Ted Kremenek | 77349cb | 2008-02-14 22:13:12 +0000 | [diff] [blame] | 1 | //=-- GRExprEngine.cpp - Path-Sensitive Expression-Level Dataflow ---*- C++ -*-= |
Ted Kremenek | 6492485 | 2008-01-31 02:35:41 +0000 | [diff] [blame] | 2 | // |
Ted Kremenek | 4af8431 | 2008-01-31 06:49:09 +0000 | [diff] [blame] | 3 | // The LLVM Compiler Infrastructure |
Ted Kremenek | d27f816 | 2008-01-15 23:55:06 +0000 | [diff] [blame] | 4 | // |
| 5 | // This file is distributed under the University of Illinois Open Source |
| 6 | // License. See LICENSE.TXT for details. |
| 7 | // |
| 8 | //===----------------------------------------------------------------------===// |
| 9 | // |
Ted Kremenek | 77349cb | 2008-02-14 22:13:12 +0000 | [diff] [blame] | 10 | // This file defines a meta-engine for path-sensitive dataflow analysis that |
| 11 | // is built on GREngine, but provides the boilerplate to execute transfer |
| 12 | // functions and build the ExplodedGraph at the expression level. |
Ted Kremenek | d27f816 | 2008-01-15 23:55:06 +0000 | [diff] [blame] | 13 | // |
| 14 | //===----------------------------------------------------------------------===// |
| 15 | |
Ted Kremenek | 77349cb | 2008-02-14 22:13:12 +0000 | [diff] [blame] | 16 | #include "clang/Analysis/PathSensitive/GRExprEngine.h" |
Ted Kremenek | e97ca06 | 2008-03-07 20:57:30 +0000 | [diff] [blame] | 17 | #include "clang/Basic/SourceManager.h" |
Ted Kremenek | e01c987 | 2008-02-14 22:36:46 +0000 | [diff] [blame] | 18 | #include "llvm/Support/Streams.h" |
Ted Kremenek | b387a3f | 2008-02-14 22:16:04 +0000 | [diff] [blame] | 19 | |
Ted Kremenek | 0f5f059 | 2008-02-27 06:07:00 +0000 | [diff] [blame] | 20 | #ifndef NDEBUG |
| 21 | #include "llvm/Support/GraphWriter.h" |
| 22 | #include <sstream> |
| 23 | #endif |
| 24 | |
Ted Kremenek | 4bf38da | 2008-03-05 21:15:02 +0000 | [diff] [blame] | 25 | // SaveAndRestore - A utility class that uses RIIA to save and restore |
| 26 | // the value of a variable. |
| 27 | template<typename T> |
| 28 | struct VISIBILITY_HIDDEN SaveAndRestore { |
| 29 | SaveAndRestore(T& x) : X(x), old_value(x) {} |
| 30 | ~SaveAndRestore() { X = old_value; } |
| 31 | T get() { return old_value; } |
| 32 | |
| 33 | T& X; |
| 34 | T old_value; |
| 35 | }; |
| 36 | |
Ted Kremenek | b387a3f | 2008-02-14 22:16:04 +0000 | [diff] [blame] | 37 | using namespace clang; |
| 38 | using llvm::dyn_cast; |
| 39 | using llvm::cast; |
| 40 | using llvm::APSInt; |
Ted Kremenek | ab2b8c5 | 2008-01-23 19:59:44 +0000 | [diff] [blame] | 41 | |
Ted Kremenek | daa497e | 2008-03-09 18:05:48 +0000 | [diff] [blame] | 42 | |
Ted Kremenek | aed9b6a | 2008-02-28 10:21:43 +0000 | [diff] [blame] | 43 | ValueState* GRExprEngine::getInitialState() { |
Ted Kremenek | 0793263 | 2008-02-27 06:47:26 +0000 | [diff] [blame] | 44 | |
| 45 | // The LiveVariables information already has a compilation of all VarDecls |
| 46 | // used in the function. Iterate through this set, and "symbolicate" |
| 47 | // any VarDecl whose value originally comes from outside the function. |
| 48 | |
| 49 | typedef LiveVariables::AnalysisDataTy LVDataTy; |
| 50 | LVDataTy& D = Liveness.getAnalysisData(); |
| 51 | |
Ted Kremenek | aed9b6a | 2008-02-28 10:21:43 +0000 | [diff] [blame] | 52 | ValueState StateImpl = *StateMgr.getInitialState(); |
Ted Kremenek | 0793263 | 2008-02-27 06:47:26 +0000 | [diff] [blame] | 53 | |
| 54 | for (LVDataTy::decl_iterator I=D.begin_decl(), E=D.end_decl(); I != E; ++I) { |
| 55 | |
| 56 | VarDecl* VD = cast<VarDecl>(const_cast<ScopedDecl*>(I->first)); |
| 57 | |
| 58 | if (VD->hasGlobalStorage() || isa<ParmVarDecl>(VD)) { |
| 59 | RVal X = RVal::GetSymbolValue(SymMgr, VD); |
| 60 | StateMgr.BindVar(StateImpl, VD, X); |
| 61 | } |
| 62 | } |
| 63 | |
| 64 | return StateMgr.getPersistentState(StateImpl); |
| 65 | } |
| 66 | |
Ted Kremenek | aed9b6a | 2008-02-28 10:21:43 +0000 | [diff] [blame] | 67 | ValueState* GRExprEngine::SetRVal(ValueState* St, Expr* Ex, RVal V) { |
Ted Kremenek | 3271f8d | 2008-02-07 04:16:04 +0000 | [diff] [blame] | 68 | |
Ted Kremenek | e070a1d | 2008-02-04 21:59:01 +0000 | [diff] [blame] | 69 | bool isBlkExpr = false; |
Ted Kremenek | 3271f8d | 2008-02-07 04:16:04 +0000 | [diff] [blame] | 70 | |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 71 | if (Ex == CurrentStmt) { |
| 72 | isBlkExpr = getCFG().isBlkExpr(Ex); |
Ted Kremenek | e070a1d | 2008-02-04 21:59:01 +0000 | [diff] [blame] | 73 | |
| 74 | if (!isBlkExpr) |
| 75 | return St; |
| 76 | } |
Ted Kremenek | 3271f8d | 2008-02-07 04:16:04 +0000 | [diff] [blame] | 77 | |
Ted Kremenek | 5a7b382 | 2008-02-26 23:37:01 +0000 | [diff] [blame] | 78 | return StateMgr.SetRVal(St, Ex, V, isBlkExpr, false); |
Ted Kremenek | e070a1d | 2008-02-04 21:59:01 +0000 | [diff] [blame] | 79 | } |
| 80 | |
Ted Kremenek | aed9b6a | 2008-02-28 10:21:43 +0000 | [diff] [blame] | 81 | ValueState* GRExprEngine::MarkBranch(ValueState* St, Stmt* Terminator, |
| 82 | bool branchTaken) { |
Ted Kremenek | 05a2378 | 2008-02-26 19:05:15 +0000 | [diff] [blame] | 83 | |
| 84 | switch (Terminator->getStmtClass()) { |
| 85 | default: |
| 86 | return St; |
| 87 | |
| 88 | case Stmt::BinaryOperatorClass: { // '&&' and '||' |
| 89 | |
| 90 | BinaryOperator* B = cast<BinaryOperator>(Terminator); |
| 91 | BinaryOperator::Opcode Op = B->getOpcode(); |
| 92 | |
| 93 | assert (Op == BinaryOperator::LAnd || Op == BinaryOperator::LOr); |
| 94 | |
| 95 | // For &&, if we take the true branch, then the value of the whole |
| 96 | // expression is that of the RHS expression. |
| 97 | // |
| 98 | // For ||, if we take the false branch, then the value of the whole |
| 99 | // expression is that of the RHS expression. |
| 100 | |
| 101 | Expr* Ex = (Op == BinaryOperator::LAnd && branchTaken) || |
| 102 | (Op == BinaryOperator::LOr && !branchTaken) |
| 103 | ? B->getRHS() : B->getLHS(); |
| 104 | |
Ted Kremenek | 4a4e524 | 2008-02-28 09:25:22 +0000 | [diff] [blame] | 105 | return SetBlkExprRVal(St, B, UndefinedVal(Ex)); |
Ted Kremenek | 05a2378 | 2008-02-26 19:05:15 +0000 | [diff] [blame] | 106 | } |
| 107 | |
| 108 | case Stmt::ConditionalOperatorClass: { // ?: |
| 109 | |
| 110 | ConditionalOperator* C = cast<ConditionalOperator>(Terminator); |
| 111 | |
| 112 | // For ?, if branchTaken == true then the value is either the LHS or |
| 113 | // the condition itself. (GNU extension). |
| 114 | |
| 115 | Expr* Ex; |
| 116 | |
| 117 | if (branchTaken) |
| 118 | Ex = C->getLHS() ? C->getLHS() : C->getCond(); |
| 119 | else |
| 120 | Ex = C->getRHS(); |
| 121 | |
Ted Kremenek | 4a4e524 | 2008-02-28 09:25:22 +0000 | [diff] [blame] | 122 | return SetBlkExprRVal(St, C, UndefinedVal(Ex)); |
Ted Kremenek | 05a2378 | 2008-02-26 19:05:15 +0000 | [diff] [blame] | 123 | } |
| 124 | |
| 125 | case Stmt::ChooseExprClass: { // ?: |
| 126 | |
| 127 | ChooseExpr* C = cast<ChooseExpr>(Terminator); |
| 128 | |
| 129 | Expr* Ex = branchTaken ? C->getLHS() : C->getRHS(); |
Ted Kremenek | 4a4e524 | 2008-02-28 09:25:22 +0000 | [diff] [blame] | 130 | return SetBlkExprRVal(St, C, UndefinedVal(Ex)); |
Ted Kremenek | 05a2378 | 2008-02-26 19:05:15 +0000 | [diff] [blame] | 131 | } |
| 132 | } |
| 133 | } |
| 134 | |
Ted Kremenek | 6a6719a | 2008-02-29 20:27:50 +0000 | [diff] [blame] | 135 | bool GRExprEngine::ProcessBlockEntrance(CFGBlock* B, ValueState*, |
| 136 | GRBlockCounter BC) { |
| 137 | |
| 138 | return BC.getNumVisited(B->getBlockID()) < 3; |
| 139 | } |
| 140 | |
Ted Kremenek | 4d4dd85 | 2008-02-13 17:41:41 +0000 | [diff] [blame] | 141 | void GRExprEngine::ProcessBranch(Expr* Condition, Stmt* Term, |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 142 | BranchNodeBuilder& builder) { |
Ted Kremenek | b38911f | 2008-01-30 23:03:39 +0000 | [diff] [blame] | 143 | |
Ted Kremenek | e7d2211 | 2008-02-11 19:21:59 +0000 | [diff] [blame] | 144 | // Remove old bindings for subexpressions. |
Ted Kremenek | aed9b6a | 2008-02-28 10:21:43 +0000 | [diff] [blame] | 145 | ValueState* PrevState = StateMgr.RemoveSubExprBindings(builder.getState()); |
Ted Kremenek | f233d48 | 2008-02-05 00:26:40 +0000 | [diff] [blame] | 146 | |
Ted Kremenek | b233183 | 2008-02-15 22:29:00 +0000 | [diff] [blame] | 147 | // Check for NULL conditions; e.g. "for(;;)" |
| 148 | if (!Condition) { |
| 149 | builder.markInfeasible(false); |
Ted Kremenek | b233183 | 2008-02-15 22:29:00 +0000 | [diff] [blame] | 150 | return; |
| 151 | } |
| 152 | |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 153 | RVal V = GetRVal(PrevState, Condition); |
Ted Kremenek | b38911f | 2008-01-30 23:03:39 +0000 | [diff] [blame] | 154 | |
| 155 | switch (V.getBaseKind()) { |
| 156 | default: |
| 157 | break; |
| 158 | |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 159 | case RVal::UnknownKind: |
Ted Kremenek | 58b3321 | 2008-02-26 19:40:44 +0000 | [diff] [blame] | 160 | builder.generateNode(MarkBranch(PrevState, Term, true), true); |
| 161 | builder.generateNode(MarkBranch(PrevState, Term, false), false); |
Ted Kremenek | b38911f | 2008-01-30 23:03:39 +0000 | [diff] [blame] | 162 | return; |
| 163 | |
Ted Kremenek | 4a4e524 | 2008-02-28 09:25:22 +0000 | [diff] [blame] | 164 | case RVal::UndefinedKind: { |
Ted Kremenek | b38911f | 2008-01-30 23:03:39 +0000 | [diff] [blame] | 165 | NodeTy* N = builder.generateNode(PrevState, true); |
| 166 | |
| 167 | if (N) { |
| 168 | N->markAsSink(); |
Ted Kremenek | 4a4e524 | 2008-02-28 09:25:22 +0000 | [diff] [blame] | 169 | UndefBranches.insert(N); |
Ted Kremenek | b38911f | 2008-01-30 23:03:39 +0000 | [diff] [blame] | 170 | } |
| 171 | |
| 172 | builder.markInfeasible(false); |
| 173 | return; |
| 174 | } |
| 175 | } |
Ted Kremenek | 8e49dd6 | 2008-02-12 18:08:17 +0000 | [diff] [blame] | 176 | |
Ted Kremenek | b38911f | 2008-01-30 23:03:39 +0000 | [diff] [blame] | 177 | |
Ted Kremenek | 6a6719a | 2008-02-29 20:27:50 +0000 | [diff] [blame] | 178 | // Process the true branch. |
Ted Kremenek | 8e49dd6 | 2008-02-12 18:08:17 +0000 | [diff] [blame] | 179 | |
Ted Kremenek | 361fa8e | 2008-03-12 21:45:47 +0000 | [diff] [blame] | 180 | bool isFeasible = false; |
Ted Kremenek | 6a6719a | 2008-02-29 20:27:50 +0000 | [diff] [blame] | 181 | ValueState* St = Assume(PrevState, V, true, isFeasible); |
| 182 | |
| 183 | if (isFeasible) |
| 184 | builder.generateNode(MarkBranch(St, Term, true), true); |
Ted Kremenek | 8e49dd6 | 2008-02-12 18:08:17 +0000 | [diff] [blame] | 185 | else |
| 186 | builder.markInfeasible(true); |
Ted Kremenek | 6a6719a | 2008-02-29 20:27:50 +0000 | [diff] [blame] | 187 | |
| 188 | // Process the false branch. |
Ted Kremenek | b38911f | 2008-01-30 23:03:39 +0000 | [diff] [blame] | 189 | |
Ted Kremenek | 6a6719a | 2008-02-29 20:27:50 +0000 | [diff] [blame] | 190 | isFeasible = false; |
| 191 | St = Assume(PrevState, V, false, isFeasible); |
Ted Kremenek | b38911f | 2008-01-30 23:03:39 +0000 | [diff] [blame] | 192 | |
Ted Kremenek | 6a6719a | 2008-02-29 20:27:50 +0000 | [diff] [blame] | 193 | if (isFeasible) |
| 194 | builder.generateNode(MarkBranch(St, Term, false), false); |
Ted Kremenek | f233d48 | 2008-02-05 00:26:40 +0000 | [diff] [blame] | 195 | else |
| 196 | builder.markInfeasible(false); |
Ted Kremenek | 71c29bd | 2008-01-29 23:32:35 +0000 | [diff] [blame] | 197 | } |
| 198 | |
Ted Kremenek | 4d4dd85 | 2008-02-13 17:41:41 +0000 | [diff] [blame] | 199 | /// ProcessIndirectGoto - Called by GRCoreEngine. Used to generate successor |
Ted Kremenek | 754607e | 2008-02-13 00:24:44 +0000 | [diff] [blame] | 200 | /// nodes by processing the 'effects' of a computed goto jump. |
Ted Kremenek | 4d4dd85 | 2008-02-13 17:41:41 +0000 | [diff] [blame] | 201 | void GRExprEngine::ProcessIndirectGoto(IndirectGotoNodeBuilder& builder) { |
Ted Kremenek | 754607e | 2008-02-13 00:24:44 +0000 | [diff] [blame] | 202 | |
Ted Kremenek | aed9b6a | 2008-02-28 10:21:43 +0000 | [diff] [blame] | 203 | ValueState* St = builder.getState(); |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 204 | RVal V = GetRVal(St, builder.getTarget()); |
Ted Kremenek | 754607e | 2008-02-13 00:24:44 +0000 | [diff] [blame] | 205 | |
| 206 | // Three possibilities: |
| 207 | // |
| 208 | // (1) We know the computed label. |
Ted Kremenek | 4a4e524 | 2008-02-28 09:25:22 +0000 | [diff] [blame] | 209 | // (2) The label is NULL (or some other constant), or Undefined. |
Ted Kremenek | 754607e | 2008-02-13 00:24:44 +0000 | [diff] [blame] | 210 | // (3) We have no clue about the label. Dispatch to all targets. |
| 211 | // |
| 212 | |
| 213 | typedef IndirectGotoNodeBuilder::iterator iterator; |
| 214 | |
| 215 | if (isa<lval::GotoLabel>(V)) { |
| 216 | LabelStmt* L = cast<lval::GotoLabel>(V).getLabel(); |
| 217 | |
| 218 | for (iterator I=builder.begin(), E=builder.end(); I != E; ++I) { |
Ted Kremenek | 24f1a96 | 2008-02-13 17:27:37 +0000 | [diff] [blame] | 219 | if (I.getLabel() == L) { |
| 220 | builder.generateNode(I, St); |
Ted Kremenek | 754607e | 2008-02-13 00:24:44 +0000 | [diff] [blame] | 221 | return; |
| 222 | } |
| 223 | } |
| 224 | |
| 225 | assert (false && "No block with label."); |
| 226 | return; |
| 227 | } |
| 228 | |
Ted Kremenek | 4a4e524 | 2008-02-28 09:25:22 +0000 | [diff] [blame] | 229 | if (isa<lval::ConcreteInt>(V) || isa<UndefinedVal>(V)) { |
Ted Kremenek | 754607e | 2008-02-13 00:24:44 +0000 | [diff] [blame] | 230 | // Dispatch to the first target and mark it as a sink. |
Ted Kremenek | 24f1a96 | 2008-02-13 17:27:37 +0000 | [diff] [blame] | 231 | NodeTy* N = builder.generateNode(builder.begin(), St, true); |
Ted Kremenek | 4a4e524 | 2008-02-28 09:25:22 +0000 | [diff] [blame] | 232 | UndefBranches.insert(N); |
Ted Kremenek | 754607e | 2008-02-13 00:24:44 +0000 | [diff] [blame] | 233 | return; |
| 234 | } |
| 235 | |
| 236 | // This is really a catch-all. We don't support symbolics yet. |
| 237 | |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 238 | assert (V.isUnknown()); |
Ted Kremenek | 754607e | 2008-02-13 00:24:44 +0000 | [diff] [blame] | 239 | |
| 240 | for (iterator I=builder.begin(), E=builder.end(); I != E; ++I) |
Ted Kremenek | 24f1a96 | 2008-02-13 17:27:37 +0000 | [diff] [blame] | 241 | builder.generateNode(I, St); |
Ted Kremenek | 754607e | 2008-02-13 00:24:44 +0000 | [diff] [blame] | 242 | } |
Ted Kremenek | f233d48 | 2008-02-05 00:26:40 +0000 | [diff] [blame] | 243 | |
Ted Kremenek | daeb9a7 | 2008-02-13 23:08:21 +0000 | [diff] [blame] | 244 | /// ProcessSwitch - Called by GRCoreEngine. Used to generate successor |
| 245 | /// nodes by processing the 'effects' of a switch statement. |
| 246 | void GRExprEngine::ProcessSwitch(SwitchNodeBuilder& builder) { |
| 247 | |
| 248 | typedef SwitchNodeBuilder::iterator iterator; |
| 249 | |
Ted Kremenek | aed9b6a | 2008-02-28 10:21:43 +0000 | [diff] [blame] | 250 | ValueState* St = builder.getState(); |
Ted Kremenek | 692416c | 2008-02-18 22:57:02 +0000 | [diff] [blame] | 251 | Expr* CondE = builder.getCondition(); |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 252 | RVal CondV = GetRVal(St, CondE); |
Ted Kremenek | daeb9a7 | 2008-02-13 23:08:21 +0000 | [diff] [blame] | 253 | |
Ted Kremenek | 4a4e524 | 2008-02-28 09:25:22 +0000 | [diff] [blame] | 254 | if (CondV.isUndef()) { |
Ted Kremenek | daeb9a7 | 2008-02-13 23:08:21 +0000 | [diff] [blame] | 255 | NodeTy* N = builder.generateDefaultCaseNode(St, true); |
Ted Kremenek | 4a4e524 | 2008-02-28 09:25:22 +0000 | [diff] [blame] | 256 | UndefBranches.insert(N); |
Ted Kremenek | daeb9a7 | 2008-02-13 23:08:21 +0000 | [diff] [blame] | 257 | return; |
| 258 | } |
| 259 | |
Ted Kremenek | aed9b6a | 2008-02-28 10:21:43 +0000 | [diff] [blame] | 260 | ValueState* DefaultSt = St; |
Ted Kremenek | daeb9a7 | 2008-02-13 23:08:21 +0000 | [diff] [blame] | 261 | |
| 262 | // While most of this can be assumed (such as the signedness), having it |
| 263 | // just computed makes sure everything makes the same assumptions end-to-end. |
Ted Kremenek | 692416c | 2008-02-18 22:57:02 +0000 | [diff] [blame] | 264 | |
Chris Lattner | 98be494 | 2008-03-05 18:54:05 +0000 | [diff] [blame] | 265 | unsigned bits = getContext().getTypeSize(CondE->getType()); |
Ted Kremenek | 692416c | 2008-02-18 22:57:02 +0000 | [diff] [blame] | 266 | |
Ted Kremenek | daeb9a7 | 2008-02-13 23:08:21 +0000 | [diff] [blame] | 267 | APSInt V1(bits, false); |
| 268 | APSInt V2 = V1; |
| 269 | |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 270 | for (iterator I = builder.begin(), EI = builder.end(); I != EI; ++I) { |
Ted Kremenek | daeb9a7 | 2008-02-13 23:08:21 +0000 | [diff] [blame] | 271 | |
| 272 | CaseStmt* Case = cast<CaseStmt>(I.getCase()); |
| 273 | |
| 274 | // Evaluate the case. |
| 275 | if (!Case->getLHS()->isIntegerConstantExpr(V1, getContext(), 0, true)) { |
| 276 | assert (false && "Case condition must evaluate to an integer constant."); |
| 277 | return; |
| 278 | } |
| 279 | |
| 280 | // Get the RHS of the case, if it exists. |
| 281 | |
| 282 | if (Expr* E = Case->getRHS()) { |
| 283 | if (!E->isIntegerConstantExpr(V2, getContext(), 0, true)) { |
| 284 | assert (false && |
| 285 | "Case condition (RHS) must evaluate to an integer constant."); |
| 286 | return ; |
| 287 | } |
| 288 | |
| 289 | assert (V1 <= V2); |
| 290 | } |
Ted Kremenek | 14a1140 | 2008-03-17 22:17:56 +0000 | [diff] [blame] | 291 | else |
| 292 | V2 = V1; |
Ted Kremenek | daeb9a7 | 2008-02-13 23:08:21 +0000 | [diff] [blame] | 293 | |
| 294 | // FIXME: Eventually we should replace the logic below with a range |
| 295 | // comparison, rather than concretize the values within the range. |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 296 | // This should be easy once we have "ranges" for NonLVals. |
Ted Kremenek | daeb9a7 | 2008-02-13 23:08:21 +0000 | [diff] [blame] | 297 | |
Ted Kremenek | 14a1140 | 2008-03-17 22:17:56 +0000 | [diff] [blame] | 298 | do { |
Ted Kremenek | 240f1f0 | 2008-03-07 20:13:31 +0000 | [diff] [blame] | 299 | nonlval::ConcreteInt CaseVal(BasicVals.getValue(V1)); |
Ted Kremenek | daeb9a7 | 2008-02-13 23:08:21 +0000 | [diff] [blame] | 300 | |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 301 | RVal Res = EvalBinOp(BinaryOperator::EQ, CondV, CaseVal); |
Ted Kremenek | daeb9a7 | 2008-02-13 23:08:21 +0000 | [diff] [blame] | 302 | |
| 303 | // Now "assume" that the case matches. |
Ted Kremenek | daeb9a7 | 2008-02-13 23:08:21 +0000 | [diff] [blame] | 304 | |
Ted Kremenek | 361fa8e | 2008-03-12 21:45:47 +0000 | [diff] [blame] | 305 | bool isFeasible = false; |
Ted Kremenek | aed9b6a | 2008-02-28 10:21:43 +0000 | [diff] [blame] | 306 | ValueState* StNew = Assume(St, Res, true, isFeasible); |
Ted Kremenek | daeb9a7 | 2008-02-13 23:08:21 +0000 | [diff] [blame] | 307 | |
| 308 | if (isFeasible) { |
| 309 | builder.generateCaseStmtNode(I, StNew); |
| 310 | |
| 311 | // If CondV evaluates to a constant, then we know that this |
| 312 | // is the *only* case that we can take, so stop evaluating the |
| 313 | // others. |
| 314 | if (isa<nonlval::ConcreteInt>(CondV)) |
| 315 | return; |
| 316 | } |
| 317 | |
| 318 | // Now "assume" that the case doesn't match. Add this state |
| 319 | // to the default state (if it is feasible). |
| 320 | |
Ted Kremenek | 361fa8e | 2008-03-12 21:45:47 +0000 | [diff] [blame] | 321 | isFeasible = false; |
Ted Kremenek | 6cb0b54 | 2008-02-14 19:37:24 +0000 | [diff] [blame] | 322 | StNew = Assume(DefaultSt, Res, false, isFeasible); |
Ted Kremenek | daeb9a7 | 2008-02-13 23:08:21 +0000 | [diff] [blame] | 323 | |
| 324 | if (isFeasible) |
| 325 | DefaultSt = StNew; |
| 326 | |
Ted Kremenek | 14a1140 | 2008-03-17 22:17:56 +0000 | [diff] [blame] | 327 | // Concretize the next value in the range. |
| 328 | if (V1 == V2) |
| 329 | break; |
Ted Kremenek | daeb9a7 | 2008-02-13 23:08:21 +0000 | [diff] [blame] | 330 | |
Ted Kremenek | 14a1140 | 2008-03-17 22:17:56 +0000 | [diff] [blame] | 331 | ++V1; |
Ted Kremenek | 58cda6f | 2008-03-17 22:18:22 +0000 | [diff] [blame] | 332 | assert (V1 <= V2); |
Ted Kremenek | 14a1140 | 2008-03-17 22:17:56 +0000 | [diff] [blame] | 333 | |
| 334 | } while (true); |
Ted Kremenek | daeb9a7 | 2008-02-13 23:08:21 +0000 | [diff] [blame] | 335 | } |
| 336 | |
| 337 | // If we reach here, than we know that the default branch is |
| 338 | // possible. |
| 339 | builder.generateDefaultCaseNode(DefaultSt); |
| 340 | } |
| 341 | |
| 342 | |
Ted Kremenek | 4d4dd85 | 2008-02-13 17:41:41 +0000 | [diff] [blame] | 343 | void GRExprEngine::VisitLogicalExpr(BinaryOperator* B, NodeTy* Pred, |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 344 | NodeSet& Dst) { |
Ted Kremenek | 9dca062 | 2008-02-19 00:22:37 +0000 | [diff] [blame] | 345 | |
Ted Kremenek | 05a2378 | 2008-02-26 19:05:15 +0000 | [diff] [blame] | 346 | assert (B->getOpcode() == BinaryOperator::LAnd || |
| 347 | B->getOpcode() == BinaryOperator::LOr); |
| 348 | |
| 349 | assert (B == CurrentStmt && getCFG().isBlkExpr(B)); |
| 350 | |
Ted Kremenek | 0d093d3 | 2008-03-10 04:11:42 +0000 | [diff] [blame] | 351 | ValueState* St = GetState(Pred); |
Ted Kremenek | 05a2378 | 2008-02-26 19:05:15 +0000 | [diff] [blame] | 352 | RVal X = GetBlkExprRVal(St, B); |
| 353 | |
Ted Kremenek | 4a4e524 | 2008-02-28 09:25:22 +0000 | [diff] [blame] | 354 | assert (X.isUndef()); |
Ted Kremenek | 05a2378 | 2008-02-26 19:05:15 +0000 | [diff] [blame] | 355 | |
Ted Kremenek | 4a4e524 | 2008-02-28 09:25:22 +0000 | [diff] [blame] | 356 | Expr* Ex = (Expr*) cast<UndefinedVal>(X).getData(); |
Ted Kremenek | 05a2378 | 2008-02-26 19:05:15 +0000 | [diff] [blame] | 357 | |
| 358 | assert (Ex); |
| 359 | |
| 360 | if (Ex == B->getRHS()) { |
| 361 | |
| 362 | X = GetBlkExprRVal(St, Ex); |
| 363 | |
Ted Kremenek | 4a4e524 | 2008-02-28 09:25:22 +0000 | [diff] [blame] | 364 | // Handle undefined values. |
Ted Kremenek | 58b3321 | 2008-02-26 19:40:44 +0000 | [diff] [blame] | 365 | |
Ted Kremenek | 4a4e524 | 2008-02-28 09:25:22 +0000 | [diff] [blame] | 366 | if (X.isUndef()) { |
Ted Kremenek | 0e561a3 | 2008-03-21 21:30:14 +0000 | [diff] [blame] | 367 | MakeNode(Dst, B, Pred, SetBlkExprRVal(St, B, X)); |
Ted Kremenek | 58b3321 | 2008-02-26 19:40:44 +0000 | [diff] [blame] | 368 | return; |
| 369 | } |
| 370 | |
Ted Kremenek | 05a2378 | 2008-02-26 19:05:15 +0000 | [diff] [blame] | 371 | // We took the RHS. Because the value of the '&&' or '||' expression must |
| 372 | // evaluate to 0 or 1, we must assume the value of the RHS evaluates to 0 |
| 373 | // or 1. Alternatively, we could take a lazy approach, and calculate this |
| 374 | // value later when necessary. We don't have the machinery in place for |
| 375 | // this right now, and since most logical expressions are used for branches, |
| 376 | // the payoff is not likely to be large. Instead, we do eager evaluation. |
| 377 | |
| 378 | bool isFeasible = false; |
Ted Kremenek | aed9b6a | 2008-02-28 10:21:43 +0000 | [diff] [blame] | 379 | ValueState* NewState = Assume(St, X, true, isFeasible); |
Ted Kremenek | 05a2378 | 2008-02-26 19:05:15 +0000 | [diff] [blame] | 380 | |
| 381 | if (isFeasible) |
Ted Kremenek | 0e561a3 | 2008-03-21 21:30:14 +0000 | [diff] [blame] | 382 | MakeNode(Dst, B, Pred, |
| 383 | SetBlkExprRVal(NewState, B, MakeConstantVal(1U, B))); |
Ted Kremenek | 05a2378 | 2008-02-26 19:05:15 +0000 | [diff] [blame] | 384 | |
| 385 | isFeasible = false; |
| 386 | NewState = Assume(St, X, false, isFeasible); |
| 387 | |
| 388 | if (isFeasible) |
Ted Kremenek | 0e561a3 | 2008-03-21 21:30:14 +0000 | [diff] [blame] | 389 | MakeNode(Dst, B, Pred, |
| 390 | SetBlkExprRVal(NewState, B, MakeConstantVal(0U, B))); |
Ted Kremenek | f233d48 | 2008-02-05 00:26:40 +0000 | [diff] [blame] | 391 | } |
| 392 | else { |
Ted Kremenek | 05a2378 | 2008-02-26 19:05:15 +0000 | [diff] [blame] | 393 | // We took the LHS expression. Depending on whether we are '&&' or |
| 394 | // '||' we know what the value of the expression is via properties of |
| 395 | // the short-circuiting. |
| 396 | |
| 397 | X = MakeConstantVal( B->getOpcode() == BinaryOperator::LAnd ? 0U : 1U, B); |
Ted Kremenek | 0e561a3 | 2008-03-21 21:30:14 +0000 | [diff] [blame] | 398 | MakeNode(Dst, B, Pred, SetBlkExprRVal(St, B, X)); |
Ted Kremenek | f233d48 | 2008-02-05 00:26:40 +0000 | [diff] [blame] | 399 | } |
Ted Kremenek | f233d48 | 2008-02-05 00:26:40 +0000 | [diff] [blame] | 400 | } |
Ted Kremenek | 05a2378 | 2008-02-26 19:05:15 +0000 | [diff] [blame] | 401 | |
Ted Kremenek | f233d48 | 2008-02-05 00:26:40 +0000 | [diff] [blame] | 402 | |
Ted Kremenek | 4d4dd85 | 2008-02-13 17:41:41 +0000 | [diff] [blame] | 403 | void GRExprEngine::ProcessStmt(Stmt* S, StmtNodeBuilder& builder) { |
Ted Kremenek | ab2b8c5 | 2008-01-23 19:59:44 +0000 | [diff] [blame] | 404 | |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 405 | Builder = &builder; |
Ted Kremenek | ab2b8c5 | 2008-01-23 19:59:44 +0000 | [diff] [blame] | 406 | StmtEntryNode = builder.getLastNode(); |
| 407 | CurrentStmt = S; |
| 408 | NodeSet Dst; |
Ted Kremenek | 512c913 | 2008-03-09 18:28:41 +0000 | [diff] [blame] | 409 | |
Ted Kremenek | 99c6ad3 | 2008-03-27 07:25:52 +0000 | [diff] [blame] | 410 | // Set up our simple checks. |
| 411 | |
| 412 | if (!MsgExprChecks.empty()) |
| 413 | Builder->setObjCMsgExprAuditors( |
Ted Kremenek | e5d5c20 | 2008-03-27 21:15:17 +0000 | [diff] [blame] | 414 | (GRAuditor<ValueState>**) &MsgExprChecks[0], |
| 415 | (GRAuditor<ValueState>**) (&MsgExprChecks[0] + MsgExprChecks.size())); |
Ted Kremenek | 99c6ad3 | 2008-03-27 07:25:52 +0000 | [diff] [blame] | 416 | |
| 417 | |
| 418 | if (!CallChecks.empty()) |
| 419 | Builder->setCallExprAuditors( |
Ted Kremenek | e5d5c20 | 2008-03-27 21:15:17 +0000 | [diff] [blame] | 420 | (GRAuditor<ValueState>**) &CallChecks[0], |
| 421 | (GRAuditor<ValueState>**) (&CallChecks[0] + CallChecks.size())); |
Ted Kremenek | 99c6ad3 | 2008-03-27 07:25:52 +0000 | [diff] [blame] | 422 | |
Ted Kremenek | 512c913 | 2008-03-09 18:28:41 +0000 | [diff] [blame] | 423 | // Create the cleaned state. |
| 424 | |
Ted Kremenek | 0d093d3 | 2008-03-10 04:11:42 +0000 | [diff] [blame] | 425 | CleanedState = StateMgr.RemoveDeadBindings(StmtEntryNode->getState(), |
| 426 | CurrentStmt, Liveness); |
Ted Kremenek | 3bbad55 | 2008-03-10 04:45:00 +0000 | [diff] [blame] | 427 | |
| 428 | Builder->SetCleanedState(CleanedState); |
Ted Kremenek | 512c913 | 2008-03-09 18:28:41 +0000 | [diff] [blame] | 429 | |
| 430 | // Visit the statement. |
Ted Kremenek | ab2b8c5 | 2008-01-23 19:59:44 +0000 | [diff] [blame] | 431 | |
| 432 | Visit(S, StmtEntryNode, Dst); |
| 433 | |
| 434 | // If no nodes were generated, generate a new node that has all the |
| 435 | // dead mappings removed. |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 436 | |
Ted Kremenek | 0d093d3 | 2008-03-10 04:11:42 +0000 | [diff] [blame] | 437 | if (Dst.size() == 1 && *Dst.begin() == StmtEntryNode) |
| 438 | builder.generateNode(S, GetState(StmtEntryNode), StmtEntryNode); |
Ted Kremenek | f84469b | 2008-01-18 00:41:32 +0000 | [diff] [blame] | 439 | |
Ted Kremenek | 0d093d3 | 2008-03-10 04:11:42 +0000 | [diff] [blame] | 440 | // NULL out these variables to cleanup. |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 441 | |
Ted Kremenek | ab2b8c5 | 2008-01-23 19:59:44 +0000 | [diff] [blame] | 442 | CurrentStmt = NULL; |
| 443 | StmtEntryNode = NULL; |
| 444 | Builder = NULL; |
Ted Kremenek | 0d093d3 | 2008-03-10 04:11:42 +0000 | [diff] [blame] | 445 | CleanedState = NULL; |
Ted Kremenek | d27f816 | 2008-01-15 23:55:06 +0000 | [diff] [blame] | 446 | } |
| 447 | |
Ted Kremenek | 44842c2 | 2008-02-13 18:06:44 +0000 | [diff] [blame] | 448 | void GRExprEngine::VisitDeclRefExpr(DeclRefExpr* D, NodeTy* Pred, NodeSet& Dst){ |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 449 | |
Ted Kremenek | 3271f8d | 2008-02-07 04:16:04 +0000 | [diff] [blame] | 450 | if (D != CurrentStmt) { |
| 451 | Dst.Add(Pred); // No-op. Simply propagate the current state unchanged. |
| 452 | return; |
| 453 | } |
| 454 | |
| 455 | // If we are here, we are loading the value of the decl and binding |
| 456 | // it to the block-level expression. |
| 457 | |
Ted Kremenek | 0d093d3 | 2008-03-10 04:11:42 +0000 | [diff] [blame] | 458 | ValueState* St = GetState(Pred); |
Ted Kremenek | 9b5551d | 2008-03-09 03:30:59 +0000 | [diff] [blame] | 459 | RVal X = RVal::MakeVal(BasicVals, D); |
| 460 | RVal Y = isa<lval::DeclVal>(X) ? GetRVal(St, cast<lval::DeclVal>(X)) : X; |
Ted Kremenek | 0e561a3 | 2008-03-21 21:30:14 +0000 | [diff] [blame] | 461 | MakeNode(Dst, D, Pred, SetBlkExprRVal(St, D, Y)); |
Ted Kremenek | 3271f8d | 2008-02-07 04:16:04 +0000 | [diff] [blame] | 462 | } |
| 463 | |
Ted Kremenek | de43424 | 2008-02-19 01:44:53 +0000 | [diff] [blame] | 464 | void GRExprEngine::VisitCall(CallExpr* CE, NodeTy* Pred, |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 465 | CallExpr::arg_iterator AI, |
| 466 | CallExpr::arg_iterator AE, |
Ted Kremenek | de43424 | 2008-02-19 01:44:53 +0000 | [diff] [blame] | 467 | NodeSet& Dst) { |
| 468 | |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 469 | // Process the arguments. |
| 470 | |
| 471 | if (AI != AE) { |
Ted Kremenek | de43424 | 2008-02-19 01:44:53 +0000 | [diff] [blame] | 472 | |
Ted Kremenek | ed2d2ed | 2008-03-04 00:56:45 +0000 | [diff] [blame] | 473 | NodeSet DstTmp; |
Ted Kremenek | d753f3c | 2008-03-04 22:01:56 +0000 | [diff] [blame] | 474 | Visit(*AI, Pred, DstTmp); |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 475 | ++AI; |
| 476 | |
Ted Kremenek | d753f3c | 2008-03-04 22:01:56 +0000 | [diff] [blame] | 477 | for (NodeSet::iterator DI=DstTmp.begin(), DE=DstTmp.end(); DI != DE; ++DI) |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 478 | VisitCall(CE, *DI, AI, AE, Dst); |
Ted Kremenek | de43424 | 2008-02-19 01:44:53 +0000 | [diff] [blame] | 479 | |
| 480 | return; |
| 481 | } |
| 482 | |
| 483 | // If we reach here we have processed all of the arguments. Evaluate |
| 484 | // the callee expression. |
Ted Kremenek | a1354a5 | 2008-03-03 16:47:31 +0000 | [diff] [blame] | 485 | |
Ted Kremenek | 994a09b | 2008-02-25 21:16:03 +0000 | [diff] [blame] | 486 | NodeSet DstTmp; |
| 487 | Expr* Callee = CE->getCallee()->IgnoreParenCasts(); |
Ted Kremenek | a1354a5 | 2008-03-03 16:47:31 +0000 | [diff] [blame] | 488 | |
Ted Kremenek | 994a09b | 2008-02-25 21:16:03 +0000 | [diff] [blame] | 489 | VisitLVal(Callee, Pred, DstTmp); |
Ted Kremenek | a1354a5 | 2008-03-03 16:47:31 +0000 | [diff] [blame] | 490 | |
| 491 | if (DstTmp.empty()) |
| 492 | DstTmp.Add(Pred); |
Ted Kremenek | de43424 | 2008-02-19 01:44:53 +0000 | [diff] [blame] | 493 | |
| 494 | // Finally, evaluate the function call. |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 495 | for (NodeSet::iterator DI = DstTmp.begin(), DE = DstTmp.end(); DI!=DE; ++DI) { |
| 496 | |
Ted Kremenek | 0d093d3 | 2008-03-10 04:11:42 +0000 | [diff] [blame] | 497 | ValueState* St = GetState(*DI); |
Ted Kremenek | 994a09b | 2008-02-25 21:16:03 +0000 | [diff] [blame] | 498 | RVal L = GetLVal(St, Callee); |
Ted Kremenek | de43424 | 2008-02-19 01:44:53 +0000 | [diff] [blame] | 499 | |
Ted Kremenek | a1354a5 | 2008-03-03 16:47:31 +0000 | [diff] [blame] | 500 | // FIXME: Add support for symbolic function calls (calls involving |
| 501 | // function pointer values that are symbolic). |
| 502 | |
| 503 | // Check for undefined control-flow or calls to NULL. |
| 504 | |
Ted Kremenek | 5e03fcb | 2008-02-29 23:14:48 +0000 | [diff] [blame] | 505 | if (L.isUndef() || isa<lval::ConcreteInt>(L)) { |
Ted Kremenek | de43424 | 2008-02-19 01:44:53 +0000 | [diff] [blame] | 506 | NodeTy* N = Builder->generateNode(CE, St, *DI); |
Ted Kremenek | d753f3c | 2008-03-04 22:01:56 +0000 | [diff] [blame] | 507 | |
Ted Kremenek | 2ded35a | 2008-02-29 23:53:11 +0000 | [diff] [blame] | 508 | if (N) { |
| 509 | N->markAsSink(); |
| 510 | BadCalls.insert(N); |
| 511 | } |
Ted Kremenek | d753f3c | 2008-03-04 22:01:56 +0000 | [diff] [blame] | 512 | |
Ted Kremenek | de43424 | 2008-02-19 01:44:53 +0000 | [diff] [blame] | 513 | continue; |
Ted Kremenek | 4bf38da | 2008-03-05 21:15:02 +0000 | [diff] [blame] | 514 | } |
| 515 | |
| 516 | // Check for the "noreturn" attribute. |
| 517 | |
| 518 | SaveAndRestore<bool> OldSink(Builder->BuildSinks); |
| 519 | |
Ted Kremenek | 636e6ba | 2008-03-14 21:58:42 +0000 | [diff] [blame] | 520 | if (isa<lval::FuncVal>(L)) { |
| 521 | |
| 522 | FunctionDecl* FD = cast<lval::FuncVal>(L).getDecl(); |
| 523 | |
| 524 | if (FD->getAttr<NoReturnAttr>()) |
Ted Kremenek | 4bf38da | 2008-03-05 21:15:02 +0000 | [diff] [blame] | 525 | Builder->BuildSinks = true; |
Ted Kremenek | 636e6ba | 2008-03-14 21:58:42 +0000 | [diff] [blame] | 526 | else { |
| 527 | // HACK: Some functions are not marked noreturn, and don't return. |
| 528 | // Here are a few hardwired ones. If this takes too long, we can |
| 529 | // potentially cache these results. |
| 530 | const char* s = FD->getIdentifier()->getName(); |
| 531 | unsigned n = strlen(s); |
| 532 | |
| 533 | switch (n) { |
| 534 | default: |
| 535 | break; |
Ted Kremenek | 76fdbde | 2008-03-14 23:25:49 +0000 | [diff] [blame] | 536 | |
Ted Kremenek | 636e6ba | 2008-03-14 21:58:42 +0000 | [diff] [blame] | 537 | case 4: |
Ted Kremenek | 76fdbde | 2008-03-14 23:25:49 +0000 | [diff] [blame] | 538 | if (!memcmp(s, "exit", 4)) Builder->BuildSinks = true; |
| 539 | break; |
| 540 | |
| 541 | case 5: |
| 542 | if (!memcmp(s, "panic", 5)) Builder->BuildSinks = true; |
| 543 | break; |
Ted Kremenek | 636e6ba | 2008-03-14 21:58:42 +0000 | [diff] [blame] | 544 | } |
| 545 | } |
| 546 | } |
Ted Kremenek | 4bf38da | 2008-03-05 21:15:02 +0000 | [diff] [blame] | 547 | |
| 548 | // Evaluate the call. |
| 549 | |
Ted Kremenek | a1354a5 | 2008-03-03 16:47:31 +0000 | [diff] [blame] | 550 | |
Ted Kremenek | d753f3c | 2008-03-04 22:01:56 +0000 | [diff] [blame] | 551 | bool invalidateArgs = false; |
Ted Kremenek | de43424 | 2008-02-19 01:44:53 +0000 | [diff] [blame] | 552 | |
Ted Kremenek | 03da0d7 | 2008-02-21 19:46:04 +0000 | [diff] [blame] | 553 | if (L.isUnknown()) { |
Ted Kremenek | d753f3c | 2008-03-04 22:01:56 +0000 | [diff] [blame] | 554 | // Check for an "unknown" callee. |
| 555 | invalidateArgs = true; |
| 556 | } |
| 557 | else if (isa<lval::FuncVal>(L)) { |
| 558 | |
| 559 | IdentifierInfo* Info = cast<lval::FuncVal>(L).getDecl()->getIdentifier(); |
| 560 | |
Ted Kremenek | 55aea31 | 2008-03-05 22:59:42 +0000 | [diff] [blame] | 561 | if (unsigned id = Info->getBuiltinID()) { |
| 562 | switch (id) { |
| 563 | case Builtin::BI__builtin_expect: { |
| 564 | // For __builtin_expect, just return the value of the subexpression. |
| 565 | assert (CE->arg_begin() != CE->arg_end()); |
| 566 | RVal X = GetRVal(St, *(CE->arg_begin())); |
Ted Kremenek | 0e561a3 | 2008-03-21 21:30:14 +0000 | [diff] [blame] | 567 | MakeNode(Dst, CE, *DI, SetRVal(St, CE, X)); |
Ted Kremenek | 55aea31 | 2008-03-05 22:59:42 +0000 | [diff] [blame] | 568 | continue; |
| 569 | } |
| 570 | |
| 571 | default: |
| 572 | invalidateArgs = true; |
| 573 | break; |
| 574 | } |
| 575 | } |
Ted Kremenek | d753f3c | 2008-03-04 22:01:56 +0000 | [diff] [blame] | 576 | } |
| 577 | |
| 578 | if (invalidateArgs) { |
Ted Kremenek | 03da0d7 | 2008-02-21 19:46:04 +0000 | [diff] [blame] | 579 | // Invalidate all arguments passed in by reference (LVals). |
| 580 | for (CallExpr::arg_iterator I = CE->arg_begin(), E = CE->arg_end(); |
| 581 | I != E; ++I) { |
| 582 | RVal V = GetRVal(St, *I); |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 583 | |
Ted Kremenek | 03da0d7 | 2008-02-21 19:46:04 +0000 | [diff] [blame] | 584 | if (isa<LVal>(V)) |
| 585 | St = SetRVal(St, cast<LVal>(V), UnknownVal()); |
Ted Kremenek | 4bf38da | 2008-03-05 21:15:02 +0000 | [diff] [blame] | 586 | } |
| 587 | |
Ted Kremenek | 0e561a3 | 2008-03-21 21:30:14 +0000 | [diff] [blame] | 588 | MakeNode(Dst, CE, *DI, St); |
Ted Kremenek | 03da0d7 | 2008-02-21 19:46:04 +0000 | [diff] [blame] | 589 | } |
Ted Kremenek | d753f3c | 2008-03-04 22:01:56 +0000 | [diff] [blame] | 590 | else { |
| 591 | |
| 592 | // Check any arguments passed-by-value against being undefined. |
| 593 | |
| 594 | bool badArg = false; |
| 595 | |
| 596 | for (CallExpr::arg_iterator I = CE->arg_begin(), E = CE->arg_end(); |
| 597 | I != E; ++I) { |
| 598 | |
Ted Kremenek | 0d093d3 | 2008-03-10 04:11:42 +0000 | [diff] [blame] | 599 | if (GetRVal(GetState(*DI), *I).isUndef()) { |
| 600 | NodeTy* N = Builder->generateNode(CE, GetState(*DI), *DI); |
Ted Kremenek | d753f3c | 2008-03-04 22:01:56 +0000 | [diff] [blame] | 601 | |
| 602 | if (N) { |
| 603 | N->markAsSink(); |
| 604 | UndefArgs[N] = *I; |
| 605 | } |
| 606 | |
| 607 | badArg = true; |
| 608 | break; |
| 609 | } |
| 610 | } |
| 611 | |
| 612 | if (badArg) |
| 613 | continue; |
| 614 | |
| 615 | // Dispatch to the plug-in transfer function. |
Ted Kremenek | 330dddd | 2008-03-05 00:33:14 +0000 | [diff] [blame] | 616 | |
| 617 | unsigned size = Dst.size(); |
| 618 | |
| 619 | EvalCall(Dst, CE, cast<LVal>(L), *DI); |
| 620 | |
Ted Kremenek | 5dc7f8b | 2008-03-05 22:49:16 +0000 | [diff] [blame] | 621 | if (!Builder->BuildSinks && Dst.size() == size) |
Ted Kremenek | 0e561a3 | 2008-03-21 21:30:14 +0000 | [diff] [blame] | 622 | MakeNode(Dst, CE, *DI, St); |
Ted Kremenek | d753f3c | 2008-03-04 22:01:56 +0000 | [diff] [blame] | 623 | } |
Ted Kremenek | de43424 | 2008-02-19 01:44:53 +0000 | [diff] [blame] | 624 | } |
| 625 | } |
| 626 | |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 627 | void GRExprEngine::VisitCast(Expr* CastE, Expr* Ex, NodeTy* Pred, NodeSet& Dst){ |
Ted Kremenek | 874d63f | 2008-01-24 02:02:54 +0000 | [diff] [blame] | 628 | |
Ted Kremenek | 5d3003a | 2008-02-19 18:52:54 +0000 | [diff] [blame] | 629 | NodeSet S1; |
Ted Kremenek | 5d3003a | 2008-02-19 18:52:54 +0000 | [diff] [blame] | 630 | QualType T = CastE->getType(); |
| 631 | |
Ted Kremenek | 65cfb73 | 2008-03-04 22:16:08 +0000 | [diff] [blame] | 632 | if (T->isReferenceType()) |
| 633 | VisitLVal(Ex, Pred, S1); |
| 634 | else |
| 635 | Visit(Ex, Pred, S1); |
| 636 | |
Ted Kremenek | 402563b | 2008-02-19 18:47:04 +0000 | [diff] [blame] | 637 | // Check for redundant casts or casting to "void" |
| 638 | if (T->isVoidType() || |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 639 | Ex->getType() == T || |
| 640 | (T->isPointerType() && Ex->getType()->isFunctionType())) { |
Ted Kremenek | 5d3003a | 2008-02-19 18:52:54 +0000 | [diff] [blame] | 641 | |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 642 | for (NodeSet::iterator I1 = S1.begin(), E1 = S1.end(); I1 != E1; ++I1) |
Ted Kremenek | 5d3003a | 2008-02-19 18:52:54 +0000 | [diff] [blame] | 643 | Dst.Add(*I1); |
| 644 | |
Ted Kremenek | 874d63f | 2008-01-24 02:02:54 +0000 | [diff] [blame] | 645 | return; |
| 646 | } |
| 647 | |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 648 | for (NodeSet::iterator I1 = S1.begin(), E1 = S1.end(); I1 != E1; ++I1) { |
Ted Kremenek | 874d63f | 2008-01-24 02:02:54 +0000 | [diff] [blame] | 649 | NodeTy* N = *I1; |
Ted Kremenek | 0d093d3 | 2008-03-10 04:11:42 +0000 | [diff] [blame] | 650 | ValueState* St = GetState(N); |
Ted Kremenek | 65cfb73 | 2008-03-04 22:16:08 +0000 | [diff] [blame] | 651 | |
| 652 | RVal V = T->isReferenceType() ? GetLVal(St, Ex) : GetRVal(St, Ex); |
| 653 | |
Ted Kremenek | 0e561a3 | 2008-03-21 21:30:14 +0000 | [diff] [blame] | 654 | MakeNode(Dst, CastE, N, SetRVal(St, CastE, EvalCast(V, CastE->getType()))); |
Ted Kremenek | 874d63f | 2008-01-24 02:02:54 +0000 | [diff] [blame] | 655 | } |
Ted Kremenek | 9de04c4 | 2008-01-24 20:55:43 +0000 | [diff] [blame] | 656 | } |
| 657 | |
Ted Kremenek | 4d4dd85 | 2008-02-13 17:41:41 +0000 | [diff] [blame] | 658 | void GRExprEngine::VisitDeclStmt(DeclStmt* DS, GRExprEngine::NodeTy* Pred, |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 659 | GRExprEngine::NodeSet& Dst) { |
Ted Kremenek | 9de04c4 | 2008-01-24 20:55:43 +0000 | [diff] [blame] | 660 | |
Ted Kremenek | 0d093d3 | 2008-03-10 04:11:42 +0000 | [diff] [blame] | 661 | ValueState* St = GetState(Pred); |
Ted Kremenek | 9de04c4 | 2008-01-24 20:55:43 +0000 | [diff] [blame] | 662 | |
| 663 | for (const ScopedDecl* D = DS->getDecl(); D; D = D->getNextDeclarator()) |
Ted Kremenek | 403c181 | 2008-01-28 22:51:57 +0000 | [diff] [blame] | 664 | if (const VarDecl* VD = dyn_cast<VarDecl>(D)) { |
Ted Kremenek | c2c95b0 | 2008-02-19 00:29:51 +0000 | [diff] [blame] | 665 | |
| 666 | // FIXME: Add support for local arrays. |
| 667 | if (VD->getType()->isArrayType()) |
| 668 | continue; |
| 669 | |
Ted Kremenek | b0ab212 | 2008-02-27 19:21:33 +0000 | [diff] [blame] | 670 | const Expr* Ex = VD->getInit(); |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 671 | |
Ted Kremenek | b0ab212 | 2008-02-27 19:21:33 +0000 | [diff] [blame] | 672 | if (!VD->hasGlobalStorage() || VD->getStorageClass() == VarDecl::Static) { |
| 673 | |
| 674 | // In this context, Static => Local variable. |
| 675 | |
| 676 | assert (!VD->getStorageClass() == VarDecl::Static || |
| 677 | !isa<FileVarDecl>(VD)); |
| 678 | |
| 679 | // If there is no initializer, set the value of the |
Ted Kremenek | 4a4e524 | 2008-02-28 09:25:22 +0000 | [diff] [blame] | 680 | // variable to "Undefined". |
Ted Kremenek | b0ab212 | 2008-02-27 19:21:33 +0000 | [diff] [blame] | 681 | // |
| 682 | // FIXME: static variables may have an initializer, but the second |
| 683 | // time a function is called those values may not be current. |
Ted Kremenek | fcb092b | 2008-03-04 20:40:11 +0000 | [diff] [blame] | 684 | |
| 685 | QualType T = VD->getType(); |
Ted Kremenek | b0ab212 | 2008-02-27 19:21:33 +0000 | [diff] [blame] | 686 | |
Ted Kremenek | 16d8156 | 2008-03-04 04:18:04 +0000 | [diff] [blame] | 687 | if ( VD->getStorageClass() == VarDecl::Static) { |
Ted Kremenek | 16d8156 | 2008-03-04 04:18:04 +0000 | [diff] [blame] | 688 | |
| 689 | // C99: 6.7.8 Initialization |
| 690 | // If an object that has static storage duration is not initialized |
| 691 | // explicitly, then: |
| 692 | // —if it has pointer type, it is initialized to a null pointer; |
| 693 | // —if it has arithmetic type, it is initialized to (positive or |
| 694 | // unsigned) zero; |
| 695 | |
Ted Kremenek | fcb092b | 2008-03-04 20:40:11 +0000 | [diff] [blame] | 696 | // FIXME: Handle structs. Now we treat their values as unknown. |
| 697 | |
Ted Kremenek | 16d8156 | 2008-03-04 04:18:04 +0000 | [diff] [blame] | 698 | if (T->isPointerType()) { |
| 699 | |
| 700 | St = SetRVal(St, lval::DeclVal(VD), |
Ted Kremenek | 240f1f0 | 2008-03-07 20:13:31 +0000 | [diff] [blame] | 701 | lval::ConcreteInt(BasicVals.getValue(0, T))); |
Ted Kremenek | 16d8156 | 2008-03-04 04:18:04 +0000 | [diff] [blame] | 702 | } |
| 703 | else if (T->isIntegerType()) { |
| 704 | |
| 705 | St = SetRVal(St, lval::DeclVal(VD), |
Ted Kremenek | 240f1f0 | 2008-03-07 20:13:31 +0000 | [diff] [blame] | 706 | nonlval::ConcreteInt(BasicVals.getValue(0, T))); |
Ted Kremenek | 16d8156 | 2008-03-04 04:18:04 +0000 | [diff] [blame] | 707 | } |
| 708 | |
Ted Kremenek | fcb092b | 2008-03-04 20:40:11 +0000 | [diff] [blame] | 709 | |
Ted Kremenek | 16d8156 | 2008-03-04 04:18:04 +0000 | [diff] [blame] | 710 | } |
Ted Kremenek | fcb092b | 2008-03-04 20:40:11 +0000 | [diff] [blame] | 711 | else { |
Ted Kremenek | 16d8156 | 2008-03-04 04:18:04 +0000 | [diff] [blame] | 712 | |
Ted Kremenek | fcb092b | 2008-03-04 20:40:11 +0000 | [diff] [blame] | 713 | // FIXME: Handle structs. Now we treat them as unknown. What |
| 714 | // we need to do is treat their members as unknown. |
| 715 | |
| 716 | if (T->isPointerType() || T->isIntegerType()) |
| 717 | St = SetRVal(St, lval::DeclVal(VD), |
| 718 | Ex ? GetRVal(St, Ex) : UndefinedVal()); |
| 719 | } |
Ted Kremenek | b0ab212 | 2008-02-27 19:21:33 +0000 | [diff] [blame] | 720 | } |
Ted Kremenek | 403c181 | 2008-01-28 22:51:57 +0000 | [diff] [blame] | 721 | } |
Ted Kremenek | 9de04c4 | 2008-01-24 20:55:43 +0000 | [diff] [blame] | 722 | |
Ted Kremenek | 0e561a3 | 2008-03-21 21:30:14 +0000 | [diff] [blame] | 723 | MakeNode(Dst, DS, Pred, St); |
Ted Kremenek | 9de04c4 | 2008-01-24 20:55:43 +0000 | [diff] [blame] | 724 | } |
Ted Kremenek | 874d63f | 2008-01-24 02:02:54 +0000 | [diff] [blame] | 725 | |
Ted Kremenek | f233d48 | 2008-02-05 00:26:40 +0000 | [diff] [blame] | 726 | |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 727 | void GRExprEngine::VisitGuardedExpr(Expr* Ex, Expr* L, Expr* R, |
Ted Kremenek | f233d48 | 2008-02-05 00:26:40 +0000 | [diff] [blame] | 728 | NodeTy* Pred, NodeSet& Dst) { |
| 729 | |
Ted Kremenek | 05a2378 | 2008-02-26 19:05:15 +0000 | [diff] [blame] | 730 | assert (Ex == CurrentStmt && getCFG().isBlkExpr(Ex)); |
| 731 | |
Ted Kremenek | 0d093d3 | 2008-03-10 04:11:42 +0000 | [diff] [blame] | 732 | ValueState* St = GetState(Pred); |
Ted Kremenek | 05a2378 | 2008-02-26 19:05:15 +0000 | [diff] [blame] | 733 | RVal X = GetBlkExprRVal(St, Ex); |
Ted Kremenek | f233d48 | 2008-02-05 00:26:40 +0000 | [diff] [blame] | 734 | |
Ted Kremenek | 4a4e524 | 2008-02-28 09:25:22 +0000 | [diff] [blame] | 735 | assert (X.isUndef()); |
Ted Kremenek | f233d48 | 2008-02-05 00:26:40 +0000 | [diff] [blame] | 736 | |
Ted Kremenek | 4a4e524 | 2008-02-28 09:25:22 +0000 | [diff] [blame] | 737 | Expr* SE = (Expr*) cast<UndefinedVal>(X).getData(); |
Ted Kremenek | 05a2378 | 2008-02-26 19:05:15 +0000 | [diff] [blame] | 738 | |
| 739 | assert (SE); |
| 740 | |
| 741 | X = GetBlkExprRVal(St, SE); |
Ted Kremenek | 5a7b382 | 2008-02-26 23:37:01 +0000 | [diff] [blame] | 742 | |
| 743 | // Make sure that we invalidate the previous binding. |
Ted Kremenek | 0e561a3 | 2008-03-21 21:30:14 +0000 | [diff] [blame] | 744 | MakeNode(Dst, Ex, Pred, StateMgr.SetRVal(St, Ex, X, true, true)); |
Ted Kremenek | f233d48 | 2008-02-05 00:26:40 +0000 | [diff] [blame] | 745 | } |
| 746 | |
Ted Kremenek | d9435bf | 2008-02-12 19:49:57 +0000 | [diff] [blame] | 747 | /// VisitSizeOfAlignOfTypeExpr - Transfer function for sizeof(type). |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 748 | void GRExprEngine::VisitSizeOfAlignOfTypeExpr(SizeOfAlignOfTypeExpr* Ex, |
| 749 | NodeTy* Pred, |
| 750 | NodeSet& Dst) { |
Ted Kremenek | 9ef1ec9 | 2008-02-21 18:43:30 +0000 | [diff] [blame] | 751 | |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 752 | QualType T = Ex->getArgumentType(); |
Ted Kremenek | 87e8034 | 2008-03-15 03:13:20 +0000 | [diff] [blame] | 753 | uint64_t amt; |
| 754 | |
| 755 | if (Ex->isSizeOf()) { |
Ted Kremenek | 9ef1ec9 | 2008-02-21 18:43:30 +0000 | [diff] [blame] | 756 | |
Ted Kremenek | 87e8034 | 2008-03-15 03:13:20 +0000 | [diff] [blame] | 757 | // FIXME: Add support for VLAs. |
| 758 | if (!T.getTypePtr()->isConstantSizeType()) |
| 759 | return; |
| 760 | |
| 761 | amt = 1; // Handle sizeof(void) |
| 762 | |
| 763 | if (T != getContext().VoidTy) |
| 764 | amt = getContext().getTypeSize(T) / 8; |
| 765 | |
| 766 | } |
| 767 | else // Get alignment of the type. |
Ted Kremenek | 897781a | 2008-03-15 03:13:55 +0000 | [diff] [blame] | 768 | amt = getContext().getTypeAlign(T) / 8; |
Ted Kremenek | d9435bf | 2008-02-12 19:49:57 +0000 | [diff] [blame] | 769 | |
Ted Kremenek | 0e561a3 | 2008-03-21 21:30:14 +0000 | [diff] [blame] | 770 | MakeNode(Dst, Ex, Pred, |
Ted Kremenek | 0d093d3 | 2008-03-10 04:11:42 +0000 | [diff] [blame] | 771 | SetRVal(GetState(Pred), Ex, |
Ted Kremenek | 87e8034 | 2008-03-15 03:13:20 +0000 | [diff] [blame] | 772 | NonLVal::MakeVal(BasicVals, amt, Ex->getType()))); |
Ted Kremenek | d9435bf | 2008-02-12 19:49:57 +0000 | [diff] [blame] | 773 | } |
| 774 | |
Ted Kremenek | ffe0f43 | 2008-03-07 22:58:01 +0000 | [diff] [blame] | 775 | void GRExprEngine::VisitDeref(UnaryOperator* U, NodeTy* Pred, |
| 776 | NodeSet& Dst, bool GetLVal) { |
Ted Kremenek | d8e9f0d | 2008-02-20 04:02:35 +0000 | [diff] [blame] | 777 | |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 778 | Expr* Ex = U->getSubExpr()->IgnoreParens(); |
Ted Kremenek | d8e9f0d | 2008-02-20 04:02:35 +0000 | [diff] [blame] | 779 | |
| 780 | NodeSet DstTmp; |
| 781 | |
Ted Kremenek | 018c15f | 2008-02-26 03:44:25 +0000 | [diff] [blame] | 782 | if (isa<DeclRefExpr>(Ex)) |
Ted Kremenek | d8e9f0d | 2008-02-20 04:02:35 +0000 | [diff] [blame] | 783 | DstTmp.Add(Pred); |
| 784 | else |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 785 | Visit(Ex, Pred, DstTmp); |
Ted Kremenek | d8e9f0d | 2008-02-20 04:02:35 +0000 | [diff] [blame] | 786 | |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 787 | for (NodeSet::iterator I = DstTmp.begin(), DE = DstTmp.end(); I != DE; ++I) { |
Ted Kremenek | d8e9f0d | 2008-02-20 04:02:35 +0000 | [diff] [blame] | 788 | |
| 789 | NodeTy* N = *I; |
Ted Kremenek | 0d093d3 | 2008-03-10 04:11:42 +0000 | [diff] [blame] | 790 | ValueState* St = GetState(N); |
Ted Kremenek | d8e9f0d | 2008-02-20 04:02:35 +0000 | [diff] [blame] | 791 | |
| 792 | // FIXME: Bifurcate when dereferencing a symbolic with no constraints? |
| 793 | |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 794 | RVal V = GetRVal(St, Ex); |
Ted Kremenek | d8e9f0d | 2008-02-20 04:02:35 +0000 | [diff] [blame] | 795 | |
Ted Kremenek | 4a4e524 | 2008-02-28 09:25:22 +0000 | [diff] [blame] | 796 | // Check for dereferences of undefined values. |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 797 | |
Ted Kremenek | 4a4e524 | 2008-02-28 09:25:22 +0000 | [diff] [blame] | 798 | if (V.isUndef()) { |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 799 | |
Ted Kremenek | d8e9f0d | 2008-02-20 04:02:35 +0000 | [diff] [blame] | 800 | NodeTy* Succ = Builder->generateNode(U, St, N); |
| 801 | |
| 802 | if (Succ) { |
| 803 | Succ->markAsSink(); |
Ted Kremenek | 4a4e524 | 2008-02-28 09:25:22 +0000 | [diff] [blame] | 804 | UndefDeref.insert(Succ); |
Ted Kremenek | d8e9f0d | 2008-02-20 04:02:35 +0000 | [diff] [blame] | 805 | } |
| 806 | |
| 807 | continue; |
| 808 | } |
| 809 | |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 810 | // Check for dereferences of unknown values. Treat as No-Ops. |
| 811 | |
| 812 | if (V.isUnknown()) { |
Ted Kremenek | d8e9f0d | 2008-02-20 04:02:35 +0000 | [diff] [blame] | 813 | Dst.Add(N); |
| 814 | continue; |
| 815 | } |
| 816 | |
| 817 | // After a dereference, one of two possible situations arise: |
| 818 | // (1) A crash, because the pointer was NULL. |
| 819 | // (2) The pointer is not NULL, and the dereference works. |
| 820 | // |
| 821 | // We add these assumptions. |
| 822 | |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 823 | LVal LV = cast<LVal>(V); |
Ted Kremenek | d8e9f0d | 2008-02-20 04:02:35 +0000 | [diff] [blame] | 824 | bool isFeasibleNotNull; |
| 825 | |
| 826 | // "Assume" that the pointer is Not-NULL. |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 827 | |
Ted Kremenek | aed9b6a | 2008-02-28 10:21:43 +0000 | [diff] [blame] | 828 | ValueState* StNotNull = Assume(St, LV, true, isFeasibleNotNull); |
Ted Kremenek | d8e9f0d | 2008-02-20 04:02:35 +0000 | [diff] [blame] | 829 | |
| 830 | if (isFeasibleNotNull) { |
Ted Kremenek | ffe0f43 | 2008-03-07 22:58:01 +0000 | [diff] [blame] | 831 | |
Ted Kremenek | 0e561a3 | 2008-03-21 21:30:14 +0000 | [diff] [blame] | 832 | if (GetLVal) MakeNode(Dst, U, N, SetRVal(StNotNull, U, LV)); |
Ted Kremenek | ffe0f43 | 2008-03-07 22:58:01 +0000 | [diff] [blame] | 833 | else { |
| 834 | |
| 835 | // FIXME: Currently symbolic analysis "generates" new symbols |
| 836 | // for the contents of values. We need a better approach. |
Ted Kremenek | d8e9f0d | 2008-02-20 04:02:35 +0000 | [diff] [blame] | 837 | |
Ted Kremenek | 0e561a3 | 2008-03-21 21:30:14 +0000 | [diff] [blame] | 838 | MakeNode(Dst, U, N, SetRVal(StNotNull, U, |
Ted Kremenek | ffe0f43 | 2008-03-07 22:58:01 +0000 | [diff] [blame] | 839 | GetRVal(StNotNull, LV, U->getType()))); |
| 840 | } |
Ted Kremenek | d8e9f0d | 2008-02-20 04:02:35 +0000 | [diff] [blame] | 841 | } |
| 842 | |
| 843 | bool isFeasibleNull; |
| 844 | |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 845 | // Now "assume" that the pointer is NULL. |
| 846 | |
Ted Kremenek | aed9b6a | 2008-02-28 10:21:43 +0000 | [diff] [blame] | 847 | ValueState* StNull = Assume(St, LV, false, isFeasibleNull); |
Ted Kremenek | d8e9f0d | 2008-02-20 04:02:35 +0000 | [diff] [blame] | 848 | |
| 849 | if (isFeasibleNull) { |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 850 | |
Ted Kremenek | 0e561a3 | 2008-03-21 21:30:14 +0000 | [diff] [blame] | 851 | // We don't use "MakeNode" here because the node will be a sink |
Ted Kremenek | d8e9f0d | 2008-02-20 04:02:35 +0000 | [diff] [blame] | 852 | // and we have no intention of processing it later. |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 853 | |
Ted Kremenek | d8e9f0d | 2008-02-20 04:02:35 +0000 | [diff] [blame] | 854 | NodeTy* NullNode = Builder->generateNode(U, StNull, N); |
| 855 | |
| 856 | if (NullNode) { |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 857 | |
Ted Kremenek | d8e9f0d | 2008-02-20 04:02:35 +0000 | [diff] [blame] | 858 | NullNode->markAsSink(); |
| 859 | |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 860 | if (isFeasibleNotNull) ImplicitNullDeref.insert(NullNode); |
| 861 | else ExplicitNullDeref.insert(NullNode); |
Ted Kremenek | d8e9f0d | 2008-02-20 04:02:35 +0000 | [diff] [blame] | 862 | } |
| 863 | } |
| 864 | } |
| 865 | } |
| 866 | |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 867 | void GRExprEngine::VisitUnaryOperator(UnaryOperator* U, NodeTy* Pred, |
| 868 | NodeSet& Dst) { |
Ted Kremenek | 3271f8d | 2008-02-07 04:16:04 +0000 | [diff] [blame] | 869 | |
Ted Kremenek | 7b8009a | 2008-01-24 02:28:56 +0000 | [diff] [blame] | 870 | NodeSet S1; |
Ted Kremenek | 3271f8d | 2008-02-07 04:16:04 +0000 | [diff] [blame] | 871 | |
Ted Kremenek | d8e9f0d | 2008-02-20 04:02:35 +0000 | [diff] [blame] | 872 | assert (U->getOpcode() != UnaryOperator::Deref); |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 873 | assert (U->getOpcode() != UnaryOperator::SizeOf); |
| 874 | assert (U->getOpcode() != UnaryOperator::AlignOf); |
| 875 | |
| 876 | bool use_GetLVal = false; |
Ted Kremenek | d8e9f0d | 2008-02-20 04:02:35 +0000 | [diff] [blame] | 877 | |
| 878 | switch (U->getOpcode()) { |
| 879 | case UnaryOperator::PostInc: |
| 880 | case UnaryOperator::PostDec: |
| 881 | case UnaryOperator::PreInc: |
| 882 | case UnaryOperator::PreDec: |
| 883 | case UnaryOperator::AddrOf: |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 884 | // Evalue subexpression as an LVal. |
| 885 | use_GetLVal = true; |
| 886 | VisitLVal(U->getSubExpr(), Pred, S1); |
Ted Kremenek | d8e9f0d | 2008-02-20 04:02:35 +0000 | [diff] [blame] | 887 | break; |
| 888 | |
| 889 | default: |
| 890 | Visit(U->getSubExpr(), Pred, S1); |
| 891 | break; |
| 892 | } |
| 893 | |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 894 | for (NodeSet::iterator I1 = S1.begin(), E1 = S1.end(); I1 != E1; ++I1) { |
Ted Kremenek | d8e9f0d | 2008-02-20 04:02:35 +0000 | [diff] [blame] | 895 | |
Ted Kremenek | 7b8009a | 2008-01-24 02:28:56 +0000 | [diff] [blame] | 896 | NodeTy* N1 = *I1; |
Ted Kremenek | 0d093d3 | 2008-03-10 04:11:42 +0000 | [diff] [blame] | 897 | ValueState* St = GetState(N1); |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 898 | |
| 899 | RVal SubV = use_GetLVal ? GetLVal(St, U->getSubExpr()) : |
| 900 | GetRVal(St, U->getSubExpr()); |
| 901 | |
| 902 | if (SubV.isUnknown()) { |
| 903 | Dst.Add(N1); |
| 904 | continue; |
| 905 | } |
| 906 | |
Ted Kremenek | 4a4e524 | 2008-02-28 09:25:22 +0000 | [diff] [blame] | 907 | if (SubV.isUndef()) { |
Ted Kremenek | 0e561a3 | 2008-03-21 21:30:14 +0000 | [diff] [blame] | 908 | MakeNode(Dst, U, N1, SetRVal(St, U, SubV)); |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 909 | continue; |
| 910 | } |
Ted Kremenek | 7b8009a | 2008-01-24 02:28:56 +0000 | [diff] [blame] | 911 | |
Ted Kremenek | 50d0ac2 | 2008-02-15 22:09:30 +0000 | [diff] [blame] | 912 | if (U->isIncrementDecrementOp()) { |
Ted Kremenek | d8e9f0d | 2008-02-20 04:02:35 +0000 | [diff] [blame] | 913 | |
| 914 | // Handle ++ and -- (both pre- and post-increment). |
| 915 | |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 916 | LVal SubLV = cast<LVal>(SubV); |
| 917 | RVal V = GetRVal(St, SubLV, U->getType()); |
| 918 | |
Ted Kremenek | 89063af | 2008-02-21 19:15:37 +0000 | [diff] [blame] | 919 | if (V.isUnknown()) { |
| 920 | Dst.Add(N1); |
| 921 | continue; |
| 922 | } |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 923 | |
Ted Kremenek | 4a4e524 | 2008-02-28 09:25:22 +0000 | [diff] [blame] | 924 | // Propagate undefined values. |
| 925 | if (V.isUndef()) { |
Ted Kremenek | 0e561a3 | 2008-03-21 21:30:14 +0000 | [diff] [blame] | 926 | MakeNode(Dst, U, N1, SetRVal(St, U, V)); |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 927 | continue; |
| 928 | } |
| 929 | |
Ted Kremenek | 443003b | 2008-02-21 19:29:23 +0000 | [diff] [blame] | 930 | // Handle all other values. |
Ted Kremenek | 50d0ac2 | 2008-02-15 22:09:30 +0000 | [diff] [blame] | 931 | |
| 932 | BinaryOperator::Opcode Op = U->isIncrementOp() ? BinaryOperator::Add |
| 933 | : BinaryOperator::Sub; |
| 934 | |
Ted Kremenek | 443003b | 2008-02-21 19:29:23 +0000 | [diff] [blame] | 935 | RVal Result = EvalBinOp(Op, V, MakeConstantVal(1U, U)); |
Ted Kremenek | 50d0ac2 | 2008-02-15 22:09:30 +0000 | [diff] [blame] | 936 | |
| 937 | if (U->isPostfix()) |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 938 | St = SetRVal(SetRVal(St, U, V), SubLV, Result); |
Ted Kremenek | 50d0ac2 | 2008-02-15 22:09:30 +0000 | [diff] [blame] | 939 | else |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 940 | St = SetRVal(SetRVal(St, U, Result), SubLV, Result); |
Ted Kremenek | 50d0ac2 | 2008-02-15 22:09:30 +0000 | [diff] [blame] | 941 | |
Ted Kremenek | 0e561a3 | 2008-03-21 21:30:14 +0000 | [diff] [blame] | 942 | MakeNode(Dst, U, N1, St); |
Ted Kremenek | 50d0ac2 | 2008-02-15 22:09:30 +0000 | [diff] [blame] | 943 | continue; |
| 944 | } |
| 945 | |
| 946 | // Handle all other unary operators. |
| 947 | |
Ted Kremenek | 7b8009a | 2008-01-24 02:28:56 +0000 | [diff] [blame] | 948 | switch (U->getOpcode()) { |
Ted Kremenek | 5139c78 | 2008-03-15 03:05:30 +0000 | [diff] [blame] | 949 | |
| 950 | case UnaryOperator::Extension: |
| 951 | St = SetRVal(St, U, SubV); |
| 952 | break; |
Ted Kremenek | cf78b6a | 2008-02-06 22:50:25 +0000 | [diff] [blame] | 953 | |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 954 | case UnaryOperator::Minus: |
| 955 | St = SetRVal(St, U, EvalMinus(U, cast<NonLVal>(SubV))); |
Ted Kremenek | dacbb4f | 2008-01-24 08:20:02 +0000 | [diff] [blame] | 956 | break; |
Ted Kremenek | dacbb4f | 2008-01-24 08:20:02 +0000 | [diff] [blame] | 957 | |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 958 | case UnaryOperator::Not: |
| 959 | St = SetRVal(St, U, EvalComplement(cast<NonLVal>(SubV))); |
Ted Kremenek | 90e4203 | 2008-02-20 04:12:31 +0000 | [diff] [blame] | 960 | break; |
Ted Kremenek | 90e4203 | 2008-02-20 04:12:31 +0000 | [diff] [blame] | 961 | |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 962 | case UnaryOperator::LNot: |
Ted Kremenek | c5d3b4c | 2008-02-04 16:58:30 +0000 | [diff] [blame] | 963 | |
Ted Kremenek | c60f0f7 | 2008-02-06 17:56:00 +0000 | [diff] [blame] | 964 | // C99 6.5.3.3: "The expression !E is equivalent to (0==E)." |
| 965 | // |
| 966 | // Note: technically we do "E == 0", but this is the same in the |
| 967 | // transfer functions as "0 == E". |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 968 | |
| 969 | if (isa<LVal>(SubV)) { |
Ted Kremenek | 240f1f0 | 2008-03-07 20:13:31 +0000 | [diff] [blame] | 970 | lval::ConcreteInt V(BasicVals.getZeroWithPtrWidth()); |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 971 | RVal Result = EvalBinOp(BinaryOperator::EQ, cast<LVal>(SubV), V); |
| 972 | St = SetRVal(St, U, Result); |
Ted Kremenek | c60f0f7 | 2008-02-06 17:56:00 +0000 | [diff] [blame] | 973 | } |
| 974 | else { |
Ted Kremenek | f7ca696 | 2008-02-22 00:42:36 +0000 | [diff] [blame] | 975 | Expr* Ex = U->getSubExpr(); |
Ted Kremenek | 240f1f0 | 2008-03-07 20:13:31 +0000 | [diff] [blame] | 976 | nonlval::ConcreteInt V(BasicVals.getValue(0, Ex->getType())); |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 977 | RVal Result = EvalBinOp(BinaryOperator::EQ, cast<NonLVal>(SubV), V); |
| 978 | St = SetRVal(St, U, Result); |
Ted Kremenek | c60f0f7 | 2008-02-06 17:56:00 +0000 | [diff] [blame] | 979 | } |
| 980 | |
| 981 | break; |
Ted Kremenek | c60f0f7 | 2008-02-06 17:56:00 +0000 | [diff] [blame] | 982 | |
Ted Kremenek | 6492485 | 2008-01-31 02:35:41 +0000 | [diff] [blame] | 983 | case UnaryOperator::AddrOf: { |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 984 | assert (isa<LVal>(SubV)); |
| 985 | St = SetRVal(St, U, SubV); |
Ted Kremenek | 6492485 | 2008-01-31 02:35:41 +0000 | [diff] [blame] | 986 | break; |
| 987 | } |
Ted Kremenek | d131c4f | 2008-02-07 05:48:01 +0000 | [diff] [blame] | 988 | |
Ted Kremenek | 7b8009a | 2008-01-24 02:28:56 +0000 | [diff] [blame] | 989 | default: ; |
| 990 | assert (false && "Not implemented."); |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 991 | } |
| 992 | |
Ted Kremenek | 0e561a3 | 2008-03-21 21:30:14 +0000 | [diff] [blame] | 993 | MakeNode(Dst, U, N1, St); |
Ted Kremenek | 7b8009a | 2008-01-24 02:28:56 +0000 | [diff] [blame] | 994 | } |
| 995 | } |
| 996 | |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 997 | void GRExprEngine::VisitSizeOfExpr(UnaryOperator* U, NodeTy* Pred, |
| 998 | NodeSet& Dst) { |
Ted Kremenek | d8e9f0d | 2008-02-20 04:02:35 +0000 | [diff] [blame] | 999 | |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 1000 | QualType T = U->getSubExpr()->getType(); |
Ted Kremenek | d8e9f0d | 2008-02-20 04:02:35 +0000 | [diff] [blame] | 1001 | |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 1002 | // FIXME: Add support for VLAs. |
| 1003 | if (!T.getTypePtr()->isConstantSizeType()) |
| 1004 | return; |
| 1005 | |
Chris Lattner | 98be494 | 2008-03-05 18:54:05 +0000 | [diff] [blame] | 1006 | uint64_t size = getContext().getTypeSize(T) / 8; |
Ted Kremenek | 0d093d3 | 2008-03-10 04:11:42 +0000 | [diff] [blame] | 1007 | ValueState* St = GetState(Pred); |
Ted Kremenek | 240f1f0 | 2008-03-07 20:13:31 +0000 | [diff] [blame] | 1008 | St = SetRVal(St, U, NonLVal::MakeVal(BasicVals, size, U->getType())); |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 1009 | |
Ted Kremenek | 0e561a3 | 2008-03-21 21:30:14 +0000 | [diff] [blame] | 1010 | MakeNode(Dst, U, Pred, St); |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 1011 | } |
| 1012 | |
| 1013 | void GRExprEngine::VisitLVal(Expr* Ex, NodeTy* Pred, NodeSet& Dst) { |
Ted Kremenek | 2ad8868 | 2008-02-27 07:04:16 +0000 | [diff] [blame] | 1014 | |
| 1015 | if (Ex != CurrentStmt && getCFG().isBlkExpr(Ex)) { |
| 1016 | Dst.Add(Pred); |
| 1017 | return; |
| 1018 | } |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 1019 | |
| 1020 | Ex = Ex->IgnoreParens(); |
| 1021 | |
Ted Kremenek | 0793263 | 2008-02-27 06:47:26 +0000 | [diff] [blame] | 1022 | if (isa<DeclRefExpr>(Ex)) { |
Ted Kremenek | 3271f8d | 2008-02-07 04:16:04 +0000 | [diff] [blame] | 1023 | Dst.Add(Pred); |
Ted Kremenek | 5b6dc2d | 2008-02-07 01:08:27 +0000 | [diff] [blame] | 1024 | return; |
Ted Kremenek | 3271f8d | 2008-02-07 04:16:04 +0000 | [diff] [blame] | 1025 | } |
Ted Kremenek | 5b6dc2d | 2008-02-07 01:08:27 +0000 | [diff] [blame] | 1026 | |
Ted Kremenek | ffe0f43 | 2008-03-07 22:58:01 +0000 | [diff] [blame] | 1027 | if (UnaryOperator* U = dyn_cast<UnaryOperator>(Ex)) |
Ted Kremenek | 5b6dc2d | 2008-02-07 01:08:27 +0000 | [diff] [blame] | 1028 | if (U->getOpcode() == UnaryOperator::Deref) { |
Ted Kremenek | ffe0f43 | 2008-03-07 22:58:01 +0000 | [diff] [blame] | 1029 | VisitDeref(U, Pred, Dst, true); |
Ted Kremenek | 5b6dc2d | 2008-02-07 01:08:27 +0000 | [diff] [blame] | 1030 | return; |
| 1031 | } |
Ted Kremenek | 5b6dc2d | 2008-02-07 01:08:27 +0000 | [diff] [blame] | 1032 | |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 1033 | Visit(Ex, Pred, Dst); |
Ted Kremenek | 5b6dc2d | 2008-02-07 01:08:27 +0000 | [diff] [blame] | 1034 | } |
| 1035 | |
Ted Kremenek | ef44bfb | 2008-03-17 21:11:24 +0000 | [diff] [blame] | 1036 | void GRExprEngine::VisitAsmStmt(AsmStmt* A, NodeTy* Pred, NodeSet& Dst) { |
| 1037 | VisitAsmStmtHelperOutputs(A, A->begin_outputs(), A->end_outputs(), Pred, Dst); |
| 1038 | } |
| 1039 | |
| 1040 | void GRExprEngine::VisitAsmStmtHelperOutputs(AsmStmt* A, |
| 1041 | AsmStmt::outputs_iterator I, |
| 1042 | AsmStmt::outputs_iterator E, |
| 1043 | NodeTy* Pred, NodeSet& Dst) { |
| 1044 | if (I == E) { |
| 1045 | VisitAsmStmtHelperInputs(A, A->begin_inputs(), A->end_inputs(), Pred, Dst); |
| 1046 | return; |
| 1047 | } |
| 1048 | |
| 1049 | NodeSet Tmp; |
| 1050 | VisitLVal(*I, Pred, Tmp); |
| 1051 | |
| 1052 | ++I; |
| 1053 | |
| 1054 | for (NodeSet::iterator NI = Tmp.begin(), NE = Tmp.end(); NI != NE; ++NI) |
| 1055 | VisitAsmStmtHelperOutputs(A, I, E, *NI, Dst); |
| 1056 | } |
| 1057 | |
| 1058 | void GRExprEngine::VisitAsmStmtHelperInputs(AsmStmt* A, |
| 1059 | AsmStmt::inputs_iterator I, |
| 1060 | AsmStmt::inputs_iterator E, |
| 1061 | NodeTy* Pred, NodeSet& Dst) { |
| 1062 | if (I == E) { |
| 1063 | |
| 1064 | // We have processed both the inputs and the outputs. All of the outputs |
| 1065 | // should evaluate to LVals. Nuke all of their values. |
| 1066 | |
| 1067 | // FIXME: Some day in the future it would be nice to allow a "plug-in" |
| 1068 | // which interprets the inline asm and stores proper results in the |
| 1069 | // outputs. |
| 1070 | |
| 1071 | ValueState* St = GetState(Pred); |
| 1072 | |
| 1073 | for (AsmStmt::outputs_iterator OI = A->begin_outputs(), |
| 1074 | OE = A->end_outputs(); OI != OE; ++OI) { |
| 1075 | |
| 1076 | RVal X = GetLVal(St, *OI); |
| 1077 | |
| 1078 | assert (!isa<NonLVal>(X)); |
| 1079 | |
| 1080 | if (isa<LVal>(X)) |
| 1081 | St = SetRVal(St, cast<LVal>(X), UnknownVal()); |
| 1082 | } |
| 1083 | |
Ted Kremenek | 0e561a3 | 2008-03-21 21:30:14 +0000 | [diff] [blame] | 1084 | MakeNode(Dst, A, Pred, St); |
Ted Kremenek | ef44bfb | 2008-03-17 21:11:24 +0000 | [diff] [blame] | 1085 | return; |
| 1086 | } |
| 1087 | |
| 1088 | NodeSet Tmp; |
| 1089 | Visit(*I, Pred, Tmp); |
| 1090 | |
| 1091 | ++I; |
| 1092 | |
| 1093 | for (NodeSet::iterator NI = Tmp.begin(), NE = Tmp.end(); NI != NE; ++NI) |
| 1094 | VisitAsmStmtHelperInputs(A, I, E, *NI, Dst); |
| 1095 | } |
| 1096 | |
| 1097 | |
Ted Kremenek | 55deb97 | 2008-03-25 00:34:37 +0000 | [diff] [blame] | 1098 | void GRExprEngine::VisitObjCMessageExpr(ObjCMessageExpr* ME, NodeTy* Pred, |
| 1099 | NodeSet& Dst){ |
Ted Kremenek | b930837 | 2008-03-25 16:07:41 +0000 | [diff] [blame] | 1100 | VisitObjCMessageExprArgHelper(ME, ME->arg_begin(), ME->arg_end(), Pred, Dst); |
Ted Kremenek | 55deb97 | 2008-03-25 00:34:37 +0000 | [diff] [blame] | 1101 | } |
| 1102 | |
Ted Kremenek | b930837 | 2008-03-25 16:07:41 +0000 | [diff] [blame] | 1103 | void GRExprEngine::VisitObjCMessageExprArgHelper(ObjCMessageExpr* ME, |
Ted Kremenek | 23a4f91 | 2008-03-25 02:10:28 +0000 | [diff] [blame] | 1104 | ObjCMessageExpr::arg_iterator AI, |
| 1105 | ObjCMessageExpr::arg_iterator AE, |
Ted Kremenek | 55deb97 | 2008-03-25 00:34:37 +0000 | [diff] [blame] | 1106 | NodeTy* Pred, NodeSet& Dst) { |
Ted Kremenek | 23a4f91 | 2008-03-25 02:10:28 +0000 | [diff] [blame] | 1107 | if (AI == AE) { |
Ted Kremenek | 55deb97 | 2008-03-25 00:34:37 +0000 | [diff] [blame] | 1108 | |
| 1109 | // Process the receiver. |
| 1110 | |
Ted Kremenek | b930837 | 2008-03-25 16:07:41 +0000 | [diff] [blame] | 1111 | if (Expr* Receiver = ME->getReceiver()) { |
| 1112 | NodeSet Tmp; |
Ted Kremenek | 5af373a | 2008-03-26 21:36:08 +0000 | [diff] [blame] | 1113 | Visit(Receiver, Pred, Tmp); |
Ted Kremenek | b930837 | 2008-03-25 16:07:41 +0000 | [diff] [blame] | 1114 | |
| 1115 | for (NodeSet::iterator NI = Tmp.begin(), NE = Tmp.end(); NI != NE; ++NI) |
| 1116 | VisitObjCMessageExprDispatchHelper(ME, *NI, Dst); |
Ted Kremenek | 23a4f91 | 2008-03-25 02:10:28 +0000 | [diff] [blame] | 1117 | |
Ted Kremenek | b930837 | 2008-03-25 16:07:41 +0000 | [diff] [blame] | 1118 | return; |
Ted Kremenek | 23a4f91 | 2008-03-25 02:10:28 +0000 | [diff] [blame] | 1119 | } |
Ted Kremenek | b930837 | 2008-03-25 16:07:41 +0000 | [diff] [blame] | 1120 | |
| 1121 | VisitObjCMessageExprDispatchHelper(ME, Pred, Dst); |
Ted Kremenek | 55deb97 | 2008-03-25 00:34:37 +0000 | [diff] [blame] | 1122 | return; |
| 1123 | } |
| 1124 | |
| 1125 | NodeSet Tmp; |
Ted Kremenek | 23a4f91 | 2008-03-25 02:10:28 +0000 | [diff] [blame] | 1126 | Visit(*AI, Pred, Tmp); |
Ted Kremenek | 55deb97 | 2008-03-25 00:34:37 +0000 | [diff] [blame] | 1127 | |
Ted Kremenek | 23a4f91 | 2008-03-25 02:10:28 +0000 | [diff] [blame] | 1128 | ++AI; |
Ted Kremenek | 55deb97 | 2008-03-25 00:34:37 +0000 | [diff] [blame] | 1129 | |
| 1130 | for (NodeSet::iterator NI = Tmp.begin(), NE = Tmp.end(); NI != NE; ++NI) |
Ted Kremenek | b930837 | 2008-03-25 16:07:41 +0000 | [diff] [blame] | 1131 | VisitObjCMessageExprArgHelper(ME, AI, AE, *NI, Dst); |
Ted Kremenek | 55deb97 | 2008-03-25 00:34:37 +0000 | [diff] [blame] | 1132 | } |
| 1133 | |
Ted Kremenek | b930837 | 2008-03-25 16:07:41 +0000 | [diff] [blame] | 1134 | void GRExprEngine::VisitObjCMessageExprDispatchHelper(ObjCMessageExpr* ME, |
| 1135 | NodeTy* Pred, NodeSet& Dst) { |
| 1136 | |
| 1137 | |
| 1138 | // FIXME: More logic for the processing the method call. |
| 1139 | |
| 1140 | ValueState* St = GetState(Pred); |
| 1141 | |
| 1142 | if (Expr* Receiver = ME->getReceiver()) { |
| 1143 | |
Ted Kremenek | a056b4f | 2008-03-26 22:21:58 +0000 | [diff] [blame] | 1144 | RVal L = GetRVal(St, Receiver); |
Ted Kremenek | b930837 | 2008-03-25 16:07:41 +0000 | [diff] [blame] | 1145 | |
| 1146 | // Check for undefined control-flow or calls to NULL. |
| 1147 | |
| 1148 | if (L.isUndef()) { |
| 1149 | NodeTy* N = Builder->generateNode(ME, St, Pred); |
| 1150 | |
| 1151 | if (N) { |
| 1152 | N->markAsSink(); |
| 1153 | UndefReceivers.insert(N); |
| 1154 | } |
| 1155 | |
| 1156 | return; |
| 1157 | } |
| 1158 | } |
| 1159 | |
| 1160 | // Check for any arguments that are uninitialized/undefined. |
| 1161 | |
| 1162 | for (ObjCMessageExpr::arg_iterator I = ME->arg_begin(), E = ME->arg_end(); |
| 1163 | I != E; ++I) { |
| 1164 | |
| 1165 | if (GetRVal(St, *I).isUndef()) { |
| 1166 | |
| 1167 | NodeTy* N = Builder->generateNode(ME, St, Pred); |
| 1168 | |
| 1169 | if (N) { |
| 1170 | N->markAsSink(); |
| 1171 | MsgExprUndefArgs[N] = *I; |
| 1172 | } |
| 1173 | |
| 1174 | return; |
| 1175 | } |
| 1176 | } |
| 1177 | |
| 1178 | // FIXME: Eventually we will properly handle the effects of a message |
| 1179 | // expr. For now invalidate all arguments passed in by references. |
| 1180 | |
| 1181 | for (ObjCMessageExpr::arg_iterator I = ME->arg_begin(), E = ME->arg_end(); |
| 1182 | I != E; ++I) { |
| 1183 | |
| 1184 | RVal V = GetRVal(St, *I); |
| 1185 | |
| 1186 | if (isa<LVal>(V)) |
| 1187 | St = SetRVal(St, cast<LVal>(V), UnknownVal()); |
| 1188 | } |
| 1189 | |
| 1190 | MakeNode(Dst, ME, Pred, St); |
| 1191 | } |
Ted Kremenek | 55deb97 | 2008-03-25 00:34:37 +0000 | [diff] [blame] | 1192 | |
Ted Kremenek | 02737ed | 2008-03-31 15:02:58 +0000 | [diff] [blame] | 1193 | void GRExprEngine::VisitReturnStmt(ReturnStmt* S, NodeTy* Pred, NodeSet& Dst) { |
| 1194 | |
| 1195 | Expr* R = S->getRetValue(); |
| 1196 | |
| 1197 | if (!R) { |
| 1198 | Dst.Add(Pred); |
| 1199 | return; |
| 1200 | } |
| 1201 | |
| 1202 | QualType T = R->getType(); |
| 1203 | |
Chris Lattner | 423a3c9 | 2008-04-02 17:45:06 +0000 | [diff] [blame^] | 1204 | if (T->isPointerLikeType()) { |
Ted Kremenek | 02737ed | 2008-03-31 15:02:58 +0000 | [diff] [blame] | 1205 | |
| 1206 | // Check if any of the return values return the address of a stack variable. |
| 1207 | |
| 1208 | NodeSet Tmp; |
| 1209 | Visit(R, Pred, Tmp); |
| 1210 | |
| 1211 | for (NodeSet::iterator I=Tmp.begin(), E=Tmp.end(); I!=E; ++I) { |
| 1212 | RVal X = GetRVal((*I)->getState(), R); |
| 1213 | |
| 1214 | if (isa<lval::DeclVal>(X)) { |
| 1215 | |
| 1216 | if (cast<lval::DeclVal>(X).getDecl()->hasLocalStorage()) { |
| 1217 | |
| 1218 | // Create a special node representing the v |
| 1219 | |
| 1220 | NodeTy* RetStackNode = Builder->generateNode(S, GetState(*I), *I); |
| 1221 | |
| 1222 | if (RetStackNode) { |
| 1223 | RetStackNode->markAsSink(); |
| 1224 | RetsStackAddr.insert(RetStackNode); |
| 1225 | } |
| 1226 | |
| 1227 | continue; |
| 1228 | } |
| 1229 | } |
| 1230 | |
| 1231 | Dst.Add(*I); |
| 1232 | } |
| 1233 | } |
| 1234 | else |
| 1235 | Visit(R, Pred, Dst); |
| 1236 | } |
Ted Kremenek | 55deb97 | 2008-03-25 00:34:37 +0000 | [diff] [blame] | 1237 | |
Ted Kremenek | 4d4dd85 | 2008-02-13 17:41:41 +0000 | [diff] [blame] | 1238 | void GRExprEngine::VisitBinaryOperator(BinaryOperator* B, |
Ted Kremenek | daeb9a7 | 2008-02-13 23:08:21 +0000 | [diff] [blame] | 1239 | GRExprEngine::NodeTy* Pred, |
| 1240 | GRExprEngine::NodeSet& Dst) { |
Ted Kremenek | ab2b8c5 | 2008-01-23 19:59:44 +0000 | [diff] [blame] | 1241 | NodeSet S1; |
Ted Kremenek | 5b6dc2d | 2008-02-07 01:08:27 +0000 | [diff] [blame] | 1242 | |
| 1243 | if (B->isAssignmentOp()) |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 1244 | VisitLVal(B->getLHS(), Pred, S1); |
Ted Kremenek | 5b6dc2d | 2008-02-07 01:08:27 +0000 | [diff] [blame] | 1245 | else |
| 1246 | Visit(B->getLHS(), Pred, S1); |
Ted Kremenek | cb448ca | 2008-01-16 00:53:15 +0000 | [diff] [blame] | 1247 | |
Ted Kremenek | ab2b8c5 | 2008-01-23 19:59:44 +0000 | [diff] [blame] | 1248 | for (NodeSet::iterator I1=S1.begin(), E1=S1.end(); I1 != E1; ++I1) { |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 1249 | |
Ted Kremenek | ab2b8c5 | 2008-01-23 19:59:44 +0000 | [diff] [blame] | 1250 | NodeTy* N1 = *I1; |
Ted Kremenek | e00fe3f | 2008-01-17 00:52:48 +0000 | [diff] [blame] | 1251 | |
Ted Kremenek | ab2b8c5 | 2008-01-23 19:59:44 +0000 | [diff] [blame] | 1252 | // When getting the value for the LHS, check if we are in an assignment. |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 1253 | // In such cases, we want to (initially) treat the LHS as an LVal, |
| 1254 | // so we use GetLVal instead of GetRVal so that DeclRefExpr's are |
| 1255 | // evaluated to LValDecl's instead of to an NonLVal. |
| 1256 | |
Ted Kremenek | 0d093d3 | 2008-03-10 04:11:42 +0000 | [diff] [blame] | 1257 | RVal LeftV = B->isAssignmentOp() ? GetLVal(GetState(N1), B->getLHS()) |
| 1258 | : GetRVal(GetState(N1), B->getLHS()); |
Ted Kremenek | cb448ca | 2008-01-16 00:53:15 +0000 | [diff] [blame] | 1259 | |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 1260 | // Visit the RHS... |
| 1261 | |
| 1262 | NodeSet S2; |
Ted Kremenek | ab2b8c5 | 2008-01-23 19:59:44 +0000 | [diff] [blame] | 1263 | Visit(B->getRHS(), N1, S2); |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 1264 | |
| 1265 | // Process the binary operator. |
Ted Kremenek | ab2b8c5 | 2008-01-23 19:59:44 +0000 | [diff] [blame] | 1266 | |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 1267 | for (NodeSet::iterator I2 = S2.begin(), E2 = S2.end(); I2 != E2; ++I2) { |
Ted Kremenek | cf78b6a | 2008-02-06 22:50:25 +0000 | [diff] [blame] | 1268 | |
Ted Kremenek | ab2b8c5 | 2008-01-23 19:59:44 +0000 | [diff] [blame] | 1269 | NodeTy* N2 = *I2; |
Ted Kremenek | 0d093d3 | 2008-03-10 04:11:42 +0000 | [diff] [blame] | 1270 | ValueState* St = GetState(N2); |
Ted Kremenek | 3c8d0c5 | 2008-02-25 18:42:54 +0000 | [diff] [blame] | 1271 | Expr* RHS = B->getRHS(); |
| 1272 | RVal RightV = GetRVal(St, RHS); |
Ted Kremenek | ab2b8c5 | 2008-01-23 19:59:44 +0000 | [diff] [blame] | 1273 | |
Ted Kremenek | cf78b6a | 2008-02-06 22:50:25 +0000 | [diff] [blame] | 1274 | BinaryOperator::Opcode Op = B->getOpcode(); |
| 1275 | |
Ted Kremenek | 3c8d0c5 | 2008-02-25 18:42:54 +0000 | [diff] [blame] | 1276 | if ((Op == BinaryOperator::Div || Op == BinaryOperator::Rem) |
| 1277 | && RHS->getType()->isIntegerType()) { |
Ted Kremenek | d763eb9 | 2008-02-26 02:15:56 +0000 | [diff] [blame] | 1278 | |
Ted Kremenek | 4a4e524 | 2008-02-28 09:25:22 +0000 | [diff] [blame] | 1279 | // Check if the denominator is undefined. |
Ted Kremenek | 3c8d0c5 | 2008-02-25 18:42:54 +0000 | [diff] [blame] | 1280 | |
Ted Kremenek | 0015541 | 2008-02-26 22:27:51 +0000 | [diff] [blame] | 1281 | if (!RightV.isUnknown()) { |
| 1282 | |
Ted Kremenek | 4a4e524 | 2008-02-28 09:25:22 +0000 | [diff] [blame] | 1283 | if (RightV.isUndef()) { |
| 1284 | NodeTy* DivUndef = Builder->generateNode(B, St, N2); |
Ted Kremenek | 0015541 | 2008-02-26 22:27:51 +0000 | [diff] [blame] | 1285 | |
Ted Kremenek | 4a4e524 | 2008-02-28 09:25:22 +0000 | [diff] [blame] | 1286 | if (DivUndef) { |
| 1287 | DivUndef->markAsSink(); |
Ted Kremenek | 4d839b4 | 2008-03-07 19:04:53 +0000 | [diff] [blame] | 1288 | ExplicitBadDivides.insert(DivUndef); |
Ted Kremenek | 0015541 | 2008-02-26 22:27:51 +0000 | [diff] [blame] | 1289 | } |
| 1290 | |
| 1291 | continue; |
| 1292 | } |
| 1293 | |
| 1294 | // Check for divide/remainder-by-zero. |
| 1295 | // |
Ted Kremenek | 4a4e524 | 2008-02-28 09:25:22 +0000 | [diff] [blame] | 1296 | // First, "assume" that the denominator is 0 or undefined. |
Ted Kremenek | d763eb9 | 2008-02-26 02:15:56 +0000 | [diff] [blame] | 1297 | |
Ted Kremenek | 4d839b4 | 2008-03-07 19:04:53 +0000 | [diff] [blame] | 1298 | bool isFeasibleZero = false; |
| 1299 | ValueState* ZeroSt = Assume(St, RightV, false, isFeasibleZero); |
Ted Kremenek | d763eb9 | 2008-02-26 02:15:56 +0000 | [diff] [blame] | 1300 | |
Ted Kremenek | 0015541 | 2008-02-26 22:27:51 +0000 | [diff] [blame] | 1301 | // Second, "assume" that the denominator cannot be 0. |
Ted Kremenek | d763eb9 | 2008-02-26 02:15:56 +0000 | [diff] [blame] | 1302 | |
Ted Kremenek | 4d839b4 | 2008-03-07 19:04:53 +0000 | [diff] [blame] | 1303 | bool isFeasibleNotZero = false; |
| 1304 | St = Assume(St, RightV, true, isFeasibleNotZero); |
Ted Kremenek | 07d83aa | 2008-02-25 17:51:31 +0000 | [diff] [blame] | 1305 | |
Ted Kremenek | 4d839b4 | 2008-03-07 19:04:53 +0000 | [diff] [blame] | 1306 | // Create the node for the divide-by-zero (if it occurred). |
| 1307 | |
| 1308 | if (isFeasibleZero) |
| 1309 | if (NodeTy* DivZeroNode = Builder->generateNode(B, ZeroSt, N2)) { |
| 1310 | DivZeroNode->markAsSink(); |
| 1311 | |
| 1312 | if (isFeasibleNotZero) |
| 1313 | ImplicitBadDivides.insert(DivZeroNode); |
| 1314 | else |
| 1315 | ExplicitBadDivides.insert(DivZeroNode); |
| 1316 | |
| 1317 | } |
| 1318 | |
| 1319 | if (!isFeasibleNotZero) |
Ted Kremenek | 0015541 | 2008-02-26 22:27:51 +0000 | [diff] [blame] | 1320 | continue; |
Ted Kremenek | 07d83aa | 2008-02-25 17:51:31 +0000 | [diff] [blame] | 1321 | } |
| 1322 | |
Ted Kremenek | 07d83aa | 2008-02-25 17:51:31 +0000 | [diff] [blame] | 1323 | // Fall-through. The logic below processes the divide. |
| 1324 | } |
| 1325 | |
Ted Kremenek | 8cc13ea | 2008-02-28 20:32:03 +0000 | [diff] [blame] | 1326 | |
Ted Kremenek | cf78b6a | 2008-02-06 22:50:25 +0000 | [diff] [blame] | 1327 | if (Op <= BinaryOperator::Or) { |
| 1328 | |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 1329 | // Process non-assignements except commas or short-circuited |
| 1330 | // logical expressions (LAnd and LOr). |
| 1331 | |
| 1332 | RVal Result = EvalBinOp(Op, LeftV, RightV); |
| 1333 | |
| 1334 | if (Result.isUnknown()) { |
| 1335 | Dst.Add(N2); |
Ted Kremenek | 5b6dc2d | 2008-02-07 01:08:27 +0000 | [diff] [blame] | 1336 | continue; |
| 1337 | } |
| 1338 | |
Ted Kremenek | 8cc13ea | 2008-02-28 20:32:03 +0000 | [diff] [blame] | 1339 | if (Result.isUndef() && !LeftV.isUndef() && !RightV.isUndef()) { |
| 1340 | |
| 1341 | // The operands were not undefined, but the result is undefined. |
| 1342 | |
| 1343 | if (NodeTy* UndefNode = Builder->generateNode(B, St, N2)) { |
| 1344 | UndefNode->markAsSink(); |
| 1345 | UndefResults.insert(UndefNode); |
| 1346 | } |
| 1347 | |
| 1348 | continue; |
| 1349 | } |
| 1350 | |
Ted Kremenek | 0e561a3 | 2008-03-21 21:30:14 +0000 | [diff] [blame] | 1351 | MakeNode(Dst, B, N2, SetRVal(St, B, Result)); |
Ted Kremenek | cf78b6a | 2008-02-06 22:50:25 +0000 | [diff] [blame] | 1352 | continue; |
| 1353 | } |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 1354 | |
| 1355 | // Process assignments. |
| 1356 | |
| 1357 | switch (Op) { |
| 1358 | |
Ted Kremenek | ab2b8c5 | 2008-01-23 19:59:44 +0000 | [diff] [blame] | 1359 | case BinaryOperator::Assign: { |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 1360 | |
| 1361 | // Simple assignments. |
Ted Kremenek | 9dca062 | 2008-02-19 00:22:37 +0000 | [diff] [blame] | 1362 | |
Ted Kremenek | 4a4e524 | 2008-02-28 09:25:22 +0000 | [diff] [blame] | 1363 | if (LeftV.isUndef()) { |
| 1364 | HandleUndefinedStore(B, N2); |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 1365 | continue; |
| 1366 | } |
| 1367 | |
Ted Kremenek | 361fa8e | 2008-03-12 21:45:47 +0000 | [diff] [blame] | 1368 | // EXPERIMENTAL: "Conjured" symbols. |
| 1369 | |
| 1370 | if (RightV.isUnknown()) { |
| 1371 | unsigned Count = Builder->getCurrentBlockCount(); |
| 1372 | SymbolID Sym = SymMgr.getConjuredSymbol(B->getRHS(), Count); |
| 1373 | |
| 1374 | RightV = B->getRHS()->getType()->isPointerType() |
| 1375 | ? cast<RVal>(lval::SymbolVal(Sym)) |
| 1376 | : cast<RVal>(nonlval::SymbolVal(Sym)); |
| 1377 | } |
| 1378 | |
| 1379 | // Even if the LHS evaluates to an unknown L-Value, the entire |
| 1380 | // expression still evaluates to the RHS. |
| 1381 | |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 1382 | if (LeftV.isUnknown()) { |
| 1383 | St = SetRVal(St, B, RightV); |
| 1384 | break; |
| 1385 | } |
Ted Kremenek | 361fa8e | 2008-03-12 21:45:47 +0000 | [diff] [blame] | 1386 | |
| 1387 | // Simulate the effects of a "store": bind the value of the RHS |
| 1388 | // to the L-Value represented by the LHS. |
Ted Kremenek | 9dca062 | 2008-02-19 00:22:37 +0000 | [diff] [blame] | 1389 | |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 1390 | St = SetRVal(SetRVal(St, B, RightV), cast<LVal>(LeftV), RightV); |
Ted Kremenek | ab2b8c5 | 2008-01-23 19:59:44 +0000 | [diff] [blame] | 1391 | break; |
| 1392 | } |
| 1393 | |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 1394 | // Compound assignment operators. |
Ted Kremenek | 687af80 | 2008-01-29 19:43:15 +0000 | [diff] [blame] | 1395 | |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 1396 | default: { |
Ted Kremenek | 9dca062 | 2008-02-19 00:22:37 +0000 | [diff] [blame] | 1397 | |
Ted Kremenek | 0015541 | 2008-02-26 22:27:51 +0000 | [diff] [blame] | 1398 | assert (B->isCompoundAssignmentOp()); |
| 1399 | |
| 1400 | if (Op >= BinaryOperator::AndAssign) |
| 1401 | ((int&) Op) -= (BinaryOperator::AndAssign - BinaryOperator::And); |
| 1402 | else |
| 1403 | ((int&) Op) -= BinaryOperator::MulAssign; |
| 1404 | |
Ted Kremenek | 4a4e524 | 2008-02-28 09:25:22 +0000 | [diff] [blame] | 1405 | // Check if the LHS is undefined. |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 1406 | |
Ted Kremenek | 4a4e524 | 2008-02-28 09:25:22 +0000 | [diff] [blame] | 1407 | if (LeftV.isUndef()) { |
| 1408 | HandleUndefinedStore(B, N2); |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 1409 | continue; |
| 1410 | } |
| 1411 | |
| 1412 | if (LeftV.isUnknown()) { |
Ted Kremenek | 3ce9214 | 2008-03-09 08:12:37 +0000 | [diff] [blame] | 1413 | assert (isa<UnknownVal>(GetRVal(St, B))); |
| 1414 | Dst.Add(N2); |
| 1415 | continue; |
Ted Kremenek | 9dca062 | 2008-02-19 00:22:37 +0000 | [diff] [blame] | 1416 | } |
| 1417 | |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 1418 | // At this pointer we know that the LHS evaluates to an LVal |
Ted Kremenek | 3ce9214 | 2008-03-09 08:12:37 +0000 | [diff] [blame] | 1419 | // that is neither "Unknown" or "Undefined." |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 1420 | |
| 1421 | LVal LeftLV = cast<LVal>(LeftV); |
| 1422 | |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 1423 | // Fetch the value of the LHS (the value of the variable, etc.). |
| 1424 | |
Ted Kremenek | 0d093d3 | 2008-03-10 04:11:42 +0000 | [diff] [blame] | 1425 | RVal V = GetRVal(GetState(N1), LeftLV, B->getLHS()->getType()); |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 1426 | |
Ted Kremenek | 4a4e524 | 2008-02-28 09:25:22 +0000 | [diff] [blame] | 1427 | // Propagate undefined value (left-side). We |
| 1428 | // propogate undefined values for the RHS below when |
Ted Kremenek | 0015541 | 2008-02-26 22:27:51 +0000 | [diff] [blame] | 1429 | // we also check for divide-by-zero. |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 1430 | |
Ted Kremenek | 4a4e524 | 2008-02-28 09:25:22 +0000 | [diff] [blame] | 1431 | if (V.isUndef()) { |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 1432 | St = SetRVal(St, B, V); |
| 1433 | break; |
| 1434 | } |
| 1435 | |
| 1436 | // Propagate unknown values. |
| 1437 | |
Ted Kremenek | 89063af | 2008-02-21 19:15:37 +0000 | [diff] [blame] | 1438 | if (V.isUnknown()) { |
Ted Kremenek | 3ce9214 | 2008-03-09 08:12:37 +0000 | [diff] [blame] | 1439 | // The value bound to LeftV is unknown. Thus we just |
| 1440 | // propagate the current node (as "B" is already bound to nothing). |
| 1441 | assert (isa<UnknownVal>(GetRVal(St, B))); |
Ted Kremenek | 89063af | 2008-02-21 19:15:37 +0000 | [diff] [blame] | 1442 | Dst.Add(N2); |
| 1443 | continue; |
| 1444 | } |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 1445 | |
| 1446 | if (RightV.isUnknown()) { |
Ted Kremenek | 3ce9214 | 2008-03-09 08:12:37 +0000 | [diff] [blame] | 1447 | assert (isa<UnknownVal>(GetRVal(St, B))); |
| 1448 | St = SetRVal(St, LeftLV, UnknownVal()); |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 1449 | break; |
| 1450 | } |
| 1451 | |
Ted Kremenek | 0015541 | 2008-02-26 22:27:51 +0000 | [diff] [blame] | 1452 | // At this point: |
| 1453 | // |
Ted Kremenek | 4a4e524 | 2008-02-28 09:25:22 +0000 | [diff] [blame] | 1454 | // The LHS is not Undef/Unknown. |
Ted Kremenek | 0015541 | 2008-02-26 22:27:51 +0000 | [diff] [blame] | 1455 | // The RHS is not Unknown. |
Ted Kremenek | cf78b6a | 2008-02-06 22:50:25 +0000 | [diff] [blame] | 1456 | |
Ted Kremenek | 9ef1ec9 | 2008-02-21 18:43:30 +0000 | [diff] [blame] | 1457 | // Get the computation type. |
| 1458 | QualType CTy = cast<CompoundAssignOperator>(B)->getComputationType(); |
| 1459 | |
| 1460 | // Perform promotions. |
| 1461 | V = EvalCast(V, CTy); |
Ted Kremenek | 61e090c | 2008-02-21 18:46:24 +0000 | [diff] [blame] | 1462 | RightV = EvalCast(RightV, CTy); |
Ted Kremenek | 9ef1ec9 | 2008-02-21 18:43:30 +0000 | [diff] [blame] | 1463 | |
| 1464 | // Evaluate operands and promote to result type. |
Ted Kremenek | 07d83aa | 2008-02-25 17:51:31 +0000 | [diff] [blame] | 1465 | |
Ted Kremenek | 3c8d0c5 | 2008-02-25 18:42:54 +0000 | [diff] [blame] | 1466 | if ((Op == BinaryOperator::Div || Op == BinaryOperator::Rem) |
| 1467 | && RHS->getType()->isIntegerType()) { |
| 1468 | |
Ted Kremenek | 4a4e524 | 2008-02-28 09:25:22 +0000 | [diff] [blame] | 1469 | // Check if the denominator is undefined. |
Ted Kremenek | d763eb9 | 2008-02-26 02:15:56 +0000 | [diff] [blame] | 1470 | |
Ted Kremenek | 4a4e524 | 2008-02-28 09:25:22 +0000 | [diff] [blame] | 1471 | if (RightV.isUndef()) { |
| 1472 | NodeTy* DivUndef = Builder->generateNode(B, St, N2); |
Ted Kremenek | d763eb9 | 2008-02-26 02:15:56 +0000 | [diff] [blame] | 1473 | |
Ted Kremenek | 4a4e524 | 2008-02-28 09:25:22 +0000 | [diff] [blame] | 1474 | if (DivUndef) { |
| 1475 | DivUndef->markAsSink(); |
Ted Kremenek | 4d839b4 | 2008-03-07 19:04:53 +0000 | [diff] [blame] | 1476 | ExplicitBadDivides.insert(DivUndef); |
Ted Kremenek | d763eb9 | 2008-02-26 02:15:56 +0000 | [diff] [blame] | 1477 | } |
| 1478 | |
| 1479 | continue; |
| 1480 | } |
Ted Kremenek | 0015541 | 2008-02-26 22:27:51 +0000 | [diff] [blame] | 1481 | |
Ted Kremenek | 07d83aa | 2008-02-25 17:51:31 +0000 | [diff] [blame] | 1482 | // First, "assume" that the denominator is 0. |
| 1483 | |
Ted Kremenek | 4d839b4 | 2008-03-07 19:04:53 +0000 | [diff] [blame] | 1484 | bool isFeasibleZero = false; |
| 1485 | ValueState* ZeroSt = Assume(St, RightV, false, isFeasibleZero); |
Ted Kremenek | 07d83aa | 2008-02-25 17:51:31 +0000 | [diff] [blame] | 1486 | |
Ted Kremenek | 4d839b4 | 2008-03-07 19:04:53 +0000 | [diff] [blame] | 1487 | // Second, "assume" that the denominator cannot be 0. |
| 1488 | |
| 1489 | bool isFeasibleNotZero = false; |
| 1490 | St = Assume(St, RightV, true, isFeasibleNotZero); |
| 1491 | |
| 1492 | // Create the node for the divide-by-zero error (if it occurred). |
| 1493 | |
| 1494 | if (isFeasibleZero) { |
Ted Kremenek | 07d83aa | 2008-02-25 17:51:31 +0000 | [diff] [blame] | 1495 | NodeTy* DivZeroNode = Builder->generateNode(B, ZeroSt, N2); |
| 1496 | |
| 1497 | if (DivZeroNode) { |
| 1498 | DivZeroNode->markAsSink(); |
Ted Kremenek | 4d839b4 | 2008-03-07 19:04:53 +0000 | [diff] [blame] | 1499 | |
| 1500 | if (isFeasibleNotZero) |
| 1501 | ImplicitBadDivides.insert(DivZeroNode); |
| 1502 | else |
| 1503 | ExplicitBadDivides.insert(DivZeroNode); |
Ted Kremenek | 07d83aa | 2008-02-25 17:51:31 +0000 | [diff] [blame] | 1504 | } |
| 1505 | } |
| 1506 | |
Ted Kremenek | 4d839b4 | 2008-03-07 19:04:53 +0000 | [diff] [blame] | 1507 | if (!isFeasibleNotZero) |
Ted Kremenek | 07d83aa | 2008-02-25 17:51:31 +0000 | [diff] [blame] | 1508 | continue; |
| 1509 | |
| 1510 | // Fall-through. The logic below processes the divide. |
| 1511 | } |
Ted Kremenek | 0015541 | 2008-02-26 22:27:51 +0000 | [diff] [blame] | 1512 | else { |
| 1513 | |
Ted Kremenek | 4a4e524 | 2008-02-28 09:25:22 +0000 | [diff] [blame] | 1514 | // Propagate undefined values (right-side). |
Ted Kremenek | 0015541 | 2008-02-26 22:27:51 +0000 | [diff] [blame] | 1515 | |
Ted Kremenek | 4a4e524 | 2008-02-28 09:25:22 +0000 | [diff] [blame] | 1516 | if (RightV.isUndef()) { |
Ted Kremenek | 0015541 | 2008-02-26 22:27:51 +0000 | [diff] [blame] | 1517 | St = SetRVal(SetRVal(St, B, RightV), LeftLV, RightV); |
| 1518 | break; |
| 1519 | } |
| 1520 | |
| 1521 | } |
Ted Kremenek | 07d83aa | 2008-02-25 17:51:31 +0000 | [diff] [blame] | 1522 | |
Ted Kremenek | 9ef1ec9 | 2008-02-21 18:43:30 +0000 | [diff] [blame] | 1523 | RVal Result = EvalCast(EvalBinOp(Op, V, RightV), B->getType()); |
Ted Kremenek | 8cc13ea | 2008-02-28 20:32:03 +0000 | [diff] [blame] | 1524 | |
| 1525 | if (Result.isUndef()) { |
| 1526 | |
| 1527 | // The operands were not undefined, but the result is undefined. |
| 1528 | |
| 1529 | if (NodeTy* UndefNode = Builder->generateNode(B, St, N2)) { |
| 1530 | UndefNode->markAsSink(); |
| 1531 | UndefResults.insert(UndefNode); |
| 1532 | } |
| 1533 | |
| 1534 | continue; |
| 1535 | } |
| 1536 | |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 1537 | St = SetRVal(SetRVal(St, B, Result), LeftLV, Result); |
Ted Kremenek | cf78b6a | 2008-02-06 22:50:25 +0000 | [diff] [blame] | 1538 | } |
Ted Kremenek | ab2b8c5 | 2008-01-23 19:59:44 +0000 | [diff] [blame] | 1539 | } |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 1540 | |
Ted Kremenek | 0e561a3 | 2008-03-21 21:30:14 +0000 | [diff] [blame] | 1541 | MakeNode(Dst, B, N2, St); |
Ted Kremenek | cb448ca | 2008-01-16 00:53:15 +0000 | [diff] [blame] | 1542 | } |
Ted Kremenek | d27f816 | 2008-01-15 23:55:06 +0000 | [diff] [blame] | 1543 | } |
Ted Kremenek | d27f816 | 2008-01-15 23:55:06 +0000 | [diff] [blame] | 1544 | } |
Ted Kremenek | ee98546 | 2008-01-16 18:18:48 +0000 | [diff] [blame] | 1545 | |
Ted Kremenek | 4a4e524 | 2008-02-28 09:25:22 +0000 | [diff] [blame] | 1546 | void GRExprEngine::HandleUndefinedStore(Stmt* S, NodeTy* Pred) { |
Ted Kremenek | 0d093d3 | 2008-03-10 04:11:42 +0000 | [diff] [blame] | 1547 | NodeTy* N = Builder->generateNode(S, GetState(Pred), Pred); |
Ted Kremenek | 9dca062 | 2008-02-19 00:22:37 +0000 | [diff] [blame] | 1548 | N->markAsSink(); |
Ted Kremenek | 4a4e524 | 2008-02-28 09:25:22 +0000 | [diff] [blame] | 1549 | UndefStores.insert(N); |
Ted Kremenek | 9dca062 | 2008-02-19 00:22:37 +0000 | [diff] [blame] | 1550 | } |
Ted Kremenek | 1ccd31c | 2008-01-16 19:42:59 +0000 | [diff] [blame] | 1551 | |
Ted Kremenek | 9dca062 | 2008-02-19 00:22:37 +0000 | [diff] [blame] | 1552 | void GRExprEngine::Visit(Stmt* S, NodeTy* Pred, NodeSet& Dst) { |
Ted Kremenek | ab2b8c5 | 2008-01-23 19:59:44 +0000 | [diff] [blame] | 1553 | |
| 1554 | // FIXME: add metadata to the CFG so that we can disable |
| 1555 | // this check when we KNOW that there is no block-level subexpression. |
| 1556 | // The motivation is that this check requires a hashtable lookup. |
| 1557 | |
| 1558 | if (S != CurrentStmt && getCFG().isBlkExpr(S)) { |
| 1559 | Dst.Add(Pred); |
| 1560 | return; |
| 1561 | } |
| 1562 | |
| 1563 | switch (S->getStmtClass()) { |
Ted Kremenek | 230aaab | 2008-02-12 21:37:25 +0000 | [diff] [blame] | 1564 | |
| 1565 | default: |
| 1566 | // Cases we intentionally have "default" handle: |
Ted Kremenek | 189c305 | 2008-02-26 19:17:09 +0000 | [diff] [blame] | 1567 | // AddrLabelExpr, IntegerLiteral, CharacterLiteral |
Ted Kremenek | 230aaab | 2008-02-12 21:37:25 +0000 | [diff] [blame] | 1568 | |
| 1569 | Dst.Add(Pred); // No-op. Simply propagate the current state unchanged. |
| 1570 | break; |
Ted Kremenek | 7ffa0aa | 2008-03-17 21:31:48 +0000 | [diff] [blame] | 1571 | |
| 1572 | case Stmt::AsmStmtClass: |
| 1573 | VisitAsmStmt(cast<AsmStmt>(S), Pred, Dst); |
| 1574 | break; |
Ted Kremenek | 230aaab | 2008-02-12 21:37:25 +0000 | [diff] [blame] | 1575 | |
Ted Kremenek | d70b62e | 2008-02-08 20:29:23 +0000 | [diff] [blame] | 1576 | case Stmt::BinaryOperatorClass: { |
| 1577 | BinaryOperator* B = cast<BinaryOperator>(S); |
Ted Kremenek | f233d48 | 2008-02-05 00:26:40 +0000 | [diff] [blame] | 1578 | |
Ted Kremenek | d70b62e | 2008-02-08 20:29:23 +0000 | [diff] [blame] | 1579 | if (B->isLogicalOp()) { |
| 1580 | VisitLogicalExpr(B, Pred, Dst); |
Ted Kremenek | f233d48 | 2008-02-05 00:26:40 +0000 | [diff] [blame] | 1581 | break; |
| 1582 | } |
Ted Kremenek | d70b62e | 2008-02-08 20:29:23 +0000 | [diff] [blame] | 1583 | else if (B->getOpcode() == BinaryOperator::Comma) { |
Ted Kremenek | 0d093d3 | 2008-03-10 04:11:42 +0000 | [diff] [blame] | 1584 | ValueState* St = GetState(Pred); |
Ted Kremenek | 0e561a3 | 2008-03-21 21:30:14 +0000 | [diff] [blame] | 1585 | MakeNode(Dst, B, Pred, SetRVal(St, B, GetRVal(St, B->getRHS()))); |
Ted Kremenek | da9bd09 | 2008-02-08 07:05:39 +0000 | [diff] [blame] | 1586 | break; |
| 1587 | } |
Ted Kremenek | d9435bf | 2008-02-12 19:49:57 +0000 | [diff] [blame] | 1588 | |
| 1589 | VisitBinaryOperator(cast<BinaryOperator>(S), Pred, Dst); |
| 1590 | break; |
| 1591 | } |
Ted Kremenek | de43424 | 2008-02-19 01:44:53 +0000 | [diff] [blame] | 1592 | |
| 1593 | case Stmt::CallExprClass: { |
| 1594 | CallExpr* C = cast<CallExpr>(S); |
| 1595 | VisitCall(C, Pred, C->arg_begin(), C->arg_end(), Dst); |
| 1596 | break; |
| 1597 | } |
Ted Kremenek | d9435bf | 2008-02-12 19:49:57 +0000 | [diff] [blame] | 1598 | |
| 1599 | case Stmt::CastExprClass: { |
| 1600 | CastExpr* C = cast<CastExpr>(S); |
| 1601 | VisitCast(C, C->getSubExpr(), Pred, Dst); |
| 1602 | break; |
Ted Kremenek | d70b62e | 2008-02-08 20:29:23 +0000 | [diff] [blame] | 1603 | } |
Ted Kremenek | 189c305 | 2008-02-26 19:17:09 +0000 | [diff] [blame] | 1604 | |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 1605 | // FIXME: ChooseExpr is really a constant. We need to fix |
| 1606 | // the CFG do not model them as explicit control-flow. |
| 1607 | |
Ted Kremenek | d9435bf | 2008-02-12 19:49:57 +0000 | [diff] [blame] | 1608 | case Stmt::ChooseExprClass: { // __builtin_choose_expr |
| 1609 | ChooseExpr* C = cast<ChooseExpr>(S); |
| 1610 | VisitGuardedExpr(C, C->getLHS(), C->getRHS(), Pred, Dst); |
| 1611 | break; |
| 1612 | } |
Ted Kremenek | f233d48 | 2008-02-05 00:26:40 +0000 | [diff] [blame] | 1613 | |
Ted Kremenek | b4ae33f | 2008-01-23 23:38:00 +0000 | [diff] [blame] | 1614 | case Stmt::CompoundAssignOperatorClass: |
Ted Kremenek | ab2b8c5 | 2008-01-23 19:59:44 +0000 | [diff] [blame] | 1615 | VisitBinaryOperator(cast<BinaryOperator>(S), Pred, Dst); |
| 1616 | break; |
| 1617 | |
Ted Kremenek | d9435bf | 2008-02-12 19:49:57 +0000 | [diff] [blame] | 1618 | case Stmt::ConditionalOperatorClass: { // '?' operator |
| 1619 | ConditionalOperator* C = cast<ConditionalOperator>(S); |
| 1620 | VisitGuardedExpr(C, C->getLHS(), C->getRHS(), Pred, Dst); |
| 1621 | break; |
| 1622 | } |
| 1623 | |
| 1624 | case Stmt::DeclRefExprClass: |
| 1625 | VisitDeclRefExpr(cast<DeclRefExpr>(S), Pred, Dst); |
| 1626 | break; |
| 1627 | |
| 1628 | case Stmt::DeclStmtClass: |
| 1629 | VisitDeclStmt(cast<DeclStmt>(S), Pred, Dst); |
| 1630 | break; |
| 1631 | |
| 1632 | case Stmt::ImplicitCastExprClass: { |
| 1633 | ImplicitCastExpr* C = cast<ImplicitCastExpr>(S); |
| 1634 | VisitCast(C, C->getSubExpr(), Pred, Dst); |
| 1635 | break; |
| 1636 | } |
Ted Kremenek | 55deb97 | 2008-03-25 00:34:37 +0000 | [diff] [blame] | 1637 | |
| 1638 | case Stmt::ObjCMessageExprClass: { |
| 1639 | VisitObjCMessageExpr(cast<ObjCMessageExpr>(S), Pred, Dst); |
| 1640 | break; |
| 1641 | } |
Ted Kremenek | d9435bf | 2008-02-12 19:49:57 +0000 | [diff] [blame] | 1642 | |
| 1643 | case Stmt::ParenExprClass: |
| 1644 | Visit(cast<ParenExpr>(S)->getSubExpr(), Pred, Dst); |
| 1645 | break; |
| 1646 | |
| 1647 | case Stmt::SizeOfAlignOfTypeExprClass: |
| 1648 | VisitSizeOfAlignOfTypeExpr(cast<SizeOfAlignOfTypeExpr>(S), Pred, Dst); |
| 1649 | break; |
| 1650 | |
Ted Kremenek | da9bd09 | 2008-02-08 07:05:39 +0000 | [diff] [blame] | 1651 | case Stmt::StmtExprClass: { |
Ted Kremenek | d70b62e | 2008-02-08 20:29:23 +0000 | [diff] [blame] | 1652 | StmtExpr* SE = cast<StmtExpr>(S); |
| 1653 | |
Ted Kremenek | 0d093d3 | 2008-03-10 04:11:42 +0000 | [diff] [blame] | 1654 | ValueState* St = GetState(Pred); |
Ted Kremenek | 3b4a8ef | 2008-03-15 03:27:30 +0000 | [diff] [blame] | 1655 | |
| 1656 | // FIXME: Not certain if we can have empty StmtExprs. If so, we should |
| 1657 | // probably just remove these from the CFG. |
| 1658 | assert (!SE->getSubStmt()->body_empty()); |
| 1659 | |
| 1660 | if (Expr* LastExpr = dyn_cast<Expr>(*SE->getSubStmt()->body_rbegin())) |
Ted Kremenek | 0e561a3 | 2008-03-21 21:30:14 +0000 | [diff] [blame] | 1661 | MakeNode(Dst, SE, Pred, SetRVal(St, SE, GetRVal(St, LastExpr))); |
Ted Kremenek | 3b4a8ef | 2008-03-15 03:27:30 +0000 | [diff] [blame] | 1662 | else |
| 1663 | Dst.Add(Pred); |
| 1664 | |
| 1665 | break; |
Ted Kremenek | da9bd09 | 2008-02-08 07:05:39 +0000 | [diff] [blame] | 1666 | } |
| 1667 | |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 1668 | // FIXME: We may wish to always bind state to ReturnStmts so |
| 1669 | // that users can quickly query what was the state at the |
| 1670 | // exit points of a function. |
| 1671 | |
Ted Kremenek | 02737ed | 2008-03-31 15:02:58 +0000 | [diff] [blame] | 1672 | case Stmt::ReturnStmtClass: |
| 1673 | VisitReturnStmt(cast<ReturnStmt>(S), Pred, Dst); break; |
Ted Kremenek | 5b6dc2d | 2008-02-07 01:08:27 +0000 | [diff] [blame] | 1674 | |
Ted Kremenek | d8e9f0d | 2008-02-20 04:02:35 +0000 | [diff] [blame] | 1675 | case Stmt::UnaryOperatorClass: { |
| 1676 | UnaryOperator* U = cast<UnaryOperator>(S); |
| 1677 | |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 1678 | switch (U->getOpcode()) { |
| 1679 | case UnaryOperator::Deref: VisitDeref(U, Pred, Dst); break; |
| 1680 | case UnaryOperator::Plus: Visit(U->getSubExpr(), Pred, Dst); break; |
| 1681 | case UnaryOperator::SizeOf: VisitSizeOfExpr(U, Pred, Dst); break; |
| 1682 | default: VisitUnaryOperator(U, Pred, Dst); break; |
| 1683 | } |
Ted Kremenek | d8e9f0d | 2008-02-20 04:02:35 +0000 | [diff] [blame] | 1684 | |
Ted Kremenek | 9de04c4 | 2008-01-24 20:55:43 +0000 | [diff] [blame] | 1685 | break; |
Ted Kremenek | d8e9f0d | 2008-02-20 04:02:35 +0000 | [diff] [blame] | 1686 | } |
Ted Kremenek | 79649df | 2008-01-17 18:25:22 +0000 | [diff] [blame] | 1687 | } |
Ted Kremenek | 1ccd31c | 2008-01-16 19:42:59 +0000 | [diff] [blame] | 1688 | } |
| 1689 | |
Ted Kremenek | ee98546 | 2008-01-16 18:18:48 +0000 | [diff] [blame] | 1690 | //===----------------------------------------------------------------------===// |
Ted Kremenek | b38911f | 2008-01-30 23:03:39 +0000 | [diff] [blame] | 1691 | // "Assume" logic. |
| 1692 | //===----------------------------------------------------------------------===// |
| 1693 | |
Ted Kremenek | aed9b6a | 2008-02-28 10:21:43 +0000 | [diff] [blame] | 1694 | ValueState* GRExprEngine::Assume(ValueState* St, LVal Cond, |
Ted Kremenek | 692416c | 2008-02-18 22:57:02 +0000 | [diff] [blame] | 1695 | bool Assumption, |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 1696 | bool& isFeasible) { |
Ted Kremenek | a6e4d21 | 2008-02-01 06:36:40 +0000 | [diff] [blame] | 1697 | switch (Cond.getSubKind()) { |
| 1698 | default: |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 1699 | assert (false && "'Assume' not implemented for this LVal."); |
Ted Kremenek | a6e4d21 | 2008-02-01 06:36:40 +0000 | [diff] [blame] | 1700 | return St; |
| 1701 | |
Ted Kremenek | 862d5bb | 2008-02-06 00:54:14 +0000 | [diff] [blame] | 1702 | case lval::SymbolValKind: |
| 1703 | if (Assumption) |
| 1704 | return AssumeSymNE(St, cast<lval::SymbolVal>(Cond).getSymbol(), |
Ted Kremenek | 240f1f0 | 2008-03-07 20:13:31 +0000 | [diff] [blame] | 1705 | BasicVals.getZeroWithPtrWidth(), isFeasible); |
Ted Kremenek | 862d5bb | 2008-02-06 00:54:14 +0000 | [diff] [blame] | 1706 | else |
| 1707 | return AssumeSymEQ(St, cast<lval::SymbolVal>(Cond).getSymbol(), |
Ted Kremenek | 240f1f0 | 2008-03-07 20:13:31 +0000 | [diff] [blame] | 1708 | BasicVals.getZeroWithPtrWidth(), isFeasible); |
Ted Kremenek | 862d5bb | 2008-02-06 00:54:14 +0000 | [diff] [blame] | 1709 | |
Ted Kremenek | 08b6625 | 2008-02-06 04:31:33 +0000 | [diff] [blame] | 1710 | |
Ted Kremenek | 329f854 | 2008-02-05 21:52:21 +0000 | [diff] [blame] | 1711 | case lval::DeclValKind: |
Ted Kremenek | dc3936b | 2008-02-22 00:54:56 +0000 | [diff] [blame] | 1712 | case lval::FuncValKind: |
| 1713 | case lval::GotoLabelKind: |
Ted Kremenek | a6e4d21 | 2008-02-01 06:36:40 +0000 | [diff] [blame] | 1714 | isFeasible = Assumption; |
| 1715 | return St; |
Ted Kremenek | 862d5bb | 2008-02-06 00:54:14 +0000 | [diff] [blame] | 1716 | |
Ted Kremenek | 329f854 | 2008-02-05 21:52:21 +0000 | [diff] [blame] | 1717 | case lval::ConcreteIntKind: { |
| 1718 | bool b = cast<lval::ConcreteInt>(Cond).getValue() != 0; |
Ted Kremenek | a6e4d21 | 2008-02-01 06:36:40 +0000 | [diff] [blame] | 1719 | isFeasible = b ? Assumption : !Assumption; |
| 1720 | return St; |
| 1721 | } |
| 1722 | } |
Ted Kremenek | b38911f | 2008-01-30 23:03:39 +0000 | [diff] [blame] | 1723 | } |
| 1724 | |
Ted Kremenek | aed9b6a | 2008-02-28 10:21:43 +0000 | [diff] [blame] | 1725 | ValueState* GRExprEngine::Assume(ValueState* St, NonLVal Cond, |
Ted Kremenek | 862d5bb | 2008-02-06 00:54:14 +0000 | [diff] [blame] | 1726 | bool Assumption, |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 1727 | bool& isFeasible) { |
Ted Kremenek | b38911f | 2008-01-30 23:03:39 +0000 | [diff] [blame] | 1728 | switch (Cond.getSubKind()) { |
| 1729 | default: |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 1730 | assert (false && "'Assume' not implemented for this NonLVal."); |
Ted Kremenek | b38911f | 2008-01-30 23:03:39 +0000 | [diff] [blame] | 1731 | return St; |
| 1732 | |
Ted Kremenek | feb01f6 | 2008-02-06 17:32:17 +0000 | [diff] [blame] | 1733 | |
| 1734 | case nonlval::SymbolValKind: { |
Ted Kremenek | 230aaab | 2008-02-12 21:37:25 +0000 | [diff] [blame] | 1735 | nonlval::SymbolVal& SV = cast<nonlval::SymbolVal>(Cond); |
Ted Kremenek | feb01f6 | 2008-02-06 17:32:17 +0000 | [diff] [blame] | 1736 | SymbolID sym = SV.getSymbol(); |
| 1737 | |
| 1738 | if (Assumption) |
Ted Kremenek | 240f1f0 | 2008-03-07 20:13:31 +0000 | [diff] [blame] | 1739 | return AssumeSymNE(St, sym, BasicVals.getValue(0, SymMgr.getType(sym)), |
Ted Kremenek | feb01f6 | 2008-02-06 17:32:17 +0000 | [diff] [blame] | 1740 | isFeasible); |
| 1741 | else |
Ted Kremenek | 240f1f0 | 2008-03-07 20:13:31 +0000 | [diff] [blame] | 1742 | return AssumeSymEQ(St, sym, BasicVals.getValue(0, SymMgr.getType(sym)), |
Ted Kremenek | feb01f6 | 2008-02-06 17:32:17 +0000 | [diff] [blame] | 1743 | isFeasible); |
| 1744 | } |
| 1745 | |
Ted Kremenek | 08b6625 | 2008-02-06 04:31:33 +0000 | [diff] [blame] | 1746 | case nonlval::SymIntConstraintValKind: |
| 1747 | return |
| 1748 | AssumeSymInt(St, Assumption, |
| 1749 | cast<nonlval::SymIntConstraintVal>(Cond).getConstraint(), |
| 1750 | isFeasible); |
| 1751 | |
Ted Kremenek | 329f854 | 2008-02-05 21:52:21 +0000 | [diff] [blame] | 1752 | case nonlval::ConcreteIntKind: { |
| 1753 | bool b = cast<nonlval::ConcreteInt>(Cond).getValue() != 0; |
Ted Kremenek | b38911f | 2008-01-30 23:03:39 +0000 | [diff] [blame] | 1754 | isFeasible = b ? Assumption : !Assumption; |
| 1755 | return St; |
| 1756 | } |
| 1757 | } |
| 1758 | } |
| 1759 | |
Ted Kremenek | aed9b6a | 2008-02-28 10:21:43 +0000 | [diff] [blame] | 1760 | ValueState* |
| 1761 | GRExprEngine::AssumeSymNE(ValueState* St, SymbolID sym, |
Ted Kremenek | 862d5bb | 2008-02-06 00:54:14 +0000 | [diff] [blame] | 1762 | const llvm::APSInt& V, bool& isFeasible) { |
Ted Kremenek | 692416c | 2008-02-18 22:57:02 +0000 | [diff] [blame] | 1763 | |
Ted Kremenek | 862d5bb | 2008-02-06 00:54:14 +0000 | [diff] [blame] | 1764 | // First, determine if sym == X, where X != V. |
Ted Kremenek | aed9b6a | 2008-02-28 10:21:43 +0000 | [diff] [blame] | 1765 | if (const llvm::APSInt* X = St->getSymVal(sym)) { |
Ted Kremenek | 862d5bb | 2008-02-06 00:54:14 +0000 | [diff] [blame] | 1766 | isFeasible = *X != V; |
| 1767 | return St; |
| 1768 | } |
| 1769 | |
| 1770 | // Second, determine if sym != V. |
Ted Kremenek | aed9b6a | 2008-02-28 10:21:43 +0000 | [diff] [blame] | 1771 | if (St->isNotEqual(sym, V)) { |
Ted Kremenek | 862d5bb | 2008-02-06 00:54:14 +0000 | [diff] [blame] | 1772 | isFeasible = true; |
| 1773 | return St; |
| 1774 | } |
| 1775 | |
| 1776 | // If we reach here, sym is not a constant and we don't know if it is != V. |
| 1777 | // Make that assumption. |
| 1778 | |
| 1779 | isFeasible = true; |
| 1780 | return StateMgr.AddNE(St, sym, V); |
| 1781 | } |
| 1782 | |
Ted Kremenek | aed9b6a | 2008-02-28 10:21:43 +0000 | [diff] [blame] | 1783 | ValueState* |
| 1784 | GRExprEngine::AssumeSymEQ(ValueState* St, SymbolID sym, |
Ted Kremenek | 862d5bb | 2008-02-06 00:54:14 +0000 | [diff] [blame] | 1785 | const llvm::APSInt& V, bool& isFeasible) { |
| 1786 | |
| 1787 | // First, determine if sym == X, where X != V. |
Ted Kremenek | aed9b6a | 2008-02-28 10:21:43 +0000 | [diff] [blame] | 1788 | if (const llvm::APSInt* X = St->getSymVal(sym)) { |
Ted Kremenek | 862d5bb | 2008-02-06 00:54:14 +0000 | [diff] [blame] | 1789 | isFeasible = *X == V; |
| 1790 | return St; |
| 1791 | } |
| 1792 | |
| 1793 | // Second, determine if sym != V. |
Ted Kremenek | aed9b6a | 2008-02-28 10:21:43 +0000 | [diff] [blame] | 1794 | if (St->isNotEqual(sym, V)) { |
Ted Kremenek | 862d5bb | 2008-02-06 00:54:14 +0000 | [diff] [blame] | 1795 | isFeasible = false; |
| 1796 | return St; |
| 1797 | } |
| 1798 | |
| 1799 | // If we reach here, sym is not a constant and we don't know if it is == V. |
| 1800 | // Make that assumption. |
| 1801 | |
| 1802 | isFeasible = true; |
| 1803 | return StateMgr.AddEQ(St, sym, V); |
| 1804 | } |
Ted Kremenek | b38911f | 2008-01-30 23:03:39 +0000 | [diff] [blame] | 1805 | |
Ted Kremenek | aed9b6a | 2008-02-28 10:21:43 +0000 | [diff] [blame] | 1806 | ValueState* |
| 1807 | GRExprEngine::AssumeSymInt(ValueState* St, bool Assumption, |
Ted Kremenek | 08b6625 | 2008-02-06 04:31:33 +0000 | [diff] [blame] | 1808 | const SymIntConstraint& C, bool& isFeasible) { |
| 1809 | |
| 1810 | switch (C.getOpcode()) { |
| 1811 | default: |
| 1812 | // No logic yet for other operators. |
Ted Kremenek | 361fa8e | 2008-03-12 21:45:47 +0000 | [diff] [blame] | 1813 | isFeasible = true; |
Ted Kremenek | 08b6625 | 2008-02-06 04:31:33 +0000 | [diff] [blame] | 1814 | return St; |
| 1815 | |
| 1816 | case BinaryOperator::EQ: |
| 1817 | if (Assumption) |
| 1818 | return AssumeSymEQ(St, C.getSymbol(), C.getInt(), isFeasible); |
| 1819 | else |
| 1820 | return AssumeSymNE(St, C.getSymbol(), C.getInt(), isFeasible); |
| 1821 | |
| 1822 | case BinaryOperator::NE: |
| 1823 | if (Assumption) |
| 1824 | return AssumeSymNE(St, C.getSymbol(), C.getInt(), isFeasible); |
| 1825 | else |
| 1826 | return AssumeSymEQ(St, C.getSymbol(), C.getInt(), isFeasible); |
| 1827 | } |
| 1828 | } |
| 1829 | |
Ted Kremenek | b38911f | 2008-01-30 23:03:39 +0000 | [diff] [blame] | 1830 | //===----------------------------------------------------------------------===// |
Ted Kremenek | e01c987 | 2008-02-14 22:36:46 +0000 | [diff] [blame] | 1831 | // Visualization. |
Ted Kremenek | ee98546 | 2008-01-16 18:18:48 +0000 | [diff] [blame] | 1832 | //===----------------------------------------------------------------------===// |
| 1833 | |
Ted Kremenek | aa66a32 | 2008-01-16 21:46:15 +0000 | [diff] [blame] | 1834 | #ifndef NDEBUG |
Ted Kremenek | 4d4dd85 | 2008-02-13 17:41:41 +0000 | [diff] [blame] | 1835 | static GRExprEngine* GraphPrintCheckerState; |
Ted Kremenek | e97ca06 | 2008-03-07 20:57:30 +0000 | [diff] [blame] | 1836 | static SourceManager* GraphPrintSourceManager; |
Ted Kremenek | 75da3e8 | 2008-03-11 19:02:40 +0000 | [diff] [blame] | 1837 | static ValueState::CheckerStatePrinter* GraphCheckerStatePrinter; |
Ted Kremenek | 3b4f670 | 2008-01-30 23:24:39 +0000 | [diff] [blame] | 1838 | |
Ted Kremenek | aa66a32 | 2008-01-16 21:46:15 +0000 | [diff] [blame] | 1839 | namespace llvm { |
| 1840 | template<> |
Ted Kremenek | 4d4dd85 | 2008-02-13 17:41:41 +0000 | [diff] [blame] | 1841 | struct VISIBILITY_HIDDEN DOTGraphTraits<GRExprEngine::NodeTy*> : |
Ted Kremenek | aa66a32 | 2008-01-16 21:46:15 +0000 | [diff] [blame] | 1842 | public DefaultDOTGraphTraits { |
Ted Kremenek | 016f52f | 2008-02-08 21:10:02 +0000 | [diff] [blame] | 1843 | |
Ted Kremenek | aed9b6a | 2008-02-28 10:21:43 +0000 | [diff] [blame] | 1844 | static void PrintVarBindings(std::ostream& Out, ValueState* St) { |
Ted Kremenek | 016f52f | 2008-02-08 21:10:02 +0000 | [diff] [blame] | 1845 | |
| 1846 | Out << "Variables:\\l"; |
| 1847 | |
Ted Kremenek | 9ff731d | 2008-01-24 22:27:20 +0000 | [diff] [blame] | 1848 | bool isFirst = true; |
| 1849 | |
Ted Kremenek | aed9b6a | 2008-02-28 10:21:43 +0000 | [diff] [blame] | 1850 | for (ValueState::vb_iterator I=St->vb_begin(), E=St->vb_end(); I!=E;++I) { |
Ted Kremenek | 016f52f | 2008-02-08 21:10:02 +0000 | [diff] [blame] | 1851 | |
| 1852 | if (isFirst) |
| 1853 | isFirst = false; |
| 1854 | else |
| 1855 | Out << "\\l"; |
| 1856 | |
| 1857 | Out << ' ' << I.getKey()->getName() << " : "; |
| 1858 | I.getData().print(Out); |
| 1859 | } |
| 1860 | |
| 1861 | } |
| 1862 | |
Ted Kremenek | e7d2211 | 2008-02-11 19:21:59 +0000 | [diff] [blame] | 1863 | |
Ted Kremenek | aed9b6a | 2008-02-28 10:21:43 +0000 | [diff] [blame] | 1864 | static void PrintSubExprBindings(std::ostream& Out, ValueState* St){ |
Ted Kremenek | e7d2211 | 2008-02-11 19:21:59 +0000 | [diff] [blame] | 1865 | |
| 1866 | bool isFirst = true; |
| 1867 | |
Ted Kremenek | aed9b6a | 2008-02-28 10:21:43 +0000 | [diff] [blame] | 1868 | for (ValueState::seb_iterator I=St->seb_begin(), E=St->seb_end();I!=E;++I) { |
Ted Kremenek | e7d2211 | 2008-02-11 19:21:59 +0000 | [diff] [blame] | 1869 | |
| 1870 | if (isFirst) { |
| 1871 | Out << "\\l\\lSub-Expressions:\\l"; |
| 1872 | isFirst = false; |
| 1873 | } |
| 1874 | else |
| 1875 | Out << "\\l"; |
| 1876 | |
| 1877 | Out << " (" << (void*) I.getKey() << ") "; |
| 1878 | I.getKey()->printPretty(Out); |
| 1879 | Out << " : "; |
| 1880 | I.getData().print(Out); |
| 1881 | } |
| 1882 | } |
| 1883 | |
Ted Kremenek | aed9b6a | 2008-02-28 10:21:43 +0000 | [diff] [blame] | 1884 | static void PrintBlkExprBindings(std::ostream& Out, ValueState* St){ |
Ted Kremenek | e7d2211 | 2008-02-11 19:21:59 +0000 | [diff] [blame] | 1885 | |
Ted Kremenek | 016f52f | 2008-02-08 21:10:02 +0000 | [diff] [blame] | 1886 | bool isFirst = true; |
| 1887 | |
Ted Kremenek | aed9b6a | 2008-02-28 10:21:43 +0000 | [diff] [blame] | 1888 | for (ValueState::beb_iterator I=St->beb_begin(), E=St->beb_end(); I!=E;++I){ |
Ted Kremenek | 9ff731d | 2008-01-24 22:27:20 +0000 | [diff] [blame] | 1889 | if (isFirst) { |
Ted Kremenek | e7d2211 | 2008-02-11 19:21:59 +0000 | [diff] [blame] | 1890 | Out << "\\l\\lBlock-level Expressions:\\l"; |
Ted Kremenek | 9ff731d | 2008-01-24 22:27:20 +0000 | [diff] [blame] | 1891 | isFirst = false; |
| 1892 | } |
| 1893 | else |
| 1894 | Out << "\\l"; |
Ted Kremenek | 016f52f | 2008-02-08 21:10:02 +0000 | [diff] [blame] | 1895 | |
Ted Kremenek | e7d2211 | 2008-02-11 19:21:59 +0000 | [diff] [blame] | 1896 | Out << " (" << (void*) I.getKey() << ") "; |
| 1897 | I.getKey()->printPretty(Out); |
Ted Kremenek | 9ff731d | 2008-01-24 22:27:20 +0000 | [diff] [blame] | 1898 | Out << " : "; |
| 1899 | I.getData().print(Out); |
| 1900 | } |
| 1901 | } |
| 1902 | |
Ted Kremenek | aed9b6a | 2008-02-28 10:21:43 +0000 | [diff] [blame] | 1903 | static void PrintEQ(std::ostream& Out, ValueState* St) { |
| 1904 | ValueState::ConstEqTy CE = St->ConstEq; |
Ted Kremenek | ed4de31 | 2008-02-06 03:56:15 +0000 | [diff] [blame] | 1905 | |
| 1906 | if (CE.isEmpty()) |
| 1907 | return; |
| 1908 | |
| 1909 | Out << "\\l\\|'==' constraints:"; |
| 1910 | |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 1911 | for (ValueState::ConstEqTy::iterator I=CE.begin(), E=CE.end(); I!=E;++I) |
Ted Kremenek | ed4de31 | 2008-02-06 03:56:15 +0000 | [diff] [blame] | 1912 | Out << "\\l $" << I.getKey() << " : " << I.getData()->toString(); |
| 1913 | } |
| 1914 | |
Ted Kremenek | aed9b6a | 2008-02-28 10:21:43 +0000 | [diff] [blame] | 1915 | static void PrintNE(std::ostream& Out, ValueState* St) { |
| 1916 | ValueState::ConstNotEqTy NE = St->ConstNotEq; |
Ted Kremenek | ed4de31 | 2008-02-06 03:56:15 +0000 | [diff] [blame] | 1917 | |
| 1918 | if (NE.isEmpty()) |
| 1919 | return; |
| 1920 | |
| 1921 | Out << "\\l\\|'!=' constraints:"; |
| 1922 | |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 1923 | for (ValueState::ConstNotEqTy::iterator I=NE.begin(), EI=NE.end(); |
Ted Kremenek | ed4de31 | 2008-02-06 03:56:15 +0000 | [diff] [blame] | 1924 | I != EI; ++I){ |
| 1925 | |
| 1926 | Out << "\\l $" << I.getKey() << " : "; |
| 1927 | bool isFirst = true; |
| 1928 | |
| 1929 | ValueState::IntSetTy::iterator J=I.getData().begin(), |
| 1930 | EJ=I.getData().end(); |
| 1931 | for ( ; J != EJ; ++J) { |
| 1932 | if (isFirst) isFirst = false; |
| 1933 | else Out << ", "; |
| 1934 | |
| 1935 | Out << (*J)->toString(); |
| 1936 | } |
| 1937 | } |
Ted Kremenek | a3fadfc | 2008-02-14 22:54:53 +0000 | [diff] [blame] | 1938 | } |
| 1939 | |
| 1940 | static std::string getNodeAttributes(const GRExprEngine::NodeTy* N, void*) { |
| 1941 | |
| 1942 | if (GraphPrintCheckerState->isImplicitNullDeref(N) || |
Ted Kremenek | 9dca062 | 2008-02-19 00:22:37 +0000 | [diff] [blame] | 1943 | GraphPrintCheckerState->isExplicitNullDeref(N) || |
Ted Kremenek | 4a4e524 | 2008-02-28 09:25:22 +0000 | [diff] [blame] | 1944 | GraphPrintCheckerState->isUndefDeref(N) || |
| 1945 | GraphPrintCheckerState->isUndefStore(N) || |
| 1946 | GraphPrintCheckerState->isUndefControlFlow(N) || |
Ted Kremenek | 4d839b4 | 2008-03-07 19:04:53 +0000 | [diff] [blame] | 1947 | GraphPrintCheckerState->isExplicitBadDivide(N) || |
| 1948 | GraphPrintCheckerState->isImplicitBadDivide(N) || |
Ted Kremenek | 5e03fcb | 2008-02-29 23:14:48 +0000 | [diff] [blame] | 1949 | GraphPrintCheckerState->isUndefResult(N) || |
Ted Kremenek | 2ded35a | 2008-02-29 23:53:11 +0000 | [diff] [blame] | 1950 | GraphPrintCheckerState->isBadCall(N) || |
| 1951 | GraphPrintCheckerState->isUndefArg(N)) |
Ted Kremenek | a3fadfc | 2008-02-14 22:54:53 +0000 | [diff] [blame] | 1952 | return "color=\"red\",style=\"filled\""; |
| 1953 | |
Ted Kremenek | 8cc13ea | 2008-02-28 20:32:03 +0000 | [diff] [blame] | 1954 | if (GraphPrintCheckerState->isNoReturnCall(N)) |
| 1955 | return "color=\"blue\",style=\"filled\""; |
| 1956 | |
Ted Kremenek | a3fadfc | 2008-02-14 22:54:53 +0000 | [diff] [blame] | 1957 | return ""; |
| 1958 | } |
Ted Kremenek | ed4de31 | 2008-02-06 03:56:15 +0000 | [diff] [blame] | 1959 | |
Ted Kremenek | 4d4dd85 | 2008-02-13 17:41:41 +0000 | [diff] [blame] | 1960 | static std::string getNodeLabel(const GRExprEngine::NodeTy* N, void*) { |
Ted Kremenek | aa66a32 | 2008-01-16 21:46:15 +0000 | [diff] [blame] | 1961 | std::ostringstream Out; |
Ted Kremenek | 803c9ed | 2008-01-23 22:30:44 +0000 | [diff] [blame] | 1962 | |
| 1963 | // Program Location. |
Ted Kremenek | aa66a32 | 2008-01-16 21:46:15 +0000 | [diff] [blame] | 1964 | ProgramPoint Loc = N->getLocation(); |
| 1965 | |
| 1966 | switch (Loc.getKind()) { |
| 1967 | case ProgramPoint::BlockEntranceKind: |
| 1968 | Out << "Block Entrance: B" |
| 1969 | << cast<BlockEntrance>(Loc).getBlock()->getBlockID(); |
| 1970 | break; |
| 1971 | |
| 1972 | case ProgramPoint::BlockExitKind: |
| 1973 | assert (false); |
| 1974 | break; |
| 1975 | |
| 1976 | case ProgramPoint::PostStmtKind: { |
Ted Kremenek | e97ca06 | 2008-03-07 20:57:30 +0000 | [diff] [blame] | 1977 | const PostStmt& L = cast<PostStmt>(Loc); |
| 1978 | Stmt* S = L.getStmt(); |
| 1979 | SourceLocation SLoc = S->getLocStart(); |
| 1980 | |
| 1981 | Out << S->getStmtClassName() << ' ' << (void*) S << ' '; |
| 1982 | S->printPretty(Out); |
Ted Kremenek | 9ff731d | 2008-01-24 22:27:20 +0000 | [diff] [blame] | 1983 | |
Ted Kremenek | 9b5551d | 2008-03-09 03:30:59 +0000 | [diff] [blame] | 1984 | if (SLoc.isFileID()) { |
| 1985 | Out << "\\lline=" |
| 1986 | << GraphPrintSourceManager->getLineNumber(SLoc) << " col=" |
| 1987 | << GraphPrintSourceManager->getColumnNumber(SLoc) << "\\l"; |
| 1988 | } |
Ted Kremenek | d131c4f | 2008-02-07 05:48:01 +0000 | [diff] [blame] | 1989 | |
Ted Kremenek | 5e03fcb | 2008-02-29 23:14:48 +0000 | [diff] [blame] | 1990 | if (GraphPrintCheckerState->isImplicitNullDeref(N)) |
Ted Kremenek | d131c4f | 2008-02-07 05:48:01 +0000 | [diff] [blame] | 1991 | Out << "\\|Implicit-Null Dereference.\\l"; |
Ted Kremenek | 5e03fcb | 2008-02-29 23:14:48 +0000 | [diff] [blame] | 1992 | else if (GraphPrintCheckerState->isExplicitNullDeref(N)) |
Ted Kremenek | 63a4f69 | 2008-02-07 06:04:18 +0000 | [diff] [blame] | 1993 | Out << "\\|Explicit-Null Dereference.\\l"; |
Ted Kremenek | 5e03fcb | 2008-02-29 23:14:48 +0000 | [diff] [blame] | 1994 | else if (GraphPrintCheckerState->isUndefDeref(N)) |
Ted Kremenek | 4a4e524 | 2008-02-28 09:25:22 +0000 | [diff] [blame] | 1995 | Out << "\\|Dereference of undefialied value.\\l"; |
Ted Kremenek | 5e03fcb | 2008-02-29 23:14:48 +0000 | [diff] [blame] | 1996 | else if (GraphPrintCheckerState->isUndefStore(N)) |
Ted Kremenek | 4a4e524 | 2008-02-28 09:25:22 +0000 | [diff] [blame] | 1997 | Out << "\\|Store to Undefined LVal."; |
Ted Kremenek | 4d839b4 | 2008-03-07 19:04:53 +0000 | [diff] [blame] | 1998 | else if (GraphPrintCheckerState->isExplicitBadDivide(N)) |
| 1999 | Out << "\\|Explicit divide-by zero or undefined value."; |
| 2000 | else if (GraphPrintCheckerState->isImplicitBadDivide(N)) |
| 2001 | Out << "\\|Implicit divide-by zero or undefined value."; |
Ted Kremenek | 5e03fcb | 2008-02-29 23:14:48 +0000 | [diff] [blame] | 2002 | else if (GraphPrintCheckerState->isUndefResult(N)) |
Ted Kremenek | 8cc13ea | 2008-02-28 20:32:03 +0000 | [diff] [blame] | 2003 | Out << "\\|Result of operation is undefined."; |
Ted Kremenek | 8cc13ea | 2008-02-28 20:32:03 +0000 | [diff] [blame] | 2004 | else if (GraphPrintCheckerState->isNoReturnCall(N)) |
| 2005 | Out << "\\|Call to function marked \"noreturn\"."; |
Ted Kremenek | 5e03fcb | 2008-02-29 23:14:48 +0000 | [diff] [blame] | 2006 | else if (GraphPrintCheckerState->isBadCall(N)) |
| 2007 | Out << "\\|Call to NULL/Undefined."; |
Ted Kremenek | 2ded35a | 2008-02-29 23:53:11 +0000 | [diff] [blame] | 2008 | else if (GraphPrintCheckerState->isUndefArg(N)) |
| 2009 | Out << "\\|Argument in call is undefined"; |
Ted Kremenek | d131c4f | 2008-02-07 05:48:01 +0000 | [diff] [blame] | 2010 | |
Ted Kremenek | aa66a32 | 2008-01-16 21:46:15 +0000 | [diff] [blame] | 2011 | break; |
| 2012 | } |
| 2013 | |
| 2014 | default: { |
| 2015 | const BlockEdge& E = cast<BlockEdge>(Loc); |
| 2016 | Out << "Edge: (B" << E.getSrc()->getBlockID() << ", B" |
| 2017 | << E.getDst()->getBlockID() << ')'; |
Ted Kremenek | b38911f | 2008-01-30 23:03:39 +0000 | [diff] [blame] | 2018 | |
| 2019 | if (Stmt* T = E.getSrc()->getTerminator()) { |
Ted Kremenek | e97ca06 | 2008-03-07 20:57:30 +0000 | [diff] [blame] | 2020 | |
| 2021 | SourceLocation SLoc = T->getLocStart(); |
| 2022 | |
Ted Kremenek | b38911f | 2008-01-30 23:03:39 +0000 | [diff] [blame] | 2023 | Out << "\\|Terminator: "; |
Ted Kremenek | e97ca06 | 2008-03-07 20:57:30 +0000 | [diff] [blame] | 2024 | |
Ted Kremenek | b38911f | 2008-01-30 23:03:39 +0000 | [diff] [blame] | 2025 | E.getSrc()->printTerminator(Out); |
| 2026 | |
Ted Kremenek | 9b5551d | 2008-03-09 03:30:59 +0000 | [diff] [blame] | 2027 | if (SLoc.isFileID()) { |
| 2028 | Out << "\\lline=" |
| 2029 | << GraphPrintSourceManager->getLineNumber(SLoc) << " col=" |
| 2030 | << GraphPrintSourceManager->getColumnNumber(SLoc); |
| 2031 | } |
Ted Kremenek | e97ca06 | 2008-03-07 20:57:30 +0000 | [diff] [blame] | 2032 | |
Ted Kremenek | daeb9a7 | 2008-02-13 23:08:21 +0000 | [diff] [blame] | 2033 | if (isa<SwitchStmt>(T)) { |
| 2034 | Stmt* Label = E.getDst()->getLabel(); |
| 2035 | |
| 2036 | if (Label) { |
| 2037 | if (CaseStmt* C = dyn_cast<CaseStmt>(Label)) { |
| 2038 | Out << "\\lcase "; |
| 2039 | C->getLHS()->printPretty(Out); |
| 2040 | |
| 2041 | if (Stmt* RHS = C->getRHS()) { |
| 2042 | Out << " .. "; |
| 2043 | RHS->printPretty(Out); |
| 2044 | } |
| 2045 | |
| 2046 | Out << ":"; |
| 2047 | } |
| 2048 | else { |
| 2049 | assert (isa<DefaultStmt>(Label)); |
| 2050 | Out << "\\ldefault:"; |
| 2051 | } |
| 2052 | } |
| 2053 | else |
| 2054 | Out << "\\l(implicit) default:"; |
| 2055 | } |
| 2056 | else if (isa<IndirectGotoStmt>(T)) { |
Ted Kremenek | b38911f | 2008-01-30 23:03:39 +0000 | [diff] [blame] | 2057 | // FIXME |
| 2058 | } |
| 2059 | else { |
| 2060 | Out << "\\lCondition: "; |
| 2061 | if (*E.getSrc()->succ_begin() == E.getDst()) |
| 2062 | Out << "true"; |
| 2063 | else |
| 2064 | Out << "false"; |
| 2065 | } |
| 2066 | |
| 2067 | Out << "\\l"; |
| 2068 | } |
Ted Kremenek | 3b4f670 | 2008-01-30 23:24:39 +0000 | [diff] [blame] | 2069 | |
Ted Kremenek | 4a4e524 | 2008-02-28 09:25:22 +0000 | [diff] [blame] | 2070 | if (GraphPrintCheckerState->isUndefControlFlow(N)) { |
| 2071 | Out << "\\|Control-flow based on\\lUndefined value.\\l"; |
Ted Kremenek | 3b4f670 | 2008-01-30 23:24:39 +0000 | [diff] [blame] | 2072 | } |
Ted Kremenek | aa66a32 | 2008-01-16 21:46:15 +0000 | [diff] [blame] | 2073 | } |
| 2074 | } |
| 2075 | |
Ted Kremenek | aed9b6a | 2008-02-28 10:21:43 +0000 | [diff] [blame] | 2076 | Out << "\\|StateID: " << (void*) N->getState() << "\\|"; |
Ted Kremenek | 016f52f | 2008-02-08 21:10:02 +0000 | [diff] [blame] | 2077 | |
Ted Kremenek | 75da3e8 | 2008-03-11 19:02:40 +0000 | [diff] [blame] | 2078 | N->getState()->printDOT(Out, GraphCheckerStatePrinter); |
Ted Kremenek | 803c9ed | 2008-01-23 22:30:44 +0000 | [diff] [blame] | 2079 | |
Ted Kremenek | 803c9ed | 2008-01-23 22:30:44 +0000 | [diff] [blame] | 2080 | Out << "\\l"; |
Ted Kremenek | aa66a32 | 2008-01-16 21:46:15 +0000 | [diff] [blame] | 2081 | return Out.str(); |
| 2082 | } |
| 2083 | }; |
| 2084 | } // end llvm namespace |
| 2085 | #endif |
| 2086 | |
Ted Kremenek | ffe0f43 | 2008-03-07 22:58:01 +0000 | [diff] [blame] | 2087 | #ifndef NDEBUG |
Ted Kremenek | 7ec07fd | 2008-03-12 17:18:20 +0000 | [diff] [blame] | 2088 | |
| 2089 | template <typename ITERATOR> |
| 2090 | GRExprEngine::NodeTy* GetGraphNode(ITERATOR I) { return *I; } |
| 2091 | |
| 2092 | template <> |
| 2093 | GRExprEngine::NodeTy* |
| 2094 | GetGraphNode<llvm::DenseMap<GRExprEngine::NodeTy*, Expr*>::iterator> |
| 2095 | (llvm::DenseMap<GRExprEngine::NodeTy*, Expr*>::iterator I) { |
| 2096 | return I->first; |
| 2097 | } |
| 2098 | |
Ted Kremenek | ffe0f43 | 2008-03-07 22:58:01 +0000 | [diff] [blame] | 2099 | template <typename ITERATOR> |
| 2100 | static void AddSources(llvm::SmallVector<GRExprEngine::NodeTy*, 10>& Sources, |
Ted Kremenek | 7ec07fd | 2008-03-12 17:18:20 +0000 | [diff] [blame] | 2101 | ITERATOR I, ITERATOR E) { |
Ted Kremenek | ffe0f43 | 2008-03-07 22:58:01 +0000 | [diff] [blame] | 2102 | |
Ted Kremenek | 7ec07fd | 2008-03-12 17:18:20 +0000 | [diff] [blame] | 2103 | llvm::SmallPtrSet<void*,10> CachedSources; |
| 2104 | |
| 2105 | for ( ; I != E; ++I ) { |
| 2106 | GRExprEngine::NodeTy* N = GetGraphNode(I); |
| 2107 | void* p = N->getLocation().getRawData(); |
| 2108 | |
| 2109 | if (CachedSources.count(p)) |
| 2110 | continue; |
| 2111 | |
| 2112 | CachedSources.insert(p); |
| 2113 | |
| 2114 | Sources.push_back(N); |
| 2115 | } |
Ted Kremenek | ffe0f43 | 2008-03-07 22:58:01 +0000 | [diff] [blame] | 2116 | } |
| 2117 | #endif |
| 2118 | |
| 2119 | void GRExprEngine::ViewGraph(bool trim) { |
Ted Kremenek | 493d7a2 | 2008-03-11 18:25:33 +0000 | [diff] [blame] | 2120 | #ifndef NDEBUG |
Ted Kremenek | ffe0f43 | 2008-03-07 22:58:01 +0000 | [diff] [blame] | 2121 | if (trim) { |
Ted Kremenek | 7ec07fd | 2008-03-12 17:18:20 +0000 | [diff] [blame] | 2122 | llvm::SmallVector<NodeTy*, 10> Src; |
| 2123 | AddSources(Src, null_derefs_begin(), null_derefs_end()); |
| 2124 | AddSources(Src, undef_derefs_begin(), undef_derefs_end()); |
| 2125 | AddSources(Src, explicit_bad_divides_begin(), explicit_bad_divides_end()); |
| 2126 | AddSources(Src, undef_results_begin(), undef_results_end()); |
| 2127 | AddSources(Src, bad_calls_begin(), bad_calls_end()); |
| 2128 | AddSources(Src, undef_arg_begin(), undef_arg_end()); |
Ted Kremenek | 1b9df4c | 2008-03-14 18:14:50 +0000 | [diff] [blame] | 2129 | AddSources(Src, undef_branches_begin(), undef_branches_end()); |
Ted Kremenek | ffe0f43 | 2008-03-07 22:58:01 +0000 | [diff] [blame] | 2130 | |
Ted Kremenek | 7ec07fd | 2008-03-12 17:18:20 +0000 | [diff] [blame] | 2131 | ViewGraph(&Src[0], &Src[0]+Src.size()); |
Ted Kremenek | ffe0f43 | 2008-03-07 22:58:01 +0000 | [diff] [blame] | 2132 | } |
Ted Kremenek | 493d7a2 | 2008-03-11 18:25:33 +0000 | [diff] [blame] | 2133 | else { |
| 2134 | GraphPrintCheckerState = this; |
| 2135 | GraphPrintSourceManager = &getContext().getSourceManager(); |
Ted Kremenek | 75da3e8 | 2008-03-11 19:02:40 +0000 | [diff] [blame] | 2136 | GraphCheckerStatePrinter = TF->getCheckerStatePrinter(); |
Ted Kremenek | 493d7a2 | 2008-03-11 18:25:33 +0000 | [diff] [blame] | 2137 | |
Ted Kremenek | ffe0f43 | 2008-03-07 22:58:01 +0000 | [diff] [blame] | 2138 | llvm::ViewGraph(*G.roots_begin(), "GRExprEngine"); |
Ted Kremenek | 493d7a2 | 2008-03-11 18:25:33 +0000 | [diff] [blame] | 2139 | |
| 2140 | GraphPrintCheckerState = NULL; |
| 2141 | GraphPrintSourceManager = NULL; |
Ted Kremenek | 75da3e8 | 2008-03-11 19:02:40 +0000 | [diff] [blame] | 2142 | GraphCheckerStatePrinter = NULL; |
Ted Kremenek | 493d7a2 | 2008-03-11 18:25:33 +0000 | [diff] [blame] | 2143 | } |
| 2144 | #endif |
| 2145 | } |
| 2146 | |
| 2147 | void GRExprEngine::ViewGraph(NodeTy** Beg, NodeTy** End) { |
| 2148 | #ifndef NDEBUG |
| 2149 | GraphPrintCheckerState = this; |
| 2150 | GraphPrintSourceManager = &getContext().getSourceManager(); |
Ted Kremenek | 75da3e8 | 2008-03-11 19:02:40 +0000 | [diff] [blame] | 2151 | GraphCheckerStatePrinter = TF->getCheckerStatePrinter(); |
Ted Kremenek | ffe0f43 | 2008-03-07 22:58:01 +0000 | [diff] [blame] | 2152 | |
Ted Kremenek | 493d7a2 | 2008-03-11 18:25:33 +0000 | [diff] [blame] | 2153 | GRExprEngine::GraphTy* TrimmedG = G.Trim(Beg, End); |
| 2154 | |
| 2155 | if (!TrimmedG) |
| 2156 | llvm::cerr << "warning: Trimmed ExplodedGraph is empty.\n"; |
| 2157 | else { |
| 2158 | llvm::ViewGraph(*TrimmedG->roots_begin(), "TrimmedGRExprEngine"); |
| 2159 | delete TrimmedG; |
| 2160 | } |
Ted Kremenek | ffe0f43 | 2008-03-07 22:58:01 +0000 | [diff] [blame] | 2161 | |
Ted Kremenek | 3b4f670 | 2008-01-30 23:24:39 +0000 | [diff] [blame] | 2162 | GraphPrintCheckerState = NULL; |
Ted Kremenek | e97ca06 | 2008-03-07 20:57:30 +0000 | [diff] [blame] | 2163 | GraphPrintSourceManager = NULL; |
Ted Kremenek | 75da3e8 | 2008-03-11 19:02:40 +0000 | [diff] [blame] | 2164 | GraphCheckerStatePrinter = NULL; |
Ted Kremenek | e01c987 | 2008-02-14 22:36:46 +0000 | [diff] [blame] | 2165 | #endif |
Ted Kremenek | ee98546 | 2008-01-16 18:18:48 +0000 | [diff] [blame] | 2166 | } |