ExprEngine.h revision 769ce3e93ad35bd9ac28e4d8b8f035ae4fd9a5b5 
1//===-- ExprEngine.h - Path-Sensitive Expression-Level Dataflow ---*- C++ -*-=//
2//
3//                     The LLVM Compiler Infrastructure
4//
5// This file is distributed under the University of Illinois Open Source
6// License. See LICENSE.TXT for details.
7//
8//===----------------------------------------------------------------------===//
9//
10//  This file defines a meta-engine for path-sensitive dataflow analysis that
11//  is built on CoreEngine, but provides the boilerplate to execute transfer
12//  functions and build the ExplodedGraph at the expression level.
13//
14//===----------------------------------------------------------------------===//
15
16#ifndef LLVM_CLANG_GR_EXPRENGINE
17#define LLVM_CLANG_GR_EXPRENGINE
18
19#include "clang/StaticAnalyzer/Core/PathSensitive/AnalysisManager.h"
20#include "clang/StaticAnalyzer/Core/PathSensitive/SubEngine.h"
21#include "clang/StaticAnalyzer/Core/PathSensitive/CoreEngine.h"
22#include "clang/StaticAnalyzer/Core/PathSensitive/GRState.h"
23#include "clang/StaticAnalyzer/Core/PathSensitive/TransferFuncs.h"
24#include "clang/StaticAnalyzer/Core/BugReporter/BugReporter.h"
25#include "clang/AST/Type.h"
26#include "clang/AST/ExprObjC.h"
27#include "clang/AST/ExprCXX.h"
28#include "clang/AST/StmtObjC.h"
29
30namespace clang {
31
32class ObjCForCollectionStmt;
33
34namespace ento {
35
36class AnalysisManager;
37class Checker;
38
39class ExprEngine : public SubEngine {
40  AnalysisManager &AMgr;
41
42  CoreEngine Engine;
43
44  /// G - the simulation graph.
45  ExplodedGraph& G;
46
47  /// Builder - The current StmtNodeBuilder which is used when building the
48  ///  nodes for a given statement.
49  StmtNodeBuilder* Builder;
50
51  /// StateMgr - Object that manages the data for all created states.
52  GRStateManager StateMgr;
53
54  /// SymMgr - Object that manages the symbol information.
55  SymbolManager& SymMgr;
56
57  /// svalBuilder - SValBuilder object that creates SVals from expressions.
58  SValBuilder &svalBuilder;
59
60  /// EntryNode - The immediate predecessor node.
61  ExplodedNode* EntryNode;
62
63  /// CleanedState - The state for EntryNode "cleaned" of all dead
64  ///  variables and symbols (as determined by a liveness analysis).
65  const GRState* CleanedState;
66
67  /// currentStmt - The current block-level statement.
68  const Stmt* currentStmt;
69
70  // Obj-C Class Identifiers.
71  IdentifierInfo* NSExceptionII;
72
73  // Obj-C Selectors.
74  Selector* NSExceptionInstanceRaiseSelectors;
75  Selector RaiseSel;
76
77  enum CallbackKind {
78    PreVisitStmtCallback,
79    PostVisitStmtCallback,
80    processAssumeCallback,
81    EvalRegionChangesCallback
82  };
83
84  typedef uint32_t CallbackTag;
85
86  /// GetCallbackTag - Create a tag for a certain kind of callback. The 'Sub'
87  ///  argument can be used to differentiate callbacks that depend on another
88  ///  value from a small set of possibilities, such as statement classes.
89  static inline CallbackTag GetCallbackTag(CallbackKind K, uint32_t Sub = 0) {
90    assert(Sub == ((Sub << 8) >> 8) && "Tag sub-kind must fit into 24 bits");
91    return K | (Sub << 8);
92  }
93
94  typedef llvm::DenseMap<void *, unsigned> CheckerMap;
95  typedef std::vector<std::pair<void *, Checker*> > CheckersOrdered;
96  typedef llvm::DenseMap<CallbackTag, CheckersOrdered *> CheckersOrderedCache;
97
98  /// A registration map from checker tag to the index into the
99  ///  ordered checkers vector.
100  CheckerMap CheckerM;
101
102  /// An ordered vector of checkers that are called when evaluating
103  ///  various expressions and statements.
104  CheckersOrdered Checkers;
105
106  /// A map used for caching the checkers that respond to the callback for
107  ///  a particular callback tag.
108  CheckersOrderedCache COCache;
109
110  /// The BugReporter associated with this engine.  It is important that
111  ///  this object be placed at the very end of member variables so that its
112  ///  destructor is called before the rest of the ExprEngine is destroyed.
113  GRBugReporter BR;
114
115  llvm::OwningPtr<TransferFuncs> TF;
116
117public:
118  ExprEngine(AnalysisManager &mgr, TransferFuncs *tf);
119
120  ~ExprEngine();
121
122  void ExecuteWorkList(const LocationContext *L, unsigned Steps = 150000) {
123    Engine.ExecuteWorkList(L, Steps, 0);
124  }
125
126  /// Execute the work list with an initial state. Nodes that reaches the exit
127  /// of the function are added into the Dst set, which represent the exit
128  /// state of the function call.
129  void ExecuteWorkListWithInitialState(const LocationContext *L, unsigned Steps,
130                                       const GRState *InitState,
131                                       ExplodedNodeSet &Dst) {
132    Engine.ExecuteWorkListWithInitialState(L, Steps, InitState, Dst);
133  }
134
135  /// getContext - Return the ASTContext associated with this analysis.
136  ASTContext& getContext() const { return AMgr.getASTContext(); }
137
138  virtual AnalysisManager &getAnalysisManager() { return AMgr; }
139
140  CheckerManager &getCheckerManager() const {
141    return *AMgr.getCheckerManager();
142  }
143
144  SValBuilder &getSValBuilder() { return svalBuilder; }
145
146  TransferFuncs& getTF() { return *TF; }
147
148  BugReporter& getBugReporter() { return BR; }
149
150  StmtNodeBuilder &getBuilder() { assert(Builder); return *Builder; }
151
152  // FIXME: Remove once TransferFuncs is no longer referenced.
153  void setTransferFunction(TransferFuncs* tf);
154
155  /// ViewGraph - Visualize the ExplodedGraph created by executing the
156  ///  simulation.
157  void ViewGraph(bool trim = false);
158
159  void ViewGraph(ExplodedNode** Beg, ExplodedNode** End);
160
161  /// getInitialState - Return the initial state used for the root vertex
162  ///  in the ExplodedGraph.
163  const GRState* getInitialState(const LocationContext *InitLoc);
164
165  ExplodedGraph& getGraph() { return G; }
166  const ExplodedGraph& getGraph() const { return G; }
167
168  template <typename CHECKER>
169  void registerCheck(CHECKER *check) {
170    unsigned entry = Checkers.size();
171    void *tag = CHECKER::getTag();
172    Checkers.push_back(std::make_pair(tag, check));
173    CheckerM[tag] = entry;
174  }
175
176  Checker *lookupChecker(void *tag) const;
177
178  template <typename CHECKER>
179  CHECKER *getChecker() const {
180     return static_cast<CHECKER*>(lookupChecker(CHECKER::getTag()));
181  }
182
183  /// processCFGElement - Called by CoreEngine. Used to generate new successor
184  ///  nodes by processing the 'effects' of a CFG element.
185  void processCFGElement(const CFGElement E, StmtNodeBuilder& builder);
186
187  void ProcessStmt(const CFGStmt S, StmtNodeBuilder &builder);
188
189  void ProcessInitializer(const CFGInitializer I, StmtNodeBuilder &builder);
190
191  void ProcessImplicitDtor(const CFGImplicitDtor D, StmtNodeBuilder &builder);
192
193  void ProcessAutomaticObjDtor(const CFGAutomaticObjDtor D,
194                            StmtNodeBuilder &builder);
195  void ProcessBaseDtor(const CFGBaseDtor D, StmtNodeBuilder &builder);
196  void ProcessMemberDtor(const CFGMemberDtor D, StmtNodeBuilder &builder);
197  void ProcessTemporaryDtor(const CFGTemporaryDtor D,
198                            StmtNodeBuilder &builder);
199
200  /// Called by CoreEngine when processing the entrance of a CFGBlock.
201  virtual void processCFGBlockEntrance(ExplodedNodeSet &dstNodes,
202                                GenericNodeBuilder<BlockEntrance> &nodeBuilder);
203
204  /// ProcessBranch - Called by CoreEngine.  Used to generate successor
205  ///  nodes by processing the 'effects' of a branch condition.
206  void processBranch(const Stmt* Condition, const Stmt* Term,
207                     BranchNodeBuilder& builder);
208
209  /// processIndirectGoto - Called by CoreEngine.  Used to generate successor
210  ///  nodes by processing the 'effects' of a computed goto jump.
211  void processIndirectGoto(IndirectGotoNodeBuilder& builder);
212
213  /// ProcessSwitch - Called by CoreEngine.  Used to generate successor
214  ///  nodes by processing the 'effects' of a switch statement.
215  void processSwitch(SwitchNodeBuilder& builder);
216
217  /// ProcessEndPath - Called by CoreEngine.  Used to generate end-of-path
218  ///  nodes when the control reaches the end of a function.
219  void processEndOfFunction(EndOfFunctionNodeBuilder& builder);
220
221  /// Generate the entry node of the callee.
222  void processCallEnter(CallEnterNodeBuilder &builder);
223
224  /// Generate the first post callsite node.
225  void processCallExit(CallExitNodeBuilder &builder);
226
227  /// Called by CoreEngine when the analysis worklist has terminated.
228  void processEndWorklist(bool hasWorkRemaining);
229
230  /// evalAssume - Callback function invoked by the ConstraintManager when
231  ///  making assumptions about state values.
232  const GRState *processAssume(const GRState *state, SVal cond,bool assumption);
233
234  /// wantsRegionChangeUpdate - Called by GRStateManager to determine if a
235  ///  region change should trigger a processRegionChanges update.
236  bool wantsRegionChangeUpdate(const GRState* state);
237
238  /// processRegionChanges - Called by GRStateManager whenever a change is made
239  ///  to the store. Used to update checkers that track region values.
240  const GRState* processRegionChanges(const GRState *state,
241                                      const MemRegion * const *Begin,
242                                      const MemRegion * const *End);
243
244  virtual GRStateManager& getStateManager() { return StateMgr; }
245
246  StoreManager& getStoreManager() { return StateMgr.getStoreManager(); }
247
248  ConstraintManager& getConstraintManager() {
249    return StateMgr.getConstraintManager();
250  }
251
252  // FIXME: Remove when we migrate over to just using SValBuilder.
253  BasicValueFactory& getBasicVals() {
254    return StateMgr.getBasicVals();
255  }
256  const BasicValueFactory& getBasicVals() const {
257    return StateMgr.getBasicVals();
258  }
259
260  // FIXME: Remove when we migrate over to just using ValueManager.
261  SymbolManager& getSymbolManager() { return SymMgr; }
262  const SymbolManager& getSymbolManager() const { return SymMgr; }
263
264  // Functions for external checking of whether we have unfinished work
265  bool wasBlockAborted() const { return Engine.wasBlockAborted(); }
266  bool hasEmptyWorkList() const { return !Engine.getWorkList()->hasWork(); }
267  bool hasWorkRemaining() const {
268    return wasBlockAborted() || Engine.getWorkList()->hasWork();
269  }
270
271  const CoreEngine &getCoreEngine() const { return Engine; }
272
273protected:
274  const GRState* GetState(ExplodedNode* N) {
275    return N == EntryNode ? CleanedState : N->getState();
276  }
277
278public:
279  ExplodedNode* MakeNode(ExplodedNodeSet& Dst, const Stmt* S,
280                         ExplodedNode* Pred, const GRState* St,
281                         ProgramPoint::Kind K = ProgramPoint::PostStmtKind,
282                         const void *tag = 0);
283
284  /// CheckerVisit - Dispatcher for performing checker-specific logic
285  ///  at specific statements.
286  void CheckerVisit(const Stmt *S, ExplodedNodeSet &Dst, ExplodedNodeSet &Src,
287                    CallbackKind Kind);
288
289  void CheckerVisitObjCMessage(const ObjCMessage &msg, ExplodedNodeSet &Dst,
290                               ExplodedNodeSet &Src, bool isPrevisit);
291
292  bool CheckerEvalCall(const CallExpr *CE,
293                       ExplodedNodeSet &Dst,
294                       ExplodedNode *Pred);
295
296  void CheckerEvalNilReceiver(const ObjCMessage &msg,
297                              ExplodedNodeSet &Dst,
298                              const GRState *state,
299                              ExplodedNode *Pred);
300
301  void CheckerVisitBind(const Stmt *StoreE, ExplodedNodeSet &Dst,
302                        ExplodedNodeSet &Src,  SVal location, SVal val,
303                        bool isPrevisit);
304
305  /// Visit - Transfer function logic for all statements.  Dispatches to
306  ///  other functions that handle specific kinds of statements.
307  void Visit(const Stmt* S, ExplodedNode* Pred, ExplodedNodeSet& Dst);
308
309  /// VisitArraySubscriptExpr - Transfer function for array accesses.
310  void VisitLvalArraySubscriptExpr(const ArraySubscriptExpr* Ex,
311                                   ExplodedNode* Pred,
312                                   ExplodedNodeSet& Dst);
313
314  /// VisitAsmStmt - Transfer function logic for inline asm.
315  void VisitAsmStmt(const AsmStmt* A, ExplodedNode* Pred, ExplodedNodeSet& Dst);
316
317  void VisitAsmStmtHelperOutputs(const AsmStmt* A,
318                                 AsmStmt::const_outputs_iterator I,
319                                 AsmStmt::const_outputs_iterator E,
320                                 ExplodedNode* Pred, ExplodedNodeSet& Dst);
321
322  void VisitAsmStmtHelperInputs(const AsmStmt* A,
323                                AsmStmt::const_inputs_iterator I,
324                                AsmStmt::const_inputs_iterator E,
325                                ExplodedNode* Pred, ExplodedNodeSet& Dst);
326
327  /// VisitBlockExpr - Transfer function logic for BlockExprs.
328  void VisitBlockExpr(const BlockExpr *BE, ExplodedNode *Pred,
329                      ExplodedNodeSet &Dst);
330
331  /// VisitBinaryOperator - Transfer function logic for binary operators.
332  void VisitBinaryOperator(const BinaryOperator* B, ExplodedNode* Pred,
333                           ExplodedNodeSet& Dst);
334
335
336  /// VisitCall - Transfer function for function calls.
337  void VisitCall(const CallExpr* CE, ExplodedNode* Pred,
338                 CallExpr::const_arg_iterator AI,
339                 CallExpr::const_arg_iterator AE,
340                 ExplodedNodeSet& Dst);
341
342  /// VisitCast - Transfer function logic for all casts (implicit and explicit).
343  void VisitCast(const CastExpr *CastE, const Expr *Ex, ExplodedNode *Pred,
344                ExplodedNodeSet &Dst);
345
346  /// VisitCompoundLiteralExpr - Transfer function logic for compound literals.
347  void VisitCompoundLiteralExpr(const CompoundLiteralExpr* CL,
348                                ExplodedNode* Pred, ExplodedNodeSet& Dst);
349
350  /// Transfer function logic for DeclRefExprs and BlockDeclRefExprs.
351  void VisitCommonDeclRefExpr(const Expr* DR, const NamedDecl *D,
352                              ExplodedNode* Pred, ExplodedNodeSet& Dst);
353
354  /// VisitDeclStmt - Transfer function logic for DeclStmts.
355  void VisitDeclStmt(const DeclStmt* DS, ExplodedNode* Pred,
356                     ExplodedNodeSet& Dst);
357
358  /// VisitGuardedExpr - Transfer function logic for ?, __builtin_choose
359  void VisitGuardedExpr(const Expr* Ex, const Expr* L, const Expr* R,
360                        ExplodedNode* Pred, ExplodedNodeSet& Dst);
361
362  /// VisitCondInit - Transfer function for handling the initialization
363  ///  of a condition variable in an IfStmt, SwitchStmt, etc.
364  void VisitCondInit(const VarDecl *VD, const Stmt *S, ExplodedNode *Pred,
365                     ExplodedNodeSet& Dst);
366
367  void VisitInitListExpr(const InitListExpr* E, ExplodedNode* Pred,
368                         ExplodedNodeSet& Dst);
369
370  /// VisitLogicalExpr - Transfer function logic for '&&', '||'
371  void VisitLogicalExpr(const BinaryOperator* B, ExplodedNode* Pred,
372                        ExplodedNodeSet& Dst);
373
374  /// VisitMemberExpr - Transfer function for member expressions.
375  void VisitMemberExpr(const MemberExpr* M, ExplodedNode* Pred,
376                           ExplodedNodeSet& Dst);
377
378  /// Transfer function logic for ObjCAtSynchronizedStmts.
379  void VisitObjCAtSynchronizedStmt(const ObjCAtSynchronizedStmt *S,
380                                   ExplodedNode *Pred, ExplodedNodeSet &Dst);
381
382  void VisitObjCPropertyRefExpr(const ObjCPropertyRefExpr *E,
383                                ExplodedNode *Pred, ExplodedNodeSet &Dst);
384
385  /// Transfer function logic for computing the lvalue of an Objective-C ivar.
386  void VisitLvalObjCIvarRefExpr(const ObjCIvarRefExpr* DR, ExplodedNode* Pred,
387                                ExplodedNodeSet& Dst);
388
389  /// VisitObjCForCollectionStmt - Transfer function logic for
390  ///  ObjCForCollectionStmt.
391  void VisitObjCForCollectionStmt(const ObjCForCollectionStmt* S,
392                                  ExplodedNode* Pred, ExplodedNodeSet& Dst);
393
394  void VisitObjCForCollectionStmtAux(const ObjCForCollectionStmt* S,
395                                     ExplodedNode* Pred,
396                                     ExplodedNodeSet& Dst, SVal ElementV);
397
398  /// VisitObjCMessageExpr - Transfer function for ObjC message expressions.
399  void VisitObjCMessageExpr(const ObjCMessageExpr* ME, ExplodedNode* Pred,
400                            ExplodedNodeSet& Dst);
401  void VisitObjCMessage(const ObjCMessage &msg, ExplodedNodeSet &Src,
402                        ExplodedNodeSet& Dst);
403
404  /// VisitReturnStmt - Transfer function logic for return statements.
405  void VisitReturnStmt(const ReturnStmt* R, ExplodedNode* Pred,
406                       ExplodedNodeSet& Dst);
407
408  /// VisitOffsetOfExpr - Transfer function for offsetof.
409  void VisitOffsetOfExpr(const OffsetOfExpr* Ex, ExplodedNode* Pred,
410                         ExplodedNodeSet& Dst);
411
412  /// VisitSizeOfAlignOfExpr - Transfer function for sizeof.
413  void VisitSizeOfAlignOfExpr(const SizeOfAlignOfExpr* Ex, ExplodedNode* Pred,
414                              ExplodedNodeSet& Dst);
415
416  /// VisitUnaryOperator - Transfer function logic for unary operators.
417  void VisitUnaryOperator(const UnaryOperator* B, ExplodedNode* Pred,
418                          ExplodedNodeSet& Dst);
419
420  void VisitCXXThisExpr(const CXXThisExpr *TE, ExplodedNode *Pred,
421                        ExplodedNodeSet & Dst);
422
423  void VisitCXXTemporaryObjectExpr(const CXXTemporaryObjectExpr *expr,
424                                   ExplodedNode *Pred, ExplodedNodeSet &Dst) {
425    VisitCXXConstructExpr(expr, 0, Pred, Dst);
426  }
427
428  void VisitCXXConstructExpr(const CXXConstructExpr *E, const MemRegion *Dest,
429                             ExplodedNode *Pred, ExplodedNodeSet &Dst);
430
431  void VisitCXXDestructor(const CXXDestructorDecl *DD,
432                          const MemRegion *Dest, const Stmt *S,
433                          ExplodedNode *Pred, ExplodedNodeSet &Dst);
434
435  void VisitCXXMemberCallExpr(const CXXMemberCallExpr *MCE, ExplodedNode *Pred,
436                              ExplodedNodeSet &Dst);
437
438  void VisitCXXOperatorCallExpr(const CXXOperatorCallExpr *C,
439                                ExplodedNode *Pred, ExplodedNodeSet &Dst);
440
441  void VisitCXXNewExpr(const CXXNewExpr *CNE, ExplodedNode *Pred,
442                       ExplodedNodeSet &Dst);
443
444  void VisitCXXDeleteExpr(const CXXDeleteExpr *CDE, ExplodedNode *Pred,
445                          ExplodedNodeSet &Dst);
446
447  void VisitAggExpr(const Expr *E, const MemRegion *Dest, ExplodedNode *Pred,
448                    ExplodedNodeSet &Dst);
449
450  /// Create a C++ temporary object for an rvalue.
451  void CreateCXXTemporaryObject(const Expr *Ex, ExplodedNode *Pred,
452                                ExplodedNodeSet &Dst);
453
454  /// Synthesize CXXThisRegion.
455  const CXXThisRegion *getCXXThisRegion(const CXXRecordDecl *RD,
456                                        const StackFrameContext *SFC);
457
458  const CXXThisRegion *getCXXThisRegion(const CXXMethodDecl *decl,
459                                        const StackFrameContext *frameCtx);
460
461  /// Evaluate arguments with a work list algorithm.
462  void evalArguments(ConstExprIterator AI, ConstExprIterator AE,
463                     const FunctionProtoType *FnType,
464                     ExplodedNode *Pred, ExplodedNodeSet &Dst,
465                     bool FstArgAsLValue = false);
466
467  /// Evaluate method call itself. Used for CXXMethodCallExpr and
468  /// CXXOperatorCallExpr.
469  void evalMethodCall(const CallExpr *MCE, const CXXMethodDecl *MD,
470                      const Expr *ThisExpr, ExplodedNode *Pred,
471                      ExplodedNodeSet &Src, ExplodedNodeSet &Dst);
472
473  /// evalEagerlyAssume - Given the nodes in 'Src', eagerly assume symbolic
474  ///  expressions of the form 'x != 0' and generate new nodes (stored in Dst)
475  ///  with those assumptions.
476  void evalEagerlyAssume(ExplodedNodeSet& Dst, ExplodedNodeSet& Src,
477                         const Expr *Ex);
478
479  SVal evalMinus(SVal X) {
480    return X.isValid() ? svalBuilder.evalMinus(cast<NonLoc>(X)) : X;
481  }
482
483  SVal evalComplement(SVal X) {
484    return X.isValid() ? svalBuilder.evalComplement(cast<NonLoc>(X)) : X;
485  }
486
487public:
488
489  SVal evalBinOp(const GRState *state, BinaryOperator::Opcode op,
490                 NonLoc L, NonLoc R, QualType T) {
491    return svalBuilder.evalBinOpNN(state, op, L, R, T);
492  }
493
494  SVal evalBinOp(const GRState *state, BinaryOperator::Opcode op,
495                 NonLoc L, SVal R, QualType T) {
496    return R.isValid() ? svalBuilder.evalBinOpNN(state,op,L, cast<NonLoc>(R), T) : R;
497  }
498
499  SVal evalBinOp(const GRState *ST, BinaryOperator::Opcode Op,
500                 SVal LHS, SVal RHS, QualType T) {
501    return svalBuilder.evalBinOp(ST, Op, LHS, RHS, T);
502  }
503
504protected:
505  void evalObjCMessage(ExplodedNodeSet& Dst, const ObjCMessage &msg,
506                       ExplodedNode* Pred, const GRState *state) {
507    assert (Builder && "StmtNodeBuilder must be defined.");
508    getTF().evalObjCMessage(Dst, *this, *Builder, msg, Pred, state);
509  }
510
511  const GRState* MarkBranch(const GRState* St, const Stmt* Terminator,
512                            bool branchTaken);
513
514  /// evalBind - Handle the semantics of binding a value to a specific location.
515  ///  This method is used by evalStore, VisitDeclStmt, and others.
516  void evalBind(ExplodedNodeSet& Dst, const Stmt* StoreE, ExplodedNode* Pred,
517                const GRState* St, SVal location, SVal Val,
518                bool atDeclInit = false);
519
520public:
521  // FIXME: 'tag' should be removed, and a LocationContext should be used
522  // instead.
523  // FIXME: Comment on the meaning of the arguments, when 'St' may not
524  // be the same as Pred->state, and when 'location' may not be the
525  // same as state->getLValue(Ex).
526  /// Simulate a read of the result of Ex.
527  void evalLoad(ExplodedNodeSet& Dst, const Expr* Ex, ExplodedNode* Pred,
528                const GRState* St, SVal location, const void *tag = 0,
529                QualType LoadTy = QualType());
530
531  // FIXME: 'tag' should be removed, and a LocationContext should be used
532  // instead.
533  void evalStore(ExplodedNodeSet& Dst, const Expr* AssignE, const Expr* StoreE,
534                 ExplodedNode* Pred, const GRState* St, SVal TargetLV, SVal Val,
535                 const void *tag = 0);
536private:
537  void evalLoadCommon(ExplodedNodeSet& Dst, const Expr* Ex, ExplodedNode* Pred,
538                      const GRState* St, SVal location, const void *tag,
539                      QualType LoadTy);
540
541  // FIXME: 'tag' should be removed, and a LocationContext should be used
542  // instead.
543  void evalLocation(ExplodedNodeSet &Dst, const Stmt *S, ExplodedNode* Pred,
544                    const GRState* St, SVal location,
545                    const void *tag, bool isLoad);
546
547  bool InlineCall(ExplodedNodeSet &Dst, const CallExpr *CE, ExplodedNode *Pred);
548};
549
550} // end ento namespace
551
552} // end clang namespace
553
554#endif
555