ExprEngine.cpp revision 7a95de68c093991047ed8d339479ccad51b88663
1//=-- ExprEngine.cpp - Path-Sensitive Expression-Level Dataflow ---*- C++ -*-= 2// 3// The LLVM Compiler Infrastructure 4// 5// This file is distributed under the University of Illinois Open Source 6// License. See LICENSE.TXT for details. 7// 8//===----------------------------------------------------------------------===// 9// 10// This file defines a meta-engine for path-sensitive dataflow analysis that 11// is built on GREngine, but provides the boilerplate to execute transfer 12// functions and build the ExplodedGraph at the expression level. 13// 14//===----------------------------------------------------------------------===// 15 16#define DEBUG_TYPE "ExprEngine" 17 18#include "clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h" 19#include "clang/AST/CharUnits.h" 20#include "clang/AST/ParentMap.h" 21#include "clang/AST/StmtCXX.h" 22#include "clang/AST/StmtObjC.h" 23#include "clang/Basic/Builtins.h" 24#include "clang/Basic/PrettyStackTrace.h" 25#include "clang/Basic/SourceManager.h" 26#include "clang/StaticAnalyzer/Core/BugReporter/BugType.h" 27#include "clang/StaticAnalyzer/Core/CheckerManager.h" 28#include "clang/StaticAnalyzer/Core/PathSensitive/AnalysisManager.h" 29#include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h" 30#include "llvm/ADT/ImmutableList.h" 31#include "llvm/ADT/Statistic.h" 32#include "llvm/Support/raw_ostream.h" 33 34#ifndef NDEBUG 35#include "llvm/Support/GraphWriter.h" 36#endif 37 38using namespace clang; 39using namespace ento; 40using llvm::APSInt; 41 42STATISTIC(NumRemoveDeadBindings, 43 "The # of times RemoveDeadBindings is called"); 44STATISTIC(NumMaxBlockCountReached, 45 "The # of aborted paths due to reaching the maximum block count in " 46 "a top level function"); 47STATISTIC(NumMaxBlockCountReachedInInlined, 48 "The # of aborted paths due to reaching the maximum block count in " 49 "an inlined function"); 50STATISTIC(NumTimesRetriedWithoutInlining, 51 "The # of times we re-evaluated a call without inlining"); 52 53//===----------------------------------------------------------------------===// 54// Engine construction and deletion. 55//===----------------------------------------------------------------------===// 56 57ExprEngine::ExprEngine(AnalysisManager &mgr, bool gcEnabled, 58 SetOfConstDecls *VisitedCalleesIn, 59 FunctionSummariesTy *FS, 60 InliningModes HowToInlineIn) 61 : AMgr(mgr), 62 AnalysisDeclContexts(mgr.getAnalysisDeclContextManager()), 63 Engine(*this, FS), 64 G(Engine.getGraph()), 65 StateMgr(getContext(), mgr.getStoreManagerCreator(), 66 mgr.getConstraintManagerCreator(), G.getAllocator(), 67 this), 68 SymMgr(StateMgr.getSymbolManager()), 69 svalBuilder(StateMgr.getSValBuilder()), 70 currStmtIdx(0), currBldrCtx(0), 71 ObjCNoRet(mgr.getASTContext()), 72 ObjCGCEnabled(gcEnabled), BR(mgr, *this), 73 VisitedCallees(VisitedCalleesIn), 74 HowToInline(HowToInlineIn) 75{ 76 unsigned TrimInterval = mgr.options.getGraphTrimInterval(); 77 if (TrimInterval != 0) { 78 // Enable eager node reclaimation when constructing the ExplodedGraph. 79 G.enableNodeReclamation(TrimInterval); 80 } 81} 82 83ExprEngine::~ExprEngine() { 84 BR.FlushReports(); 85} 86 87//===----------------------------------------------------------------------===// 88// Utility methods. 89//===----------------------------------------------------------------------===// 90 91ProgramStateRef ExprEngine::getInitialState(const LocationContext *InitLoc) { 92 ProgramStateRef state = StateMgr.getInitialState(InitLoc); 93 const Decl *D = InitLoc->getDecl(); 94 95 // Preconditions. 96 // FIXME: It would be nice if we had a more general mechanism to add 97 // such preconditions. Some day. 98 do { 99 100 if (const FunctionDecl *FD = dyn_cast<FunctionDecl>(D)) { 101 // Precondition: the first argument of 'main' is an integer guaranteed 102 // to be > 0. 103 const IdentifierInfo *II = FD->getIdentifier(); 104 if (!II || !(II->getName() == "main" && FD->getNumParams() > 0)) 105 break; 106 107 const ParmVarDecl *PD = FD->getParamDecl(0); 108 QualType T = PD->getType(); 109 if (!T->isIntegerType()) 110 break; 111 112 const MemRegion *R = state->getRegion(PD, InitLoc); 113 if (!R) 114 break; 115 116 SVal V = state->getSVal(loc::MemRegionVal(R)); 117 SVal Constraint_untested = evalBinOp(state, BO_GT, V, 118 svalBuilder.makeZeroVal(T), 119 getContext().IntTy); 120 121 Optional<DefinedOrUnknownSVal> Constraint = 122 Constraint_untested.getAs<DefinedOrUnknownSVal>(); 123 124 if (!Constraint) 125 break; 126 127 if (ProgramStateRef newState = state->assume(*Constraint, true)) 128 state = newState; 129 } 130 break; 131 } 132 while (0); 133 134 if (const ObjCMethodDecl *MD = dyn_cast<ObjCMethodDecl>(D)) { 135 // Precondition: 'self' is always non-null upon entry to an Objective-C 136 // method. 137 const ImplicitParamDecl *SelfD = MD->getSelfDecl(); 138 const MemRegion *R = state->getRegion(SelfD, InitLoc); 139 SVal V = state->getSVal(loc::MemRegionVal(R)); 140 141 if (Optional<Loc> LV = V.getAs<Loc>()) { 142 // Assume that the pointer value in 'self' is non-null. 143 state = state->assume(*LV, true); 144 assert(state && "'self' cannot be null"); 145 } 146 } 147 148 if (const CXXMethodDecl *MD = dyn_cast<CXXMethodDecl>(D)) { 149 if (!MD->isStatic()) { 150 // Precondition: 'this' is always non-null upon entry to the 151 // top-level function. This is our starting assumption for 152 // analyzing an "open" program. 153 const StackFrameContext *SFC = InitLoc->getCurrentStackFrame(); 154 if (SFC->getParent() == 0) { 155 loc::MemRegionVal L = svalBuilder.getCXXThis(MD, SFC); 156 SVal V = state->getSVal(L); 157 if (Optional<Loc> LV = V.getAs<Loc>()) { 158 state = state->assume(*LV, true); 159 assert(state && "'this' cannot be null"); 160 } 161 } 162 } 163 } 164 165 return state; 166} 167 168/// If the value of the given expression is a NonLoc, copy it into a new 169/// temporary region, and replace the value of the expression with that. 170static ProgramStateRef createTemporaryRegionIfNeeded(ProgramStateRef State, 171 const LocationContext *LC, 172 const Expr *E) { 173 SVal V = State->getSVal(E, LC); 174 175 if (V.getAs<NonLoc>()) { 176 MemRegionManager &MRMgr = State->getStateManager().getRegionManager(); 177 const MemRegion *R = MRMgr.getCXXTempObjectRegion(E, LC); 178 State = State->bindLoc(loc::MemRegionVal(R), V); 179 State = State->BindExpr(E, LC, loc::MemRegionVal(R)); 180 } 181 182 return State; 183} 184 185//===----------------------------------------------------------------------===// 186// Top-level transfer function logic (Dispatcher). 187//===----------------------------------------------------------------------===// 188 189/// evalAssume - Called by ConstraintManager. Used to call checker-specific 190/// logic for handling assumptions on symbolic values. 191ProgramStateRef ExprEngine::processAssume(ProgramStateRef state, 192 SVal cond, bool assumption) { 193 return getCheckerManager().runCheckersForEvalAssume(state, cond, assumption); 194} 195 196bool ExprEngine::wantsRegionChangeUpdate(ProgramStateRef state) { 197 return getCheckerManager().wantsRegionChangeUpdate(state); 198} 199 200ProgramStateRef 201ExprEngine::processRegionChanges(ProgramStateRef state, 202 const InvalidatedSymbols *invalidated, 203 ArrayRef<const MemRegion *> Explicits, 204 ArrayRef<const MemRegion *> Regions, 205 const CallEvent *Call) { 206 return getCheckerManager().runCheckersForRegionChanges(state, invalidated, 207 Explicits, Regions, Call); 208} 209 210void ExprEngine::printState(raw_ostream &Out, ProgramStateRef State, 211 const char *NL, const char *Sep) { 212 getCheckerManager().runCheckersForPrintState(Out, State, NL, Sep); 213} 214 215void ExprEngine::processEndWorklist(bool hasWorkRemaining) { 216 getCheckerManager().runCheckersForEndAnalysis(G, BR, *this); 217} 218 219void ExprEngine::processCFGElement(const CFGElement E, ExplodedNode *Pred, 220 unsigned StmtIdx, NodeBuilderContext *Ctx) { 221 currStmtIdx = StmtIdx; 222 currBldrCtx = Ctx; 223 224 switch (E.getKind()) { 225 case CFGElement::Invalid: 226 llvm_unreachable("Unexpected CFGElement kind."); 227 case CFGElement::Statement: 228 ProcessStmt(const_cast<Stmt*>(E.castAs<CFGStmt>().getStmt()), Pred); 229 return; 230 case CFGElement::Initializer: 231 ProcessInitializer(E.castAs<CFGInitializer>().getInitializer(), Pred); 232 return; 233 case CFGElement::AutomaticObjectDtor: 234 case CFGElement::BaseDtor: 235 case CFGElement::MemberDtor: 236 case CFGElement::TemporaryDtor: 237 ProcessImplicitDtor(E.castAs<CFGImplicitDtor>(), Pred); 238 return; 239 } 240 currBldrCtx = 0; 241} 242 243static bool shouldRemoveDeadBindings(AnalysisManager &AMgr, 244 const CFGStmt S, 245 const ExplodedNode *Pred, 246 const LocationContext *LC) { 247 248 // Are we never purging state values? 249 if (AMgr.options.AnalysisPurgeOpt == PurgeNone) 250 return false; 251 252 // Is this the beginning of a basic block? 253 if (Pred->getLocation().getAs<BlockEntrance>()) 254 return true; 255 256 // Is this on a non-expression? 257 if (!isa<Expr>(S.getStmt())) 258 return true; 259 260 // Run before processing a call. 261 if (CallEvent::isCallStmt(S.getStmt())) 262 return true; 263 264 // Is this an expression that is consumed by another expression? If so, 265 // postpone cleaning out the state. 266 ParentMap &PM = LC->getAnalysisDeclContext()->getParentMap(); 267 return !PM.isConsumedExpr(cast<Expr>(S.getStmt())); 268} 269 270void ExprEngine::removeDead(ExplodedNode *Pred, ExplodedNodeSet &Out, 271 const Stmt *ReferenceStmt, 272 const LocationContext *LC, 273 const Stmt *DiagnosticStmt, 274 ProgramPoint::Kind K) { 275 assert((K == ProgramPoint::PreStmtPurgeDeadSymbolsKind || 276 ReferenceStmt == 0 || isa<ReturnStmt>(ReferenceStmt)) 277 && "PostStmt is not generally supported by the SymbolReaper yet"); 278 assert(LC && "Must pass the current (or expiring) LocationContext"); 279 280 if (!DiagnosticStmt) { 281 DiagnosticStmt = ReferenceStmt; 282 assert(DiagnosticStmt && "Required for clearing a LocationContext"); 283 } 284 285 NumRemoveDeadBindings++; 286 ProgramStateRef CleanedState = Pred->getState(); 287 288 // LC is the location context being destroyed, but SymbolReaper wants a 289 // location context that is still live. (If this is the top-level stack 290 // frame, this will be null.) 291 if (!ReferenceStmt) { 292 assert(K == ProgramPoint::PostStmtPurgeDeadSymbolsKind && 293 "Use PostStmtPurgeDeadSymbolsKind for clearing a LocationContext"); 294 LC = LC->getParent(); 295 } 296 297 const StackFrameContext *SFC = LC ? LC->getCurrentStackFrame() : 0; 298 SymbolReaper SymReaper(SFC, ReferenceStmt, SymMgr, getStoreManager()); 299 300 getCheckerManager().runCheckersForLiveSymbols(CleanedState, SymReaper); 301 302 // Create a state in which dead bindings are removed from the environment 303 // and the store. TODO: The function should just return new env and store, 304 // not a new state. 305 CleanedState = StateMgr.removeDeadBindings(CleanedState, SFC, SymReaper); 306 307 // Process any special transfer function for dead symbols. 308 // A tag to track convenience transitions, which can be removed at cleanup. 309 static SimpleProgramPointTag cleanupTag("ExprEngine : Clean Node"); 310 if (!SymReaper.hasDeadSymbols()) { 311 // Generate a CleanedNode that has the environment and store cleaned 312 // up. Since no symbols are dead, we can optimize and not clean out 313 // the constraint manager. 314 StmtNodeBuilder Bldr(Pred, Out, *currBldrCtx); 315 Bldr.generateNode(DiagnosticStmt, Pred, CleanedState, &cleanupTag, K); 316 317 } else { 318 // Call checkers with the non-cleaned state so that they could query the 319 // values of the soon to be dead symbols. 320 ExplodedNodeSet CheckedSet; 321 getCheckerManager().runCheckersForDeadSymbols(CheckedSet, Pred, SymReaper, 322 DiagnosticStmt, *this, K); 323 324 // For each node in CheckedSet, generate CleanedNodes that have the 325 // environment, the store, and the constraints cleaned up but have the 326 // user-supplied states as the predecessors. 327 StmtNodeBuilder Bldr(CheckedSet, Out, *currBldrCtx); 328 for (ExplodedNodeSet::const_iterator 329 I = CheckedSet.begin(), E = CheckedSet.end(); I != E; ++I) { 330 ProgramStateRef CheckerState = (*I)->getState(); 331 332 // The constraint manager has not been cleaned up yet, so clean up now. 333 CheckerState = getConstraintManager().removeDeadBindings(CheckerState, 334 SymReaper); 335 336 assert(StateMgr.haveEqualEnvironments(CheckerState, Pred->getState()) && 337 "Checkers are not allowed to modify the Environment as a part of " 338 "checkDeadSymbols processing."); 339 assert(StateMgr.haveEqualStores(CheckerState, Pred->getState()) && 340 "Checkers are not allowed to modify the Store as a part of " 341 "checkDeadSymbols processing."); 342 343 // Create a state based on CleanedState with CheckerState GDM and 344 // generate a transition to that state. 345 ProgramStateRef CleanedCheckerSt = 346 StateMgr.getPersistentStateWithGDM(CleanedState, CheckerState); 347 Bldr.generateNode(DiagnosticStmt, *I, CleanedCheckerSt, &cleanupTag, K); 348 } 349 } 350} 351 352void ExprEngine::ProcessStmt(const CFGStmt S, 353 ExplodedNode *Pred) { 354 // Reclaim any unnecessary nodes in the ExplodedGraph. 355 G.reclaimRecentlyAllocatedNodes(); 356 357 const Stmt *currStmt = S.getStmt(); 358 PrettyStackTraceLoc CrashInfo(getContext().getSourceManager(), 359 currStmt->getLocStart(), 360 "Error evaluating statement"); 361 362 // Remove dead bindings and symbols. 363 ExplodedNodeSet CleanedStates; 364 if (shouldRemoveDeadBindings(AMgr, S, Pred, Pred->getLocationContext())){ 365 removeDead(Pred, CleanedStates, currStmt, Pred->getLocationContext()); 366 } else 367 CleanedStates.Add(Pred); 368 369 // Visit the statement. 370 ExplodedNodeSet Dst; 371 for (ExplodedNodeSet::iterator I = CleanedStates.begin(), 372 E = CleanedStates.end(); I != E; ++I) { 373 ExplodedNodeSet DstI; 374 // Visit the statement. 375 Visit(currStmt, *I, DstI); 376 Dst.insert(DstI); 377 } 378 379 // Enqueue the new nodes onto the work list. 380 Engine.enqueue(Dst, currBldrCtx->getBlock(), currStmtIdx); 381} 382 383void ExprEngine::ProcessInitializer(const CFGInitializer Init, 384 ExplodedNode *Pred) { 385 const CXXCtorInitializer *BMI = Init.getInitializer(); 386 387 PrettyStackTraceLoc CrashInfo(getContext().getSourceManager(), 388 BMI->getSourceLocation(), 389 "Error evaluating initializer"); 390 391 // We don't clean up dead bindings here. 392 const StackFrameContext *stackFrame = 393 cast<StackFrameContext>(Pred->getLocationContext()); 394 const CXXConstructorDecl *decl = 395 cast<CXXConstructorDecl>(stackFrame->getDecl()); 396 397 ProgramStateRef State = Pred->getState(); 398 SVal thisVal = State->getSVal(svalBuilder.getCXXThis(decl, stackFrame)); 399 400 PostInitializer PP(BMI, stackFrame); 401 ExplodedNodeSet Tmp(Pred); 402 403 // Evaluate the initializer, if necessary 404 if (BMI->isAnyMemberInitializer()) { 405 // Constructors build the object directly in the field, 406 // but non-objects must be copied in from the initializer. 407 const Expr *Init = BMI->getInit()->IgnoreImplicit(); 408 if (!isa<CXXConstructExpr>(Init)) { 409 SVal FieldLoc; 410 if (BMI->isIndirectMemberInitializer()) 411 FieldLoc = State->getLValue(BMI->getIndirectMember(), thisVal); 412 else 413 FieldLoc = State->getLValue(BMI->getMember(), thisVal); 414 415 SVal InitVal = State->getSVal(BMI->getInit(), stackFrame); 416 417 Tmp.clear(); 418 evalBind(Tmp, Init, Pred, FieldLoc, InitVal, /*isInit=*/true, &PP); 419 } 420 } else { 421 assert(BMI->isBaseInitializer() || BMI->isDelegatingInitializer()); 422 // We already did all the work when visiting the CXXConstructExpr. 423 } 424 425 // Construct PostInitializer nodes whether the state changed or not, 426 // so that the diagnostics don't get confused. 427 ExplodedNodeSet Dst; 428 NodeBuilder Bldr(Tmp, Dst, *currBldrCtx); 429 for (ExplodedNodeSet::iterator I = Tmp.begin(), E = Tmp.end(); I != E; ++I) { 430 ExplodedNode *N = *I; 431 Bldr.generateNode(PP, N->getState(), N); 432 } 433 434 // Enqueue the new nodes onto the work list. 435 Engine.enqueue(Dst, currBldrCtx->getBlock(), currStmtIdx); 436} 437 438void ExprEngine::ProcessImplicitDtor(const CFGImplicitDtor D, 439 ExplodedNode *Pred) { 440 ExplodedNodeSet Dst; 441 switch (D.getKind()) { 442 case CFGElement::AutomaticObjectDtor: 443 ProcessAutomaticObjDtor(D.castAs<CFGAutomaticObjDtor>(), Pred, Dst); 444 break; 445 case CFGElement::BaseDtor: 446 ProcessBaseDtor(D.castAs<CFGBaseDtor>(), Pred, Dst); 447 break; 448 case CFGElement::MemberDtor: 449 ProcessMemberDtor(D.castAs<CFGMemberDtor>(), Pred, Dst); 450 break; 451 case CFGElement::TemporaryDtor: 452 ProcessTemporaryDtor(D.castAs<CFGTemporaryDtor>(), Pred, Dst); 453 break; 454 default: 455 llvm_unreachable("Unexpected dtor kind."); 456 } 457 458 // Enqueue the new nodes onto the work list. 459 Engine.enqueue(Dst, currBldrCtx->getBlock(), currStmtIdx); 460} 461 462void ExprEngine::ProcessAutomaticObjDtor(const CFGAutomaticObjDtor Dtor, 463 ExplodedNode *Pred, 464 ExplodedNodeSet &Dst) { 465 ProgramStateRef state = Pred->getState(); 466 const VarDecl *varDecl = Dtor.getVarDecl(); 467 468 QualType varType = varDecl->getType(); 469 470 if (const ReferenceType *refType = varType->getAs<ReferenceType>()) 471 varType = refType->getPointeeType(); 472 473 Loc dest = state->getLValue(varDecl, Pred->getLocationContext()); 474 475 VisitCXXDestructor(varType, dest.castAs<loc::MemRegionVal>().getRegion(), 476 Dtor.getTriggerStmt(), /*IsBase=*/ false, Pred, Dst); 477} 478 479void ExprEngine::ProcessBaseDtor(const CFGBaseDtor D, 480 ExplodedNode *Pred, ExplodedNodeSet &Dst) { 481 const LocationContext *LCtx = Pred->getLocationContext(); 482 ProgramStateRef State = Pred->getState(); 483 484 const CXXDestructorDecl *CurDtor = cast<CXXDestructorDecl>(LCtx->getDecl()); 485 Loc ThisPtr = getSValBuilder().getCXXThis(CurDtor, 486 LCtx->getCurrentStackFrame()); 487 SVal ThisVal = Pred->getState()->getSVal(ThisPtr); 488 489 // Create the base object region. 490 const CXXBaseSpecifier *Base = D.getBaseSpecifier(); 491 QualType BaseTy = Base->getType(); 492 SVal BaseVal = getStoreManager().evalDerivedToBase(ThisVal, BaseTy, 493 Base->isVirtual()); 494 495 VisitCXXDestructor(BaseTy, BaseVal.castAs<loc::MemRegionVal>().getRegion(), 496 CurDtor->getBody(), /*IsBase=*/ true, Pred, Dst); 497} 498 499void ExprEngine::ProcessMemberDtor(const CFGMemberDtor D, 500 ExplodedNode *Pred, ExplodedNodeSet &Dst) { 501 const FieldDecl *Member = D.getFieldDecl(); 502 ProgramStateRef State = Pred->getState(); 503 const LocationContext *LCtx = Pred->getLocationContext(); 504 505 const CXXDestructorDecl *CurDtor = cast<CXXDestructorDecl>(LCtx->getDecl()); 506 Loc ThisVal = getSValBuilder().getCXXThis(CurDtor, 507 LCtx->getCurrentStackFrame()); 508 SVal FieldVal = 509 State->getLValue(Member, State->getSVal(ThisVal).castAs<Loc>()); 510 511 VisitCXXDestructor(Member->getType(), 512 FieldVal.castAs<loc::MemRegionVal>().getRegion(), 513 CurDtor->getBody(), /*IsBase=*/false, Pred, Dst); 514} 515 516void ExprEngine::ProcessTemporaryDtor(const CFGTemporaryDtor D, 517 ExplodedNode *Pred, 518 ExplodedNodeSet &Dst) {} 519 520void ExprEngine::Visit(const Stmt *S, ExplodedNode *Pred, 521 ExplodedNodeSet &DstTop) { 522 PrettyStackTraceLoc CrashInfo(getContext().getSourceManager(), 523 S->getLocStart(), 524 "Error evaluating statement"); 525 ExplodedNodeSet Dst; 526 StmtNodeBuilder Bldr(Pred, DstTop, *currBldrCtx); 527 528 assert(!isa<Expr>(S) || S == cast<Expr>(S)->IgnoreParens()); 529 530 switch (S->getStmtClass()) { 531 // C++ and ARC stuff we don't support yet. 532 case Expr::ObjCIndirectCopyRestoreExprClass: 533 case Stmt::CXXDependentScopeMemberExprClass: 534 case Stmt::CXXPseudoDestructorExprClass: 535 case Stmt::CXXTryStmtClass: 536 case Stmt::CXXTypeidExprClass: 537 case Stmt::CXXUuidofExprClass: 538 case Stmt::CXXUnresolvedConstructExprClass: 539 case Stmt::DependentScopeDeclRefExprClass: 540 case Stmt::UnaryTypeTraitExprClass: 541 case Stmt::BinaryTypeTraitExprClass: 542 case Stmt::TypeTraitExprClass: 543 case Stmt::ArrayTypeTraitExprClass: 544 case Stmt::ExpressionTraitExprClass: 545 case Stmt::UnresolvedLookupExprClass: 546 case Stmt::UnresolvedMemberExprClass: 547 case Stmt::CXXNoexceptExprClass: 548 case Stmt::PackExpansionExprClass: 549 case Stmt::SubstNonTypeTemplateParmPackExprClass: 550 case Stmt::FunctionParmPackExprClass: 551 case Stmt::SEHTryStmtClass: 552 case Stmt::SEHExceptStmtClass: 553 case Stmt::LambdaExprClass: 554 case Stmt::SEHFinallyStmtClass: { 555 const ExplodedNode *node = Bldr.generateSink(S, Pred, Pred->getState()); 556 Engine.addAbortedBlock(node, currBldrCtx->getBlock()); 557 break; 558 } 559 560 case Stmt::ParenExprClass: 561 llvm_unreachable("ParenExprs already handled."); 562 case Stmt::GenericSelectionExprClass: 563 llvm_unreachable("GenericSelectionExprs already handled."); 564 // Cases that should never be evaluated simply because they shouldn't 565 // appear in the CFG. 566 case Stmt::BreakStmtClass: 567 case Stmt::CaseStmtClass: 568 case Stmt::CompoundStmtClass: 569 case Stmt::ContinueStmtClass: 570 case Stmt::CXXForRangeStmtClass: 571 case Stmt::DefaultStmtClass: 572 case Stmt::DoStmtClass: 573 case Stmt::ForStmtClass: 574 case Stmt::GotoStmtClass: 575 case Stmt::IfStmtClass: 576 case Stmt::IndirectGotoStmtClass: 577 case Stmt::LabelStmtClass: 578 case Stmt::AttributedStmtClass: 579 case Stmt::NoStmtClass: 580 case Stmt::NullStmtClass: 581 case Stmt::SwitchStmtClass: 582 case Stmt::WhileStmtClass: 583 case Expr::MSDependentExistsStmtClass: 584 llvm_unreachable("Stmt should not be in analyzer evaluation loop"); 585 586 case Stmt::ObjCSubscriptRefExprClass: 587 case Stmt::ObjCPropertyRefExprClass: 588 llvm_unreachable("These are handled by PseudoObjectExpr"); 589 590 case Stmt::GNUNullExprClass: { 591 // GNU __null is a pointer-width integer, not an actual pointer. 592 ProgramStateRef state = Pred->getState(); 593 state = state->BindExpr(S, Pred->getLocationContext(), 594 svalBuilder.makeIntValWithPtrWidth(0, false)); 595 Bldr.generateNode(S, Pred, state); 596 break; 597 } 598 599 case Stmt::ObjCAtSynchronizedStmtClass: 600 Bldr.takeNodes(Pred); 601 VisitObjCAtSynchronizedStmt(cast<ObjCAtSynchronizedStmt>(S), Pred, Dst); 602 Bldr.addNodes(Dst); 603 break; 604 605 case Stmt::ExprWithCleanupsClass: 606 // Handled due to fully linearised CFG. 607 break; 608 609 // Cases not handled yet; but will handle some day. 610 case Stmt::DesignatedInitExprClass: 611 case Stmt::ExtVectorElementExprClass: 612 case Stmt::ImaginaryLiteralClass: 613 case Stmt::ObjCAtCatchStmtClass: 614 case Stmt::ObjCAtFinallyStmtClass: 615 case Stmt::ObjCAtTryStmtClass: 616 case Stmt::ObjCAutoreleasePoolStmtClass: 617 case Stmt::ObjCEncodeExprClass: 618 case Stmt::ObjCIsaExprClass: 619 case Stmt::ObjCProtocolExprClass: 620 case Stmt::ObjCSelectorExprClass: 621 case Stmt::ParenListExprClass: 622 case Stmt::PredefinedExprClass: 623 case Stmt::ShuffleVectorExprClass: 624 case Stmt::VAArgExprClass: 625 case Stmt::CUDAKernelCallExprClass: 626 case Stmt::OpaqueValueExprClass: 627 case Stmt::AsTypeExprClass: 628 case Stmt::AtomicExprClass: 629 // Fall through. 630 631 // Cases we intentionally don't evaluate, since they don't need 632 // to be explicitly evaluated. 633 case Stmt::AddrLabelExprClass: 634 case Stmt::IntegerLiteralClass: 635 case Stmt::CharacterLiteralClass: 636 case Stmt::ImplicitValueInitExprClass: 637 case Stmt::CXXScalarValueInitExprClass: 638 case Stmt::CXXBoolLiteralExprClass: 639 case Stmt::ObjCBoolLiteralExprClass: 640 case Stmt::FloatingLiteralClass: 641 case Stmt::SizeOfPackExprClass: 642 case Stmt::StringLiteralClass: 643 case Stmt::ObjCStringLiteralClass: 644 case Stmt::CXXBindTemporaryExprClass: 645 case Stmt::SubstNonTypeTemplateParmExprClass: 646 case Stmt::CXXNullPtrLiteralExprClass: { 647 Bldr.takeNodes(Pred); 648 ExplodedNodeSet preVisit; 649 getCheckerManager().runCheckersForPreStmt(preVisit, Pred, S, *this); 650 getCheckerManager().runCheckersForPostStmt(Dst, preVisit, S, *this); 651 Bldr.addNodes(Dst); 652 break; 653 } 654 655 case Stmt::CXXDefaultArgExprClass: { 656 Bldr.takeNodes(Pred); 657 ExplodedNodeSet PreVisit; 658 getCheckerManager().runCheckersForPreStmt(PreVisit, Pred, S, *this); 659 660 ExplodedNodeSet Tmp; 661 StmtNodeBuilder Bldr2(PreVisit, Tmp, *currBldrCtx); 662 663 const LocationContext *LCtx = Pred->getLocationContext(); 664 const Expr *ArgE = cast<CXXDefaultArgExpr>(S)->getExpr(); 665 666 // Avoid creating and destroying a lot of APSInts. 667 SVal V; 668 llvm::APSInt Result; 669 670 for (ExplodedNodeSet::iterator I = PreVisit.begin(), E = PreVisit.end(); 671 I != E; ++I) { 672 ProgramStateRef State = (*I)->getState(); 673 674 if (ArgE->EvaluateAsInt(Result, getContext())) 675 V = svalBuilder.makeIntVal(Result); 676 else 677 V = State->getSVal(ArgE, LCtx); 678 679 State = State->BindExpr(S, LCtx, V); 680 Bldr2.generateNode(S, *I, State); 681 } 682 683 getCheckerManager().runCheckersForPostStmt(Dst, Tmp, S, *this); 684 Bldr.addNodes(Dst); 685 break; 686 } 687 688 case Expr::ObjCArrayLiteralClass: 689 case Expr::ObjCDictionaryLiteralClass: 690 // FIXME: explicitly model with a region and the actual contents 691 // of the container. For now, conjure a symbol. 692 case Expr::ObjCBoxedExprClass: { 693 Bldr.takeNodes(Pred); 694 695 ExplodedNodeSet preVisit; 696 getCheckerManager().runCheckersForPreStmt(preVisit, Pred, S, *this); 697 698 ExplodedNodeSet Tmp; 699 StmtNodeBuilder Bldr2(preVisit, Tmp, *currBldrCtx); 700 701 const Expr *Ex = cast<Expr>(S); 702 QualType resultType = Ex->getType(); 703 704 for (ExplodedNodeSet::iterator it = preVisit.begin(), et = preVisit.end(); 705 it != et; ++it) { 706 ExplodedNode *N = *it; 707 const LocationContext *LCtx = N->getLocationContext(); 708 SVal result = svalBuilder.conjureSymbolVal(0, Ex, LCtx, resultType, 709 currBldrCtx->blockCount()); 710 ProgramStateRef state = N->getState()->BindExpr(Ex, LCtx, result); 711 Bldr2.generateNode(S, N, state); 712 } 713 714 getCheckerManager().runCheckersForPostStmt(Dst, Tmp, S, *this); 715 Bldr.addNodes(Dst); 716 break; 717 } 718 719 case Stmt::ArraySubscriptExprClass: 720 Bldr.takeNodes(Pred); 721 VisitLvalArraySubscriptExpr(cast<ArraySubscriptExpr>(S), Pred, Dst); 722 Bldr.addNodes(Dst); 723 break; 724 725 case Stmt::GCCAsmStmtClass: 726 Bldr.takeNodes(Pred); 727 VisitGCCAsmStmt(cast<GCCAsmStmt>(S), Pred, Dst); 728 Bldr.addNodes(Dst); 729 break; 730 731 case Stmt::MSAsmStmtClass: 732 Bldr.takeNodes(Pred); 733 VisitMSAsmStmt(cast<MSAsmStmt>(S), Pred, Dst); 734 Bldr.addNodes(Dst); 735 break; 736 737 case Stmt::BlockExprClass: 738 Bldr.takeNodes(Pred); 739 VisitBlockExpr(cast<BlockExpr>(S), Pred, Dst); 740 Bldr.addNodes(Dst); 741 break; 742 743 case Stmt::BinaryOperatorClass: { 744 const BinaryOperator* B = cast<BinaryOperator>(S); 745 if (B->isLogicalOp()) { 746 Bldr.takeNodes(Pred); 747 VisitLogicalExpr(B, Pred, Dst); 748 Bldr.addNodes(Dst); 749 break; 750 } 751 else if (B->getOpcode() == BO_Comma) { 752 ProgramStateRef state = Pred->getState(); 753 Bldr.generateNode(B, Pred, 754 state->BindExpr(B, Pred->getLocationContext(), 755 state->getSVal(B->getRHS(), 756 Pred->getLocationContext()))); 757 break; 758 } 759 760 Bldr.takeNodes(Pred); 761 762 if (AMgr.options.eagerlyAssumeBinOpBifurcation && 763 (B->isRelationalOp() || B->isEqualityOp())) { 764 ExplodedNodeSet Tmp; 765 VisitBinaryOperator(cast<BinaryOperator>(S), Pred, Tmp); 766 evalEagerlyAssumeBinOpBifurcation(Dst, Tmp, cast<Expr>(S)); 767 } 768 else 769 VisitBinaryOperator(cast<BinaryOperator>(S), Pred, Dst); 770 771 Bldr.addNodes(Dst); 772 break; 773 } 774 775 case Stmt::CXXOperatorCallExprClass: { 776 const CXXOperatorCallExpr *OCE = cast<CXXOperatorCallExpr>(S); 777 778 // For instance method operators, make sure the 'this' argument has a 779 // valid region. 780 const Decl *Callee = OCE->getCalleeDecl(); 781 if (const CXXMethodDecl *MD = dyn_cast_or_null<CXXMethodDecl>(Callee)) { 782 if (MD->isInstance()) { 783 ProgramStateRef State = Pred->getState(); 784 const LocationContext *LCtx = Pred->getLocationContext(); 785 ProgramStateRef NewState = 786 createTemporaryRegionIfNeeded(State, LCtx, OCE->getArg(0)); 787 if (NewState != State) 788 Pred = Bldr.generateNode(OCE, Pred, NewState, /*Tag=*/0, 789 ProgramPoint::PreStmtKind); 790 } 791 } 792 // FALLTHROUGH 793 } 794 case Stmt::CallExprClass: 795 case Stmt::CXXMemberCallExprClass: 796 case Stmt::UserDefinedLiteralClass: { 797 Bldr.takeNodes(Pred); 798 VisitCallExpr(cast<CallExpr>(S), Pred, Dst); 799 Bldr.addNodes(Dst); 800 break; 801 } 802 803 case Stmt::CXXCatchStmtClass: { 804 Bldr.takeNodes(Pred); 805 VisitCXXCatchStmt(cast<CXXCatchStmt>(S), Pred, Dst); 806 Bldr.addNodes(Dst); 807 break; 808 } 809 810 case Stmt::CXXTemporaryObjectExprClass: 811 case Stmt::CXXConstructExprClass: { 812 Bldr.takeNodes(Pred); 813 VisitCXXConstructExpr(cast<CXXConstructExpr>(S), Pred, Dst); 814 Bldr.addNodes(Dst); 815 break; 816 } 817 818 case Stmt::CXXNewExprClass: { 819 Bldr.takeNodes(Pred); 820 ExplodedNodeSet PostVisit; 821 VisitCXXNewExpr(cast<CXXNewExpr>(S), Pred, PostVisit); 822 getCheckerManager().runCheckersForPostStmt(Dst, PostVisit, S, *this); 823 Bldr.addNodes(Dst); 824 break; 825 } 826 827 case Stmt::CXXDeleteExprClass: { 828 Bldr.takeNodes(Pred); 829 ExplodedNodeSet PreVisit; 830 const CXXDeleteExpr *CDE = cast<CXXDeleteExpr>(S); 831 getCheckerManager().runCheckersForPreStmt(PreVisit, Pred, S, *this); 832 833 for (ExplodedNodeSet::iterator i = PreVisit.begin(), 834 e = PreVisit.end(); i != e ; ++i) 835 VisitCXXDeleteExpr(CDE, *i, Dst); 836 837 Bldr.addNodes(Dst); 838 break; 839 } 840 // FIXME: ChooseExpr is really a constant. We need to fix 841 // the CFG do not model them as explicit control-flow. 842 843 case Stmt::ChooseExprClass: { // __builtin_choose_expr 844 Bldr.takeNodes(Pred); 845 const ChooseExpr *C = cast<ChooseExpr>(S); 846 VisitGuardedExpr(C, C->getLHS(), C->getRHS(), Pred, Dst); 847 Bldr.addNodes(Dst); 848 break; 849 } 850 851 case Stmt::CompoundAssignOperatorClass: 852 Bldr.takeNodes(Pred); 853 VisitBinaryOperator(cast<BinaryOperator>(S), Pred, Dst); 854 Bldr.addNodes(Dst); 855 break; 856 857 case Stmt::CompoundLiteralExprClass: 858 Bldr.takeNodes(Pred); 859 VisitCompoundLiteralExpr(cast<CompoundLiteralExpr>(S), Pred, Dst); 860 Bldr.addNodes(Dst); 861 break; 862 863 case Stmt::BinaryConditionalOperatorClass: 864 case Stmt::ConditionalOperatorClass: { // '?' operator 865 Bldr.takeNodes(Pred); 866 const AbstractConditionalOperator *C 867 = cast<AbstractConditionalOperator>(S); 868 VisitGuardedExpr(C, C->getTrueExpr(), C->getFalseExpr(), Pred, Dst); 869 Bldr.addNodes(Dst); 870 break; 871 } 872 873 case Stmt::CXXThisExprClass: 874 Bldr.takeNodes(Pred); 875 VisitCXXThisExpr(cast<CXXThisExpr>(S), Pred, Dst); 876 Bldr.addNodes(Dst); 877 break; 878 879 case Stmt::DeclRefExprClass: { 880 Bldr.takeNodes(Pred); 881 const DeclRefExpr *DE = cast<DeclRefExpr>(S); 882 VisitCommonDeclRefExpr(DE, DE->getDecl(), Pred, Dst); 883 Bldr.addNodes(Dst); 884 break; 885 } 886 887 case Stmt::DeclStmtClass: 888 Bldr.takeNodes(Pred); 889 VisitDeclStmt(cast<DeclStmt>(S), Pred, Dst); 890 Bldr.addNodes(Dst); 891 break; 892 893 case Stmt::ImplicitCastExprClass: 894 case Stmt::CStyleCastExprClass: 895 case Stmt::CXXStaticCastExprClass: 896 case Stmt::CXXDynamicCastExprClass: 897 case Stmt::CXXReinterpretCastExprClass: 898 case Stmt::CXXConstCastExprClass: 899 case Stmt::CXXFunctionalCastExprClass: 900 case Stmt::ObjCBridgedCastExprClass: { 901 Bldr.takeNodes(Pred); 902 const CastExpr *C = cast<CastExpr>(S); 903 // Handle the previsit checks. 904 ExplodedNodeSet dstPrevisit; 905 getCheckerManager().runCheckersForPreStmt(dstPrevisit, Pred, C, *this); 906 907 // Handle the expression itself. 908 ExplodedNodeSet dstExpr; 909 for (ExplodedNodeSet::iterator i = dstPrevisit.begin(), 910 e = dstPrevisit.end(); i != e ; ++i) { 911 VisitCast(C, C->getSubExpr(), *i, dstExpr); 912 } 913 914 // Handle the postvisit checks. 915 getCheckerManager().runCheckersForPostStmt(Dst, dstExpr, C, *this); 916 Bldr.addNodes(Dst); 917 break; 918 } 919 920 case Expr::MaterializeTemporaryExprClass: { 921 Bldr.takeNodes(Pred); 922 const MaterializeTemporaryExpr *MTE = cast<MaterializeTemporaryExpr>(S); 923 CreateCXXTemporaryObject(MTE, Pred, Dst); 924 Bldr.addNodes(Dst); 925 break; 926 } 927 928 case Stmt::InitListExprClass: 929 Bldr.takeNodes(Pred); 930 VisitInitListExpr(cast<InitListExpr>(S), Pred, Dst); 931 Bldr.addNodes(Dst); 932 break; 933 934 case Stmt::MemberExprClass: 935 Bldr.takeNodes(Pred); 936 VisitMemberExpr(cast<MemberExpr>(S), Pred, Dst); 937 Bldr.addNodes(Dst); 938 break; 939 940 case Stmt::ObjCIvarRefExprClass: 941 Bldr.takeNodes(Pred); 942 VisitLvalObjCIvarRefExpr(cast<ObjCIvarRefExpr>(S), Pred, Dst); 943 Bldr.addNodes(Dst); 944 break; 945 946 case Stmt::ObjCForCollectionStmtClass: 947 Bldr.takeNodes(Pred); 948 VisitObjCForCollectionStmt(cast<ObjCForCollectionStmt>(S), Pred, Dst); 949 Bldr.addNodes(Dst); 950 break; 951 952 case Stmt::ObjCMessageExprClass: 953 Bldr.takeNodes(Pred); 954 VisitObjCMessage(cast<ObjCMessageExpr>(S), Pred, Dst); 955 Bldr.addNodes(Dst); 956 break; 957 958 case Stmt::ObjCAtThrowStmtClass: 959 case Stmt::CXXThrowExprClass: 960 // FIXME: This is not complete. We basically treat @throw as 961 // an abort. 962 Bldr.generateSink(S, Pred, Pred->getState()); 963 break; 964 965 case Stmt::ReturnStmtClass: 966 Bldr.takeNodes(Pred); 967 VisitReturnStmt(cast<ReturnStmt>(S), Pred, Dst); 968 Bldr.addNodes(Dst); 969 break; 970 971 case Stmt::OffsetOfExprClass: 972 Bldr.takeNodes(Pred); 973 VisitOffsetOfExpr(cast<OffsetOfExpr>(S), Pred, Dst); 974 Bldr.addNodes(Dst); 975 break; 976 977 case Stmt::UnaryExprOrTypeTraitExprClass: 978 Bldr.takeNodes(Pred); 979 VisitUnaryExprOrTypeTraitExpr(cast<UnaryExprOrTypeTraitExpr>(S), 980 Pred, Dst); 981 Bldr.addNodes(Dst); 982 break; 983 984 case Stmt::StmtExprClass: { 985 const StmtExpr *SE = cast<StmtExpr>(S); 986 987 if (SE->getSubStmt()->body_empty()) { 988 // Empty statement expression. 989 assert(SE->getType() == getContext().VoidTy 990 && "Empty statement expression must have void type."); 991 break; 992 } 993 994 if (Expr *LastExpr = dyn_cast<Expr>(*SE->getSubStmt()->body_rbegin())) { 995 ProgramStateRef state = Pred->getState(); 996 Bldr.generateNode(SE, Pred, 997 state->BindExpr(SE, Pred->getLocationContext(), 998 state->getSVal(LastExpr, 999 Pred->getLocationContext()))); 1000 } 1001 break; 1002 } 1003 1004 case Stmt::UnaryOperatorClass: { 1005 Bldr.takeNodes(Pred); 1006 const UnaryOperator *U = cast<UnaryOperator>(S); 1007 if (AMgr.options.eagerlyAssumeBinOpBifurcation && (U->getOpcode() == UO_LNot)) { 1008 ExplodedNodeSet Tmp; 1009 VisitUnaryOperator(U, Pred, Tmp); 1010 evalEagerlyAssumeBinOpBifurcation(Dst, Tmp, U); 1011 } 1012 else 1013 VisitUnaryOperator(U, Pred, Dst); 1014 Bldr.addNodes(Dst); 1015 break; 1016 } 1017 1018 case Stmt::PseudoObjectExprClass: { 1019 Bldr.takeNodes(Pred); 1020 ProgramStateRef state = Pred->getState(); 1021 const PseudoObjectExpr *PE = cast<PseudoObjectExpr>(S); 1022 if (const Expr *Result = PE->getResultExpr()) { 1023 SVal V = state->getSVal(Result, Pred->getLocationContext()); 1024 Bldr.generateNode(S, Pred, 1025 state->BindExpr(S, Pred->getLocationContext(), V)); 1026 } 1027 else 1028 Bldr.generateNode(S, Pred, 1029 state->BindExpr(S, Pred->getLocationContext(), 1030 UnknownVal())); 1031 1032 Bldr.addNodes(Dst); 1033 break; 1034 } 1035 } 1036} 1037 1038bool ExprEngine::replayWithoutInlining(ExplodedNode *N, 1039 const LocationContext *CalleeLC) { 1040 const StackFrameContext *CalleeSF = CalleeLC->getCurrentStackFrame(); 1041 const StackFrameContext *CallerSF = CalleeSF->getParent()->getCurrentStackFrame(); 1042 assert(CalleeSF && CallerSF); 1043 ExplodedNode *BeforeProcessingCall = 0; 1044 const Stmt *CE = CalleeSF->getCallSite(); 1045 1046 // Find the first node before we started processing the call expression. 1047 while (N) { 1048 ProgramPoint L = N->getLocation(); 1049 BeforeProcessingCall = N; 1050 N = N->pred_empty() ? NULL : *(N->pred_begin()); 1051 1052 // Skip the nodes corresponding to the inlined code. 1053 if (L.getLocationContext()->getCurrentStackFrame() != CallerSF) 1054 continue; 1055 // We reached the caller. Find the node right before we started 1056 // processing the call. 1057 if (L.isPurgeKind()) 1058 continue; 1059 if (L.getAs<PreImplicitCall>()) 1060 continue; 1061 if (L.getAs<CallEnter>()) 1062 continue; 1063 if (Optional<StmtPoint> SP = L.getAs<StmtPoint>()) 1064 if (SP->getStmt() == CE) 1065 continue; 1066 break; 1067 } 1068 1069 if (!BeforeProcessingCall) 1070 return false; 1071 1072 // TODO: Clean up the unneeded nodes. 1073 1074 // Build an Epsilon node from which we will restart the analyzes. 1075 // Note that CE is permitted to be NULL! 1076 ProgramPoint NewNodeLoc = 1077 EpsilonPoint(BeforeProcessingCall->getLocationContext(), CE); 1078 // Add the special flag to GDM to signal retrying with no inlining. 1079 // Note, changing the state ensures that we are not going to cache out. 1080 ProgramStateRef NewNodeState = BeforeProcessingCall->getState(); 1081 NewNodeState = 1082 NewNodeState->set<ReplayWithoutInlining>(const_cast<Stmt *>(CE)); 1083 1084 // Make the new node a successor of BeforeProcessingCall. 1085 bool IsNew = false; 1086 ExplodedNode *NewNode = G.getNode(NewNodeLoc, NewNodeState, false, &IsNew); 1087 // We cached out at this point. Caching out is common due to us backtracking 1088 // from the inlined function, which might spawn several paths. 1089 if (!IsNew) 1090 return true; 1091 1092 NewNode->addPredecessor(BeforeProcessingCall, G); 1093 1094 // Add the new node to the work list. 1095 Engine.enqueueStmtNode(NewNode, CalleeSF->getCallSiteBlock(), 1096 CalleeSF->getIndex()); 1097 NumTimesRetriedWithoutInlining++; 1098 return true; 1099} 1100 1101/// Block entrance. (Update counters). 1102void ExprEngine::processCFGBlockEntrance(const BlockEdge &L, 1103 NodeBuilderWithSinks &nodeBuilder, 1104 ExplodedNode *Pred) { 1105 1106 // FIXME: Refactor this into a checker. 1107 if (nodeBuilder.getContext().blockCount() >= AMgr.options.maxBlockVisitOnPath) { 1108 static SimpleProgramPointTag tag("ExprEngine : Block count exceeded"); 1109 const ExplodedNode *Sink = 1110 nodeBuilder.generateSink(Pred->getState(), Pred, &tag); 1111 1112 // Check if we stopped at the top level function or not. 1113 // Root node should have the location context of the top most function. 1114 const LocationContext *CalleeLC = Pred->getLocation().getLocationContext(); 1115 const LocationContext *CalleeSF = CalleeLC->getCurrentStackFrame(); 1116 const LocationContext *RootLC = 1117 (*G.roots_begin())->getLocation().getLocationContext(); 1118 if (RootLC->getCurrentStackFrame() != CalleeSF) { 1119 Engine.FunctionSummaries->markReachedMaxBlockCount(CalleeSF->getDecl()); 1120 1121 // Re-run the call evaluation without inlining it, by storing the 1122 // no-inlining policy in the state and enqueuing the new work item on 1123 // the list. Replay should almost never fail. Use the stats to catch it 1124 // if it does. 1125 if ((!AMgr.options.NoRetryExhausted && 1126 replayWithoutInlining(Pred, CalleeLC))) 1127 return; 1128 NumMaxBlockCountReachedInInlined++; 1129 } else 1130 NumMaxBlockCountReached++; 1131 1132 // Make sink nodes as exhausted(for stats) only if retry failed. 1133 Engine.blocksExhausted.push_back(std::make_pair(L, Sink)); 1134 } 1135} 1136 1137//===----------------------------------------------------------------------===// 1138// Branch processing. 1139//===----------------------------------------------------------------------===// 1140 1141/// RecoverCastedSymbol - A helper function for ProcessBranch that is used 1142/// to try to recover some path-sensitivity for casts of symbolic 1143/// integers that promote their values (which are currently not tracked well). 1144/// This function returns the SVal bound to Condition->IgnoreCasts if all the 1145// cast(s) did was sign-extend the original value. 1146static SVal RecoverCastedSymbol(ProgramStateManager& StateMgr, 1147 ProgramStateRef state, 1148 const Stmt *Condition, 1149 const LocationContext *LCtx, 1150 ASTContext &Ctx) { 1151 1152 const Expr *Ex = dyn_cast<Expr>(Condition); 1153 if (!Ex) 1154 return UnknownVal(); 1155 1156 uint64_t bits = 0; 1157 bool bitsInit = false; 1158 1159 while (const CastExpr *CE = dyn_cast<CastExpr>(Ex)) { 1160 QualType T = CE->getType(); 1161 1162 if (!T->isIntegerType()) 1163 return UnknownVal(); 1164 1165 uint64_t newBits = Ctx.getTypeSize(T); 1166 if (!bitsInit || newBits < bits) { 1167 bitsInit = true; 1168 bits = newBits; 1169 } 1170 1171 Ex = CE->getSubExpr(); 1172 } 1173 1174 // We reached a non-cast. Is it a symbolic value? 1175 QualType T = Ex->getType(); 1176 1177 if (!bitsInit || !T->isIntegerType() || Ctx.getTypeSize(T) > bits) 1178 return UnknownVal(); 1179 1180 return state->getSVal(Ex, LCtx); 1181} 1182 1183static const Stmt *ResolveCondition(const Stmt *Condition, 1184 const CFGBlock *B) { 1185 if (const Expr *Ex = dyn_cast<Expr>(Condition)) 1186 Condition = Ex->IgnoreParens(); 1187 1188 const BinaryOperator *BO = dyn_cast<BinaryOperator>(Condition); 1189 if (!BO || !BO->isLogicalOp()) 1190 return Condition; 1191 1192 // For logical operations, we still have the case where some branches 1193 // use the traditional "merge" approach and others sink the branch 1194 // directly into the basic blocks representing the logical operation. 1195 // We need to distinguish between those two cases here. 1196 1197 // The invariants are still shifting, but it is possible that the 1198 // last element in a CFGBlock is not a CFGStmt. Look for the last 1199 // CFGStmt as the value of the condition. 1200 CFGBlock::const_reverse_iterator I = B->rbegin(), E = B->rend(); 1201 for (; I != E; ++I) { 1202 CFGElement Elem = *I; 1203 CFGStmt CS = Elem.getAs<CFGStmt>(); 1204 if (!CS) 1205 continue; 1206 if (CS.getStmt() != Condition) 1207 break; 1208 return Condition; 1209 } 1210 1211 assert(I != E); 1212 1213 while (Condition) { 1214 BO = dyn_cast<BinaryOperator>(Condition); 1215 if (!BO || !BO->isLogicalOp()) 1216 return Condition; 1217 Condition = BO->getRHS()->IgnoreParens(); 1218 } 1219 llvm_unreachable("could not resolve condition"); 1220} 1221 1222void ExprEngine::processBranch(const Stmt *Condition, const Stmt *Term, 1223 NodeBuilderContext& BldCtx, 1224 ExplodedNode *Pred, 1225 ExplodedNodeSet &Dst, 1226 const CFGBlock *DstT, 1227 const CFGBlock *DstF) { 1228 currBldrCtx = &BldCtx; 1229 1230 // Check for NULL conditions; e.g. "for(;;)" 1231 if (!Condition) { 1232 BranchNodeBuilder NullCondBldr(Pred, Dst, BldCtx, DstT, DstF); 1233 NullCondBldr.markInfeasible(false); 1234 NullCondBldr.generateNode(Pred->getState(), true, Pred); 1235 return; 1236 } 1237 1238 1239 // Resolve the condition in the precense of nested '||' and '&&'. 1240 if (const Expr *Ex = dyn_cast<Expr>(Condition)) 1241 Condition = Ex->IgnoreParens(); 1242 1243 Condition = ResolveCondition(Condition, BldCtx.getBlock()); 1244 PrettyStackTraceLoc CrashInfo(getContext().getSourceManager(), 1245 Condition->getLocStart(), 1246 "Error evaluating branch"); 1247 1248 ExplodedNodeSet CheckersOutSet; 1249 getCheckerManager().runCheckersForBranchCondition(Condition, CheckersOutSet, 1250 Pred, *this); 1251 // We generated only sinks. 1252 if (CheckersOutSet.empty()) 1253 return; 1254 1255 BranchNodeBuilder builder(CheckersOutSet, Dst, BldCtx, DstT, DstF); 1256 for (NodeBuilder::iterator I = CheckersOutSet.begin(), 1257 E = CheckersOutSet.end(); E != I; ++I) { 1258 ExplodedNode *PredI = *I; 1259 1260 if (PredI->isSink()) 1261 continue; 1262 1263 ProgramStateRef PrevState = PredI->getState(); 1264 SVal X = PrevState->getSVal(Condition, PredI->getLocationContext()); 1265 1266 if (X.isUnknownOrUndef()) { 1267 // Give it a chance to recover from unknown. 1268 if (const Expr *Ex = dyn_cast<Expr>(Condition)) { 1269 if (Ex->getType()->isIntegerType()) { 1270 // Try to recover some path-sensitivity. Right now casts of symbolic 1271 // integers that promote their values are currently not tracked well. 1272 // If 'Condition' is such an expression, try and recover the 1273 // underlying value and use that instead. 1274 SVal recovered = RecoverCastedSymbol(getStateManager(), 1275 PrevState, Condition, 1276 PredI->getLocationContext(), 1277 getContext()); 1278 1279 if (!recovered.isUnknown()) { 1280 X = recovered; 1281 } 1282 } 1283 } 1284 } 1285 1286 // If the condition is still unknown, give up. 1287 if (X.isUnknownOrUndef()) { 1288 builder.generateNode(PrevState, true, PredI); 1289 builder.generateNode(PrevState, false, PredI); 1290 continue; 1291 } 1292 1293 DefinedSVal V = X.castAs<DefinedSVal>(); 1294 1295 ProgramStateRef StTrue, StFalse; 1296 tie(StTrue, StFalse) = PrevState->assume(V); 1297 1298 // Process the true branch. 1299 if (builder.isFeasible(true)) { 1300 if (StTrue) 1301 builder.generateNode(StTrue, true, PredI); 1302 else 1303 builder.markInfeasible(true); 1304 } 1305 1306 // Process the false branch. 1307 if (builder.isFeasible(false)) { 1308 if (StFalse) 1309 builder.generateNode(StFalse, false, PredI); 1310 else 1311 builder.markInfeasible(false); 1312 } 1313 } 1314 currBldrCtx = 0; 1315} 1316 1317/// processIndirectGoto - Called by CoreEngine. Used to generate successor 1318/// nodes by processing the 'effects' of a computed goto jump. 1319void ExprEngine::processIndirectGoto(IndirectGotoNodeBuilder &builder) { 1320 1321 ProgramStateRef state = builder.getState(); 1322 SVal V = state->getSVal(builder.getTarget(), builder.getLocationContext()); 1323 1324 // Three possibilities: 1325 // 1326 // (1) We know the computed label. 1327 // (2) The label is NULL (or some other constant), or Undefined. 1328 // (3) We have no clue about the label. Dispatch to all targets. 1329 // 1330 1331 typedef IndirectGotoNodeBuilder::iterator iterator; 1332 1333 if (Optional<loc::GotoLabel> LV = V.getAs<loc::GotoLabel>()) { 1334 const LabelDecl *L = LV->getLabel(); 1335 1336 for (iterator I = builder.begin(), E = builder.end(); I != E; ++I) { 1337 if (I.getLabel() == L) { 1338 builder.generateNode(I, state); 1339 return; 1340 } 1341 } 1342 1343 llvm_unreachable("No block with label."); 1344 } 1345 1346 if (V.getAs<loc::ConcreteInt>() || V.getAs<UndefinedVal>()) { 1347 // Dispatch to the first target and mark it as a sink. 1348 //ExplodedNode* N = builder.generateNode(builder.begin(), state, true); 1349 // FIXME: add checker visit. 1350 // UndefBranches.insert(N); 1351 return; 1352 } 1353 1354 // This is really a catch-all. We don't support symbolics yet. 1355 // FIXME: Implement dispatch for symbolic pointers. 1356 1357 for (iterator I=builder.begin(), E=builder.end(); I != E; ++I) 1358 builder.generateNode(I, state); 1359} 1360 1361/// ProcessEndPath - Called by CoreEngine. Used to generate end-of-path 1362/// nodes when the control reaches the end of a function. 1363void ExprEngine::processEndOfFunction(NodeBuilderContext& BC, 1364 ExplodedNode *Pred) { 1365 StateMgr.EndPath(Pred->getState()); 1366 1367 ExplodedNodeSet Dst; 1368 if (Pred->getLocationContext()->inTopFrame()) { 1369 // Remove dead symbols. 1370 ExplodedNodeSet AfterRemovedDead; 1371 removeDeadOnEndOfFunction(BC, Pred, AfterRemovedDead); 1372 1373 // Notify checkers. 1374 for (ExplodedNodeSet::iterator I = AfterRemovedDead.begin(), 1375 E = AfterRemovedDead.end(); I != E; ++I) { 1376 getCheckerManager().runCheckersForEndFunction(BC, Dst, *I, *this); 1377 } 1378 } else { 1379 getCheckerManager().runCheckersForEndFunction(BC, Dst, Pred, *this); 1380 } 1381 1382 Engine.enqueueEndOfFunction(Dst); 1383} 1384 1385/// ProcessSwitch - Called by CoreEngine. Used to generate successor 1386/// nodes by processing the 'effects' of a switch statement. 1387void ExprEngine::processSwitch(SwitchNodeBuilder& builder) { 1388 typedef SwitchNodeBuilder::iterator iterator; 1389 ProgramStateRef state = builder.getState(); 1390 const Expr *CondE = builder.getCondition(); 1391 SVal CondV_untested = state->getSVal(CondE, builder.getLocationContext()); 1392 1393 if (CondV_untested.isUndef()) { 1394 //ExplodedNode* N = builder.generateDefaultCaseNode(state, true); 1395 // FIXME: add checker 1396 //UndefBranches.insert(N); 1397 1398 return; 1399 } 1400 DefinedOrUnknownSVal CondV = CondV_untested.castAs<DefinedOrUnknownSVal>(); 1401 1402 ProgramStateRef DefaultSt = state; 1403 1404 iterator I = builder.begin(), EI = builder.end(); 1405 bool defaultIsFeasible = I == EI; 1406 1407 for ( ; I != EI; ++I) { 1408 // Successor may be pruned out during CFG construction. 1409 if (!I.getBlock()) 1410 continue; 1411 1412 const CaseStmt *Case = I.getCase(); 1413 1414 // Evaluate the LHS of the case value. 1415 llvm::APSInt V1 = Case->getLHS()->EvaluateKnownConstInt(getContext()); 1416 assert(V1.getBitWidth() == getContext().getTypeSize(CondE->getType())); 1417 1418 // Get the RHS of the case, if it exists. 1419 llvm::APSInt V2; 1420 if (const Expr *E = Case->getRHS()) 1421 V2 = E->EvaluateKnownConstInt(getContext()); 1422 else 1423 V2 = V1; 1424 1425 // FIXME: Eventually we should replace the logic below with a range 1426 // comparison, rather than concretize the values within the range. 1427 // This should be easy once we have "ranges" for NonLVals. 1428 1429 do { 1430 nonloc::ConcreteInt CaseVal(getBasicVals().getValue(V1)); 1431 DefinedOrUnknownSVal Res = svalBuilder.evalEQ(DefaultSt ? DefaultSt : state, 1432 CondV, CaseVal); 1433 1434 // Now "assume" that the case matches. 1435 if (ProgramStateRef stateNew = state->assume(Res, true)) { 1436 builder.generateCaseStmtNode(I, stateNew); 1437 1438 // If CondV evaluates to a constant, then we know that this 1439 // is the *only* case that we can take, so stop evaluating the 1440 // others. 1441 if (CondV.getAs<nonloc::ConcreteInt>()) 1442 return; 1443 } 1444 1445 // Now "assume" that the case doesn't match. Add this state 1446 // to the default state (if it is feasible). 1447 if (DefaultSt) { 1448 if (ProgramStateRef stateNew = DefaultSt->assume(Res, false)) { 1449 defaultIsFeasible = true; 1450 DefaultSt = stateNew; 1451 } 1452 else { 1453 defaultIsFeasible = false; 1454 DefaultSt = NULL; 1455 } 1456 } 1457 1458 // Concretize the next value in the range. 1459 if (V1 == V2) 1460 break; 1461 1462 ++V1; 1463 assert (V1 <= V2); 1464 1465 } while (true); 1466 } 1467 1468 if (!defaultIsFeasible) 1469 return; 1470 1471 // If we have switch(enum value), the default branch is not 1472 // feasible if all of the enum constants not covered by 'case:' statements 1473 // are not feasible values for the switch condition. 1474 // 1475 // Note that this isn't as accurate as it could be. Even if there isn't 1476 // a case for a particular enum value as long as that enum value isn't 1477 // feasible then it shouldn't be considered for making 'default:' reachable. 1478 const SwitchStmt *SS = builder.getSwitch(); 1479 const Expr *CondExpr = SS->getCond()->IgnoreParenImpCasts(); 1480 if (CondExpr->getType()->getAs<EnumType>()) { 1481 if (SS->isAllEnumCasesCovered()) 1482 return; 1483 } 1484 1485 builder.generateDefaultCaseNode(DefaultSt); 1486} 1487 1488//===----------------------------------------------------------------------===// 1489// Transfer functions: Loads and stores. 1490//===----------------------------------------------------------------------===// 1491 1492void ExprEngine::VisitCommonDeclRefExpr(const Expr *Ex, const NamedDecl *D, 1493 ExplodedNode *Pred, 1494 ExplodedNodeSet &Dst) { 1495 StmtNodeBuilder Bldr(Pred, Dst, *currBldrCtx); 1496 1497 ProgramStateRef state = Pred->getState(); 1498 const LocationContext *LCtx = Pred->getLocationContext(); 1499 1500 if (const VarDecl *VD = dyn_cast<VarDecl>(D)) { 1501 assert(Ex->isGLValue()); 1502 SVal V = state->getLValue(VD, Pred->getLocationContext()); 1503 1504 // For references, the 'lvalue' is the pointer address stored in the 1505 // reference region. 1506 if (VD->getType()->isReferenceType()) { 1507 if (const MemRegion *R = V.getAsRegion()) 1508 V = state->getSVal(R); 1509 else 1510 V = UnknownVal(); 1511 } 1512 1513 Bldr.generateNode(Ex, Pred, state->BindExpr(Ex, LCtx, V), 0, 1514 ProgramPoint::PostLValueKind); 1515 return; 1516 } 1517 if (const EnumConstantDecl *ED = dyn_cast<EnumConstantDecl>(D)) { 1518 assert(!Ex->isGLValue()); 1519 SVal V = svalBuilder.makeIntVal(ED->getInitVal()); 1520 Bldr.generateNode(Ex, Pred, state->BindExpr(Ex, LCtx, V)); 1521 return; 1522 } 1523 if (const FunctionDecl *FD = dyn_cast<FunctionDecl>(D)) { 1524 SVal V = svalBuilder.getFunctionPointer(FD); 1525 Bldr.generateNode(Ex, Pred, state->BindExpr(Ex, LCtx, V), 0, 1526 ProgramPoint::PostLValueKind); 1527 return; 1528 } 1529 if (isa<FieldDecl>(D)) { 1530 // FIXME: Compute lvalue of field pointers-to-member. 1531 // Right now we just use a non-null void pointer, so that it gives proper 1532 // results in boolean contexts. 1533 SVal V = svalBuilder.conjureSymbolVal(Ex, LCtx, getContext().VoidPtrTy, 1534 currBldrCtx->blockCount()); 1535 state = state->assume(V.castAs<DefinedOrUnknownSVal>(), true); 1536 Bldr.generateNode(Ex, Pred, state->BindExpr(Ex, LCtx, V), 0, 1537 ProgramPoint::PostLValueKind); 1538 return; 1539 } 1540 1541 llvm_unreachable("Support for this Decl not implemented."); 1542} 1543 1544/// VisitArraySubscriptExpr - Transfer function for array accesses 1545void ExprEngine::VisitLvalArraySubscriptExpr(const ArraySubscriptExpr *A, 1546 ExplodedNode *Pred, 1547 ExplodedNodeSet &Dst){ 1548 1549 const Expr *Base = A->getBase()->IgnoreParens(); 1550 const Expr *Idx = A->getIdx()->IgnoreParens(); 1551 1552 1553 ExplodedNodeSet checkerPreStmt; 1554 getCheckerManager().runCheckersForPreStmt(checkerPreStmt, Pred, A, *this); 1555 1556 StmtNodeBuilder Bldr(checkerPreStmt, Dst, *currBldrCtx); 1557 1558 for (ExplodedNodeSet::iterator it = checkerPreStmt.begin(), 1559 ei = checkerPreStmt.end(); it != ei; ++it) { 1560 const LocationContext *LCtx = (*it)->getLocationContext(); 1561 ProgramStateRef state = (*it)->getState(); 1562 SVal V = state->getLValue(A->getType(), 1563 state->getSVal(Idx, LCtx), 1564 state->getSVal(Base, LCtx)); 1565 assert(A->isGLValue()); 1566 Bldr.generateNode(A, *it, state->BindExpr(A, LCtx, V), 0, 1567 ProgramPoint::PostLValueKind); 1568 } 1569} 1570 1571/// VisitMemberExpr - Transfer function for member expressions. 1572void ExprEngine::VisitMemberExpr(const MemberExpr *M, ExplodedNode *Pred, 1573 ExplodedNodeSet &TopDst) { 1574 1575 StmtNodeBuilder Bldr(Pred, TopDst, *currBldrCtx); 1576 ExplodedNodeSet Dst; 1577 ValueDecl *Member = M->getMemberDecl(); 1578 1579 // Handle static member variables and enum constants accessed via 1580 // member syntax. 1581 if (isa<VarDecl>(Member) || isa<EnumConstantDecl>(Member)) { 1582 Bldr.takeNodes(Pred); 1583 VisitCommonDeclRefExpr(M, Member, Pred, Dst); 1584 Bldr.addNodes(Dst); 1585 return; 1586 } 1587 1588 ProgramStateRef state = Pred->getState(); 1589 const LocationContext *LCtx = Pred->getLocationContext(); 1590 Expr *BaseExpr = M->getBase(); 1591 1592 // Handle C++ method calls. 1593 if (const CXXMethodDecl *MD = dyn_cast<CXXMethodDecl>(Member)) { 1594 if (MD->isInstance()) 1595 state = createTemporaryRegionIfNeeded(state, LCtx, BaseExpr); 1596 1597 SVal MDVal = svalBuilder.getFunctionPointer(MD); 1598 state = state->BindExpr(M, LCtx, MDVal); 1599 1600 Bldr.generateNode(M, Pred, state); 1601 return; 1602 } 1603 1604 // Handle regular struct fields / member variables. 1605 state = createTemporaryRegionIfNeeded(state, LCtx, BaseExpr); 1606 SVal baseExprVal = state->getSVal(BaseExpr, LCtx); 1607 1608 FieldDecl *field = cast<FieldDecl>(Member); 1609 SVal L = state->getLValue(field, baseExprVal); 1610 if (M->isGLValue()) { 1611 if (field->getType()->isReferenceType()) { 1612 if (const MemRegion *R = L.getAsRegion()) 1613 L = state->getSVal(R); 1614 else 1615 L = UnknownVal(); 1616 } 1617 1618 Bldr.generateNode(M, Pred, state->BindExpr(M, LCtx, L), 0, 1619 ProgramPoint::PostLValueKind); 1620 } else { 1621 Bldr.takeNodes(Pred); 1622 evalLoad(Dst, M, M, Pred, state, L); 1623 Bldr.addNodes(Dst); 1624 } 1625} 1626 1627namespace { 1628class CollectReachableSymbolsCallback : public SymbolVisitor { 1629 InvalidatedSymbols Symbols; 1630public: 1631 CollectReachableSymbolsCallback(ProgramStateRef State) {} 1632 const InvalidatedSymbols &getSymbols() const { return Symbols; } 1633 1634 bool VisitSymbol(SymbolRef Sym) { 1635 Symbols.insert(Sym); 1636 return true; 1637 } 1638}; 1639} // end anonymous namespace 1640 1641// A value escapes in three possible cases: 1642// (1) We are binding to something that is not a memory region. 1643// (2) We are binding to a MemrRegion that does not have stack storage. 1644// (3) We are binding to a MemRegion with stack storage that the store 1645// does not understand. 1646ProgramStateRef ExprEngine::processPointerEscapedOnBind(ProgramStateRef State, 1647 SVal Loc, SVal Val) { 1648 // Are we storing to something that causes the value to "escape"? 1649 bool escapes = true; 1650 1651 // TODO: Move to StoreManager. 1652 if (Optional<loc::MemRegionVal> regionLoc = Loc.getAs<loc::MemRegionVal>()) { 1653 escapes = !regionLoc->getRegion()->hasStackStorage(); 1654 1655 if (!escapes) { 1656 // To test (3), generate a new state with the binding added. If it is 1657 // the same state, then it escapes (since the store cannot represent 1658 // the binding). 1659 // Do this only if we know that the store is not supposed to generate the 1660 // same state. 1661 SVal StoredVal = State->getSVal(regionLoc->getRegion()); 1662 if (StoredVal != Val) 1663 escapes = (State == (State->bindLoc(*regionLoc, Val))); 1664 } 1665 if (!escapes) { 1666 // Case 4: We do not currently model what happens when a symbol is 1667 // assigned to a struct field, so be conservative here and let the symbol 1668 // go. TODO: This could definitely be improved upon. 1669 escapes = !isa<VarRegion>(regionLoc->getRegion()); 1670 } 1671 } 1672 1673 // If our store can represent the binding and we aren't storing to something 1674 // that doesn't have local storage then just return and have the simulation 1675 // state continue as is. 1676 if (!escapes) 1677 return State; 1678 1679 // Otherwise, find all symbols referenced by 'val' that we are tracking 1680 // and stop tracking them. 1681 CollectReachableSymbolsCallback Scanner = 1682 State->scanReachableSymbols<CollectReachableSymbolsCallback>(Val); 1683 const InvalidatedSymbols &EscapedSymbols = Scanner.getSymbols(); 1684 State = getCheckerManager().runCheckersForPointerEscape(State, 1685 EscapedSymbols, 1686 /*CallEvent*/ 0, 1687 PSK_EscapeOnBind); 1688 1689 return State; 1690} 1691 1692ProgramStateRef 1693ExprEngine::processPointerEscapedOnInvalidateRegions(ProgramStateRef State, 1694 const InvalidatedSymbols *Invalidated, 1695 ArrayRef<const MemRegion *> ExplicitRegions, 1696 ArrayRef<const MemRegion *> Regions, 1697 const CallEvent *Call) { 1698 1699 if (!Invalidated || Invalidated->empty()) 1700 return State; 1701 1702 if (!Call) 1703 return getCheckerManager().runCheckersForPointerEscape(State, 1704 *Invalidated, 1705 0, 1706 PSK_EscapeOther); 1707 1708 // If the symbols were invalidated by a call, we want to find out which ones 1709 // were invalidated directly due to being arguments to the call. 1710 InvalidatedSymbols SymbolsDirectlyInvalidated; 1711 for (ArrayRef<const MemRegion *>::iterator I = ExplicitRegions.begin(), 1712 E = ExplicitRegions.end(); I != E; ++I) { 1713 if (const SymbolicRegion *R = (*I)->StripCasts()->getAs<SymbolicRegion>()) 1714 SymbolsDirectlyInvalidated.insert(R->getSymbol()); 1715 } 1716 1717 InvalidatedSymbols SymbolsIndirectlyInvalidated; 1718 for (InvalidatedSymbols::const_iterator I=Invalidated->begin(), 1719 E = Invalidated->end(); I!=E; ++I) { 1720 SymbolRef sym = *I; 1721 if (SymbolsDirectlyInvalidated.count(sym)) 1722 continue; 1723 SymbolsIndirectlyInvalidated.insert(sym); 1724 } 1725 1726 if (!SymbolsDirectlyInvalidated.empty()) 1727 State = getCheckerManager().runCheckersForPointerEscape(State, 1728 SymbolsDirectlyInvalidated, Call, PSK_DirectEscapeOnCall); 1729 1730 // Notify about the symbols that get indirectly invalidated by the call. 1731 if (!SymbolsIndirectlyInvalidated.empty()) 1732 State = getCheckerManager().runCheckersForPointerEscape(State, 1733 SymbolsIndirectlyInvalidated, Call, PSK_IndirectEscapeOnCall); 1734 1735 return State; 1736} 1737 1738/// evalBind - Handle the semantics of binding a value to a specific location. 1739/// This method is used by evalStore and (soon) VisitDeclStmt, and others. 1740void ExprEngine::evalBind(ExplodedNodeSet &Dst, const Stmt *StoreE, 1741 ExplodedNode *Pred, 1742 SVal location, SVal Val, 1743 bool atDeclInit, const ProgramPoint *PP) { 1744 1745 const LocationContext *LC = Pred->getLocationContext(); 1746 PostStmt PS(StoreE, LC); 1747 if (!PP) 1748 PP = &PS; 1749 1750 // Do a previsit of the bind. 1751 ExplodedNodeSet CheckedSet; 1752 getCheckerManager().runCheckersForBind(CheckedSet, Pred, location, Val, 1753 StoreE, *this, *PP); 1754 1755 1756 StmtNodeBuilder Bldr(CheckedSet, Dst, *currBldrCtx); 1757 1758 // If the location is not a 'Loc', it will already be handled by 1759 // the checkers. There is nothing left to do. 1760 if (!location.getAs<Loc>()) { 1761 const ProgramPoint L = PostStore(StoreE, LC, /*Loc*/0, /*tag*/0); 1762 ProgramStateRef state = Pred->getState(); 1763 state = processPointerEscapedOnBind(state, location, Val); 1764 Bldr.generateNode(L, state, Pred); 1765 return; 1766 } 1767 1768 1769 for (ExplodedNodeSet::iterator I = CheckedSet.begin(), E = CheckedSet.end(); 1770 I!=E; ++I) { 1771 ExplodedNode *PredI = *I; 1772 ProgramStateRef state = PredI->getState(); 1773 1774 state = processPointerEscapedOnBind(state, location, Val); 1775 1776 // When binding the value, pass on the hint that this is a initialization. 1777 // For initializations, we do not need to inform clients of region 1778 // changes. 1779 state = state->bindLoc(location.castAs<Loc>(), 1780 Val, /* notifyChanges = */ !atDeclInit); 1781 1782 const MemRegion *LocReg = 0; 1783 if (Optional<loc::MemRegionVal> LocRegVal = 1784 location.getAs<loc::MemRegionVal>()) { 1785 LocReg = LocRegVal->getRegion(); 1786 } 1787 1788 const ProgramPoint L = PostStore(StoreE, LC, LocReg, 0); 1789 Bldr.generateNode(L, state, PredI); 1790 } 1791} 1792 1793/// evalStore - Handle the semantics of a store via an assignment. 1794/// @param Dst The node set to store generated state nodes 1795/// @param AssignE The assignment expression if the store happens in an 1796/// assignment. 1797/// @param LocationE The location expression that is stored to. 1798/// @param state The current simulation state 1799/// @param location The location to store the value 1800/// @param Val The value to be stored 1801void ExprEngine::evalStore(ExplodedNodeSet &Dst, const Expr *AssignE, 1802 const Expr *LocationE, 1803 ExplodedNode *Pred, 1804 ProgramStateRef state, SVal location, SVal Val, 1805 const ProgramPointTag *tag) { 1806 // Proceed with the store. We use AssignE as the anchor for the PostStore 1807 // ProgramPoint if it is non-NULL, and LocationE otherwise. 1808 const Expr *StoreE = AssignE ? AssignE : LocationE; 1809 1810 // Evaluate the location (checks for bad dereferences). 1811 ExplodedNodeSet Tmp; 1812 evalLocation(Tmp, AssignE, LocationE, Pred, state, location, tag, false); 1813 1814 if (Tmp.empty()) 1815 return; 1816 1817 if (location.isUndef()) 1818 return; 1819 1820 for (ExplodedNodeSet::iterator NI=Tmp.begin(), NE=Tmp.end(); NI!=NE; ++NI) 1821 evalBind(Dst, StoreE, *NI, location, Val, false); 1822} 1823 1824void ExprEngine::evalLoad(ExplodedNodeSet &Dst, 1825 const Expr *NodeEx, 1826 const Expr *BoundEx, 1827 ExplodedNode *Pred, 1828 ProgramStateRef state, 1829 SVal location, 1830 const ProgramPointTag *tag, 1831 QualType LoadTy) 1832{ 1833 assert(!location.getAs<NonLoc>() && "location cannot be a NonLoc."); 1834 1835 // Are we loading from a region? This actually results in two loads; one 1836 // to fetch the address of the referenced value and one to fetch the 1837 // referenced value. 1838 if (const TypedValueRegion *TR = 1839 dyn_cast_or_null<TypedValueRegion>(location.getAsRegion())) { 1840 1841 QualType ValTy = TR->getValueType(); 1842 if (const ReferenceType *RT = ValTy->getAs<ReferenceType>()) { 1843 static SimpleProgramPointTag 1844 loadReferenceTag("ExprEngine : Load Reference"); 1845 ExplodedNodeSet Tmp; 1846 evalLoadCommon(Tmp, NodeEx, BoundEx, Pred, state, 1847 location, &loadReferenceTag, 1848 getContext().getPointerType(RT->getPointeeType())); 1849 1850 // Perform the load from the referenced value. 1851 for (ExplodedNodeSet::iterator I=Tmp.begin(), E=Tmp.end() ; I!=E; ++I) { 1852 state = (*I)->getState(); 1853 location = state->getSVal(BoundEx, (*I)->getLocationContext()); 1854 evalLoadCommon(Dst, NodeEx, BoundEx, *I, state, location, tag, LoadTy); 1855 } 1856 return; 1857 } 1858 } 1859 1860 evalLoadCommon(Dst, NodeEx, BoundEx, Pred, state, location, tag, LoadTy); 1861} 1862 1863void ExprEngine::evalLoadCommon(ExplodedNodeSet &Dst, 1864 const Expr *NodeEx, 1865 const Expr *BoundEx, 1866 ExplodedNode *Pred, 1867 ProgramStateRef state, 1868 SVal location, 1869 const ProgramPointTag *tag, 1870 QualType LoadTy) { 1871 assert(NodeEx); 1872 assert(BoundEx); 1873 // Evaluate the location (checks for bad dereferences). 1874 ExplodedNodeSet Tmp; 1875 evalLocation(Tmp, NodeEx, BoundEx, Pred, state, location, tag, true); 1876 if (Tmp.empty()) 1877 return; 1878 1879 StmtNodeBuilder Bldr(Tmp, Dst, *currBldrCtx); 1880 if (location.isUndef()) 1881 return; 1882 1883 // Proceed with the load. 1884 for (ExplodedNodeSet::iterator NI=Tmp.begin(), NE=Tmp.end(); NI!=NE; ++NI) { 1885 state = (*NI)->getState(); 1886 const LocationContext *LCtx = (*NI)->getLocationContext(); 1887 1888 SVal V = UnknownVal(); 1889 if (location.isValid()) { 1890 if (LoadTy.isNull()) 1891 LoadTy = BoundEx->getType(); 1892 V = state->getSVal(location.castAs<Loc>(), LoadTy); 1893 } 1894 1895 Bldr.generateNode(NodeEx, *NI, state->BindExpr(BoundEx, LCtx, V), tag, 1896 ProgramPoint::PostLoadKind); 1897 } 1898} 1899 1900void ExprEngine::evalLocation(ExplodedNodeSet &Dst, 1901 const Stmt *NodeEx, 1902 const Stmt *BoundEx, 1903 ExplodedNode *Pred, 1904 ProgramStateRef state, 1905 SVal location, 1906 const ProgramPointTag *tag, 1907 bool isLoad) { 1908 StmtNodeBuilder BldrTop(Pred, Dst, *currBldrCtx); 1909 // Early checks for performance reason. 1910 if (location.isUnknown()) { 1911 return; 1912 } 1913 1914 ExplodedNodeSet Src; 1915 BldrTop.takeNodes(Pred); 1916 StmtNodeBuilder Bldr(Pred, Src, *currBldrCtx); 1917 if (Pred->getState() != state) { 1918 // Associate this new state with an ExplodedNode. 1919 // FIXME: If I pass null tag, the graph is incorrect, e.g for 1920 // int *p; 1921 // p = 0; 1922 // *p = 0xDEADBEEF; 1923 // "p = 0" is not noted as "Null pointer value stored to 'p'" but 1924 // instead "int *p" is noted as 1925 // "Variable 'p' initialized to a null pointer value" 1926 1927 static SimpleProgramPointTag tag("ExprEngine: Location"); 1928 Bldr.generateNode(NodeEx, Pred, state, &tag); 1929 } 1930 ExplodedNodeSet Tmp; 1931 getCheckerManager().runCheckersForLocation(Tmp, Src, location, isLoad, 1932 NodeEx, BoundEx, *this); 1933 BldrTop.addNodes(Tmp); 1934} 1935 1936std::pair<const ProgramPointTag *, const ProgramPointTag*> 1937ExprEngine::geteagerlyAssumeBinOpBifurcationTags() { 1938 static SimpleProgramPointTag 1939 eagerlyAssumeBinOpBifurcationTrue("ExprEngine : Eagerly Assume True"), 1940 eagerlyAssumeBinOpBifurcationFalse("ExprEngine : Eagerly Assume False"); 1941 return std::make_pair(&eagerlyAssumeBinOpBifurcationTrue, 1942 &eagerlyAssumeBinOpBifurcationFalse); 1943} 1944 1945void ExprEngine::evalEagerlyAssumeBinOpBifurcation(ExplodedNodeSet &Dst, 1946 ExplodedNodeSet &Src, 1947 const Expr *Ex) { 1948 StmtNodeBuilder Bldr(Src, Dst, *currBldrCtx); 1949 1950 for (ExplodedNodeSet::iterator I=Src.begin(), E=Src.end(); I!=E; ++I) { 1951 ExplodedNode *Pred = *I; 1952 // Test if the previous node was as the same expression. This can happen 1953 // when the expression fails to evaluate to anything meaningful and 1954 // (as an optimization) we don't generate a node. 1955 ProgramPoint P = Pred->getLocation(); 1956 if (!P.getAs<PostStmt>() || P.castAs<PostStmt>().getStmt() != Ex) { 1957 continue; 1958 } 1959 1960 ProgramStateRef state = Pred->getState(); 1961 SVal V = state->getSVal(Ex, Pred->getLocationContext()); 1962 Optional<nonloc::SymbolVal> SEV = V.getAs<nonloc::SymbolVal>(); 1963 if (SEV && SEV->isExpression()) { 1964 const std::pair<const ProgramPointTag *, const ProgramPointTag*> &tags = 1965 geteagerlyAssumeBinOpBifurcationTags(); 1966 1967 ProgramStateRef StateTrue, StateFalse; 1968 tie(StateTrue, StateFalse) = state->assume(*SEV); 1969 1970 // First assume that the condition is true. 1971 if (StateTrue) { 1972 SVal Val = svalBuilder.makeIntVal(1U, Ex->getType()); 1973 StateTrue = StateTrue->BindExpr(Ex, Pred->getLocationContext(), Val); 1974 Bldr.generateNode(Ex, Pred, StateTrue, tags.first); 1975 } 1976 1977 // Next, assume that the condition is false. 1978 if (StateFalse) { 1979 SVal Val = svalBuilder.makeIntVal(0U, Ex->getType()); 1980 StateFalse = StateFalse->BindExpr(Ex, Pred->getLocationContext(), Val); 1981 Bldr.generateNode(Ex, Pred, StateFalse, tags.second); 1982 } 1983 } 1984 } 1985} 1986 1987void ExprEngine::VisitGCCAsmStmt(const GCCAsmStmt *A, ExplodedNode *Pred, 1988 ExplodedNodeSet &Dst) { 1989 StmtNodeBuilder Bldr(Pred, Dst, *currBldrCtx); 1990 // We have processed both the inputs and the outputs. All of the outputs 1991 // should evaluate to Locs. Nuke all of their values. 1992 1993 // FIXME: Some day in the future it would be nice to allow a "plug-in" 1994 // which interprets the inline asm and stores proper results in the 1995 // outputs. 1996 1997 ProgramStateRef state = Pred->getState(); 1998 1999 for (GCCAsmStmt::const_outputs_iterator OI = A->begin_outputs(), 2000 OE = A->end_outputs(); OI != OE; ++OI) { 2001 SVal X = state->getSVal(*OI, Pred->getLocationContext()); 2002 assert (!X.getAs<NonLoc>()); // Should be an Lval, or unknown, undef. 2003 2004 if (Optional<Loc> LV = X.getAs<Loc>()) 2005 state = state->bindLoc(*LV, UnknownVal()); 2006 } 2007 2008 Bldr.generateNode(A, Pred, state); 2009} 2010 2011void ExprEngine::VisitMSAsmStmt(const MSAsmStmt *A, ExplodedNode *Pred, 2012 ExplodedNodeSet &Dst) { 2013 StmtNodeBuilder Bldr(Pred, Dst, *currBldrCtx); 2014 Bldr.generateNode(A, Pred, Pred->getState()); 2015} 2016 2017//===----------------------------------------------------------------------===// 2018// Visualization. 2019//===----------------------------------------------------------------------===// 2020 2021#ifndef NDEBUG 2022static ExprEngine* GraphPrintCheckerState; 2023static SourceManager* GraphPrintSourceManager; 2024 2025namespace llvm { 2026template<> 2027struct DOTGraphTraits<ExplodedNode*> : 2028 public DefaultDOTGraphTraits { 2029 2030 DOTGraphTraits (bool isSimple=false) : DefaultDOTGraphTraits(isSimple) {} 2031 2032 // FIXME: Since we do not cache error nodes in ExprEngine now, this does not 2033 // work. 2034 static std::string getNodeAttributes(const ExplodedNode *N, void*) { 2035 2036#if 0 2037 // FIXME: Replace with a general scheme to tell if the node is 2038 // an error node. 2039 if (GraphPrintCheckerState->isImplicitNullDeref(N) || 2040 GraphPrintCheckerState->isExplicitNullDeref(N) || 2041 GraphPrintCheckerState->isUndefDeref(N) || 2042 GraphPrintCheckerState->isUndefStore(N) || 2043 GraphPrintCheckerState->isUndefControlFlow(N) || 2044 GraphPrintCheckerState->isUndefResult(N) || 2045 GraphPrintCheckerState->isBadCall(N) || 2046 GraphPrintCheckerState->isUndefArg(N)) 2047 return "color=\"red\",style=\"filled\""; 2048 2049 if (GraphPrintCheckerState->isNoReturnCall(N)) 2050 return "color=\"blue\",style=\"filled\""; 2051#endif 2052 return ""; 2053 } 2054 2055 static void printLocation(raw_ostream &Out, SourceLocation SLoc) { 2056 if (SLoc.isFileID()) { 2057 Out << "\\lline=" 2058 << GraphPrintSourceManager->getExpansionLineNumber(SLoc) 2059 << " col=" 2060 << GraphPrintSourceManager->getExpansionColumnNumber(SLoc) 2061 << "\\l"; 2062 } 2063 } 2064 2065 static std::string getNodeLabel(const ExplodedNode *N, void*){ 2066 2067 std::string sbuf; 2068 llvm::raw_string_ostream Out(sbuf); 2069 2070 // Program Location. 2071 ProgramPoint Loc = N->getLocation(); 2072 2073 switch (Loc.getKind()) { 2074 case ProgramPoint::BlockEntranceKind: { 2075 Out << "Block Entrance: B" 2076 << Loc.castAs<BlockEntrance>().getBlock()->getBlockID(); 2077 if (const NamedDecl *ND = 2078 dyn_cast<NamedDecl>(Loc.getLocationContext()->getDecl())) { 2079 Out << " ("; 2080 ND->printName(Out); 2081 Out << ")"; 2082 } 2083 break; 2084 } 2085 2086 case ProgramPoint::BlockExitKind: 2087 assert (false); 2088 break; 2089 2090 case ProgramPoint::CallEnterKind: 2091 Out << "CallEnter"; 2092 break; 2093 2094 case ProgramPoint::CallExitBeginKind: 2095 Out << "CallExitBegin"; 2096 break; 2097 2098 case ProgramPoint::CallExitEndKind: 2099 Out << "CallExitEnd"; 2100 break; 2101 2102 case ProgramPoint::PostStmtPurgeDeadSymbolsKind: 2103 Out << "PostStmtPurgeDeadSymbols"; 2104 break; 2105 2106 case ProgramPoint::PreStmtPurgeDeadSymbolsKind: 2107 Out << "PreStmtPurgeDeadSymbols"; 2108 break; 2109 2110 case ProgramPoint::EpsilonKind: 2111 Out << "Epsilon Point"; 2112 break; 2113 2114 case ProgramPoint::PreImplicitCallKind: { 2115 ImplicitCallPoint PC = Loc.castAs<ImplicitCallPoint>(); 2116 Out << "PreCall: "; 2117 2118 // FIXME: Get proper printing options. 2119 PC.getDecl()->print(Out, LangOptions()); 2120 printLocation(Out, PC.getLocation()); 2121 break; 2122 } 2123 2124 case ProgramPoint::PostImplicitCallKind: { 2125 ImplicitCallPoint PC = Loc.castAs<ImplicitCallPoint>(); 2126 Out << "PostCall: "; 2127 2128 // FIXME: Get proper printing options. 2129 PC.getDecl()->print(Out, LangOptions()); 2130 printLocation(Out, PC.getLocation()); 2131 break; 2132 } 2133 2134 default: { 2135 if (Optional<StmtPoint> L = Loc.getAs<StmtPoint>()) { 2136 const Stmt *S = L->getStmt(); 2137 2138 Out << S->getStmtClassName() << ' ' << (const void*) S << ' '; 2139 LangOptions LO; // FIXME. 2140 S->printPretty(Out, 0, PrintingPolicy(LO)); 2141 printLocation(Out, S->getLocStart()); 2142 2143 if (Loc.getAs<PreStmt>()) 2144 Out << "\\lPreStmt\\l;"; 2145 else if (Loc.getAs<PostLoad>()) 2146 Out << "\\lPostLoad\\l;"; 2147 else if (Loc.getAs<PostStore>()) 2148 Out << "\\lPostStore\\l"; 2149 else if (Loc.getAs<PostLValue>()) 2150 Out << "\\lPostLValue\\l"; 2151 2152#if 0 2153 // FIXME: Replace with a general scheme to determine 2154 // the name of the check. 2155 if (GraphPrintCheckerState->isImplicitNullDeref(N)) 2156 Out << "\\|Implicit-Null Dereference.\\l"; 2157 else if (GraphPrintCheckerState->isExplicitNullDeref(N)) 2158 Out << "\\|Explicit-Null Dereference.\\l"; 2159 else if (GraphPrintCheckerState->isUndefDeref(N)) 2160 Out << "\\|Dereference of undefialied value.\\l"; 2161 else if (GraphPrintCheckerState->isUndefStore(N)) 2162 Out << "\\|Store to Undefined Loc."; 2163 else if (GraphPrintCheckerState->isUndefResult(N)) 2164 Out << "\\|Result of operation is undefined."; 2165 else if (GraphPrintCheckerState->isNoReturnCall(N)) 2166 Out << "\\|Call to function marked \"noreturn\"."; 2167 else if (GraphPrintCheckerState->isBadCall(N)) 2168 Out << "\\|Call to NULL/Undefined."; 2169 else if (GraphPrintCheckerState->isUndefArg(N)) 2170 Out << "\\|Argument in call is undefined"; 2171#endif 2172 2173 break; 2174 } 2175 2176 const BlockEdge &E = Loc.castAs<BlockEdge>(); 2177 Out << "Edge: (B" << E.getSrc()->getBlockID() << ", B" 2178 << E.getDst()->getBlockID() << ')'; 2179 2180 if (const Stmt *T = E.getSrc()->getTerminator()) { 2181 2182 SourceLocation SLoc = T->getLocStart(); 2183 2184 Out << "\\|Terminator: "; 2185 LangOptions LO; // FIXME. 2186 E.getSrc()->printTerminator(Out, LO); 2187 2188 if (SLoc.isFileID()) { 2189 Out << "\\lline=" 2190 << GraphPrintSourceManager->getExpansionLineNumber(SLoc) 2191 << " col=" 2192 << GraphPrintSourceManager->getExpansionColumnNumber(SLoc); 2193 } 2194 2195 if (isa<SwitchStmt>(T)) { 2196 const Stmt *Label = E.getDst()->getLabel(); 2197 2198 if (Label) { 2199 if (const CaseStmt *C = dyn_cast<CaseStmt>(Label)) { 2200 Out << "\\lcase "; 2201 LangOptions LO; // FIXME. 2202 C->getLHS()->printPretty(Out, 0, PrintingPolicy(LO)); 2203 2204 if (const Stmt *RHS = C->getRHS()) { 2205 Out << " .. "; 2206 RHS->printPretty(Out, 0, PrintingPolicy(LO)); 2207 } 2208 2209 Out << ":"; 2210 } 2211 else { 2212 assert (isa<DefaultStmt>(Label)); 2213 Out << "\\ldefault:"; 2214 } 2215 } 2216 else 2217 Out << "\\l(implicit) default:"; 2218 } 2219 else if (isa<IndirectGotoStmt>(T)) { 2220 // FIXME 2221 } 2222 else { 2223 Out << "\\lCondition: "; 2224 if (*E.getSrc()->succ_begin() == E.getDst()) 2225 Out << "true"; 2226 else 2227 Out << "false"; 2228 } 2229 2230 Out << "\\l"; 2231 } 2232 2233#if 0 2234 // FIXME: Replace with a general scheme to determine 2235 // the name of the check. 2236 if (GraphPrintCheckerState->isUndefControlFlow(N)) { 2237 Out << "\\|Control-flow based on\\lUndefined value.\\l"; 2238 } 2239#endif 2240 } 2241 } 2242 2243 ProgramStateRef state = N->getState(); 2244 Out << "\\|StateID: " << (const void*) state.getPtr() 2245 << " NodeID: " << (const void*) N << "\\|"; 2246 state->printDOT(Out); 2247 2248 Out << "\\l"; 2249 2250 if (const ProgramPointTag *tag = Loc.getTag()) { 2251 Out << "\\|Tag: " << tag->getTagDescription(); 2252 Out << "\\l"; 2253 } 2254 return Out.str(); 2255 } 2256}; 2257} // end llvm namespace 2258#endif 2259 2260#ifndef NDEBUG 2261template <typename ITERATOR> 2262ExplodedNode *GetGraphNode(ITERATOR I) { return *I; } 2263 2264template <> ExplodedNode* 2265GetGraphNode<llvm::DenseMap<ExplodedNode*, Expr*>::iterator> 2266 (llvm::DenseMap<ExplodedNode*, Expr*>::iterator I) { 2267 return I->first; 2268} 2269#endif 2270 2271void ExprEngine::ViewGraph(bool trim) { 2272#ifndef NDEBUG 2273 if (trim) { 2274 std::vector<ExplodedNode*> Src; 2275 2276 // Flush any outstanding reports to make sure we cover all the nodes. 2277 // This does not cause them to get displayed. 2278 for (BugReporter::iterator I=BR.begin(), E=BR.end(); I!=E; ++I) 2279 const_cast<BugType*>(*I)->FlushReports(BR); 2280 2281 // Iterate through the reports and get their nodes. 2282 for (BugReporter::EQClasses_iterator 2283 EI = BR.EQClasses_begin(), EE = BR.EQClasses_end(); EI != EE; ++EI) { 2284 ExplodedNode *N = const_cast<ExplodedNode*>(EI->begin()->getErrorNode()); 2285 if (N) Src.push_back(N); 2286 } 2287 2288 ViewGraph(&Src[0], &Src[0]+Src.size()); 2289 } 2290 else { 2291 GraphPrintCheckerState = this; 2292 GraphPrintSourceManager = &getContext().getSourceManager(); 2293 2294 llvm::ViewGraph(*G.roots_begin(), "ExprEngine"); 2295 2296 GraphPrintCheckerState = NULL; 2297 GraphPrintSourceManager = NULL; 2298 } 2299#endif 2300} 2301 2302void ExprEngine::ViewGraph(ExplodedNode** Beg, ExplodedNode** End) { 2303#ifndef NDEBUG 2304 GraphPrintCheckerState = this; 2305 GraphPrintSourceManager = &getContext().getSourceManager(); 2306 2307 std::auto_ptr<ExplodedGraph> TrimmedG(G.Trim(Beg, End).first); 2308 2309 if (!TrimmedG.get()) 2310 llvm::errs() << "warning: Trimmed ExplodedGraph is empty.\n"; 2311 else 2312 llvm::ViewGraph(*TrimmedG->roots_begin(), "TrimmedExprEngine"); 2313 2314 GraphPrintCheckerState = NULL; 2315 GraphPrintSourceManager = NULL; 2316#endif 2317} 2318