18 using namespace clang;
40 SVal LeftV = state->getSVal(LHS, LCtx);
41 SVal RightV = state->getSVal(RHS, LCtx);
45 if (Op == BO_Assign) {
56 evalStore(Tmp2, B, LHS, *it, state->BindExpr(B, LCtx, ExprVal),
89 state = createTemporaryRegionIfNeeded(state, LCtx, LHS);
99 state = state->BindExpr(B, LCtx, Result);
108 llvm_unreachable(
"Invalid opcode for compound assignment.");
109 case BO_MulAssign: Op = BO_Mul;
break;
110 case BO_DivAssign: Op = BO_Div;
break;
111 case BO_RemAssign: Op = BO_Rem;
break;
112 case BO_AddAssign: Op = BO_Add;
break;
113 case BO_SubAssign: Op = BO_Sub;
break;
114 case BO_ShlAssign: Op = BO_Shl;
break;
115 case BO_ShrAssign: Op = BO_Shr;
break;
116 case BO_AndAssign: Op = BO_And;
break;
117 case BO_XorAssign: Op = BO_Xor;
break;
118 case BO_OrAssign: Op = BO_Or;
break;
124 SVal location = LeftV;
125 evalLoad(Tmp, B, LHS, *it, state, location);
130 state = (*I)->getState();
132 SVal V = state->getSVal(LHS, LCtx);
136 cast<CompoundAssignOperator>(B)->getComputationResultType();
140 cast<CompoundAssignOperator>(B)->getComputationLHSType();
146 V = svalBuilder.
evalCast(V, CLHSTy, LTy);
164 Result = svalBuilder.
evalCast(LHSVal, CTy, LTy);
169 LHSVal = svalBuilder.
evalCast(Result, LTy, CTy);
175 state = state->BindExpr(B, LCtx, location);
177 state = state->BindExpr(B, LCtx, Result);
179 evalStore(Tmp2, B, LHS, *
I, state, location, LHSVal);
203 dyn_cast_or_null<BlockDataRegion>(V.
getAsRegion())) {
206 E = BDR->referenced_vars_end();
210 for (; I !=
E; ++
I) {
220 const Expr *copyExpr =
nullptr;
222 assert(CI->getVariable() == capturedR->
getDecl());
223 copyExpr = CI->getCopyExpr();
227 if (capturedR != originalR) {
261 evalLoad(Dst, CastE, CastE, subExprNode, state, state->getSVal(Ex, LCtx));
270 if (
const ExplicitCastExpr *ExCast=dyn_cast_or_null<ExplicitCastExpr>(CastE))
271 T = ExCast->getTypeAsWritten();
282 case CK_LValueToRValue:
283 llvm_unreachable(
"LValueToRValue casts handled earlier.");
288 case CK_ARCProduceObject:
289 case CK_ARCConsumeObject:
290 case CK_ARCReclaimReturnedObject:
291 case CK_ARCExtendBlockObject:
292 case CK_CopyAndAutoreleaseBlockObject:
296 case CK_AtomicToNonAtomic:
297 case CK_NonAtomicToAtomic:
300 case CK_ConstructorConversion:
301 case CK_UserDefinedConversion:
302 case CK_FunctionToPointerDecay:
303 case CK_BuiltinFnToFnPtr: {
307 SVal V = state->getSVal(Ex, LCtx);
308 state = state->BindExpr(CastE, LCtx, V);
312 case CK_MemberPointerToBoolean:
316 case CK_ArrayToPointerDecay:
318 case CK_AddressSpaceConversion:
319 case CK_BooleanToSignedIntegral:
320 case CK_NullToPointer:
321 case CK_IntegralToPointer:
322 case CK_PointerToIntegral:
323 case CK_PointerToBoolean:
324 case CK_IntegralToBoolean:
325 case CK_IntegralToFloating:
326 case CK_FloatingToIntegral:
327 case CK_FloatingToBoolean:
328 case CK_FloatingCast:
329 case CK_FloatingRealToComplex:
330 case CK_FloatingComplexToReal:
331 case CK_FloatingComplexToBoolean:
332 case CK_FloatingComplexCast:
333 case CK_FloatingComplexToIntegralComplex:
334 case CK_IntegralRealToComplex:
335 case CK_IntegralComplexToReal:
336 case CK_IntegralComplexToBoolean:
337 case CK_IntegralComplexCast:
338 case CK_IntegralComplexToFloatingComplex:
339 case CK_CPointerToObjCPointerCast:
340 case CK_BlockPointerToObjCPointerCast:
341 case CK_AnyPointerToBlockPointerCast:
342 case CK_ObjCObjectLValueCast:
343 case CK_ZeroToOCLEvent:
344 case CK_LValueBitCast: {
346 SVal V = state->getSVal(Ex, LCtx);
347 V = svalBuilder.
evalCast(V, T, ExTy);
349 if (CastE->
getCastKind() == CK_BooleanToSignedIntegral)
351 state = state->BindExpr(CastE, LCtx, V);
355 case CK_IntegralCast: {
357 SVal V = state->getSVal(Ex, LCtx);
359 state = state->BindExpr(CastE, LCtx, V);
363 case CK_DerivedToBase:
364 case CK_UncheckedDerivedToBase: {
366 SVal val = state->getSVal(Ex, LCtx);
368 state = state->BindExpr(CastE, LCtx, val);
374 SVal val = state->getSVal(Ex, LCtx);
398 state = state->BindExpr(CastE, LCtx, svalBuilder.
makeNull());
406 state = state->BindExpr(CastE, LCtx, NewSym);
409 state = state->BindExpr(CastE, LCtx, val);
414 case CK_NullToMemberPointer: {
417 state = state->BindExpr(CastE, LCtx, V);
423 case CK_BaseToDerived:
424 case CK_BaseToDerivedMemberPointer:
425 case CK_DerivedToBaseMemberPointer:
426 case CK_ReinterpretMemberPointer:
427 case CK_VectorSplat: {
435 state = state->BindExpr(CastE, LCtx, result);
454 if (isa<CXXConstructExpr>(Init)) {
457 assert(isa<InitListExpr>(Init));
458 Loc CLLoc = State->getLValue(CL, LCtx);
459 State = State->bindLoc(CLLoc, V);
504 SVal InitVal = state->getSVal(InitEx, LC);
507 if (
auto *CtorExpr = findDirectConstructorForCurrentCFGElement()) {
508 assert(InitEx->IgnoreImplicit() == CtorExpr);
520 InitVal = state->getSVal(M->getRegion());
529 if (InitEx->isGLValue()) {
540 evalBind(Dst2, DS, UpdatedN, state->getLValue(VD, LC), InitVal,
true);
581 assert(Term->isLogicalOp());
591 assert(!SrcBlock->
empty());
593 const Expr *RHS = cast<Expr>(Elem.getStmt());
596 if (RHSVal.isUndef()) {
601 std::tie(StTrue, StFalse) = N->getState()->assume(DefinedRHS);
613 assert(StFalse &&
"Infeasible path!");
638 if (NumInitElements == 0) {
645 ei = IE->
rend(); it != ei; ++it) {
646 SVal V = state->getSVal(cast<Expr>(*it), LCtx);
651 state->BindExpr(IE, LCtx,
659 assert(NumInitElements <= 1);
662 if (NumInitElements == 0)
665 V = state->getSVal(IE->
getInit(0), LCtx);
687 assert(N->pred_size() == 1);
691 SrcState = N->getState();
695 assert(SrcBlock &&
"missing function entry");
699 bool hasValue =
false;
702 for (
CFGElement CE : llvm::reverse(*SrcBlock)) {
704 const Expr *ValEx = cast<Expr>(CS->getStmt());
710 L = OpaqueEx->getSourceExpr();
716 V = SrcState->getSVal(ValEx, LCtx);
727 B.
generateNode(Ex, Pred, state->BindExpr(Ex, LCtx, V,
true));
783 state = state->BindExpr(Ex, (*I)->getLocationContext(),
826 state->getSVal(Ex, LCtx)));
862 state->getSVal(Ex, LCtx)));
875 SVal V = state->getSVal(Ex, LCtx);
884 llvm_unreachable(
"Invalid Opcode.");
903 else if (Ex->getType()->isFloatingType()) {
912 state = state->BindExpr(U, LCtx, Result);
933 SVal loc = state->getSVal(Ex, LCtx);
937 evalLoad(Tmp, U, Ex, Pred, state, loc);
943 state = (*I)->getState();
944 assert(LCtx == (*I)->getLocationContext());
945 SVal V2_untested = state->getSVal(Ex, LCtx);
948 if (V2_untested.isUnknownOrUndef()) {
949 Bldr.
generateNode(U, *
I, state->BindExpr(U, LCtx, V2_untested));
985 if (!state->assume(Constraint,
true)) {
988 Constraint = svalBuilder.
evalEQ(state, SymVal,
992 state = state->assume(Constraint,
false);
1001 state = state->BindExpr(U, LCtx, loc);
1003 state = state->BindExpr(U, LCtx, U->
isPostfix() ? V2 : Result);
1008 evalStore(Dst3, U, U, *
I, state, loc, Result);
unsigned getNumInits() const
CastKind getCastKind() const
nonloc::ConcreteInt makeIntVal(const IntegerLiteral *integer)
DefinedSVal getBlockPointer(const BlockDecl *block, CanQualType locTy, const LocationContext *locContext, unsigned blockCount)
reverse_iterator rbegin()
SVal evalDerivedToBase(SVal Derived, const CastExpr *Cast)
Evaluates a chain of derived-to-base casts through the path specified in Cast.
SVal evalDynamicCast(SVal Base, QualType DerivedPtrType, bool &Failed)
Evaluates C++ dynamic_cast cast.
A (possibly-)qualified type.
succ_iterator succ_begin()
This builder class is useful for generating nodes that resulted from visiting a statement.
QuantityType getQuantity() const
getQuantity - Get the raw integer representation of this quantity.
bool isRecordType() const
ProgramPoint getLocation() const
getLocation - Returns the edge associated with the given node.
SVal evalBinOp(ProgramStateRef state, BinaryOperator::Opcode op, NonLoc L, NonLoc R, QualType T)
unsigned pred_size() const
Represents a point after we ran remove dead bindings BEFORE processing the given statement.
const Expr * getInit() const
SVal evalCast(SVal val, QualType castTy, QualType originalType)
Value representing integer constant.
void VisitUnaryOperator(const UnaryOperator *B, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitUnaryOperator - Transfer function logic for unary operators.
void takeNodes(const ExplodedNodeSet &S)
VarDecl - An instance of this class is created to represent a variable declaration or definition...
CompoundLiteralExpr - [C99 6.5.2.5].
unsigned succ_size() const
NonLoc makeArrayIndex(uint64_t idx)
uint64_t getTypeSize(QualType T) const
Return the size of the specified (complete) type T, in bits.
void evalStore(ExplodedNodeSet &Dst, const Expr *AssignE, const Expr *StoreE, ExplodedNode *Pred, ProgramStateRef St, SVal TargetLV, SVal Val, const ProgramPointTag *tag=nullptr)
evalStore - Handle the semantics of a store via an assignment.
UnaryExprOrTypeTrait getKind() const
static bool isAssignmentOp(Opcode Opc)
bool isZeroConstant() const
Defines the clang::Expr interface and subclasses for C++ expressions.
InitExprsTy::const_reverse_iterator const_reverse_iterator
ImplTy::iterator iterator
Represents a class type in Objective C.
SVal evalIntegralCast(ProgramStateRef state, SVal val, QualType castTy, QualType originalType)
bool isReferenceType() const
bool isAnyPointerType() const
llvm::ImmutableList< SVal > consVals(SVal X, llvm::ImmutableList< SVal > L)
static bool isIncrementDecrementOp(Opcode Op)
T castAs() const
Convert to the specified CFGElement type, asserting that this CFGElement is of the desired type...
ASTContext & getContext() const
getContext - Return the ASTContext associated with this analysis.
i32 captured_struct **param SharedsTy A type which contains references the shared variables *param Shareds Context with the list of shared variables from the p *TaskFunction *param Data Additional data for task generation like final * state
const VarDecl * getDecl() const
static bool isLocType(QualType T)
Describes an C or C++ initializer list.
void VisitOffsetOfExpr(const OffsetOfExpr *Ex, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitOffsetOfExpr - Transfer function for offsetof.
BlockDataRegion - A region that represents a block instance.
ExplodedNode * generateSink(const Stmt *S, ExplodedNode *Pred, ProgramStateRef St, const ProgramPointTag *tag=nullptr, ProgramPoint::Kind K=ProgramPoint::PostStmtKind)
CharUnits - This is an opaque type for sizes expressed in character units.
bool isUnknownOrUndef() const
A builtin binary operation expression such as "x + y" or "x <= y".
static bool isPostfix(Opcode Op)
isPostfix - Return true if this is a postfix operation, like x++.
NonLoc makeCompoundVal(QualType type, llvm::ImmutableList< SVal > vals)
CastExpr - Base class for type casts, including both implicit casts (ImplicitCastExpr) and explicit c...
bool isIncompleteType(NamedDecl **Def=nullptr) const
Types are partitioned into 3 broad categories (C99 6.2.5p1): object types, function types...
SVal evalComplement(SVal X)
void VisitDeclStmt(const DeclStmt *DS, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitDeclStmt - Transfer function logic for DeclStmts.
detail::InMemoryDirectory::const_iterator I
void evalBind(ExplodedNodeSet &Dst, const Stmt *StoreE, ExplodedNode *Pred, SVal location, SVal Val, bool atDeclInit=false, const ProgramPoint *PP=nullptr)
evalBind - Handle the semantics of binding a value to a specific location.
void VisitLogicalExpr(const BinaryOperator *B, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitLogicalExpr - Transfer function logic for '&&', '||'.
const LocationContext * getLocationContext() const
const CFGBlock * getSrc() const
UnaryExprOrTypeTraitExpr - expression with either a type or (unevaluated) expression operand...
CFGBlock - Represents a single basic block in a source-level CFG.
void VisitInitListExpr(const InitListExpr *E, ExplodedNode *Pred, ExplodedNodeSet &Dst)
unsigned blockCount() const
Returns the number of times the current basic block has been visited on the exploded graph path...
CheckerManager & getCheckerManager() const
void runCheckersForPostStmt(ExplodedNodeSet &Dst, const ExplodedNodeSet &Src, const Stmt *S, ExprEngine &Eng, bool wasInlined=false)
Run checkers for post-visiting Stmts.
const CFGBlock * getDst() const
DefinedOrUnknownSVal makeZeroVal(QualType type)
Construct an SVal representing '0' for the specified type.
BlockDecl - This represents a block literal declaration, which is like an unnamed FunctionDecl...
Expr - This represents one expression.
const ProgramStateRef & getState() const
bool isAnyComplexType() const
const VarRegion * getCapturedRegion() const
void VisitCast(const CastExpr *CastE, const Expr *Ex, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitCast - Transfer function logic for all casts (implicit and explicit).
BlockExpr - Adaptor class for mixing a BlockDecl with expressions.
capture_const_iterator capture_begin() const
Optional< T > getAs() const
Convert to the specified SVal type, returning None if this SVal is not of the desired type...
bool isVariableArrayType() const
const ExplodedNodeSet & getResults()
static CharUnits fromQuantity(QuantityType Quantity)
fromQuantity - Construct a CharUnits quantity from a raw integer type.
static SVal getValue(SVal val, SValBuilder &svalBuilder)
Expr * getSubExpr() const
T castAs() const
Convert to the specified ProgramPoint type, asserting that this ProgramPoint is of the desired type...
bool EvaluateAsInt(llvm::APSInt &Result, const ASTContext &Ctx, SideEffectsKind AllowSideEffects=SE_NoSideEffects) const
EvaluateAsInt - Return true if this is a constant which we can fold and convert to an integer...
UnaryOperator - This represents the unary-expression's (except sizeof and alignof), the postinc/postdec operators from postfix-expression, and various extensions.
void evalLoad(ExplodedNodeSet &Dst, const Expr *NodeEx, const Expr *BoundExpr, ExplodedNode *Pred, ProgramStateRef St, SVal location, const ProgramPointTag *tag=nullptr, QualType LoadTy=QualType())
Simulate a read of the result of Ex.
The result type of a method or function.
reverse_iterator rbegin()
CFGTerminator getTerminator()
OpaqueValueExpr - An expression referring to an opaque object of a fixed type and value class...
bool isIntegralOrEnumerationType() const
Determine whether this type is an integral or enumeration type.
void VisitGuardedExpr(const Expr *Ex, const Expr *L, const Expr *R, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitGuardedExpr - Transfer function logic for ?, __builtin_choose.
DefinedOrUnknownSVal conjureSymbolVal(const void *symbolTag, const Expr *expr, const LocationContext *LCtx, unsigned count)
Create a new symbol with a unique 'name'.
bool isBuiltinType() const
Helper methods to distinguish type categories.
bool isSingleDecl() const
isSingleDecl - This method returns true if this DeclStmt refers to a single Decl. ...
bool isConstantSizeType() const
Return true if this is not a variable sized type, according to the rules of C99 6.7.5p3.
capture_const_iterator capture_end() const
DeclStmt - Adaptor class for mixing declarations with statements and expressions. ...
void VisitCompoundLiteralExpr(const CompoundLiteralExpr *CL, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitCompoundLiteralExpr - Transfer function logic for compound literals.
llvm::APSInt EvaluateKnownConstInt(const ASTContext &Ctx, SmallVectorImpl< PartialDiagnosticAt > *Diag=nullptr) const
EvaluateKnownConstInt - Call EvaluateAsRValue and return the folded integer.
const VarRegion * getOriginalRegion() const
SVal - This represents a symbolic expression, which can be either an L-value or an R-value...
decl_iterator decl_begin()
void VisitUnaryExprOrTypeTraitExpr(const UnaryExprOrTypeTraitExpr *Ex, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitUnaryExprOrTypeTraitExpr - Transfer function for sizeof.
bool isVectorType() const
BasicValueFactory & getBasicVals()
void runCheckersForPreStmt(ExplodedNodeSet &Dst, const ExplodedNodeSet &Src, const Stmt *S, ExprEngine &Eng)
Run checkers for pre-visiting Stmts.
const BlockDecl * getBlockDecl() const
void insert(const ExplodedNodeSet &S)
void VisitIncrementDecrementOperator(const UnaryOperator *U, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Handle ++ and – (both pre- and post-increment).
SValBuilder & getSValBuilder()
void addNodes(const ExplodedNodeSet &S)
StoreManager & getStoreManager()
QualType getPointerType(QualType T) const
Return the uniqued reference to the type for a pointer to the specified type.
detail::InMemoryDirectory::const_iterator E
const MemRegion * getAsRegion() const
CanQualType getCanonicalType(QualType T) const
Return the canonical (structural) type corresponding to the specified potentially non-canonical type ...
ExplicitCastExpr - An explicit cast written in the source code.
Optional< T > getAs() const
Convert to the specified ProgramPoint type, returning None if this ProgramPoint is not of the desired...
const T * getAs() const
Member-template getAs<specific type>'.
QualType getTypeOfArgument() const
Gets the argument type, or the type of the argument expression, whichever is appropriate.
static bool isAdditiveOp(Opcode Opc)
const Expr * getInitializer() const
static bool isIncrementOp(Opcode Op)
X
Add a minimal nested name specifier fixit hint to allow lookup of a tag name from an outer enclosing ...
void VisitBlockExpr(const BlockExpr *BE, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitBlockExpr - Transfer function logic for BlockExprs.
static bool isCompoundAssignmentOp(Opcode Opc)
DefinedOrUnknownSVal evalEQ(ProgramStateRef state, DefinedOrUnknownSVal lhs, DefinedOrUnknownSVal rhs)
pred_iterator pred_begin()
CFGElement - Represents a top-level expression in a basic block.
This class is used for builtin types like 'int'.
CFGTerminator - Represents CFGBlock terminator statement.
ExplodedNode * generateNode(const Stmt *S, ExplodedNode *Pred, ProgramStateRef St, const ProgramPointTag *tag=nullptr, ProgramPoint::Kind K=ProgramPoint::PostStmtKind)
const LangOptions & getLangOpts() const
const Expr * getInit(unsigned Init) const
OffsetOfExpr - [C99 7.17] - This represents an expression of the form offsetof(record-type, member-designator).
void VisitBinaryOperator(const BinaryOperator *B, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitBinaryOperator - Transfer function logic for binary operators.
bool isSignedIntegerType() const
Return true if this is an integer type that is signed, according to C99 6.2.5p4 [char, signed char, short, int, long..], or an enum decl which has a signed representation.
T castAs() const
Convert to the specified SVal type, asserting that this SVal is of the desired type.
llvm::ImmutableList< SVal > getEmptySValList()
Expr * IgnoreParens() LLVM_READONLY
IgnoreParens - Ignore parentheses.