ExprEngine.h revision 651f13cea278ec967336033dd032faef0e9fc2ec 
1//===-- ExprEngine.h - Path-Sensitive Expression-Level Dataflow ---*- C++ -*-=//
2//
3//                     The LLVM Compiler Infrastructure
4//
5// This file is distributed under the University of Illinois Open Source
6// License. See LICENSE.TXT for details.
7//
8//===----------------------------------------------------------------------===//
9//
10//  This file defines a meta-engine for path-sensitive dataflow analysis that
11//  is built on CoreEngine, but provides the boilerplate to execute transfer
12//  functions and build the ExplodedGraph at the expression level.
13//
14//===----------------------------------------------------------------------===//
15
16#ifndef LLVM_CLANG_GR_EXPRENGINE
17#define LLVM_CLANG_GR_EXPRENGINE
18
19#include "clang/AST/Expr.h"
20#include "clang/AST/Type.h"
21#include "clang/Analysis/DomainSpecific/ObjCNoReturn.h"
22#include "clang/StaticAnalyzer/Core/BugReporter/BugReporter.h"
23#include "clang/StaticAnalyzer/Core/PathSensitive/AnalysisManager.h"
24#include "clang/StaticAnalyzer/Core/PathSensitive/CoreEngine.h"
25#include "clang/StaticAnalyzer/Core/PathSensitive/ProgramState.h"
26#include "clang/StaticAnalyzer/Core/PathSensitive/ProgramStateTrait.h"
27#include "clang/StaticAnalyzer/Core/PathSensitive/SubEngine.h"
28
29namespace clang {
30
31class AnalysisDeclContextManager;
32class CXXCatchStmt;
33class CXXConstructExpr;
34class CXXDeleteExpr;
35class CXXNewExpr;
36class CXXTemporaryObjectExpr;
37class CXXThisExpr;
38class MaterializeTemporaryExpr;
39class ObjCAtSynchronizedStmt;
40class ObjCForCollectionStmt;
41
42namespace ento {
43
44class AnalysisManager;
45class CallEvent;
46class CXXConstructorCall;
47
48class ExprEngine : public SubEngine {
49public:
50  /// The modes of inlining, which override the default analysis-wide settings.
51  enum InliningModes {
52    /// Follow the default settings for inlining callees.
53    Inline_Regular = 0,
54    /// Do minimal inlining of callees.
55    Inline_Minimal = 0x1
56  };
57
58private:
59  AnalysisManager &AMgr;
60
61  AnalysisDeclContextManager &AnalysisDeclContexts;
62
63  CoreEngine Engine;
64
65  /// G - the simulation graph.
66  ExplodedGraph& G;
67
68  /// StateMgr - Object that manages the data for all created states.
69  ProgramStateManager StateMgr;
70
71  /// SymMgr - Object that manages the symbol information.
72  SymbolManager& SymMgr;
73
74  /// svalBuilder - SValBuilder object that creates SVals from expressions.
75  SValBuilder &svalBuilder;
76
77  unsigned int currStmtIdx;
78  const NodeBuilderContext *currBldrCtx;
79
80  /// Helper object to determine if an Objective-C message expression
81  /// implicitly never returns.
82  ObjCNoReturn ObjCNoRet;
83
84  /// Whether or not GC is enabled in this analysis.
85  bool ObjCGCEnabled;
86
87  /// The BugReporter associated with this engine.  It is important that
88  ///  this object be placed at the very end of member variables so that its
89  ///  destructor is called before the rest of the ExprEngine is destroyed.
90  GRBugReporter BR;
91
92  /// The functions which have been analyzed through inlining. This is owned by
93  /// AnalysisConsumer. It can be null.
94  SetOfConstDecls *VisitedCallees;
95
96  /// The flag, which specifies the mode of inlining for the engine.
97  InliningModes HowToInline;
98
99public:
100  ExprEngine(AnalysisManager &mgr, bool gcEnabled,
101             SetOfConstDecls *VisitedCalleesIn,
102             FunctionSummariesTy *FS,
103             InliningModes HowToInlineIn);
104
105  ~ExprEngine();
106
107  /// Returns true if there is still simulation state on the worklist.
108  bool ExecuteWorkList(const LocationContext *L, unsigned Steps = 150000) {
109    return Engine.ExecuteWorkList(L, Steps, 0);
110  }
111
112  /// Execute the work list with an initial state. Nodes that reaches the exit
113  /// of the function are added into the Dst set, which represent the exit
114  /// state of the function call. Returns true if there is still simulation
115  /// state on the worklist.
116  bool ExecuteWorkListWithInitialState(const LocationContext *L, unsigned Steps,
117                                       ProgramStateRef InitState,
118                                       ExplodedNodeSet &Dst) {
119    return Engine.ExecuteWorkListWithInitialState(L, Steps, InitState, Dst);
120  }
121
122  /// getContext - Return the ASTContext associated with this analysis.
123  ASTContext &getContext() const { return AMgr.getASTContext(); }
124
125  AnalysisManager &getAnalysisManager() override { return AMgr; }
126
127  CheckerManager &getCheckerManager() const {
128    return *AMgr.getCheckerManager();
129  }
130
131  SValBuilder &getSValBuilder() { return svalBuilder; }
132
133  BugReporter& getBugReporter() { return BR; }
134
135  const NodeBuilderContext &getBuilderContext() {
136    assert(currBldrCtx);
137    return *currBldrCtx;
138  }
139
140  bool isObjCGCEnabled() { return ObjCGCEnabled; }
141
142  const Stmt *getStmt() const;
143
144  void GenerateAutoTransition(ExplodedNode *N);
145  void enqueueEndOfPath(ExplodedNodeSet &S);
146  void GenerateCallExitNode(ExplodedNode *N);
147
148  /// Visualize the ExplodedGraph created by executing the simulation.
149  void ViewGraph(bool trim = false);
150
151  /// Visualize a trimmed ExplodedGraph that only contains paths to the given
152  /// nodes.
153  void ViewGraph(ArrayRef<const ExplodedNode*> Nodes);
154
155  /// getInitialState - Return the initial state used for the root vertex
156  ///  in the ExplodedGraph.
157  ProgramStateRef getInitialState(const LocationContext *InitLoc) override;
158
159  ExplodedGraph& getGraph() { return G; }
160  const ExplodedGraph& getGraph() const { return G; }
161
162  /// \brief Run the analyzer's garbage collection - remove dead symbols and
163  /// bindings from the state.
164  ///
165  /// Checkers can participate in this process with two callbacks:
166  /// \c checkLiveSymbols and \c checkDeadSymbols. See the CheckerDocumentation
167  /// class for more information.
168  ///
169  /// \param Node The predecessor node, from which the processing should start.
170  /// \param Out The returned set of output nodes.
171  /// \param ReferenceStmt The statement which is about to be processed.
172  ///        Everything needed for this statement should be considered live.
173  ///        A null statement means that everything in child LocationContexts
174  ///        is dead.
175  /// \param LC The location context of the \p ReferenceStmt. A null location
176  ///        context means that we have reached the end of analysis and that
177  ///        all statements and local variables should be considered dead.
178  /// \param DiagnosticStmt Used as a location for any warnings that should
179  ///        occur while removing the dead (e.g. leaks). By default, the
180  ///        \p ReferenceStmt is used.
181  /// \param K Denotes whether this is a pre- or post-statement purge. This
182  ///        must only be ProgramPoint::PostStmtPurgeDeadSymbolsKind if an
183  ///        entire location context is being cleared, in which case the
184  ///        \p ReferenceStmt must either be a ReturnStmt or \c NULL. Otherwise,
185  ///        it must be ProgramPoint::PreStmtPurgeDeadSymbolsKind (the default)
186  ///        and \p ReferenceStmt must be valid (non-null).
187  void removeDead(ExplodedNode *Node, ExplodedNodeSet &Out,
188            const Stmt *ReferenceStmt, const LocationContext *LC,
189            const Stmt *DiagnosticStmt = 0,
190            ProgramPoint::Kind K = ProgramPoint::PreStmtPurgeDeadSymbolsKind);
191
192  /// processCFGElement - Called by CoreEngine. Used to generate new successor
193  ///  nodes by processing the 'effects' of a CFG element.
194  void processCFGElement(const CFGElement E, ExplodedNode *Pred,
195                         unsigned StmtIdx, NodeBuilderContext *Ctx) override;
196
197  void ProcessStmt(const CFGStmt S, ExplodedNode *Pred);
198
199  void ProcessInitializer(const CFGInitializer I, ExplodedNode *Pred);
200
201  void ProcessImplicitDtor(const CFGImplicitDtor D, ExplodedNode *Pred);
202
203  void ProcessNewAllocator(const CXXNewExpr *NE, ExplodedNode *Pred);
204
205  void ProcessAutomaticObjDtor(const CFGAutomaticObjDtor D,
206                               ExplodedNode *Pred, ExplodedNodeSet &Dst);
207  void ProcessDeleteDtor(const CFGDeleteDtor D,
208                         ExplodedNode *Pred, ExplodedNodeSet &Dst);
209  void ProcessBaseDtor(const CFGBaseDtor D,
210                       ExplodedNode *Pred, ExplodedNodeSet &Dst);
211  void ProcessMemberDtor(const CFGMemberDtor D,
212                         ExplodedNode *Pred, ExplodedNodeSet &Dst);
213  void ProcessTemporaryDtor(const CFGTemporaryDtor D,
214                            ExplodedNode *Pred, ExplodedNodeSet &Dst);
215
216  /// Called by CoreEngine when processing the entrance of a CFGBlock.
217  void processCFGBlockEntrance(const BlockEdge &L,
218                               NodeBuilderWithSinks &nodeBuilder,
219                               ExplodedNode *Pred) override;
220
221  /// ProcessBranch - Called by CoreEngine.  Used to generate successor
222  ///  nodes by processing the 'effects' of a branch condition.
223  void processBranch(const Stmt *Condition, const Stmt *Term,
224                     NodeBuilderContext& BuilderCtx,
225                     ExplodedNode *Pred,
226                     ExplodedNodeSet &Dst,
227                     const CFGBlock *DstT,
228                     const CFGBlock *DstF) override;
229
230  /// Called by CoreEngine.  Used to processing branching behavior
231  /// at static initalizers.
232  void processStaticInitializer(const DeclStmt *DS,
233                                NodeBuilderContext& BuilderCtx,
234                                ExplodedNode *Pred,
235                                ExplodedNodeSet &Dst,
236                                const CFGBlock *DstT,
237                                const CFGBlock *DstF) override;
238
239  /// processIndirectGoto - Called by CoreEngine.  Used to generate successor
240  ///  nodes by processing the 'effects' of a computed goto jump.
241  void processIndirectGoto(IndirectGotoNodeBuilder& builder) override;
242
243  /// ProcessSwitch - Called by CoreEngine.  Used to generate successor
244  ///  nodes by processing the 'effects' of a switch statement.
245  void processSwitch(SwitchNodeBuilder& builder) override;
246
247  /// Called by CoreEngine.  Used to generate end-of-path
248  /// nodes when the control reaches the end of a function.
249  void processEndOfFunction(NodeBuilderContext& BC,
250                            ExplodedNode *Pred) override;
251
252  /// Remove dead bindings/symbols before exiting a function.
253  void removeDeadOnEndOfFunction(NodeBuilderContext& BC,
254                                 ExplodedNode *Pred,
255                                 ExplodedNodeSet &Dst);
256
257  /// Generate the entry node of the callee.
258  void processCallEnter(CallEnter CE, ExplodedNode *Pred) override;
259
260  /// Generate the sequence of nodes that simulate the call exit and the post
261  /// visit for CallExpr.
262  void processCallExit(ExplodedNode *Pred) override;
263
264  /// Called by CoreEngine when the analysis worklist has terminated.
265  void processEndWorklist(bool hasWorkRemaining) override;
266
267  /// evalAssume - Callback function invoked by the ConstraintManager when
268  ///  making assumptions about state values.
269  ProgramStateRef processAssume(ProgramStateRef state, SVal cond,
270                                bool assumption) override;
271
272  /// wantsRegionChangeUpdate - Called by ProgramStateManager to determine if a
273  ///  region change should trigger a processRegionChanges update.
274  bool wantsRegionChangeUpdate(ProgramStateRef state) override;
275
276  /// processRegionChanges - Called by ProgramStateManager whenever a change is made
277  ///  to the store. Used to update checkers that track region values.
278  ProgramStateRef
279  processRegionChanges(ProgramStateRef state,
280                       const InvalidatedSymbols *invalidated,
281                       ArrayRef<const MemRegion *> ExplicitRegions,
282                       ArrayRef<const MemRegion *> Regions,
283                       const CallEvent *Call) override;
284
285  /// printState - Called by ProgramStateManager to print checker-specific data.
286  void printState(raw_ostream &Out, ProgramStateRef State,
287                  const char *NL, const char *Sep) override;
288
289  ProgramStateManager& getStateManager() override { return StateMgr; }
290
291  StoreManager& getStoreManager() { return StateMgr.getStoreManager(); }
292
293  ConstraintManager& getConstraintManager() {
294    return StateMgr.getConstraintManager();
295  }
296
297  // FIXME: Remove when we migrate over to just using SValBuilder.
298  BasicValueFactory& getBasicVals() {
299    return StateMgr.getBasicVals();
300  }
301
302  // FIXME: Remove when we migrate over to just using ValueManager.
303  SymbolManager& getSymbolManager() { return SymMgr; }
304  const SymbolManager& getSymbolManager() const { return SymMgr; }
305
306  // Functions for external checking of whether we have unfinished work
307  bool wasBlocksExhausted() const { return Engine.wasBlocksExhausted(); }
308  bool hasEmptyWorkList() const { return !Engine.getWorkList()->hasWork(); }
309  bool hasWorkRemaining() const { return Engine.hasWorkRemaining(); }
310
311  const CoreEngine &getCoreEngine() const { return Engine; }
312
313public:
314  /// Visit - Transfer function logic for all statements.  Dispatches to
315  ///  other functions that handle specific kinds of statements.
316  void Visit(const Stmt *S, ExplodedNode *Pred, ExplodedNodeSet &Dst);
317
318  /// VisitArraySubscriptExpr - Transfer function for array accesses.
319  void VisitLvalArraySubscriptExpr(const ArraySubscriptExpr *Ex,
320                                   ExplodedNode *Pred,
321                                   ExplodedNodeSet &Dst);
322
323  /// VisitGCCAsmStmt - Transfer function logic for inline asm.
324  void VisitGCCAsmStmt(const GCCAsmStmt *A, ExplodedNode *Pred,
325                       ExplodedNodeSet &Dst);
326
327  /// VisitMSAsmStmt - Transfer function logic for MS inline asm.
328  void VisitMSAsmStmt(const MSAsmStmt *A, ExplodedNode *Pred,
329                      ExplodedNodeSet &Dst);
330
331  /// VisitBlockExpr - Transfer function logic for BlockExprs.
332  void VisitBlockExpr(const BlockExpr *BE, ExplodedNode *Pred,
333                      ExplodedNodeSet &Dst);
334
335  /// VisitBinaryOperator - Transfer function logic for binary operators.
336  void VisitBinaryOperator(const BinaryOperator* B, ExplodedNode *Pred,
337                           ExplodedNodeSet &Dst);
338
339
340  /// VisitCall - Transfer function for function calls.
341  void VisitCallExpr(const CallExpr *CE, ExplodedNode *Pred,
342                     ExplodedNodeSet &Dst);
343
344  /// VisitCast - Transfer function logic for all casts (implicit and explicit).
345  void VisitCast(const CastExpr *CastE, const Expr *Ex, ExplodedNode *Pred,
346                ExplodedNodeSet &Dst);
347
348  /// VisitCompoundLiteralExpr - Transfer function logic for compound literals.
349  void VisitCompoundLiteralExpr(const CompoundLiteralExpr *CL,
350                                ExplodedNode *Pred, ExplodedNodeSet &Dst);
351
352  /// Transfer function logic for DeclRefExprs and BlockDeclRefExprs.
353  void VisitCommonDeclRefExpr(const Expr *DR, const NamedDecl *D,
354                              ExplodedNode *Pred, ExplodedNodeSet &Dst);
355
356  /// VisitDeclStmt - Transfer function logic for DeclStmts.
357  void VisitDeclStmt(const DeclStmt *DS, ExplodedNode *Pred,
358                     ExplodedNodeSet &Dst);
359
360  /// VisitGuardedExpr - Transfer function logic for ?, __builtin_choose
361  void VisitGuardedExpr(const Expr *Ex, const Expr *L, const Expr *R,
362                        ExplodedNode *Pred, ExplodedNodeSet &Dst);
363
364  void VisitInitListExpr(const InitListExpr *E, ExplodedNode *Pred,
365                         ExplodedNodeSet &Dst);
366
367  /// VisitLogicalExpr - Transfer function logic for '&&', '||'
368  void VisitLogicalExpr(const BinaryOperator* B, ExplodedNode *Pred,
369                        ExplodedNodeSet &Dst);
370
371  /// VisitMemberExpr - Transfer function for member expressions.
372  void VisitMemberExpr(const MemberExpr *M, ExplodedNode *Pred,
373                           ExplodedNodeSet &Dst);
374
375  /// Transfer function logic for ObjCAtSynchronizedStmts.
376  void VisitObjCAtSynchronizedStmt(const ObjCAtSynchronizedStmt *S,
377                                   ExplodedNode *Pred, ExplodedNodeSet &Dst);
378
379  /// Transfer function logic for computing the lvalue of an Objective-C ivar.
380  void VisitLvalObjCIvarRefExpr(const ObjCIvarRefExpr *DR, ExplodedNode *Pred,
381                                ExplodedNodeSet &Dst);
382
383  /// VisitObjCForCollectionStmt - Transfer function logic for
384  ///  ObjCForCollectionStmt.
385  void VisitObjCForCollectionStmt(const ObjCForCollectionStmt *S,
386                                  ExplodedNode *Pred, ExplodedNodeSet &Dst);
387
388  void VisitObjCMessage(const ObjCMessageExpr *ME, ExplodedNode *Pred,
389                        ExplodedNodeSet &Dst);
390
391  /// VisitReturnStmt - Transfer function logic for return statements.
392  void VisitReturnStmt(const ReturnStmt *R, ExplodedNode *Pred,
393                       ExplodedNodeSet &Dst);
394
395  /// VisitOffsetOfExpr - Transfer function for offsetof.
396  void VisitOffsetOfExpr(const OffsetOfExpr *Ex, ExplodedNode *Pred,
397                         ExplodedNodeSet &Dst);
398
399  /// VisitUnaryExprOrTypeTraitExpr - Transfer function for sizeof.
400  void VisitUnaryExprOrTypeTraitExpr(const UnaryExprOrTypeTraitExpr *Ex,
401                              ExplodedNode *Pred, ExplodedNodeSet &Dst);
402
403  /// VisitUnaryOperator - Transfer function logic for unary operators.
404  void VisitUnaryOperator(const UnaryOperator* B, ExplodedNode *Pred,
405                          ExplodedNodeSet &Dst);
406
407  /// Handle ++ and -- (both pre- and post-increment).
408  void VisitIncrementDecrementOperator(const UnaryOperator* U,
409                                       ExplodedNode *Pred,
410                                       ExplodedNodeSet &Dst);
411
412  void VisitCXXCatchStmt(const CXXCatchStmt *CS, ExplodedNode *Pred,
413                         ExplodedNodeSet &Dst);
414
415  void VisitCXXThisExpr(const CXXThisExpr *TE, ExplodedNode *Pred,
416                        ExplodedNodeSet & Dst);
417
418  void VisitCXXConstructExpr(const CXXConstructExpr *E, ExplodedNode *Pred,
419                             ExplodedNodeSet &Dst);
420
421  void VisitCXXDestructor(QualType ObjectType, const MemRegion *Dest,
422                          const Stmt *S, bool IsBaseDtor,
423                          ExplodedNode *Pred, ExplodedNodeSet &Dst);
424
425  void VisitCXXNewAllocatorCall(const CXXNewExpr *CNE,
426                                ExplodedNode *Pred,
427                                ExplodedNodeSet &Dst);
428
429  void VisitCXXNewExpr(const CXXNewExpr *CNE, ExplodedNode *Pred,
430                       ExplodedNodeSet &Dst);
431
432  void VisitCXXDeleteExpr(const CXXDeleteExpr *CDE, ExplodedNode *Pred,
433                          ExplodedNodeSet &Dst);
434
435  /// Create a C++ temporary object for an rvalue.
436  void CreateCXXTemporaryObject(const MaterializeTemporaryExpr *ME,
437                                ExplodedNode *Pred,
438                                ExplodedNodeSet &Dst);
439
440  /// evalEagerlyAssumeBinOpBifurcation - Given the nodes in 'Src', eagerly assume symbolic
441  ///  expressions of the form 'x != 0' and generate new nodes (stored in Dst)
442  ///  with those assumptions.
443  void evalEagerlyAssumeBinOpBifurcation(ExplodedNodeSet &Dst, ExplodedNodeSet &Src,
444                         const Expr *Ex);
445
446  std::pair<const ProgramPointTag *, const ProgramPointTag*>
447    geteagerlyAssumeBinOpBifurcationTags();
448
449  SVal evalMinus(SVal X) {
450    return X.isValid() ? svalBuilder.evalMinus(X.castAs<NonLoc>()) : X;
451  }
452
453  SVal evalComplement(SVal X) {
454    return X.isValid() ? svalBuilder.evalComplement(X.castAs<NonLoc>()) : X;
455  }
456
457public:
458
459  SVal evalBinOp(ProgramStateRef state, BinaryOperator::Opcode op,
460                 NonLoc L, NonLoc R, QualType T) {
461    return svalBuilder.evalBinOpNN(state, op, L, R, T);
462  }
463
464  SVal evalBinOp(ProgramStateRef state, BinaryOperator::Opcode op,
465                 NonLoc L, SVal R, QualType T) {
466    return R.isValid() ? svalBuilder.evalBinOpNN(state, op, L,
467                                                 R.castAs<NonLoc>(), T) : R;
468  }
469
470  SVal evalBinOp(ProgramStateRef ST, BinaryOperator::Opcode Op,
471                 SVal LHS, SVal RHS, QualType T) {
472    return svalBuilder.evalBinOp(ST, Op, LHS, RHS, T);
473  }
474
475protected:
476  /// evalBind - Handle the semantics of binding a value to a specific location.
477  ///  This method is used by evalStore, VisitDeclStmt, and others.
478  void evalBind(ExplodedNodeSet &Dst, const Stmt *StoreE, ExplodedNode *Pred,
479                SVal location, SVal Val, bool atDeclInit = false,
480                const ProgramPoint *PP = 0);
481
482  /// Call PointerEscape callback when a value escapes as a result of bind.
483  ProgramStateRef processPointerEscapedOnBind(ProgramStateRef State,
484                                              SVal Loc, SVal Val) override;
485  /// Call PointerEscape callback when a value escapes as a result of
486  /// region invalidation.
487  /// \param[in] ITraits Specifies invalidation traits for regions/symbols.
488  ProgramStateRef notifyCheckersOfPointerEscape(
489                           ProgramStateRef State,
490                           const InvalidatedSymbols *Invalidated,
491                           ArrayRef<const MemRegion *> ExplicitRegions,
492                           ArrayRef<const MemRegion *> Regions,
493                           const CallEvent *Call,
494                           RegionAndSymbolInvalidationTraits &ITraits) override;
495
496public:
497  // FIXME: 'tag' should be removed, and a LocationContext should be used
498  // instead.
499  // FIXME: Comment on the meaning of the arguments, when 'St' may not
500  // be the same as Pred->state, and when 'location' may not be the
501  // same as state->getLValue(Ex).
502  /// Simulate a read of the result of Ex.
503  void evalLoad(ExplodedNodeSet &Dst,
504                const Expr *NodeEx,  /* Eventually will be a CFGStmt */
505                const Expr *BoundExpr,
506                ExplodedNode *Pred,
507                ProgramStateRef St,
508                SVal location,
509                const ProgramPointTag *tag = 0,
510                QualType LoadTy = QualType());
511
512  // FIXME: 'tag' should be removed, and a LocationContext should be used
513  // instead.
514  void evalStore(ExplodedNodeSet &Dst, const Expr *AssignE, const Expr *StoreE,
515                 ExplodedNode *Pred, ProgramStateRef St, SVal TargetLV, SVal Val,
516                 const ProgramPointTag *tag = 0);
517
518  /// \brief Create a new state in which the call return value is binded to the
519  /// call origin expression.
520  ProgramStateRef bindReturnValue(const CallEvent &Call,
521                                  const LocationContext *LCtx,
522                                  ProgramStateRef State);
523
524  /// Evaluate a call, running pre- and post-call checks and allowing checkers
525  /// to be responsible for handling the evaluation of the call itself.
526  void evalCall(ExplodedNodeSet &Dst, ExplodedNode *Pred,
527                const CallEvent &Call);
528
529  /// \brief Default implementation of call evaluation.
530  void defaultEvalCall(NodeBuilder &B, ExplodedNode *Pred,
531                       const CallEvent &Call);
532private:
533  void evalLoadCommon(ExplodedNodeSet &Dst,
534                      const Expr *NodeEx,  /* Eventually will be a CFGStmt */
535                      const Expr *BoundEx,
536                      ExplodedNode *Pred,
537                      ProgramStateRef St,
538                      SVal location,
539                      const ProgramPointTag *tag,
540                      QualType LoadTy);
541
542  // FIXME: 'tag' should be removed, and a LocationContext should be used
543  // instead.
544  void evalLocation(ExplodedNodeSet &Dst,
545                    const Stmt *NodeEx, /* This will eventually be a CFGStmt */
546                    const Stmt *BoundEx,
547                    ExplodedNode *Pred,
548                    ProgramStateRef St, SVal location,
549                    const ProgramPointTag *tag, bool isLoad);
550
551  /// Count the stack depth and determine if the call is recursive.
552  void examineStackFrames(const Decl *D, const LocationContext *LCtx,
553                          bool &IsRecursive, unsigned &StackDepth);
554
555  /// Checks our policies and decides weither the given call should be inlined.
556  bool shouldInlineCall(const CallEvent &Call, const Decl *D,
557                        const ExplodedNode *Pred);
558
559  bool inlineCall(const CallEvent &Call, const Decl *D, NodeBuilder &Bldr,
560                  ExplodedNode *Pred, ProgramStateRef State);
561
562  /// \brief Conservatively evaluate call by invalidating regions and binding
563  /// a conjured return value.
564  void conservativeEvalCall(const CallEvent &Call, NodeBuilder &Bldr,
565                            ExplodedNode *Pred, ProgramStateRef State);
566
567  /// \brief Either inline or process the call conservatively (or both), based
568  /// on DynamicDispatchBifurcation data.
569  void BifurcateCall(const MemRegion *BifurReg,
570                     const CallEvent &Call, const Decl *D, NodeBuilder &Bldr,
571                     ExplodedNode *Pred);
572
573  bool replayWithoutInlining(ExplodedNode *P, const LocationContext *CalleeLC);
574
575  /// Models a trivial copy or move constructor or trivial assignment operator
576  /// call with a simple bind.
577  void performTrivialCopy(NodeBuilder &Bldr, ExplodedNode *Pred,
578                          const CallEvent &Call);
579
580  /// If the value of the given expression is a NonLoc, copy it into a new
581  /// temporary object region, and replace the value of the expression with
582  /// that.
583  ///
584  /// If \p ResultE is provided, the new region will be bound to this expression
585  /// instead of \p E.
586  ProgramStateRef createTemporaryRegionIfNeeded(ProgramStateRef State,
587                                                const LocationContext *LC,
588                                                const Expr *E,
589                                                const Expr *ResultE = 0);
590};
591
592/// Traits for storing the call processing policy inside GDM.
593/// The GDM stores the corresponding CallExpr pointer.
594// FIXME: This does not use the nice trait macros because it must be accessible
595// from multiple translation units.
596struct ReplayWithoutInlining{};
597template <>
598struct ProgramStateTrait<ReplayWithoutInlining> :
599  public ProgramStatePartialTrait<const void*> {
600  static void *GDMIndex() { static int index = 0; return &index; }
601};
602
603} // end ento namespace
604
605} // end clang namespace
606
607#endif
608