microsoft
/
clang
зеркало из https://github.com/microsoft/clang.git
1
0
Форкнуть 0
Код Задачи Пакеты Проекты Релизы Вики Активность

Revert 95541. 

git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@95545 91177308-0d34-0410-b5e6-96231b3b80d8
This commit is contained in:
Ted Kremenek 2010-02-08 16:18:51 +00:00
Родитель d819f74fb5
Коммит 1397663af9
29 изменённых файлов: 133 добавлений и 138 удалений
Показать статистику Скачать Patch файл Скачать Diff файл Показать все файлы Свернуть все файлы

20
include/clang/Checker/PathSensitive/GRState.h
Просмотреть файл

@ -252,15 +252,15 @@ public:
const llvm::APSInt *getSymVal(SymbolRef sym) const; const llvm::APSInt *getSymVal(SymbolRef sym) const;
SVal getExprVal(const Stmt* Ex) const; SVal getSVal(const Stmt* Ex) const;
SVal getExprValAsScalarOrLoc(const Stmt *Ex) const; SVal getSValAsScalarOrLoc(const Stmt *Ex) const;
SVal Load(Loc LV, QualType T = QualType()) const; SVal getSVal(Loc LV, QualType T = QualType()) const;
SVal Load(const MemRegion* R) const; SVal getSVal(const MemRegion* R) const;
SVal LoadAsScalarOrLoc(const MemRegion *R) const; SVal getSValAsScalarOrLoc(const MemRegion *R) const;
const llvm::APSInt *getSymVal(SymbolRef sym); const llvm::APSInt *getSymVal(SymbolRef sym);
@ -661,25 +661,25 @@ inline const llvm::APSInt *GRState::getSymVal(SymbolRef sym) const {
return getStateManager().getSymVal(this, sym); return getStateManager().getSymVal(this, sym);
} }
inline SVal GRState::getExprVal(const Stmt* Ex) const { inline SVal GRState::getSVal(const Stmt* Ex) const {
return Env.GetSVal(Ex, getStateManager().ValueMgr); return Env.GetSVal(Ex, getStateManager().ValueMgr);
} }
inline SVal GRState::getExprValAsScalarOrLoc(const Stmt *S) const { inline SVal GRState::getSValAsScalarOrLoc(const Stmt *S) const {
if (const Expr *Ex = dyn_cast<Expr>(S)) { if (const Expr *Ex = dyn_cast<Expr>(S)) {
QualType T = Ex->getType(); QualType T = Ex->getType();
if (Loc::IsLocType(T) || T->isIntegerType()) if (Loc::IsLocType(T) || T->isIntegerType())
return getExprVal(S); return getSVal(S);
} }
return UnknownVal(); return UnknownVal();
} }
inline SVal GRState::Load(Loc LV, QualType T) const { inline SVal GRState::getSVal(Loc LV, QualType T) const {
return getStateManager().StoreMgr->Retrieve(St, LV, T); return getStateManager().StoreMgr->Retrieve(St, LV, T);
} }
inline SVal GRState::Load(const MemRegion* R) const { inline SVal GRState::getSVal(const MemRegion* R) const {
return getStateManager().StoreMgr->Retrieve(St, loc::MemRegionVal(R)); return getStateManager().StoreMgr->Retrieve(St, loc::MemRegionVal(R));
} }

4
lib/Checker/AdjustedReturnValueChecker.cpp
Просмотреть файл

@ -49,7 +49,7 @@ void AdjustedReturnValueChecker::PostVisitCallExpr(CheckerContext &C,
// Fetch the signature of the called function. // Fetch the signature of the called function.
const GRState *state = C.getState(); const GRState *state = C.getState();
SVal V = state->getExprVal(CE); SVal V = state->getSVal(CE);
if (V.isUnknown()) if (V.isUnknown())
return; return;
@ -60,7 +60,7 @@ void AdjustedReturnValueChecker::PostVisitCallExpr(CheckerContext &C,
return; return;
} }
const MemRegion *callee = state->getExprVal(CE->getCallee()).getAsRegion(); const MemRegion *callee = state->getSVal(CE->getCallee()).getAsRegion();
if (!callee) if (!callee)
return; return;

4
lib/Checker/AttrNonNullChecker.cpp
Просмотреть файл

@ -41,7 +41,7 @@ void AttrNonNullChecker::PreVisitCallExpr(CheckerContext &C,
const GRState *state = C.getState(); const GRState *state = C.getState();
// Check if the callee has a 'nonnull' attribute. // Check if the callee has a 'nonnull' attribute.
SVal X = state->getExprVal(CE->getCallee()); SVal X = state->getSVal(CE->getCallee());
const FunctionDecl* FD = X.getAsFunctionDecl(); const FunctionDecl* FD = X.getAsFunctionDecl();
if (!FD) if (!FD)
@ -60,7 +60,7 @@ void AttrNonNullChecker::PreVisitCallExpr(CheckerContext &C,
if (!Att->isNonNull(idx)) if (!Att->isNonNull(idx))
continue; continue;
const SVal &V = state->getExprVal(*I); const SVal &V = state->getSVal(*I);
const DefinedSVal *DV = dyn_cast<DefinedSVal>(&V); const DefinedSVal *DV = dyn_cast<DefinedSVal>(&V);
if (!DV) if (!DV)

10
lib/Checker/BasicObjCFoundationChecks.cpp
Просмотреть файл

@ -135,7 +135,7 @@ bool BasicObjCFoundationChecks::CheckNilArg(ExplodedNode* N, unsigned Arg) {
const Expr * E = ME->getArg(Arg); const Expr * E = ME->getArg(Arg);
if (isNil(N->getState()->getExprVal(E))) { if (isNil(N->getState()->getSVal(E))) {
WarnNilArg(N, ME, Arg); WarnNilArg(N, ME, Arg);
return true; return true;
} }
@ -349,14 +349,14 @@ bool AuditCFNumberCreate::Audit(ExplodedNode* N,GRStateManager&){
const CallExpr* CE = const CallExpr* CE =
cast<CallExpr>(cast<PostStmt>(N->getLocation()).getStmt()); cast<CallExpr>(cast<PostStmt>(N->getLocation()).getStmt());
const Expr* Callee = CE->getCallee(); const Expr* Callee = CE->getCallee();
SVal CallV = N->getState()->getExprVal(Callee); SVal CallV = N->getState()->getSVal(Callee);
const FunctionDecl* FD = CallV.getAsFunctionDecl(); const FunctionDecl* FD = CallV.getAsFunctionDecl();
if (!FD || FD->getIdentifier() != II || CE->getNumArgs()!=3) if (!FD || FD->getIdentifier() != II || CE->getNumArgs()!=3)
return false; return false;
// Get the value of the "theType" argument. // Get the value of the "theType" argument.
SVal TheTypeVal = N->getState()->getExprVal(CE->getArg(1)); SVal TheTypeVal = N->getState()->getSVal(CE->getArg(1));
// FIXME: We really should allow ranges of valid theType values, and // FIXME: We really should allow ranges of valid theType values, and
// bifurcate the state appropriately. // bifurcate the state appropriately.
@ -375,7 +375,7 @@ bool AuditCFNumberCreate::Audit(ExplodedNode* N,GRStateManager&){
// Look at the value of the integer being passed by reference. Essentially // Look at the value of the integer being passed by reference. Essentially
// we want to catch cases where the value passed in is not equal to the // we want to catch cases where the value passed in is not equal to the
// size of the type being created. // size of the type being created.
SVal TheValueExpr = N->getState()->getExprVal(CE->getArg(2)); SVal TheValueExpr = N->getState()->getSVal(CE->getArg(2));
// FIXME: Eventually we should handle arbitrary locations. We can do this // FIXME: Eventually we should handle arbitrary locations. We can do this
// by having an enhanced memory model that does low-level typing. // by having an enhanced memory model that does low-level typing.
@ -482,7 +482,7 @@ bool AuditCFRetainRelease::Audit(ExplodedNode* N, GRStateManager&) {
// Check if we called CFRetain/CFRelease. // Check if we called CFRetain/CFRelease.
const GRState* state = N->getState(); const GRState* state = N->getState();
SVal X = state->getExprVal(CE->getCallee()); SVal X = state->getSVal(CE->getCallee());
const FunctionDecl* FD = X.getAsFunctionDecl(); const FunctionDecl* FD = X.getAsFunctionDecl();
if (!FD) if (!FD)

4
lib/Checker/BugReporter.cpp
Просмотреть файл

@ -350,7 +350,7 @@ GetMostRecentVarDeclBinding(const ExplodedNode* N,
if (!DR) if (!DR)
continue; continue;
SVal Y = N->getState()->getExprVal(DR); SVal Y = N->getState()->getSVal(DR);
if (X != Y) if (X != Y)
continue; continue;
@ -394,7 +394,7 @@ public:
return true; return true;
// Check if the previous state has this binding. // Check if the previous state has this binding.
SVal X = PrevSt->Load(loc::MemRegionVal(R)); SVal X = PrevSt->getSVal(loc::MemRegionVal(R));
if (X == V) // Same binding? if (X == V) // Same binding?
return true; return true;

6
lib/Checker/BugReporterVisitors.cpp
Просмотреть файл

@ -113,7 +113,7 @@ public:
} }
} }
if (Node->getState()->Load(R) != V) if (Node->getState()->getSVal(R) != V)
break; break;
} }
@ -319,7 +319,7 @@ void clang::bugreporter::registerTrackNullOrUndefValue(BugReporterContext& BRC,
StateMgr.getRegionManager().getVarRegion(VD, N->getLocationContext()); StateMgr.getRegionManager().getVarRegion(VD, N->getLocationContext());
// What did we load? // What did we load?
SVal V = state->getExprVal(S); SVal V = state->getSVal(S);
if (isa<loc::ConcreteInt>(V) || isa<nonloc::ConcreteInt>(V) if (isa<loc::ConcreteInt>(V) || isa<nonloc::ConcreteInt>(V)
|| V.isUndef()) { || V.isUndef()) {
@ -328,7 +328,7 @@ void clang::bugreporter::registerTrackNullOrUndefValue(BugReporterContext& BRC,
} }
} }
SVal V = state->getExprValAsScalarOrLoc(S); SVal V = state->getSValAsScalarOrLoc(S);
// Uncomment this to find cases where we aren't properly getting the // Uncomment this to find cases where we aren't properly getting the
// base value that was dereferenced. // base value that was dereferenced.

6
lib/Checker/BuiltinFunctionChecker.cpp
Просмотреть файл

@ -35,7 +35,7 @@ void clang::RegisterBuiltinFunctionChecker(GRExprEngine &Eng) {
bool BuiltinFunctionChecker::EvalCallExpr(CheckerContext &C,const CallExpr *CE){ bool BuiltinFunctionChecker::EvalCallExpr(CheckerContext &C,const CallExpr *CE){
const GRState *state = C.getState(); const GRState *state = C.getState();
const Expr *Callee = CE->getCallee(); const Expr *Callee = CE->getCallee();
SVal L = state->getExprVal(Callee); SVal L = state->getSVal(Callee);
const FunctionDecl *FD = L.getAsFunctionDecl(); const FunctionDecl *FD = L.getAsFunctionDecl();
if (!FD) if (!FD)
@ -50,7 +50,7 @@ bool BuiltinFunctionChecker::EvalCallExpr(CheckerContext &C,const CallExpr *CE){
case Builtin::BI__builtin_expect: { case Builtin::BI__builtin_expect: {
// For __builtin_expect, just return the value of the subexpression. // For __builtin_expect, just return the value of the subexpression.
assert (CE->arg_begin() != CE->arg_end()); assert (CE->arg_begin() != CE->arg_end());
SVal X = state->getExprVal(*(CE->arg_begin())); SVal X = state->getSVal(*(CE->arg_begin()));
C.GenerateNode(state->BindExpr(CE, X)); C.GenerateNode(state->BindExpr(CE, X));
return true; return true;
} }
@ -65,7 +65,7 @@ bool BuiltinFunctionChecker::EvalCallExpr(CheckerContext &C,const CallExpr *CE){
// Set the extent of the region in bytes. This enables us to use the // Set the extent of the region in bytes. This enables us to use the
// SVal of the argument directly. If we save the extent in bits, we // SVal of the argument directly. If we save the extent in bits, we
// cannot represent values like symbol*8. // cannot represent values like symbol*8.
SVal Extent = state->getExprVal(*(CE->arg_begin())); SVal Extent = state->getSVal(*(CE->arg_begin()));
state = C.getStoreManager().setExtent(state, R, Extent); state = C.getStoreManager().setExtent(state, R, Extent);
C.GenerateNode(state->BindExpr(CE, loc::MemRegionVal(R))); C.GenerateNode(state->BindExpr(CE, loc::MemRegionVal(R)));
return true; return true;

31
lib/Checker/CFRefCount.cpp
Просмотреть файл

@ -1399,7 +1399,7 @@ RetainSummaryManager::getInstanceMethodSummary(const ObjCMessageExpr *ME,
// FIXME: Is this really working as expected? There are cases where // FIXME: Is this really working as expected? There are cases where
// we just use the 'ID' from the message expression. // we just use the 'ID' from the message expression.
SVal receiverV = state->getExprValAsScalarOrLoc(Receiver); SVal receiverV = state->getSValAsScalarOrLoc(Receiver);
// FIXME: Eventually replace the use of state->get<RefBindings> with // FIXME: Eventually replace the use of state->get<RefBindings> with
// a generic API for reasoning about the Objective-C types of symbolic // a generic API for reasoning about the Objective-C types of symbolic
@ -1428,7 +1428,7 @@ RetainSummaryManager::getInstanceMethodSummary(const ObjCMessageExpr *ME,
if (const loc::MemRegionVal *L = dyn_cast<loc::MemRegionVal>(&receiverV)) { if (const loc::MemRegionVal *L = dyn_cast<loc::MemRegionVal>(&receiverV)) {
// Get the region associated with 'self'. // Get the region associated with 'self'.
if (const ImplicitParamDecl *SelfDecl = LC->getSelfDecl()) { if (const ImplicitParamDecl *SelfDecl = LC->getSelfDecl()) {
SVal SelfVal = state->Load(state->getRegion(SelfDecl, LC)); SVal SelfVal = state->getSVal(state->getRegion(SelfDecl, LC));
if (L->StripCasts() == SelfVal.getAsRegion()) { if (L->StripCasts() == SelfVal.getAsRegion()) {
// Update the summary to make the default argument effect // Update the summary to make the default argument effect
// 'StopTracking'. // 'StopTracking'.
@ -2140,7 +2140,7 @@ PathDiagnosticPiece* CFRefReport::VisitNode(const ExplodedNode* N,
if (const CallExpr *CE = dyn_cast<CallExpr>(S)) { if (const CallExpr *CE = dyn_cast<CallExpr>(S)) {
// Get the name of the callee (if it is available). // Get the name of the callee (if it is available).
SVal X = CurrSt->getExprValAsScalarOrLoc(CE->getCallee()); SVal X = CurrSt->getSValAsScalarOrLoc(CE->getCallee());
if (const FunctionDecl* FD = X.getAsFunctionDecl()) if (const FunctionDecl* FD = X.getAsFunctionDecl())
os << "Call to function '" << FD->getNameAsString() <<'\''; os << "Call to function '" << FD->getNameAsString() <<'\'';
else else
@ -2197,7 +2197,7 @@ PathDiagnosticPiece* CFRefReport::VisitNode(const ExplodedNode* N,
// Retrieve the value of the argument. Is it the symbol // Retrieve the value of the argument. Is it the symbol
// we are interested in? // we are interested in?
if (CurrSt->getExprValAsScalarOrLoc(*AI).getAsLocSymbol() != Sym) if (CurrSt->getSValAsScalarOrLoc(*AI).getAsLocSymbol() != Sym)
continue; continue;
// We have an argument. Get the effect! // We have an argument. Get the effect!
@ -2206,7 +2206,7 @@ PathDiagnosticPiece* CFRefReport::VisitNode(const ExplodedNode* N,
} }
else if (const ObjCMessageExpr *ME = dyn_cast<ObjCMessageExpr>(S)) { else if (const ObjCMessageExpr *ME = dyn_cast<ObjCMessageExpr>(S)) {
if (const Expr *receiver = ME->getReceiver()) if (const Expr *receiver = ME->getReceiver())
if (CurrSt->getExprValAsScalarOrLoc(receiver).getAsLocSymbol() == Sym) { if (CurrSt->getSValAsScalarOrLoc(receiver).getAsLocSymbol() == Sym) {
// The symbol we are tracking is the receiver. // The symbol we are tracking is the receiver.
AEffects.push_back(Summ->getReceiverEffect()); AEffects.push_back(Summ->getReceiverEffect());
} }
@ -2234,7 +2234,7 @@ PathDiagnosticPiece* CFRefReport::VisitNode(const ExplodedNode* N,
if (contains(AEffects, MakeCollectable)) { if (contains(AEffects, MakeCollectable)) {
// Get the name of the function. // Get the name of the function.
const Stmt* S = cast<PostStmt>(N->getLocation()).getStmt(); const Stmt* S = cast<PostStmt>(N->getLocation()).getStmt();
SVal X = CurrSt->getExprValAsScalarOrLoc(cast<CallExpr>(S)->getCallee()); SVal X = CurrSt->getSValAsScalarOrLoc(cast<CallExpr>(S)->getCallee());
const FunctionDecl* FD = X.getAsFunctionDecl(); const FunctionDecl* FD = X.getAsFunctionDecl();
const std::string& FName = FD->getNameAsString(); const std::string& FName = FD->getNameAsString();
@ -2346,7 +2346,7 @@ PathDiagnosticPiece* CFRefReport::VisitNode(const ExplodedNode* N,
for (Stmt::const_child_iterator I = S->child_begin(), E = S->child_end(); for (Stmt::const_child_iterator I = S->child_begin(), E = S->child_end();
I!=E; ++I) I!=E; ++I)
if (const Expr* Exp = dyn_cast_or_null<Expr>(*I)) if (const Expr* Exp = dyn_cast_or_null<Expr>(*I))
if (CurrSt->getExprValAsScalarOrLoc(Exp).getAsLocSymbol() == Sym) { if (CurrSt->getSValAsScalarOrLoc(Exp).getAsLocSymbol() == Sym) {
P->addRange(Exp->getSourceRange()); P->addRange(Exp->getSourceRange());
break; break;
} }
@ -2597,7 +2597,7 @@ void CFRefCount::EvalSummary(ExplodedNodeSet& Dst,
llvm::SmallVector<const MemRegion*, 10> RegionsToInvalidate; llvm::SmallVector<const MemRegion*, 10> RegionsToInvalidate;
for (ExprIterator I = arg_beg; I != arg_end; ++I, ++idx) { for (ExprIterator I = arg_beg; I != arg_end; ++I, ++idx) {
SVal V = state->getExprValAsScalarOrLoc(*I); SVal V = state->getSValAsScalarOrLoc(*I);
SymbolRef Sym = V.getAsLocSymbol(); SymbolRef Sym = V.getAsLocSymbol();
if (Sym) if (Sym)
@ -2698,7 +2698,7 @@ void CFRefCount::EvalSummary(ExplodedNodeSet& Dst,
// Evaluate the effect on the message receiver. // Evaluate the effect on the message receiver.
if (!ErrorExpr && Receiver) { if (!ErrorExpr && Receiver) {
SymbolRef Sym = state->getExprValAsScalarOrLoc(Receiver).getAsLocSymbol(); SymbolRef Sym = state->getSValAsScalarOrLoc(Receiver).getAsLocSymbol();
if (Sym) { if (Sym) {
if (const RefVal* T = state->get<RefBindings>(Sym)) { if (const RefVal* T = state->get<RefBindings>(Sym)) {
state = Update(state, Sym, *T, Summ.getReceiverEffect(), hasErr); state = Update(state, Sym, *T, Summ.getReceiverEffect(), hasErr);
@ -2722,7 +2722,7 @@ void CFRefCount::EvalSummary(ExplodedNodeSet& Dst,
if (RE.getKind() == RetEffect::OwnedWhenTrackedReceiver) { if (RE.getKind() == RetEffect::OwnedWhenTrackedReceiver) {
assert(Receiver); assert(Receiver);
SVal V = state->getExprValAsScalarOrLoc(Receiver); SVal V = state->getSValAsScalarOrLoc(Receiver);
bool found = false; bool found = false;
if (SymbolRef Sym = V.getAsLocSymbol()) if (SymbolRef Sym = V.getAsLocSymbol())
if (state->get<RefBindings>(Sym)) { if (state->get<RefBindings>(Sym)) {
@ -2751,8 +2751,7 @@ void CFRefCount::EvalSummary(ExplodedNodeSet& Dst,
// For CallExpr, use the result type to know if it returns a reference. // For CallExpr, use the result type to know if it returns a reference.
if (const CallExpr *CE = dyn_cast<CallExpr>(Ex)) { if (const CallExpr *CE = dyn_cast<CallExpr>(Ex)) {
const Expr *Callee = CE->getCallee(); const Expr *Callee = CE->getCallee();
if (const FunctionDecl *FD = if (const FunctionDecl *FD = state->getSVal(Callee).getAsFunctionDecl())
state->getExprVal(Callee).getAsFunctionDecl())
T = FD->getResultType(); T = FD->getResultType();
} }
else if (const ObjCMessageExpr *ME = dyn_cast<ObjCMessageExpr>(Ex)) { else if (const ObjCMessageExpr *ME = dyn_cast<ObjCMessageExpr>(Ex)) {
@ -2774,14 +2773,14 @@ void CFRefCount::EvalSummary(ExplodedNodeSet& Dst,
unsigned idx = RE.getIndex(); unsigned idx = RE.getIndex();
assert (arg_end >= arg_beg); assert (arg_end >= arg_beg);
assert (idx < (unsigned) (arg_end - arg_beg)); assert (idx < (unsigned) (arg_end - arg_beg));
SVal V = state->getExprValAsScalarOrLoc(*(arg_beg+idx)); SVal V = state->getSValAsScalarOrLoc(*(arg_beg+idx));
state = state->BindExpr(Ex, V, false); state = state->BindExpr(Ex, V, false);
break; break;
} }
case RetEffect::ReceiverAlias: { case RetEffect::ReceiverAlias: {
assert (Receiver); assert (Receiver);
SVal V = state->getExprValAsScalarOrLoc(Receiver); SVal V = state->getSValAsScalarOrLoc(Receiver);
state = state->BindExpr(Ex, V, false); state = state->BindExpr(Ex, V, false);
break; break;
} }
@ -2938,7 +2937,7 @@ void CFRefCount::EvalReturn(ExplodedNodeSet& Dst,
return; return;
const GRState *state = Builder.GetState(Pred); const GRState *state = Builder.GetState(Pred);
SymbolRef Sym = state->getExprValAsScalarOrLoc(RetE).getAsLocSymbol(); SymbolRef Sym = state->getSValAsScalarOrLoc(RetE).getAsLocSymbol();
if (!Sym) if (!Sym)
return; return;
@ -3493,7 +3492,7 @@ void RetainReleaseChecker::PostVisitBlockExpr(CheckerContext &C,
const GRState *state = C.getState(); const GRState *state = C.getState();
const BlockDataRegion *R = const BlockDataRegion *R =
cast<BlockDataRegion>(state->getExprVal(BE).getAsRegion()); cast<BlockDataRegion>(state->getSVal(BE).getAsRegion());
BlockDataRegion::referenced_vars_iterator I = R->referenced_vars_begin(), BlockDataRegion::referenced_vars_iterator I = R->referenced_vars_begin(),
E = R->referenced_vars_end(); E = R->referenced_vars_end();

8
lib/Checker/CallAndMessageChecker.cpp
Просмотреть файл

@ -73,7 +73,7 @@ void CallAndMessageChecker::PreVisitCallExpr(CheckerContext &C,
const CallExpr *CE){ const CallExpr *CE){
const Expr *Callee = CE->getCallee()->IgnoreParens(); const Expr *Callee = CE->getCallee()->IgnoreParens();
SVal L = C.getState()->getExprVal(Callee); SVal L = C.getState()->getSVal(Callee);
if (L.isUndef()) { if (L.isUndef()) {
if (!BT_call_undef) if (!BT_call_undef)
@ -92,7 +92,7 @@ void CallAndMessageChecker::PreVisitCallExpr(CheckerContext &C,
for (CallExpr::const_arg_iterator I = CE->arg_begin(), E = CE->arg_end(); for (CallExpr::const_arg_iterator I = CE->arg_begin(), E = CE->arg_end();
I != E; ++I) { I != E; ++I) {
if (C.getState()->getExprVal(*I).isUndef()) { if (C.getState()->getSVal(*I).isUndef()) {
if (ExplodedNode *N = C.GenerateSink()) { if (ExplodedNode *N = C.GenerateSink()) {
if (!BT_call_arg) if (!BT_call_arg)
BT_call_arg = new BuiltinBug("Pass-by-value argument in function call" BT_call_arg = new BuiltinBug("Pass-by-value argument in function call"
@ -115,7 +115,7 @@ void CallAndMessageChecker::PreVisitObjCMessageExpr(CheckerContext &C,
const GRState *state = C.getState(); const GRState *state = C.getState();
if (const Expr *receiver = ME->getReceiver()) if (const Expr *receiver = ME->getReceiver())
if (state->getExprVal(receiver).isUndef()) { if (state->getSVal(receiver).isUndef()) {
if (ExplodedNode *N = C.GenerateSink()) { if (ExplodedNode *N = C.GenerateSink()) {
if (!BT_msg_undef) if (!BT_msg_undef)
BT_msg_undef = BT_msg_undef =
@ -133,7 +133,7 @@ void CallAndMessageChecker::PreVisitObjCMessageExpr(CheckerContext &C,
// Check for any arguments that are uninitialized/undefined. // Check for any arguments that are uninitialized/undefined.
for (ObjCMessageExpr::const_arg_iterator I = ME->arg_begin(), for (ObjCMessageExpr::const_arg_iterator I = ME->arg_begin(),
E = ME->arg_end(); I != E; ++I) { E = ME->arg_end(); I != E; ++I) {
if (state->getExprVal(*I).isUndef()) { if (state->getSVal(*I).isUndef()) {
if (ExplodedNode *N = C.GenerateSink()) { if (ExplodedNode *N = C.GenerateSink()) {
if (!BT_msg_arg) if (!BT_msg_arg)
BT_msg_arg = BT_msg_arg =

2
lib/Checker/CallInliner.cpp
Просмотреть файл

@ -37,7 +37,7 @@ void clang::RegisterCallInliner(GRExprEngine &Eng) {
bool CallInliner::EvalCallExpr(CheckerContext &C, const CallExpr *CE) { bool CallInliner::EvalCallExpr(CheckerContext &C, const CallExpr *CE) {
const GRState *state = C.getState(); const GRState *state = C.getState();
const Expr *Callee = CE->getCallee(); const Expr *Callee = CE->getCallee();
SVal L = state->getExprVal(Callee); SVal L = state->getSVal(Callee);
const FunctionDecl *FD = L.getAsFunctionDecl(); const FunctionDecl *FD = L.getAsFunctionDecl();
if (!FD) if (!FD)

2
lib/Checker/DivZeroChecker.cpp
Просмотреть файл

@ -49,7 +49,7 @@ void DivZeroChecker::PreVisitBinaryOperator(CheckerContext &C,
!B->getRHS()->getType()->isScalarType()) !B->getRHS()->getType()->isScalarType())
return; return;
SVal Denom = C.getState()->getExprVal(B->getRHS()); SVal Denom = C.getState()->getSVal(B->getRHS());
const DefinedSVal *DV = dyn_cast<DefinedSVal>(&Denom); const DefinedSVal *DV = dyn_cast<DefinedSVal>(&Denom);
// Divide-by-undefined handled in the generic checking for uses of // Divide-by-undefined handled in the generic checking for uses of

2
lib/Checker/FixedAddressChecker.cpp
Просмотреть файл

@ -48,7 +48,7 @@ void FixedAddressChecker::PreVisitBinaryOperator(CheckerContext &C,
const GRState *state = C.getState(); const GRState *state = C.getState();
SVal RV = state->getExprVal(B->getRHS()); SVal RV = state->getSVal(B->getRHS());
if (!RV.isConstant() || RV.isZeroConstant()) if (!RV.isConstant() || RV.isZeroConstant())
return; return;

94
lib/Checker/GRExprEngine.cpp
Просмотреть файл

@ -392,7 +392,7 @@ const GRState* GRExprEngine::getInitialState(const LocationContext *InitLoc) {
if (!R) if (!R)
break; break;
SVal V = state->Load(loc::MemRegionVal(R)); SVal V = state->getSVal(loc::MemRegionVal(R));
SVal Constraint_untested = EvalBinOp(state, BinaryOperator::GT, V, SVal Constraint_untested = EvalBinOp(state, BinaryOperator::GT, V,
ValMgr.makeZeroVal(T), ValMgr.makeZeroVal(T),
getContext().IntTy); getContext().IntTy);
@ -414,7 +414,7 @@ const GRState* GRExprEngine::getInitialState(const LocationContext *InitLoc) {
// method. // method.
const ImplicitParamDecl *SelfD = MD->getSelfDecl(); const ImplicitParamDecl *SelfD = MD->getSelfDecl();
const MemRegion *R = state->getRegion(SelfD, InitLoc); const MemRegion *R = state->getRegion(SelfD, InitLoc);
SVal V = state->Load(loc::MemRegionVal(R)); SVal V = state->getSVal(loc::MemRegionVal(R));
if (const Loc *LV = dyn_cast<Loc>(&V)) { if (const Loc *LV = dyn_cast<Loc>(&V)) {
// Assume that the pointer value in 'self' is non-null. // Assume that the pointer value in 'self' is non-null.
@ -633,8 +633,7 @@ void GRExprEngine::Visit(Stmt* S, ExplodedNode* Pred, ExplodedNodeSet& Dst) {
} }
else if (B->getOpcode() == BinaryOperator::Comma) { else if (B->getOpcode() == BinaryOperator::Comma) {
const GRState* state = GetState(Pred); const GRState* state = GetState(Pred);
MakeNode(Dst, B, Pred, state->BindExpr(B, MakeNode(Dst, B, Pred, state->BindExpr(B, state->getSVal(B->getRHS())));
state->getExprVal(B->getRHS())));
break; break;
} }
@ -765,8 +764,7 @@ void GRExprEngine::Visit(Stmt* S, ExplodedNode* Pred, ExplodedNodeSet& Dst) {
if (Expr* LastExpr = dyn_cast<Expr>(*SE->getSubStmt()->body_rbegin())) { if (Expr* LastExpr = dyn_cast<Expr>(*SE->getSubStmt()->body_rbegin())) {
const GRState* state = GetState(Pred); const GRState* state = GetState(Pred);
MakeNode(Dst, SE, Pred, state->BindExpr(SE, MakeNode(Dst, SE, Pred, state->BindExpr(SE, state->getSVal(LastExpr)));
state->getExprVal(LastExpr)));
} }
else else
Dst.Add(Pred); Dst.Add(Pred);
@ -1045,7 +1043,7 @@ static SVal RecoverCastedSymbol(GRStateManager& StateMgr, const GRState* state,
if (!bitsInit || !T->isIntegerType() || Ctx.getTypeSize(T) > bits) if (!bitsInit || !T->isIntegerType() || Ctx.getTypeSize(T) > bits)
return UnknownVal(); return UnknownVal();
return state->getExprVal(Ex); return state->getSVal(Ex);
} }
void GRExprEngine::ProcessBranch(Stmt* Condition, Stmt* Term, void GRExprEngine::ProcessBranch(Stmt* Condition, Stmt* Term,
@ -1072,7 +1070,7 @@ void GRExprEngine::ProcessBranch(Stmt* Condition, Stmt* Term,
return; return;
const GRState* PrevState = builder.getState(); const GRState* PrevState = builder.getState();
SVal X = PrevState->getExprVal(Condition); SVal X = PrevState->getSVal(Condition);
if (X.isUnknown()) { if (X.isUnknown()) {
// Give it a chance to recover from unknown. // Give it a chance to recover from unknown.
@ -1123,7 +1121,7 @@ void GRExprEngine::ProcessBranch(Stmt* Condition, Stmt* Term,
void GRExprEngine::ProcessIndirectGoto(GRIndirectGotoNodeBuilder& builder) { void GRExprEngine::ProcessIndirectGoto(GRIndirectGotoNodeBuilder& builder) {
const GRState *state = builder.getState(); const GRState *state = builder.getState();
SVal V = state->getExprVal(builder.getTarget()); SVal V = state->getSVal(builder.getTarget());
// Three possibilities: // Three possibilities:
// //
@ -1171,13 +1169,13 @@ void GRExprEngine::VisitGuardedExpr(Expr* Ex, Expr* L, Expr* R,
Pred->getLocationContext()->getCFG()->isBlkExpr(Ex)); Pred->getLocationContext()->getCFG()->isBlkExpr(Ex));
const GRState* state = GetState(Pred); const GRState* state = GetState(Pred);
SVal X = state->getExprVal(Ex); SVal X = state->getSVal(Ex);
assert (X.isUndef()); assert (X.isUndef());
Expr *SE = (Expr*) cast<UndefinedVal>(X).getData(); Expr *SE = (Expr*) cast<UndefinedVal>(X).getData();
assert(SE); assert(SE);
X = state->getExprVal(SE); X = state->getSVal(SE);
// Make sure that we invalidate the previous binding. // Make sure that we invalidate the previous binding.
MakeNode(Dst, Ex, Pred, state->BindExpr(Ex, X, true)); MakeNode(Dst, Ex, Pred, state->BindExpr(Ex, X, true));
@ -1201,7 +1199,7 @@ void GRExprEngine::ProcessSwitch(GRSwitchNodeBuilder& builder) {
typedef GRSwitchNodeBuilder::iterator iterator; typedef GRSwitchNodeBuilder::iterator iterator;
const GRState* state = builder.getState(); const GRState* state = builder.getState();
Expr* CondE = builder.getCondition(); Expr* CondE = builder.getCondition();
SVal CondV_untested = state->getExprVal(CondE); SVal CondV_untested = state->getSVal(CondE);
if (CondV_untested.isUndef()) { if (CondV_untested.isUndef()) {
//ExplodedNode* N = builder.generateDefaultCaseNode(state, true); //ExplodedNode* N = builder.generateDefaultCaseNode(state, true);
@ -1302,14 +1300,14 @@ void GRExprEngine::VisitLogicalExpr(BinaryOperator* B, ExplodedNode* Pred,
assert(B==CurrentStmt && Pred->getLocationContext()->getCFG()->isBlkExpr(B)); assert(B==CurrentStmt && Pred->getLocationContext()->getCFG()->isBlkExpr(B));
const GRState* state = GetState(Pred); const GRState* state = GetState(Pred);
SVal X = state->getExprVal(B); SVal X = state->getSVal(B);
assert(X.isUndef()); assert(X.isUndef());
const Expr *Ex = (const Expr*) cast<UndefinedVal>(X).getData(); const Expr *Ex = (const Expr*) cast<UndefinedVal>(X).getData();
assert(Ex); assert(Ex);
if (Ex == B->getRHS()) { if (Ex == B->getRHS()) {
X = state->getExprVal(Ex); X = state->getSVal(Ex);
// Handle undefined values. // Handle undefined values.
if (X.isUndef()) { if (X.isUndef()) {
@ -1389,7 +1387,7 @@ void GRExprEngine::VisitCommonDeclRefExpr(Expr *Ex, const NamedDecl *D,
// reference region. // reference region.
if (VD->getType()->isReferenceType()) { if (VD->getType()->isReferenceType()) {
if (const MemRegion *R = V.getAsRegion()) if (const MemRegion *R = V.getAsRegion())
V = state->Load(R); V = state->getSVal(R);
else else
V = UnknownVal(); V = UnknownVal();
} }
@ -1448,8 +1446,8 @@ void GRExprEngine::VisitArraySubscriptExpr(ArraySubscriptExpr* A,
for (ExplodedNodeSet::iterator I2=Tmp3.begin(),E2=Tmp3.end();I2!=E2; ++I2) { for (ExplodedNodeSet::iterator I2=Tmp3.begin(),E2=Tmp3.end();I2!=E2; ++I2) {
const GRState* state = GetState(*I2); const GRState* state = GetState(*I2);
SVal V = state->getLValue(A->getType(), state->getExprVal(Idx), SVal V = state->getLValue(A->getType(), state->getSVal(Idx),
state->getExprVal(Base)); state->getSVal(Base));
if (asLValue) if (asLValue)
MakeNode(Dst, A, *I2, state->BindExpr(A, V), MakeNode(Dst, A, *I2, state->BindExpr(A, V),
@ -1481,7 +1479,7 @@ void GRExprEngine::VisitMemberExpr(MemberExpr* M, ExplodedNode* Pred,
// FIXME: Should we insert some assumption logic in here to determine // FIXME: Should we insert some assumption logic in here to determine
// if "Base" is a valid piece of memory? Before we put this assumption // if "Base" is a valid piece of memory? Before we put this assumption
// later when using FieldOffset lvals (which we no longer have). // later when using FieldOffset lvals (which we no longer have).
SVal L = state->getLValue(Field, state->getExprVal(Base)); SVal L = state->getLValue(Field, state->getSVal(Base));
if (asLValue) if (asLValue)
MakeNode(Dst, M, *I, state->BindExpr(M, L), ProgramPoint::PostLValueKind); MakeNode(Dst, M, *I, state->BindExpr(M, L), ProgramPoint::PostLValueKind);
@ -1593,7 +1591,7 @@ void GRExprEngine::EvalLoad(ExplodedNodeSet& Dst, Expr *Ex, ExplodedNode* Pred,
// Perform the load from the referenced value. // Perform the load from the referenced value.
for (ExplodedNodeSet::iterator I=Tmp.begin(), E=Tmp.end() ; I!=E; ++I) { for (ExplodedNodeSet::iterator I=Tmp.begin(), E=Tmp.end() ; I!=E; ++I) {
state = GetState(*I); state = GetState(*I);
location = state->getExprVal(Ex); location = state->getSVal(Ex);
EvalLoadCommon(Dst, Ex, *I, state, location, tag, LoadTy); EvalLoadCommon(Dst, Ex, *I, state, location, tag, LoadTy);
} }
return; return;
@ -1629,7 +1627,7 @@ void GRExprEngine::EvalLoadCommon(ExplodedNodeSet& Dst, Expr *Ex,
ProgramPoint::PostLoadKind, tag); ProgramPoint::PostLoadKind, tag);
} }
else { else {
SVal V = state->Load(cast<Loc>(location), LoadTy.isNull() ? SVal V = state->getSVal(cast<Loc>(location), LoadTy.isNull() ?
Ex->getType() : LoadTy); Ex->getType() : LoadTy);
MakeNode(Dst, Ex, *NI, state->BindExpr(Ex, V), ProgramPoint::PostLoadKind, MakeNode(Dst, Ex, *NI, state->BindExpr(Ex, V), ProgramPoint::PostLoadKind,
tag); tag);
@ -1762,7 +1760,7 @@ void GRExprEngine::VisitCall(CallExpr* CE, ExplodedNode* Pred,
DI != DE; ++DI) { DI != DE; ++DI) {
const GRState* state = GetState(*DI); const GRState* state = GetState(*DI);
SVal L = state->getExprVal(Callee); SVal L = state->getSVal(Callee);
// FIXME: Add support for symbolic function calls (calls involving // FIXME: Add support for symbolic function calls (calls involving
// function pointer values that are symbolic). // function pointer values that are symbolic).
@ -1817,7 +1815,7 @@ void GRExprEngine::VisitCall(CallExpr* CE, ExplodedNode* Pred,
for (ExplodedNodeSet::iterator NI = DstTmp4.begin(), NE = DstTmp4.end(); for (ExplodedNodeSet::iterator NI = DstTmp4.begin(), NE = DstTmp4.end();
NI!=NE; ++NI) { NI!=NE; ++NI) {
const GRState *state = GetState(*NI); const GRState *state = GetState(*NI);
EvalLoad(Dst, CE, *NI, state, state->getExprVal(CE), EvalLoad(Dst, CE, *NI, state, state->getSVal(CE),
&ConvertToRvalueTag, LoadTy); &ConvertToRvalueTag, LoadTy);
} }
} }
@ -1844,7 +1842,7 @@ void GRExprEngine::EvalEagerlyAssume(ExplodedNodeSet &Dst, ExplodedNodeSet &Src,
} }
const GRState* state = Pred->getState(); const GRState* state = Pred->getState();
SVal V = state->getExprVal(Ex); SVal V = state->getSVal(Ex);
if (nonloc::SymExprVal *SEV = dyn_cast<nonloc::SymExprVal>(&V)) { if (nonloc::SymExprVal *SEV = dyn_cast<nonloc::SymExprVal>(&V)) {
// First assume that the condition is true. // First assume that the condition is true.
if (const GRState *stateTrue = state->Assume(*SEV, true)) { if (const GRState *stateTrue = state->Assume(*SEV, true)) {
@ -1882,7 +1880,7 @@ void GRExprEngine::VisitObjCIvarRefExpr(ObjCIvarRefExpr* Ex, ExplodedNode* Pred,
for (ExplodedNodeSet::iterator I=Tmp.begin(), E=Tmp.end(); I!=E; ++I) { for (ExplodedNodeSet::iterator I=Tmp.begin(), E=Tmp.end(); I!=E; ++I) {
const GRState* state = GetState(*I); const GRState* state = GetState(*I);
SVal BaseVal = state->getExprVal(Base); SVal BaseVal = state->getSVal(Base);
SVal location = state->getLValue(Ex->getDecl(), BaseVal); SVal location = state->getLValue(Ex->getDecl(), BaseVal);
if (asLValue) if (asLValue)
@ -1940,7 +1938,7 @@ void GRExprEngine::VisitObjCForCollectionStmt(ObjCForCollectionStmt* S,
for (ExplodedNodeSet::iterator I = Tmp.begin(), E = Tmp.end(); I!=E; ++I) { for (ExplodedNodeSet::iterator I = Tmp.begin(), E = Tmp.end(); I!=E; ++I) {
const GRState* state = GetState(*I); const GRState* state = GetState(*I);
VisitObjCForCollectionStmtAux(S, *I, Dst, state->getExprVal(elem)); VisitObjCForCollectionStmtAux(S, *I, Dst, state->getSVal(elem));
} }
} }
@ -2064,7 +2062,7 @@ void GRExprEngine::VisitObjCMessageExprDispatchHelper(ObjCMessageExpr* ME,
// Bifurcate the state into nil and non-nil ones. // Bifurcate the state into nil and non-nil ones.
DefinedOrUnknownSVal receiverVal = DefinedOrUnknownSVal receiverVal =
cast<DefinedOrUnknownSVal>(state->getExprVal(Receiver)); cast<DefinedOrUnknownSVal>(state->getSVal(Receiver));
const GRState *notNilState, *nilState; const GRState *notNilState, *nilState;
llvm::tie(notNilState, nilState) = state->Assume(receiverVal); llvm::tie(notNilState, nilState) = state->Assume(receiverVal);
@ -2166,7 +2164,7 @@ void GRExprEngine::VisitObjCMessageExprDispatchHelper(ObjCMessageExpr* ME,
NE = DstRValueConvert.end(); NE = DstRValueConvert.end();
NI!=NE; ++NI) { NI!=NE; ++NI) {
const GRState *state = GetState(*NI); const GRState *state = GetState(*NI);
EvalLoad(Dst, ME, *NI, state, state->getExprVal(ME), EvalLoad(Dst, ME, *NI, state, state->getSVal(ME),
&ConvertToRvalueTag, LoadTy); &ConvertToRvalueTag, LoadTy);
} }
} }
@ -2214,7 +2212,7 @@ void GRExprEngine::VisitCast(CastExpr *CastE, Expr *Ex, ExplodedNode *Pred,
// Copy the SVal of Ex to CastE. // Copy the SVal of Ex to CastE.
ExplodedNode *N = *I; ExplodedNode *N = *I;
const GRState *state = GetState(N); const GRState *state = GetState(N);
SVal V = state->getExprVal(Ex); SVal V = state->getSVal(Ex);
state = state->BindExpr(CastE, V); state = state->BindExpr(CastE, V);
MakeNode(Dst, CastE, N, state); MakeNode(Dst, CastE, N, state);
} }
@ -2236,7 +2234,7 @@ void GRExprEngine::VisitCast(CastExpr *CastE, Expr *Ex, ExplodedNode *Pred,
for (ExplodedNodeSet::iterator I = S2.begin(), E = S2.end(); I != E; ++I) { for (ExplodedNodeSet::iterator I = S2.begin(), E = S2.end(); I != E; ++I) {
ExplodedNode* N = *I; ExplodedNode* N = *I;
const GRState* state = GetState(N); const GRState* state = GetState(N);
SVal V = state->getExprVal(Ex); SVal V = state->getSVal(Ex);
V = SVator.EvalCast(V, T, ExTy); V = SVator.EvalCast(V, T, ExTy);
state = state->BindExpr(CastE, V); state = state->BindExpr(CastE, V);
MakeNode(Dst, CastE, N, state); MakeNode(Dst, CastE, N, state);
@ -2259,7 +2257,7 @@ void GRExprEngine::VisitCompoundLiteralExpr(CompoundLiteralExpr* CL,
for (ExplodedNodeSet::iterator I = Tmp.begin(), EI = Tmp.end(); I!=EI; ++I) { for (ExplodedNodeSet::iterator I = Tmp.begin(), EI = Tmp.end(); I!=EI; ++I) {
const GRState* state = GetState(*I); const GRState* state = GetState(*I);
SVal ILV = state->getExprVal(ILE); SVal ILV = state->getSVal(ILE);
const LocationContext *LC = (*I)->getLocationContext(); const LocationContext *LC = (*I)->getLocationContext();
state = state->bindCompoundLiteral(CL, LC, ILV); state = state->bindCompoundLiteral(CL, LC, ILV);
@ -2307,7 +2305,7 @@ void GRExprEngine::VisitDeclStmt(DeclStmt *DS, ExplodedNode *Pred,
const LocationContext *LC = N->getLocationContext(); const LocationContext *LC = N->getLocationContext();
if (InitEx) { if (InitEx) {
SVal InitVal = state->getExprVal(InitEx); SVal InitVal = state->getSVal(InitEx);
// Recover some path-sensitivity if a scalar value evaluated to // Recover some path-sensitivity if a scalar value evaluated to
// UnknownVal. // UnknownVal.
@ -2339,7 +2337,7 @@ void GRExprEngine::VisitCondInit(VarDecl *VD, Stmt *S,
const GRState *state = GetState(N); const GRState *state = GetState(N);
const LocationContext *LC = N->getLocationContext(); const LocationContext *LC = N->getLocationContext();
SVal InitVal = state->getExprVal(InitEx); SVal InitVal = state->getSVal(InitEx);
// Recover some path-sensitivity if a scalar value evaluated to // Recover some path-sensitivity if a scalar value evaluated to
// UnknownVal. // UnknownVal.
@ -2410,7 +2408,7 @@ void GRExprEngine::VisitInitListExpr(InitListExpr* E, ExplodedNode* Pred,
for (ExplodedNodeSet::iterator NI=Tmp.begin(),NE=Tmp.end();NI!=NE;++NI) { for (ExplodedNodeSet::iterator NI=Tmp.begin(),NE=Tmp.end();NI!=NE;++NI) {
// Get the last initializer value. // Get the last initializer value.
state = GetState(*NI); state = GetState(*NI);
SVal InitV = state->getExprVal(cast<Expr>(*X.Itr)); SVal InitV = state->getSVal(cast<Expr>(*X.Itr));
// Construct the new list of values by prepending the new value to // Construct the new list of values by prepending the new value to
// the already constructed list. // the already constructed list.
@ -2441,7 +2439,7 @@ void GRExprEngine::VisitInitListExpr(InitListExpr* E, ExplodedNode* Pred,
Visit(Init, Pred, Tmp); Visit(Init, Pred, Tmp);
for (ExplodedNodeSet::iterator I=Tmp.begin(), EI=Tmp.end(); I != EI; ++I) { for (ExplodedNodeSet::iterator I=Tmp.begin(), EI=Tmp.end(); I != EI; ++I) {
state = GetState(*I); state = GetState(*I);
MakeNode(Dst, E, *I, state->BindExpr(E, state->getExprVal(Init))); MakeNode(Dst, E, *I, state->BindExpr(E, state->getSVal(Init)));
} }
return; return;
} }
@ -2504,7 +2502,7 @@ void GRExprEngine::VisitUnaryOperator(UnaryOperator* U, ExplodedNode* Pred,
for (ExplodedNodeSet::iterator I=Tmp.begin(), E=Tmp.end(); I!=E; ++I) { for (ExplodedNodeSet::iterator I=Tmp.begin(), E=Tmp.end(); I!=E; ++I) {
const GRState* state = GetState(*I); const GRState* state = GetState(*I);
SVal location = state->getExprVal(Ex); SVal location = state->getSVal(Ex);
if (asLValue) if (asLValue)
MakeNode(Dst, U, *I, state->BindExpr(U, location), MakeNode(Dst, U, *I, state->BindExpr(U, location),
@ -2534,7 +2532,7 @@ void GRExprEngine::VisitUnaryOperator(UnaryOperator* U, ExplodedNode* Pred,
// For all other types, UnaryOperator::Real is an identity operation. // For all other types, UnaryOperator::Real is an identity operation.
assert (U->getType() == Ex->getType()); assert (U->getType() == Ex->getType());
const GRState* state = GetState(*I); const GRState* state = GetState(*I);
MakeNode(Dst, U, *I, state->BindExpr(U, state->getExprVal(Ex))); MakeNode(Dst, U, *I, state->BindExpr(U, state->getSVal(Ex)));
} }
return; return;
@ -2594,7 +2592,7 @@ void GRExprEngine::VisitUnaryOperator(UnaryOperator* U, ExplodedNode* Pred,
for (ExplodedNodeSet::iterator I=Tmp.begin(), E=Tmp.end(); I!=E; ++I) { for (ExplodedNodeSet::iterator I=Tmp.begin(), E=Tmp.end(); I!=E; ++I) {
const GRState* state = GetState(*I); const GRState* state = GetState(*I);
MakeNode(Dst, U, *I, state->BindExpr(U, state->getExprVal(Ex))); MakeNode(Dst, U, *I, state->BindExpr(U, state->getSVal(Ex)));
} }
return; return;
@ -2609,7 +2607,7 @@ void GRExprEngine::VisitUnaryOperator(UnaryOperator* U, ExplodedNode* Pred,
for (ExplodedNodeSet::iterator I=Tmp.begin(), E=Tmp.end(); I!=E; ++I) { for (ExplodedNodeSet::iterator I=Tmp.begin(), E=Tmp.end(); I!=E; ++I) {
const GRState* state = GetState(*I); const GRState* state = GetState(*I);
SVal V = state->getExprVal(Ex); SVal V = state->getSVal(Ex);
state = state->BindExpr(U, V); state = state->BindExpr(U, V);
MakeNode(Dst, U, *I, state); MakeNode(Dst, U, *I, state);
} }
@ -2630,7 +2628,7 @@ void GRExprEngine::VisitUnaryOperator(UnaryOperator* U, ExplodedNode* Pred,
const GRState* state = GetState(*I); const GRState* state = GetState(*I);
// Get the value of the subexpression. // Get the value of the subexpression.
SVal V = state->getExprVal(Ex); SVal V = state->getSVal(Ex);
if (V.isUnknownOrUndef()) { if (V.isUnknownOrUndef()) {
MakeNode(Dst, U, *I, state->BindExpr(U, V)); MakeNode(Dst, U, *I, state->BindExpr(U, V));
@ -2704,7 +2702,7 @@ void GRExprEngine::VisitUnaryOperator(UnaryOperator* U, ExplodedNode* Pred,
for (ExplodedNodeSet::iterator I = Tmp.begin(), E = Tmp.end(); I!=E; ++I) { for (ExplodedNodeSet::iterator I = Tmp.begin(), E = Tmp.end(); I!=E; ++I) {
const GRState* state = GetState(*I); const GRState* state = GetState(*I);
SVal V1 = state->getExprVal(Ex); SVal V1 = state->getSVal(Ex);
// Perform a load. // Perform a load.
ExplodedNodeSet Tmp2; ExplodedNodeSet Tmp2;
@ -2713,7 +2711,7 @@ void GRExprEngine::VisitUnaryOperator(UnaryOperator* U, ExplodedNode* Pred,
for (ExplodedNodeSet::iterator I2=Tmp2.begin(), E2=Tmp2.end();I2!=E2;++I2) { for (ExplodedNodeSet::iterator I2=Tmp2.begin(), E2=Tmp2.end();I2!=E2;++I2) {
state = GetState(*I2); state = GetState(*I2);
SVal V2_untested = state->getExprVal(Ex); SVal V2_untested = state->getSVal(Ex);
// Propagate unknown and undefined values. // Propagate unknown and undefined values.
if (V2_untested.isUnknownOrUndef()) { if (V2_untested.isUnknownOrUndef()) {
@ -2782,7 +2780,7 @@ void GRExprEngine::VisitCXXThisExpr(CXXThisExpr *TE, ExplodedNode *Pred,
Pred->getLocationContext()); Pred->getLocationContext());
const GRState *state = GetState(Pred); const GRState *state = GetState(Pred);
SVal V = state->Load(loc::MemRegionVal(R)); SVal V = state->getSVal(loc::MemRegionVal(R));
MakeNode(Dst, TE, Pred, state->BindExpr(TE, V)); MakeNode(Dst, TE, Pred, state->BindExpr(TE, V));
} }
@ -2828,7 +2826,7 @@ void GRExprEngine::VisitAsmStmtHelperInputs(AsmStmt* A,
for (AsmStmt::outputs_iterator OI = A->begin_outputs(), for (AsmStmt::outputs_iterator OI = A->begin_outputs(),
OE = A->end_outputs(); OI != OE; ++OI) { OE = A->end_outputs(); OI != OE; ++OI) {
SVal X = state->getExprVal(*OI); SVal X = state->getSVal(*OI);
assert (!isa<NonLoc>(X)); // Should be an Lval, or unknown, undef. assert (!isa<NonLoc>(X)); // Should be an Lval, or unknown, undef.
if (isa<Loc>(X)) if (isa<Loc>(X))
@ -2908,7 +2906,7 @@ void GRExprEngine::VisitBinaryOperator(BinaryOperator* B,
ExplodedNodeSet Tmp3; ExplodedNodeSet Tmp3;
for (ExplodedNodeSet::iterator I1=Tmp1.begin(), E1=Tmp1.end(); I1!=E1; ++I1) { for (ExplodedNodeSet::iterator I1=Tmp1.begin(), E1=Tmp1.end(); I1!=E1; ++I1) {
SVal LeftV = (*I1)->getState()->getExprVal(LHS); SVal LeftV = (*I1)->getState()->getSVal(LHS);
ExplodedNodeSet Tmp2; ExplodedNodeSet Tmp2;
Visit(RHS, *I1, Tmp2); Visit(RHS, *I1, Tmp2);
@ -2922,7 +2920,7 @@ void GRExprEngine::VisitBinaryOperator(BinaryOperator* B,
const GRState *state = GetState(*I2); const GRState *state = GetState(*I2);
const GRState *OldSt = state; const GRState *OldSt = state;
SVal RightV = state->getExprVal(RHS); SVal RightV = state->getSVal(RHS);
BinaryOperator::Opcode Op = B->getOpcode(); BinaryOperator::Opcode Op = B->getOpcode();
@ -2987,13 +2985,13 @@ void GRExprEngine::VisitBinaryOperator(BinaryOperator* B,
// Perform a load (the LHS). This performs the checks for // Perform a load (the LHS). This performs the checks for
// null dereferences, and so on. // null dereferences, and so on.
ExplodedNodeSet Tmp4; ExplodedNodeSet Tmp4;
SVal location = state->getExprVal(LHS); SVal location = state->getSVal(LHS);
EvalLoad(Tmp4, LHS, *I2, state, location); EvalLoad(Tmp4, LHS, *I2, state, location);
for (ExplodedNodeSet::iterator I4=Tmp4.begin(), E4=Tmp4.end(); I4!=E4; for (ExplodedNodeSet::iterator I4=Tmp4.begin(), E4=Tmp4.end(); I4!=E4;
++I4) { ++I4) {
state = GetState(*I4); state = GetState(*I4);
SVal V = state->getExprVal(LHS); SVal V = state->getSVal(LHS);
// Get the computation type. // Get the computation type.
QualType CTy = QualType CTy =
@ -3058,7 +3056,7 @@ void GRExprEngine::CreateCXXTemporaryObject(Expr *Ex, ExplodedNode *Pred,
// Bind the temporary object to the value of the expression. Then bind // Bind the temporary object to the value of the expression. Then bind
// the expression to the location of the object. // the expression to the location of the object.
SVal V = state->getExprVal(Ex); SVal V = state->getSVal(Ex);
const MemRegion *R = const MemRegion *R =
ValMgr.getRegionManager().getCXXObjectRegion(Ex, ValMgr.getRegionManager().getCXXObjectRegion(Ex,

8
lib/Checker/GRState.cpp
Просмотреть файл

@ -69,7 +69,7 @@ const GRState *GRState::unbindLoc(Loc LV) const {
return getStateManager().getPersistentState(NewSt); return getStateManager().getPersistentState(NewSt);
} }
SVal GRState::LoadAsScalarOrLoc(const MemRegion *R) const { SVal GRState::getSValAsScalarOrLoc(const MemRegion *R) const {
// We only want to do fetches from regions that we can actually bind // We only want to do fetches from regions that we can actually bind
// values. For example, SymbolicRegions of type 'id<...>' cannot // values. For example, SymbolicRegions of type 'id<...>' cannot
// have direct bindings (but their can be bindings on their subregions). // have direct bindings (but their can be bindings on their subregions).
@ -79,7 +79,7 @@ SVal GRState::LoadAsScalarOrLoc(const MemRegion *R) const {
if (const TypedRegion *TR = dyn_cast<TypedRegion>(R)) { if (const TypedRegion *TR = dyn_cast<TypedRegion>(R)) {
QualType T = TR->getValueType(getStateManager().getContext()); QualType T = TR->getValueType(getStateManager().getContext());
if (Loc::IsLocType(T) || T->isIntegerType()) if (Loc::IsLocType(T) || T->isIntegerType())
return Load(R); return getSVal(R);
} }
return UnknownVal(); return UnknownVal();
@ -297,7 +297,7 @@ bool ScanReachableSymbols::scan(const MemRegion *R) {
return false; return false;
// Now look at the binding to this region (if any). // Now look at the binding to this region (if any).
if (!scan(state->LoadAsScalarOrLoc(R))) if (!scan(state->getSValAsScalarOrLoc(R)))
return false; return false;
// Now look at the subregions. // Now look at the subregions.
@ -341,7 +341,7 @@ bool GRState::scanReachableSymbols(const MemRegion * const *I,
bool GRStateManager::isEqual(const GRState* state, const Expr* Ex, bool GRStateManager::isEqual(const GRState* state, const Expr* Ex,
const llvm::APSInt& Y) { const llvm::APSInt& Y) {
SVal V = state->getExprVal(Ex); SVal V = state->getSVal(Ex);
if (loc::ConcreteInt* X = dyn_cast<loc::ConcreteInt>(&V)) if (loc::ConcreteInt* X = dyn_cast<loc::ConcreteInt>(&V))
return X->getValue() == Y; return X->getValue() == Y;

13
lib/Checker/MallocChecker.cpp
Просмотреть файл

@ -103,7 +103,7 @@ void *MallocChecker::getTag() {
bool MallocChecker::EvalCallExpr(CheckerContext &C, const CallExpr *CE) { bool MallocChecker::EvalCallExpr(CheckerContext &C, const CallExpr *CE) {
const GRState *state = C.getState(); const GRState *state = C.getState();
const Expr *Callee = CE->getCallee(); const Expr *Callee = CE->getCallee();
SVal L = state->getExprVal(Callee); SVal L = state->getSVal(Callee);
const FunctionDecl *FD = L.getAsFunctionDecl(); const FunctionDecl *FD = L.getAsFunctionDecl();
if (!FD) if (!FD)
@ -149,7 +149,7 @@ const GRState *MallocChecker::MallocMemAux(CheckerContext &C,
SVal RetVal = ValMgr.getConjuredSymbolVal(NULL, CE, CE->getType(), Count); SVal RetVal = ValMgr.getConjuredSymbolVal(NULL, CE, CE->getType(), Count);
SVal Size = state->getExprVal(SizeEx); SVal Size = state->getSVal(SizeEx);
state = C.getEngine().getStoreManager().setExtent(state, RetVal.getAsRegion(), state = C.getEngine().getStoreManager().setExtent(state, RetVal.getAsRegion(),
Size); Size);
@ -171,7 +171,7 @@ void MallocChecker::FreeMem(CheckerContext &C, const CallExpr *CE) {
const GRState *MallocChecker::FreeMemAux(CheckerContext &C, const CallExpr *CE, const GRState *MallocChecker::FreeMemAux(CheckerContext &C, const CallExpr *CE,
const GRState *state) { const GRState *state) {
SVal ArgVal = state->getExprVal(CE->getArg(0)); SVal ArgVal = state->getSVal(CE->getArg(0));
SymbolRef Sym = ArgVal.getAsLocSymbol(); SymbolRef Sym = ArgVal.getAsLocSymbol();
assert(Sym); assert(Sym);
@ -205,8 +205,7 @@ const GRState *MallocChecker::FreeMemAux(CheckerContext &C, const CallExpr *CE,
void MallocChecker::ReallocMem(CheckerContext &C, const CallExpr *CE) { void MallocChecker::ReallocMem(CheckerContext &C, const CallExpr *CE) {
const GRState *state = C.getState(); const GRState *state = C.getState();
const Expr *Arg0 = CE->getArg(0); const Expr *Arg0 = CE->getArg(0);
DefinedOrUnknownSVal Arg0Val = DefinedOrUnknownSVal Arg0Val=cast<DefinedOrUnknownSVal>(state->getSVal(Arg0));
cast<DefinedOrUnknownSVal>(state->getExprVal(Arg0));
ValueManager &ValMgr = C.getValueManager(); ValueManager &ValMgr = C.getValueManager();
SValuator &SVator = C.getSValuator(); SValuator &SVator = C.getSValuator();
@ -230,7 +229,7 @@ void MallocChecker::ReallocMem(CheckerContext &C, const CallExpr *CE) {
if (const GRState *stateNotEqual = state->Assume(PtrEQ, false)) { if (const GRState *stateNotEqual = state->Assume(PtrEQ, false)) {
const Expr *Arg1 = CE->getArg(1); const Expr *Arg1 = CE->getArg(1);
DefinedOrUnknownSVal Arg1Val = DefinedOrUnknownSVal Arg1Val =
cast<DefinedOrUnknownSVal>(stateNotEqual->getExprVal(Arg1)); cast<DefinedOrUnknownSVal>(stateNotEqual->getSVal(Arg1));
DefinedOrUnknownSVal SizeZero = SVator.EvalEQ(stateNotEqual, Arg1Val, DefinedOrUnknownSVal SizeZero = SVator.EvalEQ(stateNotEqual, Arg1Val,
ValMgr.makeIntValWithPtrWidth(0, false)); ValMgr.makeIntValWithPtrWidth(0, false));
@ -305,7 +304,7 @@ void MallocChecker::PreVisitReturnStmt(CheckerContext &C, const ReturnStmt *S) {
const GRState *state = C.getState(); const GRState *state = C.getState();
SymbolRef Sym = state->getExprVal(RetE).getAsSymbol(); SymbolRef Sym = state->getSVal(RetE).getAsSymbol();
if (!Sym) if (!Sym)
return; return;

5
lib/Checker/NSErrorChecker.cpp
Просмотреть файл

@ -199,7 +199,7 @@ void NSErrorChecker::CheckParamDeref(const VarDecl *Param,
SVal ParamL = rootState->getLValue(Param, LC); SVal ParamL = rootState->getLValue(Param, LC);
const MemRegion* ParamR = cast<loc::MemRegionVal>(ParamL).getRegionAs<VarRegion>(); const MemRegion* ParamR = cast<loc::MemRegionVal>(ParamL).getRegionAs<VarRegion>();
assert (ParamR && "Parameters always have VarRegions."); assert (ParamR && "Parameters always have VarRegions.");
SVal ParamSVal = rootState->Load(ParamR); SVal ParamSVal = rootState->getSVal(ParamR);
// FIXME: For now assume that ParamSVal is symbolic. We need to generalize // FIXME: For now assume that ParamSVal is symbolic. We need to generalize
// this later. // this later.
@ -212,8 +212,7 @@ void NSErrorChecker::CheckParamDeref(const VarDecl *Param,
llvm::tie(I, E) = GetImplicitNullDereferences(Eng); llvm::tie(I, E) = GetImplicitNullDereferences(Eng);
for ( ; I != E; ++I) { for ( ; I != E; ++I) {
const GRState *state = (*I)->getState(); const GRState *state = (*I)->getState();
SVal location = SVal location = state->getSVal((*I)->getLocationAs<StmtPoint>()->getStmt());
state->getExprVal((*I)->getLocationAs<StmtPoint>()->getStmt());
if (location.getAsSymbol() != ParamSym) if (location.getAsSymbol() != ParamSym)
continue; continue;

2
lib/Checker/NoReturnFunctionChecker.cpp
Просмотреть файл

@ -36,7 +36,7 @@ bool NoReturnFunctionChecker::EvalCallExpr(CheckerContext &C,
const CallExpr *CE) { const CallExpr *CE) {
const GRState *state = C.getState(); const GRState *state = C.getState();
const Expr *Callee = CE->getCallee(); const Expr *Callee = CE->getCallee();
SVal L = state->getExprVal(Callee); SVal L = state->getSVal(Callee);
const FunctionDecl *FD = L.getAsFunctionDecl(); const FunctionDecl *FD = L.getAsFunctionDecl();
if (!FD) if (!FD)
return false; return false;

10
lib/Checker/OSAtomicChecker.cpp
Просмотреть файл

@ -38,7 +38,7 @@ void clang::RegisterOSAtomicChecker(GRExprEngine &Eng) {
bool OSAtomicChecker::EvalCallExpr(CheckerContext &C,const CallExpr *CE) { bool OSAtomicChecker::EvalCallExpr(CheckerContext &C,const CallExpr *CE) {
const GRState *state = C.getState(); const GRState *state = C.getState();
const Expr *Callee = CE->getCallee(); const Expr *Callee = CE->getCallee();
SVal L = state->getExprVal(Callee); SVal L = state->getSVal(Callee);
const FunctionDecl* FD = L.getAsFunctionDecl(); const FunctionDecl* FD = L.getAsFunctionDecl();
if (!FD) if (!FD)
@ -100,7 +100,7 @@ bool OSAtomicChecker::EvalOSAtomicCompareAndSwap(CheckerContext &C,
GRExprEngine &Engine = C.getEngine(); GRExprEngine &Engine = C.getEngine();
const GRState *state = C.getState(); const GRState *state = C.getState();
ExplodedNodeSet Tmp; ExplodedNodeSet Tmp;
SVal location = state->getExprVal(theValueExpr); SVal location = state->getSVal(theValueExpr);
// Here we should use the value type of the region as the load type. // Here we should use the value type of the region as the load type.
QualType LoadTy; QualType LoadTy;
if (const TypedRegion *TR = if (const TypedRegion *TR =
@ -124,8 +124,8 @@ bool OSAtomicChecker::EvalOSAtomicCompareAndSwap(CheckerContext &C,
ExplodedNode *N = *I; ExplodedNode *N = *I;
const GRState *stateLoad = N->getState(); const GRState *stateLoad = N->getState();
SVal theValueVal_untested = stateLoad->getExprVal(theValueExpr); SVal theValueVal_untested = stateLoad->getSVal(theValueExpr);
SVal oldValueVal_untested = stateLoad->getExprVal(oldValueExpr); SVal oldValueVal_untested = stateLoad->getSVal(oldValueExpr);
// FIXME: Issue an error. // FIXME: Issue an error.
if (theValueVal_untested.isUndef() || oldValueVal_untested.isUndef()) { if (theValueVal_untested.isUndef() || oldValueVal_untested.isUndef()) {
@ -148,7 +148,7 @@ bool OSAtomicChecker::EvalOSAtomicCompareAndSwap(CheckerContext &C,
if (stateEqual) { if (stateEqual) {
// Perform the store. // Perform the store.
ExplodedNodeSet TmpStore; ExplodedNodeSet TmpStore;
SVal val = stateEqual->getExprVal(newValueExpr); SVal val = stateEqual->getSVal(newValueExpr);
// Handle implicit value casts. // Handle implicit value casts.
if (const TypedRegion *R = if (const TypedRegion *R =

4
lib/Checker/PointerArithChecker.cpp
Просмотреть файл

@ -40,8 +40,8 @@ void PointerArithChecker::PreVisitBinaryOperator(CheckerContext &C,
return; return;
const GRState *state = C.getState(); const GRState *state = C.getState();
SVal LV = state->getExprVal(B->getLHS()); SVal LV = state->getSVal(B->getLHS());
SVal RV = state->getExprVal(B->getRHS()); SVal RV = state->getSVal(B->getRHS());
const MemRegion *LR = LV.getAsRegion(); const MemRegion *LR = LV.getAsRegion();

4
lib/Checker/PointerSubChecker.cpp
Просмотреть файл

@ -42,8 +42,8 @@ void PointerSubChecker::PreVisitBinaryOperator(CheckerContext &C,
return; return;
const GRState *state = C.getState(); const GRState *state = C.getState();
SVal LV = state->getExprVal(B->getLHS()); SVal LV = state->getSVal(B->getLHS());
SVal RV = state->getExprVal(B->getRHS()); SVal RV = state->getSVal(B->getRHS());
const MemRegion *LR = LV.getAsRegion(); const MemRegion *LR = LV.getAsRegion();
const MemRegion *RR = RV.getAsRegion(); const MemRegion *RR = RV.getAsRegion();

10
lib/Checker/PthreadLockChecker.cpp
Просмотреть файл

@ -60,7 +60,7 @@ void PthreadLockChecker::PostVisitCallExpr(CheckerContext &C,
const GRState *state = C.getState(); const GRState *state = C.getState();
const Expr *Callee = CE->getCallee(); const Expr *Callee = CE->getCallee();
const FunctionTextRegion *R = const FunctionTextRegion *R =
dyn_cast_or_null<FunctionTextRegion>(state->getExprVal(Callee).getAsRegion()); dyn_cast_or_null<FunctionTextRegion>(state->getSVal(Callee).getAsRegion());
if (!R) if (!R)
return; return;
@ -70,17 +70,17 @@ void PthreadLockChecker::PostVisitCallExpr(CheckerContext &C,
if (FName == "pthread_mutex_lock") { if (FName == "pthread_mutex_lock") {
if (CE->getNumArgs() != 1) if (CE->getNumArgs() != 1)
return; return;
AcquireLock(C, CE, state->getExprVal(CE->getArg(0)), false); AcquireLock(C, CE, state->getSVal(CE->getArg(0)), false);
} }
else if (FName == "pthread_mutex_trylock") { else if (FName == "pthread_mutex_trylock") {
if (CE->getNumArgs() != 1) if (CE->getNumArgs() != 1)
return; return;
AcquireLock(C, CE, state->getExprVal(CE->getArg(0)), true); AcquireLock(C, CE, state->getSVal(CE->getArg(0)), true);
} }
else if (FName == "pthread_mutex_unlock") { else if (FName == "pthread_mutex_unlock") {
if (CE->getNumArgs() != 1) if (CE->getNumArgs() != 1)
return; return;
ReleaseLock(C, CE, state->getExprVal(CE->getArg(0))); ReleaseLock(C, CE, state->getSVal(CE->getArg(0)));
} }
} }
@ -93,7 +93,7 @@ void PthreadLockChecker::AcquireLock(CheckerContext &C, const CallExpr *CE,
const GRState *state = C.getState(); const GRState *state = C.getState();
SVal X = state->getExprVal(CE); SVal X = state->getSVal(CE);
if (X.isUnknownOrUndef()) if (X.isUnknownOrUndef())
return; return;

2
lib/Checker/RegionStore.cpp
Просмотреть файл

@ -1859,7 +1859,7 @@ GRState const *RegionStoreManager::EnterStackFrame(GRState const *state,
// Copy the arg expression value to the arg variables. // Copy the arg expression value to the arg variables.
Store store = state->getStore(); Store store = state->getStore();
for (; AI != AE; ++AI, ++PI) { for (; AI != AE; ++AI, ++PI) {
SVal ArgVal = state->getExprVal(*AI); SVal ArgVal = state->getSVal(*AI);
store = Bind(store, ValMgr.makeLoc(MRMgr.getVarRegion(*PI, frame)), ArgVal); store = Bind(store, ValMgr.makeLoc(MRMgr.getVarRegion(*PI, frame)), ArgVal);
} }

2
lib/Checker/ReturnPointerRangeChecker.cpp
Просмотреть файл

@ -46,7 +46,7 @@ void ReturnPointerRangeChecker::PreVisitReturnStmt(CheckerContext &C,
if (!RetE) if (!RetE)
return; return;
SVal V = state->getExprVal(RetE); SVal V = state->getSVal(RetE);
const MemRegion *R = V.getAsRegion(); const MemRegion *R = V.getAsRegion();
if (!R) if (!R)
return; return;

2
lib/Checker/ReturnStackAddressChecker.cpp
Просмотреть файл

@ -112,7 +112,7 @@ void ReturnStackAddressChecker::PreVisitReturnStmt(CheckerContext &C,
if (!RetE) if (!RetE)
return; return;
SVal V = C.getState()->getExprVal(RetE); SVal V = C.getState()->getSVal(RetE);
const MemRegion *R = V.getAsRegion(); const MemRegion *R = V.getAsRegion();
if (!R || !R->hasStackStorage()) if (!R || !R->hasStackStorage())

2
lib/Checker/ReturnUndefChecker.cpp
Просмотреть файл

@ -47,7 +47,7 @@ void ReturnUndefChecker::PreVisitReturnStmt(CheckerContext &C,
if (!RetE) if (!RetE)
return; return;
if (!C.getState()->getExprVal(RetE).isUndef()) if (!C.getState()->getSVal(RetE).isUndef())
return; return;
ExplodedNode *N = C.GenerateSink(); ExplodedNode *N = C.GenerateSink();

4
lib/Checker/UndefBranchChecker.cpp
Просмотреть файл

@ -41,7 +41,7 @@ class UndefBranchChecker : public Checker {
return Ex; return Ex;
} }
bool MatchesCriteria(Expr* Ex) { return St->getExprVal(Ex).isUndef(); } bool MatchesCriteria(Expr* Ex) { return St->getSVal(Ex).isUndef(); }
}; };
public: public:
@ -66,7 +66,7 @@ void UndefBranchChecker::VisitBranchCondition(GRBranchNodeBuilder &Builder,
GRExprEngine &Eng, GRExprEngine &Eng,
Stmt *Condition, void *tag) { Stmt *Condition, void *tag) {
const GRState *state = Builder.getState(); const GRState *state = Builder.getState();
SVal X = state->getExprVal(Condition); SVal X = state->getSVal(Condition);
if (X.isUndef()) { if (X.isUndef()) {
ExplodedNode *N = Builder.generateNode(state, true); ExplodedNode *N = Builder.generateNode(state, true);
if (N) { if (N) {

6
lib/Checker/UndefResultChecker.cpp
Просмотреть файл

@ -39,7 +39,7 @@ void clang::RegisterUndefResultChecker(GRExprEngine &Eng) {
void UndefResultChecker::PostVisitBinaryOperator(CheckerContext &C, void UndefResultChecker::PostVisitBinaryOperator(CheckerContext &C,
const BinaryOperator *B) { const BinaryOperator *B) {
const GRState *state = C.getState(); const GRState *state = C.getState();
if (state->getExprVal(B).isUndef()) { if (state->getSVal(B).isUndef()) {
// Generate an error node. // Generate an error node.
ExplodedNode *N = C.GenerateSink(); ExplodedNode *N = C.GenerateSink();
if (!N) if (!N)
@ -53,11 +53,11 @@ void UndefResultChecker::PostVisitBinaryOperator(CheckerContext &C,
const Expr *Ex = NULL; const Expr *Ex = NULL;
bool isLeft = true; bool isLeft = true;
if (state->getExprVal(B->getLHS()).isUndef()) { if (state->getSVal(B->getLHS()).isUndef()) {
Ex = B->getLHS()->IgnoreParenCasts(); Ex = B->getLHS()->IgnoreParenCasts();
isLeft = true; isLeft = true;
} }
else if (state->getExprVal(B->getRHS()).isUndef()) { else if (state->getSVal(B->getRHS()).isUndef()) {
Ex = B->getRHS()->IgnoreParenCasts(); Ex = B->getRHS()->IgnoreParenCasts();
isLeft = false; isLeft = false;
} }

2
lib/Checker/UndefinedArraySubscriptChecker.cpp
Просмотреть файл

@ -40,7 +40,7 @@ void clang::RegisterUndefinedArraySubscriptChecker(GRExprEngine &Eng) {
void void
UndefinedArraySubscriptChecker::PreVisitArraySubscriptExpr(CheckerContext &C, UndefinedArraySubscriptChecker::PreVisitArraySubscriptExpr(CheckerContext &C,
const ArraySubscriptExpr *A) { const ArraySubscriptExpr *A) {
if (C.getState()->getExprVal(A->getIdx()).isUndef()) { if (C.getState()->getSVal(A->getIdx()).isUndef()) {
if (ExplodedNode *N = C.GenerateSink()) { if (ExplodedNode *N = C.GenerateSink()) {
if (!BT) if (!BT)
BT = new BuiltinBug("Array subscript is undefined"); BT = new BuiltinBug("Array subscript is undefined");

2
lib/Checker/VLASizeChecker.cpp
Просмотреть файл

@ -51,7 +51,7 @@ void VLASizeChecker::PreVisitDeclStmt(CheckerContext &C, const DeclStmt *DS) {
// FIXME: Handle multi-dimensional VLAs. // FIXME: Handle multi-dimensional VLAs.
const Expr* SE = VLA->getSizeExpr(); const Expr* SE = VLA->getSizeExpr();
const GRState *state = C.getState(); const GRState *state = C.getState();
SVal sizeV = state->getExprVal(SE); SVal sizeV = state->getSVal(SE);
if (sizeV.isUndef()) { if (sizeV.isUndef()) {
// Generate an error node. // Generate an error node.