31 #include "llvm/ADT/APSInt.h" 32 #include "llvm/ADT/Optional.h" 33 #include "llvm/ADT/SmallVector.h" 34 #include "llvm/Support/Casting.h" 35 #include "llvm/Support/ErrorHandling.h" 39 using namespace clang;
43 : svalBuilder(stateMgr.getSValBuilder()), StateMgr(stateMgr),
44 MRMgr(svalBuilder.getRegionManager()), Ctx(stateMgr.getContext()) {}
54 for (
const auto &I : InitialBindings)
86 if (isa<CodeTextRegion>(R) || isa<SymbolicRegion>(R))
105 if (
const auto *TR = dyn_cast<TypedValueRegion>(R)) {
107 if (CanonPointeeTy == ObjTy)
113 case MemRegion::CXXThisRegionKind:
114 case MemRegion::CodeSpaceRegionKind:
115 case MemRegion::StackLocalsSpaceRegionKind:
116 case MemRegion::StackArgumentsSpaceRegionKind:
117 case MemRegion::HeapSpaceRegionKind:
118 case MemRegion::UnknownSpaceRegionKind:
119 case MemRegion::StaticGlobalSpaceRegionKind:
120 case MemRegion::GlobalInternalSpaceRegionKind:
121 case MemRegion::GlobalSystemSpaceRegionKind:
122 case MemRegion::GlobalImmutableSpaceRegionKind: {
123 llvm_unreachable(
"Invalid region cast");
126 case MemRegion::FunctionCodeRegionKind:
127 case MemRegion::BlockCodeRegionKind:
128 case MemRegion::BlockDataRegionKind:
129 case MemRegion::StringRegionKind:
131 case MemRegion::SymbolicRegionKind:
132 case MemRegion::AllocaRegionKind:
133 case MemRegion::CompoundLiteralRegionKind:
134 case MemRegion::FieldRegionKind:
135 case MemRegion::ObjCIvarRegionKind:
136 case MemRegion::ObjCStringRegionKind:
137 case MemRegion::VarRegionKind:
138 case MemRegion::CXXTempObjectRegionKind:
139 case MemRegion::CXXBaseObjectRegionKind:
140 case MemRegion::CXXDerivedObjectRegionKind:
143 case MemRegion::ElementRegionKind: {
165 const MemRegion *baseR = rawOff.getRegion();
178 if (
const auto *TR = dyn_cast<TypedValueRegion>(baseR)) {
181 if (CanonPointeeTy == ObjTy)
196 int64_t newIndex = 0;
203 if (!pointeeTySize.
isZero()) {
207 if (off % pointeeTySize == 0) {
208 newIndex = off / pointeeTySize;
225 llvm_unreachable(
"unreachable");
229 const MemRegion *MR = V.getAsRegion();
233 const auto *TVR = dyn_cast<TypedValueRegion>(MR);
237 const CXXRecordDecl *RD = TVR->getValueType()->getAsCXXRecordDecl();
255 SVal Result = Derived;
266 SVal Result = Derived;
267 for (
const auto &I : Path)
269 I.Base->isVirtual());
282 assert(BaseDecl &&
"not a C++ object?");
284 if (
const auto *AlreadyDerivedReg =
285 dyn_cast<CXXDerivedObjectRegion>(DerivedReg)) {
287 dyn_cast<SymbolicRegion>(AlreadyDerivedReg->getSuperRegion()))
288 if (SR->getSymbol()->getType()->getPointeeCXXRecordDecl() == BaseDecl)
291 DerivedReg = AlreadyDerivedReg->getSuperRegion();
295 BaseDecl, cast<SubRegion>(DerivedReg), IsVirtual);
307 if (
const auto *TVR = dyn_cast<TypedValueRegion>(MR))
308 return TVR->getValueType()->getAsCXXRecordDecl();
309 if (
const auto *SR = dyn_cast<SymbolicRegion>(MR))
310 return SR->getSymbol()->getType()->getPointeeCXXRecordDecl();
324 assert(!TargetType.
isNull());
326 if (!TargetClass && !TargetType->
isVoidType())
333 if (MRClass == TargetClass)
339 if (!TargetType->
isVoidType() && MRClass->hasDefinition()) {
344 if (MRClass->isDerivedFrom(TargetClass, Paths))
348 if (
const auto *BaseR = dyn_cast<CXXBaseObjectRegion>(MR)) {
350 MR = BaseR->getSuperRegion();
367 if (Uncasted == MR) {
382 if (
const auto *SR = dyn_cast<SymbolicRegion>(MR)) {
383 QualType T = SR->getSymbol()->getType();
385 if (TargetClass && SourceClass && TargetClass->
isDerivedFrom(SourceClass))
392 Failed = isa<TypedValueRegion>(MR);
424 if (
const auto *SR = dyn_cast_or_null<SymbolicRegion>(V.
getAsRegion()))
425 if (SR->getSymbol()->getType().getCanonicalType() !=
440 case loc::MemRegionValKind:
444 case loc::GotoLabelKind:
448 case loc::ConcreteIntKind:
462 llvm_unreachable(
"Unhandled Base.");
467 if (
const auto *
ID = dyn_cast<ObjCIvarDecl>(D))
474 return getLValueFieldOrIvar(decl, base);
510 SVal BaseIdx = ElemR->getIndex();
515 const llvm::APSInt &BaseIdxI =
522 if (isa<ElementRegion>(BaseRegion->
StripCasts()))
526 elementType, Offset, cast<SubRegion>(ElemR->getSuperRegion()),
Ctx));
530 assert(BaseIdxI.isSigned());
537 const SubRegion *ArrayR = cast<SubRegion>(ElemR->getSuperRegion());
549 if (!SymV || SymV != Sym)
Defines the clang::ASTContext interface.
SVal attemptDownCast(SVal Base, QualType DerivedPtrType, bool &Failed)
Attempts to do a down cast.
TypedValueRegion - An abstract class representing regions having a typed value.
SVal evalDerivedToBase(SVal Derived, const CastExpr *Cast)
Evaluates a chain of derived-to-base casts through the path specified in Cast.
A (possibly-)qualified type.
MemRegion - The root abstract class for all memory regions.
bool isBlockPointerType() const
QualType getPointeeType() const
If this is a pointer, ObjC object pointer, or block pointer, this returns the respective pointee...
C Language Family Type Representation.
Decl - This represents one declaration (or definition), e.g.
bool isDerivedFrom(const CXXRecordDecl *Base) const
Determine whether this class is derived from the class Base.
bool isZero() const
isZero - Test whether the quantity equals zero.
Represents a path from a specific derived class (which is not represented as part of the path) to a p...
Value representing integer constant.
const ObjCIvarRegion * getObjCIvarRegion(const ObjCIvarDecl *ivd, const SubRegion *superRegion)
getObjCIvarRegion - Retrieve or create the memory region associated with a specified Objective-c inst...
const CXXBaseSpecifier *const * path_const_iterator
SymbolRef getAsLocSymbol(bool IncludeBaseRegions=false) const
If this SVal is a location and wraps a symbol, return that SymbolRef.
virtual SVal dispatchCast(SVal val, QualType castTy)=0
const void * Store
Store - This opaque type encapsulates an immutable mapping from locations to values.
NonLoc makeArrayIndex(uint64_t idx)
const ElementRegion * GetElementZeroRegion(const SubRegion *R, QualType T)
QualType getLocalUnqualifiedType() const
Return this type with all of the instance-specific qualifiers removed, but without removing any quali...
const MemRegion * castRegion(const MemRegion *region, QualType CastToTy)
castRegion - Used by ExprEngine::VisitCast to handle casts from a MemRegion* to a specific location t...
bool HandleBinding(StoreManager &SMgr, Store store, const MemRegion *R, SVal val) override
Holds long-lived AST nodes (such as types and decls) that can be referred to throughout the semantic ...
static bool regionMatchesCXXRecordType(SVal V, QualType Ty)
CharUnits - This is an opaque type for sizes expressed in character units.
Forward-declares and imports various common LLVM datatypes that clang wants to use unqualified...
path_iterator path_begin()
CXXRecordDecl * getCanonicalDecl() override
Retrieves the "canonical" declaration of the given declaration.
CastExpr - Base class for type casts, including both implicit casts (ImplicitCastExpr) and explicit c...
StoreRef enterStackFrame(Store store, const CallEvent &Call, const StackFrameContext *CalleeCtx)
enterStackFrame - Let the StoreManager to do something when execution engine is about to execute into...
virtual QualType getType() const =0
virtual SVal getLValueIvar(const ObjCIvarDecl *decl, SVal base)
SymbolRef getAsSymbol(bool IncludeBaseRegions=false) const
If this SVal wraps a symbol return that SymbolRef.
CXXRecordDecl * getAsCXXRecordDecl() const
Retrieves the CXXRecordDecl that this type refers to, either because the type is a RecordType or beca...
unsigned getSubKind() const
QuantityType getQuantity() const
getQuantity - Get the raw integer representation of this quantity.
SValBuilder & svalBuilder
const CXXRecordDecl * getPointeeCXXRecordDecl() const
If this is a pointer or reference to a RecordType, return the CXXRecordDecl that the type refers to...
const internal::VariadicAllOfMatcher< Decl > decl
Matches declarations.
static SVal getValue(SVal val, SValBuilder &svalBuilder)
ProgramStateManager & StateMgr
virtual StoreRef Bind(Store store, Loc loc, SVal val)=0
Return a store with the specified value bound to the given location.
bool isNull() const
Return true if this QualType doesn't point to a type yet.
NonLoc makeZeroArrayIndex()
Optional< T > getAs() const
Convert to the specified SVal type, returning None if this SVal is not of the desired type...
virtual bool isBoundable() const
bool isVoidPointerType() const
QualType getCanonicalType() const
virtual void getInitialStackFrameContents(const StackFrameContext *CalleeCtx, BindingsTy &Bindings) const =0
Populates the given SmallVector with the bindings in the callee's stack frame at the start of this ca...
const MemRegion * getAsRegion() const
ASTContext & getContext()
SVal - This represents a symbolic expression, which can be either an L-value or an R-value...
const CXXDerivedObjectRegion * getCXXDerivedObjectRegion(const CXXRecordDecl *BaseClass, const SubRegion *Super)
Create a CXXDerivedObjectRegion with the given derived class for region Super.
bool isObjCObjectPointerType() const
virtual ~BindingsHandler()
RegionRawOffset getAsArrayOffset() const
Compute the offset within the array. The array might also be a subobject.
const CXXBaseObjectRegion * getCXXBaseObjectRegion(const CXXRecordDecl *BaseClass, const SubRegion *Super, bool IsVirtual)
Create a CXXBaseObjectRegion with the given base class for region Super.
Dataflow Directional Tag Classes.
const ElementRegion * getElementRegion(QualType elementType, NonLoc Idx, const SubRegion *superRegion, ASTContext &Ctx)
getElementRegion - Retrieve the memory region associated with the associated element type...
const MemRegion * StripCasts(bool StripBaseAndDerivedCasts=true) const
Represents an abstract call to a function or method along a particular path.
SVal convertToArrayIndex(SVal val)
ASTContext & getContext()
T castAs() const
Convert to the specified SVal type, asserting that this SVal is of the desired type.
BasicValueFactory & getBasicValueFactory()
SubRegion - A region that subsets another larger region.
const ElementRegion * MakeElementRegion(const SubRegion *baseRegion, QualType pointeeTy, uint64_t index=0)
SVal CastRetrievedVal(SVal val, const TypedValueRegion *region, QualType castTy)
CastRetrievedVal - Used by subclasses of StoreManager to implement implicit casts that arise from loa...
MemRegionManager & MRMgr
MRMgr - Manages region objects associated with this StoreManager.
bool isIncompleteType(NamedDecl **Def=nullptr) const
Types are partitioned into 3 broad categories (C99 6.2.5p1): object types, function types...
virtual SVal getLValueElement(QualType elementType, NonLoc offset, SVal Base)
CanQualType getCanonicalType(QualType T) const
Return the canonical (structural) type corresponding to the specified potentially non-canonical type ...
Defines the C++ Decl subclasses, other than those for templates (found in DeclTemplate.h) and friends (in DeclFriend.h).
static const CXXRecordDecl * getCXXRecordType(const MemRegion *MR)
Returns the static type of the given region, if it represents a C++ class object. ...
Represents a C++ struct/union/class.
ObjCIvarDecl - Represents an ObjC instance variable.
ElementRegion is used to represent both array elements and casts.
bool isPointerType() const
BasePaths - Represents the set of paths from a derived class to one of its (direct or indirect) bases...
CharUnits getTypeSizeInChars(QualType T) const
Return the size of the specified (complete) type T, in characters.
bool isFloatingType() const
StoreManager(ProgramStateManager &stateMgr)
const FieldRegion * getFieldRegion(const FieldDecl *fd, const SubRegion *superRegion)
getFieldRegion - Retrieve or create the memory region associated with a specified FieldDecl...
bool isUnknownOrUndef() const