ExprEngine.cpp revision ff80afcfb2b00ccffcb6cb10528bec565fc59edd
1d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidis//=-- ExprEngine.cpp - Path-Sensitive Expression-Level Dataflow ---*- C++ -*-= 264924859b6b09d1cfb62fecf5954ec6c27cb58feTed Kremenek// 34af84313df0d2710fd57af89132e680294225cadTed Kremenek// The LLVM Compiler Infrastructure 4d27f8169f4b68337a489547a41ac45bf7a5d1ddfTed Kremenek// 5d27f8169f4b68337a489547a41ac45bf7a5d1ddfTed Kremenek// This file is distributed under the University of Illinois Open Source 6d27f8169f4b68337a489547a41ac45bf7a5d1ddfTed Kremenek// License. See LICENSE.TXT for details. 7d27f8169f4b68337a489547a41ac45bf7a5d1ddfTed Kremenek// 8d27f8169f4b68337a489547a41ac45bf7a5d1ddfTed Kremenek//===----------------------------------------------------------------------===// 9d27f8169f4b68337a489547a41ac45bf7a5d1ddfTed Kremenek// 1077349cb20bfd7069d081f84c91975bfa8ef60a32Ted Kremenek// This file defines a meta-engine for path-sensitive dataflow analysis that 1177349cb20bfd7069d081f84c91975bfa8ef60a32Ted Kremenek// is built on GREngine, but provides the boilerplate to execute transfer 1277349cb20bfd7069d081f84c91975bfa8ef60a32Ted Kremenek// functions and build the ExplodedGraph at the expression level. 13d27f8169f4b68337a489547a41ac45bf7a5d1ddfTed Kremenek// 14d27f8169f4b68337a489547a41ac45bf7a5d1ddfTed Kremenek//===----------------------------------------------------------------------===// 15a7af5ea88a6c5bdf87497cca6c20831e8c546751Argyrios Kyrtzidis 1643dee220252ef0b42c5f8a3bb1eca97f84f2565fArgyrios Kyrtzidis#include "clang/StaticAnalyzer/Core/CheckerManager.h" 179b663716449b618ba0390b1dbebc54fa8e971124Ted Kremenek#include "clang/StaticAnalyzer/Core/BugReporter/BugType.h" 189b663716449b618ba0390b1dbebc54fa8e971124Ted Kremenek#include "clang/StaticAnalyzer/Core/PathSensitive/AnalysisManager.h" 199b663716449b618ba0390b1dbebc54fa8e971124Ted Kremenek#include "clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h" 20d1e5a89226da79f7e6f43d40facc46abda9e5245Jordy Rose#include "clang/StaticAnalyzer/Core/PathSensitive/ObjCMessage.h" 21199c3d6cd16aebbb9c7f0d42af9d922c9628bf70Ken Dyck#include "clang/AST/CharUnits.h" 2216f0049415ec596504891259e2a83e19871c0d52Chris Lattner#include "clang/AST/ParentMap.h" 2316f0049415ec596504891259e2a83e19871c0d52Chris Lattner#include "clang/AST/StmtObjC.h" 24c506357c3778092c2a3251243f12524e8eb89274Zhongxing Xu#include "clang/AST/DeclCXX.h" 251b63e4f732dbc73d90abf886b4d21f8e3a165f6dChris Lattner#include "clang/Basic/Builtins.h" 2616f0049415ec596504891259e2a83e19871c0d52Chris Lattner#include "clang/Basic/SourceManager.h" 270bed8a12f2878d3cd94fb8bdba55b593d92dd11aTed Kremenek#include "clang/Basic/PrettyStackTrace.h" 28a95d3750441ac8ad03e36af8e6e74039c9a3109dTed Kremenek#include "llvm/Support/raw_ostream.h" 296cb7c1a43b0c8f739d1f54b7fdae5ede86033496Benjamin Kramer#include "llvm/ADT/ImmutableList.h" 304323a57627e796dcfdfdb7d47672dc09ed308edaTed Kremenek 310f5f0595d6a038843a7051c5a65fca7bce2915a0Ted Kremenek#ifndef NDEBUG 320f5f0595d6a038843a7051c5a65fca7bce2915a0Ted Kremenek#include "llvm/Support/GraphWriter.h" 330f5f0595d6a038843a7051c5a65fca7bce2915a0Ted Kremenek#endif 340f5f0595d6a038843a7051c5a65fca7bce2915a0Ted Kremenek 35b387a3f23e423d62c053be86294b703da1d1a222Ted Kremenekusing namespace clang; 369ef6537a894c33003359b1f9b9676e9178e028b7Ted Kremenekusing namespace ento; 37b387a3f23e423d62c053be86294b703da1d1a222Ted Kremenekusing llvm::APSInt; 38ab2b8c54bca82866876f91e756788916d3fa20c3Ted Kremenek 39e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek//===----------------------------------------------------------------------===// 4032c4995826c76f282fc05fbbc3241d2dded4fb57Ted Kremenek// Utility functions. 4132c4995826c76f282fc05fbbc3241d2dded4fb57Ted Kremenek//===----------------------------------------------------------------------===// 4232c4995826c76f282fc05fbbc3241d2dded4fb57Ted Kremenek 439c378f705405d37f49795d5e915989de774fe11fTed Kremenekstatic inline Selector GetNullarySelector(const char* name, ASTContext &Ctx) { 4432c4995826c76f282fc05fbbc3241d2dded4fb57Ted Kremenek IdentifierInfo* II = &Ctx.Idents.get(name); 4532c4995826c76f282fc05fbbc3241d2dded4fb57Ted Kremenek return Ctx.Selectors.getSelector(0, &II); 4632c4995826c76f282fc05fbbc3241d2dded4fb57Ted Kremenek} 4732c4995826c76f282fc05fbbc3241d2dded4fb57Ted Kremenek 4832c4995826c76f282fc05fbbc3241d2dded4fb57Ted Kremenek//===----------------------------------------------------------------------===// 49bdb435ddaafd5069becd543d638112f68825b89dTed Kremenek// Engine construction and deletion. 50bdb435ddaafd5069becd543d638112f68825b89dTed Kremenek//===----------------------------------------------------------------------===// 51bdb435ddaafd5069becd543d638112f68825b89dTed Kremenek 5217a38e2636a8b1ce473fc6504c4b16cb09db29f4Jordy RoseExprEngine::ExprEngine(AnalysisManager &mgr, bool gcEnabled) 5325e695b2d574d919cc1bbddf3a2efe073d449b1cZhongxing Xu : AMgr(mgr), 541d26f48dc2eea1c07431ca1519d7034a21b9bcffTed Kremenek AnalysisDeclContexts(mgr.getAnalysisDeclContextManager()), 55d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidis Engine(*this), 56d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidis G(Engine.getGraph()), 57c77a55126fcad66fb086f8e100a494caa2496a2dZhongxing Xu StateMgr(getContext(), mgr.getStoreManagerCreator(), 5832a58084a4c53e6938dd81bfce224db25a5976d1Ted Kremenek mgr.getConstraintManagerCreator(), G.getAllocator(), 5932a58084a4c53e6938dd81bfce224db25a5976d1Ted Kremenek *this), 6050a6d0ce344c02782e0207574005c3b2aaa5077cTed Kremenek SymMgr(StateMgr.getSymbolManager()), 61c8413fd03f73084a5c93028f8b4db619fc388087Ted Kremenek svalBuilder(StateMgr.getSValBuilder()), 628ad8c546372fe602708cb7ceeaf0ebbb866735c6Anna Zaks EntryNode(NULL), 638ad8c546372fe602708cb7ceeaf0ebbb866735c6Anna Zaks currentStmt(NULL), currentStmtIdx(0), currentBuilderContext(0), 64a5a4166f8cb04490b7b27355874edfb98837cd45Zhongxing Xu NSExceptionII(NULL), NSExceptionInstanceRaiseSelectors(NULL), 65c77a55126fcad66fb086f8e100a494caa2496a2dZhongxing Xu RaiseSel(GetNullarySelector("raise", getContext())), 66e1b364324b94e54c610a1681ab96df755ba766fdJordy Rose ObjCGCEnabled(gcEnabled), BR(mgr, *this) { 67d767d81290288c030f3be0be1d3e62b9c8df51dcTed Kremenek 68d767d81290288c030f3be0be1d3e62b9c8df51dcTed Kremenek if (mgr.shouldEagerlyTrimExplodedGraph()) { 69d767d81290288c030f3be0be1d3e62b9c8df51dcTed Kremenek // Enable eager node reclaimation when constructing the ExplodedGraph. 70d767d81290288c030f3be0be1d3e62b9c8df51dcTed Kremenek G.enableNodeReclamation(); 71d767d81290288c030f3be0be1d3e62b9c8df51dcTed Kremenek } 72c80135ba857da48173578b9c528fce6777e18168Ted Kremenek} 7350a6d0ce344c02782e0207574005c3b2aaa5077cTed Kremenek 74d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios KyrtzidisExprEngine::~ExprEngine() { 75cf118d41f7930a18dce97416ef7834a62642f587Ted Kremenek BR.FlushReports(); 76e448ab4f9dd162802f5d7cfea60f7830cc61c654Ted Kremenek delete [] NSExceptionInstanceRaiseSelectors; 7750a6d0ce344c02782e0207574005c3b2aaa5077cTed Kremenek} 7850a6d0ce344c02782e0207574005c3b2aaa5077cTed Kremenek 79e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek//===----------------------------------------------------------------------===// 80e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek// Utility methods. 81e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek//===----------------------------------------------------------------------===// 82e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek 838bef8238181a30e52dea380789a7e2d760eac532Ted KremenekProgramStateRef ExprEngine::getInitialState(const LocationContext *InitLoc) { 848bef8238181a30e52dea380789a7e2d760eac532Ted Kremenek ProgramStateRef state = StateMgr.getInitialState(InitLoc); 85a078ecf3484d62b01d9f8c01e0fecffd65c583e1Ted Kremenek const Decl *D = InitLoc->getDecl(); 861eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 87cfcd7fd0de701c5ce05e96de1ed2d0bf8c7035d9Ted Kremenek // Preconditions. 8852e5602056e4cade24cbcca57767e94e1d430b03Ted Kremenek // FIXME: It would be nice if we had a more general mechanism to add 8952e5602056e4cade24cbcca57767e94e1d430b03Ted Kremenek // such preconditions. Some day. 905974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek do { 91a078ecf3484d62b01d9f8c01e0fecffd65c583e1Ted Kremenek 925974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek if (const FunctionDecl *FD = dyn_cast<FunctionDecl>(D)) { 935974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek // Precondition: the first argument of 'main' is an integer guaranteed 945974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek // to be > 0. 955974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek const IdentifierInfo *II = FD->getIdentifier(); 965974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek if (!II || !(II->getName() == "main" && FD->getNumParams() > 0)) 975974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek break; 985974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek 995974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek const ParmVarDecl *PD = FD->getParamDecl(0); 1005974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek QualType T = PD->getType(); 1015974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek if (!T->isIntegerType()) 1025974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek break; 103b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 1045974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek const MemRegion *R = state->getRegion(PD, InitLoc); 1055974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek if (!R) 1065974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek break; 107b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 1081397663af9dbcc24dbf0e11de43931b3dc08fdbbTed Kremenek SVal V = state->getSVal(loc::MemRegionVal(R)); 1099c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek SVal Constraint_untested = evalBinOp(state, BO_GT, V, 110c8413fd03f73084a5c93028f8b4db619fc388087Ted Kremenek svalBuilder.makeZeroVal(T), 1115974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek getContext().IntTy); 1125974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek 1135974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek DefinedOrUnknownSVal *Constraint = 1145974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek dyn_cast<DefinedOrUnknownSVal>(&Constraint_untested); 115b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 1165974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek if (!Constraint) 1175974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek break; 118b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 1198bef8238181a30e52dea380789a7e2d760eac532Ted Kremenek if (ProgramStateRef newState = state->assume(*Constraint, true)) 1205974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek state = newState; 12152e5602056e4cade24cbcca57767e94e1d430b03Ted Kremenek } 122a078ecf3484d62b01d9f8c01e0fecffd65c583e1Ted Kremenek break; 123a078ecf3484d62b01d9f8c01e0fecffd65c583e1Ted Kremenek } 124a078ecf3484d62b01d9f8c01e0fecffd65c583e1Ted Kremenek while (0); 125a078ecf3484d62b01d9f8c01e0fecffd65c583e1Ted Kremenek 126a078ecf3484d62b01d9f8c01e0fecffd65c583e1Ted Kremenek if (const ObjCMethodDecl *MD = dyn_cast<ObjCMethodDecl>(D)) { 127a078ecf3484d62b01d9f8c01e0fecffd65c583e1Ted Kremenek // Precondition: 'self' is always non-null upon entry to an Objective-C 128a078ecf3484d62b01d9f8c01e0fecffd65c583e1Ted Kremenek // method. 129a078ecf3484d62b01d9f8c01e0fecffd65c583e1Ted Kremenek const ImplicitParamDecl *SelfD = MD->getSelfDecl(); 130a078ecf3484d62b01d9f8c01e0fecffd65c583e1Ted Kremenek const MemRegion *R = state->getRegion(SelfD, InitLoc); 131a078ecf3484d62b01d9f8c01e0fecffd65c583e1Ted Kremenek SVal V = state->getSVal(loc::MemRegionVal(R)); 132a078ecf3484d62b01d9f8c01e0fecffd65c583e1Ted Kremenek 133a078ecf3484d62b01d9f8c01e0fecffd65c583e1Ted Kremenek if (const Loc *LV = dyn_cast<Loc>(&V)) { 134a078ecf3484d62b01d9f8c01e0fecffd65c583e1Ted Kremenek // Assume that the pointer value in 'self' is non-null. 135a078ecf3484d62b01d9f8c01e0fecffd65c583e1Ted Kremenek state = state->assume(*LV, true); 136a078ecf3484d62b01d9f8c01e0fecffd65c583e1Ted Kremenek assert(state && "'self' cannot be null"); 137a078ecf3484d62b01d9f8c01e0fecffd65c583e1Ted Kremenek } 138a078ecf3484d62b01d9f8c01e0fecffd65c583e1Ted Kremenek } 1395974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek 140a078ecf3484d62b01d9f8c01e0fecffd65c583e1Ted Kremenek if (const CXXMethodDecl *MD = dyn_cast<CXXMethodDecl>(D)) { 141a078ecf3484d62b01d9f8c01e0fecffd65c583e1Ted Kremenek if (!MD->isStatic()) { 142a078ecf3484d62b01d9f8c01e0fecffd65c583e1Ted Kremenek // Precondition: 'this' is always non-null upon entry to the 143a078ecf3484d62b01d9f8c01e0fecffd65c583e1Ted Kremenek // top-level function. This is our starting assumption for 144a078ecf3484d62b01d9f8c01e0fecffd65c583e1Ted Kremenek // analyzing an "open" program. 145a078ecf3484d62b01d9f8c01e0fecffd65c583e1Ted Kremenek const StackFrameContext *SFC = InitLoc->getCurrentStackFrame(); 146a078ecf3484d62b01d9f8c01e0fecffd65c583e1Ted Kremenek if (SFC->getParent() == 0) { 147a078ecf3484d62b01d9f8c01e0fecffd65c583e1Ted Kremenek loc::MemRegionVal L(getCXXThisRegion(MD, SFC)); 148a078ecf3484d62b01d9f8c01e0fecffd65c583e1Ted Kremenek SVal V = state->getSVal(L); 149a078ecf3484d62b01d9f8c01e0fecffd65c583e1Ted Kremenek if (const Loc *LV = dyn_cast<Loc>(&V)) { 150a078ecf3484d62b01d9f8c01e0fecffd65c583e1Ted Kremenek state = state->assume(*LV, true); 151a078ecf3484d62b01d9f8c01e0fecffd65c583e1Ted Kremenek assert(state && "'this' cannot be null"); 152a078ecf3484d62b01d9f8c01e0fecffd65c583e1Ted Kremenek } 1535974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek } 154cfcd7fd0de701c5ce05e96de1ed2d0bf8c7035d9Ted Kremenek } 155a078ecf3484d62b01d9f8c01e0fecffd65c583e1Ted Kremenek } 156a078ecf3484d62b01d9f8c01e0fecffd65c583e1Ted Kremenek 15752e5602056e4cade24cbcca57767e94e1d430b03Ted Kremenek return state; 158e070a1df66aab6d4168fb28f7559fdf996df3567Ted Kremenek} 159e070a1df66aab6d4168fb28f7559fdf996df3567Ted Kremenek 160e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek//===----------------------------------------------------------------------===// 161e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek// Top-level transfer function logic (Dispatcher). 162e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek//===----------------------------------------------------------------------===// 163e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek 1649c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek/// evalAssume - Called by ConstraintManager. Used to call checker-specific 16532a58084a4c53e6938dd81bfce224db25a5976d1Ted Kremenek/// logic for handling assumptions on symbolic values. 1668bef8238181a30e52dea380789a7e2d760eac532Ted KremenekProgramStateRef ExprEngine::processAssume(ProgramStateRef state, 167fe27971d54d26997149d6b84057f04ff398d1d5dJordy Rose SVal cond, bool assumption) { 168fe27971d54d26997149d6b84057f04ff398d1d5dJordy Rose return getCheckerManager().runCheckersForEvalAssume(state, cond, assumption); 16932a58084a4c53e6938dd81bfce224db25a5976d1Ted Kremenek} 17032a58084a4c53e6938dd81bfce224db25a5976d1Ted Kremenek 1718bef8238181a30e52dea380789a7e2d760eac532Ted Kremenekbool ExprEngine::wantsRegionChangeUpdate(ProgramStateRef state) { 172183ff98f425d470c2a0276880aaf43496c9dad14Argyrios Kyrtzidis return getCheckerManager().wantsRegionChangeUpdate(state); 173c2b7dfaad674587cfd220ff447b3710d252130c3Jordy Rose} 174c2b7dfaad674587cfd220ff447b3710d252130c3Jordy Rose 1758bef8238181a30e52dea380789a7e2d760eac532Ted KremenekProgramStateRef 1768bef8238181a30e52dea380789a7e2d760eac532Ted KremenekExprEngine::processRegionChanges(ProgramStateRef state, 17735bdbf40624beba3fc00cb72ab444659939c1a6bTed Kremenek const StoreManager::InvalidatedSymbols *invalidated, 178537716ad8dd10f984b6cfe6985afade1185c5e3cJordy Rose ArrayRef<const MemRegion *> Explicits, 17966c40400e7d6272b0cd675ada18dd62c1f0362c7Anna Zaks ArrayRef<const MemRegion *> Regions, 18066c40400e7d6272b0cd675ada18dd62c1f0362c7Anna Zaks const CallOrObjCMessage *Call) { 18135bdbf40624beba3fc00cb72ab444659939c1a6bTed Kremenek return getCheckerManager().runCheckersForRegionChanges(state, invalidated, 18266c40400e7d6272b0cd675ada18dd62c1f0362c7Anna Zaks Explicits, Regions, Call); 183c2b7dfaad674587cfd220ff447b3710d252130c3Jordy Rose} 184c2b7dfaad674587cfd220ff447b3710d252130c3Jordy Rose 1858bef8238181a30e52dea380789a7e2d760eac532Ted Kremenekvoid ExprEngine::printState(raw_ostream &Out, ProgramStateRef State, 186dbd658e139b3e0bf084f75feaea8d844af9e319fJordy Rose const char *NL, const char *Sep) { 187dbd658e139b3e0bf084f75feaea8d844af9e319fJordy Rose getCheckerManager().runCheckersForPrintState(Out, State, NL, Sep); 188dbd658e139b3e0bf084f75feaea8d844af9e319fJordy Rose} 189dbd658e139b3e0bf084f75feaea8d844af9e319fJordy Rose 190e36de1fe51c39d9161915dd3dbef880954af6476Ted Kremenekvoid ExprEngine::processEndWorklist(bool hasWorkRemaining) { 19130726c6baee1417307236e854f1474fdb3cedb98Argyrios Kyrtzidis getCheckerManager().runCheckersForEndAnalysis(G, BR, *this); 192ccc263b44c62ce3a02f797a3ddb3d6017cf0e5e4Ted Kremenek} 193ccc263b44c62ce3a02f797a3ddb3d6017cf0e5e4Ted Kremenek 194ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaksvoid ExprEngine::processCFGElement(const CFGElement E, ExplodedNode *Pred, 195ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks unsigned StmtIdx, NodeBuilderContext *Ctx) { 196ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks currentStmtIdx = StmtIdx; 197ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks currentBuilderContext = Ctx; 198ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks 1999c6cd67ea416bace666d614c84d5531124287653Zhongxing Xu switch (E.getKind()) { 2003c0349e87cdbd7316d06d2411d86ee1086e717a5Ted Kremenek case CFGElement::Invalid: 2013c0349e87cdbd7316d06d2411d86ee1086e717a5Ted Kremenek llvm_unreachable("Unexpected CFGElement kind."); 2023c0349e87cdbd7316d06d2411d86ee1086e717a5Ted Kremenek case CFGElement::Statement: 203ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks ProcessStmt(const_cast<Stmt*>(E.getAs<CFGStmt>()->getStmt()), Pred); 2043c0349e87cdbd7316d06d2411d86ee1086e717a5Ted Kremenek return; 2053c0349e87cdbd7316d06d2411d86ee1086e717a5Ted Kremenek case CFGElement::Initializer: 206ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks ProcessInitializer(E.getAs<CFGInitializer>()->getInitializer(), Pred); 2073c0349e87cdbd7316d06d2411d86ee1086e717a5Ted Kremenek return; 2083c0349e87cdbd7316d06d2411d86ee1086e717a5Ted Kremenek case CFGElement::AutomaticObjectDtor: 2093c0349e87cdbd7316d06d2411d86ee1086e717a5Ted Kremenek case CFGElement::BaseDtor: 2103c0349e87cdbd7316d06d2411d86ee1086e717a5Ted Kremenek case CFGElement::MemberDtor: 2113c0349e87cdbd7316d06d2411d86ee1086e717a5Ted Kremenek case CFGElement::TemporaryDtor: 212ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks ProcessImplicitDtor(*E.getAs<CFGImplicitDtor>(), Pred); 2133c0349e87cdbd7316d06d2411d86ee1086e717a5Ted Kremenek return; 2149c6cd67ea416bace666d614c84d5531124287653Zhongxing Xu } 2159c6cd67ea416bace666d614c84d5531124287653Zhongxing Xu} 2169c6cd67ea416bace666d614c84d5531124287653Zhongxing Xu 217ce117a7d289f57f792e5cc3294280cfe070433deTed Kremenekstatic bool shouldRemoveDeadBindings(AnalysisManager &AMgr, 218ce117a7d289f57f792e5cc3294280cfe070433deTed Kremenek const CFGStmt S, 219ce117a7d289f57f792e5cc3294280cfe070433deTed Kremenek const ExplodedNode *Pred, 220ce117a7d289f57f792e5cc3294280cfe070433deTed Kremenek const LocationContext *LC) { 221ce117a7d289f57f792e5cc3294280cfe070433deTed Kremenek 222ce117a7d289f57f792e5cc3294280cfe070433deTed Kremenek // Are we never purging state values? 223ce117a7d289f57f792e5cc3294280cfe070433deTed Kremenek if (AMgr.getPurgeMode() == PurgeNone) 224ce117a7d289f57f792e5cc3294280cfe070433deTed Kremenek return false; 225ce117a7d289f57f792e5cc3294280cfe070433deTed Kremenek 226ce117a7d289f57f792e5cc3294280cfe070433deTed Kremenek // Is this the beginning of a basic block? 2279e9a3e612d57b583800d5f0e48bb28d4afbd8b84Ted Kremenek if (isa<BlockEntrance>(Pred->getLocation())) 228ce117a7d289f57f792e5cc3294280cfe070433deTed Kremenek return true; 229ce117a7d289f57f792e5cc3294280cfe070433deTed Kremenek 230ce117a7d289f57f792e5cc3294280cfe070433deTed Kremenek // Is this on a non-expression? 231ce117a7d289f57f792e5cc3294280cfe070433deTed Kremenek if (!isa<Expr>(S.getStmt())) 232ce117a7d289f57f792e5cc3294280cfe070433deTed Kremenek return true; 233ff80afcfb2b00ccffcb6cb10528bec565fc59eddAnna Zaks 234ff80afcfb2b00ccffcb6cb10528bec565fc59eddAnna Zaks // Run before processing a call. 235ff80afcfb2b00ccffcb6cb10528bec565fc59eddAnna Zaks if (isa<CallExpr>(S.getStmt())) 236ff80afcfb2b00ccffcb6cb10528bec565fc59eddAnna Zaks return true; 237ff80afcfb2b00ccffcb6cb10528bec565fc59eddAnna Zaks 238ce117a7d289f57f792e5cc3294280cfe070433deTed Kremenek // Is this an expression that is consumed by another expression? If so, 239ce117a7d289f57f792e5cc3294280cfe070433deTed Kremenek // postpone cleaning out the state. 240ce117a7d289f57f792e5cc3294280cfe070433deTed Kremenek ParentMap &PM = LC->getAnalysisDeclContext()->getParentMap(); 241ce117a7d289f57f792e5cc3294280cfe070433deTed Kremenek return !PM.isConsumedExpr(cast<Expr>(S.getStmt())); 242ce117a7d289f57f792e5cc3294280cfe070433deTed Kremenek} 243ce117a7d289f57f792e5cc3294280cfe070433deTed Kremenek 244ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaksvoid ExprEngine::ProcessStmt(const CFGStmt S, 2452ac58b7c09938bb28c51c7cd2deada609b75f94cTed Kremenek ExplodedNode *Pred) { 2462ac58b7c09938bb28c51c7cd2deada609b75f94cTed Kremenek // Reclaim any unnecessary nodes in the ExplodedGraph. 2472ac58b7c09938bb28c51c7cd2deada609b75f94cTed Kremenek G.reclaimRecentlyAllocatedNodes(); 2482ac58b7c09938bb28c51c7cd2deada609b75f94cTed Kremenek 2490a3ed3143b00f237decb1288c1ff574ae09eba4eTed Kremenek currentStmt = S.getStmt(); 2500bed8a12f2878d3cd94fb8bdba55b593d92dd11aTed Kremenek PrettyStackTraceLoc CrashInfo(getContext().getSourceManager(), 2510a3ed3143b00f237decb1288c1ff574ae09eba4eTed Kremenek currentStmt->getLocStart(), 2520bed8a12f2878d3cd94fb8bdba55b593d92dd11aTed Kremenek "Error evaluating statement"); 2531eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 2544e82d3cf6fd4c907265e3fa3aac0a835c35dc759Anna Zaks EntryNode = Pred; 2551eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 2568bef8238181a30e52dea380789a7e2d760eac532Ted Kremenek ProgramStateRef EntryState = EntryNode->getState(); 2576bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks CleanedState = EntryState; 2586bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks 2591eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump // Create the cleaned state. 260bd533aa4ff8895c676d4634d0d3de254962569d0Jordy Rose const LocationContext *LC = EntryNode->getLocationContext(); 261882998923889a2fcce9b49696506c499e22cf38fTed Kremenek SymbolReaper SymReaper(LC, currentStmt, SymMgr, getStoreManager()); 262c179a7fbb294fe3ff6cf5479f6239a10f39628c7Zhongxing Xu 263ce117a7d289f57f792e5cc3294280cfe070433deTed Kremenek if (shouldRemoveDeadBindings(AMgr, S, Pred, LC)) { 2646bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks getCheckerManager().runCheckersForLiveSymbols(CleanedState, SymReaper); 265183ff98f425d470c2a0276880aaf43496c9dad14Argyrios Kyrtzidis 266bd533aa4ff8895c676d4634d0d3de254962569d0Jordy Rose const StackFrameContext *SFC = LC->getCurrentStackFrame(); 2676bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks 2686bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks // Create a state in which dead bindings are removed from the environment 2696bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks // and the store. TODO: The function should just return new env and store, 2706bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks // not a new state. 2716bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks CleanedState = StateMgr.removeDeadBindings(CleanedState, SFC, SymReaper); 272bd533aa4ff8895c676d4634d0d3de254962569d0Jordy Rose } 273241677a13cc46647a8f5098b3e3239bd9480dca2Ted Kremenek 27477d7ef8d8a80ccb2ab3d25c80810571e3ab14ee4Ted Kremenek // Process any special transfer function for dead symbols. 275031ccc0555a82afc2e8afe29e19dd57ff204e2deZhongxing Xu ExplodedNodeSet Tmp; 276f185cc1ac77a84139c603eee3473b88dcb839c68Anna Zaks // A tag to track convenience transitions, which can be removed at cleanup. 277f185cc1ac77a84139c603eee3473b88dcb839c68Anna Zaks static SimpleProgramPointTag cleanupTag("ExprEngine : Clean Node"); 278f185cc1ac77a84139c603eee3473b88dcb839c68Anna Zaks 2796bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks if (!SymReaper.hasDeadSymbols()) { 2806bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks // Generate a CleanedNode that has the environment and store cleaned 2816bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks // up. Since no symbols are dead, we can optimize and not clean out 2826bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks // the constraint manager. 283aa0aeb1cbe117db68d35700cb3a34aace0f99b99Anna Zaks StmtNodeBuilder Bldr(Pred, Tmp, *currentBuilderContext); 284f185cc1ac77a84139c603eee3473b88dcb839c68Anna Zaks Bldr.generateNode(currentStmt, EntryNode, CleanedState, false, &cleanupTag); 2851eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 2866bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks } else { 2876bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks // Call checkers with the non-cleaned state so that they could query the 2886bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks // values of the soon to be dead symbols. 289fe27971d54d26997149d6b84057f04ff398d1d5dJordy Rose ExplodedNodeSet CheckedSet; 290fe27971d54d26997149d6b84057f04ff398d1d5dJordy Rose getCheckerManager().runCheckersForDeadSymbols(CheckedSet, EntryNode, 291183ff98f425d470c2a0276880aaf43496c9dad14Argyrios Kyrtzidis SymReaper, currentStmt, *this); 292183ff98f425d470c2a0276880aaf43496c9dad14Argyrios Kyrtzidis 293fe27971d54d26997149d6b84057f04ff398d1d5dJordy Rose // For each node in CheckedSet, generate CleanedNodes that have the 294fe27971d54d26997149d6b84057f04ff398d1d5dJordy Rose // environment, the store, and the constraints cleaned up but have the 295fe27971d54d26997149d6b84057f04ff398d1d5dJordy Rose // user-supplied states as the predecessors. 296aa0aeb1cbe117db68d35700cb3a34aace0f99b99Anna Zaks StmtNodeBuilder Bldr(CheckedSet, Tmp, *currentBuilderContext); 297fe27971d54d26997149d6b84057f04ff398d1d5dJordy Rose for (ExplodedNodeSet::const_iterator 298fe27971d54d26997149d6b84057f04ff398d1d5dJordy Rose I = CheckedSet.begin(), E = CheckedSet.end(); I != E; ++I) { 2998bef8238181a30e52dea380789a7e2d760eac532Ted Kremenek ProgramStateRef CheckerState = (*I)->getState(); 3006bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks 3016bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks // The constraint manager has not been cleaned up yet, so clean up now. 3026bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks CheckerState = getConstraintManager().removeDeadBindings(CheckerState, 3036bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks SymReaper); 3046bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks 3056bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks assert(StateMgr.haveEqualEnvironments(CheckerState, EntryState) && 3066bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks "Checkers are not allowed to modify the Environment as a part of " 3076bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks "checkDeadSymbols processing."); 3086bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks assert(StateMgr.haveEqualStores(CheckerState, EntryState) && 3096bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks "Checkers are not allowed to modify the Store as a part of " 3106bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks "checkDeadSymbols processing."); 3116bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks 3126bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks // Create a state based on CleanedState with CheckerState GDM and 3136bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks // generate a transition to that state. 3148bef8238181a30e52dea380789a7e2d760eac532Ted Kremenek ProgramStateRef CleanedCheckerSt = 3156bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks StateMgr.getPersistentStateWithGDM(CleanedState, CheckerState); 316f185cc1ac77a84139c603eee3473b88dcb839c68Anna Zaks Bldr.generateNode(currentStmt, *I, CleanedCheckerSt, false, &cleanupTag, 317f185cc1ac77a84139c603eee3473b88dcb839c68Anna Zaks ProgramPoint::PostPurgeDeadSymbolsKind); 3186bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks } 31977d7ef8d8a80ccb2ab3d25c80810571e3ab14ee4Ted Kremenek } 3201eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 321dd7ddf2b2296f95e7591ca3f9791f0eb9a15ee42Anna Zaks ExplodedNodeSet Dst; 322031ccc0555a82afc2e8afe29e19dd57ff204e2deZhongxing Xu for (ExplodedNodeSet::iterator I=Tmp.begin(), E=Tmp.end(); I!=E; ++I) { 323dd7ddf2b2296f95e7591ca3f9791f0eb9a15ee42Anna Zaks ExplodedNodeSet DstI; 3241eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump // Visit the statement. 325dd7ddf2b2296f95e7591ca3f9791f0eb9a15ee42Anna Zaks Visit(currentStmt, *I, DstI); 326dd7ddf2b2296f95e7591ca3f9791f0eb9a15ee42Anna Zaks Dst.insert(DstI); 327ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks } 328ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks 329dd7ddf2b2296f95e7591ca3f9791f0eb9a15ee42Anna Zaks // Enqueue the new nodes onto the work list. 330dd7ddf2b2296f95e7591ca3f9791f0eb9a15ee42Anna Zaks Engine.enqueue(Dst, currentBuilderContext->getBlock(), currentStmtIdx); 3311eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 332e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek // NULL out these variables to cleanup. 333846d4e923bf11bcdc2816758aafa331795f29230Ted Kremenek CleanedState = NULL; 334846d4e923bf11bcdc2816758aafa331795f29230Ted Kremenek EntryNode = NULL; 3350a3ed3143b00f237decb1288c1ff574ae09eba4eTed Kremenek currentStmt = 0; 336e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek} 337e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek 338d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidisvoid ExprEngine::ProcessInitializer(const CFGInitializer Init, 339056c4b46335a3bd2612414735d5749ee159c0165Anna Zaks ExplodedNode *Pred) { 340ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks ExplodedNodeSet Dst; 341ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks 3420a3ed3143b00f237decb1288c1ff574ae09eba4eTed Kremenek // We don't set EntryNode and currentStmt. And we don't clean up state. 343cbb67480094b3bcb5b715acd827cbad55e2a204cSean Hunt const CXXCtorInitializer *BMI = Init.getInitializer(); 344056c4b46335a3bd2612414735d5749ee159c0165Anna Zaks const StackFrameContext *stackFrame = 345056c4b46335a3bd2612414735d5749ee159c0165Anna Zaks cast<StackFrameContext>(Pred->getLocationContext()); 346056c4b46335a3bd2612414735d5749ee159c0165Anna Zaks const CXXConstructorDecl *decl = 347056c4b46335a3bd2612414735d5749ee159c0165Anna Zaks cast<CXXConstructorDecl>(stackFrame->getDecl()); 348d074441e027471a914cbb909a7aad1d43224950fZhongxing Xu const CXXThisRegion *thisReg = getCXXThisRegion(decl, stackFrame); 349d074441e027471a914cbb909a7aad1d43224950fZhongxing Xu 350056c4b46335a3bd2612414735d5749ee159c0165Anna Zaks SVal thisVal = Pred->getState()->getSVal(thisReg); 3519dc84c9455df2a77195147d0210c915dc1775a88Zhongxing Xu 35200eb3f9c5b33e3d99aee1f8b75dd9c9678fdd66bFrancois Pichet if (BMI->isAnyMemberInitializer()) { 353056c4b46335a3bd2612414735d5749ee159c0165Anna Zaks ExplodedNodeSet AfterEval; 3549dc84c9455df2a77195147d0210c915dc1775a88Zhongxing Xu 3559dc84c9455df2a77195147d0210c915dc1775a88Zhongxing Xu // Evaluate the initializer. 356056c4b46335a3bd2612414735d5749ee159c0165Anna Zaks Visit(BMI->getInit(), Pred, AfterEval); 3579dc84c9455df2a77195147d0210c915dc1775a88Zhongxing Xu 358aa0aeb1cbe117db68d35700cb3a34aace0f99b99Anna Zaks StmtNodeBuilder Bldr(AfterEval, Dst, *currentBuilderContext); 359056c4b46335a3bd2612414735d5749ee159c0165Anna Zaks for (ExplodedNodeSet::iterator I = AfterEval.begin(), 360056c4b46335a3bd2612414735d5749ee159c0165Anna Zaks E = AfterEval.end(); I != E; ++I){ 361056c4b46335a3bd2612414735d5749ee159c0165Anna Zaks ExplodedNode *P = *I; 3628bef8238181a30e52dea380789a7e2d760eac532Ted Kremenek ProgramStateRef state = P->getState(); 3639dc84c9455df2a77195147d0210c915dc1775a88Zhongxing Xu 36400eb3f9c5b33e3d99aee1f8b75dd9c9678fdd66bFrancois Pichet const FieldDecl *FD = BMI->getAnyMember(); 3659dc84c9455df2a77195147d0210c915dc1775a88Zhongxing Xu 366d074441e027471a914cbb909a7aad1d43224950fZhongxing Xu SVal FieldLoc = state->getLValue(FD, thisVal); 3675eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek SVal InitVal = state->getSVal(BMI->getInit(), Pred->getLocationContext()); 3689dc84c9455df2a77195147d0210c915dc1775a88Zhongxing Xu state = state->bindLoc(FieldLoc, InitVal); 3699dc84c9455df2a77195147d0210c915dc1775a88Zhongxing Xu 3709dc84c9455df2a77195147d0210c915dc1775a88Zhongxing Xu // Use a custom node building process. 371d074441e027471a914cbb909a7aad1d43224950fZhongxing Xu PostInitializer PP(BMI, stackFrame); 3729dc84c9455df2a77195147d0210c915dc1775a88Zhongxing Xu // Builder automatically add the generated node to the deferred set, 3739dc84c9455df2a77195147d0210c915dc1775a88Zhongxing Xu // which are processed in the builder's dtor. 374056c4b46335a3bd2612414735d5749ee159c0165Anna Zaks Bldr.generateNode(PP, P, state); 3759dc84c9455df2a77195147d0210c915dc1775a88Zhongxing Xu } 376056c4b46335a3bd2612414735d5749ee159c0165Anna Zaks } else { 377056c4b46335a3bd2612414735d5749ee159c0165Anna Zaks assert(BMI->isBaseInitializer()); 378056c4b46335a3bd2612414735d5749ee159c0165Anna Zaks 379056c4b46335a3bd2612414735d5749ee159c0165Anna Zaks // Get the base class declaration. 380056c4b46335a3bd2612414735d5749ee159c0165Anna Zaks const CXXConstructExpr *ctorExpr = cast<CXXConstructExpr>(BMI->getInit()); 381056c4b46335a3bd2612414735d5749ee159c0165Anna Zaks 382056c4b46335a3bd2612414735d5749ee159c0165Anna Zaks // Create the base object region. 383056c4b46335a3bd2612414735d5749ee159c0165Anna Zaks SVal baseVal = 384056c4b46335a3bd2612414735d5749ee159c0165Anna Zaks getStoreManager().evalDerivedToBase(thisVal, ctorExpr->getType()); 385056c4b46335a3bd2612414735d5749ee159c0165Anna Zaks const MemRegion *baseReg = baseVal.getAsRegion(); 386056c4b46335a3bd2612414735d5749ee159c0165Anna Zaks assert(baseReg); 387d074441e027471a914cbb909a7aad1d43224950fZhongxing Xu 388056c4b46335a3bd2612414735d5749ee159c0165Anna Zaks VisitCXXConstructExpr(ctorExpr, baseReg, Pred, Dst); 389056c4b46335a3bd2612414735d5749ee159c0165Anna Zaks } 390dd7ddf2b2296f95e7591ca3f9791f0eb9a15ee42Anna Zaks 391dd7ddf2b2296f95e7591ca3f9791f0eb9a15ee42Anna Zaks // Enqueue the new nodes onto the work list. 392dd7ddf2b2296f95e7591ca3f9791f0eb9a15ee42Anna Zaks Engine.enqueue(Dst, currentBuilderContext->getBlock(), currentStmtIdx); 3939c6cd67ea416bace666d614c84d5531124287653Zhongxing Xu} 3949c6cd67ea416bace666d614c84d5531124287653Zhongxing Xu 395d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidisvoid ExprEngine::ProcessImplicitDtor(const CFGImplicitDtor D, 396ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks ExplodedNode *Pred) { 397ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks ExplodedNodeSet Dst; 3983c0349e87cdbd7316d06d2411d86ee1086e717a5Ted Kremenek switch (D.getKind()) { 3994ffcb9974c6b7142c4a1483abfcb1f88b6371c45Zhongxing Xu case CFGElement::AutomaticObjectDtor: 400056c4b46335a3bd2612414735d5749ee159c0165Anna Zaks ProcessAutomaticObjDtor(cast<CFGAutomaticObjDtor>(D), Pred, Dst); 4014ffcb9974c6b7142c4a1483abfcb1f88b6371c45Zhongxing Xu break; 4024ffcb9974c6b7142c4a1483abfcb1f88b6371c45Zhongxing Xu case CFGElement::BaseDtor: 403056c4b46335a3bd2612414735d5749ee159c0165Anna Zaks ProcessBaseDtor(cast<CFGBaseDtor>(D), Pred, Dst); 4044ffcb9974c6b7142c4a1483abfcb1f88b6371c45Zhongxing Xu break; 4054ffcb9974c6b7142c4a1483abfcb1f88b6371c45Zhongxing Xu case CFGElement::MemberDtor: 406056c4b46335a3bd2612414735d5749ee159c0165Anna Zaks ProcessMemberDtor(cast<CFGMemberDtor>(D), Pred, Dst); 4074ffcb9974c6b7142c4a1483abfcb1f88b6371c45Zhongxing Xu break; 4084ffcb9974c6b7142c4a1483abfcb1f88b6371c45Zhongxing Xu case CFGElement::TemporaryDtor: 409056c4b46335a3bd2612414735d5749ee159c0165Anna Zaks ProcessTemporaryDtor(cast<CFGTemporaryDtor>(D), Pred, Dst); 4104ffcb9974c6b7142c4a1483abfcb1f88b6371c45Zhongxing Xu break; 4114ffcb9974c6b7142c4a1483abfcb1f88b6371c45Zhongxing Xu default: 4124ffcb9974c6b7142c4a1483abfcb1f88b6371c45Zhongxing Xu llvm_unreachable("Unexpected dtor kind."); 4134ffcb9974c6b7142c4a1483abfcb1f88b6371c45Zhongxing Xu } 414ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks 415dd7ddf2b2296f95e7591ca3f9791f0eb9a15ee42Anna Zaks // Enqueue the new nodes onto the work list. 416dd7ddf2b2296f95e7591ca3f9791f0eb9a15ee42Anna Zaks Engine.enqueue(Dst, currentBuilderContext->getBlock(), currentStmtIdx); 4174ffcb9974c6b7142c4a1483abfcb1f88b6371c45Zhongxing Xu} 4184ffcb9974c6b7142c4a1483abfcb1f88b6371c45Zhongxing Xu 419056c4b46335a3bd2612414735d5749ee159c0165Anna Zaksvoid ExprEngine::ProcessAutomaticObjDtor(const CFGAutomaticObjDtor Dtor, 420056c4b46335a3bd2612414735d5749ee159c0165Anna Zaks ExplodedNode *Pred, 421056c4b46335a3bd2612414735d5749ee159c0165Anna Zaks ExplodedNodeSet &Dst) { 4228bef8238181a30e52dea380789a7e2d760eac532Ted Kremenek ProgramStateRef state = Pred->getState(); 423056c4b46335a3bd2612414735d5749ee159c0165Anna Zaks const VarDecl *varDecl = Dtor.getVarDecl(); 4242210490e6d099b7a5b4f68f44a136e4dcf3cdea2Zhongxing Xu 4252210490e6d099b7a5b4f68f44a136e4dcf3cdea2Zhongxing Xu QualType varType = varDecl->getType(); 4262210490e6d099b7a5b4f68f44a136e4dcf3cdea2Zhongxing Xu 4272210490e6d099b7a5b4f68f44a136e4dcf3cdea2Zhongxing Xu if (const ReferenceType *refType = varType->getAs<ReferenceType>()) 4282210490e6d099b7a5b4f68f44a136e4dcf3cdea2Zhongxing Xu varType = refType->getPointeeType(); 4292210490e6d099b7a5b4f68f44a136e4dcf3cdea2Zhongxing Xu 4302210490e6d099b7a5b4f68f44a136e4dcf3cdea2Zhongxing Xu const CXXRecordDecl *recordDecl = varType->getAsCXXRecordDecl(); 4312210490e6d099b7a5b4f68f44a136e4dcf3cdea2Zhongxing Xu assert(recordDecl && "get CXXRecordDecl fail"); 4322210490e6d099b7a5b4f68f44a136e4dcf3cdea2Zhongxing Xu const CXXDestructorDecl *dtorDecl = recordDecl->getDestructor(); 433b13453bd8a91f331d0910ca95ad52aa41b52f648Zhongxing Xu 434056c4b46335a3bd2612414735d5749ee159c0165Anna Zaks Loc dest = state->getLValue(varDecl, Pred->getLocationContext()); 435b13453bd8a91f331d0910ca95ad52aa41b52f648Zhongxing Xu 4362210490e6d099b7a5b4f68f44a136e4dcf3cdea2Zhongxing Xu VisitCXXDestructor(dtorDecl, cast<loc::MemRegionVal>(dest).getRegion(), 437056c4b46335a3bd2612414735d5749ee159c0165Anna Zaks Dtor.getTriggerStmt(), Pred, Dst); 4384ffcb9974c6b7142c4a1483abfcb1f88b6371c45Zhongxing Xu} 4394ffcb9974c6b7142c4a1483abfcb1f88b6371c45Zhongxing Xu 440d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidisvoid ExprEngine::ProcessBaseDtor(const CFGBaseDtor D, 441056c4b46335a3bd2612414735d5749ee159c0165Anna Zaks ExplodedNode *Pred, ExplodedNodeSet &Dst) {} 4424ffcb9974c6b7142c4a1483abfcb1f88b6371c45Zhongxing Xu 443d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidisvoid ExprEngine::ProcessMemberDtor(const CFGMemberDtor D, 444056c4b46335a3bd2612414735d5749ee159c0165Anna Zaks ExplodedNode *Pred, ExplodedNodeSet &Dst) {} 4454ffcb9974c6b7142c4a1483abfcb1f88b6371c45Zhongxing Xu 446d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidisvoid ExprEngine::ProcessTemporaryDtor(const CFGTemporaryDtor D, 447056c4b46335a3bd2612414735d5749ee159c0165Anna Zaks ExplodedNode *Pred, 448056c4b46335a3bd2612414735d5749ee159c0165Anna Zaks ExplodedNodeSet &Dst) {} 4499c6cd67ea416bace666d614c84d5531124287653Zhongxing Xu 4509c378f705405d37f49795d5e915989de774fe11fTed Kremenekvoid ExprEngine::Visit(const Stmt *S, ExplodedNode *Pred, 4516889679d72859960e0fc8d1080487f63c4df1e0aAnna Zaks ExplodedNodeSet &DstTop) { 4520bed8a12f2878d3cd94fb8bdba55b593d92dd11aTed Kremenek PrettyStackTraceLoc CrashInfo(getContext().getSourceManager(), 4530bed8a12f2878d3cd94fb8bdba55b593d92dd11aTed Kremenek S->getLocStart(), 4540bed8a12f2878d3cd94fb8bdba55b593d92dd11aTed Kremenek "Error evaluating statement"); 4556889679d72859960e0fc8d1080487f63c4df1e0aAnna Zaks ExplodedNodeSet Dst; 4566889679d72859960e0fc8d1080487f63c4df1e0aAnna Zaks StmtNodeBuilder Bldr(Pred, DstTop, *currentBuilderContext); 4570bed8a12f2878d3cd94fb8bdba55b593d92dd11aTed Kremenek 458f6a1648197562e0b133440d612d9af297d0a86ccJohn McCall // Expressions to ignore. 459f6a1648197562e0b133440d612d9af297d0a86ccJohn McCall if (const Expr *Ex = dyn_cast<Expr>(S)) 460892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek S = Ex->IgnoreParens(); 461f6a1648197562e0b133440d612d9af297d0a86ccJohn McCall 462e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek // FIXME: add metadata to the CFG so that we can disable 463e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek // this check when we KNOW that there is no block-level subexpression. 464e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek // The motivation is that this check requires a hashtable lookup. 4651eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 466ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks if (S != currentStmt && Pred->getLocationContext()->getCFG()->isBlkExpr(S)) 467e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek return; 4681eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 469e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek switch (S->getStmtClass()) { 470f85e193739c953358c865005855253af4f68a497John McCall // C++ and ARC stuff we don't support yet. 471f85e193739c953358c865005855253af4f68a497John McCall case Expr::ObjCIndirectCopyRestoreExprClass: 4721b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::CXXBindTemporaryExprClass: 4731b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::CXXCatchStmtClass: 4741b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::CXXDependentScopeMemberExprClass: 4751b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::CXXPseudoDestructorExprClass: 4761b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::CXXThrowExprClass: 4771b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::CXXTryStmtClass: 4781b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::CXXTypeidExprClass: 4799be88403e965cc49af76c9d33d818781d44b333eFrancois Pichet case Stmt::CXXUuidofExprClass: 480c768a0c46e6c064c3281d663777ee95aea8652eeTed Kremenek case Stmt::CXXUnresolvedConstructExprClass: 481ed8abf18329df67b0abcbb3a10458bd8c1d2a595Douglas Gregor case Stmt::CXXScalarValueInitExprClass: 4821b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::DependentScopeDeclRefExprClass: 4831b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::UnaryTypeTraitExprClass: 4846ad6f2848d7652ab2991286eb48be440d3493b28Francois Pichet case Stmt::BinaryTypeTraitExprClass: 4854ca8ac2e61c37ddadf37024af86f3e1019af8532Douglas Gregor case Stmt::TypeTraitExprClass: 48621ff2e516b0e0bc8c1dbf965cb3d44bac3c64330John Wiegley case Stmt::ArrayTypeTraitExprClass: 487552622067dc45013d240f73952fece703f5e63bdJohn Wiegley case Stmt::ExpressionTraitExprClass: 4881b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::UnresolvedLookupExprClass: 489c768a0c46e6c064c3281d663777ee95aea8652eeTed Kremenek case Stmt::UnresolvedMemberExprClass: 4906b219d082434394c1ac401390ec1d1967727815aSebastian Redl case Stmt::CXXNoexceptExprClass: 491be230c36e32142cbdcdbe9c97511d097beeecbabDouglas Gregor case Stmt::PackExpansionExprClass: 492c7793c73ba8a343de3f2552d984851985a46f159Douglas Gregor case Stmt::SubstNonTypeTemplateParmPackExprClass: 49328bbe4b8acc338476fe0825769b41fb32b423c72John Wiegley case Stmt::SEHTryStmtClass: 49428bbe4b8acc338476fe0825769b41fb32b423c72John Wiegley case Stmt::SEHExceptStmtClass: 49501d08018b7cf5ce1601707cfd7a84d22015fc04eDouglas Gregor case Stmt::LambdaExprClass: 496ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks case Stmt::SEHFinallyStmtClass: { 497ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks const ExplodedNode *node = Bldr.generateNode(S, Pred, Pred->getState()); 498ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Engine.addAbortedBlock(node, currentBuilderContext->getBlock()); 499c768a0c46e6c064c3281d663777ee95aea8652eeTed Kremenek break; 500c768a0c46e6c064c3281d663777ee95aea8652eeTed Kremenek } 5015fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek 5025fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek // We don't handle default arguments either yet, but we can fake it 5035fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek // for now by just skipping them. 50491a5755ad73c5dc1dfb167e448fdd74e75a6df56John McCall case Stmt::SubstNonTypeTemplateParmExprClass: 505ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks case Stmt::CXXDefaultArgExprClass: 5065fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek break; 5075fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek 508f6a1648197562e0b133440d612d9af297d0a86ccJohn McCall case Stmt::ParenExprClass: 509f6a1648197562e0b133440d612d9af297d0a86ccJohn McCall llvm_unreachable("ParenExprs already handled."); 510f111d935722ed488144600cea5ed03a6b5069e8fPeter Collingbourne case Stmt::GenericSelectionExprClass: 511f111d935722ed488144600cea5ed03a6b5069e8fPeter Collingbourne llvm_unreachable("GenericSelectionExprs already handled."); 5121b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek // Cases that should never be evaluated simply because they shouldn't 5131b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek // appear in the CFG. 5141b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::BreakStmtClass: 5151b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::CaseStmtClass: 5161b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::CompoundStmtClass: 5171b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::ContinueStmtClass: 51846eaf7789a1059a7b42b7dbd183150c72df5738fTed Kremenek case Stmt::CXXForRangeStmtClass: 5191b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::DefaultStmtClass: 5201b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::DoStmtClass: 521d40066b0fb883839a9100e5455e33190b9b8abacTed Kremenek case Stmt::ForStmtClass: 5221b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::GotoStmtClass: 523d40066b0fb883839a9100e5455e33190b9b8abacTed Kremenek case Stmt::IfStmtClass: 5241b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::IndirectGotoStmtClass: 5251b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::LabelStmtClass: 5261b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::NoStmtClass: 5271b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::NullStmtClass: 528d40066b0fb883839a9100e5455e33190b9b8abacTed Kremenek case Stmt::SwitchStmtClass: 529d40066b0fb883839a9100e5455e33190b9b8abacTed Kremenek case Stmt::WhileStmtClass: 530ba0513de93d2fab6db5ab30b6927209fcc883078Douglas Gregor case Expr::MSDependentExistsStmtClass: 5311b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek llvm_unreachable("Stmt should not be in analyzer evaluation loop"); 5321b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek 5338ad9cbc518a603176462f1fa1efe389023590082Ted Kremenek case Stmt::GNUNullExprClass: { 5348f08426e6f54ed20b959018f24dbea106a00b4adJordy Rose // GNU __null is a pointer-width integer, not an actual pointer. 5358bef8238181a30e52dea380789a7e2d760eac532Ted Kremenek ProgramStateRef state = Pred->getState(); 5365eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek state = state->BindExpr(S, Pred->getLocationContext(), 5375eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek svalBuilder.makeIntValWithPtrWidth(0, false)); 538ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.generateNode(S, Pred, state); 5398ad9cbc518a603176462f1fa1efe389023590082Ted Kremenek break; 5408ad9cbc518a603176462f1fa1efe389023590082Ted Kremenek } 5418ad9cbc518a603176462f1fa1efe389023590082Ted Kremenek 5424beaa9f51b2da57c64740cef2bd1c2fdb0c325d5Ted Kremenek case Stmt::ObjCAtSynchronizedStmtClass: 543ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.takeNodes(Pred); 5444beaa9f51b2da57c64740cef2bd1c2fdb0c325d5Ted Kremenek VisitObjCAtSynchronizedStmt(cast<ObjCAtSynchronizedStmt>(S), Pred, Dst); 545ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.addNodes(Dst); 5464beaa9f51b2da57c64740cef2bd1c2fdb0c325d5Ted Kremenek break; 5474beaa9f51b2da57c64740cef2bd1c2fdb0c325d5Ted Kremenek 54814429b918bd2f4cb52abc75546a7fe37142054caArgyrios Kyrtzidis case Stmt::ObjCPropertyRefExprClass: 549f8b5aae41e46f94fe90ed5f1ee98f36f0aa59dc9Ted Kremenek // Implicitly handled by Environment::getSVal(). 55014429b918bd2f4cb52abc75546a7fe37142054caArgyrios Kyrtzidis break; 55114429b918bd2f4cb52abc75546a7fe37142054caArgyrios Kyrtzidis 552f85e193739c953358c865005855253af4f68a497John McCall case Stmt::ImplicitValueInitExprClass: { 5538bef8238181a30e52dea380789a7e2d760eac532Ted Kremenek ProgramStateRef state = Pred->getState(); 554f85e193739c953358c865005855253af4f68a497John McCall QualType ty = cast<ImplicitValueInitExpr>(S)->getType(); 555f85e193739c953358c865005855253af4f68a497John McCall SVal val = svalBuilder.makeZeroVal(ty); 5565eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek Bldr.generateNode(S, Pred, state->BindExpr(S, Pred->getLocationContext(), 5575eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek val)); 558f85e193739c953358c865005855253af4f68a497John McCall break; 559f85e193739c953358c865005855253af4f68a497John McCall } 560f85e193739c953358c865005855253af4f68a497John McCall 561ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks case Stmt::ExprWithCleanupsClass: 562ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.takeNodes(Pred); 563f85e193739c953358c865005855253af4f68a497John McCall Visit(cast<ExprWithCleanups>(S)->getSubExpr(), Pred, Dst); 564ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.addNodes(Dst); 565f85e193739c953358c865005855253af4f68a497John McCall break; 566f85e193739c953358c865005855253af4f68a497John McCall 5671b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek // Cases not handled yet; but will handle some day. 5681b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::DesignatedInitExprClass: 5691b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::ExtVectorElementExprClass: 5701b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::ImaginaryLiteralClass: 5711b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::ObjCAtCatchStmtClass: 5721b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::ObjCAtFinallyStmtClass: 5731b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::ObjCAtTryStmtClass: 574f85e193739c953358c865005855253af4f68a497John McCall case Stmt::ObjCAutoreleasePoolStmtClass: 5751b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::ObjCEncodeExprClass: 5761b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::ObjCIsaExprClass: 5771b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::ObjCProtocolExprClass: 5781b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::ObjCSelectorExprClass: 5791b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::ObjCStringLiteralClass: 5801b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::ParenListExprClass: 5811b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::PredefinedExprClass: 5821b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::ShuffleVectorExprClass: 5831b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::VAArgExprClass: 584e08ce650a2b02410eddd1f60a4aa6b3d4be71e73Peter Collingbourne case Stmt::CUDAKernelCallExprClass: 58556ca35d396d8692c384c785f9aeebcf22563fe1eJohn McCall case Stmt::OpaqueValueExprClass: 58661eee0ca33b29e102f11bab77c8b74cc00e2392bTanya Lattner case Stmt::AsTypeExprClass: 587276b061970939293f1abaf694bd3ef05b2cbda79Eli Friedman case Stmt::AtomicExprClass: 5881b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek // Fall through. 5891b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek 5901b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek // Cases we intentionally don't evaluate, since they don't need 5911b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek // to be explicitly evaluated. 592bc9ad74a13e83303a3a5251f8bacbbca17341c17Zhongxing Xu case Stmt::AddrLabelExprClass: 593bc9ad74a13e83303a3a5251f8bacbbca17341c17Zhongxing Xu case Stmt::IntegerLiteralClass: 594bc9ad74a13e83303a3a5251f8bacbbca17341c17Zhongxing Xu case Stmt::CharacterLiteralClass: 595477323d58a0de352c6a61e08b5a83127c4adc904Zhongxing Xu case Stmt::CXXBoolLiteralExprClass: 596bc9ad74a13e83303a3a5251f8bacbbca17341c17Zhongxing Xu case Stmt::FloatingLiteralClass: 597f901a7de97f46ba2b1ff153f9fb83d00dc37cfcfDouglas Gregor case Stmt::SizeOfPackExprClass: 598bdd4c848349d4091d66b052efa453e6d69a77e36Ted Kremenek case Stmt::CXXNullPtrLiteralExprClass: { 599bdd4c848349d4091d66b052efa453e6d69a77e36Ted Kremenek Bldr.takeNodes(Pred); 600bdd4c848349d4091d66b052efa453e6d69a77e36Ted Kremenek ExplodedNodeSet preVisit; 601bdd4c848349d4091d66b052efa453e6d69a77e36Ted Kremenek getCheckerManager().runCheckersForPreStmt(preVisit, Pred, S, *this); 602bdd4c848349d4091d66b052efa453e6d69a77e36Ted Kremenek getCheckerManager().runCheckersForPostStmt(Dst, preVisit, S, *this); 603bdd4c848349d4091d66b052efa453e6d69a77e36Ted Kremenek Bldr.addNodes(Dst); 604e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek break; 605bdd4c848349d4091d66b052efa453e6d69a77e36Ted Kremenek } 6061eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 607540cbe2b60294fe7b926c26b4f1840f544fe3011Ted Kremenek case Stmt::ArraySubscriptExprClass: 608ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.takeNodes(Pred); 609892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek VisitLvalArraySubscriptExpr(cast<ArraySubscriptExpr>(S), Pred, Dst); 610ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.addNodes(Dst); 611540cbe2b60294fe7b926c26b4f1840f544fe3011Ted Kremenek break; 6121eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 613e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek case Stmt::AsmStmtClass: 614ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.takeNodes(Pred); 615e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek VisitAsmStmt(cast<AsmStmt>(S), Pred, Dst); 616ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.addNodes(Dst); 617e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek break; 618b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 619892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek case Stmt::BlockDeclRefExprClass: { 620ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.takeNodes(Pred); 621892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek const BlockDeclRefExpr *BE = cast<BlockDeclRefExpr>(S); 622892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek VisitCommonDeclRefExpr(BE, BE->getDecl(), Pred, Dst); 623ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.addNodes(Dst); 62467d1287035767f4f6c8ca0c2bb755990012a44caTed Kremenek break; 625892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek } 6261eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 627c95ad9ff6e574aecdd759542d5578bc65d586d93Ted Kremenek case Stmt::BlockExprClass: 628ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.takeNodes(Pred); 629c95ad9ff6e574aecdd759542d5578bc65d586d93Ted Kremenek VisitBlockExpr(cast<BlockExpr>(S), Pred, Dst); 630ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.addNodes(Dst); 631c95ad9ff6e574aecdd759542d5578bc65d586d93Ted Kremenek break; 632c95ad9ff6e574aecdd759542d5578bc65d586d93Ted Kremenek 633e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek case Stmt::BinaryOperatorClass: { 63403509aea098772644bf4662dc1c88634818ceeccZhongxing Xu const BinaryOperator* B = cast<BinaryOperator>(S); 635e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek if (B->isLogicalOp()) { 636ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.takeNodes(Pred); 637e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek VisitLogicalExpr(B, Pred, Dst); 638ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.addNodes(Dst); 639e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek break; 640e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek } 6412de56d1d0c3a504ad1529de2677628bdfbb95cd4John McCall else if (B->getOpcode() == BO_Comma) { 6428bef8238181a30e52dea380789a7e2d760eac532Ted Kremenek ProgramStateRef state = Pred->getState(); 643ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.generateNode(B, Pred, 6445eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek state->BindExpr(B, Pred->getLocationContext(), 6455eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek state->getSVal(B->getRHS(), 6465eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek Pred->getLocationContext()))); 647e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek break; 648e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek } 64906fb99fb403bff1651429923f666a2ebe2b1522fTed Kremenek 650ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.takeNodes(Pred); 651ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks 652b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek if (AMgr.shouldEagerlyAssume() && 653bb141217871e93767aa3f2de1b9946fa6d37066aZhongxing Xu (B->isRelationalOp() || B->isEqualityOp())) { 654031ccc0555a82afc2e8afe29e19dd57ff204e2deZhongxing Xu ExplodedNodeSet Tmp; 655892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek VisitBinaryOperator(cast<BinaryOperator>(S), Pred, Tmp); 6569c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek evalEagerlyAssume(Dst, Tmp, cast<Expr>(S)); 65748af2a9c1ed3259512f2d1431720add1fbe8fb5fTed Kremenek } 65848af2a9c1ed3259512f2d1431720add1fbe8fb5fTed Kremenek else 659892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek VisitBinaryOperator(cast<BinaryOperator>(S), Pred, Dst); 66048af2a9c1ed3259512f2d1431720add1fbe8fb5fTed Kremenek 661ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.addNodes(Dst); 662e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek break; 663e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek } 66406fb99fb403bff1651429923f666a2ebe2b1522fTed Kremenek 665b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek case Stmt::CallExprClass: 666b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek case Stmt::CXXOperatorCallExprClass: 667b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek case Stmt::CXXMemberCallExprClass: { 668ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.takeNodes(Pred); 669b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek VisitCallExpr(cast<CallExpr>(S), Pred, Dst); 670ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.addNodes(Dst); 67106fb99fb403bff1651429923f666a2ebe2b1522fTed Kremenek break; 672e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek } 67306fb99fb403bff1651429923f666a2ebe2b1522fTed Kremenek 674744f1cd66bb6747ea71fbf1172698e7bf35ec88dTed Kremenek case Stmt::CXXTemporaryObjectExprClass: 6757ce351db56fbce162a3b650518ce05b5c61ebf36Zhongxing Xu case Stmt::CXXConstructExprClass: { 6767ce351db56fbce162a3b650518ce05b5c61ebf36Zhongxing Xu const CXXConstructExpr *C = cast<CXXConstructExpr>(S); 6777ce351db56fbce162a3b650518ce05b5c61ebf36Zhongxing Xu // For block-level CXXConstructExpr, we don't have a destination region. 6787ce351db56fbce162a3b650518ce05b5c61ebf36Zhongxing Xu // Let VisitCXXConstructExpr() create one. 679ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.takeNodes(Pred); 680892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek VisitCXXConstructExpr(C, 0, Pred, Dst); 681ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.addNodes(Dst); 6827ce351db56fbce162a3b650518ce05b5c61ebf36Zhongxing Xu break; 6837ce351db56fbce162a3b650518ce05b5c61ebf36Zhongxing Xu } 6847ce351db56fbce162a3b650518ce05b5c61ebf36Zhongxing Xu 685856c6bcaea56e05255e9f3997ddd56b5c18a14f0Zhongxing Xu case Stmt::CXXNewExprClass: { 686ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.takeNodes(Pred); 68703509aea098772644bf4662dc1c88634818ceeccZhongxing Xu const CXXNewExpr *NE = cast<CXXNewExpr>(S); 688856c6bcaea56e05255e9f3997ddd56b5c18a14f0Zhongxing Xu VisitCXXNewExpr(NE, Pred, Dst); 689ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.addNodes(Dst); 690856c6bcaea56e05255e9f3997ddd56b5c18a14f0Zhongxing Xu break; 691856c6bcaea56e05255e9f3997ddd56b5c18a14f0Zhongxing Xu } 692856c6bcaea56e05255e9f3997ddd56b5c18a14f0Zhongxing Xu 6936b8513829895e56a7b97e787ea74520bc626512eZhongxing Xu case Stmt::CXXDeleteExprClass: { 694ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.takeNodes(Pred); 69503509aea098772644bf4662dc1c88634818ceeccZhongxing Xu const CXXDeleteExpr *CDE = cast<CXXDeleteExpr>(S); 6966b8513829895e56a7b97e787ea74520bc626512eZhongxing Xu VisitCXXDeleteExpr(CDE, Pred, Dst); 697ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.addNodes(Dst); 6986b8513829895e56a7b97e787ea74520bc626512eZhongxing Xu break; 6996b8513829895e56a7b97e787ea74520bc626512eZhongxing Xu } 700e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek // FIXME: ChooseExpr is really a constant. We need to fix 701e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek // the CFG do not model them as explicit control-flow. 7021eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 703e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek case Stmt::ChooseExprClass: { // __builtin_choose_expr 704ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.takeNodes(Pred); 7059c378f705405d37f49795d5e915989de774fe11fTed Kremenek const ChooseExpr *C = cast<ChooseExpr>(S); 706e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek VisitGuardedExpr(C, C->getLHS(), C->getRHS(), Pred, Dst); 707ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.addNodes(Dst); 708e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek break; 709e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek } 7101eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 711e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek case Stmt::CompoundAssignOperatorClass: 712ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.takeNodes(Pred); 713892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek VisitBinaryOperator(cast<BinaryOperator>(S), Pred, Dst); 714ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.addNodes(Dst); 715e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek break; 716f22679e3e5d5f5754931952e58112b4c863a4137Zhongxing Xu 717f22679e3e5d5f5754931952e58112b4c863a4137Zhongxing Xu case Stmt::CompoundLiteralExprClass: 718ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.takeNodes(Pred); 719892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek VisitCompoundLiteralExpr(cast<CompoundLiteralExpr>(S), Pred, Dst); 720ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.addNodes(Dst); 721f22679e3e5d5f5754931952e58112b4c863a4137Zhongxing Xu break; 7221eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 72356ca35d396d8692c384c785f9aeebcf22563fe1eJohn McCall case Stmt::BinaryConditionalOperatorClass: 724e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek case Stmt::ConditionalOperatorClass: { // '?' operator 725ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.takeNodes(Pred); 72656ca35d396d8692c384c785f9aeebcf22563fe1eJohn McCall const AbstractConditionalOperator *C 72756ca35d396d8692c384c785f9aeebcf22563fe1eJohn McCall = cast<AbstractConditionalOperator>(S); 72856ca35d396d8692c384c785f9aeebcf22563fe1eJohn McCall VisitGuardedExpr(C, C->getTrueExpr(), C->getFalseExpr(), Pred, Dst); 729ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.addNodes(Dst); 730e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek break; 731e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek } 7321eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 733bb141217871e93767aa3f2de1b9946fa6d37066aZhongxing Xu case Stmt::CXXThisExprClass: 734ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.takeNodes(Pred); 735bb141217871e93767aa3f2de1b9946fa6d37066aZhongxing Xu VisitCXXThisExpr(cast<CXXThisExpr>(S), Pred, Dst); 736ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.addNodes(Dst); 737bb141217871e93767aa3f2de1b9946fa6d37066aZhongxing Xu break; 738bb141217871e93767aa3f2de1b9946fa6d37066aZhongxing Xu 739892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek case Stmt::DeclRefExprClass: { 740ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.takeNodes(Pred); 741892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek const DeclRefExpr *DE = cast<DeclRefExpr>(S); 742892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek VisitCommonDeclRefExpr(DE, DE->getDecl(), Pred, Dst); 743ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.addNodes(Dst); 744e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek break; 745892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek } 7461eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 747e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek case Stmt::DeclStmtClass: 748ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.takeNodes(Pred); 749e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek VisitDeclStmt(cast<DeclStmt>(S), Pred, Dst); 750ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.addNodes(Dst); 751e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek break; 7521eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 7530835a3cdeefe714b4959d31127ea155e56393125Argyrios Kyrtzidis case Stmt::ImplicitCastExprClass: 7540d9d736c49b51691ced96759ec99399824e2a602Zhongxing Xu case Stmt::CStyleCastExprClass: 7550d9d736c49b51691ced96759ec99399824e2a602Zhongxing Xu case Stmt::CXXStaticCastExprClass: 7560d9d736c49b51691ced96759ec99399824e2a602Zhongxing Xu case Stmt::CXXDynamicCastExprClass: 7570d9d736c49b51691ced96759ec99399824e2a602Zhongxing Xu case Stmt::CXXReinterpretCastExprClass: 7580d9d736c49b51691ced96759ec99399824e2a602Zhongxing Xu case Stmt::CXXConstCastExprClass: 759f85e193739c953358c865005855253af4f68a497John McCall case Stmt::CXXFunctionalCastExprClass: 760f85e193739c953358c865005855253af4f68a497John McCall case Stmt::ObjCBridgedCastExprClass: { 761ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.takeNodes(Pred); 7629c378f705405d37f49795d5e915989de774fe11fTed Kremenek const CastExpr *C = cast<CastExpr>(S); 763f85e193739c953358c865005855253af4f68a497John McCall // Handle the previsit checks. 764f85e193739c953358c865005855253af4f68a497John McCall ExplodedNodeSet dstPrevisit; 765f85e193739c953358c865005855253af4f68a497John McCall getCheckerManager().runCheckersForPreStmt(dstPrevisit, Pred, C, *this); 766f85e193739c953358c865005855253af4f68a497John McCall 767f85e193739c953358c865005855253af4f68a497John McCall // Handle the expression itself. 768f85e193739c953358c865005855253af4f68a497John McCall ExplodedNodeSet dstExpr; 769f85e193739c953358c865005855253af4f68a497John McCall for (ExplodedNodeSet::iterator i = dstPrevisit.begin(), 770f85e193739c953358c865005855253af4f68a497John McCall e = dstPrevisit.end(); i != e ; ++i) { 771f85e193739c953358c865005855253af4f68a497John McCall VisitCast(C, C->getSubExpr(), *i, dstExpr); 772f85e193739c953358c865005855253af4f68a497John McCall } 773f85e193739c953358c865005855253af4f68a497John McCall 774f85e193739c953358c865005855253af4f68a497John McCall // Handle the postvisit checks. 775f85e193739c953358c865005855253af4f68a497John McCall getCheckerManager().runCheckersForPostStmt(Dst, dstExpr, C, *this); 776ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.addNodes(Dst); 777e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek break; 778e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek } 779b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 78003e80030515c800d1ab44125b9052dfffd1bd04cDouglas Gregor case Expr::MaterializeTemporaryExprClass: { 781ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.takeNodes(Pred); 78203e80030515c800d1ab44125b9052dfffd1bd04cDouglas Gregor const MaterializeTemporaryExpr *Materialize 78303e80030515c800d1ab44125b9052dfffd1bd04cDouglas Gregor = cast<MaterializeTemporaryExpr>(S); 78403e80030515c800d1ab44125b9052dfffd1bd04cDouglas Gregor if (!Materialize->getType()->isRecordType()) 785eea72a925f294225391ecec876a342771c09b635Ted Kremenek CreateCXXTemporaryObject(Materialize, Pred, Dst); 78603e80030515c800d1ab44125b9052dfffd1bd04cDouglas Gregor else 78703e80030515c800d1ab44125b9052dfffd1bd04cDouglas Gregor Visit(Materialize->GetTemporaryExpr(), Pred, Dst); 788ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.addNodes(Dst); 78903e80030515c800d1ab44125b9052dfffd1bd04cDouglas Gregor break; 79003e80030515c800d1ab44125b9052dfffd1bd04cDouglas Gregor } 79103e80030515c800d1ab44125b9052dfffd1bd04cDouglas Gregor 792c4f8706b6539e06a5de153bd72850bb2e0a71456Zhongxing Xu case Stmt::InitListExprClass: 793ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.takeNodes(Pred); 794c4f8706b6539e06a5de153bd72850bb2e0a71456Zhongxing Xu VisitInitListExpr(cast<InitListExpr>(S), Pred, Dst); 795ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.addNodes(Dst); 796c4f8706b6539e06a5de153bd72850bb2e0a71456Zhongxing Xu break; 7971eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 79897ed4f68f5dba3e21e7a490ef0f9ffd3bfead7f8Ted Kremenek case Stmt::MemberExprClass: 799ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.takeNodes(Pred); 800892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek VisitMemberExpr(cast<MemberExpr>(S), Pred, Dst); 801ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.addNodes(Dst); 802469ecbded3616416ef938ed94a67f86149faf226Ted Kremenek break; 803ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks 80497ed4f68f5dba3e21e7a490ef0f9ffd3bfead7f8Ted Kremenek case Stmt::ObjCIvarRefExprClass: 805ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.takeNodes(Pred); 806892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek VisitLvalObjCIvarRefExpr(cast<ObjCIvarRefExpr>(S), Pred, Dst); 807ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.addNodes(Dst); 80897ed4f68f5dba3e21e7a490ef0f9ffd3bfead7f8Ted Kremenek break; 809af3374187c47acea45706eab6744be6b1c66a856Ted Kremenek 810af3374187c47acea45706eab6744be6b1c66a856Ted Kremenek case Stmt::ObjCForCollectionStmtClass: 811ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.takeNodes(Pred); 812af3374187c47acea45706eab6744be6b1c66a856Ted Kremenek VisitObjCForCollectionStmt(cast<ObjCForCollectionStmt>(S), Pred, Dst); 813ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.addNodes(Dst); 814af3374187c47acea45706eab6744be6b1c66a856Ted Kremenek break; 8151eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 816b673a41c92aa276f2e37164d0747be1cfb0c402bTed Kremenek case Stmt::ObjCMessageExprClass: { 817ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.takeNodes(Pred); 818b673a41c92aa276f2e37164d0747be1cfb0c402bTed Kremenek // Is this a property access? 819b673a41c92aa276f2e37164d0747be1cfb0c402bTed Kremenek const ParentMap &PM = Pred->getLocationContext()->getParentMap(); 820b673a41c92aa276f2e37164d0747be1cfb0c402bTed Kremenek const ObjCMessageExpr *ME = cast<ObjCMessageExpr>(S); 821b673a41c92aa276f2e37164d0747be1cfb0c402bTed Kremenek bool evaluated = false; 822b673a41c92aa276f2e37164d0747be1cfb0c402bTed Kremenek 823b673a41c92aa276f2e37164d0747be1cfb0c402bTed Kremenek if (const PseudoObjectExpr *PO = 824b673a41c92aa276f2e37164d0747be1cfb0c402bTed Kremenek dyn_cast_or_null<PseudoObjectExpr>(PM.getParent(S))) { 825b673a41c92aa276f2e37164d0747be1cfb0c402bTed Kremenek const Expr *syntactic = PO->getSyntacticForm(); 826b673a41c92aa276f2e37164d0747be1cfb0c402bTed Kremenek if (const ObjCPropertyRefExpr *PR = 827b673a41c92aa276f2e37164d0747be1cfb0c402bTed Kremenek dyn_cast<ObjCPropertyRefExpr>(syntactic)) { 828b673a41c92aa276f2e37164d0747be1cfb0c402bTed Kremenek bool isSetter = ME->getNumArgs() > 0; 829b673a41c92aa276f2e37164d0747be1cfb0c402bTed Kremenek VisitObjCMessage(ObjCMessage(ME, PR, isSetter), Pred, Dst); 830b673a41c92aa276f2e37164d0747be1cfb0c402bTed Kremenek evaluated = true; 831b673a41c92aa276f2e37164d0747be1cfb0c402bTed Kremenek } 832b673a41c92aa276f2e37164d0747be1cfb0c402bTed Kremenek else if (isa<BinaryOperator>(syntactic)) { 833b673a41c92aa276f2e37164d0747be1cfb0c402bTed Kremenek VisitObjCMessage(ObjCMessage(ME, 0, true), Pred, Dst); 834b673a41c92aa276f2e37164d0747be1cfb0c402bTed Kremenek } 835b673a41c92aa276f2e37164d0747be1cfb0c402bTed Kremenek } 836b673a41c92aa276f2e37164d0747be1cfb0c402bTed Kremenek 837b673a41c92aa276f2e37164d0747be1cfb0c402bTed Kremenek if (!evaluated) 838b673a41c92aa276f2e37164d0747be1cfb0c402bTed Kremenek VisitObjCMessage(ME, Pred, Dst); 839b673a41c92aa276f2e37164d0747be1cfb0c402bTed Kremenek 840ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.addNodes(Dst); 841e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek break; 842b673a41c92aa276f2e37164d0747be1cfb0c402bTed Kremenek } 8431eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 844bbfd07a0c94f659beaf74316029ef73769cefb81Ted Kremenek case Stmt::ObjCAtThrowStmtClass: { 845bbfd07a0c94f659beaf74316029ef73769cefb81Ted Kremenek // FIXME: This is not complete. We basically treat @throw as 846bbfd07a0c94f659beaf74316029ef73769cefb81Ted Kremenek // an abort. 847ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.generateNode(S, Pred, Pred->getState()); 848bbfd07a0c94f659beaf74316029ef73769cefb81Ted Kremenek break; 849bbfd07a0c94f659beaf74316029ef73769cefb81Ted Kremenek } 8501eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 8511b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek case Stmt::ReturnStmtClass: 852ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.takeNodes(Pred); 8531b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek VisitReturnStmt(cast<ReturnStmt>(S), Pred, Dst); 854ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.addNodes(Dst); 8551b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek break; 8561eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 8578ecdb65716cd7914ffb2eeee993fa9039fcd31e8Douglas Gregor case Stmt::OffsetOfExprClass: 858ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.takeNodes(Pred); 8598ecdb65716cd7914ffb2eeee993fa9039fcd31e8Douglas Gregor VisitOffsetOfExpr(cast<OffsetOfExpr>(S), Pred, Dst); 860ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.addNodes(Dst); 8618ecdb65716cd7914ffb2eeee993fa9039fcd31e8Douglas Gregor break; 8628ecdb65716cd7914ffb2eeee993fa9039fcd31e8Douglas Gregor 863f4e3cfbe8abd124be6341ef5d714819b4fbd9082Peter Collingbourne case Stmt::UnaryExprOrTypeTraitExprClass: 864ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.takeNodes(Pred); 865f4e3cfbe8abd124be6341ef5d714819b4fbd9082Peter Collingbourne VisitUnaryExprOrTypeTraitExpr(cast<UnaryExprOrTypeTraitExpr>(S), 866f4e3cfbe8abd124be6341ef5d714819b4fbd9082Peter Collingbourne Pred, Dst); 867ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.addNodes(Dst); 868e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek break; 8691eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 870e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek case Stmt::StmtExprClass: { 8719c378f705405d37f49795d5e915989de774fe11fTed Kremenek const StmtExpr *SE = cast<StmtExpr>(S); 872a3d1eb85853eae7b719f679b40923826b5e4b7dfTed Kremenek 873a3d1eb85853eae7b719f679b40923826b5e4b7dfTed Kremenek if (SE->getSubStmt()->body_empty()) { 874a3d1eb85853eae7b719f679b40923826b5e4b7dfTed Kremenek // Empty statement expression. 875a3d1eb85853eae7b719f679b40923826b5e4b7dfTed Kremenek assert(SE->getType() == getContext().VoidTy 876a3d1eb85853eae7b719f679b40923826b5e4b7dfTed Kremenek && "Empty statement expression must have void type."); 877a3d1eb85853eae7b719f679b40923826b5e4b7dfTed Kremenek break; 878a3d1eb85853eae7b719f679b40923826b5e4b7dfTed Kremenek } 8791eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 8809c378f705405d37f49795d5e915989de774fe11fTed Kremenek if (Expr *LastExpr = dyn_cast<Expr>(*SE->getSubStmt()->body_rbegin())) { 8818bef8238181a30e52dea380789a7e2d760eac532Ted Kremenek ProgramStateRef state = Pred->getState(); 882ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.generateNode(SE, Pred, 8835eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek state->BindExpr(SE, Pred->getLocationContext(), 8845eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek state->getSVal(LastExpr, 8855eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek Pred->getLocationContext()))); 886a3d1eb85853eae7b719f679b40923826b5e4b7dfTed Kremenek } 887e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek break; 888e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek } 8896987c7b74146b9658b1925c5981f8b0cd0672b55Zhongxing Xu 890892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek case Stmt::StringLiteralClass: { 8918bef8238181a30e52dea380789a7e2d760eac532Ted Kremenek ProgramStateRef state = Pred->getState(); 892892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek SVal V = state->getLValue(cast<StringLiteral>(S)); 8935eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek Bldr.generateNode(S, Pred, state->BindExpr(S, Pred->getLocationContext(), 8945eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek V)); 895892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek return; 896892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek } 897b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 89872374594c5d9ade02451bc85cf9dfa5b0ea106e7Ted Kremenek case Stmt::UnaryOperatorClass: { 899ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.takeNodes(Pred); 90003509aea098772644bf4662dc1c88634818ceeccZhongxing Xu const UnaryOperator *U = cast<UnaryOperator>(S); 901ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks if (AMgr.shouldEagerlyAssume() && (U->getOpcode() == UO_LNot)) { 902031ccc0555a82afc2e8afe29e19dd57ff204e2deZhongxing Xu ExplodedNodeSet Tmp; 903892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek VisitUnaryOperator(U, Pred, Tmp); 9049c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek evalEagerlyAssume(Dst, Tmp, U); 90572374594c5d9ade02451bc85cf9dfa5b0ea106e7Ted Kremenek } 90672374594c5d9ade02451bc85cf9dfa5b0ea106e7Ted Kremenek else 907892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek VisitUnaryOperator(U, Pred, Dst); 908ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.addNodes(Dst); 9091b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek break; 91072374594c5d9ade02451bc85cf9dfa5b0ea106e7Ted Kremenek } 9114b9c2d235fb9449e249d74f48ecfec601650de93John McCall 9124b9c2d235fb9449e249d74f48ecfec601650de93John McCall case Stmt::PseudoObjectExprClass: { 9134b9c2d235fb9449e249d74f48ecfec601650de93John McCall Bldr.takeNodes(Pred); 9148bef8238181a30e52dea380789a7e2d760eac532Ted Kremenek ProgramStateRef state = Pred->getState(); 9154b9c2d235fb9449e249d74f48ecfec601650de93John McCall const PseudoObjectExpr *PE = cast<PseudoObjectExpr>(S); 9164b9c2d235fb9449e249d74f48ecfec601650de93John McCall if (const Expr *Result = PE->getResultExpr()) { 9175eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek SVal V = state->getSVal(Result, Pred->getLocationContext()); 9185eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek Bldr.generateNode(S, Pred, 9195eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek state->BindExpr(S, Pred->getLocationContext(), V)); 9204b9c2d235fb9449e249d74f48ecfec601650de93John McCall } 9214b9c2d235fb9449e249d74f48ecfec601650de93John McCall else 9225eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek Bldr.generateNode(S, Pred, 9235eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek state->BindExpr(S, Pred->getLocationContext(), 9245eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek UnknownVal())); 9254b9c2d235fb9449e249d74f48ecfec601650de93John McCall 9264b9c2d235fb9449e249d74f48ecfec601650de93John McCall Bldr.addNodes(Dst); 9274b9c2d235fb9449e249d74f48ecfec601650de93John McCall break; 9284b9c2d235fb9449e249d74f48ecfec601650de93John McCall } 9291b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek } 9301b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek} 9311b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek 932c03a39e16762627b421247b12a2658be630a3300Anna Zaks/// Block entrance. (Update counters). 933c03a39e16762627b421247b12a2658be630a3300Anna Zaksvoid ExprEngine::processCFGBlockEntrance(NodeBuilderWithSinks &nodeBuilder) { 93427c54e57c4a012dcdf2b40cf985b70d0b9caa69eTed Kremenek 93527c54e57c4a012dcdf2b40cf985b70d0b9caa69eTed Kremenek // FIXME: Refactor this into a checker. 936c03a39e16762627b421247b12a2658be630a3300Anna Zaks ExplodedNode *pred = nodeBuilder.getContext().getPred(); 93727c54e57c4a012dcdf2b40cf985b70d0b9caa69eTed Kremenek 938c03a39e16762627b421247b12a2658be630a3300Anna Zaks if (nodeBuilder.getContext().getCurrentBlockCount() >= AMgr.getMaxVisit()) { 939ca804539d908d3a0e8c72a0df5f1f571d29490bbTed Kremenek static SimpleProgramPointTag tag("ExprEngine : Block count exceeded"); 940b6a2b08a6b3fbce1a6a4b69d4185165de970696cTed Kremenek nodeBuilder.generateNode(pred->getState(), pred, &tag, true); 94127c54e57c4a012dcdf2b40cf985b70d0b9caa69eTed Kremenek } 942e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek} 943e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek 944e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek//===----------------------------------------------------------------------===// 945e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek// Branch processing. 946e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek//===----------------------------------------------------------------------===// 947e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek 9488bef8238181a30e52dea380789a7e2d760eac532Ted KremenekProgramStateRef ExprEngine::MarkBranch(ProgramStateRef state, 9495eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek const Stmt *Terminator, 9505eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek const LocationContext *LCtx, 9515eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek bool branchTaken) { 9521eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 95305a2378c708688c8ef498a5cea40ed7f5db15fa5Ted Kremenek switch (Terminator->getStmtClass()) { 95405a2378c708688c8ef498a5cea40ed7f5db15fa5Ted Kremenek default: 955a8538d902fce9cfec20f39b34492268b51643819Ted Kremenek return state; 9561eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 95705a2378c708688c8ef498a5cea40ed7f5db15fa5Ted Kremenek case Stmt::BinaryOperatorClass: { // '&&' and '||' 9581eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 95903509aea098772644bf4662dc1c88634818ceeccZhongxing Xu const BinaryOperator* B = cast<BinaryOperator>(Terminator); 96005a2378c708688c8ef498a5cea40ed7f5db15fa5Ted Kremenek BinaryOperator::Opcode Op = B->getOpcode(); 9611eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 9622de56d1d0c3a504ad1529de2677628bdfbb95cd4John McCall assert (Op == BO_LAnd || Op == BO_LOr); 9631eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 96405a2378c708688c8ef498a5cea40ed7f5db15fa5Ted Kremenek // For &&, if we take the true branch, then the value of the whole 96505a2378c708688c8ef498a5cea40ed7f5db15fa5Ted Kremenek // expression is that of the RHS expression. 96605a2378c708688c8ef498a5cea40ed7f5db15fa5Ted Kremenek // 96705a2378c708688c8ef498a5cea40ed7f5db15fa5Ted Kremenek // For ||, if we take the false branch, then the value of the whole 96805a2378c708688c8ef498a5cea40ed7f5db15fa5Ted Kremenek // expression is that of the RHS expression. 9691eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 9709c378f705405d37f49795d5e915989de774fe11fTed Kremenek const Expr *Ex = (Op == BO_LAnd && branchTaken) || 9712de56d1d0c3a504ad1529de2677628bdfbb95cd4John McCall (Op == BO_LOr && !branchTaken) 97203509aea098772644bf4662dc1c88634818ceeccZhongxing Xu ? B->getRHS() : B->getLHS(); 9731eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 9745eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek return state->BindExpr(B, LCtx, UndefinedVal(Ex)); 97505a2378c708688c8ef498a5cea40ed7f5db15fa5Ted Kremenek } 9761eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 97756ca35d396d8692c384c785f9aeebcf22563fe1eJohn McCall case Stmt::BinaryConditionalOperatorClass: 97805a2378c708688c8ef498a5cea40ed7f5db15fa5Ted Kremenek case Stmt::ConditionalOperatorClass: { // ?: 97956ca35d396d8692c384c785f9aeebcf22563fe1eJohn McCall const AbstractConditionalOperator* C 98056ca35d396d8692c384c785f9aeebcf22563fe1eJohn McCall = cast<AbstractConditionalOperator>(Terminator); 9811eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 98205a2378c708688c8ef498a5cea40ed7f5db15fa5Ted Kremenek // For ?, if branchTaken == true then the value is either the LHS or 98305a2378c708688c8ef498a5cea40ed7f5db15fa5Ted Kremenek // the condition itself. (GNU extension). 9841eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 9859c378f705405d37f49795d5e915989de774fe11fTed Kremenek const Expr *Ex; 9861eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 98705a2378c708688c8ef498a5cea40ed7f5db15fa5Ted Kremenek if (branchTaken) 98856ca35d396d8692c384c785f9aeebcf22563fe1eJohn McCall Ex = C->getTrueExpr(); 98905a2378c708688c8ef498a5cea40ed7f5db15fa5Ted Kremenek else 99056ca35d396d8692c384c785f9aeebcf22563fe1eJohn McCall Ex = C->getFalseExpr(); 9911eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 9925eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek return state->BindExpr(C, LCtx, UndefinedVal(Ex)); 99305a2378c708688c8ef498a5cea40ed7f5db15fa5Ted Kremenek } 9941eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 99505a2378c708688c8ef498a5cea40ed7f5db15fa5Ted Kremenek case Stmt::ChooseExprClass: { // ?: 9961eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 9979c378f705405d37f49795d5e915989de774fe11fTed Kremenek const ChooseExpr *C = cast<ChooseExpr>(Terminator); 9981eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 9999c378f705405d37f49795d5e915989de774fe11fTed Kremenek const Expr *Ex = branchTaken ? C->getLHS() : C->getRHS(); 10005eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek return state->BindExpr(C, LCtx, UndefinedVal(Ex)); 100105a2378c708688c8ef498a5cea40ed7f5db15fa5Ted Kremenek } 100205a2378c708688c8ef498a5cea40ed7f5db15fa5Ted Kremenek } 100305a2378c708688c8ef498a5cea40ed7f5db15fa5Ted Kremenek} 100405a2378c708688c8ef498a5cea40ed7f5db15fa5Ted Kremenek 10056ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek/// RecoverCastedSymbol - A helper function for ProcessBranch that is used 10066ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek/// to try to recover some path-sensitivity for casts of symbolic 10076ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek/// integers that promote their values (which are currently not tracked well). 10086ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek/// This function returns the SVal bound to Condition->IgnoreCasts if all the 10096ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek// cast(s) did was sign-extend the original value. 1010294fd0a62b95f512637910bf85c7efa6c2354b50Ted Kremenekstatic SVal RecoverCastedSymbol(ProgramStateManager& StateMgr, 10118bef8238181a30e52dea380789a7e2d760eac532Ted Kremenek ProgramStateRef state, 1012294fd0a62b95f512637910bf85c7efa6c2354b50Ted Kremenek const Stmt *Condition, 10135eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek const LocationContext *LCtx, 1014294fd0a62b95f512637910bf85c7efa6c2354b50Ted Kremenek ASTContext &Ctx) { 10156ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek 101603509aea098772644bf4662dc1c88634818ceeccZhongxing Xu const Expr *Ex = dyn_cast<Expr>(Condition); 10176ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek if (!Ex) 10186ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek return UnknownVal(); 10196ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek 10206ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek uint64_t bits = 0; 10216ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek bool bitsInit = false; 10221eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 102303509aea098772644bf4662dc1c88634818ceeccZhongxing Xu while (const CastExpr *CE = dyn_cast<CastExpr>(Ex)) { 10246ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek QualType T = CE->getType(); 10256ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek 10266ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek if (!T->isIntegerType()) 10276ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek return UnknownVal(); 10281eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 10296ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek uint64_t newBits = Ctx.getTypeSize(T); 10306ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek if (!bitsInit || newBits < bits) { 10316ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek bitsInit = true; 10326ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek bits = newBits; 10336ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek } 10341eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 10356ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek Ex = CE->getSubExpr(); 10366ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek } 10376ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek 10386ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek // We reached a non-cast. Is it a symbolic value? 10396ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek QualType T = Ex->getType(); 10406ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek 10416ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek if (!bitsInit || !T->isIntegerType() || Ctx.getTypeSize(T) > bits) 10426ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek return UnknownVal(); 10431eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 10445eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek return state->getSVal(Ex, LCtx); 10456ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek} 10466ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek 10479c378f705405d37f49795d5e915989de774fe11fTed Kremenekvoid ExprEngine::processBranch(const Stmt *Condition, const Stmt *Term, 1048a19f4af7a94835ce4693bfe12d6270754e79eb56Anna Zaks NodeBuilderContext& BldCtx, 1049ad62deeb70e97da6bd514dd390ea1ce6af6ad81dAnna Zaks ExplodedNode *Pred, 10501aae01a8308d2f8e31adab3f4d7ac35543aac680Anna Zaks ExplodedNodeSet &Dst, 1051a19f4af7a94835ce4693bfe12d6270754e79eb56Anna Zaks const CFGBlock *DstT, 1052a19f4af7a94835ce4693bfe12d6270754e79eb56Anna Zaks const CFGBlock *DstF) { 1053f236b6503a4dbc44c1fccb8756bd57c9d0efdf05Anna Zaks currentBuilderContext = &BldCtx; 1054f236b6503a4dbc44c1fccb8756bd57c9d0efdf05Anna Zaks 1055b2331834a0515c80862ee51325c758a053829f15Ted Kremenek // Check for NULL conditions; e.g. "for(;;)" 10561eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump if (!Condition) { 10571aae01a8308d2f8e31adab3f4d7ac35543aac680Anna Zaks BranchNodeBuilder NullCondBldr(Pred, Dst, BldCtx, DstT, DstF); 1058a19f4af7a94835ce4693bfe12d6270754e79eb56Anna Zaks NullCondBldr.markInfeasible(false); 10594e82d3cf6fd4c907265e3fa3aac0a835c35dc759Anna Zaks NullCondBldr.generateNode(Pred->getState(), true, Pred); 1060b2331834a0515c80862ee51325c758a053829f15Ted Kremenek return; 1061b2331834a0515c80862ee51325c758a053829f15Ted Kremenek } 10621eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 106321028dd8850c64a414f7a82dfddcc291351203d6Ted Kremenek PrettyStackTraceLoc CrashInfo(getContext().getSourceManager(), 106421028dd8850c64a414f7a82dfddcc291351203d6Ted Kremenek Condition->getLocStart(), 106521028dd8850c64a414f7a82dfddcc291351203d6Ted Kremenek "Error evaluating branch"); 10660fb0bc4067d6c9d7c0e655300ef309b05d3adfc9Ted Kremenek 1067f236b6503a4dbc44c1fccb8756bd57c9d0efdf05Anna Zaks ExplodedNodeSet CheckersOutSet; 1068f236b6503a4dbc44c1fccb8756bd57c9d0efdf05Anna Zaks getCheckerManager().runCheckersForBranchCondition(Condition, CheckersOutSet, 10694e82d3cf6fd4c907265e3fa3aac0a835c35dc759Anna Zaks Pred, *this); 10708ff5c41f2bde7ebbe568b4c15e59f14b8befae66Anna Zaks // We generated only sinks. 1071f236b6503a4dbc44c1fccb8756bd57c9d0efdf05Anna Zaks if (CheckersOutSet.empty()) 10728ff5c41f2bde7ebbe568b4c15e59f14b8befae66Anna Zaks return; 10731eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1074f236b6503a4dbc44c1fccb8756bd57c9d0efdf05Anna Zaks BranchNodeBuilder builder(CheckersOutSet, Dst, BldCtx, DstT, DstF); 1075f236b6503a4dbc44c1fccb8756bd57c9d0efdf05Anna Zaks for (NodeBuilder::iterator I = CheckersOutSet.begin(), 1076f236b6503a4dbc44c1fccb8756bd57c9d0efdf05Anna Zaks E = CheckersOutSet.end(); E != I; ++I) { 1077cd656cab3fa3dd4b0c974c6ae1c0e60880b18c22Anna Zaks ExplodedNode *PredI = *I; 1078cd656cab3fa3dd4b0c974c6ae1c0e60880b18c22Anna Zaks 1079cd656cab3fa3dd4b0c974c6ae1c0e60880b18c22Anna Zaks if (PredI->isSink()) 1080cd656cab3fa3dd4b0c974c6ae1c0e60880b18c22Anna Zaks continue; 1081cd656cab3fa3dd4b0c974c6ae1c0e60880b18c22Anna Zaks 10828bef8238181a30e52dea380789a7e2d760eac532Ted Kremenek ProgramStateRef PrevState = Pred->getState(); 10835eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek SVal X = PrevState->getSVal(Condition, Pred->getLocationContext()); 1084cd656cab3fa3dd4b0c974c6ae1c0e60880b18c22Anna Zaks 1085cd656cab3fa3dd4b0c974c6ae1c0e60880b18c22Anna Zaks if (X.isUnknownOrUndef()) { 1086cd656cab3fa3dd4b0c974c6ae1c0e60880b18c22Anna Zaks // Give it a chance to recover from unknown. 1087cd656cab3fa3dd4b0c974c6ae1c0e60880b18c22Anna Zaks if (const Expr *Ex = dyn_cast<Expr>(Condition)) { 1088cd656cab3fa3dd4b0c974c6ae1c0e60880b18c22Anna Zaks if (Ex->getType()->isIntegerType()) { 1089cd656cab3fa3dd4b0c974c6ae1c0e60880b18c22Anna Zaks // Try to recover some path-sensitivity. Right now casts of symbolic 1090cd656cab3fa3dd4b0c974c6ae1c0e60880b18c22Anna Zaks // integers that promote their values are currently not tracked well. 1091cd656cab3fa3dd4b0c974c6ae1c0e60880b18c22Anna Zaks // If 'Condition' is such an expression, try and recover the 1092cd656cab3fa3dd4b0c974c6ae1c0e60880b18c22Anna Zaks // underlying value and use that instead. 1093cd656cab3fa3dd4b0c974c6ae1c0e60880b18c22Anna Zaks SVal recovered = RecoverCastedSymbol(getStateManager(), 1094cd656cab3fa3dd4b0c974c6ae1c0e60880b18c22Anna Zaks PrevState, Condition, 10955eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek Pred->getLocationContext(), 1096cd656cab3fa3dd4b0c974c6ae1c0e60880b18c22Anna Zaks getContext()); 1097cd656cab3fa3dd4b0c974c6ae1c0e60880b18c22Anna Zaks 1098cd656cab3fa3dd4b0c974c6ae1c0e60880b18c22Anna Zaks if (!recovered.isUnknown()) { 1099cd656cab3fa3dd4b0c974c6ae1c0e60880b18c22Anna Zaks X = recovered; 1100cd656cab3fa3dd4b0c974c6ae1c0e60880b18c22Anna Zaks } 11010835e4cccfef3ea5346962722b79484f6b3ca602Zhongxing Xu } 1102b38911f16b4943548db6a3695fc6ae23070b25d2Ted Kremenek } 11030835e4cccfef3ea5346962722b79484f6b3ca602Zhongxing Xu } 11045eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek 11055eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek const LocationContext *LCtx = PredI->getLocationContext(); 11065eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek 11070835e4cccfef3ea5346962722b79484f6b3ca602Zhongxing Xu // If the condition is still unknown, give up. 110873c498a08f4968b6987d1453c7b77929dcc6d5f7Argyrios Kyrtzidis if (X.isUnknownOrUndef()) { 11095eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek builder.generateNode(MarkBranch(PrevState, Term, LCtx, true), 11105eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek true, PredI); 11115eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek builder.generateNode(MarkBranch(PrevState, Term, LCtx, false), 11125eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek false, PredI); 1113cd656cab3fa3dd4b0c974c6ae1c0e60880b18c22Anna Zaks continue; 11141eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump } 11151eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1116cd656cab3fa3dd4b0c974c6ae1c0e60880b18c22Anna Zaks DefinedSVal V = cast<DefinedSVal>(X); 11170835e4cccfef3ea5346962722b79484f6b3ca602Zhongxing Xu 1118cd656cab3fa3dd4b0c974c6ae1c0e60880b18c22Anna Zaks // Process the true branch. 1119cd656cab3fa3dd4b0c974c6ae1c0e60880b18c22Anna Zaks if (builder.isFeasible(true)) { 11208bef8238181a30e52dea380789a7e2d760eac532Ted Kremenek if (ProgramStateRef state = PrevState->assume(V, true)) 11215eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek builder.generateNode(MarkBranch(state, Term, LCtx, true), 11225eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek true, PredI); 1123cd656cab3fa3dd4b0c974c6ae1c0e60880b18c22Anna Zaks else 1124cd656cab3fa3dd4b0c974c6ae1c0e60880b18c22Anna Zaks builder.markInfeasible(true); 1125cd656cab3fa3dd4b0c974c6ae1c0e60880b18c22Anna Zaks } 11261eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1127cd656cab3fa3dd4b0c974c6ae1c0e60880b18c22Anna Zaks // Process the false branch. 1128cd656cab3fa3dd4b0c974c6ae1c0e60880b18c22Anna Zaks if (builder.isFeasible(false)) { 11298bef8238181a30e52dea380789a7e2d760eac532Ted Kremenek if (ProgramStateRef state = PrevState->assume(V, false)) 11305eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek builder.generateNode(MarkBranch(state, Term, LCtx, false), 11315eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek false, PredI); 1132cd656cab3fa3dd4b0c974c6ae1c0e60880b18c22Anna Zaks else 1133cd656cab3fa3dd4b0c974c6ae1c0e60880b18c22Anna Zaks builder.markInfeasible(false); 1134cd656cab3fa3dd4b0c974c6ae1c0e60880b18c22Anna Zaks } 1135cd656cab3fa3dd4b0c974c6ae1c0e60880b18c22Anna Zaks } 1136f236b6503a4dbc44c1fccb8756bd57c9d0efdf05Anna Zaks currentBuilderContext = 0; 1137f233d48cfc513b045e2c2cfca5c175220fbd0a82Ted Kremenek} 1138f233d48cfc513b045e2c2cfca5c175220fbd0a82Ted Kremenek 1139e36de1fe51c39d9161915dd3dbef880954af6476Ted Kremenek/// processIndirectGoto - Called by CoreEngine. Used to generate successor 1140754607e7cff2d902d9af8b771409449fb2f8d2bfTed Kremenek/// nodes by processing the 'effects' of a computed goto jump. 1141ad8dcf4a9df0e24051dc31bf9e6f3cd138a34298Chris Lattnervoid ExprEngine::processIndirectGoto(IndirectGotoNodeBuilder &builder) { 1142754607e7cff2d902d9af8b771409449fb2f8d2bfTed Kremenek 11438bef8238181a30e52dea380789a7e2d760eac532Ted Kremenek ProgramStateRef state = builder.getState(); 11445eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek SVal V = state->getSVal(builder.getTarget(), builder.getLocationContext()); 11451eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1146754607e7cff2d902d9af8b771409449fb2f8d2bfTed Kremenek // Three possibilities: 1147754607e7cff2d902d9af8b771409449fb2f8d2bfTed Kremenek // 1148754607e7cff2d902d9af8b771409449fb2f8d2bfTed Kremenek // (1) We know the computed label. 11494a4e524afef40d6f3ddb25d0e407c814e4ca56a8Ted Kremenek // (2) The label is NULL (or some other constant), or Undefined. 1150754607e7cff2d902d9af8b771409449fb2f8d2bfTed Kremenek // (3) We have no clue about the label. Dispatch to all targets. 1151754607e7cff2d902d9af8b771409449fb2f8d2bfTed Kremenek // 11521eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1153d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidis typedef IndirectGotoNodeBuilder::iterator iterator; 1154754607e7cff2d902d9af8b771409449fb2f8d2bfTed Kremenek 11551c96b24285d05c0eac455ae96d7c9ff43d42bc96Zhongxing Xu if (isa<loc::GotoLabel>(V)) { 1156ad8dcf4a9df0e24051dc31bf9e6f3cd138a34298Chris Lattner const LabelDecl *L = cast<loc::GotoLabel>(V).getLabel(); 11571eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1158ad8dcf4a9df0e24051dc31bf9e6f3cd138a34298Chris Lattner for (iterator I = builder.begin(), E = builder.end(); I != E; ++I) { 115924f1a967741ff9f8025ee23be12ba6feacc31f77Ted Kremenek if (I.getLabel() == L) { 1160a8538d902fce9cfec20f39b34492268b51643819Ted Kremenek builder.generateNode(I, state); 1161754607e7cff2d902d9af8b771409449fb2f8d2bfTed Kremenek return; 1162754607e7cff2d902d9af8b771409449fb2f8d2bfTed Kremenek } 1163754607e7cff2d902d9af8b771409449fb2f8d2bfTed Kremenek } 11641eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1165b219cfc4d75f0a03630b7c4509ef791b7e97b2c8David Blaikie llvm_unreachable("No block with label."); 1166754607e7cff2d902d9af8b771409449fb2f8d2bfTed Kremenek } 1167754607e7cff2d902d9af8b771409449fb2f8d2bfTed Kremenek 11681c96b24285d05c0eac455ae96d7c9ff43d42bc96Zhongxing Xu if (isa<loc::ConcreteInt>(V) || isa<UndefinedVal>(V)) { 1169754607e7cff2d902d9af8b771409449fb2f8d2bfTed Kremenek // Dispatch to the first target and mark it as a sink. 11702055effed54d614b51e3501a174c9b1fe92e4de4Zhongxing Xu //ExplodedNode* N = builder.generateNode(builder.begin(), state, true); 11712055effed54d614b51e3501a174c9b1fe92e4de4Zhongxing Xu // FIXME: add checker visit. 11722055effed54d614b51e3501a174c9b1fe92e4de4Zhongxing Xu // UndefBranches.insert(N); 1173754607e7cff2d902d9af8b771409449fb2f8d2bfTed Kremenek return; 1174754607e7cff2d902d9af8b771409449fb2f8d2bfTed Kremenek } 11751eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1176754607e7cff2d902d9af8b771409449fb2f8d2bfTed Kremenek // This is really a catch-all. We don't support symbolics yet. 1177b3cfd58c9b13325d994e5f9b5065e6a22d91911dTed Kremenek // FIXME: Implement dispatch for symbolic pointers. 11781eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1179754607e7cff2d902d9af8b771409449fb2f8d2bfTed Kremenek for (iterator I=builder.begin(), E=builder.end(); I != E; ++I) 1180a8538d902fce9cfec20f39b34492268b51643819Ted Kremenek builder.generateNode(I, state); 1181754607e7cff2d902d9af8b771409449fb2f8d2bfTed Kremenek} 1182f233d48cfc513b045e2c2cfca5c175220fbd0a82Ted Kremenek 1183d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidis/// ProcessEndPath - Called by CoreEngine. Used to generate end-of-path 118473099bfea9f5d4ec05265170bbefec3d76fb6b5eTed Kremenek/// nodes when the control reaches the end of a function. 1185af498a28797c075c48d7e943df5f5a8e78ed8eb0Anna Zaksvoid ExprEngine::processEndOfFunction(NodeBuilderContext& BC) { 1186af498a28797c075c48d7e943df5f5a8e78ed8eb0Anna Zaks StateMgr.EndPath(BC.Pred->getState()); 1187af498a28797c075c48d7e943df5f5a8e78ed8eb0Anna Zaks ExplodedNodeSet Dst; 1188af498a28797c075c48d7e943df5f5a8e78ed8eb0Anna Zaks getCheckerManager().runCheckersForEndPath(BC, Dst, *this); 11894d2ae4a70336dc2aa11389b34946be152bb454c9Anna Zaks Engine.enqueueEndOfFunction(Dst); 119073099bfea9f5d4ec05265170bbefec3d76fb6b5eTed Kremenek} 119173099bfea9f5d4ec05265170bbefec3d76fb6b5eTed Kremenek 1192d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidis/// ProcessSwitch - Called by CoreEngine. Used to generate successor 1193daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek/// nodes by processing the 'effects' of a switch statement. 1194e36de1fe51c39d9161915dd3dbef880954af6476Ted Kremenekvoid ExprEngine::processSwitch(SwitchNodeBuilder& builder) { 1195d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidis typedef SwitchNodeBuilder::iterator iterator; 11968bef8238181a30e52dea380789a7e2d760eac532Ted Kremenek ProgramStateRef state = builder.getState(); 11979c378f705405d37f49795d5e915989de774fe11fTed Kremenek const Expr *CondE = builder.getCondition(); 11985eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek SVal CondV_untested = state->getSVal(CondE, builder.getLocationContext()); 1199daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek 12005b9bd2137ebef350af803c634e3fdf5d74678100Ted Kremenek if (CondV_untested.isUndef()) { 12012055effed54d614b51e3501a174c9b1fe92e4de4Zhongxing Xu //ExplodedNode* N = builder.generateDefaultCaseNode(state, true); 1202b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek // FIXME: add checker 12032055effed54d614b51e3501a174c9b1fe92e4de4Zhongxing Xu //UndefBranches.insert(N); 12042055effed54d614b51e3501a174c9b1fe92e4de4Zhongxing Xu 1205daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek return; 1206daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek } 12075b9bd2137ebef350af803c634e3fdf5d74678100Ted Kremenek DefinedOrUnknownSVal CondV = cast<DefinedOrUnknownSVal>(CondV_untested); 1208692416c214a3b234236dedcf875735a9cc29e90bTed Kremenek 12098bef8238181a30e52dea380789a7e2d760eac532Ted Kremenek ProgramStateRef DefaultSt = state; 121034feff654c6304e0a59ceb1376989d28dbc956ffTed Kremenek 121134feff654c6304e0a59ceb1376989d28dbc956ffTed Kremenek iterator I = builder.begin(), EI = builder.end(); 121234feff654c6304e0a59ceb1376989d28dbc956ffTed Kremenek bool defaultIsFeasible = I == EI; 12131eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 121434feff654c6304e0a59ceb1376989d28dbc956ffTed Kremenek for ( ; I != EI; ++I) { 1215e71f3d587844110d836c82250830b27b1651afdbTed Kremenek // Successor may be pruned out during CFG construction. 1216e71f3d587844110d836c82250830b27b1651afdbTed Kremenek if (!I.getBlock()) 1217e71f3d587844110d836c82250830b27b1651afdbTed Kremenek continue; 1218e71f3d587844110d836c82250830b27b1651afdbTed Kremenek 12199c378f705405d37f49795d5e915989de774fe11fTed Kremenek const CaseStmt *Case = I.getCase(); 122072afb3739da0da02158242ae41a50cfe0bea78b4Ted Kremenek 122172afb3739da0da02158242ae41a50cfe0bea78b4Ted Kremenek // Evaluate the LHS of the case value. 122285df96c1f04867e26ba069aa0cc6a4cd6a01292eRichard Smith llvm::APSInt V1 = Case->getLHS()->EvaluateKnownConstInt(getContext()); 122385df96c1f04867e26ba069aa0cc6a4cd6a01292eRichard Smith assert(V1.getBitWidth() == getContext().getTypeSize(CondE->getType())); 12241eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1225daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek // Get the RHS of the case, if it exists. 122685df96c1f04867e26ba069aa0cc6a4cd6a01292eRichard Smith llvm::APSInt V2; 122785df96c1f04867e26ba069aa0cc6a4cd6a01292eRichard Smith if (const Expr *E = Case->getRHS()) 122885df96c1f04867e26ba069aa0cc6a4cd6a01292eRichard Smith V2 = E->EvaluateKnownConstInt(getContext()); 122914a1140c9f4e20b12a54db8745b74699b9872cd2Ted Kremenek else 123014a1140c9f4e20b12a54db8745b74699b9872cd2Ted Kremenek V2 = V1; 12311eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1232daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek // FIXME: Eventually we should replace the logic below with a range 1233daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek // comparison, rather than concretize the values within the range. 1234aa1c4e5a6b87b62d991c55a0d4522bcd778068d7Ted Kremenek // This should be easy once we have "ranges" for NonLVals. 12351eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 123614a1140c9f4e20b12a54db8745b74699b9872cd2Ted Kremenek do { 123785df96c1f04867e26ba069aa0cc6a4cd6a01292eRichard Smith nonloc::ConcreteInt CaseVal(getBasicVals().getValue(V1)); 12389c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek DefinedOrUnknownSVal Res = svalBuilder.evalEQ(DefaultSt ? DefaultSt : state, 123948569f9562740ac1f4b175cb17ce3d49035402c4Ted Kremenek CondV, CaseVal); 1240b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 12411eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump // Now "assume" that the case matches. 12428bef8238181a30e52dea380789a7e2d760eac532Ted Kremenek if (ProgramStateRef stateNew = state->assume(Res, true)) { 1243a591bc04d21fa62ebffcb2c7814d738ca8f5e2f9Ted Kremenek builder.generateCaseStmtNode(I, stateNew); 12441eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1245daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek // If CondV evaluates to a constant, then we know that this 1246daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek // is the *only* case that we can take, so stop evaluating the 1247daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek // others. 12481c96b24285d05c0eac455ae96d7c9ff43d42bc96Zhongxing Xu if (isa<nonloc::ConcreteInt>(CondV)) 1249daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek return; 1250daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek } 12511eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1252daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek // Now "assume" that the case doesn't match. Add this state 1253daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek // to the default state (if it is feasible). 125448569f9562740ac1f4b175cb17ce3d49035402c4Ted Kremenek if (DefaultSt) { 12558bef8238181a30e52dea380789a7e2d760eac532Ted Kremenek if (ProgramStateRef stateNew = DefaultSt->assume(Res, false)) { 125648569f9562740ac1f4b175cb17ce3d49035402c4Ted Kremenek defaultIsFeasible = true; 125748569f9562740ac1f4b175cb17ce3d49035402c4Ted Kremenek DefaultSt = stateNew; 125848569f9562740ac1f4b175cb17ce3d49035402c4Ted Kremenek } 125948569f9562740ac1f4b175cb17ce3d49035402c4Ted Kremenek else { 126048569f9562740ac1f4b175cb17ce3d49035402c4Ted Kremenek defaultIsFeasible = false; 126148569f9562740ac1f4b175cb17ce3d49035402c4Ted Kremenek DefaultSt = NULL; 126248569f9562740ac1f4b175cb17ce3d49035402c4Ted Kremenek } 12635014ab113eb211b8320ae30b173d7020352663c6Ted Kremenek } 1264b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 126514a1140c9f4e20b12a54db8745b74699b9872cd2Ted Kremenek // Concretize the next value in the range. 126685df96c1f04867e26ba069aa0cc6a4cd6a01292eRichard Smith if (V1 == V2) 126714a1140c9f4e20b12a54db8745b74699b9872cd2Ted Kremenek break; 12681eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 126985df96c1f04867e26ba069aa0cc6a4cd6a01292eRichard Smith ++V1; 127085df96c1f04867e26ba069aa0cc6a4cd6a01292eRichard Smith assert (V1 <= V2); 12711eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 127214a1140c9f4e20b12a54db8745b74699b9872cd2Ted Kremenek } while (true); 1273daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek } 12741eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 12754d3175c1e5a44251ea97b0c81e80f060629d9c08Ted Kremenek if (!defaultIsFeasible) 12764d3175c1e5a44251ea97b0c81e80f060629d9c08Ted Kremenek return; 12774d3175c1e5a44251ea97b0c81e80f060629d9c08Ted Kremenek 12784d3175c1e5a44251ea97b0c81e80f060629d9c08Ted Kremenek // If we have switch(enum value), the default branch is not 12794d3175c1e5a44251ea97b0c81e80f060629d9c08Ted Kremenek // feasible if all of the enum constants not covered by 'case:' statements 12804d3175c1e5a44251ea97b0c81e80f060629d9c08Ted Kremenek // are not feasible values for the switch condition. 12814d3175c1e5a44251ea97b0c81e80f060629d9c08Ted Kremenek // 12824d3175c1e5a44251ea97b0c81e80f060629d9c08Ted Kremenek // Note that this isn't as accurate as it could be. Even if there isn't 12834d3175c1e5a44251ea97b0c81e80f060629d9c08Ted Kremenek // a case for a particular enum value as long as that enum value isn't 12844d3175c1e5a44251ea97b0c81e80f060629d9c08Ted Kremenek // feasible then it shouldn't be considered for making 'default:' reachable. 12854d3175c1e5a44251ea97b0c81e80f060629d9c08Ted Kremenek const SwitchStmt *SS = builder.getSwitch(); 12864d3175c1e5a44251ea97b0c81e80f060629d9c08Ted Kremenek const Expr *CondExpr = SS->getCond()->IgnoreParenImpCasts(); 12874d3175c1e5a44251ea97b0c81e80f060629d9c08Ted Kremenek if (CondExpr->getType()->getAs<EnumType>()) { 12884d3175c1e5a44251ea97b0c81e80f060629d9c08Ted Kremenek if (SS->isAllEnumCasesCovered()) 12894d3175c1e5a44251ea97b0c81e80f060629d9c08Ted Kremenek return; 12904d3175c1e5a44251ea97b0c81e80f060629d9c08Ted Kremenek } 12914d3175c1e5a44251ea97b0c81e80f060629d9c08Ted Kremenek 12924d3175c1e5a44251ea97b0c81e80f060629d9c08Ted Kremenek builder.generateDefaultCaseNode(DefaultSt); 1293daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek} 1294daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek 1295e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek//===----------------------------------------------------------------------===// 1296ec96a2d52d16e150baaf629cd35e3fabff5d8915Ted Kremenek// Transfer functions: Loads and stores. 1297e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek//===----------------------------------------------------------------------===// 1298d27f8169f4b68337a489547a41ac45bf7a5d1ddfTed Kremenek 1299d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidisvoid ExprEngine::VisitCommonDeclRefExpr(const Expr *Ex, const NamedDecl *D, 1300d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidis ExplodedNode *Pred, 1301d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidis ExplodedNodeSet &Dst) { 1302aa0aeb1cbe117db68d35700cb3a34aace0f99b99Anna Zaks StmtNodeBuilder Bldr(Pred, Dst, *currentBuilderContext); 1303ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks 13048bef8238181a30e52dea380789a7e2d760eac532Ted Kremenek ProgramStateRef state = Pred->getState(); 13055eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek const LocationContext *LCtx = Pred->getLocationContext(); 13066d69b5d82281992e981caa9bc038e3f6cac6594aZhongxing Xu 13079c378f705405d37f49795d5e915989de774fe11fTed Kremenek if (const VarDecl *VD = dyn_cast<VarDecl>(D)) { 1308892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek assert(Ex->isLValue()); 1309d17da2b99f323fa91b01e1dd119cc32e0ee8197dTed Kremenek SVal V = state->getLValue(VD, Pred->getLocationContext()); 1310a7581731b1453b51b26154d2409d42a5b6395079Zhongxing Xu 1311892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek // For references, the 'lvalue' is the pointer address stored in the 1312892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek // reference region. 1313892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek if (VD->getType()->isReferenceType()) { 1314892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek if (const MemRegion *R = V.getAsRegion()) 1315892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek V = state->getSVal(R); 1316892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek else 1317892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek V = UnknownVal(); 1318852274d4257134906995cb252fb3dfd2d71deae8Ted Kremenek } 13196d69b5d82281992e981caa9bc038e3f6cac6594aZhongxing Xu 13205eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek Bldr.generateNode(Ex, Pred, state->BindExpr(Ex, LCtx, V), false, 0, 1321ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks ProgramPoint::PostLValueKind); 1322852274d4257134906995cb252fb3dfd2d71deae8Ted Kremenek return; 1323892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek } 13249c378f705405d37f49795d5e915989de774fe11fTed Kremenek if (const EnumConstantDecl *ED = dyn_cast<EnumConstantDecl>(D)) { 1325892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek assert(!Ex->isLValue()); 1326c8413fd03f73084a5c93028f8b4db619fc388087Ted Kremenek SVal V = svalBuilder.makeIntVal(ED->getInitVal()); 13275eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek Bldr.generateNode(Ex, Pred, state->BindExpr(Ex, LCtx, V)); 13286d69b5d82281992e981caa9bc038e3f6cac6594aZhongxing Xu return; 1329892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek } 13309c378f705405d37f49795d5e915989de774fe11fTed Kremenek if (const FunctionDecl *FD = dyn_cast<FunctionDecl>(D)) { 1331c8413fd03f73084a5c93028f8b4db619fc388087Ted Kremenek SVal V = svalBuilder.getFunctionPointer(FD); 13325eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek Bldr.generateNode(Ex, Pred, state->BindExpr(Ex, LCtx, V), false, 0, 1333ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks ProgramPoint::PostLValueKind); 13346d69b5d82281992e981caa9bc038e3f6cac6594aZhongxing Xu return; 13351b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek } 13366d69b5d82281992e981caa9bc038e3f6cac6594aZhongxing Xu assert (false && 13376d69b5d82281992e981caa9bc038e3f6cac6594aZhongxing Xu "ValueDecl support for this ValueDecl not implemented."); 13383271f8d315712885ac87747369bb1d9f4b1ea81fTed Kremenek} 13393271f8d315712885ac87747369bb1d9f4b1ea81fTed Kremenek 1340540cbe2b60294fe7b926c26b4f1840f544fe3011Ted Kremenek/// VisitArraySubscriptExpr - Transfer function for array accesses 13419c378f705405d37f49795d5e915989de774fe11fTed Kremenekvoid ExprEngine::VisitLvalArraySubscriptExpr(const ArraySubscriptExpr *A, 13429c378f705405d37f49795d5e915989de774fe11fTed Kremenek ExplodedNode *Pred, 13439c378f705405d37f49795d5e915989de774fe11fTed Kremenek ExplodedNodeSet &Dst){ 13441eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 13459c378f705405d37f49795d5e915989de774fe11fTed Kremenek const Expr *Base = A->getBase()->IgnoreParens(); 13469c378f705405d37f49795d5e915989de774fe11fTed Kremenek const Expr *Idx = A->getIdx()->IgnoreParens(); 1347892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek 13481eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 13498f3407ef22bc7efe6ca4169381e09d0d657ec192Ted Kremenek ExplodedNodeSet checkerPreStmt; 13508f3407ef22bc7efe6ca4169381e09d0d657ec192Ted Kremenek getCheckerManager().runCheckersForPreStmt(checkerPreStmt, Pred, A, *this); 13518f3407ef22bc7efe6ca4169381e09d0d657ec192Ted Kremenek 1352aa0aeb1cbe117db68d35700cb3a34aace0f99b99Anna Zaks StmtNodeBuilder Bldr(checkerPreStmt, Dst, *currentBuilderContext); 1353ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks 13548f3407ef22bc7efe6ca4169381e09d0d657ec192Ted Kremenek for (ExplodedNodeSet::iterator it = checkerPreStmt.begin(), 13558f3407ef22bc7efe6ca4169381e09d0d657ec192Ted Kremenek ei = checkerPreStmt.end(); it != ei; ++it) { 13565eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek const LocationContext *LCtx = (*it)->getLocationContext(); 13578bef8238181a30e52dea380789a7e2d760eac532Ted Kremenek ProgramStateRef state = (*it)->getState(); 13585eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek SVal V = state->getLValue(A->getType(), 13595eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek state->getSVal(Idx, LCtx), 13605eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek state->getSVal(Base, LCtx)); 13618f3407ef22bc7efe6ca4169381e09d0d657ec192Ted Kremenek assert(A->isLValue()); 13625eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek Bldr.generateNode(A, *it, state->BindExpr(A, LCtx, V), 1363ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks false, 0, ProgramPoint::PostLValueKind); 13641b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek } 1365540cbe2b60294fe7b926c26b4f1840f544fe3011Ted Kremenek} 1366540cbe2b60294fe7b926c26b4f1840f544fe3011Ted Kremenek 1367469ecbded3616416ef938ed94a67f86149faf226Ted Kremenek/// VisitMemberExpr - Transfer function for member expressions. 13689c378f705405d37f49795d5e915989de774fe11fTed Kremenekvoid ExprEngine::VisitMemberExpr(const MemberExpr *M, ExplodedNode *Pred, 13696889679d72859960e0fc8d1080487f63c4df1e0aAnna Zaks ExplodedNodeSet &TopDst) { 13701eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 13716889679d72859960e0fc8d1080487f63c4df1e0aAnna Zaks StmtNodeBuilder Bldr(Pred, TopDst, *currentBuilderContext); 13726889679d72859960e0fc8d1080487f63c4df1e0aAnna Zaks ExplodedNodeSet Dst; 13735bd04952d4ae7ca894f583583208f0cec4735a90Ted Kremenek Decl *member = M->getMemberDecl(); 13745bd04952d4ae7ca894f583583208f0cec4735a90Ted Kremenek if (VarDecl *VD = dyn_cast<VarDecl>(member)) { 13755bd04952d4ae7ca894f583583208f0cec4735a90Ted Kremenek assert(M->isLValue()); 1376ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.takeNodes(Pred); 13775bd04952d4ae7ca894f583583208f0cec4735a90Ted Kremenek VisitCommonDeclRefExpr(M, VD, Pred, Dst); 1378ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.addNodes(Dst); 13795bd04952d4ae7ca894f583583208f0cec4735a90Ted Kremenek return; 13805bd04952d4ae7ca894f583583208f0cec4735a90Ted Kremenek } 13815bd04952d4ae7ca894f583583208f0cec4735a90Ted Kremenek 13825bd04952d4ae7ca894f583583208f0cec4735a90Ted Kremenek FieldDecl *field = dyn_cast<FieldDecl>(member); 1383892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek if (!field) // FIXME: skipping member expressions for non-fields 138486f194083504938df72135b5b66bf0c5cafd9498Douglas Gregor return; 138586f194083504938df72135b5b66bf0c5cafd9498Douglas Gregor 1386e3939d7446959afb6b650fe08e952d0f64ab6794Ted Kremenek Expr *baseExpr = M->getBase()->IgnoreParens(); 13878bef8238181a30e52dea380789a7e2d760eac532Ted Kremenek ProgramStateRef state = Pred->getState(); 13885eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek const LocationContext *LCtx = Pred->getLocationContext(); 13895eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek SVal baseExprVal = state->getSVal(baseExpr, Pred->getLocationContext()); 1390e3939d7446959afb6b650fe08e952d0f64ab6794Ted Kremenek if (isa<nonloc::LazyCompoundVal>(baseExprVal) || 1391e3939d7446959afb6b650fe08e952d0f64ab6794Ted Kremenek isa<nonloc::CompoundVal>(baseExprVal) || 1392e3939d7446959afb6b650fe08e952d0f64ab6794Ted Kremenek // FIXME: This can originate by conjuring a symbol for an unknown 1393e3939d7446959afb6b650fe08e952d0f64ab6794Ted Kremenek // temporary struct object, see test/Analysis/fields.c: 1394e3939d7446959afb6b650fe08e952d0f64ab6794Ted Kremenek // (p = getit()).x 1395e3939d7446959afb6b650fe08e952d0f64ab6794Ted Kremenek isa<nonloc::SymbolVal>(baseExprVal)) { 13965eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek Bldr.generateNode(M, Pred, state->BindExpr(M, LCtx, UnknownVal())); 1397e3939d7446959afb6b650fe08e952d0f64ab6794Ted Kremenek return; 1398e3939d7446959afb6b650fe08e952d0f64ab6794Ted Kremenek } 1399892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek 1400e3939d7446959afb6b650fe08e952d0f64ab6794Ted Kremenek // FIXME: Should we insert some assumption logic in here to determine 1401e3939d7446959afb6b650fe08e952d0f64ab6794Ted Kremenek // if "Base" is a valid piece of memory? Before we put this assumption 1402e3939d7446959afb6b650fe08e952d0f64ab6794Ted Kremenek // later when using FieldOffset lvals (which we no longer have). 1403d9bc33efa195114d6f2a365c26e5b8dba4e1cc38Ted Kremenek 1404e3939d7446959afb6b650fe08e952d0f64ab6794Ted Kremenek // For all other cases, compute an lvalue. 1405e3939d7446959afb6b650fe08e952d0f64ab6794Ted Kremenek SVal L = state->getLValue(field, baseExprVal); 1406e3939d7446959afb6b650fe08e952d0f64ab6794Ted Kremenek if (M->isLValue()) 14075eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek Bldr.generateNode(M, Pred, state->BindExpr(M, LCtx, L), false, 0, 1408ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks ProgramPoint::PostLValueKind); 1409ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks else { 1410ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.takeNodes(Pred); 1411e3939d7446959afb6b650fe08e952d0f64ab6794Ted Kremenek evalLoad(Dst, M, Pred, state, L); 1412ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.addNodes(Dst); 1413ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks } 1414469ecbded3616416ef938ed94a67f86149faf226Ted Kremenek} 1415469ecbded3616416ef938ed94a67f86149faf226Ted Kremenek 14169c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek/// evalBind - Handle the semantics of binding a value to a specific location. 14179c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek/// This method is used by evalStore and (soon) VisitDeclStmt, and others. 14189c378f705405d37f49795d5e915989de774fe11fTed Kremenekvoid ExprEngine::evalBind(ExplodedNodeSet &Dst, const Stmt *StoreE, 141993bd5ca766c4d7906878f4ffe76ce1b2080e540bJordy Rose ExplodedNode *Pred, 1420ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks SVal location, SVal Val, bool atDeclInit, 1421ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks ProgramPoint::Kind PointKind) { 1422b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 1423b107c4b7efb907d75620cd3c17f82fe27dc5b745Ted Kremenek // Do a previsit of the bind. 1424fe27971d54d26997149d6b84057f04ff398d1d5dJordy Rose ExplodedNodeSet CheckedSet; 1425fe27971d54d26997149d6b84057f04ff398d1d5dJordy Rose getCheckerManager().runCheckersForBind(CheckedSet, Pred, location, Val, 1426ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks StoreE, *this, PointKind); 1427b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 1428d231d0130a95336610ab9a42eaeb2cdac19992f3Anna Zaks // TODO:AZ Remove TmpDst after NB refactoring is done. 14296b6152ba96c164a292cc0b8d8b1d4cecbec27a60Anna Zaks ExplodedNodeSet TmpDst; 1430aa0aeb1cbe117db68d35700cb3a34aace0f99b99Anna Zaks StmtNodeBuilder Bldr(CheckedSet, TmpDst, *currentBuilderContext); 14316b6152ba96c164a292cc0b8d8b1d4cecbec27a60Anna Zaks 1432b107c4b7efb907d75620cd3c17f82fe27dc5b745Ted Kremenek for (ExplodedNodeSet::iterator I = CheckedSet.begin(), E = CheckedSet.end(); 1433b107c4b7efb907d75620cd3c17f82fe27dc5b745Ted Kremenek I!=E; ++I) { 14348bef8238181a30e52dea380789a7e2d760eac532Ted Kremenek ProgramStateRef state = (*I)->getState(); 1435a8538d902fce9cfec20f39b34492268b51643819Ted Kremenek 1436b107c4b7efb907d75620cd3c17f82fe27dc5b745Ted Kremenek if (atDeclInit) { 1437b107c4b7efb907d75620cd3c17f82fe27dc5b745Ted Kremenek const VarRegion *VR = 1438b107c4b7efb907d75620cd3c17f82fe27dc5b745Ted Kremenek cast<VarRegion>(cast<loc::MemRegionVal>(location).getRegion()); 1439f6f56d4fc8ebce17e7b83eb2c35f57a055c22283Ted Kremenek 1440fe27971d54d26997149d6b84057f04ff398d1d5dJordy Rose state = state->bindDecl(VR, Val); 1441fe27971d54d26997149d6b84057f04ff398d1d5dJordy Rose } else { 1442fe27971d54d26997149d6b84057f04ff398d1d5dJordy Rose state = state->bindLoc(location, Val); 1443f6f56d4fc8ebce17e7b83eb2c35f57a055c22283Ted Kremenek } 14441eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1445ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.generateNode(StoreE, *I, state, false, 0, PointKind); 1446b107c4b7efb907d75620cd3c17f82fe27dc5b745Ted Kremenek } 1447ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks 14486b6152ba96c164a292cc0b8d8b1d4cecbec27a60Anna Zaks Dst.insert(TmpDst); 1449a8538d902fce9cfec20f39b34492268b51643819Ted Kremenek} 1450a8538d902fce9cfec20f39b34492268b51643819Ted Kremenek 14519c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek/// evalStore - Handle the semantics of a store via an assignment. 1452a8538d902fce9cfec20f39b34492268b51643819Ted Kremenek/// @param Dst The node set to store generated state nodes 1453e8a4d7d0064b357a30fe7ee4f2ddc02f9ffc0357Zhongxing Xu/// @param AssignE The assignment expression if the store happens in an 1454e8a4d7d0064b357a30fe7ee4f2ddc02f9ffc0357Zhongxing Xu/// assignment. 1455e8a4d7d0064b357a30fe7ee4f2ddc02f9ffc0357Zhongxing Xu/// @param LocatioinE The location expression that is stored to. 1456a8538d902fce9cfec20f39b34492268b51643819Ted Kremenek/// @param state The current simulation state 1457a8538d902fce9cfec20f39b34492268b51643819Ted Kremenek/// @param location The location to store the value 1458a8538d902fce9cfec20f39b34492268b51643819Ted Kremenek/// @param Val The value to be stored 14599c378f705405d37f49795d5e915989de774fe11fTed Kremenekvoid ExprEngine::evalStore(ExplodedNodeSet &Dst, const Expr *AssignE, 14609c378f705405d37f49795d5e915989de774fe11fTed Kremenek const Expr *LocationE, 14619c378f705405d37f49795d5e915989de774fe11fTed Kremenek ExplodedNode *Pred, 14628bef8238181a30e52dea380789a7e2d760eac532Ted Kremenek ProgramStateRef state, SVal location, SVal Val, 1463ca804539d908d3a0e8c72a0df5f1f571d29490bbTed Kremenek const ProgramPointTag *tag) { 146414429b918bd2f4cb52abc75546a7fe37142054caArgyrios Kyrtzidis // Proceed with the store. We use AssignE as the anchor for the PostStore 146514429b918bd2f4cb52abc75546a7fe37142054caArgyrios Kyrtzidis // ProgramPoint if it is non-NULL, and LocationE otherwise. 146614429b918bd2f4cb52abc75546a7fe37142054caArgyrios Kyrtzidis const Expr *StoreE = AssignE ? AssignE : LocationE; 146714429b918bd2f4cb52abc75546a7fe37142054caArgyrios Kyrtzidis 146814429b918bd2f4cb52abc75546a7fe37142054caArgyrios Kyrtzidis if (isa<loc::ObjCPropRef>(location)) { 1469b673a41c92aa276f2e37164d0747be1cfb0c402bTed Kremenek assert(false); 147014429b918bd2f4cb52abc75546a7fe37142054caArgyrios Kyrtzidis } 147114429b918bd2f4cb52abc75546a7fe37142054caArgyrios Kyrtzidis 14721b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek // Evaluate the location (checks for bad dereferences). 1473b4b817d704287836b52b34369009e682f208aa2bTed Kremenek ExplodedNodeSet Tmp; 14749c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek evalLocation(Tmp, LocationE, Pred, state, location, tag, false); 14751eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1476b4b817d704287836b52b34369009e682f208aa2bTed Kremenek if (Tmp.empty()) 14771b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek return; 1478b0533965f1b4db020692e3b23ca7b3bc15bf5897Ted Kremenek 147973c498a08f4968b6987d1453c7b77929dcc6d5f7Argyrios Kyrtzidis if (location.isUndef()) 148073c498a08f4968b6987d1453c7b77929dcc6d5f7Argyrios Kyrtzidis return; 1481a8538d902fce9cfec20f39b34492268b51643819Ted Kremenek 1482b4b817d704287836b52b34369009e682f208aa2bTed Kremenek for (ExplodedNodeSet::iterator NI=Tmp.begin(), NE=Tmp.end(); NI!=NE; ++NI) 1483ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks evalBind(Dst, StoreE, *NI, location, Val, false, 1484ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks ProgramPoint::PostStoreKind); 14851b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek} 14861b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek 14879c378f705405d37f49795d5e915989de774fe11fTed Kremenekvoid ExprEngine::evalLoad(ExplodedNodeSet &Dst, const Expr *Ex, 14889c378f705405d37f49795d5e915989de774fe11fTed Kremenek ExplodedNode *Pred, 14898bef8238181a30e52dea380789a7e2d760eac532Ted Kremenek ProgramStateRef state, SVal location, 1490ca804539d908d3a0e8c72a0df5f1f571d29490bbTed Kremenek const ProgramPointTag *tag, QualType LoadTy) { 1491cca8ab155e8c20b98ba2d90eb2b1c228895e06fdZhanyong Wan assert(!isa<NonLoc>(location) && "location cannot be a NonLoc."); 14921b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek 149314429b918bd2f4cb52abc75546a7fe37142054caArgyrios Kyrtzidis if (isa<loc::ObjCPropRef>(location)) { 1494b673a41c92aa276f2e37164d0747be1cfb0c402bTed Kremenek assert(false); 149514429b918bd2f4cb52abc75546a7fe37142054caArgyrios Kyrtzidis } 149614429b918bd2f4cb52abc75546a7fe37142054caArgyrios Kyrtzidis 1497852274d4257134906995cb252fb3dfd2d71deae8Ted Kremenek // Are we loading from a region? This actually results in two loads; one 1498852274d4257134906995cb252fb3dfd2d71deae8Ted Kremenek // to fetch the address of the referenced value and one to fetch the 1499852274d4257134906995cb252fb3dfd2d71deae8Ted Kremenek // referenced value. 15009697934650354bed2e509d8e7e44f21a1fb00f76Ted Kremenek if (const TypedValueRegion *TR = 15019697934650354bed2e509d8e7e44f21a1fb00f76Ted Kremenek dyn_cast_or_null<TypedValueRegion>(location.getAsRegion())) { 1502b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 1503018220c343c103b7dfaa117a7a474c7a7fd6d068Zhongxing Xu QualType ValTy = TR->getValueType(); 1504852274d4257134906995cb252fb3dfd2d71deae8Ted Kremenek if (const ReferenceType *RT = ValTy->getAs<ReferenceType>()) { 1505ca804539d908d3a0e8c72a0df5f1f571d29490bbTed Kremenek static SimpleProgramPointTag 1506ca804539d908d3a0e8c72a0df5f1f571d29490bbTed Kremenek loadReferenceTag("ExprEngine : Load Reference"); 1507852274d4257134906995cb252fb3dfd2d71deae8Ted Kremenek ExplodedNodeSet Tmp; 15089c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek evalLoadCommon(Tmp, Ex, Pred, state, location, &loadReferenceTag, 1509852274d4257134906995cb252fb3dfd2d71deae8Ted Kremenek getContext().getPointerType(RT->getPointeeType())); 1510852274d4257134906995cb252fb3dfd2d71deae8Ted Kremenek 1511852274d4257134906995cb252fb3dfd2d71deae8Ted Kremenek // Perform the load from the referenced value. 1512852274d4257134906995cb252fb3dfd2d71deae8Ted Kremenek for (ExplodedNodeSet::iterator I=Tmp.begin(), E=Tmp.end() ; I!=E; ++I) { 1513db5e8cd095d1ffdd18f5620ad2348b5f386bebe3Anna Zaks state = (*I)->getState(); 15145eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek location = state->getSVal(Ex, (*I)->getLocationContext()); 15159c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek evalLoadCommon(Dst, Ex, *I, state, location, tag, LoadTy); 1516b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek } 1517852274d4257134906995cb252fb3dfd2d71deae8Ted Kremenek return; 1518852274d4257134906995cb252fb3dfd2d71deae8Ted Kremenek } 1519852274d4257134906995cb252fb3dfd2d71deae8Ted Kremenek } 1520b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 15219c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek evalLoadCommon(Dst, Ex, Pred, state, location, tag, LoadTy); 1522852274d4257134906995cb252fb3dfd2d71deae8Ted Kremenek} 1523852274d4257134906995cb252fb3dfd2d71deae8Ted Kremenek 15249c378f705405d37f49795d5e915989de774fe11fTed Kremenekvoid ExprEngine::evalLoadCommon(ExplodedNodeSet &Dst, const Expr *Ex, 15259c378f705405d37f49795d5e915989de774fe11fTed Kremenek ExplodedNode *Pred, 15268bef8238181a30e52dea380789a7e2d760eac532Ted Kremenek ProgramStateRef state, SVal location, 1527ca804539d908d3a0e8c72a0df5f1f571d29490bbTed Kremenek const ProgramPointTag *tag, QualType LoadTy) { 1528b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 15291eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump // Evaluate the location (checks for bad dereferences). 1530b4b817d704287836b52b34369009e682f208aa2bTed Kremenek ExplodedNodeSet Tmp; 15319c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek evalLocation(Tmp, Ex, Pred, state, location, tag, true); 1532b4b817d704287836b52b34369009e682f208aa2bTed Kremenek if (Tmp.empty()) 15331b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek return; 1534b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 1535aa0aeb1cbe117db68d35700cb3a34aace0f99b99Anna Zaks StmtNodeBuilder Bldr(Tmp, Dst, *currentBuilderContext); 153673c498a08f4968b6987d1453c7b77929dcc6d5f7Argyrios Kyrtzidis if (location.isUndef()) 153773c498a08f4968b6987d1453c7b77929dcc6d5f7Argyrios Kyrtzidis return; 1538b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 15391b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek // Proceed with the load. 1540b4b817d704287836b52b34369009e682f208aa2bTed Kremenek for (ExplodedNodeSet::iterator NI=Tmp.begin(), NE=Tmp.end(); NI!=NE; ++NI) { 1541db5e8cd095d1ffdd18f5620ad2348b5f386bebe3Anna Zaks state = (*NI)->getState(); 15425eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek const LocationContext *LCtx = (*NI)->getLocationContext(); 154396ebad66c451d79c9f57b1edb31efaeeb23b9a01Ted Kremenek 1544b4b817d704287836b52b34369009e682f208aa2bTed Kremenek if (location.isUnknown()) { 1545b4b817d704287836b52b34369009e682f208aa2bTed Kremenek // This is important. We must nuke the old binding. 15465eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek Bldr.generateNode(Ex, *NI, state->BindExpr(Ex, LCtx, UnknownVal()), 1547ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks false, tag, ProgramPoint::PostLoadKind); 1548b4b817d704287836b52b34369009e682f208aa2bTed Kremenek } 1549b4b817d704287836b52b34369009e682f208aa2bTed Kremenek else { 155096ebad66c451d79c9f57b1edb31efaeeb23b9a01Ted Kremenek if (LoadTy.isNull()) 155196ebad66c451d79c9f57b1edb31efaeeb23b9a01Ted Kremenek LoadTy = Ex->getType(); 155296ebad66c451d79c9f57b1edb31efaeeb23b9a01Ted Kremenek SVal V = state->getSVal(cast<Loc>(location), LoadTy); 15535eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek Bldr.generateNode(Ex, *NI, state->bindExprAndLocation(Ex, LCtx, 15545eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek location, V), 1555ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks false, tag, ProgramPoint::PostLoadKind); 1556b4b817d704287836b52b34369009e682f208aa2bTed Kremenek } 1557d5b499d43c3526fae7f9ebb6e2d50e79d3496cedZhongxing Xu } 15581b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek} 15591b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek 1560d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidisvoid ExprEngine::evalLocation(ExplodedNodeSet &Dst, const Stmt *S, 15619c378f705405d37f49795d5e915989de774fe11fTed Kremenek ExplodedNode *Pred, 15628bef8238181a30e52dea380789a7e2d760eac532Ted Kremenek ProgramStateRef state, SVal location, 1563ca804539d908d3a0e8c72a0df5f1f571d29490bbTed Kremenek const ProgramPointTag *tag, bool isLoad) { 1564aa0aeb1cbe117db68d35700cb3a34aace0f99b99Anna Zaks StmtNodeBuilder BldrTop(Pred, Dst, *currentBuilderContext); 156500b1ad2d56f3e39f95c3f61bf511a531ab6a4fa5Zhongxing Xu // Early checks for performance reason. 1566769ce3e93ad35bd9ac28e4d8b8f035ae4fd9a5b5Argyrios Kyrtzidis if (location.isUnknown()) { 1567b4b817d704287836b52b34369009e682f208aa2bTed Kremenek return; 1568b4b817d704287836b52b34369009e682f208aa2bTed Kremenek } 1569b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 15709c0d6891b3ec4b0d20b8a295946c0dc5426d147cArgyrios Kyrtzidis ExplodedNodeSet Src; 1571ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks BldrTop.takeNodes(Pred); 1572aa0aeb1cbe117db68d35700cb3a34aace0f99b99Anna Zaks StmtNodeBuilder Bldr(Pred, Src, *currentBuilderContext); 1573ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks if (Pred->getState() != state) { 1574eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis // Associate this new state with an ExplodedNode. 1575eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis // FIXME: If I pass null tag, the graph is incorrect, e.g for 1576eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis // int *p; 1577eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis // p = 0; 1578eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis // *p = 0xDEADBEEF; 1579eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis // "p = 0" is not noted as "Null pointer value stored to 'p'" but 1580eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis // instead "int *p" is noted as 1581eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis // "Variable 'p' initialized to a null pointer value" 1582ca804539d908d3a0e8c72a0df5f1f571d29490bbTed Kremenek 1583ca804539d908d3a0e8c72a0df5f1f571d29490bbTed Kremenek // FIXME: why is 'tag' not used instead of etag? 1584ca804539d908d3a0e8c72a0df5f1f571d29490bbTed Kremenek static SimpleProgramPointTag etag("ExprEngine: Location"); 1585ca804539d908d3a0e8c72a0df5f1f571d29490bbTed Kremenek 1586ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.generateNode(S, Pred, state, false, &etag); 15870296c22557b3735e2ffeff690eb46fb0e9152bccTed Kremenek } 1588ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks ExplodedNodeSet Tmp; 1589ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks getCheckerManager().runCheckersForLocation(Tmp, Src, location, isLoad, S, 1590eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis *this); 1591ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks BldrTop.addNodes(Tmp); 1592ec96a2d52d16e150baaf629cd35e3fabff5d8915Ted Kremenek} 1593ec96a2d52d16e150baaf629cd35e3fabff5d8915Ted Kremenek 15946c7511db998817e64f2e124013e7d7c9a430c580Ted Kremenekstd::pair<const ProgramPointTag *, const ProgramPointTag*> 15956c7511db998817e64f2e124013e7d7c9a430c580Ted KremenekExprEngine::getEagerlyAssumeTags() { 15966c7511db998817e64f2e124013e7d7c9a430c580Ted Kremenek static SimpleProgramPointTag 15976c7511db998817e64f2e124013e7d7c9a430c580Ted Kremenek EagerlyAssumeTrue("ExprEngine : Eagerly Assume True"), 15986c7511db998817e64f2e124013e7d7c9a430c580Ted Kremenek EagerlyAssumeFalse("ExprEngine : Eagerly Assume False"); 15996c7511db998817e64f2e124013e7d7c9a430c580Ted Kremenek return std::make_pair(&EagerlyAssumeTrue, &EagerlyAssumeFalse); 16006c7511db998817e64f2e124013e7d7c9a430c580Ted Kremenek} 16016c7511db998817e64f2e124013e7d7c9a430c580Ted Kremenek 1602d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidisvoid ExprEngine::evalEagerlyAssume(ExplodedNodeSet &Dst, ExplodedNodeSet &Src, 16036800ba622e4edf287801ac69c42c61e7e294b06bAnna Zaks const Expr *Ex) { 1604aa0aeb1cbe117db68d35700cb3a34aace0f99b99Anna Zaks StmtNodeBuilder Bldr(Src, Dst, *currentBuilderContext); 160586b39f20d5091ca3fdcbeb4a22766aaffdf6ac35Ted Kremenek 1606031ccc0555a82afc2e8afe29e19dd57ff204e2deZhongxing Xu for (ExplodedNodeSet::iterator I=Src.begin(), E=Src.end(); I!=E; ++I) { 1607031ccc0555a82afc2e8afe29e19dd57ff204e2deZhongxing Xu ExplodedNode *Pred = *I; 1608b293902c5cfa18365ffb0e00763849c9808a2ad1Ted Kremenek // Test if the previous node was as the same expression. This can happen 1609b293902c5cfa18365ffb0e00763849c9808a2ad1Ted Kremenek // when the expression fails to evaluate to anything meaningful and 1610b293902c5cfa18365ffb0e00763849c9808a2ad1Ted Kremenek // (as an optimization) we don't generate a node. 16111eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump ProgramPoint P = Pred->getLocation(); 1612b293902c5cfa18365ffb0e00763849c9808a2ad1Ted Kremenek if (!isa<PostStmt>(P) || cast<PostStmt>(P).getStmt() != Ex) { 1613b293902c5cfa18365ffb0e00763849c9808a2ad1Ted Kremenek continue; 16141eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump } 1615b293902c5cfa18365ffb0e00763849c9808a2ad1Ted Kremenek 16168bef8238181a30e52dea380789a7e2d760eac532Ted Kremenek ProgramStateRef state = Pred->getState(); 16175eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek SVal V = state->getSVal(Ex, Pred->getLocationContext()); 16185344baa704f42b22d9df25c24ffbbf6b4716603bAnna Zaks nonloc::SymbolVal *SEV = dyn_cast<nonloc::SymbolVal>(&V); 16195344baa704f42b22d9df25c24ffbbf6b4716603bAnna Zaks if (SEV && SEV->isExpression()) { 16206c7511db998817e64f2e124013e7d7c9a430c580Ted Kremenek const std::pair<const ProgramPointTag *, const ProgramPointTag*> &tags = 16216c7511db998817e64f2e124013e7d7c9a430c580Ted Kremenek getEagerlyAssumeTags(); 16226c7511db998817e64f2e124013e7d7c9a430c580Ted Kremenek 162348af2a9c1ed3259512f2d1431720add1fbe8fb5fTed Kremenek // First assume that the condition is true. 16248bef8238181a30e52dea380789a7e2d760eac532Ted Kremenek if (ProgramStateRef StateTrue = state->assume(*SEV, true)) { 162586b39f20d5091ca3fdcbeb4a22766aaffdf6ac35Ted Kremenek SVal Val = svalBuilder.makeIntVal(1U, Ex->getType()); 16265eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek StateTrue = StateTrue->BindExpr(Ex, Pred->getLocationContext(), Val); 1627ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.generateNode(Ex, Pred, StateTrue, false, tags.first); 162848af2a9c1ed3259512f2d1431720add1fbe8fb5fTed Kremenek } 16291eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 163048af2a9c1ed3259512f2d1431720add1fbe8fb5fTed Kremenek // Next, assume that the condition is false. 16318bef8238181a30e52dea380789a7e2d760eac532Ted Kremenek if (ProgramStateRef StateFalse = state->assume(*SEV, false)) { 163286b39f20d5091ca3fdcbeb4a22766aaffdf6ac35Ted Kremenek SVal Val = svalBuilder.makeIntVal(0U, Ex->getType()); 16335eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek StateFalse = StateFalse->BindExpr(Ex, Pred->getLocationContext(), Val); 1634ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.generateNode(Ex, Pred, StateFalse, false, tags.second); 163548af2a9c1ed3259512f2d1431720add1fbe8fb5fTed Kremenek } 163648af2a9c1ed3259512f2d1431720add1fbe8fb5fTed Kremenek } 163748af2a9c1ed3259512f2d1431720add1fbe8fb5fTed Kremenek } 163848af2a9c1ed3259512f2d1431720add1fbe8fb5fTed Kremenek} 163948af2a9c1ed3259512f2d1431720add1fbe8fb5fTed Kremenek 16409c378f705405d37f49795d5e915989de774fe11fTed Kremenekvoid ExprEngine::VisitAsmStmt(const AsmStmt *A, ExplodedNode *Pred, 16419c378f705405d37f49795d5e915989de774fe11fTed Kremenek ExplodedNodeSet &Dst) { 1642ef44bfb9d0f15ba0391f8346c9f01355fb450a09Ted Kremenek VisitAsmStmtHelperOutputs(A, A->begin_outputs(), A->end_outputs(), Pred, Dst); 16431eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump} 1644ef44bfb9d0f15ba0391f8346c9f01355fb450a09Ted Kremenek 16459c378f705405d37f49795d5e915989de774fe11fTed Kremenekvoid ExprEngine::VisitAsmStmtHelperOutputs(const AsmStmt *A, 164603509aea098772644bf4662dc1c88634818ceeccZhongxing Xu AsmStmt::const_outputs_iterator I, 164703509aea098772644bf4662dc1c88634818ceeccZhongxing Xu AsmStmt::const_outputs_iterator E, 16489c378f705405d37f49795d5e915989de774fe11fTed Kremenek ExplodedNode *Pred, ExplodedNodeSet &Dst) { 1649ef44bfb9d0f15ba0391f8346c9f01355fb450a09Ted Kremenek if (I == E) { 1650ef44bfb9d0f15ba0391f8346c9f01355fb450a09Ted Kremenek VisitAsmStmtHelperInputs(A, A->begin_inputs(), A->end_inputs(), Pred, Dst); 1651ef44bfb9d0f15ba0391f8346c9f01355fb450a09Ted Kremenek return; 1652ef44bfb9d0f15ba0391f8346c9f01355fb450a09Ted Kremenek } 16531eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1654031ccc0555a82afc2e8afe29e19dd57ff204e2deZhongxing Xu ExplodedNodeSet Tmp; 1655892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek Visit(*I, Pred, Tmp); 1656ef44bfb9d0f15ba0391f8346c9f01355fb450a09Ted Kremenek ++I; 16571eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1658bb141217871e93767aa3f2de1b9946fa6d37066aZhongxing Xu for (ExplodedNodeSet::iterator NI = Tmp.begin(), NE = Tmp.end();NI != NE;++NI) 1659ef44bfb9d0f15ba0391f8346c9f01355fb450a09Ted Kremenek VisitAsmStmtHelperOutputs(A, I, E, *NI, Dst); 1660ef44bfb9d0f15ba0391f8346c9f01355fb450a09Ted Kremenek} 1661ef44bfb9d0f15ba0391f8346c9f01355fb450a09Ted Kremenek 16629c378f705405d37f49795d5e915989de774fe11fTed Kremenekvoid ExprEngine::VisitAsmStmtHelperInputs(const AsmStmt *A, 166303509aea098772644bf4662dc1c88634818ceeccZhongxing Xu AsmStmt::const_inputs_iterator I, 166403509aea098772644bf4662dc1c88634818ceeccZhongxing Xu AsmStmt::const_inputs_iterator E, 16659c378f705405d37f49795d5e915989de774fe11fTed Kremenek ExplodedNode *Pred, 16669c378f705405d37f49795d5e915989de774fe11fTed Kremenek ExplodedNodeSet &Dst) { 1667ef44bfb9d0f15ba0391f8346c9f01355fb450a09Ted Kremenek if (I == E) { 1668aa0aeb1cbe117db68d35700cb3a34aace0f99b99Anna Zaks StmtNodeBuilder Bldr(Pred, Dst, *currentBuilderContext); 1669ef44bfb9d0f15ba0391f8346c9f01355fb450a09Ted Kremenek // We have processed both the inputs and the outputs. All of the outputs 16701c96b24285d05c0eac455ae96d7c9ff43d42bc96Zhongxing Xu // should evaluate to Locs. Nuke all of their values. 16711eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1672ef44bfb9d0f15ba0391f8346c9f01355fb450a09Ted Kremenek // FIXME: Some day in the future it would be nice to allow a "plug-in" 1673ef44bfb9d0f15ba0391f8346c9f01355fb450a09Ted Kremenek // which interprets the inline asm and stores proper results in the 1674ef44bfb9d0f15ba0391f8346c9f01355fb450a09Ted Kremenek // outputs. 16751eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 16768bef8238181a30e52dea380789a7e2d760eac532Ted Kremenek ProgramStateRef state = Pred->getState(); 16771eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 167803509aea098772644bf4662dc1c88634818ceeccZhongxing Xu for (AsmStmt::const_outputs_iterator OI = A->begin_outputs(), 1679ef44bfb9d0f15ba0391f8346c9f01355fb450a09Ted Kremenek OE = A->end_outputs(); OI != OE; ++OI) { 16801eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 16815eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek SVal X = state->getSVal(*OI, Pred->getLocationContext()); 16821c96b24285d05c0eac455ae96d7c9ff43d42bc96Zhongxing Xu assert (!isa<NonLoc>(X)); // Should be an Lval, or unknown, undef. 16831eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 16841c96b24285d05c0eac455ae96d7c9ff43d42bc96Zhongxing Xu if (isa<Loc>(X)) 16853ff12591494a3cb3d3a24427975df58714ac3b2fTed Kremenek state = state->bindLoc(cast<Loc>(X), UnknownVal()); 1686ef44bfb9d0f15ba0391f8346c9f01355fb450a09Ted Kremenek } 16871eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1688ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.generateNode(A, Pred, state); 1689ef44bfb9d0f15ba0391f8346c9f01355fb450a09Ted Kremenek return; 1690ef44bfb9d0f15ba0391f8346c9f01355fb450a09Ted Kremenek } 16911eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1692031ccc0555a82afc2e8afe29e19dd57ff204e2deZhongxing Xu ExplodedNodeSet Tmp; 1693ef44bfb9d0f15ba0391f8346c9f01355fb450a09Ted Kremenek Visit(*I, Pred, Tmp); 16941eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1695ef44bfb9d0f15ba0391f8346c9f01355fb450a09Ted Kremenek ++I; 16961eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1697e1ccccff777f6bad6b25e9c6a762f98fd8003181Ted Kremenek for (ExplodedNodeSet::iterator NI = Tmp.begin(), NE = Tmp.end(); NI!=NE; ++NI) 1698ef44bfb9d0f15ba0391f8346c9f01355fb450a09Ted Kremenek VisitAsmStmtHelperInputs(A, I, E, *NI, Dst); 1699ef44bfb9d0f15ba0391f8346c9f01355fb450a09Ted Kremenek} 1700ef44bfb9d0f15ba0391f8346c9f01355fb450a09Ted Kremenek 1701094bef56a7900f13bb777f9a352704104b1458e7Ted Kremenek 1702094bef56a7900f13bb777f9a352704104b1458e7Ted Kremenek//===----------------------------------------------------------------------===// 1703e01c98767dfd7153c3c84637c36659e3bbe16ff7Ted Kremenek// Visualization. 1704ee98546b0d5f3439c4a590b0d7d1545af794a0ecTed Kremenek//===----------------------------------------------------------------------===// 1705ee98546b0d5f3439c4a590b0d7d1545af794a0ecTed Kremenek 1706aa66a32ba177338763cd0cf9df8310dfa2e24ff7Ted Kremenek#ifndef NDEBUG 1707d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidisstatic ExprEngine* GraphPrintCheckerState; 1708e97ca065c91ff9ca2a2a42eb443eaa553c40441cTed Kremenekstatic SourceManager* GraphPrintSourceManager; 17093b4f6702860208692f6ef28401e68de4e3ff9af9Ted Kremenek 1710aa66a32ba177338763cd0cf9df8310dfa2e24ff7Ted Kremeneknamespace llvm { 1711aa66a32ba177338763cd0cf9df8310dfa2e24ff7Ted Kremenektemplate<> 171247491f8b7adf9d42a404d44c073e8a5308fa6cfcDouglas Gregorstruct DOTGraphTraits<ExplodedNode*> : 1713aa66a32ba177338763cd0cf9df8310dfa2e24ff7Ted Kremenek public DefaultDOTGraphTraits { 1714006b0eb3e11162d8c06372db813ac9f71a7a16e8Tobias Grosser 1715006b0eb3e11162d8c06372db813ac9f71a7a16e8Tobias Grosser DOTGraphTraits (bool isSimple=false) : DefaultDOTGraphTraits(isSimple) {} 1716006b0eb3e11162d8c06372db813ac9f71a7a16e8Tobias Grosser 1717d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidis // FIXME: Since we do not cache error nodes in ExprEngine now, this does not 1718ec9227fea66c3439991fc84b0d33b0a8b4b8875eZhongxing Xu // work. 17199c378f705405d37f49795d5e915989de774fe11fTed Kremenek static std::string getNodeAttributes(const ExplodedNode *N, void*) { 17201eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 172110f51e8785e43d5a22acc2d2a638307c582949c2Ted Kremenek#if 0 172210f51e8785e43d5a22acc2d2a638307c582949c2Ted Kremenek // FIXME: Replace with a general scheme to tell if the node is 172310f51e8785e43d5a22acc2d2a638307c582949c2Ted Kremenek // an error node. 1724a3fadfcce5911742801a302cac82d4fe54d5c682Ted Kremenek if (GraphPrintCheckerState->isImplicitNullDeref(N) || 17259dca062461a6244cf0f733346657fa3eee853f9bTed Kremenek GraphPrintCheckerState->isExplicitNullDeref(N) || 17264a4e524afef40d6f3ddb25d0e407c814e4ca56a8Ted Kremenek GraphPrintCheckerState->isUndefDeref(N) || 17274a4e524afef40d6f3ddb25d0e407c814e4ca56a8Ted Kremenek GraphPrintCheckerState->isUndefStore(N) || 17284a4e524afef40d6f3ddb25d0e407c814e4ca56a8Ted Kremenek GraphPrintCheckerState->isUndefControlFlow(N) || 17295e03fcb5420c33207433dd6f800588e256dd9bdbTed Kremenek GraphPrintCheckerState->isUndefResult(N) || 17302ded35a576e3899553ea0ccfcbf5cbdb3d8cf664Ted Kremenek GraphPrintCheckerState->isBadCall(N) || 17312ded35a576e3899553ea0ccfcbf5cbdb3d8cf664Ted Kremenek GraphPrintCheckerState->isUndefArg(N)) 1732a3fadfcce5911742801a302cac82d4fe54d5c682Ted Kremenek return "color=\"red\",style=\"filled\""; 17331eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 17348cc13ea74fea1c04042a2f4087665bc5182e8408Ted Kremenek if (GraphPrintCheckerState->isNoReturnCall(N)) 17358cc13ea74fea1c04042a2f4087665bc5182e8408Ted Kremenek return "color=\"blue\",style=\"filled\""; 17362055effed54d614b51e3501a174c9b1fe92e4de4Zhongxing Xu#endif 1737a3fadfcce5911742801a302cac82d4fe54d5c682Ted Kremenek return ""; 1738a3fadfcce5911742801a302cac82d4fe54d5c682Ted Kremenek } 17391eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 17409c378f705405d37f49795d5e915989de774fe11fTed Kremenek static std::string getNodeLabel(const ExplodedNode *N, void*){ 17411eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 174253ba0b636194dbeaa65a6f85316c9397a0c5298bTed Kremenek std::string sbuf; 174353ba0b636194dbeaa65a6f85316c9397a0c5298bTed Kremenek llvm::raw_string_ostream Out(sbuf); 1744803c9edd06e8f936821525d36b1d8cc131e37d44Ted Kremenek 1745803c9edd06e8f936821525d36b1d8cc131e37d44Ted Kremenek // Program Location. 1746aa66a32ba177338763cd0cf9df8310dfa2e24ff7Ted Kremenek ProgramPoint Loc = N->getLocation(); 17471eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1748aa66a32ba177338763cd0cf9df8310dfa2e24ff7Ted Kremenek switch (Loc.getKind()) { 1749aa66a32ba177338763cd0cf9df8310dfa2e24ff7Ted Kremenek case ProgramPoint::BlockEntranceKind: 17501eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump Out << "Block Entrance: B" 1751aa66a32ba177338763cd0cf9df8310dfa2e24ff7Ted Kremenek << cast<BlockEntrance>(Loc).getBlock()->getBlockID(); 1752aa66a32ba177338763cd0cf9df8310dfa2e24ff7Ted Kremenek break; 17531eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1754aa66a32ba177338763cd0cf9df8310dfa2e24ff7Ted Kremenek case ProgramPoint::BlockExitKind: 1755aa66a32ba177338763cd0cf9df8310dfa2e24ff7Ted Kremenek assert (false); 1756aa66a32ba177338763cd0cf9df8310dfa2e24ff7Ted Kremenek break; 17571eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1758102acd5369bbb17c0d6ab868af376671acff7a93Douglas Gregor case ProgramPoint::CallEnterKind: 1759102acd5369bbb17c0d6ab868af376671acff7a93Douglas Gregor Out << "CallEnter"; 1760102acd5369bbb17c0d6ab868af376671acff7a93Douglas Gregor break; 1761102acd5369bbb17c0d6ab868af376671acff7a93Douglas Gregor 1762102acd5369bbb17c0d6ab868af376671acff7a93Douglas Gregor case ProgramPoint::CallExitKind: 1763102acd5369bbb17c0d6ab868af376671acff7a93Douglas Gregor Out << "CallExit"; 1764102acd5369bbb17c0d6ab868af376671acff7a93Douglas Gregor break; 1765102acd5369bbb17c0d6ab868af376671acff7a93Douglas Gregor 1766aa66a32ba177338763cd0cf9df8310dfa2e24ff7Ted Kremenek default: { 17675f85e17df3f5b0a8021443f2b590daecfb2cbd17Ted Kremenek if (StmtPoint *L = dyn_cast<StmtPoint>(&Loc)) { 17689c378f705405d37f49795d5e915989de774fe11fTed Kremenek const Stmt *S = L->getStmt(); 17698c354758c2d39db87c77c723d81e34b4d967f762Ted Kremenek SourceLocation SLoc = S->getLocStart(); 17708c354758c2d39db87c77c723d81e34b4d967f762Ted Kremenek 17711eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump Out << S->getStmtClassName() << ' ' << (void*) S << ' '; 1772e4f2142d00fa5fdb580c4e2413da91882d955381Chris Lattner LangOptions LO; // FIXME. 1773e4f2142d00fa5fdb580c4e2413da91882d955381Chris Lattner S->printPretty(Out, 0, PrintingPolicy(LO)); 17741eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 17751eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump if (SLoc.isFileID()) { 17768c354758c2d39db87c77c723d81e34b4d967f762Ted Kremenek Out << "\\lline=" 1777642116259e8df6286063a17361c20e95b5017a0aChandler Carruth << GraphPrintSourceManager->getExpansionLineNumber(SLoc) 17787da5aea7669e6db3e593162b8a123aef06a04d07Chris Lattner << " col=" 1779a77c031cb66f75d22672070052cc6e0205289ff8Chandler Carruth << GraphPrintSourceManager->getExpansionColumnNumber(SLoc) 17807da5aea7669e6db3e593162b8a123aef06a04d07Chris Lattner << "\\l"; 17818c354758c2d39db87c77c723d81e34b4d967f762Ted Kremenek } 17821eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 17835f85e17df3f5b0a8021443f2b590daecfb2cbd17Ted Kremenek if (isa<PreStmt>(Loc)) 17841eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump Out << "\\lPreStmt\\l;"; 17855f85e17df3f5b0a8021443f2b590daecfb2cbd17Ted Kremenek else if (isa<PostLoad>(Loc)) 17867090d5465de7ca620da16211cf886edf1edc1f1fTed Kremenek Out << "\\lPostLoad\\l;"; 17877090d5465de7ca620da16211cf886edf1edc1f1fTed Kremenek else if (isa<PostStore>(Loc)) 17887090d5465de7ca620da16211cf886edf1edc1f1fTed Kremenek Out << "\\lPostStore\\l"; 17897090d5465de7ca620da16211cf886edf1edc1f1fTed Kremenek else if (isa<PostLValue>(Loc)) 17907090d5465de7ca620da16211cf886edf1edc1f1fTed Kremenek Out << "\\lPostLValue\\l"; 17911eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 179210f51e8785e43d5a22acc2d2a638307c582949c2Ted Kremenek#if 0 179310f51e8785e43d5a22acc2d2a638307c582949c2Ted Kremenek // FIXME: Replace with a general scheme to determine 179410f51e8785e43d5a22acc2d2a638307c582949c2Ted Kremenek // the name of the check. 17958c354758c2d39db87c77c723d81e34b4d967f762Ted Kremenek if (GraphPrintCheckerState->isImplicitNullDeref(N)) 17968c354758c2d39db87c77c723d81e34b4d967f762Ted Kremenek Out << "\\|Implicit-Null Dereference.\\l"; 17978c354758c2d39db87c77c723d81e34b4d967f762Ted Kremenek else if (GraphPrintCheckerState->isExplicitNullDeref(N)) 17988c354758c2d39db87c77c723d81e34b4d967f762Ted Kremenek Out << "\\|Explicit-Null Dereference.\\l"; 17998c354758c2d39db87c77c723d81e34b4d967f762Ted Kremenek else if (GraphPrintCheckerState->isUndefDeref(N)) 18008c354758c2d39db87c77c723d81e34b4d967f762Ted Kremenek Out << "\\|Dereference of undefialied value.\\l"; 18018c354758c2d39db87c77c723d81e34b4d967f762Ted Kremenek else if (GraphPrintCheckerState->isUndefStore(N)) 18028c354758c2d39db87c77c723d81e34b4d967f762Ted Kremenek Out << "\\|Store to Undefined Loc."; 18038c354758c2d39db87c77c723d81e34b4d967f762Ted Kremenek else if (GraphPrintCheckerState->isUndefResult(N)) 18048c354758c2d39db87c77c723d81e34b4d967f762Ted Kremenek Out << "\\|Result of operation is undefined."; 18058c354758c2d39db87c77c723d81e34b4d967f762Ted Kremenek else if (GraphPrintCheckerState->isNoReturnCall(N)) 18068c354758c2d39db87c77c723d81e34b4d967f762Ted Kremenek Out << "\\|Call to function marked \"noreturn\"."; 18078c354758c2d39db87c77c723d81e34b4d967f762Ted Kremenek else if (GraphPrintCheckerState->isBadCall(N)) 18088c354758c2d39db87c77c723d81e34b4d967f762Ted Kremenek Out << "\\|Call to NULL/Undefined."; 18098c354758c2d39db87c77c723d81e34b4d967f762Ted Kremenek else if (GraphPrintCheckerState->isUndefArg(N)) 18108c354758c2d39db87c77c723d81e34b4d967f762Ted Kremenek Out << "\\|Argument in call is undefined"; 181110f51e8785e43d5a22acc2d2a638307c582949c2Ted Kremenek#endif 18121eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 18138c354758c2d39db87c77c723d81e34b4d967f762Ted Kremenek break; 18148c354758c2d39db87c77c723d81e34b4d967f762Ted Kremenek } 18158c354758c2d39db87c77c723d81e34b4d967f762Ted Kremenek 18169c378f705405d37f49795d5e915989de774fe11fTed Kremenek const BlockEdge &E = cast<BlockEdge>(Loc); 1817aa66a32ba177338763cd0cf9df8310dfa2e24ff7Ted Kremenek Out << "Edge: (B" << E.getSrc()->getBlockID() << ", B" 1818aa66a32ba177338763cd0cf9df8310dfa2e24ff7Ted Kremenek << E.getDst()->getBlockID() << ')'; 18191eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 18209c378f705405d37f49795d5e915989de774fe11fTed Kremenek if (const Stmt *T = E.getSrc()->getTerminator()) { 18211eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1822e97ca065c91ff9ca2a2a42eb443eaa553c40441cTed Kremenek SourceLocation SLoc = T->getLocStart(); 18231eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1824b38911f16b4943548db6a3695fc6ae23070b25d2Ted Kremenek Out << "\\|Terminator: "; 1825e4f2142d00fa5fdb580c4e2413da91882d955381Chris Lattner LangOptions LO; // FIXME. 1826e4f2142d00fa5fdb580c4e2413da91882d955381Chris Lattner E.getSrc()->printTerminator(Out, LO); 18271eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 18289b5551d7f0209cec8b9c555cf70e893940674e5cTed Kremenek if (SLoc.isFileID()) { 18299b5551d7f0209cec8b9c555cf70e893940674e5cTed Kremenek Out << "\\lline=" 1830642116259e8df6286063a17361c20e95b5017a0aChandler Carruth << GraphPrintSourceManager->getExpansionLineNumber(SLoc) 18317da5aea7669e6db3e593162b8a123aef06a04d07Chris Lattner << " col=" 1832a77c031cb66f75d22672070052cc6e0205289ff8Chandler Carruth << GraphPrintSourceManager->getExpansionColumnNumber(SLoc); 18339b5551d7f0209cec8b9c555cf70e893940674e5cTed Kremenek } 18341eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1835daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek if (isa<SwitchStmt>(T)) { 18369c378f705405d37f49795d5e915989de774fe11fTed Kremenek const Stmt *Label = E.getDst()->getLabel(); 18371eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 18381eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump if (Label) { 18399c378f705405d37f49795d5e915989de774fe11fTed Kremenek if (const CaseStmt *C = dyn_cast<CaseStmt>(Label)) { 1840daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek Out << "\\lcase "; 1841e4f2142d00fa5fdb580c4e2413da91882d955381Chris Lattner LangOptions LO; // FIXME. 1842e4f2142d00fa5fdb580c4e2413da91882d955381Chris Lattner C->getLHS()->printPretty(Out, 0, PrintingPolicy(LO)); 18431eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 18449c378f705405d37f49795d5e915989de774fe11fTed Kremenek if (const Stmt *RHS = C->getRHS()) { 1845daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek Out << " .. "; 1846e4f2142d00fa5fdb580c4e2413da91882d955381Chris Lattner RHS->printPretty(Out, 0, PrintingPolicy(LO)); 1847daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek } 18481eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1849daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek Out << ":"; 1850daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek } 1851daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek else { 1852daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek assert (isa<DefaultStmt>(Label)); 1853daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek Out << "\\ldefault:"; 1854daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek } 1855daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek } 18561eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump else 1857daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek Out << "\\l(implicit) default:"; 1858daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek } 1859daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek else if (isa<IndirectGotoStmt>(T)) { 1860b38911f16b4943548db6a3695fc6ae23070b25d2Ted Kremenek // FIXME 1861b38911f16b4943548db6a3695fc6ae23070b25d2Ted Kremenek } 1862b38911f16b4943548db6a3695fc6ae23070b25d2Ted Kremenek else { 1863b38911f16b4943548db6a3695fc6ae23070b25d2Ted Kremenek Out << "\\lCondition: "; 1864b38911f16b4943548db6a3695fc6ae23070b25d2Ted Kremenek if (*E.getSrc()->succ_begin() == E.getDst()) 1865b38911f16b4943548db6a3695fc6ae23070b25d2Ted Kremenek Out << "true"; 1866b38911f16b4943548db6a3695fc6ae23070b25d2Ted Kremenek else 18671eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump Out << "false"; 1868b38911f16b4943548db6a3695fc6ae23070b25d2Ted Kremenek } 18691eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1870b38911f16b4943548db6a3695fc6ae23070b25d2Ted Kremenek Out << "\\l"; 1871b38911f16b4943548db6a3695fc6ae23070b25d2Ted Kremenek } 18721eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 187310f51e8785e43d5a22acc2d2a638307c582949c2Ted Kremenek#if 0 187410f51e8785e43d5a22acc2d2a638307c582949c2Ted Kremenek // FIXME: Replace with a general scheme to determine 187510f51e8785e43d5a22acc2d2a638307c582949c2Ted Kremenek // the name of the check. 18764a4e524afef40d6f3ddb25d0e407c814e4ca56a8Ted Kremenek if (GraphPrintCheckerState->isUndefControlFlow(N)) { 18774a4e524afef40d6f3ddb25d0e407c814e4ca56a8Ted Kremenek Out << "\\|Control-flow based on\\lUndefined value.\\l"; 18783b4f6702860208692f6ef28401e68de4e3ff9af9Ted Kremenek } 187910f51e8785e43d5a22acc2d2a638307c582949c2Ted Kremenek#endif 1880aa66a32ba177338763cd0cf9df8310dfa2e24ff7Ted Kremenek } 1881aa66a32ba177338763cd0cf9df8310dfa2e24ff7Ted Kremenek } 18821eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 18838bef8238181a30e52dea380789a7e2d760eac532Ted Kremenek ProgramStateRef state = N->getState(); 1884a5888f61be9f8d76e9b48a453dbced50523bd2e0Argyrios Kyrtzidis Out << "\\|StateID: " << (void*) state.getPtr() 18858673a68a8ab55a2bd03f92d636a50e6b0bfad2daTed Kremenek << " NodeID: " << (void*) N << "\\|"; 18865eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek state->printDOT(Out); 1887ca804539d908d3a0e8c72a0df5f1f571d29490bbTed Kremenek 1888ca804539d908d3a0e8c72a0df5f1f571d29490bbTed Kremenek Out << "\\l"; 1889ca804539d908d3a0e8c72a0df5f1f571d29490bbTed Kremenek 1890ca804539d908d3a0e8c72a0df5f1f571d29490bbTed Kremenek if (const ProgramPointTag *tag = Loc.getTag()) { 1891ca804539d908d3a0e8c72a0df5f1f571d29490bbTed Kremenek Out << "\\|Tag: " << tag->getTagDescription(); 1892ca804539d908d3a0e8c72a0df5f1f571d29490bbTed Kremenek Out << "\\l"; 1893ca804539d908d3a0e8c72a0df5f1f571d29490bbTed Kremenek } 1894aa66a32ba177338763cd0cf9df8310dfa2e24ff7Ted Kremenek return Out.str(); 1895aa66a32ba177338763cd0cf9df8310dfa2e24ff7Ted Kremenek } 1896aa66a32ba177338763cd0cf9df8310dfa2e24ff7Ted Kremenek}; 18971eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump} // end llvm namespace 1898aa66a32ba177338763cd0cf9df8310dfa2e24ff7Ted Kremenek#endif 1899aa66a32ba177338763cd0cf9df8310dfa2e24ff7Ted Kremenek 1900ffe0f43806d4823271c2406c1fccc2373115c36aTed Kremenek#ifndef NDEBUG 19017ec07fd91f6eae8bd619ebb8512805222ca41c92Ted Kremenektemplate <typename ITERATOR> 19029c378f705405d37f49795d5e915989de774fe11fTed KremenekExplodedNode *GetGraphNode(ITERATOR I) { return *I; } 19037ec07fd91f6eae8bd619ebb8512805222ca41c92Ted Kremenek 1904031ccc0555a82afc2e8afe29e19dd57ff204e2deZhongxing Xutemplate <> ExplodedNode* 1905031ccc0555a82afc2e8afe29e19dd57ff204e2deZhongxing XuGetGraphNode<llvm::DenseMap<ExplodedNode*, Expr*>::iterator> 1906031ccc0555a82afc2e8afe29e19dd57ff204e2deZhongxing Xu (llvm::DenseMap<ExplodedNode*, Expr*>::iterator I) { 19077ec07fd91f6eae8bd619ebb8512805222ca41c92Ted Kremenek return I->first; 19087ec07fd91f6eae8bd619ebb8512805222ca41c92Ted Kremenek} 1909ffe0f43806d4823271c2406c1fccc2373115c36aTed Kremenek#endif 1910ffe0f43806d4823271c2406c1fccc2373115c36aTed Kremenek 1911d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidisvoid ExprEngine::ViewGraph(bool trim) { 19121eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump#ifndef NDEBUG 1913ffe0f43806d4823271c2406c1fccc2373115c36aTed Kremenek if (trim) { 1914031ccc0555a82afc2e8afe29e19dd57ff204e2deZhongxing Xu std::vector<ExplodedNode*> Src; 1915940abcc574580e454689be801f38a3d4d41ab01fTed Kremenek 1916940abcc574580e454689be801f38a3d4d41ab01fTed Kremenek // Flush any outstanding reports to make sure we cover all the nodes. 1917940abcc574580e454689be801f38a3d4d41ab01fTed Kremenek // This does not cause them to get displayed. 1918940abcc574580e454689be801f38a3d4d41ab01fTed Kremenek for (BugReporter::iterator I=BR.begin(), E=BR.end(); I!=E; ++I) 1919940abcc574580e454689be801f38a3d4d41ab01fTed Kremenek const_cast<BugType*>(*I)->FlushReports(BR); 1920940abcc574580e454689be801f38a3d4d41ab01fTed Kremenek 1921940abcc574580e454689be801f38a3d4d41ab01fTed Kremenek // Iterate through the reports and get their nodes. 1922404fc3ad6bd844bf8ce70cbf9974ab297704a122Argyrios Kyrtzidis for (BugReporter::EQClasses_iterator 1923404fc3ad6bd844bf8ce70cbf9974ab297704a122Argyrios Kyrtzidis EI = BR.EQClasses_begin(), EE = BR.EQClasses_end(); EI != EE; ++EI) { 1924404fc3ad6bd844bf8ce70cbf9974ab297704a122Argyrios Kyrtzidis BugReportEquivClass& EQ = *EI; 1925404fc3ad6bd844bf8ce70cbf9974ab297704a122Argyrios Kyrtzidis const BugReport &R = **EQ.begin(); 1926404fc3ad6bd844bf8ce70cbf9974ab297704a122Argyrios Kyrtzidis ExplodedNode *N = const_cast<ExplodedNode*>(R.getErrorNode()); 1927404fc3ad6bd844bf8ce70cbf9974ab297704a122Argyrios Kyrtzidis if (N) Src.push_back(N); 1928940abcc574580e454689be801f38a3d4d41ab01fTed Kremenek } 19291eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 19307ec07fd91f6eae8bd619ebb8512805222ca41c92Ted Kremenek ViewGraph(&Src[0], &Src[0]+Src.size()); 1931ffe0f43806d4823271c2406c1fccc2373115c36aTed Kremenek } 1932493d7a26d5ea319770ba904b43f2740d43b820cbTed Kremenek else { 1933493d7a26d5ea319770ba904b43f2740d43b820cbTed Kremenek GraphPrintCheckerState = this; 1934493d7a26d5ea319770ba904b43f2740d43b820cbTed Kremenek GraphPrintSourceManager = &getContext().getSourceManager(); 1935ae6814efb6c41bd0c0f6413d25097105284d5be7Ted Kremenek 1936d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidis llvm::ViewGraph(*G.roots_begin(), "ExprEngine"); 19371eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1938493d7a26d5ea319770ba904b43f2740d43b820cbTed Kremenek GraphPrintCheckerState = NULL; 1939493d7a26d5ea319770ba904b43f2740d43b820cbTed Kremenek GraphPrintSourceManager = NULL; 1940493d7a26d5ea319770ba904b43f2740d43b820cbTed Kremenek } 1941493d7a26d5ea319770ba904b43f2740d43b820cbTed Kremenek#endif 1942493d7a26d5ea319770ba904b43f2740d43b820cbTed Kremenek} 1943493d7a26d5ea319770ba904b43f2740d43b820cbTed Kremenek 1944d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidisvoid ExprEngine::ViewGraph(ExplodedNode** Beg, ExplodedNode** End) { 1945493d7a26d5ea319770ba904b43f2740d43b820cbTed Kremenek#ifndef NDEBUG 1946493d7a26d5ea319770ba904b43f2740d43b820cbTed Kremenek GraphPrintCheckerState = this; 1947493d7a26d5ea319770ba904b43f2740d43b820cbTed Kremenek GraphPrintSourceManager = &getContext().getSourceManager(); 19481eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1949031ccc0555a82afc2e8afe29e19dd57ff204e2deZhongxing Xu std::auto_ptr<ExplodedGraph> TrimmedG(G.Trim(Beg, End).first); 1950493d7a26d5ea319770ba904b43f2740d43b820cbTed Kremenek 1951cf118d41f7930a18dce97416ef7834a62642f587Ted Kremenek if (!TrimmedG.get()) 19526cb7c1a43b0c8f739d1f54b7fdae5ede86033496Benjamin Kramer llvm::errs() << "warning: Trimmed ExplodedGraph is empty.\n"; 1953cf118d41f7930a18dce97416ef7834a62642f587Ted Kremenek else 1954d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidis llvm::ViewGraph(*TrimmedG->roots_begin(), "TrimmedExprEngine"); 19551eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 19563b4f6702860208692f6ef28401e68de4e3ff9af9Ted Kremenek GraphPrintCheckerState = NULL; 1957e97ca065c91ff9ca2a2a42eb443eaa553c40441cTed Kremenek GraphPrintSourceManager = NULL; 1958e01c98767dfd7153c3c84637c36659e3bbe16ff7Ted Kremenek#endif 1959ee98546b0d5f3439c4a590b0d7d1545af794a0ecTed Kremenek} 1960