SValBuilder.cpp Source File (original) (raw)

36#include "llvm/ADT/APSInt.h"

37#include "llvm/Support/Casting.h"

38#include "llvm/Support/Compiler.h"

39#include

40#include

41#include

43using namespace clang;

44using namespace ento;

50void SValBuilder::anchor() {}

54 : Context(context), BasicVals(context, alloc),

55 SymMgr(context, BasicVals, alloc), MemMgr(context, alloc),

56 StateMgr(stateMgr),

57 AnOpts(

58 stateMgr.getOwningEngine().getAnalysisManager().getAnalyzerOptions()),

59 ArrayIndexTy(context.LongLongTy),

60 ArrayIndexWidth(context.getTypeSize(ArrayIndexTy)) {}

66 if (type->isIntegralOrEnumerationType())

69 if (type->isArrayType() || type->isRecordType() || type->isVectorType() ||

70 type->isAnyComplexType())

75}

80 assert(lhs);

83}

88 assert(rhs);

91}

96 assert(lhs && rhs);

99}

100

103 assert(operand);

106}

107

110 assert(operand);

112 if (fromTy == toTy)

115}

116

119 return val;

120

121

122 if (std::optionalnonloc::ConcreteInt CI =

124 const llvm::APSInt& I = CI->getValue();

126 return val;

127 }

128

130}

131

134}

135

139

142

145

147

150

152}

153

155 const Expr *Ex,

157 unsigned Count) {

159

162

163

164

168

170}

171

173 const Stmt *St,

176 unsigned count) {

177 if (type->isNullPtrType())

179

182

184

187

189}

190

194 unsigned visitCount) {

195 if (type->isNullPtrType())

197

200

202

205

207}

208

214}

215

222 if (type->isNullPtrType()) {

223

224

226 }

227

230}

231

238}

239

244 unsigned count) {

246

248 count, symbolTag);

249

252

254}

255

260

263

266

268

271

273}

274

276 assert(!ND || (isa<CXXMethodDecl, FieldDecl, IndirectFieldDecl>(ND)));

277

278 if (const auto *MD = dyn_cast_or_null(ND)) {

279

280

281

282

283

284 if (!MD->isImplicitObjectMemberFunction())

286 }

287

289}

290

293}

294

298 unsigned blockCount) {

302 blockCount);

304}

305

306std::optionalloc::MemRegionVal

310 return std::nullopt;

311}

312

313

318}

319

320

323 const Type *T = D->getTypeForDecl();

326}

327

330

332

333

334 case Stmt::AddrLabelExprClass:

335 return makeLoc(cast(E));

336

337 case Stmt::CXXScalarValueInitExprClass:

338 case Stmt::ImplicitValueInitExprClass:

340

341 case Stmt::ObjCStringLiteralClass: {

342 const auto *SL = cast(E);

344 }

345

346 case Stmt::StringLiteralClass: {

347 const auto *SL = cast(E);

349 }

350

351 case Stmt::PredefinedExprClass: {

352 const auto *PE = cast(E);

353 assert(PE->getFunctionName() &&

354 "Since we analyze only instantiated functions, PredefinedExpr "

355 "should have a function name.");

357 }

358

359

360

361 case Stmt::CharacterLiteralClass: {

362 const auto *C = cast(E);

363 return makeIntVal(C->getValue(), C->getType());

364 }

365

366 case Stmt::CXXBoolLiteralExprClass:

367 return makeBoolVal(cast(E));

368

369 case Stmt::TypeTraitExprClass: {

370 const auto *TE = cast(E);

371 return makeTruthVal(TE->getValue(), TE->getType());

372 }

373

374 case Stmt::IntegerLiteralClass:

375 return makeIntVal(cast(E));

376

377 case Stmt::ObjCBoolLiteralExprClass:

378 return makeBoolVal(cast(E));

379

380 case Stmt::CXXNullPtrLiteralExprClass:

382

383 case Stmt::CStyleCastExprClass:

384 case Stmt::CXXFunctionalCastExprClass:

385 case Stmt::CXXConstCastExprClass:

386 case Stmt::CXXReinterpretCastExprClass:

387 case Stmt::CXXStaticCastExprClass:

388 case Stmt::ImplicitCastExprClass: {

389 const auto *CE = cast(E);

390 switch (CE->getCastKind()) {

391 default:

392 break;

393 case CK_ArrayToPointerDecay:

394 case CK_IntegralToPointer:

395 case CK_NoOp:

396 case CK_BitCast: {

397 const Expr *SE = CE->getSubExpr();

399 if (!Val)

400 return std::nullopt;

402 }

403 }

404 [[fallthrough]];

405 }

406

407

408 default: {

409

411 return std::nullopt;

412

417

421

422 return std::nullopt;

423 }

424 }

425}

426

432

433

434

435 const unsigned MaxComp = AnOpts.MaxSymbolComplexity;

436

437 if (symLHS && symRHS &&

439 return makeNonLoc(symLHS, Op, symRHS, ResultTy);

440

442 if (std::optionalnonloc::ConcreteInt rInt =

444 return makeNonLoc(symLHS, Op, rInt->getValue(), ResultTy);

445

447 if (std::optionalnonloc::ConcreteInt lInt =

449 return makeNonLoc(lInt->getValue(), Op, symRHS, ResultTy);

450

452}

453

455 switch (X.getKind()) {

456 case nonloc::ConcreteIntKind:

458 case nonloc::SymbolValKind:

461 default:

463 }

464}

465

467 switch (X.getKind()) {

468 case nonloc::ConcreteIntKind:

470 case nonloc::SymbolValKind:

473 default:

475 }

476}

477

481 if (!OpN)

483

484 if (opc == UO_Minus)

486 if (opc == UO_Not)

488 llvm_unreachable("Unexpected unary operator");

489}

490

495

498

499 if (isanonloc::LazyCompoundVal(lhs) || isanonloc::LazyCompoundVal(rhs)) {

501 }

502

503 if (op == BinaryOperatorKind::BO_Cmp) {

504

505

506

507

509 }

510

511 if (std::optional LV = lhs.getAs<Loc>()) {

512 if (std::optional RV = rhs.getAs<Loc>())

514

516 }

517

518 if (const std::optional RV = rhs.getAs<Loc>()) {

520 return Op == BO_Mul || Op == BO_Add || Op == BO_And || Op == BO_Xor ||

521 Op == BO_Or;

522 };

523

524 if (IsCommutative(op)) {

525

527 }

528

529

530

534 }

535 }

536

539}

540

543 return state->isNonNull(evalEQ(state, lhs, rhs));

544}

545

548}

549

553 return evalEQ(state, static_cast<SVal>(lhs), static_cast<SVal>(rhs))

555}

556

557

558

559

566

567

568

571 if (Quals1 != Quals2)

572 return false;

573 }

574

575

576

577

578

579

580

582 return true;

583

584 if (ToTy != FromTy)

585 return false;

586

587 return true;

588}

589

590

591

592

595

596 if (getContext().getTypeSize(castTy) >= getContext().getTypeSize(originalTy))

597 return evalCast(val, castTy, originalTy);

598

601 if (!AsSymbol || !AsNonLoc)

602 return evalCast(val, castTy, originalTy);

603

604

607 llvm::APSInt ToTypeMax = ToType.getMaxValue();

608

610

611

612

614 NonLoc CompVal = evalBinOpNN(state, BO_LE, *AsNonLoc, ToTypeMaxVal, CmpTy)

617 std::tie(IsNotTruncated, IsTruncated) = state->assume(CompVal);

618 if (!IsNotTruncated && IsTruncated) {

619

620 return makeNonLoc(AsSymbol, originalTy, castTy);

621 }

622 return evalCast(val, castTy, originalTy);

623}

624

625

626

627

628

629

630namespace {

631class EvalCastVisitor : public SValVisitor<EvalCastVisitor, SVal> {

632private:

636

637public:

639 : VB(VB), Context(VB.getContext()), CastTy(CastTy),

640 OriginalTy(OriginalTy) {}

641

644 return V;

645

647

648 const bool IsUnknownOriginalType = OriginalTy.isNull();

649 if (!IsUnknownOriginalType) {

651

652 if (CastTy == OriginalTy)

653 return V;

654

655

656

657

661 return V;

662 }

664 }

668

670 return VB.makeTruthVal(V.getValue()->getBoolValue(), CastTy);

671

672

674 llvm::APSInt Value = V.getValue();

677 }

678

679

681 llvm::APSInt Value = V.getValue();

684 }

685

686

688 }

690

692

694

695

697 const unsigned BitWidth = Context.getIntWidth(CastTy);

699 }

700

701 const bool IsUnknownOriginalType = OriginalTy.isNull();

702 if (!IsUnknownOriginalType) {

703

704 if (isa(OriginalTy))

707 }

708

709

711 return V;

712

713

715 }

717

721 if (const FunctionDecl *FD = dyn_cast(FTR->getDecl()))

722 if (FD->isWeak())

723

724

725

728

730 SymbolRef Sym = SymR->getSymbol();

732

733

734

738 CastTy);

739 }

740

742 }

743

744 const bool IsUnknownOriginalType = OriginalTy.isNull();

745

746 const auto *ArrayTy =

747 IsUnknownOriginalType

748 ? nullptr

750

751

754

755 if (ArrayTy) {

756

757 QualType ElemTy = ArrayTy->getElementType();

759

760

761

762

763 }

764 const unsigned BitWidth = Context.getIntWidth(CastTy);

766 }

767

768

770

771 if (IsUnknownOriginalType) {

772

773

774

775

776

777

778

779

782 if (const auto *SR = dyn_cast(R)) {

783 QualType SRTy = SR->getSymbol()->getType();

784

785 auto HasSameUnqualifiedPointeeType = [](QualType ty1,

789 };

790 if (!HasSameUnqualifiedPointeeType(SRTy, CastTy)) {

792 return *OptMemRegV;

793 }

794 }

795 }

796

797

798 if (const auto *ER = dyn_cast(R)) {

800 return *OptMemRegV;

801 }

802

803 return V;

804 }

805

809 return V;

810

811

812 if (ArrayTy) {

813

814

816

817 QualType ElemTy = ArrayTy->getElementType();

819 }

820

821

823 }

824

825

828

829

830

831

832

833

834

835

836

837

838

839

840

841

842

843

844

847 return *OptMemRegV;

848 }

849

850

851

852

853

854

855

856

857

858

860 }

862

864 }

866 auto CastedValue = [V, this]() {

867 llvm::APSInt Value = V.getValue();

870 };

871

872

874 return VB.makeTruthVal(V.getValue()->getBoolValue(), CastTy);

875

876

879

880

883

884

886 }

888

890 }

892 Loc L = V.getLoc();

893

894

896

897 return Visit(L);

898

899 const bool IsUnknownOriginalType = OriginalTy.isNull();

900

901 if (!IsUnknownOriginalType && Loc::isLocType(CastTy) &&

905 return *OptMemRegV;

906 return L;

907 }

908

909

911 if (!IsUnknownOriginalType && R) {

914

918

919

920

922 return *OptMemRegV;

923 }

924 } else {

926 if (IsUnknownOriginalType)

928 return L;

929 }

930

932 if (R) {

934 dyn_cast(R->StripCasts())) {

935 SE = SR->getSymbol();

936 }

937 }

938

940

941 const unsigned CastSize = Context.getIntWidth(CastTy);

942 if (CastSize == V.getNumBits())

943 return V;

944

946 }

947 }

948

949

951 }

954

955 const bool IsUnknownOriginalType = OriginalTy.isNull();

956

957 if (!IsUnknownOriginalType && CastTy->isBooleanType()) {

958

963 return VB.makeNonLoc(SE, BO_NE, BVF.getValue(0, SE->getType()), CastTy);

964 }

965 } else {

966

968

969

970

977

978

979 if (!Opts.ShouldSupportSymbolicIntegerCasts)

980 return V;

981 return simplifySymbolCast(V, CastTy);

982 }

984 if (!IsUnknownOriginalType || !CastTy->isFloatingType() ||

987 }

988

989

990

991

992

993

994

996 }

998

999 return V;

1000 }

1001

1002

1003

1004

1005

1006

1007

1008

1009

1010

1011

1013

1014

1015

1016

1017

1018

1019

1020

1021

1022

1023

1024

1025

1026

1027

1028

1029

1030

1031

1032

1033

1034

1035

1036

1037

1038

1039

1040

1041

1042

1043

1044

1045

1046

1047

1050

1051 if (T == CastTy)

1052 return V;

1053

1054 if (!isa(SE))

1056

1057 SymbolRef RootSym = cast(SE)->getOperand();

1059

1060

1063

1067

1070

1071 if (WC <= WT) {

1072 const bool isSameType = (RT == CastTy);

1073 if (isSameType)

1075 return VB.makeNonLoc(RootSym, RT, CastTy);

1076 }

1077

1082

1083 if (((WT > WR) && (UR || !UT)) || ((WT == WR) && (UT == UR)))

1084 return VB.makeNonLoc(RootSym, RT, CastTy);

1085

1087 }

1088};

1089}

1090

1091

1092

1093

1094

1095

1096

1097

1098

1099

1100

1101

1103 EvalCastVisitor TRV{*this, CastTy, OriginalTy};

1104 return TRV.Visit(V);

1105}

Defines the clang::ASTContext interface.

This file defines AnalysisDeclContext, a class that manages the analysis context data for context sen...

Defines the C++ Decl subclasses, other than those for templates (found in DeclTemplate....

Defines the clang::Expr interface and subclasses for C++ expressions.

Forward-declares and imports various common LLVM datatypes that clang wants to use unqualified.

llvm::DenseMap< const CFGBlock *, unsigned > VisitCount

static bool shouldBeModeledWithNoOp(ASTContext &Context, QualType ToTy, QualType FromTy)

Recursively check if the pointer types are equal modulo const, volatile, and restrict qualifiers.

C Language Family Type Representation.

Holds long-lived AST nodes (such as types and decls) that can be referred to throughout the semantic ...

unsigned getIntWidth(QualType T) const

CanQualType getCanonicalType(QualType T) const

Return the canonical (structural) type corresponding to the specified potentially non-canonical type ...

QualType getPointerType(QualType T) const

Return the uniqued reference to the type for a pointer to the specified type.

bool UnwrapSimilarTypes(QualType &T1, QualType &T2, bool AllowPiMismatch=true) const

Attempt to unwrap two types that may be similar (C++ [conv.qual]).

QualType getUnqualifiedArrayType(QualType T, Qualifiers &Quals) const

Return this type as a completely-unqualified array type, capturing the qualifiers in Quals.

ASTContext & getASTContext() const

Stores options for the analyzer from the command line.

Represents a block literal declaration, which is like an unnamed FunctionDecl.

A boolean literal, per ([C++ lex.bool] Boolean literals).

Represents a static or instance method of a struct/union/class.

Represents a C++ struct/union/class.

This represents one expression.

bool EvaluateAsInt(EvalResult &Result, const ASTContext &Ctx, SideEffectsKind AllowSideEffects=SE_NoSideEffects, bool InConstantContext=false) const

EvaluateAsInt - Return true if this is a constant which we can fold and convert to an integer,...

Expr * IgnoreParens() LLVM_READONLY

Skip past any parentheses which might surround this expression until reaching a fixed point.

@ NPC_ValueDependentIsNotNull

Specifies that a value-dependent expression should be considered to never be a null pointer constant.

NullPointerConstantKind isNullPointerConstant(ASTContext &Ctx, NullPointerConstantValueDependence NPC) const

isNullPointerConstant - C99 6.3.2.3p3 - Test if this reduces down to a Null pointer constant.

Represents a function declaration or definition.

It wraps the AnalysisDeclContext to represent both the call stack with the help of StackFrameContext ...

LLVM_ATTRIBUTE_RETURNS_NONNULL AnalysisDeclContext * getAnalysisDeclContext() const

This represents a decl that may have a name.

A (possibly-)qualified type.

bool isNull() const

Return true if this QualType doesn't point to a type yet.

const Type * getTypePtr() const

Retrieves a pointer to the underlying (unqualified) type.

QualType getCanonicalType() const

The collection of all-type qualifiers we support.

void removeCVRQualifiers(unsigned mask)

It represents a stack frame of the call stack (based on CallEvent).

Stmt - This represents one statement.

StmtClass getStmtClass() const

The base class of the type hierarchy.

bool isBlockPointerType() const

bool isBooleanType() const

bool isIntegralOrUnscopedEnumerationType() const

Determine whether this type is an integral or unscoped enumeration type.

bool isVoidPointerType() const

bool isFunctionPointerType() const

bool isPointerType() const

bool isReferenceType() const

bool isVariableArrayType() const

QualType getPointeeType() const

If this is a pointer, ObjC object pointer, or block pointer, this returns the respective pointee.

bool isIntegralOrEnumerationType() const

Determine whether this type is an integral or enumeration type.

bool isMemberPointerType() const

bool isFunctionType() const

bool isFloatingType() const

bool isUnsignedIntegerType() const

Return true if this is an integer type that is unsigned, according to C99 6.2.5p6 [which returns true...

bool isNullPtrType() const

A safe wrapper around APSInt objects allocated and owned by BasicValueFactory.

A record of the "type" of an APSInt, used for conversions.

uint32_t getBitWidth() const

llvm::APSInt getMaxValue() const LLVM_READONLY

Returns the maximum value for this type.

void apply(llvm::APSInt &Value) const

Convert a given APSInt, in place, to match this type.

AllocaRegion - A region that represents an untyped blob of bytes created by a call to 'alloca'.

AnalyzerOptions & getAnalyzerOptions() override

APSIntPtr getZeroWithTypeSize(QualType T)

APSIntType getAPSIntType(QualType T) const

Returns the type of the APSInt used to store values of the given QualType.

llvm::ImmutableList< SVal > getEmptySValList()

Template implementation for all binary symbolic expressions.

BlockCodeRegion - A region that represents code texts of blocks (closures).

BlockDataRegion - A region that represents a block instance.

AnalysisManager & getAnalysisManager()

FunctionCodeRegion - A region that represents code texts of function.

static bool isLocType(QualType T)

const BlockCodeRegion * getBlockCodeRegion(const BlockDecl *BD, CanQualType locTy, AnalysisDeclContext *AC)

const AllocaRegion * getAllocaRegion(const Expr *Ex, unsigned Cnt, const LocationContext *LC)

getAllocaRegion - Retrieve a region associated with a call to alloca().

const SymbolicRegion * getSymbolicHeapRegion(SymbolRef sym)

Return a unique symbolic region belonging to heap memory space.

const SymbolicRegion * getSymbolicRegion(SymbolRef Sym, const MemSpaceRegion *MemSpace=nullptr)

Retrieve or create a "symbolic" memory region.

const FunctionCodeRegion * getFunctionCodeRegion(const NamedDecl *FD)

const BlockDataRegion * getBlockDataRegion(const BlockCodeRegion *bc, const LocationContext *lc, unsigned blockCount)

getBlockDataRegion - Get the memory region associated with an instance of a block.

MemRegion - The root abstract class for all memory regions.

LLVM_ATTRIBUTE_RETURNS_NONNULL const MemRegion * StripCasts(bool StripBaseAndDerivedCasts=true) const

const SymbolicRegion * getSymbolicBase() const

If this is a symbolic region, returns the region.

ExprEngine & getOwningEngine()

SVal ArrayToPointer(Loc Array, QualType ElementTy)

StoreManager & getStoreManager()

DefinedOrUnknownSVal makeZeroVal(QualType type)

Construct an SVal representing '0' for the specified type.

DefinedSVal getMemberPointer(const NamedDecl *ND)

SVal evalMinus(NonLoc val)

SVal evalComplement(NonLoc val)

BasicValueFactory & getBasicValueFactory()

NonLoc makeCompoundVal(QualType type, llvm::ImmutableList< SVal > vals)

SymbolManager SymMgr

Manages the creation of symbols.

virtual SVal evalBinOpLN(ProgramStateRef state, BinaryOperator::Opcode op, Loc lhs, NonLoc rhs, QualType resultTy)=0

Create a new value which represents a binary expression with a memory location and non-location opera...

DefinedSVal getMetadataSymbolVal(const void *symbolTag, const MemRegion *region, const Expr *expr, QualType type, const LocationContext *LCtx, unsigned count)

MemRegionManager & getRegionManager()

ProgramStateManager & getStateManager()

SVal makeSymExprValNN(BinaryOperator::Opcode op, NonLoc lhs, NonLoc rhs, QualType resultTy)

Constructs a symbolic expression for two non-location values.

virtual SVal evalBinOpLL(ProgramStateRef state, BinaryOperator::Opcode op, Loc lhs, Loc rhs, QualType resultTy)=0

Create a new value which represents a binary expression with two memory location operands.

const unsigned ArrayIndexWidth

The width of the scalar type used for array indices.

DefinedSVal getBlockPointer(const BlockDecl *block, CanQualType locTy, const LocationContext *locContext, unsigned blockCount)

DefinedSVal getFunctionPointer(const FunctionDecl *func)

const QualType ArrayIndexTy

The scalar type to use for array indices.

ASTContext & getContext()

nonloc::ConcreteInt makeIntVal(const IntegerLiteral *integer)

SVal convertToArrayIndex(SVal val)

loc::MemRegionVal makeLoc(SymbolRef sym)

virtual SVal evalBinOpNN(ProgramStateRef state, BinaryOperator::Opcode op, NonLoc lhs, NonLoc rhs, QualType resultTy)=0

Create a new value which represents a binary expression with two non- location operands.

SVal evalCast(SVal V, QualType CastTy, QualType OriginalTy)

Cast a given SVal to another SVal using given QualType's.

DefinedOrUnknownSVal conjureSymbolVal(const void *symbolTag, const Expr *expr, const LocationContext *LCtx, unsigned count)

Create a new symbol with a unique 'name'.

BasicValueFactory BasicVals

Manager of APSInt values.

ConditionTruthVal areEqual(ProgramStateRef state, SVal lhs, SVal rhs)

QualType getConditionType() const

MemRegionManager MemMgr

Manages the creation of memory regions.

SVal evalEQ(ProgramStateRef state, SVal lhs, SVal rhs)

SVal evalUnaryOp(ProgramStateRef state, UnaryOperator::Opcode opc, SVal operand, QualType type)

DefinedOrUnknownSVal getDerivedRegionValueSymbolVal(SymbolRef parentSymbol, const TypedValueRegion *region)

loc::MemRegionVal getCXXThis(const CXXMethodDecl *D, const StackFrameContext *SFC)

Return a memory region for the 'this' object reference.

nonloc::ConcreteInt makeTruthVal(bool b, QualType type)

loc::ConcreteInt makeNullWithType(QualType type)

Create NULL pointer, with proper pointer bit-width for given address space.

ProgramStateManager & StateMgr

std::optional< SVal > getConstantVal(const Expr *E)

Returns the value of E, if it can be determined in a non-path-sensitive manner.

NonLoc makeLocAsInteger(Loc loc, unsigned bits)

SVal evalIntegralCast(ProgramStateRef state, SVal val, QualType castTy, QualType originalType)

SymbolManager & getSymbolManager()

DefinedOrUnknownSVal getRegionValueSymbolVal(const TypedValueRegion *region)

Make a unique symbol for value of region.

SVal evalBinOp(ProgramStateRef state, BinaryOperator::Opcode op, SVal lhs, SVal rhs, QualType type)

loc::ConcreteInt makeIntLocVal(const llvm::APSInt &integer)

nonloc::SymbolVal makeNonLoc(const SymExpr *lhs, BinaryOperator::Opcode op, APSIntPtr rhs, QualType type)

const AnalyzerOptions & AnOpts

DefinedSVal getConjuredHeapSymbolVal(const Expr *E, const LocationContext *LCtx, unsigned Count)

Conjure a symbol representing heap allocated memory region.

std::optional< loc::MemRegionVal > getCastedMemRegionVal(const MemRegion *region, QualType type)

Return MemRegionVal on success cast, otherwise return std::nullopt.

loc::MemRegionVal getAllocaRegionVal(const Expr *E, const LocationContext *LCtx, unsigned Count)

Create an SVal representing the result of an alloca()-like call, that is, an AllocaRegion on the stac...

nonloc::ConcreteInt makeBoolVal(const ObjCBoolLiteralExpr *boolean)

SValBuilder(llvm::BumpPtrAllocator &alloc, ASTContext &context, ProgramStateManager &stateMgr)

SValVisitor - this class implements a simple visitor for SVal subclasses.

SVal - This represents a symbolic expression, which can be either an L-value or an R-value.

bool isUnknownOrUndef() const

SymbolRef getAsSymbol(bool IncludeBaseRegions=false) const

If this SVal wraps a symbol return that SymbolRef.

std::optional< T > getAs() const

Convert to the specified SVal type, returning std::nullopt if this SVal is not of the desired type.

const MemRegion * getAsRegion() const

T castAs() const

Convert to the specified SVal type, asserting that this SVal is of the desired type.

std::optional< const MemRegion * > castRegion(const MemRegion *region, QualType CastToTy)

castRegion - Used by ExprEngine::VisitCast to handle casts from a MemRegion* to a specific location t...

virtual QualType getType() const =0

virtual unsigned computeComplexity() const =0

Represents a cast expression.

A symbol representing the value of a MemRegion whose parent region has symbolic value.

SymbolExtent - Represents the extent (size in bytes) of a bounded region.

const SymExprT * acquire(Args &&...args)

Create or retrieve a SymExpr of type SymExprT for the given arguments.

const SymbolConjured * conjureSymbol(const Stmt *E, const LocationContext *LCtx, QualType T, unsigned VisitCount, const void *SymbolTag=nullptr)

static bool canSymbolicate(QualType T)

A symbol representing the value stored at a MemRegion.

SymbolicRegion - A special, "non-concrete" region.

TypedValueRegion - An abstract class representing regions having a typed value.

virtual QualType getValueType() const =0

Represents a symbolic expression involving a unary operator.

The simplest example of a concrete compound value is nonloc::CompoundVal, which represents a concrete...

Value representing integer constant.

APSIntPtr getValue() const

While nonloc::CompoundVal covers a few simple use cases, nonloc::LazyCompoundVal is a more performant...

Value representing pointer-to-member.

Represents symbolic expression that isn't a location.

LLVM_ATTRIBUTE_RETURNS_NONNULL SymbolRef getSymbol() const

const internal::VariadicAllOfMatcher< Type > type

Matches Types in the clang AST.

const internal::VariadicAllOfMatcher< Stmt > stmt

Matches statements.

const internal::VariadicDynCastAllOfMatcher< Stmt, Expr > expr

Matches expressions.

The JSON file list parser is used to communicate input to InstallAPI.

@ Result

The result type of a method or function.

const FunctionProtoType * T

EvalResult is a struct with detailed info about an evaluated expression.