ExprEngine.h revision 9dc5167e4017ef4c8b327abb6f72225eec2e0f19
1d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidis//===-- ExprEngine.h - Path-Sensitive Expression-Level Dataflow ---*- C++ -*-=// 277349cb20bfd7069d081f84c91975bfa8ef60a32Ted Kremenek// 377349cb20bfd7069d081f84c91975bfa8ef60a32Ted Kremenek// The LLVM Compiler Infrastructure 477349cb20bfd7069d081f84c91975bfa8ef60a32Ted Kremenek// 577349cb20bfd7069d081f84c91975bfa8ef60a32Ted Kremenek// This file is distributed under the University of Illinois Open Source 677349cb20bfd7069d081f84c91975bfa8ef60a32Ted Kremenek// License. See LICENSE.TXT for details. 777349cb20bfd7069d081f84c91975bfa8ef60a32Ted Kremenek// 877349cb20bfd7069d081f84c91975bfa8ef60a32Ted Kremenek//===----------------------------------------------------------------------===// 977349cb20bfd7069d081f84c91975bfa8ef60a32Ted Kremenek// 10b387a3f23e423d62c053be86294b703da1d1a222Ted Kremenek// This file defines a meta-engine for path-sensitive dataflow analysis that 11d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidis// is built on CoreEngine, but provides the boilerplate to execute transfer 12b387a3f23e423d62c053be86294b703da1d1a222Ted Kremenek// functions and build the ExplodedGraph at the expression level. 1377349cb20bfd7069d081f84c91975bfa8ef60a32Ted Kremenek// 1477349cb20bfd7069d081f84c91975bfa8ef60a32Ted Kremenek//===----------------------------------------------------------------------===// 1577349cb20bfd7069d081f84c91975bfa8ef60a32Ted Kremenek 16d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidis#ifndef LLVM_CLANG_GR_EXPRENGINE 17d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidis#define LLVM_CLANG_GR_EXPRENGINE 18d065d6080f0620bb80b933f3f5d52d37bb2ea770Ted Kremenek 199b663716449b618ba0390b1dbebc54fa8e971124Ted Kremenek#include "clang/StaticAnalyzer/Core/PathSensitive/AnalysisManager.h" 209b663716449b618ba0390b1dbebc54fa8e971124Ted Kremenek#include "clang/StaticAnalyzer/Core/PathSensitive/SubEngine.h" 219b663716449b618ba0390b1dbebc54fa8e971124Ted Kremenek#include "clang/StaticAnalyzer/Core/PathSensitive/CoreEngine.h" 2218c66fdc3c4008d335885695fe36fb5353c5f672Ted Kremenek#include "clang/StaticAnalyzer/Core/PathSensitive/ProgramState.h" 235903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks#include "clang/StaticAnalyzer/Core/PathSensitive/ProgramStateTrait.h" 249b663716449b618ba0390b1dbebc54fa8e971124Ted Kremenek#include "clang/StaticAnalyzer/Core/BugReporter/BugReporter.h" 25c35fb7d67d515659ad2325b4f6ec97c9fe64fb63Benjamin Kramer#include "clang/AST/Expr.h" 26c0c3f5dbc9e78aa53a86c7d5e3eeda23ddad93d6Ted Kremenek#include "clang/AST/Type.h" 2777349cb20bfd7069d081f84c91975bfa8ef60a32Ted Kremenek 281eb4433ac451dc16f4133a88af2d002ac26c58efMike Stumpnamespace clang { 295a4f98ff943e6a501b0fe47ade007c9bbf96cb88Argyrios Kyrtzidis 301d26f48dc2eea1c07431ca1519d7034a21b9bcffTed Kremenekclass AnalysisDeclContextManager; 31337e4dbc6859589b8878146a88bebf754e916702Ted Kremenekclass CXXCatchStmt; 32c35fb7d67d515659ad2325b4f6ec97c9fe64fb63Benjamin Kramerclass CXXConstructExpr; 33c35fb7d67d515659ad2325b4f6ec97c9fe64fb63Benjamin Kramerclass CXXDeleteExpr; 34c35fb7d67d515659ad2325b4f6ec97c9fe64fb63Benjamin Kramerclass CXXNewExpr; 35c35fb7d67d515659ad2325b4f6ec97c9fe64fb63Benjamin Kramerclass CXXTemporaryObjectExpr; 36c35fb7d67d515659ad2325b4f6ec97c9fe64fb63Benjamin Kramerclass CXXThisExpr; 37c35fb7d67d515659ad2325b4f6ec97c9fe64fb63Benjamin Kramerclass MaterializeTemporaryExpr; 38c35fb7d67d515659ad2325b4f6ec97c9fe64fb63Benjamin Kramerclass ObjCAtSynchronizedStmt; 395a4f98ff943e6a501b0fe47ade007c9bbf96cb88Argyrios Kyrtzidisclass ObjCForCollectionStmt; 40b1b5daf30d2597e066936772bd206500232d7d65Ted Kremenek 419ef6537a894c33003359b1f9b9676e9178e028b7Ted Kremeneknamespace ento { 425a4f98ff943e6a501b0fe47ade007c9bbf96cb88Argyrios Kyrtzidis 435e2d2c2ee3cf410643e0f9a5701708e51409d973Benjamin Kramerclass AnalysisManager; 44740d490593e0de8732a697c9f77b90ddd463863bJordan Roseclass CallEvent; 4569f87c956b3ac2b80124fd9604af012e1061473aJordan Roseclass SimpleCall; 46cde8cdbd6a662c636164465ad309b5f17ff01064Jordan Roseclass ObjCMethodCall; 47f494b579b22f9950f5af021f0bf9879a91bb8b41Steve Naroff 48d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidisclass ExprEngine : public SubEngine { 4925e695b2d574d919cc1bbddf3a2efe073d449b1cZhongxing Xu AnalysisManager &AMgr; 50b1b5daf30d2597e066936772bd206500232d7d65Ted Kremenek 511d26f48dc2eea1c07431ca1519d7034a21b9bcffTed Kremenek AnalysisDeclContextManager &AnalysisDeclContexts; 5225e695b2d574d919cc1bbddf3a2efe073d449b1cZhongxing Xu 53d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidis CoreEngine Engine; 541eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 55b387a3f23e423d62c053be86294b703da1d1a222Ted Kremenek /// G - the simulation graph. 56031ccc0555a82afc2e8afe29e19dd57ff204e2deZhongxing Xu ExplodedGraph& G; 571eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 58b387a3f23e423d62c053be86294b703da1d1a222Ted Kremenek /// StateMgr - Object that manages the data for all created states. 5918c66fdc3c4008d335885695fe36fb5353c5f672Ted Kremenek ProgramStateManager StateMgr; 60cf118d41f7930a18dce97416ef7834a62642f587Ted Kremenek 61b387a3f23e423d62c053be86294b703da1d1a222Ted Kremenek /// SymMgr - Object that manages the symbol information. 62b387a3f23e423d62c053be86294b703da1d1a222Ted Kremenek SymbolManager& SymMgr; 631eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 64846eabd187be4bfe992e8bca131166b734d86e0dTed Kremenek /// svalBuilder - SValBuilder object that creates SVals from expressions. 65846eabd187be4bfe992e8bca131166b734d86e0dTed Kremenek SValBuilder &svalBuilder; 661eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 67846d4e923bf11bcdc2816758aafa331795f29230Ted Kremenek /// EntryNode - The immediate predecessor node. 689c378f705405d37f49795d5e915989de774fe11fTed Kremenek ExplodedNode *EntryNode; 69846d4e923bf11bcdc2816758aafa331795f29230Ted Kremenek 70846d4e923bf11bcdc2816758aafa331795f29230Ted Kremenek /// CleanedState - The state for EntryNode "cleaned" of all dead 710d093d3005dd583675a45a85bd688063572cc8afTed Kremenek /// variables and symbols (as determined by a liveness analysis). 728bef8238181a30e52dea380789a7e2d760eac532Ted Kremenek ProgramStateRef CleanedState; 731eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 740a3ed3143b00f237decb1288c1ff574ae09eba4eTed Kremenek /// currentStmt - The current block-level statement. 759c378f705405d37f49795d5e915989de774fe11fTed Kremenek const Stmt *currentStmt; 768ad8c546372fe602708cb7ceeaf0ebbb866735c6Anna Zaks unsigned int currentStmtIdx; 778ad8c546372fe602708cb7ceeaf0ebbb866735c6Anna Zaks const NodeBuilderContext *currentBuilderContext; 781eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 79a81fffe678107d49a9f1c03d80adf85f18a9867fAnna Zaks /// Obj-C Class Identifiers. 80e448ab4f9dd162802f5d7cfea60f7830cc61c654Ted Kremenek IdentifierInfo* NSExceptionII; 811eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 82a81fffe678107d49a9f1c03d80adf85f18a9867fAnna Zaks /// Obj-C Selectors. 83e448ab4f9dd162802f5d7cfea60f7830cc61c654Ted Kremenek Selector* NSExceptionInstanceRaiseSelectors; 84e448ab4f9dd162802f5d7cfea60f7830cc61c654Ted Kremenek Selector RaiseSel; 8517a38e2636a8b1ce473fc6504c4b16cb09db29f4Jordy Rose 8617a38e2636a8b1ce473fc6504c4b16cb09db29f4Jordy Rose /// Whether or not GC is enabled in this analysis. 8717a38e2636a8b1ce473fc6504c4b16cb09db29f4Jordy Rose bool ObjCGCEnabled; 881eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 899e9595b12e9b55586c4d50d370f429c7a3c92a90Ted Kremenek /// The BugReporter associated with this engine. It is important that 909e9595b12e9b55586c4d50d370f429c7a3c92a90Ted Kremenek /// this object be placed at the very end of member variables so that its 91d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidis /// destructor is called before the rest of the ExprEngine is destroyed. 92cf118d41f7930a18dce97416ef7834a62642f587Ted Kremenek GRBugReporter BR; 931eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 94b22d589e2ccd09cada0bcea136f0966883a8bb11Ted Kremenekpublic: 956a86082f3a06a2dcceaaf63f78a0e52d64bcbaa3Anna Zaks ExprEngine(AnalysisManager &mgr, bool gcEnabled, 966a86082f3a06a2dcceaaf63f78a0e52d64bcbaa3Anna Zaks SetOfConstDecls *VisitedCallees, 973bbd8cd831788c506f2980293eb3c7e1b3ca2501Anna Zaks FunctionSummariesTy *FS); 98cf118d41f7930a18dce97416ef7834a62642f587Ted Kremenek 99d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidis ~ExprEngine(); 1001eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 101253955ca25c7e7049963b5db613c0cd15d66e4f8Anna Zaks /// Returns true if there is still simulation state on the worklist. 102253955ca25c7e7049963b5db613c0cd15d66e4f8Anna Zaks bool ExecuteWorkList(const LocationContext *L, unsigned Steps = 150000) { 103253955ca25c7e7049963b5db613c0cd15d66e4f8Anna Zaks return Engine.ExecuteWorkList(L, Steps, 0); 1042ce43c8f43254a9edea53a20dc0e69195bc82ae0Zhongxing Xu } 1052ce43c8f43254a9edea53a20dc0e69195bc82ae0Zhongxing Xu 1062ce43c8f43254a9edea53a20dc0e69195bc82ae0Zhongxing Xu /// Execute the work list with an initial state. Nodes that reaches the exit 1072ce43c8f43254a9edea53a20dc0e69195bc82ae0Zhongxing Xu /// of the function are added into the Dst set, which represent the exit 108253955ca25c7e7049963b5db613c0cd15d66e4f8Anna Zaks /// state of the function call. Returns true if there is still simulation 109253955ca25c7e7049963b5db613c0cd15d66e4f8Anna Zaks /// state on the worklist. 110253955ca25c7e7049963b5db613c0cd15d66e4f8Anna Zaks bool ExecuteWorkListWithInitialState(const LocationContext *L, unsigned Steps, 1118bef8238181a30e52dea380789a7e2d760eac532Ted Kremenek ProgramStateRef InitState, 1122ce43c8f43254a9edea53a20dc0e69195bc82ae0Zhongxing Xu ExplodedNodeSet &Dst) { 113253955ca25c7e7049963b5db613c0cd15d66e4f8Anna Zaks return Engine.ExecuteWorkListWithInitialState(L, Steps, InitState, Dst); 114b387a3f23e423d62c053be86294b703da1d1a222Ted Kremenek } 1151eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 116b387a3f23e423d62c053be86294b703da1d1a222Ted Kremenek /// getContext - Return the ASTContext associated with this analysis. 1179c378f705405d37f49795d5e915989de774fe11fTed Kremenek ASTContext &getContext() const { return AMgr.getASTContext(); } 1185032ffe4259e7d436f2eb19e5a29fdae559e7c12Zhongxing Xu 1192ce43c8f43254a9edea53a20dc0e69195bc82ae0Zhongxing Xu virtual AnalysisManager &getAnalysisManager() { return AMgr; } 1201eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 121769ce3e93ad35bd9ac28e4d8b8f035ae4fd9a5b5Argyrios Kyrtzidis CheckerManager &getCheckerManager() const { 122769ce3e93ad35bd9ac28e4d8b8f035ae4fd9a5b5Argyrios Kyrtzidis return *AMgr.getCheckerManager(); 123769ce3e93ad35bd9ac28e4d8b8f035ae4fd9a5b5Argyrios Kyrtzidis } 124769ce3e93ad35bd9ac28e4d8b8f035ae4fd9a5b5Argyrios Kyrtzidis 125846eabd187be4bfe992e8bca131166b734d86e0dTed Kremenek SValBuilder &getSValBuilder() { return svalBuilder; } 1261eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 127cf118d41f7930a18dce97416ef7834a62642f587Ted Kremenek BugReporter& getBugReporter() { return BR; } 1281eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1291aae01a8308d2f8e31adab3f4d7ac35543aac680Anna Zaks const NodeBuilderContext &getBuilderContext() { 130ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks assert(currentBuilderContext); 131ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks return *currentBuilderContext; 1321aae01a8308d2f8e31adab3f4d7ac35543aac680Anna Zaks } 133ec9227fea66c3439991fc84b0d33b0a8b4b8875eZhongxing Xu 13417a38e2636a8b1ce473fc6504c4b16cb09db29f4Jordy Rose bool isObjCGCEnabled() { return ObjCGCEnabled; } 1351eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 136ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks const Stmt *getStmt() const; 137ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks 138ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks void GenerateAutoTransition(ExplodedNode *N); 139af498a28797c075c48d7e943df5f5a8e78ed8eb0Anna Zaks void enqueueEndOfPath(ExplodedNodeSet &S); 140af498a28797c075c48d7e943df5f5a8e78ed8eb0Anna Zaks void GenerateCallExitNode(ExplodedNode *N); 141ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks 142e01c98767dfd7153c3c84637c36659e3bbe16ff7Ted Kremenek /// ViewGraph - Visualize the ExplodedGraph created by executing the 143e01c98767dfd7153c3c84637c36659e3bbe16ff7Ted Kremenek /// simulation. 144ffe0f43806d4823271c2406c1fccc2373115c36aTed Kremenek void ViewGraph(bool trim = false); 1451eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 146031ccc0555a82afc2e8afe29e19dd57ff204e2deZhongxing Xu void ViewGraph(ExplodedNode** Beg, ExplodedNode** End); 1471eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 148b387a3f23e423d62c053be86294b703da1d1a222Ted Kremenek /// getInitialState - Return the initial state used for the root vertex 149b387a3f23e423d62c053be86294b703da1d1a222Ted Kremenek /// in the ExplodedGraph. 1508bef8238181a30e52dea380789a7e2d760eac532Ted Kremenek ProgramStateRef getInitialState(const LocationContext *InitLoc); 1511eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 152031ccc0555a82afc2e8afe29e19dd57ff204e2deZhongxing Xu ExplodedGraph& getGraph() { return G; } 153031ccc0555a82afc2e8afe29e19dd57ff204e2deZhongxing Xu const ExplodedGraph& getGraph() const { return G; } 15450a6d0ce344c02782e0207574005c3b2aaa5077cTed Kremenek 1550b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks /// \brief Run the analyzer's garbage collection - remove dead symbols and 1560b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks /// bindings. 1570b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks /// 1580b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks /// \param Node - The predecessor node, from which the processing should 1590b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks /// start. 1600b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks /// \param Out - The returned set of output nodes. 1610b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks /// \param ReferenceStmt - Run garbage collection using the symbols, 1620b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks /// which are live before the given statement. 1630b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks /// \param LC - The location context of the ReferenceStmt. 1640b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks /// \param DiagnosticStmt - the statement used to associate the diagnostic 1650b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks /// message, if any warnings should occur while removing the dead (leaks 1660b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks /// are usually reported here). 1670b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks /// \param K - In some cases it is possible to use PreStmt kind. (Do 1680b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks /// not use it unless you know what you are doing.) 1690b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks void removeDead(ExplodedNode *Node, ExplodedNodeSet &Out, 1700b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks const Stmt *ReferenceStmt, const LocationContext *LC, 1710b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks const Stmt *DiagnosticStmt, 1720b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks ProgramPoint::Kind K = ProgramPoint::PreStmtPurgeDeadSymbolsKind); 1730b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks 174e36de1fe51c39d9161915dd3dbef880954af6476Ted Kremenek /// processCFGElement - Called by CoreEngine. Used to generate new successor 1759c6cd67ea416bace666d614c84d5531124287653Zhongxing Xu /// nodes by processing the 'effects' of a CFG element. 176ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks void processCFGElement(const CFGElement E, ExplodedNode *Pred, 177ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks unsigned StmtIdx, NodeBuilderContext *Ctx); 1789c6cd67ea416bace666d614c84d5531124287653Zhongxing Xu 179ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks void ProcessStmt(const CFGStmt S, ExplodedNode *Pred); 1809c6cd67ea416bace666d614c84d5531124287653Zhongxing Xu 181ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks void ProcessInitializer(const CFGInitializer I, ExplodedNode *Pred); 1829c6cd67ea416bace666d614c84d5531124287653Zhongxing Xu 183ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks void ProcessImplicitDtor(const CFGImplicitDtor D, ExplodedNode *Pred); 1841eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1854ffcb9974c6b7142c4a1483abfcb1f88b6371c45Zhongxing Xu void ProcessAutomaticObjDtor(const CFGAutomaticObjDtor D, 186056c4b46335a3bd2612414735d5749ee159c0165Anna Zaks ExplodedNode *Pred, ExplodedNodeSet &Dst); 187056c4b46335a3bd2612414735d5749ee159c0165Anna Zaks void ProcessBaseDtor(const CFGBaseDtor D, 188056c4b46335a3bd2612414735d5749ee159c0165Anna Zaks ExplodedNode *Pred, ExplodedNodeSet &Dst); 189056c4b46335a3bd2612414735d5749ee159c0165Anna Zaks void ProcessMemberDtor(const CFGMemberDtor D, 190056c4b46335a3bd2612414735d5749ee159c0165Anna Zaks ExplodedNode *Pred, ExplodedNodeSet &Dst); 1914ffcb9974c6b7142c4a1483abfcb1f88b6371c45Zhongxing Xu void ProcessTemporaryDtor(const CFGTemporaryDtor D, 192056c4b46335a3bd2612414735d5749ee159c0165Anna Zaks ExplodedNode *Pred, ExplodedNodeSet &Dst); 1934ffcb9974c6b7142c4a1483abfcb1f88b6371c45Zhongxing Xu 19427c54e57c4a012dcdf2b40cf985b70d0b9caa69eTed Kremenek /// Called by CoreEngine when processing the entrance of a CFGBlock. 195253955ca25c7e7049963b5db613c0cd15d66e4f8Anna Zaks virtual void processCFGBlockEntrance(const BlockEdge &L, 196253955ca25c7e7049963b5db613c0cd15d66e4f8Anna Zaks NodeBuilderWithSinks &nodeBuilder); 19727c54e57c4a012dcdf2b40cf985b70d0b9caa69eTed Kremenek 198d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidis /// ProcessBranch - Called by CoreEngine. Used to generate successor 199b387a3f23e423d62c053be86294b703da1d1a222Ted Kremenek /// nodes by processing the 'effects' of a branch condition. 2009c378f705405d37f49795d5e915989de774fe11fTed Kremenek void processBranch(const Stmt *Condition, const Stmt *Term, 201a19f4af7a94835ce4693bfe12d6270754e79eb56Anna Zaks NodeBuilderContext& BuilderCtx, 202ad62deeb70e97da6bd514dd390ea1ce6af6ad81dAnna Zaks ExplodedNode *Pred, 2031aae01a8308d2f8e31adab3f4d7ac35543aac680Anna Zaks ExplodedNodeSet &Dst, 204a19f4af7a94835ce4693bfe12d6270754e79eb56Anna Zaks const CFGBlock *DstT, 205a19f4af7a94835ce4693bfe12d6270754e79eb56Anna Zaks const CFGBlock *DstF); 2061eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 207e36de1fe51c39d9161915dd3dbef880954af6476Ted Kremenek /// processIndirectGoto - Called by CoreEngine. Used to generate successor 208b387a3f23e423d62c053be86294b703da1d1a222Ted Kremenek /// nodes by processing the 'effects' of a computed goto jump. 209e36de1fe51c39d9161915dd3dbef880954af6476Ted Kremenek void processIndirectGoto(IndirectGotoNodeBuilder& builder); 2101eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 211d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidis /// ProcessSwitch - Called by CoreEngine. Used to generate successor 212b387a3f23e423d62c053be86294b703da1d1a222Ted Kremenek /// nodes by processing the 'effects' of a switch statement. 213e36de1fe51c39d9161915dd3dbef880954af6476Ted Kremenek void processSwitch(SwitchNodeBuilder& builder); 2141eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 215d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidis /// ProcessEndPath - Called by CoreEngine. Used to generate end-of-path 21611062b118476368fa5b294954713e5df97d8599fTed Kremenek /// nodes when the control reaches the end of a function. 217af498a28797c075c48d7e943df5f5a8e78ed8eb0Anna Zaks void processEndOfFunction(NodeBuilderContext& BC); 218102acd5369bbb17c0d6ab868af376671acff7a93Douglas Gregor 219ccc263b44c62ce3a02f797a3ddb3d6017cf0e5e4Ted Kremenek /// Generate the entry node of the callee. 2203070e13dca5bbefa32acb80ce4a7b217a6220983Ted Kremenek void processCallEnter(CallEnter CE, ExplodedNode *Pred); 221102acd5369bbb17c0d6ab868af376671acff7a93Douglas Gregor 2220b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks /// Generate the sequence of nodes that simulate the call exit and the post 2230b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks /// visit for CallExpr. 224894212e9510299abb203801e014fec76b7926a05Ted Kremenek void processCallExit(ExplodedNode *Pred); 225102acd5369bbb17c0d6ab868af376671acff7a93Douglas Gregor 226d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidis /// Called by CoreEngine when the analysis worklist has terminated. 227e36de1fe51c39d9161915dd3dbef880954af6476Ted Kremenek void processEndWorklist(bool hasWorkRemaining); 228ccc263b44c62ce3a02f797a3ddb3d6017cf0e5e4Ted Kremenek 2299c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek /// evalAssume - Callback function invoked by the ConstraintManager when 23032a58084a4c53e6938dd81bfce224db25a5976d1Ted Kremenek /// making assumptions about state values. 2318bef8238181a30e52dea380789a7e2d760eac532Ted Kremenek ProgramStateRef processAssume(ProgramStateRef state, SVal cond,bool assumption); 2321eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 23318c66fdc3c4008d335885695fe36fb5353c5f672Ted Kremenek /// wantsRegionChangeUpdate - Called by ProgramStateManager to determine if a 234e36de1fe51c39d9161915dd3dbef880954af6476Ted Kremenek /// region change should trigger a processRegionChanges update. 2358bef8238181a30e52dea380789a7e2d760eac532Ted Kremenek bool wantsRegionChangeUpdate(ProgramStateRef state); 236c2b7dfaad674587cfd220ff447b3710d252130c3Jordy Rose 23718c66fdc3c4008d335885695fe36fb5353c5f672Ted Kremenek /// processRegionChanges - Called by ProgramStateManager whenever a change is made 238c2b7dfaad674587cfd220ff447b3710d252130c3Jordy Rose /// to the store. Used to update checkers that track region values. 2398bef8238181a30e52dea380789a7e2d760eac532Ted Kremenek ProgramStateRef 2408bef8238181a30e52dea380789a7e2d760eac532Ted Kremenek processRegionChanges(ProgramStateRef state, 24135bdbf40624beba3fc00cb72ab444659939c1a6bTed Kremenek const StoreManager::InvalidatedSymbols *invalidated, 242537716ad8dd10f984b6cfe6985afade1185c5e3cJordy Rose ArrayRef<const MemRegion *> ExplicitRegions, 24366c40400e7d6272b0cd675ada18dd62c1f0362c7Anna Zaks ArrayRef<const MemRegion *> Regions, 244740d490593e0de8732a697c9f77b90ddd463863bJordan Rose const CallEvent *Call); 245c2b7dfaad674587cfd220ff447b3710d252130c3Jordy Rose 246dbd658e139b3e0bf084f75feaea8d844af9e319fJordy Rose /// printState - Called by ProgramStateManager to print checker-specific data. 2478bef8238181a30e52dea380789a7e2d760eac532Ted Kremenek void printState(raw_ostream &Out, ProgramStateRef State, 248dbd658e139b3e0bf084f75feaea8d844af9e319fJordy Rose const char *NL, const char *Sep); 249dbd658e139b3e0bf084f75feaea8d844af9e319fJordy Rose 25018c66fdc3c4008d335885695fe36fb5353c5f672Ted Kremenek virtual ProgramStateManager& getStateManager() { return StateMgr; } 25190e72e4106a0c3efa7575e9f9cba0c775bb54552Zhongxing Xu 25290e72e4106a0c3efa7575e9f9cba0c775bb54552Zhongxing Xu StoreManager& getStoreManager() { return StateMgr.getStoreManager(); } 2531eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 254a516ce16b472e61924f5dd10d181c3e8330979afTed Kremenek ConstraintManager& getConstraintManager() { 255a516ce16b472e61924f5dd10d181c3e8330979afTed Kremenek return StateMgr.getConstraintManager(); 256a516ce16b472e61924f5dd10d181c3e8330979afTed Kremenek } 2571eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 258c8413fd03f73084a5c93028f8b4db619fc388087Ted Kremenek // FIXME: Remove when we migrate over to just using SValBuilder. 2596297a8ec313c722db50f686fd190842b7ea91118Ted Kremenek BasicValueFactory& getBasicVals() { 2606297a8ec313c722db50f686fd190842b7ea91118Ted Kremenek return StateMgr.getBasicVals(); 2616297a8ec313c722db50f686fd190842b7ea91118Ted Kremenek } 2626297a8ec313c722db50f686fd190842b7ea91118Ted Kremenek const BasicValueFactory& getBasicVals() const { 2636297a8ec313c722db50f686fd190842b7ea91118Ted Kremenek return StateMgr.getBasicVals(); 2646297a8ec313c722db50f686fd190842b7ea91118Ted Kremenek } 2651eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 266044b6f0417cb98741f277602fabf5f07ec9a02c0Ted Kremenek // FIXME: Remove when we migrate over to just using ValueManager. 26700a3a5f024ac54088ab887712b292171188064f0Ted Kremenek SymbolManager& getSymbolManager() { return SymMgr; } 26800a3a5f024ac54088ab887712b292171188064f0Ted Kremenek const SymbolManager& getSymbolManager() const { return SymMgr; } 2691eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 270bc42c533e7d3d946704a49e242939dd232f33072Tom Care // Functions for external checking of whether we have unfinished work 271422ab7a49a9a4252dbc6350e49d7a5708337b9c7Ted Kremenek bool wasBlocksExhausted() const { return Engine.wasBlocksExhausted(); } 272d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidis bool hasEmptyWorkList() const { return !Engine.getWorkList()->hasWork(); } 273422ab7a49a9a4252dbc6350e49d7a5708337b9c7Ted Kremenek bool hasWorkRemaining() const { return Engine.hasWorkRemaining(); } 274bc42c533e7d3d946704a49e242939dd232f33072Tom Care 275d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidis const CoreEngine &getCoreEngine() const { return Engine; } 276bc42c533e7d3d946704a49e242939dd232f33072Tom Care 2771670e403c48f3af4fceff3f6773a0e1cfc6c4eb3Ted Kremenekpublic: 278b387a3f23e423d62c053be86294b703da1d1a222Ted Kremenek /// Visit - Transfer function logic for all statements. Dispatches to 279b387a3f23e423d62c053be86294b703da1d1a222Ted Kremenek /// other functions that handle specific kinds of statements. 2809c378f705405d37f49795d5e915989de774fe11fTed Kremenek void Visit(const Stmt *S, ExplodedNode *Pred, ExplodedNodeSet &Dst); 2811eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 282c5b1bf10133a8ecbfe9e6b3ec92bae84e3d927e8Ted Kremenek /// VisitArraySubscriptExpr - Transfer function for array accesses. 2839c378f705405d37f49795d5e915989de774fe11fTed Kremenek void VisitLvalArraySubscriptExpr(const ArraySubscriptExpr *Ex, 2849c378f705405d37f49795d5e915989de774fe11fTed Kremenek ExplodedNode *Pred, 2859c378f705405d37f49795d5e915989de774fe11fTed Kremenek ExplodedNodeSet &Dst); 2861eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 287ef44bfb9d0f15ba0391f8346c9f01355fb450a09Ted Kremenek /// VisitAsmStmt - Transfer function logic for inline asm. 2889c378f705405d37f49795d5e915989de774fe11fTed Kremenek void VisitAsmStmt(const AsmStmt *A, ExplodedNode *Pred, ExplodedNodeSet &Dst); 2898cd64b4c5553fa6284d248336cb7c82dc960a394Chad Rosier 2908cd64b4c5553fa6284d248336cb7c82dc960a394Chad Rosier /// VisitMSAsmStmt - Transfer function logic for MS inline asm. 2918cd64b4c5553fa6284d248336cb7c82dc960a394Chad Rosier void VisitMSAsmStmt(const MSAsmStmt *A, ExplodedNode *Pred, 2928cd64b4c5553fa6284d248336cb7c82dc960a394Chad Rosier ExplodedNodeSet &Dst); 293c95ad9ff6e574aecdd759542d5578bc65d586d93Ted Kremenek 294c95ad9ff6e574aecdd759542d5578bc65d586d93Ted Kremenek /// VisitBlockExpr - Transfer function logic for BlockExprs. 29503509aea098772644bf4662dc1c88634818ceeccZhongxing Xu void VisitBlockExpr(const BlockExpr *BE, ExplodedNode *Pred, 29603509aea098772644bf4662dc1c88634818ceeccZhongxing Xu ExplodedNodeSet &Dst); 2971eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 298b387a3f23e423d62c053be86294b703da1d1a222Ted Kremenek /// VisitBinaryOperator - Transfer function logic for binary operators. 2999c378f705405d37f49795d5e915989de774fe11fTed Kremenek void VisitBinaryOperator(const BinaryOperator* B, ExplodedNode *Pred, 3009c378f705405d37f49795d5e915989de774fe11fTed Kremenek ExplodedNodeSet &Dst); 301469ecbded3616416ef938ed94a67f86149faf226Ted Kremenek 3021eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 303de43424560f1a744de6214dab6bbee28ad8437f5Ted Kremenek /// VisitCall - Transfer function for function calls. 3049c378f705405d37f49795d5e915989de774fe11fTed Kremenek void VisitCallExpr(const CallExpr *CE, ExplodedNode *Pred, 3059c378f705405d37f49795d5e915989de774fe11fTed Kremenek ExplodedNodeSet &Dst); 3061eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 307b387a3f23e423d62c053be86294b703da1d1a222Ted Kremenek /// VisitCast - Transfer function logic for all casts (implicit and explicit). 30803509aea098772644bf4662dc1c88634818ceeccZhongxing Xu void VisitCast(const CastExpr *CastE, const Expr *Ex, ExplodedNode *Pred, 309892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek ExplodedNodeSet &Dst); 310e1c2a675e0c089e1f53cbd55d2197a8beaa852aeTed Kremenek 3114f09027385466f1f4c382c80ca77157e2aef97d9Ted Kremenek /// VisitCompoundLiteralExpr - Transfer function logic for compound literals. 3129c378f705405d37f49795d5e915989de774fe11fTed Kremenek void VisitCompoundLiteralExpr(const CompoundLiteralExpr *CL, 3139c378f705405d37f49795d5e915989de774fe11fTed Kremenek ExplodedNode *Pred, ExplodedNodeSet &Dst); 3141eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 315892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek /// Transfer function logic for DeclRefExprs and BlockDeclRefExprs. 3169c378f705405d37f49795d5e915989de774fe11fTed Kremenek void VisitCommonDeclRefExpr(const Expr *DR, const NamedDecl *D, 3179c378f705405d37f49795d5e915989de774fe11fTed Kremenek ExplodedNode *Pred, ExplodedNodeSet &Dst); 31867d1287035767f4f6c8ca0c2bb755990012a44caTed Kremenek 319b387a3f23e423d62c053be86294b703da1d1a222Ted Kremenek /// VisitDeclStmt - Transfer function logic for DeclStmts. 3209c378f705405d37f49795d5e915989de774fe11fTed Kremenek void VisitDeclStmt(const DeclStmt *DS, ExplodedNode *Pred, 3219c378f705405d37f49795d5e915989de774fe11fTed Kremenek ExplodedNodeSet &Dst); 3221eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 323b387a3f23e423d62c053be86294b703da1d1a222Ted Kremenek /// VisitGuardedExpr - Transfer function logic for ?, __builtin_choose 3249c378f705405d37f49795d5e915989de774fe11fTed Kremenek void VisitGuardedExpr(const Expr *Ex, const Expr *L, const Expr *R, 3259c378f705405d37f49795d5e915989de774fe11fTed Kremenek ExplodedNode *Pred, ExplodedNodeSet &Dst); 32661dfbecd8e6181b2ba42ffb5feede27a2bab3b8aTed Kremenek 3279c378f705405d37f49795d5e915989de774fe11fTed Kremenek void VisitInitListExpr(const InitListExpr *E, ExplodedNode *Pred, 3289c378f705405d37f49795d5e915989de774fe11fTed Kremenek ExplodedNodeSet &Dst); 329c4f8706b6539e06a5de153bd72850bb2e0a71456Zhongxing Xu 330b387a3f23e423d62c053be86294b703da1d1a222Ted Kremenek /// VisitLogicalExpr - Transfer function logic for '&&', '||' 3319c378f705405d37f49795d5e915989de774fe11fTed Kremenek void VisitLogicalExpr(const BinaryOperator* B, ExplodedNode *Pred, 3329c378f705405d37f49795d5e915989de774fe11fTed Kremenek ExplodedNodeSet &Dst); 3331eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 334469ecbded3616416ef938ed94a67f86149faf226Ted Kremenek /// VisitMemberExpr - Transfer function for member expressions. 3359c378f705405d37f49795d5e915989de774fe11fTed Kremenek void VisitMemberExpr(const MemberExpr *M, ExplodedNode *Pred, 3369c378f705405d37f49795d5e915989de774fe11fTed Kremenek ExplodedNodeSet &Dst); 3371eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 3384beaa9f51b2da57c64740cef2bd1c2fdb0c325d5Ted Kremenek /// Transfer function logic for ObjCAtSynchronizedStmts. 3394beaa9f51b2da57c64740cef2bd1c2fdb0c325d5Ted Kremenek void VisitObjCAtSynchronizedStmt(const ObjCAtSynchronizedStmt *S, 3404beaa9f51b2da57c64740cef2bd1c2fdb0c325d5Ted Kremenek ExplodedNode *Pred, ExplodedNodeSet &Dst); 3414beaa9f51b2da57c64740cef2bd1c2fdb0c325d5Ted Kremenek 342892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek /// Transfer function logic for computing the lvalue of an Objective-C ivar. 3439c378f705405d37f49795d5e915989de774fe11fTed Kremenek void VisitLvalObjCIvarRefExpr(const ObjCIvarRefExpr *DR, ExplodedNode *Pred, 3449c378f705405d37f49795d5e915989de774fe11fTed Kremenek ExplodedNodeSet &Dst); 345af3374187c47acea45706eab6744be6b1c66a856Ted Kremenek 346af3374187c47acea45706eab6744be6b1c66a856Ted Kremenek /// VisitObjCForCollectionStmt - Transfer function logic for 347af3374187c47acea45706eab6744be6b1c66a856Ted Kremenek /// ObjCForCollectionStmt. 3489c378f705405d37f49795d5e915989de774fe11fTed Kremenek void VisitObjCForCollectionStmt(const ObjCForCollectionStmt *S, 3499c378f705405d37f49795d5e915989de774fe11fTed Kremenek ExplodedNode *Pred, ExplodedNodeSet &Dst); 3501eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 351cde8cdbd6a662c636164465ad309b5f17ff01064Jordan Rose void VisitObjCMessage(const ObjCMethodCall &Msg, ExplodedNode *Pred, 3529c378f705405d37f49795d5e915989de774fe11fTed Kremenek ExplodedNodeSet &Dst); 3531eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 35402737ed29d7fff2206f7c7ee958cdf0665e35542Ted Kremenek /// VisitReturnStmt - Transfer function logic for return statements. 3559c378f705405d37f49795d5e915989de774fe11fTed Kremenek void VisitReturnStmt(const ReturnStmt *R, ExplodedNode *Pred, 3569c378f705405d37f49795d5e915989de774fe11fTed Kremenek ExplodedNodeSet &Dst); 3578ecdb65716cd7914ffb2eeee993fa9039fcd31e8Douglas Gregor 3588ecdb65716cd7914ffb2eeee993fa9039fcd31e8Douglas Gregor /// VisitOffsetOfExpr - Transfer function for offsetof. 3599c378f705405d37f49795d5e915989de774fe11fTed Kremenek void VisitOffsetOfExpr(const OffsetOfExpr *Ex, ExplodedNode *Pred, 3609c378f705405d37f49795d5e915989de774fe11fTed Kremenek ExplodedNodeSet &Dst); 3611eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 362f4e3cfbe8abd124be6341ef5d714819b4fbd9082Peter Collingbourne /// VisitUnaryExprOrTypeTraitExpr - Transfer function for sizeof. 3639c378f705405d37f49795d5e915989de774fe11fTed Kremenek void VisitUnaryExprOrTypeTraitExpr(const UnaryExprOrTypeTraitExpr *Ex, 3649c378f705405d37f49795d5e915989de774fe11fTed Kremenek ExplodedNode *Pred, ExplodedNodeSet &Dst); 3651eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 366b387a3f23e423d62c053be86294b703da1d1a222Ted Kremenek /// VisitUnaryOperator - Transfer function logic for unary operators. 3679c378f705405d37f49795d5e915989de774fe11fTed Kremenek void VisitUnaryOperator(const UnaryOperator* B, ExplodedNode *Pred, 3689c378f705405d37f49795d5e915989de774fe11fTed Kremenek ExplodedNodeSet &Dst); 369bb141217871e93767aa3f2de1b9946fa6d37066aZhongxing Xu 3708ad8c546372fe602708cb7ceeaf0ebbb866735c6Anna Zaks /// Handle ++ and -- (both pre- and post-increment). 3718ad8c546372fe602708cb7ceeaf0ebbb866735c6Anna Zaks void VisitIncrementDecrementOperator(const UnaryOperator* U, 3728ad8c546372fe602708cb7ceeaf0ebbb866735c6Anna Zaks ExplodedNode *Pred, 3738ad8c546372fe602708cb7ceeaf0ebbb866735c6Anna Zaks ExplodedNodeSet &Dst); 374337e4dbc6859589b8878146a88bebf754e916702Ted Kremenek 375337e4dbc6859589b8878146a88bebf754e916702Ted Kremenek void VisitCXXCatchStmt(const CXXCatchStmt *CS, ExplodedNode *Pred, 376337e4dbc6859589b8878146a88bebf754e916702Ted Kremenek ExplodedNodeSet &Dst); 3778ad8c546372fe602708cb7ceeaf0ebbb866735c6Anna Zaks 37803509aea098772644bf4662dc1c88634818ceeccZhongxing Xu void VisitCXXThisExpr(const CXXThisExpr *TE, ExplodedNode *Pred, 379bb141217871e93767aa3f2de1b9946fa6d37066aZhongxing Xu ExplodedNodeSet & Dst); 380d706434b0231c76fd9acf30060646a7aa8f69aefZhongxing Xu 3817ce351db56fbce162a3b650518ce05b5c61ebf36Zhongxing Xu void VisitCXXConstructExpr(const CXXConstructExpr *E, const MemRegion *Dest, 382892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek ExplodedNode *Pred, ExplodedNodeSet &Dst); 383950db87e5efe2ff0c7234116929f8637aaf7ae7aZhongxing Xu 384b13453bd8a91f331d0910ca95ad52aa41b52f648Zhongxing Xu void VisitCXXDestructor(const CXXDestructorDecl *DD, 385b13453bd8a91f331d0910ca95ad52aa41b52f648Zhongxing Xu const MemRegion *Dest, const Stmt *S, 386b13453bd8a91f331d0910ca95ad52aa41b52f648Zhongxing Xu ExplodedNode *Pred, ExplodedNodeSet &Dst); 387b13453bd8a91f331d0910ca95ad52aa41b52f648Zhongxing Xu 38803509aea098772644bf4662dc1c88634818ceeccZhongxing Xu void VisitCXXNewExpr(const CXXNewExpr *CNE, ExplodedNode *Pred, 389856c6bcaea56e05255e9f3997ddd56b5c18a14f0Zhongxing Xu ExplodedNodeSet &Dst); 390856c6bcaea56e05255e9f3997ddd56b5c18a14f0Zhongxing Xu 39103509aea098772644bf4662dc1c88634818ceeccZhongxing Xu void VisitCXXDeleteExpr(const CXXDeleteExpr *CDE, ExplodedNode *Pred, 3926b8513829895e56a7b97e787ea74520bc626512eZhongxing Xu ExplodedNodeSet &Dst); 3936b8513829895e56a7b97e787ea74520bc626512eZhongxing Xu 394bc37b8dd9914e02580f531fa6e5e72be34d9675eZhongxing Xu /// Create a C++ temporary object for an rvalue. 395eea72a925f294225391ecec876a342771c09b635Ted Kremenek void CreateCXXTemporaryObject(const MaterializeTemporaryExpr *ME, 396eea72a925f294225391ecec876a342771c09b635Ted Kremenek ExplodedNode *Pred, 397bc37b8dd9914e02580f531fa6e5e72be34d9675eZhongxing Xu ExplodedNodeSet &Dst); 398b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek 3999c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek /// evalEagerlyAssume - Given the nodes in 'Src', eagerly assume symbolic 40048af2a9c1ed3259512f2d1431720add1fbe8fb5fTed Kremenek /// expressions of the form 'x != 0' and generate new nodes (stored in Dst) 40148af2a9c1ed3259512f2d1431720add1fbe8fb5fTed Kremenek /// with those assumptions. 4029c378f705405d37f49795d5e915989de774fe11fTed Kremenek void evalEagerlyAssume(ExplodedNodeSet &Dst, ExplodedNodeSet &Src, 40303509aea098772644bf4662dc1c88634818ceeccZhongxing Xu const Expr *Ex); 4046c7511db998817e64f2e124013e7d7c9a430c580Ted Kremenek 4056c7511db998817e64f2e124013e7d7c9a430c580Ted Kremenek std::pair<const ProgramPointTag *, const ProgramPointTag*> 4066c7511db998817e64f2e124013e7d7c9a430c580Ted Kremenek getEagerlyAssumeTags(); 4071eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 4089c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek SVal evalMinus(SVal X) { 4099c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek return X.isValid() ? svalBuilder.evalMinus(cast<NonLoc>(X)) : X; 410b387a3f23e423d62c053be86294b703da1d1a222Ted Kremenek } 4111eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 4129c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek SVal evalComplement(SVal X) { 4139c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek return X.isValid() ? svalBuilder.evalComplement(cast<NonLoc>(X)) : X; 41490e420321f60860f4c4e7a68ca9f7567824b46ecTed Kremenek } 415248072a8b9cd956c4ac63172fc2af09790f7c6a9Zhongxing Xu 4161670e403c48f3af4fceff3f6773a0e1cfc6c4eb3Ted Kremenekpublic: 4171eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 4188bef8238181a30e52dea380789a7e2d760eac532Ted Kremenek SVal evalBinOp(ProgramStateRef state, BinaryOperator::Opcode op, 419cd8f6ac9b613e1fe962ebf9c87d822ce765275e6Ted Kremenek NonLoc L, NonLoc R, QualType T) { 4209c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek return svalBuilder.evalBinOpNN(state, op, L, R, T); 4216297a8ec313c722db50f686fd190842b7ea91118Ted Kremenek } 42210c16657eec144def180ee53d1e0249c9ed2b3b5Ted Kremenek 4238bef8238181a30e52dea380789a7e2d760eac532Ted Kremenek SVal evalBinOp(ProgramStateRef state, BinaryOperator::Opcode op, 424cd8f6ac9b613e1fe962ebf9c87d822ce765275e6Ted Kremenek NonLoc L, SVal R, QualType T) { 4259c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek return R.isValid() ? svalBuilder.evalBinOpNN(state,op,L, cast<NonLoc>(R), T) : R; 426b640b3b5dfccaf259967cb2cb6755c9aa20d4423Ted Kremenek } 4271eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 4288bef8238181a30e52dea380789a7e2d760eac532Ted Kremenek SVal evalBinOp(ProgramStateRef ST, BinaryOperator::Opcode Op, 429ff4264dae31cf42807b64ecc114906b0b835690aTed Kremenek SVal LHS, SVal RHS, QualType T) { 4309c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek return svalBuilder.evalBinOp(ST, Op, LHS, RHS, T); 431ff4264dae31cf42807b64ecc114906b0b835690aTed Kremenek } 4325b9bd2137ebef350af803c634e3fdf5d74678100Ted Kremenek 4331670e403c48f3af4fceff3f6773a0e1cfc6c4eb3Ted Kremenekprotected: 434cde8cdbd6a662c636164465ad309b5f17ff01064Jordan Rose void evalObjCMessage(StmtNodeBuilder &Bldr, const ObjCMethodCall &Msg, 4358bef8238181a30e52dea380789a7e2d760eac532Ted Kremenek ExplodedNode *Pred, ProgramStateRef state, 436ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks bool GenSink); 4371670e403c48f3af4fceff3f6773a0e1cfc6c4eb3Ted Kremenek 4389c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek /// evalBind - Handle the semantics of binding a value to a specific location. 4399c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek /// This method is used by evalStore, VisitDeclStmt, and others. 4409c378f705405d37f49795d5e915989de774fe11fTed Kremenek void evalBind(ExplodedNodeSet &Dst, const Stmt *StoreE, ExplodedNode *Pred, 4413d7c44e01d568e5d5c0fac9c6ccb3f080157ba19Anna Zaks SVal location, SVal Val, bool atDeclInit = false); 4421eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 4431670e403c48f3af4fceff3f6773a0e1cfc6c4eb3Ted Kremenekpublic: 444b4b817d704287836b52b34369009e682f208aa2bTed Kremenek // FIXME: 'tag' should be removed, and a LocationContext should be used 445b4b817d704287836b52b34369009e682f208aa2bTed Kremenek // instead. 446834f9de3d3d76986d09f41725a70ba45a3e2aecdZhanyong Wan // FIXME: Comment on the meaning of the arguments, when 'St' may not 447834f9de3d3d76986d09f41725a70ba45a3e2aecdZhanyong Wan // be the same as Pred->state, and when 'location' may not be the 448834f9de3d3d76986d09f41725a70ba45a3e2aecdZhanyong Wan // same as state->getLValue(Ex). 449834f9de3d3d76986d09f41725a70ba45a3e2aecdZhanyong Wan /// Simulate a read of the result of Ex. 450bd613137499b1d4c3b63dccd0aa21f6add243f4fTed Kremenek void evalLoad(ExplodedNodeSet &Dst, 451bd613137499b1d4c3b63dccd0aa21f6add243f4fTed Kremenek const Expr *NodeEx, /* Eventually will be a CFGStmt */ 452bd613137499b1d4c3b63dccd0aa21f6add243f4fTed Kremenek const Expr *BoundExpr, 453bd613137499b1d4c3b63dccd0aa21f6add243f4fTed Kremenek ExplodedNode *Pred, 454bd613137499b1d4c3b63dccd0aa21f6add243f4fTed Kremenek ProgramStateRef St, 455bd613137499b1d4c3b63dccd0aa21f6add243f4fTed Kremenek SVal location, 456bd613137499b1d4c3b63dccd0aa21f6add243f4fTed Kremenek const ProgramPointTag *tag = 0, 457652be346f74feba027bcbdeb6a3e3f4755a0e62cZhongxing Xu QualType LoadTy = QualType()); 4581eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 459b4b817d704287836b52b34369009e682f208aa2bTed Kremenek // FIXME: 'tag' should be removed, and a LocationContext should be used 460b4b817d704287836b52b34369009e682f208aa2bTed Kremenek // instead. 4619c378f705405d37f49795d5e915989de774fe11fTed Kremenek void evalStore(ExplodedNodeSet &Dst, const Expr *AssignE, const Expr *StoreE, 4628bef8238181a30e52dea380789a7e2d760eac532Ted Kremenek ExplodedNode *Pred, ProgramStateRef St, SVal TargetLV, SVal Val, 463ca804539d908d3a0e8c72a0df5f1f571d29490bbTed Kremenek const ProgramPointTag *tag = 0); 46469f87c956b3ac2b80124fd9604af012e1061473aJordan Rose 465e81ce256b62717dd846bd19aecc4115a0dcd4995Anna Zaks /// \brief Create a new state in which the call return value is binded to the 466e81ce256b62717dd846bd19aecc4115a0dcd4995Anna Zaks /// call origin expression. 467e81ce256b62717dd846bd19aecc4115a0dcd4995Anna Zaks ProgramStateRef bindReturnValue(const CallEvent &Call, 468e81ce256b62717dd846bd19aecc4115a0dcd4995Anna Zaks const LocationContext *LCtx, 469e81ce256b62717dd846bd19aecc4115a0dcd4995Anna Zaks ProgramStateRef State); 470e81ce256b62717dd846bd19aecc4115a0dcd4995Anna Zaks 47169f87c956b3ac2b80124fd9604af012e1061473aJordan Rose void evalCall(ExplodedNodeSet &Dst, ExplodedNode *Pred, 47269f87c956b3ac2b80124fd9604af012e1061473aJordan Rose const SimpleCall &Call); 473e81ce256b62717dd846bd19aecc4115a0dcd4995Anna Zaks 4749dc5167e4017ef4c8b327abb6f72225eec2e0f19Anna Zaks /// \brief Default implementation of call evaluation. 475e81ce256b62717dd846bd19aecc4115a0dcd4995Anna Zaks void defaultEvalCall(NodeBuilder &B, ExplodedNode *Pred, 47669f87c956b3ac2b80124fd9604af012e1061473aJordan Rose const CallEvent &Call); 477834f9de3d3d76986d09f41725a70ba45a3e2aecdZhanyong Wanprivate: 478bd613137499b1d4c3b63dccd0aa21f6add243f4fTed Kremenek void evalLoadCommon(ExplodedNodeSet &Dst, 479bd613137499b1d4c3b63dccd0aa21f6add243f4fTed Kremenek const Expr *NodeEx, /* Eventually will be a CFGStmt */ 480bd613137499b1d4c3b63dccd0aa21f6add243f4fTed Kremenek const Expr *BoundEx, 481bd613137499b1d4c3b63dccd0aa21f6add243f4fTed Kremenek ExplodedNode *Pred, 482bd613137499b1d4c3b63dccd0aa21f6add243f4fTed Kremenek ProgramStateRef St, 483bd613137499b1d4c3b63dccd0aa21f6add243f4fTed Kremenek SVal location, 484bd613137499b1d4c3b63dccd0aa21f6add243f4fTed Kremenek const ProgramPointTag *tag, 485852274d4257134906995cb252fb3dfd2d71deae8Ted Kremenek QualType LoadTy); 486852274d4257134906995cb252fb3dfd2d71deae8Ted Kremenek 487852274d4257134906995cb252fb3dfd2d71deae8Ted Kremenek // FIXME: 'tag' should be removed, and a LocationContext should be used 488852274d4257134906995cb252fb3dfd2d71deae8Ted Kremenek // instead. 489bd613137499b1d4c3b63dccd0aa21f6add243f4fTed Kremenek void evalLocation(ExplodedNodeSet &Dst, 490bd613137499b1d4c3b63dccd0aa21f6add243f4fTed Kremenek const Stmt *NodeEx, /* This will eventually be a CFGStmt */ 491bd613137499b1d4c3b63dccd0aa21f6add243f4fTed Kremenek const Stmt *BoundEx, 492bd613137499b1d4c3b63dccd0aa21f6add243f4fTed Kremenek ExplodedNode *Pred, 4938bef8238181a30e52dea380789a7e2d760eac532Ted Kremenek ProgramStateRef St, SVal location, 494ca804539d908d3a0e8c72a0df5f1f571d29490bbTed Kremenek const ProgramPointTag *tag, bool isLoad); 4951c625f25055331bf76ab5479a8060d2b0f61e8b8Zhongxing Xu 4967fa9b4f258636d89342eda28f21a986c8ac353b1Ted Kremenek bool shouldInlineDecl(const Decl *D, ExplodedNode *Pred); 497e81ce256b62717dd846bd19aecc4115a0dcd4995Anna Zaks bool inlineCall(const CallEvent &Call, ExplodedNode *Pred); 4985903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks 4995903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks bool replayWithoutInlining(ExplodedNode *P, const LocationContext *CalleeLC); 5005903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks}; 5015903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks 5025903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks/// Traits for storing the call processing policy inside GDM. 5035903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks/// The GDM stores the corresponding CallExpr pointer. 5045903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaksstruct ReplayWithoutInlining{}; 5055903a373db3d27794c90b25687e0dd6adb0e497dAnna Zakstemplate <> 5065903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaksstruct ProgramStateTrait<ReplayWithoutInlining> : 5075903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks public ProgramStatePartialTrait<void*> { 5085903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks static void *GDMIndex() { static int index = 0; return &index; } 509b387a3f23e423d62c053be86294b703da1d1a222Ted Kremenek}; 5101eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 51165423aeb996a296cf2964f136ce4a4a937bd1687Zhongxing Xu} // end ento namespace 5125a4f98ff943e6a501b0fe47ade007c9bbf96cb88Argyrios Kyrtzidis 513c0c3f5dbc9e78aa53a86c7d5e3eeda23ddad93d6Ted Kremenek} // end clang namespace 514c0c3f5dbc9e78aa53a86c7d5e3eeda23ddad93d6Ted Kremenek 515d065d6080f0620bb80b933f3f5d52d37bb2ea770Ted Kremenek#endif 516