ExprEngine.cpp revision 537716ad8dd10f984b6cfe6985afade1185c5e3c
1d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidis//=-- ExprEngine.cpp - Path-Sensitive Expression-Level Dataflow ---*- C++ -*-= 264924859b6b09d1cfb62fecf5954ec6c27cb58feTed Kremenek// 34af84313df0d2710fd57af89132e680294225cadTed Kremenek// The LLVM Compiler Infrastructure 4d27f8169f4b68337a489547a41ac45bf7a5d1ddfTed Kremenek// 5d27f8169f4b68337a489547a41ac45bf7a5d1ddfTed Kremenek// This file is distributed under the University of Illinois Open Source 6d27f8169f4b68337a489547a41ac45bf7a5d1ddfTed Kremenek// License. See LICENSE.TXT for details. 7d27f8169f4b68337a489547a41ac45bf7a5d1ddfTed Kremenek// 8d27f8169f4b68337a489547a41ac45bf7a5d1ddfTed Kremenek//===----------------------------------------------------------------------===// 9d27f8169f4b68337a489547a41ac45bf7a5d1ddfTed Kremenek// 1077349cb20bfd7069d081f84c91975bfa8ef60a32Ted Kremenek// This file defines a meta-engine for path-sensitive dataflow analysis that 1177349cb20bfd7069d081f84c91975bfa8ef60a32Ted Kremenek// is built on GREngine, but provides the boilerplate to execute transfer 1277349cb20bfd7069d081f84c91975bfa8ef60a32Ted Kremenek// functions and build the ExplodedGraph at the expression level. 13d27f8169f4b68337a489547a41ac45bf7a5d1ddfTed Kremenek// 14d27f8169f4b68337a489547a41ac45bf7a5d1ddfTed Kremenek//===----------------------------------------------------------------------===// 15a7af5ea88a6c5bdf87497cca6c20831e8c546751Argyrios Kyrtzidis 1643dee220252ef0b42c5f8a3bb1eca97f84f2565fArgyrios Kyrtzidis#include "clang/StaticAnalyzer/Core/CheckerManager.h" 179b663716449b618ba0390b1dbebc54fa8e971124Ted Kremenek#include "clang/StaticAnalyzer/Core/BugReporter/BugType.h" 189b663716449b618ba0390b1dbebc54fa8e971124Ted Kremenek#include "clang/StaticAnalyzer/Core/PathSensitive/AnalysisManager.h" 199b663716449b618ba0390b1dbebc54fa8e971124Ted Kremenek#include "clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h" 209b663716449b618ba0390b1dbebc54fa8e971124Ted Kremenek#include "clang/StaticAnalyzer/Core/PathSensitive/ExprEngineBuilders.h" 21199c3d6cd16aebbb9c7f0d42af9d922c9628bf70Ken Dyck#include "clang/AST/CharUnits.h" 2216f0049415ec596504891259e2a83e19871c0d52Chris Lattner#include "clang/AST/ParentMap.h" 2316f0049415ec596504891259e2a83e19871c0d52Chris Lattner#include "clang/AST/StmtObjC.h" 24c506357c3778092c2a3251243f12524e8eb89274Zhongxing Xu#include "clang/AST/DeclCXX.h" 251b63e4f732dbc73d90abf886b4d21f8e3a165f6dChris Lattner#include "clang/Basic/Builtins.h" 2616f0049415ec596504891259e2a83e19871c0d52Chris Lattner#include "clang/Basic/SourceManager.h" 27e97ca065c91ff9ca2a2a42eb443eaa553c40441cTed Kremenek#include "clang/Basic/SourceManager.h" 280bed8a12f2878d3cd94fb8bdba55b593d92dd11aTed Kremenek#include "clang/Basic/PrettyStackTrace.h" 29a95d3750441ac8ad03e36af8e6e74039c9a3109dTed Kremenek#include "llvm/Support/raw_ostream.h" 306cb7c1a43b0c8f739d1f54b7fdae5ede86033496Benjamin Kramer#include "llvm/ADT/ImmutableList.h" 314323a57627e796dcfdfdb7d47672dc09ed308edaTed Kremenek 320f5f0595d6a038843a7051c5a65fca7bce2915a0Ted Kremenek#ifndef NDEBUG 330f5f0595d6a038843a7051c5a65fca7bce2915a0Ted Kremenek#include "llvm/Support/GraphWriter.h" 340f5f0595d6a038843a7051c5a65fca7bce2915a0Ted Kremenek#endif 350f5f0595d6a038843a7051c5a65fca7bce2915a0Ted Kremenek 36b387a3f23e423d62c053be86294b703da1d1a222Ted Kremenekusing namespace clang; 379ef6537a894c33003359b1f9b9676e9178e028b7Ted Kremenekusing namespace ento; 38b387a3f23e423d62c053be86294b703da1d1a222Ted Kremenekusing llvm::APSInt; 39ab2b8c54bca82866876f91e756788916d3fa20c3Ted Kremenek 40e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek//===----------------------------------------------------------------------===// 4132c4995826c76f282fc05fbbc3241d2dded4fb57Ted Kremenek// Utility functions. 4232c4995826c76f282fc05fbbc3241d2dded4fb57Ted Kremenek//===----------------------------------------------------------------------===// 4332c4995826c76f282fc05fbbc3241d2dded4fb57Ted Kremenek 449c378f705405d37f49795d5e915989de774fe11fTed Kremenekstatic inline Selector GetNullarySelector(const char* name, ASTContext &Ctx) { 4532c4995826c76f282fc05fbbc3241d2dded4fb57Ted Kremenek IdentifierInfo* II = &Ctx.Idents.get(name); 4632c4995826c76f282fc05fbbc3241d2dded4fb57Ted Kremenek return Ctx.Selectors.getSelector(0, &II); 4732c4995826c76f282fc05fbbc3241d2dded4fb57Ted Kremenek} 4832c4995826c76f282fc05fbbc3241d2dded4fb57Ted Kremenek 4932c4995826c76f282fc05fbbc3241d2dded4fb57Ted Kremenek//===----------------------------------------------------------------------===// 50bdb435ddaafd5069becd543d638112f68825b89dTed Kremenek// Engine construction and deletion. 51bdb435ddaafd5069becd543d638112f68825b89dTed Kremenek//===----------------------------------------------------------------------===// 52bdb435ddaafd5069becd543d638112f68825b89dTed Kremenek 53d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios KyrtzidisExprEngine::ExprEngine(AnalysisManager &mgr, TransferFuncs *tf) 5425e695b2d574d919cc1bbddf3a2efe073d449b1cZhongxing Xu : AMgr(mgr), 55d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidis Engine(*this), 56d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidis G(Engine.getGraph()), 5750a6d0ce344c02782e0207574005c3b2aaa5077cTed Kremenek Builder(NULL), 58c77a55126fcad66fb086f8e100a494caa2496a2dZhongxing Xu StateMgr(getContext(), mgr.getStoreManagerCreator(), 5932a58084a4c53e6938dd81bfce224db25a5976d1Ted Kremenek mgr.getConstraintManagerCreator(), G.getAllocator(), 6032a58084a4c53e6938dd81bfce224db25a5976d1Ted Kremenek *this), 6150a6d0ce344c02782e0207574005c3b2aaa5077cTed Kremenek SymMgr(StateMgr.getSymbolManager()), 62c8413fd03f73084a5c93028f8b4db619fc388087Ted Kremenek svalBuilder(StateMgr.getSValBuilder()), 630a3ed3143b00f237decb1288c1ff574ae09eba4eTed Kremenek EntryNode(NULL), currentStmt(NULL), 64a5a4166f8cb04490b7b27355874edfb98837cd45Zhongxing Xu NSExceptionII(NULL), NSExceptionInstanceRaiseSelectors(NULL), 65c77a55126fcad66fb086f8e100a494caa2496a2dZhongxing Xu RaiseSel(GetNullarySelector("raise", getContext())), 6632a58084a4c53e6938dd81bfce224db25a5976d1Ted Kremenek BR(mgr, *this), TF(tf) { 67b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 6832a58084a4c53e6938dd81bfce224db25a5976d1Ted Kremenek // FIXME: Eventually remove the TF object entirely. 6932a58084a4c53e6938dd81bfce224db25a5976d1Ted Kremenek TF->RegisterChecks(*this); 7032a58084a4c53e6938dd81bfce224db25a5976d1Ted Kremenek TF->RegisterPrinters(getStateManager().Printers); 71d767d81290288c030f3be0be1d3e62b9c8df51dcTed Kremenek 72d767d81290288c030f3be0be1d3e62b9c8df51dcTed Kremenek if (mgr.shouldEagerlyTrimExplodedGraph()) { 73d767d81290288c030f3be0be1d3e62b9c8df51dcTed Kremenek // Enable eager node reclaimation when constructing the ExplodedGraph. 74d767d81290288c030f3be0be1d3e62b9c8df51dcTed Kremenek G.enableNodeReclamation(); 75d767d81290288c030f3be0be1d3e62b9c8df51dcTed Kremenek } 76c80135ba857da48173578b9c528fce6777e18168Ted Kremenek} 7750a6d0ce344c02782e0207574005c3b2aaa5077cTed Kremenek 78d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios KyrtzidisExprEngine::~ExprEngine() { 79cf118d41f7930a18dce97416ef7834a62642f587Ted Kremenek BR.FlushReports(); 80e448ab4f9dd162802f5d7cfea60f7830cc61c654Ted Kremenek delete [] NSExceptionInstanceRaiseSelectors; 8150a6d0ce344c02782e0207574005c3b2aaa5077cTed Kremenek} 8250a6d0ce344c02782e0207574005c3b2aaa5077cTed Kremenek 83e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek//===----------------------------------------------------------------------===// 84e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek// Utility methods. 85e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek//===----------------------------------------------------------------------===// 86e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek 8718c66fdc3c4008d335885695fe36fb5353c5f672Ted Kremenekconst ProgramState *ExprEngine::getInitialState(const LocationContext *InitLoc) { 8818c66fdc3c4008d335885695fe36fb5353c5f672Ted Kremenek const ProgramState *state = StateMgr.getInitialState(InitLoc); 891eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 90cfcd7fd0de701c5ce05e96de1ed2d0bf8c7035d9Ted Kremenek // Preconditions. 91cfcd7fd0de701c5ce05e96de1ed2d0bf8c7035d9Ted Kremenek 9252e5602056e4cade24cbcca57767e94e1d430b03Ted Kremenek // FIXME: It would be nice if we had a more general mechanism to add 9352e5602056e4cade24cbcca57767e94e1d430b03Ted Kremenek // such preconditions. Some day. 945974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek do { 95b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek const Decl *D = InitLoc->getDecl(); 965974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek if (const FunctionDecl *FD = dyn_cast<FunctionDecl>(D)) { 975974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek // Precondition: the first argument of 'main' is an integer guaranteed 985974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek // to be > 0. 995974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek const IdentifierInfo *II = FD->getIdentifier(); 1005974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek if (!II || !(II->getName() == "main" && FD->getNumParams() > 0)) 1015974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek break; 1025974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek 1035974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek const ParmVarDecl *PD = FD->getParamDecl(0); 1045974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek QualType T = PD->getType(); 1055974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek if (!T->isIntegerType()) 1065974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek break; 107b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 1085974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek const MemRegion *R = state->getRegion(PD, InitLoc); 1095974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek if (!R) 1105974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek break; 111b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 1121397663af9dbcc24dbf0e11de43931b3dc08fdbbTed Kremenek SVal V = state->getSVal(loc::MemRegionVal(R)); 1139c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek SVal Constraint_untested = evalBinOp(state, BO_GT, V, 114c8413fd03f73084a5c93028f8b4db619fc388087Ted Kremenek svalBuilder.makeZeroVal(T), 1155974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek getContext().IntTy); 1165974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek 1175974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek DefinedOrUnknownSVal *Constraint = 1185974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek dyn_cast<DefinedOrUnknownSVal>(&Constraint_untested); 119b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 1205974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek if (!Constraint) 1215974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek break; 122b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 12318c66fdc3c4008d335885695fe36fb5353c5f672Ted Kremenek if (const ProgramState *newState = state->assume(*Constraint, true)) 1245974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek state = newState; 125b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 1265974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek break; 12752e5602056e4cade24cbcca57767e94e1d430b03Ted Kremenek } 1285974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek 129b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek if (const ObjCMethodDecl *MD = dyn_cast<ObjCMethodDecl>(D)) { 1305974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek // Precondition: 'self' is always non-null upon entry to an Objective-C 1315974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek // method. 1325974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek const ImplicitParamDecl *SelfD = MD->getSelfDecl(); 1335974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek const MemRegion *R = state->getRegion(SelfD, InitLoc); 1341397663af9dbcc24dbf0e11de43931b3dc08fdbbTed Kremenek SVal V = state->getSVal(loc::MemRegionVal(R)); 135b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 1365974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek if (const Loc *LV = dyn_cast<Loc>(&V)) { 1375974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek // Assume that the pointer value in 'self' is non-null. 13828f47b92e760ccf641ac91cb0fe1c12d9ca89795Ted Kremenek state = state->assume(*LV, true); 1395974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek assert(state && "'self' cannot be null"); 1405974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek } 141cfcd7fd0de701c5ce05e96de1ed2d0bf8c7035d9Ted Kremenek } 1425974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek } while (0); 143b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 14452e5602056e4cade24cbcca57767e94e1d430b03Ted Kremenek return state; 145e070a1df66aab6d4168fb28f7559fdf996df3567Ted Kremenek} 146e070a1df66aab6d4168fb28f7559fdf996df3567Ted Kremenek 147e5cfd52a3a5d4bb46f77323fa8fa0b973fcde7bcTed Kremenekbool 148e5cfd52a3a5d4bb46f77323fa8fa0b973fcde7bcTed KremenekExprEngine::doesInvalidateGlobals(const CallOrObjCMessage &callOrMessage) const 149e5cfd52a3a5d4bb46f77323fa8fa0b973fcde7bcTed Kremenek{ 150e5cfd52a3a5d4bb46f77323fa8fa0b973fcde7bcTed Kremenek if (callOrMessage.isFunctionCall() && !callOrMessage.isCXXCall()) { 151e5cfd52a3a5d4bb46f77323fa8fa0b973fcde7bcTed Kremenek SVal calleeV = callOrMessage.getFunctionCallee(); 152e5cfd52a3a5d4bb46f77323fa8fa0b973fcde7bcTed Kremenek if (const FunctionTextRegion *codeR = 1535f9e272e632e951b1efe824cd16acb4d96077930Chris Lattner dyn_cast_or_null<FunctionTextRegion>(calleeV.getAsRegion())) { 154e5cfd52a3a5d4bb46f77323fa8fa0b973fcde7bcTed Kremenek 155e5cfd52a3a5d4bb46f77323fa8fa0b973fcde7bcTed Kremenek const FunctionDecl *fd = codeR->getDecl(); 156e5cfd52a3a5d4bb46f77323fa8fa0b973fcde7bcTed Kremenek if (const IdentifierInfo *ii = fd->getIdentifier()) { 1575f9e272e632e951b1efe824cd16acb4d96077930Chris Lattner StringRef fname = ii->getName(); 158e5cfd52a3a5d4bb46f77323fa8fa0b973fcde7bcTed Kremenek if (fname == "strlen") 159e5cfd52a3a5d4bb46f77323fa8fa0b973fcde7bcTed Kremenek return false; 160e5cfd52a3a5d4bb46f77323fa8fa0b973fcde7bcTed Kremenek } 161e5cfd52a3a5d4bb46f77323fa8fa0b973fcde7bcTed Kremenek } 162e5cfd52a3a5d4bb46f77323fa8fa0b973fcde7bcTed Kremenek } 163e5cfd52a3a5d4bb46f77323fa8fa0b973fcde7bcTed Kremenek 164e5cfd52a3a5d4bb46f77323fa8fa0b973fcde7bcTed Kremenek // The conservative answer: invalidates globals. 165e5cfd52a3a5d4bb46f77323fa8fa0b973fcde7bcTed Kremenek return true; 166e5cfd52a3a5d4bb46f77323fa8fa0b973fcde7bcTed Kremenek} 167e5cfd52a3a5d4bb46f77323fa8fa0b973fcde7bcTed Kremenek 168e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek//===----------------------------------------------------------------------===// 169e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek// Top-level transfer function logic (Dispatcher). 170e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek//===----------------------------------------------------------------------===// 171e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek 1729c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek/// evalAssume - Called by ConstraintManager. Used to call checker-specific 17332a58084a4c53e6938dd81bfce224db25a5976d1Ted Kremenek/// logic for handling assumptions on symbolic values. 174294fd0a62b95f512637910bf85c7efa6c2354b50Ted Kremenekconst ProgramState *ExprEngine::processAssume(const ProgramState *state, 175294fd0a62b95f512637910bf85c7efa6c2354b50Ted Kremenek SVal cond, 176294fd0a62b95f512637910bf85c7efa6c2354b50Ted Kremenek bool assumption) { 177294fd0a62b95f512637910bf85c7efa6c2354b50Ted Kremenek 178294fd0a62b95f512637910bf85c7efa6c2354b50Ted Kremenek state = getCheckerManager().runCheckersForEvalAssume(state, cond, 179294fd0a62b95f512637910bf85c7efa6c2354b50Ted Kremenek assumption); 180312dbec867f6b8d6b86fd562c53352cd4db27468Argyrios Kyrtzidis 18172905cfa81cfd126f322c4173f56d332aac5539eJordy Rose // If the state is infeasible at this point, bail out. 18232a58084a4c53e6938dd81bfce224db25a5976d1Ted Kremenek if (!state) 18332a58084a4c53e6938dd81bfce224db25a5976d1Ted Kremenek return NULL; 184b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 1859c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek return TF->evalAssume(state, cond, assumption); 18632a58084a4c53e6938dd81bfce224db25a5976d1Ted Kremenek} 18732a58084a4c53e6938dd81bfce224db25a5976d1Ted Kremenek 18818c66fdc3c4008d335885695fe36fb5353c5f672Ted Kremenekbool ExprEngine::wantsRegionChangeUpdate(const ProgramState *state) { 189183ff98f425d470c2a0276880aaf43496c9dad14Argyrios Kyrtzidis return getCheckerManager().wantsRegionChangeUpdate(state); 190c2b7dfaad674587cfd220ff447b3710d252130c3Jordy Rose} 191c2b7dfaad674587cfd220ff447b3710d252130c3Jordy Rose 19218c66fdc3c4008d335885695fe36fb5353c5f672Ted Kremenekconst ProgramState * 19318c66fdc3c4008d335885695fe36fb5353c5f672Ted KremenekExprEngine::processRegionChanges(const ProgramState *state, 19435bdbf40624beba3fc00cb72ab444659939c1a6bTed Kremenek const StoreManager::InvalidatedSymbols *invalidated, 195537716ad8dd10f984b6cfe6985afade1185c5e3cJordy Rose ArrayRef<const MemRegion *> Explicits, 196537716ad8dd10f984b6cfe6985afade1185c5e3cJordy Rose ArrayRef<const MemRegion *> Regions) { 19735bdbf40624beba3fc00cb72ab444659939c1a6bTed Kremenek return getCheckerManager().runCheckersForRegionChanges(state, invalidated, 198537716ad8dd10f984b6cfe6985afade1185c5e3cJordy Rose Explicits, Regions); 199c2b7dfaad674587cfd220ff447b3710d252130c3Jordy Rose} 200c2b7dfaad674587cfd220ff447b3710d252130c3Jordy Rose 201e36de1fe51c39d9161915dd3dbef880954af6476Ted Kremenekvoid ExprEngine::processEndWorklist(bool hasWorkRemaining) { 20230726c6baee1417307236e854f1474fdb3cedb98Argyrios Kyrtzidis getCheckerManager().runCheckersForEndAnalysis(G, BR, *this); 203ccc263b44c62ce3a02f797a3ddb3d6017cf0e5e4Ted Kremenek} 204ccc263b44c62ce3a02f797a3ddb3d6017cf0e5e4Ted Kremenek 205e36de1fe51c39d9161915dd3dbef880954af6476Ted Kremenekvoid ExprEngine::processCFGElement(const CFGElement E, 206d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidis StmtNodeBuilder& builder) { 2079c6cd67ea416bace666d614c84d5531124287653Zhongxing Xu switch (E.getKind()) { 2083c0349e87cdbd7316d06d2411d86ee1086e717a5Ted Kremenek case CFGElement::Invalid: 2093c0349e87cdbd7316d06d2411d86ee1086e717a5Ted Kremenek llvm_unreachable("Unexpected CFGElement kind."); 2103c0349e87cdbd7316d06d2411d86ee1086e717a5Ted Kremenek case CFGElement::Statement: 211f1d10d939739f1a4544926d807e4f0f9fb64be61Ted Kremenek ProcessStmt(const_cast<Stmt*>(E.getAs<CFGStmt>()->getStmt()), builder); 2123c0349e87cdbd7316d06d2411d86ee1086e717a5Ted Kremenek return; 2133c0349e87cdbd7316d06d2411d86ee1086e717a5Ted Kremenek case CFGElement::Initializer: 2143c0349e87cdbd7316d06d2411d86ee1086e717a5Ted Kremenek ProcessInitializer(E.getAs<CFGInitializer>()->getInitializer(), builder); 2153c0349e87cdbd7316d06d2411d86ee1086e717a5Ted Kremenek return; 2163c0349e87cdbd7316d06d2411d86ee1086e717a5Ted Kremenek case CFGElement::AutomaticObjectDtor: 2173c0349e87cdbd7316d06d2411d86ee1086e717a5Ted Kremenek case CFGElement::BaseDtor: 2183c0349e87cdbd7316d06d2411d86ee1086e717a5Ted Kremenek case CFGElement::MemberDtor: 2193c0349e87cdbd7316d06d2411d86ee1086e717a5Ted Kremenek case CFGElement::TemporaryDtor: 2203c0349e87cdbd7316d06d2411d86ee1086e717a5Ted Kremenek ProcessImplicitDtor(*E.getAs<CFGImplicitDtor>(), builder); 2213c0349e87cdbd7316d06d2411d86ee1086e717a5Ted Kremenek return; 2229c6cd67ea416bace666d614c84d5531124287653Zhongxing Xu } 2239c6cd67ea416bace666d614c84d5531124287653Zhongxing Xu} 2249c6cd67ea416bace666d614c84d5531124287653Zhongxing Xu 225d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidisvoid ExprEngine::ProcessStmt(const CFGStmt S, StmtNodeBuilder& builder) { 2266bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks // TODO: Use RAII to remove the unnecessary, tagged nodes. 2276bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks //RegisterCreatedNodes registerCreatedNodes(getGraph()); 2286bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks 229d767d81290288c030f3be0be1d3e62b9c8df51dcTed Kremenek // Reclaim any unnecessary nodes in the ExplodedGraph. 230d767d81290288c030f3be0be1d3e62b9c8df51dcTed Kremenek G.reclaimRecentlyAllocatedNodes(); 23118c66fdc3c4008d335885695fe36fb5353c5f672Ted Kremenek // Recycle any unused states in the ProgramStateManager. 232e3115e257163321ecde429aeae75f1702f099d4cTed Kremenek StateMgr.recycleUnusedStates(); 233e3115e257163321ecde429aeae75f1702f099d4cTed Kremenek 2340a3ed3143b00f237decb1288c1ff574ae09eba4eTed Kremenek currentStmt = S.getStmt(); 2350bed8a12f2878d3cd94fb8bdba55b593d92dd11aTed Kremenek PrettyStackTraceLoc CrashInfo(getContext().getSourceManager(), 2360a3ed3143b00f237decb1288c1ff574ae09eba4eTed Kremenek currentStmt->getLocStart(), 2370bed8a12f2878d3cd94fb8bdba55b593d92dd11aTed Kremenek "Error evaluating statement"); 2381eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 2396bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks // A tag to track convenience transitions, which can be removed at cleanup. 240ca804539d908d3a0e8c72a0df5f1f571d29490bbTed Kremenek static SimpleProgramPointTag cleanupTag("ExprEngine : Clean Node"); 241e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek Builder = &builder; 242b4857264b8d3d861f688cdaa174aab30e0729a73Ted Kremenek EntryNode = builder.getPredecessor(); 2431eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 24418c66fdc3c4008d335885695fe36fb5353c5f672Ted Kremenek const ProgramState *EntryState = EntryNode->getState(); 2456bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks CleanedState = EntryState; 2466bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks ExplodedNode *CleanedNode = 0; 2476bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks 2481eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump // Create the cleaned state. 249bd533aa4ff8895c676d4634d0d3de254962569d0Jordy Rose const LocationContext *LC = EntryNode->getLocationContext(); 250882998923889a2fcce9b49696506c499e22cf38fTed Kremenek SymbolReaper SymReaper(LC, currentStmt, SymMgr, getStoreManager()); 251c179a7fbb294fe3ff6cf5479f6239a10f39628c7Zhongxing Xu 252bd533aa4ff8895c676d4634d0d3de254962569d0Jordy Rose if (AMgr.shouldPurgeDead()) { 2536bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks getCheckerManager().runCheckersForLiveSymbols(CleanedState, SymReaper); 254183ff98f425d470c2a0276880aaf43496c9dad14Argyrios Kyrtzidis 255bd533aa4ff8895c676d4634d0d3de254962569d0Jordy Rose const StackFrameContext *SFC = LC->getCurrentStackFrame(); 2566bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks 2576bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks // Create a state in which dead bindings are removed from the environment 2586bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks // and the store. TODO: The function should just return new env and store, 2596bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks // not a new state. 2606bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks CleanedState = StateMgr.removeDeadBindings(CleanedState, SFC, SymReaper); 261bd533aa4ff8895c676d4634d0d3de254962569d0Jordy Rose } 262241677a13cc46647a8f5098b3e3239bd9480dca2Ted Kremenek 26377d7ef8d8a80ccb2ab3d25c80810571e3ab14ee4Ted Kremenek // Process any special transfer function for dead symbols. 264031ccc0555a82afc2e8afe29e19dd57ff204e2deZhongxing Xu ExplodedNodeSet Tmp; 2656bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks if (!SymReaper.hasDeadSymbols()) { 2666bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks // Generate a CleanedNode that has the environment and store cleaned 2676bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks // up. Since no symbols are dead, we can optimize and not clean out 2686bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks // the constraint manager. 2696bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks CleanedNode = 270ca804539d908d3a0e8c72a0df5f1f571d29490bbTed Kremenek Builder->generateNode(currentStmt, CleanedState, EntryNode, &cleanupTag); 2716bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks Tmp.Add(CleanedNode); 2721eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 2736bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks } else { 27477d7ef8d8a80ccb2ab3d25c80810571e3ab14ee4Ted Kremenek SaveAndRestore<bool> OldSink(Builder->BuildSinks); 275b4857264b8d3d861f688cdaa174aab30e0729a73Ted Kremenek SaveOr OldHasGen(Builder->hasGeneratedNode); 276846d4e923bf11bcdc2816758aafa331795f29230Ted Kremenek 277331b0ac44b9eb0ffcba66b4f3f3f9adb27c2434fTed Kremenek SaveAndRestore<bool> OldPurgeDeadSymbols(Builder->PurgingDeadSymbols); 278331b0ac44b9eb0ffcba66b4f3f3f9adb27c2434fTed Kremenek Builder->PurgingDeadSymbols = true; 2791eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 2806bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks // Call checkers with the non-cleaned state so that they could query the 2816bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks // values of the soon to be dead symbols. 2829400613b54bf56c317786d778f58f45f1080d619Zhongxing Xu // FIXME: This should soon be removed. 2839400613b54bf56c317786d778f58f45f1080d619Zhongxing Xu ExplodedNodeSet Tmp2; 2849c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek getTF().evalDeadSymbols(Tmp2, *this, *Builder, EntryNode, 2856bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks EntryState, SymReaper); 28638f17d6c86417944403dfa2b0d50a0dc92efa9ceJordy Rose if (Tmp2.empty()) { 28738f17d6c86417944403dfa2b0d50a0dc92efa9ceJordy Rose Builder->MakeNode(Tmp2, currentStmt, EntryNode, EntryState); 28838f17d6c86417944403dfa2b0d50a0dc92efa9ceJordy Rose } 289846d4e923bf11bcdc2816758aafa331795f29230Ted Kremenek 2906bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks ExplodedNodeSet Tmp3; 2916bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks getCheckerManager().runCheckersForDeadSymbols(Tmp3, Tmp2, 292183ff98f425d470c2a0276880aaf43496c9dad14Argyrios Kyrtzidis SymReaper, currentStmt, *this); 293183ff98f425d470c2a0276880aaf43496c9dad14Argyrios Kyrtzidis 2946bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks // For each node in Tmp3, generate CleanedNodes that have the environment, 2956bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks // the store, and the constraints cleaned up but have the user supplied 2966bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks // states as the predecessors. 2976bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks for (ExplodedNodeSet::const_iterator I = Tmp3.begin(), E = Tmp3.end(); 2986bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks I != E; ++I) { 29918c66fdc3c4008d335885695fe36fb5353c5f672Ted Kremenek const ProgramState *CheckerState = (*I)->getState(); 3006bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks 3016bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks // The constraint manager has not been cleaned up yet, so clean up now. 3026bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks CheckerState = getConstraintManager().removeDeadBindings(CheckerState, 3036bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks SymReaper); 3046bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks 3056bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks assert(StateMgr.haveEqualEnvironments(CheckerState, EntryState) && 3066bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks "Checkers are not allowed to modify the Environment as a part of " 3076bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks "checkDeadSymbols processing."); 3086bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks assert(StateMgr.haveEqualStores(CheckerState, EntryState) && 3096bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks "Checkers are not allowed to modify the Store as a part of " 3106bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks "checkDeadSymbols processing."); 3116bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks 3126bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks // Create a state based on CleanedState with CheckerState GDM and 3136bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks // generate a transition to that state. 31418c66fdc3c4008d335885695fe36fb5353c5f672Ted Kremenek const ProgramState *CleanedCheckerSt = 3156bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks StateMgr.getPersistentStateWithGDM(CleanedState, CheckerState); 3166bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks ExplodedNode *CleanedNode = Builder->generateNode(currentStmt, 3176bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks CleanedCheckerSt, *I, 318ca804539d908d3a0e8c72a0df5f1f571d29490bbTed Kremenek &cleanupTag); 3196bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks Tmp.Add(CleanedNode); 3206bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks } 32177d7ef8d8a80ccb2ab3d25c80810571e3ab14ee4Ted Kremenek } 3221eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 323031ccc0555a82afc2e8afe29e19dd57ff204e2deZhongxing Xu for (ExplodedNodeSet::iterator I=Tmp.begin(), E=Tmp.end(); I!=E; ++I) { 3246bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks // TODO: Remove Dest set, it's no longer needed. 325031ccc0555a82afc2e8afe29e19dd57ff204e2deZhongxing Xu ExplodedNodeSet Dst; 3261eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump // Visit the statement. 3270a3ed3143b00f237decb1288c1ff574ae09eba4eTed Kremenek Visit(currentStmt, *I, Dst); 32877d7ef8d8a80ccb2ab3d25c80810571e3ab14ee4Ted Kremenek } 3291eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 330e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek // NULL out these variables to cleanup. 331846d4e923bf11bcdc2816758aafa331795f29230Ted Kremenek CleanedState = NULL; 332846d4e923bf11bcdc2816758aafa331795f29230Ted Kremenek EntryNode = NULL; 3330a3ed3143b00f237decb1288c1ff574ae09eba4eTed Kremenek currentStmt = 0; 334e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek Builder = NULL; 335e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek} 336e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek 337d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidisvoid ExprEngine::ProcessInitializer(const CFGInitializer Init, 338d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidis StmtNodeBuilder &builder) { 3390a3ed3143b00f237decb1288c1ff574ae09eba4eTed Kremenek // We don't set EntryNode and currentStmt. And we don't clean up state. 340cbb67480094b3bcb5b715acd827cbad55e2a204cSean Hunt const CXXCtorInitializer *BMI = Init.getInitializer(); 3419dc84c9455df2a77195147d0210c915dc1775a88Zhongxing Xu 342d074441e027471a914cbb909a7aad1d43224950fZhongxing Xu ExplodedNode *pred = builder.getPredecessor(); 343d074441e027471a914cbb909a7aad1d43224950fZhongxing Xu 344d074441e027471a914cbb909a7aad1d43224950fZhongxing Xu const StackFrameContext *stackFrame = cast<StackFrameContext>(pred->getLocationContext()); 345d074441e027471a914cbb909a7aad1d43224950fZhongxing Xu const CXXConstructorDecl *decl = cast<CXXConstructorDecl>(stackFrame->getDecl()); 346d074441e027471a914cbb909a7aad1d43224950fZhongxing Xu const CXXThisRegion *thisReg = getCXXThisRegion(decl, stackFrame); 347d074441e027471a914cbb909a7aad1d43224950fZhongxing Xu 348d074441e027471a914cbb909a7aad1d43224950fZhongxing Xu SVal thisVal = pred->getState()->getSVal(thisReg); 3499dc84c9455df2a77195147d0210c915dc1775a88Zhongxing Xu 35000eb3f9c5b33e3d99aee1f8b75dd9c9678fdd66bFrancois Pichet if (BMI->isAnyMemberInitializer()) { 3519dc84c9455df2a77195147d0210c915dc1775a88Zhongxing Xu ExplodedNodeSet Dst; 3529dc84c9455df2a77195147d0210c915dc1775a88Zhongxing Xu 3539dc84c9455df2a77195147d0210c915dc1775a88Zhongxing Xu // Evaluate the initializer. 354d074441e027471a914cbb909a7aad1d43224950fZhongxing Xu Visit(BMI->getInit(), pred, Dst); 3559dc84c9455df2a77195147d0210c915dc1775a88Zhongxing Xu 3569dc84c9455df2a77195147d0210c915dc1775a88Zhongxing Xu for (ExplodedNodeSet::iterator I = Dst.begin(), E = Dst.end(); I != E; ++I){ 3579dc84c9455df2a77195147d0210c915dc1775a88Zhongxing Xu ExplodedNode *Pred = *I; 35818c66fdc3c4008d335885695fe36fb5353c5f672Ted Kremenek const ProgramState *state = Pred->getState(); 3599dc84c9455df2a77195147d0210c915dc1775a88Zhongxing Xu 36000eb3f9c5b33e3d99aee1f8b75dd9c9678fdd66bFrancois Pichet const FieldDecl *FD = BMI->getAnyMember(); 3619dc84c9455df2a77195147d0210c915dc1775a88Zhongxing Xu 362d074441e027471a914cbb909a7aad1d43224950fZhongxing Xu SVal FieldLoc = state->getLValue(FD, thisVal); 3639dc84c9455df2a77195147d0210c915dc1775a88Zhongxing Xu SVal InitVal = state->getSVal(BMI->getInit()); 3649dc84c9455df2a77195147d0210c915dc1775a88Zhongxing Xu state = state->bindLoc(FieldLoc, InitVal); 3659dc84c9455df2a77195147d0210c915dc1775a88Zhongxing Xu 3669dc84c9455df2a77195147d0210c915dc1775a88Zhongxing Xu // Use a custom node building process. 367d074441e027471a914cbb909a7aad1d43224950fZhongxing Xu PostInitializer PP(BMI, stackFrame); 3689dc84c9455df2a77195147d0210c915dc1775a88Zhongxing Xu // Builder automatically add the generated node to the deferred set, 3699dc84c9455df2a77195147d0210c915dc1775a88Zhongxing Xu // which are processed in the builder's dtor. 3709dc84c9455df2a77195147d0210c915dc1775a88Zhongxing Xu builder.generateNode(PP, state, Pred); 3719dc84c9455df2a77195147d0210c915dc1775a88Zhongxing Xu } 372d074441e027471a914cbb909a7aad1d43224950fZhongxing Xu return; 3739dc84c9455df2a77195147d0210c915dc1775a88Zhongxing Xu } 374d074441e027471a914cbb909a7aad1d43224950fZhongxing Xu 375d074441e027471a914cbb909a7aad1d43224950fZhongxing Xu assert(BMI->isBaseInitializer()); 376d074441e027471a914cbb909a7aad1d43224950fZhongxing Xu 377d074441e027471a914cbb909a7aad1d43224950fZhongxing Xu // Get the base class declaration. 378d074441e027471a914cbb909a7aad1d43224950fZhongxing Xu const CXXConstructExpr *ctorExpr = cast<CXXConstructExpr>(BMI->getInit()); 379d074441e027471a914cbb909a7aad1d43224950fZhongxing Xu 380d074441e027471a914cbb909a7aad1d43224950fZhongxing Xu // Create the base object region. 381d074441e027471a914cbb909a7aad1d43224950fZhongxing Xu SVal baseVal = 382d074441e027471a914cbb909a7aad1d43224950fZhongxing Xu getStoreManager().evalDerivedToBase(thisVal, ctorExpr->getType()); 383d074441e027471a914cbb909a7aad1d43224950fZhongxing Xu const MemRegion *baseReg = baseVal.getAsRegion(); 384d074441e027471a914cbb909a7aad1d43224950fZhongxing Xu assert(baseReg); 385d074441e027471a914cbb909a7aad1d43224950fZhongxing Xu Builder = &builder; 386d074441e027471a914cbb909a7aad1d43224950fZhongxing Xu ExplodedNodeSet dst; 387d074441e027471a914cbb909a7aad1d43224950fZhongxing Xu VisitCXXConstructExpr(ctorExpr, baseReg, pred, dst); 3889c6cd67ea416bace666d614c84d5531124287653Zhongxing Xu} 3899c6cd67ea416bace666d614c84d5531124287653Zhongxing Xu 390d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidisvoid ExprEngine::ProcessImplicitDtor(const CFGImplicitDtor D, 391d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidis StmtNodeBuilder &builder) { 392b13453bd8a91f331d0910ca95ad52aa41b52f648Zhongxing Xu Builder = &builder; 393b13453bd8a91f331d0910ca95ad52aa41b52f648Zhongxing Xu 3943c0349e87cdbd7316d06d2411d86ee1086e717a5Ted Kremenek switch (D.getKind()) { 3954ffcb9974c6b7142c4a1483abfcb1f88b6371c45Zhongxing Xu case CFGElement::AutomaticObjectDtor: 3964ffcb9974c6b7142c4a1483abfcb1f88b6371c45Zhongxing Xu ProcessAutomaticObjDtor(cast<CFGAutomaticObjDtor>(D), builder); 3974ffcb9974c6b7142c4a1483abfcb1f88b6371c45Zhongxing Xu break; 3984ffcb9974c6b7142c4a1483abfcb1f88b6371c45Zhongxing Xu case CFGElement::BaseDtor: 3994ffcb9974c6b7142c4a1483abfcb1f88b6371c45Zhongxing Xu ProcessBaseDtor(cast<CFGBaseDtor>(D), builder); 4004ffcb9974c6b7142c4a1483abfcb1f88b6371c45Zhongxing Xu break; 4014ffcb9974c6b7142c4a1483abfcb1f88b6371c45Zhongxing Xu case CFGElement::MemberDtor: 4024ffcb9974c6b7142c4a1483abfcb1f88b6371c45Zhongxing Xu ProcessMemberDtor(cast<CFGMemberDtor>(D), builder); 4034ffcb9974c6b7142c4a1483abfcb1f88b6371c45Zhongxing Xu break; 4044ffcb9974c6b7142c4a1483abfcb1f88b6371c45Zhongxing Xu case CFGElement::TemporaryDtor: 4054ffcb9974c6b7142c4a1483abfcb1f88b6371c45Zhongxing Xu ProcessTemporaryDtor(cast<CFGTemporaryDtor>(D), builder); 4064ffcb9974c6b7142c4a1483abfcb1f88b6371c45Zhongxing Xu break; 4074ffcb9974c6b7142c4a1483abfcb1f88b6371c45Zhongxing Xu default: 4084ffcb9974c6b7142c4a1483abfcb1f88b6371c45Zhongxing Xu llvm_unreachable("Unexpected dtor kind."); 4094ffcb9974c6b7142c4a1483abfcb1f88b6371c45Zhongxing Xu } 4104ffcb9974c6b7142c4a1483abfcb1f88b6371c45Zhongxing Xu} 4114ffcb9974c6b7142c4a1483abfcb1f88b6371c45Zhongxing Xu 412d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidisvoid ExprEngine::ProcessAutomaticObjDtor(const CFGAutomaticObjDtor dtor, 413d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidis StmtNodeBuilder &builder) { 414b4857264b8d3d861f688cdaa174aab30e0729a73Ted Kremenek ExplodedNode *pred = builder.getPredecessor(); 41518c66fdc3c4008d335885695fe36fb5353c5f672Ted Kremenek const ProgramState *state = pred->getState(); 4162210490e6d099b7a5b4f68f44a136e4dcf3cdea2Zhongxing Xu const VarDecl *varDecl = dtor.getVarDecl(); 4172210490e6d099b7a5b4f68f44a136e4dcf3cdea2Zhongxing Xu 4182210490e6d099b7a5b4f68f44a136e4dcf3cdea2Zhongxing Xu QualType varType = varDecl->getType(); 4192210490e6d099b7a5b4f68f44a136e4dcf3cdea2Zhongxing Xu 4202210490e6d099b7a5b4f68f44a136e4dcf3cdea2Zhongxing Xu if (const ReferenceType *refType = varType->getAs<ReferenceType>()) 4212210490e6d099b7a5b4f68f44a136e4dcf3cdea2Zhongxing Xu varType = refType->getPointeeType(); 4222210490e6d099b7a5b4f68f44a136e4dcf3cdea2Zhongxing Xu 4232210490e6d099b7a5b4f68f44a136e4dcf3cdea2Zhongxing Xu const CXXRecordDecl *recordDecl = varType->getAsCXXRecordDecl(); 4242210490e6d099b7a5b4f68f44a136e4dcf3cdea2Zhongxing Xu assert(recordDecl && "get CXXRecordDecl fail"); 4252210490e6d099b7a5b4f68f44a136e4dcf3cdea2Zhongxing Xu const CXXDestructorDecl *dtorDecl = recordDecl->getDestructor(); 426b13453bd8a91f331d0910ca95ad52aa41b52f648Zhongxing Xu 4272210490e6d099b7a5b4f68f44a136e4dcf3cdea2Zhongxing Xu Loc dest = state->getLValue(varDecl, pred->getLocationContext()); 428b13453bd8a91f331d0910ca95ad52aa41b52f648Zhongxing Xu 4292210490e6d099b7a5b4f68f44a136e4dcf3cdea2Zhongxing Xu ExplodedNodeSet dstSet; 4302210490e6d099b7a5b4f68f44a136e4dcf3cdea2Zhongxing Xu VisitCXXDestructor(dtorDecl, cast<loc::MemRegionVal>(dest).getRegion(), 4312210490e6d099b7a5b4f68f44a136e4dcf3cdea2Zhongxing Xu dtor.getTriggerStmt(), pred, dstSet); 4324ffcb9974c6b7142c4a1483abfcb1f88b6371c45Zhongxing Xu} 4334ffcb9974c6b7142c4a1483abfcb1f88b6371c45Zhongxing Xu 434d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidisvoid ExprEngine::ProcessBaseDtor(const CFGBaseDtor D, 435d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidis StmtNodeBuilder &builder) { 4364ffcb9974c6b7142c4a1483abfcb1f88b6371c45Zhongxing Xu} 4374ffcb9974c6b7142c4a1483abfcb1f88b6371c45Zhongxing Xu 438d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidisvoid ExprEngine::ProcessMemberDtor(const CFGMemberDtor D, 439d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidis StmtNodeBuilder &builder) { 4404ffcb9974c6b7142c4a1483abfcb1f88b6371c45Zhongxing Xu} 4414ffcb9974c6b7142c4a1483abfcb1f88b6371c45Zhongxing Xu 442d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidisvoid ExprEngine::ProcessTemporaryDtor(const CFGTemporaryDtor D, 443d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidis StmtNodeBuilder &builder) { 4449c6cd67ea416bace666d614c84d5531124287653Zhongxing Xu} 4459c6cd67ea416bace666d614c84d5531124287653Zhongxing Xu 4469c378f705405d37f49795d5e915989de774fe11fTed Kremenekvoid ExprEngine::Visit(const Stmt *S, ExplodedNode *Pred, 4479c378f705405d37f49795d5e915989de774fe11fTed Kremenek ExplodedNodeSet &Dst) { 4480bed8a12f2878d3cd94fb8bdba55b593d92dd11aTed Kremenek PrettyStackTraceLoc CrashInfo(getContext().getSourceManager(), 4490bed8a12f2878d3cd94fb8bdba55b593d92dd11aTed Kremenek S->getLocStart(), 4500bed8a12f2878d3cd94fb8bdba55b593d92dd11aTed Kremenek "Error evaluating statement"); 4510bed8a12f2878d3cd94fb8bdba55b593d92dd11aTed Kremenek 452f6a1648197562e0b133440d612d9af297d0a86ccJohn McCall // Expressions to ignore. 453f6a1648197562e0b133440d612d9af297d0a86ccJohn McCall if (const Expr *Ex = dyn_cast<Expr>(S)) 454892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek S = Ex->IgnoreParens(); 455f6a1648197562e0b133440d612d9af297d0a86ccJohn McCall 456e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek // FIXME: add metadata to the CFG so that we can disable 457e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek // this check when we KNOW that there is no block-level subexpression. 458e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek // The motivation is that this check requires a hashtable lookup. 4591eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 4600a3ed3143b00f237decb1288c1ff574ae09eba4eTed Kremenek if (S != currentStmt && Pred->getLocationContext()->getCFG()->isBlkExpr(S)) { 461e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek Dst.Add(Pred); 462e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek return; 463e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek } 4641eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 465e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek switch (S->getStmtClass()) { 466f85e193739c953358c865005855253af4f68a497John McCall // C++ and ARC stuff we don't support yet. 467f85e193739c953358c865005855253af4f68a497John McCall case Expr::ObjCIndirectCopyRestoreExprClass: 4681b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::CXXBindTemporaryExprClass: 4691b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::CXXCatchStmtClass: 4701b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::CXXDependentScopeMemberExprClass: 471ad762fcdc16b9e4705b12b09d92b8c026212b906Richard Smith case Stmt::CXXForRangeStmtClass: 4721b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::CXXPseudoDestructorExprClass: 473c768a0c46e6c064c3281d663777ee95aea8652eeTed Kremenek case Stmt::CXXTemporaryObjectExprClass: 4741b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::CXXThrowExprClass: 4751b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::CXXTryStmtClass: 4761b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::CXXTypeidExprClass: 4779be88403e965cc49af76c9d33d818781d44b333eFrancois Pichet case Stmt::CXXUuidofExprClass: 478c768a0c46e6c064c3281d663777ee95aea8652eeTed Kremenek case Stmt::CXXUnresolvedConstructExprClass: 479ed8abf18329df67b0abcbb3a10458bd8c1d2a595Douglas Gregor case Stmt::CXXScalarValueInitExprClass: 4801b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::DependentScopeDeclRefExprClass: 4811b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::UnaryTypeTraitExprClass: 4826ad6f2848d7652ab2991286eb48be440d3493b28Francois Pichet case Stmt::BinaryTypeTraitExprClass: 48321ff2e516b0e0bc8c1dbf965cb3d44bac3c64330John Wiegley case Stmt::ArrayTypeTraitExprClass: 484552622067dc45013d240f73952fece703f5e63bdJohn Wiegley case Stmt::ExpressionTraitExprClass: 4851b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::UnresolvedLookupExprClass: 486c768a0c46e6c064c3281d663777ee95aea8652eeTed Kremenek case Stmt::UnresolvedMemberExprClass: 4876b219d082434394c1ac401390ec1d1967727815aSebastian Redl case Stmt::CXXNoexceptExprClass: 488be230c36e32142cbdcdbe9c97511d097beeecbabDouglas Gregor case Stmt::PackExpansionExprClass: 489c7793c73ba8a343de3f2552d984851985a46f159Douglas Gregor case Stmt::SubstNonTypeTemplateParmPackExprClass: 49028bbe4b8acc338476fe0825769b41fb32b423c72John Wiegley case Stmt::SEHTryStmtClass: 49128bbe4b8acc338476fe0825769b41fb32b423c72John Wiegley case Stmt::SEHExceptStmtClass: 49228bbe4b8acc338476fe0825769b41fb32b423c72John Wiegley case Stmt::SEHFinallyStmtClass: 4931b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek { 494c768a0c46e6c064c3281d663777ee95aea8652eeTed Kremenek SaveAndRestore<bool> OldSink(Builder->BuildSinks); 495c768a0c46e6c064c3281d663777ee95aea8652eeTed Kremenek Builder->BuildSinks = true; 496db5e8cd095d1ffdd18f5620ad2348b5f386bebe3Anna Zaks const ExplodedNode *node = MakeNode(Dst, S, Pred, Pred->getState()); 497422ab7a49a9a4252dbc6350e49d7a5708337b9c7Ted Kremenek Engine.addAbortedBlock(node, Builder->getBlock()); 498c768a0c46e6c064c3281d663777ee95aea8652eeTed Kremenek break; 499c768a0c46e6c064c3281d663777ee95aea8652eeTed Kremenek } 5005fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek 5015fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek // We don't handle default arguments either yet, but we can fake it 5025fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek // for now by just skipping them. 50391a5755ad73c5dc1dfb167e448fdd74e75a6df56John McCall case Stmt::SubstNonTypeTemplateParmExprClass: 5045fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek case Stmt::CXXDefaultArgExprClass: { 5055fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek Dst.Add(Pred); 5065fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek break; 5075fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek } 5085fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek 509f6a1648197562e0b133440d612d9af297d0a86ccJohn McCall case Stmt::ParenExprClass: 510f6a1648197562e0b133440d612d9af297d0a86ccJohn McCall llvm_unreachable("ParenExprs already handled."); 511f111d935722ed488144600cea5ed03a6b5069e8fPeter Collingbourne case Stmt::GenericSelectionExprClass: 512f111d935722ed488144600cea5ed03a6b5069e8fPeter Collingbourne llvm_unreachable("GenericSelectionExprs already handled."); 5131b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek // Cases that should never be evaluated simply because they shouldn't 5141b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek // appear in the CFG. 5151b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::BreakStmtClass: 5161b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::CaseStmtClass: 5171b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::CompoundStmtClass: 5181b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::ContinueStmtClass: 5191b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::DefaultStmtClass: 5201b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::DoStmtClass: 521d40066b0fb883839a9100e5455e33190b9b8abacTed Kremenek case Stmt::ForStmtClass: 5221b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::GotoStmtClass: 523d40066b0fb883839a9100e5455e33190b9b8abacTed Kremenek case Stmt::IfStmtClass: 5241b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::IndirectGotoStmtClass: 5251b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::LabelStmtClass: 5261b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::NoStmtClass: 5271b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::NullStmtClass: 528d40066b0fb883839a9100e5455e33190b9b8abacTed Kremenek case Stmt::SwitchStmtClass: 529d40066b0fb883839a9100e5455e33190b9b8abacTed Kremenek case Stmt::WhileStmtClass: 5301b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek llvm_unreachable("Stmt should not be in analyzer evaluation loop"); 5311b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek break; 5321b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek 5338ad9cbc518a603176462f1fa1efe389023590082Ted Kremenek case Stmt::GNUNullExprClass: { 5348f08426e6f54ed20b959018f24dbea106a00b4adJordy Rose // GNU __null is a pointer-width integer, not an actual pointer. 53518c66fdc3c4008d335885695fe36fb5353c5f672Ted Kremenek const ProgramState *state = Pred->getState(); 5368f08426e6f54ed20b959018f24dbea106a00b4adJordy Rose state = state->BindExpr(S, svalBuilder.makeIntValWithPtrWidth(0, false)); 5378f08426e6f54ed20b959018f24dbea106a00b4adJordy Rose MakeNode(Dst, S, Pred, state); 5388ad9cbc518a603176462f1fa1efe389023590082Ted Kremenek break; 5398ad9cbc518a603176462f1fa1efe389023590082Ted Kremenek } 5408ad9cbc518a603176462f1fa1efe389023590082Ted Kremenek 5414beaa9f51b2da57c64740cef2bd1c2fdb0c325d5Ted Kremenek case Stmt::ObjCAtSynchronizedStmtClass: 5424beaa9f51b2da57c64740cef2bd1c2fdb0c325d5Ted Kremenek VisitObjCAtSynchronizedStmt(cast<ObjCAtSynchronizedStmt>(S), Pred, Dst); 5434beaa9f51b2da57c64740cef2bd1c2fdb0c325d5Ted Kremenek break; 5444beaa9f51b2da57c64740cef2bd1c2fdb0c325d5Ted Kremenek 54514429b918bd2f4cb52abc75546a7fe37142054caArgyrios Kyrtzidis case Stmt::ObjCPropertyRefExprClass: 546f8b5aae41e46f94fe90ed5f1ee98f36f0aa59dc9Ted Kremenek // Implicitly handled by Environment::getSVal(). 547f8b5aae41e46f94fe90ed5f1ee98f36f0aa59dc9Ted Kremenek Dst.Add(Pred); 54814429b918bd2f4cb52abc75546a7fe37142054caArgyrios Kyrtzidis break; 54914429b918bd2f4cb52abc75546a7fe37142054caArgyrios Kyrtzidis 550f85e193739c953358c865005855253af4f68a497John McCall case Stmt::ImplicitValueInitExprClass: { 55118c66fdc3c4008d335885695fe36fb5353c5f672Ted Kremenek const ProgramState *state = Pred->getState(); 552f85e193739c953358c865005855253af4f68a497John McCall QualType ty = cast<ImplicitValueInitExpr>(S)->getType(); 553f85e193739c953358c865005855253af4f68a497John McCall SVal val = svalBuilder.makeZeroVal(ty); 554f85e193739c953358c865005855253af4f68a497John McCall MakeNode(Dst, S, Pred, state->BindExpr(S, val)); 555f85e193739c953358c865005855253af4f68a497John McCall break; 556f85e193739c953358c865005855253af4f68a497John McCall } 557f85e193739c953358c865005855253af4f68a497John McCall 558f85e193739c953358c865005855253af4f68a497John McCall case Stmt::ExprWithCleanupsClass: { 559f85e193739c953358c865005855253af4f68a497John McCall Visit(cast<ExprWithCleanups>(S)->getSubExpr(), Pred, Dst); 560f85e193739c953358c865005855253af4f68a497John McCall break; 561f85e193739c953358c865005855253af4f68a497John McCall } 562f85e193739c953358c865005855253af4f68a497John McCall 5631b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek // Cases not handled yet; but will handle some day. 5641b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::DesignatedInitExprClass: 5651b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::ExtVectorElementExprClass: 5661b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::ImaginaryLiteralClass: 5671b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::ObjCAtCatchStmtClass: 5681b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::ObjCAtFinallyStmtClass: 5691b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::ObjCAtTryStmtClass: 570f85e193739c953358c865005855253af4f68a497John McCall case Stmt::ObjCAutoreleasePoolStmtClass: 5711b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::ObjCEncodeExprClass: 5721b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::ObjCIsaExprClass: 5731b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::ObjCProtocolExprClass: 5741b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::ObjCSelectorExprClass: 5751b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::ObjCStringLiteralClass: 5761b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::ParenListExprClass: 5771b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::PredefinedExprClass: 5781b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::ShuffleVectorExprClass: 5791b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::VAArgExprClass: 580e08ce650a2b02410eddd1f60a4aa6b3d4be71e73Peter Collingbourne case Stmt::CUDAKernelCallExprClass: 58156ca35d396d8692c384c785f9aeebcf22563fe1eJohn McCall case Stmt::OpaqueValueExprClass: 58261eee0ca33b29e102f11bab77c8b74cc00e2392bTanya Lattner case Stmt::AsTypeExprClass: 5831b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek // Fall through. 5841b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek 5851b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek // Cases we intentionally don't evaluate, since they don't need 5861b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek // to be explicitly evaluated. 587bc9ad74a13e83303a3a5251f8bacbbca17341c17Zhongxing Xu case Stmt::AddrLabelExprClass: 588bc9ad74a13e83303a3a5251f8bacbbca17341c17Zhongxing Xu case Stmt::IntegerLiteralClass: 589bc9ad74a13e83303a3a5251f8bacbbca17341c17Zhongxing Xu case Stmt::CharacterLiteralClass: 590477323d58a0de352c6a61e08b5a83127c4adc904Zhongxing Xu case Stmt::CXXBoolLiteralExprClass: 591bc9ad74a13e83303a3a5251f8bacbbca17341c17Zhongxing Xu case Stmt::FloatingLiteralClass: 592f901a7de97f46ba2b1ff153f9fb83d00dc37cfcfDouglas Gregor case Stmt::SizeOfPackExprClass: 593e970c60dadaf22019743724bac879dbefbc4f5e3Ted Kremenek case Stmt::CXXNullPtrLiteralExprClass: 594e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek Dst.Add(Pred); // No-op. Simply propagate the current state unchanged. 595e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek break; 5961eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 597540cbe2b60294fe7b926c26b4f1840f544fe3011Ted Kremenek case Stmt::ArraySubscriptExprClass: 598892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek VisitLvalArraySubscriptExpr(cast<ArraySubscriptExpr>(S), Pred, Dst); 599540cbe2b60294fe7b926c26b4f1840f544fe3011Ted Kremenek break; 6001eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 601e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek case Stmt::AsmStmtClass: 602e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek VisitAsmStmt(cast<AsmStmt>(S), Pred, Dst); 603e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek break; 604b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 605892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek case Stmt::BlockDeclRefExprClass: { 606892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek const BlockDeclRefExpr *BE = cast<BlockDeclRefExpr>(S); 607892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek VisitCommonDeclRefExpr(BE, BE->getDecl(), Pred, Dst); 60867d1287035767f4f6c8ca0c2bb755990012a44caTed Kremenek break; 609892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek } 6101eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 611c95ad9ff6e574aecdd759542d5578bc65d586d93Ted Kremenek case Stmt::BlockExprClass: 612c95ad9ff6e574aecdd759542d5578bc65d586d93Ted Kremenek VisitBlockExpr(cast<BlockExpr>(S), Pred, Dst); 613c95ad9ff6e574aecdd759542d5578bc65d586d93Ted Kremenek break; 614c95ad9ff6e574aecdd759542d5578bc65d586d93Ted Kremenek 615e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek case Stmt::BinaryOperatorClass: { 61603509aea098772644bf4662dc1c88634818ceeccZhongxing Xu const BinaryOperator* B = cast<BinaryOperator>(S); 617e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek if (B->isLogicalOp()) { 618e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek VisitLogicalExpr(B, Pred, Dst); 619e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek break; 620e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek } 6212de56d1d0c3a504ad1529de2677628bdfbb95cd4John McCall else if (B->getOpcode() == BO_Comma) { 62218c66fdc3c4008d335885695fe36fb5353c5f672Ted Kremenek const ProgramState *state = Pred->getState(); 6231397663af9dbcc24dbf0e11de43931b3dc08fdbbTed Kremenek MakeNode(Dst, B, Pred, state->BindExpr(B, state->getSVal(B->getRHS()))); 624e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek break; 625e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek } 62606fb99fb403bff1651429923f666a2ebe2b1522fTed Kremenek 627b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek if (AMgr.shouldEagerlyAssume() && 628bb141217871e93767aa3f2de1b9946fa6d37066aZhongxing Xu (B->isRelationalOp() || B->isEqualityOp())) { 629031ccc0555a82afc2e8afe29e19dd57ff204e2deZhongxing Xu ExplodedNodeSet Tmp; 630892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek VisitBinaryOperator(cast<BinaryOperator>(S), Pred, Tmp); 6319c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek evalEagerlyAssume(Dst, Tmp, cast<Expr>(S)); 63248af2a9c1ed3259512f2d1431720add1fbe8fb5fTed Kremenek } 63348af2a9c1ed3259512f2d1431720add1fbe8fb5fTed Kremenek else 634892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek VisitBinaryOperator(cast<BinaryOperator>(S), Pred, Dst); 63548af2a9c1ed3259512f2d1431720add1fbe8fb5fTed Kremenek 636e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek break; 637e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek } 63806fb99fb403bff1651429923f666a2ebe2b1522fTed Kremenek 639b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek case Stmt::CallExprClass: 640b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek case Stmt::CXXOperatorCallExprClass: 641b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek case Stmt::CXXMemberCallExprClass: { 642b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek VisitCallExpr(cast<CallExpr>(S), Pred, Dst); 64306fb99fb403bff1651429923f666a2ebe2b1522fTed Kremenek break; 644e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek } 64506fb99fb403bff1651429923f666a2ebe2b1522fTed Kremenek 6467ce351db56fbce162a3b650518ce05b5c61ebf36Zhongxing Xu case Stmt::CXXConstructExprClass: { 6477ce351db56fbce162a3b650518ce05b5c61ebf36Zhongxing Xu const CXXConstructExpr *C = cast<CXXConstructExpr>(S); 6487ce351db56fbce162a3b650518ce05b5c61ebf36Zhongxing Xu // For block-level CXXConstructExpr, we don't have a destination region. 6497ce351db56fbce162a3b650518ce05b5c61ebf36Zhongxing Xu // Let VisitCXXConstructExpr() create one. 650892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek VisitCXXConstructExpr(C, 0, Pred, Dst); 6517ce351db56fbce162a3b650518ce05b5c61ebf36Zhongxing Xu break; 6527ce351db56fbce162a3b650518ce05b5c61ebf36Zhongxing Xu } 6537ce351db56fbce162a3b650518ce05b5c61ebf36Zhongxing Xu 654856c6bcaea56e05255e9f3997ddd56b5c18a14f0Zhongxing Xu case Stmt::CXXNewExprClass: { 65503509aea098772644bf4662dc1c88634818ceeccZhongxing Xu const CXXNewExpr *NE = cast<CXXNewExpr>(S); 656856c6bcaea56e05255e9f3997ddd56b5c18a14f0Zhongxing Xu VisitCXXNewExpr(NE, Pred, Dst); 657856c6bcaea56e05255e9f3997ddd56b5c18a14f0Zhongxing Xu break; 658856c6bcaea56e05255e9f3997ddd56b5c18a14f0Zhongxing Xu } 659856c6bcaea56e05255e9f3997ddd56b5c18a14f0Zhongxing Xu 6606b8513829895e56a7b97e787ea74520bc626512eZhongxing Xu case Stmt::CXXDeleteExprClass: { 66103509aea098772644bf4662dc1c88634818ceeccZhongxing Xu const CXXDeleteExpr *CDE = cast<CXXDeleteExpr>(S); 6626b8513829895e56a7b97e787ea74520bc626512eZhongxing Xu VisitCXXDeleteExpr(CDE, Pred, Dst); 6636b8513829895e56a7b97e787ea74520bc626512eZhongxing Xu break; 6646b8513829895e56a7b97e787ea74520bc626512eZhongxing Xu } 665e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek // FIXME: ChooseExpr is really a constant. We need to fix 666e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek // the CFG do not model them as explicit control-flow. 6671eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 668e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek case Stmt::ChooseExprClass: { // __builtin_choose_expr 6699c378f705405d37f49795d5e915989de774fe11fTed Kremenek const ChooseExpr *C = cast<ChooseExpr>(S); 670e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek VisitGuardedExpr(C, C->getLHS(), C->getRHS(), Pred, Dst); 671e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek break; 672e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek } 6731eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 674e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek case Stmt::CompoundAssignOperatorClass: 675892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek VisitBinaryOperator(cast<BinaryOperator>(S), Pred, Dst); 676e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek break; 677f22679e3e5d5f5754931952e58112b4c863a4137Zhongxing Xu 678f22679e3e5d5f5754931952e58112b4c863a4137Zhongxing Xu case Stmt::CompoundLiteralExprClass: 679892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek VisitCompoundLiteralExpr(cast<CompoundLiteralExpr>(S), Pred, Dst); 680f22679e3e5d5f5754931952e58112b4c863a4137Zhongxing Xu break; 6811eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 68256ca35d396d8692c384c785f9aeebcf22563fe1eJohn McCall case Stmt::BinaryConditionalOperatorClass: 683e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek case Stmt::ConditionalOperatorClass: { // '?' operator 68456ca35d396d8692c384c785f9aeebcf22563fe1eJohn McCall const AbstractConditionalOperator *C 68556ca35d396d8692c384c785f9aeebcf22563fe1eJohn McCall = cast<AbstractConditionalOperator>(S); 68656ca35d396d8692c384c785f9aeebcf22563fe1eJohn McCall VisitGuardedExpr(C, C->getTrueExpr(), C->getFalseExpr(), Pred, Dst); 687e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek break; 688e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek } 6891eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 690bb141217871e93767aa3f2de1b9946fa6d37066aZhongxing Xu case Stmt::CXXThisExprClass: 691bb141217871e93767aa3f2de1b9946fa6d37066aZhongxing Xu VisitCXXThisExpr(cast<CXXThisExpr>(S), Pred, Dst); 692bb141217871e93767aa3f2de1b9946fa6d37066aZhongxing Xu break; 693bb141217871e93767aa3f2de1b9946fa6d37066aZhongxing Xu 694892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek case Stmt::DeclRefExprClass: { 695892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek const DeclRefExpr *DE = cast<DeclRefExpr>(S); 696892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek VisitCommonDeclRefExpr(DE, DE->getDecl(), Pred, Dst); 697e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek break; 698892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek } 6991eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 700e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek case Stmt::DeclStmtClass: 701e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek VisitDeclStmt(cast<DeclStmt>(S), Pred, Dst); 702e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek break; 7031eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 7040835a3cdeefe714b4959d31127ea155e56393125Argyrios Kyrtzidis case Stmt::ImplicitCastExprClass: 7050d9d736c49b51691ced96759ec99399824e2a602Zhongxing Xu case Stmt::CStyleCastExprClass: 7060d9d736c49b51691ced96759ec99399824e2a602Zhongxing Xu case Stmt::CXXStaticCastExprClass: 7070d9d736c49b51691ced96759ec99399824e2a602Zhongxing Xu case Stmt::CXXDynamicCastExprClass: 7080d9d736c49b51691ced96759ec99399824e2a602Zhongxing Xu case Stmt::CXXReinterpretCastExprClass: 7090d9d736c49b51691ced96759ec99399824e2a602Zhongxing Xu case Stmt::CXXConstCastExprClass: 710f85e193739c953358c865005855253af4f68a497John McCall case Stmt::CXXFunctionalCastExprClass: 711f85e193739c953358c865005855253af4f68a497John McCall case Stmt::ObjCBridgedCastExprClass: { 7129c378f705405d37f49795d5e915989de774fe11fTed Kremenek const CastExpr *C = cast<CastExpr>(S); 713f85e193739c953358c865005855253af4f68a497John McCall // Handle the previsit checks. 714f85e193739c953358c865005855253af4f68a497John McCall ExplodedNodeSet dstPrevisit; 715f85e193739c953358c865005855253af4f68a497John McCall getCheckerManager().runCheckersForPreStmt(dstPrevisit, Pred, C, *this); 716f85e193739c953358c865005855253af4f68a497John McCall 717f85e193739c953358c865005855253af4f68a497John McCall // Handle the expression itself. 718f85e193739c953358c865005855253af4f68a497John McCall ExplodedNodeSet dstExpr; 719f85e193739c953358c865005855253af4f68a497John McCall for (ExplodedNodeSet::iterator i = dstPrevisit.begin(), 720f85e193739c953358c865005855253af4f68a497John McCall e = dstPrevisit.end(); i != e ; ++i) { 721f85e193739c953358c865005855253af4f68a497John McCall VisitCast(C, C->getSubExpr(), *i, dstExpr); 722f85e193739c953358c865005855253af4f68a497John McCall } 723f85e193739c953358c865005855253af4f68a497John McCall 724f85e193739c953358c865005855253af4f68a497John McCall // Handle the postvisit checks. 725f85e193739c953358c865005855253af4f68a497John McCall getCheckerManager().runCheckersForPostStmt(Dst, dstExpr, C, *this); 726e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek break; 727e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek } 728b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 72903e80030515c800d1ab44125b9052dfffd1bd04cDouglas Gregor case Expr::MaterializeTemporaryExprClass: { 73003e80030515c800d1ab44125b9052dfffd1bd04cDouglas Gregor const MaterializeTemporaryExpr *Materialize 73103e80030515c800d1ab44125b9052dfffd1bd04cDouglas Gregor = cast<MaterializeTemporaryExpr>(S); 73203e80030515c800d1ab44125b9052dfffd1bd04cDouglas Gregor if (!Materialize->getType()->isRecordType()) 733eea72a925f294225391ecec876a342771c09b635Ted Kremenek CreateCXXTemporaryObject(Materialize, Pred, Dst); 73403e80030515c800d1ab44125b9052dfffd1bd04cDouglas Gregor else 73503e80030515c800d1ab44125b9052dfffd1bd04cDouglas Gregor Visit(Materialize->GetTemporaryExpr(), Pred, Dst); 73603e80030515c800d1ab44125b9052dfffd1bd04cDouglas Gregor break; 73703e80030515c800d1ab44125b9052dfffd1bd04cDouglas Gregor } 73803e80030515c800d1ab44125b9052dfffd1bd04cDouglas Gregor 739c4f8706b6539e06a5de153bd72850bb2e0a71456Zhongxing Xu case Stmt::InitListExprClass: 740c4f8706b6539e06a5de153bd72850bb2e0a71456Zhongxing Xu VisitInitListExpr(cast<InitListExpr>(S), Pred, Dst); 741c4f8706b6539e06a5de153bd72850bb2e0a71456Zhongxing Xu break; 7421eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 74397ed4f68f5dba3e21e7a490ef0f9ffd3bfead7f8Ted Kremenek case Stmt::MemberExprClass: 744892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek VisitMemberExpr(cast<MemberExpr>(S), Pred, Dst); 745469ecbded3616416ef938ed94a67f86149faf226Ted Kremenek break; 74697ed4f68f5dba3e21e7a490ef0f9ffd3bfead7f8Ted Kremenek case Stmt::ObjCIvarRefExprClass: 747892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek VisitLvalObjCIvarRefExpr(cast<ObjCIvarRefExpr>(S), Pred, Dst); 74897ed4f68f5dba3e21e7a490ef0f9ffd3bfead7f8Ted Kremenek break; 749af3374187c47acea45706eab6744be6b1c66a856Ted Kremenek 750af3374187c47acea45706eab6744be6b1c66a856Ted Kremenek case Stmt::ObjCForCollectionStmtClass: 751af3374187c47acea45706eab6744be6b1c66a856Ted Kremenek VisitObjCForCollectionStmt(cast<ObjCForCollectionStmt>(S), Pred, Dst); 752af3374187c47acea45706eab6744be6b1c66a856Ted Kremenek break; 7531eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 75438ac4f504bf8ed514520b5a82be538bdb0860687Ted Kremenek case Stmt::ObjCMessageExprClass: 7554410a935e8d8ee3c903b858bbf74ca24fce629b5Ted Kremenek VisitObjCMessage(cast<ObjCMessageExpr>(S), Pred, Dst); 756e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek break; 7571eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 758bbfd07a0c94f659beaf74316029ef73769cefb81Ted Kremenek case Stmt::ObjCAtThrowStmtClass: { 759bbfd07a0c94f659beaf74316029ef73769cefb81Ted Kremenek // FIXME: This is not complete. We basically treat @throw as 760bbfd07a0c94f659beaf74316029ef73769cefb81Ted Kremenek // an abort. 761bbfd07a0c94f659beaf74316029ef73769cefb81Ted Kremenek SaveAndRestore<bool> OldSink(Builder->BuildSinks); 762bbfd07a0c94f659beaf74316029ef73769cefb81Ted Kremenek Builder->BuildSinks = true; 763db5e8cd095d1ffdd18f5620ad2348b5f386bebe3Anna Zaks MakeNode(Dst, S, Pred, Pred->getState()); 764bbfd07a0c94f659beaf74316029ef73769cefb81Ted Kremenek break; 765bbfd07a0c94f659beaf74316029ef73769cefb81Ted Kremenek } 7661eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 7671b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek case Stmt::ReturnStmtClass: 7681b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek VisitReturnStmt(cast<ReturnStmt>(S), Pred, Dst); 7691b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek break; 7701eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 7718ecdb65716cd7914ffb2eeee993fa9039fcd31e8Douglas Gregor case Stmt::OffsetOfExprClass: 7728ecdb65716cd7914ffb2eeee993fa9039fcd31e8Douglas Gregor VisitOffsetOfExpr(cast<OffsetOfExpr>(S), Pred, Dst); 7738ecdb65716cd7914ffb2eeee993fa9039fcd31e8Douglas Gregor break; 7748ecdb65716cd7914ffb2eeee993fa9039fcd31e8Douglas Gregor 775f4e3cfbe8abd124be6341ef5d714819b4fbd9082Peter Collingbourne case Stmt::UnaryExprOrTypeTraitExprClass: 776f4e3cfbe8abd124be6341ef5d714819b4fbd9082Peter Collingbourne VisitUnaryExprOrTypeTraitExpr(cast<UnaryExprOrTypeTraitExpr>(S), 777f4e3cfbe8abd124be6341ef5d714819b4fbd9082Peter Collingbourne Pred, Dst); 778e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek break; 7791eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 780e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek case Stmt::StmtExprClass: { 7819c378f705405d37f49795d5e915989de774fe11fTed Kremenek const StmtExpr *SE = cast<StmtExpr>(S); 782a3d1eb85853eae7b719f679b40923826b5e4b7dfTed Kremenek 783a3d1eb85853eae7b719f679b40923826b5e4b7dfTed Kremenek if (SE->getSubStmt()->body_empty()) { 784a3d1eb85853eae7b719f679b40923826b5e4b7dfTed Kremenek // Empty statement expression. 785a3d1eb85853eae7b719f679b40923826b5e4b7dfTed Kremenek assert(SE->getType() == getContext().VoidTy 786a3d1eb85853eae7b719f679b40923826b5e4b7dfTed Kremenek && "Empty statement expression must have void type."); 787a3d1eb85853eae7b719f679b40923826b5e4b7dfTed Kremenek Dst.Add(Pred); 788a3d1eb85853eae7b719f679b40923826b5e4b7dfTed Kremenek break; 789a3d1eb85853eae7b719f679b40923826b5e4b7dfTed Kremenek } 7901eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 7919c378f705405d37f49795d5e915989de774fe11fTed Kremenek if (Expr *LastExpr = dyn_cast<Expr>(*SE->getSubStmt()->body_rbegin())) { 79218c66fdc3c4008d335885695fe36fb5353c5f672Ted Kremenek const ProgramState *state = Pred->getState(); 7931397663af9dbcc24dbf0e11de43931b3dc08fdbbTed Kremenek MakeNode(Dst, SE, Pred, state->BindExpr(SE, state->getSVal(LastExpr))); 794a3d1eb85853eae7b719f679b40923826b5e4b7dfTed Kremenek } 795e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek else 796e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek Dst.Add(Pred); 7971eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 798e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek break; 799e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek } 8006987c7b74146b9658b1925c5981f8b0cd0672b55Zhongxing Xu 801892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek case Stmt::StringLiteralClass: { 80218c66fdc3c4008d335885695fe36fb5353c5f672Ted Kremenek const ProgramState *state = Pred->getState(); 803892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek SVal V = state->getLValue(cast<StringLiteral>(S)); 804892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek MakeNode(Dst, S, Pred, state->BindExpr(S, V)); 805892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek return; 806892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek } 807b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 80872374594c5d9ade02451bc85cf9dfa5b0ea106e7Ted Kremenek case Stmt::UnaryOperatorClass: { 80903509aea098772644bf4662dc1c88634818ceeccZhongxing Xu const UnaryOperator *U = cast<UnaryOperator>(S); 8102de56d1d0c3a504ad1529de2677628bdfbb95cd4John McCall if (AMgr.shouldEagerlyAssume()&&(U->getOpcode() == UO_LNot)) { 811031ccc0555a82afc2e8afe29e19dd57ff204e2deZhongxing Xu ExplodedNodeSet Tmp; 812892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek VisitUnaryOperator(U, Pred, Tmp); 8139c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek evalEagerlyAssume(Dst, Tmp, U); 81472374594c5d9ade02451bc85cf9dfa5b0ea106e7Ted Kremenek } 81572374594c5d9ade02451bc85cf9dfa5b0ea106e7Ted Kremenek else 816892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek VisitUnaryOperator(U, Pred, Dst); 8171b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek break; 81872374594c5d9ade02451bc85cf9dfa5b0ea106e7Ted Kremenek } 8191b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek } 8201b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek} 8211b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek 822e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek//===----------------------------------------------------------------------===// 823e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek// Block entrance. (Update counters). 824e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek//===----------------------------------------------------------------------===// 825e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek 82627c54e57c4a012dcdf2b40cf985b70d0b9caa69eTed Kremenekvoid ExprEngine::processCFGBlockEntrance(ExplodedNodeSet &dstNodes, 82727c54e57c4a012dcdf2b40cf985b70d0b9caa69eTed Kremenek GenericNodeBuilder<BlockEntrance> &nodeBuilder){ 82827c54e57c4a012dcdf2b40cf985b70d0b9caa69eTed Kremenek 82927c54e57c4a012dcdf2b40cf985b70d0b9caa69eTed Kremenek // FIXME: Refactor this into a checker. 83027c54e57c4a012dcdf2b40cf985b70d0b9caa69eTed Kremenek const CFGBlock *block = nodeBuilder.getProgramPoint().getBlock(); 83127c54e57c4a012dcdf2b40cf985b70d0b9caa69eTed Kremenek ExplodedNode *pred = nodeBuilder.getPredecessor(); 83227c54e57c4a012dcdf2b40cf985b70d0b9caa69eTed Kremenek 83327c54e57c4a012dcdf2b40cf985b70d0b9caa69eTed Kremenek if (nodeBuilder.getBlockCounter().getNumVisited( 83427c54e57c4a012dcdf2b40cf985b70d0b9caa69eTed Kremenek pred->getLocationContext()->getCurrentStackFrame(), 83527c54e57c4a012dcdf2b40cf985b70d0b9caa69eTed Kremenek block->getBlockID()) >= AMgr.getMaxVisit()) { 836ca804539d908d3a0e8c72a0df5f1f571d29490bbTed Kremenek static SimpleProgramPointTag tag("ExprEngine : Block count exceeded"); 837b6a2b08a6b3fbce1a6a4b69d4185165de970696cTed Kremenek nodeBuilder.generateNode(pred->getState(), pred, &tag, true); 83827c54e57c4a012dcdf2b40cf985b70d0b9caa69eTed Kremenek } 839e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek} 840e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek 841e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek//===----------------------------------------------------------------------===// 8421670e403c48f3af4fceff3f6773a0e1cfc6c4eb3Ted Kremenek// Generic node creation. 8431670e403c48f3af4fceff3f6773a0e1cfc6c4eb3Ted Kremenek//===----------------------------------------------------------------------===// 8441670e403c48f3af4fceff3f6773a0e1cfc6c4eb3Ted Kremenek 8459c378f705405d37f49795d5e915989de774fe11fTed KremenekExplodedNode *ExprEngine::MakeNode(ExplodedNodeSet &Dst, const Stmt *S, 84618c66fdc3c4008d335885695fe36fb5353c5f672Ted Kremenek ExplodedNode *Pred, const ProgramState *St, 847ca804539d908d3a0e8c72a0df5f1f571d29490bbTed Kremenek ProgramPoint::Kind K, 848ca804539d908d3a0e8c72a0df5f1f571d29490bbTed Kremenek const ProgramPointTag *tag) { 849d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidis assert (Builder && "StmtNodeBuilder not present."); 850ca804539d908d3a0e8c72a0df5f1f571d29490bbTed Kremenek SaveAndRestore<const ProgramPointTag*> OldTag(Builder->Tag); 8511670e403c48f3af4fceff3f6773a0e1cfc6c4eb3Ted Kremenek Builder->Tag = tag; 8521670e403c48f3af4fceff3f6773a0e1cfc6c4eb3Ted Kremenek return Builder->MakeNode(Dst, S, Pred, St, K); 8531670e403c48f3af4fceff3f6773a0e1cfc6c4eb3Ted Kremenek} 8541670e403c48f3af4fceff3f6773a0e1cfc6c4eb3Ted Kremenek 8551670e403c48f3af4fceff3f6773a0e1cfc6c4eb3Ted Kremenek//===----------------------------------------------------------------------===// 856e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek// Branch processing. 857e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek//===----------------------------------------------------------------------===// 858e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek 85918c66fdc3c4008d335885695fe36fb5353c5f672Ted Kremenekconst ProgramState *ExprEngine::MarkBranch(const ProgramState *state, 8609c378f705405d37f49795d5e915989de774fe11fTed Kremenek const Stmt *Terminator, 86103509aea098772644bf4662dc1c88634818ceeccZhongxing Xu bool branchTaken) { 8621eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 86305a2378c708688c8ef498a5cea40ed7f5db15fa5Ted Kremenek switch (Terminator->getStmtClass()) { 86405a2378c708688c8ef498a5cea40ed7f5db15fa5Ted Kremenek default: 865a8538d902fce9cfec20f39b34492268b51643819Ted Kremenek return state; 8661eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 86705a2378c708688c8ef498a5cea40ed7f5db15fa5Ted Kremenek case Stmt::BinaryOperatorClass: { // '&&' and '||' 8681eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 86903509aea098772644bf4662dc1c88634818ceeccZhongxing Xu const BinaryOperator* B = cast<BinaryOperator>(Terminator); 87005a2378c708688c8ef498a5cea40ed7f5db15fa5Ted Kremenek BinaryOperator::Opcode Op = B->getOpcode(); 8711eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 8722de56d1d0c3a504ad1529de2677628bdfbb95cd4John McCall assert (Op == BO_LAnd || Op == BO_LOr); 8731eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 87405a2378c708688c8ef498a5cea40ed7f5db15fa5Ted Kremenek // For &&, if we take the true branch, then the value of the whole 87505a2378c708688c8ef498a5cea40ed7f5db15fa5Ted Kremenek // expression is that of the RHS expression. 87605a2378c708688c8ef498a5cea40ed7f5db15fa5Ted Kremenek // 87705a2378c708688c8ef498a5cea40ed7f5db15fa5Ted Kremenek // For ||, if we take the false branch, then the value of the whole 87805a2378c708688c8ef498a5cea40ed7f5db15fa5Ted Kremenek // expression is that of the RHS expression. 8791eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 8809c378f705405d37f49795d5e915989de774fe11fTed Kremenek const Expr *Ex = (Op == BO_LAnd && branchTaken) || 8812de56d1d0c3a504ad1529de2677628bdfbb95cd4John McCall (Op == BO_LOr && !branchTaken) 88203509aea098772644bf4662dc1c88634818ceeccZhongxing Xu ? B->getRHS() : B->getLHS(); 8831eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 8848e0293406f9d62a293be6be3b1fb89d359f5ea40Ted Kremenek return state->BindExpr(B, UndefinedVal(Ex)); 88505a2378c708688c8ef498a5cea40ed7f5db15fa5Ted Kremenek } 8861eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 88756ca35d396d8692c384c785f9aeebcf22563fe1eJohn McCall case Stmt::BinaryConditionalOperatorClass: 88805a2378c708688c8ef498a5cea40ed7f5db15fa5Ted Kremenek case Stmt::ConditionalOperatorClass: { // ?: 88956ca35d396d8692c384c785f9aeebcf22563fe1eJohn McCall const AbstractConditionalOperator* C 89056ca35d396d8692c384c785f9aeebcf22563fe1eJohn McCall = cast<AbstractConditionalOperator>(Terminator); 8911eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 89205a2378c708688c8ef498a5cea40ed7f5db15fa5Ted Kremenek // For ?, if branchTaken == true then the value is either the LHS or 89305a2378c708688c8ef498a5cea40ed7f5db15fa5Ted Kremenek // the condition itself. (GNU extension). 8941eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 8959c378f705405d37f49795d5e915989de774fe11fTed Kremenek const Expr *Ex; 8961eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 89705a2378c708688c8ef498a5cea40ed7f5db15fa5Ted Kremenek if (branchTaken) 89856ca35d396d8692c384c785f9aeebcf22563fe1eJohn McCall Ex = C->getTrueExpr(); 89905a2378c708688c8ef498a5cea40ed7f5db15fa5Ted Kremenek else 90056ca35d396d8692c384c785f9aeebcf22563fe1eJohn McCall Ex = C->getFalseExpr(); 9011eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 9028e0293406f9d62a293be6be3b1fb89d359f5ea40Ted Kremenek return state->BindExpr(C, UndefinedVal(Ex)); 90305a2378c708688c8ef498a5cea40ed7f5db15fa5Ted Kremenek } 9041eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 90505a2378c708688c8ef498a5cea40ed7f5db15fa5Ted Kremenek case Stmt::ChooseExprClass: { // ?: 9061eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 9079c378f705405d37f49795d5e915989de774fe11fTed Kremenek const ChooseExpr *C = cast<ChooseExpr>(Terminator); 9081eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 9099c378f705405d37f49795d5e915989de774fe11fTed Kremenek const Expr *Ex = branchTaken ? C->getLHS() : C->getRHS(); 9108e0293406f9d62a293be6be3b1fb89d359f5ea40Ted Kremenek return state->BindExpr(C, UndefinedVal(Ex)); 91105a2378c708688c8ef498a5cea40ed7f5db15fa5Ted Kremenek } 91205a2378c708688c8ef498a5cea40ed7f5db15fa5Ted Kremenek } 91305a2378c708688c8ef498a5cea40ed7f5db15fa5Ted Kremenek} 91405a2378c708688c8ef498a5cea40ed7f5db15fa5Ted Kremenek 9156ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek/// RecoverCastedSymbol - A helper function for ProcessBranch that is used 9166ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek/// to try to recover some path-sensitivity for casts of symbolic 9176ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek/// integers that promote their values (which are currently not tracked well). 9186ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek/// This function returns the SVal bound to Condition->IgnoreCasts if all the 9196ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek// cast(s) did was sign-extend the original value. 920294fd0a62b95f512637910bf85c7efa6c2354b50Ted Kremenekstatic SVal RecoverCastedSymbol(ProgramStateManager& StateMgr, 921294fd0a62b95f512637910bf85c7efa6c2354b50Ted Kremenek const ProgramState *state, 922294fd0a62b95f512637910bf85c7efa6c2354b50Ted Kremenek const Stmt *Condition, 923294fd0a62b95f512637910bf85c7efa6c2354b50Ted Kremenek ASTContext &Ctx) { 9246ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek 92503509aea098772644bf4662dc1c88634818ceeccZhongxing Xu const Expr *Ex = dyn_cast<Expr>(Condition); 9266ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek if (!Ex) 9276ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek return UnknownVal(); 9286ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek 9296ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek uint64_t bits = 0; 9306ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek bool bitsInit = false; 9311eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 93203509aea098772644bf4662dc1c88634818ceeccZhongxing Xu while (const CastExpr *CE = dyn_cast<CastExpr>(Ex)) { 9336ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek QualType T = CE->getType(); 9346ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek 9356ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek if (!T->isIntegerType()) 9366ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek return UnknownVal(); 9371eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 9386ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek uint64_t newBits = Ctx.getTypeSize(T); 9396ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek if (!bitsInit || newBits < bits) { 9406ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek bitsInit = true; 9416ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek bits = newBits; 9426ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek } 9431eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 9446ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek Ex = CE->getSubExpr(); 9456ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek } 9466ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek 9476ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek // We reached a non-cast. Is it a symbolic value? 9486ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek QualType T = Ex->getType(); 9496ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek 9506ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek if (!bitsInit || !T->isIntegerType() || Ctx.getTypeSize(T) > bits) 9516ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek return UnknownVal(); 9521eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 9531397663af9dbcc24dbf0e11de43931b3dc08fdbbTed Kremenek return state->getSVal(Ex); 9546ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek} 9556ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek 9569c378f705405d37f49795d5e915989de774fe11fTed Kremenekvoid ExprEngine::processBranch(const Stmt *Condition, const Stmt *Term, 957d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidis BranchNodeBuilder& builder) { 9581eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 959b2331834a0515c80862ee51325c758a053829f15Ted Kremenek // Check for NULL conditions; e.g. "for(;;)" 9601eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump if (!Condition) { 961b2331834a0515c80862ee51325c758a053829f15Ted Kremenek builder.markInfeasible(false); 962b2331834a0515c80862ee51325c758a053829f15Ted Kremenek return; 963b2331834a0515c80862ee51325c758a053829f15Ted Kremenek } 9641eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 96521028dd8850c64a414f7a82dfddcc291351203d6Ted Kremenek PrettyStackTraceLoc CrashInfo(getContext().getSourceManager(), 96621028dd8850c64a414f7a82dfddcc291351203d6Ted Kremenek Condition->getLocStart(), 96721028dd8850c64a414f7a82dfddcc291351203d6Ted Kremenek "Error evaluating branch"); 9680fb0bc4067d6c9d7c0e655300ef309b05d3adfc9Ted Kremenek 969cc05d511b26ac6dc80fcbcc78ac305d2755aa0b9Argyrios Kyrtzidis getCheckerManager().runCheckersForBranchCondition(Condition, builder, *this); 970cc05d511b26ac6dc80fcbcc78ac305d2755aa0b9Argyrios Kyrtzidis 9710835e4cccfef3ea5346962722b79484f6b3ca602Zhongxing Xu // If the branch condition is undefined, return; 9720835e4cccfef3ea5346962722b79484f6b3ca602Zhongxing Xu if (!builder.isFeasible(true) && !builder.isFeasible(false)) 9730835e4cccfef3ea5346962722b79484f6b3ca602Zhongxing Xu return; 9741eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 97518c66fdc3c4008d335885695fe36fb5353c5f672Ted Kremenek const ProgramState *PrevState = builder.getState(); 9761397663af9dbcc24dbf0e11de43931b3dc08fdbbTed Kremenek SVal X = PrevState->getSVal(Condition); 977b38911f16b4943548db6a3695fc6ae23070b25d2Ted Kremenek 97873c498a08f4968b6987d1453c7b77929dcc6d5f7Argyrios Kyrtzidis if (X.isUnknownOrUndef()) { 9790835e4cccfef3ea5346962722b79484f6b3ca602Zhongxing Xu // Give it a chance to recover from unknown. 9800835e4cccfef3ea5346962722b79484f6b3ca602Zhongxing Xu if (const Expr *Ex = dyn_cast<Expr>(Condition)) { 9810835e4cccfef3ea5346962722b79484f6b3ca602Zhongxing Xu if (Ex->getType()->isIntegerType()) { 9820835e4cccfef3ea5346962722b79484f6b3ca602Zhongxing Xu // Try to recover some path-sensitivity. Right now casts of symbolic 9830835e4cccfef3ea5346962722b79484f6b3ca602Zhongxing Xu // integers that promote their values are currently not tracked well. 9840835e4cccfef3ea5346962722b79484f6b3ca602Zhongxing Xu // If 'Condition' is such an expression, try and recover the 9850835e4cccfef3ea5346962722b79484f6b3ca602Zhongxing Xu // underlying value and use that instead. 9860835e4cccfef3ea5346962722b79484f6b3ca602Zhongxing Xu SVal recovered = RecoverCastedSymbol(getStateManager(), 9870835e4cccfef3ea5346962722b79484f6b3ca602Zhongxing Xu builder.getState(), Condition, 9880835e4cccfef3ea5346962722b79484f6b3ca602Zhongxing Xu getContext()); 989b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 9900835e4cccfef3ea5346962722b79484f6b3ca602Zhongxing Xu if (!recovered.isUnknown()) { 9910835e4cccfef3ea5346962722b79484f6b3ca602Zhongxing Xu X = recovered; 9920835e4cccfef3ea5346962722b79484f6b3ca602Zhongxing Xu } 993b38911f16b4943548db6a3695fc6ae23070b25d2Ted Kremenek } 9940835e4cccfef3ea5346962722b79484f6b3ca602Zhongxing Xu } 9950835e4cccfef3ea5346962722b79484f6b3ca602Zhongxing Xu // If the condition is still unknown, give up. 99673c498a08f4968b6987d1453c7b77929dcc6d5f7Argyrios Kyrtzidis if (X.isUnknownOrUndef()) { 9970835e4cccfef3ea5346962722b79484f6b3ca602Zhongxing Xu builder.generateNode(MarkBranch(PrevState, Term, true), true); 9980835e4cccfef3ea5346962722b79484f6b3ca602Zhongxing Xu builder.generateNode(MarkBranch(PrevState, Term, false), false); 999b38911f16b4943548db6a3695fc6ae23070b25d2Ted Kremenek return; 10001eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump } 1001b38911f16b4943548db6a3695fc6ae23070b25d2Ted Kremenek } 10021eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 10030835e4cccfef3ea5346962722b79484f6b3ca602Zhongxing Xu DefinedSVal V = cast<DefinedSVal>(X); 10040835e4cccfef3ea5346962722b79484f6b3ca602Zhongxing Xu 10056a6719a3a11087b48d9f1a4eb08b3bd43cb05a65Ted Kremenek // Process the true branch. 1006520035439d7133064325c4df6378c5a8f2f05539Ted Kremenek if (builder.isFeasible(true)) { 100718c66fdc3c4008d335885695fe36fb5353c5f672Ted Kremenek if (const ProgramState *state = PrevState->assume(V, true)) 1008520035439d7133064325c4df6378c5a8f2f05539Ted Kremenek builder.generateNode(MarkBranch(state, Term, true), true); 1009520035439d7133064325c4df6378c5a8f2f05539Ted Kremenek else 1010520035439d7133064325c4df6378c5a8f2f05539Ted Kremenek builder.markInfeasible(true); 1011520035439d7133064325c4df6378c5a8f2f05539Ted Kremenek } 10121eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 10131eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump // Process the false branch. 1014520035439d7133064325c4df6378c5a8f2f05539Ted Kremenek if (builder.isFeasible(false)) { 101518c66fdc3c4008d335885695fe36fb5353c5f672Ted Kremenek if (const ProgramState *state = PrevState->assume(V, false)) 1016520035439d7133064325c4df6378c5a8f2f05539Ted Kremenek builder.generateNode(MarkBranch(state, Term, false), false); 1017520035439d7133064325c4df6378c5a8f2f05539Ted Kremenek else 1018520035439d7133064325c4df6378c5a8f2f05539Ted Kremenek builder.markInfeasible(false); 1019520035439d7133064325c4df6378c5a8f2f05539Ted Kremenek } 1020f233d48cfc513b045e2c2cfca5c175220fbd0a82Ted Kremenek} 1021f233d48cfc513b045e2c2cfca5c175220fbd0a82Ted Kremenek 1022e36de1fe51c39d9161915dd3dbef880954af6476Ted Kremenek/// processIndirectGoto - Called by CoreEngine. Used to generate successor 1023754607e7cff2d902d9af8b771409449fb2f8d2bfTed Kremenek/// nodes by processing the 'effects' of a computed goto jump. 1024ad8dcf4a9df0e24051dc31bf9e6f3cd138a34298Chris Lattnervoid ExprEngine::processIndirectGoto(IndirectGotoNodeBuilder &builder) { 1025754607e7cff2d902d9af8b771409449fb2f8d2bfTed Kremenek 102618c66fdc3c4008d335885695fe36fb5353c5f672Ted Kremenek const ProgramState *state = builder.getState(); 10271397663af9dbcc24dbf0e11de43931b3dc08fdbbTed Kremenek SVal V = state->getSVal(builder.getTarget()); 10281eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1029754607e7cff2d902d9af8b771409449fb2f8d2bfTed Kremenek // Three possibilities: 1030754607e7cff2d902d9af8b771409449fb2f8d2bfTed Kremenek // 1031754607e7cff2d902d9af8b771409449fb2f8d2bfTed Kremenek // (1) We know the computed label. 10324a4e524afef40d6f3ddb25d0e407c814e4ca56a8Ted Kremenek // (2) The label is NULL (or some other constant), or Undefined. 1033754607e7cff2d902d9af8b771409449fb2f8d2bfTed Kremenek // (3) We have no clue about the label. Dispatch to all targets. 1034754607e7cff2d902d9af8b771409449fb2f8d2bfTed Kremenek // 10351eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1036d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidis typedef IndirectGotoNodeBuilder::iterator iterator; 1037754607e7cff2d902d9af8b771409449fb2f8d2bfTed Kremenek 10381c96b24285d05c0eac455ae96d7c9ff43d42bc96Zhongxing Xu if (isa<loc::GotoLabel>(V)) { 1039ad8dcf4a9df0e24051dc31bf9e6f3cd138a34298Chris Lattner const LabelDecl *L = cast<loc::GotoLabel>(V).getLabel(); 10401eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1041ad8dcf4a9df0e24051dc31bf9e6f3cd138a34298Chris Lattner for (iterator I = builder.begin(), E = builder.end(); I != E; ++I) { 104224f1a967741ff9f8025ee23be12ba6feacc31f77Ted Kremenek if (I.getLabel() == L) { 1043a8538d902fce9cfec20f39b34492268b51643819Ted Kremenek builder.generateNode(I, state); 1044754607e7cff2d902d9af8b771409449fb2f8d2bfTed Kremenek return; 1045754607e7cff2d902d9af8b771409449fb2f8d2bfTed Kremenek } 1046754607e7cff2d902d9af8b771409449fb2f8d2bfTed Kremenek } 10471eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1048ad8dcf4a9df0e24051dc31bf9e6f3cd138a34298Chris Lattner assert(false && "No block with label."); 1049754607e7cff2d902d9af8b771409449fb2f8d2bfTed Kremenek return; 1050754607e7cff2d902d9af8b771409449fb2f8d2bfTed Kremenek } 1051754607e7cff2d902d9af8b771409449fb2f8d2bfTed Kremenek 10521c96b24285d05c0eac455ae96d7c9ff43d42bc96Zhongxing Xu if (isa<loc::ConcreteInt>(V) || isa<UndefinedVal>(V)) { 1053754607e7cff2d902d9af8b771409449fb2f8d2bfTed Kremenek // Dispatch to the first target and mark it as a sink. 10542055effed54d614b51e3501a174c9b1fe92e4de4Zhongxing Xu //ExplodedNode* N = builder.generateNode(builder.begin(), state, true); 10552055effed54d614b51e3501a174c9b1fe92e4de4Zhongxing Xu // FIXME: add checker visit. 10562055effed54d614b51e3501a174c9b1fe92e4de4Zhongxing Xu // UndefBranches.insert(N); 1057754607e7cff2d902d9af8b771409449fb2f8d2bfTed Kremenek return; 1058754607e7cff2d902d9af8b771409449fb2f8d2bfTed Kremenek } 10591eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1060754607e7cff2d902d9af8b771409449fb2f8d2bfTed Kremenek // This is really a catch-all. We don't support symbolics yet. 1061b3cfd58c9b13325d994e5f9b5065e6a22d91911dTed Kremenek // FIXME: Implement dispatch for symbolic pointers. 10621eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1063754607e7cff2d902d9af8b771409449fb2f8d2bfTed Kremenek for (iterator I=builder.begin(), E=builder.end(); I != E; ++I) 1064a8538d902fce9cfec20f39b34492268b51643819Ted Kremenek builder.generateNode(I, state); 1065754607e7cff2d902d9af8b771409449fb2f8d2bfTed Kremenek} 1066f233d48cfc513b045e2c2cfca5c175220fbd0a82Ted Kremenek 1067d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidis/// ProcessEndPath - Called by CoreEngine. Used to generate end-of-path 106873099bfea9f5d4ec05265170bbefec3d76fb6b5eTed Kremenek/// nodes when the control reaches the end of a function. 1069e36de1fe51c39d9161915dd3dbef880954af6476Ted Kremenekvoid ExprEngine::processEndOfFunction(EndOfFunctionNodeBuilder& builder) { 10709c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek getTF().evalEndPath(*this, builder); 107173099bfea9f5d4ec05265170bbefec3d76fb6b5eTed Kremenek StateMgr.EndPath(builder.getState()); 1072af5800a1e287990bb547e052f257adeeae5ab476Argyrios Kyrtzidis getCheckerManager().runCheckersForEndPath(builder, *this); 107373099bfea9f5d4ec05265170bbefec3d76fb6b5eTed Kremenek} 107473099bfea9f5d4ec05265170bbefec3d76fb6b5eTed Kremenek 1075d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidis/// ProcessSwitch - Called by CoreEngine. Used to generate successor 1076daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek/// nodes by processing the 'effects' of a switch statement. 1077e36de1fe51c39d9161915dd3dbef880954af6476Ted Kremenekvoid ExprEngine::processSwitch(SwitchNodeBuilder& builder) { 1078d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidis typedef SwitchNodeBuilder::iterator iterator; 107918c66fdc3c4008d335885695fe36fb5353c5f672Ted Kremenek const ProgramState *state = builder.getState(); 10809c378f705405d37f49795d5e915989de774fe11fTed Kremenek const Expr *CondE = builder.getCondition(); 10811397663af9dbcc24dbf0e11de43931b3dc08fdbbTed Kremenek SVal CondV_untested = state->getSVal(CondE); 1082daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek 10835b9bd2137ebef350af803c634e3fdf5d74678100Ted Kremenek if (CondV_untested.isUndef()) { 10842055effed54d614b51e3501a174c9b1fe92e4de4Zhongxing Xu //ExplodedNode* N = builder.generateDefaultCaseNode(state, true); 1085b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek // FIXME: add checker 10862055effed54d614b51e3501a174c9b1fe92e4de4Zhongxing Xu //UndefBranches.insert(N); 10872055effed54d614b51e3501a174c9b1fe92e4de4Zhongxing Xu 1088daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek return; 1089daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek } 10905b9bd2137ebef350af803c634e3fdf5d74678100Ted Kremenek DefinedOrUnknownSVal CondV = cast<DefinedOrUnknownSVal>(CondV_untested); 1091692416c214a3b234236dedcf875735a9cc29e90bTed Kremenek 109218c66fdc3c4008d335885695fe36fb5353c5f672Ted Kremenek const ProgramState *DefaultSt = state; 109334feff654c6304e0a59ceb1376989d28dbc956ffTed Kremenek 109434feff654c6304e0a59ceb1376989d28dbc956ffTed Kremenek iterator I = builder.begin(), EI = builder.end(); 109534feff654c6304e0a59ceb1376989d28dbc956ffTed Kremenek bool defaultIsFeasible = I == EI; 10961eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 109734feff654c6304e0a59ceb1376989d28dbc956ffTed Kremenek for ( ; I != EI; ++I) { 1098e71f3d587844110d836c82250830b27b1651afdbTed Kremenek // Successor may be pruned out during CFG construction. 1099e71f3d587844110d836c82250830b27b1651afdbTed Kremenek if (!I.getBlock()) 1100e71f3d587844110d836c82250830b27b1651afdbTed Kremenek continue; 1101e71f3d587844110d836c82250830b27b1651afdbTed Kremenek 11029c378f705405d37f49795d5e915989de774fe11fTed Kremenek const CaseStmt *Case = I.getCase(); 110372afb3739da0da02158242ae41a50cfe0bea78b4Ted Kremenek 110472afb3739da0da02158242ae41a50cfe0bea78b4Ted Kremenek // Evaluate the LHS of the case value. 110572afb3739da0da02158242ae41a50cfe0bea78b4Ted Kremenek Expr::EvalResult V1; 11061eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump bool b = Case->getLHS()->Evaluate(V1, getContext()); 11071eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 110872afb3739da0da02158242ae41a50cfe0bea78b4Ted Kremenek // Sanity checks. These go away in Release builds. 11091eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump assert(b && V1.Val.isInt() && !V1.HasSideEffects 111072afb3739da0da02158242ae41a50cfe0bea78b4Ted Kremenek && "Case condition must evaluate to an integer constant."); 1111c6ed729f669044f5072a49d79041f455d971ece3Jeffrey Yasskin (void)b; // silence unused variable warning 11121eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump assert(V1.Val.getInt().getBitWidth() == 111372afb3739da0da02158242ae41a50cfe0bea78b4Ted Kremenek getContext().getTypeSize(CondE->getType())); 11141eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1115daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek // Get the RHS of the case, if it exists. 111672afb3739da0da02158242ae41a50cfe0bea78b4Ted Kremenek Expr::EvalResult V2; 11171eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 11189c378f705405d37f49795d5e915989de774fe11fTed Kremenek if (const Expr *E = Case->getRHS()) { 111972afb3739da0da02158242ae41a50cfe0bea78b4Ted Kremenek b = E->Evaluate(V2, getContext()); 11201eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump assert(b && V2.Val.isInt() && !V2.HasSideEffects 112172afb3739da0da02158242ae41a50cfe0bea78b4Ted Kremenek && "Case condition must evaluate to an integer constant."); 1122c6ed729f669044f5072a49d79041f455d971ece3Jeffrey Yasskin (void)b; // silence unused variable warning 1123daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek } 112414a1140c9f4e20b12a54db8745b74699b9872cd2Ted Kremenek else 112514a1140c9f4e20b12a54db8745b74699b9872cd2Ted Kremenek V2 = V1; 11261eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1127daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek // FIXME: Eventually we should replace the logic below with a range 1128daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek // comparison, rather than concretize the values within the range. 1129aa1c4e5a6b87b62d991c55a0d4522bcd778068d7Ted Kremenek // This should be easy once we have "ranges" for NonLVals. 11301eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 113114a1140c9f4e20b12a54db8745b74699b9872cd2Ted Kremenek do { 11321eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump nonloc::ConcreteInt CaseVal(getBasicVals().getValue(V1.Val.getInt())); 11339c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek DefinedOrUnknownSVal Res = svalBuilder.evalEQ(DefaultSt ? DefaultSt : state, 113448569f9562740ac1f4b175cb17ce3d49035402c4Ted Kremenek CondV, CaseVal); 1135b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 11361eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump // Now "assume" that the case matches. 113718c66fdc3c4008d335885695fe36fb5353c5f672Ted Kremenek if (const ProgramState *stateNew = state->assume(Res, true)) { 1138a591bc04d21fa62ebffcb2c7814d738ca8f5e2f9Ted Kremenek builder.generateCaseStmtNode(I, stateNew); 11391eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1140daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek // If CondV evaluates to a constant, then we know that this 1141daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek // is the *only* case that we can take, so stop evaluating the 1142daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek // others. 11431c96b24285d05c0eac455ae96d7c9ff43d42bc96Zhongxing Xu if (isa<nonloc::ConcreteInt>(CondV)) 1144daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek return; 1145daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek } 11461eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1147daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek // Now "assume" that the case doesn't match. Add this state 1148daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek // to the default state (if it is feasible). 114948569f9562740ac1f4b175cb17ce3d49035402c4Ted Kremenek if (DefaultSt) { 115018c66fdc3c4008d335885695fe36fb5353c5f672Ted Kremenek if (const ProgramState *stateNew = DefaultSt->assume(Res, false)) { 115148569f9562740ac1f4b175cb17ce3d49035402c4Ted Kremenek defaultIsFeasible = true; 115248569f9562740ac1f4b175cb17ce3d49035402c4Ted Kremenek DefaultSt = stateNew; 115348569f9562740ac1f4b175cb17ce3d49035402c4Ted Kremenek } 115448569f9562740ac1f4b175cb17ce3d49035402c4Ted Kremenek else { 115548569f9562740ac1f4b175cb17ce3d49035402c4Ted Kremenek defaultIsFeasible = false; 115648569f9562740ac1f4b175cb17ce3d49035402c4Ted Kremenek DefaultSt = NULL; 115748569f9562740ac1f4b175cb17ce3d49035402c4Ted Kremenek } 11585014ab113eb211b8320ae30b173d7020352663c6Ted Kremenek } 1159b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 116014a1140c9f4e20b12a54db8745b74699b9872cd2Ted Kremenek // Concretize the next value in the range. 116172afb3739da0da02158242ae41a50cfe0bea78b4Ted Kremenek if (V1.Val.getInt() == V2.Val.getInt()) 116214a1140c9f4e20b12a54db8745b74699b9872cd2Ted Kremenek break; 11631eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 116472afb3739da0da02158242ae41a50cfe0bea78b4Ted Kremenek ++V1.Val.getInt(); 116572afb3739da0da02158242ae41a50cfe0bea78b4Ted Kremenek assert (V1.Val.getInt() <= V2.Val.getInt()); 11661eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 116714a1140c9f4e20b12a54db8745b74699b9872cd2Ted Kremenek } while (true); 1168daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek } 11691eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 11704d3175c1e5a44251ea97b0c81e80f060629d9c08Ted Kremenek if (!defaultIsFeasible) 11714d3175c1e5a44251ea97b0c81e80f060629d9c08Ted Kremenek return; 11724d3175c1e5a44251ea97b0c81e80f060629d9c08Ted Kremenek 11734d3175c1e5a44251ea97b0c81e80f060629d9c08Ted Kremenek // If we have switch(enum value), the default branch is not 11744d3175c1e5a44251ea97b0c81e80f060629d9c08Ted Kremenek // feasible if all of the enum constants not covered by 'case:' statements 11754d3175c1e5a44251ea97b0c81e80f060629d9c08Ted Kremenek // are not feasible values for the switch condition. 11764d3175c1e5a44251ea97b0c81e80f060629d9c08Ted Kremenek // 11774d3175c1e5a44251ea97b0c81e80f060629d9c08Ted Kremenek // Note that this isn't as accurate as it could be. Even if there isn't 11784d3175c1e5a44251ea97b0c81e80f060629d9c08Ted Kremenek // a case for a particular enum value as long as that enum value isn't 11794d3175c1e5a44251ea97b0c81e80f060629d9c08Ted Kremenek // feasible then it shouldn't be considered for making 'default:' reachable. 11804d3175c1e5a44251ea97b0c81e80f060629d9c08Ted Kremenek const SwitchStmt *SS = builder.getSwitch(); 11814d3175c1e5a44251ea97b0c81e80f060629d9c08Ted Kremenek const Expr *CondExpr = SS->getCond()->IgnoreParenImpCasts(); 11824d3175c1e5a44251ea97b0c81e80f060629d9c08Ted Kremenek if (CondExpr->getType()->getAs<EnumType>()) { 11834d3175c1e5a44251ea97b0c81e80f060629d9c08Ted Kremenek if (SS->isAllEnumCasesCovered()) 11844d3175c1e5a44251ea97b0c81e80f060629d9c08Ted Kremenek return; 11854d3175c1e5a44251ea97b0c81e80f060629d9c08Ted Kremenek } 11864d3175c1e5a44251ea97b0c81e80f060629d9c08Ted Kremenek 11874d3175c1e5a44251ea97b0c81e80f060629d9c08Ted Kremenek builder.generateDefaultCaseNode(DefaultSt); 1188daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek} 1189daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek 1190e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek//===----------------------------------------------------------------------===// 1191ec96a2d52d16e150baaf629cd35e3fabff5d8915Ted Kremenek// Transfer functions: Loads and stores. 1192e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek//===----------------------------------------------------------------------===// 1193d27f8169f4b68337a489547a41ac45bf7a5d1ddfTed Kremenek 1194d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidisvoid ExprEngine::VisitCommonDeclRefExpr(const Expr *Ex, const NamedDecl *D, 1195d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidis ExplodedNode *Pred, 1196d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidis ExplodedNodeSet &Dst) { 119718c66fdc3c4008d335885695fe36fb5353c5f672Ted Kremenek const ProgramState *state = Pred->getState(); 11986d69b5d82281992e981caa9bc038e3f6cac6594aZhongxing Xu 11999c378f705405d37f49795d5e915989de774fe11fTed Kremenek if (const VarDecl *VD = dyn_cast<VarDecl>(D)) { 1200892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek assert(Ex->isLValue()); 1201d17da2b99f323fa91b01e1dd119cc32e0ee8197dTed Kremenek SVal V = state->getLValue(VD, Pred->getLocationContext()); 1202a7581731b1453b51b26154d2409d42a5b6395079Zhongxing Xu 1203892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek // For references, the 'lvalue' is the pointer address stored in the 1204892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek // reference region. 1205892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek if (VD->getType()->isReferenceType()) { 1206892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek if (const MemRegion *R = V.getAsRegion()) 1207892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek V = state->getSVal(R); 1208892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek else 1209892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek V = UnknownVal(); 1210852274d4257134906995cb252fb3dfd2d71deae8Ted Kremenek } 12116d69b5d82281992e981caa9bc038e3f6cac6594aZhongxing Xu 1212892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek MakeNode(Dst, Ex, Pred, state->BindExpr(Ex, V), 1213892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek ProgramPoint::PostLValueKind); 1214852274d4257134906995cb252fb3dfd2d71deae8Ted Kremenek return; 1215892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek } 12169c378f705405d37f49795d5e915989de774fe11fTed Kremenek if (const EnumConstantDecl *ED = dyn_cast<EnumConstantDecl>(D)) { 1217892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek assert(!Ex->isLValue()); 1218c8413fd03f73084a5c93028f8b4db619fc388087Ted Kremenek SVal V = svalBuilder.makeIntVal(ED->getInitVal()); 12198e0293406f9d62a293be6be3b1fb89d359f5ea40Ted Kremenek MakeNode(Dst, Ex, Pred, state->BindExpr(Ex, V)); 12206d69b5d82281992e981caa9bc038e3f6cac6594aZhongxing Xu return; 1221892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek } 12229c378f705405d37f49795d5e915989de774fe11fTed Kremenek if (const FunctionDecl *FD = dyn_cast<FunctionDecl>(D)) { 1223c8413fd03f73084a5c93028f8b4db619fc388087Ted Kremenek SVal V = svalBuilder.getFunctionPointer(FD); 12248e0293406f9d62a293be6be3b1fb89d359f5ea40Ted Kremenek MakeNode(Dst, Ex, Pred, state->BindExpr(Ex, V), 12257090d5465de7ca620da16211cf886edf1edc1f1fTed Kremenek ProgramPoint::PostLValueKind); 12266d69b5d82281992e981caa9bc038e3f6cac6594aZhongxing Xu return; 12271b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek } 12286d69b5d82281992e981caa9bc038e3f6cac6594aZhongxing Xu assert (false && 12296d69b5d82281992e981caa9bc038e3f6cac6594aZhongxing Xu "ValueDecl support for this ValueDecl not implemented."); 12303271f8d315712885ac87747369bb1d9f4b1ea81fTed Kremenek} 12313271f8d315712885ac87747369bb1d9f4b1ea81fTed Kremenek 1232540cbe2b60294fe7b926c26b4f1840f544fe3011Ted Kremenek/// VisitArraySubscriptExpr - Transfer function for array accesses 12339c378f705405d37f49795d5e915989de774fe11fTed Kremenekvoid ExprEngine::VisitLvalArraySubscriptExpr(const ArraySubscriptExpr *A, 12349c378f705405d37f49795d5e915989de774fe11fTed Kremenek ExplodedNode *Pred, 12359c378f705405d37f49795d5e915989de774fe11fTed Kremenek ExplodedNodeSet &Dst){ 12361eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 12379c378f705405d37f49795d5e915989de774fe11fTed Kremenek const Expr *Base = A->getBase()->IgnoreParens(); 12389c378f705405d37f49795d5e915989de774fe11fTed Kremenek const Expr *Idx = A->getIdx()->IgnoreParens(); 1239892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek 12401eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 12418f3407ef22bc7efe6ca4169381e09d0d657ec192Ted Kremenek ExplodedNodeSet checkerPreStmt; 12428f3407ef22bc7efe6ca4169381e09d0d657ec192Ted Kremenek getCheckerManager().runCheckersForPreStmt(checkerPreStmt, Pred, A, *this); 12438f3407ef22bc7efe6ca4169381e09d0d657ec192Ted Kremenek 12448f3407ef22bc7efe6ca4169381e09d0d657ec192Ted Kremenek for (ExplodedNodeSet::iterator it = checkerPreStmt.begin(), 12458f3407ef22bc7efe6ca4169381e09d0d657ec192Ted Kremenek ei = checkerPreStmt.end(); it != ei; ++it) { 124618c66fdc3c4008d335885695fe36fb5353c5f672Ted Kremenek const ProgramState *state = (*it)->getState(); 12478f3407ef22bc7efe6ca4169381e09d0d657ec192Ted Kremenek SVal V = state->getLValue(A->getType(), state->getSVal(Idx), 12488f3407ef22bc7efe6ca4169381e09d0d657ec192Ted Kremenek state->getSVal(Base)); 12498f3407ef22bc7efe6ca4169381e09d0d657ec192Ted Kremenek assert(A->isLValue()); 12508f3407ef22bc7efe6ca4169381e09d0d657ec192Ted Kremenek MakeNode(Dst, A, *it, state->BindExpr(A, V), ProgramPoint::PostLValueKind); 12511b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek } 1252540cbe2b60294fe7b926c26b4f1840f544fe3011Ted Kremenek} 1253540cbe2b60294fe7b926c26b4f1840f544fe3011Ted Kremenek 1254469ecbded3616416ef938ed94a67f86149faf226Ted Kremenek/// VisitMemberExpr - Transfer function for member expressions. 12559c378f705405d37f49795d5e915989de774fe11fTed Kremenekvoid ExprEngine::VisitMemberExpr(const MemberExpr *M, ExplodedNode *Pred, 12569c378f705405d37f49795d5e915989de774fe11fTed Kremenek ExplodedNodeSet &Dst) { 12571eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 12585bd04952d4ae7ca894f583583208f0cec4735a90Ted Kremenek Decl *member = M->getMemberDecl(); 12595bd04952d4ae7ca894f583583208f0cec4735a90Ted Kremenek if (VarDecl *VD = dyn_cast<VarDecl>(member)) { 12605bd04952d4ae7ca894f583583208f0cec4735a90Ted Kremenek assert(M->isLValue()); 12615bd04952d4ae7ca894f583583208f0cec4735a90Ted Kremenek VisitCommonDeclRefExpr(M, VD, Pred, Dst); 12625bd04952d4ae7ca894f583583208f0cec4735a90Ted Kremenek return; 12635bd04952d4ae7ca894f583583208f0cec4735a90Ted Kremenek } 12645bd04952d4ae7ca894f583583208f0cec4735a90Ted Kremenek 12655bd04952d4ae7ca894f583583208f0cec4735a90Ted Kremenek FieldDecl *field = dyn_cast<FieldDecl>(member); 1266892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek if (!field) // FIXME: skipping member expressions for non-fields 126786f194083504938df72135b5b66bf0c5cafd9498Douglas Gregor return; 126886f194083504938df72135b5b66bf0c5cafd9498Douglas Gregor 1269e3939d7446959afb6b650fe08e952d0f64ab6794Ted Kremenek Expr *baseExpr = M->getBase()->IgnoreParens(); 127018c66fdc3c4008d335885695fe36fb5353c5f672Ted Kremenek const ProgramState *state = Pred->getState(); 1271e3939d7446959afb6b650fe08e952d0f64ab6794Ted Kremenek SVal baseExprVal = state->getSVal(baseExpr); 1272e3939d7446959afb6b650fe08e952d0f64ab6794Ted Kremenek if (isa<nonloc::LazyCompoundVal>(baseExprVal) || 1273e3939d7446959afb6b650fe08e952d0f64ab6794Ted Kremenek isa<nonloc::CompoundVal>(baseExprVal) || 1274e3939d7446959afb6b650fe08e952d0f64ab6794Ted Kremenek // FIXME: This can originate by conjuring a symbol for an unknown 1275e3939d7446959afb6b650fe08e952d0f64ab6794Ted Kremenek // temporary struct object, see test/Analysis/fields.c: 1276e3939d7446959afb6b650fe08e952d0f64ab6794Ted Kremenek // (p = getit()).x 1277e3939d7446959afb6b650fe08e952d0f64ab6794Ted Kremenek isa<nonloc::SymbolVal>(baseExprVal)) { 1278e3939d7446959afb6b650fe08e952d0f64ab6794Ted Kremenek MakeNode(Dst, M, Pred, state->BindExpr(M, UnknownVal())); 1279e3939d7446959afb6b650fe08e952d0f64ab6794Ted Kremenek return; 1280e3939d7446959afb6b650fe08e952d0f64ab6794Ted Kremenek } 1281892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek 1282e3939d7446959afb6b650fe08e952d0f64ab6794Ted Kremenek // FIXME: Should we insert some assumption logic in here to determine 1283e3939d7446959afb6b650fe08e952d0f64ab6794Ted Kremenek // if "Base" is a valid piece of memory? Before we put this assumption 1284e3939d7446959afb6b650fe08e952d0f64ab6794Ted Kremenek // later when using FieldOffset lvals (which we no longer have). 1285d9bc33efa195114d6f2a365c26e5b8dba4e1cc38Ted Kremenek 1286e3939d7446959afb6b650fe08e952d0f64ab6794Ted Kremenek // For all other cases, compute an lvalue. 1287e3939d7446959afb6b650fe08e952d0f64ab6794Ted Kremenek SVal L = state->getLValue(field, baseExprVal); 1288e3939d7446959afb6b650fe08e952d0f64ab6794Ted Kremenek if (M->isLValue()) 1289e3939d7446959afb6b650fe08e952d0f64ab6794Ted Kremenek MakeNode(Dst, M, Pred, state->BindExpr(M, L), ProgramPoint::PostLValueKind); 1290e3939d7446959afb6b650fe08e952d0f64ab6794Ted Kremenek else 1291e3939d7446959afb6b650fe08e952d0f64ab6794Ted Kremenek evalLoad(Dst, M, Pred, state, L); 1292469ecbded3616416ef938ed94a67f86149faf226Ted Kremenek} 1293469ecbded3616416ef938ed94a67f86149faf226Ted Kremenek 12949c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek/// evalBind - Handle the semantics of binding a value to a specific location. 12959c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek/// This method is used by evalStore and (soon) VisitDeclStmt, and others. 12969c378f705405d37f49795d5e915989de774fe11fTed Kremenekvoid ExprEngine::evalBind(ExplodedNodeSet &Dst, const Stmt *StoreE, 129718c66fdc3c4008d335885695fe36fb5353c5f672Ted Kremenek ExplodedNode *Pred, const ProgramState *state, 129879d73044b7d0adfbd18ee34285395e1d5135f662Ted Kremenek SVal location, SVal Val, bool atDeclInit) { 1299b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 1300b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 1301b107c4b7efb907d75620cd3c17f82fe27dc5b745Ted Kremenek // Do a previsit of the bind. 1302b107c4b7efb907d75620cd3c17f82fe27dc5b745Ted Kremenek ExplodedNodeSet CheckedSet, Src; 1303b107c4b7efb907d75620cd3c17f82fe27dc5b745Ted Kremenek Src.Add(Pred); 1304eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis getCheckerManager().runCheckersForBind(CheckedSet, Src, location, Val, StoreE, 1305eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis *this); 1306b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 1307b107c4b7efb907d75620cd3c17f82fe27dc5b745Ted Kremenek for (ExplodedNodeSet::iterator I = CheckedSet.begin(), E = CheckedSet.end(); 1308b107c4b7efb907d75620cd3c17f82fe27dc5b745Ted Kremenek I!=E; ++I) { 1309b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 1310b107c4b7efb907d75620cd3c17f82fe27dc5b745Ted Kremenek if (Pred != *I) 1311db5e8cd095d1ffdd18f5620ad2348b5f386bebe3Anna Zaks state = (*I)->getState(); 1312b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 131318c66fdc3c4008d335885695fe36fb5353c5f672Ted Kremenek const ProgramState *newState = 0; 1314a8538d902fce9cfec20f39b34492268b51643819Ted Kremenek 1315b107c4b7efb907d75620cd3c17f82fe27dc5b745Ted Kremenek if (atDeclInit) { 1316b107c4b7efb907d75620cd3c17f82fe27dc5b745Ted Kremenek const VarRegion *VR = 1317b107c4b7efb907d75620cd3c17f82fe27dc5b745Ted Kremenek cast<VarRegion>(cast<loc::MemRegionVal>(location).getRegion()); 1318f6f56d4fc8ebce17e7b83eb2c35f57a055c22283Ted Kremenek 1319b107c4b7efb907d75620cd3c17f82fe27dc5b745Ted Kremenek newState = state->bindDecl(VR, Val); 1320f6f56d4fc8ebce17e7b83eb2c35f57a055c22283Ted Kremenek } 1321f6f56d4fc8ebce17e7b83eb2c35f57a055c22283Ted Kremenek else { 1322b107c4b7efb907d75620cd3c17f82fe27dc5b745Ted Kremenek if (location.isUnknown()) { 1323b107c4b7efb907d75620cd3c17f82fe27dc5b745Ted Kremenek // We know that the new state will be the same as the old state since 1324b107c4b7efb907d75620cd3c17f82fe27dc5b745Ted Kremenek // the location of the binding is "unknown". Consequently, there 1325b107c4b7efb907d75620cd3c17f82fe27dc5b745Ted Kremenek // is no reason to just create a new node. 1326b107c4b7efb907d75620cd3c17f82fe27dc5b745Ted Kremenek newState = state; 1327b107c4b7efb907d75620cd3c17f82fe27dc5b745Ted Kremenek } 1328b107c4b7efb907d75620cd3c17f82fe27dc5b745Ted Kremenek else { 1329b107c4b7efb907d75620cd3c17f82fe27dc5b745Ted Kremenek // We are binding to a value other than 'unknown'. Perform the binding 1330b107c4b7efb907d75620cd3c17f82fe27dc5b745Ted Kremenek // using the StoreManager. 1331b107c4b7efb907d75620cd3c17f82fe27dc5b745Ted Kremenek newState = state->bindLoc(cast<Loc>(location), Val); 1332b107c4b7efb907d75620cd3c17f82fe27dc5b745Ted Kremenek } 1333f6f56d4fc8ebce17e7b83eb2c35f57a055c22283Ted Kremenek } 1334a8538d902fce9cfec20f39b34492268b51643819Ted Kremenek 1335d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidis // The next thing to do is check if the TransferFuncs object wants to 1336b107c4b7efb907d75620cd3c17f82fe27dc5b745Ted Kremenek // update the state based on the new binding. If the GRTransferFunc object 1337b107c4b7efb907d75620cd3c17f82fe27dc5b745Ted Kremenek // doesn't do anything, just auto-propagate the current state. 133879d73044b7d0adfbd18ee34285395e1d5135f662Ted Kremenek 133979d73044b7d0adfbd18ee34285395e1d5135f662Ted Kremenek // NOTE: We use 'AssignE' for the location of the PostStore if 'AssignE' 134079d73044b7d0adfbd18ee34285395e1d5135f662Ted Kremenek // is non-NULL. Checkers typically care about 134179d73044b7d0adfbd18ee34285395e1d5135f662Ted Kremenek 1342d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidis StmtNodeBuilderRef BuilderRef(Dst, *Builder, *this, *I, newState, StoreE, 134396ebad66c451d79c9f57b1edb31efaeeb23b9a01Ted Kremenek true); 13441eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 13459c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek getTF().evalBind(BuilderRef, location, Val); 1346b107c4b7efb907d75620cd3c17f82fe27dc5b745Ted Kremenek } 1347a8538d902fce9cfec20f39b34492268b51643819Ted Kremenek} 1348a8538d902fce9cfec20f39b34492268b51643819Ted Kremenek 13499c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek/// evalStore - Handle the semantics of a store via an assignment. 1350a8538d902fce9cfec20f39b34492268b51643819Ted Kremenek/// @param Dst The node set to store generated state nodes 1351e8a4d7d0064b357a30fe7ee4f2ddc02f9ffc0357Zhongxing Xu/// @param AssignE The assignment expression if the store happens in an 1352e8a4d7d0064b357a30fe7ee4f2ddc02f9ffc0357Zhongxing Xu/// assignment. 1353e8a4d7d0064b357a30fe7ee4f2ddc02f9ffc0357Zhongxing Xu/// @param LocatioinE The location expression that is stored to. 1354a8538d902fce9cfec20f39b34492268b51643819Ted Kremenek/// @param state The current simulation state 1355a8538d902fce9cfec20f39b34492268b51643819Ted Kremenek/// @param location The location to store the value 1356a8538d902fce9cfec20f39b34492268b51643819Ted Kremenek/// @param Val The value to be stored 13579c378f705405d37f49795d5e915989de774fe11fTed Kremenekvoid ExprEngine::evalStore(ExplodedNodeSet &Dst, const Expr *AssignE, 13589c378f705405d37f49795d5e915989de774fe11fTed Kremenek const Expr *LocationE, 13599c378f705405d37f49795d5e915989de774fe11fTed Kremenek ExplodedNode *Pred, 136018c66fdc3c4008d335885695fe36fb5353c5f672Ted Kremenek const ProgramState *state, SVal location, SVal Val, 1361ca804539d908d3a0e8c72a0df5f1f571d29490bbTed Kremenek const ProgramPointTag *tag) { 13621eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1363d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidis assert(Builder && "StmtNodeBuilder must be defined."); 13641eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 136514429b918bd2f4cb52abc75546a7fe37142054caArgyrios Kyrtzidis // Proceed with the store. We use AssignE as the anchor for the PostStore 136614429b918bd2f4cb52abc75546a7fe37142054caArgyrios Kyrtzidis // ProgramPoint if it is non-NULL, and LocationE otherwise. 136714429b918bd2f4cb52abc75546a7fe37142054caArgyrios Kyrtzidis const Expr *StoreE = AssignE ? AssignE : LocationE; 136814429b918bd2f4cb52abc75546a7fe37142054caArgyrios Kyrtzidis 136914429b918bd2f4cb52abc75546a7fe37142054caArgyrios Kyrtzidis if (isa<loc::ObjCPropRef>(location)) { 137014429b918bd2f4cb52abc75546a7fe37142054caArgyrios Kyrtzidis loc::ObjCPropRef prop = cast<loc::ObjCPropRef>(location); 137114429b918bd2f4cb52abc75546a7fe37142054caArgyrios Kyrtzidis return VisitObjCMessage(ObjCPropertySetter(prop.getPropRefExpr(), 13724410a935e8d8ee3c903b858bbf74ca24fce629b5Ted Kremenek StoreE, Val), Pred, Dst); 137314429b918bd2f4cb52abc75546a7fe37142054caArgyrios Kyrtzidis } 137414429b918bd2f4cb52abc75546a7fe37142054caArgyrios Kyrtzidis 13751b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek // Evaluate the location (checks for bad dereferences). 1376b4b817d704287836b52b34369009e682f208aa2bTed Kremenek ExplodedNodeSet Tmp; 13779c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek evalLocation(Tmp, LocationE, Pred, state, location, tag, false); 13781eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1379b4b817d704287836b52b34369009e682f208aa2bTed Kremenek if (Tmp.empty()) 13801b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek return; 1381b0533965f1b4db020692e3b23ca7b3bc15bf5897Ted Kremenek 138273c498a08f4968b6987d1453c7b77929dcc6d5f7Argyrios Kyrtzidis if (location.isUndef()) 138373c498a08f4968b6987d1453c7b77929dcc6d5f7Argyrios Kyrtzidis return; 1384a8538d902fce9cfec20f39b34492268b51643819Ted Kremenek 1385b4b817d704287836b52b34369009e682f208aa2bTed Kremenek SaveAndRestore<ProgramPoint::Kind> OldSPointKind(Builder->PointKind, 1386b4b817d704287836b52b34369009e682f208aa2bTed Kremenek ProgramPoint::PostStoreKind); 1387b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 1388b4b817d704287836b52b34369009e682f208aa2bTed Kremenek for (ExplodedNodeSet::iterator NI=Tmp.begin(), NE=Tmp.end(); NI!=NE; ++NI) 1389db5e8cd095d1ffdd18f5620ad2348b5f386bebe3Anna Zaks evalBind(Dst, StoreE, *NI, (*NI)->getState(), location, Val); 13901b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek} 13911b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek 13929c378f705405d37f49795d5e915989de774fe11fTed Kremenekvoid ExprEngine::evalLoad(ExplodedNodeSet &Dst, const Expr *Ex, 13939c378f705405d37f49795d5e915989de774fe11fTed Kremenek ExplodedNode *Pred, 139418c66fdc3c4008d335885695fe36fb5353c5f672Ted Kremenek const ProgramState *state, SVal location, 1395ca804539d908d3a0e8c72a0df5f1f571d29490bbTed Kremenek const ProgramPointTag *tag, QualType LoadTy) { 1396cca8ab155e8c20b98ba2d90eb2b1c228895e06fdZhanyong Wan assert(!isa<NonLoc>(location) && "location cannot be a NonLoc."); 13971b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek 139814429b918bd2f4cb52abc75546a7fe37142054caArgyrios Kyrtzidis if (isa<loc::ObjCPropRef>(location)) { 139914429b918bd2f4cb52abc75546a7fe37142054caArgyrios Kyrtzidis loc::ObjCPropRef prop = cast<loc::ObjCPropRef>(location); 140014429b918bd2f4cb52abc75546a7fe37142054caArgyrios Kyrtzidis return VisitObjCMessage(ObjCPropertyGetter(prop.getPropRefExpr(), Ex), 14014410a935e8d8ee3c903b858bbf74ca24fce629b5Ted Kremenek Pred, Dst); 140214429b918bd2f4cb52abc75546a7fe37142054caArgyrios Kyrtzidis } 140314429b918bd2f4cb52abc75546a7fe37142054caArgyrios Kyrtzidis 1404852274d4257134906995cb252fb3dfd2d71deae8Ted Kremenek // Are we loading from a region? This actually results in two loads; one 1405852274d4257134906995cb252fb3dfd2d71deae8Ted Kremenek // to fetch the address of the referenced value and one to fetch the 1406852274d4257134906995cb252fb3dfd2d71deae8Ted Kremenek // referenced value. 14079697934650354bed2e509d8e7e44f21a1fb00f76Ted Kremenek if (const TypedValueRegion *TR = 14089697934650354bed2e509d8e7e44f21a1fb00f76Ted Kremenek dyn_cast_or_null<TypedValueRegion>(location.getAsRegion())) { 1409b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 1410018220c343c103b7dfaa117a7a474c7a7fd6d068Zhongxing Xu QualType ValTy = TR->getValueType(); 1411852274d4257134906995cb252fb3dfd2d71deae8Ted Kremenek if (const ReferenceType *RT = ValTy->getAs<ReferenceType>()) { 1412ca804539d908d3a0e8c72a0df5f1f571d29490bbTed Kremenek static SimpleProgramPointTag 1413ca804539d908d3a0e8c72a0df5f1f571d29490bbTed Kremenek loadReferenceTag("ExprEngine : Load Reference"); 1414852274d4257134906995cb252fb3dfd2d71deae8Ted Kremenek ExplodedNodeSet Tmp; 14159c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek evalLoadCommon(Tmp, Ex, Pred, state, location, &loadReferenceTag, 1416852274d4257134906995cb252fb3dfd2d71deae8Ted Kremenek getContext().getPointerType(RT->getPointeeType())); 1417852274d4257134906995cb252fb3dfd2d71deae8Ted Kremenek 1418852274d4257134906995cb252fb3dfd2d71deae8Ted Kremenek // Perform the load from the referenced value. 1419852274d4257134906995cb252fb3dfd2d71deae8Ted Kremenek for (ExplodedNodeSet::iterator I=Tmp.begin(), E=Tmp.end() ; I!=E; ++I) { 1420db5e8cd095d1ffdd18f5620ad2348b5f386bebe3Anna Zaks state = (*I)->getState(); 14211397663af9dbcc24dbf0e11de43931b3dc08fdbbTed Kremenek location = state->getSVal(Ex); 14229c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek evalLoadCommon(Dst, Ex, *I, state, location, tag, LoadTy); 1423b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek } 1424852274d4257134906995cb252fb3dfd2d71deae8Ted Kremenek return; 1425852274d4257134906995cb252fb3dfd2d71deae8Ted Kremenek } 1426852274d4257134906995cb252fb3dfd2d71deae8Ted Kremenek } 1427b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 14289c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek evalLoadCommon(Dst, Ex, Pred, state, location, tag, LoadTy); 1429852274d4257134906995cb252fb3dfd2d71deae8Ted Kremenek} 1430852274d4257134906995cb252fb3dfd2d71deae8Ted Kremenek 14319c378f705405d37f49795d5e915989de774fe11fTed Kremenekvoid ExprEngine::evalLoadCommon(ExplodedNodeSet &Dst, const Expr *Ex, 14329c378f705405d37f49795d5e915989de774fe11fTed Kremenek ExplodedNode *Pred, 143318c66fdc3c4008d335885695fe36fb5353c5f672Ted Kremenek const ProgramState *state, SVal location, 1434ca804539d908d3a0e8c72a0df5f1f571d29490bbTed Kremenek const ProgramPointTag *tag, QualType LoadTy) { 1435b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 14361eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump // Evaluate the location (checks for bad dereferences). 1437b4b817d704287836b52b34369009e682f208aa2bTed Kremenek ExplodedNodeSet Tmp; 14389c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek evalLocation(Tmp, Ex, Pred, state, location, tag, true); 14391eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1440b4b817d704287836b52b34369009e682f208aa2bTed Kremenek if (Tmp.empty()) 14411b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek return; 1442b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 144373c498a08f4968b6987d1453c7b77929dcc6d5f7Argyrios Kyrtzidis if (location.isUndef()) 144473c498a08f4968b6987d1453c7b77929dcc6d5f7Argyrios Kyrtzidis return; 1445b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 1446b4b817d704287836b52b34369009e682f208aa2bTed Kremenek SaveAndRestore<ProgramPoint::Kind> OldSPointKind(Builder->PointKind); 14471eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 14481b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek // Proceed with the load. 1449b4b817d704287836b52b34369009e682f208aa2bTed Kremenek for (ExplodedNodeSet::iterator NI=Tmp.begin(), NE=Tmp.end(); NI!=NE; ++NI) { 1450db5e8cd095d1ffdd18f5620ad2348b5f386bebe3Anna Zaks state = (*NI)->getState(); 145196ebad66c451d79c9f57b1edb31efaeeb23b9a01Ted Kremenek 1452b4b817d704287836b52b34369009e682f208aa2bTed Kremenek if (location.isUnknown()) { 1453b4b817d704287836b52b34369009e682f208aa2bTed Kremenek // This is important. We must nuke the old binding. 1454b4b817d704287836b52b34369009e682f208aa2bTed Kremenek MakeNode(Dst, Ex, *NI, state->BindExpr(Ex, UnknownVal()), 1455b4b817d704287836b52b34369009e682f208aa2bTed Kremenek ProgramPoint::PostLoadKind, tag); 1456b4b817d704287836b52b34369009e682f208aa2bTed Kremenek } 1457b4b817d704287836b52b34369009e682f208aa2bTed Kremenek else { 145896ebad66c451d79c9f57b1edb31efaeeb23b9a01Ted Kremenek if (LoadTy.isNull()) 145996ebad66c451d79c9f57b1edb31efaeeb23b9a01Ted Kremenek LoadTy = Ex->getType(); 146096ebad66c451d79c9f57b1edb31efaeeb23b9a01Ted Kremenek SVal V = state->getSVal(cast<Loc>(location), LoadTy); 146196ebad66c451d79c9f57b1edb31efaeeb23b9a01Ted Kremenek MakeNode(Dst, Ex, *NI, state->bindExprAndLocation(Ex, location, V), 146296ebad66c451d79c9f57b1edb31efaeeb23b9a01Ted Kremenek ProgramPoint::PostLoadKind, tag); 1463b4b817d704287836b52b34369009e682f208aa2bTed Kremenek } 1464d5b499d43c3526fae7f9ebb6e2d50e79d3496cedZhongxing Xu } 14651b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek} 14661b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek 1467d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidisvoid ExprEngine::evalLocation(ExplodedNodeSet &Dst, const Stmt *S, 14689c378f705405d37f49795d5e915989de774fe11fTed Kremenek ExplodedNode *Pred, 146918c66fdc3c4008d335885695fe36fb5353c5f672Ted Kremenek const ProgramState *state, SVal location, 1470ca804539d908d3a0e8c72a0df5f1f571d29490bbTed Kremenek const ProgramPointTag *tag, bool isLoad) { 147100b1ad2d56f3e39f95c3f61bf511a531ab6a4fa5Zhongxing Xu // Early checks for performance reason. 1472769ce3e93ad35bd9ac28e4d8b8f035ae4fd9a5b5Argyrios Kyrtzidis if (location.isUnknown()) { 1473b4b817d704287836b52b34369009e682f208aa2bTed Kremenek Dst.Add(Pred); 1474b4b817d704287836b52b34369009e682f208aa2bTed Kremenek return; 1475b4b817d704287836b52b34369009e682f208aa2bTed Kremenek } 1476b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 14779c0d6891b3ec4b0d20b8a295946c0dc5426d147cArgyrios Kyrtzidis ExplodedNodeSet Src; 14780e89061a399bae32f0eca5b85658ad66a58c504dAnna Zaks if (Pred->getState() == state) { 1479eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis Src.Add(Pred); 1480eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis } else { 1481eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis // Associate this new state with an ExplodedNode. 1482eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis // FIXME: If I pass null tag, the graph is incorrect, e.g for 1483eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis // int *p; 1484eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis // p = 0; 1485eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis // *p = 0xDEADBEEF; 1486eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis // "p = 0" is not noted as "Null pointer value stored to 'p'" but 1487eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis // instead "int *p" is noted as 1488eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis // "Variable 'p' initialized to a null pointer value" 1489ca804539d908d3a0e8c72a0df5f1f571d29490bbTed Kremenek 1490ca804539d908d3a0e8c72a0df5f1f571d29490bbTed Kremenek // FIXME: why is 'tag' not used instead of etag? 1491ca804539d908d3a0e8c72a0df5f1f571d29490bbTed Kremenek static SimpleProgramPointTag etag("ExprEngine: Location"); 1492ca804539d908d3a0e8c72a0df5f1f571d29490bbTed Kremenek 1493ca804539d908d3a0e8c72a0df5f1f571d29490bbTed Kremenek ExplodedNode *N = Builder->generateNode(S, state, Pred, &etag); 1494eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis Src.Add(N ? N : Pred); 14950296c22557b3735e2ffeff690eb46fb0e9152bccTed Kremenek } 1496eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis getCheckerManager().runCheckersForLocation(Dst, Src, location, isLoad, S, 1497eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis *this); 1498ec96a2d52d16e150baaf629cd35e3fabff5d8915Ted Kremenek} 1499ec96a2d52d16e150baaf629cd35e3fabff5d8915Ted Kremenek 1500d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidisbool ExprEngine::InlineCall(ExplodedNodeSet &Dst, const CallExpr *CE, 15011c625f25055331bf76ab5479a8060d2b0f61e8b8Zhongxing Xu ExplodedNode *Pred) { 1502b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek return false; 1503b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek 1504b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek // Inlining isn't correct right now because we: 1505b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek // (a) don't generate CallExit nodes. 1506b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek // (b) we need a way to postpone doing post-visits of CallExprs until 1507b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek // the CallExit. This means we need CallExits for the non-inline 1508b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek // cases as well. 1509b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek 1510b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek#if 0 151118c66fdc3c4008d335885695fe36fb5353c5f672Ted Kremenek const ProgramState *state = Pred->getState(); 15121c625f25055331bf76ab5479a8060d2b0f61e8b8Zhongxing Xu const Expr *Callee = CE->getCallee(); 15131c625f25055331bf76ab5479a8060d2b0f61e8b8Zhongxing Xu SVal L = state->getSVal(Callee); 15141c625f25055331bf76ab5479a8060d2b0f61e8b8Zhongxing Xu 15151c625f25055331bf76ab5479a8060d2b0f61e8b8Zhongxing Xu const FunctionDecl *FD = L.getAsFunctionDecl(); 15161c625f25055331bf76ab5479a8060d2b0f61e8b8Zhongxing Xu if (!FD) 15171c625f25055331bf76ab5479a8060d2b0f61e8b8Zhongxing Xu return false; 15181c625f25055331bf76ab5479a8060d2b0f61e8b8Zhongxing Xu 1519b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek // Specially handle CXXMethods. 1520b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek const CXXMethodDecl *methodDecl = 0; 1521b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek 1522b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek switch (CE->getStmtClass()) { 1523b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek default: break; 1524b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek case Stmt::CXXOperatorCallExprClass: { 1525b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek const CXXOperatorCallExpr *opCall = cast<CXXOperatorCallExpr>(CE); 1526b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek methodDecl = 15275f9e272e632e951b1efe824cd16acb4d96077930Chris Lattner dyn_cast_or_null<CXXMethodDecl>(opCall->getCalleeDecl()); 1528b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek break; 1529b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek } 1530b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek case Stmt::CXXMemberCallExprClass: { 1531b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek const CXXMemberCallExpr *memberCall = cast<CXXMemberCallExpr>(CE); 1532b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek const MemberExpr *memberExpr = 1533b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek cast<MemberExpr>(memberCall->getCallee()->IgnoreParens()); 1534b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek methodDecl = cast<CXXMethodDecl>(memberExpr->getMemberDecl()); 1535b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek break; 1536b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek } 1537b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek } 1538b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek 1539b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek 1540b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek 1541b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek 1542c6238d2786cfd961b94580b3d3675a1b3ff0721cZhongxing Xu // Check if the function definition is in the same translation unit. 1543c6238d2786cfd961b94580b3d3675a1b3ff0721cZhongxing Xu if (FD->hasBody(FD)) { 154419b78d9e3dbbc27bbcbdd8c3017a00fe88849ecdZhongxing Xu const StackFrameContext *stackFrame = 154519b78d9e3dbbc27bbcbdd8c3017a00fe88849ecdZhongxing Xu AMgr.getStackFrame(AMgr.getAnalysisContext(FD), 154619b78d9e3dbbc27bbcbdd8c3017a00fe88849ecdZhongxing Xu Pred->getLocationContext(), 1547892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek CE, Builder->getBlock(), Builder->getIndex()); 1548c6238d2786cfd961b94580b3d3675a1b3ff0721cZhongxing Xu // Now we have the definition of the callee, create a CallEnter node. 154919b78d9e3dbbc27bbcbdd8c3017a00fe88849ecdZhongxing Xu CallEnter Loc(CE, stackFrame, Pred->getLocationContext()); 1550c6238d2786cfd961b94580b3d3675a1b3ff0721cZhongxing Xu 1551c6238d2786cfd961b94580b3d3675a1b3ff0721cZhongxing Xu ExplodedNode *N = Builder->generateNode(Loc, state, Pred); 1552c6238d2786cfd961b94580b3d3675a1b3ff0721cZhongxing Xu Dst.Add(N); 1553c6238d2786cfd961b94580b3d3675a1b3ff0721cZhongxing Xu return true; 1554c6238d2786cfd961b94580b3d3675a1b3ff0721cZhongxing Xu } 15551c625f25055331bf76ab5479a8060d2b0f61e8b8Zhongxing Xu 1556c6238d2786cfd961b94580b3d3675a1b3ff0721cZhongxing Xu // Check if we can find the function definition in other translation units. 1557c6238d2786cfd961b94580b3d3675a1b3ff0721cZhongxing Xu if (AMgr.hasIndexer()) { 155819b78d9e3dbbc27bbcbdd8c3017a00fe88849ecdZhongxing Xu AnalysisContext *C = AMgr.getAnalysisContextInAnotherTU(FD); 1559c6238d2786cfd961b94580b3d3675a1b3ff0721cZhongxing Xu if (C == 0) 1560c6238d2786cfd961b94580b3d3675a1b3ff0721cZhongxing Xu return false; 156119b78d9e3dbbc27bbcbdd8c3017a00fe88849ecdZhongxing Xu const StackFrameContext *stackFrame = 156219b78d9e3dbbc27bbcbdd8c3017a00fe88849ecdZhongxing Xu AMgr.getStackFrame(C, Pred->getLocationContext(), 1563892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek CE, Builder->getBlock(), Builder->getIndex()); 156419b78d9e3dbbc27bbcbdd8c3017a00fe88849ecdZhongxing Xu CallEnter Loc(CE, stackFrame, Pred->getLocationContext()); 1565c6238d2786cfd961b94580b3d3675a1b3ff0721cZhongxing Xu ExplodedNode *N = Builder->generateNode(Loc, state, Pred); 15661c625f25055331bf76ab5479a8060d2b0f61e8b8Zhongxing Xu Dst.Add(N); 1567c6238d2786cfd961b94580b3d3675a1b3ff0721cZhongxing Xu return true; 1568c6238d2786cfd961b94580b3d3675a1b3ff0721cZhongxing Xu } 1569b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek 1570b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek // Generate the CallExit node. 1571c6238d2786cfd961b94580b3d3675a1b3ff0721cZhongxing Xu 1572c6238d2786cfd961b94580b3d3675a1b3ff0721cZhongxing Xu return false; 1573b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek#endif 15741c625f25055331bf76ab5479a8060d2b0f61e8b8Zhongxing Xu} 15751c625f25055331bf76ab5479a8060d2b0f61e8b8Zhongxing Xu 15766c7511db998817e64f2e124013e7d7c9a430c580Ted Kremenekstd::pair<const ProgramPointTag *, const ProgramPointTag*> 15776c7511db998817e64f2e124013e7d7c9a430c580Ted KremenekExprEngine::getEagerlyAssumeTags() { 15786c7511db998817e64f2e124013e7d7c9a430c580Ted Kremenek static SimpleProgramPointTag 15796c7511db998817e64f2e124013e7d7c9a430c580Ted Kremenek EagerlyAssumeTrue("ExprEngine : Eagerly Assume True"), 15806c7511db998817e64f2e124013e7d7c9a430c580Ted Kremenek EagerlyAssumeFalse("ExprEngine : Eagerly Assume False"); 15816c7511db998817e64f2e124013e7d7c9a430c580Ted Kremenek return std::make_pair(&EagerlyAssumeTrue, &EagerlyAssumeFalse); 15826c7511db998817e64f2e124013e7d7c9a430c580Ted Kremenek} 15836c7511db998817e64f2e124013e7d7c9a430c580Ted Kremenek 1584d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidisvoid ExprEngine::evalEagerlyAssume(ExplodedNodeSet &Dst, ExplodedNodeSet &Src, 158503509aea098772644bf4662dc1c88634818ceeccZhongxing Xu const Expr *Ex) { 158686b39f20d5091ca3fdcbeb4a22766aaffdf6ac35Ted Kremenek 158786b39f20d5091ca3fdcbeb4a22766aaffdf6ac35Ted Kremenek 1588031ccc0555a82afc2e8afe29e19dd57ff204e2deZhongxing Xu for (ExplodedNodeSet::iterator I=Src.begin(), E=Src.end(); I!=E; ++I) { 1589031ccc0555a82afc2e8afe29e19dd57ff204e2deZhongxing Xu ExplodedNode *Pred = *I; 15901eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1591b293902c5cfa18365ffb0e00763849c9808a2ad1Ted Kremenek // Test if the previous node was as the same expression. This can happen 1592b293902c5cfa18365ffb0e00763849c9808a2ad1Ted Kremenek // when the expression fails to evaluate to anything meaningful and 1593b293902c5cfa18365ffb0e00763849c9808a2ad1Ted Kremenek // (as an optimization) we don't generate a node. 15941eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump ProgramPoint P = Pred->getLocation(); 1595b293902c5cfa18365ffb0e00763849c9808a2ad1Ted Kremenek if (!isa<PostStmt>(P) || cast<PostStmt>(P).getStmt() != Ex) { 15961eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump Dst.Add(Pred); 1597b293902c5cfa18365ffb0e00763849c9808a2ad1Ted Kremenek continue; 15981eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump } 1599b293902c5cfa18365ffb0e00763849c9808a2ad1Ted Kremenek 160018c66fdc3c4008d335885695fe36fb5353c5f672Ted Kremenek const ProgramState *state = Pred->getState(); 16011397663af9dbcc24dbf0e11de43931b3dc08fdbbTed Kremenek SVal V = state->getSVal(Ex); 16025b9bd2137ebef350af803c634e3fdf5d74678100Ted Kremenek if (nonloc::SymExprVal *SEV = dyn_cast<nonloc::SymExprVal>(&V)) { 16036c7511db998817e64f2e124013e7d7c9a430c580Ted Kremenek const std::pair<const ProgramPointTag *, const ProgramPointTag*> &tags = 16046c7511db998817e64f2e124013e7d7c9a430c580Ted Kremenek getEagerlyAssumeTags(); 16056c7511db998817e64f2e124013e7d7c9a430c580Ted Kremenek 160648af2a9c1ed3259512f2d1431720add1fbe8fb5fTed Kremenek // First assume that the condition is true. 16076c7511db998817e64f2e124013e7d7c9a430c580Ted Kremenek if (const ProgramState *StateTrue = state->assume(*SEV, true)) { 160886b39f20d5091ca3fdcbeb4a22766aaffdf6ac35Ted Kremenek SVal Val = svalBuilder.makeIntVal(1U, Ex->getType()); 16096c7511db998817e64f2e124013e7d7c9a430c580Ted Kremenek StateTrue = StateTrue->BindExpr(Ex, Val); 16106c7511db998817e64f2e124013e7d7c9a430c580Ted Kremenek Dst.Add(Builder->generateNode(Ex, StateTrue, Pred, tags.first)); 161148af2a9c1ed3259512f2d1431720add1fbe8fb5fTed Kremenek } 16121eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 161348af2a9c1ed3259512f2d1431720add1fbe8fb5fTed Kremenek // Next, assume that the condition is false. 16146c7511db998817e64f2e124013e7d7c9a430c580Ted Kremenek if (const ProgramState *StateFalse = state->assume(*SEV, false)) { 161586b39f20d5091ca3fdcbeb4a22766aaffdf6ac35Ted Kremenek SVal Val = svalBuilder.makeIntVal(0U, Ex->getType()); 16166c7511db998817e64f2e124013e7d7c9a430c580Ted Kremenek StateFalse = StateFalse->BindExpr(Ex, Val); 16176c7511db998817e64f2e124013e7d7c9a430c580Ted Kremenek Dst.Add(Builder->generateNode(Ex, StateFalse, Pred, tags.second)); 161848af2a9c1ed3259512f2d1431720add1fbe8fb5fTed Kremenek } 161948af2a9c1ed3259512f2d1431720add1fbe8fb5fTed Kremenek } 162048af2a9c1ed3259512f2d1431720add1fbe8fb5fTed Kremenek else 162148af2a9c1ed3259512f2d1431720add1fbe8fb5fTed Kremenek Dst.Add(Pred); 162248af2a9c1ed3259512f2d1431720add1fbe8fb5fTed Kremenek } 162348af2a9c1ed3259512f2d1431720add1fbe8fb5fTed Kremenek} 162448af2a9c1ed3259512f2d1431720add1fbe8fb5fTed Kremenek 16259c378f705405d37f49795d5e915989de774fe11fTed Kremenekvoid ExprEngine::VisitAsmStmt(const AsmStmt *A, ExplodedNode *Pred, 16269c378f705405d37f49795d5e915989de774fe11fTed Kremenek ExplodedNodeSet &Dst) { 1627ef44bfb9d0f15ba0391f8346c9f01355fb450a09Ted Kremenek VisitAsmStmtHelperOutputs(A, A->begin_outputs(), A->end_outputs(), Pred, Dst); 16281eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump} 1629ef44bfb9d0f15ba0391f8346c9f01355fb450a09Ted Kremenek 16309c378f705405d37f49795d5e915989de774fe11fTed Kremenekvoid ExprEngine::VisitAsmStmtHelperOutputs(const AsmStmt *A, 163103509aea098772644bf4662dc1c88634818ceeccZhongxing Xu AsmStmt::const_outputs_iterator I, 163203509aea098772644bf4662dc1c88634818ceeccZhongxing Xu AsmStmt::const_outputs_iterator E, 16339c378f705405d37f49795d5e915989de774fe11fTed Kremenek ExplodedNode *Pred, ExplodedNodeSet &Dst) { 1634ef44bfb9d0f15ba0391f8346c9f01355fb450a09Ted Kremenek if (I == E) { 1635ef44bfb9d0f15ba0391f8346c9f01355fb450a09Ted Kremenek VisitAsmStmtHelperInputs(A, A->begin_inputs(), A->end_inputs(), Pred, Dst); 1636ef44bfb9d0f15ba0391f8346c9f01355fb450a09Ted Kremenek return; 1637ef44bfb9d0f15ba0391f8346c9f01355fb450a09Ted Kremenek } 16381eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1639031ccc0555a82afc2e8afe29e19dd57ff204e2deZhongxing Xu ExplodedNodeSet Tmp; 1640892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek Visit(*I, Pred, Tmp); 1641ef44bfb9d0f15ba0391f8346c9f01355fb450a09Ted Kremenek ++I; 16421eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1643bb141217871e93767aa3f2de1b9946fa6d37066aZhongxing Xu for (ExplodedNodeSet::iterator NI = Tmp.begin(), NE = Tmp.end();NI != NE;++NI) 1644ef44bfb9d0f15ba0391f8346c9f01355fb450a09Ted Kremenek VisitAsmStmtHelperOutputs(A, I, E, *NI, Dst); 1645ef44bfb9d0f15ba0391f8346c9f01355fb450a09Ted Kremenek} 1646ef44bfb9d0f15ba0391f8346c9f01355fb450a09Ted Kremenek 16479c378f705405d37f49795d5e915989de774fe11fTed Kremenekvoid ExprEngine::VisitAsmStmtHelperInputs(const AsmStmt *A, 164803509aea098772644bf4662dc1c88634818ceeccZhongxing Xu AsmStmt::const_inputs_iterator I, 164903509aea098772644bf4662dc1c88634818ceeccZhongxing Xu AsmStmt::const_inputs_iterator E, 16509c378f705405d37f49795d5e915989de774fe11fTed Kremenek ExplodedNode *Pred, 16519c378f705405d37f49795d5e915989de774fe11fTed Kremenek ExplodedNodeSet &Dst) { 1652ef44bfb9d0f15ba0391f8346c9f01355fb450a09Ted Kremenek if (I == E) { 16531eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1654ef44bfb9d0f15ba0391f8346c9f01355fb450a09Ted Kremenek // We have processed both the inputs and the outputs. All of the outputs 16551c96b24285d05c0eac455ae96d7c9ff43d42bc96Zhongxing Xu // should evaluate to Locs. Nuke all of their values. 16561eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1657ef44bfb9d0f15ba0391f8346c9f01355fb450a09Ted Kremenek // FIXME: Some day in the future it would be nice to allow a "plug-in" 1658ef44bfb9d0f15ba0391f8346c9f01355fb450a09Ted Kremenek // which interprets the inline asm and stores proper results in the 1659ef44bfb9d0f15ba0391f8346c9f01355fb450a09Ted Kremenek // outputs. 16601eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 166118c66fdc3c4008d335885695fe36fb5353c5f672Ted Kremenek const ProgramState *state = Pred->getState(); 16621eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 166303509aea098772644bf4662dc1c88634818ceeccZhongxing Xu for (AsmStmt::const_outputs_iterator OI = A->begin_outputs(), 1664ef44bfb9d0f15ba0391f8346c9f01355fb450a09Ted Kremenek OE = A->end_outputs(); OI != OE; ++OI) { 16651eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 16661397663af9dbcc24dbf0e11de43931b3dc08fdbbTed Kremenek SVal X = state->getSVal(*OI); 16671c96b24285d05c0eac455ae96d7c9ff43d42bc96Zhongxing Xu assert (!isa<NonLoc>(X)); // Should be an Lval, or unknown, undef. 16681eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 16691c96b24285d05c0eac455ae96d7c9ff43d42bc96Zhongxing Xu if (isa<Loc>(X)) 16703ff12591494a3cb3d3a24427975df58714ac3b2fTed Kremenek state = state->bindLoc(cast<Loc>(X), UnknownVal()); 1671ef44bfb9d0f15ba0391f8346c9f01355fb450a09Ted Kremenek } 16721eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1673a8538d902fce9cfec20f39b34492268b51643819Ted Kremenek MakeNode(Dst, A, Pred, state); 1674ef44bfb9d0f15ba0391f8346c9f01355fb450a09Ted Kremenek return; 1675ef44bfb9d0f15ba0391f8346c9f01355fb450a09Ted Kremenek } 16761eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1677031ccc0555a82afc2e8afe29e19dd57ff204e2deZhongxing Xu ExplodedNodeSet Tmp; 1678ef44bfb9d0f15ba0391f8346c9f01355fb450a09Ted Kremenek Visit(*I, Pred, Tmp); 16791eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1680ef44bfb9d0f15ba0391f8346c9f01355fb450a09Ted Kremenek ++I; 16811eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1682e1ccccff777f6bad6b25e9c6a762f98fd8003181Ted Kremenek for (ExplodedNodeSet::iterator NI = Tmp.begin(), NE = Tmp.end(); NI!=NE; ++NI) 1683ef44bfb9d0f15ba0391f8346c9f01355fb450a09Ted Kremenek VisitAsmStmtHelperInputs(A, I, E, *NI, Dst); 1684ef44bfb9d0f15ba0391f8346c9f01355fb450a09Ted Kremenek} 1685ef44bfb9d0f15ba0391f8346c9f01355fb450a09Ted Kremenek 1686094bef56a7900f13bb777f9a352704104b1458e7Ted Kremenek 1687094bef56a7900f13bb777f9a352704104b1458e7Ted Kremenek//===----------------------------------------------------------------------===// 1688e01c98767dfd7153c3c84637c36659e3bbe16ff7Ted Kremenek// Visualization. 1689ee98546b0d5f3439c4a590b0d7d1545af794a0ecTed Kremenek//===----------------------------------------------------------------------===// 1690ee98546b0d5f3439c4a590b0d7d1545af794a0ecTed Kremenek 1691aa66a32ba177338763cd0cf9df8310dfa2e24ff7Ted Kremenek#ifndef NDEBUG 1692d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidisstatic ExprEngine* GraphPrintCheckerState; 1693e97ca065c91ff9ca2a2a42eb443eaa553c40441cTed Kremenekstatic SourceManager* GraphPrintSourceManager; 16943b4f6702860208692f6ef28401e68de4e3ff9af9Ted Kremenek 1695aa66a32ba177338763cd0cf9df8310dfa2e24ff7Ted Kremeneknamespace llvm { 1696aa66a32ba177338763cd0cf9df8310dfa2e24ff7Ted Kremenektemplate<> 169747491f8b7adf9d42a404d44c073e8a5308fa6cfcDouglas Gregorstruct DOTGraphTraits<ExplodedNode*> : 1698aa66a32ba177338763cd0cf9df8310dfa2e24ff7Ted Kremenek public DefaultDOTGraphTraits { 1699006b0eb3e11162d8c06372db813ac9f71a7a16e8Tobias Grosser 1700006b0eb3e11162d8c06372db813ac9f71a7a16e8Tobias Grosser DOTGraphTraits (bool isSimple=false) : DefaultDOTGraphTraits(isSimple) {} 1701006b0eb3e11162d8c06372db813ac9f71a7a16e8Tobias Grosser 1702d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidis // FIXME: Since we do not cache error nodes in ExprEngine now, this does not 1703ec9227fea66c3439991fc84b0d33b0a8b4b8875eZhongxing Xu // work. 17049c378f705405d37f49795d5e915989de774fe11fTed Kremenek static std::string getNodeAttributes(const ExplodedNode *N, void*) { 17051eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 170610f51e8785e43d5a22acc2d2a638307c582949c2Ted Kremenek#if 0 170710f51e8785e43d5a22acc2d2a638307c582949c2Ted Kremenek // FIXME: Replace with a general scheme to tell if the node is 170810f51e8785e43d5a22acc2d2a638307c582949c2Ted Kremenek // an error node. 1709a3fadfcce5911742801a302cac82d4fe54d5c682Ted Kremenek if (GraphPrintCheckerState->isImplicitNullDeref(N) || 17109dca062461a6244cf0f733346657fa3eee853f9bTed Kremenek GraphPrintCheckerState->isExplicitNullDeref(N) || 17114a4e524afef40d6f3ddb25d0e407c814e4ca56a8Ted Kremenek GraphPrintCheckerState->isUndefDeref(N) || 17124a4e524afef40d6f3ddb25d0e407c814e4ca56a8Ted Kremenek GraphPrintCheckerState->isUndefStore(N) || 17134a4e524afef40d6f3ddb25d0e407c814e4ca56a8Ted Kremenek GraphPrintCheckerState->isUndefControlFlow(N) || 17145e03fcb5420c33207433dd6f800588e256dd9bdbTed Kremenek GraphPrintCheckerState->isUndefResult(N) || 17152ded35a576e3899553ea0ccfcbf5cbdb3d8cf664Ted Kremenek GraphPrintCheckerState->isBadCall(N) || 17162ded35a576e3899553ea0ccfcbf5cbdb3d8cf664Ted Kremenek GraphPrintCheckerState->isUndefArg(N)) 1717a3fadfcce5911742801a302cac82d4fe54d5c682Ted Kremenek return "color=\"red\",style=\"filled\""; 17181eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 17198cc13ea74fea1c04042a2f4087665bc5182e8408Ted Kremenek if (GraphPrintCheckerState->isNoReturnCall(N)) 17208cc13ea74fea1c04042a2f4087665bc5182e8408Ted Kremenek return "color=\"blue\",style=\"filled\""; 17212055effed54d614b51e3501a174c9b1fe92e4de4Zhongxing Xu#endif 1722a3fadfcce5911742801a302cac82d4fe54d5c682Ted Kremenek return ""; 1723a3fadfcce5911742801a302cac82d4fe54d5c682Ted Kremenek } 17241eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 17259c378f705405d37f49795d5e915989de774fe11fTed Kremenek static std::string getNodeLabel(const ExplodedNode *N, void*){ 17261eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 172753ba0b636194dbeaa65a6f85316c9397a0c5298bTed Kremenek std::string sbuf; 172853ba0b636194dbeaa65a6f85316c9397a0c5298bTed Kremenek llvm::raw_string_ostream Out(sbuf); 1729803c9edd06e8f936821525d36b1d8cc131e37d44Ted Kremenek 1730803c9edd06e8f936821525d36b1d8cc131e37d44Ted Kremenek // Program Location. 1731aa66a32ba177338763cd0cf9df8310dfa2e24ff7Ted Kremenek ProgramPoint Loc = N->getLocation(); 17321eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1733aa66a32ba177338763cd0cf9df8310dfa2e24ff7Ted Kremenek switch (Loc.getKind()) { 1734aa66a32ba177338763cd0cf9df8310dfa2e24ff7Ted Kremenek case ProgramPoint::BlockEntranceKind: 17351eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump Out << "Block Entrance: B" 1736aa66a32ba177338763cd0cf9df8310dfa2e24ff7Ted Kremenek << cast<BlockEntrance>(Loc).getBlock()->getBlockID(); 1737aa66a32ba177338763cd0cf9df8310dfa2e24ff7Ted Kremenek break; 17381eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1739aa66a32ba177338763cd0cf9df8310dfa2e24ff7Ted Kremenek case ProgramPoint::BlockExitKind: 1740aa66a32ba177338763cd0cf9df8310dfa2e24ff7Ted Kremenek assert (false); 1741aa66a32ba177338763cd0cf9df8310dfa2e24ff7Ted Kremenek break; 17421eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1743102acd5369bbb17c0d6ab868af376671acff7a93Douglas Gregor case ProgramPoint::CallEnterKind: 1744102acd5369bbb17c0d6ab868af376671acff7a93Douglas Gregor Out << "CallEnter"; 1745102acd5369bbb17c0d6ab868af376671acff7a93Douglas Gregor break; 1746102acd5369bbb17c0d6ab868af376671acff7a93Douglas Gregor 1747102acd5369bbb17c0d6ab868af376671acff7a93Douglas Gregor case ProgramPoint::CallExitKind: 1748102acd5369bbb17c0d6ab868af376671acff7a93Douglas Gregor Out << "CallExit"; 1749102acd5369bbb17c0d6ab868af376671acff7a93Douglas Gregor break; 1750102acd5369bbb17c0d6ab868af376671acff7a93Douglas Gregor 1751aa66a32ba177338763cd0cf9df8310dfa2e24ff7Ted Kremenek default: { 17525f85e17df3f5b0a8021443f2b590daecfb2cbd17Ted Kremenek if (StmtPoint *L = dyn_cast<StmtPoint>(&Loc)) { 17539c378f705405d37f49795d5e915989de774fe11fTed Kremenek const Stmt *S = L->getStmt(); 17548c354758c2d39db87c77c723d81e34b4d967f762Ted Kremenek SourceLocation SLoc = S->getLocStart(); 17558c354758c2d39db87c77c723d81e34b4d967f762Ted Kremenek 17561eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump Out << S->getStmtClassName() << ' ' << (void*) S << ' '; 1757e4f2142d00fa5fdb580c4e2413da91882d955381Chris Lattner LangOptions LO; // FIXME. 1758e4f2142d00fa5fdb580c4e2413da91882d955381Chris Lattner S->printPretty(Out, 0, PrintingPolicy(LO)); 17591eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 17601eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump if (SLoc.isFileID()) { 17618c354758c2d39db87c77c723d81e34b4d967f762Ted Kremenek Out << "\\lline=" 1762642116259e8df6286063a17361c20e95b5017a0aChandler Carruth << GraphPrintSourceManager->getExpansionLineNumber(SLoc) 17637da5aea7669e6db3e593162b8a123aef06a04d07Chris Lattner << " col=" 1764a77c031cb66f75d22672070052cc6e0205289ff8Chandler Carruth << GraphPrintSourceManager->getExpansionColumnNumber(SLoc) 17657da5aea7669e6db3e593162b8a123aef06a04d07Chris Lattner << "\\l"; 17668c354758c2d39db87c77c723d81e34b4d967f762Ted Kremenek } 17671eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 17685f85e17df3f5b0a8021443f2b590daecfb2cbd17Ted Kremenek if (isa<PreStmt>(Loc)) 17691eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump Out << "\\lPreStmt\\l;"; 17705f85e17df3f5b0a8021443f2b590daecfb2cbd17Ted Kremenek else if (isa<PostLoad>(Loc)) 17717090d5465de7ca620da16211cf886edf1edc1f1fTed Kremenek Out << "\\lPostLoad\\l;"; 17727090d5465de7ca620da16211cf886edf1edc1f1fTed Kremenek else if (isa<PostStore>(Loc)) 17737090d5465de7ca620da16211cf886edf1edc1f1fTed Kremenek Out << "\\lPostStore\\l"; 17747090d5465de7ca620da16211cf886edf1edc1f1fTed Kremenek else if (isa<PostLValue>(Loc)) 17757090d5465de7ca620da16211cf886edf1edc1f1fTed Kremenek Out << "\\lPostLValue\\l"; 17761eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 177710f51e8785e43d5a22acc2d2a638307c582949c2Ted Kremenek#if 0 177810f51e8785e43d5a22acc2d2a638307c582949c2Ted Kremenek // FIXME: Replace with a general scheme to determine 177910f51e8785e43d5a22acc2d2a638307c582949c2Ted Kremenek // the name of the check. 17808c354758c2d39db87c77c723d81e34b4d967f762Ted Kremenek if (GraphPrintCheckerState->isImplicitNullDeref(N)) 17818c354758c2d39db87c77c723d81e34b4d967f762Ted Kremenek Out << "\\|Implicit-Null Dereference.\\l"; 17828c354758c2d39db87c77c723d81e34b4d967f762Ted Kremenek else if (GraphPrintCheckerState->isExplicitNullDeref(N)) 17838c354758c2d39db87c77c723d81e34b4d967f762Ted Kremenek Out << "\\|Explicit-Null Dereference.\\l"; 17848c354758c2d39db87c77c723d81e34b4d967f762Ted Kremenek else if (GraphPrintCheckerState->isUndefDeref(N)) 17858c354758c2d39db87c77c723d81e34b4d967f762Ted Kremenek Out << "\\|Dereference of undefialied value.\\l"; 17868c354758c2d39db87c77c723d81e34b4d967f762Ted Kremenek else if (GraphPrintCheckerState->isUndefStore(N)) 17878c354758c2d39db87c77c723d81e34b4d967f762Ted Kremenek Out << "\\|Store to Undefined Loc."; 17888c354758c2d39db87c77c723d81e34b4d967f762Ted Kremenek else if (GraphPrintCheckerState->isUndefResult(N)) 17898c354758c2d39db87c77c723d81e34b4d967f762Ted Kremenek Out << "\\|Result of operation is undefined."; 17908c354758c2d39db87c77c723d81e34b4d967f762Ted Kremenek else if (GraphPrintCheckerState->isNoReturnCall(N)) 17918c354758c2d39db87c77c723d81e34b4d967f762Ted Kremenek Out << "\\|Call to function marked \"noreturn\"."; 17928c354758c2d39db87c77c723d81e34b4d967f762Ted Kremenek else if (GraphPrintCheckerState->isBadCall(N)) 17938c354758c2d39db87c77c723d81e34b4d967f762Ted Kremenek Out << "\\|Call to NULL/Undefined."; 17948c354758c2d39db87c77c723d81e34b4d967f762Ted Kremenek else if (GraphPrintCheckerState->isUndefArg(N)) 17958c354758c2d39db87c77c723d81e34b4d967f762Ted Kremenek Out << "\\|Argument in call is undefined"; 179610f51e8785e43d5a22acc2d2a638307c582949c2Ted Kremenek#endif 17971eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 17988c354758c2d39db87c77c723d81e34b4d967f762Ted Kremenek break; 17998c354758c2d39db87c77c723d81e34b4d967f762Ted Kremenek } 18008c354758c2d39db87c77c723d81e34b4d967f762Ted Kremenek 18019c378f705405d37f49795d5e915989de774fe11fTed Kremenek const BlockEdge &E = cast<BlockEdge>(Loc); 1802aa66a32ba177338763cd0cf9df8310dfa2e24ff7Ted Kremenek Out << "Edge: (B" << E.getSrc()->getBlockID() << ", B" 1803aa66a32ba177338763cd0cf9df8310dfa2e24ff7Ted Kremenek << E.getDst()->getBlockID() << ')'; 18041eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 18059c378f705405d37f49795d5e915989de774fe11fTed Kremenek if (const Stmt *T = E.getSrc()->getTerminator()) { 18061eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1807e97ca065c91ff9ca2a2a42eb443eaa553c40441cTed Kremenek SourceLocation SLoc = T->getLocStart(); 18081eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1809b38911f16b4943548db6a3695fc6ae23070b25d2Ted Kremenek Out << "\\|Terminator: "; 1810e4f2142d00fa5fdb580c4e2413da91882d955381Chris Lattner LangOptions LO; // FIXME. 1811e4f2142d00fa5fdb580c4e2413da91882d955381Chris Lattner E.getSrc()->printTerminator(Out, LO); 18121eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 18139b5551d7f0209cec8b9c555cf70e893940674e5cTed Kremenek if (SLoc.isFileID()) { 18149b5551d7f0209cec8b9c555cf70e893940674e5cTed Kremenek Out << "\\lline=" 1815642116259e8df6286063a17361c20e95b5017a0aChandler Carruth << GraphPrintSourceManager->getExpansionLineNumber(SLoc) 18167da5aea7669e6db3e593162b8a123aef06a04d07Chris Lattner << " col=" 1817a77c031cb66f75d22672070052cc6e0205289ff8Chandler Carruth << GraphPrintSourceManager->getExpansionColumnNumber(SLoc); 18189b5551d7f0209cec8b9c555cf70e893940674e5cTed Kremenek } 18191eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1820daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek if (isa<SwitchStmt>(T)) { 18219c378f705405d37f49795d5e915989de774fe11fTed Kremenek const Stmt *Label = E.getDst()->getLabel(); 18221eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 18231eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump if (Label) { 18249c378f705405d37f49795d5e915989de774fe11fTed Kremenek if (const CaseStmt *C = dyn_cast<CaseStmt>(Label)) { 1825daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek Out << "\\lcase "; 1826e4f2142d00fa5fdb580c4e2413da91882d955381Chris Lattner LangOptions LO; // FIXME. 1827e4f2142d00fa5fdb580c4e2413da91882d955381Chris Lattner C->getLHS()->printPretty(Out, 0, PrintingPolicy(LO)); 18281eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 18299c378f705405d37f49795d5e915989de774fe11fTed Kremenek if (const Stmt *RHS = C->getRHS()) { 1830daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek Out << " .. "; 1831e4f2142d00fa5fdb580c4e2413da91882d955381Chris Lattner RHS->printPretty(Out, 0, PrintingPolicy(LO)); 1832daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek } 18331eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1834daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek Out << ":"; 1835daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek } 1836daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek else { 1837daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek assert (isa<DefaultStmt>(Label)); 1838daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek Out << "\\ldefault:"; 1839daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek } 1840daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek } 18411eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump else 1842daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek Out << "\\l(implicit) default:"; 1843daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek } 1844daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek else if (isa<IndirectGotoStmt>(T)) { 1845b38911f16b4943548db6a3695fc6ae23070b25d2Ted Kremenek // FIXME 1846b38911f16b4943548db6a3695fc6ae23070b25d2Ted Kremenek } 1847b38911f16b4943548db6a3695fc6ae23070b25d2Ted Kremenek else { 1848b38911f16b4943548db6a3695fc6ae23070b25d2Ted Kremenek Out << "\\lCondition: "; 1849b38911f16b4943548db6a3695fc6ae23070b25d2Ted Kremenek if (*E.getSrc()->succ_begin() == E.getDst()) 1850b38911f16b4943548db6a3695fc6ae23070b25d2Ted Kremenek Out << "true"; 1851b38911f16b4943548db6a3695fc6ae23070b25d2Ted Kremenek else 18521eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump Out << "false"; 1853b38911f16b4943548db6a3695fc6ae23070b25d2Ted Kremenek } 18541eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1855b38911f16b4943548db6a3695fc6ae23070b25d2Ted Kremenek Out << "\\l"; 1856b38911f16b4943548db6a3695fc6ae23070b25d2Ted Kremenek } 18571eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 185810f51e8785e43d5a22acc2d2a638307c582949c2Ted Kremenek#if 0 185910f51e8785e43d5a22acc2d2a638307c582949c2Ted Kremenek // FIXME: Replace with a general scheme to determine 186010f51e8785e43d5a22acc2d2a638307c582949c2Ted Kremenek // the name of the check. 18614a4e524afef40d6f3ddb25d0e407c814e4ca56a8Ted Kremenek if (GraphPrintCheckerState->isUndefControlFlow(N)) { 18624a4e524afef40d6f3ddb25d0e407c814e4ca56a8Ted Kremenek Out << "\\|Control-flow based on\\lUndefined value.\\l"; 18633b4f6702860208692f6ef28401e68de4e3ff9af9Ted Kremenek } 186410f51e8785e43d5a22acc2d2a638307c582949c2Ted Kremenek#endif 1865aa66a32ba177338763cd0cf9df8310dfa2e24ff7Ted Kremenek } 1866aa66a32ba177338763cd0cf9df8310dfa2e24ff7Ted Kremenek } 18671eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 186818c66fdc3c4008d335885695fe36fb5353c5f672Ted Kremenek const ProgramState *state = N->getState(); 18698673a68a8ab55a2bd03f92d636a50e6b0bfad2daTed Kremenek Out << "\\|StateID: " << (void*) state 18708673a68a8ab55a2bd03f92d636a50e6b0bfad2daTed Kremenek << " NodeID: " << (void*) N << "\\|"; 1871c179a7fbb294fe3ff6cf5479f6239a10f39628c7Zhongxing Xu state->printDOT(Out, *N->getLocationContext()->getCFG()); 1872ca804539d908d3a0e8c72a0df5f1f571d29490bbTed Kremenek 1873ca804539d908d3a0e8c72a0df5f1f571d29490bbTed Kremenek Out << "\\l"; 1874ca804539d908d3a0e8c72a0df5f1f571d29490bbTed Kremenek 1875ca804539d908d3a0e8c72a0df5f1f571d29490bbTed Kremenek if (const ProgramPointTag *tag = Loc.getTag()) { 1876ca804539d908d3a0e8c72a0df5f1f571d29490bbTed Kremenek Out << "\\|Tag: " << tag->getTagDescription(); 1877ca804539d908d3a0e8c72a0df5f1f571d29490bbTed Kremenek Out << "\\l"; 1878ca804539d908d3a0e8c72a0df5f1f571d29490bbTed Kremenek } 1879aa66a32ba177338763cd0cf9df8310dfa2e24ff7Ted Kremenek return Out.str(); 1880aa66a32ba177338763cd0cf9df8310dfa2e24ff7Ted Kremenek } 1881aa66a32ba177338763cd0cf9df8310dfa2e24ff7Ted Kremenek}; 18821eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump} // end llvm namespace 1883aa66a32ba177338763cd0cf9df8310dfa2e24ff7Ted Kremenek#endif 1884aa66a32ba177338763cd0cf9df8310dfa2e24ff7Ted Kremenek 1885ffe0f43806d4823271c2406c1fccc2373115c36aTed Kremenek#ifndef NDEBUG 18867ec07fd91f6eae8bd619ebb8512805222ca41c92Ted Kremenektemplate <typename ITERATOR> 18879c378f705405d37f49795d5e915989de774fe11fTed KremenekExplodedNode *GetGraphNode(ITERATOR I) { return *I; } 18887ec07fd91f6eae8bd619ebb8512805222ca41c92Ted Kremenek 1889031ccc0555a82afc2e8afe29e19dd57ff204e2deZhongxing Xutemplate <> ExplodedNode* 1890031ccc0555a82afc2e8afe29e19dd57ff204e2deZhongxing XuGetGraphNode<llvm::DenseMap<ExplodedNode*, Expr*>::iterator> 1891031ccc0555a82afc2e8afe29e19dd57ff204e2deZhongxing Xu (llvm::DenseMap<ExplodedNode*, Expr*>::iterator I) { 18927ec07fd91f6eae8bd619ebb8512805222ca41c92Ted Kremenek return I->first; 18937ec07fd91f6eae8bd619ebb8512805222ca41c92Ted Kremenek} 1894ffe0f43806d4823271c2406c1fccc2373115c36aTed Kremenek#endif 1895ffe0f43806d4823271c2406c1fccc2373115c36aTed Kremenek 1896d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidisvoid ExprEngine::ViewGraph(bool trim) { 18971eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump#ifndef NDEBUG 1898ffe0f43806d4823271c2406c1fccc2373115c36aTed Kremenek if (trim) { 1899031ccc0555a82afc2e8afe29e19dd57ff204e2deZhongxing Xu std::vector<ExplodedNode*> Src; 1900940abcc574580e454689be801f38a3d4d41ab01fTed Kremenek 1901940abcc574580e454689be801f38a3d4d41ab01fTed Kremenek // Flush any outstanding reports to make sure we cover all the nodes. 1902940abcc574580e454689be801f38a3d4d41ab01fTed Kremenek // This does not cause them to get displayed. 1903940abcc574580e454689be801f38a3d4d41ab01fTed Kremenek for (BugReporter::iterator I=BR.begin(), E=BR.end(); I!=E; ++I) 1904940abcc574580e454689be801f38a3d4d41ab01fTed Kremenek const_cast<BugType*>(*I)->FlushReports(BR); 1905940abcc574580e454689be801f38a3d4d41ab01fTed Kremenek 1906940abcc574580e454689be801f38a3d4d41ab01fTed Kremenek // Iterate through the reports and get their nodes. 1907404fc3ad6bd844bf8ce70cbf9974ab297704a122Argyrios Kyrtzidis for (BugReporter::EQClasses_iterator 1908404fc3ad6bd844bf8ce70cbf9974ab297704a122Argyrios Kyrtzidis EI = BR.EQClasses_begin(), EE = BR.EQClasses_end(); EI != EE; ++EI) { 1909404fc3ad6bd844bf8ce70cbf9974ab297704a122Argyrios Kyrtzidis BugReportEquivClass& EQ = *EI; 1910404fc3ad6bd844bf8ce70cbf9974ab297704a122Argyrios Kyrtzidis const BugReport &R = **EQ.begin(); 1911404fc3ad6bd844bf8ce70cbf9974ab297704a122Argyrios Kyrtzidis ExplodedNode *N = const_cast<ExplodedNode*>(R.getErrorNode()); 1912404fc3ad6bd844bf8ce70cbf9974ab297704a122Argyrios Kyrtzidis if (N) Src.push_back(N); 1913940abcc574580e454689be801f38a3d4d41ab01fTed Kremenek } 19141eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 19157ec07fd91f6eae8bd619ebb8512805222ca41c92Ted Kremenek ViewGraph(&Src[0], &Src[0]+Src.size()); 1916ffe0f43806d4823271c2406c1fccc2373115c36aTed Kremenek } 1917493d7a26d5ea319770ba904b43f2740d43b820cbTed Kremenek else { 1918493d7a26d5ea319770ba904b43f2740d43b820cbTed Kremenek GraphPrintCheckerState = this; 1919493d7a26d5ea319770ba904b43f2740d43b820cbTed Kremenek GraphPrintSourceManager = &getContext().getSourceManager(); 1920ae6814efb6c41bd0c0f6413d25097105284d5be7Ted Kremenek 1921d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidis llvm::ViewGraph(*G.roots_begin(), "ExprEngine"); 19221eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1923493d7a26d5ea319770ba904b43f2740d43b820cbTed Kremenek GraphPrintCheckerState = NULL; 1924493d7a26d5ea319770ba904b43f2740d43b820cbTed Kremenek GraphPrintSourceManager = NULL; 1925493d7a26d5ea319770ba904b43f2740d43b820cbTed Kremenek } 1926493d7a26d5ea319770ba904b43f2740d43b820cbTed Kremenek#endif 1927493d7a26d5ea319770ba904b43f2740d43b820cbTed Kremenek} 1928493d7a26d5ea319770ba904b43f2740d43b820cbTed Kremenek 1929d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidisvoid ExprEngine::ViewGraph(ExplodedNode** Beg, ExplodedNode** End) { 1930493d7a26d5ea319770ba904b43f2740d43b820cbTed Kremenek#ifndef NDEBUG 1931493d7a26d5ea319770ba904b43f2740d43b820cbTed Kremenek GraphPrintCheckerState = this; 1932493d7a26d5ea319770ba904b43f2740d43b820cbTed Kremenek GraphPrintSourceManager = &getContext().getSourceManager(); 19331eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1934031ccc0555a82afc2e8afe29e19dd57ff204e2deZhongxing Xu std::auto_ptr<ExplodedGraph> TrimmedG(G.Trim(Beg, End).first); 1935493d7a26d5ea319770ba904b43f2740d43b820cbTed Kremenek 1936cf118d41f7930a18dce97416ef7834a62642f587Ted Kremenek if (!TrimmedG.get()) 19376cb7c1a43b0c8f739d1f54b7fdae5ede86033496Benjamin Kramer llvm::errs() << "warning: Trimmed ExplodedGraph is empty.\n"; 1938cf118d41f7930a18dce97416ef7834a62642f587Ted Kremenek else 1939d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidis llvm::ViewGraph(*TrimmedG->roots_begin(), "TrimmedExprEngine"); 19401eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 19413b4f6702860208692f6ef28401e68de4e3ff9af9Ted Kremenek GraphPrintCheckerState = NULL; 1942e97ca065c91ff9ca2a2a42eb443eaa553c40441cTed Kremenek GraphPrintSourceManager = NULL; 1943e01c98767dfd7153c3c84637c36659e3bbe16ff7Ted Kremenek#endif 1944ee98546b0d5f3439c4a590b0d7d1545af794a0ecTed Kremenek} 1945