clang  3.9.0
ProgramState.cpp
Go to the documentation of this file.
1 //= ProgramState.cpp - Path-Sensitive "State" for tracking values --*- C++ -*--=
2 //
3 // The LLVM Compiler Infrastructure
4 //
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
7 //
8 //===----------------------------------------------------------------------===//
9 //
10 // This file implements ProgramState and ProgramStateManager.
11 //
12 //===----------------------------------------------------------------------===//
13 
15 #include "clang/Analysis/CFG.h"
20 #include "llvm/Support/raw_ostream.h"
21 
22 using namespace clang;
23 using namespace ento;
24 
25 namespace clang { namespace ento {
26 /// Increments the number of times this state is referenced.
27 
29  ++const_cast<ProgramState*>(state)->refCount;
30 }
31 
32 /// Decrement the number of times this state is referenced.
34  assert(state->refCount > 0);
35  ProgramState *s = const_cast<ProgramState*>(state);
36  if (--s->refCount == 0) {
38  Mgr.StateSet.RemoveNode(s);
39  s->~ProgramState();
40  Mgr.freeStates.push_back(s);
41  }
42 }
43 }}
44 
46  StoreRef st, GenericDataMap gdm)
47  : stateMgr(mgr),
48  Env(env),
49  store(st.getStore()),
50  GDM(gdm),
51  refCount(0) {
52  stateMgr->getStoreManager().incrementReferenceCount(store);
53 }
54 
56  : llvm::FoldingSetNode(),
57  stateMgr(RHS.stateMgr),
58  Env(RHS.Env),
59  store(RHS.store),
60  GDM(RHS.GDM),
61  refCount(0) {
62  stateMgr->getStoreManager().incrementReferenceCount(store);
63 }
64 
66  if (store)
67  stateMgr->getStoreManager().decrementReferenceCount(store);
68 }
69 
71  StoreManagerCreator CreateSMgr,
72  ConstraintManagerCreator CreateCMgr,
73  llvm::BumpPtrAllocator &alloc,
74  SubEngine *SubEng)
75  : Eng(SubEng), EnvMgr(alloc), GDMFactory(alloc),
76  svalBuilder(createSimpleSValBuilder(alloc, Ctx, *this)),
77  CallEventMgr(new CallEventManager(alloc)), Alloc(alloc) {
78  StoreMgr = (*CreateSMgr)(*this);
79  ConstraintMgr = (*CreateCMgr)(*this, SubEng);
80 }
81 
82 
84  for (GDMContextsTy::iterator I=GDMContexts.begin(), E=GDMContexts.end();
85  I!=E; ++I)
86  I->second.second(I->second.first);
87 }
88 
91  const StackFrameContext *LCtx,
92  SymbolReaper& SymReaper) {
93 
94  // This code essentially performs a "mark-and-sweep" of the VariableBindings.
95  // The roots are any Block-level exprs and Decls that our liveness algorithm
96  // tells us are live. We then see what Decls they may reference, and keep
97  // those around. This code more than likely can be made faster, and the
98  // frequency of which this method is called should be experimented with
99  // for optimum performance.
100  ProgramState NewState = *state;
101 
102  NewState.Env = EnvMgr.removeDeadBindings(NewState.Env, SymReaper, state);
103 
104  // Clean up the store.
105  StoreRef newStore = StoreMgr->removeDeadBindings(NewState.getStore(), LCtx,
106  SymReaper);
107  NewState.setStore(newStore);
108  SymReaper.setReapedStore(newStore);
109 
111  return ConstraintMgr->removeDeadBindings(Result, SymReaper);
112 }
113 
114 ProgramStateRef ProgramState::bindLoc(Loc LV, SVal V, bool notifyChanges) const {
116  ProgramStateRef newState = makeWithStore(Mgr.StoreMgr->Bind(getStore(),
117  LV, V));
118  const MemRegion *MR = LV.getAsRegion();
119  if (MR && Mgr.getOwningEngine() && notifyChanges)
120  return Mgr.getOwningEngine()->processRegionChange(newState, MR);
121 
122  return newState;
123 }
124 
127  const MemRegion *R = loc.castAs<loc::MemRegionVal>().getRegion();
128  const StoreRef &newStore = Mgr.StoreMgr->BindDefault(getStore(), R, V);
129  ProgramStateRef new_state = makeWithStore(newStore);
130  return Mgr.getOwningEngine() ?
131  Mgr.getOwningEngine()->processRegionChange(new_state, R) :
132  new_state;
133 }
134 
135 typedef ArrayRef<const MemRegion *> RegionList;
136 typedef ArrayRef<SVal> ValueList;
137 
140  const Expr *E, unsigned Count,
141  const LocationContext *LCtx,
142  bool CausedByPointerEscape,
143  InvalidatedSymbols *IS,
144  const CallEvent *Call,
145  RegionAndSymbolInvalidationTraits *ITraits) const {
146  SmallVector<SVal, 8> Values;
147  for (RegionList::const_iterator I = Regions.begin(),
148  End = Regions.end(); I != End; ++I)
149  Values.push_back(loc::MemRegionVal(*I));
150 
151  return invalidateRegionsImpl(Values, E, Count, LCtx, CausedByPointerEscape,
152  IS, ITraits, Call);
153 }
154 
157  const Expr *E, unsigned Count,
158  const LocationContext *LCtx,
159  bool CausedByPointerEscape,
160  InvalidatedSymbols *IS,
161  const CallEvent *Call,
162  RegionAndSymbolInvalidationTraits *ITraits) const {
163 
164  return invalidateRegionsImpl(Values, E, Count, LCtx, CausedByPointerEscape,
165  IS, ITraits, Call);
166 }
167 
169 ProgramState::invalidateRegionsImpl(ValueList Values,
170  const Expr *E, unsigned Count,
171  const LocationContext *LCtx,
172  bool CausedByPointerEscape,
173  InvalidatedSymbols *IS,
175  const CallEvent *Call) const {
177  SubEngine* Eng = Mgr.getOwningEngine();
178 
179  InvalidatedSymbols Invalidated;
180  if (!IS)
181  IS = &Invalidated;
182 
184  if (!ITraits)
185  ITraits = &ITraitsLocal;
186 
187  if (Eng) {
188  StoreManager::InvalidatedRegions TopLevelInvalidated;
190  const StoreRef &newStore
191  = Mgr.StoreMgr->invalidateRegions(getStore(), Values, E, Count, LCtx, Call,
192  *IS, *ITraits, &TopLevelInvalidated,
193  &Invalidated);
194 
195  ProgramStateRef newState = makeWithStore(newStore);
196 
197  if (CausedByPointerEscape) {
198  newState = Eng->notifyCheckersOfPointerEscape(newState, IS,
199  TopLevelInvalidated,
200  Invalidated, Call,
201  *ITraits);
202  }
203 
204  return Eng->processRegionChanges(newState, IS, TopLevelInvalidated,
205  Invalidated, Call);
206  }
207 
208  const StoreRef &newStore =
209  Mgr.StoreMgr->invalidateRegions(getStore(), Values, E, Count, LCtx, Call,
210  *IS, *ITraits, nullptr, nullptr);
211  return makeWithStore(newStore);
212 }
213 
215  assert(!LV.getAs<loc::MemRegionVal>() && "Use invalidateRegion instead.");
216 
217  Store OldStore = getStore();
218  const StoreRef &newStore =
219  getStateManager().StoreMgr->killBinding(OldStore, LV);
220 
221  if (newStore.getStore() == OldStore)
222  return this;
223 
224  return makeWithStore(newStore);
225 }
226 
229  const StackFrameContext *CalleeCtx) const {
230  const StoreRef &NewStore =
231  getStateManager().StoreMgr->enterStackFrame(getStore(), Call, CalleeCtx);
232  return makeWithStore(NewStore);
233 }
234 
236  // We only want to do fetches from regions that we can actually bind
237  // values. For example, SymbolicRegions of type 'id<...>' cannot
238  // have direct bindings (but their can be bindings on their subregions).
239  if (!R->isBoundable())
240  return UnknownVal();
241 
242  if (const TypedValueRegion *TR = dyn_cast<TypedValueRegion>(R)) {
243  QualType T = TR->getValueType();
245  return getSVal(R);
246  }
247 
248  return UnknownVal();
249 }
250 
252  SVal V = getRawSVal(cast<Loc>(location), T);
253 
254  // If 'V' is a symbolic value that is *perfectly* constrained to
255  // be a constant value, use that value instead to lessen the burden
256  // on later analysis stages (so we have less symbolic values to reason
257  // about).
258  if (!T.isNull()) {
259  if (SymbolRef sym = V.getAsSymbol()) {
260  if (const llvm::APSInt *Int = getStateManager()
262  .getSymVal(this, sym)) {
263  // FIXME: Because we don't correctly model (yet) sign-extension
264  // and truncation of symbolic values, we need to convert
265  // the integer value to the correct signedness and bitwidth.
266  //
267  // This shows up in the following:
268  //
269  // char foo();
270  // unsigned x = foo();
271  // if (x == 54)
272  // ...
273  //
274  // The symbolic value stored to 'x' is actually the conjured
275  // symbol for the call to foo(); the type of that symbol is 'char',
276  // not unsigned.
277  const llvm::APSInt &NewV = getBasicVals().Convert(T, *Int);
278 
279  if (V.getAs<Loc>())
280  return loc::ConcreteInt(NewV);
281  else
282  return nonloc::ConcreteInt(NewV);
283  }
284  }
285  }
286 
287  return V;
288 }
289 
291  const LocationContext *LCtx,
292  SVal V, bool Invalidate) const{
293  Environment NewEnv =
294  getStateManager().EnvMgr.bindExpr(Env, EnvironmentEntry(S, LCtx), V,
295  Invalidate);
296  if (NewEnv == Env)
297  return this;
298 
299  ProgramState NewSt = *this;
300  NewSt.Env = NewEnv;
301  return getStateManager().getPersistentState(NewSt);
302 }
303 
305  DefinedOrUnknownSVal UpperBound,
306  bool Assumption,
307  QualType indexTy) const {
308  if (Idx.isUnknown() || UpperBound.isUnknown())
309  return this;
310 
311  // Build an expression for 0 <= Idx < UpperBound.
312  // This is the same as Idx + MIN < UpperBound + MIN, if overflow is allowed.
313  // FIXME: This should probably be part of SValBuilder.
315  SValBuilder &svalBuilder = SM.getSValBuilder();
316  ASTContext &Ctx = svalBuilder.getContext();
317 
318  // Get the offset: the minimum value of the array index type.
319  BasicValueFactory &BVF = svalBuilder.getBasicValueFactory();
320  // FIXME: This should be using ValueManager::ArrayindexTy...somehow.
321  if (indexTy.isNull())
322  indexTy = Ctx.IntTy;
323  nonloc::ConcreteInt Min(BVF.getMinValue(indexTy));
324 
325  // Adjust the index.
326  SVal newIdx = svalBuilder.evalBinOpNN(this, BO_Add,
327  Idx.castAs<NonLoc>(), Min, indexTy);
328  if (newIdx.isUnknownOrUndef())
329  return this;
330 
331  // Adjust the upper bound.
332  SVal newBound =
333  svalBuilder.evalBinOpNN(this, BO_Add, UpperBound.castAs<NonLoc>(),
334  Min, indexTy);
335 
336  if (newBound.isUnknownOrUndef())
337  return this;
338 
339  // Build the actual comparison.
340  SVal inBound = svalBuilder.evalBinOpNN(this, BO_LT, newIdx.castAs<NonLoc>(),
341  newBound.castAs<NonLoc>(), Ctx.IntTy);
342  if (inBound.isUnknownOrUndef())
343  return this;
344 
345  // Finally, let the constraint manager take care of it.
347  return CM.assume(this, inBound.castAs<DefinedSVal>(), Assumption);
348 }
349 
351  if (V.isZeroConstant())
352  return true;
353 
354  if (V.isConstant())
355  return false;
356 
357  SymbolRef Sym = V.getAsSymbol(/* IncludeBaseRegion */ true);
358  if (!Sym)
359  return ConditionTruthVal();
360 
361  return getStateManager().ConstraintMgr->isNull(this, Sym);
362 }
363 
365  ProgramState State(this,
366  EnvMgr.getInitialEnvironment(),
367  StoreMgr->getInitialStore(InitLoc),
368  GDMFactory.getEmptyMap());
369 
370  return getPersistentState(State);
371 }
372 
374  ProgramStateRef FromState,
375  ProgramStateRef GDMState) {
376  ProgramState NewState(*FromState);
377  NewState.GDM = GDMState->GDM;
378  return getPersistentState(NewState);
379 }
380 
382 
383  llvm::FoldingSetNodeID ID;
384  State.Profile(ID);
385  void *InsertPos;
386 
387  if (ProgramState *I = StateSet.FindNodeOrInsertPos(ID, InsertPos))
388  return I;
389 
390  ProgramState *newState = nullptr;
391  if (!freeStates.empty()) {
392  newState = freeStates.back();
393  freeStates.pop_back();
394  }
395  else {
396  newState = (ProgramState*) Alloc.Allocate<ProgramState>();
397  }
398  new (newState) ProgramState(State);
399  StateSet.InsertNode(newState, InsertPos);
400  return newState;
401 }
402 
403 ProgramStateRef ProgramState::makeWithStore(const StoreRef &store) const {
404  ProgramState NewSt(*this);
405  NewSt.setStore(store);
406  return getStateManager().getPersistentState(NewSt);
407 }
408 
409 void ProgramState::setStore(const StoreRef &newStore) {
410  Store newStoreStore = newStore.getStore();
411  if (newStoreStore)
412  stateMgr->getStoreManager().incrementReferenceCount(newStoreStore);
413  if (store)
414  stateMgr->getStoreManager().decrementReferenceCount(store);
415  store = newStoreStore;
416 }
417 
418 //===----------------------------------------------------------------------===//
419 // State pretty-printing.
420 //===----------------------------------------------------------------------===//
421 
422 void ProgramState::print(raw_ostream &Out,
423  const char *NL, const char *Sep) const {
424  // Print the store.
426  Mgr.getStoreManager().print(getStore(), Out, NL, Sep);
427 
428  // Print out the environment.
429  Env.print(Out, NL, Sep);
430 
431  // Print out the constraints.
432  Mgr.getConstraintManager().print(this, Out, NL, Sep);
433 
434  // Print checker-specific data.
435  Mgr.getOwningEngine()->printState(Out, this, NL, Sep);
436 }
437 
438 void ProgramState::printDOT(raw_ostream &Out) const {
439  print(Out, "\\l", "\\|");
440 }
441 
442 LLVM_DUMP_METHOD void ProgramState::dump() const {
443  print(llvm::errs());
444 }
445 
446 void ProgramState::printTaint(raw_ostream &Out,
447  const char *NL, const char *Sep) const {
448  TaintMapImpl TM = get<TaintMap>();
449 
450  if (!TM.isEmpty())
451  Out <<"Tainted Symbols:" << NL;
452 
453  for (TaintMapImpl::iterator I = TM.begin(), E = TM.end(); I != E; ++I) {
454  Out << I->first << " : " << I->second << NL;
455  }
456 }
457 
459  printTaint(llvm::errs());
460 }
461 
462 //===----------------------------------------------------------------------===//
463 // Generic Data Map.
464 //===----------------------------------------------------------------------===//
465 
466 void *const* ProgramState::FindGDM(void *K) const {
467  return GDM.lookup(K);
468 }
469 
470 void*
472  void *(*CreateContext)(llvm::BumpPtrAllocator&),
473  void (*DeleteContext)(void*)) {
474 
475  std::pair<void*, void (*)(void*)>& p = GDMContexts[K];
476  if (!p.first) {
477  p.first = CreateContext(Alloc);
478  p.second = DeleteContext;
479  }
480 
481  return p.first;
482 }
483 
485  ProgramState::GenericDataMap M1 = St->getGDM();
486  ProgramState::GenericDataMap M2 = GDMFactory.add(M1, Key, Data);
487 
488  if (M1 == M2)
489  return St;
490 
491  ProgramState NewSt = *St;
492  NewSt.GDM = M2;
493  return getPersistentState(NewSt);
494 }
495 
497  ProgramState::GenericDataMap OldM = state->getGDM();
498  ProgramState::GenericDataMap NewM = GDMFactory.remove(OldM, Key);
499 
500  if (NewM == OldM)
501  return state;
502 
503  ProgramState NewState = *state;
504  NewState.GDM = NewM;
505  return getPersistentState(NewState);
506 }
507 
509  bool wasVisited = !visited.insert(val.getCVData()).second;
510  if (wasVisited)
511  return true;
512 
513  StoreManager &StoreMgr = state->getStateManager().getStoreManager();
514  // FIXME: We don't really want to use getBaseRegion() here because pointer
515  // arithmetic doesn't apply, but scanReachableSymbols only accepts base
516  // regions right now.
517  const MemRegion *R = val.getRegion()->getBaseRegion();
518  return StoreMgr.scanReachableSymbols(val.getStore(), R, *this);
519 }
520 
522  for (nonloc::CompoundVal::iterator I=val.begin(), E=val.end(); I!=E; ++I)
523  if (!scan(*I))
524  return false;
525 
526  return true;
527 }
528 
530  bool wasVisited = !visited.insert(sym).second;
531  if (wasVisited)
532  return true;
533 
534  if (!visitor.VisitSymbol(sym))
535  return false;
536 
537  // TODO: should be rewritten using SymExpr::symbol_iterator.
538  switch (sym->getKind()) {
539  case SymExpr::SymbolRegionValueKind:
540  case SymExpr::SymbolConjuredKind:
541  case SymExpr::SymbolDerivedKind:
542  case SymExpr::SymbolExtentKind:
543  case SymExpr::SymbolMetadataKind:
544  break;
545  case SymExpr::SymbolCastKind:
546  return scan(cast<SymbolCast>(sym)->getOperand());
547  case SymExpr::SymIntExprKind:
548  return scan(cast<SymIntExpr>(sym)->getLHS());
549  case SymExpr::IntSymExprKind:
550  return scan(cast<IntSymExpr>(sym)->getRHS());
551  case SymExpr::SymSymExprKind: {
552  const SymSymExpr *x = cast<SymSymExpr>(sym);
553  return scan(x->getLHS()) && scan(x->getRHS());
554  }
555  }
556  return true;
557 }
558 
561  return scan(X->getRegion());
562 
565  return scan(*X);
566 
568  return scan(X->getLoc());
569 
570  if (SymbolRef Sym = val.getAsSymbol())
571  return scan(Sym);
572 
573  if (const SymExpr *Sym = val.getAsSymbolicExpression())
574  return scan(Sym);
575 
577  return scan(*X);
578 
579  return true;
580 }
581 
583  if (isa<MemSpaceRegion>(R))
584  return true;
585 
586  bool wasVisited = !visited.insert(R).second;
587  if (wasVisited)
588  return true;
589 
590  if (!visitor.VisitMemRegion(R))
591  return false;
592 
593  // If this is a symbolic region, visit the symbol for the region.
594  if (const SymbolicRegion *SR = dyn_cast<SymbolicRegion>(R))
595  if (!visitor.VisitSymbol(SR->getSymbol()))
596  return false;
597 
598  // If this is a subregion, also visit the parent regions.
599  if (const SubRegion *SR = dyn_cast<SubRegion>(R)) {
600  const MemRegion *Super = SR->getSuperRegion();
601  if (!scan(Super))
602  return false;
603 
604  // When we reach the topmost region, scan all symbols in it.
605  if (isa<MemSpaceRegion>(Super)) {
606  StoreManager &StoreMgr = state->getStateManager().getStoreManager();
607  if (!StoreMgr.scanReachableSymbols(state->getStore(), SR, *this))
608  return false;
609  }
610  }
611 
612  // Regions captured by a block are also implicitly reachable.
613  if (const BlockDataRegion *BDR = dyn_cast<BlockDataRegion>(R)) {
614  BlockDataRegion::referenced_vars_iterator I = BDR->referenced_vars_begin(),
615  E = BDR->referenced_vars_end();
616  for ( ; I != E; ++I) {
617  if (!scan(I.getCapturedRegion()))
618  return false;
619  }
620  }
621 
622  return true;
623 }
624 
626  ScanReachableSymbols S(this, visitor);
627  return S.scan(val);
628 }
629 
631  SymbolVisitor &visitor) const {
632  ScanReachableSymbols S(this, visitor);
633  for ( ; I != E; ++I) {
634  if (!S.scan(*I))
635  return false;
636  }
637  return true;
638 }
639 
641  const MemRegion * const *E,
642  SymbolVisitor &visitor) const {
643  ScanReachableSymbols S(this, visitor);
644  for ( ; I != E; ++I) {
645  if (!S.scan(*I))
646  return false;
647  }
648  return true;
649 }
650 
652  const LocationContext *LCtx,
653  TaintTagType Kind) const {
654  if (const Expr *E = dyn_cast_or_null<Expr>(S))
655  S = E->IgnoreParens();
656 
657  SymbolRef Sym = getSVal(S, LCtx).getAsSymbol();
658  if (Sym)
659  return addTaint(Sym, Kind);
660 
661  const MemRegion *R = getSVal(S, LCtx).getAsRegion();
662  addTaint(R, Kind);
663 
664  // Cannot add taint, so just return the state.
665  return this;
666 }
667 
669  TaintTagType Kind) const {
670  if (const SymbolicRegion *SR = dyn_cast_or_null<SymbolicRegion>(R))
671  return addTaint(SR->getSymbol(), Kind);
672  return this;
673 }
674 
676  TaintTagType Kind) const {
677  // If this is a symbol cast, remove the cast before adding the taint. Taint
678  // is cast agnostic.
679  while (const SymbolCast *SC = dyn_cast<SymbolCast>(Sym))
680  Sym = SC->getOperand();
681 
682  ProgramStateRef NewState = set<TaintMap>(Sym, Kind);
683  assert(NewState);
684  return NewState;
685 }
686 
688  TaintTagType Kind) const {
689  if (const Expr *E = dyn_cast_or_null<Expr>(S))
690  S = E->IgnoreParens();
691 
692  SVal val = getSVal(S, LCtx);
693  return isTainted(val, Kind);
694 }
695 
697  if (const SymExpr *Sym = V.getAsSymExpr())
698  return isTainted(Sym, Kind);
699  if (const MemRegion *Reg = V.getAsRegion())
700  return isTainted(Reg, Kind);
701  return false;
702 }
703 
704 bool ProgramState::isTainted(const MemRegion *Reg, TaintTagType K) const {
705  if (!Reg)
706  return false;
707 
708  // Element region (array element) is tainted if either the base or the offset
709  // are tainted.
710  if (const ElementRegion *ER = dyn_cast<ElementRegion>(Reg))
711  return isTainted(ER->getSuperRegion(), K) || isTainted(ER->getIndex(), K);
712 
713  if (const SymbolicRegion *SR = dyn_cast<SymbolicRegion>(Reg))
714  return isTainted(SR->getSymbol(), K);
715 
716  if (const SubRegion *ER = dyn_cast<SubRegion>(Reg))
717  return isTainted(ER->getSuperRegion(), K);
718 
719  return false;
720 }
721 
723  if (!Sym)
724  return false;
725 
726  // Traverse all the symbols this symbol depends on to see if any are tainted.
727  bool Tainted = false;
728  for (SymExpr::symbol_iterator SI = Sym->symbol_begin(), SE =Sym->symbol_end();
729  SI != SE; ++SI) {
730  if (!isa<SymbolData>(*SI))
731  continue;
732 
733  const TaintTagType *Tag = get<TaintMap>(*SI);
734  Tainted = (Tag && *Tag == Kind);
735 
736  // If this is a SymbolDerived with a tainted parent, it's also tainted.
737  if (const SymbolDerived *SD = dyn_cast<SymbolDerived>(*SI))
738  Tainted = Tainted || isTainted(SD->getParentSymbol(), Kind);
739 
740  // If memory region is tainted, data is also tainted.
741  if (const SymbolRegionValue *SRV = dyn_cast<SymbolRegionValue>(*SI))
742  Tainted = Tainted || isTainted(SRV->getRegion(), Kind);
743 
744  // If If this is a SymbolCast from a tainted value, it's also tainted.
745  if (const SymbolCast *SC = dyn_cast<SymbolCast>(*SI))
746  Tainted = Tainted || isTainted(SC->getOperand(), Kind);
747 
748  if (Tainted)
749  return true;
750  }
751 
752  return Tainted;
753 }
754 
virtual ProgramStateRef assume(ProgramStateRef state, DefinedSVal Cond, bool Assumption)=0
ProgramStateRef addGDM(ProgramStateRef St, void *Key, void *Data)
const SymExpr * getAsSymExpr() const
Definition: SVals.cpp:128
ProgramStateManager & getStateManager() const
Return the ProgramStateManager associated with this state.
Definition: ProgramState.h:110
ProgramStateRef enterStackFrame(const CallEvent &Call, const StackFrameContext *CalleeCtx) const
enterStackFrame - Returns the state for entry to the given stack frame, preserving the current state...
TypedValueRegion - An abstract class representing regions having a typed value.
Definition: MemRegion.h:494
A (possibly-)qualified type.
Definition: Type.h:598
MemRegion - The root abstract class for all memory regions.
Definition: MemRegion.h:79
void print(raw_ostream &Out, const char *NL, const char *Sep) const
Store getStore() const
Definition: StoreRef.h:46
SValBuilder * createSimpleSValBuilder(llvm::BumpPtrAllocator &alloc, ASTContext &context, ProgramStateManager &stateMgr)
Information about invalidation for a particular region/symbol.
Definition: MemRegion.h:1316
SVal getRawSVal(Loc LV, QualType T=QualType()) const
Returns the "raw" SVal bound to LV before any value simplfication.
Definition: ProgramState.h:747
ProgramStateRef addTaint(const Stmt *S, const LocationContext *LCtx, TaintTagType Kind=TaintTagGeneric) const
Create a new state in which the statement is marked as tainted.
virtual bool isBoundable() const
Definition: MemRegion.h:152
Manages the lifetime of CallEvent objects.
Definition: CallEvent.h:993
Store getStore() const
Return the store associated with this state.
Definition: ProgramState.h:123
const void * Store
Store - This opaque type encapsulates an immutable mapping from locations to values.
Definition: StoreRef.h:26
Value representing integer constant.
Definition: SVals.h:341
A Utility class that allows to visit the reachable symbols using a custom SymbolVisitor.
Definition: ProgramState.h:833
const SymExpr * getRHS() const
std::unique_ptr< ConstraintManager >(* ConstraintManagerCreator)(ProgramStateManager &, SubEngine *)
Definition: ProgramState.h:43
const MemRegion * getBaseRegion() const
Definition: MemRegion.cpp:1129
ProgramStateRef removeDeadBindings(ProgramStateRef St, const StackFrameContext *LCtx, SymbolReaper &SymReaper)
bool isZeroConstant() const
Definition: SVals.cpp:186
bool isTainted(const Stmt *S, const LocationContext *LCtx, TaintTagType Kind=TaintTagGeneric) const
Check if the statement is tainted in the current state.
Symbolic value.
Definition: SymExpr.h:29
Holds long-lived AST nodes (such as types and decls) that can be referred to throughout the semantic ...
Definition: ASTContext.h:92
LineState State
Environment bindExpr(Environment Env, const EnvironmentEntry &E, SVal V, bool Invalidate)
Bind a symbolic value to the given environment entry.
i32 captured_struct **param SharedsTy A type which contains references the shared variables *param Shareds Context with the list of shared variables from the p *TaskFunction *param Data Additional data for task generation like final * state
void setReapedStore(StoreRef st)
Set to the value of the symbolic store after StoreManager::removeDeadBindings has been called...
const SymExpr * getLHS() const
const llvm::APSInt & Convert(const llvm::APSInt &To, const llvm::APSInt &From)
Convert - Create a new persistent APSInt with the same value as 'From' but with the bitwidth and sign...
static bool isLocType(QualType T)
Definition: SVals.h:291
BlockDataRegion - A region that represents a block instance.
Definition: MemRegion.h:627
void *const * FindGDM(void *K) const
bool isUnknownOrUndef() const
Definition: SVals.h:125
virtual void decrementReferenceCount(Store store)
If the StoreManager supports it, decrement the reference count of the specified Store object...
Definition: Store.h:157
A symbol representing the value of a MemRegion whose parent region has symbolic value.
bool isConstant() const
Definition: SVals.cpp:174
detail::InMemoryDirectory::const_iterator I
SVal getSValAsScalarOrLoc(const Stmt *Ex, const LocationContext *LCtx) const
Definition: ProgramState.h:735
virtual void print(ProgramStateRef state, raw_ostream &Out, const char *nl, const char *sep)=0
llvm::ImmutableList< SVal >::iterator iterator
Definition: SVals.h:422
const SmallVectorImpl< AnnotatedLine * >::const_iterator End
virtual ProgramStateRef processRegionChanges(ProgramStateRef state, const InvalidatedSymbols *invalidated, ArrayRef< const MemRegion * > ExplicitRegions, ArrayRef< const MemRegion * > Regions, const CallEvent *Call)=0
processRegionChanges - Called by ProgramStateManager whenever a change is made to the store...
SymbolicRegion - A special, "non-concrete" region.
Definition: MemRegion.h:707
ProgramStateRef invalidateRegions(ArrayRef< const MemRegion * > Regions, const Expr *E, unsigned BlockCount, const LocationContext *LCtx, bool CausesPointerEscape, InvalidatedSymbols *IS=nullptr, const CallEvent *Call=nullptr, RegionAndSymbolInvalidationTraits *ITraits=nullptr) const
Returns the state with bindings for the given regions cleared from the store.
ProgramState - This class encapsulates:
Definition: ProgramState.h:74
Expr - This represents one expression.
Definition: Expr.h:105
SVal getSVal(const Stmt *S, const LocationContext *LCtx) const
Returns the SVal bound to the statement 'S' in the state's environment.
Definition: ProgramState.h:728
Optional< T > getAs() const
Convert to the specified SVal type, returning None if this SVal is not of the desired type...
Definition: SVals.h:86
Represents a cast expression.
ProgramStateRef bindLoc(Loc location, SVal V, bool notifyChanges=true) const
The result type of a method or function.
Kind getKind() const
Definition: SymExpr.h:48
const LazyCompoundValData * getCVData() const
Definition: SVals.h:444
ProgramStateRef BindExpr(const Stmt *S, const LocationContext *LCtx, SVal V, bool Invalidate=true) const
Create a new state by binding the value 'V' to the statement 'S' in the state's environment.
const SourceManager & SM
Definition: Format.cpp:1184
ProgramStateRef removeGDM(ProgramStateRef state, void *Key)
virtual bool VisitMemRegion(const MemRegion *region)
bool scan(nonloc::LazyCompoundVal val)
Kind
bool isIntegralOrEnumerationType() const
Determine whether this type is an integral or enumeration type.
Definition: Type.h:5730
ProgramStateRef getInitialState(const LocationContext *InitLoc)
const TemplateArgument * iterator
Definition: Type.h:4233
const std::string ID
ProgramStateRef assumeInBound(DefinedOrUnknownSVal idx, DefinedOrUnknownSVal upperBound, bool assumption, QualType IndexType=QualType()) const
ProgramStateRef processRegionChange(ProgramStateRef state, const MemRegion *MR)
Definition: SubEngine.h:141
An entry in the environment consists of a Stmt and an LocationContext.
Definition: Environment.h:35
ASTContext & getContext()
Definition: SValBuilder.h:126
SVal - This represents a symbolic expression, which can be either an L-value or an R-value...
Definition: SVals.h:46
A class responsible for cleaning up unused symbols.
const VarRegion * getRegion(const VarDecl *D, const LocationContext *LC) const
Utility method for getting regions.
Definition: ProgramState.h:637
ConditionTruthVal isNull(SVal V) const
Check if the given SVal is constrained to zero or is a zero constant.
void printDOT(raw_ostream &Out) const
ProgramStateRef getPersistentStateWithGDM(ProgramStateRef FromState, ProgramStateRef GDMState)
virtual SVal evalBinOpNN(ProgramStateRef state, BinaryOperator::Opcode op, NonLoc lhs, NonLoc rhs, QualType resultTy)=0
Create a new value which represents a binary expression with two non- location operands.
An immutable map from EnvironemntEntries to SVals.
Definition: Environment.h:56
A symbol representing the value stored at a MemRegion.
Definition: SymbolManager.h:42
virtual bool VisitSymbol(SymbolRef sym)=0
A visitor method invoked by ProgramStateManager::scanReachableSymbols.
void ProgramStateRelease(const ProgramState *state)
Decrement the number of times this state is referenced.
ArrayRef< const MemRegion * > RegionList
static symbol_iterator symbol_end()
Definition: SymExpr.h:78
detail::InMemoryDirectory::const_iterator E
const MemRegion * getAsRegion() const
Definition: SVals.cpp:135
virtual void print(Store store, raw_ostream &Out, const char *nl, const char *sep)=0
ProgramStateRef killBinding(Loc LV) const
Represents an abstract call to a function or method along a particular path.
Definition: CallEvent.h:138
virtual bool scanReachableSymbols(Store S, const MemRegion *R, ScanReachableSymbols &Visitor)=0
Finds the transitive closure of symbols within the given region.
const llvm::APSInt & getMinValue(const llvm::APSInt &v)
ConstraintManager & getConstraintManager()
Definition: ProgramState.h:518
BasicValueFactory & getBasicValueFactory()
Definition: SValBuilder.h:139
SubRegion - A region that subsets another larger region.
Definition: MemRegion.h:410
bool isUnknown() const
Definition: SVals.h:117
const TypedValueRegion * getRegion() const
Definition: SVals.cpp:154
ProgramState(ProgramStateManager *mgr, const Environment &env, StoreRef st, GenericDataMap gdm)
This ctor is used when creating the first ProgramState object.
void ProgramStateRetain(const ProgramState *state)
Increments the number of times this state is referenced.
ProgramStateRef bindDefault(SVal loc, SVal V) const
X
Add a minimal nested name specifier fixit hint to allow lookup of a tag name from an outer enclosing ...
Definition: SemaDecl.cpp:12171
ProgramStateManager(ASTContext &Ctx, StoreManagerCreator CreateStoreManager, ConstraintManagerCreator CreateConstraintManager, llvm::BumpPtrAllocator &alloc, SubEngine *subeng)
void print(raw_ostream &Out, const char *nl="\n", const char *sep="") const
Environment removeDeadBindings(Environment Env, SymbolReaper &SymReaper, ProgramStateRef state)
void * FindGDMContext(void *index, void *(*CreateContext)(llvm::BumpPtrAllocator &), void(*DeleteContext)(void *))
SymbolRef getAsSymbol(bool IncludeBaseRegions=false) const
If this SVal wraps a symbol return that SymbolRef.
Definition: SVals.cpp:111
virtual void incrementReferenceCount(Store store)
If the StoreManager supports it, increment the reference count of the specified Store object...
Definition: Store.h:152
symbol_iterator symbol_begin() const
Definition: SymExpr.h:77
ElementRegin is used to represent both array elements and casts.
Definition: MemRegion.h:1004
virtual ProgramStateRef notifyCheckersOfPointerEscape(ProgramStateRef State, const InvalidatedSymbols *Invalidated, ArrayRef< const MemRegion * > ExplicitRegions, ArrayRef< const MemRegion * > Regions, const CallEvent *Call, RegionAndSymbolInvalidationTraits &HTraits)=0
CanQualType IntTy
Definition: ASTContext.h:901
virtual void printState(raw_ostream &Out, ProgramStateRef State, const char *NL, const char *Sep)=0
printState - Called by ProgramStateManager to print checker-specific data.
static void Profile(llvm::FoldingSetNodeID &ID, const ProgramState *V)
Profile - Profile the contents of a ProgramState object for use in a FoldingSet.
Definition: ProgramState.h:134
virtual const llvm::APSInt * getSymVal(ProgramStateRef state, SymbolRef sym) const
If a symbol is perfectly constrained to a constant, attempt to return the concrete value...
const SymExpr * getAsSymbolicExpression() const
getAsSymbolicExpression - If this Sval wraps a symbolic expression then return that expression...
Definition: SVals.cpp:121
ProgramStateRef getPersistentState(ProgramState &Impl)
iterator begin() const
Definition: SVals.cpp:162
BasicValueFactory & getBasicVals() const
Definition: ProgramState.h:756
bool isNull() const
Return true if this QualType doesn't point to a type yet.
Definition: Type.h:665
T castAs() const
Convert to the specified SVal type, asserting that this SVal is of the desired type.
Definition: SVals.h:75
void printTaint(raw_ostream &Out, const char *nl="\n", const char *sep="") const
Represents a symbolic expression like 'x' + 'y'.
ArrayRef< SVal > ValueList
Expr * IgnoreParens() LLVM_READONLY
IgnoreParens - Ignore parentheses.
Definition: Expr.cpp:2295
bool scanReachableSymbols(SVal val, SymbolVisitor &visitor) const
Visits the symbols reachable from the given SVal using the provided SymbolVisitor.
std::unique_ptr< StoreManager >(* StoreManagerCreator)(ProgramStateManager &)
Definition: ProgramState.h:45
Iterator over symbols that the current symbol depends on.
Definition: SymExpr.h:62
const void * getStore() const
Definition: SVals.cpp:150