;
50voidSValBuilder::anchor() {}
54: Context(context), BasicVals(context, alloc),
55SymMgr(context, BasicVals, alloc), MemMgr(context, alloc),
58stateMgr.getOwningEngine().getAnalysisManager().getAnalyzerOptions()),
59ArrayIndexTy(context.LongLongTy),
60ArrayIndexWidth(context.getTypeSize(ArrayIndexTy)) {}
66 if(
type->isIntegralOrEnumerationType())
69 if(
type->isArrayType() ||
type->isRecordType() ||
type->isVectorType() ||
70 type->isAnyComplexType())
122 if(std::optional<nonloc::ConcreteInt> CI =
124 constllvm::APSInt& I = CI->getValue();
177 if(
type->isNullPtrType())
194 unsignedvisitCount) {
195 if(
type->isNullPtrType())
222 if(
type->isNullPtrType()) {
276assert(!ND || (isa<CXXMethodDecl, FieldDecl, IndirectFieldDecl>(ND)));
278 if(
const auto*MD = dyn_cast_or_null<CXXMethodDecl>(ND)) {
284 if(!MD->isImplicitObjectMemberFunction())
298 unsignedblockCount) {
306std::optional<loc::MemRegionVal>
323 const Type*
T=
D->getTypeForDecl();
334 caseStmt::AddrLabelExprClass:
335 return makeLoc(cast<AddrLabelExpr>(
E));
337 caseStmt::CXXScalarValueInitExprClass:
338 caseStmt::ImplicitValueInitExprClass:
341 caseStmt::ObjCStringLiteralClass: {
342 const auto*SL = cast<ObjCStringLiteral>(
E);
346 caseStmt::StringLiteralClass: {
347 const auto*SL = cast<StringLiteral>(
E);
351 caseStmt::PredefinedExprClass: {
352 const auto*PE = cast<PredefinedExpr>(
E);
353assert(PE->getFunctionName() &&
354 "Since we analyze only instantiated functions, PredefinedExpr " 355 "should have a function name.");
361 caseStmt::CharacterLiteralClass: {
362 const auto*
C= cast<CharacterLiteral>(
E);
366 caseStmt::CXXBoolLiteralExprClass:
369 caseStmt::TypeTraitExprClass: {
370 const auto*TE = cast<TypeTraitExpr>(
E);
374 caseStmt::IntegerLiteralClass:
377 caseStmt::ObjCBoolLiteralExprClass:
380 caseStmt::CXXNullPtrLiteralExprClass:
383 caseStmt::CStyleCastExprClass:
384 caseStmt::CXXFunctionalCastExprClass:
385 caseStmt::CXXConstCastExprClass:
386 caseStmt::CXXReinterpretCastExprClass:
387 caseStmt::CXXStaticCastExprClass:
388 caseStmt::ImplicitCastExprClass: {
389 const auto*CE = cast<CastExpr>(
E);
390 switch(CE->getCastKind()) {
393 caseCK_ArrayToPointerDecay:
394 caseCK_IntegralToPointer:
397 const Expr*SE = CE->getSubExpr();
435 const unsignedMaxComp =
AnOpts.MaxSymbolComplexity;
437 if(symLHS && symRHS &&
439 return makeNonLoc(symLHS, Op, symRHS, ResultTy);
442 if(std::optional<nonloc::ConcreteInt> rInt =
444 return makeNonLoc(symLHS, Op, rInt->getValue(), ResultTy);
447 if(std::optional<nonloc::ConcreteInt> lInt =
449 return makeNonLoc(lInt->getValue(), Op, symRHS, ResultTy);
455 switch(
X.getKind()) {
456 casenonloc::ConcreteIntKind:
458 casenonloc::SymbolValKind:
467 switch(
X.getKind()) {
468 casenonloc::ConcreteIntKind:
470 casenonloc::SymbolValKind:
488llvm_unreachable(
"Unexpected unary operator");
499 if(isa<nonloc::LazyCompoundVal>(lhs) || isa<nonloc::LazyCompoundVal>(rhs)) {
503 if(op == BinaryOperatorKind::BO_Cmp) {
511 if(std::optional<Loc> LV = lhs.
getAs<
Loc>()) {
512 if(std::optional<Loc> RV = rhs.
getAs<
Loc>())
518 if(
conststd::optional<Loc> RV = rhs.
getAs<
Loc>()) {
520 returnOp == BO_Mul || Op == BO_Add || Op == BO_And || Op == BO_Xor ||
524 if(IsCommutative(op)) {
543 returnstate->isNonNull(
evalEQ(state, lhs, rhs));
553 return evalEQ(state,
static_cast<SVal>(lhs),
static_cast<SVal>(rhs))
571 if(Quals1 != Quals2)
597 return evalCast(val, castTy, originalTy);
601 if(!AsSymbol || !AsNonLoc)
602 return evalCast(val, castTy, originalTy);
617std::tie(IsNotTruncated, IsTruncated) = state->assume(CompVal);
618 if(!IsNotTruncated && IsTruncated) {
620 return makeNonLoc(AsSymbol, originalTy, castTy);
622 return evalCast(val, castTy, originalTy);
631classEvalCastVisitor :
public SValVisitor<EvalCastVisitor, SVal> {
639: VB(VB), Context(VB.getContext()), CastTy(CastTy),
640OriginalTy(OriginalTy) {}
648 const boolIsUnknownOriginalType = OriginalTy.
isNull();
649 if(!IsUnknownOriginalType) {
652 if(CastTy == OriginalTy)
670 returnVB.
makeTruthVal(
V.getValue()->getBoolValue(), CastTy);
674llvm::APSInt
Value=
V.getValue();
681llvm::APSInt
Value=
V.getValue();
697 const unsignedBitWidth = Context.
getIntWidth(CastTy);
701 const boolIsUnknownOriginalType = OriginalTy.
isNull();
702 if(!IsUnknownOriginalType) {
704 if(isa<ArrayType>(OriginalTy))
721 if(
const FunctionDecl*FD = dyn_cast<FunctionDecl>(FTR->getDecl()))
744 const boolIsUnknownOriginalType = OriginalTy.
isNull();
746 const auto*ArrayTy =
747IsUnknownOriginalType
757 QualTypeElemTy = ArrayTy->getElementType();
764 const unsignedBitWidth = Context.
getIntWidth(CastTy);
771 if(IsUnknownOriginalType) {
782 if(
const auto*SR = dyn_cast<SymbolicRegion>(R)) {
783 QualTypeSRTy = SR->getSymbol()->getType();
785 autoHasSameUnqualifiedPointeeType = [](
QualTypety1,
790 if(!HasSameUnqualifiedPointeeType(SRTy, CastTy)) {
798 if(
const auto*ER = dyn_cast<ElementRegion>(R)) {
817 QualTypeElemTy = ArrayTy->getElementType();
866 autoCastedValue = [
V,
this]() {
867llvm::APSInt
Value=
V.getValue();
874 returnVB.
makeTruthVal(
V.getValue()->getBoolValue(), CastTy);
899 const boolIsUnknownOriginalType = OriginalTy.
isNull();
911 if(!IsUnknownOriginalType && R) {
926 if(IsUnknownOriginalType)
934dyn_cast<SymbolicRegion>(R->
StripCasts())) {
935SE = SR->getSymbol();
941 const unsignedCastSize = Context.
getIntWidth(CastTy);
942 if(CastSize ==
V.getNumBits())
955 const boolIsUnknownOriginalType = OriginalTy.
isNull();
979 if(!Opts.ShouldSupportSymbolicIntegerCasts)
981 returnsimplifySymbolCast(
V, CastTy);
1054 if(!isa<SymbolCast>(SE))
1057 SymbolRefRootSym = cast<SymbolCast>(SE)->getOperand();
1072 const boolisSameType = (RT == CastTy);
1083 if(((WT > WR) && (UR || !UT)) || ((WT == WR) && (UT == UR)))
1103EvalCastVisitor TRV{*
this, CastTy, OriginalTy};
1104 returnTRV.Visit(
V);
Defines the clang::ASTContext interface.
This file defines AnalysisDeclContext, a class that manages the analysis context data for context sen...
Defines the C++ Decl subclasses, other than those for templates (found in DeclTemplate....
Defines the clang::Expr interface and subclasses for C++ expressions.
Forward-declares and imports various common LLVM datatypes that clang wants to use unqualified.
llvm::DenseMap< const CFGBlock *, unsigned > VisitCount
static bool shouldBeModeledWithNoOp(ASTContext &Context, QualType ToTy, QualType FromTy)
Recursively check if the pointer types are equal modulo const, volatile, and restrict qualifiers.
C Language Family Type Representation.
Holds long-lived AST nodes (such as types and decls) that can be referred to throughout the semantic ...
unsigned getIntWidth(QualType T) const
CanQualType getCanonicalType(QualType T) const
Return the canonical (structural) type corresponding to the specified potentially non-canonical type ...
QualType getPointerType(QualType T) const
Return the uniqued reference to the type for a pointer to the specified type.
bool UnwrapSimilarTypes(QualType &T1, QualType &T2, bool AllowPiMismatch=true) const
Attempt to unwrap two types that may be similar (C++ [conv.qual]).
QualType getUnqualifiedArrayType(QualType T, Qualifiers &Quals) const
Return this type as a completely-unqualified array type, capturing the qualifiers in Quals.
ASTContext & getASTContext() const
Stores options for the analyzer from the command line.
Represents a block literal declaration, which is like an unnamed FunctionDecl.
A boolean literal, per ([C++ lex.bool] Boolean literals).
Represents a static or instance method of a struct/union/class.
Represents a C++ struct/union/class.
This represents one expression.
bool EvaluateAsInt(EvalResult &Result, const ASTContext &Ctx, SideEffectsKind AllowSideEffects=SE_NoSideEffects, bool InConstantContext=false) const
EvaluateAsInt - Return true if this is a constant which we can fold and convert to an integer,...
Expr * IgnoreParens() LLVM_READONLY
Skip past any parentheses which might surround this expression until reaching a fixed point.
@ NPC_ValueDependentIsNotNull
Specifies that a value-dependent expression should be considered to never be a null pointer constant.
NullPointerConstantKind isNullPointerConstant(ASTContext &Ctx, NullPointerConstantValueDependence NPC) const
isNullPointerConstant - C99 6.3.2.3p3 - Test if this reduces down to a Null pointer constant.
Represents a function declaration or definition.
It wraps the AnalysisDeclContext to represent both the call stack with the help of StackFrameContext ...
LLVM_ATTRIBUTE_RETURNS_NONNULL AnalysisDeclContext * getAnalysisDeclContext() const
This represents a decl that may have a name.
A (possibly-)qualified type.
bool isNull() const
Return true if this QualType doesn't point to a type yet.
const Type * getTypePtr() const
Retrieves a pointer to the underlying (unqualified) type.
QualType getCanonicalType() const
The collection of all-type qualifiers we support.
void removeCVRQualifiers(unsigned mask)
It represents a stack frame of the call stack (based on CallEvent).
Stmt - This represents one statement.
StmtClass getStmtClass() const
The base class of the type hierarchy.
bool isBlockPointerType() const
bool isBooleanType() const
bool isIntegralOrUnscopedEnumerationType() const
Determine whether this type is an integral or unscoped enumeration type.
bool isVoidPointerType() const
bool isFunctionPointerType() const
bool isPointerType() const
bool isReferenceType() const
bool isVariableArrayType() const
QualType getPointeeType() const
If this is a pointer, ObjC object pointer, or block pointer, this returns the respective pointee.
bool isIntegralOrEnumerationType() const
Determine whether this type is an integral or enumeration type.
bool isMemberPointerType() const
bool isFunctionType() const
bool isFloatingType() const
bool isUnsignedIntegerType() const
Return true if this is an integer type that is unsigned, according to C99 6.2.5p6 [which returns true...
bool isNullPtrType() const
A safe wrapper around APSInt objects allocated and owned by BasicValueFactory.
A record of the "type" of an APSInt, used for conversions.
uint32_t getBitWidth() const
llvm::APSInt getMaxValue() const LLVM_READONLY
Returns the maximum value for this type.
void apply(llvm::APSInt &Value) const
Convert a given APSInt, in place, to match this type.
AllocaRegion - A region that represents an untyped blob of bytes created by a call to 'alloca'.
AnalyzerOptions & getAnalyzerOptions() override
APSIntPtr getZeroWithTypeSize(QualType T)
APSIntType getAPSIntType(QualType T) const
Returns the type of the APSInt used to store values of the given QualType.
llvm::ImmutableList< SVal > getEmptySValList()
Template implementation for all binary symbolic expressions.
BlockCodeRegion - A region that represents code texts of blocks (closures).
BlockDataRegion - A region that represents a block instance.
AnalysisManager & getAnalysisManager()
FunctionCodeRegion - A region that represents code texts of function.
static bool isLocType(QualType T)
const BlockCodeRegion * getBlockCodeRegion(const BlockDecl *BD, CanQualType locTy, AnalysisDeclContext *AC)
const AllocaRegion * getAllocaRegion(const Expr *Ex, unsigned Cnt, const LocationContext *LC)
getAllocaRegion - Retrieve a region associated with a call to alloca().
const SymbolicRegion * getSymbolicHeapRegion(SymbolRef sym)
Return a unique symbolic region belonging to heap memory space.
const SymbolicRegion * getSymbolicRegion(SymbolRef Sym, const MemSpaceRegion *MemSpace=nullptr)
Retrieve or create a "symbolic" memory region.
const FunctionCodeRegion * getFunctionCodeRegion(const NamedDecl *FD)
const BlockDataRegion * getBlockDataRegion(const BlockCodeRegion *bc, const LocationContext *lc, unsigned blockCount)
getBlockDataRegion - Get the memory region associated with an instance of a block.
MemRegion - The root abstract class for all memory regions.
LLVM_ATTRIBUTE_RETURNS_NONNULL const MemRegion * StripCasts(bool StripBaseAndDerivedCasts=true) const
const SymbolicRegion * getSymbolicBase() const
If this is a symbolic region, returns the region.
ExprEngine & getOwningEngine()
SVal ArrayToPointer(Loc Array, QualType ElementTy)
StoreManager & getStoreManager()
DefinedOrUnknownSVal makeZeroVal(QualType type)
Construct an SVal representing '0' for the specified type.
DefinedSVal getMemberPointer(const NamedDecl *ND)
SVal evalMinus(NonLoc val)
SVal evalComplement(NonLoc val)
BasicValueFactory & getBasicValueFactory()
NonLoc makeCompoundVal(QualType type, llvm::ImmutableList< SVal > vals)
SymbolManager SymMgr
Manages the creation of symbols.
virtual SVal evalBinOpLN(ProgramStateRef state, BinaryOperator::Opcode op, Loc lhs, NonLoc rhs, QualType resultTy)=0
Create a new value which represents a binary expression with a memory location and non-location opera...
DefinedSVal getMetadataSymbolVal(const void *symbolTag, const MemRegion *region, const Expr *expr, QualType type, const LocationContext *LCtx, unsigned count)
MemRegionManager & getRegionManager()
ProgramStateManager & getStateManager()
SVal makeSymExprValNN(BinaryOperator::Opcode op, NonLoc lhs, NonLoc rhs, QualType resultTy)
Constructs a symbolic expression for two non-location values.
virtual SVal evalBinOpLL(ProgramStateRef state, BinaryOperator::Opcode op, Loc lhs, Loc rhs, QualType resultTy)=0
Create a new value which represents a binary expression with two memory location operands.
const unsigned ArrayIndexWidth
The width of the scalar type used for array indices.
DefinedSVal getBlockPointer(const BlockDecl *block, CanQualType locTy, const LocationContext *locContext, unsigned blockCount)
DefinedSVal getFunctionPointer(const FunctionDecl *func)
const QualType ArrayIndexTy
The scalar type to use for array indices.
ASTContext & getContext()
nonloc::ConcreteInt makeIntVal(const IntegerLiteral *integer)
SVal convertToArrayIndex(SVal val)
loc::MemRegionVal makeLoc(SymbolRef sym)
virtual SVal evalBinOpNN(ProgramStateRef state, BinaryOperator::Opcode op, NonLoc lhs, NonLoc rhs, QualType resultTy)=0
Create a new value which represents a binary expression with two non- location operands.
SVal evalCast(SVal V, QualType CastTy, QualType OriginalTy)
Cast a given SVal to another SVal using given QualType's.
DefinedOrUnknownSVal conjureSymbolVal(const void *symbolTag, const Expr *expr, const LocationContext *LCtx, unsigned count)
Create a new symbol with a unique 'name'.
BasicValueFactory BasicVals
Manager of APSInt values.
ConditionTruthVal areEqual(ProgramStateRef state, SVal lhs, SVal rhs)
QualType getConditionType() const
MemRegionManager MemMgr
Manages the creation of memory regions.
SVal evalEQ(ProgramStateRef state, SVal lhs, SVal rhs)
SVal evalUnaryOp(ProgramStateRef state, UnaryOperator::Opcode opc, SVal operand, QualType type)
DefinedOrUnknownSVal getDerivedRegionValueSymbolVal(SymbolRef parentSymbol, const TypedValueRegion *region)
loc::MemRegionVal getCXXThis(const CXXMethodDecl *D, const StackFrameContext *SFC)
Return a memory region for the 'this' object reference.
nonloc::ConcreteInt makeTruthVal(bool b, QualType type)
loc::ConcreteInt makeNullWithType(QualType type)
Create NULL pointer, with proper pointer bit-width for given address space.
ProgramStateManager & StateMgr
std::optional< SVal > getConstantVal(const Expr *E)
Returns the value of E, if it can be determined in a non-path-sensitive manner.
NonLoc makeLocAsInteger(Loc loc, unsigned bits)
SVal evalIntegralCast(ProgramStateRef state, SVal val, QualType castTy, QualType originalType)
SymbolManager & getSymbolManager()
DefinedOrUnknownSVal getRegionValueSymbolVal(const TypedValueRegion *region)
Make a unique symbol for value of region.
SVal evalBinOp(ProgramStateRef state, BinaryOperator::Opcode op, SVal lhs, SVal rhs, QualType type)
loc::ConcreteInt makeIntLocVal(const llvm::APSInt &integer)
nonloc::SymbolVal makeNonLoc(const SymExpr *lhs, BinaryOperator::Opcode op, APSIntPtr rhs, QualType type)
const AnalyzerOptions & AnOpts
DefinedSVal getConjuredHeapSymbolVal(const Expr *E, const LocationContext *LCtx, unsigned Count)
Conjure a symbol representing heap allocated memory region.
std::optional< loc::MemRegionVal > getCastedMemRegionVal(const MemRegion *region, QualType type)
Return MemRegionVal on success cast, otherwise return std::nullopt.
loc::MemRegionVal getAllocaRegionVal(const Expr *E, const LocationContext *LCtx, unsigned Count)
Create an SVal representing the result of an alloca()-like call, that is, an AllocaRegion on the stac...
nonloc::ConcreteInt makeBoolVal(const ObjCBoolLiteralExpr *boolean)
SValBuilder(llvm::BumpPtrAllocator &alloc, ASTContext &context, ProgramStateManager &stateMgr)
SValVisitor - this class implements a simple visitor for SVal subclasses.
SVal - This represents a symbolic expression, which can be either an L-value or an R-value.
bool isUnknownOrUndef() const
SymbolRef getAsSymbol(bool IncludeBaseRegions=false) const
If this SVal wraps a symbol return that SymbolRef.
std::optional< T > getAs() const
Convert to the specified SVal type, returning std::nullopt if this SVal is not of the desired type.
const MemRegion * getAsRegion() const
T castAs() const
Convert to the specified SVal type, asserting that this SVal is of the desired type.
std::optional< const MemRegion * > castRegion(const MemRegion *region, QualType CastToTy)
castRegion - Used by ExprEngine::VisitCast to handle casts from a MemRegion* to a specific location t...
virtual QualType getType() const =0
virtual unsigned computeComplexity() const =0
Represents a cast expression.
A symbol representing the value of a MemRegion whose parent region has symbolic value.
SymbolExtent - Represents the extent (size in bytes) of a bounded region.
const SymExprT * acquire(Args &&...args)
Create or retrieve a SymExpr of type SymExprT for the given arguments.
const SymbolConjured * conjureSymbol(const Stmt *E, const LocationContext *LCtx, QualType T, unsigned VisitCount, const void *SymbolTag=nullptr)
static bool canSymbolicate(QualType T)
A symbol representing the value stored at a MemRegion.
SymbolicRegion - A special, "non-concrete" region.
TypedValueRegion - An abstract class representing regions having a typed value.
virtual QualType getValueType() const =0
Represents a symbolic expression involving a unary operator.
The simplest example of a concrete compound value is nonloc::CompoundVal, which represents a concrete...
Value representing integer constant.
APSIntPtr getValue() const
While nonloc::CompoundVal covers a few simple use cases, nonloc::LazyCompoundVal is a more performant...
Value representing pointer-to-member.
Represents symbolic expression that isn't a location.
LLVM_ATTRIBUTE_RETURNS_NONNULL SymbolRef getSymbol() const
const internal::VariadicAllOfMatcher< Type > type
Matches Types in the clang AST.
const internal::VariadicAllOfMatcher< Stmt > stmt
Matches statements.
const internal::VariadicDynCastAllOfMatcher< Stmt, Expr > expr
Matches expressions.
The JSON file list parser is used to communicate input to InstallAPI.
@ Result
The result type of a method or function.
const FunctionProtoType * T
EvalResult is a struct with detailed info about an evaluated expression.
RetroSearch is an open source project built by @garambo | Open a GitHub Issue
Search and Browse the WWW like it's 1997 | Search results from DuckDuckGo
HTML:
3.2
| Encoding:
UTF-8
| Version:
0.7.4