ExprEngine.cpp revision 48b6247804eacc262cc5508e0fbb74ed819fbb6e
1d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidis//=-- ExprEngine.cpp - Path-Sensitive Expression-Level Dataflow ---*- C++ -*-= 264924859b6b09d1cfb62fecf5954ec6c27cb58feTed Kremenek// 34af84313df0d2710fd57af89132e680294225cadTed Kremenek// The LLVM Compiler Infrastructure 4d27f8169f4b68337a489547a41ac45bf7a5d1ddfTed Kremenek// 5d27f8169f4b68337a489547a41ac45bf7a5d1ddfTed Kremenek// This file is distributed under the University of Illinois Open Source 6d27f8169f4b68337a489547a41ac45bf7a5d1ddfTed Kremenek// License. See LICENSE.TXT for details. 7d27f8169f4b68337a489547a41ac45bf7a5d1ddfTed Kremenek// 8d27f8169f4b68337a489547a41ac45bf7a5d1ddfTed Kremenek//===----------------------------------------------------------------------===// 9d27f8169f4b68337a489547a41ac45bf7a5d1ddfTed Kremenek// 1077349cb20bfd7069d081f84c91975bfa8ef60a32Ted Kremenek// This file defines a meta-engine for path-sensitive dataflow analysis that 1177349cb20bfd7069d081f84c91975bfa8ef60a32Ted Kremenek// is built on GREngine, but provides the boilerplate to execute transfer 1277349cb20bfd7069d081f84c91975bfa8ef60a32Ted Kremenek// functions and build the ExplodedGraph at the expression level. 13d27f8169f4b68337a489547a41ac45bf7a5d1ddfTed Kremenek// 14d27f8169f4b68337a489547a41ac45bf7a5d1ddfTed Kremenek//===----------------------------------------------------------------------===// 15a7af5ea88a6c5bdf87497cca6c20831e8c546751Argyrios Kyrtzidis 16c2994283aa7538b7420c8e398cde7afa328d7042Anna Zaks#define DEBUG_TYPE "ExprEngine" 17c2994283aa7538b7420c8e398cde7afa328d7042Anna Zaks 1843dee220252ef0b42c5f8a3bb1eca97f84f2565fArgyrios Kyrtzidis#include "clang/StaticAnalyzer/Core/CheckerManager.h" 199b663716449b618ba0390b1dbebc54fa8e971124Ted Kremenek#include "clang/StaticAnalyzer/Core/BugReporter/BugType.h" 209b663716449b618ba0390b1dbebc54fa8e971124Ted Kremenek#include "clang/StaticAnalyzer/Core/PathSensitive/AnalysisManager.h" 2185d7e01cf639b257d70f8a129709a2d7594d7b22Jordan Rose#include "clang/StaticAnalyzer/Core/PathSensitive/Calls.h" 229b663716449b618ba0390b1dbebc54fa8e971124Ted Kremenek#include "clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h" 23199c3d6cd16aebbb9c7f0d42af9d922c9628bf70Ken Dyck#include "clang/AST/CharUnits.h" 2416f0049415ec596504891259e2a83e19871c0d52Chris Lattner#include "clang/AST/ParentMap.h" 2516f0049415ec596504891259e2a83e19871c0d52Chris Lattner#include "clang/AST/StmtObjC.h" 26337e4dbc6859589b8878146a88bebf754e916702Ted Kremenek#include "clang/AST/StmtCXX.h" 27c506357c3778092c2a3251243f12524e8eb89274Zhongxing Xu#include "clang/AST/DeclCXX.h" 281b63e4f732dbc73d90abf886b4d21f8e3a165f6dChris Lattner#include "clang/Basic/Builtins.h" 2916f0049415ec596504891259e2a83e19871c0d52Chris Lattner#include "clang/Basic/SourceManager.h" 300bed8a12f2878d3cd94fb8bdba55b593d92dd11aTed Kremenek#include "clang/Basic/PrettyStackTrace.h" 31a95d3750441ac8ad03e36af8e6e74039c9a3109dTed Kremenek#include "llvm/Support/raw_ostream.h" 326cb7c1a43b0c8f739d1f54b7fdae5ede86033496Benjamin Kramer#include "llvm/ADT/ImmutableList.h" 33c2994283aa7538b7420c8e398cde7afa328d7042Anna Zaks#include "llvm/ADT/Statistic.h" 344323a57627e796dcfdfdb7d47672dc09ed308edaTed Kremenek 350f5f0595d6a038843a7051c5a65fca7bce2915a0Ted Kremenek#ifndef NDEBUG 360f5f0595d6a038843a7051c5a65fca7bce2915a0Ted Kremenek#include "llvm/Support/GraphWriter.h" 370f5f0595d6a038843a7051c5a65fca7bce2915a0Ted Kremenek#endif 380f5f0595d6a038843a7051c5a65fca7bce2915a0Ted Kremenek 39b387a3f23e423d62c053be86294b703da1d1a222Ted Kremenekusing namespace clang; 409ef6537a894c33003359b1f9b9676e9178e028b7Ted Kremenekusing namespace ento; 41b387a3f23e423d62c053be86294b703da1d1a222Ted Kremenekusing llvm::APSInt; 42ab2b8c54bca82866876f91e756788916d3fa20c3Ted Kremenek 43c2994283aa7538b7420c8e398cde7afa328d7042Anna ZaksSTATISTIC(NumRemoveDeadBindings, 44c2994283aa7538b7420c8e398cde7afa328d7042Anna Zaks "The # of times RemoveDeadBindings is called"); 45749bbe6f5f23676244f12a0d41511c8e73516febAnna ZaksSTATISTIC(NumMaxBlockCountReached, 46749bbe6f5f23676244f12a0d41511c8e73516febAnna Zaks "The # of aborted paths due to reaching the maximum block count in " 47749bbe6f5f23676244f12a0d41511c8e73516febAnna Zaks "a top level function"); 48749bbe6f5f23676244f12a0d41511c8e73516febAnna ZaksSTATISTIC(NumMaxBlockCountReachedInInlined, 49749bbe6f5f23676244f12a0d41511c8e73516febAnna Zaks "The # of aborted paths due to reaching the maximum block count in " 50749bbe6f5f23676244f12a0d41511c8e73516febAnna Zaks "an inlined function"); 515903a373db3d27794c90b25687e0dd6adb0e497dAnna ZaksSTATISTIC(NumTimesRetriedWithoutInlining, 525903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks "The # of times we re-evaluated a call without inlining"); 535903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks 54e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek//===----------------------------------------------------------------------===// 55bdb435ddaafd5069becd543d638112f68825b89dTed Kremenek// Engine construction and deletion. 56bdb435ddaafd5069becd543d638112f68825b89dTed Kremenek//===----------------------------------------------------------------------===// 57bdb435ddaafd5069becd543d638112f68825b89dTed Kremenek 583fd5f370a28552976c52e76c3035d79012d78ddaAnna ZaksExprEngine::ExprEngine(AnalysisManager &mgr, bool gcEnabled, 596a86082f3a06a2dcceaaf63f78a0e52d64bcbaa3Anna Zaks SetOfConstDecls *VisitedCallees, 603bbd8cd831788c506f2980293eb3c7e1b3ca2501Anna Zaks FunctionSummariesTy *FS) 6125e695b2d574d919cc1bbddf3a2efe073d449b1cZhongxing Xu : AMgr(mgr), 621d26f48dc2eea1c07431ca1519d7034a21b9bcffTed Kremenek AnalysisDeclContexts(mgr.getAnalysisDeclContextManager()), 63e62f048960645b79363408fdead53fec2a063c52Anna Zaks Engine(*this, VisitedCallees, FS), 64d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidis G(Engine.getGraph()), 65c77a55126fcad66fb086f8e100a494caa2496a2dZhongxing Xu StateMgr(getContext(), mgr.getStoreManagerCreator(), 6632a58084a4c53e6938dd81bfce224db25a5976d1Ted Kremenek mgr.getConstraintManagerCreator(), G.getAllocator(), 6732a58084a4c53e6938dd81bfce224db25a5976d1Ted Kremenek *this), 6850a6d0ce344c02782e0207574005c3b2aaa5077cTed Kremenek SymMgr(StateMgr.getSymbolManager()), 69c8413fd03f73084a5c93028f8b4db619fc388087Ted Kremenek svalBuilder(StateMgr.getSValBuilder()), 708ad8c546372fe602708cb7ceeaf0ebbb866735c6Anna Zaks EntryNode(NULL), 718ad8c546372fe602708cb7ceeaf0ebbb866735c6Anna Zaks currentStmt(NULL), currentStmtIdx(0), currentBuilderContext(0), 72a5a4166f8cb04490b7b27355874edfb98837cd45Zhongxing Xu NSExceptionII(NULL), NSExceptionInstanceRaiseSelectors(NULL), 73c77a55126fcad66fb086f8e100a494caa2496a2dZhongxing Xu RaiseSel(GetNullarySelector("raise", getContext())), 74e62f048960645b79363408fdead53fec2a063c52Anna Zaks ObjCGCEnabled(gcEnabled), BR(mgr, *this) { 75d767d81290288c030f3be0be1d3e62b9c8df51dcTed Kremenek 76d767d81290288c030f3be0be1d3e62b9c8df51dcTed Kremenek if (mgr.shouldEagerlyTrimExplodedGraph()) { 77d767d81290288c030f3be0be1d3e62b9c8df51dcTed Kremenek // Enable eager node reclaimation when constructing the ExplodedGraph. 78d767d81290288c030f3be0be1d3e62b9c8df51dcTed Kremenek G.enableNodeReclamation(); 79d767d81290288c030f3be0be1d3e62b9c8df51dcTed Kremenek } 80c80135ba857da48173578b9c528fce6777e18168Ted Kremenek} 8150a6d0ce344c02782e0207574005c3b2aaa5077cTed Kremenek 82d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios KyrtzidisExprEngine::~ExprEngine() { 83cf118d41f7930a18dce97416ef7834a62642f587Ted Kremenek BR.FlushReports(); 84e448ab4f9dd162802f5d7cfea60f7830cc61c654Ted Kremenek delete [] NSExceptionInstanceRaiseSelectors; 8550a6d0ce344c02782e0207574005c3b2aaa5077cTed Kremenek} 8650a6d0ce344c02782e0207574005c3b2aaa5077cTed Kremenek 87e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek//===----------------------------------------------------------------------===// 88e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek// Utility methods. 89e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek//===----------------------------------------------------------------------===// 90e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek 918bef8238181a30e52dea380789a7e2d760eac532Ted KremenekProgramStateRef ExprEngine::getInitialState(const LocationContext *InitLoc) { 928bef8238181a30e52dea380789a7e2d760eac532Ted Kremenek ProgramStateRef state = StateMgr.getInitialState(InitLoc); 93a078ecf3484d62b01d9f8c01e0fecffd65c583e1Ted Kremenek const Decl *D = InitLoc->getDecl(); 941eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 95cfcd7fd0de701c5ce05e96de1ed2d0bf8c7035d9Ted Kremenek // Preconditions. 9652e5602056e4cade24cbcca57767e94e1d430b03Ted Kremenek // FIXME: It would be nice if we had a more general mechanism to add 9752e5602056e4cade24cbcca57767e94e1d430b03Ted Kremenek // such preconditions. Some day. 985974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek do { 99a078ecf3484d62b01d9f8c01e0fecffd65c583e1Ted Kremenek 1005974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek if (const FunctionDecl *FD = dyn_cast<FunctionDecl>(D)) { 1015974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek // Precondition: the first argument of 'main' is an integer guaranteed 1025974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek // to be > 0. 1035974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek const IdentifierInfo *II = FD->getIdentifier(); 1045974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek if (!II || !(II->getName() == "main" && FD->getNumParams() > 0)) 1055974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek break; 1065974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek 1075974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek const ParmVarDecl *PD = FD->getParamDecl(0); 1085974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek QualType T = PD->getType(); 1095974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek if (!T->isIntegerType()) 1105974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek break; 111b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 1125974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek const MemRegion *R = state->getRegion(PD, InitLoc); 1135974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek if (!R) 1145974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek break; 115b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 1161397663af9dbcc24dbf0e11de43931b3dc08fdbbTed Kremenek SVal V = state->getSVal(loc::MemRegionVal(R)); 1179c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek SVal Constraint_untested = evalBinOp(state, BO_GT, V, 118c8413fd03f73084a5c93028f8b4db619fc388087Ted Kremenek svalBuilder.makeZeroVal(T), 1195974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek getContext().IntTy); 1205974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek 1215974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek DefinedOrUnknownSVal *Constraint = 1225974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek dyn_cast<DefinedOrUnknownSVal>(&Constraint_untested); 123b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 1245974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek if (!Constraint) 1255974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek break; 126b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 1278bef8238181a30e52dea380789a7e2d760eac532Ted Kremenek if (ProgramStateRef newState = state->assume(*Constraint, true)) 1285974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek state = newState; 12952e5602056e4cade24cbcca57767e94e1d430b03Ted Kremenek } 130a078ecf3484d62b01d9f8c01e0fecffd65c583e1Ted Kremenek break; 131a078ecf3484d62b01d9f8c01e0fecffd65c583e1Ted Kremenek } 132a078ecf3484d62b01d9f8c01e0fecffd65c583e1Ted Kremenek while (0); 133a078ecf3484d62b01d9f8c01e0fecffd65c583e1Ted Kremenek 134a078ecf3484d62b01d9f8c01e0fecffd65c583e1Ted Kremenek if (const ObjCMethodDecl *MD = dyn_cast<ObjCMethodDecl>(D)) { 135a078ecf3484d62b01d9f8c01e0fecffd65c583e1Ted Kremenek // Precondition: 'self' is always non-null upon entry to an Objective-C 136a078ecf3484d62b01d9f8c01e0fecffd65c583e1Ted Kremenek // method. 137a078ecf3484d62b01d9f8c01e0fecffd65c583e1Ted Kremenek const ImplicitParamDecl *SelfD = MD->getSelfDecl(); 138a078ecf3484d62b01d9f8c01e0fecffd65c583e1Ted Kremenek const MemRegion *R = state->getRegion(SelfD, InitLoc); 139a078ecf3484d62b01d9f8c01e0fecffd65c583e1Ted Kremenek SVal V = state->getSVal(loc::MemRegionVal(R)); 140a078ecf3484d62b01d9f8c01e0fecffd65c583e1Ted Kremenek 141a078ecf3484d62b01d9f8c01e0fecffd65c583e1Ted Kremenek if (const Loc *LV = dyn_cast<Loc>(&V)) { 142a078ecf3484d62b01d9f8c01e0fecffd65c583e1Ted Kremenek // Assume that the pointer value in 'self' is non-null. 143a078ecf3484d62b01d9f8c01e0fecffd65c583e1Ted Kremenek state = state->assume(*LV, true); 144a078ecf3484d62b01d9f8c01e0fecffd65c583e1Ted Kremenek assert(state && "'self' cannot be null"); 145a078ecf3484d62b01d9f8c01e0fecffd65c583e1Ted Kremenek } 146a078ecf3484d62b01d9f8c01e0fecffd65c583e1Ted Kremenek } 1475974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek 148a078ecf3484d62b01d9f8c01e0fecffd65c583e1Ted Kremenek if (const CXXMethodDecl *MD = dyn_cast<CXXMethodDecl>(D)) { 149a078ecf3484d62b01d9f8c01e0fecffd65c583e1Ted Kremenek if (!MD->isStatic()) { 150a078ecf3484d62b01d9f8c01e0fecffd65c583e1Ted Kremenek // Precondition: 'this' is always non-null upon entry to the 151a078ecf3484d62b01d9f8c01e0fecffd65c583e1Ted Kremenek // top-level function. This is our starting assumption for 152a078ecf3484d62b01d9f8c01e0fecffd65c583e1Ted Kremenek // analyzing an "open" program. 153a078ecf3484d62b01d9f8c01e0fecffd65c583e1Ted Kremenek const StackFrameContext *SFC = InitLoc->getCurrentStackFrame(); 154a078ecf3484d62b01d9f8c01e0fecffd65c583e1Ted Kremenek if (SFC->getParent() == 0) { 15510f77ad7fc5e5cf3f37a9b14ff5843468b8b84d2Ted Kremenek loc::MemRegionVal L = svalBuilder.getCXXThis(MD, SFC); 156a078ecf3484d62b01d9f8c01e0fecffd65c583e1Ted Kremenek SVal V = state->getSVal(L); 157a078ecf3484d62b01d9f8c01e0fecffd65c583e1Ted Kremenek if (const Loc *LV = dyn_cast<Loc>(&V)) { 158a078ecf3484d62b01d9f8c01e0fecffd65c583e1Ted Kremenek state = state->assume(*LV, true); 159a078ecf3484d62b01d9f8c01e0fecffd65c583e1Ted Kremenek assert(state && "'this' cannot be null"); 160a078ecf3484d62b01d9f8c01e0fecffd65c583e1Ted Kremenek } 1615974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek } 162cfcd7fd0de701c5ce05e96de1ed2d0bf8c7035d9Ted Kremenek } 163a078ecf3484d62b01d9f8c01e0fecffd65c583e1Ted Kremenek } 164a078ecf3484d62b01d9f8c01e0fecffd65c583e1Ted Kremenek 16552e5602056e4cade24cbcca57767e94e1d430b03Ted Kremenek return state; 166e070a1df66aab6d4168fb28f7559fdf996df3567Ted Kremenek} 167e070a1df66aab6d4168fb28f7559fdf996df3567Ted Kremenek 168e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek//===----------------------------------------------------------------------===// 169e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek// Top-level transfer function logic (Dispatcher). 170e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek//===----------------------------------------------------------------------===// 171e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek 1729c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek/// evalAssume - Called by ConstraintManager. Used to call checker-specific 17332a58084a4c53e6938dd81bfce224db25a5976d1Ted Kremenek/// logic for handling assumptions on symbolic values. 1748bef8238181a30e52dea380789a7e2d760eac532Ted KremenekProgramStateRef ExprEngine::processAssume(ProgramStateRef state, 175fe27971d54d26997149d6b84057f04ff398d1d5dJordy Rose SVal cond, bool assumption) { 176fe27971d54d26997149d6b84057f04ff398d1d5dJordy Rose return getCheckerManager().runCheckersForEvalAssume(state, cond, assumption); 17732a58084a4c53e6938dd81bfce224db25a5976d1Ted Kremenek} 17832a58084a4c53e6938dd81bfce224db25a5976d1Ted Kremenek 1798bef8238181a30e52dea380789a7e2d760eac532Ted Kremenekbool ExprEngine::wantsRegionChangeUpdate(ProgramStateRef state) { 180183ff98f425d470c2a0276880aaf43496c9dad14Argyrios Kyrtzidis return getCheckerManager().wantsRegionChangeUpdate(state); 181c2b7dfaad674587cfd220ff447b3710d252130c3Jordy Rose} 182c2b7dfaad674587cfd220ff447b3710d252130c3Jordy Rose 1838bef8238181a30e52dea380789a7e2d760eac532Ted KremenekProgramStateRef 1848bef8238181a30e52dea380789a7e2d760eac532Ted KremenekExprEngine::processRegionChanges(ProgramStateRef state, 18535bdbf40624beba3fc00cb72ab444659939c1a6bTed Kremenek const StoreManager::InvalidatedSymbols *invalidated, 186537716ad8dd10f984b6cfe6985afade1185c5e3cJordy Rose ArrayRef<const MemRegion *> Explicits, 18766c40400e7d6272b0cd675ada18dd62c1f0362c7Anna Zaks ArrayRef<const MemRegion *> Regions, 188740d490593e0de8732a697c9f77b90ddd463863bJordan Rose const CallEvent *Call) { 18935bdbf40624beba3fc00cb72ab444659939c1a6bTed Kremenek return getCheckerManager().runCheckersForRegionChanges(state, invalidated, 19066c40400e7d6272b0cd675ada18dd62c1f0362c7Anna Zaks Explicits, Regions, Call); 191c2b7dfaad674587cfd220ff447b3710d252130c3Jordy Rose} 192c2b7dfaad674587cfd220ff447b3710d252130c3Jordy Rose 1938bef8238181a30e52dea380789a7e2d760eac532Ted Kremenekvoid ExprEngine::printState(raw_ostream &Out, ProgramStateRef State, 194dbd658e139b3e0bf084f75feaea8d844af9e319fJordy Rose const char *NL, const char *Sep) { 195dbd658e139b3e0bf084f75feaea8d844af9e319fJordy Rose getCheckerManager().runCheckersForPrintState(Out, State, NL, Sep); 196dbd658e139b3e0bf084f75feaea8d844af9e319fJordy Rose} 197dbd658e139b3e0bf084f75feaea8d844af9e319fJordy Rose 198e36de1fe51c39d9161915dd3dbef880954af6476Ted Kremenekvoid ExprEngine::processEndWorklist(bool hasWorkRemaining) { 19930726c6baee1417307236e854f1474fdb3cedb98Argyrios Kyrtzidis getCheckerManager().runCheckersForEndAnalysis(G, BR, *this); 200ccc263b44c62ce3a02f797a3ddb3d6017cf0e5e4Ted Kremenek} 201ccc263b44c62ce3a02f797a3ddb3d6017cf0e5e4Ted Kremenek 202ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaksvoid ExprEngine::processCFGElement(const CFGElement E, ExplodedNode *Pred, 203ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks unsigned StmtIdx, NodeBuilderContext *Ctx) { 204ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks currentStmtIdx = StmtIdx; 205ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks currentBuilderContext = Ctx; 206ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks 2079c6cd67ea416bace666d614c84d5531124287653Zhongxing Xu switch (E.getKind()) { 2083c0349e87cdbd7316d06d2411d86ee1086e717a5Ted Kremenek case CFGElement::Invalid: 2093c0349e87cdbd7316d06d2411d86ee1086e717a5Ted Kremenek llvm_unreachable("Unexpected CFGElement kind."); 2103c0349e87cdbd7316d06d2411d86ee1086e717a5Ted Kremenek case CFGElement::Statement: 211ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks ProcessStmt(const_cast<Stmt*>(E.getAs<CFGStmt>()->getStmt()), Pred); 2123c0349e87cdbd7316d06d2411d86ee1086e717a5Ted Kremenek return; 2133c0349e87cdbd7316d06d2411d86ee1086e717a5Ted Kremenek case CFGElement::Initializer: 214ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks ProcessInitializer(E.getAs<CFGInitializer>()->getInitializer(), Pred); 2153c0349e87cdbd7316d06d2411d86ee1086e717a5Ted Kremenek return; 2163c0349e87cdbd7316d06d2411d86ee1086e717a5Ted Kremenek case CFGElement::AutomaticObjectDtor: 2173c0349e87cdbd7316d06d2411d86ee1086e717a5Ted Kremenek case CFGElement::BaseDtor: 2183c0349e87cdbd7316d06d2411d86ee1086e717a5Ted Kremenek case CFGElement::MemberDtor: 2193c0349e87cdbd7316d06d2411d86ee1086e717a5Ted Kremenek case CFGElement::TemporaryDtor: 220ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks ProcessImplicitDtor(*E.getAs<CFGImplicitDtor>(), Pred); 2213c0349e87cdbd7316d06d2411d86ee1086e717a5Ted Kremenek return; 2229c6cd67ea416bace666d614c84d5531124287653Zhongxing Xu } 2230b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks currentBuilderContext = 0; 2249c6cd67ea416bace666d614c84d5531124287653Zhongxing Xu} 2259c6cd67ea416bace666d614c84d5531124287653Zhongxing Xu 226ce117a7d289f57f792e5cc3294280cfe070433deTed Kremenekstatic bool shouldRemoveDeadBindings(AnalysisManager &AMgr, 227ce117a7d289f57f792e5cc3294280cfe070433deTed Kremenek const CFGStmt S, 228ce117a7d289f57f792e5cc3294280cfe070433deTed Kremenek const ExplodedNode *Pred, 229ce117a7d289f57f792e5cc3294280cfe070433deTed Kremenek const LocationContext *LC) { 230ce117a7d289f57f792e5cc3294280cfe070433deTed Kremenek 231ce117a7d289f57f792e5cc3294280cfe070433deTed Kremenek // Are we never purging state values? 232ce117a7d289f57f792e5cc3294280cfe070433deTed Kremenek if (AMgr.getPurgeMode() == PurgeNone) 233ce117a7d289f57f792e5cc3294280cfe070433deTed Kremenek return false; 234ce117a7d289f57f792e5cc3294280cfe070433deTed Kremenek 235ce117a7d289f57f792e5cc3294280cfe070433deTed Kremenek // Is this the beginning of a basic block? 2369e9a3e612d57b583800d5f0e48bb28d4afbd8b84Ted Kremenek if (isa<BlockEntrance>(Pred->getLocation())) 237ce117a7d289f57f792e5cc3294280cfe070433deTed Kremenek return true; 238ce117a7d289f57f792e5cc3294280cfe070433deTed Kremenek 239ce117a7d289f57f792e5cc3294280cfe070433deTed Kremenek // Is this on a non-expression? 240ce117a7d289f57f792e5cc3294280cfe070433deTed Kremenek if (!isa<Expr>(S.getStmt())) 241ce117a7d289f57f792e5cc3294280cfe070433deTed Kremenek return true; 242ff80afcfb2b00ccffcb6cb10528bec565fc59eddAnna Zaks 243ff80afcfb2b00ccffcb6cb10528bec565fc59eddAnna Zaks // Run before processing a call. 24485d7e01cf639b257d70f8a129709a2d7594d7b22Jordan Rose if (CallEvent::mayBeInlined(S.getStmt())) 245ff80afcfb2b00ccffcb6cb10528bec565fc59eddAnna Zaks return true; 246ff80afcfb2b00ccffcb6cb10528bec565fc59eddAnna Zaks 247ce117a7d289f57f792e5cc3294280cfe070433deTed Kremenek // Is this an expression that is consumed by another expression? If so, 248ce117a7d289f57f792e5cc3294280cfe070433deTed Kremenek // postpone cleaning out the state. 249ce117a7d289f57f792e5cc3294280cfe070433deTed Kremenek ParentMap &PM = LC->getAnalysisDeclContext()->getParentMap(); 250ce117a7d289f57f792e5cc3294280cfe070433deTed Kremenek return !PM.isConsumedExpr(cast<Expr>(S.getStmt())); 251ce117a7d289f57f792e5cc3294280cfe070433deTed Kremenek} 252ce117a7d289f57f792e5cc3294280cfe070433deTed Kremenek 2530b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaksvoid ExprEngine::removeDead(ExplodedNode *Pred, ExplodedNodeSet &Out, 2540b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks const Stmt *ReferenceStmt, 2550b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks const LocationContext *LC, 2560b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks const Stmt *DiagnosticStmt, 2570b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks ProgramPoint::Kind K) { 2580b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks assert((K == ProgramPoint::PreStmtPurgeDeadSymbolsKind || 2590b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks ReferenceStmt == 0) && "PreStmt is not generally supported by " 2600b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks "the SymbolReaper yet"); 2610b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks NumRemoveDeadBindings++; 2620b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks CleanedState = Pred->getState(); 2630b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks SymbolReaper SymReaper(LC, ReferenceStmt, SymMgr, getStoreManager()); 2640b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks 2650b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks getCheckerManager().runCheckersForLiveSymbols(CleanedState, SymReaper); 2660b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks 2670b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks // Create a state in which dead bindings are removed from the environment 2680b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks // and the store. TODO: The function should just return new env and store, 2690b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks // not a new state. 2700b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks const StackFrameContext *SFC = LC->getCurrentStackFrame(); 2710b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks CleanedState = StateMgr.removeDeadBindings(CleanedState, SFC, SymReaper); 272241677a13cc46647a8f5098b3e3239bd9480dca2Ted Kremenek 27377d7ef8d8a80ccb2ab3d25c80810571e3ab14ee4Ted Kremenek // Process any special transfer function for dead symbols. 274f185cc1ac77a84139c603eee3473b88dcb839c68Anna Zaks // A tag to track convenience transitions, which can be removed at cleanup. 275f185cc1ac77a84139c603eee3473b88dcb839c68Anna Zaks static SimpleProgramPointTag cleanupTag("ExprEngine : Clean Node"); 2766bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks if (!SymReaper.hasDeadSymbols()) { 2776bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks // Generate a CleanedNode that has the environment and store cleaned 2786bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks // up. Since no symbols are dead, we can optimize and not clean out 2796bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks // the constraint manager. 2800b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks StmtNodeBuilder Bldr(Pred, Out, *currentBuilderContext); 2810b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks Bldr.generateNode(DiagnosticStmt, Pred, CleanedState, false, &cleanupTag,K); 2821eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 2836bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks } else { 2846bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks // Call checkers with the non-cleaned state so that they could query the 2856bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks // values of the soon to be dead symbols. 286fe27971d54d26997149d6b84057f04ff398d1d5dJordy Rose ExplodedNodeSet CheckedSet; 2870b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks getCheckerManager().runCheckersForDeadSymbols(CheckedSet, Pred, SymReaper, 2880b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks DiagnosticStmt, *this, K); 289183ff98f425d470c2a0276880aaf43496c9dad14Argyrios Kyrtzidis 290fe27971d54d26997149d6b84057f04ff398d1d5dJordy Rose // For each node in CheckedSet, generate CleanedNodes that have the 291fe27971d54d26997149d6b84057f04ff398d1d5dJordy Rose // environment, the store, and the constraints cleaned up but have the 292fe27971d54d26997149d6b84057f04ff398d1d5dJordy Rose // user-supplied states as the predecessors. 2930b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks StmtNodeBuilder Bldr(CheckedSet, Out, *currentBuilderContext); 294fe27971d54d26997149d6b84057f04ff398d1d5dJordy Rose for (ExplodedNodeSet::const_iterator 295fe27971d54d26997149d6b84057f04ff398d1d5dJordy Rose I = CheckedSet.begin(), E = CheckedSet.end(); I != E; ++I) { 2968bef8238181a30e52dea380789a7e2d760eac532Ted Kremenek ProgramStateRef CheckerState = (*I)->getState(); 2976bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks 2986bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks // The constraint manager has not been cleaned up yet, so clean up now. 2996bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks CheckerState = getConstraintManager().removeDeadBindings(CheckerState, 3006bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks SymReaper); 3016bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks 3020b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks assert(StateMgr.haveEqualEnvironments(CheckerState, Pred->getState()) && 3036bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks "Checkers are not allowed to modify the Environment as a part of " 3046bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks "checkDeadSymbols processing."); 3050b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks assert(StateMgr.haveEqualStores(CheckerState, Pred->getState()) && 3066bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks "Checkers are not allowed to modify the Store as a part of " 3076bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks "checkDeadSymbols processing."); 3086bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks 3096bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks // Create a state based on CleanedState with CheckerState GDM and 3106bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks // generate a transition to that state. 3118bef8238181a30e52dea380789a7e2d760eac532Ted Kremenek ProgramStateRef CleanedCheckerSt = 3126bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks StateMgr.getPersistentStateWithGDM(CleanedState, CheckerState); 3130b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks Bldr.generateNode(DiagnosticStmt, *I, CleanedCheckerSt, false, 3140b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks &cleanupTag, K); 3156bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks } 31677d7ef8d8a80ccb2ab3d25c80810571e3ab14ee4Ted Kremenek } 3170b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks} 3180b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks 3190b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaksvoid ExprEngine::ProcessStmt(const CFGStmt S, 3200b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks ExplodedNode *Pred) { 3210b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks // Reclaim any unnecessary nodes in the ExplodedGraph. 3220b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks G.reclaimRecentlyAllocatedNodes(); 3230b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks 3240b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks currentStmt = S.getStmt(); 3250b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks PrettyStackTraceLoc CrashInfo(getContext().getSourceManager(), 3260b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks currentStmt->getLocStart(), 3270b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks "Error evaluating statement"); 3281eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 3290b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks // Remove dead bindings and symbols. 3300b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks EntryNode = Pred; 3310b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks ExplodedNodeSet CleanedStates; 3320b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks if (shouldRemoveDeadBindings(AMgr, S, Pred, EntryNode->getLocationContext())){ 3330b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks removeDead(EntryNode, CleanedStates, currentStmt, 3340b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks Pred->getLocationContext(), currentStmt); 3350b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks } else 3360b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks CleanedStates.Add(EntryNode); 3370b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks 3380b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks // Visit the statement. 339dd7ddf2b2296f95e7591ca3f9791f0eb9a15ee42Anna Zaks ExplodedNodeSet Dst; 3400b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks for (ExplodedNodeSet::iterator I = CleanedStates.begin(), 3410b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks E = CleanedStates.end(); I != E; ++I) { 342dd7ddf2b2296f95e7591ca3f9791f0eb9a15ee42Anna Zaks ExplodedNodeSet DstI; 3431eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump // Visit the statement. 344dd7ddf2b2296f95e7591ca3f9791f0eb9a15ee42Anna Zaks Visit(currentStmt, *I, DstI); 345dd7ddf2b2296f95e7591ca3f9791f0eb9a15ee42Anna Zaks Dst.insert(DstI); 346ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks } 347ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks 348dd7ddf2b2296f95e7591ca3f9791f0eb9a15ee42Anna Zaks // Enqueue the new nodes onto the work list. 349dd7ddf2b2296f95e7591ca3f9791f0eb9a15ee42Anna Zaks Engine.enqueue(Dst, currentBuilderContext->getBlock(), currentStmtIdx); 3501eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 351e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek // NULL out these variables to cleanup. 352846d4e923bf11bcdc2816758aafa331795f29230Ted Kremenek CleanedState = NULL; 353846d4e923bf11bcdc2816758aafa331795f29230Ted Kremenek EntryNode = NULL; 3540a3ed3143b00f237decb1288c1ff574ae09eba4eTed Kremenek currentStmt = 0; 355e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek} 356e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek 357d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidisvoid ExprEngine::ProcessInitializer(const CFGInitializer Init, 358056c4b46335a3bd2612414735d5749ee159c0165Anna Zaks ExplodedNode *Pred) { 359ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks ExplodedNodeSet Dst; 360ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks 3610a3ed3143b00f237decb1288c1ff574ae09eba4eTed Kremenek // We don't set EntryNode and currentStmt. And we don't clean up state. 362cbb67480094b3bcb5b715acd827cbad55e2a204cSean Hunt const CXXCtorInitializer *BMI = Init.getInitializer(); 363056c4b46335a3bd2612414735d5749ee159c0165Anna Zaks const StackFrameContext *stackFrame = 364056c4b46335a3bd2612414735d5749ee159c0165Anna Zaks cast<StackFrameContext>(Pred->getLocationContext()); 365056c4b46335a3bd2612414735d5749ee159c0165Anna Zaks const CXXConstructorDecl *decl = 366056c4b46335a3bd2612414735d5749ee159c0165Anna Zaks cast<CXXConstructorDecl>(stackFrame->getDecl()); 36710f77ad7fc5e5cf3f37a9b14ff5843468b8b84d2Ted Kremenek SVal thisVal = Pred->getState()->getSVal(svalBuilder.getCXXThis(decl, 36810f77ad7fc5e5cf3f37a9b14ff5843468b8b84d2Ted Kremenek stackFrame)); 3699dc84c9455df2a77195147d0210c915dc1775a88Zhongxing Xu 37000eb3f9c5b33e3d99aee1f8b75dd9c9678fdd66bFrancois Pichet if (BMI->isAnyMemberInitializer()) { 3719dc84c9455df2a77195147d0210c915dc1775a88Zhongxing Xu // Evaluate the initializer. 3729dc84c9455df2a77195147d0210c915dc1775a88Zhongxing Xu 373e711d7e7875920fee4180a26bfc67d67f0f71a2cErik Verbruggen StmtNodeBuilder Bldr(Pred, Dst, *currentBuilderContext); 374e711d7e7875920fee4180a26bfc67d67f0f71a2cErik Verbruggen ProgramStateRef state = Pred->getState(); 3759dc84c9455df2a77195147d0210c915dc1775a88Zhongxing Xu 376e711d7e7875920fee4180a26bfc67d67f0f71a2cErik Verbruggen const FieldDecl *FD = BMI->getAnyMember(); 3779dc84c9455df2a77195147d0210c915dc1775a88Zhongxing Xu 37848b6247804eacc262cc5508e0fbb74ed819fbb6eJordan Rose // FIXME: This does not work for initializers that call constructors. 379e711d7e7875920fee4180a26bfc67d67f0f71a2cErik Verbruggen SVal FieldLoc = state->getLValue(FD, thisVal); 380e711d7e7875920fee4180a26bfc67d67f0f71a2cErik Verbruggen SVal InitVal = state->getSVal(BMI->getInit(), Pred->getLocationContext()); 381e711d7e7875920fee4180a26bfc67d67f0f71a2cErik Verbruggen state = state->bindLoc(FieldLoc, InitVal); 3829dc84c9455df2a77195147d0210c915dc1775a88Zhongxing Xu 383e711d7e7875920fee4180a26bfc67d67f0f71a2cErik Verbruggen // Use a custom node building process. 384e711d7e7875920fee4180a26bfc67d67f0f71a2cErik Verbruggen PostInitializer PP(BMI, stackFrame); 385e711d7e7875920fee4180a26bfc67d67f0f71a2cErik Verbruggen // Builder automatically add the generated node to the deferred set, 386e711d7e7875920fee4180a26bfc67d67f0f71a2cErik Verbruggen // which are processed in the builder's dtor. 387e711d7e7875920fee4180a26bfc67d67f0f71a2cErik Verbruggen Bldr.generateNode(PP, Pred, state); 388056c4b46335a3bd2612414735d5749ee159c0165Anna Zaks } else { 389056c4b46335a3bd2612414735d5749ee159c0165Anna Zaks assert(BMI->isBaseInitializer()); 390056c4b46335a3bd2612414735d5749ee159c0165Anna Zaks 391056c4b46335a3bd2612414735d5749ee159c0165Anna Zaks // Get the base class declaration. 392056c4b46335a3bd2612414735d5749ee159c0165Anna Zaks const CXXConstructExpr *ctorExpr = cast<CXXConstructExpr>(BMI->getInit()); 393056c4b46335a3bd2612414735d5749ee159c0165Anna Zaks 394056c4b46335a3bd2612414735d5749ee159c0165Anna Zaks // Create the base object region. 395056c4b46335a3bd2612414735d5749ee159c0165Anna Zaks SVal baseVal = 396056c4b46335a3bd2612414735d5749ee159c0165Anna Zaks getStoreManager().evalDerivedToBase(thisVal, ctorExpr->getType()); 397056c4b46335a3bd2612414735d5749ee159c0165Anna Zaks const MemRegion *baseReg = baseVal.getAsRegion(); 398056c4b46335a3bd2612414735d5749ee159c0165Anna Zaks assert(baseReg); 399d074441e027471a914cbb909a7aad1d43224950fZhongxing Xu 400056c4b46335a3bd2612414735d5749ee159c0165Anna Zaks VisitCXXConstructExpr(ctorExpr, baseReg, Pred, Dst); 401056c4b46335a3bd2612414735d5749ee159c0165Anna Zaks } 402dd7ddf2b2296f95e7591ca3f9791f0eb9a15ee42Anna Zaks 403dd7ddf2b2296f95e7591ca3f9791f0eb9a15ee42Anna Zaks // Enqueue the new nodes onto the work list. 404dd7ddf2b2296f95e7591ca3f9791f0eb9a15ee42Anna Zaks Engine.enqueue(Dst, currentBuilderContext->getBlock(), currentStmtIdx); 4059c6cd67ea416bace666d614c84d5531124287653Zhongxing Xu} 4069c6cd67ea416bace666d614c84d5531124287653Zhongxing Xu 407d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidisvoid ExprEngine::ProcessImplicitDtor(const CFGImplicitDtor D, 408ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks ExplodedNode *Pred) { 409ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks ExplodedNodeSet Dst; 4103c0349e87cdbd7316d06d2411d86ee1086e717a5Ted Kremenek switch (D.getKind()) { 4114ffcb9974c6b7142c4a1483abfcb1f88b6371c45Zhongxing Xu case CFGElement::AutomaticObjectDtor: 412056c4b46335a3bd2612414735d5749ee159c0165Anna Zaks ProcessAutomaticObjDtor(cast<CFGAutomaticObjDtor>(D), Pred, Dst); 4134ffcb9974c6b7142c4a1483abfcb1f88b6371c45Zhongxing Xu break; 4144ffcb9974c6b7142c4a1483abfcb1f88b6371c45Zhongxing Xu case CFGElement::BaseDtor: 415056c4b46335a3bd2612414735d5749ee159c0165Anna Zaks ProcessBaseDtor(cast<CFGBaseDtor>(D), Pred, Dst); 4164ffcb9974c6b7142c4a1483abfcb1f88b6371c45Zhongxing Xu break; 4174ffcb9974c6b7142c4a1483abfcb1f88b6371c45Zhongxing Xu case CFGElement::MemberDtor: 418056c4b46335a3bd2612414735d5749ee159c0165Anna Zaks ProcessMemberDtor(cast<CFGMemberDtor>(D), Pred, Dst); 4194ffcb9974c6b7142c4a1483abfcb1f88b6371c45Zhongxing Xu break; 4204ffcb9974c6b7142c4a1483abfcb1f88b6371c45Zhongxing Xu case CFGElement::TemporaryDtor: 421056c4b46335a3bd2612414735d5749ee159c0165Anna Zaks ProcessTemporaryDtor(cast<CFGTemporaryDtor>(D), Pred, Dst); 4224ffcb9974c6b7142c4a1483abfcb1f88b6371c45Zhongxing Xu break; 4234ffcb9974c6b7142c4a1483abfcb1f88b6371c45Zhongxing Xu default: 4244ffcb9974c6b7142c4a1483abfcb1f88b6371c45Zhongxing Xu llvm_unreachable("Unexpected dtor kind."); 4254ffcb9974c6b7142c4a1483abfcb1f88b6371c45Zhongxing Xu } 426ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks 427dd7ddf2b2296f95e7591ca3f9791f0eb9a15ee42Anna Zaks // Enqueue the new nodes onto the work list. 428dd7ddf2b2296f95e7591ca3f9791f0eb9a15ee42Anna Zaks Engine.enqueue(Dst, currentBuilderContext->getBlock(), currentStmtIdx); 4294ffcb9974c6b7142c4a1483abfcb1f88b6371c45Zhongxing Xu} 4304ffcb9974c6b7142c4a1483abfcb1f88b6371c45Zhongxing Xu 431056c4b46335a3bd2612414735d5749ee159c0165Anna Zaksvoid ExprEngine::ProcessAutomaticObjDtor(const CFGAutomaticObjDtor Dtor, 432056c4b46335a3bd2612414735d5749ee159c0165Anna Zaks ExplodedNode *Pred, 433056c4b46335a3bd2612414735d5749ee159c0165Anna Zaks ExplodedNodeSet &Dst) { 4348bef8238181a30e52dea380789a7e2d760eac532Ted Kremenek ProgramStateRef state = Pred->getState(); 435056c4b46335a3bd2612414735d5749ee159c0165Anna Zaks const VarDecl *varDecl = Dtor.getVarDecl(); 4362210490e6d099b7a5b4f68f44a136e4dcf3cdea2Zhongxing Xu 4372210490e6d099b7a5b4f68f44a136e4dcf3cdea2Zhongxing Xu QualType varType = varDecl->getType(); 4382210490e6d099b7a5b4f68f44a136e4dcf3cdea2Zhongxing Xu 4392210490e6d099b7a5b4f68f44a136e4dcf3cdea2Zhongxing Xu if (const ReferenceType *refType = varType->getAs<ReferenceType>()) 4402210490e6d099b7a5b4f68f44a136e4dcf3cdea2Zhongxing Xu varType = refType->getPointeeType(); 4412210490e6d099b7a5b4f68f44a136e4dcf3cdea2Zhongxing Xu 4422210490e6d099b7a5b4f68f44a136e4dcf3cdea2Zhongxing Xu const CXXRecordDecl *recordDecl = varType->getAsCXXRecordDecl(); 4432210490e6d099b7a5b4f68f44a136e4dcf3cdea2Zhongxing Xu assert(recordDecl && "get CXXRecordDecl fail"); 4442210490e6d099b7a5b4f68f44a136e4dcf3cdea2Zhongxing Xu const CXXDestructorDecl *dtorDecl = recordDecl->getDestructor(); 445b13453bd8a91f331d0910ca95ad52aa41b52f648Zhongxing Xu 446056c4b46335a3bd2612414735d5749ee159c0165Anna Zaks Loc dest = state->getLValue(varDecl, Pred->getLocationContext()); 447b13453bd8a91f331d0910ca95ad52aa41b52f648Zhongxing Xu 4482210490e6d099b7a5b4f68f44a136e4dcf3cdea2Zhongxing Xu VisitCXXDestructor(dtorDecl, cast<loc::MemRegionVal>(dest).getRegion(), 449056c4b46335a3bd2612414735d5749ee159c0165Anna Zaks Dtor.getTriggerStmt(), Pred, Dst); 4504ffcb9974c6b7142c4a1483abfcb1f88b6371c45Zhongxing Xu} 4514ffcb9974c6b7142c4a1483abfcb1f88b6371c45Zhongxing Xu 452d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidisvoid ExprEngine::ProcessBaseDtor(const CFGBaseDtor D, 453056c4b46335a3bd2612414735d5749ee159c0165Anna Zaks ExplodedNode *Pred, ExplodedNodeSet &Dst) {} 4544ffcb9974c6b7142c4a1483abfcb1f88b6371c45Zhongxing Xu 455d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidisvoid ExprEngine::ProcessMemberDtor(const CFGMemberDtor D, 456056c4b46335a3bd2612414735d5749ee159c0165Anna Zaks ExplodedNode *Pred, ExplodedNodeSet &Dst) {} 4574ffcb9974c6b7142c4a1483abfcb1f88b6371c45Zhongxing Xu 458d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidisvoid ExprEngine::ProcessTemporaryDtor(const CFGTemporaryDtor D, 459056c4b46335a3bd2612414735d5749ee159c0165Anna Zaks ExplodedNode *Pred, 460056c4b46335a3bd2612414735d5749ee159c0165Anna Zaks ExplodedNodeSet &Dst) {} 4619c6cd67ea416bace666d614c84d5531124287653Zhongxing Xu 46248b6247804eacc262cc5508e0fbb74ed819fbb6eJordan Rosestatic const VarDecl *findDirectConstruction(const DeclStmt *DS, 46348b6247804eacc262cc5508e0fbb74ed819fbb6eJordan Rose const Expr *Init) { 46448b6247804eacc262cc5508e0fbb74ed819fbb6eJordan Rose for (DeclStmt::const_decl_iterator I = DS->decl_begin(), E = DS->decl_end(); 46548b6247804eacc262cc5508e0fbb74ed819fbb6eJordan Rose I != E; ++I) { 46648b6247804eacc262cc5508e0fbb74ed819fbb6eJordan Rose const VarDecl *Var = dyn_cast<VarDecl>(*I); 46748b6247804eacc262cc5508e0fbb74ed819fbb6eJordan Rose if (!Var) 46848b6247804eacc262cc5508e0fbb74ed819fbb6eJordan Rose continue; 46948b6247804eacc262cc5508e0fbb74ed819fbb6eJordan Rose if (Var->getInit() != Init) 47048b6247804eacc262cc5508e0fbb74ed819fbb6eJordan Rose continue; 47148b6247804eacc262cc5508e0fbb74ed819fbb6eJordan Rose // FIXME: We need to decide how copy-elision should work here. 47248b6247804eacc262cc5508e0fbb74ed819fbb6eJordan Rose if (!Var->isDirectInit()) 47348b6247804eacc262cc5508e0fbb74ed819fbb6eJordan Rose break; 47448b6247804eacc262cc5508e0fbb74ed819fbb6eJordan Rose if (Var->getType()->isReferenceType()) 47548b6247804eacc262cc5508e0fbb74ed819fbb6eJordan Rose break; 47648b6247804eacc262cc5508e0fbb74ed819fbb6eJordan Rose return Var; 47748b6247804eacc262cc5508e0fbb74ed819fbb6eJordan Rose } 47848b6247804eacc262cc5508e0fbb74ed819fbb6eJordan Rose 47948b6247804eacc262cc5508e0fbb74ed819fbb6eJordan Rose return 0; 48048b6247804eacc262cc5508e0fbb74ed819fbb6eJordan Rose} 48148b6247804eacc262cc5508e0fbb74ed819fbb6eJordan Rose 48248b6247804eacc262cc5508e0fbb74ed819fbb6eJordan Rosevoid ExprEngine::Visit(const Stmt *S, ExplodedNode *Pred, 4836889679d72859960e0fc8d1080487f63c4df1e0aAnna Zaks ExplodedNodeSet &DstTop) { 4840bed8a12f2878d3cd94fb8bdba55b593d92dd11aTed Kremenek PrettyStackTraceLoc CrashInfo(getContext().getSourceManager(), 4850bed8a12f2878d3cd94fb8bdba55b593d92dd11aTed Kremenek S->getLocStart(), 4860bed8a12f2878d3cd94fb8bdba55b593d92dd11aTed Kremenek "Error evaluating statement"); 4876889679d72859960e0fc8d1080487f63c4df1e0aAnna Zaks ExplodedNodeSet Dst; 4886889679d72859960e0fc8d1080487f63c4df1e0aAnna Zaks StmtNodeBuilder Bldr(Pred, DstTop, *currentBuilderContext); 4890bed8a12f2878d3cd94fb8bdba55b593d92dd11aTed Kremenek 490f6a1648197562e0b133440d612d9af297d0a86ccJohn McCall // Expressions to ignore. 491f6a1648197562e0b133440d612d9af297d0a86ccJohn McCall if (const Expr *Ex = dyn_cast<Expr>(S)) 492892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek S = Ex->IgnoreParens(); 493f6a1648197562e0b133440d612d9af297d0a86ccJohn McCall 494e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek // FIXME: add metadata to the CFG so that we can disable 495e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek // this check when we KNOW that there is no block-level subexpression. 496e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek // The motivation is that this check requires a hashtable lookup. 4971eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 498ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks if (S != currentStmt && Pred->getLocationContext()->getCFG()->isBlkExpr(S)) 499e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek return; 5001eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 501e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek switch (S->getStmtClass()) { 502f85e193739c953358c865005855253af4f68a497John McCall // C++ and ARC stuff we don't support yet. 503f85e193739c953358c865005855253af4f68a497John McCall case Expr::ObjCIndirectCopyRestoreExprClass: 5041b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::CXXDependentScopeMemberExprClass: 5051b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::CXXPseudoDestructorExprClass: 5061b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::CXXTryStmtClass: 5071b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::CXXTypeidExprClass: 5089be88403e965cc49af76c9d33d818781d44b333eFrancois Pichet case Stmt::CXXUuidofExprClass: 509c768a0c46e6c064c3281d663777ee95aea8652eeTed Kremenek case Stmt::CXXUnresolvedConstructExprClass: 5101b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::DependentScopeDeclRefExprClass: 5111b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::UnaryTypeTraitExprClass: 5126ad6f2848d7652ab2991286eb48be440d3493b28Francois Pichet case Stmt::BinaryTypeTraitExprClass: 5134ca8ac2e61c37ddadf37024af86f3e1019af8532Douglas Gregor case Stmt::TypeTraitExprClass: 51421ff2e516b0e0bc8c1dbf965cb3d44bac3c64330John Wiegley case Stmt::ArrayTypeTraitExprClass: 515552622067dc45013d240f73952fece703f5e63bdJohn Wiegley case Stmt::ExpressionTraitExprClass: 5161b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::UnresolvedLookupExprClass: 517c768a0c46e6c064c3281d663777ee95aea8652eeTed Kremenek case Stmt::UnresolvedMemberExprClass: 5186b219d082434394c1ac401390ec1d1967727815aSebastian Redl case Stmt::CXXNoexceptExprClass: 519be230c36e32142cbdcdbe9c97511d097beeecbabDouglas Gregor case Stmt::PackExpansionExprClass: 520c7793c73ba8a343de3f2552d984851985a46f159Douglas Gregor case Stmt::SubstNonTypeTemplateParmPackExprClass: 52128bbe4b8acc338476fe0825769b41fb32b423c72John Wiegley case Stmt::SEHTryStmtClass: 52228bbe4b8acc338476fe0825769b41fb32b423c72John Wiegley case Stmt::SEHExceptStmtClass: 52301d08018b7cf5ce1601707cfd7a84d22015fc04eDouglas Gregor case Stmt::LambdaExprClass: 524ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks case Stmt::SEHFinallyStmtClass: { 525337e4dbc6859589b8878146a88bebf754e916702Ted Kremenek const ExplodedNode *node = Bldr.generateNode(S, Pred, Pred->getState(), 526337e4dbc6859589b8878146a88bebf754e916702Ted Kremenek /* sink */ true); 527ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Engine.addAbortedBlock(node, currentBuilderContext->getBlock()); 528c768a0c46e6c064c3281d663777ee95aea8652eeTed Kremenek break; 529c768a0c46e6c064c3281d663777ee95aea8652eeTed Kremenek } 5305fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek 5315fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek // We don't handle default arguments either yet, but we can fake it 5325fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek // for now by just skipping them. 53391a5755ad73c5dc1dfb167e448fdd74e75a6df56John McCall case Stmt::SubstNonTypeTemplateParmExprClass: 534ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks case Stmt::CXXDefaultArgExprClass: 5355fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek break; 5365fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek 537f6a1648197562e0b133440d612d9af297d0a86ccJohn McCall case Stmt::ParenExprClass: 538f6a1648197562e0b133440d612d9af297d0a86ccJohn McCall llvm_unreachable("ParenExprs already handled."); 539f111d935722ed488144600cea5ed03a6b5069e8fPeter Collingbourne case Stmt::GenericSelectionExprClass: 540f111d935722ed488144600cea5ed03a6b5069e8fPeter Collingbourne llvm_unreachable("GenericSelectionExprs already handled."); 5411b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek // Cases that should never be evaluated simply because they shouldn't 5421b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek // appear in the CFG. 5431b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::BreakStmtClass: 5441b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::CaseStmtClass: 5451b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::CompoundStmtClass: 5461b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::ContinueStmtClass: 54746eaf7789a1059a7b42b7dbd183150c72df5738fTed Kremenek case Stmt::CXXForRangeStmtClass: 5481b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::DefaultStmtClass: 5491b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::DoStmtClass: 550d40066b0fb883839a9100e5455e33190b9b8abacTed Kremenek case Stmt::ForStmtClass: 5511b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::GotoStmtClass: 552d40066b0fb883839a9100e5455e33190b9b8abacTed Kremenek case Stmt::IfStmtClass: 5531b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::IndirectGotoStmtClass: 5541b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::LabelStmtClass: 555534986f2b21e6050bf00163cd6423fd92155a6edRichard Smith case Stmt::AttributedStmtClass: 5561b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::NoStmtClass: 5571b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::NullStmtClass: 558d40066b0fb883839a9100e5455e33190b9b8abacTed Kremenek case Stmt::SwitchStmtClass: 559d40066b0fb883839a9100e5455e33190b9b8abacTed Kremenek case Stmt::WhileStmtClass: 560ba0513de93d2fab6db5ab30b6927209fcc883078Douglas Gregor case Expr::MSDependentExistsStmtClass: 5611b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek llvm_unreachable("Stmt should not be in analyzer evaluation loop"); 5621b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek 5638ad9cbc518a603176462f1fa1efe389023590082Ted Kremenek case Stmt::GNUNullExprClass: { 5648f08426e6f54ed20b959018f24dbea106a00b4adJordy Rose // GNU __null is a pointer-width integer, not an actual pointer. 5658bef8238181a30e52dea380789a7e2d760eac532Ted Kremenek ProgramStateRef state = Pred->getState(); 5665eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek state = state->BindExpr(S, Pred->getLocationContext(), 5675eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek svalBuilder.makeIntValWithPtrWidth(0, false)); 568ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.generateNode(S, Pred, state); 5698ad9cbc518a603176462f1fa1efe389023590082Ted Kremenek break; 5708ad9cbc518a603176462f1fa1efe389023590082Ted Kremenek } 5718ad9cbc518a603176462f1fa1efe389023590082Ted Kremenek 5724beaa9f51b2da57c64740cef2bd1c2fdb0c325d5Ted Kremenek case Stmt::ObjCAtSynchronizedStmtClass: 573ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.takeNodes(Pred); 5744beaa9f51b2da57c64740cef2bd1c2fdb0c325d5Ted Kremenek VisitObjCAtSynchronizedStmt(cast<ObjCAtSynchronizedStmt>(S), Pred, Dst); 575ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.addNodes(Dst); 5764beaa9f51b2da57c64740cef2bd1c2fdb0c325d5Ted Kremenek break; 5774beaa9f51b2da57c64740cef2bd1c2fdb0c325d5Ted Kremenek 5781a45a5ff5d495cb6cd9a3d4d06317af79c0f634dTed Kremenek // FIXME. 5791a45a5ff5d495cb6cd9a3d4d06317af79c0f634dTed Kremenek case Stmt::ObjCSubscriptRefExprClass: 5801a45a5ff5d495cb6cd9a3d4d06317af79c0f634dTed Kremenek break; 5811a45a5ff5d495cb6cd9a3d4d06317af79c0f634dTed Kremenek 58214429b918bd2f4cb52abc75546a7fe37142054caArgyrios Kyrtzidis case Stmt::ObjCPropertyRefExprClass: 583f8b5aae41e46f94fe90ed5f1ee98f36f0aa59dc9Ted Kremenek // Implicitly handled by Environment::getSVal(). 58414429b918bd2f4cb52abc75546a7fe37142054caArgyrios Kyrtzidis break; 58514429b918bd2f4cb52abc75546a7fe37142054caArgyrios Kyrtzidis 586ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks case Stmt::ExprWithCleanupsClass: 587e711d7e7875920fee4180a26bfc67d67f0f71a2cErik Verbruggen // Handled due to fully linearised CFG. 588f85e193739c953358c865005855253af4f68a497John McCall break; 589f85e193739c953358c865005855253af4f68a497John McCall 5901b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek // Cases not handled yet; but will handle some day. 5911b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::DesignatedInitExprClass: 5921b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::ExtVectorElementExprClass: 5931b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::ImaginaryLiteralClass: 5941b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::ObjCAtCatchStmtClass: 5951b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::ObjCAtFinallyStmtClass: 5961b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::ObjCAtTryStmtClass: 597f85e193739c953358c865005855253af4f68a497John McCall case Stmt::ObjCAutoreleasePoolStmtClass: 5981b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::ObjCEncodeExprClass: 5991b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::ObjCIsaExprClass: 6001b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::ObjCProtocolExprClass: 6011b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::ObjCSelectorExprClass: 6021b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::ParenListExprClass: 6031b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::PredefinedExprClass: 6041b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::ShuffleVectorExprClass: 6051b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::VAArgExprClass: 606e08ce650a2b02410eddd1f60a4aa6b3d4be71e73Peter Collingbourne case Stmt::CUDAKernelCallExprClass: 60756ca35d396d8692c384c785f9aeebcf22563fe1eJohn McCall case Stmt::OpaqueValueExprClass: 60861eee0ca33b29e102f11bab77c8b74cc00e2392bTanya Lattner case Stmt::AsTypeExprClass: 609276b061970939293f1abaf694bd3ef05b2cbda79Eli Friedman case Stmt::AtomicExprClass: 610337e4dbc6859589b8878146a88bebf754e916702Ted Kremenek // Fall through. 6111b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek 612337e4dbc6859589b8878146a88bebf754e916702Ted Kremenek // Currently all handling of 'throw' just falls to the CFG. We 613337e4dbc6859589b8878146a88bebf754e916702Ted Kremenek // can consider doing more if necessary. 614337e4dbc6859589b8878146a88bebf754e916702Ted Kremenek case Stmt::CXXThrowExprClass: 615337e4dbc6859589b8878146a88bebf754e916702Ted Kremenek // Fall through. 616337e4dbc6859589b8878146a88bebf754e916702Ted Kremenek 6171b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek // Cases we intentionally don't evaluate, since they don't need 6181b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek // to be explicitly evaluated. 619bc9ad74a13e83303a3a5251f8bacbbca17341c17Zhongxing Xu case Stmt::AddrLabelExprClass: 620bc9ad74a13e83303a3a5251f8bacbbca17341c17Zhongxing Xu case Stmt::IntegerLiteralClass: 621bc9ad74a13e83303a3a5251f8bacbbca17341c17Zhongxing Xu case Stmt::CharacterLiteralClass: 622c319c585c0d5899cba0dca2272e6e4909c8b9f16Ted Kremenek case Stmt::ImplicitValueInitExprClass: 623c319c585c0d5899cba0dca2272e6e4909c8b9f16Ted Kremenek case Stmt::CXXScalarValueInitExprClass: 624477323d58a0de352c6a61e08b5a83127c4adc904Zhongxing Xu case Stmt::CXXBoolLiteralExprClass: 6251a45a5ff5d495cb6cd9a3d4d06317af79c0f634dTed Kremenek case Stmt::ObjCBoolLiteralExprClass: 626bc9ad74a13e83303a3a5251f8bacbbca17341c17Zhongxing Xu case Stmt::FloatingLiteralClass: 627f901a7de97f46ba2b1ff153f9fb83d00dc37cfcfDouglas Gregor case Stmt::SizeOfPackExprClass: 628e739a29c62c67eaec0af5c4d5c75f9e8f11228bdTed Kremenek case Stmt::StringLiteralClass: 629e739a29c62c67eaec0af5c4d5c75f9e8f11228bdTed Kremenek case Stmt::ObjCStringLiteralClass: 630cc2c4b293d8590346f26b7ecc16d299226b8794fTed Kremenek case Stmt::CXXBindTemporaryExprClass: 631bdd4c848349d4091d66b052efa453e6d69a77e36Ted Kremenek case Stmt::CXXNullPtrLiteralExprClass: { 632bdd4c848349d4091d66b052efa453e6d69a77e36Ted Kremenek Bldr.takeNodes(Pred); 633bdd4c848349d4091d66b052efa453e6d69a77e36Ted Kremenek ExplodedNodeSet preVisit; 634bdd4c848349d4091d66b052efa453e6d69a77e36Ted Kremenek getCheckerManager().runCheckersForPreStmt(preVisit, Pred, S, *this); 635bdd4c848349d4091d66b052efa453e6d69a77e36Ted Kremenek getCheckerManager().runCheckersForPostStmt(Dst, preVisit, S, *this); 636bdd4c848349d4091d66b052efa453e6d69a77e36Ted Kremenek Bldr.addNodes(Dst); 637e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek break; 638bdd4c848349d4091d66b052efa453e6d69a77e36Ted Kremenek } 6391eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 6401a45a5ff5d495cb6cd9a3d4d06317af79c0f634dTed Kremenek case Expr::ObjCArrayLiteralClass: 64170fdbc366da85880aae5baebd3351e993ca05603Jordy Rose case Expr::ObjCDictionaryLiteralClass: 64270fdbc366da85880aae5baebd3351e993ca05603Jordy Rose // FIXME: explicitly model with a region and the actual contents 64370fdbc366da85880aae5baebd3351e993ca05603Jordy Rose // of the container. For now, conjure a symbol. 64470fdbc366da85880aae5baebd3351e993ca05603Jordy Rose case Expr::ObjCBoxedExprClass: { 6451a45a5ff5d495cb6cd9a3d4d06317af79c0f634dTed Kremenek Bldr.takeNodes(Pred); 6461a45a5ff5d495cb6cd9a3d4d06317af79c0f634dTed Kremenek 6471a45a5ff5d495cb6cd9a3d4d06317af79c0f634dTed Kremenek ExplodedNodeSet preVisit; 6481a45a5ff5d495cb6cd9a3d4d06317af79c0f634dTed Kremenek getCheckerManager().runCheckersForPreStmt(preVisit, Pred, S, *this); 6491a45a5ff5d495cb6cd9a3d4d06317af79c0f634dTed Kremenek 6501a45a5ff5d495cb6cd9a3d4d06317af79c0f634dTed Kremenek ExplodedNodeSet Tmp; 6511a45a5ff5d495cb6cd9a3d4d06317af79c0f634dTed Kremenek StmtNodeBuilder Bldr2(preVisit, Tmp, *currentBuilderContext); 6521a45a5ff5d495cb6cd9a3d4d06317af79c0f634dTed Kremenek 65370fdbc366da85880aae5baebd3351e993ca05603Jordy Rose const Expr *Ex = cast<Expr>(S); 65470fdbc366da85880aae5baebd3351e993ca05603Jordy Rose QualType resultType = Ex->getType(); 65570fdbc366da85880aae5baebd3351e993ca05603Jordy Rose 6561a45a5ff5d495cb6cd9a3d4d06317af79c0f634dTed Kremenek for (ExplodedNodeSet::iterator it = preVisit.begin(), et = preVisit.end(); 6571a45a5ff5d495cb6cd9a3d4d06317af79c0f634dTed Kremenek it != et; ++it) { 6581a45a5ff5d495cb6cd9a3d4d06317af79c0f634dTed Kremenek ExplodedNode *N = *it; 6591a45a5ff5d495cb6cd9a3d4d06317af79c0f634dTed Kremenek const LocationContext *LCtx = N->getLocationContext(); 6601a45a5ff5d495cb6cd9a3d4d06317af79c0f634dTed Kremenek SVal result = 6611a45a5ff5d495cb6cd9a3d4d06317af79c0f634dTed Kremenek svalBuilder.getConjuredSymbolVal(0, Ex, LCtx, resultType, 6621a45a5ff5d495cb6cd9a3d4d06317af79c0f634dTed Kremenek currentBuilderContext->getCurrentBlockCount()); 6631a45a5ff5d495cb6cd9a3d4d06317af79c0f634dTed Kremenek ProgramStateRef state = N->getState()->BindExpr(Ex, LCtx, result); 6641a45a5ff5d495cb6cd9a3d4d06317af79c0f634dTed Kremenek Bldr2.generateNode(S, N, state); 6651a45a5ff5d495cb6cd9a3d4d06317af79c0f634dTed Kremenek } 6661a45a5ff5d495cb6cd9a3d4d06317af79c0f634dTed Kremenek 6671a45a5ff5d495cb6cd9a3d4d06317af79c0f634dTed Kremenek getCheckerManager().runCheckersForPostStmt(Dst, Tmp, S, *this); 6681a45a5ff5d495cb6cd9a3d4d06317af79c0f634dTed Kremenek Bldr.addNodes(Dst); 6691a45a5ff5d495cb6cd9a3d4d06317af79c0f634dTed Kremenek break; 6701a45a5ff5d495cb6cd9a3d4d06317af79c0f634dTed Kremenek } 6711a45a5ff5d495cb6cd9a3d4d06317af79c0f634dTed Kremenek 672540cbe2b60294fe7b926c26b4f1840f544fe3011Ted Kremenek case Stmt::ArraySubscriptExprClass: 673ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.takeNodes(Pred); 674892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek VisitLvalArraySubscriptExpr(cast<ArraySubscriptExpr>(S), Pred, Dst); 675ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.addNodes(Dst); 676540cbe2b60294fe7b926c26b4f1840f544fe3011Ted Kremenek break; 6771eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 678e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek case Stmt::AsmStmtClass: 679ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.takeNodes(Pred); 680e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek VisitAsmStmt(cast<AsmStmt>(S), Pred, Dst); 681ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.addNodes(Dst); 682e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek break; 683b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 6848cd64b4c5553fa6284d248336cb7c82dc960a394Chad Rosier case Stmt::MSAsmStmtClass: 6858cd64b4c5553fa6284d248336cb7c82dc960a394Chad Rosier Bldr.takeNodes(Pred); 6868cd64b4c5553fa6284d248336cb7c82dc960a394Chad Rosier VisitMSAsmStmt(cast<MSAsmStmt>(S), Pred, Dst); 6878cd64b4c5553fa6284d248336cb7c82dc960a394Chad Rosier Bldr.addNodes(Dst); 6888cd64b4c5553fa6284d248336cb7c82dc960a394Chad Rosier break; 6898cd64b4c5553fa6284d248336cb7c82dc960a394Chad Rosier 690c95ad9ff6e574aecdd759542d5578bc65d586d93Ted Kremenek case Stmt::BlockExprClass: 691ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.takeNodes(Pred); 692c95ad9ff6e574aecdd759542d5578bc65d586d93Ted Kremenek VisitBlockExpr(cast<BlockExpr>(S), Pred, Dst); 693ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.addNodes(Dst); 694c95ad9ff6e574aecdd759542d5578bc65d586d93Ted Kremenek break; 695c95ad9ff6e574aecdd759542d5578bc65d586d93Ted Kremenek 696e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek case Stmt::BinaryOperatorClass: { 69703509aea098772644bf4662dc1c88634818ceeccZhongxing Xu const BinaryOperator* B = cast<BinaryOperator>(S); 698e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek if (B->isLogicalOp()) { 699ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.takeNodes(Pred); 700e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek VisitLogicalExpr(B, Pred, Dst); 701ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.addNodes(Dst); 702e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek break; 703e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek } 7042de56d1d0c3a504ad1529de2677628bdfbb95cd4John McCall else if (B->getOpcode() == BO_Comma) { 7058bef8238181a30e52dea380789a7e2d760eac532Ted Kremenek ProgramStateRef state = Pred->getState(); 706ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.generateNode(B, Pred, 7075eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek state->BindExpr(B, Pred->getLocationContext(), 7085eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek state->getSVal(B->getRHS(), 7095eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek Pred->getLocationContext()))); 710e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek break; 711e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek } 71206fb99fb403bff1651429923f666a2ebe2b1522fTed Kremenek 713ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.takeNodes(Pred); 714ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks 715b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek if (AMgr.shouldEagerlyAssume() && 716bb141217871e93767aa3f2de1b9946fa6d37066aZhongxing Xu (B->isRelationalOp() || B->isEqualityOp())) { 717031ccc0555a82afc2e8afe29e19dd57ff204e2deZhongxing Xu ExplodedNodeSet Tmp; 718892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek VisitBinaryOperator(cast<BinaryOperator>(S), Pred, Tmp); 7199c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek evalEagerlyAssume(Dst, Tmp, cast<Expr>(S)); 72048af2a9c1ed3259512f2d1431720add1fbe8fb5fTed Kremenek } 72148af2a9c1ed3259512f2d1431720add1fbe8fb5fTed Kremenek else 722892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek VisitBinaryOperator(cast<BinaryOperator>(S), Pred, Dst); 72348af2a9c1ed3259512f2d1431720add1fbe8fb5fTed Kremenek 724ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.addNodes(Dst); 725e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek break; 726e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek } 72706fb99fb403bff1651429923f666a2ebe2b1522fTed Kremenek 728b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek case Stmt::CallExprClass: 729b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek case Stmt::CXXOperatorCallExprClass: 7309fcce65e7e1307b5b8da9be13e4092d6bb94dc1dRichard Smith case Stmt::CXXMemberCallExprClass: 7319fcce65e7e1307b5b8da9be13e4092d6bb94dc1dRichard Smith case Stmt::UserDefinedLiteralClass: { 732ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.takeNodes(Pred); 733b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek VisitCallExpr(cast<CallExpr>(S), Pred, Dst); 734ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.addNodes(Dst); 73506fb99fb403bff1651429923f666a2ebe2b1522fTed Kremenek break; 736e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek } 737337e4dbc6859589b8878146a88bebf754e916702Ted Kremenek 738337e4dbc6859589b8878146a88bebf754e916702Ted Kremenek case Stmt::CXXCatchStmtClass: { 739337e4dbc6859589b8878146a88bebf754e916702Ted Kremenek Bldr.takeNodes(Pred); 740337e4dbc6859589b8878146a88bebf754e916702Ted Kremenek VisitCXXCatchStmt(cast<CXXCatchStmt>(S), Pred, Dst); 741337e4dbc6859589b8878146a88bebf754e916702Ted Kremenek Bldr.addNodes(Dst); 742337e4dbc6859589b8878146a88bebf754e916702Ted Kremenek break; 743337e4dbc6859589b8878146a88bebf754e916702Ted Kremenek } 74406fb99fb403bff1651429923f666a2ebe2b1522fTed Kremenek 745744f1cd66bb6747ea71fbf1172698e7bf35ec88dTed Kremenek case Stmt::CXXTemporaryObjectExprClass: 7467ce351db56fbce162a3b650518ce05b5c61ebf36Zhongxing Xu case Stmt::CXXConstructExprClass: { 7477ce351db56fbce162a3b650518ce05b5c61ebf36Zhongxing Xu const CXXConstructExpr *C = cast<CXXConstructExpr>(S); 74848b6247804eacc262cc5508e0fbb74ed819fbb6eJordan Rose const MemRegion *Target = 0; 74948b6247804eacc262cc5508e0fbb74ed819fbb6eJordan Rose 75048b6247804eacc262cc5508e0fbb74ed819fbb6eJordan Rose const LocationContext *LCtx = Pred->getLocationContext(); 75148b6247804eacc262cc5508e0fbb74ed819fbb6eJordan Rose const ParentMap &PM = LCtx->getParentMap(); 75248b6247804eacc262cc5508e0fbb74ed819fbb6eJordan Rose if (const DeclStmt *DS = dyn_cast_or_null<DeclStmt>(PM.getParent(C))) 75348b6247804eacc262cc5508e0fbb74ed819fbb6eJordan Rose if (const VarDecl *Var = findDirectConstruction(DS, C)) 75448b6247804eacc262cc5508e0fbb74ed819fbb6eJordan Rose Target = Pred->getState()->getLValue(Var, LCtx).getAsRegion(); 75548b6247804eacc262cc5508e0fbb74ed819fbb6eJordan Rose // If we don't have a destination region, VisitCXXConstructExpr() will 75648b6247804eacc262cc5508e0fbb74ed819fbb6eJordan Rose // create one. 75748b6247804eacc262cc5508e0fbb74ed819fbb6eJordan Rose 758ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.takeNodes(Pred); 75948b6247804eacc262cc5508e0fbb74ed819fbb6eJordan Rose VisitCXXConstructExpr(C, Target, Pred, Dst); 760ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.addNodes(Dst); 7617ce351db56fbce162a3b650518ce05b5c61ebf36Zhongxing Xu break; 7627ce351db56fbce162a3b650518ce05b5c61ebf36Zhongxing Xu } 7637ce351db56fbce162a3b650518ce05b5c61ebf36Zhongxing Xu 764856c6bcaea56e05255e9f3997ddd56b5c18a14f0Zhongxing Xu case Stmt::CXXNewExprClass: { 765ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.takeNodes(Pred); 76603509aea098772644bf4662dc1c88634818ceeccZhongxing Xu const CXXNewExpr *NE = cast<CXXNewExpr>(S); 767856c6bcaea56e05255e9f3997ddd56b5c18a14f0Zhongxing Xu VisitCXXNewExpr(NE, Pred, Dst); 768ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.addNodes(Dst); 769856c6bcaea56e05255e9f3997ddd56b5c18a14f0Zhongxing Xu break; 770856c6bcaea56e05255e9f3997ddd56b5c18a14f0Zhongxing Xu } 771856c6bcaea56e05255e9f3997ddd56b5c18a14f0Zhongxing Xu 7726b8513829895e56a7b97e787ea74520bc626512eZhongxing Xu case Stmt::CXXDeleteExprClass: { 773ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.takeNodes(Pred); 77403509aea098772644bf4662dc1c88634818ceeccZhongxing Xu const CXXDeleteExpr *CDE = cast<CXXDeleteExpr>(S); 7756b8513829895e56a7b97e787ea74520bc626512eZhongxing Xu VisitCXXDeleteExpr(CDE, Pred, Dst); 776ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.addNodes(Dst); 7776b8513829895e56a7b97e787ea74520bc626512eZhongxing Xu break; 7786b8513829895e56a7b97e787ea74520bc626512eZhongxing Xu } 779e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek // FIXME: ChooseExpr is really a constant. We need to fix 780e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek // the CFG do not model them as explicit control-flow. 7811eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 782e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek case Stmt::ChooseExprClass: { // __builtin_choose_expr 783ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.takeNodes(Pred); 7849c378f705405d37f49795d5e915989de774fe11fTed Kremenek const ChooseExpr *C = cast<ChooseExpr>(S); 785e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek VisitGuardedExpr(C, C->getLHS(), C->getRHS(), Pred, Dst); 786ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.addNodes(Dst); 787e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek break; 788e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek } 7891eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 790e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek case Stmt::CompoundAssignOperatorClass: 791ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.takeNodes(Pred); 792892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek VisitBinaryOperator(cast<BinaryOperator>(S), Pred, Dst); 793ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.addNodes(Dst); 794e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek break; 795f22679e3e5d5f5754931952e58112b4c863a4137Zhongxing Xu 796f22679e3e5d5f5754931952e58112b4c863a4137Zhongxing Xu case Stmt::CompoundLiteralExprClass: 797ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.takeNodes(Pred); 798892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek VisitCompoundLiteralExpr(cast<CompoundLiteralExpr>(S), Pred, Dst); 799ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.addNodes(Dst); 800f22679e3e5d5f5754931952e58112b4c863a4137Zhongxing Xu break; 8011eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 80256ca35d396d8692c384c785f9aeebcf22563fe1eJohn McCall case Stmt::BinaryConditionalOperatorClass: 803e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek case Stmt::ConditionalOperatorClass: { // '?' operator 804ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.takeNodes(Pred); 80556ca35d396d8692c384c785f9aeebcf22563fe1eJohn McCall const AbstractConditionalOperator *C 80656ca35d396d8692c384c785f9aeebcf22563fe1eJohn McCall = cast<AbstractConditionalOperator>(S); 80756ca35d396d8692c384c785f9aeebcf22563fe1eJohn McCall VisitGuardedExpr(C, C->getTrueExpr(), C->getFalseExpr(), Pred, Dst); 808ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.addNodes(Dst); 809e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek break; 810e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek } 8111eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 812bb141217871e93767aa3f2de1b9946fa6d37066aZhongxing Xu case Stmt::CXXThisExprClass: 813ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.takeNodes(Pred); 814bb141217871e93767aa3f2de1b9946fa6d37066aZhongxing Xu VisitCXXThisExpr(cast<CXXThisExpr>(S), Pred, Dst); 815ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.addNodes(Dst); 816bb141217871e93767aa3f2de1b9946fa6d37066aZhongxing Xu break; 817bb141217871e93767aa3f2de1b9946fa6d37066aZhongxing Xu 818892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek case Stmt::DeclRefExprClass: { 819ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.takeNodes(Pred); 820892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek const DeclRefExpr *DE = cast<DeclRefExpr>(S); 821892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek VisitCommonDeclRefExpr(DE, DE->getDecl(), Pred, Dst); 822ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.addNodes(Dst); 823e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek break; 824892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek } 8251eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 826e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek case Stmt::DeclStmtClass: 827ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.takeNodes(Pred); 828e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek VisitDeclStmt(cast<DeclStmt>(S), Pred, Dst); 829ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.addNodes(Dst); 830e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek break; 8311eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 8320835a3cdeefe714b4959d31127ea155e56393125Argyrios Kyrtzidis case Stmt::ImplicitCastExprClass: 8330d9d736c49b51691ced96759ec99399824e2a602Zhongxing Xu case Stmt::CStyleCastExprClass: 8340d9d736c49b51691ced96759ec99399824e2a602Zhongxing Xu case Stmt::CXXStaticCastExprClass: 8350d9d736c49b51691ced96759ec99399824e2a602Zhongxing Xu case Stmt::CXXDynamicCastExprClass: 8360d9d736c49b51691ced96759ec99399824e2a602Zhongxing Xu case Stmt::CXXReinterpretCastExprClass: 8370d9d736c49b51691ced96759ec99399824e2a602Zhongxing Xu case Stmt::CXXConstCastExprClass: 838f85e193739c953358c865005855253af4f68a497John McCall case Stmt::CXXFunctionalCastExprClass: 839f85e193739c953358c865005855253af4f68a497John McCall case Stmt::ObjCBridgedCastExprClass: { 840ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.takeNodes(Pred); 8419c378f705405d37f49795d5e915989de774fe11fTed Kremenek const CastExpr *C = cast<CastExpr>(S); 842f85e193739c953358c865005855253af4f68a497John McCall // Handle the previsit checks. 843f85e193739c953358c865005855253af4f68a497John McCall ExplodedNodeSet dstPrevisit; 844f85e193739c953358c865005855253af4f68a497John McCall getCheckerManager().runCheckersForPreStmt(dstPrevisit, Pred, C, *this); 845f85e193739c953358c865005855253af4f68a497John McCall 846f85e193739c953358c865005855253af4f68a497John McCall // Handle the expression itself. 847f85e193739c953358c865005855253af4f68a497John McCall ExplodedNodeSet dstExpr; 848f85e193739c953358c865005855253af4f68a497John McCall for (ExplodedNodeSet::iterator i = dstPrevisit.begin(), 849f85e193739c953358c865005855253af4f68a497John McCall e = dstPrevisit.end(); i != e ; ++i) { 850f85e193739c953358c865005855253af4f68a497John McCall VisitCast(C, C->getSubExpr(), *i, dstExpr); 851f85e193739c953358c865005855253af4f68a497John McCall } 852f85e193739c953358c865005855253af4f68a497John McCall 853f85e193739c953358c865005855253af4f68a497John McCall // Handle the postvisit checks. 854f85e193739c953358c865005855253af4f68a497John McCall getCheckerManager().runCheckersForPostStmt(Dst, dstExpr, C, *this); 855ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.addNodes(Dst); 856e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek break; 857e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek } 858b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 85903e80030515c800d1ab44125b9052dfffd1bd04cDouglas Gregor case Expr::MaterializeTemporaryExprClass: { 860ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.takeNodes(Pred); 86103e80030515c800d1ab44125b9052dfffd1bd04cDouglas Gregor const MaterializeTemporaryExpr *Materialize 86203e80030515c800d1ab44125b9052dfffd1bd04cDouglas Gregor = cast<MaterializeTemporaryExpr>(S); 863e711d7e7875920fee4180a26bfc67d67f0f71a2cErik Verbruggen if (Materialize->getType()->isRecordType()) 864e711d7e7875920fee4180a26bfc67d67f0f71a2cErik Verbruggen Dst.Add(Pred); 86503e80030515c800d1ab44125b9052dfffd1bd04cDouglas Gregor else 866e711d7e7875920fee4180a26bfc67d67f0f71a2cErik Verbruggen CreateCXXTemporaryObject(Materialize, Pred, Dst); 867ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.addNodes(Dst); 86803e80030515c800d1ab44125b9052dfffd1bd04cDouglas Gregor break; 86903e80030515c800d1ab44125b9052dfffd1bd04cDouglas Gregor } 87003e80030515c800d1ab44125b9052dfffd1bd04cDouglas Gregor 871c4f8706b6539e06a5de153bd72850bb2e0a71456Zhongxing Xu case Stmt::InitListExprClass: 872ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.takeNodes(Pred); 873c4f8706b6539e06a5de153bd72850bb2e0a71456Zhongxing Xu VisitInitListExpr(cast<InitListExpr>(S), Pred, Dst); 874ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.addNodes(Dst); 875c4f8706b6539e06a5de153bd72850bb2e0a71456Zhongxing Xu break; 8761eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 87797ed4f68f5dba3e21e7a490ef0f9ffd3bfead7f8Ted Kremenek case Stmt::MemberExprClass: 878ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.takeNodes(Pred); 879892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek VisitMemberExpr(cast<MemberExpr>(S), Pred, Dst); 880ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.addNodes(Dst); 881469ecbded3616416ef938ed94a67f86149faf226Ted Kremenek break; 882ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks 88397ed4f68f5dba3e21e7a490ef0f9ffd3bfead7f8Ted Kremenek case Stmt::ObjCIvarRefExprClass: 884ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.takeNodes(Pred); 885892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek VisitLvalObjCIvarRefExpr(cast<ObjCIvarRefExpr>(S), Pred, Dst); 886ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.addNodes(Dst); 88797ed4f68f5dba3e21e7a490ef0f9ffd3bfead7f8Ted Kremenek break; 888af3374187c47acea45706eab6744be6b1c66a856Ted Kremenek 889af3374187c47acea45706eab6744be6b1c66a856Ted Kremenek case Stmt::ObjCForCollectionStmtClass: 890ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.takeNodes(Pred); 891af3374187c47acea45706eab6744be6b1c66a856Ted Kremenek VisitObjCForCollectionStmt(cast<ObjCForCollectionStmt>(S), Pred, Dst); 892ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.addNodes(Dst); 893af3374187c47acea45706eab6744be6b1c66a856Ted Kremenek break; 8941eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 895b673a41c92aa276f2e37164d0747be1cfb0c402bTed Kremenek case Stmt::ObjCMessageExprClass: { 896ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.takeNodes(Pred); 897b673a41c92aa276f2e37164d0747be1cfb0c402bTed Kremenek // Is this a property access? 898cde8cdbd6a662c636164465ad309b5f17ff01064Jordan Rose 899cde8cdbd6a662c636164465ad309b5f17ff01064Jordan Rose const LocationContext *LCtx = Pred->getLocationContext(); 900cde8cdbd6a662c636164465ad309b5f17ff01064Jordan Rose const ParentMap &PM = LCtx->getParentMap(); 901b673a41c92aa276f2e37164d0747be1cfb0c402bTed Kremenek const ObjCMessageExpr *ME = cast<ObjCMessageExpr>(S); 902b673a41c92aa276f2e37164d0747be1cfb0c402bTed Kremenek bool evaluated = false; 903b673a41c92aa276f2e37164d0747be1cfb0c402bTed Kremenek 904b673a41c92aa276f2e37164d0747be1cfb0c402bTed Kremenek if (const PseudoObjectExpr *PO = 905cde8cdbd6a662c636164465ad309b5f17ff01064Jordan Rose dyn_cast_or_null<PseudoObjectExpr>(PM.getParent(S))) { 906b673a41c92aa276f2e37164d0747be1cfb0c402bTed Kremenek const Expr *syntactic = PO->getSyntacticForm(); 907cde8cdbd6a662c636164465ad309b5f17ff01064Jordan Rose 908cde8cdbd6a662c636164465ad309b5f17ff01064Jordan Rose // This handles the funny case of assigning to the result of a getter. 909cde8cdbd6a662c636164465ad309b5f17ff01064Jordan Rose // This can happen if the getter returns a non-const reference. 910cde8cdbd6a662c636164465ad309b5f17ff01064Jordan Rose if (const BinaryOperator *BO = dyn_cast<BinaryOperator>(syntactic)) 911cde8cdbd6a662c636164465ad309b5f17ff01064Jordan Rose syntactic = BO->getLHS(); 912cde8cdbd6a662c636164465ad309b5f17ff01064Jordan Rose 913840c9842ed8b3a2b1276519a80f89e7d409fc148Jordan Rose if (const ObjCPropertyRefExpr *PR = 914840c9842ed8b3a2b1276519a80f89e7d409fc148Jordan Rose dyn_cast<ObjCPropertyRefExpr>(syntactic)) { 915840c9842ed8b3a2b1276519a80f89e7d409fc148Jordan Rose VisitObjCMessage(ObjCPropertyAccess(PR, PO->getSourceRange(), ME, 916de507eaf3cb54d3cb234dc14499c10ab3373d15fJordan Rose Pred->getState(), LCtx), 917cde8cdbd6a662c636164465ad309b5f17ff01064Jordan Rose Pred, Dst); 918b673a41c92aa276f2e37164d0747be1cfb0c402bTed Kremenek evaluated = true; 919b673a41c92aa276f2e37164d0747be1cfb0c402bTed Kremenek } 920b673a41c92aa276f2e37164d0747be1cfb0c402bTed Kremenek } 921b673a41c92aa276f2e37164d0747be1cfb0c402bTed Kremenek 922b673a41c92aa276f2e37164d0747be1cfb0c402bTed Kremenek if (!evaluated) 923cde8cdbd6a662c636164465ad309b5f17ff01064Jordan Rose VisitObjCMessage(ObjCMessageSend(ME, Pred->getState(), LCtx), 924cde8cdbd6a662c636164465ad309b5f17ff01064Jordan Rose Pred, Dst); 925b673a41c92aa276f2e37164d0747be1cfb0c402bTed Kremenek 926ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.addNodes(Dst); 927e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek break; 928b673a41c92aa276f2e37164d0747be1cfb0c402bTed Kremenek } 9291eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 930bbfd07a0c94f659beaf74316029ef73769cefb81Ted Kremenek case Stmt::ObjCAtThrowStmtClass: { 931bbfd07a0c94f659beaf74316029ef73769cefb81Ted Kremenek // FIXME: This is not complete. We basically treat @throw as 932bbfd07a0c94f659beaf74316029ef73769cefb81Ted Kremenek // an abort. 933ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.generateNode(S, Pred, Pred->getState()); 934bbfd07a0c94f659beaf74316029ef73769cefb81Ted Kremenek break; 935bbfd07a0c94f659beaf74316029ef73769cefb81Ted Kremenek } 9361eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 9371b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek case Stmt::ReturnStmtClass: 938ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.takeNodes(Pred); 9391b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek VisitReturnStmt(cast<ReturnStmt>(S), Pred, Dst); 940ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.addNodes(Dst); 9411b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek break; 9421eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 9438ecdb65716cd7914ffb2eeee993fa9039fcd31e8Douglas Gregor case Stmt::OffsetOfExprClass: 944ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.takeNodes(Pred); 9458ecdb65716cd7914ffb2eeee993fa9039fcd31e8Douglas Gregor VisitOffsetOfExpr(cast<OffsetOfExpr>(S), Pred, Dst); 946ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.addNodes(Dst); 9478ecdb65716cd7914ffb2eeee993fa9039fcd31e8Douglas Gregor break; 9488ecdb65716cd7914ffb2eeee993fa9039fcd31e8Douglas Gregor 949f4e3cfbe8abd124be6341ef5d714819b4fbd9082Peter Collingbourne case Stmt::UnaryExprOrTypeTraitExprClass: 950ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.takeNodes(Pred); 951f4e3cfbe8abd124be6341ef5d714819b4fbd9082Peter Collingbourne VisitUnaryExprOrTypeTraitExpr(cast<UnaryExprOrTypeTraitExpr>(S), 952f4e3cfbe8abd124be6341ef5d714819b4fbd9082Peter Collingbourne Pred, Dst); 953ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.addNodes(Dst); 954e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek break; 9551eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 956e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek case Stmt::StmtExprClass: { 9579c378f705405d37f49795d5e915989de774fe11fTed Kremenek const StmtExpr *SE = cast<StmtExpr>(S); 958a3d1eb85853eae7b719f679b40923826b5e4b7dfTed Kremenek 959a3d1eb85853eae7b719f679b40923826b5e4b7dfTed Kremenek if (SE->getSubStmt()->body_empty()) { 960a3d1eb85853eae7b719f679b40923826b5e4b7dfTed Kremenek // Empty statement expression. 961a3d1eb85853eae7b719f679b40923826b5e4b7dfTed Kremenek assert(SE->getType() == getContext().VoidTy 962a3d1eb85853eae7b719f679b40923826b5e4b7dfTed Kremenek && "Empty statement expression must have void type."); 963a3d1eb85853eae7b719f679b40923826b5e4b7dfTed Kremenek break; 964a3d1eb85853eae7b719f679b40923826b5e4b7dfTed Kremenek } 9651eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 9669c378f705405d37f49795d5e915989de774fe11fTed Kremenek if (Expr *LastExpr = dyn_cast<Expr>(*SE->getSubStmt()->body_rbegin())) { 9678bef8238181a30e52dea380789a7e2d760eac532Ted Kremenek ProgramStateRef state = Pred->getState(); 968ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.generateNode(SE, Pred, 9695eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek state->BindExpr(SE, Pred->getLocationContext(), 9705eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek state->getSVal(LastExpr, 9715eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek Pred->getLocationContext()))); 972a3d1eb85853eae7b719f679b40923826b5e4b7dfTed Kremenek } 973e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek break; 974e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek } 9756987c7b74146b9658b1925c5981f8b0cd0672b55Zhongxing Xu 97672374594c5d9ade02451bc85cf9dfa5b0ea106e7Ted Kremenek case Stmt::UnaryOperatorClass: { 977ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.takeNodes(Pred); 97803509aea098772644bf4662dc1c88634818ceeccZhongxing Xu const UnaryOperator *U = cast<UnaryOperator>(S); 979ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks if (AMgr.shouldEagerlyAssume() && (U->getOpcode() == UO_LNot)) { 980031ccc0555a82afc2e8afe29e19dd57ff204e2deZhongxing Xu ExplodedNodeSet Tmp; 981892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek VisitUnaryOperator(U, Pred, Tmp); 9829c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek evalEagerlyAssume(Dst, Tmp, U); 98372374594c5d9ade02451bc85cf9dfa5b0ea106e7Ted Kremenek } 98472374594c5d9ade02451bc85cf9dfa5b0ea106e7Ted Kremenek else 985892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek VisitUnaryOperator(U, Pred, Dst); 986ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.addNodes(Dst); 9871b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek break; 98872374594c5d9ade02451bc85cf9dfa5b0ea106e7Ted Kremenek } 9894b9c2d235fb9449e249d74f48ecfec601650de93John McCall 9904b9c2d235fb9449e249d74f48ecfec601650de93John McCall case Stmt::PseudoObjectExprClass: { 9914b9c2d235fb9449e249d74f48ecfec601650de93John McCall Bldr.takeNodes(Pred); 9928bef8238181a30e52dea380789a7e2d760eac532Ted Kremenek ProgramStateRef state = Pred->getState(); 9934b9c2d235fb9449e249d74f48ecfec601650de93John McCall const PseudoObjectExpr *PE = cast<PseudoObjectExpr>(S); 9944b9c2d235fb9449e249d74f48ecfec601650de93John McCall if (const Expr *Result = PE->getResultExpr()) { 9955eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek SVal V = state->getSVal(Result, Pred->getLocationContext()); 9965eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek Bldr.generateNode(S, Pred, 9975eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek state->BindExpr(S, Pred->getLocationContext(), V)); 9984b9c2d235fb9449e249d74f48ecfec601650de93John McCall } 9994b9c2d235fb9449e249d74f48ecfec601650de93John McCall else 10005eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek Bldr.generateNode(S, Pred, 10015eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek state->BindExpr(S, Pred->getLocationContext(), 10025eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek UnknownVal())); 10034b9c2d235fb9449e249d74f48ecfec601650de93John McCall 10044b9c2d235fb9449e249d74f48ecfec601650de93John McCall Bldr.addNodes(Dst); 10054b9c2d235fb9449e249d74f48ecfec601650de93John McCall break; 10064b9c2d235fb9449e249d74f48ecfec601650de93John McCall } 10071b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek } 10081b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek} 10091b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek 10105903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaksbool ExprEngine::replayWithoutInlining(ExplodedNode *N, 10115903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks const LocationContext *CalleeLC) { 10125903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks const StackFrameContext *CalleeSF = CalleeLC->getCurrentStackFrame(); 10135903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks const StackFrameContext *CallerSF = CalleeSF->getParent()->getCurrentStackFrame(); 10145903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks assert(CalleeSF && CallerSF); 10155903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks ExplodedNode *BeforeProcessingCall = 0; 101628038f33aa2db4833881fea757a1f0daf85ac02bJordan Rose const Stmt *CE = CalleeSF->getCallSite(); 10175903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks 10185903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks // Find the first node before we started processing the call expression. 10195903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks while (N) { 10205903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks ProgramPoint L = N->getLocation(); 10215903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks BeforeProcessingCall = N; 10225903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks N = N->pred_empty() ? NULL : *(N->pred_begin()); 10235903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks 10245903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks // Skip the nodes corresponding to the inlined code. 10255903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks if (L.getLocationContext()->getCurrentStackFrame() != CallerSF) 10265903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks continue; 10275903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks // We reached the caller. Find the node right before we started 102828038f33aa2db4833881fea757a1f0daf85ac02bJordan Rose // processing the call. 10290b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks if (L.isPurgeKind()) 10305903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks continue; 103128038f33aa2db4833881fea757a1f0daf85ac02bJordan Rose if (isa<PreImplicitCall>(&L)) 103228038f33aa2db4833881fea757a1f0daf85ac02bJordan Rose continue; 1033852aa0d2c5d2d1faf2d77b5aa3c0848068a342c5Jordan Rose if (isa<CallEnter>(&L)) 1034852aa0d2c5d2d1faf2d77b5aa3c0848068a342c5Jordan Rose continue; 10355903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks if (const StmtPoint *SP = dyn_cast<StmtPoint>(&L)) 103628038f33aa2db4833881fea757a1f0daf85ac02bJordan Rose if (SP->getStmt() == CE) 10375903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks continue; 10385903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks break; 10395903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks } 10405903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks 1041253955ca25c7e7049963b5db613c0cd15d66e4f8Anna Zaks if (!BeforeProcessingCall) 10425903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks return false; 10435903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks 10445903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks // TODO: Clean up the unneeded nodes. 10455903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks 10465903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks // Build an Epsilon node from which we will restart the analyzes. 104728038f33aa2db4833881fea757a1f0daf85ac02bJordan Rose // Note that CE is permitted to be NULL! 10485903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks ProgramPoint NewNodeLoc = 10495903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks EpsilonPoint(BeforeProcessingCall->getLocationContext(), CE); 10505903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks // Add the special flag to GDM to signal retrying with no inlining. 10515903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks // Note, changing the state ensures that we are not going to cache out. 10525903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks ProgramStateRef NewNodeState = BeforeProcessingCall->getState(); 10535903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks NewNodeState = NewNodeState->set<ReplayWithoutInlining>((void*)CE); 10545903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks 10555903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks // Make the new node a successor of BeforeProcessingCall. 10565903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks bool IsNew = false; 10575903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks ExplodedNode *NewNode = G.getNode(NewNodeLoc, NewNodeState, false, &IsNew); 1058253955ca25c7e7049963b5db613c0cd15d66e4f8Anna Zaks // We cached out at this point. Caching out is common due to us backtracking 1059253955ca25c7e7049963b5db613c0cd15d66e4f8Anna Zaks // from the inlined function, which might spawn several paths. 1060253955ca25c7e7049963b5db613c0cd15d66e4f8Anna Zaks if (!IsNew) 1061253955ca25c7e7049963b5db613c0cd15d66e4f8Anna Zaks return true; 1062253955ca25c7e7049963b5db613c0cd15d66e4f8Anna Zaks 10635903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks NewNode->addPredecessor(BeforeProcessingCall, G); 10645903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks 10655903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks // Add the new node to the work list. 10665903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks Engine.enqueueStmtNode(NewNode, CalleeSF->getCallSiteBlock(), 10675903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks CalleeSF->getIndex()); 10685903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks NumTimesRetriedWithoutInlining++; 10695903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks return true; 10705903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks} 10715903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks 1072c03a39e16762627b421247b12a2658be630a3300Anna Zaks/// Block entrance. (Update counters). 1073253955ca25c7e7049963b5db613c0cd15d66e4f8Anna Zaksvoid ExprEngine::processCFGBlockEntrance(const BlockEdge &L, 1074253955ca25c7e7049963b5db613c0cd15d66e4f8Anna Zaks NodeBuilderWithSinks &nodeBuilder) { 107527c54e57c4a012dcdf2b40cf985b70d0b9caa69eTed Kremenek 107627c54e57c4a012dcdf2b40cf985b70d0b9caa69eTed Kremenek // FIXME: Refactor this into a checker. 1077c03a39e16762627b421247b12a2658be630a3300Anna Zaks ExplodedNode *pred = nodeBuilder.getContext().getPred(); 107827c54e57c4a012dcdf2b40cf985b70d0b9caa69eTed Kremenek 1079c03a39e16762627b421247b12a2658be630a3300Anna Zaks if (nodeBuilder.getContext().getCurrentBlockCount() >= AMgr.getMaxVisit()) { 1080ca804539d908d3a0e8c72a0df5f1f571d29490bbTed Kremenek static SimpleProgramPointTag tag("ExprEngine : Block count exceeded"); 1081253955ca25c7e7049963b5db613c0cd15d66e4f8Anna Zaks const ExplodedNode *Sink = 1082253955ca25c7e7049963b5db613c0cd15d66e4f8Anna Zaks nodeBuilder.generateNode(pred->getState(), pred, &tag, true); 1083749bbe6f5f23676244f12a0d41511c8e73516febAnna Zaks 1084749bbe6f5f23676244f12a0d41511c8e73516febAnna Zaks // Check if we stopped at the top level function or not. 1085749bbe6f5f23676244f12a0d41511c8e73516febAnna Zaks // Root node should have the location context of the top most function. 10865903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks const LocationContext *CalleeLC = pred->getLocation().getLocationContext(); 10873bbd8cd831788c506f2980293eb3c7e1b3ca2501Anna Zaks const LocationContext *CalleeSF = CalleeLC->getCurrentStackFrame(); 10885903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks const LocationContext *RootLC = 10895903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks (*G.roots_begin())->getLocation().getLocationContext(); 10903bbd8cd831788c506f2980293eb3c7e1b3ca2501Anna Zaks if (RootLC->getCurrentStackFrame() != CalleeSF) { 1091e62f048960645b79363408fdead53fec2a063c52Anna Zaks Engine.FunctionSummaries->markReachedMaxBlockCount(CalleeSF->getDecl()); 10923bbd8cd831788c506f2980293eb3c7e1b3ca2501Anna Zaks 10935903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks // Re-run the call evaluation without inlining it, by storing the 10945903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks // no-inlining policy in the state and enqueuing the new work item on 10955903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks // the list. Replay should almost never fail. Use the stats to catch it 10965903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks // if it does. 1097b47dbcbc12430fdf3e5a5b9f59cdec5480e89e75Anna Zaks if ((!AMgr.NoRetryExhausted && replayWithoutInlining(pred, CalleeLC))) 1098253955ca25c7e7049963b5db613c0cd15d66e4f8Anna Zaks return; 1099253955ca25c7e7049963b5db613c0cd15d66e4f8Anna Zaks NumMaxBlockCountReachedInInlined++; 11005903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks } else 1101749bbe6f5f23676244f12a0d41511c8e73516febAnna Zaks NumMaxBlockCountReached++; 1102253955ca25c7e7049963b5db613c0cd15d66e4f8Anna Zaks 1103253955ca25c7e7049963b5db613c0cd15d66e4f8Anna Zaks // Make sink nodes as exhausted(for stats) only if retry failed. 1104253955ca25c7e7049963b5db613c0cd15d66e4f8Anna Zaks Engine.blocksExhausted.push_back(std::make_pair(L, Sink)); 110527c54e57c4a012dcdf2b40cf985b70d0b9caa69eTed Kremenek } 1106e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek} 1107e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek 1108e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek//===----------------------------------------------------------------------===// 1109e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek// Branch processing. 1110e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek//===----------------------------------------------------------------------===// 1111e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek 11128bef8238181a30e52dea380789a7e2d760eac532Ted KremenekProgramStateRef ExprEngine::MarkBranch(ProgramStateRef state, 11135eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek const Stmt *Terminator, 11145eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek const LocationContext *LCtx, 11155eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek bool branchTaken) { 11161eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 111705a2378c708688c8ef498a5cea40ed7f5db15fa5Ted Kremenek switch (Terminator->getStmtClass()) { 111805a2378c708688c8ef498a5cea40ed7f5db15fa5Ted Kremenek default: 1119a8538d902fce9cfec20f39b34492268b51643819Ted Kremenek return state; 11201eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 112105a2378c708688c8ef498a5cea40ed7f5db15fa5Ted Kremenek case Stmt::BinaryOperatorClass: { // '&&' and '||' 11221eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 112303509aea098772644bf4662dc1c88634818ceeccZhongxing Xu const BinaryOperator* B = cast<BinaryOperator>(Terminator); 112405a2378c708688c8ef498a5cea40ed7f5db15fa5Ted Kremenek BinaryOperator::Opcode Op = B->getOpcode(); 11251eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 11262de56d1d0c3a504ad1529de2677628bdfbb95cd4John McCall assert (Op == BO_LAnd || Op == BO_LOr); 11271eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 112805a2378c708688c8ef498a5cea40ed7f5db15fa5Ted Kremenek // For &&, if we take the true branch, then the value of the whole 112905a2378c708688c8ef498a5cea40ed7f5db15fa5Ted Kremenek // expression is that of the RHS expression. 113005a2378c708688c8ef498a5cea40ed7f5db15fa5Ted Kremenek // 113105a2378c708688c8ef498a5cea40ed7f5db15fa5Ted Kremenek // For ||, if we take the false branch, then the value of the whole 113205a2378c708688c8ef498a5cea40ed7f5db15fa5Ted Kremenek // expression is that of the RHS expression. 11331eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 11349c378f705405d37f49795d5e915989de774fe11fTed Kremenek const Expr *Ex = (Op == BO_LAnd && branchTaken) || 11352de56d1d0c3a504ad1529de2677628bdfbb95cd4John McCall (Op == BO_LOr && !branchTaken) 113603509aea098772644bf4662dc1c88634818ceeccZhongxing Xu ? B->getRHS() : B->getLHS(); 11371eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 11385eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek return state->BindExpr(B, LCtx, UndefinedVal(Ex)); 113905a2378c708688c8ef498a5cea40ed7f5db15fa5Ted Kremenek } 11401eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 114156ca35d396d8692c384c785f9aeebcf22563fe1eJohn McCall case Stmt::BinaryConditionalOperatorClass: 114205a2378c708688c8ef498a5cea40ed7f5db15fa5Ted Kremenek case Stmt::ConditionalOperatorClass: { // ?: 114356ca35d396d8692c384c785f9aeebcf22563fe1eJohn McCall const AbstractConditionalOperator* C 114456ca35d396d8692c384c785f9aeebcf22563fe1eJohn McCall = cast<AbstractConditionalOperator>(Terminator); 11451eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 114605a2378c708688c8ef498a5cea40ed7f5db15fa5Ted Kremenek // For ?, if branchTaken == true then the value is either the LHS or 114705a2378c708688c8ef498a5cea40ed7f5db15fa5Ted Kremenek // the condition itself. (GNU extension). 11481eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 11499c378f705405d37f49795d5e915989de774fe11fTed Kremenek const Expr *Ex; 11501eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 115105a2378c708688c8ef498a5cea40ed7f5db15fa5Ted Kremenek if (branchTaken) 115256ca35d396d8692c384c785f9aeebcf22563fe1eJohn McCall Ex = C->getTrueExpr(); 115305a2378c708688c8ef498a5cea40ed7f5db15fa5Ted Kremenek else 115456ca35d396d8692c384c785f9aeebcf22563fe1eJohn McCall Ex = C->getFalseExpr(); 11551eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 11565eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek return state->BindExpr(C, LCtx, UndefinedVal(Ex)); 115705a2378c708688c8ef498a5cea40ed7f5db15fa5Ted Kremenek } 11581eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 115905a2378c708688c8ef498a5cea40ed7f5db15fa5Ted Kremenek case Stmt::ChooseExprClass: { // ?: 11601eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 11619c378f705405d37f49795d5e915989de774fe11fTed Kremenek const ChooseExpr *C = cast<ChooseExpr>(Terminator); 11621eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 11639c378f705405d37f49795d5e915989de774fe11fTed Kremenek const Expr *Ex = branchTaken ? C->getLHS() : C->getRHS(); 11645eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek return state->BindExpr(C, LCtx, UndefinedVal(Ex)); 116505a2378c708688c8ef498a5cea40ed7f5db15fa5Ted Kremenek } 116605a2378c708688c8ef498a5cea40ed7f5db15fa5Ted Kremenek } 116705a2378c708688c8ef498a5cea40ed7f5db15fa5Ted Kremenek} 116805a2378c708688c8ef498a5cea40ed7f5db15fa5Ted Kremenek 11696ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek/// RecoverCastedSymbol - A helper function for ProcessBranch that is used 11706ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek/// to try to recover some path-sensitivity for casts of symbolic 11716ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek/// integers that promote their values (which are currently not tracked well). 11726ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek/// This function returns the SVal bound to Condition->IgnoreCasts if all the 11736ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek// cast(s) did was sign-extend the original value. 1174294fd0a62b95f512637910bf85c7efa6c2354b50Ted Kremenekstatic SVal RecoverCastedSymbol(ProgramStateManager& StateMgr, 11758bef8238181a30e52dea380789a7e2d760eac532Ted Kremenek ProgramStateRef state, 1176294fd0a62b95f512637910bf85c7efa6c2354b50Ted Kremenek const Stmt *Condition, 11775eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek const LocationContext *LCtx, 1178294fd0a62b95f512637910bf85c7efa6c2354b50Ted Kremenek ASTContext &Ctx) { 11796ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek 118003509aea098772644bf4662dc1c88634818ceeccZhongxing Xu const Expr *Ex = dyn_cast<Expr>(Condition); 11816ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek if (!Ex) 11826ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek return UnknownVal(); 11836ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek 11846ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek uint64_t bits = 0; 11856ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek bool bitsInit = false; 11861eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 118703509aea098772644bf4662dc1c88634818ceeccZhongxing Xu while (const CastExpr *CE = dyn_cast<CastExpr>(Ex)) { 11886ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek QualType T = CE->getType(); 11896ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek 11906ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek if (!T->isIntegerType()) 11916ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek return UnknownVal(); 11921eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 11936ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek uint64_t newBits = Ctx.getTypeSize(T); 11946ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek if (!bitsInit || newBits < bits) { 11956ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek bitsInit = true; 11966ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek bits = newBits; 11976ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek } 11981eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 11996ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek Ex = CE->getSubExpr(); 12006ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek } 12016ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek 12026ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek // We reached a non-cast. Is it a symbolic value? 12036ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek QualType T = Ex->getType(); 12046ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek 12056ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek if (!bitsInit || !T->isIntegerType() || Ctx.getTypeSize(T) > bits) 12066ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek return UnknownVal(); 12071eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 12085eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek return state->getSVal(Ex, LCtx); 12096ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek} 12106ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek 12119c378f705405d37f49795d5e915989de774fe11fTed Kremenekvoid ExprEngine::processBranch(const Stmt *Condition, const Stmt *Term, 1212a19f4af7a94835ce4693bfe12d6270754e79eb56Anna Zaks NodeBuilderContext& BldCtx, 1213ad62deeb70e97da6bd514dd390ea1ce6af6ad81dAnna Zaks ExplodedNode *Pred, 12141aae01a8308d2f8e31adab3f4d7ac35543aac680Anna Zaks ExplodedNodeSet &Dst, 1215a19f4af7a94835ce4693bfe12d6270754e79eb56Anna Zaks const CFGBlock *DstT, 1216a19f4af7a94835ce4693bfe12d6270754e79eb56Anna Zaks const CFGBlock *DstF) { 1217f236b6503a4dbc44c1fccb8756bd57c9d0efdf05Anna Zaks currentBuilderContext = &BldCtx; 1218f236b6503a4dbc44c1fccb8756bd57c9d0efdf05Anna Zaks 1219b2331834a0515c80862ee51325c758a053829f15Ted Kremenek // Check for NULL conditions; e.g. "for(;;)" 12201eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump if (!Condition) { 12211aae01a8308d2f8e31adab3f4d7ac35543aac680Anna Zaks BranchNodeBuilder NullCondBldr(Pred, Dst, BldCtx, DstT, DstF); 1222a19f4af7a94835ce4693bfe12d6270754e79eb56Anna Zaks NullCondBldr.markInfeasible(false); 12234e82d3cf6fd4c907265e3fa3aac0a835c35dc759Anna Zaks NullCondBldr.generateNode(Pred->getState(), true, Pred); 1224b2331834a0515c80862ee51325c758a053829f15Ted Kremenek return; 1225b2331834a0515c80862ee51325c758a053829f15Ted Kremenek } 12261eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 122721028dd8850c64a414f7a82dfddcc291351203d6Ted Kremenek PrettyStackTraceLoc CrashInfo(getContext().getSourceManager(), 122821028dd8850c64a414f7a82dfddcc291351203d6Ted Kremenek Condition->getLocStart(), 122921028dd8850c64a414f7a82dfddcc291351203d6Ted Kremenek "Error evaluating branch"); 12300fb0bc4067d6c9d7c0e655300ef309b05d3adfc9Ted Kremenek 1231f236b6503a4dbc44c1fccb8756bd57c9d0efdf05Anna Zaks ExplodedNodeSet CheckersOutSet; 1232f236b6503a4dbc44c1fccb8756bd57c9d0efdf05Anna Zaks getCheckerManager().runCheckersForBranchCondition(Condition, CheckersOutSet, 12334e82d3cf6fd4c907265e3fa3aac0a835c35dc759Anna Zaks Pred, *this); 12348ff5c41f2bde7ebbe568b4c15e59f14b8befae66Anna Zaks // We generated only sinks. 1235f236b6503a4dbc44c1fccb8756bd57c9d0efdf05Anna Zaks if (CheckersOutSet.empty()) 12368ff5c41f2bde7ebbe568b4c15e59f14b8befae66Anna Zaks return; 12371eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1238f236b6503a4dbc44c1fccb8756bd57c9d0efdf05Anna Zaks BranchNodeBuilder builder(CheckersOutSet, Dst, BldCtx, DstT, DstF); 1239f236b6503a4dbc44c1fccb8756bd57c9d0efdf05Anna Zaks for (NodeBuilder::iterator I = CheckersOutSet.begin(), 1240f236b6503a4dbc44c1fccb8756bd57c9d0efdf05Anna Zaks E = CheckersOutSet.end(); E != I; ++I) { 1241cd656cab3fa3dd4b0c974c6ae1c0e60880b18c22Anna Zaks ExplodedNode *PredI = *I; 1242cd656cab3fa3dd4b0c974c6ae1c0e60880b18c22Anna Zaks 1243cd656cab3fa3dd4b0c974c6ae1c0e60880b18c22Anna Zaks if (PredI->isSink()) 1244cd656cab3fa3dd4b0c974c6ae1c0e60880b18c22Anna Zaks continue; 1245cd656cab3fa3dd4b0c974c6ae1c0e60880b18c22Anna Zaks 12468bef8238181a30e52dea380789a7e2d760eac532Ted Kremenek ProgramStateRef PrevState = Pred->getState(); 12475eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek SVal X = PrevState->getSVal(Condition, Pred->getLocationContext()); 1248cd656cab3fa3dd4b0c974c6ae1c0e60880b18c22Anna Zaks 1249cd656cab3fa3dd4b0c974c6ae1c0e60880b18c22Anna Zaks if (X.isUnknownOrUndef()) { 1250cd656cab3fa3dd4b0c974c6ae1c0e60880b18c22Anna Zaks // Give it a chance to recover from unknown. 1251cd656cab3fa3dd4b0c974c6ae1c0e60880b18c22Anna Zaks if (const Expr *Ex = dyn_cast<Expr>(Condition)) { 1252cd656cab3fa3dd4b0c974c6ae1c0e60880b18c22Anna Zaks if (Ex->getType()->isIntegerType()) { 1253cd656cab3fa3dd4b0c974c6ae1c0e60880b18c22Anna Zaks // Try to recover some path-sensitivity. Right now casts of symbolic 1254cd656cab3fa3dd4b0c974c6ae1c0e60880b18c22Anna Zaks // integers that promote their values are currently not tracked well. 1255cd656cab3fa3dd4b0c974c6ae1c0e60880b18c22Anna Zaks // If 'Condition' is such an expression, try and recover the 1256cd656cab3fa3dd4b0c974c6ae1c0e60880b18c22Anna Zaks // underlying value and use that instead. 1257cd656cab3fa3dd4b0c974c6ae1c0e60880b18c22Anna Zaks SVal recovered = RecoverCastedSymbol(getStateManager(), 1258cd656cab3fa3dd4b0c974c6ae1c0e60880b18c22Anna Zaks PrevState, Condition, 12595eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek Pred->getLocationContext(), 1260cd656cab3fa3dd4b0c974c6ae1c0e60880b18c22Anna Zaks getContext()); 1261cd656cab3fa3dd4b0c974c6ae1c0e60880b18c22Anna Zaks 1262cd656cab3fa3dd4b0c974c6ae1c0e60880b18c22Anna Zaks if (!recovered.isUnknown()) { 1263cd656cab3fa3dd4b0c974c6ae1c0e60880b18c22Anna Zaks X = recovered; 1264cd656cab3fa3dd4b0c974c6ae1c0e60880b18c22Anna Zaks } 12650835e4cccfef3ea5346962722b79484f6b3ca602Zhongxing Xu } 1266b38911f16b4943548db6a3695fc6ae23070b25d2Ted Kremenek } 12670835e4cccfef3ea5346962722b79484f6b3ca602Zhongxing Xu } 12685eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek 12695eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek const LocationContext *LCtx = PredI->getLocationContext(); 12705eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek 12710835e4cccfef3ea5346962722b79484f6b3ca602Zhongxing Xu // If the condition is still unknown, give up. 127273c498a08f4968b6987d1453c7b77929dcc6d5f7Argyrios Kyrtzidis if (X.isUnknownOrUndef()) { 12735eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek builder.generateNode(MarkBranch(PrevState, Term, LCtx, true), 12745eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek true, PredI); 12755eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek builder.generateNode(MarkBranch(PrevState, Term, LCtx, false), 12765eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek false, PredI); 1277cd656cab3fa3dd4b0c974c6ae1c0e60880b18c22Anna Zaks continue; 12781eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump } 12791eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1280cd656cab3fa3dd4b0c974c6ae1c0e60880b18c22Anna Zaks DefinedSVal V = cast<DefinedSVal>(X); 12810835e4cccfef3ea5346962722b79484f6b3ca602Zhongxing Xu 1282cd656cab3fa3dd4b0c974c6ae1c0e60880b18c22Anna Zaks // Process the true branch. 1283cd656cab3fa3dd4b0c974c6ae1c0e60880b18c22Anna Zaks if (builder.isFeasible(true)) { 12848bef8238181a30e52dea380789a7e2d760eac532Ted Kremenek if (ProgramStateRef state = PrevState->assume(V, true)) 12855eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek builder.generateNode(MarkBranch(state, Term, LCtx, true), 12865eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek true, PredI); 1287cd656cab3fa3dd4b0c974c6ae1c0e60880b18c22Anna Zaks else 1288cd656cab3fa3dd4b0c974c6ae1c0e60880b18c22Anna Zaks builder.markInfeasible(true); 1289cd656cab3fa3dd4b0c974c6ae1c0e60880b18c22Anna Zaks } 12901eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1291cd656cab3fa3dd4b0c974c6ae1c0e60880b18c22Anna Zaks // Process the false branch. 1292cd656cab3fa3dd4b0c974c6ae1c0e60880b18c22Anna Zaks if (builder.isFeasible(false)) { 12938bef8238181a30e52dea380789a7e2d760eac532Ted Kremenek if (ProgramStateRef state = PrevState->assume(V, false)) 12945eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek builder.generateNode(MarkBranch(state, Term, LCtx, false), 12955eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek false, PredI); 1296cd656cab3fa3dd4b0c974c6ae1c0e60880b18c22Anna Zaks else 1297cd656cab3fa3dd4b0c974c6ae1c0e60880b18c22Anna Zaks builder.markInfeasible(false); 1298cd656cab3fa3dd4b0c974c6ae1c0e60880b18c22Anna Zaks } 1299cd656cab3fa3dd4b0c974c6ae1c0e60880b18c22Anna Zaks } 1300f236b6503a4dbc44c1fccb8756bd57c9d0efdf05Anna Zaks currentBuilderContext = 0; 1301f233d48cfc513b045e2c2cfca5c175220fbd0a82Ted Kremenek} 1302f233d48cfc513b045e2c2cfca5c175220fbd0a82Ted Kremenek 1303e36de1fe51c39d9161915dd3dbef880954af6476Ted Kremenek/// processIndirectGoto - Called by CoreEngine. Used to generate successor 1304754607e7cff2d902d9af8b771409449fb2f8d2bfTed Kremenek/// nodes by processing the 'effects' of a computed goto jump. 1305ad8dcf4a9df0e24051dc31bf9e6f3cd138a34298Chris Lattnervoid ExprEngine::processIndirectGoto(IndirectGotoNodeBuilder &builder) { 1306754607e7cff2d902d9af8b771409449fb2f8d2bfTed Kremenek 13078bef8238181a30e52dea380789a7e2d760eac532Ted Kremenek ProgramStateRef state = builder.getState(); 13085eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek SVal V = state->getSVal(builder.getTarget(), builder.getLocationContext()); 13091eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1310754607e7cff2d902d9af8b771409449fb2f8d2bfTed Kremenek // Three possibilities: 1311754607e7cff2d902d9af8b771409449fb2f8d2bfTed Kremenek // 1312754607e7cff2d902d9af8b771409449fb2f8d2bfTed Kremenek // (1) We know the computed label. 13134a4e524afef40d6f3ddb25d0e407c814e4ca56a8Ted Kremenek // (2) The label is NULL (or some other constant), or Undefined. 1314754607e7cff2d902d9af8b771409449fb2f8d2bfTed Kremenek // (3) We have no clue about the label. Dispatch to all targets. 1315754607e7cff2d902d9af8b771409449fb2f8d2bfTed Kremenek // 13161eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1317d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidis typedef IndirectGotoNodeBuilder::iterator iterator; 1318754607e7cff2d902d9af8b771409449fb2f8d2bfTed Kremenek 13191c96b24285d05c0eac455ae96d7c9ff43d42bc96Zhongxing Xu if (isa<loc::GotoLabel>(V)) { 1320ad8dcf4a9df0e24051dc31bf9e6f3cd138a34298Chris Lattner const LabelDecl *L = cast<loc::GotoLabel>(V).getLabel(); 13211eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1322ad8dcf4a9df0e24051dc31bf9e6f3cd138a34298Chris Lattner for (iterator I = builder.begin(), E = builder.end(); I != E; ++I) { 132324f1a967741ff9f8025ee23be12ba6feacc31f77Ted Kremenek if (I.getLabel() == L) { 1324a8538d902fce9cfec20f39b34492268b51643819Ted Kremenek builder.generateNode(I, state); 1325754607e7cff2d902d9af8b771409449fb2f8d2bfTed Kremenek return; 1326754607e7cff2d902d9af8b771409449fb2f8d2bfTed Kremenek } 1327754607e7cff2d902d9af8b771409449fb2f8d2bfTed Kremenek } 13281eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1329b219cfc4d75f0a03630b7c4509ef791b7e97b2c8David Blaikie llvm_unreachable("No block with label."); 1330754607e7cff2d902d9af8b771409449fb2f8d2bfTed Kremenek } 1331754607e7cff2d902d9af8b771409449fb2f8d2bfTed Kremenek 13321c96b24285d05c0eac455ae96d7c9ff43d42bc96Zhongxing Xu if (isa<loc::ConcreteInt>(V) || isa<UndefinedVal>(V)) { 1333754607e7cff2d902d9af8b771409449fb2f8d2bfTed Kremenek // Dispatch to the first target and mark it as a sink. 13342055effed54d614b51e3501a174c9b1fe92e4de4Zhongxing Xu //ExplodedNode* N = builder.generateNode(builder.begin(), state, true); 13352055effed54d614b51e3501a174c9b1fe92e4de4Zhongxing Xu // FIXME: add checker visit. 13362055effed54d614b51e3501a174c9b1fe92e4de4Zhongxing Xu // UndefBranches.insert(N); 1337754607e7cff2d902d9af8b771409449fb2f8d2bfTed Kremenek return; 1338754607e7cff2d902d9af8b771409449fb2f8d2bfTed Kremenek } 13391eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1340754607e7cff2d902d9af8b771409449fb2f8d2bfTed Kremenek // This is really a catch-all. We don't support symbolics yet. 1341b3cfd58c9b13325d994e5f9b5065e6a22d91911dTed Kremenek // FIXME: Implement dispatch for symbolic pointers. 13421eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1343754607e7cff2d902d9af8b771409449fb2f8d2bfTed Kremenek for (iterator I=builder.begin(), E=builder.end(); I != E; ++I) 1344a8538d902fce9cfec20f39b34492268b51643819Ted Kremenek builder.generateNode(I, state); 1345754607e7cff2d902d9af8b771409449fb2f8d2bfTed Kremenek} 1346f233d48cfc513b045e2c2cfca5c175220fbd0a82Ted Kremenek 1347d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidis/// ProcessEndPath - Called by CoreEngine. Used to generate end-of-path 134873099bfea9f5d4ec05265170bbefec3d76fb6b5eTed Kremenek/// nodes when the control reaches the end of a function. 1349af498a28797c075c48d7e943df5f5a8e78ed8eb0Anna Zaksvoid ExprEngine::processEndOfFunction(NodeBuilderContext& BC) { 1350af498a28797c075c48d7e943df5f5a8e78ed8eb0Anna Zaks StateMgr.EndPath(BC.Pred->getState()); 1351af498a28797c075c48d7e943df5f5a8e78ed8eb0Anna Zaks ExplodedNodeSet Dst; 1352af498a28797c075c48d7e943df5f5a8e78ed8eb0Anna Zaks getCheckerManager().runCheckersForEndPath(BC, Dst, *this); 13534d2ae4a70336dc2aa11389b34946be152bb454c9Anna Zaks Engine.enqueueEndOfFunction(Dst); 135473099bfea9f5d4ec05265170bbefec3d76fb6b5eTed Kremenek} 135573099bfea9f5d4ec05265170bbefec3d76fb6b5eTed Kremenek 1356d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidis/// ProcessSwitch - Called by CoreEngine. Used to generate successor 1357daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek/// nodes by processing the 'effects' of a switch statement. 1358e36de1fe51c39d9161915dd3dbef880954af6476Ted Kremenekvoid ExprEngine::processSwitch(SwitchNodeBuilder& builder) { 1359d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidis typedef SwitchNodeBuilder::iterator iterator; 13608bef8238181a30e52dea380789a7e2d760eac532Ted Kremenek ProgramStateRef state = builder.getState(); 13619c378f705405d37f49795d5e915989de774fe11fTed Kremenek const Expr *CondE = builder.getCondition(); 13625eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek SVal CondV_untested = state->getSVal(CondE, builder.getLocationContext()); 1363daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek 13645b9bd2137ebef350af803c634e3fdf5d74678100Ted Kremenek if (CondV_untested.isUndef()) { 13652055effed54d614b51e3501a174c9b1fe92e4de4Zhongxing Xu //ExplodedNode* N = builder.generateDefaultCaseNode(state, true); 1366b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek // FIXME: add checker 13672055effed54d614b51e3501a174c9b1fe92e4de4Zhongxing Xu //UndefBranches.insert(N); 13682055effed54d614b51e3501a174c9b1fe92e4de4Zhongxing Xu 1369daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek return; 1370daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek } 13715b9bd2137ebef350af803c634e3fdf5d74678100Ted Kremenek DefinedOrUnknownSVal CondV = cast<DefinedOrUnknownSVal>(CondV_untested); 1372692416c214a3b234236dedcf875735a9cc29e90bTed Kremenek 13738bef8238181a30e52dea380789a7e2d760eac532Ted Kremenek ProgramStateRef DefaultSt = state; 137434feff654c6304e0a59ceb1376989d28dbc956ffTed Kremenek 137534feff654c6304e0a59ceb1376989d28dbc956ffTed Kremenek iterator I = builder.begin(), EI = builder.end(); 137634feff654c6304e0a59ceb1376989d28dbc956ffTed Kremenek bool defaultIsFeasible = I == EI; 13771eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 137834feff654c6304e0a59ceb1376989d28dbc956ffTed Kremenek for ( ; I != EI; ++I) { 1379e71f3d587844110d836c82250830b27b1651afdbTed Kremenek // Successor may be pruned out during CFG construction. 1380e71f3d587844110d836c82250830b27b1651afdbTed Kremenek if (!I.getBlock()) 1381e71f3d587844110d836c82250830b27b1651afdbTed Kremenek continue; 1382e71f3d587844110d836c82250830b27b1651afdbTed Kremenek 13839c378f705405d37f49795d5e915989de774fe11fTed Kremenek const CaseStmt *Case = I.getCase(); 138472afb3739da0da02158242ae41a50cfe0bea78b4Ted Kremenek 138572afb3739da0da02158242ae41a50cfe0bea78b4Ted Kremenek // Evaluate the LHS of the case value. 138685df96c1f04867e26ba069aa0cc6a4cd6a01292eRichard Smith llvm::APSInt V1 = Case->getLHS()->EvaluateKnownConstInt(getContext()); 138785df96c1f04867e26ba069aa0cc6a4cd6a01292eRichard Smith assert(V1.getBitWidth() == getContext().getTypeSize(CondE->getType())); 13881eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1389daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek // Get the RHS of the case, if it exists. 139085df96c1f04867e26ba069aa0cc6a4cd6a01292eRichard Smith llvm::APSInt V2; 139185df96c1f04867e26ba069aa0cc6a4cd6a01292eRichard Smith if (const Expr *E = Case->getRHS()) 139285df96c1f04867e26ba069aa0cc6a4cd6a01292eRichard Smith V2 = E->EvaluateKnownConstInt(getContext()); 139314a1140c9f4e20b12a54db8745b74699b9872cd2Ted Kremenek else 139414a1140c9f4e20b12a54db8745b74699b9872cd2Ted Kremenek V2 = V1; 13951eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1396daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek // FIXME: Eventually we should replace the logic below with a range 1397daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek // comparison, rather than concretize the values within the range. 1398aa1c4e5a6b87b62d991c55a0d4522bcd778068d7Ted Kremenek // This should be easy once we have "ranges" for NonLVals. 13991eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 140014a1140c9f4e20b12a54db8745b74699b9872cd2Ted Kremenek do { 140185df96c1f04867e26ba069aa0cc6a4cd6a01292eRichard Smith nonloc::ConcreteInt CaseVal(getBasicVals().getValue(V1)); 14029c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek DefinedOrUnknownSVal Res = svalBuilder.evalEQ(DefaultSt ? DefaultSt : state, 140348569f9562740ac1f4b175cb17ce3d49035402c4Ted Kremenek CondV, CaseVal); 1404b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 14051eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump // Now "assume" that the case matches. 14068bef8238181a30e52dea380789a7e2d760eac532Ted Kremenek if (ProgramStateRef stateNew = state->assume(Res, true)) { 1407a591bc04d21fa62ebffcb2c7814d738ca8f5e2f9Ted Kremenek builder.generateCaseStmtNode(I, stateNew); 14081eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1409daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek // If CondV evaluates to a constant, then we know that this 1410daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek // is the *only* case that we can take, so stop evaluating the 1411daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek // others. 14121c96b24285d05c0eac455ae96d7c9ff43d42bc96Zhongxing Xu if (isa<nonloc::ConcreteInt>(CondV)) 1413daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek return; 1414daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek } 14151eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1416daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek // Now "assume" that the case doesn't match. Add this state 1417daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek // to the default state (if it is feasible). 141848569f9562740ac1f4b175cb17ce3d49035402c4Ted Kremenek if (DefaultSt) { 14198bef8238181a30e52dea380789a7e2d760eac532Ted Kremenek if (ProgramStateRef stateNew = DefaultSt->assume(Res, false)) { 142048569f9562740ac1f4b175cb17ce3d49035402c4Ted Kremenek defaultIsFeasible = true; 142148569f9562740ac1f4b175cb17ce3d49035402c4Ted Kremenek DefaultSt = stateNew; 142248569f9562740ac1f4b175cb17ce3d49035402c4Ted Kremenek } 142348569f9562740ac1f4b175cb17ce3d49035402c4Ted Kremenek else { 142448569f9562740ac1f4b175cb17ce3d49035402c4Ted Kremenek defaultIsFeasible = false; 142548569f9562740ac1f4b175cb17ce3d49035402c4Ted Kremenek DefaultSt = NULL; 142648569f9562740ac1f4b175cb17ce3d49035402c4Ted Kremenek } 14275014ab113eb211b8320ae30b173d7020352663c6Ted Kremenek } 1428b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 142914a1140c9f4e20b12a54db8745b74699b9872cd2Ted Kremenek // Concretize the next value in the range. 143085df96c1f04867e26ba069aa0cc6a4cd6a01292eRichard Smith if (V1 == V2) 143114a1140c9f4e20b12a54db8745b74699b9872cd2Ted Kremenek break; 14321eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 143385df96c1f04867e26ba069aa0cc6a4cd6a01292eRichard Smith ++V1; 143485df96c1f04867e26ba069aa0cc6a4cd6a01292eRichard Smith assert (V1 <= V2); 14351eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 143614a1140c9f4e20b12a54db8745b74699b9872cd2Ted Kremenek } while (true); 1437daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek } 14381eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 14394d3175c1e5a44251ea97b0c81e80f060629d9c08Ted Kremenek if (!defaultIsFeasible) 14404d3175c1e5a44251ea97b0c81e80f060629d9c08Ted Kremenek return; 14414d3175c1e5a44251ea97b0c81e80f060629d9c08Ted Kremenek 14424d3175c1e5a44251ea97b0c81e80f060629d9c08Ted Kremenek // If we have switch(enum value), the default branch is not 14434d3175c1e5a44251ea97b0c81e80f060629d9c08Ted Kremenek // feasible if all of the enum constants not covered by 'case:' statements 14444d3175c1e5a44251ea97b0c81e80f060629d9c08Ted Kremenek // are not feasible values for the switch condition. 14454d3175c1e5a44251ea97b0c81e80f060629d9c08Ted Kremenek // 14464d3175c1e5a44251ea97b0c81e80f060629d9c08Ted Kremenek // Note that this isn't as accurate as it could be. Even if there isn't 14474d3175c1e5a44251ea97b0c81e80f060629d9c08Ted Kremenek // a case for a particular enum value as long as that enum value isn't 14484d3175c1e5a44251ea97b0c81e80f060629d9c08Ted Kremenek // feasible then it shouldn't be considered for making 'default:' reachable. 14494d3175c1e5a44251ea97b0c81e80f060629d9c08Ted Kremenek const SwitchStmt *SS = builder.getSwitch(); 14504d3175c1e5a44251ea97b0c81e80f060629d9c08Ted Kremenek const Expr *CondExpr = SS->getCond()->IgnoreParenImpCasts(); 14514d3175c1e5a44251ea97b0c81e80f060629d9c08Ted Kremenek if (CondExpr->getType()->getAs<EnumType>()) { 14524d3175c1e5a44251ea97b0c81e80f060629d9c08Ted Kremenek if (SS->isAllEnumCasesCovered()) 14534d3175c1e5a44251ea97b0c81e80f060629d9c08Ted Kremenek return; 14544d3175c1e5a44251ea97b0c81e80f060629d9c08Ted Kremenek } 14554d3175c1e5a44251ea97b0c81e80f060629d9c08Ted Kremenek 14564d3175c1e5a44251ea97b0c81e80f060629d9c08Ted Kremenek builder.generateDefaultCaseNode(DefaultSt); 1457daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek} 1458daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek 1459e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek//===----------------------------------------------------------------------===// 1460ec96a2d52d16e150baaf629cd35e3fabff5d8915Ted Kremenek// Transfer functions: Loads and stores. 1461e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek//===----------------------------------------------------------------------===// 1462d27f8169f4b68337a489547a41ac45bf7a5d1ddfTed Kremenek 1463d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidisvoid ExprEngine::VisitCommonDeclRefExpr(const Expr *Ex, const NamedDecl *D, 1464d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidis ExplodedNode *Pred, 1465d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidis ExplodedNodeSet &Dst) { 1466aa0aeb1cbe117db68d35700cb3a34aace0f99b99Anna Zaks StmtNodeBuilder Bldr(Pred, Dst, *currentBuilderContext); 1467ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks 14688bef8238181a30e52dea380789a7e2d760eac532Ted Kremenek ProgramStateRef state = Pred->getState(); 14695eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek const LocationContext *LCtx = Pred->getLocationContext(); 14706d69b5d82281992e981caa9bc038e3f6cac6594aZhongxing Xu 14719c378f705405d37f49795d5e915989de774fe11fTed Kremenek if (const VarDecl *VD = dyn_cast<VarDecl>(D)) { 1472591b5f53c0e11d87401b4804bb1be1a53f95c619Anna Zaks assert(Ex->isGLValue()); 1473d17da2b99f323fa91b01e1dd119cc32e0ee8197dTed Kremenek SVal V = state->getLValue(VD, Pred->getLocationContext()); 1474a7581731b1453b51b26154d2409d42a5b6395079Zhongxing Xu 1475892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek // For references, the 'lvalue' is the pointer address stored in the 1476892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek // reference region. 1477892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek if (VD->getType()->isReferenceType()) { 1478892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek if (const MemRegion *R = V.getAsRegion()) 1479892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek V = state->getSVal(R); 1480892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek else 1481892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek V = UnknownVal(); 1482852274d4257134906995cb252fb3dfd2d71deae8Ted Kremenek } 14836d69b5d82281992e981caa9bc038e3f6cac6594aZhongxing Xu 14845eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek Bldr.generateNode(Ex, Pred, state->BindExpr(Ex, LCtx, V), false, 0, 1485ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks ProgramPoint::PostLValueKind); 1486852274d4257134906995cb252fb3dfd2d71deae8Ted Kremenek return; 1487892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek } 14889c378f705405d37f49795d5e915989de774fe11fTed Kremenek if (const EnumConstantDecl *ED = dyn_cast<EnumConstantDecl>(D)) { 1489591b5f53c0e11d87401b4804bb1be1a53f95c619Anna Zaks assert(!Ex->isGLValue()); 1490c8413fd03f73084a5c93028f8b4db619fc388087Ted Kremenek SVal V = svalBuilder.makeIntVal(ED->getInitVal()); 14915eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek Bldr.generateNode(Ex, Pred, state->BindExpr(Ex, LCtx, V)); 14926d69b5d82281992e981caa9bc038e3f6cac6594aZhongxing Xu return; 1493892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek } 14949c378f705405d37f49795d5e915989de774fe11fTed Kremenek if (const FunctionDecl *FD = dyn_cast<FunctionDecl>(D)) { 1495c8413fd03f73084a5c93028f8b4db619fc388087Ted Kremenek SVal V = svalBuilder.getFunctionPointer(FD); 14965eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek Bldr.generateNode(Ex, Pred, state->BindExpr(Ex, LCtx, V), false, 0, 1497ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks ProgramPoint::PostLValueKind); 14986d69b5d82281992e981caa9bc038e3f6cac6594aZhongxing Xu return; 14991b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek } 15005aac0b6ae95f137b1783f3e6227241fb457b8f8bTed Kremenek if (isa<FieldDecl>(D)) { 15015aac0b6ae95f137b1783f3e6227241fb457b8f8bTed Kremenek // FIXME: Compute lvalue of fields. 15025aac0b6ae95f137b1783f3e6227241fb457b8f8bTed Kremenek Bldr.generateNode(Ex, Pred, state->BindExpr(Ex, LCtx, UnknownVal()), 15035aac0b6ae95f137b1783f3e6227241fb457b8f8bTed Kremenek false, 0, ProgramPoint::PostLValueKind); 15045aac0b6ae95f137b1783f3e6227241fb457b8f8bTed Kremenek return; 15055aac0b6ae95f137b1783f3e6227241fb457b8f8bTed Kremenek } 15065aac0b6ae95f137b1783f3e6227241fb457b8f8bTed Kremenek 15076d69b5d82281992e981caa9bc038e3f6cac6594aZhongxing Xu assert (false && 15086d69b5d82281992e981caa9bc038e3f6cac6594aZhongxing Xu "ValueDecl support for this ValueDecl not implemented."); 15093271f8d315712885ac87747369bb1d9f4b1ea81fTed Kremenek} 15103271f8d315712885ac87747369bb1d9f4b1ea81fTed Kremenek 1511540cbe2b60294fe7b926c26b4f1840f544fe3011Ted Kremenek/// VisitArraySubscriptExpr - Transfer function for array accesses 15129c378f705405d37f49795d5e915989de774fe11fTed Kremenekvoid ExprEngine::VisitLvalArraySubscriptExpr(const ArraySubscriptExpr *A, 15139c378f705405d37f49795d5e915989de774fe11fTed Kremenek ExplodedNode *Pred, 15149c378f705405d37f49795d5e915989de774fe11fTed Kremenek ExplodedNodeSet &Dst){ 15151eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 15169c378f705405d37f49795d5e915989de774fe11fTed Kremenek const Expr *Base = A->getBase()->IgnoreParens(); 15179c378f705405d37f49795d5e915989de774fe11fTed Kremenek const Expr *Idx = A->getIdx()->IgnoreParens(); 1518892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek 15191eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 15208f3407ef22bc7efe6ca4169381e09d0d657ec192Ted Kremenek ExplodedNodeSet checkerPreStmt; 15218f3407ef22bc7efe6ca4169381e09d0d657ec192Ted Kremenek getCheckerManager().runCheckersForPreStmt(checkerPreStmt, Pred, A, *this); 15228f3407ef22bc7efe6ca4169381e09d0d657ec192Ted Kremenek 1523aa0aeb1cbe117db68d35700cb3a34aace0f99b99Anna Zaks StmtNodeBuilder Bldr(checkerPreStmt, Dst, *currentBuilderContext); 1524ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks 15258f3407ef22bc7efe6ca4169381e09d0d657ec192Ted Kremenek for (ExplodedNodeSet::iterator it = checkerPreStmt.begin(), 15268f3407ef22bc7efe6ca4169381e09d0d657ec192Ted Kremenek ei = checkerPreStmt.end(); it != ei; ++it) { 15275eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek const LocationContext *LCtx = (*it)->getLocationContext(); 15288bef8238181a30e52dea380789a7e2d760eac532Ted Kremenek ProgramStateRef state = (*it)->getState(); 15295eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek SVal V = state->getLValue(A->getType(), 15305eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek state->getSVal(Idx, LCtx), 15315eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek state->getSVal(Base, LCtx)); 1532591b5f53c0e11d87401b4804bb1be1a53f95c619Anna Zaks assert(A->isGLValue()); 15335eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek Bldr.generateNode(A, *it, state->BindExpr(A, LCtx, V), 1534ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks false, 0, ProgramPoint::PostLValueKind); 15351b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek } 1536540cbe2b60294fe7b926c26b4f1840f544fe3011Ted Kremenek} 1537540cbe2b60294fe7b926c26b4f1840f544fe3011Ted Kremenek 1538469ecbded3616416ef938ed94a67f86149faf226Ted Kremenek/// VisitMemberExpr - Transfer function for member expressions. 15399c378f705405d37f49795d5e915989de774fe11fTed Kremenekvoid ExprEngine::VisitMemberExpr(const MemberExpr *M, ExplodedNode *Pred, 15406889679d72859960e0fc8d1080487f63c4df1e0aAnna Zaks ExplodedNodeSet &TopDst) { 15411eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 15426889679d72859960e0fc8d1080487f63c4df1e0aAnna Zaks StmtNodeBuilder Bldr(Pred, TopDst, *currentBuilderContext); 15436889679d72859960e0fc8d1080487f63c4df1e0aAnna Zaks ExplodedNodeSet Dst; 15445bd04952d4ae7ca894f583583208f0cec4735a90Ted Kremenek Decl *member = M->getMemberDecl(); 154510f77ad7fc5e5cf3f37a9b14ff5843468b8b84d2Ted Kremenek 15465bd04952d4ae7ca894f583583208f0cec4735a90Ted Kremenek if (VarDecl *VD = dyn_cast<VarDecl>(member)) { 1547591b5f53c0e11d87401b4804bb1be1a53f95c619Anna Zaks assert(M->isGLValue()); 1548ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.takeNodes(Pred); 15495bd04952d4ae7ca894f583583208f0cec4735a90Ted Kremenek VisitCommonDeclRefExpr(M, VD, Pred, Dst); 1550ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.addNodes(Dst); 15515bd04952d4ae7ca894f583583208f0cec4735a90Ted Kremenek return; 15525bd04952d4ae7ca894f583583208f0cec4735a90Ted Kremenek } 155310f77ad7fc5e5cf3f37a9b14ff5843468b8b84d2Ted Kremenek 155410f77ad7fc5e5cf3f37a9b14ff5843468b8b84d2Ted Kremenek // Handle C++ method calls. 155510f77ad7fc5e5cf3f37a9b14ff5843468b8b84d2Ted Kremenek if (const CXXMethodDecl *MD = dyn_cast<CXXMethodDecl>(member)) { 155610f77ad7fc5e5cf3f37a9b14ff5843468b8b84d2Ted Kremenek Bldr.takeNodes(Pred); 155710f77ad7fc5e5cf3f37a9b14ff5843468b8b84d2Ted Kremenek SVal MDVal = svalBuilder.getFunctionPointer(MD); 155810f77ad7fc5e5cf3f37a9b14ff5843468b8b84d2Ted Kremenek ProgramStateRef state = 155910f77ad7fc5e5cf3f37a9b14ff5843468b8b84d2Ted Kremenek Pred->getState()->BindExpr(M, Pred->getLocationContext(), MDVal); 156010f77ad7fc5e5cf3f37a9b14ff5843468b8b84d2Ted Kremenek Bldr.generateNode(M, Pred, state); 156110f77ad7fc5e5cf3f37a9b14ff5843468b8b84d2Ted Kremenek return; 156210f77ad7fc5e5cf3f37a9b14ff5843468b8b84d2Ted Kremenek } 156310f77ad7fc5e5cf3f37a9b14ff5843468b8b84d2Ted Kremenek 156410f77ad7fc5e5cf3f37a9b14ff5843468b8b84d2Ted Kremenek 15655bd04952d4ae7ca894f583583208f0cec4735a90Ted Kremenek FieldDecl *field = dyn_cast<FieldDecl>(member); 1566892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek if (!field) // FIXME: skipping member expressions for non-fields 156786f194083504938df72135b5b66bf0c5cafd9498Douglas Gregor return; 156886f194083504938df72135b5b66bf0c5cafd9498Douglas Gregor 1569e3939d7446959afb6b650fe08e952d0f64ab6794Ted Kremenek Expr *baseExpr = M->getBase()->IgnoreParens(); 15708bef8238181a30e52dea380789a7e2d760eac532Ted Kremenek ProgramStateRef state = Pred->getState(); 15715eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek const LocationContext *LCtx = Pred->getLocationContext(); 15725eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek SVal baseExprVal = state->getSVal(baseExpr, Pred->getLocationContext()); 1573e3939d7446959afb6b650fe08e952d0f64ab6794Ted Kremenek if (isa<nonloc::LazyCompoundVal>(baseExprVal) || 1574e3939d7446959afb6b650fe08e952d0f64ab6794Ted Kremenek isa<nonloc::CompoundVal>(baseExprVal) || 1575e3939d7446959afb6b650fe08e952d0f64ab6794Ted Kremenek // FIXME: This can originate by conjuring a symbol for an unknown 1576e3939d7446959afb6b650fe08e952d0f64ab6794Ted Kremenek // temporary struct object, see test/Analysis/fields.c: 1577e3939d7446959afb6b650fe08e952d0f64ab6794Ted Kremenek // (p = getit()).x 1578e3939d7446959afb6b650fe08e952d0f64ab6794Ted Kremenek isa<nonloc::SymbolVal>(baseExprVal)) { 15795eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek Bldr.generateNode(M, Pred, state->BindExpr(M, LCtx, UnknownVal())); 1580e3939d7446959afb6b650fe08e952d0f64ab6794Ted Kremenek return; 1581e3939d7446959afb6b650fe08e952d0f64ab6794Ted Kremenek } 1582892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek 1583e3939d7446959afb6b650fe08e952d0f64ab6794Ted Kremenek // FIXME: Should we insert some assumption logic in here to determine 1584e3939d7446959afb6b650fe08e952d0f64ab6794Ted Kremenek // if "Base" is a valid piece of memory? Before we put this assumption 1585e3939d7446959afb6b650fe08e952d0f64ab6794Ted Kremenek // later when using FieldOffset lvals (which we no longer have). 1586d9bc33efa195114d6f2a365c26e5b8dba4e1cc38Ted Kremenek 1587e3939d7446959afb6b650fe08e952d0f64ab6794Ted Kremenek // For all other cases, compute an lvalue. 1588e3939d7446959afb6b650fe08e952d0f64ab6794Ted Kremenek SVal L = state->getLValue(field, baseExprVal); 1589719b429e3ed660cfd9cce88397b29c695a25fa50Anna Zaks if (M->isGLValue()) 15905eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek Bldr.generateNode(M, Pred, state->BindExpr(M, LCtx, L), false, 0, 1591ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks ProgramPoint::PostLValueKind); 1592ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks else { 1593ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.takeNodes(Pred); 1594bd613137499b1d4c3b63dccd0aa21f6add243f4fTed Kremenek evalLoad(Dst, M, M, Pred, state, L); 1595ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.addNodes(Dst); 1596ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks } 1597469ecbded3616416ef938ed94a67f86149faf226Ted Kremenek} 1598469ecbded3616416ef938ed94a67f86149faf226Ted Kremenek 15999c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek/// evalBind - Handle the semantics of binding a value to a specific location. 16009c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek/// This method is used by evalStore and (soon) VisitDeclStmt, and others. 16019c378f705405d37f49795d5e915989de774fe11fTed Kremenekvoid ExprEngine::evalBind(ExplodedNodeSet &Dst, const Stmt *StoreE, 160293bd5ca766c4d7906878f4ffe76ce1b2080e540bJordy Rose ExplodedNode *Pred, 16033d7c44e01d568e5d5c0fac9c6ccb3f080157ba19Anna Zaks SVal location, SVal Val, bool atDeclInit) { 1604b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 1605b107c4b7efb907d75620cd3c17f82fe27dc5b745Ted Kremenek // Do a previsit of the bind. 1606fe27971d54d26997149d6b84057f04ff398d1d5dJordy Rose ExplodedNodeSet CheckedSet; 1607fe27971d54d26997149d6b84057f04ff398d1d5dJordy Rose getCheckerManager().runCheckersForBind(CheckedSet, Pred, location, Val, 16083d7c44e01d568e5d5c0fac9c6ccb3f080157ba19Anna Zaks StoreE, *this, 16093d7c44e01d568e5d5c0fac9c6ccb3f080157ba19Anna Zaks ProgramPoint::PostStmtKind); 1610b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 16116b6152ba96c164a292cc0b8d8b1d4cecbec27a60Anna Zaks ExplodedNodeSet TmpDst; 1612aa0aeb1cbe117db68d35700cb3a34aace0f99b99Anna Zaks StmtNodeBuilder Bldr(CheckedSet, TmpDst, *currentBuilderContext); 16136b6152ba96c164a292cc0b8d8b1d4cecbec27a60Anna Zaks 16143d7c44e01d568e5d5c0fac9c6ccb3f080157ba19Anna Zaks const LocationContext *LC = Pred->getLocationContext(); 1615b107c4b7efb907d75620cd3c17f82fe27dc5b745Ted Kremenek for (ExplodedNodeSet::iterator I = CheckedSet.begin(), E = CheckedSet.end(); 1616b107c4b7efb907d75620cd3c17f82fe27dc5b745Ted Kremenek I!=E; ++I) { 16173d7c44e01d568e5d5c0fac9c6ccb3f080157ba19Anna Zaks ExplodedNode *PredI = *I; 16183d7c44e01d568e5d5c0fac9c6ccb3f080157ba19Anna Zaks ProgramStateRef state = PredI->getState(); 1619a8538d902fce9cfec20f39b34492268b51643819Ted Kremenek 1620b107c4b7efb907d75620cd3c17f82fe27dc5b745Ted Kremenek if (atDeclInit) { 1621b107c4b7efb907d75620cd3c17f82fe27dc5b745Ted Kremenek const VarRegion *VR = 1622b107c4b7efb907d75620cd3c17f82fe27dc5b745Ted Kremenek cast<VarRegion>(cast<loc::MemRegionVal>(location).getRegion()); 1623f6f56d4fc8ebce17e7b83eb2c35f57a055c22283Ted Kremenek 1624fe27971d54d26997149d6b84057f04ff398d1d5dJordy Rose state = state->bindDecl(VR, Val); 1625fe27971d54d26997149d6b84057f04ff398d1d5dJordy Rose } else { 1626fe27971d54d26997149d6b84057f04ff398d1d5dJordy Rose state = state->bindLoc(location, Val); 1627f6f56d4fc8ebce17e7b83eb2c35f57a055c22283Ted Kremenek } 16281eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 16293d7c44e01d568e5d5c0fac9c6ccb3f080157ba19Anna Zaks const MemRegion *LocReg = 0; 16303d7c44e01d568e5d5c0fac9c6ccb3f080157ba19Anna Zaks if (loc::MemRegionVal *LocRegVal = dyn_cast<loc::MemRegionVal>(&location)) 16313d7c44e01d568e5d5c0fac9c6ccb3f080157ba19Anna Zaks LocReg = LocRegVal->getRegion(); 16323d7c44e01d568e5d5c0fac9c6ccb3f080157ba19Anna Zaks 16333d7c44e01d568e5d5c0fac9c6ccb3f080157ba19Anna Zaks const ProgramPoint L = PostStore(StoreE, LC, LocReg, 0); 16343d7c44e01d568e5d5c0fac9c6ccb3f080157ba19Anna Zaks Bldr.generateNode(L, PredI, state, false); 1635b107c4b7efb907d75620cd3c17f82fe27dc5b745Ted Kremenek } 1636ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks 16376b6152ba96c164a292cc0b8d8b1d4cecbec27a60Anna Zaks Dst.insert(TmpDst); 1638a8538d902fce9cfec20f39b34492268b51643819Ted Kremenek} 1639a8538d902fce9cfec20f39b34492268b51643819Ted Kremenek 16409c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek/// evalStore - Handle the semantics of a store via an assignment. 1641a8538d902fce9cfec20f39b34492268b51643819Ted Kremenek/// @param Dst The node set to store generated state nodes 16422e6f5b823912ae76211427cb8684c9eaa6e53a1fJames Dennett/// @param AssignE The assignment expression if the store happens in an 1643e8a4d7d0064b357a30fe7ee4f2ddc02f9ffc0357Zhongxing Xu/// assignment. 16442e6f5b823912ae76211427cb8684c9eaa6e53a1fJames Dennett/// @param LocationE The location expression that is stored to. 1645a8538d902fce9cfec20f39b34492268b51643819Ted Kremenek/// @param state The current simulation state 1646a8538d902fce9cfec20f39b34492268b51643819Ted Kremenek/// @param location The location to store the value 1647a8538d902fce9cfec20f39b34492268b51643819Ted Kremenek/// @param Val The value to be stored 16489c378f705405d37f49795d5e915989de774fe11fTed Kremenekvoid ExprEngine::evalStore(ExplodedNodeSet &Dst, const Expr *AssignE, 16499c378f705405d37f49795d5e915989de774fe11fTed Kremenek const Expr *LocationE, 16509c378f705405d37f49795d5e915989de774fe11fTed Kremenek ExplodedNode *Pred, 16518bef8238181a30e52dea380789a7e2d760eac532Ted Kremenek ProgramStateRef state, SVal location, SVal Val, 1652ca804539d908d3a0e8c72a0df5f1f571d29490bbTed Kremenek const ProgramPointTag *tag) { 165314429b918bd2f4cb52abc75546a7fe37142054caArgyrios Kyrtzidis // Proceed with the store. We use AssignE as the anchor for the PostStore 165414429b918bd2f4cb52abc75546a7fe37142054caArgyrios Kyrtzidis // ProgramPoint if it is non-NULL, and LocationE otherwise. 165514429b918bd2f4cb52abc75546a7fe37142054caArgyrios Kyrtzidis const Expr *StoreE = AssignE ? AssignE : LocationE; 165614429b918bd2f4cb52abc75546a7fe37142054caArgyrios Kyrtzidis 165714429b918bd2f4cb52abc75546a7fe37142054caArgyrios Kyrtzidis if (isa<loc::ObjCPropRef>(location)) { 1658b673a41c92aa276f2e37164d0747be1cfb0c402bTed Kremenek assert(false); 165914429b918bd2f4cb52abc75546a7fe37142054caArgyrios Kyrtzidis } 166014429b918bd2f4cb52abc75546a7fe37142054caArgyrios Kyrtzidis 16611b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek // Evaluate the location (checks for bad dereferences). 1662b4b817d704287836b52b34369009e682f208aa2bTed Kremenek ExplodedNodeSet Tmp; 1663bd613137499b1d4c3b63dccd0aa21f6add243f4fTed Kremenek evalLocation(Tmp, AssignE, LocationE, Pred, state, location, tag, false); 16641eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1665b4b817d704287836b52b34369009e682f208aa2bTed Kremenek if (Tmp.empty()) 16661b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek return; 1667b0533965f1b4db020692e3b23ca7b3bc15bf5897Ted Kremenek 166873c498a08f4968b6987d1453c7b77929dcc6d5f7Argyrios Kyrtzidis if (location.isUndef()) 166973c498a08f4968b6987d1453c7b77929dcc6d5f7Argyrios Kyrtzidis return; 1670a8538d902fce9cfec20f39b34492268b51643819Ted Kremenek 1671b4b817d704287836b52b34369009e682f208aa2bTed Kremenek for (ExplodedNodeSet::iterator NI=Tmp.begin(), NE=Tmp.end(); NI!=NE; ++NI) 16723d7c44e01d568e5d5c0fac9c6ccb3f080157ba19Anna Zaks evalBind(Dst, StoreE, *NI, location, Val, false); 16731b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek} 16741b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek 1675bd613137499b1d4c3b63dccd0aa21f6add243f4fTed Kremenekvoid ExprEngine::evalLoad(ExplodedNodeSet &Dst, 1676bd613137499b1d4c3b63dccd0aa21f6add243f4fTed Kremenek const Expr *NodeEx, 1677bd613137499b1d4c3b63dccd0aa21f6add243f4fTed Kremenek const Expr *BoundEx, 1678bd613137499b1d4c3b63dccd0aa21f6add243f4fTed Kremenek ExplodedNode *Pred, 1679bd613137499b1d4c3b63dccd0aa21f6add243f4fTed Kremenek ProgramStateRef state, 1680bd613137499b1d4c3b63dccd0aa21f6add243f4fTed Kremenek SVal location, 1681bd613137499b1d4c3b63dccd0aa21f6add243f4fTed Kremenek const ProgramPointTag *tag, 1682bd613137499b1d4c3b63dccd0aa21f6add243f4fTed Kremenek QualType LoadTy) 1683bd613137499b1d4c3b63dccd0aa21f6add243f4fTed Kremenek{ 1684cca8ab155e8c20b98ba2d90eb2b1c228895e06fdZhanyong Wan assert(!isa<NonLoc>(location) && "location cannot be a NonLoc."); 1685bd613137499b1d4c3b63dccd0aa21f6add243f4fTed Kremenek assert(!isa<loc::ObjCPropRef>(location)); 168614429b918bd2f4cb52abc75546a7fe37142054caArgyrios Kyrtzidis 16875b8c69494881b7d35bc6244b4a19be0cc2eab368Jordan Rose // Are we loading from a region? This actually results in two loads; one 1688852274d4257134906995cb252fb3dfd2d71deae8Ted Kremenek // to fetch the address of the referenced value and one to fetch the 1689852274d4257134906995cb252fb3dfd2d71deae8Ted Kremenek // referenced value. 16909697934650354bed2e509d8e7e44f21a1fb00f76Ted Kremenek if (const TypedValueRegion *TR = 16919697934650354bed2e509d8e7e44f21a1fb00f76Ted Kremenek dyn_cast_or_null<TypedValueRegion>(location.getAsRegion())) { 1692b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 1693018220c343c103b7dfaa117a7a474c7a7fd6d068Zhongxing Xu QualType ValTy = TR->getValueType(); 1694852274d4257134906995cb252fb3dfd2d71deae8Ted Kremenek if (const ReferenceType *RT = ValTy->getAs<ReferenceType>()) { 1695ca804539d908d3a0e8c72a0df5f1f571d29490bbTed Kremenek static SimpleProgramPointTag 1696ca804539d908d3a0e8c72a0df5f1f571d29490bbTed Kremenek loadReferenceTag("ExprEngine : Load Reference"); 1697852274d4257134906995cb252fb3dfd2d71deae8Ted Kremenek ExplodedNodeSet Tmp; 1698bd613137499b1d4c3b63dccd0aa21f6add243f4fTed Kremenek evalLoadCommon(Tmp, NodeEx, BoundEx, Pred, state, 1699bd613137499b1d4c3b63dccd0aa21f6add243f4fTed Kremenek location, &loadReferenceTag, 1700852274d4257134906995cb252fb3dfd2d71deae8Ted Kremenek getContext().getPointerType(RT->getPointeeType())); 1701852274d4257134906995cb252fb3dfd2d71deae8Ted Kremenek 1702852274d4257134906995cb252fb3dfd2d71deae8Ted Kremenek // Perform the load from the referenced value. 1703852274d4257134906995cb252fb3dfd2d71deae8Ted Kremenek for (ExplodedNodeSet::iterator I=Tmp.begin(), E=Tmp.end() ; I!=E; ++I) { 1704db5e8cd095d1ffdd18f5620ad2348b5f386bebe3Anna Zaks state = (*I)->getState(); 1705bd613137499b1d4c3b63dccd0aa21f6add243f4fTed Kremenek location = state->getSVal(BoundEx, (*I)->getLocationContext()); 1706bd613137499b1d4c3b63dccd0aa21f6add243f4fTed Kremenek evalLoadCommon(Dst, NodeEx, BoundEx, *I, state, location, tag, LoadTy); 1707b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek } 1708852274d4257134906995cb252fb3dfd2d71deae8Ted Kremenek return; 1709852274d4257134906995cb252fb3dfd2d71deae8Ted Kremenek } 1710852274d4257134906995cb252fb3dfd2d71deae8Ted Kremenek } 1711b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 1712bd613137499b1d4c3b63dccd0aa21f6add243f4fTed Kremenek evalLoadCommon(Dst, NodeEx, BoundEx, Pred, state, location, tag, LoadTy); 1713852274d4257134906995cb252fb3dfd2d71deae8Ted Kremenek} 1714852274d4257134906995cb252fb3dfd2d71deae8Ted Kremenek 1715bd613137499b1d4c3b63dccd0aa21f6add243f4fTed Kremenekvoid ExprEngine::evalLoadCommon(ExplodedNodeSet &Dst, 1716bd613137499b1d4c3b63dccd0aa21f6add243f4fTed Kremenek const Expr *NodeEx, 1717bd613137499b1d4c3b63dccd0aa21f6add243f4fTed Kremenek const Expr *BoundEx, 1718bd613137499b1d4c3b63dccd0aa21f6add243f4fTed Kremenek ExplodedNode *Pred, 1719bd613137499b1d4c3b63dccd0aa21f6add243f4fTed Kremenek ProgramStateRef state, 1720bd613137499b1d4c3b63dccd0aa21f6add243f4fTed Kremenek SVal location, 1721bd613137499b1d4c3b63dccd0aa21f6add243f4fTed Kremenek const ProgramPointTag *tag, 1722bd613137499b1d4c3b63dccd0aa21f6add243f4fTed Kremenek QualType LoadTy) { 1723bd613137499b1d4c3b63dccd0aa21f6add243f4fTed Kremenek assert(NodeEx); 1724bd613137499b1d4c3b63dccd0aa21f6add243f4fTed Kremenek assert(BoundEx); 17251eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump // Evaluate the location (checks for bad dereferences). 1726b4b817d704287836b52b34369009e682f208aa2bTed Kremenek ExplodedNodeSet Tmp; 1727bd613137499b1d4c3b63dccd0aa21f6add243f4fTed Kremenek evalLocation(Tmp, NodeEx, BoundEx, Pred, state, location, tag, true); 1728b4b817d704287836b52b34369009e682f208aa2bTed Kremenek if (Tmp.empty()) 17291b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek return; 1730b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 1731aa0aeb1cbe117db68d35700cb3a34aace0f99b99Anna Zaks StmtNodeBuilder Bldr(Tmp, Dst, *currentBuilderContext); 173273c498a08f4968b6987d1453c7b77929dcc6d5f7Argyrios Kyrtzidis if (location.isUndef()) 173373c498a08f4968b6987d1453c7b77929dcc6d5f7Argyrios Kyrtzidis return; 1734b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 17351b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek // Proceed with the load. 1736b4b817d704287836b52b34369009e682f208aa2bTed Kremenek for (ExplodedNodeSet::iterator NI=Tmp.begin(), NE=Tmp.end(); NI!=NE; ++NI) { 1737db5e8cd095d1ffdd18f5620ad2348b5f386bebe3Anna Zaks state = (*NI)->getState(); 17385eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek const LocationContext *LCtx = (*NI)->getLocationContext(); 173996ebad66c451d79c9f57b1edb31efaeeb23b9a01Ted Kremenek 1740b4b817d704287836b52b34369009e682f208aa2bTed Kremenek if (location.isUnknown()) { 1741b4b817d704287836b52b34369009e682f208aa2bTed Kremenek // This is important. We must nuke the old binding. 1742bd613137499b1d4c3b63dccd0aa21f6add243f4fTed Kremenek Bldr.generateNode(NodeEx, *NI, 1743bd613137499b1d4c3b63dccd0aa21f6add243f4fTed Kremenek state->BindExpr(BoundEx, LCtx, UnknownVal()), 1744bd613137499b1d4c3b63dccd0aa21f6add243f4fTed Kremenek false, tag, 1745bd613137499b1d4c3b63dccd0aa21f6add243f4fTed Kremenek ProgramPoint::PostLoadKind); 1746b4b817d704287836b52b34369009e682f208aa2bTed Kremenek } 1747b4b817d704287836b52b34369009e682f208aa2bTed Kremenek else { 174896ebad66c451d79c9f57b1edb31efaeeb23b9a01Ted Kremenek if (LoadTy.isNull()) 1749bd613137499b1d4c3b63dccd0aa21f6add243f4fTed Kremenek LoadTy = BoundEx->getType(); 175096ebad66c451d79c9f57b1edb31efaeeb23b9a01Ted Kremenek SVal V = state->getSVal(cast<Loc>(location), LoadTy); 1751bd613137499b1d4c3b63dccd0aa21f6add243f4fTed Kremenek Bldr.generateNode(NodeEx, *NI, 1752bd613137499b1d4c3b63dccd0aa21f6add243f4fTed Kremenek state->bindExprAndLocation(BoundEx, LCtx, location, V), 1753ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks false, tag, ProgramPoint::PostLoadKind); 1754b4b817d704287836b52b34369009e682f208aa2bTed Kremenek } 1755d5b499d43c3526fae7f9ebb6e2d50e79d3496cedZhongxing Xu } 17561b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek} 17571b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek 1758bd613137499b1d4c3b63dccd0aa21f6add243f4fTed Kremenekvoid ExprEngine::evalLocation(ExplodedNodeSet &Dst, 1759bd613137499b1d4c3b63dccd0aa21f6add243f4fTed Kremenek const Stmt *NodeEx, 1760bd613137499b1d4c3b63dccd0aa21f6add243f4fTed Kremenek const Stmt *BoundEx, 1761bd613137499b1d4c3b63dccd0aa21f6add243f4fTed Kremenek ExplodedNode *Pred, 1762bd613137499b1d4c3b63dccd0aa21f6add243f4fTed Kremenek ProgramStateRef state, 1763bd613137499b1d4c3b63dccd0aa21f6add243f4fTed Kremenek SVal location, 1764bd613137499b1d4c3b63dccd0aa21f6add243f4fTed Kremenek const ProgramPointTag *tag, 1765bd613137499b1d4c3b63dccd0aa21f6add243f4fTed Kremenek bool isLoad) { 1766aa0aeb1cbe117db68d35700cb3a34aace0f99b99Anna Zaks StmtNodeBuilder BldrTop(Pred, Dst, *currentBuilderContext); 176700b1ad2d56f3e39f95c3f61bf511a531ab6a4fa5Zhongxing Xu // Early checks for performance reason. 1768769ce3e93ad35bd9ac28e4d8b8f035ae4fd9a5b5Argyrios Kyrtzidis if (location.isUnknown()) { 1769b4b817d704287836b52b34369009e682f208aa2bTed Kremenek return; 1770b4b817d704287836b52b34369009e682f208aa2bTed Kremenek } 1771b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 17729c0d6891b3ec4b0d20b8a295946c0dc5426d147cArgyrios Kyrtzidis ExplodedNodeSet Src; 1773ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks BldrTop.takeNodes(Pred); 1774aa0aeb1cbe117db68d35700cb3a34aace0f99b99Anna Zaks StmtNodeBuilder Bldr(Pred, Src, *currentBuilderContext); 1775ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks if (Pred->getState() != state) { 1776eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis // Associate this new state with an ExplodedNode. 1777eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis // FIXME: If I pass null tag, the graph is incorrect, e.g for 1778eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis // int *p; 1779eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis // p = 0; 1780eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis // *p = 0xDEADBEEF; 1781eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis // "p = 0" is not noted as "Null pointer value stored to 'p'" but 1782eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis // instead "int *p" is noted as 1783eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis // "Variable 'p' initialized to a null pointer value" 1784ca804539d908d3a0e8c72a0df5f1f571d29490bbTed Kremenek 1785ca804539d908d3a0e8c72a0df5f1f571d29490bbTed Kremenek // FIXME: why is 'tag' not used instead of etag? 1786ca804539d908d3a0e8c72a0df5f1f571d29490bbTed Kremenek static SimpleProgramPointTag etag("ExprEngine: Location"); 1787bd613137499b1d4c3b63dccd0aa21f6add243f4fTed Kremenek Bldr.generateNode(NodeEx, Pred, state, false, &etag); 17880296c22557b3735e2ffeff690eb46fb0e9152bccTed Kremenek } 1789ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks ExplodedNodeSet Tmp; 1790bd613137499b1d4c3b63dccd0aa21f6add243f4fTed Kremenek getCheckerManager().runCheckersForLocation(Tmp, Src, location, isLoad, 1791bd613137499b1d4c3b63dccd0aa21f6add243f4fTed Kremenek NodeEx, BoundEx, *this); 1792ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks BldrTop.addNodes(Tmp); 1793ec96a2d52d16e150baaf629cd35e3fabff5d8915Ted Kremenek} 1794ec96a2d52d16e150baaf629cd35e3fabff5d8915Ted Kremenek 17956c7511db998817e64f2e124013e7d7c9a430c580Ted Kremenekstd::pair<const ProgramPointTag *, const ProgramPointTag*> 17966c7511db998817e64f2e124013e7d7c9a430c580Ted KremenekExprEngine::getEagerlyAssumeTags() { 17976c7511db998817e64f2e124013e7d7c9a430c580Ted Kremenek static SimpleProgramPointTag 17986c7511db998817e64f2e124013e7d7c9a430c580Ted Kremenek EagerlyAssumeTrue("ExprEngine : Eagerly Assume True"), 17996c7511db998817e64f2e124013e7d7c9a430c580Ted Kremenek EagerlyAssumeFalse("ExprEngine : Eagerly Assume False"); 18006c7511db998817e64f2e124013e7d7c9a430c580Ted Kremenek return std::make_pair(&EagerlyAssumeTrue, &EagerlyAssumeFalse); 18016c7511db998817e64f2e124013e7d7c9a430c580Ted Kremenek} 18026c7511db998817e64f2e124013e7d7c9a430c580Ted Kremenek 1803d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidisvoid ExprEngine::evalEagerlyAssume(ExplodedNodeSet &Dst, ExplodedNodeSet &Src, 18046800ba622e4edf287801ac69c42c61e7e294b06bAnna Zaks const Expr *Ex) { 1805aa0aeb1cbe117db68d35700cb3a34aace0f99b99Anna Zaks StmtNodeBuilder Bldr(Src, Dst, *currentBuilderContext); 180686b39f20d5091ca3fdcbeb4a22766aaffdf6ac35Ted Kremenek 1807031ccc0555a82afc2e8afe29e19dd57ff204e2deZhongxing Xu for (ExplodedNodeSet::iterator I=Src.begin(), E=Src.end(); I!=E; ++I) { 1808031ccc0555a82afc2e8afe29e19dd57ff204e2deZhongxing Xu ExplodedNode *Pred = *I; 1809b293902c5cfa18365ffb0e00763849c9808a2ad1Ted Kremenek // Test if the previous node was as the same expression. This can happen 1810b293902c5cfa18365ffb0e00763849c9808a2ad1Ted Kremenek // when the expression fails to evaluate to anything meaningful and 1811b293902c5cfa18365ffb0e00763849c9808a2ad1Ted Kremenek // (as an optimization) we don't generate a node. 18121eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump ProgramPoint P = Pred->getLocation(); 1813b293902c5cfa18365ffb0e00763849c9808a2ad1Ted Kremenek if (!isa<PostStmt>(P) || cast<PostStmt>(P).getStmt() != Ex) { 1814b293902c5cfa18365ffb0e00763849c9808a2ad1Ted Kremenek continue; 18151eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump } 1816b293902c5cfa18365ffb0e00763849c9808a2ad1Ted Kremenek 18178bef8238181a30e52dea380789a7e2d760eac532Ted Kremenek ProgramStateRef state = Pred->getState(); 18185eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek SVal V = state->getSVal(Ex, Pred->getLocationContext()); 18195344baa704f42b22d9df25c24ffbbf6b4716603bAnna Zaks nonloc::SymbolVal *SEV = dyn_cast<nonloc::SymbolVal>(&V); 18205344baa704f42b22d9df25c24ffbbf6b4716603bAnna Zaks if (SEV && SEV->isExpression()) { 18216c7511db998817e64f2e124013e7d7c9a430c580Ted Kremenek const std::pair<const ProgramPointTag *, const ProgramPointTag*> &tags = 18226c7511db998817e64f2e124013e7d7c9a430c580Ted Kremenek getEagerlyAssumeTags(); 18236c7511db998817e64f2e124013e7d7c9a430c580Ted Kremenek 182448af2a9c1ed3259512f2d1431720add1fbe8fb5fTed Kremenek // First assume that the condition is true. 18258bef8238181a30e52dea380789a7e2d760eac532Ted Kremenek if (ProgramStateRef StateTrue = state->assume(*SEV, true)) { 182686b39f20d5091ca3fdcbeb4a22766aaffdf6ac35Ted Kremenek SVal Val = svalBuilder.makeIntVal(1U, Ex->getType()); 18275eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek StateTrue = StateTrue->BindExpr(Ex, Pred->getLocationContext(), Val); 1828ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.generateNode(Ex, Pred, StateTrue, false, tags.first); 182948af2a9c1ed3259512f2d1431720add1fbe8fb5fTed Kremenek } 18301eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 183148af2a9c1ed3259512f2d1431720add1fbe8fb5fTed Kremenek // Next, assume that the condition is false. 18328bef8238181a30e52dea380789a7e2d760eac532Ted Kremenek if (ProgramStateRef StateFalse = state->assume(*SEV, false)) { 183386b39f20d5091ca3fdcbeb4a22766aaffdf6ac35Ted Kremenek SVal Val = svalBuilder.makeIntVal(0U, Ex->getType()); 18345eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek StateFalse = StateFalse->BindExpr(Ex, Pred->getLocationContext(), Val); 1835ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.generateNode(Ex, Pred, StateFalse, false, tags.second); 183648af2a9c1ed3259512f2d1431720add1fbe8fb5fTed Kremenek } 183748af2a9c1ed3259512f2d1431720add1fbe8fb5fTed Kremenek } 183848af2a9c1ed3259512f2d1431720add1fbe8fb5fTed Kremenek } 183948af2a9c1ed3259512f2d1431720add1fbe8fb5fTed Kremenek} 184048af2a9c1ed3259512f2d1431720add1fbe8fb5fTed Kremenek 18419c378f705405d37f49795d5e915989de774fe11fTed Kremenekvoid ExprEngine::VisitAsmStmt(const AsmStmt *A, ExplodedNode *Pred, 1842a81d3d434e6581ff354eaf5b2a3c25c75771a792Erik Verbruggen ExplodedNodeSet &Dst) { 1843a81d3d434e6581ff354eaf5b2a3c25c75771a792Erik Verbruggen StmtNodeBuilder Bldr(Pred, Dst, *currentBuilderContext); 1844a81d3d434e6581ff354eaf5b2a3c25c75771a792Erik Verbruggen // We have processed both the inputs and the outputs. All of the outputs 1845a81d3d434e6581ff354eaf5b2a3c25c75771a792Erik Verbruggen // should evaluate to Locs. Nuke all of their values. 18461eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1847a81d3d434e6581ff354eaf5b2a3c25c75771a792Erik Verbruggen // FIXME: Some day in the future it would be nice to allow a "plug-in" 1848a81d3d434e6581ff354eaf5b2a3c25c75771a792Erik Verbruggen // which interprets the inline asm and stores proper results in the 1849a81d3d434e6581ff354eaf5b2a3c25c75771a792Erik Verbruggen // outputs. 18501eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1851a81d3d434e6581ff354eaf5b2a3c25c75771a792Erik Verbruggen ProgramStateRef state = Pred->getState(); 18521eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1853a81d3d434e6581ff354eaf5b2a3c25c75771a792Erik Verbruggen for (AsmStmt::const_outputs_iterator OI = A->begin_outputs(), 1854a81d3d434e6581ff354eaf5b2a3c25c75771a792Erik Verbruggen OE = A->end_outputs(); OI != OE; ++OI) { 1855a81d3d434e6581ff354eaf5b2a3c25c75771a792Erik Verbruggen SVal X = state->getSVal(*OI, Pred->getLocationContext()); 1856a81d3d434e6581ff354eaf5b2a3c25c75771a792Erik Verbruggen assert (!isa<NonLoc>(X)); // Should be an Lval, or unknown, undef. 18571eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1858a81d3d434e6581ff354eaf5b2a3c25c75771a792Erik Verbruggen if (isa<Loc>(X)) 1859a81d3d434e6581ff354eaf5b2a3c25c75771a792Erik Verbruggen state = state->bindLoc(cast<Loc>(X), UnknownVal()); 1860ef44bfb9d0f15ba0391f8346c9f01355fb450a09Ted Kremenek } 18611eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1862a81d3d434e6581ff354eaf5b2a3c25c75771a792Erik Verbruggen Bldr.generateNode(A, Pred, state); 1863ef44bfb9d0f15ba0391f8346c9f01355fb450a09Ted Kremenek} 1864ef44bfb9d0f15ba0391f8346c9f01355fb450a09Ted Kremenek 18658cd64b4c5553fa6284d248336cb7c82dc960a394Chad Rosiervoid ExprEngine::VisitMSAsmStmt(const MSAsmStmt *A, ExplodedNode *Pred, 18668cd64b4c5553fa6284d248336cb7c82dc960a394Chad Rosier ExplodedNodeSet &Dst) { 18678cd64b4c5553fa6284d248336cb7c82dc960a394Chad Rosier StmtNodeBuilder Bldr(Pred, Dst, *currentBuilderContext); 18688cd64b4c5553fa6284d248336cb7c82dc960a394Chad Rosier Bldr.generateNode(A, Pred, Pred->getState()); 18698cd64b4c5553fa6284d248336cb7c82dc960a394Chad Rosier} 18708cd64b4c5553fa6284d248336cb7c82dc960a394Chad Rosier 1871094bef56a7900f13bb777f9a352704104b1458e7Ted Kremenek//===----------------------------------------------------------------------===// 1872e01c98767dfd7153c3c84637c36659e3bbe16ff7Ted Kremenek// Visualization. 1873ee98546b0d5f3439c4a590b0d7d1545af794a0ecTed Kremenek//===----------------------------------------------------------------------===// 1874ee98546b0d5f3439c4a590b0d7d1545af794a0ecTed Kremenek 1875aa66a32ba177338763cd0cf9df8310dfa2e24ff7Ted Kremenek#ifndef NDEBUG 1876d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidisstatic ExprEngine* GraphPrintCheckerState; 1877e97ca065c91ff9ca2a2a42eb443eaa553c40441cTed Kremenekstatic SourceManager* GraphPrintSourceManager; 18783b4f6702860208692f6ef28401e68de4e3ff9af9Ted Kremenek 1879aa66a32ba177338763cd0cf9df8310dfa2e24ff7Ted Kremeneknamespace llvm { 1880aa66a32ba177338763cd0cf9df8310dfa2e24ff7Ted Kremenektemplate<> 188147491f8b7adf9d42a404d44c073e8a5308fa6cfcDouglas Gregorstruct DOTGraphTraits<ExplodedNode*> : 1882aa66a32ba177338763cd0cf9df8310dfa2e24ff7Ted Kremenek public DefaultDOTGraphTraits { 1883006b0eb3e11162d8c06372db813ac9f71a7a16e8Tobias Grosser 1884006b0eb3e11162d8c06372db813ac9f71a7a16e8Tobias Grosser DOTGraphTraits (bool isSimple=false) : DefaultDOTGraphTraits(isSimple) {} 1885006b0eb3e11162d8c06372db813ac9f71a7a16e8Tobias Grosser 1886d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidis // FIXME: Since we do not cache error nodes in ExprEngine now, this does not 1887ec9227fea66c3439991fc84b0d33b0a8b4b8875eZhongxing Xu // work. 18889c378f705405d37f49795d5e915989de774fe11fTed Kremenek static std::string getNodeAttributes(const ExplodedNode *N, void*) { 18891eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 189010f51e8785e43d5a22acc2d2a638307c582949c2Ted Kremenek#if 0 189110f51e8785e43d5a22acc2d2a638307c582949c2Ted Kremenek // FIXME: Replace with a general scheme to tell if the node is 189210f51e8785e43d5a22acc2d2a638307c582949c2Ted Kremenek // an error node. 1893a3fadfcce5911742801a302cac82d4fe54d5c682Ted Kremenek if (GraphPrintCheckerState->isImplicitNullDeref(N) || 18949dca062461a6244cf0f733346657fa3eee853f9bTed Kremenek GraphPrintCheckerState->isExplicitNullDeref(N) || 18954a4e524afef40d6f3ddb25d0e407c814e4ca56a8Ted Kremenek GraphPrintCheckerState->isUndefDeref(N) || 18964a4e524afef40d6f3ddb25d0e407c814e4ca56a8Ted Kremenek GraphPrintCheckerState->isUndefStore(N) || 18974a4e524afef40d6f3ddb25d0e407c814e4ca56a8Ted Kremenek GraphPrintCheckerState->isUndefControlFlow(N) || 18985e03fcb5420c33207433dd6f800588e256dd9bdbTed Kremenek GraphPrintCheckerState->isUndefResult(N) || 18992ded35a576e3899553ea0ccfcbf5cbdb3d8cf664Ted Kremenek GraphPrintCheckerState->isBadCall(N) || 19002ded35a576e3899553ea0ccfcbf5cbdb3d8cf664Ted Kremenek GraphPrintCheckerState->isUndefArg(N)) 1901a3fadfcce5911742801a302cac82d4fe54d5c682Ted Kremenek return "color=\"red\",style=\"filled\""; 19021eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 19038cc13ea74fea1c04042a2f4087665bc5182e8408Ted Kremenek if (GraphPrintCheckerState->isNoReturnCall(N)) 19048cc13ea74fea1c04042a2f4087665bc5182e8408Ted Kremenek return "color=\"blue\",style=\"filled\""; 19052055effed54d614b51e3501a174c9b1fe92e4de4Zhongxing Xu#endif 1906a3fadfcce5911742801a302cac82d4fe54d5c682Ted Kremenek return ""; 1907a3fadfcce5911742801a302cac82d4fe54d5c682Ted Kremenek } 19081eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 190928038f33aa2db4833881fea757a1f0daf85ac02bJordan Rose static void printLocation(llvm::raw_ostream &Out, SourceLocation SLoc) { 191028038f33aa2db4833881fea757a1f0daf85ac02bJordan Rose if (SLoc.isFileID()) { 191128038f33aa2db4833881fea757a1f0daf85ac02bJordan Rose Out << "\\lline=" 191228038f33aa2db4833881fea757a1f0daf85ac02bJordan Rose << GraphPrintSourceManager->getExpansionLineNumber(SLoc) 191328038f33aa2db4833881fea757a1f0daf85ac02bJordan Rose << " col=" 191428038f33aa2db4833881fea757a1f0daf85ac02bJordan Rose << GraphPrintSourceManager->getExpansionColumnNumber(SLoc) 191528038f33aa2db4833881fea757a1f0daf85ac02bJordan Rose << "\\l"; 191628038f33aa2db4833881fea757a1f0daf85ac02bJordan Rose } 191728038f33aa2db4833881fea757a1f0daf85ac02bJordan Rose } 191828038f33aa2db4833881fea757a1f0daf85ac02bJordan Rose 19199c378f705405d37f49795d5e915989de774fe11fTed Kremenek static std::string getNodeLabel(const ExplodedNode *N, void*){ 19201eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 192153ba0b636194dbeaa65a6f85316c9397a0c5298bTed Kremenek std::string sbuf; 192253ba0b636194dbeaa65a6f85316c9397a0c5298bTed Kremenek llvm::raw_string_ostream Out(sbuf); 1923803c9edd06e8f936821525d36b1d8cc131e37d44Ted Kremenek 1924803c9edd06e8f936821525d36b1d8cc131e37d44Ted Kremenek // Program Location. 1925aa66a32ba177338763cd0cf9df8310dfa2e24ff7Ted Kremenek ProgramPoint Loc = N->getLocation(); 19261eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1927aa66a32ba177338763cd0cf9df8310dfa2e24ff7Ted Kremenek switch (Loc.getKind()) { 19280b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks case ProgramPoint::BlockEntranceKind: { 19291eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump Out << "Block Entrance: B" 1930aa66a32ba177338763cd0cf9df8310dfa2e24ff7Ted Kremenek << cast<BlockEntrance>(Loc).getBlock()->getBlockID(); 19310b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks if (const NamedDecl *ND = 19320b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks dyn_cast<NamedDecl>(Loc.getLocationContext()->getDecl())) { 19330b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks Out << " ("; 19340b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks ND->printName(Out); 19350b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks Out << ")"; 19360b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks } 1937aa66a32ba177338763cd0cf9df8310dfa2e24ff7Ted Kremenek break; 19380b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks } 19391eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1940aa66a32ba177338763cd0cf9df8310dfa2e24ff7Ted Kremenek case ProgramPoint::BlockExitKind: 1941aa66a32ba177338763cd0cf9df8310dfa2e24ff7Ted Kremenek assert (false); 1942aa66a32ba177338763cd0cf9df8310dfa2e24ff7Ted Kremenek break; 19431eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1944102acd5369bbb17c0d6ab868af376671acff7a93Douglas Gregor case ProgramPoint::CallEnterKind: 1945102acd5369bbb17c0d6ab868af376671acff7a93Douglas Gregor Out << "CallEnter"; 1946102acd5369bbb17c0d6ab868af376671acff7a93Douglas Gregor break; 1947102acd5369bbb17c0d6ab868af376671acff7a93Douglas Gregor 19480b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks case ProgramPoint::CallExitBeginKind: 19490b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks Out << "CallExitBegin"; 19500b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks break; 19510b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks 19520b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks case ProgramPoint::CallExitEndKind: 19530b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks Out << "CallExitEnd"; 19540b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks break; 19550b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks 19560b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks case ProgramPoint::PostStmtPurgeDeadSymbolsKind: 19570b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks Out << "PostStmtPurgeDeadSymbols"; 19580b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks break; 19590b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks 19600b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks case ProgramPoint::PreStmtPurgeDeadSymbolsKind: 19610b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks Out << "PreStmtPurgeDeadSymbols"; 1962102acd5369bbb17c0d6ab868af376671acff7a93Douglas Gregor break; 1963102acd5369bbb17c0d6ab868af376671acff7a93Douglas Gregor 19645903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks case ProgramPoint::EpsilonKind: 19655903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks Out << "Epsilon Point"; 19665903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks break; 19675903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks 196828038f33aa2db4833881fea757a1f0daf85ac02bJordan Rose case ProgramPoint::PreImplicitCallKind: { 196928038f33aa2db4833881fea757a1f0daf85ac02bJordan Rose ImplicitCallPoint *PC = cast<ImplicitCallPoint>(&Loc); 197028038f33aa2db4833881fea757a1f0daf85ac02bJordan Rose Out << "PreCall: "; 197128038f33aa2db4833881fea757a1f0daf85ac02bJordan Rose 197228038f33aa2db4833881fea757a1f0daf85ac02bJordan Rose // FIXME: Get proper printing options. 197328038f33aa2db4833881fea757a1f0daf85ac02bJordan Rose PC->getDecl()->print(Out, LangOptions()); 197428038f33aa2db4833881fea757a1f0daf85ac02bJordan Rose printLocation(Out, PC->getLocation()); 197528038f33aa2db4833881fea757a1f0daf85ac02bJordan Rose break; 197628038f33aa2db4833881fea757a1f0daf85ac02bJordan Rose } 197728038f33aa2db4833881fea757a1f0daf85ac02bJordan Rose 197828038f33aa2db4833881fea757a1f0daf85ac02bJordan Rose case ProgramPoint::PostImplicitCallKind: { 197928038f33aa2db4833881fea757a1f0daf85ac02bJordan Rose ImplicitCallPoint *PC = cast<ImplicitCallPoint>(&Loc); 198028038f33aa2db4833881fea757a1f0daf85ac02bJordan Rose Out << "PostCall: "; 198128038f33aa2db4833881fea757a1f0daf85ac02bJordan Rose 198228038f33aa2db4833881fea757a1f0daf85ac02bJordan Rose // FIXME: Get proper printing options. 198328038f33aa2db4833881fea757a1f0daf85ac02bJordan Rose PC->getDecl()->print(Out, LangOptions()); 198428038f33aa2db4833881fea757a1f0daf85ac02bJordan Rose printLocation(Out, PC->getLocation()); 198528038f33aa2db4833881fea757a1f0daf85ac02bJordan Rose break; 198628038f33aa2db4833881fea757a1f0daf85ac02bJordan Rose } 198728038f33aa2db4833881fea757a1f0daf85ac02bJordan Rose 1988aa66a32ba177338763cd0cf9df8310dfa2e24ff7Ted Kremenek default: { 19895f85e17df3f5b0a8021443f2b590daecfb2cbd17Ted Kremenek if (StmtPoint *L = dyn_cast<StmtPoint>(&Loc)) { 19909c378f705405d37f49795d5e915989de774fe11fTed Kremenek const Stmt *S = L->getStmt(); 19918c354758c2d39db87c77c723d81e34b4d967f762Ted Kremenek 19921eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump Out << S->getStmtClassName() << ' ' << (void*) S << ' '; 1993e4f2142d00fa5fdb580c4e2413da91882d955381Chris Lattner LangOptions LO; // FIXME. 1994e4f2142d00fa5fdb580c4e2413da91882d955381Chris Lattner S->printPretty(Out, 0, PrintingPolicy(LO)); 199528038f33aa2db4833881fea757a1f0daf85ac02bJordan Rose printLocation(Out, S->getLocStart()); 19961eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 19975f85e17df3f5b0a8021443f2b590daecfb2cbd17Ted Kremenek if (isa<PreStmt>(Loc)) 19981eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump Out << "\\lPreStmt\\l;"; 19995f85e17df3f5b0a8021443f2b590daecfb2cbd17Ted Kremenek else if (isa<PostLoad>(Loc)) 20007090d5465de7ca620da16211cf886edf1edc1f1fTed Kremenek Out << "\\lPostLoad\\l;"; 20017090d5465de7ca620da16211cf886edf1edc1f1fTed Kremenek else if (isa<PostStore>(Loc)) 20027090d5465de7ca620da16211cf886edf1edc1f1fTed Kremenek Out << "\\lPostStore\\l"; 20037090d5465de7ca620da16211cf886edf1edc1f1fTed Kremenek else if (isa<PostLValue>(Loc)) 20047090d5465de7ca620da16211cf886edf1edc1f1fTed Kremenek Out << "\\lPostLValue\\l"; 20051eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 200610f51e8785e43d5a22acc2d2a638307c582949c2Ted Kremenek#if 0 200710f51e8785e43d5a22acc2d2a638307c582949c2Ted Kremenek // FIXME: Replace with a general scheme to determine 200810f51e8785e43d5a22acc2d2a638307c582949c2Ted Kremenek // the name of the check. 20098c354758c2d39db87c77c723d81e34b4d967f762Ted Kremenek if (GraphPrintCheckerState->isImplicitNullDeref(N)) 20108c354758c2d39db87c77c723d81e34b4d967f762Ted Kremenek Out << "\\|Implicit-Null Dereference.\\l"; 20118c354758c2d39db87c77c723d81e34b4d967f762Ted Kremenek else if (GraphPrintCheckerState->isExplicitNullDeref(N)) 20128c354758c2d39db87c77c723d81e34b4d967f762Ted Kremenek Out << "\\|Explicit-Null Dereference.\\l"; 20138c354758c2d39db87c77c723d81e34b4d967f762Ted Kremenek else if (GraphPrintCheckerState->isUndefDeref(N)) 20148c354758c2d39db87c77c723d81e34b4d967f762Ted Kremenek Out << "\\|Dereference of undefialied value.\\l"; 20158c354758c2d39db87c77c723d81e34b4d967f762Ted Kremenek else if (GraphPrintCheckerState->isUndefStore(N)) 20168c354758c2d39db87c77c723d81e34b4d967f762Ted Kremenek Out << "\\|Store to Undefined Loc."; 20178c354758c2d39db87c77c723d81e34b4d967f762Ted Kremenek else if (GraphPrintCheckerState->isUndefResult(N)) 20188c354758c2d39db87c77c723d81e34b4d967f762Ted Kremenek Out << "\\|Result of operation is undefined."; 20198c354758c2d39db87c77c723d81e34b4d967f762Ted Kremenek else if (GraphPrintCheckerState->isNoReturnCall(N)) 20208c354758c2d39db87c77c723d81e34b4d967f762Ted Kremenek Out << "\\|Call to function marked \"noreturn\"."; 20218c354758c2d39db87c77c723d81e34b4d967f762Ted Kremenek else if (GraphPrintCheckerState->isBadCall(N)) 20228c354758c2d39db87c77c723d81e34b4d967f762Ted Kremenek Out << "\\|Call to NULL/Undefined."; 20238c354758c2d39db87c77c723d81e34b4d967f762Ted Kremenek else if (GraphPrintCheckerState->isUndefArg(N)) 20248c354758c2d39db87c77c723d81e34b4d967f762Ted Kremenek Out << "\\|Argument in call is undefined"; 202510f51e8785e43d5a22acc2d2a638307c582949c2Ted Kremenek#endif 20261eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 20278c354758c2d39db87c77c723d81e34b4d967f762Ted Kremenek break; 20288c354758c2d39db87c77c723d81e34b4d967f762Ted Kremenek } 20298c354758c2d39db87c77c723d81e34b4d967f762Ted Kremenek 20309c378f705405d37f49795d5e915989de774fe11fTed Kremenek const BlockEdge &E = cast<BlockEdge>(Loc); 2031aa66a32ba177338763cd0cf9df8310dfa2e24ff7Ted Kremenek Out << "Edge: (B" << E.getSrc()->getBlockID() << ", B" 2032aa66a32ba177338763cd0cf9df8310dfa2e24ff7Ted Kremenek << E.getDst()->getBlockID() << ')'; 20331eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 20349c378f705405d37f49795d5e915989de774fe11fTed Kremenek if (const Stmt *T = E.getSrc()->getTerminator()) { 20351eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 2036e97ca065c91ff9ca2a2a42eb443eaa553c40441cTed Kremenek SourceLocation SLoc = T->getLocStart(); 20371eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 2038b38911f16b4943548db6a3695fc6ae23070b25d2Ted Kremenek Out << "\\|Terminator: "; 2039e4f2142d00fa5fdb580c4e2413da91882d955381Chris Lattner LangOptions LO; // FIXME. 2040e4f2142d00fa5fdb580c4e2413da91882d955381Chris Lattner E.getSrc()->printTerminator(Out, LO); 20411eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 20429b5551d7f0209cec8b9c555cf70e893940674e5cTed Kremenek if (SLoc.isFileID()) { 20439b5551d7f0209cec8b9c555cf70e893940674e5cTed Kremenek Out << "\\lline=" 2044642116259e8df6286063a17361c20e95b5017a0aChandler Carruth << GraphPrintSourceManager->getExpansionLineNumber(SLoc) 20457da5aea7669e6db3e593162b8a123aef06a04d07Chris Lattner << " col=" 2046a77c031cb66f75d22672070052cc6e0205289ff8Chandler Carruth << GraphPrintSourceManager->getExpansionColumnNumber(SLoc); 20479b5551d7f0209cec8b9c555cf70e893940674e5cTed Kremenek } 20481eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 2049daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek if (isa<SwitchStmt>(T)) { 20509c378f705405d37f49795d5e915989de774fe11fTed Kremenek const Stmt *Label = E.getDst()->getLabel(); 20511eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 20521eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump if (Label) { 20539c378f705405d37f49795d5e915989de774fe11fTed Kremenek if (const CaseStmt *C = dyn_cast<CaseStmt>(Label)) { 2054daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek Out << "\\lcase "; 2055e4f2142d00fa5fdb580c4e2413da91882d955381Chris Lattner LangOptions LO; // FIXME. 2056e4f2142d00fa5fdb580c4e2413da91882d955381Chris Lattner C->getLHS()->printPretty(Out, 0, PrintingPolicy(LO)); 20571eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 20589c378f705405d37f49795d5e915989de774fe11fTed Kremenek if (const Stmt *RHS = C->getRHS()) { 2059daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek Out << " .. "; 2060e4f2142d00fa5fdb580c4e2413da91882d955381Chris Lattner RHS->printPretty(Out, 0, PrintingPolicy(LO)); 2061daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek } 20621eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 2063daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek Out << ":"; 2064daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek } 2065daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek else { 2066daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek assert (isa<DefaultStmt>(Label)); 2067daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek Out << "\\ldefault:"; 2068daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek } 2069daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek } 20701eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump else 2071daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek Out << "\\l(implicit) default:"; 2072daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek } 2073daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek else if (isa<IndirectGotoStmt>(T)) { 2074b38911f16b4943548db6a3695fc6ae23070b25d2Ted Kremenek // FIXME 2075b38911f16b4943548db6a3695fc6ae23070b25d2Ted Kremenek } 2076b38911f16b4943548db6a3695fc6ae23070b25d2Ted Kremenek else { 2077b38911f16b4943548db6a3695fc6ae23070b25d2Ted Kremenek Out << "\\lCondition: "; 2078b38911f16b4943548db6a3695fc6ae23070b25d2Ted Kremenek if (*E.getSrc()->succ_begin() == E.getDst()) 2079b38911f16b4943548db6a3695fc6ae23070b25d2Ted Kremenek Out << "true"; 2080b38911f16b4943548db6a3695fc6ae23070b25d2Ted Kremenek else 20811eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump Out << "false"; 2082b38911f16b4943548db6a3695fc6ae23070b25d2Ted Kremenek } 20831eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 2084b38911f16b4943548db6a3695fc6ae23070b25d2Ted Kremenek Out << "\\l"; 2085b38911f16b4943548db6a3695fc6ae23070b25d2Ted Kremenek } 20861eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 208710f51e8785e43d5a22acc2d2a638307c582949c2Ted Kremenek#if 0 208810f51e8785e43d5a22acc2d2a638307c582949c2Ted Kremenek // FIXME: Replace with a general scheme to determine 208910f51e8785e43d5a22acc2d2a638307c582949c2Ted Kremenek // the name of the check. 20904a4e524afef40d6f3ddb25d0e407c814e4ca56a8Ted Kremenek if (GraphPrintCheckerState->isUndefControlFlow(N)) { 20914a4e524afef40d6f3ddb25d0e407c814e4ca56a8Ted Kremenek Out << "\\|Control-flow based on\\lUndefined value.\\l"; 20923b4f6702860208692f6ef28401e68de4e3ff9af9Ted Kremenek } 209310f51e8785e43d5a22acc2d2a638307c582949c2Ted Kremenek#endif 2094aa66a32ba177338763cd0cf9df8310dfa2e24ff7Ted Kremenek } 2095aa66a32ba177338763cd0cf9df8310dfa2e24ff7Ted Kremenek } 20961eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 20978bef8238181a30e52dea380789a7e2d760eac532Ted Kremenek ProgramStateRef state = N->getState(); 2098a5888f61be9f8d76e9b48a453dbced50523bd2e0Argyrios Kyrtzidis Out << "\\|StateID: " << (void*) state.getPtr() 20998673a68a8ab55a2bd03f92d636a50e6b0bfad2daTed Kremenek << " NodeID: " << (void*) N << "\\|"; 21005eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek state->printDOT(Out); 2101ca804539d908d3a0e8c72a0df5f1f571d29490bbTed Kremenek 2102ca804539d908d3a0e8c72a0df5f1f571d29490bbTed Kremenek Out << "\\l"; 2103ca804539d908d3a0e8c72a0df5f1f571d29490bbTed Kremenek 2104ca804539d908d3a0e8c72a0df5f1f571d29490bbTed Kremenek if (const ProgramPointTag *tag = Loc.getTag()) { 2105ca804539d908d3a0e8c72a0df5f1f571d29490bbTed Kremenek Out << "\\|Tag: " << tag->getTagDescription(); 2106ca804539d908d3a0e8c72a0df5f1f571d29490bbTed Kremenek Out << "\\l"; 2107ca804539d908d3a0e8c72a0df5f1f571d29490bbTed Kremenek } 2108aa66a32ba177338763cd0cf9df8310dfa2e24ff7Ted Kremenek return Out.str(); 2109aa66a32ba177338763cd0cf9df8310dfa2e24ff7Ted Kremenek } 2110aa66a32ba177338763cd0cf9df8310dfa2e24ff7Ted Kremenek}; 21111eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump} // end llvm namespace 2112aa66a32ba177338763cd0cf9df8310dfa2e24ff7Ted Kremenek#endif 2113aa66a32ba177338763cd0cf9df8310dfa2e24ff7Ted Kremenek 2114ffe0f43806d4823271c2406c1fccc2373115c36aTed Kremenek#ifndef NDEBUG 21157ec07fd91f6eae8bd619ebb8512805222ca41c92Ted Kremenektemplate <typename ITERATOR> 21169c378f705405d37f49795d5e915989de774fe11fTed KremenekExplodedNode *GetGraphNode(ITERATOR I) { return *I; } 21177ec07fd91f6eae8bd619ebb8512805222ca41c92Ted Kremenek 2118031ccc0555a82afc2e8afe29e19dd57ff204e2deZhongxing Xutemplate <> ExplodedNode* 2119031ccc0555a82afc2e8afe29e19dd57ff204e2deZhongxing XuGetGraphNode<llvm::DenseMap<ExplodedNode*, Expr*>::iterator> 2120031ccc0555a82afc2e8afe29e19dd57ff204e2deZhongxing Xu (llvm::DenseMap<ExplodedNode*, Expr*>::iterator I) { 21217ec07fd91f6eae8bd619ebb8512805222ca41c92Ted Kremenek return I->first; 21227ec07fd91f6eae8bd619ebb8512805222ca41c92Ted Kremenek} 2123ffe0f43806d4823271c2406c1fccc2373115c36aTed Kremenek#endif 2124ffe0f43806d4823271c2406c1fccc2373115c36aTed Kremenek 2125d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidisvoid ExprEngine::ViewGraph(bool trim) { 21261eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump#ifndef NDEBUG 2127ffe0f43806d4823271c2406c1fccc2373115c36aTed Kremenek if (trim) { 2128031ccc0555a82afc2e8afe29e19dd57ff204e2deZhongxing Xu std::vector<ExplodedNode*> Src; 2129940abcc574580e454689be801f38a3d4d41ab01fTed Kremenek 2130940abcc574580e454689be801f38a3d4d41ab01fTed Kremenek // Flush any outstanding reports to make sure we cover all the nodes. 2131940abcc574580e454689be801f38a3d4d41ab01fTed Kremenek // This does not cause them to get displayed. 2132940abcc574580e454689be801f38a3d4d41ab01fTed Kremenek for (BugReporter::iterator I=BR.begin(), E=BR.end(); I!=E; ++I) 2133940abcc574580e454689be801f38a3d4d41ab01fTed Kremenek const_cast<BugType*>(*I)->FlushReports(BR); 2134940abcc574580e454689be801f38a3d4d41ab01fTed Kremenek 2135940abcc574580e454689be801f38a3d4d41ab01fTed Kremenek // Iterate through the reports and get their nodes. 2136404fc3ad6bd844bf8ce70cbf9974ab297704a122Argyrios Kyrtzidis for (BugReporter::EQClasses_iterator 2137404fc3ad6bd844bf8ce70cbf9974ab297704a122Argyrios Kyrtzidis EI = BR.EQClasses_begin(), EE = BR.EQClasses_end(); EI != EE; ++EI) { 21384a5f724538cbc275370c9504e8169ce92503256cBenjamin Kramer ExplodedNode *N = const_cast<ExplodedNode*>(EI->begin()->getErrorNode()); 2139404fc3ad6bd844bf8ce70cbf9974ab297704a122Argyrios Kyrtzidis if (N) Src.push_back(N); 2140940abcc574580e454689be801f38a3d4d41ab01fTed Kremenek } 21411eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 21427ec07fd91f6eae8bd619ebb8512805222ca41c92Ted Kremenek ViewGraph(&Src[0], &Src[0]+Src.size()); 2143ffe0f43806d4823271c2406c1fccc2373115c36aTed Kremenek } 2144493d7a26d5ea319770ba904b43f2740d43b820cbTed Kremenek else { 2145493d7a26d5ea319770ba904b43f2740d43b820cbTed Kremenek GraphPrintCheckerState = this; 2146493d7a26d5ea319770ba904b43f2740d43b820cbTed Kremenek GraphPrintSourceManager = &getContext().getSourceManager(); 2147ae6814efb6c41bd0c0f6413d25097105284d5be7Ted Kremenek 2148d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidis llvm::ViewGraph(*G.roots_begin(), "ExprEngine"); 21491eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 2150493d7a26d5ea319770ba904b43f2740d43b820cbTed Kremenek GraphPrintCheckerState = NULL; 2151493d7a26d5ea319770ba904b43f2740d43b820cbTed Kremenek GraphPrintSourceManager = NULL; 2152493d7a26d5ea319770ba904b43f2740d43b820cbTed Kremenek } 2153493d7a26d5ea319770ba904b43f2740d43b820cbTed Kremenek#endif 2154493d7a26d5ea319770ba904b43f2740d43b820cbTed Kremenek} 2155493d7a26d5ea319770ba904b43f2740d43b820cbTed Kremenek 2156d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidisvoid ExprEngine::ViewGraph(ExplodedNode** Beg, ExplodedNode** End) { 2157493d7a26d5ea319770ba904b43f2740d43b820cbTed Kremenek#ifndef NDEBUG 2158493d7a26d5ea319770ba904b43f2740d43b820cbTed Kremenek GraphPrintCheckerState = this; 2159493d7a26d5ea319770ba904b43f2740d43b820cbTed Kremenek GraphPrintSourceManager = &getContext().getSourceManager(); 21601eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 2161031ccc0555a82afc2e8afe29e19dd57ff204e2deZhongxing Xu std::auto_ptr<ExplodedGraph> TrimmedG(G.Trim(Beg, End).first); 2162493d7a26d5ea319770ba904b43f2740d43b820cbTed Kremenek 2163cf118d41f7930a18dce97416ef7834a62642f587Ted Kremenek if (!TrimmedG.get()) 21646cb7c1a43b0c8f739d1f54b7fdae5ede86033496Benjamin Kramer llvm::errs() << "warning: Trimmed ExplodedGraph is empty.\n"; 2165cf118d41f7930a18dce97416ef7834a62642f587Ted Kremenek else 2166d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidis llvm::ViewGraph(*TrimmedG->roots_begin(), "TrimmedExprEngine"); 21671eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 21683b4f6702860208692f6ef28401e68de4e3ff9af9Ted Kremenek GraphPrintCheckerState = NULL; 2169e97ca065c91ff9ca2a2a42eb443eaa553c40441cTed Kremenek GraphPrintSourceManager = NULL; 2170e01c98767dfd7153c3c84637c36659e3bbe16ff7Ted Kremenek#endif 2171ee98546b0d5f3439c4a590b0d7d1545af794a0ecTed Kremenek} 2172