microsoft
/
clang-1
зеркало из https://github.com/microsoft/clang-1.git
1
0
Форкнуть 0
Код Задачи Пакеты Проекты Релизы Вики Активность

Rename ValueState -> GRState. 

Rename ValueStateManager -> GRStateManager.


git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@54721 91177308-0d34-0410-b5e6-96231b3b80d8
This commit is contained in:
Ted Kremenek 2008-08-13 04:27:00 +00:00
Родитель 70ecb9b883
Коммит 4adc81e540
15 изменённых файлов: 464 добавлений и 464 удалений
Показать статистику Скачать Patch файл Скачать Diff файл Показать все файлы Свернуть все файлы

28
include/clang/Analysis/PathSensitive/BugReporter.h
Просмотреть файл

@ -8,7 +8,7 @@
//===----------------------------------------------------------------------===//
//
// This file defines BugReporter, a utility class for generating
// PathDiagnostics for analyses based on ValueState.
// PathDiagnostics for analyses based on GRState.
//
//===----------------------------------------------------------------------===//
@ -17,7 +17,7 @@
#include "clang/Basic/Diagnostic.h"
#include "clang/Basic/SourceLocation.h"
#include "clang/Analysis/PathSensitive/ValueState.h"
#include "clang/Analysis/PathSensitive/GRState.h"
#include "clang/Analysis/PathSensitive/ExplodedGraph.h"
#include "llvm/ADT/SmallPtrSet.h"
#include "llvm/ADT/SmallSet.h"
@ -33,7 +33,7 @@ class ASTContext;
class Diagnostic;
class BugReporter;
class GRExprEngine;
class ValueState;
class GRState;
class Stmt;
class BugReport;
class ParentMap;
@ -51,7 +51,7 @@ public:
}
virtual void EmitWarnings(BugReporter& BR) {}
virtual void GetErrorNodes(std::vector<ExplodedNode<ValueState>*>& Nodes) {}
virtual void GetErrorNodes(std::vector<ExplodedNode<GRState>*>& Nodes) {}
virtual bool isCached(BugReport& R) = 0;
};
@ -68,16 +68,16 @@ public:
class BugReport {
BugType& Desc;
ExplodedNode<ValueState> *EndNode;
ExplodedNode<GRState> *EndNode;
SourceRange R;
public:
BugReport(BugType& D, ExplodedNode<ValueState> *n) : Desc(D), EndNode(n) {}
BugReport(BugType& D, ExplodedNode<GRState> *n) : Desc(D), EndNode(n) {}
virtual ~BugReport();
const BugType& getBugType() const { return Desc; }
BugType& getBugType() { return Desc; }
ExplodedNode<ValueState>* getEndNode() const { return EndNode; }
ExplodedNode<GRState>* getEndNode() const { return EndNode; }
Stmt* getStmt(BugReporter& BR) const;
@ -92,16 +92,16 @@ public:
}
virtual PathDiagnosticPiece* getEndPath(BugReporter& BR,
ExplodedNode<ValueState>* N);
ExplodedNode<GRState>* N);
virtual FullSourceLoc getLocation(SourceManager& Mgr);
virtual void getRanges(BugReporter& BR,const SourceRange*& beg,
const SourceRange*& end);
virtual PathDiagnosticPiece* VisitNode(ExplodedNode<ValueState>* N,
ExplodedNode<ValueState>* PrevN,
ExplodedGraph<ValueState>& G,
virtual PathDiagnosticPiece* VisitNode(ExplodedNode<GRState>* N,
ExplodedNode<GRState>* PrevN,
ExplodedGraph<GRState>& G,
BugReporter& BR);
};
@ -109,7 +109,7 @@ class RangedBugReport : public BugReport {
std::vector<SourceRange> Ranges;
const char* desc;
public:
RangedBugReport(BugType& D, ExplodedNode<ValueState> *n,
RangedBugReport(BugType& D, ExplodedNode<GRState> *n,
const char* description = 0)
: BugReport(D, n), desc(description) {}
@ -227,9 +227,9 @@ public:
return Eng;
}
ExplodedGraph<ValueState>& getGraph();
ExplodedGraph<GRState>& getGraph();
ValueStateManager& getStateManager();
GRStateManager& getStateManager();
virtual void GeneratePathDiagnostic(PathDiagnostic& PD, BugReport& R);

62
include/clang/Analysis/PathSensitive/GRExprEngine.h
Просмотреть файл

@ -17,7 +17,7 @@
#define LLVM_CLANG_ANALYSIS_GREXPRENGINE
#include "clang/Analysis/PathSensitive/GRCoreEngine.h"
#include "clang/Analysis/PathSensitive/ValueState.h"
#include "clang/Analysis/PathSensitive/GRState.h"
#include "clang/Analysis/PathSensitive/GRSimpleAPICheck.h"
#include "clang/Analysis/PathSensitive/GRTransferFuncs.h"
#include "clang/AST/Type.h"
@ -33,7 +33,7 @@ namespace clang {
class GRExprEngine {
public:
typedef ValueState StateTy;
typedef GRState StateTy;
typedef ExplodedGraph<StateTy> GraphTy;
typedef GraphTy::NodeTy NodeTy;
@ -57,15 +57,15 @@ protected:
LiveVariables& Liveness;
/// DeadSymbols - A scratch set used to record the set of symbols that
/// were just marked dead by a call to ValueStateManager::RemoveDeadBindings.
ValueStateManager::DeadSymbolsTy DeadSymbols;
/// were just marked dead by a call to GRStateManager::RemoveDeadBindings.
GRStateManager::DeadSymbolsTy DeadSymbols;
/// Builder - The current GRStmtNodeBuilder which is used when building the
/// nodes for a given statement.
StmtNodeBuilder* Builder;
/// StateMgr - Object that manages the data for all created states.
ValueStateManager StateMgr;
GRStateManager StateMgr;
/// BugTypes - Objects used for reporting bugs.
typedef std::vector<BugType*> BugTypeSet;
@ -79,7 +79,7 @@ protected:
/// CleanedState - The state for EntryNode "cleaned" of all dead
/// variables and symbols (as determined by a liveness analysis).
const ValueState* CleanedState;
const GRState* CleanedState;
/// CurrentStmt - The current block-level statement.
Stmt* CurrentStmt;
@ -202,7 +202,7 @@ public:
/// getInitialState - Return the initial state used for the root vertex
/// in the ExplodedGraph.
const ValueState* getInitialState();
const GRState* getInitialState();
GraphTy& getGraph() { return G; }
const GraphTy& getGraph() const { return G; }
@ -350,7 +350,7 @@ public:
/// ProcessBlockEntrance - Called by GRCoreEngine when start processing
/// a CFGBlock. This method returns true if the analysis should continue
/// exploring the given path, and false otherwise.
bool ProcessBlockEntrance(CFGBlock* B, const ValueState* St,
bool ProcessBlockEntrance(CFGBlock* B, const GRState* St,
GRBlockCounter BC);
/// ProcessBranch - Called by GRCoreEngine. Used to generate successor
@ -371,8 +371,8 @@ public:
getTF().EvalEndPath(*this, builder);
}
ValueStateManager& getStateManager() { return StateMgr; }
const ValueStateManager& getStateManger() const { return StateMgr; }
GRStateManager& getStateManager() { return StateMgr; }
const GRStateManager& getStateManger() const { return StateMgr; }
BasicValueFactory& getBasicVals() {
return StateMgr.getBasicVals();
@ -386,43 +386,43 @@ public:
protected:
const ValueState* GetState(NodeTy* N) {
const GRState* GetState(NodeTy* N) {
return N == EntryNode ? CleanedState : N->getState();
}
public:
const ValueState* SetRVal(const ValueState* St, Expr* Ex, RVal V) {
const GRState* SetRVal(const GRState* St, Expr* Ex, RVal V) {
return StateMgr.SetRVal(St, Ex, V);
}
const ValueState* SetRVal(const ValueState* St, const Expr* Ex, RVal V) {
const GRState* SetRVal(const GRState* St, const Expr* Ex, RVal V) {
return SetRVal(St, const_cast<Expr*>(Ex), V);
}
protected:
const ValueState* SetBlkExprRVal(const ValueState* St, Expr* Ex, RVal V) {
const GRState* SetBlkExprRVal(const GRState* St, Expr* Ex, RVal V) {
return StateMgr.SetRVal(St, Ex, V, true, false);
}
const ValueState* SetRVal(const ValueState* St, LVal LV, RVal V) {
const GRState* SetRVal(const GRState* St, LVal LV, RVal V) {
return StateMgr.SetRVal(St, LV, V);
}
RVal GetRVal(const ValueState* St, Expr* Ex) {
RVal GetRVal(const GRState* St, Expr* Ex) {
return StateMgr.GetRVal(St, Ex);
}
RVal GetRVal(const ValueState* St, const Expr* Ex) {
RVal GetRVal(const GRState* St, const Expr* Ex) {
return GetRVal(St, const_cast<Expr*>(Ex));
}
RVal GetBlkExprRVal(const ValueState* St, Expr* Ex) {
RVal GetBlkExprRVal(const GRState* St, Expr* Ex) {
return StateMgr.GetBlkExprRVal(St, Ex);
}
RVal GetRVal(const ValueState* St, LVal LV, QualType T = QualType()) {
RVal GetRVal(const GRState* St, LVal LV, QualType T = QualType()) {
return StateMgr.GetRVal(St, LV, T);
}
@ -432,17 +432,17 @@ protected:
/// Assume - Create new state by assuming that a given expression
/// is true or false.
const ValueState* Assume(const ValueState* St, RVal Cond, bool Assumption,
const GRState* Assume(const GRState* St, RVal Cond, bool Assumption,
bool& isFeasible) {
return StateMgr.Assume(St, Cond, Assumption, isFeasible);
}
const ValueState* Assume(const ValueState* St, LVal Cond, bool Assumption,
const GRState* Assume(const GRState* St, LVal Cond, bool Assumption,
bool& isFeasible) {
return StateMgr.Assume(St, Cond, Assumption, isFeasible);
}
NodeTy* MakeNode(NodeSet& Dst, Stmt* S, NodeTy* Pred, const ValueState* St) {
NodeTy* MakeNode(NodeSet& Dst, Stmt* S, NodeTy* Pred, const GRState* St) {
assert (Builder && "GRStmtNodeBuilder not present.");
return Builder->MakeNode(Dst, S, Pred, St);
}
@ -528,7 +528,7 @@ protected:
void VisitUnaryOperator(UnaryOperator* B, NodeTy* Pred, NodeSet& Dst,
bool asLVal);
bool CheckDivideZero(Expr* Ex, const ValueState* St, NodeTy* Pred,
bool CheckDivideZero(Expr* Ex, const GRState* St, NodeTy* Pred,
RVal Denom);
RVal EvalCast(RVal X, QualType CastT) {
@ -559,11 +559,11 @@ protected:
cast<NonLVal>(R)) : R;
}
void EvalBinOp(ExplodedNodeSet<ValueState>& Dst, Expr* Ex,
void EvalBinOp(ExplodedNodeSet<GRState>& Dst, Expr* Ex,
BinaryOperator::Opcode Op, NonLVal L, NonLVal R,
ExplodedNode<ValueState>* Pred);
ExplodedNode<GRState>* Pred);
void EvalBinOp(ValueStateSet& OStates, const ValueState* St, Expr* Ex,
void EvalBinOp(GRStateSet& OStates, const GRState* St, Expr* Ex,
BinaryOperator::Opcode Op, NonLVal L, NonLVal R);
RVal EvalBinOp(BinaryOperator::Opcode Op, RVal L, RVal R) {
@ -607,22 +607,22 @@ protected:
getTF().EvalObjCMessageExpr(Dst, *this, *Builder, ME, Pred);
}
void EvalStore(NodeSet& Dst, Expr* E, NodeTy* Pred, const ValueState* St,
void EvalStore(NodeSet& Dst, Expr* E, NodeTy* Pred, const GRState* St,
RVal TargetLV, RVal Val);
// FIXME: The "CheckOnly" option exists only because Array and Field
// loads aren't fully implemented. Eventually this option will go away.
void EvalLoad(NodeSet& Dst, Expr* Ex, NodeTy* Pred,
const ValueState* St, RVal location, bool CheckOnly = false);
const GRState* St, RVal location, bool CheckOnly = false);
const ValueState* EvalLocation(Expr* Ex, NodeTy* Pred,
const ValueState* St, RVal location,
const GRState* EvalLocation(Expr* Ex, NodeTy* Pred,
const GRState* St, RVal location,
bool isLoad = false);
void EvalReturn(NodeSet& Dst, ReturnStmt* s, NodeTy* Pred);
const ValueState* MarkBranch(const ValueState* St, Stmt* Terminator, bool branchTaken);
const GRState* MarkBranch(const GRState* St, Stmt* Terminator, bool branchTaken);
};
} // end clang namespace

4
include/clang/Analysis/PathSensitive/GRSimpleAPICheck.h
Просмотреть файл

@ -17,7 +17,7 @@
#define LLVM_CLANG_ANALYSIS_GRAPICHECKS
#include "clang/Analysis/PathSensitive/GRAuditor.h"
#include "clang/Analysis/PathSensitive/ValueState.h"
#include "clang/Analysis/PathSensitive/GRState.h"
namespace clang {
@ -29,7 +29,7 @@ class PathDiagnosticClient;
template <typename T> class ExplodedGraph;
class GRSimpleAPICheck : public GRAuditor<ValueState> {
class GRSimpleAPICheck : public GRAuditor<GRState> {
public:
GRSimpleAPICheck() {}
virtual ~GRSimpleAPICheck() {}

52
include/clang/Analysis/PathSensitive/GRTransferFuncs.h
Просмотреть файл

@ -17,7 +17,7 @@
#include "clang/Analysis/PathSensitive/RValues.h"
#include "clang/Analysis/PathSensitive/GRCoreEngine.h"
#include "clang/Analysis/PathSensitive/ValueState.h"
#include "clang/Analysis/PathSensitive/GRState.h"
namespace clang {
@ -31,7 +31,7 @@ class GRTransferFuncs {
protected:
virtual RVal DetermEvalBinOpNN(ValueStateManager& StateMgr,
virtual RVal DetermEvalBinOpNN(GRStateManager& StateMgr,
BinaryOperator::Opcode Op,
NonLVal L, NonLVal R) {
return UnknownVal();
@ -42,7 +42,7 @@ public:
GRTransferFuncs() {}
virtual ~GRTransferFuncs() {}
virtual ValueState::CheckerStatePrinter* getCheckerStatePrinter() {
virtual GRState::CheckerStatePrinter* getCheckerStatePrinter() {
return NULL;
}
@ -60,8 +60,8 @@ public:
virtual RVal EvalComplement(GRExprEngine& Engine, NonLVal X) = 0;
// Binary Operators.
virtual void EvalBinOpNN(ValueStateSet& OStates, ValueStateManager& StateMgr,
const ValueState* St, Expr* Ex,
virtual void EvalBinOpNN(GRStateSet& OStates, GRStateManager& StateMgr,
const GRState* St, Expr* Ex,
BinaryOperator::Opcode Op, NonLVal L, NonLVal R);
virtual RVal EvalBinOp(GRExprEngine& Engine, BinaryOperator::Opcode Op,
@ -74,55 +74,55 @@ public:
// Calls.
virtual void EvalCall(ExplodedNodeSet<ValueState>& Dst,
virtual void EvalCall(ExplodedNodeSet<GRState>& Dst,
GRExprEngine& Engine,
GRStmtNodeBuilder<ValueState>& Builder,
GRStmtNodeBuilder<GRState>& Builder,
CallExpr* CE, RVal L,
ExplodedNode<ValueState>* Pred) {}
ExplodedNode<GRState>* Pred) {}
virtual void EvalObjCMessageExpr(ExplodedNodeSet<ValueState>& Dst,
virtual void EvalObjCMessageExpr(ExplodedNodeSet<GRState>& Dst,
GRExprEngine& Engine,
GRStmtNodeBuilder<ValueState>& Builder,
GRStmtNodeBuilder<GRState>& Builder,
ObjCMessageExpr* ME,
ExplodedNode<ValueState>* Pred) {}
ExplodedNode<GRState>* Pred) {}
// Stores.
/// EvalStore - Evaluate the effects of a store, creating a new node
/// the represents the effect of binding 'Val' to the location 'TargetLV'.
// TargetLV is guaranteed to either be an UnknownVal or an LVal.
virtual void EvalStore(ExplodedNodeSet<ValueState>& Dst,
virtual void EvalStore(ExplodedNodeSet<GRState>& Dst,
GRExprEngine& Engine,
GRStmtNodeBuilder<ValueState>& Builder,
Expr* E, ExplodedNode<ValueState>* Pred,
const ValueState* St, RVal TargetLV, RVal Val);
GRStmtNodeBuilder<GRState>& Builder,
Expr* E, ExplodedNode<GRState>* Pred,
const GRState* St, RVal TargetLV, RVal Val);
// End-of-path and dead symbol notification.
virtual void EvalEndPath(GRExprEngine& Engine,
GREndPathNodeBuilder<ValueState>& Builder) {}
GREndPathNodeBuilder<GRState>& Builder) {}
virtual void EvalDeadSymbols(ExplodedNodeSet<ValueState>& Dst,
virtual void EvalDeadSymbols(ExplodedNodeSet<GRState>& Dst,
GRExprEngine& Engine,
GRStmtNodeBuilder<ValueState>& Builder,
ExplodedNode<ValueState>* Pred,
GRStmtNodeBuilder<GRState>& Builder,
ExplodedNode<GRState>* Pred,
Stmt* S,
const ValueState* St,
const ValueStateManager::DeadSymbolsTy& Dead) {}
const GRState* St,
const GRStateManager::DeadSymbolsTy& Dead) {}
// Return statements.
virtual void EvalReturn(ExplodedNodeSet<ValueState>& Dst,
virtual void EvalReturn(ExplodedNodeSet<GRState>& Dst,
GRExprEngine& Engine,
GRStmtNodeBuilder<ValueState>& Builder,
GRStmtNodeBuilder<GRState>& Builder,
ReturnStmt* S,
ExplodedNode<ValueState>* Pred) {}
ExplodedNode<GRState>* Pred) {}
// Assumptions.
virtual const ValueState* EvalAssume(ValueStateManager& VMgr,
const ValueState* St,
virtual const GRState* EvalAssume(GRStateManager& VMgr,
const GRState* St,
RVal Cond, bool Assumption,
bool& isFeasible) {
return St;

136
include/clang/Analysis/PathSensitive/ValueState.h
Просмотреть файл

@ -1,4 +1,4 @@
//== ValueState*h - Path-Sens. "State" for tracking valuues -----*- C++ -*--==//
//== GRState*h - Path-Sens. "State" for tracking valuues -----*- C++ -*--==//
//
// The LLVM Compiler Infrastructure
//
@ -7,7 +7,7 @@
//
//===----------------------------------------------------------------------===//
//
// This file defines SymbolID, ExprBindKey, and ValueState*
// This file defines SymbolID, ExprBindKey, and GRState*
//
//===----------------------------------------------------------------------===//
@ -40,18 +40,18 @@
namespace clang {
class ValueStateManager;
class GRStateManager;
class GRTransferFuncs;
//===----------------------------------------------------------------------===//
// ValueState- An ImmutableMap type Stmt*/Decl*/Symbols to RVals.
// GRState- An ImmutableMap type Stmt*/Decl*/Symbols to RVals.
//===----------------------------------------------------------------------===//
/// ValueState - This class encapsulates the actual data values for
/// GRState - This class encapsulates the actual data values for
/// for a "state" in our symbolic value tracking. It is intended to be
/// used as a functional object; that is once it is created and made
/// "persistent" in a FoldingSet its values will never change.
class ValueState : public llvm::FoldingSetNode {
class GRState : public llvm::FoldingSetNode {
public:
// Typedefs.
typedef llvm::ImmutableSet<llvm::APSInt*> IntSetTy;
@ -59,12 +59,12 @@ public:
typedef llvm::ImmutableMap<SymbolID,IntSetTy> ConstNotEqTy;
typedef llvm::ImmutableMap<SymbolID,const llvm::APSInt*> ConstEqTy;
typedef ValueStateManager ManagerTy;
typedef GRStateManager ManagerTy;
private:
void operator=(const ValueState& R) const;
void operator=(const GRState& R) const;
friend class ValueStateManager;
friend class GRStateManager;
Environment Env;
Store St;
@ -78,8 +78,8 @@ public:
public:
/// This ctor is used when creating the first ValueState object.
ValueState(const Environment& env, Store st, GenericDataMap gdm,
/// This ctor is used when creating the first GRState object.
GRState(const Environment& env, Store st, GenericDataMap gdm,
ConstNotEqTy CNE, ConstEqTy CE)
: Env(env),
St(st),
@ -90,7 +90,7 @@ public:
/// Copy ctor - We must explicitly define this or else the "Next" ptr
/// in FoldingSetNode will also get copied.
ValueState(const ValueState& RHS)
GRState(const GRState& RHS)
: llvm::FoldingSetNode(),
Env(RHS.Env),
St(RHS.St),
@ -110,9 +110,9 @@ public:
/// getGDM - Return the generic data map associated with this state.
GenericDataMap getGDM() const { return GDM; }
/// Profile - Profile the contents of a ValueState object for use
/// Profile - Profile the contents of a GRState object for use
/// in a FoldingSet.
static void Profile(llvm::FoldingSetNodeID& ID, const ValueState* V) {
static void Profile(llvm::FoldingSetNodeID& ID, const GRState* V) {
V->Env.Profile(ID);
ID.AddPointer(V->St);
V->GDM.Profile(ID);
@ -186,23 +186,23 @@ public:
void printDOT(std::ostream& Out, CheckerStatePrinter*P = NULL) const;
};
template<> struct GRTrait<ValueState*> {
static inline void* toPtr(ValueState* St) { return (void*) St; }
static inline ValueState* toState(void* P) { return (ValueState*) P; }
static inline void Profile(llvm::FoldingSetNodeID& profile, ValueState* St) {
template<> struct GRTrait<GRState*> {
static inline void* toPtr(GRState* St) { return (void*) St; }
static inline GRState* toState(void* P) { return (GRState*) P; }
static inline void Profile(llvm::FoldingSetNodeID& profile, GRState* St) {
// At this point states have already been uniqued. Just
// add the pointer.
profile.AddPointer(St);
}
};
class ValueStateSet {
typedef llvm::SmallPtrSet<const ValueState*,5> ImplTy;
class GRStateSet {
typedef llvm::SmallPtrSet<const GRState*,5> ImplTy;
ImplTy Impl;
public:
ValueStateSet() {}
GRStateSet() {}
inline void Add(const ValueState* St) {
inline void Add(const GRState* St) {
Impl.insert(St);
}
@ -215,11 +215,11 @@ public:
inline iterator end() const { return Impl.end(); }
class AutoPopulate {
ValueStateSet& S;
GRStateSet& S;
unsigned StartSize;
const ValueState* St;
const GRState* St;
public:
AutoPopulate(ValueStateSet& s, const ValueState* st)
AutoPopulate(GRStateSet& s, const GRState* st)
: S(s), StartSize(S.size()), St(st) {}
~AutoPopulate() {
@ -229,20 +229,20 @@ public:
};
};
class ValueStateManager {
class GRStateManager {
friend class GRExprEngine;
private:
EnvironmentManager EnvMgr;
llvm::OwningPtr<StoreManager> StMgr;
ValueState::IntSetTy::Factory ISetFactory;
ValueState::GenericDataMap::Factory GDMFactory;
ValueState::ConstNotEqTy::Factory CNEFactory;
ValueState::ConstEqTy::Factory CEFactory;
GRState::IntSetTy::Factory ISetFactory;
GRState::GenericDataMap::Factory GDMFactory;
GRState::ConstNotEqTy::Factory CNEFactory;
GRState::ConstEqTy::Factory CEFactory;
/// StateSet - FoldingSet containing all the states created for analyzing
/// a particular function. This is used to unique states.
llvm::FoldingSet<ValueState> StateSet;
llvm::FoldingSet<GRState> StateSet;
/// ValueMgr - Object that manages the data for all created RVals.
BasicValueFactory BasicVals;
@ -275,12 +275,12 @@ private:
}
// FIXME: Remove when we do lazy initializaton of variable bindings.
const ValueState* BindVar(const ValueState* St, VarDecl* D, RVal V) {
const GRState* BindVar(const GRState* St, VarDecl* D, RVal V) {
return SetRVal(St, lval::DeclVal(D), V);
}
public:
ValueStateManager(ASTContext& Ctx, StoreManager* stmgr,
GRStateManager(ASTContext& Ctx, StoreManager* stmgr,
llvm::BumpPtrAllocator& alloc, CFG& c)
: EnvMgr(alloc),
StMgr(stmgr),
@ -293,7 +293,7 @@ public:
Alloc(alloc),
cfg(c) {}
const ValueState* getInitialState();
const GRState* getInitialState();
BasicValueFactory& getBasicVals() { return BasicVals; }
const BasicValueFactory& getBasicVals() const { return BasicVals; }
@ -301,27 +301,27 @@ public:
typedef StoreManager::DeadSymbolsTy DeadSymbolsTy;
const ValueState* RemoveDeadBindings(const ValueState* St, Stmt* Loc,
const GRState* RemoveDeadBindings(const GRState* St, Stmt* Loc,
const LiveVariables& Liveness,
DeadSymbolsTy& DeadSyms);
const ValueState* RemoveSubExprBindings(const ValueState* St) {
ValueState NewSt = *St;
const GRState* RemoveSubExprBindings(const GRState* St) {
GRState NewSt = *St;
NewSt.Env = EnvMgr.RemoveSubExprBindings(NewSt.Env);
return getPersistentState(NewSt);
}
// Methods that query & manipulate the Environment.
RVal GetRVal(const ValueState* St, Expr* Ex) {
RVal GetRVal(const GRState* St, Expr* Ex) {
return St->getEnvironment().GetRVal(Ex, BasicVals);
}
RVal GetBlkExprRVal(const ValueState* St, Expr* Ex) {
RVal GetBlkExprRVal(const GRState* St, Expr* Ex) {
return St->getEnvironment().GetBlkExprRVal(Ex, BasicVals);
}
const ValueState* SetRVal(const ValueState* St, Expr* Ex, RVal V,
const GRState* SetRVal(const GRState* St, Expr* Ex, RVal V,
bool isBlkExpr, bool Invalidate) {
const Environment& OldEnv = St->getEnvironment();
@ -330,12 +330,12 @@ public:
if (NewEnv == OldEnv)
return St;
ValueState NewSt = *St;
GRState NewSt = *St;
NewSt.Env = NewEnv;
return getPersistentState(NewSt);
}
const ValueState* SetRVal(const ValueState* St, Expr* Ex, RVal V) {
const GRState* SetRVal(const GRState* St, Expr* Ex, RVal V) {
bool isBlkExpr = false;
@ -350,48 +350,48 @@ public:
}
// Methods that manipulate the GDM.
const ValueState* addGDM(const ValueState* St, void* Key, void* Data) {
ValueState::GenericDataMap M1 = St->getGDM();
ValueState::GenericDataMap M2 = GDMFactory.Add(M2, Key, Data);
const GRState* addGDM(const GRState* St, void* Key, void* Data) {
GRState::GenericDataMap M1 = St->getGDM();
GRState::GenericDataMap M2 = GDMFactory.Add(M2, Key, Data);
if (M1 == M2)
return St;
ValueState NewSt = *St;
GRState NewSt = *St;
NewSt.GDM = M2;
return getPersistentState(NewSt);
}
// Methods that query & manipulate the Store.
RVal GetRVal(const ValueState* St, LVal LV, QualType T = QualType()) {
RVal GetRVal(const GRState* St, LVal LV, QualType T = QualType()) {
return StMgr->GetRVal(St->getStore(), LV, T);
}
void SetRVal(ValueState& St, LVal LV, RVal V) {
void SetRVal(GRState& St, LVal LV, RVal V) {
St.St = StMgr->SetRVal(St.St, LV, V);
}
const ValueState* SetRVal(const ValueState* St, LVal LV, RVal V);
const GRState* SetRVal(const GRState* St, LVal LV, RVal V);
void Unbind(ValueState& St, LVal LV) {
void Unbind(GRState& St, LVal LV) {
St.St = StMgr->Remove(St.St, LV);
}
const ValueState* Unbind(const ValueState* St, LVal LV);
const GRState* Unbind(const GRState* St, LVal LV);
const ValueState* getPersistentState(ValueState& Impl);
const GRState* getPersistentState(GRState& Impl);
const ValueState* AddEQ(const ValueState* St, SymbolID sym,
const GRState* AddEQ(const GRState* St, SymbolID sym,
const llvm::APSInt& V);
const ValueState* AddNE(const ValueState* St, SymbolID sym,
const GRState* AddNE(const GRState* St, SymbolID sym,
const llvm::APSInt& V);
bool isEqual(const ValueState* state, Expr* Ex, const llvm::APSInt& V);
bool isEqual(const ValueState* state, Expr* Ex, uint64_t);
bool isEqual(const GRState* state, Expr* Ex, const llvm::APSInt& V);
bool isEqual(const GRState* state, Expr* Ex, uint64_t);
// Assumption logic.
const ValueState* Assume(const ValueState* St, RVal Cond, bool Assumption,
const GRState* Assume(const GRState* St, RVal Cond, bool Assumption,
bool& isFeasible) {
if (Cond.isUnknown()) {
@ -405,39 +405,39 @@ public:
return Assume(St, cast<NonLVal>(Cond), Assumption, isFeasible);
}
const ValueState* Assume(const ValueState* St, LVal Cond, bool Assumption,
const GRState* Assume(const GRState* St, LVal Cond, bool Assumption,
bool& isFeasible);
const ValueState* Assume(const ValueState* St, NonLVal Cond, bool Assumption,
const GRState* Assume(const GRState* St, NonLVal Cond, bool Assumption,
bool& isFeasible);
private:
const ValueState* AssumeAux(const ValueState* St, LVal Cond, bool Assumption,
const GRState* AssumeAux(const GRState* St, LVal Cond, bool Assumption,
bool& isFeasible);
const ValueState* AssumeAux(const ValueState* St, NonLVal Cond,
const GRState* AssumeAux(const GRState* St, NonLVal Cond,
bool Assumption, bool& isFeasible);
const ValueState* AssumeSymInt(const ValueState* St, bool Assumption,
const GRState* AssumeSymInt(const GRState* St, bool Assumption,
const SymIntConstraint& C, bool& isFeasible);
const ValueState* AssumeSymNE(const ValueState* St, SymbolID sym,
const GRState* AssumeSymNE(const GRState* St, SymbolID sym,
const llvm::APSInt& V, bool& isFeasible);
const ValueState* AssumeSymEQ(const ValueState* St, SymbolID sym,
const GRState* AssumeSymEQ(const GRState* St, SymbolID sym,
const llvm::APSInt& V, bool& isFeasible);
const ValueState* AssumeSymLT(const ValueState* St, SymbolID sym,
const GRState* AssumeSymLT(const GRState* St, SymbolID sym,
const llvm::APSInt& V, bool& isFeasible);
const ValueState* AssumeSymLE(const ValueState* St, SymbolID sym,
const GRState* AssumeSymLE(const GRState* St, SymbolID sym,
const llvm::APSInt& V, bool& isFeasible);
const ValueState* AssumeSymGT(const ValueState* St, SymbolID sym,
const GRState* AssumeSymGT(const GRState* St, SymbolID sym,
const llvm::APSInt& V, bool& isFeasible);
const ValueState* AssumeSymGE(const ValueState* St, SymbolID sym,
const GRState* AssumeSymGE(const GRState* St, SymbolID sym,
const llvm::APSInt& V, bool& isFeasible);
};

40
lib/Analysis/BasicObjCFoundationChecks.cpp
Просмотреть файл

@ -18,7 +18,7 @@
#include "clang/Analysis/PathSensitive/ExplodedGraph.h"
#include "clang/Analysis/PathSensitive/GRSimpleAPICheck.h"
#include "clang/Analysis/PathSensitive/GRExprEngine.h"
#include "clang/Analysis/PathSensitive/ValueState.h"
#include "clang/Analysis/PathSensitive/GRState.h"
#include "clang/Analysis/PathSensitive/BugReporter.h"
#include "clang/Analysis/PathDiagnostic.h"
#include "clang/Analysis/LocalCheckers.h"
@ -73,7 +73,7 @@ public:
SourceRange R;
public:
Report(NilArg& Desc, ExplodedNode<ValueState>* N,
Report(NilArg& Desc, ExplodedNode<GRState>* N,
ObjCMessageExpr* ME, unsigned Arg)
: BugReport(Desc, N) {
@ -105,12 +105,12 @@ public:
class VISIBILITY_HIDDEN BasicObjCFoundationChecks : public GRSimpleAPICheck {
NilArg Desc;
ASTContext &Ctx;
ValueStateManager* VMgr;
GRStateManager* VMgr;
typedef std::vector<BugReport*> ErrorsTy;
ErrorsTy Errors;
RVal GetRVal(const ValueState* St, Expr* E) { return VMgr->GetRVal(St, E); }
RVal GetRVal(const GRState* St, Expr* E) { return VMgr->GetRVal(St, E); }
bool isNSString(ObjCInterfaceType* T, const char* suffix);
bool AuditNSString(NodeTy* N, ObjCMessageExpr* ME);
@ -121,7 +121,7 @@ class VISIBILITY_HIDDEN BasicObjCFoundationChecks : public GRSimpleAPICheck {
bool CheckNilArg(NodeTy* N, unsigned Arg);
public:
BasicObjCFoundationChecks(ASTContext& ctx, ValueStateManager* vmgr)
BasicObjCFoundationChecks(ASTContext& ctx, GRStateManager* vmgr)
: Ctx(ctx), VMgr(vmgr) {}
virtual ~BasicObjCFoundationChecks() {
@ -129,7 +129,7 @@ public:
delete *I;
}
virtual bool Audit(ExplodedNode<ValueState>* N, ValueStateManager&);
virtual bool Audit(ExplodedNode<GRState>* N, GRStateManager&);
virtual void EmitWarnings(BugReporter& BR);
@ -149,15 +149,15 @@ private:
GRSimpleAPICheck*
clang::CreateBasicObjCFoundationChecks(ASTContext& Ctx,
ValueStateManager* VMgr) {
GRStateManager* VMgr) {
return new BasicObjCFoundationChecks(Ctx, VMgr);
}
bool BasicObjCFoundationChecks::Audit(ExplodedNode<ValueState>* N,
ValueStateManager&) {
bool BasicObjCFoundationChecks::Audit(ExplodedNode<GRState>* N,
GRStateManager&) {
ObjCMessageExpr* ME =
cast<ObjCMessageExpr>(cast<PostStmt>(N->getLocation()).getStmt());
@ -322,7 +322,7 @@ class VISIBILITY_HIDDEN StrBugReport : public RangedBugReport {
std::string str;
const char* cstr;
public:
StrBugReport(BugType& D, ExplodedNode<ValueState>* N, std::string s)
StrBugReport(BugType& D, ExplodedNode<GRState>* N, std::string s)
: RangedBugReport(D, N), str(s) {
cstr = str.c_str();
}
@ -340,19 +340,19 @@ class VISIBILITY_HIDDEN AuditCFNumberCreate : public GRSimpleAPICheck {
// approach makes this class more stateless.
ASTContext& Ctx;
IdentifierInfo* II;
ValueStateManager* VMgr;
GRStateManager* VMgr;
RVal GetRVal(const ValueState* St, Expr* E) { return VMgr->GetRVal(St, E); }
RVal GetRVal(const ValueState* St, LVal LV) { return VMgr->GetRVal(St, LV); }
RVal GetRVal(const GRState* St, Expr* E) { return VMgr->GetRVal(St, E); }
RVal GetRVal(const GRState* St, LVal LV) { return VMgr->GetRVal(St, LV); }
public:
AuditCFNumberCreate(ASTContext& ctx, ValueStateManager* vmgr)
AuditCFNumberCreate(ASTContext& ctx, GRStateManager* vmgr)
: Ctx(ctx), II(&Ctx.Idents.get("CFNumberCreate")), VMgr(vmgr) {}
virtual ~AuditCFNumberCreate() {}
virtual bool Audit(ExplodedNode<ValueState>* N, ValueStateManager&);
virtual bool Audit(ExplodedNode<GRState>* N, GRStateManager&);
virtual void EmitWarnings(BugReporter& BR) {
Desc.EmitWarnings(BR);
@ -360,7 +360,7 @@ public:
private:
void AddError(VarDecl* V, Expr* Ex, ExplodedNode<ValueState> *N,
void AddError(VarDecl* V, Expr* Ex, ExplodedNode<GRState> *N,
uint64_t SourceSize, uint64_t TargetSize, uint64_t NumberKind);
};
} // end anonymous namespace
@ -458,7 +458,7 @@ static const char* GetCFNumberTypeStr(uint64_t i) {
}
#endif
bool AuditCFNumberCreate::Audit(ExplodedNode<ValueState>* N,ValueStateManager&){
bool AuditCFNumberCreate::Audit(ExplodedNode<GRState>* N,GRStateManager&){
CallExpr* CE = cast<CallExpr>(cast<PostStmt>(N->getLocation()).getStmt());
Expr* Callee = CE->getCallee();
RVal CallV = GetRVal(N->getState(), Callee);
@ -519,7 +519,7 @@ bool AuditCFNumberCreate::Audit(ExplodedNode<ValueState>* N,ValueStateManager&){
}
void AuditCFNumberCreate::AddError(VarDecl* V, Expr* Ex,
ExplodedNode<ValueState> *N,
ExplodedNode<GRState> *N,
uint64_t SourceSize, uint64_t TargetSize,
uint64_t NumberKind) {
@ -545,7 +545,7 @@ void AuditCFNumberCreate::AddError(VarDecl* V, Expr* Ex,
GRSimpleAPICheck*
clang::CreateAuditCFNumberCreate(ASTContext& Ctx,
ValueStateManager* VMgr) {
GRStateManager* VMgr) {
return new AuditCFNumberCreate(Ctx, VMgr);
}
@ -555,7 +555,7 @@ clang::CreateAuditCFNumberCreate(ASTContext& Ctx,
void clang::RegisterAppleChecks(GRExprEngine& Eng) {
ASTContext& Ctx = Eng.getContext();
ValueStateManager* VMgr = &Eng.getStateManager();
GRStateManager* VMgr = &Eng.getStateManager();
Eng.AddCheck(CreateBasicObjCFoundationChecks(Ctx, VMgr),
Stmt::ObjCMessageExprClass);

8
lib/Analysis/BasicObjCFoundationChecks.h
Просмотреть файл

@ -15,7 +15,7 @@
#include "clang/Analysis/PathSensitive/ExplodedGraph.h"
#include "clang/Analysis/PathSensitive/GRSimpleAPICheck.h"
#include "clang/Analysis/PathSensitive/ValueState.h"
#include "clang/Analysis/PathSensitive/GRState.h"
#include "clang/Analysis/PathDiagnostic.h"
#include "clang/AST/Expr.h"
#include "clang/AST/ASTContext.h"
@ -28,13 +28,13 @@ namespace clang {
class GRSimpleAPICheck;
class ASTContext;
class ValueStateManager;
class GRStateManager;
GRSimpleAPICheck* CreateBasicObjCFoundationChecks(ASTContext& Ctx,
ValueStateManager* VMgr);
GRStateManager* VMgr);
GRSimpleAPICheck* CreateAuditCFNumberCreate(ASTContext& Ctx,
ValueStateManager* VMgr);
GRStateManager* VMgr);
} // end clang namespace

80
lib/Analysis/BugReporter.cpp
Просмотреть файл

@ -33,11 +33,11 @@ BugType::~BugType() {}
BugReport::~BugReport() {}
RangedBugReport::~RangedBugReport() {}
ExplodedGraph<ValueState>& GRBugReporter::getGraph() {
ExplodedGraph<GRState>& GRBugReporter::getGraph() {
return Eng.getGraph();
}
ValueStateManager& GRBugReporter::getStateManager() {
GRStateManager& GRBugReporter::getStateManager() {
return Eng.getStateManager();
}
@ -63,12 +63,12 @@ static inline Stmt* GetStmt(const CFGBlock* B) {
return (*B)[0];
}
static inline ExplodedNode<ValueState>*
GetNextNode(ExplodedNode<ValueState>* N) {
static inline ExplodedNode<GRState>*
GetNextNode(ExplodedNode<GRState>* N) {
return N->pred_empty() ? NULL : *(N->pred_begin());
}
static Stmt* GetLastStmt(ExplodedNode<ValueState>* N) {
static Stmt* GetLastStmt(ExplodedNode<GRState>* N) {
assert (isa<BlockEntrance>(N->getLocation()));
for (N = GetNextNode(N); N; N = GetNextNode(N)) {
@ -99,7 +99,7 @@ static void ExecutionContinues(std::ostringstream& os, SourceManager& SMgr,
static inline void ExecutionContinues(std::ostringstream& os,
SourceManager& SMgr,
ExplodedNode<ValueState>* N) {
ExplodedNode<GRState>* N) {
ExecutionContinues(os, SMgr, GetStmt(N->getLocation()));
}
@ -128,7 +128,7 @@ Stmt* BugReport::getStmt(BugReporter& BR) const {
PathDiagnosticPiece*
BugReport::getEndPath(BugReporter& BR,
ExplodedNode<ValueState>* EndPathNode) {
ExplodedNode<GRState>* EndPathNode) {
Stmt* S = getStmt(BR);
@ -172,24 +172,24 @@ FullSourceLoc BugReport::getLocation(SourceManager& Mgr) {
return FullSourceLoc(S->getLocStart(), Mgr);
}
PathDiagnosticPiece* BugReport::VisitNode(ExplodedNode<ValueState>* N,
ExplodedNode<ValueState>* PrevN,
ExplodedGraph<ValueState>& G,
PathDiagnosticPiece* BugReport::VisitNode(ExplodedNode<GRState>* N,
ExplodedNode<GRState>* PrevN,
ExplodedGraph<GRState>& G,
BugReporter& BR) {
return NULL;
}
static std::pair<ExplodedGraph<ValueState>*, ExplodedNode<ValueState>*>
MakeReportGraph(ExplodedGraph<ValueState>* G, ExplodedNode<ValueState>* N) {
static std::pair<ExplodedGraph<GRState>*, ExplodedNode<GRState>*>
MakeReportGraph(ExplodedGraph<GRState>* G, ExplodedNode<GRState>* N) {
llvm::OwningPtr<ExplodedGraph<ValueState> > GTrim(G->Trim(&N, &N+1));
llvm::OwningPtr<ExplodedGraph<GRState> > GTrim(G->Trim(&N, &N+1));
// Find the error node in the trimmed graph.
ExplodedNode<ValueState>* NOld = N;
ExplodedNode<GRState>* NOld = N;
N = 0;
for (ExplodedGraph<ValueState>::node_iterator
for (ExplodedGraph<GRState>::node_iterator
I = GTrim->nodes_begin(), E = GTrim->nodes_end(); I != E; ++I) {
if (I->getState() == NOld->getState() &&
@ -203,20 +203,20 @@ MakeReportGraph(ExplodedGraph<ValueState>* G, ExplodedNode<ValueState>* N) {
// Create a new graph with a single path.
G = new ExplodedGraph<ValueState>(GTrim->getCFG(), GTrim->getCodeDecl(),
G = new ExplodedGraph<GRState>(GTrim->getCFG(), GTrim->getCodeDecl(),
GTrim->getContext());
// Sometimes TrimGraph can contain a cycle. Perform a reverse DFS
// to the root node, and then construct a new graph that contains only
// a single path.
llvm::DenseMap<void*,unsigned> Visited;
llvm::SmallVector<ExplodedNode<ValueState>*, 10> WS;
llvm::SmallVector<ExplodedNode<GRState>*, 10> WS;
WS.push_back(N);
unsigned cnt = 0;
ExplodedNode<ValueState>* Root = 0;
ExplodedNode<GRState>* Root = 0;
while (!WS.empty()) {
ExplodedNode<ValueState>* Node = WS.back();
ExplodedNode<GRState>* Node = WS.back();
WS.pop_back();
if (Visited.find(Node) != Visited.end())
@ -229,7 +229,7 @@ MakeReportGraph(ExplodedGraph<ValueState>* G, ExplodedNode<ValueState>* N) {
break;
}
for (ExplodedNode<ValueState>::pred_iterator I=Node->pred_begin(),
for (ExplodedNode<GRState>::pred_iterator I=Node->pred_begin(),
E=Node->pred_end(); I!=E; ++I)
WS.push_back(*I);
}
@ -238,7 +238,7 @@ MakeReportGraph(ExplodedGraph<ValueState>* G, ExplodedNode<ValueState>* N) {
// Now walk from the root down the DFS path, always taking the successor
// with the lowest number.
ExplodedNode<ValueState> *Last = 0, *First = 0;
ExplodedNode<GRState> *Last = 0, *First = 0;
for ( N = Root ;;) {
@ -248,7 +248,7 @@ MakeReportGraph(ExplodedGraph<ValueState>* G, ExplodedNode<ValueState>* N) {
// Create the equivalent node in the new graph with the same state
// and location.
ExplodedNode<ValueState>* NewN =
ExplodedNode<GRState>* NewN =
G->getNode(N->getLocation(), N->getState());
// Link up the new node with the previous node.
@ -265,8 +265,8 @@ MakeReportGraph(ExplodedGraph<ValueState>* G, ExplodedNode<ValueState>* N) {
// Find the next successor node. We choose the node that is marked
// with the lowest DFS number.
ExplodedNode<ValueState>::succ_iterator SI = N->succ_begin();
ExplodedNode<ValueState>::succ_iterator SE = N->succ_end();
ExplodedNode<GRState>::succ_iterator SI = N->succ_begin();
ExplodedNode<GRState>::succ_iterator SE = N->succ_end();
N = 0;
for (unsigned MinVal = 0; SI != SE; ++SI) {
@ -289,8 +289,8 @@ MakeReportGraph(ExplodedGraph<ValueState>* G, ExplodedNode<ValueState>* N) {
return std::make_pair(G, First);
}
static VarDecl* GetMostRecentVarDeclBinding(ExplodedNode<ValueState>* N,
ValueStateManager& VMgr,
static VarDecl* GetMostRecentVarDeclBinding(ExplodedNode<GRState>* N,
GRStateManager& VMgr,
RVal X) {
for ( ; N ; N = N->pred_empty() ? 0 : *N->pred_begin()) {
@ -322,12 +322,12 @@ static VarDecl* GetMostRecentVarDeclBinding(ExplodedNode<ValueState>* N,
}
static void HandleNotableSymbol(ExplodedNode<ValueState>* N, Stmt* S,
static void HandleNotableSymbol(ExplodedNode<GRState>* N, Stmt* S,
SymbolID Sym, BugReporter& BR,
PathDiagnostic& PD) {
ExplodedNode<ValueState>* Pred = N->pred_empty() ? 0 : *N->pred_begin();
const ValueState* PrevSt = Pred ? Pred->getState() : 0;
ExplodedNode<GRState>* Pred = N->pred_empty() ? 0 : *N->pred_begin();
const GRState* PrevSt = Pred ? Pred->getState() : 0;
if (!PrevSt)
return;
@ -335,8 +335,8 @@ static void HandleNotableSymbol(ExplodedNode<ValueState>* N, Stmt* S,
// Look at the variable bindings of the current state that map to the
// specified symbol. Are any of them not in the previous state.
const ValueState* St = N->getState();
ValueStateManager& VMgr = cast<GRBugReporter>(BR).getStateManager();
const GRState* St = N->getState();
GRStateManager& VMgr = cast<GRBugReporter>(BR).getStateManager();
// FIXME: Later generalize for a broader memory model.
@ -344,7 +344,7 @@ static void HandleNotableSymbol(ExplodedNode<ValueState>* N, Stmt* S,
// doesn't matter, but keep an eye out for performance issues. It's
// also a bunch of copy-paste. Bad. Cleanup later.
for (ValueState::vb_iterator I=St->vb_begin(), E=St->vb_end(); I!=E; ++I){
for (GRState::vb_iterator I=St->vb_begin(), E=St->vb_end(); I!=E; ++I){
RVal V = I.getData();
SymbolID ScanSym;
@ -412,17 +412,17 @@ static void HandleNotableSymbol(ExplodedNode<ValueState>* N, Stmt* S,
void GRBugReporter::GeneratePathDiagnostic(PathDiagnostic& PD,
BugReport& R) {
ExplodedNode<ValueState>* N = R.getEndNode();
ExplodedNode<GRState>* N = R.getEndNode();
if (!N) return;
// Construct a new graph that contains only a single path from the error
// node to a root.
const std::pair<ExplodedGraph<ValueState>*,ExplodedNode<ValueState>*>
const std::pair<ExplodedGraph<GRState>*,ExplodedNode<GRState>*>
GPair = MakeReportGraph(&getGraph(), N);
llvm::OwningPtr<ExplodedGraph<ValueState> > ReportGraph(GPair.first);
llvm::OwningPtr<ExplodedGraph<GRState> > ReportGraph(GPair.first);
assert(GPair.second->getLocation() == N->getLocation());
N = GPair.second;
@ -433,7 +433,7 @@ void GRBugReporter::GeneratePathDiagnostic(PathDiagnostic& PD,
else
return;
ExplodedNode<ValueState>* NextNode = N->pred_empty()
ExplodedNode<GRState>* NextNode = N->pred_empty()
? NULL : *(N->pred_begin());
ASTContext& Ctx = getContext();
@ -441,7 +441,7 @@ void GRBugReporter::GeneratePathDiagnostic(PathDiagnostic& PD,
while (NextNode) {
ExplodedNode<ValueState>* LastNode = N;
ExplodedNode<GRState>* LastNode = N;
N = NextNode;
NextNode = GetNextNode(N);
@ -633,7 +633,7 @@ void GRBugReporter::GeneratePathDiagnostic(PathDiagnostic& PD,
if (const PostStmt* PS = dyn_cast<PostStmt>(&P)) {
const ValueState* St = N->getState();
const GRState* St = N->getState();
// Scan the lval bindings, and see if a "notable" symbol has a new
// lval binding.
@ -643,7 +643,7 @@ void GRBugReporter::GeneratePathDiagnostic(PathDiagnostic& PD,
llvm::SmallSet<SymbolID, 10> AlreadyProcessed;
for (ValueState::vb_iterator I=St->vb_begin(), E=St->vb_end(); I!=E; ++I){
for (GRState::vb_iterator I=St->vb_begin(), E=St->vb_end(); I!=E; ++I){
RVal V = I.getData();
SymbolID ScanSym;
@ -674,7 +674,7 @@ void GRBugReporter::GeneratePathDiagnostic(PathDiagnostic& PD,
bool BugTypeCacheLocation::isCached(BugReport& R) {
ExplodedNode<ValueState>* N = R.getEndNode();
ExplodedNode<GRState>* N = R.getEndNode();
if (!N)
return false;

218
lib/Analysis/CFRefCount.cpp
Просмотреть файл

@ -15,7 +15,7 @@
#include "GRSimpleVals.h"
#include "clang/Basic/LangOptions.h"
#include "clang/Basic/SourceManager.h"
#include "clang/Analysis/PathSensitive/ValueState.h"
#include "clang/Analysis/PathSensitive/GRState.h"
#include "clang/Analysis/PathDiagnostic.h"
#include "clang/Analysis/LocalCheckers.h"
#include "clang/Analysis/PathDiagnostic.h"
@ -1211,7 +1211,7 @@ public:
typedef llvm::DenseMap<GRExprEngine::NodeTy*, std::vector<SymbolID>*>
LeaksTy;
class BindingsPrinter : public ValueState::CheckerStatePrinter {
class BindingsPrinter : public GRState::CheckerStatePrinter {
public:
virtual void PrintCheckerState(std::ostream& Out, void* State,
const char* nl, const char* sep);
@ -1228,13 +1228,13 @@ private:
public:
static RefBindings GetRefBindings(const ValueState& StImpl) {
static RefBindings GetRefBindings(const GRState& StImpl) {
return RefBindings((const RefBindings::TreeTy*) StImpl.CheckerState);
}
private:
static void SetRefBindings(ValueState& StImpl, RefBindings B) {
static void SetRefBindings(GRState& StImpl, RefBindings B) {
StImpl.CheckerState = B.getRoot();
}
@ -1245,18 +1245,18 @@ private:
RefBindings Update(RefBindings B, SymbolID sym, RefVal V, ArgEffect E,
RefVal::Kind& hasErr);
void ProcessNonLeakError(ExplodedNodeSet<ValueState>& Dst,
GRStmtNodeBuilder<ValueState>& Builder,
void ProcessNonLeakError(ExplodedNodeSet<GRState>& Dst,
GRStmtNodeBuilder<GRState>& Builder,
Expr* NodeExpr, Expr* ErrorExpr,
ExplodedNode<ValueState>* Pred,
const ValueState* St,
ExplodedNode<GRState>* Pred,
const GRState* St,
RefVal::Kind hasErr, SymbolID Sym);
const ValueState* HandleSymbolDeath(ValueStateManager& VMgr,
const ValueState* St,
const GRState* HandleSymbolDeath(GRStateManager& VMgr,
const GRState* St,
SymbolID sid, RefVal V, bool& hasLeak);
const ValueState* NukeBinding(ValueStateManager& VMgr, const ValueState* St,
const GRState* NukeBinding(GRStateManager& VMgr, const GRState* St,
SymbolID sid);
public:
@ -1272,7 +1272,7 @@ public:
virtual void RegisterChecks(GRExprEngine& Eng);
virtual ValueState::CheckerStatePrinter* getCheckerStatePrinter() {
virtual GRState::CheckerStatePrinter* getCheckerStatePrinter() {
return &Printer;
}
@ -1281,65 +1281,65 @@ public:
// Calls.
void EvalSummary(ExplodedNodeSet<ValueState>& Dst,
void EvalSummary(ExplodedNodeSet<GRState>& Dst,
GRExprEngine& Eng,
GRStmtNodeBuilder<ValueState>& Builder,
GRStmtNodeBuilder<GRState>& Builder,
Expr* Ex,
Expr* Receiver,
RetainSummary* Summ,
ExprIterator arg_beg, ExprIterator arg_end,
ExplodedNode<ValueState>* Pred);
ExplodedNode<GRState>* Pred);
virtual void EvalCall(ExplodedNodeSet<ValueState>& Dst,
virtual void EvalCall(ExplodedNodeSet<GRState>& Dst,
GRExprEngine& Eng,
GRStmtNodeBuilder<ValueState>& Builder,
GRStmtNodeBuilder<GRState>& Builder,
CallExpr* CE, RVal L,
ExplodedNode<ValueState>* Pred);
ExplodedNode<GRState>* Pred);
virtual void EvalObjCMessageExpr(ExplodedNodeSet<ValueState>& Dst,
virtual void EvalObjCMessageExpr(ExplodedNodeSet<GRState>& Dst,
GRExprEngine& Engine,
GRStmtNodeBuilder<ValueState>& Builder,
GRStmtNodeBuilder<GRState>& Builder,
ObjCMessageExpr* ME,
ExplodedNode<ValueState>* Pred);
ExplodedNode<GRState>* Pred);
bool EvalObjCMessageExprAux(ExplodedNodeSet<ValueState>& Dst,
bool EvalObjCMessageExprAux(ExplodedNodeSet<GRState>& Dst,
GRExprEngine& Engine,
GRStmtNodeBuilder<ValueState>& Builder,
GRStmtNodeBuilder<GRState>& Builder,
ObjCMessageExpr* ME,
ExplodedNode<ValueState>* Pred);
ExplodedNode<GRState>* Pred);
// Stores.
virtual void EvalStore(ExplodedNodeSet<ValueState>& Dst,
virtual void EvalStore(ExplodedNodeSet<GRState>& Dst,
GRExprEngine& Engine,
GRStmtNodeBuilder<ValueState>& Builder,
Expr* E, ExplodedNode<ValueState>* Pred,
const ValueState* St, RVal TargetLV, RVal Val);
GRStmtNodeBuilder<GRState>& Builder,
Expr* E, ExplodedNode<GRState>* Pred,
const GRState* St, RVal TargetLV, RVal Val);
// End-of-path.
virtual void EvalEndPath(GRExprEngine& Engine,
GREndPathNodeBuilder<ValueState>& Builder);
GREndPathNodeBuilder<GRState>& Builder);
virtual void EvalDeadSymbols(ExplodedNodeSet<ValueState>& Dst,
virtual void EvalDeadSymbols(ExplodedNodeSet<GRState>& Dst,
GRExprEngine& Engine,
GRStmtNodeBuilder<ValueState>& Builder,
ExplodedNode<ValueState>* Pred,
GRStmtNodeBuilder<GRState>& Builder,
ExplodedNode<GRState>* Pred,
Stmt* S,
const ValueState* St,
const ValueStateManager::DeadSymbolsTy& Dead);
const GRState* St,
const GRStateManager::DeadSymbolsTy& Dead);
// Return statements.
virtual void EvalReturn(ExplodedNodeSet<ValueState>& Dst,
virtual void EvalReturn(ExplodedNodeSet<GRState>& Dst,
GRExprEngine& Engine,
GRStmtNodeBuilder<ValueState>& Builder,
GRStmtNodeBuilder<GRState>& Builder,
ReturnStmt* S,
ExplodedNode<ValueState>* Pred);
ExplodedNode<GRState>* Pred);
// Assumptions.
virtual const ValueState* EvalAssume(ValueStateManager& VMgr,
const ValueState* St, RVal Cond,
virtual const GRState* EvalAssume(GRStateManager& VMgr,
const GRState* St, RVal Cond,
bool Assumption, bool& isFeasible);
// Error iterators.
@ -1394,11 +1394,11 @@ static inline bool IsEndPath(RetainSummary* Summ) {
return Summ ? Summ->isEndPath() : false;
}
void CFRefCount::ProcessNonLeakError(ExplodedNodeSet<ValueState>& Dst,
GRStmtNodeBuilder<ValueState>& Builder,
void CFRefCount::ProcessNonLeakError(ExplodedNodeSet<GRState>& Dst,
GRStmtNodeBuilder<GRState>& Builder,
Expr* NodeExpr, Expr* ErrorExpr,
ExplodedNode<ValueState>* Pred,
const ValueState* St,
ExplodedNode<GRState>* Pred,
const GRState* St,
RefVal::Kind hasErr, SymbolID Sym) {
Builder.BuildSinks = true;
GRExprEngine::NodeTy* N = Builder.MakeNode(Dst, NodeExpr, Pred, St);
@ -1450,21 +1450,21 @@ static QualType GetReturnType(Expr* RetE, ASTContext& Ctx) {
}
void CFRefCount::EvalSummary(ExplodedNodeSet<ValueState>& Dst,
void CFRefCount::EvalSummary(ExplodedNodeSet<GRState>& Dst,
GRExprEngine& Eng,
GRStmtNodeBuilder<ValueState>& Builder,
GRStmtNodeBuilder<GRState>& Builder,
Expr* Ex,
Expr* Receiver,
RetainSummary* Summ,
ExprIterator arg_beg, ExprIterator arg_end,
ExplodedNode<ValueState>* Pred) {
ExplodedNode<GRState>* Pred) {
// Get the state.
ValueStateManager& StateMgr = Eng.getStateManager();
const ValueState* St = Builder.GetState(Pred);
GRStateManager& StateMgr = Eng.getStateManager();
const GRState* St = Builder.GetState(Pred);
// Evaluate the effect of the arguments.
ValueState StVals = *St;
GRState StVals = *St;
RefVal::Kind hasErr = (RefVal::Kind) 0;
unsigned idx = 0;
Expr* ErrorExpr = NULL;
@ -1615,7 +1615,7 @@ void CFRefCount::EvalSummary(ExplodedNodeSet<ValueState>& Dst,
SymbolID Sym = Eng.getSymbolManager().getConjuredSymbol(Ex, Count);
QualType RetT = GetReturnType(Ex, Eng.getContext());
ValueState StImpl = *St;
GRState StImpl = *St;
RefBindings B = GetRefBindings(StImpl);
SetRefBindings(StImpl, RefBFactory.Add(B, Sym, RefVal::makeOwned(RetT)));
@ -1635,7 +1635,7 @@ void CFRefCount::EvalSummary(ExplodedNodeSet<ValueState>& Dst,
SymbolID Sym = Eng.getSymbolManager().getConjuredSymbol(Ex, Count);
QualType RetT = GetReturnType(Ex, Eng.getContext());
ValueState StImpl = *St;
GRState StImpl = *St;
RefBindings B = GetRefBindings(StImpl);
SetRefBindings(StImpl, RefBFactory.Add(B, Sym,
RefVal::makeNotOwned(RetT)));
@ -1656,11 +1656,11 @@ void CFRefCount::EvalSummary(ExplodedNodeSet<ValueState>& Dst,
}
void CFRefCount::EvalCall(ExplodedNodeSet<ValueState>& Dst,
void CFRefCount::EvalCall(ExplodedNodeSet<GRState>& Dst,
GRExprEngine& Eng,
GRStmtNodeBuilder<ValueState>& Builder,
GRStmtNodeBuilder<GRState>& Builder,
CallExpr* CE, RVal L,
ExplodedNode<ValueState>* Pred) {
ExplodedNode<GRState>* Pred) {
RetainSummary* Summ = !isa<lval::FuncVal>(L) ? 0
: Summaries.getSummary(cast<lval::FuncVal>(L).getDecl());
@ -1669,11 +1669,11 @@ void CFRefCount::EvalCall(ExplodedNodeSet<ValueState>& Dst,
CE->arg_begin(), CE->arg_end(), Pred);
}
void CFRefCount::EvalObjCMessageExpr(ExplodedNodeSet<ValueState>& Dst,
void CFRefCount::EvalObjCMessageExpr(ExplodedNodeSet<GRState>& Dst,
GRExprEngine& Eng,
GRStmtNodeBuilder<ValueState>& Builder,
GRStmtNodeBuilder<GRState>& Builder,
ObjCMessageExpr* ME,
ExplodedNode<ValueState>* Pred) {
ExplodedNode<GRState>* Pred) {
RetainSummary* Summ;
if (Expr* Receiver = ME->getReceiver()) {
@ -1683,7 +1683,7 @@ void CFRefCount::EvalObjCMessageExpr(ExplodedNodeSet<ValueState>& Dst,
// FIXME: Wouldn't it be great if this code could be reduced? It's just
// a chain of lookups.
const ValueState* St = Builder.GetState(Pred);
const GRState* St = Builder.GetState(Pred);
RVal V = Eng.getStateManager().GetRVal(St, Receiver );
if (isa<lval::SymbolVal>(V)) {
@ -1713,11 +1713,11 @@ void CFRefCount::EvalObjCMessageExpr(ExplodedNodeSet<ValueState>& Dst,
// Stores.
void CFRefCount::EvalStore(ExplodedNodeSet<ValueState>& Dst,
void CFRefCount::EvalStore(ExplodedNodeSet<GRState>& Dst,
GRExprEngine& Eng,
GRStmtNodeBuilder<ValueState>& Builder,
Expr* E, ExplodedNode<ValueState>* Pred,
const ValueState* St, RVal TargetLV, RVal Val) {
GRStmtNodeBuilder<GRState>& Builder,
Expr* E, ExplodedNode<GRState>* Pred,
const GRState* St, RVal TargetLV, RVal Val) {
// Check if we have a binding for "Val" and if we are storing it to something
// we don't understand or otherwise the value "escapes" the function.
@ -1750,10 +1750,10 @@ void CFRefCount::EvalStore(ExplodedNodeSet<ValueState>& Dst,
}
const ValueState* CFRefCount::NukeBinding(ValueStateManager& VMgr,
const ValueState* St,
const GRState* CFRefCount::NukeBinding(GRStateManager& VMgr,
const GRState* St,
SymbolID sid) {
ValueState StImpl = *St;
GRState StImpl = *St;
RefBindings B = GetRefBindings(StImpl);
StImpl.CheckerState = RefBFactory.Remove(B, sid).getRoot();
return VMgr.getPersistentState(StImpl);
@ -1761,8 +1761,8 @@ const ValueState* CFRefCount::NukeBinding(ValueStateManager& VMgr,
// End-of-path.
const ValueState* CFRefCount::HandleSymbolDeath(ValueStateManager& VMgr,
const ValueState* St, SymbolID sid,
const GRState* CFRefCount::HandleSymbolDeath(GRStateManager& VMgr,
const GRState* St, SymbolID sid,
RefVal V, bool& hasLeak) {
hasLeak = V.isOwned() ||
@ -1772,16 +1772,16 @@ const ValueState* CFRefCount::HandleSymbolDeath(ValueStateManager& VMgr,
return NukeBinding(VMgr, St, sid);
RefBindings B = GetRefBindings(*St);
ValueState StImpl = *St;
GRState StImpl = *St;
StImpl.CheckerState = RefBFactory.Add(B, sid, V^RefVal::ErrorLeak).getRoot();
return VMgr.getPersistentState(StImpl);
}
void CFRefCount::EvalEndPath(GRExprEngine& Eng,
GREndPathNodeBuilder<ValueState>& Builder) {
GREndPathNodeBuilder<GRState>& Builder) {
const ValueState* St = Builder.getState();
const GRState* St = Builder.getState();
RefBindings B = GetRefBindings(*St);
llvm::SmallVector<SymbolID, 10> Leaked;
@ -1798,7 +1798,7 @@ void CFRefCount::EvalEndPath(GRExprEngine& Eng,
if (Leaked.empty())
return;
ExplodedNode<ValueState>* N = Builder.MakeNode(St);
ExplodedNode<GRState>* N = Builder.MakeNode(St);
if (!N)
return;
@ -1814,20 +1814,20 @@ void CFRefCount::EvalEndPath(GRExprEngine& Eng,
// Dead symbols.
void CFRefCount::EvalDeadSymbols(ExplodedNodeSet<ValueState>& Dst,
void CFRefCount::EvalDeadSymbols(ExplodedNodeSet<GRState>& Dst,
GRExprEngine& Eng,
GRStmtNodeBuilder<ValueState>& Builder,
ExplodedNode<ValueState>* Pred,
GRStmtNodeBuilder<GRState>& Builder,
ExplodedNode<GRState>* Pred,
Stmt* S,
const ValueState* St,
const ValueStateManager::DeadSymbolsTy& Dead) {
const GRState* St,
const GRStateManager::DeadSymbolsTy& Dead) {
// FIXME: a lot of copy-and-paste from EvalEndPath. Refactor.
RefBindings B = GetRefBindings(*St);
llvm::SmallVector<SymbolID, 10> Leaked;
for (ValueStateManager::DeadSymbolsTy::const_iterator
for (GRStateManager::DeadSymbolsTy::const_iterator
I=Dead.begin(), E=Dead.end(); I!=E; ++I) {
const RefVal* T = B.lookup(*I);
@ -1846,7 +1846,7 @@ void CFRefCount::EvalDeadSymbols(ExplodedNodeSet<ValueState>& Dst,
if (Leaked.empty())
return;
ExplodedNode<ValueState>* N = Builder.MakeNode(Dst, S, Pred, St);
ExplodedNode<GRState>* N = Builder.MakeNode(Dst, S, Pred, St);
if (!N)
return;
@ -1862,17 +1862,17 @@ void CFRefCount::EvalDeadSymbols(ExplodedNodeSet<ValueState>& Dst,
// Return statements.
void CFRefCount::EvalReturn(ExplodedNodeSet<ValueState>& Dst,
void CFRefCount::EvalReturn(ExplodedNodeSet<GRState>& Dst,
GRExprEngine& Eng,
GRStmtNodeBuilder<ValueState>& Builder,
GRStmtNodeBuilder<GRState>& Builder,
ReturnStmt* S,
ExplodedNode<ValueState>* Pred) {
ExplodedNode<GRState>* Pred) {
Expr* RetE = S->getRetValue();
if (!RetE) return;
ValueStateManager& StateMgr = Eng.getStateManager();
const ValueState* St = Builder.GetState(Pred);
GRStateManager& StateMgr = Eng.getStateManager();
const GRState* St = Builder.GetState(Pred);
RVal V = StateMgr.GetRVal(St, RetE);
if (!isa<lval::SymbolVal>(V))
@ -1912,15 +1912,15 @@ void CFRefCount::EvalReturn(ExplodedNodeSet<ValueState>& Dst,
// Update the binding.
ValueState StImpl = *St;
GRState StImpl = *St;
StImpl.CheckerState = RefBFactory.Add(B, Sym, X).getRoot();
Builder.MakeNode(Dst, S, Pred, StateMgr.getPersistentState(StImpl));
}
// Assumptions.
const ValueState* CFRefCount::EvalAssume(ValueStateManager& VMgr,
const ValueState* St,
const GRState* CFRefCount::EvalAssume(GRStateManager& VMgr,
const GRState* St,
RVal Cond, bool Assumption,
bool& isFeasible) {
@ -1949,7 +1949,7 @@ const ValueState* CFRefCount::EvalAssume(ValueStateManager& VMgr,
if (!changed)
return St;
ValueState StImpl = *St;
GRState StImpl = *St;
StImpl.CheckerState = B.getRoot();
return VMgr.getPersistentState(StImpl);
}
@ -2109,7 +2109,7 @@ namespace {
}
virtual void EmitWarnings(BugReporter& BR);
virtual void GetErrorNodes(std::vector<ExplodedNode<ValueState>*>& Nodes);
virtual void GetErrorNodes(std::vector<ExplodedNode<GRState>*>& Nodes);
virtual bool isLeak() const { return true; }
virtual bool isCached(BugReport& R);
};
@ -2121,7 +2121,7 @@ namespace {
class VISIBILITY_HIDDEN CFRefReport : public RangedBugReport {
SymbolID Sym;
public:
CFRefReport(CFRefBug& D, ExplodedNode<ValueState> *n, SymbolID sym)
CFRefReport(CFRefBug& D, ExplodedNode<GRState> *n, SymbolID sym)
: RangedBugReport(D, n), Sym(sym) {}
virtual ~CFRefReport() {}
@ -2145,13 +2145,13 @@ namespace {
SymbolID getSymbol() const { return Sym; }
virtual PathDiagnosticPiece* getEndPath(BugReporter& BR,
ExplodedNode<ValueState>* N);
ExplodedNode<GRState>* N);
virtual std::pair<const char**,const char**> getExtraDescriptiveText();
virtual PathDiagnosticPiece* VisitNode(ExplodedNode<ValueState>* N,
ExplodedNode<ValueState>* PrevN,
ExplodedGraph<ValueState>& G,
virtual PathDiagnosticPiece* VisitNode(ExplodedNode<GRState>* N,
ExplodedNode<GRState>* PrevN,
ExplodedGraph<GRState>& G,
BugReporter& BR);
};
@ -2201,15 +2201,15 @@ std::pair<const char**,const char**> CFRefReport::getExtraDescriptiveText() {
}
}
PathDiagnosticPiece* CFRefReport::VisitNode(ExplodedNode<ValueState>* N,
ExplodedNode<ValueState>* PrevN,
ExplodedGraph<ValueState>& G,
PathDiagnosticPiece* CFRefReport::VisitNode(ExplodedNode<GRState>* N,
ExplodedNode<GRState>* PrevN,
ExplodedGraph<GRState>& G,
BugReporter& BR) {
// Check if the type state has changed.
const ValueState* PrevSt = PrevN->getState();
const ValueState* CurrSt = N->getState();
const GRState* PrevSt = PrevN->getState();
const GRState* CurrSt = N->getState();
CFRefCount::RefBindings PrevB = CFRefCount::GetRefBindings(*PrevSt);
CFRefCount::RefBindings CurrB = CFRefCount::GetRefBindings(*CurrSt);
@ -2320,7 +2320,7 @@ PathDiagnosticPiece* CFRefReport::VisitNode(ExplodedNode<ValueState>* N,
// Add the range by scanning the children of the statement for any bindings
// to Sym.
ValueStateManager& VSM = cast<GRBugReporter>(BR).getStateManager();
GRStateManager& VSM = cast<GRBugReporter>(BR).getStateManager();
for (Stmt::child_iterator I = S->child_begin(), E = S->child_end(); I!=E; ++I)
if (Expr* Exp = dyn_cast_or_null<Expr>(*I)) {
@ -2335,11 +2335,11 @@ PathDiagnosticPiece* CFRefReport::VisitNode(ExplodedNode<ValueState>* N,
return P;
}
static std::pair<ExplodedNode<ValueState>*,VarDecl*>
GetAllocationSite(ExplodedNode<ValueState>* N, SymbolID Sym) {
static std::pair<ExplodedNode<GRState>*,VarDecl*>
GetAllocationSite(ExplodedNode<GRState>* N, SymbolID Sym) {
typedef CFRefCount::RefBindings RefBindings;
ExplodedNode<ValueState>* Last = N;
ExplodedNode<GRState>* Last = N;
// Find the first node that referred to the tracked symbol. We also
// try and find the first VarDecl the value was stored to.
@ -2347,7 +2347,7 @@ GetAllocationSite(ExplodedNode<ValueState>* N, SymbolID Sym) {
VarDecl* FirstDecl = 0;
while (N) {
const ValueState* St = N->getState();
const GRState* St = N->getState();
RefBindings B = RefBindings((RefBindings::TreeTy*) St->CheckerState);
if (!B.lookup(Sym))
@ -2356,7 +2356,7 @@ GetAllocationSite(ExplodedNode<ValueState>* N, SymbolID Sym) {
VarDecl* VD = 0;
// Determine if there is an LVal binding to the symbol.
for (ValueState::vb_iterator I=St->vb_begin(), E=St->vb_end(); I!=E; ++I) {
for (GRState::vb_iterator I=St->vb_begin(), E=St->vb_end(); I!=E; ++I) {
if (!isa<lval::SymbolVal>(I->second) // Is the value a symbol?
|| cast<lval::SymbolVal>(I->second).getSymbol() != Sym)
continue;
@ -2379,7 +2379,7 @@ GetAllocationSite(ExplodedNode<ValueState>* N, SymbolID Sym) {
}
PathDiagnosticPiece* CFRefReport::getEndPath(BugReporter& BR,
ExplodedNode<ValueState>* EndN) {
ExplodedNode<GRState>* EndN) {
// Tell the BugReporter to report cases when the tracked symbol is
// assigned to different variables, etc.
@ -2399,7 +2399,7 @@ PathDiagnosticPiece* CFRefReport::getEndPath(BugReporter& BR,
// symbol appeared, and also get the first VarDecl that tracked object
// is stored to.
ExplodedNode<ValueState>* AllocNode = 0;
ExplodedNode<GRState>* AllocNode = 0;
VarDecl* FirstDecl = 0;
llvm::tie(AllocNode, FirstDecl) = GetAllocationSite(EndN, Sym);
@ -2434,7 +2434,7 @@ PathDiagnosticPiece* CFRefReport::getEndPath(BugReporter& BR,
PathDiagnosticPiece::DisplayHint Hint = PathDiagnosticPiece::Above;
assert (!EndN->pred_empty()); // Not possible to have 0 predecessors.
ExplodedNode<ValueState> *Pred = *(EndN->pred_begin());
ExplodedNode<GRState> *Pred = *(EndN->pred_begin());
ProgramPoint PredPos = Pred->getLocation();
if (PostStmt* PredPS = dyn_cast<PostStmt>(&PredPos)) {
@ -2500,7 +2500,7 @@ void Leak::EmitWarnings(BugReporter& BR) {
}
}
void Leak::GetErrorNodes(std::vector<ExplodedNode<ValueState>*>& Nodes) {
void Leak::GetErrorNodes(std::vector<ExplodedNode<GRState>*>& Nodes) {
for (CFRefCount::leaks_iterator I=TF.leaks_begin(), E=TF.leaks_end();
I!=E; ++I)
Nodes.push_back(I->first);
@ -2514,7 +2514,7 @@ bool Leak::isCached(BugReport& R) {
SymbolID Sym = static_cast<CFRefReport&>(R).getSymbol();
ExplodedNode<ValueState>* AllocNode =
ExplodedNode<GRState>* AllocNode =
GetAllocationSite(R.getEndNode(), Sym).first;
if (!AllocNode)

124
lib/Analysis/GRExprEngine.cpp
Просмотреть файл

@ -85,7 +85,7 @@ public:
}
}
virtual bool Audit(NodeTy* N, ValueStateManager& VMgr) {
virtual bool Audit(NodeTy* N, GRStateManager& VMgr) {
Stmt* S = cast<PostStmt>(N->getLocation()).getStmt();
void* key = reinterpret_cast<void*>((uintptr_t) S->getStmtClass());
MapTy::iterator MI = M.find(key);
@ -187,7 +187,7 @@ void GRExprEngine::AddCheck(GRSimpleAPICheck* A, Stmt::StmtClass C) {
((MappedBatchAuditor*) BatchAuditor.get())->AddCheck(A, C);
}
const ValueState* GRExprEngine::getInitialState() {
const GRState* GRExprEngine::getInitialState() {
// The LiveVariables information already has a compilation of all VarDecls
// used in the function. Iterate through this set, and "symbolicate"
@ -196,7 +196,7 @@ const ValueState* GRExprEngine::getInitialState() {
typedef LiveVariables::AnalysisDataTy LVDataTy;
LVDataTy& D = Liveness.getAnalysisData();
ValueState StateImpl = *StateMgr.getInitialState();
GRState StateImpl = *StateMgr.getInitialState();
for (LVDataTy::decl_iterator I=D.begin_decl(), E=D.end_decl(); I != E; ++I) {
@ -331,7 +331,7 @@ void GRExprEngine::Visit(Stmt* S, NodeTy* Pred, NodeSet& Dst) {
break;
}
else if (B->getOpcode() == BinaryOperator::Comma) {
const ValueState* St = GetState(Pred);
const GRState* St = GetState(Pred);
MakeNode(Dst, B, Pred, SetRVal(St, B, GetRVal(St, B->getRHS())));
break;
}
@ -410,7 +410,7 @@ void GRExprEngine::Visit(Stmt* S, NodeTy* Pred, NodeSet& Dst) {
case Stmt::StmtExprClass: {
StmtExpr* SE = cast<StmtExpr>(S);
const ValueState* St = GetState(Pred);
const GRState* St = GetState(Pred);
// FIXME: Not certain if we can have empty StmtExprs. If so, we should
// probably just remove these from the CFG.
@ -466,7 +466,7 @@ void GRExprEngine::VisitLVal(Expr* Ex, NodeTy* Pred, NodeSet& Dst) {
// Block entrance. (Update counters).
//===----------------------------------------------------------------------===//
bool GRExprEngine::ProcessBlockEntrance(CFGBlock* B, const ValueState*,
bool GRExprEngine::ProcessBlockEntrance(CFGBlock* B, const GRState*,
GRBlockCounter BC) {
return BC.getNumVisited(B->getBlockID()) < 3;
@ -476,7 +476,7 @@ bool GRExprEngine::ProcessBlockEntrance(CFGBlock* B, const ValueState*,
// Branch processing.
//===----------------------------------------------------------------------===//
const ValueState* GRExprEngine::MarkBranch(const ValueState* St,
const GRState* GRExprEngine::MarkBranch(const GRState* St,
Stmt* Terminator,
bool branchTaken) {
@ -535,7 +535,7 @@ void GRExprEngine::ProcessBranch(Expr* Condition, Stmt* Term,
BranchNodeBuilder& builder) {
// Remove old bindings for subexpressions.
const ValueState* PrevState =
const GRState* PrevState =
StateMgr.RemoveSubExprBindings(builder.getState());
// Check for NULL conditions; e.g. "for(;;)"
@ -571,7 +571,7 @@ void GRExprEngine::ProcessBranch(Expr* Condition, Stmt* Term,
// Process the true branch.
bool isFeasible = false;
const ValueState* St = Assume(PrevState, V, true, isFeasible);
const GRState* St = Assume(PrevState, V, true, isFeasible);
if (isFeasible)
builder.generateNode(MarkBranch(St, Term, true), true);
@ -593,7 +593,7 @@ void GRExprEngine::ProcessBranch(Expr* Condition, Stmt* Term,
/// nodes by processing the 'effects' of a computed goto jump.
void GRExprEngine::ProcessIndirectGoto(IndirectGotoNodeBuilder& builder) {
const ValueState* St = builder.getState();
const GRState* St = builder.getState();
RVal V = GetRVal(St, builder.getTarget());
// Three possibilities:
@ -640,7 +640,7 @@ void GRExprEngine::VisitGuardedExpr(Expr* Ex, Expr* L, Expr* R,
assert (Ex == CurrentStmt && getCFG().isBlkExpr(Ex));
const ValueState* St = GetState(Pred);
const GRState* St = GetState(Pred);
RVal X = GetBlkExprRVal(St, Ex);
assert (X.isUndef());
@ -661,7 +661,7 @@ void GRExprEngine::ProcessSwitch(SwitchNodeBuilder& builder) {
typedef SwitchNodeBuilder::iterator iterator;
const ValueState* St = builder.getState();
const GRState* St = builder.getState();
Expr* CondE = builder.getCondition();
RVal CondV = GetRVal(St, CondE);
@ -671,7 +671,7 @@ void GRExprEngine::ProcessSwitch(SwitchNodeBuilder& builder) {
return;
}
const ValueState* DefaultSt = St;
const GRState* DefaultSt = St;
// While most of this can be assumed (such as the signedness), having it
// just computed makes sure everything makes the same assumptions end-to-end.
@ -718,7 +718,7 @@ void GRExprEngine::ProcessSwitch(SwitchNodeBuilder& builder) {
// Now "assume" that the case matches.
bool isFeasible = false;
const ValueState* StNew = Assume(St, Res, true, isFeasible);
const GRState* StNew = Assume(St, Res, true, isFeasible);
if (isFeasible) {
builder.generateCaseStmtNode(I, StNew);
@ -768,7 +768,7 @@ void GRExprEngine::VisitLogicalExpr(BinaryOperator* B, NodeTy* Pred,
assert (B == CurrentStmt && getCFG().isBlkExpr(B));
const ValueState* St = GetState(Pred);
const GRState* St = GetState(Pred);
RVal X = GetBlkExprRVal(St, B);
assert (X.isUndef());
@ -796,7 +796,7 @@ void GRExprEngine::VisitLogicalExpr(BinaryOperator* B, NodeTy* Pred,
// the payoff is not likely to be large. Instead, we do eager evaluation.
bool isFeasible = false;
const ValueState* NewState = Assume(St, X, true, isFeasible);
const GRState* NewState = Assume(St, X, true, isFeasible);
if (isFeasible)
MakeNode(Dst, B, Pred,
@ -826,7 +826,7 @@ void GRExprEngine::VisitLogicalExpr(BinaryOperator* B, NodeTy* Pred,
void GRExprEngine::VisitDeclRefExpr(DeclRefExpr* D, NodeTy* Pred, NodeSet& Dst,
bool asLVal) {
const ValueState* St = GetState(Pred);
const GRState* St = GetState(Pred);
RVal X = RVal::MakeVal(getBasicVals(), D);
if (asLVal)
@ -862,7 +862,7 @@ void GRExprEngine::VisitArraySubscriptExpr(ArraySubscriptExpr* A, NodeTy* Pred,
for (NodeSet::iterator I2=Tmp2.begin(), E2=Tmp2.end(); I2!=E2; ++I2) {
const ValueState* St = GetState(*I2);
const GRState* St = GetState(*I2);
RVal BaseV = GetRVal(St, Base);
RVal IdxV = GetRVal(St, Idx);
@ -901,7 +901,7 @@ void GRExprEngine::VisitMemberExpr(MemberExpr* M, NodeTy* Pred,
VisitLVal(Base, Pred, Tmp);
for (NodeSet::iterator I=Tmp.begin(), E=Tmp.end(); I!=E; ++I) {
const ValueState* St = GetState(*I);
const GRState* St = GetState(*I);
RVal BaseV = GetRVal(St, Base);
RVal V = lval::FieldOffset::Make(getBasicVals(), GetRVal(St, Base),
@ -919,7 +919,7 @@ void GRExprEngine::VisitMemberExpr(MemberExpr* M, NodeTy* Pred,
for (NodeSet::iterator I=Tmp.begin(), E=Tmp.end(); I!=E; ++I) {
const ValueState* St = GetState(*I);
const GRState* St = GetState(*I);
RVal BaseV = GetRVal(St, Base);
if (LVal::IsLValType(Base->getType())) {
@ -948,7 +948,7 @@ void GRExprEngine::VisitMemberExpr(MemberExpr* M, NodeTy* Pred,
}
void GRExprEngine::EvalStore(NodeSet& Dst, Expr* Ex, NodeTy* Pred,
const ValueState* St, RVal location, RVal Val) {
const GRState* St, RVal location, RVal Val) {
assert (Builder && "GRStmtNodeBuilder must be defined.");
@ -978,7 +978,7 @@ void GRExprEngine::EvalStore(NodeSet& Dst, Expr* Ex, NodeTy* Pred,
}
void GRExprEngine::EvalLoad(NodeSet& Dst, Expr* Ex, NodeTy* Pred,
const ValueState* St, RVal location,
const GRState* St, RVal location,
bool CheckOnly) {
// Evaluate the location (checks for bad dereferences).
@ -1007,8 +1007,8 @@ void GRExprEngine::EvalLoad(NodeSet& Dst, Expr* Ex, NodeTy* Pred,
Ex->getType())));
}
const ValueState* GRExprEngine::EvalLocation(Expr* Ex, NodeTy* Pred,
const ValueState* St,
const GRState* GRExprEngine::EvalLocation(Expr* Ex, NodeTy* Pred,
const GRState* St,
RVal location, bool isLoad) {
// Check for loads/stores from/to undefined values.
@ -1039,12 +1039,12 @@ const ValueState* GRExprEngine::EvalLocation(Expr* Ex, NodeTy* Pred,
// "Assume" that the pointer is not NULL.
bool isFeasibleNotNull = false;
const ValueState* StNotNull = Assume(St, LV, true, isFeasibleNotNull);
const GRState* StNotNull = Assume(St, LV, true, isFeasibleNotNull);
// "Assume" that the pointer is NULL.
bool isFeasibleNull = false;
const ValueState* StNull = Assume(St, LV, false, isFeasibleNull);
const GRState* StNull = Assume(St, LV, false, isFeasibleNull);
if (isFeasibleNull) {
@ -1102,7 +1102,7 @@ void GRExprEngine::VisitCall(CallExpr* CE, NodeTy* Pred,
// Finally, evaluate the function call.
for (NodeSet::iterator DI = DstTmp.begin(), DE = DstTmp.end(); DI!=DE; ++DI) {
const ValueState* St = GetState(*DI);
const GRState* St = GetState(*DI);
RVal L = GetRVal(St, Callee);
// FIXME: Add support for symbolic function calls (calls involving
@ -1296,7 +1296,7 @@ void GRExprEngine::VisitObjCMessageExprDispatchHelper(ObjCMessageExpr* ME,
// FIXME: More logic for the processing the method call.
const ValueState* St = GetState(Pred);
const GRState* St = GetState(Pred);
bool RaisesException = false;
@ -1441,7 +1441,7 @@ void GRExprEngine::VisitCast(Expr* CastE, Expr* Ex, NodeTy* Pred, NodeSet& Dst){
for (NodeSet::iterator I1 = S1.begin(), E1 = S1.end(); I1 != E1; ++I1) {
NodeTy* N = *I1;
const ValueState* St = GetState(N);
const GRState* St = GetState(N);
RVal V = GetRVal(St, Ex);
// Unknown?
@ -1520,7 +1520,7 @@ void GRExprEngine::VisitDeclStmtAux(DeclStmt* DS, ScopedDecl* D,
for (NodeSet::iterator I=Tmp.begin(), E=Tmp.end(); I!=E; ++I) {
const ValueState* St = GetState(*I);
const GRState* St = GetState(*I);
if (!Ex && VD->hasGlobalStorage()) {
@ -1651,7 +1651,7 @@ void GRExprEngine::VisitUnaryOperator(UnaryOperator* U, NodeTy* Pred,
for (NodeSet::iterator I=Tmp.begin(), E=Tmp.end(); I!=E; ++I) {
const ValueState* St = GetState(*I);
const GRState* St = GetState(*I);
RVal location = GetRVal(St, Ex);
if (asLVal)
@ -1680,7 +1680,7 @@ void GRExprEngine::VisitUnaryOperator(UnaryOperator* U, NodeTy* Pred,
// For all other types, UnaryOperator::Real is an identity operation.
assert (U->getType() == Ex->getType());
const ValueState* St = GetState(*I);
const GRState* St = GetState(*I);
MakeNode(Dst, U, *I, SetRVal(St, U, GetRVal(St, Ex)));
}
@ -1703,7 +1703,7 @@ void GRExprEngine::VisitUnaryOperator(UnaryOperator* U, NodeTy* Pred,
// For all other types, UnaryOperator::Float returns 0.
assert (Ex->getType()->isIntegerType());
const ValueState* St = GetState(*I);
const GRState* St = GetState(*I);
RVal X = NonLVal::MakeVal(getBasicVals(), 0, Ex->getType());
MakeNode(Dst, U, *I, SetRVal(St, U, X));
}
@ -1729,7 +1729,7 @@ void GRExprEngine::VisitUnaryOperator(UnaryOperator* U, NodeTy* Pred,
Visit(Ex, Pred, Tmp);
for (NodeSet::iterator I=Tmp.begin(), E=Tmp.end(); I!=E; ++I) {
const ValueState* St = GetState(*I);
const GRState* St = GetState(*I);
MakeNode(Dst, U, *I, SetRVal(St, U, GetRVal(St, Ex)));
}
@ -1744,7 +1744,7 @@ void GRExprEngine::VisitUnaryOperator(UnaryOperator* U, NodeTy* Pred,
VisitLVal(Ex, Pred, Tmp);
for (NodeSet::iterator I=Tmp.begin(), E=Tmp.end(); I!=E; ++I) {
const ValueState* St = GetState(*I);
const GRState* St = GetState(*I);
RVal V = GetRVal(St, Ex);
St = SetRVal(St, U, V);
MakeNode(Dst, U, *I, St);
@ -1763,7 +1763,7 @@ void GRExprEngine::VisitUnaryOperator(UnaryOperator* U, NodeTy* Pred,
Visit(Ex, Pred, Tmp);
for (NodeSet::iterator I=Tmp.begin(), E=Tmp.end(); I!=E; ++I) {
const ValueState* St = GetState(*I);
const GRState* St = GetState(*I);
RVal V = GetRVal(St, Ex);
if (V.isUnknownOrUndef()) {
@ -1826,7 +1826,7 @@ void GRExprEngine::VisitUnaryOperator(UnaryOperator* U, NodeTy* Pred,
return;
uint64_t size = getContext().getTypeSize(T) / 8;
const ValueState* St = GetState(Pred);
const GRState* St = GetState(Pred);
St = SetRVal(St, U, NonLVal::MakeVal(getBasicVals(), size, U->getType()));
MakeNode(Dst, U, Pred, St);
@ -1843,7 +1843,7 @@ void GRExprEngine::VisitUnaryOperator(UnaryOperator* U, NodeTy* Pred,
for (NodeSet::iterator I = Tmp.begin(), E = Tmp.end(); I!=E; ++I) {
const ValueState* St = GetState(*I);
const GRState* St = GetState(*I);
RVal V1 = GetRVal(St, Ex);
// Perform a load.
@ -1910,7 +1910,7 @@ void GRExprEngine::VisitAsmStmtHelperInputs(AsmStmt* A,
// which interprets the inline asm and stores proper results in the
// outputs.
const ValueState* St = GetState(Pred);
const GRState* St = GetState(Pred);
for (AsmStmt::outputs_iterator OI = A->begin_outputs(),
OE = A->end_outputs(); OI != OE; ++OI) {
@ -2004,7 +2004,7 @@ void GRExprEngine::VisitReturnStmt(ReturnStmt* S, NodeTy* Pred, NodeSet& Dst) {
// Transfer functions: Binary operators.
//===----------------------------------------------------------------------===//
bool GRExprEngine::CheckDivideZero(Expr* Ex, const ValueState* St,
bool GRExprEngine::CheckDivideZero(Expr* Ex, const GRState* St,
NodeTy* Pred, RVal Denom) {
// Divide by undefined? (potentially zero)
@ -2024,7 +2024,7 @@ bool GRExprEngine::CheckDivideZero(Expr* Ex, const ValueState* St,
// First, "assume" that the denominator is 0 or undefined.
bool isFeasibleZero = false;
const ValueState* ZeroSt = Assume(St, Denom, false, isFeasibleZero);
const GRState* ZeroSt = Assume(St, Denom, false, isFeasibleZero);
// Second, "assume" that the denominator cannot be 0.
@ -2073,7 +2073,7 @@ void GRExprEngine::VisitBinaryOperator(BinaryOperator* B,
for (NodeSet::iterator I2=Tmp2.begin(), E2=Tmp2.end(); I2 != E2; ++I2) {
const ValueState* St = GetState(*I2);
const GRState* St = GetState(*I2);
RVal RightV = GetRVal(St, RHS);
BinaryOperator::Opcode Op = B->getOpcode();
@ -2230,23 +2230,23 @@ void GRExprEngine::VisitBinaryOperator(BinaryOperator* B,
// Transfer-function Helpers.
//===----------------------------------------------------------------------===//
void GRExprEngine::EvalBinOp(ExplodedNodeSet<ValueState>& Dst, Expr* Ex,
void GRExprEngine::EvalBinOp(ExplodedNodeSet<GRState>& Dst, Expr* Ex,
BinaryOperator::Opcode Op,
NonLVal L, NonLVal R,
ExplodedNode<ValueState>* Pred) {
ExplodedNode<GRState>* Pred) {
ValueStateSet OStates;
GRStateSet OStates;
EvalBinOp(OStates, GetState(Pred), Ex, Op, L, R);
for (ValueStateSet::iterator I=OStates.begin(), E=OStates.end(); I!=E; ++I)
for (GRStateSet::iterator I=OStates.begin(), E=OStates.end(); I!=E; ++I)
MakeNode(Dst, Ex, Pred, *I);
}
void GRExprEngine::EvalBinOp(ValueStateSet& OStates, const ValueState* St,
void GRExprEngine::EvalBinOp(GRStateSet& OStates, const GRState* St,
Expr* Ex, BinaryOperator::Opcode Op,
NonLVal L, NonLVal R) {
ValueStateSet::AutoPopulate AP(OStates, St);
GRStateSet::AutoPopulate AP(OStates, St);
if (R.isValid()) getTF().EvalBinOpNN(OStates, StateMgr, St, Ex, Op, L, R);
}
@ -2257,20 +2257,20 @@ void GRExprEngine::EvalBinOp(ValueStateSet& OStates, const ValueState* St,
#ifndef NDEBUG
static GRExprEngine* GraphPrintCheckerState;
static SourceManager* GraphPrintSourceManager;
static ValueState::CheckerStatePrinter* GraphCheckerStatePrinter;
static GRState::CheckerStatePrinter* GraphCheckerStatePrinter;
namespace llvm {
template<>
struct VISIBILITY_HIDDEN DOTGraphTraits<GRExprEngine::NodeTy*> :
public DefaultDOTGraphTraits {
static void PrintVarBindings(std::ostream& Out, ValueState* St) {
static void PrintVarBindings(std::ostream& Out, GRState* St) {
Out << "Variables:\\l";
bool isFirst = true;
for (ValueState::vb_iterator I=St->vb_begin(), E=St->vb_end(); I!=E;++I) {
for (GRState::vb_iterator I=St->vb_begin(), E=St->vb_end(); I!=E;++I) {
if (isFirst)
isFirst = false;
@ -2284,11 +2284,11 @@ struct VISIBILITY_HIDDEN DOTGraphTraits<GRExprEngine::NodeTy*> :
}
static void PrintSubExprBindings(std::ostream& Out, ValueState* St){
static void PrintSubExprBindings(std::ostream& Out, GRState* St){
bool isFirst = true;
for (ValueState::seb_iterator I=St->seb_begin(), E=St->seb_end();I!=E;++I) {
for (GRState::seb_iterator I=St->seb_begin(), E=St->seb_end();I!=E;++I) {
if (isFirst) {
Out << "\\l\\lSub-Expressions:\\l";
@ -2304,11 +2304,11 @@ struct VISIBILITY_HIDDEN DOTGraphTraits<GRExprEngine::NodeTy*> :
}
}
static void PrintBlkExprBindings(std::ostream& Out, ValueState* St){
static void PrintBlkExprBindings(std::ostream& Out, GRState* St){
bool isFirst = true;
for (ValueState::beb_iterator I=St->beb_begin(), E=St->beb_end(); I!=E;++I){
for (GRState::beb_iterator I=St->beb_begin(), E=St->beb_end(); I!=E;++I){
if (isFirst) {
Out << "\\l\\lBlock-level Expressions:\\l";
isFirst = false;
@ -2323,33 +2323,33 @@ struct VISIBILITY_HIDDEN DOTGraphTraits<GRExprEngine::NodeTy*> :
}
}
static void PrintEQ(std::ostream& Out, ValueState* St) {
ValueState::ConstEqTy CE = St->ConstEq;
static void PrintEQ(std::ostream& Out, GRState* St) {
GRState::ConstEqTy CE = St->ConstEq;
if (CE.isEmpty())
return;
Out << "\\l\\|'==' constraints:";
for (ValueState::ConstEqTy::iterator I=CE.begin(), E=CE.end(); I!=E;++I)
for (GRState::ConstEqTy::iterator I=CE.begin(), E=CE.end(); I!=E;++I)
Out << "\\l $" << I.getKey() << " : " << I.getData()->toString();
}
static void PrintNE(std::ostream& Out, ValueState* St) {
ValueState::ConstNotEqTy NE = St->ConstNotEq;
static void PrintNE(std::ostream& Out, GRState* St) {
GRState::ConstNotEqTy NE = St->ConstNotEq;
if (NE.isEmpty())
return;
Out << "\\l\\|'!=' constraints:";
for (ValueState::ConstNotEqTy::iterator I=NE.begin(), EI=NE.end();
for (GRState::ConstNotEqTy::iterator I=NE.begin(), EI=NE.end();
I != EI; ++I){
Out << "\\l $" << I.getKey() << " : ";
bool isFirst = true;
ValueState::IntSetTy::iterator J=I.getData().begin(),
GRState::IntSetTy::iterator J=I.getData().begin(),
EJ=I.getData().end();
for ( ; J != EJ; ++J) {
if (isFirst) isFirst = false;

22
lib/Analysis/GRExprEngineInternalChecks.cpp
Просмотреть файл

@ -24,12 +24,12 @@ using namespace clang;
//===----------------------------------------------------------------------===//
template <typename ITERATOR> inline
ExplodedNode<ValueState>* GetNode(ITERATOR I) {
ExplodedNode<GRState>* GetNode(ITERATOR I) {
return *I;
}
template <> inline
ExplodedNode<ValueState>* GetNode(GRExprEngine::undef_arg_iterator I) {
ExplodedNode<GRState>* GetNode(GRExprEngine::undef_arg_iterator I) {
return I->first;
}
@ -166,7 +166,7 @@ public:
// Generate a report for this bug.
RangedBugReport report(*this, *I);
ExplodedNode<ValueState>* N = *I;
ExplodedNode<GRState>* N = *I;
Stmt *S = cast<PostStmt>(N->getLocation()).getStmt();
Expr* E = cast<ObjCMessageExpr>(S)->getReceiver();
assert (E && "Receiver cannot be NULL");
@ -186,7 +186,7 @@ public:
for (GRExprEngine::ret_stackaddr_iterator I=Eng.ret_stackaddr_begin(),
End = Eng.ret_stackaddr_end(); I!=End; ++I) {
ExplodedNode<ValueState>* N = *I;
ExplodedNode<GRState>* N = *I;
Stmt *S = cast<PostStmt>(N->getLocation()).getStmt();
Expr* E = cast<ReturnStmt>(S)->getRetValue();
assert (E && "Return expression cannot be NULL");
@ -214,10 +214,10 @@ public:
class VISIBILITY_HIDDEN UndefBranch : public BuiltinBug {
struct VISIBILITY_HIDDEN FindUndefExpr {
ValueStateManager& VM;
const ValueState* St;
GRStateManager& VM;
const GRState* St;
FindUndefExpr(ValueStateManager& V, const ValueState* S) : VM(V), St(S) {}
FindUndefExpr(GRStateManager& V, const GRState* S) : VM(V), St(S) {}
Expr* FindExpr(Expr* Ex) {
if (!MatchesCriteria(Ex))
@ -264,10 +264,10 @@ public:
// Note: any predecessor will do. They should have identical state,
// since all the BlockEdge did was act as an error sink since the value
// had to already be undefined.
ExplodedNode<ValueState> *N = *(*I)->pred_begin();
ExplodedNode<GRState> *N = *(*I)->pred_begin();
ProgramPoint P = N->getLocation();
const ValueState* St = (*I)->getState();
const GRState* St = (*I)->getState();
if (PostStmt* PS = dyn_cast<PostStmt>(&P))
if (PS->getStmt() == Ex)
@ -296,9 +296,9 @@ public:
BT("'nonnull' argument passed null",
"Null pointer passed as an argument to a 'nonnull' parameter") {}
virtual bool Audit(ExplodedNode<ValueState>* N, ValueStateManager& VMgr) {
virtual bool Audit(ExplodedNode<GRState>* N, GRStateManager& VMgr) {
CallExpr* CE = cast<CallExpr>(cast<PostStmt>(N->getLocation()).getStmt());
const ValueState* state = N->getState();
const GRState* state = N->getState();
RVal X = VMgr.GetRVal(state, CE->getCallee());

24
lib/Analysis/GRSimpleVals.cpp
Просмотреть файл

@ -17,7 +17,7 @@
#include "BasicObjCFoundationChecks.h"
#include "clang/Basic/SourceManager.h"
#include "clang/Analysis/PathDiagnostic.h"
#include "clang/Analysis/PathSensitive/ValueState.h"
#include "clang/Analysis/PathSensitive/GRState.h"
#include "clang/Analysis/PathSensitive/BugReporter.h"
#include "clang/Analysis/LocalCheckers.h"
#include "clang/Analysis/PathSensitive/GRExprEngine.h"
@ -123,7 +123,7 @@ static unsigned char LNotOpMap[] = {
(unsigned char) BinaryOperator::EQ /* NE => EQ */
};
RVal GRSimpleVals::DetermEvalBinOpNN(ValueStateManager& StateMgr,
RVal GRSimpleVals::DetermEvalBinOpNN(GRStateManager& StateMgr,
BinaryOperator::Opcode Op,
NonLVal L, NonLVal R) {
@ -355,14 +355,14 @@ RVal GRSimpleVals::EvalNE(GRExprEngine& Eng, LVal L, LVal R) {
// Transfer function for function calls.
//===----------------------------------------------------------------------===//
void GRSimpleVals::EvalCall(ExplodedNodeSet<ValueState>& Dst,
void GRSimpleVals::EvalCall(ExplodedNodeSet<GRState>& Dst,
GRExprEngine& Eng,
GRStmtNodeBuilder<ValueState>& Builder,
GRStmtNodeBuilder<GRState>& Builder,
CallExpr* CE, RVal L,
ExplodedNode<ValueState>* Pred) {
ExplodedNode<GRState>* Pred) {
ValueStateManager& StateMgr = Eng.getStateManager();
const ValueState* St = Builder.GetState(Pred);
GRStateManager& StateMgr = Eng.getStateManager();
const GRState* St = Builder.GetState(Pred);
// Invalidate all arguments passed in by reference (LVals).
@ -399,18 +399,18 @@ void GRSimpleVals::EvalCall(ExplodedNodeSet<ValueState>& Dst,
// Transfer function for Objective-C message expressions.
//===----------------------------------------------------------------------===//
void GRSimpleVals::EvalObjCMessageExpr(ExplodedNodeSet<ValueState>& Dst,
void GRSimpleVals::EvalObjCMessageExpr(ExplodedNodeSet<GRState>& Dst,
GRExprEngine& Eng,
GRStmtNodeBuilder<ValueState>& Builder,
GRStmtNodeBuilder<GRState>& Builder,
ObjCMessageExpr* ME,
ExplodedNode<ValueState>* Pred) {
ExplodedNode<GRState>* Pred) {
// The basic transfer function logic for message expressions does nothing.
// We just invalidate all arguments passed in by references.
ValueStateManager& StateMgr = Eng.getStateManager();
const ValueState* St = Builder.GetState(Pred);
GRStateManager& StateMgr = Eng.getStateManager();
const GRState* St = Builder.GetState(Pred);
for (ObjCMessageExpr::arg_iterator I = ME->arg_begin(), E = ME->arg_end();
I != E; ++I) {

16
lib/Analysis/GRSimpleVals.h
Просмотреть файл

@ -27,7 +27,7 @@ class ASTContext;
class GRSimpleVals : public GRTransferFuncs {
protected:
virtual RVal DetermEvalBinOpNN(ValueStateManager& StateMgr,
virtual RVal DetermEvalBinOpNN(GRStateManager& StateMgr,
BinaryOperator::Opcode Op,
NonLVal L, NonLVal R);
@ -58,22 +58,22 @@ public:
// Calls.
virtual void EvalCall(ExplodedNodeSet<ValueState>& Dst,
virtual void EvalCall(ExplodedNodeSet<GRState>& Dst,
GRExprEngine& Engine,
GRStmtNodeBuilder<ValueState>& Builder,
GRStmtNodeBuilder<GRState>& Builder,
CallExpr* CE, RVal L,
ExplodedNode<ValueState>* Pred);
ExplodedNode<GRState>* Pred);
virtual void EvalObjCMessageExpr(ExplodedNodeSet<ValueState>& Dst,
virtual void EvalObjCMessageExpr(ExplodedNodeSet<GRState>& Dst,
GRExprEngine& Engine,
GRStmtNodeBuilder<ValueState>& Builder,
GRStmtNodeBuilder<GRState>& Builder,
ObjCMessageExpr* ME,
ExplodedNode<ValueState>* Pred);
ExplodedNode<GRState>* Pred);
static void GeneratePathDiagnostic(PathDiagnostic& PD, ASTContext& Ctx,
ExplodedNode<ValueState>* N);
ExplodedNode<GRState>* N);
protected:

14
lib/Analysis/GRTransferFuncs.cpp
Просмотреть файл

@ -19,11 +19,11 @@ using namespace clang;
void GRTransferFuncs::RegisterChecks(GRExprEngine& Eng) {}
void GRTransferFuncs::EvalStore(ExplodedNodeSet<ValueState>& Dst,
void GRTransferFuncs::EvalStore(ExplodedNodeSet<GRState>& Dst,
GRExprEngine& Eng,
GRStmtNodeBuilder<ValueState>& Builder,
Expr* E, ExplodedNode<ValueState>* Pred,
const ValueState* St, RVal TargetLV, RVal Val) {
GRStmtNodeBuilder<GRState>& Builder,
Expr* E, ExplodedNode<GRState>* Pred,
const GRState* St, RVal TargetLV, RVal Val) {
// This code basically matches the "safety-net" logic of GRExprEngine:
// bind Val to TargetLV, and create a new node. We replicate it here
@ -38,9 +38,9 @@ void GRTransferFuncs::EvalStore(ExplodedNodeSet<ValueState>& Dst,
Eng.getStateManager().SetRVal(St, cast<LVal>(TargetLV), Val));
}
void GRTransferFuncs::EvalBinOpNN(ValueStateSet& OStates,
ValueStateManager& StateMgr,
const ValueState *St, Expr* Ex,
void GRTransferFuncs::EvalBinOpNN(GRStateSet& OStates,
GRStateManager& StateMgr,
const GRState *St, Expr* Ex,
BinaryOperator::Opcode Op,
NonLVal L, NonLVal R) {

100
lib/Analysis/ValueState.cpp
Просмотреть файл

@ -1,4 +1,4 @@
//= ValueState*cpp - Path-Sens. "State" for tracking valuues -----*- C++ -*--=//
//= GRState*cpp - Path-Sens. "State" for tracking valuues -----*- C++ -*--=//
//
// The LLVM Compiler Infrastructure
//
@ -7,17 +7,17 @@
//
//===----------------------------------------------------------------------===//
//
// This file defines SymbolID, ExprBindKey, and ValueState*
// This file defines SymbolID, ExprBindKey, and GRState*
//
//===----------------------------------------------------------------------===//
#include "clang/Analysis/PathSensitive/ValueState.h"
#include "clang/Analysis/PathSensitive/GRState.h"
#include "llvm/ADT/SmallSet.h"
#include "clang/Analysis/PathSensitive/GRTransferFuncs.h"
using namespace clang;
bool ValueState::isNotEqual(SymbolID sym, const llvm::APSInt& V) const {
bool GRState::isNotEqual(SymbolID sym, const llvm::APSInt& V) const {
// Retrieve the NE-set associated with the given symbol.
const ConstNotEqTy::data_type* T = ConstNotEq.lookup(sym);
@ -26,7 +26,7 @@ bool ValueState::isNotEqual(SymbolID sym, const llvm::APSInt& V) const {
return T ? T->contains(&V) : false;
}
bool ValueState::isEqual(SymbolID sym, const llvm::APSInt& V) const {
bool GRState::isEqual(SymbolID sym, const llvm::APSInt& V) const {
// Retrieve the EQ-set associated with the given symbol.
const ConstEqTy::data_type* T = ConstEq.lookup(sym);
@ -35,13 +35,13 @@ bool ValueState::isEqual(SymbolID sym, const llvm::APSInt& V) const {
return T ? **T == V : false;
}
const llvm::APSInt* ValueState::getSymVal(SymbolID sym) const {
const llvm::APSInt* GRState::getSymVal(SymbolID sym) const {
ConstEqTy::data_type* T = ConstEq.lookup(sym);
return T ? *T : NULL;
}
const ValueState*
ValueStateManager::RemoveDeadBindings(const ValueState* St, Stmt* Loc,
const GRState*
GRStateManager::RemoveDeadBindings(const GRState* St, Stmt* Loc,
const LiveVariables& Liveness,
DeadSymbolsTy& DSymbols) {
@ -54,7 +54,7 @@ ValueStateManager::RemoveDeadBindings(const ValueState* St, Stmt* Loc,
DRoots.clear();
StoreManager::LiveSymbolsTy LSymbols;
ValueState NewSt = *St;
GRState NewSt = *St;
// FIXME: Put this in environment.
// Clean up the environment.
@ -64,7 +64,7 @@ ValueStateManager::RemoveDeadBindings(const ValueState* St, Stmt* Loc,
// Iterate over the block-expr bindings.
for (ValueState::beb_iterator I = St->beb_begin(), E = St->beb_end();
for (GRState::beb_iterator I = St->beb_begin(), E = St->beb_end();
I!=E ; ++I) {
Expr* BlkExpr = I.getKey();
@ -97,7 +97,7 @@ ValueStateManager::RemoveDeadBindings(const ValueState* St, Stmt* Loc,
LSymbols, DSymbols);
// Remove the dead symbols from the symbol tracker.
for (ValueState::ce_iterator I = St->ce_begin(), E=St->ce_end(); I!=E; ++I) {
for (GRState::ce_iterator I = St->ce_begin(), E=St->ce_end(); I!=E; ++I) {
SymbolID sym = I.getKey();
@ -107,7 +107,7 @@ ValueStateManager::RemoveDeadBindings(const ValueState* St, Stmt* Loc,
}
}
for (ValueState::cne_iterator I = St->cne_begin(), E=St->cne_end(); I!=E;++I){
for (GRState::cne_iterator I = St->cne_begin(), E=St->cne_end(); I!=E;++I){
SymbolID sym = I.getKey();
@ -120,7 +120,7 @@ ValueStateManager::RemoveDeadBindings(const ValueState* St, Stmt* Loc,
return getPersistentState(NewSt);
}
const ValueState* ValueStateManager::SetRVal(const ValueState* St, LVal LV,
const GRState* GRStateManager::SetRVal(const GRState* St, LVal LV,
RVal V) {
Store OldStore = St->getStore();
@ -129,56 +129,56 @@ const ValueState* ValueStateManager::SetRVal(const ValueState* St, LVal LV,
if (NewStore == OldStore)
return St;
ValueState NewSt = *St;
GRState NewSt = *St;
NewSt.St = NewStore;
return getPersistentState(NewSt);
}
const ValueState* ValueStateManager::Unbind(const ValueState* St, LVal LV) {
const GRState* GRStateManager::Unbind(const GRState* St, LVal LV) {
Store OldStore = St->getStore();
Store NewStore = StMgr->Remove(OldStore, LV);
if (NewStore == OldStore)
return St;
ValueState NewSt = *St;
GRState NewSt = *St;
NewSt.St = NewStore;
return getPersistentState(NewSt);
}
const ValueState* ValueStateManager::AddNE(const ValueState* St, SymbolID sym,
const GRState* GRStateManager::AddNE(const GRState* St, SymbolID sym,
const llvm::APSInt& V) {
// First, retrieve the NE-set associated with the given symbol.
ValueState::ConstNotEqTy::data_type* T = St->ConstNotEq.lookup(sym);
ValueState::IntSetTy S = T ? *T : ISetFactory.GetEmptySet();
GRState::ConstNotEqTy::data_type* T = St->ConstNotEq.lookup(sym);
GRState::IntSetTy S = T ? *T : ISetFactory.GetEmptySet();
// Now add V to the NE set.
S = ISetFactory.Add(S, &V);
// Create a new state with the old binding replaced.
ValueState NewSt = *St;
GRState NewSt = *St;
NewSt.ConstNotEq = CNEFactory.Add(NewSt.ConstNotEq, sym, S);
// Get the persistent copy.
return getPersistentState(NewSt);
}
const ValueState* ValueStateManager::AddEQ(const ValueState* St, SymbolID sym,
const GRState* GRStateManager::AddEQ(const GRState* St, SymbolID sym,
const llvm::APSInt& V) {
// Create a new state with the old binding replaced.
ValueState NewSt = *St;
GRState NewSt = *St;
NewSt.ConstEq = CEFactory.Add(NewSt.ConstEq, sym, &V);
// Get the persistent copy.
return getPersistentState(NewSt);
}
const ValueState* ValueStateManager::getInitialState() {
const GRState* GRStateManager::getInitialState() {
ValueState StateImpl(EnvMgr.getInitialEnvironment(),
GRState StateImpl(EnvMgr.getInitialEnvironment(),
StMgr->getInitialStore(),
GDMFactory.GetEmptyMap(),
CNEFactory.GetEmptyMap(),
@ -187,30 +187,30 @@ const ValueState* ValueStateManager::getInitialState() {
return getPersistentState(StateImpl);
}
const ValueState* ValueStateManager::getPersistentState(ValueState& State) {
const GRState* GRStateManager::getPersistentState(GRState& State) {
llvm::FoldingSetNodeID ID;
State.Profile(ID);
void* InsertPos;
if (ValueState* I = StateSet.FindNodeOrInsertPos(ID, InsertPos))
if (GRState* I = StateSet.FindNodeOrInsertPos(ID, InsertPos))
return I;
ValueState* I = (ValueState*) Alloc.Allocate<ValueState>();
new (I) ValueState(State);
GRState* I = (GRState*) Alloc.Allocate<GRState>();
new (I) GRState(State);
StateSet.InsertNode(I, InsertPos);
return I;
}
void ValueState::printDOT(std::ostream& Out, CheckerStatePrinter* P) const {
void GRState::printDOT(std::ostream& Out, CheckerStatePrinter* P) const {
print(Out, P, "\\l", "\\|");
}
void ValueState::printStdErr(CheckerStatePrinter* P) const {
void GRState::printStdErr(CheckerStatePrinter* P) const {
print(*llvm::cerr, P);
}
void ValueState::print(std::ostream& Out, CheckerStatePrinter* P,
void GRState::print(std::ostream& Out, CheckerStatePrinter* P,
const char* nl, const char* sep) const {
// Print Variable Bindings
@ -311,7 +311,7 @@ void ValueState::print(std::ostream& Out, CheckerStatePrinter* P,
// Queries.
//===----------------------------------------------------------------------===//
bool ValueStateManager::isEqual(const ValueState* state, Expr* Ex,
bool GRStateManager::isEqual(const GRState* state, Expr* Ex,
const llvm::APSInt& Y) {
RVal V = GetRVal(state, Ex);
@ -330,7 +330,7 @@ bool ValueStateManager::isEqual(const ValueState* state, Expr* Ex,
return false;
}
bool ValueStateManager::isEqual(const ValueState* state, Expr* Ex,
bool GRStateManager::isEqual(const GRState* state, Expr* Ex,
uint64_t x) {
return isEqual(state, Ex, BasicVals.getValue(x, Ex->getType()));
}
@ -339,7 +339,7 @@ bool ValueStateManager::isEqual(const ValueState* state, Expr* Ex,
// "Assume" logic.
//===----------------------------------------------------------------------===//
const ValueState* ValueStateManager::Assume(const ValueState* St, LVal Cond,
const GRState* GRStateManager::Assume(const GRState* St, LVal Cond,
bool Assumption, bool& isFeasible) {
St = AssumeAux(St, Cond, Assumption, isFeasible);
@ -348,7 +348,7 @@ const ValueState* ValueStateManager::Assume(const ValueState* St, LVal Cond,
: St;
}
const ValueState* ValueStateManager::AssumeAux(const ValueState* St, LVal Cond,
const GRState* GRStateManager::AssumeAux(const GRState* St, LVal Cond,
bool Assumption, bool& isFeasible) {
switch (Cond.getSubKind()) {
@ -388,7 +388,7 @@ const ValueState* ValueStateManager::AssumeAux(const ValueState* St, LVal Cond,
}
}
const ValueState* ValueStateManager::Assume(const ValueState* St, NonLVal Cond,
const GRState* GRStateManager::Assume(const GRState* St, NonLVal Cond,
bool Assumption, bool& isFeasible) {
St = AssumeAux(St, Cond, Assumption, isFeasible);
@ -397,7 +397,7 @@ const ValueState* ValueStateManager::Assume(const ValueState* St, NonLVal Cond,
: St;
}
const ValueState* ValueStateManager::AssumeAux(const ValueState* St, NonLVal Cond,
const GRState* GRStateManager::AssumeAux(const GRState* St, NonLVal Cond,
bool Assumption, bool& isFeasible) {
switch (Cond.getSubKind()) {
default:
@ -438,7 +438,7 @@ const ValueState* ValueStateManager::AssumeAux(const ValueState* St, NonLVal Con
const ValueState* ValueStateManager::AssumeSymInt(const ValueState* St,
const GRState* GRStateManager::AssumeSymInt(const GRState* St,
bool Assumption,
const SymIntConstraint& C,
bool& isFeasible) {
@ -479,8 +479,8 @@ const ValueState* ValueStateManager::AssumeSymInt(const ValueState* St,
// FIXME: This should go into a plug-in constraint engine.
//===----------------------------------------------------------------------===//
const ValueState*
ValueStateManager::AssumeSymNE(const ValueState* St, SymbolID sym,
const GRState*
GRStateManager::AssumeSymNE(const GRState* St, SymbolID sym,
const llvm::APSInt& V, bool& isFeasible) {
// First, determine if sym == X, where X != V.
@ -502,8 +502,8 @@ ValueStateManager::AssumeSymNE(const ValueState* St, SymbolID sym,
return AddNE(St, sym, V);
}
const ValueState*
ValueStateManager::AssumeSymEQ(const ValueState* St, SymbolID sym,
const GRState*
GRStateManager::AssumeSymEQ(const GRState* St, SymbolID sym,
const llvm::APSInt& V, bool& isFeasible) {
// First, determine if sym == X, where X != V.
@ -525,24 +525,24 @@ ValueStateManager::AssumeSymEQ(const ValueState* St, SymbolID sym,
return AddEQ(St, sym, V);
}
const ValueState*
ValueStateManager::AssumeSymLT(const ValueState* St, SymbolID sym,
const GRState*
GRStateManager::AssumeSymLT(const GRState* St, SymbolID sym,
const llvm::APSInt& V, bool& isFeasible) {
// FIXME: For now have assuming x < y be the same as assuming sym != V;
return AssumeSymNE(St, sym, V, isFeasible);
}
const ValueState*
ValueStateManager::AssumeSymGT(const ValueState* St, SymbolID sym,
const GRState*
GRStateManager::AssumeSymGT(const GRState* St, SymbolID sym,
const llvm::APSInt& V, bool& isFeasible) {
// FIXME: For now have assuming x > y be the same as assuming sym != V;
return AssumeSymNE(St, sym, V, isFeasible);
}
const ValueState*
ValueStateManager::AssumeSymGE(const ValueState* St, SymbolID sym,
const GRState*
GRStateManager::AssumeSymGE(const GRState* St, SymbolID sym,
const llvm::APSInt& V, bool& isFeasible) {
// FIXME: Primitive logic for now. Only reject a path if the value of
@ -557,8 +557,8 @@ ValueStateManager::AssumeSymGE(const ValueState* St, SymbolID sym,
return St;
}
const ValueState*
ValueStateManager::AssumeSymLE(const ValueState* St, SymbolID sym,
const GRState*
GRStateManager::AssumeSymLE(const GRState* St, SymbolID sym,
const llvm::APSInt& V, bool& isFeasible) {
// FIXME: Primitive logic for now. Only reject a path if the value of