clang: clang::ento::ExprEngine Class Reference (original) (raw)

#include "[clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h](ExprEngine%5F8h%5Fsource.html)"

Public Member Functions
	ExprEngine (cross_tu::CrossTranslationUnitContext &CTU, AnalysisManager &mgr, SetOfConstDecls VisitedCalleesIn, FunctionSummariesTy FS, InliningModes HowToInlineIn)

virtual	~ExprEngine ()=default

bool	ExecuteWorkList (const LocationContext *L, unsigned Steps=150000)
	Returns true if there is still simulation state on the worklist.

ASTContext &	getContext () const
	getContext - Return the ASTContext associated with this analysis.

AnalysisManager &	getAnalysisManager ()

AnalysisDeclContextManager &	getAnalysisDeclContextManager ()

CheckerManager &	getCheckerManager () const

SValBuilder &	getSValBuilder ()

BugReporter &	getBugReporter ()

cross_tu::CrossTranslationUnitContext *	getCrossTranslationUnitContext ()

const NodeBuilderContext &	getBuilderContext ()

const Stmt *	getStmt () const

const LocationContext *	getRootLocationContext () const

CFGBlock::ConstCFGElementRef	getCFGElementRef () const

std::string	DumpGraph (bool trim=false, StringRef Filename="")
	Dump graph to the specified filename.

std::string	DumpGraph (ArrayRef< const ExplodedNode * > Nodes, StringRef Filename="")
	Dump the graph consisting of the given nodes to a specified filename.

void	ViewGraph (bool trim=false)
	Visualize the ExplodedGraph created by executing the simulation.

void	ViewGraph (ArrayRef< const ExplodedNode * > Nodes)
	Visualize a trimmed ExplodedGraph that only contains paths to the given nodes.

ProgramStateRef	getInitialState (const LocationContext *InitLoc)
	getInitialState - Return the initial state used for the root vertex in the ExplodedGraph.

ExplodedGraph &	getGraph ()

const ExplodedGraph &	getGraph () const

void	removeDead (ExplodedNode Node, ExplodedNodeSet &Out, const Stmt ReferenceStmt, const LocationContext LC, const Stmt DiagnosticStmt=nullptr, ProgramPoint::Kind K=ProgramPoint::PreStmtPurgeDeadSymbolsKind)
	Run the analyzer's garbage collection - remove dead symbols and bindings from the state.

void	processCFGElement (const CFGElement E, ExplodedNode Pred, unsigned StmtIdx, NodeBuilderContext Ctx)
	processCFGElement - Called by CoreEngine.

void	ProcessStmt (const Stmt S, ExplodedNode Pred)

void	ProcessLoopExit (const Stmt S, ExplodedNode Pred)

void	ProcessInitializer (const CFGInitializer I, ExplodedNode *Pred)

void	ProcessImplicitDtor (const CFGImplicitDtor D, ExplodedNode *Pred)

void	ProcessNewAllocator (const CXXNewExpr NE, ExplodedNode Pred)

void	ProcessAutomaticObjDtor (const CFGAutomaticObjDtor D, ExplodedNode *Pred, ExplodedNodeSet &Dst)

void	ProcessDeleteDtor (const CFGDeleteDtor D, ExplodedNode *Pred, ExplodedNodeSet &Dst)

void	ProcessBaseDtor (const CFGBaseDtor D, ExplodedNode *Pred, ExplodedNodeSet &Dst)

void	ProcessMemberDtor (const CFGMemberDtor D, ExplodedNode *Pred, ExplodedNodeSet &Dst)

void	ProcessTemporaryDtor (const CFGTemporaryDtor D, ExplodedNode *Pred, ExplodedNodeSet &Dst)

void	processCFGBlockEntrance (const BlockEdge &L, NodeBuilderWithSinks &nodeBuilder, ExplodedNode *Pred)
	Called by CoreEngine when processing the entrance of a CFGBlock.

void	processBranch (const Stmt Condition, NodeBuilderContext &BuilderCtx, ExplodedNode Pred, ExplodedNodeSet &Dst, const CFGBlock DstT, const CFGBlock DstF, std::optional< unsigned > IterationsCompletedInLoop)
	ProcessBranch - Called by CoreEngine.

void	processCleanupTemporaryBranch (const CXXBindTemporaryExpr BTE, NodeBuilderContext &BldCtx, ExplodedNode Pred, ExplodedNodeSet &Dst, const CFGBlock DstT, const CFGBlock DstF)
	Called by CoreEngine.

void	processStaticInitializer (const DeclStmt DS, NodeBuilderContext &BuilderCtx, ExplodedNode Pred, ExplodedNodeSet &Dst, const CFGBlock DstT, const CFGBlock DstF)
	Called by CoreEngine.

void	processIndirectGoto (IndirectGotoNodeBuilder &builder)
	processIndirectGoto - Called by CoreEngine.

void	processSwitch (SwitchNodeBuilder &builder)
	ProcessSwitch - Called by CoreEngine.

void	processBeginOfFunction (NodeBuilderContext &BC, ExplodedNode *Pred, ExplodedNodeSet &Dst, const BlockEdge &L)
	Called by CoreEngine.

void	processEndOfFunction (NodeBuilderContext &BC, ExplodedNode Pred, const ReturnStmt RS=nullptr)
	Called by CoreEngine.

void	removeDeadOnEndOfFunction (NodeBuilderContext &BC, ExplodedNode *Pred, ExplodedNodeSet &Dst)
	Remove dead bindings/symbols before exiting a function.

void	processCallEnter (NodeBuilderContext &BC, CallEnter CE, ExplodedNode *Pred)
	Generate the entry node of the callee.

void	processCallExit (ExplodedNode *Pred)
	Generate the sequence of nodes that simulate the call exit and the post visit for CallExpr.

void	processEndWorklist ()
	Called by CoreEngine when the analysis worklist has terminated.

ProgramStateRef	processAssume (ProgramStateRef state, SVal cond, bool assumption)
	evalAssume - Callback function invoked by the ConstraintManager when making assumptions about state values.

ProgramStateRef	processRegionChanges (ProgramStateRef state, const InvalidatedSymbols invalidated, ArrayRef< const MemRegion > ExplicitRegions, ArrayRef< const MemRegion * > Regions, const LocationContext LCtx, const CallEvent Call)
	processRegionChanges - Called by ProgramStateManager whenever a change is made to the store.

ProgramStateRef	processRegionChange (ProgramStateRef state, const MemRegion MR, const LocationContext LCtx)

void	printJson (raw_ostream &Out, ProgramStateRef State, const LocationContext LCtx, const char NL, unsigned int Space, bool IsDot) const
	printJson - Called by ProgramStateManager to print checker-specific data.

ProgramStateManager &	getStateManager ()

StoreManager &	getStoreManager ()

ConstraintManager &	getConstraintManager ()

BasicValueFactory &	getBasicVals ()

SymbolManager &	getSymbolManager ()

MemRegionManager &	getRegionManager ()

DataTag::Factory &	getDataTags ()

bool	wasBlocksExhausted () const

bool	hasEmptyWorkList () const

bool	hasWorkRemaining () const

const CoreEngine &	getCoreEngine () const

void	Visit (const Stmt S, ExplodedNode Pred, ExplodedNodeSet &Dst)
	Visit - Transfer function logic for all statements.

void	VisitArrayInitLoopExpr (const ArrayInitLoopExpr Ex, ExplodedNode Pred, ExplodedNodeSet &Dst)
	VisitArrayInitLoopExpr - Transfer function for array init loop.

void	VisitArraySubscriptExpr (const ArraySubscriptExpr Ex, ExplodedNode Pred, ExplodedNodeSet &Dst)
	VisitArraySubscriptExpr - Transfer function for array accesses.

void	VisitGCCAsmStmt (const GCCAsmStmt A, ExplodedNode Pred, ExplodedNodeSet &Dst)
	VisitGCCAsmStmt - Transfer function logic for inline asm.

void	VisitMSAsmStmt (const MSAsmStmt A, ExplodedNode Pred, ExplodedNodeSet &Dst)
	VisitMSAsmStmt - Transfer function logic for MS inline asm.

void	VisitBlockExpr (const BlockExpr BE, ExplodedNode Pred, ExplodedNodeSet &Dst)
	VisitBlockExpr - Transfer function logic for BlockExprs.

void	VisitLambdaExpr (const LambdaExpr LE, ExplodedNode Pred, ExplodedNodeSet &Dst)
	VisitLambdaExpr - Transfer function logic for LambdaExprs.

void	VisitBinaryOperator (const BinaryOperator B, ExplodedNode Pred, ExplodedNodeSet &Dst)
	VisitBinaryOperator - Transfer function logic for binary operators.

void	VisitCallExpr (const CallExpr CE, ExplodedNode Pred, ExplodedNodeSet &Dst)
	VisitCall - Transfer function for function calls.

void	VisitCast (const CastExpr CastE, const Expr Ex, ExplodedNode *Pred, ExplodedNodeSet &Dst)
	VisitCast - Transfer function logic for all casts (implicit and explicit).

void	VisitCompoundLiteralExpr (const CompoundLiteralExpr CL, ExplodedNode Pred, ExplodedNodeSet &Dst)
	VisitCompoundLiteralExpr - Transfer function logic for compound literals.

void	VisitCommonDeclRefExpr (const Expr DR, const NamedDecl D, ExplodedNode *Pred, ExplodedNodeSet &Dst)
	Transfer function logic for DeclRefExprs and BlockDeclRefExprs.

void	VisitDeclStmt (const DeclStmt DS, ExplodedNode Pred, ExplodedNodeSet &Dst)
	VisitDeclStmt - Transfer function logic for DeclStmts.

void	VisitGuardedExpr (const Expr Ex, const Expr L, const Expr R, ExplodedNode Pred, ExplodedNodeSet &Dst)
	VisitGuardedExpr - Transfer function logic for ?, __builtin_choose.

void	VisitInitListExpr (const InitListExpr E, ExplodedNode Pred, ExplodedNodeSet &Dst)

void	VisitLogicalExpr (const BinaryOperator B, ExplodedNode Pred, ExplodedNodeSet &Dst)
	VisitLogicalExpr - Transfer function logic for '&&', '\|

void	VisitMemberExpr (const MemberExpr M, ExplodedNode Pred, ExplodedNodeSet &Dst)
	VisitMemberExpr - Transfer function for member expressions.

void	VisitAtomicExpr (const AtomicExpr E, ExplodedNode Pred, ExplodedNodeSet &Dst)
	VisitAtomicExpr - Transfer function for builtin atomic expressions.

void	VisitObjCAtSynchronizedStmt (const ObjCAtSynchronizedStmt S, ExplodedNode Pred, ExplodedNodeSet &Dst)
	Transfer function logic for ObjCAtSynchronizedStmts.

void	VisitLvalObjCIvarRefExpr (const ObjCIvarRefExpr DR, ExplodedNode Pred, ExplodedNodeSet &Dst)
	Transfer function logic for computing the lvalue of an Objective-C ivar.

void	VisitObjCForCollectionStmt (const ObjCForCollectionStmt S, ExplodedNode Pred, ExplodedNodeSet &Dst)
	VisitObjCForCollectionStmt - Transfer function logic for ObjCForCollectionStmt.

void	VisitObjCMessage (const ObjCMessageExpr ME, ExplodedNode Pred, ExplodedNodeSet &Dst)

void	VisitReturnStmt (const ReturnStmt R, ExplodedNode Pred, ExplodedNodeSet &Dst)
	VisitReturnStmt - Transfer function logic for return statements.

void	VisitOffsetOfExpr (const OffsetOfExpr Ex, ExplodedNode Pred, ExplodedNodeSet &Dst)
	VisitOffsetOfExpr - Transfer function for offsetof.

void	VisitUnaryExprOrTypeTraitExpr (const UnaryExprOrTypeTraitExpr Ex, ExplodedNode Pred, ExplodedNodeSet &Dst)
	VisitUnaryExprOrTypeTraitExpr - Transfer function for sizeof.

void	VisitUnaryOperator (const UnaryOperator B, ExplodedNode Pred, ExplodedNodeSet &Dst)
	VisitUnaryOperator - Transfer function logic for unary operators.

void	VisitIncrementDecrementOperator (const UnaryOperator U, ExplodedNode Pred, ExplodedNodeSet &Dst)
	Handle ++ and – (both pre- and post-increment).

void	VisitCXXBindTemporaryExpr (const CXXBindTemporaryExpr *BTE, ExplodedNodeSet &PreVisit, ExplodedNodeSet &Dst)

void	VisitCXXCatchStmt (const CXXCatchStmt CS, ExplodedNode Pred, ExplodedNodeSet &Dst)

void	VisitCXXThisExpr (const CXXThisExpr TE, ExplodedNode Pred, ExplodedNodeSet &Dst)

void	VisitCXXConstructExpr (const CXXConstructExpr E, ExplodedNode Pred, ExplodedNodeSet &Dst)

void	VisitCXXInheritedCtorInitExpr (const CXXInheritedCtorInitExpr E, ExplodedNode Pred, ExplodedNodeSet &Dst)

void	VisitCXXDestructor (QualType ObjectType, const MemRegion Dest, const Stmt S, bool IsBaseDtor, ExplodedNode *Pred, ExplodedNodeSet &Dst, EvalCallOptions &Options)

void	VisitCXXNewAllocatorCall (const CXXNewExpr CNE, ExplodedNode Pred, ExplodedNodeSet &Dst)

void	VisitCXXNewExpr (const CXXNewExpr CNE, ExplodedNode Pred, ExplodedNodeSet &Dst)

void	VisitCXXDeleteExpr (const CXXDeleteExpr CDE, ExplodedNode Pred, ExplodedNodeSet &Dst)

void	CreateCXXTemporaryObject (const MaterializeTemporaryExpr ME, ExplodedNode Pred, ExplodedNodeSet &Dst)
	Create a C++ temporary object for an rvalue.

void	evalEagerlyAssumeBifurcation (ExplodedNodeSet &Dst, ExplodedNodeSet &Src, const Expr *Ex)
	evalEagerlyAssumeBifurcation - Given the nodes in 'Src', eagerly assume concrete boolean values for 'Ex', storing the resulting nodes in 'Dst'.

bool	didEagerlyAssumeBifurcateAt (ProgramStateRef State, const Expr *Ex) const

ProgramStateRef	handleLValueBitCast (ProgramStateRef state, const Expr Ex, const LocationContext LCtx, QualType T, QualType ExTy, const CastExpr CastE, StmtNodeBuilder &Bldr, ExplodedNode Pred)

void	handleUOExtension (ExplodedNode N, const UnaryOperator U, StmtNodeBuilder &Bldr)

SVal	evalBinOp (ProgramStateRef ST, BinaryOperator::Opcode Op, SVal LHS, SVal RHS, QualType T)

ProgramStateRef	processPointerEscapedOnBind (ProgramStateRef State, ArrayRef< std::pair< SVal, SVal > > LocAndVals, const LocationContext LCtx, PointerEscapeKind Kind, const CallEvent Call)
	Call PointerEscape callback when a value escapes as a result of bind.

ProgramStateRef	notifyCheckersOfPointerEscape (ProgramStateRef State, const InvalidatedSymbols Invalidated, ArrayRef< const MemRegion > ExplicitRegions, const CallEvent *Call, RegionAndSymbolInvalidationTraits &ITraits)
	Call PointerEscape callback when a value escapes as a result of region invalidation.

void	evalLoad (ExplodedNodeSet &Dst, const Expr NodeEx, const Expr BoundExpr, ExplodedNode Pred, ProgramStateRef St, SVal location, const ProgramPointTag tag=nullptr, QualType LoadTy=QualType())
	Simulate a read of the result of Ex.

void	evalStore (ExplodedNodeSet &Dst, const Expr AssignE, const Expr StoreE, ExplodedNode Pred, ProgramStateRef St, SVal TargetLV, SVal Val, const ProgramPointTag tag=nullptr)
	evalStore - Handle the semantics of a store via an assignment.

CFGElement	getCurrentCFGElement ()
	Return the CFG element corresponding to the worklist element that is currently being processed by ExprEngine.

ProgramStateRef	bindReturnValue (const CallEvent &Call, const LocationContext *LCtx, ProgramStateRef State)
	Create a new state in which the call return value is binded to the call origin expression.

void	evalCall (ExplodedNodeSet &Dst, ExplodedNode *Pred, const CallEvent &Call)
	Evaluate a call, running pre- and post-call checkers and allowing checkers to be responsible for handling the evaluation of the call itself.

void	defaultEvalCall (NodeBuilder &B, ExplodedNode *Pred, const CallEvent &Call, const EvalCallOptions &CallOpts={})
	Default implementation of call evaluation.

SVal	computeObjectUnderConstruction (const Expr E, ProgramStateRef State, const NodeBuilderContext BldrCtx, const LocationContext LCtx, const ConstructionContext CC, EvalCallOptions &CallOpts, unsigned Idx=0)
	Find location of the object that is being constructed by a given constructor.

ProgramStateRef	updateObjectsUnderConstruction (SVal V, const Expr E, ProgramStateRef State, const LocationContext LCtx, const ConstructionContext *CC, const EvalCallOptions &CallOpts)
	Update the program state with all the path-sensitive information that's necessary to perform construction of an object with a given syntactic construction context.

std::pair< ProgramStateRef, SVal >	handleConstructionContext (const Expr E, ProgramStateRef State, const NodeBuilderContext BldrCtx, const LocationContext LCtx, const ConstructionContext CC, EvalCallOptions &CallOpts, unsigned Idx=0)
	A convenient wrapper around computeObjectUnderConstruction and updateObjectsUnderConstruction.

Static Public Member Functions
static const ProgramPointTag *	cleanupNodeTag ()
	A tag to track convenience transitions, which can be removed at cleanup.

static std::pair< const ProgramPointTag , const ProgramPointTag >	getEagerlyAssumeBifurcationTags ()

static std::optional< unsigned >	getIndexOfElementToConstruct (ProgramStateRef State, const CXXConstructExpr E, const LocationContext LCtx)
	Retreives which element is being constructed in a non-POD type array.

static std::optional< unsigned >	getPendingArrayDestruction (ProgramStateRef State, const LocationContext *LCtx)
	Retreives which element is being destructed in a non-POD type array.

static std::optional< unsigned >	getPendingInitLoop (ProgramStateRef State, const CXXConstructExpr E, const LocationContext LCtx)
	Retreives the size of the array in the pending ArrayInitLoopExpr.

static std::optional< SVal >	getObjectUnderConstruction (ProgramStateRef State, const ConstructionContextItem &Item, const LocationContext *LC)
	By looking at a certain item that may be potentially part of an object's ConstructionContext, retrieve such object's location.

static ProgramStateRef	setWhetherHasMoreIteration (ProgramStateRef State, const ObjCForCollectionStmt O, const LocationContext LC, bool HasMoreIteraton)
	Note whether this loop has any more iteratios to model.

static ProgramStateRef	removeIterationState (ProgramStateRef State, const ObjCForCollectionStmt O, const LocationContext LC)

static bool	hasMoreIteration (ProgramStateRef State, const ObjCForCollectionStmt O, const LocationContext LC)

Definition at line 124 of file ExprEngine.h.

◆ InliningModes

The modes of inlining, which override the default analysis-wide settings.

Enumerator
Inline_Regular	Follow the default settings for inlining callees.
Inline_Minimal	Do minimal inlining of callees.

Definition at line 129 of file ExprEngine.h.

◆ ~ExprEngine()

virtual clang::ento::ExprEngine::~ExprEngine ( )	virtualdefault

◆ bindReturnValue()

Create a new state in which the call return value is binded to the call origin expression.

Definition at line 745 of file ExprEngineCallAndReturn.cpp.

References clang::ento::NodeBuilderContext::blockCount(), clang::C, clang::Call, clang::ento::SVal::castAs(), clang::ento::SValBuilder::conjureSymbolVal(), E, clang::ento::SValBuilder::evalBinOp(), clang::ento::SValBuilder::getArrayIndexType(), clang::ento::SVal::getAsRegion(), clang::ento::SValBuilder::getConjuredHeapSymbolVal(), getCurrentCFGElement(), clang::ento::getElementExtent(), clang::Expr::getType(), handleConstructionContext(), clang::ento::SValBuilder::makeIntVal(), clang::OMF_autorelease, clang::OMF_retain, clang::OMF_self, clang::ento::setDynamicExtent(), clang::ento::RegionAndSymbolInvalidationTraits::setTrait(), clang::ento::MemRegion::StripCasts(), clang::Target, and clang::ento::RegionAndSymbolInvalidationTraits::TK_DoNotInvalidateSuperRegion.

◆ cleanupNodeTag()

A tag to track convenience transitions, which can be removed at cleanup.

This tag applies to a node created after removeDead.

Definition at line 1107 of file ExprEngine.cpp.

Referenced by removeDead().

◆ computeObjectUnderConstruction()

Find location of the object that is being constructed by a given constructor.

This should ideally always succeed but due to not being fully implemented it sometimes indicates that it failed via its out-parameter CallOpts; in such cases a fake temporary region is returned, which is better than nothing but does not represent the actual behavior of the program. The Idx parameter is used if we construct an array of objects. In that case it points to the index of the continuous memory region. E.g.: For int arr[4] this index can be 0,1,2,3. For int arr2[3][3] this index can be 0,1,...,7,8. A multi-dimensional array is also a continuous memory location in a row major order, so for arr[0][0] Idx is 0 and for arr[2][2] Idx is 8.

Definition at line 113 of file ExprEngineCXX.cpp.

Referenced by computeObjectUnderConstruction(), clang::ento::CallEvent::getReturnValueUnderConstruction(), and handleConstructionContext().

◆ CreateCXXTemporaryObject()

◆ defaultEvalCall()

Default implementation of call evaluation.

Definition at line 1218 of file ExprEngineCallAndReturn.cpp.

References clang::Call, clang::ento::CallEvent::cloneWithState(), D, E, getAnalysisManager(), clang::ento::RuntimeDefinition::getDecl(), clang::ento::RuntimeDefinition::getDispatchRegion(), getInlineFailedState(), clang::ento::ExplodedNode::getState(), clang::IPAK_DynamicDispatch, clang::IPAK_DynamicDispatchBifurcate, clang::ento::RuntimeDefinition::isForeign(), isTrivialObjectAssignment(), clang::ento::RuntimeDefinition::mayHaveOtherDefinitions(), and clang::ento::AnalysisManager::options.

Referenced by clang::ento::CheckerManager::runCheckersForEvalCall(), VisitCXXDeleteExpr(), VisitCXXDestructor(), VisitCXXNewAllocatorCall(), and VisitObjCMessage().

◆ didEagerlyAssumeBifurcateAt()

◆ DumpGraph() [1/2]

std::string ExprEngine::DumpGraph	(	ArrayRef< const ExplodedNode * >	Nodes,
StringRef	Filename = ""
)

◆ DumpGraph() [2/2]

std::string ExprEngine::DumpGraph	(	bool	trim = false,
StringRef	Filename = ""
)

◆ evalBinOp()

◆ evalCall()

Evaluate a call, running pre- and post-call checkers and allowing checkers to be responsible for handling the evaluation of the call itself.

Definition at line 677 of file ExprEngineCallAndReturn.cpp.

References clang::Call, clang::ento::NodeBuilder::generateNode(), getCheckerManager(), clang::Type::getPointeeType(), clang::ento::ExplodedNodeSet::insert(), clang::QualType::isConstQualified(), clang::QualType::isNull(), clang::Type::isPointerType(), clang::Type::isReferenceType(), clang::Type::isVoidType(), processPointerEscapedOnBind(), clang::ento::PSK_EscapeOutParameters, clang::ento::CheckerManager::runCheckersForEvalCall(), clang::ento::CheckerManager::runCheckersForPostCall(), and clang::ento::CheckerManager::runCheckersForPreCall().

Referenced by VisitCallExpr().

◆ evalEagerlyAssumeBifurcation()

evalEagerlyAssumeBifurcation - Given the nodes in 'Src', eagerly assume concrete boolean values for 'Ex', storing the resulting nodes in 'Dst'.

Referenced by Visit().

◆ evalLoad()

Simulate a read of the result of Ex.

Definition at line 3681 of file ExprEngine.cpp.

References clang::ento::SVal::castAs(), clang::ento::ExplodedNodeSet::empty(), clang::ento::StmtNodeBuilder::generateNode(), clang::Expr::getType(), clang::QualType::isNull(), clang::ento::SVal::isUndef(), clang::ento::SVal::isValid(), clang::ProgramPoint::PostLoadKind, and V.

Referenced by VisitBinaryOperator(), VisitCast(), VisitIncrementDecrementOperator(), and VisitMemberExpr().

◆ evalStore()

◆ ExecuteWorkList()

◆ getAnalysisDeclContextManager()

◆ getAnalysisManager()

◆ getBasicVals()

◆ getBugReporter()

BugReporter & clang::ento::ExprEngine::getBugReporter ( )	inline

◆ getBuilderContext()

◆ getCFGElementRef()

Definition at line 229 of file ExprEngine.h.

References clang::ento::NodeBuilderContext::getBlock().

Referenced by computeObjectUnderConstruction(), ProcessAutomaticObjDtor(), ProcessDeleteDtor(), ProcessMemberDtor(), ProcessNewAllocator(), ProcessTemporaryDtor(), VisitCallExpr(), VisitCXXDeleteExpr(), VisitCXXDestructor(), VisitCXXNewAllocatorCall(), VisitCXXNewExpr(), and VisitObjCMessage().

◆ getCheckerManager()

CheckerManager & clang::ento::ExprEngine::getCheckerManager ( ) const	inline

Definition at line 204 of file ExprEngine.h.

References clang::ento::AnalysisManager::getCheckerManager().

Referenced by evalCall(), notifyCheckersOfPointerEscape(), printJson(), processAssume(), processBeginOfFunction(), processBranch(), processCallExit(), processEndOfFunction(), processEndWorklist(), processRegionChanges(), removeDead(), Visit(), VisitArrayInitLoopExpr(), VisitArraySubscriptExpr(), VisitAtomicExpr(), VisitBinaryOperator(), VisitBlockExpr(), VisitCallExpr(), VisitCast(), VisitCXXDeleteExpr(), VisitCXXDestructor(), VisitCXXNewAllocatorCall(), VisitDeclStmt(), VisitLambdaExpr(), VisitLvalObjCIvarRefExpr(), VisitMemberExpr(), VisitObjCAtSynchronizedStmt(), VisitObjCForCollectionStmt(), VisitObjCMessage(), VisitReturnStmt(), VisitUnaryExprOrTypeTraitExpr(), and VisitUnaryOperator().

◆ getConstraintManager()

◆ getContext()

ASTContext & clang::ento::ExprEngine::getContext ( ) const	inline

getContext - Return the ASTContext associated with this analysis.

Definition at line 196 of file ExprEngine.h.

References clang::ento::AnalysisManager::getASTContext().

Referenced by computeObjectUnderConstruction(), clang::ento::CheckerContext::getASTContext(), clang::ento::CheckerContext::getLangOpts(), handleLValueBitCast(), ProcessAutomaticObjDtor(), processBranch(), processCallExit(), ProcessDeleteDtor(), ProcessInitializer(), ProcessLoopExit(), ProcessMemberDtor(), ProcessStmt(), processSwitch(), ProcessTemporaryDtor(), Visit(), VisitArraySubscriptExpr(), VisitBinaryOperator(), VisitBlockExpr(), VisitCast(), VisitCXXDestructor(), VisitCXXNewAllocatorCall(), VisitCXXThisExpr(), VisitDeclStmt(), VisitInitListExpr(), VisitLambdaExpr(), VisitOffsetOfExpr(), and VisitUnaryExprOrTypeTraitExpr().

◆ getCoreEngine()

const CoreEngine & clang::ento::ExprEngine::getCoreEngine ( ) const	inline

◆ getCrossTranslationUnitContext()

◆ getCurrentCFGElement()

CFGElement clang::ento::ExprEngine::getCurrentCFGElement ( )	inline

◆ getDataTags()

◆ getEagerlyAssumeBifurcationTags()

◆ getGraph() [1/2]

◆ getGraph() [2/2]

const ExplodedGraph & clang::ento::ExprEngine::getGraph ( ) const	inline

◆ getIndexOfElementToConstruct()

◆ getInitialState()

getInitialState - Return the initial state used for the root vertex in the ExplodedGraph.

Definition at line 244 of file ExprEngine.cpp.

References D, evalBinOp(), clang::ento::SVal::getAs(), clang::ento::SValBuilder::getConditionType(), clang::ento::SValBuilder::getCXXThis(), clang::LocationContext::getDecl(), clang::ento::ProgramStateManager::getInitialState(), clang::IdentifierInfo::getName(), clang::LocationContext::getParent(), clang::LocationContext::getStackFrame(), clang::ValueDecl::getType(), clang::ento::SValBuilder::makeZeroVal(), clang::T, and V.

Referenced by clang::ento::CoreEngine::ExecuteWorkList().

◆ getObjectUnderConstruction()

By looking at a certain item that may be potentially part of an object's ConstructionContext, retrieve such object's location.

A particular statement can be transparently passed as Item in most cases.

Definition at line 603 of file ExprEngine.cpp.

References clang::LocationContext::getStackFrame(), and V.

Referenced by computeObjectUnderConstruction(), clang::ento::CXXAllocatorCall::getObjectUnderConstruction(), clang::ento::CallEvent::isArgumentConstructedDirectly(), processCleanupTemporaryBranch(), ProcessInitializer(), ProcessTemporaryDtor(), VisitCXXBindTemporaryExpr(), VisitCXXNewExpr(), VisitDeclStmt(), and VisitLambdaExpr().

◆ getPendingArrayDestruction()

◆ getPendingInitLoop()

◆ getRegionManager()

◆ getRootLocationContext()

const LocationContext * clang::ento::ExprEngine::getRootLocationContext ( ) const	inline

◆ getStateManager()

Definition at line 414 of file ExprEngine.h.

Referenced by computeObjectUnderConstruction(), clang::ento::CheckerContext::getStateManager(), clang::ento::PathSensitiveBugReporter::getStateManager(), processCallExit(), processEndOfFunction(), VisitCallExpr(), VisitCXXDeleteExpr(), VisitCXXDestructor(), VisitCXXNewAllocatorCall(), VisitCXXNewExpr(), and VisitObjCMessage().

◆ getStmt()

const Stmt * clang::ento::ExprEngine::getStmt	(	)	const

◆ getStoreManager()

StoreManager & clang::ento::ExprEngine::getStoreManager ( )	inline

◆ getSValBuilder()

SValBuilder & clang::ento::ExprEngine::getSValBuilder ( )	inline

◆ getSymbolManager()

SymbolManager & clang::ento::ExprEngine::getSymbolManager ( )	inline

◆ handleConstructionContext()

◆ handleLValueBitCast()

Definition at line 254 of file ExprEngineC.cpp.

References clang::ento::SValBuilder::evalCast(), clang::ento::SValBuilder::evalMinus(), clang::ento::StmtNodeBuilder::generateNode(), clang::CastExpr::getCastKind(), getContext(), clang::ASTContext::getLValueReferenceType(), clang::ASTContext::getRValueReferenceType(), clang::Expr::getType(), clang::Type::isLValueReferenceType(), clang::Type::isRValueReferenceType(), clang::ento::SVal::isUnknown(), clang::ento::PSK_EscapeOther, clang::ento::SValBuilder::simplifySVal(), clang::T, and V.

Referenced by VisitCast().

◆ handleUOExtension()

◆ hasEmptyWorkList()

bool clang::ento::ExprEngine::hasEmptyWorkList ( ) const	inline

◆ hasMoreIteration()

◆ hasWorkRemaining()

bool clang::ento::ExprEngine::hasWorkRemaining ( ) const	inline

◆ notifyCheckersOfPointerEscape()

◆ printJson()

◆ processAssume()

◆ ProcessAutomaticObjDtor()

Definition at line 1337 of file ExprEngine.cpp.

References clang::ento::SVal::castAs(), clang::ento::NodeBuilder::generateNode(), clang::ento::NodeBuilder::generateSink(), clang::ento::SVal::getAsInteger(), clang::ento::SVal::getAsRegion(), clang::ento::MemRegion::getBaseRegion(), getBuilderContext(), getCFGElementRef(), getContext(), clang::CFGImplicitDtor::getDestructorDecl(), clang::ento::ExplodedNode::getLocationContext(), getRegion(), clang::ento::ExplodedNode::getState(), clang::CFGAutomaticObjDtor::getTriggerStmt(), clang::CFGAutomaticObjDtor::getVarDecl(), clang::ento::EvalCallOptions::IsArrayCtorOrDtor, clang::ento::SVal::isConstant(), clang::Type::isReferenceType(), clang::ento::NodeBuilder::takeNodes(), clang::ast_matchers::varDecl, and VisitCXXDestructor().

Referenced by ProcessImplicitDtor().

◆ ProcessBaseDtor()

Definition at line 1485 of file ExprEngine.cpp.

References D, clang::ento::StoreManager::evalDerivedToBase(), clang::ento::SVal::getAsRegion(), clang::ento::SValBuilder::getCXXThis(), clang::LocationContext::getDecl(), clang::ento::ExplodedNode::getLocationContext(), clang::LocationContext::getStackFrame(), clang::ento::ExplodedNode::getState(), getStoreManager(), getSValBuilder(), and VisitCXXDestructor().

Referenced by ProcessImplicitDtor().

◆ processBeginOfFunction()

◆ processBranch()

ProcessBranch - Called by CoreEngine.

Used to generate successor nodes by processing the 'effects' of a branch condition. If the branch condition is a loop condition, IterationsCompletedInLoop is the number of completed iterations (otherwise it's std::nullopt).

Definition at line 2766 of file ExprEngine.cpp.

References assumeCondition(), clang::Condition, didEagerlyAssumeBifurcateAt(), clang::ento::ExplodedNodeSet::empty(), clang::ento::BranchNodeBuilder::generateNode(), clang::ento::NodeBuilderContext::getBlock(), getCheckerManager(), getContext(), clang::ento::ExplodedNode::getLocationContext(), clang::ento::ExplodedNode::getState(), clang::ento::AnalysisManager::options, ResolveCondition(), and clang::ento::CheckerManager::runCheckersForBranchCondition().

◆ processCallEnter()

◆ processCallExit()

Generate the sequence of nodes that simulate the call exit and the post visit for CallExpr.

The call exit is simulated with a sequence of nodes, which occur between CallExitBegin and CallExitEnd.

The following operations occur between the two program points:

CallExitBegin (triggers the start of call exit sequence)
Bind the return value
Run Remove dead bindings to clean up the dead symbols from the callee.
CallExitEnd (switch to the caller context)
PostStmt

Definition at line 254 of file ExprEngineCallAndReturn.cpp.

Referenced by clang::ento::CoreEngine::dispatchWorkItem().

◆ processCFGBlockEntrance()

Called by CoreEngine when processing the entrance of a CFGBlock.

Block entrance. (Update counters).

Definition at line 2514 of file ExprEngine.cpp.

References clang::ento::NodeBuilderContext::blockCount(), clang::ento::NodeBuilderWithSinks::generateNode(), clang::ento::NodeBuilderWithSinks::generateSink(), clang::ento::AnalysisManager::getASTContext(), clang::ento::NodeBuilderContext::getBlock(), clang::ento::NodeBuilder::getContext(), clang::LocationContext::getDecl(), clang::ento::ExplodedNode::getLocation(), clang::ProgramPoint::getLocationContext(), clang::ento::ExplodedNode::getLocationContext(), clang::LocationContext::getStackFrame(), clang::ento::ExplodedNode::getState(), clang::CFGBlock::getTerminatorStmt(), clang::ento::getWidenedLoopState(), clang::ento::isUnrolledState(), clang::ento::FunctionSummariesTy::markReachedMaxBlockCount(), clang::AnalyzerOptions::maxBlockVisitOnPath, clang::AnalyzerOptions::NoRetryExhausted, clang::ento::AnalysisManager::options, clang::ento::ExplodedGraph::roots_begin(), and clang::ento::updateLoopStack().

◆ processCFGElement()

processCFGElement - Called by CoreEngine.

Used to generate new successor nodes by processing the 'effects' of a CFG element.

Definition at line 966 of file ExprEngine.cpp.

◆ processCleanupTemporaryBranch()

◆ ProcessDeleteDtor()

Definition at line 1409 of file ExprEngine.cpp.

References clang::ento::NodeBuilder::generateNode(), clang::CXXDeleteExpr::getArgument(), clang::ASTContext::getAsArrayType(), clang::Type::getAsCXXRecordDecl(), clang::ento::SVal::getAsInteger(), clang::ento::SVal::getAsRegion(), clang::ASTContext::getBaseElementType(), clang::CXXDeleteExpr::getBeginLoc(), getBuilderContext(), getCFGElementRef(), getContext(), clang::CFGDeleteDtor::getDeleteExpr(), clang::CXXDeleteExpr::getDestroyedType(), clang::CXXRecordDecl::getDestructor(), clang::ento::ExplodedNode::getLocationContext(), clang::ento::ExplodedNode::getState(), clang::ento::EvalCallOptions::IsArrayCtorOrDtor, clang::CXXDeleteExpr::isArrayForm(), clang::ento::SVal::isConstant(), clang::ento::SValBuilder::makeArrayIndex(), clang::ento::NodeBuilder::takeNodes(), and VisitCXXDestructor().

Referenced by ProcessImplicitDtor().

◆ processEndOfFunction()

Called by CoreEngine.

ProcessEndPath - Called by CoreEngine.

Used to notify checkers that processing a function has ended. Called for both inlined and top-level functions.

Used to generate end-of-path nodes when the control reaches the end of a function.

Definition at line 2929 of file ExprEngine.cpp.

References clang::ConstructionContextItem::ElidedDestructorKind, clang::ento::CoreEngine::enqueueEndOfFunction(), clang::ento::NodeBuilder::generateNode(), getCheckerManager(), clang::ento::ExplodedNode::getLocation(), clang::ento::ExplodedNode::getLocationContext(), clang::LocationContext::getParent(), clang::LocationContext::getStackFrame(), clang::ento::ExplodedNode::getStackFrame(), clang::ento::ExplodedNode::getState(), getStateManager(), clang::LocationContext::inTopFrame(), clang::StackFrameContext::inTopFrame(), removeDeadOnEndOfFunction(), clang::ento::CheckerManager::runCheckersForEndFunction(), and clang::ConstructionContextItem::TemporaryDestructorKind.

◆ processEndWorklist()

void ExprEngine::processEndWorklist	(	)

◆ ProcessImplicitDtor()

Definition at line 1290 of file ExprEngine.cpp.

References clang::CFGElement::AutomaticObjectDtor, clang::CFGElement::BaseDtor, D, clang::CFGElement::DeleteDtor, clang::ento::CoreEngine::enqueue(), clang::ento::NodeBuilderContext::getBlock(), clang::Decl::getKind(), clang::CFGElement::MemberDtor, ProcessAutomaticObjDtor(), ProcessBaseDtor(), ProcessDeleteDtor(), ProcessMemberDtor(), ProcessTemporaryDtor(), and clang::CFGElement::TemporaryDtor.

Referenced by processCFGElement().

◆ processIndirectGoto()

◆ ProcessInitializer()

Definition at line 1160 of file ExprEngine.cpp.

Referenced by processCFGElement().

◆ ProcessLoopExit()

◆ ProcessMemberDtor()

Definition at line 1505 of file ExprEngine.cpp.

References D, clang::ento::NodeBuilder::generateNode(), clang::ento::NodeBuilder::generateSink(), clang::ento::SVal::getAsInteger(), getBuilderContext(), getCFGElementRef(), getContext(), clang::ento::SValBuilder::getCXXThis(), clang::LocationContext::getDecl(), clang::ento::ExplodedNode::getLocationContext(), clang::LocationContext::getStackFrame(), clang::ento::ExplodedNode::getState(), getSValBuilder(), clang::ento::EvalCallOptions::IsArrayCtorOrDtor, clang::ento::SVal::isConstant(), clang::Member, clang::T, clang::ento::NodeBuilder::takeNodes(), and VisitCXXDestructor().

Referenced by ProcessImplicitDtor().

◆ ProcessNewAllocator()

◆ processPointerEscapedOnBind()

◆ processRegionChange()

◆ processRegionChanges()

◆ processStaticInitializer()

Called by CoreEngine.

Used to processing branching behavior at static initializers.

◆ ProcessStmt()

Definition at line 1112 of file ExprEngine.cpp.

References clang::ento::ExplodedNodeSet::Add(), clang::ento::CoreEngine::enqueue(), clang::Stmt::getBeginLoc(), clang::ento::NodeBuilderContext::getBlock(), getContext(), clang::ento::ExplodedNode::getLocationContext(), clang::ento::ExplodedNodeSet::insert(), clang::ento::ExplodedGraph::reclaimRecentlyAllocatedNodes(), removeDead(), shouldRemoveDeadBindings(), and Visit().

Referenced by processCFGElement().

◆ processSwitch()

ProcessSwitch - Called by CoreEngine.

Used to generate successor nodes by processing the 'effects' of a switch statement.

Definition at line 3003 of file ExprEngine.cpp.

◆ ProcessTemporaryDtor()

Definition at line 1564 of file ExprEngine.cpp.

References clang::ento::ExplodedNodeSet::begin(), D, clang::ento::ExplodedNodeSet::empty(), clang::ento::NodeBuilder::generateNode(), clang::ento::StmtNodeBuilder::generateNode(), clang::Decl::getBeginLoc(), getCFGElementRef(), getContext(), clang::ento::ExplodedNode::getLocationContext(), getObjectUnderConstruction(), clang::ento::ExplodedNode::getState(), clang::ento::EvalCallOptions::IsTemporaryCtorOrDtor, clang::ento::ExplodedNodeSet::size(), clang::T, V, and VisitCXXDestructor().

Referenced by ProcessImplicitDtor().

◆ removeDead()

Run the analyzer's garbage collection - remove dead symbols and bindings from the state.

Checkers can participate in this process with two callbacks: checkLiveSymbols and checkDeadSymbols. See the CheckerDocumentation class for more information.

Parameters

Node	The predecessor node, from which the processing should start.
Out	The returned set of output nodes.
ReferenceStmt	The statement which is about to be processed. Everything needed for this statement should be considered live. A null statement means that everything in child LocationContexts is dead.
LC	The location context of the ReferenceStmt. A null location context means that we have reached the end of analysis and that all statements and local variables should be considered dead.
DiagnosticStmt	Used as a location for any warnings that should occur while removing the dead (e.g. leaks). By default, the ReferenceStmt is used.
K	Denotes whether this is a pre- or post-statement purge. This must only be ProgramPoint::PostStmtPurgeDeadSymbolsKind if an entire location context is being cleared, in which case the ReferenceStmt must either be a ReturnStmt or NULL. Otherwise, it must be ProgramPoint::PreStmtPurgeDeadSymbolsKind (the default) and ReferenceStmt must be valid (non-null).

Definition at line 1029 of file ExprEngine.cpp.

References cleanupNodeTag(), clang::ento::StmtNodeBuilder::generateNode(), getCheckerManager(), getConstraintManager(), clang::LocationContext::getParent(), clang::ento::ProgramStateManager::getPersistentStateWithGDM(), clang::LocationContext::getStackFrame(), clang::ento::ExplodedNode::getState(), getStoreManager(), clang::ento::ProgramStateManager::haveEqualEnvironments(), clang::ento::ProgramStateManager::haveEqualStores(), clang::ento::SymbolReaper::markLive(), clang::ProgramPoint::PostStmtPurgeDeadSymbolsKind, clang::ProgramPoint::PreStmtPurgeDeadSymbolsKind, clang::ento::ConstraintManager::removeDeadBindings(), clang::ento::ProgramStateManager::removeDeadBindingsFromEnvironmentAndStore(), clang::ento::CheckerManager::runCheckersForDeadSymbols(), and clang::ento::CheckerManager::runCheckersForLiveSymbols().

Referenced by processCallExit(), ProcessStmt(), and removeDeadOnEndOfFunction().

◆ removeDeadOnEndOfFunction()

◆ removeIterationState()

◆ setWhetherHasMoreIteration()

◆ updateObjectsUnderConstruction()

Update the program state with all the path-sensitive information that's necessary to perform construction of an object with a given syntactic construction context.

V and CallOpts have to be obtained from computeObjectUnderConstruction() invoked with the same set of the remaining arguments (E, State, LCtx, CC).

Definition at line 391 of file ExprEngineCXX.cpp.