStmt) {
700 DiagnosticStmt = ReferenceStmt;
701 assert(DiagnosticStmt &&
"Required for clearing a LocationContext");
704 NumRemoveDeadBindings++;
710 if (!ReferenceStmt) {
712 "Use PostStmtPurgeDeadSymbolsKind for clearing a LocationContext");
719 for (
auto I : CleanedState->get<ObjectsUnderConstruction>()) {
720 if (
SymbolRef Sym = I.second.getAsSymbol())
722 if (
const MemRegion *MR = I.second.getAsRegion())
740 DiagnosticStmt, *
this, K);
746 for (
const auto I : CheckedSet) {
754 "Checkers are not allowed to modify the Environment as a part of " 755 "checkDeadSymbols processing.");
757 "Checkers are not allowed to modify the Store as a part of " 758 "checkDeadSymbols processing.");
764 Bldr.
generateNode(DiagnosticStmt, I, CleanedCheckerSt, &cleanupTag, K);
774 "Error evaluating statement");
783 CleanedStates.Add(Pred);
787 for (
const auto I : CleanedStates) {
790 Visit(currStmt, I, DstI);
801 "Error evaluating end of the loop");
807 if(AMgr.
options.ShouldUnrollLoops)
824 "Error evaluating initializer");
828 const auto *
decl = cast<CXXConstructorDecl>(stackFrame->getDecl());
831 SVal thisVal = State->getSVal(svalBuilder.
getCXXThis(decl, stackFrame));
843 State = finishObjectConstruction(State, BMI, LC);
845 PostStore PS(Init, LC,
nullptr,
nullptr);
854 FieldLoc = State->getLValue(BMI->
getMember(), thisVal);
862 while ((ASE = dyn_cast<ArraySubscriptExpr>(Init)))
865 SVal LValue = State->getSVal(Init, stackFrame);
868 InitVal = State->getSVal(*LValueLoc);
878 InitVal = State->getSVal(BMI->
getInit(), stackFrame);
882 evalBind(Tmp, Init, Pred, FieldLoc, InitVal,
true, &PP);
895 for (
const auto I : Tmp) {
924 llvm_unreachable(
"Unexpected dtor kind.");
939 if (Opts.MayInlineCXXAllocator)
961 const MemRegion *ValueRegion = state->getSVal(Region).getAsRegion();
970 varType = cast<TypedValueRegion>(Region)->getValueType();
981 Pred, Dst, CallOpts);
992 SVal ArgVal = State->getSVal(Arg, LCtx);
996 if (State->isNull(ArgVal).isConstrainedTrue()) {
1003 Bldr.generateNode(PP, Pred->
getState(), Pred);
1016 DTy = AT->getElementType();
1028 const auto *CurDtor = cast<CXXDestructorDecl>(LCtx->
getDecl());
1040 CurDtor->getBody(),
true, Pred, Dst, {});
1050 const auto *CurDtor = cast<CXXDestructorDecl>(LCtx->
getDecl());
1054 State->getLValue(Member, State->getSVal(ThisVal).castAs<
Loc>());
1060 FieldVal = makeZeroElementRegion(State, FieldVal, T,
1064 CurDtor->getBody(),
false, Pred, Dst, CallOpts);
1088 if (isDestructorElided(State, BTE, LC)) {
1089 State = cleanupElidedDestructor(State, BTE, LC);
1105 assert(CleanDtorState.
size() <= 1);
1107 CleanDtorState.
empty() ? Pred : *CleanDtorState.
begin();
1118 T = AT->getElementType();
1127 false, CleanPred, Dst, CallOpts);
1169 State = addObjectUnderConstruction(State, BTE, LC,
UnknownVal());
1177 class CollectReachableSymbolsCallback final :
public SymbolVisitor {
1185 bool VisitSymbol(
SymbolRef Sym)
override {
1186 Symbols.insert(Sym);
1191 const CollectReachableSymbolsCallback &Scanner =
1192 State->scanReachableSymbols<CollectReachableSymbolsCallback>(
V);
1194 State, Scanner.getSymbols(),
nullptr, K,
nullptr);
1204 assert(!isa<Expr>(S) || S == cast<Expr>(S)->IgnoreParens());
1208 case Expr::ObjCIndirectCopyRestoreExprClass:
1209 case Stmt::CXXDependentScopeMemberExprClass:
1210 case Stmt::CXXInheritedCtorInitExprClass:
1211 case Stmt::CXXTryStmtClass:
1212 case Stmt::CXXTypeidExprClass:
1213 case Stmt::CXXUuidofExprClass:
1214 case Stmt::CXXFoldExprClass:
1215 case Stmt::MSPropertyRefExprClass:
1216 case Stmt::MSPropertySubscriptExprClass:
1217 case Stmt::CXXUnresolvedConstructExprClass:
1218 case Stmt::DependentScopeDeclRefExprClass:
1219 case Stmt::ArrayTypeTraitExprClass:
1220 case Stmt::ExpressionTraitExprClass:
1221 case Stmt::UnresolvedLookupExprClass:
1222 case Stmt::UnresolvedMemberExprClass:
1223 case Stmt::TypoExprClass:
1224 case Stmt::CXXNoexceptExprClass:
1225 case Stmt::PackExpansionExprClass:
1226 case Stmt::SubstNonTypeTemplateParmPackExprClass:
1227 case Stmt::FunctionParmPackExprClass:
1228 case Stmt::CoroutineBodyStmtClass:
1229 case Stmt::CoawaitExprClass:
1230 case Stmt::DependentCoawaitExprClass:
1231 case Stmt::CoreturnStmtClass:
1232 case Stmt::CoyieldExprClass:
1233 case Stmt::SEHTryStmtClass:
1234 case Stmt::SEHExceptStmtClass:
1235 case Stmt::SEHLeaveStmtClass:
1236 case Stmt::SEHFinallyStmtClass:
1237 case Stmt::OMPParallelDirectiveClass:
1238 case Stmt::OMPSimdDirectiveClass:
1239 case Stmt::OMPForDirectiveClass:
1240 case Stmt::OMPForSimdDirectiveClass:
1241 case Stmt::OMPSectionsDirectiveClass:
1242 case Stmt::OMPSectionDirectiveClass:
1243 case Stmt::OMPSingleDirectiveClass:
1244 case Stmt::OMPMasterDirectiveClass:
1245 case Stmt::OMPCriticalDirectiveClass:
1246 case Stmt::OMPParallelForDirectiveClass:
1247 case Stmt::OMPParallelForSimdDirectiveClass:
1248 case Stmt::OMPParallelSectionsDirectiveClass:
1249 case Stmt::OMPTaskDirectiveClass:
1250 case Stmt::OMPTaskyieldDirectiveClass:
1251 case Stmt::OMPBarrierDirectiveClass:
1252 case Stmt::OMPTaskwaitDirectiveClass:
1253 case Stmt::OMPTaskgroupDirectiveClass:
1254 case Stmt::OMPFlushDirectiveClass:
1255 case Stmt::OMPOrderedDirectiveClass:
1256 case Stmt::OMPAtomicDirectiveClass:
1257 case Stmt::OMPTargetDirectiveClass:
1258 case Stmt::OMPTargetDataDirectiveClass:
1259 case Stmt::OMPTargetEnterDataDirectiveClass:
1260 case Stmt::OMPTargetExitDataDirectiveClass:
1261 case Stmt::OMPTargetParallelDirectiveClass:
1262 case Stmt::OMPTargetParallelForDirectiveClass:
1263 case Stmt::OMPTargetUpdateDirectiveClass:
1264 case Stmt::OMPTeamsDirectiveClass:
1265 case Stmt::OMPCancellationPointDirectiveClass:
1266 case Stmt::OMPCancelDirectiveClass:
1267 case Stmt::OMPTaskLoopDirectiveClass:
1268 case Stmt::OMPTaskLoopSimdDirectiveClass:
1269 case Stmt::OMPDistributeDirectiveClass:
1270 case Stmt::OMPDistributeParallelForDirectiveClass:
1271 case Stmt::OMPDistributeParallelForSimdDirectiveClass:
1272 case Stmt::OMPDistributeSimdDirectiveClass:
1273 case Stmt::OMPTargetParallelForSimdDirectiveClass:
1274 case Stmt::OMPTargetSimdDirectiveClass:
1275 case Stmt::OMPTeamsDistributeDirectiveClass:
1276 case Stmt::OMPTeamsDistributeSimdDirectiveClass:
1277 case Stmt::OMPTeamsDistributeParallelForSimdDirectiveClass:
1278 case Stmt::OMPTeamsDistributeParallelForDirectiveClass:
1279 case Stmt::OMPTargetTeamsDirectiveClass:
1280 case Stmt::OMPTargetTeamsDistributeDirectiveClass:
1281 case Stmt::OMPTargetTeamsDistributeParallelForDirectiveClass:
1282 case Stmt::OMPTargetTeamsDistributeParallelForSimdDirectiveClass:
1283 case Stmt::OMPTargetTeamsDistributeSimdDirectiveClass:
1284 case Stmt::CapturedStmtClass: {
1286 Engine.addAbortedBlock(node, currBldrCtx->getBlock());
1290 case Stmt::ParenExprClass:
1291 llvm_unreachable(
"ParenExprs already handled.");
1292 case Stmt::GenericSelectionExprClass:
1293 llvm_unreachable(
"GenericSelectionExprs already handled.");
1296 case Stmt::BreakStmtClass:
1297 case Stmt::CaseStmtClass:
1298 case Stmt::CompoundStmtClass:
1299 case Stmt::ContinueStmtClass:
1300 case Stmt::CXXForRangeStmtClass:
1301 case Stmt::DefaultStmtClass:
1302 case Stmt::DoStmtClass:
1303 case Stmt::ForStmtClass:
1304 case Stmt::GotoStmtClass:
1305 case Stmt::IfStmtClass:
1306 case Stmt::IndirectGotoStmtClass:
1307 case Stmt::LabelStmtClass:
1309 case Stmt::NullStmtClass:
1310 case Stmt::SwitchStmtClass:
1311 case Stmt::WhileStmtClass:
1312 case Expr::MSDependentExistsStmtClass:
1313 llvm_unreachable(
"Stmt should not be in analyzer evaluation loop");
1315 case Stmt::ObjCSubscriptRefExprClass:
1316 case Stmt::ObjCPropertyRefExprClass:
1317 llvm_unreachable(
"These are handled by PseudoObjectExpr");
1319 case Stmt::GNUNullExprClass: {
1323 svalBuilder.makeIntValWithPtrWidth(0,
false));
1328 case Stmt::ObjCAtSynchronizedStmtClass:
1334 case Expr::ConstantExprClass:
1335 case Stmt::ExprWithCleanupsClass:
1339 case Stmt::CXXBindTemporaryExprClass: {
1351 case Stmt::DesignatedInitExprClass:
1352 case Stmt::DesignatedInitUpdateExprClass:
1353 case Stmt::ArrayInitLoopExprClass:
1354 case Stmt::ArrayInitIndexExprClass:
1355 case Stmt::ExtVectorElementExprClass:
1356 case Stmt::ImaginaryLiteralClass:
1357 case Stmt::ObjCAtCatchStmtClass:
1358 case Stmt::ObjCAtFinallyStmtClass:
1359 case Stmt::ObjCAtTryStmtClass:
1360 case Stmt::ObjCAutoreleasePoolStmtClass:
1361 case Stmt::ObjCEncodeExprClass:
1362 case Stmt::ObjCIsaExprClass:
1363 case Stmt::ObjCProtocolExprClass:
1364 case Stmt::ObjCSelectorExprClass:
1365 case Stmt::ParenListExprClass:
1366 case Stmt::ShuffleVectorExprClass:
1367 case Stmt::ConvertVectorExprClass:
1368 case Stmt::VAArgExprClass:
1369 case Stmt::CUDAKernelCallExprClass:
1370 case Stmt::OpaqueValueExprClass:
1371 case Stmt::AsTypeExprClass:
1376 case Stmt::PredefinedExprClass:
1377 case Stmt::AddrLabelExprClass:
1378 case Stmt::AttributedStmtClass:
1379 case Stmt::IntegerLiteralClass:
1380 case Stmt::FixedPointLiteralClass:
1381 case Stmt::CharacterLiteralClass:
1382 case Stmt::ImplicitValueInitExprClass:
1383 case Stmt::CXXScalarValueInitExprClass:
1384 case Stmt::CXXBoolLiteralExprClass:
1385 case Stmt::ObjCBoolLiteralExprClass:
1386 case Stmt::ObjCAvailabilityCheckExprClass:
1387 case Stmt::FloatingLiteralClass:
1388 case Stmt::NoInitExprClass:
1389 case Stmt::SizeOfPackExprClass:
1390 case Stmt::StringLiteralClass:
1391 case Stmt::SourceLocExprClass:
1392 case Stmt::ObjCStringLiteralClass:
1393 case Stmt::CXXPseudoDestructorExprClass:
1394 case Stmt::SubstNonTypeTemplateParmExprClass:
1395 case Stmt::CXXNullPtrLiteralExprClass:
1396 case Stmt::OMPArraySectionExprClass:
1397 case Stmt::TypeTraitExprClass: {
1406 case Stmt::CXXDefaultArgExprClass:
1407 case Stmt::CXXDefaultInitExprClass: {
1416 if (
const auto *DefE = dyn_cast<CXXDefaultArgExpr>(S))
1417 ArgE = DefE->getExpr();
1418 else if (
const auto *DefE = dyn_cast<CXXDefaultInitExpr>(S))
1419 ArgE = DefE->getExpr();
1421 llvm_unreachable(
"unknown constant wrapper kind");
1423 bool IsTemporary =
false;
1424 if (
const auto *MTE = dyn_cast<MaterializeTemporaryExpr>(ArgE)) {
1425 ArgE = MTE->GetTemporaryExpr();
1434 for (
const auto I : PreVisit) {
1436 State = State->BindExpr(S, LCtx, *ConstantVal);
1438 State = createTemporaryRegionIfNeeded(State, LCtx,
1450 case Stmt::CXXStdInitializerListExprClass:
1451 case Expr::ObjCArrayLiteralClass:
1452 case Expr::ObjCDictionaryLiteralClass:
1453 case Expr::ObjCBoxedExprClass: {
1462 const auto *Ex = cast<Expr>(S);
1463 QualType resultType = Ex->getType();
1465 for (
const auto N : preVisit) {
1467 SVal result = svalBuilder.conjureSymbolVal(
nullptr, Ex, LCtx,
1469 currBldrCtx->blockCount());
1474 if (!(isa<ObjCBoxedExpr>(Ex) &&
1475 !cast<ObjCBoxedExpr>(Ex)->getSubExpr()
1477 for (
auto Child : Ex->children()) {
1479 SVal Val = State->getSVal(Child, LCtx);
1491 case Stmt::ArraySubscriptExprClass:
1497 case Stmt::GCCAsmStmtClass:
1503 case Stmt::MSAsmStmtClass:
1509 case Stmt::BlockExprClass:
1515 case Stmt::LambdaExprClass:
1516 if (AMgr.options.ShouldInlineLambdas) {
1522 Engine.addAbortedBlock(node, currBldrCtx->getBlock());
1526 case Stmt::BinaryOperatorClass: {
1527 const auto *B = cast<BinaryOperator>(S);
1528 if (B->isLogicalOp()) {
1534 else if (B->getOpcode() == BO_Comma) {
1538 state->getSVal(B->getRHS(),
1545 if (AMgr.options.ShouldEagerlyAssume &&
1546 (B->isRelationalOp() || B->isEqualityOp())) {
1558 case Stmt::CXXOperatorCallExprClass: {
1559 const auto *OCE = cast<CXXOperatorCallExpr>(S);
1563 const Decl *Callee = OCE->getCalleeDecl();
1564 if (
const auto *MD = dyn_cast_or_null<CXXMethodDecl>(Callee)) {
1565 if (MD->isInstance()) {
1569 createTemporaryRegionIfNeeded(State, LCtx, OCE->getArg(0));
1570 if (NewState != State) {
1583 case Stmt::CallExprClass:
1584 case Stmt::CXXMemberCallExprClass:
1585 case Stmt::UserDefinedLiteralClass:
1591 case Stmt::CXXCatchStmtClass:
1597 case Stmt::CXXTemporaryObjectExprClass:
1598 case Stmt::CXXConstructExprClass:
1604 case Stmt::CXXNewExprClass: {
1611 for (
const auto i : PreVisit)
1619 case Stmt::CXXDeleteExprClass: {
1622 const auto *CDE = cast<CXXDeleteExpr>(S);
1625 for (
const auto i : PreVisit)
1634 case Stmt::ChooseExprClass: {
1636 const auto *C = cast<ChooseExpr>(S);
1642 case Stmt::CompoundAssignOperatorClass:
1648 case Stmt::CompoundLiteralExprClass:
1654 case Stmt::BinaryConditionalOperatorClass:
1655 case Stmt::ConditionalOperatorClass: {
1657 const auto *C = cast<AbstractConditionalOperator>(S);
1663 case Stmt::CXXThisExprClass:
1669 case Stmt::DeclRefExprClass: {
1671 const auto *DE = cast<DeclRefExpr>(S);
1677 case Stmt::DeclStmtClass:
1683 case Stmt::ImplicitCastExprClass:
1684 case Stmt::CStyleCastExprClass:
1685 case Stmt::CXXStaticCastExprClass:
1686 case Stmt::CXXDynamicCastExprClass:
1687 case Stmt::CXXReinterpretCastExprClass:
1688 case Stmt::CXXConstCastExprClass:
1689 case Stmt::CXXFunctionalCastExprClass:
1690 case Stmt::BuiltinBitCastExprClass:
1691 case Stmt::ObjCBridgedCastExprClass: {
1693 const auto *C = cast<CastExpr>(S);
1695 VisitCast(C, C->getSubExpr(), Pred, dstExpr);
1703 case Expr::MaterializeTemporaryExprClass: {
1705 const auto *MTE = cast<MaterializeTemporaryExpr>(S);
1709 for (
const auto i : dstPrevisit)
1716 case Stmt::InitListExprClass:
1722 case Stmt::MemberExprClass:
1728 case Stmt::AtomicExprClass:
1734 case Stmt::ObjCIvarRefExprClass:
1740 case Stmt::ObjCForCollectionStmtClass:
1746 case Stmt::ObjCMessageExprClass:
1752 case Stmt::ObjCAtThrowStmtClass:
1753 case Stmt::CXXThrowExprClass:
1759 case Stmt::ReturnStmtClass:
1765 case Stmt::OffsetOfExprClass: {
1771 for (
const auto Node : PreVisit)
1779 case Stmt::UnaryExprOrTypeTraitExprClass:
1786 case Stmt::StmtExprClass: {
1787 const auto *SE = cast<StmtExpr>(S);
1789 if (SE->getSubStmt()->body_empty()) {
1792 &&
"Empty statement expression must have void type.");
1796 if (
const auto *LastExpr =
1797 dyn_cast<Expr>(*SE->getSubStmt()->body_rbegin())) {
1801 state->getSVal(LastExpr,
1807 case Stmt::UnaryOperatorClass: {
1809 const auto *U = cast<UnaryOperator>(S);
1810 if (AMgr.options.ShouldEagerlyAssume && (U->getOpcode() == UO_LNot)) {
1821 case Stmt::PseudoObjectExprClass: {
1824 const auto *PE = cast<PseudoObjectExpr>(S);
1825 if (
const Expr *Result = PE->getResultExpr()) {
1841 bool ExprEngine::replayWithoutInlining(
ExplodedNode *N,
1845 assert(CalleeSF && CallerSF);
1852 BeforeProcessingCall = N;
1867 if (SP->getStmt() == CE)
1872 if (!BeforeProcessingCall)
1889 ExplodedNode *NewNode = G.getNode(NewNodeLoc, NewNodeState,
false, &IsNew);
1900 NumTimesRetriedWithoutInlining++;
1911 if(AMgr.options.ShouldUnrollLoops) {
1912 unsigned maxBlockVisitOnPath = AMgr.options.maxBlockVisitOnPath;
1916 Pred, maxBlockVisitOnPath);
1917 if (NewState != Pred->
getState()) {
1932 if (BlockCount == AMgr.options.maxBlockVisitOnPath - 1 &&
1933 AMgr.options.ShouldWidenLoops) {
1936 (isa<ForStmt>(Term) || isa<WhileStmt>(Term) || isa<DoStmt>(Term))))
1947 if (BlockCount >= AMgr.options.maxBlockVisitOnPath) {
1957 (*G.roots_begin())->getLocation().getLocationContext();
1959 Engine.FunctionSummaries->markReachedMaxBlockCount(CalleeSF->
getDecl());
1965 if ((!AMgr.options.NoRetryExhausted &&
1966 replayWithoutInlining(Pred, CalleeLC)))
1968 NumMaxBlockCountReachedInInlined++;
1970 NumMaxBlockCountReached++;
1973 Engine.blocksExhausted.push_back(std::make_pair(L, Sink));
1987 const Stmt *Condition,
1991 const auto *Ex = dyn_cast<
Expr>(Condition);
1993 return UnknownVal();
1996 bool bitsInit =
false;
1998 while (
const auto *CE = dyn_cast<CastExpr>(Ex)) {
2002 return UnknownVal();
2005 if (!bitsInit || newBits < bits) {
2010 Ex = CE->getSubExpr();
2018 return UnknownVal();
2020 return state->getSVal(Ex, LCtx);
2027 if (!BO || !BO->isLogicalOp()) {
2030 Condition = BO->getRHS()->IgnoreParens();
2052 if (
const auto *Ex = dyn_cast<Expr>(Condition))
2053 Condition = Ex->IgnoreParens();
2056 if (!BO || !BO->isLogicalOp())
2060 "Other kinds of branches are handled separately!");
2071 for (; I != E; ++I) {
2076 const Stmt *LastStmt = CS->getStmt();
2080 llvm_unreachable(
"could not resolve condition");
2089 assert((!Condition || !isa<CXXBindTemporaryExpr>(Condition)) &&
2090 "CXXBindTemporaryExprs are handled by processBindTemporary.");
2093 currBldrCtx = &BldCtx;
2103 if (
const auto *Ex = dyn_cast<Expr>(Condition))
2104 Condition = Ex->IgnoreParens();
2109 "Error evaluating branch");
2115 if (CheckersOutSet.empty())
2119 for (
const auto PredI : CheckersOutSet) {
2120 if (PredI->isSink())
2124 SVal X = PrevState->getSVal(Condition, PredI->getLocationContext());
2128 if (
const auto *Ex = dyn_cast<Expr>(Condition)) {
2129 if (Ex->getType()->isIntegralOrEnumerationType()) {
2135 PredI->getLocationContext(),
2155 std::tie(StTrue, StFalse) = PrevState->assume(V);
2173 currBldrCtx =
nullptr;
2179 llvm::ImmutableSet<const VarDecl *>)
2182 NodeBuilderContext &BuilderCtx,
2184 ExplodedNodeSet &Dst,
2187 PrettyStackTraceLocationContext CrashInfo(Pred->getLocationContext());
2188 currBldrCtx = &BuilderCtx;
2192 bool initHasRun = state->contains<InitializedGlobalsSet>(VD);
2193 BranchNodeBuilder builder(Pred, Dst, BuilderCtx, DstT, DstF);
2196 state = state->add<InitializedGlobalsSet>(VD);
2199 builder.generateNode(state, initHasRun, Pred);
2200 builder.markInfeasible(!initHasRun);
2202 currBldrCtx =
nullptr;
2223 for (iterator I = builder.
begin(), E = builder.
end(); I != E; ++I) {
2224 if (I.getLabel() == L) {
2230 llvm_unreachable(
"No block with label.");
2244 for (iterator I = builder.
begin(), E = builder.
end(); I != E; ++I)
2264 State = finishArgumentConstruction(
2279 while (LC != ToLC) {
2280 assert(LC &&
"ToLC must be a parent of FromLC!");
2281 for (
auto I : State->get<ObjectsUnderConstruction>())
2282 if (I.first.getLocationContext() == LC) {
2286 assert(I.first.getItem().getKind() ==
2288 I.first.getItem().getKind() ==
2290 State = State->remove<ObjectsUnderConstruction>(I.first);
2308 assert(areAllObjectsFullyConstructed(Pred->
getState(),
2321 for (
const auto I : AfterRemovedDead)
2327 Engine.enqueueEndOfFunction(Dst, RS);
2339 if (CondV_untested.
isUndef()) {
2350 iterator I = builder.
begin(), EI = builder.
end();
2351 bool defaultIsFeasible = I == EI;
2353 for ( ; I != EI; ++I) {
2358 const CaseStmt *Case = I.getCase();
2373 std::tie(StateCase, DefaultSt) =
2374 DefaultSt->assumeInclusiveRange(*NL, V1, V2);
2376 StateCase = DefaultSt;
2384 defaultIsFeasible =
true;
2386 defaultIsFeasible =
false;
2391 if (!defaultIsFeasible)
2423 if (
const auto *VD = dyn_cast<VarDecl>(D)) {
2426 assert(Ex->
isGLValue() || VD->getType()->isVoidType());
2428 const Decl *D = LocCtxt->getDecl();
2429 const auto *MD = dyn_cast_or_null<CXXMethodDecl>(D);
2430 const auto *DeclRefEx = dyn_cast<
DeclRefExpr>(Ex);
2433 if (AMgr.options.ShouldInlineLambdas && DeclRefEx &&
2434 DeclRefEx->refersToEnclosingVariableOrCapture() && MD &&
2435 MD->getParent()->isLambda()) {
2438 llvm::DenseMap<const VarDecl *, FieldDecl *> LambdaCaptureFields;
2444 if (
const FieldDecl *FD = LambdaCaptureFields[VD]) {
2446 svalBuilder.getCXXThis(MD, LocCtxt->getStackFrame());
2447 SVal CXXThisVal = state->getSVal(CXXThis);
2448 VInfo = std::make_pair(state->getLValue(FD, CXXThisVal), FD->getType());
2453 VInfo = std::make_pair(state->getLValue(VD, LocCtxt), VD->getType());
2455 SVal V = VInfo->first;
2456 bool IsReference = VInfo->second->isReferenceType();
2461 if (
const MemRegion *R = V.getAsRegion())
2462 V = state->getSVal(R);
2467 Bldr.
generateNode(Ex, Pred, state->BindExpr(Ex, LCtx, V),
nullptr,
2471 if (
const auto *ED = dyn_cast<EnumConstantDecl>(D)) {
2473 SVal V = svalBuilder.makeIntVal(ED->getInitVal());
2474 Bldr.
generateNode(Ex, Pred, state->BindExpr(Ex, LCtx, V));
2477 if (
const auto *FD = dyn_cast<FunctionDecl>(D)) {
2478 SVal V = svalBuilder.getFunctionPointer(FD);
2479 Bldr.
generateNode(Ex, Pred, state->BindExpr(Ex, LCtx, V),
nullptr,
2483 if (isa<FieldDecl>(D) || isa<IndirectFieldDecl>(D)) {
2489 SVal V = svalBuilder.conjureSymbolVal(Ex, LCtx,
getContext().VoidPtrTy,
2490 currBldrCtx->blockCount());
2492 Bldr.
generateNode(Ex, Pred, state->BindExpr(Ex, LCtx, V),
nullptr,
2496 if (isa<BindingDecl>(D)) {
2502 llvm_unreachable(
"Support for this Decl not implemented.");
2526 for (
auto *
Node : CheckerPreStmt) {
2530 if (IsGLValueLike) {
2539 SVal V = state->getLValue(T,
2540 state->getSVal(Idx, LCtx),
2541 state->getSVal(Base, LCtx));
2544 }
else if (IsVectorType) {
2548 llvm_unreachable(
"Array subscript should be an lValue when not \ 2549 a vector and not a forbidden lvalue type");
2568 if (isa<VarDecl>(Member) || isa<EnumConstantDecl>(Member)) {
2569 for (
const auto I : CheckedSet)
2575 for (
const auto I : CheckedSet) {
2581 if (
const auto *MD = dyn_cast<CXXMethodDecl>(Member)) {
2582 if (MD->isInstance())
2583 state = createTemporaryRegionIfNeeded(state, LCtx, BaseExpr);
2585 SVal MDVal = svalBuilder.getFunctionPointer(MD);
2586 state = state->BindExpr(M, LCtx, MDVal);
2594 state = createTemporaryRegionIfNeeded(state, LCtx, BaseExpr,
2600 const auto *field = cast<FieldDecl>(Member);
2601 SVal L = state->getLValue(field, baseExprVal);
2612 if (!PE || PE->getCastKind() != CK_ArrayToPointerDecay) {
2613 llvm_unreachable(
"should always be wrapped in ArrayToPointerDecay");
2617 if (field->getType()->isReferenceType()) {
2618 if (
const MemRegion *R = L.getAsRegion())
2619 L = state->getSVal(R);
2624 Bldr.
generateNode(M, I, state->BindExpr(M, LCtx, L),
nullptr,
2648 for (
const auto I : AfterPreSet) {
2653 for (
unsigned SI = 0, Count = AE->
getNumSubExprs(); SI != Count; SI++) {
2655 SVal SubExprVal = State->getSVal(SubExpr, LCtx);
2656 ValuesToInvalidate.push_back(SubExprVal);
2659 State = State->invalidateRegions(ValuesToInvalidate, AE,
2660 currBldrCtx->blockCount(),
2666 State = State->BindExpr(AE, LCtx, ResultVal);
2691 if (
const auto *VR = dyn_cast<VarRegion>(MR->
getBaseRegion()))
2692 if (VR->hasStackParametersStorage() && VR->getStackFrame()->inTopFrame())
2693 if (
const auto *RD = VR->getValueType()->getAsCXXRecordDecl())
2694 if (!RD->hasTrivialDestructor())
2702 SVal StoredVal = State->getSVal(MR);
2703 if (StoredVal != Val)
2716 if (!Invalidated || Invalidated->empty())
2729 for (
const auto I : ExplicitRegions) {
2731 SymbolsDirectlyInvalidated.insert(R->getSymbol());
2735 for (
const auto &sym : *Invalidated) {
2736 if (SymbolsDirectlyInvalidated.count(sym))
2738 SymbolsIndirectlyInvalidated.insert(sym);
2741 if (!SymbolsDirectlyInvalidated.empty())
2746 if (!SymbolsIndirectlyInvalidated.empty())
2767 StoreE, *
this, *PP);
2782 for (
const auto PredI : CheckedSet) {
2790 state = state->bindLoc(location.
castAs<
Loc>(),
2791 Val, LC, !atDeclInit);
2796 LocReg = LocRegVal->getRegion();
2813 const Expr *LocationE,
2819 const Expr *StoreE = AssignE ? AssignE : LocationE;
2823 evalLocation(Tmp, AssignE, LocationE, Pred, state, location,
false);
2831 for (
const auto I : Tmp)
2832 evalBind(Dst, StoreE, I, location, Val,
false);
2837 const Expr *BoundEx,
2843 assert(!location.
getAs<
NonLoc>() &&
"location cannot be a NonLoc.");
2848 evalLocation(Tmp, NodeEx, BoundEx, Pred, state, location,
true);
2857 for (
const auto I : Tmp) {
2858 state = I->getState();
2865 V = state->getSVal(location.
castAs<
Loc>(), LoadTy);
2868 Bldr.
generateNode(NodeEx, I, state->BindExpr(BoundEx, LCtx, V), tag,
2875 const Stmt *BoundEx,
2904 NodeEx, BoundEx, *
this);
2908 std::pair<const ProgramPointTag *, const ProgramPointTag*>
2911 eagerlyAssumeBinOpBifurcationTrue(TagProviderName,
2912 "Eagerly Assume True"),
2913 eagerlyAssumeBinOpBifurcationFalse(TagProviderName,
2914 "Eagerly Assume False");
2915 return std::make_pair(&eagerlyAssumeBinOpBifurcationTrue,
2916 &eagerlyAssumeBinOpBifurcationFalse);
2924 for (
const auto Pred : Src) {
2936 if (SEV && SEV->isExpression()) {
2937 const std::pair<const ProgramPointTag *, const ProgramPointTag*> &tags =
2941 std::tie(StateTrue, StateFalse) = state->assume(*SEV);
2945 SVal Val = svalBuilder.makeIntVal(1U, Ex->
getType());
2952 SVal Val = svalBuilder.makeIntVal(0U, Ex->
getType());
3002 N->getState()->getStateManager().getOwningEngine()).
getBugReporter();
3004 const auto EQClasses =
3005 llvm::make_range(BR.EQClasses_begin(), BR.EQClasses_end());
3007 for (
const auto &EQ : EQClasses) {
3008 for (
const BugReport &Report : EQ) {
3009 if (Report.getErrorNode()->getState() == N->getState() &&
3010 Report.getErrorNode()->getLocation() == N->getLocation())
3021 static bool traverseHiddenNodes(
3022 const ExplodedNode *N,
3023 llvm::function_ref<
void(
const ExplodedNode *)> PreCallback,
3024 llvm::function_ref<
void(
const ExplodedNode *)> PostCallback,
3025 llvm::function_ref<
bool(
const ExplodedNode *)> Stop) {
3026 const ExplodedNode *FirstHiddenNode = N;
3027 while (FirstHiddenNode->pred_size() == 1 &&
3028 isNodeHidden(*FirstHiddenNode->pred_begin())) {
3029 FirstHiddenNode = *FirstHiddenNode->pred_begin();
3031 const ExplodedNode *OtherNode = FirstHiddenNode;
3033 PreCallback(OtherNode);
3034 if (Stop(OtherNode))
3039 PostCallback(OtherNode);
3041 OtherNode = *OtherNode->succ_begin();
3046 static bool isNodeHidden(
const ExplodedNode *N) {
3047 return N->isTrivial();
3050 static std::string getNodeLabel(
const ExplodedNode *N, ExplodedGraph *G){
3052 llvm::raw_string_ostream Out(Buf);
3054 const bool IsDot =
true;
3055 const unsigned int Space = 1;
3058 auto Noop = [](
const ExplodedNode*){};
3059 bool HasReport = traverseHiddenNodes(
3061 bool IsSink = traverseHiddenNodes(
3062 N, Noop, Noop, [](
const ExplodedNode *N) {
return N->isSink(); });
3064 Out <<
"{ \"node_id\": " << N->getID(G) <<
", \"pointer\": \"" 3065 << (
const void *)N <<
"\", \"state_id\": " << State->getID()
3066 <<
", \"has_report\": " << (HasReport ?
"true" :
"false")
3067 <<
", \"is_sink\": " << (IsSink ?
"true" :
"false")
3070 Indent(Out, Space, IsDot) <<
"\"program_points\": [\\l";
3073 traverseHiddenNodes(
3075 [&](
const ExplodedNode *OtherNode) {
3076 Indent(Out, Space + 1, IsDot) <<
"{ ";
3077 OtherNode->getLocation().printJson(Out,
"\\l");
3078 Out <<
", \"tag\": ";
3080 Out <<
'\"' << Tag->getTagDescription() <<
"\" }";
3085 [&](
const ExplodedNode *) { Out <<
",\\l"; },
3086 [&](
const ExplodedNode *) {
return false; });
3089 Indent(Out, Space, IsDot) <<
"],\\l";
3091 bool SameAsAllPredecessors =
3092 std::all_of(N->pred_begin(), N->pred_end(), [&](
const ExplodedNode *
P) {
3093 return P->getState() ==
State;
3096 if (!SameAsAllPredecessors) {
3097 State->printDOT(Out, N->getLocationContext(), Space);
3099 Indent(Out, Space, IsDot) <<
"\"program_state\": null";
3113 llvm::DisplayGraph(Filename,
false, llvm::GraphProgram::DOT);
3115 llvm::errs() <<
"Warning: viewing graph requires assertions" <<
"\n";
3122 llvm::DisplayGraph(Filename,
false, llvm::GraphProgram::DOT);
3124 llvm::errs() <<
"Warning: viewing graph requires assertions" <<
"\n";
3130 std::vector<const ExplodedNode *> Src;
3134 EI = BR.EQClasses_begin(), EE = BR.EQClasses_end(); EI != EE; ++EI) {
3135 const auto *N =
const_cast<ExplodedNode *
>(EI->begin()->getErrorNode());
3136 if (N) Src.push_back(N);
3140 return llvm::WriteGraph(&G,
"ExprEngine",
false,
3141 "Exploded Graph", Filename);
3144 llvm::errs() <<
"Warning: dumping graph requires assertions" <<
"\n";
3149 StringRef Filename) {
3151 std::unique_ptr<ExplodedGraph> TrimmedG(G.trim(Nodes));
3153 if (!TrimmedG.get()) {
3154 llvm::errs() <<
"warning: Trimmed ExplodedGraph is empty.\n";
3156 return llvm::WriteGraph(TrimmedG.get(),
"TrimmedExprEngine",
3158 "Trimmed Exploded Graph",
3162 llvm::errs() <<
"Warning: dumping graph requires assertions" <<
"\n";
3167 static int index = 0;
void processEndWorklist() override
Called by CoreEngine when the analysis worklist has terminated.
bool isBaseInitializer() const
Determine whether this initializer is initializing a base class.
Defines the clang::ASTContext interface.
Represents C++ allocator call.
This represents a GCC inline-assembly statement extension.
TypedValueRegion - An abstract class representing regions having a typed value.
ProgramStateRef processRegionChange(ProgramStateRef state, const MemRegion *MR, const LocationContext *LCtx)
Expr * getInit() const
Get the initializer.
void VisitArraySubscriptExpr(const ArraySubscriptExpr *Ex, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitArraySubscriptExpr - Transfer function for array accesses.
void ProcessInitializer(const CFGInitializer I, ExplodedNode *Pred)
SVal evalDerivedToBase(SVal Derived, const CastExpr *Cast)
Evaluates a chain of derived-to-base casts through the path specified in Cast.
A (possibly-)qualified type.
MemRegion - The root abstract class for all memory regions.
void markLive(SymbolRef sym)
Unconditionally marks a symbol as live.
bool isMemberPointerType() const
ValueDecl * getMemberDecl() const
Retrieve the member declaration to which this expression refers.
void markInfeasible(bool branch)
const Expr * skipRValueSubobjectAdjustments(SmallVectorImpl< const Expr *> &CommaLHS, SmallVectorImpl< SubobjectAdjustment > &Adjustments) const
Walk outwards from an expression we want to bind a reference to and find the expression whose lifetim...
const Stmt * getStmt() const
bool IsTemporaryCtorOrDtor
This call is a constructor or a destructor of a temporary value.
bool operator==(CanQual< T > x, CanQual< U > y)
static bool nodeHasBugReport(const ExplodedNode *N)
bool isCForbiddenLValueType() const
Determine whether expressions of the given type are forbidden from being lvalues in C...
unsigned blockCount() const
Returns the number of times the current basic block has been visited on the exploded graph path...
Specialize PointerLikeTypeTraits to allow LazyGenerationalUpdatePtr to be placed into a PointerUnion...
void VisitCallExpr(const CallExpr *CE, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitCall - Transfer function for function calls.
Stmt - This represents one statement.
Information about invalidation for a particular region/symbol.
This builder class is useful for generating nodes that resulted from visiting a statement.
void VisitCXXBindTemporaryExpr(const CXXBindTemporaryExpr *BTE, ExplodedNodeSet &PreVisit, ExplodedNodeSet &Dst)
C Language Family Type Representation.
Defines the SourceManager interface.
static bool nodeHasBugReport(const ExplodedNode *N)
static const Stmt * getRightmostLeaf(const Stmt *Condition)
void VisitMSAsmStmt(const MSAsmStmt *A, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitMSAsmStmt - Transfer function logic for MS inline asm.
Decl - This represents one declaration (or definition), e.g.
Represents a point when we begin processing an inlined call.
Defines the PrettyStackTraceEntry class, which is used to make crashes give more contextual informati...
FunctionDecl * getOperatorNew() const
bool isVirtual() const
Determines whether the base class is a virtual base class (or not).
IntrusiveRefCntPtr< const ProgramState > ProgramStateRef
ExprEngine(cross_tu::CrossTranslationUnitContext &CTU, AnalysisManager &mgr, SetOfConstDecls *VisitedCalleesIn, FunctionSummariesTy *FS, InliningModes HowToInlineIn)
const CastExpr * BasePath
SVal evalBinOp(ProgramStateRef state, BinaryOperator::Opcode op, NonLoc L, NonLoc R, QualType T)
void processBranch(const Stmt *Condition, NodeBuilderContext &BuilderCtx, ExplodedNode *Pred, ExplodedNodeSet &Dst, const CFGBlock *DstT, const CFGBlock *DstF) override
ProcessBranch - Called by CoreEngine.
The pointer has been passed to a function indirectly.
void ViewGraph(bool trim=false)
Visualize the ExplodedGraph created by executing the simulation.
void processCleanupTemporaryBranch(const CXXBindTemporaryExpr *BTE, NodeBuilderContext &BldCtx, ExplodedNode *Pred, ExplodedNodeSet &Dst, const CFGBlock *DstT, const CFGBlock *DstF) override
Called by CoreEngine.
Represents C++ object destructor generated from a call to delete.
Represents an array type, per C99 6.7.5.2 - Array Declarators.
Hints for figuring out of a call should be inlined during evalCall().
Represents a program point just before an implicit call event.
bool IsArrayCtorOrDtor
This call is a constructor or a destructor for a single element within an array, a part of array cons...
void ProcessMemberDtor(const CFGMemberDtor D, ExplodedNode *Pred, ExplodedNodeSet &Dst)
StorageDuration
The storage duration for an object (per C++ [basic.stc]).
void runCheckersForPrintStateJson(raw_ostream &Out, ProgramStateRef State, const char *NL="\, unsigned int Space=0, bool IsDot=false) const
Run checkers for debug-printing a ProgramState.
T castAs() const
Convert to the specified CFGElement type, asserting that this CFGElement is of the desired type...
const ProgramStateRef & getState() const
DOTGraphTraits(bool isSimple=false)
void processCFGBlockEntrance(const BlockEdge &L, NodeBuilderWithSinks &nodeBuilder, ExplodedNode *Pred) override
Called by CoreEngine when processing the entrance of a CFGBlock.
Represents a point when we exit a loop.
ProgramStateRef getInitialState(const LocationContext *InitLoc) override
getInitialState - Return the initial state used for the root vertex in the ExplodedGraph.
const CXXDestructorDecl * getDestructorDecl(ASTContext &astContext) const
static void printObjectsUnderConstructionJson(raw_ostream &Out, ProgramStateRef State, const char *NL, const LocationContext *LCtx, unsigned int Space=0, bool IsDot=false)
bool isIndirectMemberInitializer() const
bool isConsumedExpr(Expr *E) const
void VisitUnaryOperator(const UnaryOperator *B, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitUnaryOperator - Transfer function logic for unary operators.
void takeNodes(const ExplodedNodeSet &S)
Represents a variable declaration or definition.
ProgramStateRef notifyCheckersOfPointerEscape(ProgramStateRef State, const InvalidatedSymbols *Invalidated, ArrayRef< const MemRegion *> ExplicitRegions, const CallEvent *Call, RegionAndSymbolInvalidationTraits &ITraits) override
Call PointerEscape callback when a value escapes as a result of region invalidation.
ASTContext & getASTContext() const
REGISTER_TRAIT_WITH_PROGRAMSTATE(ObjectsUnderConstruction, ObjectsUnderConstructionMap) static const char *TagProviderName
const T * getAs() const
Member-template getAs<specific type>'.
void ProcessDeleteDtor(const CFGDeleteDtor D, ExplodedNode *Pred, ExplodedNodeSet &Dst)
loc::MemRegionVal getCXXThis(const CXXMethodDecl *D, const StackFrameContext *SFC)
Return a memory region for the 'this' object reference.
static Optional< SVal > getObjectUnderConstruction(ProgramStateRef State, const ConstructionContextItem &Item, const LocationContext *LC)
By looking at a certain item that may be potentially part of an object's ConstructionContext, retrieve such object's location.
void evalStore(ExplodedNodeSet &Dst, const Expr *AssignE, const Expr *StoreE, ExplodedNode *Pred, ProgramStateRef St, SVal TargetLV, SVal Val, const ProgramPointTag *tag=nullptr)
evalStore - Handle the semantics of a store via an assignment.
bool isUnrolledState(ProgramStateRef State)
Returns if the given State indicates that is inside a completely unrolled loop.
const ElementRegion * GetElementZeroRegion(const SubRegion *R, QualType T)
void enqueue(ExplodedNodeSet &Set)
Enqueue the given set of nodes onto the work list.
const internal::VariadicDynCastAllOfMatcher< Decl, VarDecl > varDecl
Matches variable declarations.
const Stmt * getTriggerStmt() const
Describes how types, statements, expressions, and declarations should be printed. ...
Defines the Objective-C statement AST node classes.
void removeDead(ExplodedNode *Node, ExplodedNodeSet &Out, const Stmt *ReferenceStmt, const LocationContext *LC, const Stmt *DiagnosticStmt=nullptr, ProgramPoint::Kind K=ProgramPoint::PreStmtPurgeDeadSymbolsKind)
Run the analyzer's garbage collection - remove dead symbols and bindings from the state...
ProgramStateRef removeDeadBindings(ProgramStateRef St, const StackFrameContext *LCtx, SymbolReaper &SymReaper)
Represents a parameter to a function.
Defines the clang::Expr interface and subclasses for C++ expressions.
void VisitCXXThisExpr(const CXXThisExpr *TE, ExplodedNode *Pred, ExplodedNodeSet &Dst)
BoundNodesTreeBuilder Nodes
static bool shouldRemoveDeadBindings(AnalysisManager &AMgr, const Stmt *S, const ExplodedNode *Pred, const LocationContext *LC)
void ProcessTemporaryDtor(const CFGTemporaryDtor D, ExplodedNode *Pred, ExplodedNodeSet &Dst)
void ProcessLoopExit(const Stmt *S, ExplodedNode *Pred)
void runCheckersForLocation(ExplodedNodeSet &Dst, const ExplodedNodeSet &Src, SVal location, bool isLoad, const Stmt *NodeEx, const Stmt *BoundEx, ExprEngine &Eng)
Run checkers for load/store of a location.
bool haveEqualEnvironments(ProgramStateRef S1, ProgramStateRef S2) const
ProgramStateRef runCheckersForPointerEscape(ProgramStateRef State, const InvalidatedSymbols &Escaped, const CallEvent *Call, PointerEscapeKind Kind, RegionAndSymbolInvalidationTraits *ITraits)
Run checkers when pointers escape.
One of these records is kept for each identifier that is lexed.
A pointer escapes due to binding its value to a location that the analyzer cannot track...
Holds long-lived AST nodes (such as types and decls) that can be referred to throughout the semantic ...
void runCheckersForLiveSymbols(ProgramStateRef state, SymbolReaper &SymReaper)
Run checkers for live symbols.
void printJson(raw_ostream &Out, PrinterHelper *Helper, const PrintingPolicy &Policy, bool AddQuotes) const
Pretty-prints in JSON format.
SourceLocation getBeginLoc() const LLVM_READONLY
Represents a member of a struct/union/class.
Represents a program point after a store evaluation.
Represents C++ object destructor implicitly generated for automatic object or temporary bound to cons...
bool haveEqualStores(ProgramStateRef S1, ProgramStateRef S2) const
ProgramStateRef processLoopEnd(const Stmt *LoopStmt, ProgramStateRef State)
Updates the given ProgramState.
bool isReferenceType() const
void ProcessImplicitDtor(const CFGImplicitDtor D, ExplodedNode *Pred)
bool isAllEnumCasesCovered() const
Returns true if the SwitchStmt is a switch of an enum value and all cases have been explicitly covere...
void addPredecessor(ExplodedNode *V, ExplodedGraph &G)
addPredeccessor - Adds a predecessor to the current node, and in tandem add this node as a successor ...
i32 captured_struct **param SharedsTy A type which contains references the shared variables *param Shareds Context with the list of shared variables from the p *TaskFunction *param Data Additional data for task generation like final * state
const StackFrameContext * getStackFrame() const
bool isIntegralOrEnumerationType() const
Determine whether this type is an integral or enumeration type.
void enableNodeReclamation(unsigned Interval)
Enable tracking of recently allocated nodes for potential reclamation when calling reclaimRecentlyAll...
ProgramStateRef processPointerEscapedOnBind(ProgramStateRef State, SVal Loc, SVal Val, const LocationContext *LCtx) override
Call PointerEscape callback when a value escapes as a result of bind.
static bool isLocType(QualType T)
void VisitOffsetOfExpr(const OffsetOfExpr *Ex, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitOffsetOfExpr - Transfer function for offsetof.
This is a meta program point, which should be skipped by all the diagnostic reasoning etc...
ProgramStateRef updateLoopStack(const Stmt *LoopStmt, ASTContext &ASTCtx, ExplodedNode *Pred, unsigned maxVisitOnPath)
Updates the stack of loops contained by the ProgramState.
ExplodedNode * generateSink(const Stmt *S, ExplodedNode *Pred, ProgramStateRef St, const ProgramPointTag *tag=nullptr, ProgramPoint::Kind K=ProgramPoint::PostStmtKind)
enum clang::SubobjectAdjustment::@47 Kind
SourceLocation getBeginLoc() const LLVM_READONLY
Forward-declares and imports various common LLVM datatypes that clang wants to use unqualified...
STATISTIC(NumRemoveDeadBindings, "The # of times RemoveDeadBindings is called")
const LocationContext * getLocationContext() const
ExplodedNode * generateCaseStmtNode(const iterator &I, ProgramStateRef State)
virtual bool inTopFrame() const
Return true if the current LocationContext has no caller context.
const clang::PrintingPolicy & getPrintingPolicy() const
static bool isRecordType(QualType T)
const LocationContext * getParent() const
A builtin binary operation expression such as "x + y" or "x <= y".
If a crash happens while one of these objects are live, the message is printed out along with the spe...
void VisitReturnStmt(const ReturnStmt *R, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitReturnStmt - Transfer function logic for return statements.
const VarDecl * getVarDecl() const
CaseStmt - Represent a case statement.
const CXXBaseSpecifier * getBaseSpecifier() const
bool isAnyMemberInitializer() const
An adjustment to be made to the temporary created when emitting a reference binding, which accesses a particular subobject of that temporary.
void ProcessNewAllocator(const CXXNewExpr *NE, ExplodedNode *Pred)
void ProcessAutomaticObjDtor(const CFGAutomaticObjDtor D, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Represents binding an expression to a temporary.
virtual SVal getLValueField(const FieldDecl *D, SVal Base)
FieldDecl * getAnyMember() const
void VisitDeclStmt(const DeclStmt *DS, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitDeclStmt - Transfer function logic for DeclStmts.
CXXDestructorDecl * getDestructor() const
Returns the destructor decl for this class.
FieldDecl * getMember() const
If this is a member initializer, returns the declaration of the non-static data member being initiali...
void runCheckersForEndFunction(NodeBuilderContext &BC, ExplodedNodeSet &Dst, ExplodedNode *Pred, ExprEngine &Eng, const ReturnStmt *RS)
Run checkers on end of function.
void processStaticInitializer(const DeclStmt *DS, NodeBuilderContext &BuilderCtx, ExplodedNode *Pred, ExplodedNodeSet &Dst, const CFGBlock *DstT, const CFGBlock *DstF) override
Called by CoreEngine.
const CFGBlock * getCallSiteBlock() const
void evalBind(ExplodedNodeSet &Dst, const Stmt *StoreE, ExplodedNode *Pred, SVal location, SVal Val, bool atDeclInit=false, const ProgramPoint *PP=nullptr)
evalBind - Handle the semantics of binding a value to a specific location.
CheckerManager & getCheckerManager() const
void VisitLogicalExpr(const BinaryOperator *B, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitLogicalExpr - Transfer function logic for '&&', '||'.
CXXCtorInitializer * getInitializer() const
void removeDeadOnEndOfFunction(NodeBuilderContext &BC, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Remove dead bindings/symbols before exiting a function.
void runCheckersForBind(ExplodedNodeSet &Dst, const ExplodedNodeSet &Src, SVal location, SVal val, const Stmt *S, ExprEngine &Eng, const ProgramPoint &PP)
Run checkers for binding of a value to a location.
CXXRecordDecl * getAsCXXRecordDecl() const
Retrieves the CXXRecordDecl that this type refers to, either because the type is a RecordType or beca...
const FieldDecl * getFieldDecl() const
const Stmt * getCallSite() const
void VisitCXXCatchStmt(const CXXCatchStmt *CS, ExplodedNode *Pred, ExplodedNodeSet &Dst)
bool isDelegatingInitializer() const
Determine whether this initializer is creating a delegating constructor.
const CXXBindTemporaryExpr * getBindTemporaryExpr() const
Represents a single basic block in a source-level CFG.
void VisitInitListExpr(const InitListExpr *E, ExplodedNode *Pred, ExplodedNodeSet &Dst)
llvm::APSInt EvaluateKnownConstInt(const ASTContext &Ctx, SmallVectorImpl< PartialDiagnosticAt > *Diag=nullptr) const
EvaluateKnownConstInt - Call EvaluateAsRValue and return the folded integer.
InliningModes
The modes of inlining, which override the default analysis-wide settings.
SymbolicRegion - A special, "non-concrete" region.
void runCheckersForPostStmt(ExplodedNodeSet &Dst, const ExplodedNodeSet &Src, const Stmt *S, ExprEngine &Eng, bool wasInlined=false)
Run checkers for post-visiting Stmts.
static unsigned getNumSubExprs(AtomicOp Op)
Determine the number of arguments the specified atomic builtin should have.
void ProcessBaseDtor(const CFGBaseDtor D, ExplodedNode *Pred, ExplodedNodeSet &Dst)
DefinedOrUnknownSVal makeZeroVal(QualType type)
Construct an SVal representing '0' for the specified type.
void processSwitch(SwitchNodeBuilder &builder) override
ProcessSwitch - Called by CoreEngine.
void processBeginOfFunction(NodeBuilderContext &BC, ExplodedNode *Pred, ExplodedNodeSet &Dst, const BlockEdge &L) override
Called by CoreEngine.
Represent the declaration of a variable (in which case it is an lvalue) a function (in which case it ...
This represents one expression.
Defines the clang::LangOptions interface.
void VisitLvalObjCIvarRefExpr(const ObjCIvarRefExpr *DR, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Transfer function logic for computing the lvalue of an Objective-C ivar.
void VisitCXXNewExpr(const CXXNewExpr *CNE, ExplodedNode *Pred, ExplodedNodeSet &Dst)
void VisitCXXNewAllocatorCall(const CXXNewExpr *CNE, ExplodedNode *Pred, ExplodedNodeSet &Dst)
const Expr * getCondition() const
CallEventRef getCaller(const StackFrameContext *CalleeCtx, ProgramStateRef State)
Gets an outside caller given a callee context.
void VisitCast(const CastExpr *CastE, const Expr *Ex, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitCast - Transfer function logic for all casts (implicit and explicit).
Represents a C++ destructor within a class.
const internal::VariadicAllOfMatcher< Decl > decl
Matches declarations.
This is the simplest builder which generates nodes in the ExplodedGraph.
void Add(ExplodedNode *N)
The pointer has been passed to a function call directly.
QualType getConditionType() const
const LocationContext * getLocationContext() const
bool inTopFrame() const override
Return true if the current LocationContext has no caller context.
void Visit(const Stmt *S, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Visit - Transfer function logic for all statements.
Defines the clang::IdentifierInfo, clang::IdentifierTable, and clang::Selector interfaces.
static std::pair< const ProgramPointTag *, const ProgramPointTag * > geteagerlyAssumeBinOpBifurcationTags()
The reason for pointer escape is unknown.
ASTContext & getContext() const
getContext - Return the ASTContext associated with this analysis.
Traits for storing the call processing policy inside GDM.
DeclContext * getParent()
getParent - Returns the containing DeclContext.
ReturnStmt - This represents a return, optionally of an expression: return; return 4;...
void VisitAtomicExpr(const AtomicExpr *E, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitAtomicExpr - Transfer function for builtin atomic expressions.
This represents a Microsoft inline-assembly statement extension.
const SwitchStmt * getSwitch() const
void evalLoad(ExplodedNodeSet &Dst, const Expr *NodeEx, const Expr *BoundExpr, ExplodedNode *Pred, ProgramStateRef St, SVal location, const ProgramPointTag *tag=nullptr, QualType LoadTy=QualType())
Simulate a read of the result of Ex.
Represents C++ object destructor implicitly generated for base object in destructor.
QualType getDestroyedType() const
Retrieve the type being destroyed.
const Expr * getSubExpr() const
bool isNull() const
Return true if this QualType doesn't point to a type yet.
reverse_iterator rbegin()
virtual ProgramStateRef removeDeadBindings(ProgramStateRef state, SymbolReaper &SymReaper)=0
Scan all symbols referenced by the constraints.
Optional< T > getAs() const
Convert to the specified SVal type, returning None if this SVal is not of the desired type...
const MemRegion * getRegion() const
Get the underlining region.
ExplodedNode * generateNode(const iterator &I, ProgramStateRef State, bool isSink=false)
While alive, includes the current analysis stack in a crash trace.
void processEndOfFunction(NodeBuilderContext &BC, ExplodedNode *Pred, const ReturnStmt *RS=nullptr) override
Called by CoreEngine.
static const Stmt * ResolveCondition(const Stmt *Condition, const CFGBlock *B)
void processCFGElement(const CFGElement E, ExplodedNode *Pred, unsigned StmtIdx, NodeBuilderContext *Ctx) override
processCFGElement - Called by CoreEngine.
ProgramStateRef getInitialState(const LocationContext *InitLoc)
const LocationContext * getLocationContext() const
const Stmt * getStmt() const
void VisitGuardedExpr(const Expr *Ex, const Expr *L, const Expr *R, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitGuardedExpr - Transfer function logic for ?, __builtin_choose.
void printJson(raw_ostream &Out, ProgramStateRef State, const LocationContext *LCtx, const char *NL, unsigned int Space, bool IsDot) const override
printJson - Called by ProgramStateManager to print checker-specific data.
DefinedOrUnknownSVal conjureSymbolVal(const void *symbolTag, const Expr *expr, const LocationContext *LCtx, unsigned count)
Create a new symbol with a unique 'name'.
ProgramStateRef getWidenedLoopState(ProgramStateRef PrevState, const LocationContext *LCtx, unsigned BlockCount, const Stmt *LoopStmt)
Get the states that result from widening the loop.
A helper class that allows the use of isa/cast/dyncast to detect TagType objects of enums...
void runCheckersForBranchCondition(const Stmt *condition, ExplodedNodeSet &Dst, ExplodedNode *Pred, ExprEngine &Eng)
Run checkers for branch condition.
T castAs() const
Convert to the specified ProgramPoint type, asserting that this ProgramPoint is of the desired type...
static bool isCallStmt(const Stmt *S)
Returns true if this is a statement is a function or method call of some kind.
DOTGraphTraits(bool isSimple=false)
ProgramPoints can be "tagged" as representing points specific to a given analysis entity...
AnalysisManager & getAnalysisManager() override
std::string getNameAsString() const
Get a human-readable name for the declaration, even if it is one of the special kinds of names (C++ c...
void evalEagerlyAssumeBinOpBifurcation(ExplodedNodeSet &Dst, ExplodedNodeSet &Src, const Expr *Ex)
evalEagerlyAssumeBinOpBifurcation - Given the nodes in 'Src', eagerly assume symbolic expressions of ...
const MemRegion * getAsRegion() const
Represents a new-expression for memory allocation and constructor calls, e.g: "new CXXNewExpr(foo)"...
SourceLocation getBeginLoc() const
CallEventManager & getCallEventManager()
DeclStmt - Adaptor class for mixing declarations with statements and expressions. ...
void VisitCompoundLiteralExpr(const CompoundLiteralExpr *CL, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitCompoundLiteralExpr - Transfer function logic for compound literals.
Represents the declaration of a label.
ExplodedNode * generateNode(ProgramStateRef State, ExplodedNode *Pred, const ProgramPointTag *Tag=nullptr)
void processIndirectGoto(IndirectGotoNodeBuilder &builder) override
processIndirectGoto - Called by CoreEngine.
QualType getBaseElementType(const ArrayType *VAT) const
Return the innermost element type of an array type.
const CXXTempObjectRegion * getCXXTempObjectRegion(Expr const *Ex, LocationContext const *LC)
void VisitCXXDeleteExpr(const CXXDeleteExpr *CDE, ExplodedNode *Pred, ExplodedNodeSet &Dst)
bool IsCtorOrDtorWithImproperlyModeledTargetRegion
This call is a constructor or a destructor for which we do not currently compute the this-region corr...
ProgramPoint getLocation() const
getLocation - Returns the edge associated with the given node.
SVal - This represents a symbolic expression, which can be either an L-value or an R-value...
int64_t getID(const ASTContext &Context) const
const ArrayType * getAsArrayType(QualType T) const
Type Query functions.
AtomicExpr - Variadic atomic builtins: __atomic_exchange, __atomic_fetch_*, __atomic_load, __atomic_store, and __atomic_compare_exchange_*, for the similarly-named C++11 instructions, and __c11 variants for <stdatomic.h>, and corresponding __opencl_atomic_* for OpenCL 2.0.
void VisitUnaryExprOrTypeTraitExpr(const UnaryExprOrTypeTraitExpr *Ex, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitUnaryExprOrTypeTraitExpr - Transfer function for sizeof.
ProgramStateRef runCheckersForEvalAssume(ProgramStateRef state, SVal Cond, bool Assumption)
Run checkers for handling assumptions on symbolic values.
AnalyzerOptions & options
ImplicitCastExpr - Allows us to explicitly represent implicit type conversions, which have no direct ...
BugReporter & getBugReporter()
void VisitObjCForCollectionStmt(const ObjCForCollectionStmt *S, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitObjCForCollectionStmt - Transfer function logic for ObjCForCollectionStmt.
A class responsible for cleaning up unused symbols.
bool operator<(DeclarationName LHS, DeclarationName RHS)
Ordering on two declaration names.
void runCheckersForPreStmt(ExplodedNodeSet &Dst, const ExplodedNodeSet &Src, const Stmt *S, ExprEngine &Eng)
Run checkers for pre-visiting Stmts.
bool isVectorType() const
bool isStmtBranch() const
ProgramStateRef getPersistentStateWithGDM(ProgramStateRef FromState, ProgramStateRef GDMState)
void insert(const ExplodedNodeSet &S)
Optional< T > getAs() const
Convert to the specified CFGElement type, returning None if this CFGElement is not of the desired typ...
Defines various enumerations that describe declaration and type specifiers.
StringRef getName() const
Return the actual identifier string.
ast_type_traits::DynTypedNode Node
void runCheckersForDeadSymbols(ExplodedNodeSet &Dst, const ExplodedNodeSet &Src, SymbolReaper &SymReaper, const Stmt *S, ExprEngine &Eng, ProgramPoint::Kind K)
Run checkers for dead symbols.
Dataflow Directional Tag Classes.
void ProcessStmt(const Stmt *S, ExplodedNode *Pred)
ExplodedNode * generateDefaultCaseNode(ProgramStateRef State, bool isSink=false)
SValBuilder & getSValBuilder()
Represents a delete expression for memory deallocation and destructor calls, e.g. ...
void addNodes(const ExplodedNodeSet &S)
StoreManager & getStoreManager()
Represents a program point just after an implicit call event.
ProgramStateRef processRegionChanges(ProgramStateRef state, const InvalidatedSymbols *invalidated, ArrayRef< const MemRegion *> ExplicitRegions, ArrayRef< const MemRegion *> Regions, const LocationContext *LCtx, const CallEvent *Call) override
processRegionChanges - Called by ProgramStateManager whenever a change is made to the store...
SourceLocation getSourceLocation() const
Determine the source location of the initializer.
void VisitCXXDestructor(QualType ObjectType, const MemRegion *Dest, const Stmt *S, bool IsBaseDtor, ExplodedNode *Pred, ExplodedNodeSet &Dst, const EvalCallOptions &Options)
const NodeBuilderContext & getContext()
std::unique_ptr< DiagnosticConsumer > create(StringRef OutputFile, DiagnosticOptions *Diags, bool MergeChildRecords=false)
Returns a DiagnosticConsumer that serializes diagnostics to a bitcode file.
This node builder keeps track of the generated sink nodes.
bool isPurgeKind()
Is this a program point corresponding to purge/removal of dead symbols and bindings.
StmtClass getStmtClass() const
void reclaimRecentlyAllocatedNodes()
Reclaim "uninteresting" nodes created since the last time this method was called. ...
void VisitLambdaExpr(const LambdaExpr *LE, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitLambdaExpr - Transfer function logic for LambdaExprs.
const Decl * getSingleDecl() const
Represents symbolic expression that isn't a location.
Stmt * getTerminatorStmt()
BranchNodeBuilder is responsible for constructing the nodes corresponding to the two branches of the ...
Represents an abstract call to a function or method along a particular path.
ProgramStateRef getState() const
const Stmt * getLoopStmt() const
ProgramStateManager & getStateManager() override
This class is used for tools that requires cross translation unit capability.
const Decl * getDecl() const
const CXXDeleteExpr * getDeleteExpr() const
Represents a single point (AST node) in the program that requires attention during construction of an...
Expr * IgnoreParenImpCasts() LLVM_READONLY
Skip past any parentheses and implicit casts which might surround this expression until reaching a fi...
const CXXTempObjectRegion * getCXXStaticTempObjectRegion(const Expr *Ex)
Create a CXXTempObjectRegion for temporaries which are lifetime-extended by static references...
PointerEscapeKind
Describes the different reasons a pointer escapes during analysis.
SwitchStmt - This represents a 'switch' stmt.
SourceLocation getBeginLoc() const
unsigned getIntWidth(QualType T) const
Expr * IgnoreImplicit() LLVM_READONLY
Skip past any implicit AST nodes which might surround this expression until reaching a fixed point...
void runCheckersForEndAnalysis(ExplodedGraph &G, BugReporter &BR, ExprEngine &Eng)
Run checkers for end of analysis.
T castAs() const
Convert to the specified SVal type, asserting that this SVal is of the desired type.
ArraySubscriptExpr - [C99 6.5.2.1] Array Subscripting.
ExplodedNode * generateSink(ProgramStateRef State, ExplodedNode *Pred, const ProgramPointTag *Tag=nullptr)
SubRegion - A region that subsets another larger region.
Represents a C++ base or member initializer.
void VisitCXXConstructExpr(const CXXConstructExpr *E, ExplodedNode *Pred, ExplodedNodeSet &Dst)
unsigned getIndex() const
void VisitObjCAtSynchronizedStmt(const ObjCAtSynchronizedStmt *S, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Transfer function logic for ObjCAtSynchronizedStmts.
IndirectFieldDecl * getIndirectMember() const
const LocationContext * getLocationContext() const
void VisitObjCMessage(const ObjCMessageExpr *ME, ExplodedNode *Pred, ExplodedNodeSet &Dst)
bool hasStackStorage() const
const StackFrameContext * getStackFrame() const
void printJson(raw_ostream &Out, const char *NL="\, unsigned int Space=0, bool IsDot=false, std::function< void(const LocationContext *)> printMoreInfoPerContext=[](const LocationContext *) {}) const
llvm::FoldingSet< BugReportEquivClass >::iterator EQClasses_iterator
Iterator over the set of BugReports tracked by the BugReporter.
Represents a base class of a C++ class.
Stores options for the analyzer from the command line.
void getCaptureFields(llvm::DenseMap< const VarDecl *, FieldDecl *> &Captures, FieldDecl *&ThisCapture) const
For a closure type, retrieve the mapping from captured variables and this to the non-static data memb...
uint64_t getTypeSize(QualType T) const
Return the size of the specified (complete) type T, in bits.
X
Add a minimal nested name specifier fixit hint to allow lookup of a tag name from an outer enclosing ...
ExplodedNode * generateNode(const ProgramPoint &PP, ProgramStateRef State, ExplodedNode *Pred)
Generates a node in the ExplodedGraph.
const CXXNewExpr * getAllocatorExpr() const
void VisitBlockExpr(const BlockExpr *BE, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitBlockExpr - Transfer function logic for BlockExprs.
Defines the C++ Decl subclasses, other than those for templates (found in DeclTemplate.h) and friends (in DeclFriend.h).
MemberExpr - [C99 6.5.2.3] Structure and Union Members.
Defines the clang::SourceLocation class and associated facilities.
Represents a C++ struct/union/class.
Represents C++ object destructor implicitly generated by compiler on various occasions.
ProgramStateRef getState() const
pred_iterator pred_begin()
ExplodedNode * generateNode(ProgramStateRef State, bool branch, ExplodedNode *Pred)
Represents a top-level expression in a basic block.
This class is used for builtin types like 'int'.
ProgramStateRef processAssume(ProgramStateRef state, SVal cond, bool assumption) override
evalAssume - Callback function invoked by the ConstraintManager when making assumptions about state v...
Represents C++ object destructor implicitly generated for member object in destructor.
const MemRegion * getBaseRegion() const
ExplodedNode * generateNode(const Stmt *S, ExplodedNode *Pred, ProgramStateRef St, const ProgramPointTag *tag=nullptr, ProgramPoint::Kind K=ProgramPoint::PostStmtKind)
static Decl::Kind getKind(const Decl *D)
ProgramStateRef runCheckersForRegionChanges(ProgramStateRef state, const InvalidatedSymbols *invalidated, ArrayRef< const MemRegion *> ExplicitRegions, ArrayRef< const MemRegion *> Regions, const LocationContext *LCtx, const CallEvent *Call)
Run checkers for region changes.
std::string DumpGraph(bool trim=false, StringRef Filename="")
Dump graph to the specified filename.
void runCheckersForBeginFunction(ExplodedNodeSet &Dst, const BlockEdge &L, ExplodedNode *Pred, ExprEngine &Eng)
Run checkers on beginning of function.
void VisitCommonDeclRefExpr(const Expr *DR, const NamedDecl *D, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Transfer function logic for DeclRefExprs and BlockDeclRefExprs.
raw_ostream & Indent(raw_ostream &Out, const unsigned int Space, bool IsDot)
A reference to a declared variable, function, enum, etc.
Represents C++ base or member initializer from constructor's initialization list. ...
void VisitGCCAsmStmt(const GCCAsmStmt *A, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitGCCAsmStmt - Transfer function logic for inline asm.
const StackFrameContext * getStackFrame() const
void VisitMemberExpr(const MemberExpr *M, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitMemberExpr - Transfer function for member expressions.
ParentMap & getParentMap()
ProgramStateRef escapeValue(ProgramStateRef State, SVal V, PointerEscapeKind K) const
A simple wrapper when you only need to notify checkers of pointer-escape of a single value...
llvm::ImmutableMap< ConstructedObjectKey, SVal > ObjectsUnderConstructionMap
This represents a decl that may have a name.
Optional< T > getAs() const
Convert to the specified ProgramPoint type, returning None if this ProgramPoint is not of the desired...
ConstraintManager & getConstraintManager()
void VisitBinaryOperator(const BinaryOperator *B, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitBinaryOperator - Transfer function logic for binary operators.
CFGTerminator getTerminator() const
AnalysisDeclContext * getAnalysisDeclContext() const
bool isFeasible(bool branch)
void CreateCXXTemporaryObject(const MaterializeTemporaryExpr *ME, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Create a C++ temporary object for an rvalue.
static SVal RecoverCastedSymbol(ProgramStateRef state, const Stmt *Condition, const LocationContext *LCtx, ASTContext &Ctx)
RecoverCastedSymbol - A helper function for ProcessBranch that is used to try to recover some path-se...
const Expr * getTarget() const
Represents C++ object destructor implicitly generated at the end of full expression for temporary obj...
const CFGBlock * getBlock() const
Return the CFGBlock associated with this builder.
int64_t getID(const ASTContext &Context) const
bool isUnknownOrUndef() const
Expr * IgnoreParens() LLVM_READONLY
Skip past any parentheses which might surround this expression until reaching a fixed point...
QualType getType() const
Retrieves the type of the base class.
Represents the point where a loop ends.