SVals.cpp revision a339cd66be6202c6e86916f52a347d0289bf2eea
1//= RValues.cpp - Abstract RValues for Path-Sens. Value Tracking -*- C++ -*-==// 2// 3// The LLVM Compiler Infrastructure 4// 5// This file is distributed under the University of Illinois Open Source 6// License. See LICENSE.TXT for details. 7// 8//===----------------------------------------------------------------------===// 9// 10// This file defines SVal, Loc, and NonLoc, classes that represent 11// abstract r-values for use with path-sensitive value tracking. 12// 13//===----------------------------------------------------------------------===// 14 15#include "clang/StaticAnalyzer/Core/PathSensitive/ProgramState.h" 16#include "clang/AST/ExprObjC.h" 17#include "clang/Basic/IdentifierTable.h" 18#include "llvm/Support/raw_ostream.h" 19using namespace clang; 20using namespace ento; 21using llvm::APSInt; 22 23//===----------------------------------------------------------------------===// 24// Symbol iteration within an SVal. 25//===----------------------------------------------------------------------===// 26 27 28//===----------------------------------------------------------------------===// 29// Utility methods. 30//===----------------------------------------------------------------------===// 31 32bool SVal::hasConjuredSymbol() const { 33 if (Optional<nonloc::SymbolVal> SV = getAs<nonloc::SymbolVal>()) { 34 SymbolRef sym = SV->getSymbol(); 35 if (isa<SymbolConjured>(sym)) 36 return true; 37 } 38 39 if (Optional<loc::MemRegionVal> RV = getAs<loc::MemRegionVal>()) { 40 const MemRegion *R = RV->getRegion(); 41 if (const SymbolicRegion *SR = dyn_cast<SymbolicRegion>(R)) { 42 SymbolRef sym = SR->getSymbol(); 43 if (isa<SymbolConjured>(sym)) 44 return true; 45 } 46 } 47 48 return false; 49} 50 51const FunctionDecl *SVal::getAsFunctionDecl() const { 52 if (Optional<loc::MemRegionVal> X = getAs<loc::MemRegionVal>()) { 53 const MemRegion* R = X->getRegion(); 54 if (const FunctionTextRegion *CTR = R->getAs<FunctionTextRegion>()) 55 if (const FunctionDecl *FD = dyn_cast<FunctionDecl>(CTR->getDecl())) 56 return FD; 57 } 58 59 return 0; 60} 61 62/// \brief If this SVal is a location (subclasses Loc) and wraps a symbol, 63/// return that SymbolRef. Otherwise return 0. 64/// 65/// Implicit casts (ex: void* -> char*) can turn Symbolic region into Element 66/// region. If that is the case, gets the underlining region. 67SymbolRef SVal::getAsLocSymbol() const { 68 // FIXME: should we consider SymbolRef wrapped in CodeTextRegion? 69 if (Optional<nonloc::LocAsInteger> X = getAs<nonloc::LocAsInteger>()) 70 return X->getLoc().getAsLocSymbol(); 71 72 if (Optional<loc::MemRegionVal> X = getAs<loc::MemRegionVal>()) { 73 const MemRegion *R = X->stripCasts(); 74 if (const SymbolicRegion *SymR = dyn_cast<SymbolicRegion>(R)) 75 return SymR->getSymbol(); 76 } 77 return 0; 78} 79 80/// Get the symbol in the SVal or its base region. 81SymbolRef SVal::getLocSymbolInBase() const { 82 Optional<loc::MemRegionVal> X = getAs<loc::MemRegionVal>(); 83 84 if (!X) 85 return 0; 86 87 const MemRegion *R = X->getRegion(); 88 89 while (const SubRegion *SR = dyn_cast<SubRegion>(R)) { 90 if (const SymbolicRegion *SymR = dyn_cast<SymbolicRegion>(SR)) 91 return SymR->getSymbol(); 92 else 93 R = SR->getSuperRegion(); 94 } 95 96 return 0; 97} 98 99// TODO: The next 3 functions have to be simplified. 100 101/// \brief If this SVal wraps a symbol return that SymbolRef. 102/// Otherwise return 0. 103SymbolRef SVal::getAsSymbol() const { 104 // FIXME: should we consider SymbolRef wrapped in CodeTextRegion? 105 if (Optional<nonloc::SymbolVal> X = getAs<nonloc::SymbolVal>()) 106 return X->getSymbol(); 107 108 return getAsLocSymbol(); 109} 110 111/// getAsSymbolicExpression - If this Sval wraps a symbolic expression then 112/// return that expression. Otherwise return NULL. 113const SymExpr *SVal::getAsSymbolicExpression() const { 114 if (Optional<nonloc::SymbolVal> X = getAs<nonloc::SymbolVal>()) 115 return X->getSymbol(); 116 117 return getAsSymbol(); 118} 119 120const SymExpr* SVal::getAsSymExpr() const { 121 const SymExpr* Sym = getAsSymbol(); 122 if (!Sym) 123 Sym = getAsSymbolicExpression(); 124 return Sym; 125} 126 127const MemRegion *SVal::getAsRegion() const { 128 if (Optional<loc::MemRegionVal> X = getAs<loc::MemRegionVal>()) 129 return X->getRegion(); 130 131 if (Optional<nonloc::LocAsInteger> X = getAs<nonloc::LocAsInteger>()) 132 return X->getLoc().getAsRegion(); 133 134 return 0; 135} 136 137const MemRegion *loc::MemRegionVal::stripCasts(bool StripBaseCasts) const { 138 const MemRegion *R = getRegion(); 139 return R ? R->StripCasts(StripBaseCasts) : NULL; 140} 141 142const void *nonloc::LazyCompoundVal::getStore() const { 143 return static_cast<const LazyCompoundValData*>(Data)->getStore(); 144} 145 146const TypedValueRegion *nonloc::LazyCompoundVal::getRegion() const { 147 return static_cast<const LazyCompoundValData*>(Data)->getRegion(); 148} 149 150//===----------------------------------------------------------------------===// 151// Other Iterators. 152//===----------------------------------------------------------------------===// 153 154nonloc::CompoundVal::iterator nonloc::CompoundVal::begin() const { 155 return getValue()->begin(); 156} 157 158nonloc::CompoundVal::iterator nonloc::CompoundVal::end() const { 159 return getValue()->end(); 160} 161 162//===----------------------------------------------------------------------===// 163// Useful predicates. 164//===----------------------------------------------------------------------===// 165 166bool SVal::isConstant() const { 167 return getAs<nonloc::ConcreteInt>() || getAs<loc::ConcreteInt>(); 168} 169 170bool SVal::isConstant(int I) const { 171 if (Optional<loc::ConcreteInt> LV = getAs<loc::ConcreteInt>()) 172 return LV->getValue() == I; 173 if (Optional<nonloc::ConcreteInt> NV = getAs<nonloc::ConcreteInt>()) 174 return NV->getValue() == I; 175 return false; 176} 177 178bool SVal::isZeroConstant() const { 179 return isConstant(0); 180} 181 182 183//===----------------------------------------------------------------------===// 184// Transfer function dispatch for Non-Locs. 185//===----------------------------------------------------------------------===// 186 187SVal nonloc::ConcreteInt::evalBinOp(SValBuilder &svalBuilder, 188 BinaryOperator::Opcode Op, 189 const nonloc::ConcreteInt& R) const { 190 const llvm::APSInt* X = 191 svalBuilder.getBasicValueFactory().evalAPSInt(Op, getValue(), R.getValue()); 192 193 if (X) 194 return nonloc::ConcreteInt(*X); 195 else 196 return UndefinedVal(); 197} 198 199nonloc::ConcreteInt 200nonloc::ConcreteInt::evalComplement(SValBuilder &svalBuilder) const { 201 return svalBuilder.makeIntVal(~getValue()); 202} 203 204nonloc::ConcreteInt 205nonloc::ConcreteInt::evalMinus(SValBuilder &svalBuilder) const { 206 return svalBuilder.makeIntVal(-getValue()); 207} 208 209//===----------------------------------------------------------------------===// 210// Transfer function dispatch for Locs. 211//===----------------------------------------------------------------------===// 212 213SVal loc::ConcreteInt::evalBinOp(BasicValueFactory& BasicVals, 214 BinaryOperator::Opcode Op, 215 const loc::ConcreteInt& R) const { 216 217 assert(BinaryOperator::isComparisonOp(Op) || Op == BO_Sub); 218 219 const llvm::APSInt *X = BasicVals.evalAPSInt(Op, getValue(), R.getValue()); 220 221 if (X) 222 return nonloc::ConcreteInt(*X); 223 else 224 return UndefinedVal(); 225} 226 227//===----------------------------------------------------------------------===// 228// Pretty-Printing. 229//===----------------------------------------------------------------------===// 230 231void SVal::dump() const { dumpToStream(llvm::errs()); } 232 233void SVal::dumpToStream(raw_ostream &os) const { 234 switch (getBaseKind()) { 235 case UnknownKind: 236 os << "Unknown"; 237 break; 238 case NonLocKind: 239 castAs<NonLoc>().dumpToStream(os); 240 break; 241 case LocKind: 242 castAs<Loc>().dumpToStream(os); 243 break; 244 case UndefinedKind: 245 os << "Undefined"; 246 break; 247 } 248} 249 250void NonLoc::dumpToStream(raw_ostream &os) const { 251 switch (getSubKind()) { 252 case nonloc::ConcreteIntKind: { 253 const nonloc::ConcreteInt& C = castAs<nonloc::ConcreteInt>(); 254 if (C.getValue().isUnsigned()) 255 os << C.getValue().getZExtValue(); 256 else 257 os << C.getValue().getSExtValue(); 258 os << ' ' << (C.getValue().isUnsigned() ? 'U' : 'S') 259 << C.getValue().getBitWidth() << 'b'; 260 break; 261 } 262 case nonloc::SymbolValKind: { 263 os << castAs<nonloc::SymbolVal>().getSymbol(); 264 break; 265 } 266 case nonloc::LocAsIntegerKind: { 267 const nonloc::LocAsInteger& C = castAs<nonloc::LocAsInteger>(); 268 os << C.getLoc() << " [as " << C.getNumBits() << " bit integer]"; 269 break; 270 } 271 case nonloc::CompoundValKind: { 272 const nonloc::CompoundVal& C = castAs<nonloc::CompoundVal>(); 273 os << "compoundVal{"; 274 bool first = true; 275 for (nonloc::CompoundVal::iterator I=C.begin(), E=C.end(); I!=E; ++I) { 276 if (first) { 277 os << ' '; first = false; 278 } 279 else 280 os << ", "; 281 282 (*I).dumpToStream(os); 283 } 284 os << "}"; 285 break; 286 } 287 case nonloc::LazyCompoundValKind: { 288 const nonloc::LazyCompoundVal &C = castAs<nonloc::LazyCompoundVal>(); 289 os << "lazyCompoundVal{" << const_cast<void *>(C.getStore()) 290 << ',' << C.getRegion() 291 << '}'; 292 break; 293 } 294 default: 295 assert (false && "Pretty-printed not implemented for this NonLoc."); 296 break; 297 } 298} 299 300void Loc::dumpToStream(raw_ostream &os) const { 301 switch (getSubKind()) { 302 case loc::ConcreteIntKind: 303 os << castAs<loc::ConcreteInt>().getValue().getZExtValue() << " (Loc)"; 304 break; 305 case loc::GotoLabelKind: 306 os << "&&" << castAs<loc::GotoLabel>().getLabel()->getName(); 307 break; 308 case loc::MemRegionKind: 309 os << '&' << castAs<loc::MemRegionVal>().getRegion()->getString(); 310 break; 311 default: 312 llvm_unreachable("Pretty-printing not implemented for this Loc."); 313 } 314} 315