Ted Kremenek | 77349cb | 2008-02-14 22:13:12 +0000 | [diff] [blame] | 1 | //=-- GRExprEngine.cpp - Path-Sensitive Expression-Level Dataflow ---*- C++ -*-= |
Ted Kremenek | 6492485 | 2008-01-31 02:35:41 +0000 | [diff] [blame] | 2 | // |
Ted Kremenek | 4af8431 | 2008-01-31 06:49:09 +0000 | [diff] [blame] | 3 | // The LLVM Compiler Infrastructure |
Ted Kremenek | d27f816 | 2008-01-15 23:55:06 +0000 | [diff] [blame] | 4 | // |
| 5 | // This file is distributed under the University of Illinois Open Source |
| 6 | // License. See LICENSE.TXT for details. |
| 7 | // |
| 8 | //===----------------------------------------------------------------------===// |
| 9 | // |
Ted Kremenek | 77349cb | 2008-02-14 22:13:12 +0000 | [diff] [blame] | 10 | // This file defines a meta-engine for path-sensitive dataflow analysis that |
| 11 | // is built on GREngine, but provides the boilerplate to execute transfer |
| 12 | // functions and build the ExplodedGraph at the expression level. |
Ted Kremenek | d27f816 | 2008-01-15 23:55:06 +0000 | [diff] [blame] | 13 | // |
| 14 | //===----------------------------------------------------------------------===// |
| 15 | |
Ted Kremenek | 77349cb | 2008-02-14 22:13:12 +0000 | [diff] [blame] | 16 | #include "clang/Analysis/PathSensitive/GRExprEngine.h" |
Ted Kremenek | 50a6d0c | 2008-04-09 21:41:14 +0000 | [diff] [blame] | 17 | #include "clang/Analysis/PathSensitive/BugReporter.h" |
Ted Kremenek | e97ca06 | 2008-03-07 20:57:30 +0000 | [diff] [blame] | 18 | #include "clang/Basic/SourceManager.h" |
Ted Kremenek | e01c987 | 2008-02-14 22:36:46 +0000 | [diff] [blame] | 19 | #include "llvm/Support/Streams.h" |
Ted Kremenek | bdb435d | 2008-07-11 18:37:32 +0000 | [diff] [blame] | 20 | #include "llvm/ADT/ImmutableList.h" |
| 21 | #include "llvm/Support/Compiler.h" |
Ted Kremenek | a95d375 | 2008-09-13 05:16:45 +0000 | [diff] [blame] | 22 | #include "llvm/Support/raw_ostream.h" |
Ted Kremenek | 4323a57 | 2008-07-10 22:03:41 +0000 | [diff] [blame] | 23 | |
Ted Kremenek | 0f5f059 | 2008-02-27 06:07:00 +0000 | [diff] [blame] | 24 | #ifndef NDEBUG |
| 25 | #include "llvm/Support/GraphWriter.h" |
| 26 | #include <sstream> |
| 27 | #endif |
| 28 | |
Ted Kremenek | b387a3f | 2008-02-14 22:16:04 +0000 | [diff] [blame] | 29 | using namespace clang; |
| 30 | using llvm::dyn_cast; |
| 31 | using llvm::cast; |
| 32 | using llvm::APSInt; |
Ted Kremenek | ab2b8c5 | 2008-01-23 19:59:44 +0000 | [diff] [blame] | 33 | |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 34 | //===----------------------------------------------------------------------===// |
| 35 | // Engine construction and deletion. |
| 36 | //===----------------------------------------------------------------------===// |
| 37 | |
Ted Kremenek | bdb435d | 2008-07-11 18:37:32 +0000 | [diff] [blame] | 38 | namespace { |
| 39 | |
| 40 | class VISIBILITY_HIDDEN MappedBatchAuditor : public GRSimpleAPICheck { |
| 41 | typedef llvm::ImmutableList<GRSimpleAPICheck*> Checks; |
| 42 | typedef llvm::DenseMap<void*,Checks> MapTy; |
| 43 | |
| 44 | MapTy M; |
| 45 | Checks::Factory F; |
| 46 | |
| 47 | public: |
| 48 | MappedBatchAuditor(llvm::BumpPtrAllocator& Alloc) : F(Alloc) {} |
| 49 | |
| 50 | virtual ~MappedBatchAuditor() { |
| 51 | llvm::DenseSet<GRSimpleAPICheck*> AlreadyVisited; |
| 52 | |
| 53 | for (MapTy::iterator MI = M.begin(), ME = M.end(); MI != ME; ++MI) |
| 54 | for (Checks::iterator I=MI->second.begin(), E=MI->second.end(); I!=E;++I){ |
| 55 | |
| 56 | GRSimpleAPICheck* check = *I; |
| 57 | |
| 58 | if (AlreadyVisited.count(check)) |
| 59 | continue; |
| 60 | |
| 61 | AlreadyVisited.insert(check); |
| 62 | delete check; |
| 63 | } |
| 64 | } |
| 65 | |
| 66 | void AddCheck(GRSimpleAPICheck* A, Stmt::StmtClass C) { |
| 67 | assert (A && "Check cannot be null."); |
| 68 | void* key = reinterpret_cast<void*>((uintptr_t) C); |
| 69 | MapTy::iterator I = M.find(key); |
| 70 | M[key] = F.Concat(A, I == M.end() ? F.GetEmptyList() : I->second); |
| 71 | } |
| 72 | |
| 73 | virtual void EmitWarnings(BugReporter& BR) { |
| 74 | llvm::DenseSet<GRSimpleAPICheck*> AlreadyVisited; |
| 75 | |
| 76 | for (MapTy::iterator MI = M.begin(), ME = M.end(); MI != ME; ++MI) |
| 77 | for (Checks::iterator I=MI->second.begin(), E=MI->second.end(); I!=E;++I){ |
| 78 | |
| 79 | GRSimpleAPICheck* check = *I; |
| 80 | |
| 81 | if (AlreadyVisited.count(check)) |
| 82 | continue; |
| 83 | |
| 84 | check->EmitWarnings(BR); |
| 85 | } |
| 86 | } |
| 87 | |
Ted Kremenek | 4adc81e | 2008-08-13 04:27:00 +0000 | [diff] [blame] | 88 | virtual bool Audit(NodeTy* N, GRStateManager& VMgr) { |
Ted Kremenek | bdb435d | 2008-07-11 18:37:32 +0000 | [diff] [blame] | 89 | Stmt* S = cast<PostStmt>(N->getLocation()).getStmt(); |
| 90 | void* key = reinterpret_cast<void*>((uintptr_t) S->getStmtClass()); |
| 91 | MapTy::iterator MI = M.find(key); |
| 92 | |
| 93 | if (MI == M.end()) |
| 94 | return false; |
| 95 | |
| 96 | bool isSink = false; |
| 97 | |
| 98 | for (Checks::iterator I=MI->second.begin(), E=MI->second.end(); I!=E; ++I) |
Ted Kremenek | 584def7 | 2008-07-22 00:46:16 +0000 | [diff] [blame] | 99 | isSink |= (*I)->Audit(N, VMgr); |
Ted Kremenek | bdb435d | 2008-07-11 18:37:32 +0000 | [diff] [blame] | 100 | |
| 101 | return isSink; |
| 102 | } |
| 103 | }; |
| 104 | |
| 105 | } // end anonymous namespace |
| 106 | |
| 107 | //===----------------------------------------------------------------------===// |
| 108 | // Engine construction and deletion. |
| 109 | //===----------------------------------------------------------------------===// |
| 110 | |
Ted Kremenek | e448ab4 | 2008-05-01 18:33:28 +0000 | [diff] [blame] | 111 | static inline Selector GetNullarySelector(const char* name, ASTContext& Ctx) { |
| 112 | IdentifierInfo* II = &Ctx.Idents.get(name); |
| 113 | return Ctx.Selectors.getSelector(0, &II); |
| 114 | } |
| 115 | |
Ted Kremenek | daa497e | 2008-03-09 18:05:48 +0000 | [diff] [blame] | 116 | |
Ted Kremenek | 8b23361 | 2008-07-02 20:13:38 +0000 | [diff] [blame] | 117 | GRExprEngine::GRExprEngine(CFG& cfg, Decl& CD, ASTContext& Ctx, |
Ted Kremenek | 95c7b00 | 2008-10-24 01:04:59 +0000 | [diff] [blame] | 118 | LiveVariables& L, |
| 119 | GRStateManager::StoreManagerCreator SMC) |
Ted Kremenek | 50a6d0c | 2008-04-09 21:41:14 +0000 | [diff] [blame] | 120 | : CoreEngine(cfg, CD, Ctx, *this), |
| 121 | G(CoreEngine.getGraph()), |
Ted Kremenek | 8b23361 | 2008-07-02 20:13:38 +0000 | [diff] [blame] | 122 | Liveness(L), |
Ted Kremenek | 50a6d0c | 2008-04-09 21:41:14 +0000 | [diff] [blame] | 123 | Builder(NULL), |
Ted Kremenek | 95c7b00 | 2008-10-24 01:04:59 +0000 | [diff] [blame] | 124 | StateMgr(G.getContext(), SMC, |
Ted Kremenek | 9deb0e3 | 2008-10-24 20:32:16 +0000 | [diff] [blame] | 125 | CreateBasicConstraintManager, G.getAllocator(), cfg, CD, L), |
Ted Kremenek | 50a6d0c | 2008-04-09 21:41:14 +0000 | [diff] [blame] | 126 | SymMgr(StateMgr.getSymbolManager()), |
Ted Kremenek | e448ab4 | 2008-05-01 18:33:28 +0000 | [diff] [blame] | 127 | CurrentStmt(NULL), |
| 128 | NSExceptionII(NULL), NSExceptionInstanceRaiseSelectors(NULL), |
Ted Kremenek | 8b23361 | 2008-07-02 20:13:38 +0000 | [diff] [blame] | 129 | RaiseSel(GetNullarySelector("raise", G.getContext())) {} |
Ted Kremenek | 50a6d0c | 2008-04-09 21:41:14 +0000 | [diff] [blame] | 130 | |
Ted Kremenek | 1a654b6 | 2008-06-20 21:45:25 +0000 | [diff] [blame] | 131 | GRExprEngine::~GRExprEngine() { |
Ted Kremenek | 50a6d0c | 2008-04-09 21:41:14 +0000 | [diff] [blame] | 132 | for (BugTypeSet::iterator I = BugTypes.begin(), E = BugTypes.end(); I!=E; ++I) |
| 133 | delete *I; |
Ted Kremenek | bdb435d | 2008-07-11 18:37:32 +0000 | [diff] [blame] | 134 | |
Ted Kremenek | e448ab4 | 2008-05-01 18:33:28 +0000 | [diff] [blame] | 135 | |
| 136 | delete [] NSExceptionInstanceRaiseSelectors; |
Ted Kremenek | 50a6d0c | 2008-04-09 21:41:14 +0000 | [diff] [blame] | 137 | } |
| 138 | |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 139 | //===----------------------------------------------------------------------===// |
| 140 | // Utility methods. |
| 141 | //===----------------------------------------------------------------------===// |
| 142 | |
| 143 | // SaveAndRestore - A utility class that uses RIIA to save and restore |
| 144 | // the value of a variable. |
| 145 | template<typename T> |
| 146 | struct VISIBILITY_HIDDEN SaveAndRestore { |
| 147 | SaveAndRestore(T& x) : X(x), old_value(x) {} |
| 148 | ~SaveAndRestore() { X = old_value; } |
| 149 | T get() { return old_value; } |
| 150 | |
| 151 | T& X; |
| 152 | T old_value; |
| 153 | }; |
| 154 | |
Ted Kremenek | 186350f | 2008-04-23 20:12:28 +0000 | [diff] [blame] | 155 | // SaveOr - Similar to SaveAndRestore. Operates only on bools; the old |
| 156 | // value of a variable is saved, and during the dstor the old value is |
| 157 | // or'ed with the new value. |
| 158 | struct VISIBILITY_HIDDEN SaveOr { |
| 159 | SaveOr(bool& x) : X(x), old_value(x) { x = false; } |
| 160 | ~SaveOr() { X |= old_value; } |
| 161 | |
| 162 | bool& X; |
| 163 | bool old_value; |
| 164 | }; |
| 165 | |
| 166 | |
Ted Kremenek | c095997 | 2008-07-02 21:24:01 +0000 | [diff] [blame] | 167 | void GRExprEngine::EmitWarnings(BugReporterData& BRData) { |
Ted Kremenek | 50a6d0c | 2008-04-09 21:41:14 +0000 | [diff] [blame] | 168 | for (bug_type_iterator I = bug_types_begin(), E = bug_types_end(); I!=E; ++I){ |
Ted Kremenek | c095997 | 2008-07-02 21:24:01 +0000 | [diff] [blame] | 169 | GRBugReporter BR(BRData, *this); |
Ted Kremenek | 50a6d0c | 2008-04-09 21:41:14 +0000 | [diff] [blame] | 170 | (*I)->EmitWarnings(BR); |
| 171 | } |
| 172 | |
Ted Kremenek | bdb435d | 2008-07-11 18:37:32 +0000 | [diff] [blame] | 173 | if (BatchAuditor) { |
Ted Kremenek | c095997 | 2008-07-02 21:24:01 +0000 | [diff] [blame] | 174 | GRBugReporter BR(BRData, *this); |
Ted Kremenek | bdb435d | 2008-07-11 18:37:32 +0000 | [diff] [blame] | 175 | BatchAuditor->EmitWarnings(BR); |
Ted Kremenek | 50a6d0c | 2008-04-09 21:41:14 +0000 | [diff] [blame] | 176 | } |
| 177 | } |
| 178 | |
| 179 | void GRExprEngine::setTransferFunctions(GRTransferFuncs* tf) { |
Ted Kremenek | 729a9a2 | 2008-07-17 23:15:45 +0000 | [diff] [blame] | 180 | StateMgr.TF = tf; |
Ted Kremenek | 1c72ef0 | 2008-08-16 00:49:49 +0000 | [diff] [blame] | 181 | tf->RegisterChecks(*this); |
| 182 | tf->RegisterPrinters(getStateManager().Printers); |
Ted Kremenek | 50a6d0c | 2008-04-09 21:41:14 +0000 | [diff] [blame] | 183 | } |
| 184 | |
Ted Kremenek | bdb435d | 2008-07-11 18:37:32 +0000 | [diff] [blame] | 185 | void GRExprEngine::AddCheck(GRSimpleAPICheck* A, Stmt::StmtClass C) { |
| 186 | if (!BatchAuditor) |
| 187 | BatchAuditor.reset(new MappedBatchAuditor(getGraph().getAllocator())); |
| 188 | |
| 189 | ((MappedBatchAuditor*) BatchAuditor.get())->AddCheck(A, C); |
Ted Kremenek | 50a6d0c | 2008-04-09 21:41:14 +0000 | [diff] [blame] | 190 | } |
| 191 | |
Ted Kremenek | 4adc81e | 2008-08-13 04:27:00 +0000 | [diff] [blame] | 192 | const GRState* GRExprEngine::getInitialState() { |
Ted Kremenek | caa3724 | 2008-08-19 16:51:45 +0000 | [diff] [blame] | 193 | return StateMgr.getInitialState(); |
Ted Kremenek | e070a1d | 2008-02-04 21:59:01 +0000 | [diff] [blame] | 194 | } |
| 195 | |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 196 | //===----------------------------------------------------------------------===// |
| 197 | // Top-level transfer function logic (Dispatcher). |
| 198 | //===----------------------------------------------------------------------===// |
| 199 | |
| 200 | void GRExprEngine::ProcessStmt(Stmt* S, StmtNodeBuilder& builder) { |
| 201 | |
| 202 | Builder = &builder; |
Ted Kremenek | 846d4e9 | 2008-04-24 23:35:58 +0000 | [diff] [blame] | 203 | EntryNode = builder.getLastNode(); |
Ted Kremenek | df7533b | 2008-07-17 21:27:31 +0000 | [diff] [blame] | 204 | |
| 205 | // FIXME: Consolidate. |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 206 | CurrentStmt = S; |
Ted Kremenek | df7533b | 2008-07-17 21:27:31 +0000 | [diff] [blame] | 207 | StateMgr.CurrentStmt = S; |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 208 | |
| 209 | // Set up our simple checks. |
Ted Kremenek | bdb435d | 2008-07-11 18:37:32 +0000 | [diff] [blame] | 210 | if (BatchAuditor) |
| 211 | Builder->setAuditor(BatchAuditor.get()); |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 212 | |
Ted Kremenek | bdb435d | 2008-07-11 18:37:32 +0000 | [diff] [blame] | 213 | // Create the cleaned state. |
Ted Kremenek | 846d4e9 | 2008-04-24 23:35:58 +0000 | [diff] [blame] | 214 | CleanedState = StateMgr.RemoveDeadBindings(EntryNode->getState(), CurrentStmt, |
| 215 | Liveness, DeadSymbols); |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 216 | |
Ted Kremenek | 77d7ef8 | 2008-04-24 18:31:42 +0000 | [diff] [blame] | 217 | // Process any special transfer function for dead symbols. |
Ted Kremenek | 77d7ef8 | 2008-04-24 18:31:42 +0000 | [diff] [blame] | 218 | NodeSet Tmp; |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 219 | |
Ted Kremenek | 77d7ef8 | 2008-04-24 18:31:42 +0000 | [diff] [blame] | 220 | if (DeadSymbols.empty()) |
Ted Kremenek | 846d4e9 | 2008-04-24 23:35:58 +0000 | [diff] [blame] | 221 | Tmp.Add(EntryNode); |
Ted Kremenek | 77d7ef8 | 2008-04-24 18:31:42 +0000 | [diff] [blame] | 222 | else { |
| 223 | SaveAndRestore<bool> OldSink(Builder->BuildSinks); |
Ted Kremenek | 846d4e9 | 2008-04-24 23:35:58 +0000 | [diff] [blame] | 224 | SaveOr OldHasGen(Builder->HasGeneratedNode); |
| 225 | |
Ted Kremenek | 331b0ac | 2008-06-18 05:34:07 +0000 | [diff] [blame] | 226 | SaveAndRestore<bool> OldPurgeDeadSymbols(Builder->PurgingDeadSymbols); |
| 227 | Builder->PurgingDeadSymbols = true; |
| 228 | |
Ted Kremenek | 729a9a2 | 2008-07-17 23:15:45 +0000 | [diff] [blame] | 229 | getTF().EvalDeadSymbols(Tmp, *this, *Builder, EntryNode, S, |
Ted Kremenek | 910e999 | 2008-04-25 01:25:15 +0000 | [diff] [blame] | 230 | CleanedState, DeadSymbols); |
Ted Kremenek | 846d4e9 | 2008-04-24 23:35:58 +0000 | [diff] [blame] | 231 | |
| 232 | if (!Builder->BuildSinks && !Builder->HasGeneratedNode) |
| 233 | Tmp.Add(EntryNode); |
Ted Kremenek | 77d7ef8 | 2008-04-24 18:31:42 +0000 | [diff] [blame] | 234 | } |
Ted Kremenek | 846d4e9 | 2008-04-24 23:35:58 +0000 | [diff] [blame] | 235 | |
| 236 | bool HasAutoGenerated = false; |
| 237 | |
Ted Kremenek | 77d7ef8 | 2008-04-24 18:31:42 +0000 | [diff] [blame] | 238 | for (NodeSet::iterator I=Tmp.begin(), E=Tmp.end(); I!=E; ++I) { |
Ted Kremenek | 846d4e9 | 2008-04-24 23:35:58 +0000 | [diff] [blame] | 239 | |
| 240 | NodeSet Dst; |
| 241 | |
Ted Kremenek | 77d7ef8 | 2008-04-24 18:31:42 +0000 | [diff] [blame] | 242 | // Set the cleaned state. |
Ted Kremenek | 846d4e9 | 2008-04-24 23:35:58 +0000 | [diff] [blame] | 243 | Builder->SetCleanedState(*I == EntryNode ? CleanedState : GetState(*I)); |
| 244 | |
Ted Kremenek | 77d7ef8 | 2008-04-24 18:31:42 +0000 | [diff] [blame] | 245 | // Visit the statement. |
Ted Kremenek | 846d4e9 | 2008-04-24 23:35:58 +0000 | [diff] [blame] | 246 | Visit(S, *I, Dst); |
| 247 | |
| 248 | // Do we need to auto-generate a node? We only need to do this to generate |
| 249 | // a node with a "cleaned" state; GRCoreEngine will actually handle |
| 250 | // auto-transitions for other cases. |
| 251 | if (Dst.size() == 1 && *Dst.begin() == EntryNode |
| 252 | && !Builder->HasGeneratedNode && !HasAutoGenerated) { |
| 253 | HasAutoGenerated = true; |
| 254 | builder.generateNode(S, GetState(EntryNode), *I); |
| 255 | } |
Ted Kremenek | 77d7ef8 | 2008-04-24 18:31:42 +0000 | [diff] [blame] | 256 | } |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 257 | |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 258 | // NULL out these variables to cleanup. |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 259 | CleanedState = NULL; |
Ted Kremenek | 846d4e9 | 2008-04-24 23:35:58 +0000 | [diff] [blame] | 260 | EntryNode = NULL; |
Ted Kremenek | df7533b | 2008-07-17 21:27:31 +0000 | [diff] [blame] | 261 | |
| 262 | // FIXME: Consolidate. |
| 263 | StateMgr.CurrentStmt = 0; |
| 264 | CurrentStmt = 0; |
| 265 | |
Ted Kremenek | 846d4e9 | 2008-04-24 23:35:58 +0000 | [diff] [blame] | 266 | Builder = NULL; |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 267 | } |
| 268 | |
| 269 | void GRExprEngine::Visit(Stmt* S, NodeTy* Pred, NodeSet& Dst) { |
| 270 | |
| 271 | // FIXME: add metadata to the CFG so that we can disable |
| 272 | // this check when we KNOW that there is no block-level subexpression. |
| 273 | // The motivation is that this check requires a hashtable lookup. |
| 274 | |
| 275 | if (S != CurrentStmt && getCFG().isBlkExpr(S)) { |
| 276 | Dst.Add(Pred); |
| 277 | return; |
| 278 | } |
| 279 | |
| 280 | switch (S->getStmtClass()) { |
| 281 | |
| 282 | default: |
| 283 | // Cases we intentionally have "default" handle: |
| 284 | // AddrLabelExpr, IntegerLiteral, CharacterLiteral |
| 285 | |
| 286 | Dst.Add(Pred); // No-op. Simply propagate the current state unchanged. |
| 287 | break; |
Ted Kremenek | 540cbe2 | 2008-04-22 04:56:29 +0000 | [diff] [blame] | 288 | |
| 289 | case Stmt::ArraySubscriptExprClass: |
| 290 | VisitArraySubscriptExpr(cast<ArraySubscriptExpr>(S), Pred, Dst, false); |
| 291 | break; |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 292 | |
| 293 | case Stmt::AsmStmtClass: |
| 294 | VisitAsmStmt(cast<AsmStmt>(S), Pred, Dst); |
| 295 | break; |
| 296 | |
| 297 | case Stmt::BinaryOperatorClass: { |
| 298 | BinaryOperator* B = cast<BinaryOperator>(S); |
| 299 | |
| 300 | if (B->isLogicalOp()) { |
| 301 | VisitLogicalExpr(B, Pred, Dst); |
| 302 | break; |
| 303 | } |
| 304 | else if (B->getOpcode() == BinaryOperator::Comma) { |
Ted Kremenek | 4adc81e | 2008-08-13 04:27:00 +0000 | [diff] [blame] | 305 | const GRState* St = GetState(Pred); |
Zhongxing Xu | 8cd5aae | 2008-10-30 05:33:54 +0000 | [diff] [blame] | 306 | MakeNode(Dst, B, Pred, BindExpr(St, B, GetSVal(St, B->getRHS()))); |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 307 | break; |
| 308 | } |
| 309 | |
| 310 | VisitBinaryOperator(cast<BinaryOperator>(S), Pred, Dst); |
| 311 | break; |
| 312 | } |
| 313 | |
| 314 | case Stmt::CallExprClass: { |
| 315 | CallExpr* C = cast<CallExpr>(S); |
| 316 | VisitCall(C, Pred, C->arg_begin(), C->arg_end(), Dst); |
| 317 | break; |
| 318 | } |
| 319 | |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 320 | // FIXME: ChooseExpr is really a constant. We need to fix |
| 321 | // the CFG do not model them as explicit control-flow. |
| 322 | |
| 323 | case Stmt::ChooseExprClass: { // __builtin_choose_expr |
| 324 | ChooseExpr* C = cast<ChooseExpr>(S); |
| 325 | VisitGuardedExpr(C, C->getLHS(), C->getRHS(), Pred, Dst); |
| 326 | break; |
| 327 | } |
| 328 | |
| 329 | case Stmt::CompoundAssignOperatorClass: |
| 330 | VisitBinaryOperator(cast<BinaryOperator>(S), Pred, Dst); |
| 331 | break; |
Zhongxing Xu | f22679e | 2008-11-07 10:38:33 +0000 | [diff] [blame] | 332 | |
| 333 | case Stmt::CompoundLiteralExprClass: |
| 334 | VisitCompoundLiteralExpr(cast<CompoundLiteralExpr>(S), Pred, Dst, false); |
| 335 | break; |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 336 | |
| 337 | case Stmt::ConditionalOperatorClass: { // '?' operator |
| 338 | ConditionalOperator* C = cast<ConditionalOperator>(S); |
| 339 | VisitGuardedExpr(C, C->getLHS(), C->getRHS(), Pred, Dst); |
| 340 | break; |
| 341 | } |
| 342 | |
| 343 | case Stmt::DeclRefExprClass: |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 344 | VisitDeclRefExpr(cast<DeclRefExpr>(S), Pred, Dst, false); |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 345 | break; |
| 346 | |
| 347 | case Stmt::DeclStmtClass: |
| 348 | VisitDeclStmt(cast<DeclStmt>(S), Pred, Dst); |
| 349 | break; |
| 350 | |
Argyrios Kyrtzidis | 0835a3c | 2008-08-18 23:01:59 +0000 | [diff] [blame] | 351 | case Stmt::ImplicitCastExprClass: |
Douglas Gregor | 6eec8e8 | 2008-10-28 15:36:24 +0000 | [diff] [blame] | 352 | case Stmt::CStyleCastExprClass: { |
Argyrios Kyrtzidis | 0835a3c | 2008-08-18 23:01:59 +0000 | [diff] [blame] | 353 | CastExpr* C = cast<CastExpr>(S); |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 354 | VisitCast(C, C->getSubExpr(), Pred, Dst); |
| 355 | break; |
| 356 | } |
Zhongxing Xu | c4f8706 | 2008-10-30 05:02:23 +0000 | [diff] [blame] | 357 | |
| 358 | case Stmt::InitListExprClass: |
| 359 | VisitInitListExpr(cast<InitListExpr>(S), Pred, Dst); |
| 360 | break; |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 361 | |
Ted Kremenek | 97ed4f6 | 2008-10-17 00:03:18 +0000 | [diff] [blame] | 362 | case Stmt::MemberExprClass: |
Ted Kremenek | 469ecbd | 2008-04-21 23:43:38 +0000 | [diff] [blame] | 363 | VisitMemberExpr(cast<MemberExpr>(S), Pred, Dst, false); |
| 364 | break; |
Ted Kremenek | 97ed4f6 | 2008-10-17 00:03:18 +0000 | [diff] [blame] | 365 | |
| 366 | case Stmt::ObjCIvarRefExprClass: |
| 367 | VisitObjCIvarRefExpr(cast<ObjCIvarRefExpr>(S), Pred, Dst, false); |
| 368 | break; |
Ted Kremenek | af33741 | 2008-11-12 19:24:17 +0000 | [diff] [blame] | 369 | |
| 370 | case Stmt::ObjCForCollectionStmtClass: |
| 371 | VisitObjCForCollectionStmt(cast<ObjCForCollectionStmt>(S), Pred, Dst); |
| 372 | break; |
Ted Kremenek | 469ecbd | 2008-04-21 23:43:38 +0000 | [diff] [blame] | 373 | |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 374 | case Stmt::ObjCMessageExprClass: { |
| 375 | VisitObjCMessageExpr(cast<ObjCMessageExpr>(S), Pred, Dst); |
| 376 | break; |
| 377 | } |
| 378 | |
| 379 | case Stmt::ParenExprClass: |
Ted Kremenek | 540cbe2 | 2008-04-22 04:56:29 +0000 | [diff] [blame] | 380 | Visit(cast<ParenExpr>(S)->getSubExpr()->IgnoreParens(), Pred, Dst); |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 381 | break; |
| 382 | |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 383 | case Stmt::ReturnStmtClass: |
| 384 | VisitReturnStmt(cast<ReturnStmt>(S), Pred, Dst); |
| 385 | break; |
| 386 | |
Sebastian Redl | 0518999 | 2008-11-11 17:56:53 +0000 | [diff] [blame] | 387 | case Stmt::SizeOfAlignOfExprClass: |
| 388 | VisitSizeOfAlignOfExpr(cast<SizeOfAlignOfExpr>(S), Pred, Dst); |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 389 | break; |
| 390 | |
| 391 | case Stmt::StmtExprClass: { |
| 392 | StmtExpr* SE = cast<StmtExpr>(S); |
| 393 | |
Ted Kremenek | 4adc81e | 2008-08-13 04:27:00 +0000 | [diff] [blame] | 394 | const GRState* St = GetState(Pred); |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 395 | |
| 396 | // FIXME: Not certain if we can have empty StmtExprs. If so, we should |
| 397 | // probably just remove these from the CFG. |
| 398 | assert (!SE->getSubStmt()->body_empty()); |
| 399 | |
| 400 | if (Expr* LastExpr = dyn_cast<Expr>(*SE->getSubStmt()->body_rbegin())) |
Zhongxing Xu | 8cd5aae | 2008-10-30 05:33:54 +0000 | [diff] [blame] | 401 | MakeNode(Dst, SE, Pred, BindExpr(St, SE, GetSVal(St, LastExpr))); |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 402 | else |
| 403 | Dst.Add(Pred); |
| 404 | |
| 405 | break; |
| 406 | } |
| 407 | |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 408 | case Stmt::UnaryOperatorClass: |
| 409 | VisitUnaryOperator(cast<UnaryOperator>(S), Pred, Dst, false); |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 410 | break; |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 411 | } |
| 412 | } |
| 413 | |
Zhongxing Xu | 6d69b5d | 2008-10-16 06:09:51 +0000 | [diff] [blame] | 414 | void GRExprEngine::VisitLValue(Expr* Ex, NodeTy* Pred, NodeSet& Dst) { |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 415 | |
| 416 | Ex = Ex->IgnoreParens(); |
| 417 | |
| 418 | if (Ex != CurrentStmt && getCFG().isBlkExpr(Ex)) { |
| 419 | Dst.Add(Pred); |
| 420 | return; |
| 421 | } |
| 422 | |
| 423 | switch (Ex->getStmtClass()) { |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 424 | |
| 425 | case Stmt::ArraySubscriptExprClass: |
| 426 | VisitArraySubscriptExpr(cast<ArraySubscriptExpr>(Ex), Pred, Dst, true); |
| 427 | return; |
| 428 | |
| 429 | case Stmt::DeclRefExprClass: |
| 430 | VisitDeclRefExpr(cast<DeclRefExpr>(Ex), Pred, Dst, true); |
| 431 | return; |
| 432 | |
Ted Kremenek | 97ed4f6 | 2008-10-17 00:03:18 +0000 | [diff] [blame] | 433 | case Stmt::ObjCIvarRefExprClass: |
| 434 | VisitObjCIvarRefExpr(cast<ObjCIvarRefExpr>(Ex), Pred, Dst, true); |
| 435 | return; |
| 436 | |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 437 | case Stmt::UnaryOperatorClass: |
| 438 | VisitUnaryOperator(cast<UnaryOperator>(Ex), Pred, Dst, true); |
| 439 | return; |
| 440 | |
| 441 | case Stmt::MemberExprClass: |
| 442 | VisitMemberExpr(cast<MemberExpr>(Ex), Pred, Dst, true); |
| 443 | return; |
Ted Kremenek | b6b81d1 | 2008-10-17 17:24:14 +0000 | [diff] [blame] | 444 | |
Ted Kremenek | 4f09027 | 2008-10-27 21:54:31 +0000 | [diff] [blame] | 445 | case Stmt::CompoundLiteralExprClass: |
Zhongxing Xu | f22679e | 2008-11-07 10:38:33 +0000 | [diff] [blame] | 446 | VisitCompoundLiteralExpr(cast<CompoundLiteralExpr>(Ex), Pred, Dst, true); |
Ted Kremenek | 4f09027 | 2008-10-27 21:54:31 +0000 | [diff] [blame] | 447 | return; |
| 448 | |
Ted Kremenek | b6b81d1 | 2008-10-17 17:24:14 +0000 | [diff] [blame] | 449 | case Stmt::ObjCPropertyRefExprClass: |
| 450 | // FIXME: Property assignments are lvalues, but not really "locations". |
| 451 | // e.g.: self.x = something; |
| 452 | // Here the "self.x" really can translate to a method call (setter) when |
| 453 | // the assignment is made. Moreover, the entire assignment expression |
| 454 | // evaluate to whatever "something" is, not calling the "getter" for |
| 455 | // the property (which would make sense since it can have side effects). |
| 456 | // We'll probably treat this as a location, but not one that we can |
| 457 | // take the address of. Perhaps we need a new SVal class for cases |
| 458 | // like thsis? |
| 459 | // Note that we have a similar problem for bitfields, since they don't |
| 460 | // have "locations" in the sense that we can take their address. |
| 461 | Dst.Add(Pred); |
Ted Kremenek | c7df6d2 | 2008-10-18 04:08:49 +0000 | [diff] [blame] | 462 | return; |
Zhongxing Xu | 143bf82 | 2008-10-25 14:18:57 +0000 | [diff] [blame] | 463 | |
| 464 | case Stmt::StringLiteralClass: { |
| 465 | const GRState* St = GetState(Pred); |
| 466 | SVal V = StateMgr.GetLValue(St, cast<StringLiteral>(Ex)); |
Zhongxing Xu | 8cd5aae | 2008-10-30 05:33:54 +0000 | [diff] [blame] | 467 | MakeNode(Dst, Ex, Pred, BindExpr(St, Ex, V)); |
Zhongxing Xu | 143bf82 | 2008-10-25 14:18:57 +0000 | [diff] [blame] | 468 | return; |
| 469 | } |
Ted Kremenek | c7df6d2 | 2008-10-18 04:08:49 +0000 | [diff] [blame] | 470 | |
Ted Kremenek | f8cd1b2 | 2008-10-18 04:15:35 +0000 | [diff] [blame] | 471 | default: |
| 472 | // Arbitrary subexpressions can return aggregate temporaries that |
| 473 | // can be used in a lvalue context. We need to enhance our support |
| 474 | // of such temporaries in both the environment and the store, so right |
| 475 | // now we just do a regular visit. |
Ted Kremenek | 5b2316a | 2008-10-25 20:09:21 +0000 | [diff] [blame] | 476 | assert ((Ex->getType()->isAggregateType() || |
| 477 | Ex->getType()->isUnionType()) && |
| 478 | "Other kinds of expressions with non-aggregate/union types do" |
| 479 | " not have lvalues."); |
Ted Kremenek | c7df6d2 | 2008-10-18 04:08:49 +0000 | [diff] [blame] | 480 | |
Ted Kremenek | f8cd1b2 | 2008-10-18 04:15:35 +0000 | [diff] [blame] | 481 | Visit(Ex, Pred, Dst); |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 482 | } |
| 483 | } |
| 484 | |
| 485 | //===----------------------------------------------------------------------===// |
| 486 | // Block entrance. (Update counters). |
| 487 | //===----------------------------------------------------------------------===// |
| 488 | |
Ted Kremenek | 4adc81e | 2008-08-13 04:27:00 +0000 | [diff] [blame] | 489 | bool GRExprEngine::ProcessBlockEntrance(CFGBlock* B, const GRState*, |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 490 | GRBlockCounter BC) { |
| 491 | |
| 492 | return BC.getNumVisited(B->getBlockID()) < 3; |
| 493 | } |
| 494 | |
| 495 | //===----------------------------------------------------------------------===// |
| 496 | // Branch processing. |
| 497 | //===----------------------------------------------------------------------===// |
| 498 | |
Ted Kremenek | 4adc81e | 2008-08-13 04:27:00 +0000 | [diff] [blame] | 499 | const GRState* GRExprEngine::MarkBranch(const GRState* St, |
Ted Kremenek | 4323a57 | 2008-07-10 22:03:41 +0000 | [diff] [blame] | 500 | Stmt* Terminator, |
| 501 | bool branchTaken) { |
Ted Kremenek | 05a2378 | 2008-02-26 19:05:15 +0000 | [diff] [blame] | 502 | |
| 503 | switch (Terminator->getStmtClass()) { |
| 504 | default: |
| 505 | return St; |
| 506 | |
| 507 | case Stmt::BinaryOperatorClass: { // '&&' and '||' |
| 508 | |
| 509 | BinaryOperator* B = cast<BinaryOperator>(Terminator); |
| 510 | BinaryOperator::Opcode Op = B->getOpcode(); |
| 511 | |
| 512 | assert (Op == BinaryOperator::LAnd || Op == BinaryOperator::LOr); |
| 513 | |
| 514 | // For &&, if we take the true branch, then the value of the whole |
| 515 | // expression is that of the RHS expression. |
| 516 | // |
| 517 | // For ||, if we take the false branch, then the value of the whole |
| 518 | // expression is that of the RHS expression. |
| 519 | |
| 520 | Expr* Ex = (Op == BinaryOperator::LAnd && branchTaken) || |
| 521 | (Op == BinaryOperator::LOr && !branchTaken) |
| 522 | ? B->getRHS() : B->getLHS(); |
| 523 | |
Zhongxing Xu | 8cd5aae | 2008-10-30 05:33:54 +0000 | [diff] [blame] | 524 | return BindBlkExpr(St, B, UndefinedVal(Ex)); |
Ted Kremenek | 05a2378 | 2008-02-26 19:05:15 +0000 | [diff] [blame] | 525 | } |
| 526 | |
| 527 | case Stmt::ConditionalOperatorClass: { // ?: |
| 528 | |
| 529 | ConditionalOperator* C = cast<ConditionalOperator>(Terminator); |
| 530 | |
| 531 | // For ?, if branchTaken == true then the value is either the LHS or |
| 532 | // the condition itself. (GNU extension). |
| 533 | |
| 534 | Expr* Ex; |
| 535 | |
| 536 | if (branchTaken) |
| 537 | Ex = C->getLHS() ? C->getLHS() : C->getCond(); |
| 538 | else |
| 539 | Ex = C->getRHS(); |
| 540 | |
Zhongxing Xu | 8cd5aae | 2008-10-30 05:33:54 +0000 | [diff] [blame] | 541 | return BindBlkExpr(St, C, UndefinedVal(Ex)); |
Ted Kremenek | 05a2378 | 2008-02-26 19:05:15 +0000 | [diff] [blame] | 542 | } |
| 543 | |
| 544 | case Stmt::ChooseExprClass: { // ?: |
| 545 | |
| 546 | ChooseExpr* C = cast<ChooseExpr>(Terminator); |
| 547 | |
| 548 | Expr* Ex = branchTaken ? C->getLHS() : C->getRHS(); |
Zhongxing Xu | 8cd5aae | 2008-10-30 05:33:54 +0000 | [diff] [blame] | 549 | return BindBlkExpr(St, C, UndefinedVal(Ex)); |
Ted Kremenek | 05a2378 | 2008-02-26 19:05:15 +0000 | [diff] [blame] | 550 | } |
| 551 | } |
| 552 | } |
| 553 | |
Ted Kremenek | af33741 | 2008-11-12 19:24:17 +0000 | [diff] [blame] | 554 | void GRExprEngine::ProcessBranch(Stmt* Condition, Stmt* Term, |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 555 | BranchNodeBuilder& builder) { |
Ted Kremenek | b38911f | 2008-01-30 23:03:39 +0000 | [diff] [blame] | 556 | |
Ted Kremenek | e7d2211 | 2008-02-11 19:21:59 +0000 | [diff] [blame] | 557 | // Remove old bindings for subexpressions. |
Ted Kremenek | 4adc81e | 2008-08-13 04:27:00 +0000 | [diff] [blame] | 558 | const GRState* PrevState = |
Ted Kremenek | 4323a57 | 2008-07-10 22:03:41 +0000 | [diff] [blame] | 559 | StateMgr.RemoveSubExprBindings(builder.getState()); |
Ted Kremenek | f233d48 | 2008-02-05 00:26:40 +0000 | [diff] [blame] | 560 | |
Ted Kremenek | b233183 | 2008-02-15 22:29:00 +0000 | [diff] [blame] | 561 | // Check for NULL conditions; e.g. "for(;;)" |
| 562 | if (!Condition) { |
| 563 | builder.markInfeasible(false); |
Ted Kremenek | b233183 | 2008-02-15 22:29:00 +0000 | [diff] [blame] | 564 | return; |
| 565 | } |
| 566 | |
Zhongxing Xu | 1c96b24 | 2008-10-17 05:57:07 +0000 | [diff] [blame] | 567 | SVal V = GetSVal(PrevState, Condition); |
Ted Kremenek | b38911f | 2008-01-30 23:03:39 +0000 | [diff] [blame] | 568 | |
| 569 | switch (V.getBaseKind()) { |
| 570 | default: |
| 571 | break; |
| 572 | |
Zhongxing Xu | 1c96b24 | 2008-10-17 05:57:07 +0000 | [diff] [blame] | 573 | case SVal::UnknownKind: |
Ted Kremenek | 58b3321 | 2008-02-26 19:40:44 +0000 | [diff] [blame] | 574 | builder.generateNode(MarkBranch(PrevState, Term, true), true); |
| 575 | builder.generateNode(MarkBranch(PrevState, Term, false), false); |
Ted Kremenek | b38911f | 2008-01-30 23:03:39 +0000 | [diff] [blame] | 576 | return; |
| 577 | |
Zhongxing Xu | 1c96b24 | 2008-10-17 05:57:07 +0000 | [diff] [blame] | 578 | case SVal::UndefinedKind: { |
Ted Kremenek | b38911f | 2008-01-30 23:03:39 +0000 | [diff] [blame] | 579 | NodeTy* N = builder.generateNode(PrevState, true); |
| 580 | |
| 581 | if (N) { |
| 582 | N->markAsSink(); |
Ted Kremenek | 4a4e524 | 2008-02-28 09:25:22 +0000 | [diff] [blame] | 583 | UndefBranches.insert(N); |
Ted Kremenek | b38911f | 2008-01-30 23:03:39 +0000 | [diff] [blame] | 584 | } |
| 585 | |
| 586 | builder.markInfeasible(false); |
| 587 | return; |
| 588 | } |
| 589 | } |
Ted Kremenek | 8e49dd6 | 2008-02-12 18:08:17 +0000 | [diff] [blame] | 590 | |
Ted Kremenek | 6a6719a | 2008-02-29 20:27:50 +0000 | [diff] [blame] | 591 | // Process the true branch. |
Ted Kremenek | 8e49dd6 | 2008-02-12 18:08:17 +0000 | [diff] [blame] | 592 | |
Ted Kremenek | 361fa8e | 2008-03-12 21:45:47 +0000 | [diff] [blame] | 593 | bool isFeasible = false; |
Ted Kremenek | 4adc81e | 2008-08-13 04:27:00 +0000 | [diff] [blame] | 594 | const GRState* St = Assume(PrevState, V, true, isFeasible); |
Ted Kremenek | 6a6719a | 2008-02-29 20:27:50 +0000 | [diff] [blame] | 595 | |
| 596 | if (isFeasible) |
| 597 | builder.generateNode(MarkBranch(St, Term, true), true); |
Ted Kremenek | 8e49dd6 | 2008-02-12 18:08:17 +0000 | [diff] [blame] | 598 | else |
| 599 | builder.markInfeasible(true); |
Ted Kremenek | 6a6719a | 2008-02-29 20:27:50 +0000 | [diff] [blame] | 600 | |
| 601 | // Process the false branch. |
Ted Kremenek | b38911f | 2008-01-30 23:03:39 +0000 | [diff] [blame] | 602 | |
Ted Kremenek | 6a6719a | 2008-02-29 20:27:50 +0000 | [diff] [blame] | 603 | isFeasible = false; |
| 604 | St = Assume(PrevState, V, false, isFeasible); |
Ted Kremenek | b38911f | 2008-01-30 23:03:39 +0000 | [diff] [blame] | 605 | |
Ted Kremenek | 6a6719a | 2008-02-29 20:27:50 +0000 | [diff] [blame] | 606 | if (isFeasible) |
| 607 | builder.generateNode(MarkBranch(St, Term, false), false); |
Ted Kremenek | f233d48 | 2008-02-05 00:26:40 +0000 | [diff] [blame] | 608 | else |
| 609 | builder.markInfeasible(false); |
Ted Kremenek | 71c29bd | 2008-01-29 23:32:35 +0000 | [diff] [blame] | 610 | } |
| 611 | |
Ted Kremenek | 4d4dd85 | 2008-02-13 17:41:41 +0000 | [diff] [blame] | 612 | /// ProcessIndirectGoto - Called by GRCoreEngine. Used to generate successor |
Ted Kremenek | 754607e | 2008-02-13 00:24:44 +0000 | [diff] [blame] | 613 | /// nodes by processing the 'effects' of a computed goto jump. |
Ted Kremenek | 4d4dd85 | 2008-02-13 17:41:41 +0000 | [diff] [blame] | 614 | void GRExprEngine::ProcessIndirectGoto(IndirectGotoNodeBuilder& builder) { |
Ted Kremenek | 754607e | 2008-02-13 00:24:44 +0000 | [diff] [blame] | 615 | |
Ted Kremenek | 4adc81e | 2008-08-13 04:27:00 +0000 | [diff] [blame] | 616 | const GRState* St = builder.getState(); |
Zhongxing Xu | 1c96b24 | 2008-10-17 05:57:07 +0000 | [diff] [blame] | 617 | SVal V = GetSVal(St, builder.getTarget()); |
Ted Kremenek | 754607e | 2008-02-13 00:24:44 +0000 | [diff] [blame] | 618 | |
| 619 | // Three possibilities: |
| 620 | // |
| 621 | // (1) We know the computed label. |
Ted Kremenek | 4a4e524 | 2008-02-28 09:25:22 +0000 | [diff] [blame] | 622 | // (2) The label is NULL (or some other constant), or Undefined. |
Ted Kremenek | 754607e | 2008-02-13 00:24:44 +0000 | [diff] [blame] | 623 | // (3) We have no clue about the label. Dispatch to all targets. |
| 624 | // |
| 625 | |
| 626 | typedef IndirectGotoNodeBuilder::iterator iterator; |
| 627 | |
Zhongxing Xu | 1c96b24 | 2008-10-17 05:57:07 +0000 | [diff] [blame] | 628 | if (isa<loc::GotoLabel>(V)) { |
| 629 | LabelStmt* L = cast<loc::GotoLabel>(V).getLabel(); |
Ted Kremenek | 754607e | 2008-02-13 00:24:44 +0000 | [diff] [blame] | 630 | |
| 631 | for (iterator I=builder.begin(), E=builder.end(); I != E; ++I) { |
Ted Kremenek | 24f1a96 | 2008-02-13 17:27:37 +0000 | [diff] [blame] | 632 | if (I.getLabel() == L) { |
| 633 | builder.generateNode(I, St); |
Ted Kremenek | 754607e | 2008-02-13 00:24:44 +0000 | [diff] [blame] | 634 | return; |
| 635 | } |
| 636 | } |
| 637 | |
| 638 | assert (false && "No block with label."); |
| 639 | return; |
| 640 | } |
| 641 | |
Zhongxing Xu | 1c96b24 | 2008-10-17 05:57:07 +0000 | [diff] [blame] | 642 | if (isa<loc::ConcreteInt>(V) || isa<UndefinedVal>(V)) { |
Ted Kremenek | 754607e | 2008-02-13 00:24:44 +0000 | [diff] [blame] | 643 | // Dispatch to the first target and mark it as a sink. |
Ted Kremenek | 24f1a96 | 2008-02-13 17:27:37 +0000 | [diff] [blame] | 644 | NodeTy* N = builder.generateNode(builder.begin(), St, true); |
Ted Kremenek | 4a4e524 | 2008-02-28 09:25:22 +0000 | [diff] [blame] | 645 | UndefBranches.insert(N); |
Ted Kremenek | 754607e | 2008-02-13 00:24:44 +0000 | [diff] [blame] | 646 | return; |
| 647 | } |
| 648 | |
| 649 | // This is really a catch-all. We don't support symbolics yet. |
| 650 | |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 651 | assert (V.isUnknown()); |
Ted Kremenek | 754607e | 2008-02-13 00:24:44 +0000 | [diff] [blame] | 652 | |
| 653 | for (iterator I=builder.begin(), E=builder.end(); I != E; ++I) |
Ted Kremenek | 24f1a96 | 2008-02-13 17:27:37 +0000 | [diff] [blame] | 654 | builder.generateNode(I, St); |
Ted Kremenek | 754607e | 2008-02-13 00:24:44 +0000 | [diff] [blame] | 655 | } |
Ted Kremenek | f233d48 | 2008-02-05 00:26:40 +0000 | [diff] [blame] | 656 | |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 657 | |
| 658 | void GRExprEngine::VisitGuardedExpr(Expr* Ex, Expr* L, Expr* R, |
| 659 | NodeTy* Pred, NodeSet& Dst) { |
| 660 | |
| 661 | assert (Ex == CurrentStmt && getCFG().isBlkExpr(Ex)); |
| 662 | |
Ted Kremenek | 4adc81e | 2008-08-13 04:27:00 +0000 | [diff] [blame] | 663 | const GRState* St = GetState(Pred); |
Zhongxing Xu | 1c96b24 | 2008-10-17 05:57:07 +0000 | [diff] [blame] | 664 | SVal X = GetBlkExprSVal(St, Ex); |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 665 | |
| 666 | assert (X.isUndef()); |
| 667 | |
| 668 | Expr* SE = (Expr*) cast<UndefinedVal>(X).getData(); |
| 669 | |
| 670 | assert (SE); |
| 671 | |
Zhongxing Xu | 1c96b24 | 2008-10-17 05:57:07 +0000 | [diff] [blame] | 672 | X = GetBlkExprSVal(St, SE); |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 673 | |
| 674 | // Make sure that we invalidate the previous binding. |
Zhongxing Xu | 8cd5aae | 2008-10-30 05:33:54 +0000 | [diff] [blame] | 675 | MakeNode(Dst, Ex, Pred, StateMgr.BindExpr(St, Ex, X, true, true)); |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 676 | } |
| 677 | |
Ted Kremenek | daeb9a7 | 2008-02-13 23:08:21 +0000 | [diff] [blame] | 678 | /// ProcessSwitch - Called by GRCoreEngine. Used to generate successor |
| 679 | /// nodes by processing the 'effects' of a switch statement. |
| 680 | void GRExprEngine::ProcessSwitch(SwitchNodeBuilder& builder) { |
| 681 | |
| 682 | typedef SwitchNodeBuilder::iterator iterator; |
| 683 | |
Ted Kremenek | 4adc81e | 2008-08-13 04:27:00 +0000 | [diff] [blame] | 684 | const GRState* St = builder.getState(); |
Ted Kremenek | 692416c | 2008-02-18 22:57:02 +0000 | [diff] [blame] | 685 | Expr* CondE = builder.getCondition(); |
Zhongxing Xu | 1c96b24 | 2008-10-17 05:57:07 +0000 | [diff] [blame] | 686 | SVal CondV = GetSVal(St, CondE); |
Ted Kremenek | daeb9a7 | 2008-02-13 23:08:21 +0000 | [diff] [blame] | 687 | |
Ted Kremenek | 4a4e524 | 2008-02-28 09:25:22 +0000 | [diff] [blame] | 688 | if (CondV.isUndef()) { |
Ted Kremenek | daeb9a7 | 2008-02-13 23:08:21 +0000 | [diff] [blame] | 689 | NodeTy* N = builder.generateDefaultCaseNode(St, true); |
Ted Kremenek | 4a4e524 | 2008-02-28 09:25:22 +0000 | [diff] [blame] | 690 | UndefBranches.insert(N); |
Ted Kremenek | daeb9a7 | 2008-02-13 23:08:21 +0000 | [diff] [blame] | 691 | return; |
| 692 | } |
| 693 | |
Ted Kremenek | 4adc81e | 2008-08-13 04:27:00 +0000 | [diff] [blame] | 694 | const GRState* DefaultSt = St; |
Ted Kremenek | daeb9a7 | 2008-02-13 23:08:21 +0000 | [diff] [blame] | 695 | |
| 696 | // While most of this can be assumed (such as the signedness), having it |
| 697 | // just computed makes sure everything makes the same assumptions end-to-end. |
Ted Kremenek | 692416c | 2008-02-18 22:57:02 +0000 | [diff] [blame] | 698 | |
Chris Lattner | 98be494 | 2008-03-05 18:54:05 +0000 | [diff] [blame] | 699 | unsigned bits = getContext().getTypeSize(CondE->getType()); |
Ted Kremenek | 692416c | 2008-02-18 22:57:02 +0000 | [diff] [blame] | 700 | |
Ted Kremenek | daeb9a7 | 2008-02-13 23:08:21 +0000 | [diff] [blame] | 701 | APSInt V1(bits, false); |
| 702 | APSInt V2 = V1; |
Ted Kremenek | 5014ab1 | 2008-04-23 05:03:18 +0000 | [diff] [blame] | 703 | bool DefaultFeasible = false; |
Ted Kremenek | daeb9a7 | 2008-02-13 23:08:21 +0000 | [diff] [blame] | 704 | |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 705 | for (iterator I = builder.begin(), EI = builder.end(); I != EI; ++I) { |
Ted Kremenek | daeb9a7 | 2008-02-13 23:08:21 +0000 | [diff] [blame] | 706 | |
| 707 | CaseStmt* Case = cast<CaseStmt>(I.getCase()); |
| 708 | |
| 709 | // Evaluate the case. |
| 710 | if (!Case->getLHS()->isIntegerConstantExpr(V1, getContext(), 0, true)) { |
| 711 | assert (false && "Case condition must evaluate to an integer constant."); |
| 712 | return; |
| 713 | } |
| 714 | |
| 715 | // Get the RHS of the case, if it exists. |
| 716 | |
| 717 | if (Expr* E = Case->getRHS()) { |
| 718 | if (!E->isIntegerConstantExpr(V2, getContext(), 0, true)) { |
| 719 | assert (false && |
| 720 | "Case condition (RHS) must evaluate to an integer constant."); |
| 721 | return ; |
| 722 | } |
| 723 | |
| 724 | assert (V1 <= V2); |
| 725 | } |
Ted Kremenek | 14a1140 | 2008-03-17 22:17:56 +0000 | [diff] [blame] | 726 | else |
| 727 | V2 = V1; |
Ted Kremenek | daeb9a7 | 2008-02-13 23:08:21 +0000 | [diff] [blame] | 728 | |
| 729 | // FIXME: Eventually we should replace the logic below with a range |
| 730 | // comparison, rather than concretize the values within the range. |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 731 | // This should be easy once we have "ranges" for NonLVals. |
Ted Kremenek | daeb9a7 | 2008-02-13 23:08:21 +0000 | [diff] [blame] | 732 | |
Ted Kremenek | 14a1140 | 2008-03-17 22:17:56 +0000 | [diff] [blame] | 733 | do { |
Zhongxing Xu | 1c96b24 | 2008-10-17 05:57:07 +0000 | [diff] [blame] | 734 | nonloc::ConcreteInt CaseVal(getBasicVals().getValue(V1)); |
Ted Kremenek | daeb9a7 | 2008-02-13 23:08:21 +0000 | [diff] [blame] | 735 | |
Zhongxing Xu | 1c96b24 | 2008-10-17 05:57:07 +0000 | [diff] [blame] | 736 | SVal Res = EvalBinOp(BinaryOperator::EQ, CondV, CaseVal); |
Ted Kremenek | daeb9a7 | 2008-02-13 23:08:21 +0000 | [diff] [blame] | 737 | |
| 738 | // Now "assume" that the case matches. |
Ted Kremenek | daeb9a7 | 2008-02-13 23:08:21 +0000 | [diff] [blame] | 739 | |
Ted Kremenek | 361fa8e | 2008-03-12 21:45:47 +0000 | [diff] [blame] | 740 | bool isFeasible = false; |
Ted Kremenek | 4adc81e | 2008-08-13 04:27:00 +0000 | [diff] [blame] | 741 | const GRState* StNew = Assume(St, Res, true, isFeasible); |
Ted Kremenek | daeb9a7 | 2008-02-13 23:08:21 +0000 | [diff] [blame] | 742 | |
| 743 | if (isFeasible) { |
| 744 | builder.generateCaseStmtNode(I, StNew); |
| 745 | |
| 746 | // If CondV evaluates to a constant, then we know that this |
| 747 | // is the *only* case that we can take, so stop evaluating the |
| 748 | // others. |
Zhongxing Xu | 1c96b24 | 2008-10-17 05:57:07 +0000 | [diff] [blame] | 749 | if (isa<nonloc::ConcreteInt>(CondV)) |
Ted Kremenek | daeb9a7 | 2008-02-13 23:08:21 +0000 | [diff] [blame] | 750 | return; |
| 751 | } |
| 752 | |
| 753 | // Now "assume" that the case doesn't match. Add this state |
| 754 | // to the default state (if it is feasible). |
| 755 | |
Ted Kremenek | 361fa8e | 2008-03-12 21:45:47 +0000 | [diff] [blame] | 756 | isFeasible = false; |
Ted Kremenek | 6cb0b54 | 2008-02-14 19:37:24 +0000 | [diff] [blame] | 757 | StNew = Assume(DefaultSt, Res, false, isFeasible); |
Ted Kremenek | daeb9a7 | 2008-02-13 23:08:21 +0000 | [diff] [blame] | 758 | |
Ted Kremenek | 5014ab1 | 2008-04-23 05:03:18 +0000 | [diff] [blame] | 759 | if (isFeasible) { |
| 760 | DefaultFeasible = true; |
Ted Kremenek | daeb9a7 | 2008-02-13 23:08:21 +0000 | [diff] [blame] | 761 | DefaultSt = StNew; |
Ted Kremenek | 5014ab1 | 2008-04-23 05:03:18 +0000 | [diff] [blame] | 762 | } |
Ted Kremenek | daeb9a7 | 2008-02-13 23:08:21 +0000 | [diff] [blame] | 763 | |
Ted Kremenek | 14a1140 | 2008-03-17 22:17:56 +0000 | [diff] [blame] | 764 | // Concretize the next value in the range. |
| 765 | if (V1 == V2) |
| 766 | break; |
Ted Kremenek | daeb9a7 | 2008-02-13 23:08:21 +0000 | [diff] [blame] | 767 | |
Ted Kremenek | 14a1140 | 2008-03-17 22:17:56 +0000 | [diff] [blame] | 768 | ++V1; |
Ted Kremenek | 58cda6f | 2008-03-17 22:18:22 +0000 | [diff] [blame] | 769 | assert (V1 <= V2); |
Ted Kremenek | 14a1140 | 2008-03-17 22:17:56 +0000 | [diff] [blame] | 770 | |
| 771 | } while (true); |
Ted Kremenek | daeb9a7 | 2008-02-13 23:08:21 +0000 | [diff] [blame] | 772 | } |
| 773 | |
| 774 | // If we reach here, than we know that the default branch is |
| 775 | // possible. |
Ted Kremenek | 5014ab1 | 2008-04-23 05:03:18 +0000 | [diff] [blame] | 776 | if (DefaultFeasible) builder.generateDefaultCaseNode(DefaultSt); |
Ted Kremenek | daeb9a7 | 2008-02-13 23:08:21 +0000 | [diff] [blame] | 777 | } |
| 778 | |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 779 | //===----------------------------------------------------------------------===// |
| 780 | // Transfer functions: logical operations ('&&', '||'). |
| 781 | //===----------------------------------------------------------------------===// |
Ted Kremenek | daeb9a7 | 2008-02-13 23:08:21 +0000 | [diff] [blame] | 782 | |
Ted Kremenek | 4d4dd85 | 2008-02-13 17:41:41 +0000 | [diff] [blame] | 783 | void GRExprEngine::VisitLogicalExpr(BinaryOperator* B, NodeTy* Pred, |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 784 | NodeSet& Dst) { |
Ted Kremenek | 9dca062 | 2008-02-19 00:22:37 +0000 | [diff] [blame] | 785 | |
Ted Kremenek | 05a2378 | 2008-02-26 19:05:15 +0000 | [diff] [blame] | 786 | assert (B->getOpcode() == BinaryOperator::LAnd || |
| 787 | B->getOpcode() == BinaryOperator::LOr); |
| 788 | |
| 789 | assert (B == CurrentStmt && getCFG().isBlkExpr(B)); |
| 790 | |
Ted Kremenek | 4adc81e | 2008-08-13 04:27:00 +0000 | [diff] [blame] | 791 | const GRState* St = GetState(Pred); |
Zhongxing Xu | 1c96b24 | 2008-10-17 05:57:07 +0000 | [diff] [blame] | 792 | SVal X = GetBlkExprSVal(St, B); |
Ted Kremenek | 05a2378 | 2008-02-26 19:05:15 +0000 | [diff] [blame] | 793 | |
Ted Kremenek | 4a4e524 | 2008-02-28 09:25:22 +0000 | [diff] [blame] | 794 | assert (X.isUndef()); |
Ted Kremenek | 05a2378 | 2008-02-26 19:05:15 +0000 | [diff] [blame] | 795 | |
Ted Kremenek | 4a4e524 | 2008-02-28 09:25:22 +0000 | [diff] [blame] | 796 | Expr* Ex = (Expr*) cast<UndefinedVal>(X).getData(); |
Ted Kremenek | 05a2378 | 2008-02-26 19:05:15 +0000 | [diff] [blame] | 797 | |
| 798 | assert (Ex); |
| 799 | |
| 800 | if (Ex == B->getRHS()) { |
| 801 | |
Zhongxing Xu | 1c96b24 | 2008-10-17 05:57:07 +0000 | [diff] [blame] | 802 | X = GetBlkExprSVal(St, Ex); |
Ted Kremenek | 05a2378 | 2008-02-26 19:05:15 +0000 | [diff] [blame] | 803 | |
Ted Kremenek | 4a4e524 | 2008-02-28 09:25:22 +0000 | [diff] [blame] | 804 | // Handle undefined values. |
Ted Kremenek | 58b3321 | 2008-02-26 19:40:44 +0000 | [diff] [blame] | 805 | |
Ted Kremenek | 4a4e524 | 2008-02-28 09:25:22 +0000 | [diff] [blame] | 806 | if (X.isUndef()) { |
Zhongxing Xu | 8cd5aae | 2008-10-30 05:33:54 +0000 | [diff] [blame] | 807 | MakeNode(Dst, B, Pred, BindBlkExpr(St, B, X)); |
Ted Kremenek | 58b3321 | 2008-02-26 19:40:44 +0000 | [diff] [blame] | 808 | return; |
| 809 | } |
| 810 | |
Ted Kremenek | 05a2378 | 2008-02-26 19:05:15 +0000 | [diff] [blame] | 811 | // We took the RHS. Because the value of the '&&' or '||' expression must |
| 812 | // evaluate to 0 or 1, we must assume the value of the RHS evaluates to 0 |
| 813 | // or 1. Alternatively, we could take a lazy approach, and calculate this |
| 814 | // value later when necessary. We don't have the machinery in place for |
| 815 | // this right now, and since most logical expressions are used for branches, |
| 816 | // the payoff is not likely to be large. Instead, we do eager evaluation. |
| 817 | |
| 818 | bool isFeasible = false; |
Ted Kremenek | 4adc81e | 2008-08-13 04:27:00 +0000 | [diff] [blame] | 819 | const GRState* NewState = Assume(St, X, true, isFeasible); |
Ted Kremenek | 05a2378 | 2008-02-26 19:05:15 +0000 | [diff] [blame] | 820 | |
| 821 | if (isFeasible) |
Ted Kremenek | 0e561a3 | 2008-03-21 21:30:14 +0000 | [diff] [blame] | 822 | MakeNode(Dst, B, Pred, |
Zhongxing Xu | 8cd5aae | 2008-10-30 05:33:54 +0000 | [diff] [blame] | 823 | BindBlkExpr(NewState, B, MakeConstantVal(1U, B))); |
Ted Kremenek | 05a2378 | 2008-02-26 19:05:15 +0000 | [diff] [blame] | 824 | |
| 825 | isFeasible = false; |
| 826 | NewState = Assume(St, X, false, isFeasible); |
| 827 | |
| 828 | if (isFeasible) |
Ted Kremenek | 0e561a3 | 2008-03-21 21:30:14 +0000 | [diff] [blame] | 829 | MakeNode(Dst, B, Pred, |
Zhongxing Xu | 8cd5aae | 2008-10-30 05:33:54 +0000 | [diff] [blame] | 830 | BindBlkExpr(NewState, B, MakeConstantVal(0U, B))); |
Ted Kremenek | f233d48 | 2008-02-05 00:26:40 +0000 | [diff] [blame] | 831 | } |
| 832 | else { |
Ted Kremenek | 05a2378 | 2008-02-26 19:05:15 +0000 | [diff] [blame] | 833 | // We took the LHS expression. Depending on whether we are '&&' or |
| 834 | // '||' we know what the value of the expression is via properties of |
| 835 | // the short-circuiting. |
| 836 | |
| 837 | X = MakeConstantVal( B->getOpcode() == BinaryOperator::LAnd ? 0U : 1U, B); |
Zhongxing Xu | 8cd5aae | 2008-10-30 05:33:54 +0000 | [diff] [blame] | 838 | MakeNode(Dst, B, Pred, BindBlkExpr(St, B, X)); |
Ted Kremenek | f233d48 | 2008-02-05 00:26:40 +0000 | [diff] [blame] | 839 | } |
Ted Kremenek | f233d48 | 2008-02-05 00:26:40 +0000 | [diff] [blame] | 840 | } |
Ted Kremenek | 05a2378 | 2008-02-26 19:05:15 +0000 | [diff] [blame] | 841 | |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 842 | //===----------------------------------------------------------------------===// |
Ted Kremenek | ec96a2d | 2008-04-16 18:39:06 +0000 | [diff] [blame] | 843 | // Transfer functions: Loads and stores. |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 844 | //===----------------------------------------------------------------------===// |
Ted Kremenek | d27f816 | 2008-01-15 23:55:06 +0000 | [diff] [blame] | 845 | |
Zhongxing Xu | 6d69b5d | 2008-10-16 06:09:51 +0000 | [diff] [blame] | 846 | void GRExprEngine::VisitDeclRefExpr(DeclRefExpr* Ex, NodeTy* Pred, NodeSet& Dst, |
| 847 | bool asLValue) { |
Ted Kremenek | 3271f8d | 2008-02-07 04:16:04 +0000 | [diff] [blame] | 848 | |
Ted Kremenek | 4adc81e | 2008-08-13 04:27:00 +0000 | [diff] [blame] | 849 | const GRState* St = GetState(Pred); |
Zhongxing Xu | 6d69b5d | 2008-10-16 06:09:51 +0000 | [diff] [blame] | 850 | |
Douglas Gregor | 8e9bebd | 2008-10-21 16:13:35 +0000 | [diff] [blame] | 851 | const NamedDecl* D = Ex->getDecl(); |
Zhongxing Xu | 6d69b5d | 2008-10-16 06:09:51 +0000 | [diff] [blame] | 852 | |
| 853 | if (const VarDecl* VD = dyn_cast<VarDecl>(D)) { |
| 854 | |
Zhongxing Xu | 1c96b24 | 2008-10-17 05:57:07 +0000 | [diff] [blame] | 855 | SVal V = StateMgr.GetLValue(St, VD); |
Zhongxing Xu | a758173 | 2008-10-17 02:20:14 +0000 | [diff] [blame] | 856 | |
Zhongxing Xu | 6d69b5d | 2008-10-16 06:09:51 +0000 | [diff] [blame] | 857 | if (asLValue) |
Zhongxing Xu | 8cd5aae | 2008-10-30 05:33:54 +0000 | [diff] [blame] | 858 | MakeNode(Dst, Ex, Pred, BindExpr(St, Ex, V)); |
Zhongxing Xu | 6d69b5d | 2008-10-16 06:09:51 +0000 | [diff] [blame] | 859 | else |
| 860 | EvalLoad(Dst, Ex, Pred, St, V); |
| 861 | return; |
| 862 | |
| 863 | } else if (const EnumConstantDecl* ED = dyn_cast<EnumConstantDecl>(D)) { |
| 864 | assert(!asLValue && "EnumConstantDecl does not have lvalue."); |
| 865 | |
| 866 | BasicValueFactory& BasicVals = StateMgr.getBasicVals(); |
Zhongxing Xu | 1c96b24 | 2008-10-17 05:57:07 +0000 | [diff] [blame] | 867 | SVal V = nonloc::ConcreteInt(BasicVals.getValue(ED->getInitVal())); |
Zhongxing Xu | 8cd5aae | 2008-10-30 05:33:54 +0000 | [diff] [blame] | 868 | MakeNode(Dst, Ex, Pred, BindExpr(St, Ex, V)); |
Zhongxing Xu | 6d69b5d | 2008-10-16 06:09:51 +0000 | [diff] [blame] | 869 | return; |
| 870 | |
| 871 | } else if (const FunctionDecl* FD = dyn_cast<FunctionDecl>(D)) { |
Ted Kremenek | cd162cc | 2008-10-17 00:55:33 +0000 | [diff] [blame] | 872 | // FIXME: Does this need to be revised? We were getting cases in |
| 873 | // real code that did this. |
Zhongxing Xu | da6b999 | 2008-10-31 06:05:32 +0000 | [diff] [blame] | 874 | |
Ted Kremenek | e580c1b | 2008-10-31 15:33:11 +0000 | [diff] [blame] | 875 | // FIXME: This is not a valid assertion. Produce a test case that |
| 876 | // refutes it. |
| 877 | // assert(asLValue); // Can we assume this? |
Zhongxing Xu | da6b999 | 2008-10-31 06:05:32 +0000 | [diff] [blame] | 878 | |
Zhongxing Xu | 1c96b24 | 2008-10-17 05:57:07 +0000 | [diff] [blame] | 879 | SVal V = loc::FuncVal(FD); |
Zhongxing Xu | 8cd5aae | 2008-10-30 05:33:54 +0000 | [diff] [blame] | 880 | MakeNode(Dst, Ex, Pred, BindExpr(St, Ex, V)); |
Zhongxing Xu | 6d69b5d | 2008-10-16 06:09:51 +0000 | [diff] [blame] | 881 | return; |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 882 | } |
Zhongxing Xu | 6d69b5d | 2008-10-16 06:09:51 +0000 | [diff] [blame] | 883 | |
| 884 | assert (false && |
| 885 | "ValueDecl support for this ValueDecl not implemented."); |
Ted Kremenek | 3271f8d | 2008-02-07 04:16:04 +0000 | [diff] [blame] | 886 | } |
| 887 | |
Ted Kremenek | 540cbe2 | 2008-04-22 04:56:29 +0000 | [diff] [blame] | 888 | /// VisitArraySubscriptExpr - Transfer function for array accesses |
| 889 | void GRExprEngine::VisitArraySubscriptExpr(ArraySubscriptExpr* A, NodeTy* Pred, |
Zhongxing Xu | 6d69b5d | 2008-10-16 06:09:51 +0000 | [diff] [blame] | 890 | NodeSet& Dst, bool asLValue) { |
Ted Kremenek | 540cbe2 | 2008-04-22 04:56:29 +0000 | [diff] [blame] | 891 | |
| 892 | Expr* Base = A->getBase()->IgnoreParens(); |
Ted Kremenek | 4d0348b | 2008-04-29 23:24:44 +0000 | [diff] [blame] | 893 | Expr* Idx = A->getIdx()->IgnoreParens(); |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 894 | NodeSet Tmp; |
Ted Kremenek | d9bc33e | 2008-10-17 00:51:01 +0000 | [diff] [blame] | 895 | Visit(Base, Pred, Tmp); // Get Base's rvalue, which should be an LocVal. |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 896 | |
Ted Kremenek | d9bc33e | 2008-10-17 00:51:01 +0000 | [diff] [blame] | 897 | for (NodeSet::iterator I1=Tmp.begin(), E1=Tmp.end(); I1!=E1; ++I1) { |
Ted Kremenek | 4d0348b | 2008-04-29 23:24:44 +0000 | [diff] [blame] | 898 | NodeSet Tmp2; |
Ted Kremenek | d9bc33e | 2008-10-17 00:51:01 +0000 | [diff] [blame] | 899 | Visit(Idx, *I1, Tmp2); // Evaluate the index. |
Ted Kremenek | 4d0348b | 2008-04-29 23:24:44 +0000 | [diff] [blame] | 900 | |
| 901 | for (NodeSet::iterator I2=Tmp2.begin(), E2=Tmp2.end(); I2!=E2; ++I2) { |
Ted Kremenek | 4adc81e | 2008-08-13 04:27:00 +0000 | [diff] [blame] | 902 | const GRState* St = GetState(*I2); |
Zhongxing Xu | 1c96b24 | 2008-10-17 05:57:07 +0000 | [diff] [blame] | 903 | SVal V = StateMgr.GetLValue(St, GetSVal(St, Base), GetSVal(St, Idx)); |
Ted Kremenek | 4d0348b | 2008-04-29 23:24:44 +0000 | [diff] [blame] | 904 | |
Zhongxing Xu | 6d69b5d | 2008-10-16 06:09:51 +0000 | [diff] [blame] | 905 | if (asLValue) |
Zhongxing Xu | 8cd5aae | 2008-10-30 05:33:54 +0000 | [diff] [blame] | 906 | MakeNode(Dst, A, *I2, BindExpr(St, A, V)); |
Ted Kremenek | 4d0348b | 2008-04-29 23:24:44 +0000 | [diff] [blame] | 907 | else |
| 908 | EvalLoad(Dst, A, *I2, St, V); |
| 909 | } |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 910 | } |
Ted Kremenek | 540cbe2 | 2008-04-22 04:56:29 +0000 | [diff] [blame] | 911 | } |
| 912 | |
Ted Kremenek | 469ecbd | 2008-04-21 23:43:38 +0000 | [diff] [blame] | 913 | /// VisitMemberExpr - Transfer function for member expressions. |
| 914 | void GRExprEngine::VisitMemberExpr(MemberExpr* M, NodeTy* Pred, |
Zhongxing Xu | 6d69b5d | 2008-10-16 06:09:51 +0000 | [diff] [blame] | 915 | NodeSet& Dst, bool asLValue) { |
Ted Kremenek | 469ecbd | 2008-04-21 23:43:38 +0000 | [diff] [blame] | 916 | |
| 917 | Expr* Base = M->getBase()->IgnoreParens(); |
Ted Kremenek | 469ecbd | 2008-04-21 23:43:38 +0000 | [diff] [blame] | 918 | NodeSet Tmp; |
Ted Kremenek | 5c456fe | 2008-10-18 03:28:48 +0000 | [diff] [blame] | 919 | |
| 920 | if (M->isArrow()) |
| 921 | Visit(Base, Pred, Tmp); // p->f = ... or ... = p->f |
| 922 | else |
| 923 | VisitLValue(Base, Pred, Tmp); // x.f = ... or ... = x.f |
| 924 | |
Zhongxing Xu | 6d69b5d | 2008-10-16 06:09:51 +0000 | [diff] [blame] | 925 | for (NodeSet::iterator I = Tmp.begin(), E = Tmp.end(); I != E; ++I) { |
Ted Kremenek | 4adc81e | 2008-08-13 04:27:00 +0000 | [diff] [blame] | 926 | const GRState* St = GetState(*I); |
Ted Kremenek | d9bc33e | 2008-10-17 00:51:01 +0000 | [diff] [blame] | 927 | // FIXME: Should we insert some assumption logic in here to determine |
| 928 | // if "Base" is a valid piece of memory? Before we put this assumption |
| 929 | // later when using FieldOffset lvals (which we no longer have). |
Zhongxing Xu | c92e5fe | 2008-10-22 09:00:19 +0000 | [diff] [blame] | 930 | SVal L = StateMgr.GetLValue(St, GetSVal(St, Base), M->getMemberDecl()); |
Ted Kremenek | d9bc33e | 2008-10-17 00:51:01 +0000 | [diff] [blame] | 931 | |
Zhongxing Xu | 6d69b5d | 2008-10-16 06:09:51 +0000 | [diff] [blame] | 932 | if (asLValue) |
Zhongxing Xu | 8cd5aae | 2008-10-30 05:33:54 +0000 | [diff] [blame] | 933 | MakeNode(Dst, M, *I, BindExpr(St, M, L)); |
Zhongxing Xu | 6d69b5d | 2008-10-16 06:09:51 +0000 | [diff] [blame] | 934 | else |
| 935 | EvalLoad(Dst, M, *I, St, L); |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 936 | } |
Ted Kremenek | 469ecbd | 2008-04-21 23:43:38 +0000 | [diff] [blame] | 937 | } |
| 938 | |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 939 | void GRExprEngine::EvalStore(NodeSet& Dst, Expr* Ex, NodeTy* Pred, |
Zhongxing Xu | 1c96b24 | 2008-10-17 05:57:07 +0000 | [diff] [blame] | 940 | const GRState* St, SVal location, SVal Val) { |
Ted Kremenek | ec96a2d | 2008-04-16 18:39:06 +0000 | [diff] [blame] | 941 | |
| 942 | assert (Builder && "GRStmtNodeBuilder must be defined."); |
| 943 | |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 944 | // Evaluate the location (checks for bad dereferences). |
| 945 | St = EvalLocation(Ex, Pred, St, location); |
| 946 | |
| 947 | if (!St) |
| 948 | return; |
| 949 | |
| 950 | // Proceed with the store. |
| 951 | |
Ted Kremenek | ec96a2d | 2008-04-16 18:39:06 +0000 | [diff] [blame] | 952 | unsigned size = Dst.size(); |
Ted Kremenek | b053396 | 2008-04-18 20:35:30 +0000 | [diff] [blame] | 953 | |
Ted Kremenek | 186350f | 2008-04-23 20:12:28 +0000 | [diff] [blame] | 954 | SaveAndRestore<bool> OldSink(Builder->BuildSinks); |
Ted Kremenek | 82bae3f | 2008-09-20 01:50:34 +0000 | [diff] [blame] | 955 | SaveAndRestore<ProgramPoint::Kind> OldSPointKind(Builder->PointKind); |
Ted Kremenek | 186350f | 2008-04-23 20:12:28 +0000 | [diff] [blame] | 956 | SaveOr OldHasGen(Builder->HasGeneratedNode); |
Ted Kremenek | b053396 | 2008-04-18 20:35:30 +0000 | [diff] [blame] | 957 | |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 958 | assert (!location.isUndef()); |
Ted Kremenek | 82bae3f | 2008-09-20 01:50:34 +0000 | [diff] [blame] | 959 | Builder->PointKind = ProgramPoint::PostStoreKind; |
Ted Kremenek | 1392261 | 2008-04-16 20:40:59 +0000 | [diff] [blame] | 960 | |
Ted Kremenek | 729a9a2 | 2008-07-17 23:15:45 +0000 | [diff] [blame] | 961 | getTF().EvalStore(Dst, *this, *Builder, Ex, Pred, St, location, Val); |
Ted Kremenek | ec96a2d | 2008-04-16 18:39:06 +0000 | [diff] [blame] | 962 | |
| 963 | // Handle the case where no nodes where generated. Auto-generate that |
| 964 | // contains the updated state if we aren't generating sinks. |
| 965 | |
Ted Kremenek | b053396 | 2008-04-18 20:35:30 +0000 | [diff] [blame] | 966 | if (!Builder->BuildSinks && Dst.size() == size && !Builder->HasGeneratedNode) |
Ted Kremenek | 729a9a2 | 2008-07-17 23:15:45 +0000 | [diff] [blame] | 967 | getTF().GRTransferFuncs::EvalStore(Dst, *this, *Builder, Ex, Pred, St, |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 968 | location, Val); |
| 969 | } |
| 970 | |
| 971 | void GRExprEngine::EvalLoad(NodeSet& Dst, Expr* Ex, NodeTy* Pred, |
Zhongxing Xu | 1c96b24 | 2008-10-17 05:57:07 +0000 | [diff] [blame] | 972 | const GRState* St, SVal location, |
Ted Kremenek | 4323a57 | 2008-07-10 22:03:41 +0000 | [diff] [blame] | 973 | bool CheckOnly) { |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 974 | |
| 975 | // Evaluate the location (checks for bad dereferences). |
| 976 | |
| 977 | St = EvalLocation(Ex, Pred, St, location, true); |
| 978 | |
| 979 | if (!St) |
| 980 | return; |
| 981 | |
| 982 | // Proceed with the load. |
Ted Kremenek | 982e674 | 2008-08-28 18:43:46 +0000 | [diff] [blame] | 983 | ProgramPoint::Kind K = ProgramPoint::PostLoadKind; |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 984 | |
| 985 | // FIXME: Currently symbolic analysis "generates" new symbols |
| 986 | // for the contents of values. We need a better approach. |
| 987 | |
| 988 | // FIXME: The "CheckOnly" option exists only because Array and Field |
| 989 | // loads aren't fully implemented. Eventually this option will go away. |
Ted Kremenek | 982e674 | 2008-08-28 18:43:46 +0000 | [diff] [blame] | 990 | |
Ted Kremenek | 436f2b9 | 2008-04-30 04:23:07 +0000 | [diff] [blame] | 991 | if (CheckOnly) |
Ted Kremenek | 982e674 | 2008-08-28 18:43:46 +0000 | [diff] [blame] | 992 | MakeNode(Dst, Ex, Pred, St, K); |
Ted Kremenek | 436f2b9 | 2008-04-30 04:23:07 +0000 | [diff] [blame] | 993 | else if (location.isUnknown()) { |
| 994 | // This is important. We must nuke the old binding. |
Zhongxing Xu | 8cd5aae | 2008-10-30 05:33:54 +0000 | [diff] [blame] | 995 | MakeNode(Dst, Ex, Pred, BindExpr(St, Ex, UnknownVal()), K); |
Ted Kremenek | 436f2b9 | 2008-04-30 04:23:07 +0000 | [diff] [blame] | 996 | } |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 997 | else |
Zhongxing Xu | 8cd5aae | 2008-10-30 05:33:54 +0000 | [diff] [blame] | 998 | MakeNode(Dst, Ex, Pred, BindExpr(St, Ex, GetSVal(St, cast<Loc>(location), |
| 999 | Ex->getType())), K); |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 1000 | } |
| 1001 | |
Ted Kremenek | 82bae3f | 2008-09-20 01:50:34 +0000 | [diff] [blame] | 1002 | void GRExprEngine::EvalStore(NodeSet& Dst, Expr* Ex, Expr* StoreE, NodeTy* Pred, |
Zhongxing Xu | 1c96b24 | 2008-10-17 05:57:07 +0000 | [diff] [blame] | 1003 | const GRState* St, SVal location, SVal Val) { |
Ted Kremenek | 82bae3f | 2008-09-20 01:50:34 +0000 | [diff] [blame] | 1004 | |
| 1005 | NodeSet TmpDst; |
| 1006 | EvalStore(TmpDst, StoreE, Pred, St, location, Val); |
| 1007 | |
| 1008 | for (NodeSet::iterator I=TmpDst.begin(), E=TmpDst.end(); I!=E; ++I) |
| 1009 | MakeNode(Dst, Ex, *I, (*I)->getState()); |
| 1010 | } |
| 1011 | |
Ted Kremenek | 4adc81e | 2008-08-13 04:27:00 +0000 | [diff] [blame] | 1012 | const GRState* GRExprEngine::EvalLocation(Expr* Ex, NodeTy* Pred, |
Zhongxing Xu | 8cd5aae | 2008-10-30 05:33:54 +0000 | [diff] [blame] | 1013 | const GRState* St, |
| 1014 | SVal location, bool isLoad) { |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 1015 | |
| 1016 | // Check for loads/stores from/to undefined values. |
| 1017 | if (location.isUndef()) { |
Ted Kremenek | 331b0ac | 2008-06-18 05:34:07 +0000 | [diff] [blame] | 1018 | ProgramPoint::Kind K = |
| 1019 | isLoad ? ProgramPoint::PostLoadKind : ProgramPoint::PostStmtKind; |
| 1020 | |
| 1021 | if (NodeTy* Succ = Builder->generateNode(Ex, St, Pred, K)) { |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 1022 | Succ->markAsSink(); |
| 1023 | UndefDeref.insert(Succ); |
| 1024 | } |
| 1025 | |
| 1026 | return NULL; |
| 1027 | } |
| 1028 | |
| 1029 | // Check for loads/stores from/to unknown locations. Treat as No-Ops. |
| 1030 | if (location.isUnknown()) |
| 1031 | return St; |
| 1032 | |
| 1033 | // During a load, one of two possible situations arise: |
| 1034 | // (1) A crash, because the location (pointer) was NULL. |
| 1035 | // (2) The location (pointer) is not NULL, and the dereference works. |
| 1036 | // |
| 1037 | // We add these assumptions. |
| 1038 | |
Zhongxing Xu | 1c96b24 | 2008-10-17 05:57:07 +0000 | [diff] [blame] | 1039 | Loc LV = cast<Loc>(location); |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 1040 | |
| 1041 | // "Assume" that the pointer is not NULL. |
| 1042 | |
| 1043 | bool isFeasibleNotNull = false; |
Ted Kremenek | 4adc81e | 2008-08-13 04:27:00 +0000 | [diff] [blame] | 1044 | const GRState* StNotNull = Assume(St, LV, true, isFeasibleNotNull); |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 1045 | |
| 1046 | // "Assume" that the pointer is NULL. |
| 1047 | |
| 1048 | bool isFeasibleNull = false; |
Ted Kremenek | 7360fda | 2008-09-18 23:09:54 +0000 | [diff] [blame] | 1049 | GRStateRef StNull = GRStateRef(Assume(St, LV, false, isFeasibleNull), |
| 1050 | getStateManager()); |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 1051 | |
| 1052 | if (isFeasibleNull) { |
| 1053 | |
Ted Kremenek | 7360fda | 2008-09-18 23:09:54 +0000 | [diff] [blame] | 1054 | // Use the Generic Data Map to mark in the state what lval was null. |
Zhongxing Xu | 1c96b24 | 2008-10-17 05:57:07 +0000 | [diff] [blame] | 1055 | const SVal* PersistentLV = getBasicVals().getPersistentSVal(LV); |
Ted Kremenek | 7360fda | 2008-09-18 23:09:54 +0000 | [diff] [blame] | 1056 | StNull = StNull.set<GRState::NullDerefTag>(PersistentLV); |
| 1057 | |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 1058 | // We don't use "MakeNode" here because the node will be a sink |
| 1059 | // and we have no intention of processing it later. |
| 1060 | |
Ted Kremenek | 331b0ac | 2008-06-18 05:34:07 +0000 | [diff] [blame] | 1061 | ProgramPoint::Kind K = |
| 1062 | isLoad ? ProgramPoint::PostLoadKind : ProgramPoint::PostStmtKind; |
| 1063 | |
| 1064 | NodeTy* NullNode = Builder->generateNode(Ex, StNull, Pred, K); |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 1065 | |
| 1066 | if (NullNode) { |
| 1067 | |
| 1068 | NullNode->markAsSink(); |
| 1069 | |
| 1070 | if (isFeasibleNotNull) ImplicitNullDeref.insert(NullNode); |
| 1071 | else ExplicitNullDeref.insert(NullNode); |
| 1072 | } |
| 1073 | } |
Zhongxing Xu | 60156f0 | 2008-11-08 03:45:42 +0000 | [diff] [blame] | 1074 | |
| 1075 | // Check for out-of-bound array access. |
| 1076 | if (isFeasibleNotNull && isa<loc::MemRegionVal>(LV)) { |
| 1077 | const MemRegion* R = cast<loc::MemRegionVal>(LV).getRegion(); |
| 1078 | if (const ElementRegion* ER = dyn_cast<ElementRegion>(R)) { |
| 1079 | // Get the index of the accessed element. |
| 1080 | SVal Idx = ER->getIndex(); |
| 1081 | // Get the extent of the array. |
| 1082 | SVal NumElements = StateMgr.getStoreManager().getSizeInElements(StNotNull, |
| 1083 | ER->getSuperRegion()); |
| 1084 | |
| 1085 | bool isFeasibleInBound = false; |
| 1086 | const GRState* StInBound = AssumeInBound(StNotNull, Idx, NumElements, |
| 1087 | true, isFeasibleInBound); |
| 1088 | |
| 1089 | bool isFeasibleOutBound = false; |
| 1090 | const GRState* StOutBound = AssumeInBound(StNotNull, Idx, NumElements, |
| 1091 | false, isFeasibleOutBound); |
Chris Lattner | 8341be7 | 2008-11-10 03:00:37 +0000 | [diff] [blame] | 1092 | StInBound = StOutBound = 0; // FIXME: squeltch warning. |
Zhongxing Xu | 60156f0 | 2008-11-08 03:45:42 +0000 | [diff] [blame] | 1093 | |
| 1094 | // Report warnings ... |
| 1095 | } |
| 1096 | } |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 1097 | |
| 1098 | return isFeasibleNotNull ? StNotNull : NULL; |
Ted Kremenek | ec96a2d | 2008-04-16 18:39:06 +0000 | [diff] [blame] | 1099 | } |
| 1100 | |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 1101 | //===----------------------------------------------------------------------===// |
| 1102 | // Transfer function: Function calls. |
| 1103 | //===----------------------------------------------------------------------===// |
Ted Kremenek | de43424 | 2008-02-19 01:44:53 +0000 | [diff] [blame] | 1104 | void GRExprEngine::VisitCall(CallExpr* CE, NodeTy* Pred, |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 1105 | CallExpr::arg_iterator AI, |
| 1106 | CallExpr::arg_iterator AE, |
Douglas Gregor | 9d293df | 2008-10-28 00:22:11 +0000 | [diff] [blame] | 1107 | NodeSet& Dst) |
| 1108 | { |
| 1109 | // Determine the type of function we're calling (if available). |
| 1110 | const FunctionTypeProto *Proto = NULL; |
| 1111 | QualType FnType = CE->getCallee()->IgnoreParens()->getType(); |
| 1112 | if (const PointerType *FnTypePtr = FnType->getAsPointerType()) |
| 1113 | Proto = FnTypePtr->getPointeeType()->getAsFunctionTypeProto(); |
| 1114 | |
| 1115 | VisitCallRec(CE, Pred, AI, AE, Dst, Proto, /*ParamIdx=*/0); |
| 1116 | } |
| 1117 | |
| 1118 | void GRExprEngine::VisitCallRec(CallExpr* CE, NodeTy* Pred, |
| 1119 | CallExpr::arg_iterator AI, |
| 1120 | CallExpr::arg_iterator AE, |
| 1121 | NodeSet& Dst, const FunctionTypeProto *Proto, |
| 1122 | unsigned ParamIdx) { |
Ted Kremenek | de43424 | 2008-02-19 01:44:53 +0000 | [diff] [blame] | 1123 | |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 1124 | // Process the arguments. |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 1125 | if (AI != AE) { |
Douglas Gregor | 9d293df | 2008-10-28 00:22:11 +0000 | [diff] [blame] | 1126 | // If the call argument is being bound to a reference parameter, |
| 1127 | // visit it as an lvalue, not an rvalue. |
| 1128 | bool VisitAsLvalue = false; |
| 1129 | if (Proto && ParamIdx < Proto->getNumArgs()) |
| 1130 | VisitAsLvalue = Proto->getArgType(ParamIdx)->isReferenceType(); |
| 1131 | |
| 1132 | NodeSet DstTmp; |
| 1133 | if (VisitAsLvalue) |
| 1134 | VisitLValue(*AI, Pred, DstTmp); |
| 1135 | else |
| 1136 | Visit(*AI, Pred, DstTmp); |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 1137 | ++AI; |
| 1138 | |
Ted Kremenek | d753f3c | 2008-03-04 22:01:56 +0000 | [diff] [blame] | 1139 | for (NodeSet::iterator DI=DstTmp.begin(), DE=DstTmp.end(); DI != DE; ++DI) |
Douglas Gregor | 9d293df | 2008-10-28 00:22:11 +0000 | [diff] [blame] | 1140 | VisitCallRec(CE, *DI, AI, AE, Dst, Proto, ParamIdx + 1); |
Ted Kremenek | de43424 | 2008-02-19 01:44:53 +0000 | [diff] [blame] | 1141 | |
| 1142 | return; |
| 1143 | } |
| 1144 | |
| 1145 | // If we reach here we have processed all of the arguments. Evaluate |
| 1146 | // the callee expression. |
Ted Kremenek | a1354a5 | 2008-03-03 16:47:31 +0000 | [diff] [blame] | 1147 | |
Ted Kremenek | 994a09b | 2008-02-25 21:16:03 +0000 | [diff] [blame] | 1148 | NodeSet DstTmp; |
Ted Kremenek | 186350f | 2008-04-23 20:12:28 +0000 | [diff] [blame] | 1149 | Expr* Callee = CE->getCallee()->IgnoreParens(); |
Ted Kremenek | a1354a5 | 2008-03-03 16:47:31 +0000 | [diff] [blame] | 1150 | |
Zhongxing Xu | 6d69b5d | 2008-10-16 06:09:51 +0000 | [diff] [blame] | 1151 | Visit(Callee, Pred, DstTmp); |
Ted Kremenek | a1354a5 | 2008-03-03 16:47:31 +0000 | [diff] [blame] | 1152 | |
Ted Kremenek | de43424 | 2008-02-19 01:44:53 +0000 | [diff] [blame] | 1153 | // Finally, evaluate the function call. |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 1154 | for (NodeSet::iterator DI = DstTmp.begin(), DE = DstTmp.end(); DI!=DE; ++DI) { |
| 1155 | |
Ted Kremenek | 4adc81e | 2008-08-13 04:27:00 +0000 | [diff] [blame] | 1156 | const GRState* St = GetState(*DI); |
Zhongxing Xu | 1c96b24 | 2008-10-17 05:57:07 +0000 | [diff] [blame] | 1157 | SVal L = GetSVal(St, Callee); |
Ted Kremenek | de43424 | 2008-02-19 01:44:53 +0000 | [diff] [blame] | 1158 | |
Ted Kremenek | a1354a5 | 2008-03-03 16:47:31 +0000 | [diff] [blame] | 1159 | // FIXME: Add support for symbolic function calls (calls involving |
| 1160 | // function pointer values that are symbolic). |
| 1161 | |
| 1162 | // Check for undefined control-flow or calls to NULL. |
| 1163 | |
Zhongxing Xu | 1c96b24 | 2008-10-17 05:57:07 +0000 | [diff] [blame] | 1164 | if (L.isUndef() || isa<loc::ConcreteInt>(L)) { |
Ted Kremenek | de43424 | 2008-02-19 01:44:53 +0000 | [diff] [blame] | 1165 | NodeTy* N = Builder->generateNode(CE, St, *DI); |
Ted Kremenek | d753f3c | 2008-03-04 22:01:56 +0000 | [diff] [blame] | 1166 | |
Ted Kremenek | 2ded35a | 2008-02-29 23:53:11 +0000 | [diff] [blame] | 1167 | if (N) { |
| 1168 | N->markAsSink(); |
| 1169 | BadCalls.insert(N); |
| 1170 | } |
Ted Kremenek | d753f3c | 2008-03-04 22:01:56 +0000 | [diff] [blame] | 1171 | |
Ted Kremenek | de43424 | 2008-02-19 01:44:53 +0000 | [diff] [blame] | 1172 | continue; |
Ted Kremenek | 4bf38da | 2008-03-05 21:15:02 +0000 | [diff] [blame] | 1173 | } |
| 1174 | |
| 1175 | // Check for the "noreturn" attribute. |
| 1176 | |
| 1177 | SaveAndRestore<bool> OldSink(Builder->BuildSinks); |
| 1178 | |
Zhongxing Xu | 1c96b24 | 2008-10-17 05:57:07 +0000 | [diff] [blame] | 1179 | if (isa<loc::FuncVal>(L)) { |
Ted Kremenek | 636e6ba | 2008-03-14 21:58:42 +0000 | [diff] [blame] | 1180 | |
Zhongxing Xu | 1c96b24 | 2008-10-17 05:57:07 +0000 | [diff] [blame] | 1181 | FunctionDecl* FD = cast<loc::FuncVal>(L).getDecl(); |
Ted Kremenek | 636e6ba | 2008-03-14 21:58:42 +0000 | [diff] [blame] | 1182 | |
| 1183 | if (FD->getAttr<NoReturnAttr>()) |
Ted Kremenek | 4bf38da | 2008-03-05 21:15:02 +0000 | [diff] [blame] | 1184 | Builder->BuildSinks = true; |
Ted Kremenek | 636e6ba | 2008-03-14 21:58:42 +0000 | [diff] [blame] | 1185 | else { |
| 1186 | // HACK: Some functions are not marked noreturn, and don't return. |
| 1187 | // Here are a few hardwired ones. If this takes too long, we can |
| 1188 | // potentially cache these results. |
| 1189 | const char* s = FD->getIdentifier()->getName(); |
| 1190 | unsigned n = strlen(s); |
| 1191 | |
| 1192 | switch (n) { |
| 1193 | default: |
| 1194 | break; |
Ted Kremenek | 76fdbde | 2008-03-14 23:25:49 +0000 | [diff] [blame] | 1195 | |
Ted Kremenek | 636e6ba | 2008-03-14 21:58:42 +0000 | [diff] [blame] | 1196 | case 4: |
Ted Kremenek | 76fdbde | 2008-03-14 23:25:49 +0000 | [diff] [blame] | 1197 | if (!memcmp(s, "exit", 4)) Builder->BuildSinks = true; |
| 1198 | break; |
| 1199 | |
| 1200 | case 5: |
| 1201 | if (!memcmp(s, "panic", 5)) Builder->BuildSinks = true; |
Zhongxing Xu | bb316c5 | 2008-10-07 10:06:03 +0000 | [diff] [blame] | 1202 | else if (!memcmp(s, "error", 5)) { |
Zhongxing Xu | a90d56e | 2008-10-09 03:19:06 +0000 | [diff] [blame] | 1203 | if (CE->getNumArgs() > 0) { |
Zhongxing Xu | 1c96b24 | 2008-10-17 05:57:07 +0000 | [diff] [blame] | 1204 | SVal X = GetSVal(St, *CE->arg_begin()); |
Zhongxing Xu | a90d56e | 2008-10-09 03:19:06 +0000 | [diff] [blame] | 1205 | // FIXME: use Assume to inspect the possible symbolic value of |
| 1206 | // X. Also check the specific signature of error(). |
Zhongxing Xu | 1c96b24 | 2008-10-17 05:57:07 +0000 | [diff] [blame] | 1207 | nonloc::ConcreteInt* CI = dyn_cast<nonloc::ConcreteInt>(&X); |
Zhongxing Xu | a90d56e | 2008-10-09 03:19:06 +0000 | [diff] [blame] | 1208 | if (CI && CI->getValue() != 0) |
Zhongxing Xu | bb316c5 | 2008-10-07 10:06:03 +0000 | [diff] [blame] | 1209 | Builder->BuildSinks = true; |
Zhongxing Xu | a90d56e | 2008-10-09 03:19:06 +0000 | [diff] [blame] | 1210 | } |
Zhongxing Xu | bb316c5 | 2008-10-07 10:06:03 +0000 | [diff] [blame] | 1211 | } |
Ted Kremenek | 76fdbde | 2008-03-14 23:25:49 +0000 | [diff] [blame] | 1212 | break; |
Ted Kremenek | 9a094cb | 2008-04-22 05:37:33 +0000 | [diff] [blame] | 1213 | |
| 1214 | case 6: |
Ted Kremenek | 489ecd5 | 2008-05-17 00:42:01 +0000 | [diff] [blame] | 1215 | if (!memcmp(s, "Assert", 6)) { |
| 1216 | Builder->BuildSinks = true; |
| 1217 | break; |
| 1218 | } |
Ted Kremenek | c7122d5 | 2008-05-01 15:55:59 +0000 | [diff] [blame] | 1219 | |
| 1220 | // FIXME: This is just a wrapper around throwing an exception. |
| 1221 | // Eventually inter-procedural analysis should handle this easily. |
| 1222 | if (!memcmp(s, "ziperr", 6)) Builder->BuildSinks = true; |
| 1223 | |
Ted Kremenek | 9a094cb | 2008-04-22 05:37:33 +0000 | [diff] [blame] | 1224 | break; |
Ted Kremenek | 688738f | 2008-04-23 00:41:25 +0000 | [diff] [blame] | 1225 | |
| 1226 | case 7: |
| 1227 | if (!memcmp(s, "assfail", 7)) Builder->BuildSinks = true; |
| 1228 | break; |
Ted Kremenek | 9a108ae | 2008-04-22 06:09:33 +0000 | [diff] [blame] | 1229 | |
Ted Kremenek | f47bb78 | 2008-04-30 17:54:04 +0000 | [diff] [blame] | 1230 | case 8: |
| 1231 | if (!memcmp(s ,"db_error", 8)) Builder->BuildSinks = true; |
| 1232 | break; |
Ted Kremenek | 24cb8a2 | 2008-05-01 17:52:49 +0000 | [diff] [blame] | 1233 | |
| 1234 | case 12: |
| 1235 | if (!memcmp(s, "__assert_rtn", 12)) Builder->BuildSinks = true; |
| 1236 | break; |
Ted Kremenek | f47bb78 | 2008-04-30 17:54:04 +0000 | [diff] [blame] | 1237 | |
Ted Kremenek | f968308 | 2008-09-19 02:30:47 +0000 | [diff] [blame] | 1238 | case 13: |
| 1239 | if (!memcmp(s, "__assert_fail", 13)) Builder->BuildSinks = true; |
| 1240 | break; |
| 1241 | |
Ted Kremenek | 9a108ae | 2008-04-22 06:09:33 +0000 | [diff] [blame] | 1242 | case 14: |
Ted Kremenek | 2598b57 | 2008-10-30 00:00:57 +0000 | [diff] [blame] | 1243 | if (!memcmp(s, "dtrace_assfail", 14) || |
| 1244 | !memcmp(s, "yy_fatal_error", 14)) |
| 1245 | Builder->BuildSinks = true; |
Ted Kremenek | 9a108ae | 2008-04-22 06:09:33 +0000 | [diff] [blame] | 1246 | break; |
Ted Kremenek | ec8a1cb | 2008-05-17 00:33:23 +0000 | [diff] [blame] | 1247 | |
| 1248 | case 26: |
Ted Kremenek | 7386d77 | 2008-07-18 16:28:33 +0000 | [diff] [blame] | 1249 | if (!memcmp(s, "_XCAssertionFailureHandler", 26) || |
| 1250 | !memcmp(s, "_DTAssertionFailureHandler", 26)) |
Ted Kremenek | 05a9112 | 2008-05-17 00:40:45 +0000 | [diff] [blame] | 1251 | Builder->BuildSinks = true; |
Ted Kremenek | 7386d77 | 2008-07-18 16:28:33 +0000 | [diff] [blame] | 1252 | |
Ted Kremenek | ec8a1cb | 2008-05-17 00:33:23 +0000 | [diff] [blame] | 1253 | break; |
Ted Kremenek | 636e6ba | 2008-03-14 21:58:42 +0000 | [diff] [blame] | 1254 | } |
Ted Kremenek | 9a108ae | 2008-04-22 06:09:33 +0000 | [diff] [blame] | 1255 | |
Ted Kremenek | 636e6ba | 2008-03-14 21:58:42 +0000 | [diff] [blame] | 1256 | } |
| 1257 | } |
Ted Kremenek | 4bf38da | 2008-03-05 21:15:02 +0000 | [diff] [blame] | 1258 | |
| 1259 | // Evaluate the call. |
Ted Kremenek | 186350f | 2008-04-23 20:12:28 +0000 | [diff] [blame] | 1260 | |
Zhongxing Xu | 1c96b24 | 2008-10-17 05:57:07 +0000 | [diff] [blame] | 1261 | if (isa<loc::FuncVal>(L)) { |
Ted Kremenek | d753f3c | 2008-03-04 22:01:56 +0000 | [diff] [blame] | 1262 | |
Zhongxing Xu | 1c96b24 | 2008-10-17 05:57:07 +0000 | [diff] [blame] | 1263 | IdentifierInfo* Info = cast<loc::FuncVal>(L).getDecl()->getIdentifier(); |
Ted Kremenek | d753f3c | 2008-03-04 22:01:56 +0000 | [diff] [blame] | 1264 | |
Ted Kremenek | 186350f | 2008-04-23 20:12:28 +0000 | [diff] [blame] | 1265 | if (unsigned id = Info->getBuiltinID()) |
Ted Kremenek | 55aea31 | 2008-03-05 22:59:42 +0000 | [diff] [blame] | 1266 | switch (id) { |
| 1267 | case Builtin::BI__builtin_expect: { |
| 1268 | // For __builtin_expect, just return the value of the subexpression. |
| 1269 | assert (CE->arg_begin() != CE->arg_end()); |
Zhongxing Xu | 1c96b24 | 2008-10-17 05:57:07 +0000 | [diff] [blame] | 1270 | SVal X = GetSVal(St, *(CE->arg_begin())); |
Zhongxing Xu | 8cd5aae | 2008-10-30 05:33:54 +0000 | [diff] [blame] | 1271 | MakeNode(Dst, CE, *DI, BindExpr(St, CE, X)); |
Ted Kremenek | 55aea31 | 2008-03-05 22:59:42 +0000 | [diff] [blame] | 1272 | continue; |
| 1273 | } |
| 1274 | |
Ted Kremenek | b302133 | 2008-11-02 00:35:01 +0000 | [diff] [blame] | 1275 | case Builtin::BI__builtin_alloca: { |
| 1276 | // FIXME: Handle size. |
| 1277 | // FIXME: Refactor into StoreManager itself? |
| 1278 | MemRegionManager& RM = getStateManager().getRegionManager(); |
| 1279 | const MemRegion* R = |
| 1280 | RM.getAllocaRegion(CE, Builder->getCurrentBlockCount()); |
| 1281 | MakeNode(Dst, CE, *DI, BindExpr(St, CE, loc::MemRegionVal(R))); |
| 1282 | continue; |
| 1283 | } |
| 1284 | |
Ted Kremenek | 55aea31 | 2008-03-05 22:59:42 +0000 | [diff] [blame] | 1285 | default: |
Ted Kremenek | 55aea31 | 2008-03-05 22:59:42 +0000 | [diff] [blame] | 1286 | break; |
| 1287 | } |
Ted Kremenek | d753f3c | 2008-03-04 22:01:56 +0000 | [diff] [blame] | 1288 | } |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 1289 | |
Ted Kremenek | 186350f | 2008-04-23 20:12:28 +0000 | [diff] [blame] | 1290 | // Check any arguments passed-by-value against being undefined. |
| 1291 | |
| 1292 | bool badArg = false; |
| 1293 | |
| 1294 | for (CallExpr::arg_iterator I = CE->arg_begin(), E = CE->arg_end(); |
| 1295 | I != E; ++I) { |
| 1296 | |
Zhongxing Xu | 1c96b24 | 2008-10-17 05:57:07 +0000 | [diff] [blame] | 1297 | if (GetSVal(GetState(*DI), *I).isUndef()) { |
Ted Kremenek | 186350f | 2008-04-23 20:12:28 +0000 | [diff] [blame] | 1298 | NodeTy* N = Builder->generateNode(CE, GetState(*DI), *DI); |
Ted Kremenek | 4bf38da | 2008-03-05 21:15:02 +0000 | [diff] [blame] | 1299 | |
Ted Kremenek | 186350f | 2008-04-23 20:12:28 +0000 | [diff] [blame] | 1300 | if (N) { |
| 1301 | N->markAsSink(); |
| 1302 | UndefArgs[N] = *I; |
Ted Kremenek | d753f3c | 2008-03-04 22:01:56 +0000 | [diff] [blame] | 1303 | } |
Ted Kremenek | d753f3c | 2008-03-04 22:01:56 +0000 | [diff] [blame] | 1304 | |
Ted Kremenek | 186350f | 2008-04-23 20:12:28 +0000 | [diff] [blame] | 1305 | badArg = true; |
| 1306 | break; |
| 1307 | } |
Ted Kremenek | d753f3c | 2008-03-04 22:01:56 +0000 | [diff] [blame] | 1308 | } |
Ted Kremenek | 186350f | 2008-04-23 20:12:28 +0000 | [diff] [blame] | 1309 | |
| 1310 | if (badArg) |
| 1311 | continue; |
| 1312 | |
| 1313 | // Dispatch to the plug-in transfer function. |
| 1314 | |
| 1315 | unsigned size = Dst.size(); |
| 1316 | SaveOr OldHasGen(Builder->HasGeneratedNode); |
| 1317 | EvalCall(Dst, CE, L, *DI); |
| 1318 | |
| 1319 | // Handle the case where no nodes where generated. Auto-generate that |
| 1320 | // contains the updated state if we aren't generating sinks. |
| 1321 | |
| 1322 | if (!Builder->BuildSinks && Dst.size() == size && |
| 1323 | !Builder->HasGeneratedNode) |
| 1324 | MakeNode(Dst, CE, *DI, St); |
Ted Kremenek | de43424 | 2008-02-19 01:44:53 +0000 | [diff] [blame] | 1325 | } |
| 1326 | } |
| 1327 | |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 1328 | //===----------------------------------------------------------------------===// |
Ted Kremenek | 97ed4f6 | 2008-10-17 00:03:18 +0000 | [diff] [blame] | 1329 | // Transfer function: Objective-C ivar references. |
| 1330 | //===----------------------------------------------------------------------===// |
| 1331 | |
| 1332 | void GRExprEngine::VisitObjCIvarRefExpr(ObjCIvarRefExpr* Ex, |
| 1333 | NodeTy* Pred, NodeSet& Dst, |
| 1334 | bool asLValue) { |
| 1335 | |
| 1336 | Expr* Base = cast<Expr>(Ex->getBase()); |
| 1337 | NodeSet Tmp; |
| 1338 | Visit(Base, Pred, Tmp); |
| 1339 | |
| 1340 | for (NodeSet::iterator I=Tmp.begin(), E=Tmp.end(); I!=E; ++I) { |
| 1341 | const GRState* St = GetState(*I); |
Zhongxing Xu | 1c96b24 | 2008-10-17 05:57:07 +0000 | [diff] [blame] | 1342 | SVal BaseVal = GetSVal(St, Base); |
| 1343 | SVal location = StateMgr.GetLValue(St, Ex->getDecl(), BaseVal); |
Ted Kremenek | 97ed4f6 | 2008-10-17 00:03:18 +0000 | [diff] [blame] | 1344 | |
| 1345 | if (asLValue) |
Zhongxing Xu | 8cd5aae | 2008-10-30 05:33:54 +0000 | [diff] [blame] | 1346 | MakeNode(Dst, Ex, *I, BindExpr(St, Ex, location)); |
Ted Kremenek | 97ed4f6 | 2008-10-17 00:03:18 +0000 | [diff] [blame] | 1347 | else |
| 1348 | EvalLoad(Dst, Ex, *I, St, location); |
| 1349 | } |
| 1350 | } |
| 1351 | |
| 1352 | //===----------------------------------------------------------------------===// |
Ted Kremenek | af33741 | 2008-11-12 19:24:17 +0000 | [diff] [blame] | 1353 | // Transfer function: Objective-C fast enumeration 'for' statements. |
| 1354 | //===----------------------------------------------------------------------===// |
| 1355 | |
| 1356 | void GRExprEngine::VisitObjCForCollectionStmt(ObjCForCollectionStmt* S, |
| 1357 | NodeTy* Pred, NodeSet& Dst) { |
| 1358 | |
| 1359 | // ObjCForCollectionStmts are processed in two places. This method |
| 1360 | // handles the case where an ObjCForCollectionStmt* occurs as one of the |
| 1361 | // statements within a basic block. This transfer function does two things: |
| 1362 | // |
| 1363 | // (1) binds the next container value to 'element'. This creates a new |
| 1364 | // node in the ExplodedGraph. |
| 1365 | // |
| 1366 | // (2) binds the value 0/1 to the ObjCForCollectionStmt* itself, indicating |
| 1367 | // whether or not the container has any more elements. This value |
| 1368 | // will be tested in ProcessBranch. We need to explicitly bind |
| 1369 | // this value because a container can contain nil elements. |
| 1370 | // |
| 1371 | // FIXME: Eventually this logic should actually do dispatches to |
| 1372 | // 'countByEnumeratingWithState:objects:count:' (NSFastEnumeration). |
| 1373 | // This will require simulating a temporary NSFastEnumerationState, either |
| 1374 | // through an SVal or through the use of MemRegions. This value can |
| 1375 | // be affixed to the ObjCForCollectionStmt* instead of 0/1; when the loop |
| 1376 | // terminates we reclaim the temporary (it goes out of scope) and we |
| 1377 | // we can test if the SVal is 0 or if the MemRegion is null (depending |
| 1378 | // on what approach we take). |
| 1379 | // |
| 1380 | // For now: simulate (1) by assigning either a symbol or nil if the |
| 1381 | // container is empty. Thus this transfer function will by default |
| 1382 | // result in state splitting. |
| 1383 | |
| 1384 | Stmt* elem = S->getElement(); |
| 1385 | VarDecl* ElemD; |
Ted Kremenek | 116ed0a | 2008-11-12 21:12:46 +0000 | [diff] [blame] | 1386 | bool newDecl = false; |
Ted Kremenek | af33741 | 2008-11-12 19:24:17 +0000 | [diff] [blame] | 1387 | |
| 1388 | if (DeclStmt* DS = dyn_cast<DeclStmt>(elem)) { |
| 1389 | ElemD = cast<VarDecl>(DS->getSolitaryDecl()); |
| 1390 | assert (ElemD->getInit() == 0); |
Ted Kremenek | 116ed0a | 2008-11-12 21:12:46 +0000 | [diff] [blame] | 1391 | newDecl = true; |
Ted Kremenek | af33741 | 2008-11-12 19:24:17 +0000 | [diff] [blame] | 1392 | } |
| 1393 | else |
| 1394 | ElemD = cast<VarDecl>(cast<DeclRefExpr>(elem)->getDecl()); |
| 1395 | |
| 1396 | |
| 1397 | // Get the current state, as well as the QualType for 'int' and the |
| 1398 | // type of the element. |
| 1399 | GRStateRef state = GRStateRef(GetState(Pred), getStateManager()); |
| 1400 | QualType IntTy = getContext().IntTy; |
| 1401 | QualType ElemTy = ElemD->getType(); |
| 1402 | |
| 1403 | // Handle the case where the container still has elements. |
| 1404 | SVal TrueV = NonLoc::MakeVal(getBasicVals(), 1, IntTy); |
| 1405 | GRStateRef hasElems = state.BindExpr(S, TrueV); |
| 1406 | |
| 1407 | assert (Loc::IsLocType(ElemTy)); |
| 1408 | unsigned Count = Builder->getCurrentBlockCount(); |
| 1409 | loc::SymbolVal SymV(SymMgr.getConjuredSymbol(elem, ElemTy, Count)); |
| 1410 | |
Ted Kremenek | 116ed0a | 2008-11-12 21:12:46 +0000 | [diff] [blame] | 1411 | if (newDecl) |
Ted Kremenek | af33741 | 2008-11-12 19:24:17 +0000 | [diff] [blame] | 1412 | hasElems = hasElems.BindDecl(ElemD, &SymV, Count); |
| 1413 | else |
| 1414 | hasElems = hasElems.BindLoc(hasElems.GetLValue(ElemD), SymV); |
| 1415 | |
Ted Kremenek | af33741 | 2008-11-12 19:24:17 +0000 | [diff] [blame] | 1416 | // Handle the case where the container has no elements. |
Ted Kremenek | 116ed0a | 2008-11-12 21:12:46 +0000 | [diff] [blame] | 1417 | SVal FalseV = NonLoc::MakeVal(getBasicVals(), 0, IntTy); |
| 1418 | GRStateRef noElems = state.BindExpr(S, FalseV); |
| 1419 | |
| 1420 | if (!newDecl) { |
| 1421 | // We only need to bind nil to an existing variable, since out of the |
| 1422 | // loop the VarDecl won't exist and there will be no chance to get it's |
| 1423 | // address via the '&' operator. |
| 1424 | SVal nilV = loc::ConcreteInt(getBasicVals().getValue(0, ElemTy)); |
| 1425 | noElems.BindLoc(noElems.GetLValue(ElemD), nilV); |
| 1426 | } |
| 1427 | |
| 1428 | // Create the new nodes. |
| 1429 | MakeNode(Dst, S, Pred, hasElems); |
| 1430 | MakeNode(Dst, S, Pred, noElems); |
Ted Kremenek | af33741 | 2008-11-12 19:24:17 +0000 | [diff] [blame] | 1431 | } |
| 1432 | |
| 1433 | //===----------------------------------------------------------------------===// |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 1434 | // Transfer function: Objective-C message expressions. |
| 1435 | //===----------------------------------------------------------------------===// |
| 1436 | |
| 1437 | void GRExprEngine::VisitObjCMessageExpr(ObjCMessageExpr* ME, NodeTy* Pred, |
| 1438 | NodeSet& Dst){ |
| 1439 | |
| 1440 | VisitObjCMessageExprArgHelper(ME, ME->arg_begin(), ME->arg_end(), |
| 1441 | Pred, Dst); |
| 1442 | } |
| 1443 | |
| 1444 | void GRExprEngine::VisitObjCMessageExprArgHelper(ObjCMessageExpr* ME, |
Zhongxing Xu | d3118bd | 2008-10-31 07:26:14 +0000 | [diff] [blame] | 1445 | ObjCMessageExpr::arg_iterator AI, |
| 1446 | ObjCMessageExpr::arg_iterator AE, |
| 1447 | NodeTy* Pred, NodeSet& Dst) { |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 1448 | if (AI == AE) { |
| 1449 | |
| 1450 | // Process the receiver. |
| 1451 | |
| 1452 | if (Expr* Receiver = ME->getReceiver()) { |
| 1453 | NodeSet Tmp; |
| 1454 | Visit(Receiver, Pred, Tmp); |
| 1455 | |
| 1456 | for (NodeSet::iterator NI = Tmp.begin(), NE = Tmp.end(); NI != NE; ++NI) |
| 1457 | VisitObjCMessageExprDispatchHelper(ME, *NI, Dst); |
| 1458 | |
| 1459 | return; |
| 1460 | } |
| 1461 | |
| 1462 | VisitObjCMessageExprDispatchHelper(ME, Pred, Dst); |
| 1463 | return; |
| 1464 | } |
| 1465 | |
| 1466 | NodeSet Tmp; |
| 1467 | Visit(*AI, Pred, Tmp); |
| 1468 | |
| 1469 | ++AI; |
| 1470 | |
| 1471 | for (NodeSet::iterator NI = Tmp.begin(), NE = Tmp.end(); NI != NE; ++NI) |
| 1472 | VisitObjCMessageExprArgHelper(ME, AI, AE, *NI, Dst); |
| 1473 | } |
| 1474 | |
| 1475 | void GRExprEngine::VisitObjCMessageExprDispatchHelper(ObjCMessageExpr* ME, |
| 1476 | NodeTy* Pred, |
| 1477 | NodeSet& Dst) { |
| 1478 | |
| 1479 | // FIXME: More logic for the processing the method call. |
| 1480 | |
Ted Kremenek | 4adc81e | 2008-08-13 04:27:00 +0000 | [diff] [blame] | 1481 | const GRState* St = GetState(Pred); |
Ted Kremenek | e448ab4 | 2008-05-01 18:33:28 +0000 | [diff] [blame] | 1482 | bool RaisesException = false; |
| 1483 | |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 1484 | |
| 1485 | if (Expr* Receiver = ME->getReceiver()) { |
| 1486 | |
Zhongxing Xu | 1c96b24 | 2008-10-17 05:57:07 +0000 | [diff] [blame] | 1487 | SVal L = GetSVal(St, Receiver); |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 1488 | |
| 1489 | // Check for undefined control-flow or calls to NULL. |
| 1490 | |
| 1491 | if (L.isUndef()) { |
| 1492 | NodeTy* N = Builder->generateNode(ME, St, Pred); |
| 1493 | |
| 1494 | if (N) { |
| 1495 | N->markAsSink(); |
| 1496 | UndefReceivers.insert(N); |
| 1497 | } |
| 1498 | |
| 1499 | return; |
| 1500 | } |
Ted Kremenek | e448ab4 | 2008-05-01 18:33:28 +0000 | [diff] [blame] | 1501 | |
| 1502 | // Check if the "raise" message was sent. |
| 1503 | if (ME->getSelector() == RaiseSel) |
| 1504 | RaisesException = true; |
| 1505 | } |
| 1506 | else { |
| 1507 | |
| 1508 | IdentifierInfo* ClsName = ME->getClassName(); |
| 1509 | Selector S = ME->getSelector(); |
| 1510 | |
| 1511 | // Check for special instance methods. |
| 1512 | |
| 1513 | if (!NSExceptionII) { |
| 1514 | ASTContext& Ctx = getContext(); |
| 1515 | |
| 1516 | NSExceptionII = &Ctx.Idents.get("NSException"); |
| 1517 | } |
| 1518 | |
| 1519 | if (ClsName == NSExceptionII) { |
| 1520 | |
| 1521 | enum { NUM_RAISE_SELECTORS = 2 }; |
| 1522 | |
| 1523 | // Lazily create a cache of the selectors. |
| 1524 | |
| 1525 | if (!NSExceptionInstanceRaiseSelectors) { |
| 1526 | |
| 1527 | ASTContext& Ctx = getContext(); |
| 1528 | |
| 1529 | NSExceptionInstanceRaiseSelectors = new Selector[NUM_RAISE_SELECTORS]; |
| 1530 | |
| 1531 | llvm::SmallVector<IdentifierInfo*, NUM_RAISE_SELECTORS> II; |
| 1532 | unsigned idx = 0; |
| 1533 | |
| 1534 | // raise:format: |
Ted Kremenek | 6ff6f8b | 2008-05-02 17:12:56 +0000 | [diff] [blame] | 1535 | II.push_back(&Ctx.Idents.get("raise")); |
| 1536 | II.push_back(&Ctx.Idents.get("format")); |
Ted Kremenek | e448ab4 | 2008-05-01 18:33:28 +0000 | [diff] [blame] | 1537 | NSExceptionInstanceRaiseSelectors[idx++] = |
| 1538 | Ctx.Selectors.getSelector(II.size(), &II[0]); |
| 1539 | |
| 1540 | // raise:format::arguments: |
Ted Kremenek | 6ff6f8b | 2008-05-02 17:12:56 +0000 | [diff] [blame] | 1541 | II.push_back(&Ctx.Idents.get("arguments")); |
Ted Kremenek | e448ab4 | 2008-05-01 18:33:28 +0000 | [diff] [blame] | 1542 | NSExceptionInstanceRaiseSelectors[idx++] = |
| 1543 | Ctx.Selectors.getSelector(II.size(), &II[0]); |
| 1544 | } |
| 1545 | |
| 1546 | for (unsigned i = 0; i < NUM_RAISE_SELECTORS; ++i) |
| 1547 | if (S == NSExceptionInstanceRaiseSelectors[i]) { |
| 1548 | RaisesException = true; break; |
| 1549 | } |
| 1550 | } |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 1551 | } |
| 1552 | |
| 1553 | // Check for any arguments that are uninitialized/undefined. |
| 1554 | |
| 1555 | for (ObjCMessageExpr::arg_iterator I = ME->arg_begin(), E = ME->arg_end(); |
| 1556 | I != E; ++I) { |
| 1557 | |
Zhongxing Xu | 1c96b24 | 2008-10-17 05:57:07 +0000 | [diff] [blame] | 1558 | if (GetSVal(St, *I).isUndef()) { |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 1559 | |
| 1560 | // Generate an error node for passing an uninitialized/undefined value |
| 1561 | // as an argument to a message expression. This node is a sink. |
| 1562 | NodeTy* N = Builder->generateNode(ME, St, Pred); |
| 1563 | |
| 1564 | if (N) { |
| 1565 | N->markAsSink(); |
| 1566 | MsgExprUndefArgs[N] = *I; |
| 1567 | } |
| 1568 | |
| 1569 | return; |
| 1570 | } |
Ted Kremenek | e448ab4 | 2008-05-01 18:33:28 +0000 | [diff] [blame] | 1571 | } |
| 1572 | |
| 1573 | // Check if we raise an exception. For now treat these as sinks. Eventually |
| 1574 | // we will want to handle exceptions properly. |
| 1575 | |
| 1576 | SaveAndRestore<bool> OldSink(Builder->BuildSinks); |
| 1577 | |
| 1578 | if (RaisesException) |
| 1579 | Builder->BuildSinks = true; |
| 1580 | |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 1581 | // Dispatch to plug-in transfer function. |
| 1582 | |
| 1583 | unsigned size = Dst.size(); |
Ted Kremenek | 186350f | 2008-04-23 20:12:28 +0000 | [diff] [blame] | 1584 | SaveOr OldHasGen(Builder->HasGeneratedNode); |
Ted Kremenek | b053396 | 2008-04-18 20:35:30 +0000 | [diff] [blame] | 1585 | |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 1586 | EvalObjCMessageExpr(Dst, ME, Pred); |
| 1587 | |
| 1588 | // Handle the case where no nodes where generated. Auto-generate that |
| 1589 | // contains the updated state if we aren't generating sinks. |
| 1590 | |
Ted Kremenek | b053396 | 2008-04-18 20:35:30 +0000 | [diff] [blame] | 1591 | if (!Builder->BuildSinks && Dst.size() == size && !Builder->HasGeneratedNode) |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 1592 | MakeNode(Dst, ME, Pred, St); |
| 1593 | } |
| 1594 | |
| 1595 | //===----------------------------------------------------------------------===// |
| 1596 | // Transfer functions: Miscellaneous statements. |
| 1597 | //===----------------------------------------------------------------------===// |
| 1598 | |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 1599 | void GRExprEngine::VisitCast(Expr* CastE, Expr* Ex, NodeTy* Pred, NodeSet& Dst){ |
Ted Kremenek | 5d3003a | 2008-02-19 18:52:54 +0000 | [diff] [blame] | 1600 | NodeSet S1; |
Ted Kremenek | 5d3003a | 2008-02-19 18:52:54 +0000 | [diff] [blame] | 1601 | QualType T = CastE->getType(); |
Zhongxing Xu | 933c3e1 | 2008-10-21 06:54:23 +0000 | [diff] [blame] | 1602 | QualType ExTy = Ex->getType(); |
Zhongxing Xu | ed340f7 | 2008-10-22 08:02:16 +0000 | [diff] [blame] | 1603 | |
Zhongxing Xu | d3118bd | 2008-10-31 07:26:14 +0000 | [diff] [blame] | 1604 | if (const ExplicitCastExpr *ExCast=dyn_cast_or_null<ExplicitCastExpr>(CastE)) |
Douglas Gregor | 49badde | 2008-10-27 19:41:14 +0000 | [diff] [blame] | 1605 | T = ExCast->getTypeAsWritten(); |
| 1606 | |
Zhongxing Xu | ed340f7 | 2008-10-22 08:02:16 +0000 | [diff] [blame] | 1607 | if (ExTy->isArrayType() || ExTy->isFunctionType() || T->isReferenceType()) |
Zhongxing Xu | 6d69b5d | 2008-10-16 06:09:51 +0000 | [diff] [blame] | 1608 | VisitLValue(Ex, Pred, S1); |
Ted Kremenek | 65cfb73 | 2008-03-04 22:16:08 +0000 | [diff] [blame] | 1609 | else |
| 1610 | Visit(Ex, Pred, S1); |
| 1611 | |
Ted Kremenek | 0fe33bc | 2008-04-22 21:10:18 +0000 | [diff] [blame] | 1612 | // Check for casting to "void". |
| 1613 | if (T->isVoidType()) { |
Ted Kremenek | 5d3003a | 2008-02-19 18:52:54 +0000 | [diff] [blame] | 1614 | |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 1615 | for (NodeSet::iterator I1 = S1.begin(), E1 = S1.end(); I1 != E1; ++I1) |
Ted Kremenek | 5d3003a | 2008-02-19 18:52:54 +0000 | [diff] [blame] | 1616 | Dst.Add(*I1); |
| 1617 | |
Ted Kremenek | 874d63f | 2008-01-24 02:02:54 +0000 | [diff] [blame] | 1618 | return; |
| 1619 | } |
| 1620 | |
Ted Kremenek | 0fe33bc | 2008-04-22 21:10:18 +0000 | [diff] [blame] | 1621 | // FIXME: The rest of this should probably just go into EvalCall, and |
| 1622 | // let the transfer function object be responsible for constructing |
| 1623 | // nodes. |
| 1624 | |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 1625 | for (NodeSet::iterator I1 = S1.begin(), E1 = S1.end(); I1 != E1; ++I1) { |
Ted Kremenek | 874d63f | 2008-01-24 02:02:54 +0000 | [diff] [blame] | 1626 | NodeTy* N = *I1; |
Ted Kremenek | 4adc81e | 2008-08-13 04:27:00 +0000 | [diff] [blame] | 1627 | const GRState* St = GetState(N); |
Zhongxing Xu | 1c96b24 | 2008-10-17 05:57:07 +0000 | [diff] [blame] | 1628 | SVal V = GetSVal(St, Ex); |
Ted Kremenek | 0fe33bc | 2008-04-22 21:10:18 +0000 | [diff] [blame] | 1629 | |
| 1630 | // Unknown? |
| 1631 | |
| 1632 | if (V.isUnknown()) { |
| 1633 | Dst.Add(N); |
| 1634 | continue; |
| 1635 | } |
| 1636 | |
| 1637 | // Undefined? |
| 1638 | |
| 1639 | if (V.isUndef()) { |
Zhongxing Xu | 8cd5aae | 2008-10-30 05:33:54 +0000 | [diff] [blame] | 1640 | MakeNode(Dst, CastE, N, BindExpr(St, CastE, V)); |
Ted Kremenek | 0fe33bc | 2008-04-22 21:10:18 +0000 | [diff] [blame] | 1641 | continue; |
| 1642 | } |
Ted Kremenek | a8fe39f | 2008-09-19 20:51:22 +0000 | [diff] [blame] | 1643 | |
| 1644 | // For const casts, just propagate the value. |
| 1645 | ASTContext& C = getContext(); |
| 1646 | |
| 1647 | if (C.getCanonicalType(T).getUnqualifiedType() == |
| 1648 | C.getCanonicalType(ExTy).getUnqualifiedType()) { |
Zhongxing Xu | 8cd5aae | 2008-10-30 05:33:54 +0000 | [diff] [blame] | 1649 | MakeNode(Dst, CastE, N, BindExpr(St, CastE, V)); |
Ted Kremenek | a8fe39f | 2008-09-19 20:51:22 +0000 | [diff] [blame] | 1650 | continue; |
| 1651 | } |
Ted Kremenek | 0fe33bc | 2008-04-22 21:10:18 +0000 | [diff] [blame] | 1652 | |
| 1653 | // Check for casts from pointers to integers. |
Zhongxing Xu | 1c96b24 | 2008-10-17 05:57:07 +0000 | [diff] [blame] | 1654 | if (T->isIntegerType() && Loc::IsLocType(ExTy)) { |
Ted Kremenek | 0fe33bc | 2008-04-22 21:10:18 +0000 | [diff] [blame] | 1655 | unsigned bits = getContext().getTypeSize(ExTy); |
| 1656 | |
| 1657 | // FIXME: Determine if the number of bits of the target type is |
| 1658 | // equal or exceeds the number of bits to store the pointer value. |
| 1659 | // If not, flag an error. |
| 1660 | |
Zhongxing Xu | 1c96b24 | 2008-10-17 05:57:07 +0000 | [diff] [blame] | 1661 | V = nonloc::LocAsInteger::Make(getBasicVals(), cast<Loc>(V), bits); |
Zhongxing Xu | 8cd5aae | 2008-10-30 05:33:54 +0000 | [diff] [blame] | 1662 | MakeNode(Dst, CastE, N, BindExpr(St, CastE, V)); |
Ted Kremenek | 0fe33bc | 2008-04-22 21:10:18 +0000 | [diff] [blame] | 1663 | continue; |
| 1664 | } |
| 1665 | |
| 1666 | // Check for casts from integers to pointers. |
Zhongxing Xu | 1c96b24 | 2008-10-17 05:57:07 +0000 | [diff] [blame] | 1667 | if (Loc::IsLocType(T) && ExTy->isIntegerType()) |
| 1668 | if (nonloc::LocAsInteger *LV = dyn_cast<nonloc::LocAsInteger>(&V)) { |
Ted Kremenek | 0fe33bc | 2008-04-22 21:10:18 +0000 | [diff] [blame] | 1669 | // Just unpackage the lval and return it. |
Zhongxing Xu | 1c96b24 | 2008-10-17 05:57:07 +0000 | [diff] [blame] | 1670 | V = LV->getLoc(); |
Zhongxing Xu | 8cd5aae | 2008-10-30 05:33:54 +0000 | [diff] [blame] | 1671 | MakeNode(Dst, CastE, N, BindExpr(St, CastE, V)); |
Ted Kremenek | 0fe33bc | 2008-04-22 21:10:18 +0000 | [diff] [blame] | 1672 | continue; |
| 1673 | } |
Zhongxing Xu | e1911af | 2008-10-23 03:10:39 +0000 | [diff] [blame] | 1674 | |
| 1675 | // StoreManager casts array to different values. |
| 1676 | if (ExTy->isArrayType()) { |
Ted Kremenek | 0b50f5b | 2008-10-24 21:10:49 +0000 | [diff] [blame] | 1677 | assert(T->isPointerType() || T->isReferenceType()); |
Zhongxing Xu | e564b52 | 2008-10-23 04:19:25 +0000 | [diff] [blame] | 1678 | |
Zhongxing Xu | e1911af | 2008-10-23 03:10:39 +0000 | [diff] [blame] | 1679 | V = StateMgr.ArrayToPointer(V); |
Zhongxing Xu | 8cd5aae | 2008-10-30 05:33:54 +0000 | [diff] [blame] | 1680 | MakeNode(Dst, CastE, N, BindExpr(St, CastE, V)); |
Zhongxing Xu | e1911af | 2008-10-23 03:10:39 +0000 | [diff] [blame] | 1681 | continue; |
| 1682 | } |
| 1683 | |
Ted Kremenek | 0fe33bc | 2008-04-22 21:10:18 +0000 | [diff] [blame] | 1684 | // All other cases. |
Zhongxing Xu | 8cd5aae | 2008-10-30 05:33:54 +0000 | [diff] [blame] | 1685 | MakeNode(Dst, CastE, N, BindExpr(St, CastE, EvalCast(V, CastE->getType()))); |
Ted Kremenek | 874d63f | 2008-01-24 02:02:54 +0000 | [diff] [blame] | 1686 | } |
Ted Kremenek | 9de04c4 | 2008-01-24 20:55:43 +0000 | [diff] [blame] | 1687 | } |
| 1688 | |
Ted Kremenek | 4f09027 | 2008-10-27 21:54:31 +0000 | [diff] [blame] | 1689 | void GRExprEngine::VisitCompoundLiteralExpr(CompoundLiteralExpr* CL, |
Zhongxing Xu | f22679e | 2008-11-07 10:38:33 +0000 | [diff] [blame] | 1690 | NodeTy* Pred, NodeSet& Dst, |
| 1691 | bool asLValue) { |
Ted Kremenek | 4f09027 | 2008-10-27 21:54:31 +0000 | [diff] [blame] | 1692 | InitListExpr* ILE = cast<InitListExpr>(CL->getInitializer()->IgnoreParens()); |
| 1693 | NodeSet Tmp; |
| 1694 | Visit(ILE, Pred, Tmp); |
| 1695 | |
| 1696 | for (NodeSet::iterator I = Tmp.begin(), EI = Tmp.end(); I!=EI; ++I) { |
Zhongxing Xu | f22679e | 2008-11-07 10:38:33 +0000 | [diff] [blame] | 1697 | const GRState* St = GetState(*I); |
| 1698 | SVal ILV = GetSVal(St, ILE); |
| 1699 | St = StateMgr.BindCompoundLiteral(St, CL, ILV); |
Ted Kremenek | 4f09027 | 2008-10-27 21:54:31 +0000 | [diff] [blame] | 1700 | |
Zhongxing Xu | f22679e | 2008-11-07 10:38:33 +0000 | [diff] [blame] | 1701 | if (asLValue) |
| 1702 | MakeNode(Dst, CL, *I, BindExpr(St, CL, StateMgr.GetLValue(St, CL))); |
| 1703 | else |
| 1704 | MakeNode(Dst, CL, *I, BindExpr(St, CL, ILV)); |
Ted Kremenek | 4f09027 | 2008-10-27 21:54:31 +0000 | [diff] [blame] | 1705 | } |
| 1706 | } |
| 1707 | |
Ted Kremenek | 5b7dcce | 2008-04-22 22:25:27 +0000 | [diff] [blame] | 1708 | void GRExprEngine::VisitDeclStmt(DeclStmt* DS, NodeTy* Pred, NodeSet& Dst) { |
Ted Kremenek | 5b7dcce | 2008-04-22 22:25:27 +0000 | [diff] [blame] | 1709 | |
Ted Kremenek | 8369a8b | 2008-10-06 18:43:53 +0000 | [diff] [blame] | 1710 | // The CFG has one DeclStmt per Decl. |
| 1711 | ScopedDecl* D = *DS->decl_begin(); |
Ted Kremenek | e6c62e3 | 2008-08-28 18:34:26 +0000 | [diff] [blame] | 1712 | |
| 1713 | if (!D || !isa<VarDecl>(D)) |
Ted Kremenek | 5b7dcce | 2008-04-22 22:25:27 +0000 | [diff] [blame] | 1714 | return; |
Ted Kremenek | 9de04c4 | 2008-01-24 20:55:43 +0000 | [diff] [blame] | 1715 | |
Ted Kremenek | 5b7dcce | 2008-04-22 22:25:27 +0000 | [diff] [blame] | 1716 | const VarDecl* VD = dyn_cast<VarDecl>(D); |
| 1717 | |
Ted Kremenek | af33741 | 2008-11-12 19:24:17 +0000 | [diff] [blame] | 1718 | Expr* InitEx = const_cast<Expr*>(VD->getInit()); |
Ted Kremenek | 5b7dcce | 2008-04-22 22:25:27 +0000 | [diff] [blame] | 1719 | |
| 1720 | // FIXME: static variables may have an initializer, but the second |
| 1721 | // time a function is called those values may not be current. |
| 1722 | NodeSet Tmp; |
| 1723 | |
Ted Kremenek | af33741 | 2008-11-12 19:24:17 +0000 | [diff] [blame] | 1724 | if (InitEx) |
| 1725 | Visit(InitEx, Pred, Tmp); |
Ted Kremenek | e6c62e3 | 2008-08-28 18:34:26 +0000 | [diff] [blame] | 1726 | |
| 1727 | if (Tmp.empty()) |
| 1728 | Tmp.Add(Pred); |
Ted Kremenek | 5b7dcce | 2008-04-22 22:25:27 +0000 | [diff] [blame] | 1729 | |
| 1730 | for (NodeSet::iterator I=Tmp.begin(), E=Tmp.end(); I!=E; ++I) { |
Ted Kremenek | 4adc81e | 2008-08-13 04:27:00 +0000 | [diff] [blame] | 1731 | const GRState* St = GetState(*I); |
Ted Kremenek | af33741 | 2008-11-12 19:24:17 +0000 | [diff] [blame] | 1732 | unsigned Count = Builder->getCurrentBlockCount(); |
| 1733 | |
| 1734 | if (InitEx) { |
| 1735 | SVal InitVal = GetSVal(St, InitEx); |
| 1736 | QualType T = VD->getType(); |
| 1737 | |
| 1738 | // Recover some path-sensitivity if a scalar value evaluated to |
| 1739 | // UnknownVal. |
| 1740 | if (InitVal.isUnknown()) { |
| 1741 | if (Loc::IsLocType(T)) { |
| 1742 | SymbolID Sym = SymMgr.getConjuredSymbol(InitEx, Count); |
| 1743 | InitVal = loc::SymbolVal(Sym); |
| 1744 | } |
| 1745 | else if (T->isIntegerType()) { |
| 1746 | SymbolID Sym = SymMgr.getConjuredSymbol(InitEx, Count); |
| 1747 | InitVal = nonloc::SymbolVal(Sym); |
| 1748 | } |
| 1749 | } |
| 1750 | |
| 1751 | St = StateMgr.BindDecl(St, VD, &InitVal, Count); |
| 1752 | } |
| 1753 | else |
| 1754 | St = StateMgr.BindDecl(St, VD, 0, Count); |
| 1755 | |
Ted Kremenek | e6c62e3 | 2008-08-28 18:34:26 +0000 | [diff] [blame] | 1756 | MakeNode(Dst, DS, *I, St); |
Ted Kremenek | 5b7dcce | 2008-04-22 22:25:27 +0000 | [diff] [blame] | 1757 | } |
Ted Kremenek | 9de04c4 | 2008-01-24 20:55:43 +0000 | [diff] [blame] | 1758 | } |
Ted Kremenek | 874d63f | 2008-01-24 02:02:54 +0000 | [diff] [blame] | 1759 | |
Ted Kremenek | f75b186 | 2008-10-30 17:47:32 +0000 | [diff] [blame] | 1760 | namespace { |
| 1761 | // This class is used by VisitInitListExpr as an item in a worklist |
| 1762 | // for processing the values contained in an InitListExpr. |
| 1763 | class VISIBILITY_HIDDEN InitListWLItem { |
| 1764 | public: |
| 1765 | llvm::ImmutableList<SVal> Vals; |
| 1766 | GRExprEngine::NodeTy* N; |
| 1767 | InitListExpr::reverse_iterator Itr; |
| 1768 | |
| 1769 | InitListWLItem(GRExprEngine::NodeTy* n, llvm::ImmutableList<SVal> vals, |
| 1770 | InitListExpr::reverse_iterator itr) |
| 1771 | : Vals(vals), N(n), Itr(itr) {} |
| 1772 | }; |
| 1773 | } |
| 1774 | |
| 1775 | |
Zhongxing Xu | c4f8706 | 2008-10-30 05:02:23 +0000 | [diff] [blame] | 1776 | void GRExprEngine::VisitInitListExpr(InitListExpr* E, NodeTy* Pred, |
| 1777 | NodeSet& Dst) { |
Ted Kremenek | a49e367 | 2008-10-30 23:14:36 +0000 | [diff] [blame] | 1778 | |
Zhongxing Xu | c4f8706 | 2008-10-30 05:02:23 +0000 | [diff] [blame] | 1779 | const GRState* state = GetState(Pred); |
Ted Kremenek | 76dba7b | 2008-11-13 05:05:34 +0000 | [diff] [blame^] | 1780 | QualType T = getContext().getCanonicalType(E->getType()); |
Ted Kremenek | f75b186 | 2008-10-30 17:47:32 +0000 | [diff] [blame] | 1781 | unsigned NumInitElements = E->getNumInits(); |
Zhongxing Xu | c4f8706 | 2008-10-30 05:02:23 +0000 | [diff] [blame] | 1782 | |
Zhongxing Xu | 05d1c57 | 2008-10-30 05:35:59 +0000 | [diff] [blame] | 1783 | if (T->isArrayType() || T->isStructureType()) { |
Ted Kremenek | f75b186 | 2008-10-30 17:47:32 +0000 | [diff] [blame] | 1784 | |
Ted Kremenek | a49e367 | 2008-10-30 23:14:36 +0000 | [diff] [blame] | 1785 | llvm::ImmutableList<SVal> StartVals = getBasicVals().getEmptySValList(); |
Ted Kremenek | f75b186 | 2008-10-30 17:47:32 +0000 | [diff] [blame] | 1786 | |
Ted Kremenek | a49e367 | 2008-10-30 23:14:36 +0000 | [diff] [blame] | 1787 | // Handle base case where the initializer has no elements. |
| 1788 | // e.g: static int* myArray[] = {}; |
| 1789 | if (NumInitElements == 0) { |
| 1790 | SVal V = NonLoc::MakeCompoundVal(T, StartVals, getBasicVals()); |
| 1791 | MakeNode(Dst, E, Pred, BindExpr(state, E, V)); |
| 1792 | return; |
| 1793 | } |
| 1794 | |
| 1795 | // Create a worklist to process the initializers. |
| 1796 | llvm::SmallVector<InitListWLItem, 10> WorkList; |
| 1797 | WorkList.reserve(NumInitElements); |
| 1798 | WorkList.push_back(InitListWLItem(Pred, StartVals, E->rbegin())); |
Ted Kremenek | f75b186 | 2008-10-30 17:47:32 +0000 | [diff] [blame] | 1799 | InitListExpr::reverse_iterator ItrEnd = E->rend(); |
| 1800 | |
Ted Kremenek | a49e367 | 2008-10-30 23:14:36 +0000 | [diff] [blame] | 1801 | // Process the worklist until it is empty. |
Ted Kremenek | f75b186 | 2008-10-30 17:47:32 +0000 | [diff] [blame] | 1802 | while (!WorkList.empty()) { |
| 1803 | InitListWLItem X = WorkList.back(); |
| 1804 | WorkList.pop_back(); |
| 1805 | |
Zhongxing Xu | c4f8706 | 2008-10-30 05:02:23 +0000 | [diff] [blame] | 1806 | NodeSet Tmp; |
Ted Kremenek | f75b186 | 2008-10-30 17:47:32 +0000 | [diff] [blame] | 1807 | Visit(*X.Itr, X.N, Tmp); |
| 1808 | |
| 1809 | InitListExpr::reverse_iterator NewItr = X.Itr + 1; |
Zhongxing Xu | c4f8706 | 2008-10-30 05:02:23 +0000 | [diff] [blame] | 1810 | |
Ted Kremenek | f75b186 | 2008-10-30 17:47:32 +0000 | [diff] [blame] | 1811 | for (NodeSet::iterator NI=Tmp.begin(), NE=Tmp.end(); NI!=NE; ++NI) { |
| 1812 | // Get the last initializer value. |
| 1813 | state = GetState(*NI); |
| 1814 | SVal InitV = GetSVal(state, cast<Expr>(*X.Itr)); |
| 1815 | |
| 1816 | // Construct the new list of values by prepending the new value to |
| 1817 | // the already constructed list. |
| 1818 | llvm::ImmutableList<SVal> NewVals = |
| 1819 | getBasicVals().consVals(InitV, X.Vals); |
| 1820 | |
| 1821 | if (NewItr == ItrEnd) { |
Zhongxing Xu | a189dca | 2008-10-31 03:01:26 +0000 | [diff] [blame] | 1822 | // Now we have a list holding all init values. Make CompoundValData. |
Ted Kremenek | f75b186 | 2008-10-30 17:47:32 +0000 | [diff] [blame] | 1823 | SVal V = NonLoc::MakeCompoundVal(T, NewVals, getBasicVals()); |
Zhongxing Xu | c4f8706 | 2008-10-30 05:02:23 +0000 | [diff] [blame] | 1824 | |
Ted Kremenek | f75b186 | 2008-10-30 17:47:32 +0000 | [diff] [blame] | 1825 | // Make final state and node. |
Ted Kremenek | 4456da5 | 2008-10-30 18:37:08 +0000 | [diff] [blame] | 1826 | MakeNode(Dst, E, *NI, BindExpr(state, E, V)); |
Ted Kremenek | f75b186 | 2008-10-30 17:47:32 +0000 | [diff] [blame] | 1827 | } |
| 1828 | else { |
| 1829 | // Still some initializer values to go. Push them onto the worklist. |
| 1830 | WorkList.push_back(InitListWLItem(*NI, NewVals, NewItr)); |
| 1831 | } |
| 1832 | } |
Zhongxing Xu | c4f8706 | 2008-10-30 05:02:23 +0000 | [diff] [blame] | 1833 | } |
Ted Kremenek | 8790307 | 2008-10-30 18:34:31 +0000 | [diff] [blame] | 1834 | |
| 1835 | return; |
Zhongxing Xu | c4f8706 | 2008-10-30 05:02:23 +0000 | [diff] [blame] | 1836 | } |
| 1837 | |
Zhongxing Xu | c4f8706 | 2008-10-30 05:02:23 +0000 | [diff] [blame] | 1838 | if (Loc::IsLocType(T) || T->isIntegerType()) { |
| 1839 | assert (E->getNumInits() == 1); |
| 1840 | NodeSet Tmp; |
| 1841 | Expr* Init = E->getInit(0); |
| 1842 | Visit(Init, Pred, Tmp); |
| 1843 | for (NodeSet::iterator I = Tmp.begin(), EI = Tmp.end(); I != EI; ++I) { |
| 1844 | state = GetState(*I); |
Zhongxing Xu | 8cd5aae | 2008-10-30 05:33:54 +0000 | [diff] [blame] | 1845 | MakeNode(Dst, E, *I, BindExpr(state, E, GetSVal(state, Init))); |
Zhongxing Xu | c4f8706 | 2008-10-30 05:02:23 +0000 | [diff] [blame] | 1846 | } |
| 1847 | return; |
| 1848 | } |
| 1849 | |
Ted Kremenek | 76dba7b | 2008-11-13 05:05:34 +0000 | [diff] [blame^] | 1850 | if (T->isUnionType() || T->isVectorType()) { |
Zhongxing Xu | c4f8706 | 2008-10-30 05:02:23 +0000 | [diff] [blame] | 1851 | // FIXME: to be implemented. |
| 1852 | MakeNode(Dst, E, Pred, state); |
| 1853 | return; |
| 1854 | } |
| 1855 | |
| 1856 | printf("InitListExpr type = %s\n", T.getAsString().c_str()); |
| 1857 | assert(0 && "unprocessed InitListExpr type"); |
| 1858 | } |
Ted Kremenek | f233d48 | 2008-02-05 00:26:40 +0000 | [diff] [blame] | 1859 | |
Sebastian Redl | 0518999 | 2008-11-11 17:56:53 +0000 | [diff] [blame] | 1860 | /// VisitSizeOfAlignOfExpr - Transfer function for sizeof(type). |
| 1861 | void GRExprEngine::VisitSizeOfAlignOfExpr(SizeOfAlignOfExpr* Ex, |
| 1862 | NodeTy* Pred, |
| 1863 | NodeSet& Dst) { |
| 1864 | QualType T = Ex->getTypeOfArgument(); |
Ted Kremenek | 87e8034 | 2008-03-15 03:13:20 +0000 | [diff] [blame] | 1865 | uint64_t amt; |
| 1866 | |
| 1867 | if (Ex->isSizeOf()) { |
Ted Kremenek | 9ef1ec9 | 2008-02-21 18:43:30 +0000 | [diff] [blame] | 1868 | |
Ted Kremenek | 87e8034 | 2008-03-15 03:13:20 +0000 | [diff] [blame] | 1869 | // FIXME: Add support for VLAs. |
| 1870 | if (!T.getTypePtr()->isConstantSizeType()) |
| 1871 | return; |
| 1872 | |
Ted Kremenek | f342d18 | 2008-04-30 21:31:12 +0000 | [diff] [blame] | 1873 | // Some code tries to take the sizeof an ObjCInterfaceType, relying that |
| 1874 | // the compiler has laid out its representation. Just report Unknown |
| 1875 | // for these. |
| 1876 | if (T->isObjCInterfaceType()) |
| 1877 | return; |
| 1878 | |
Ted Kremenek | 87e8034 | 2008-03-15 03:13:20 +0000 | [diff] [blame] | 1879 | amt = 1; // Handle sizeof(void) |
| 1880 | |
| 1881 | if (T != getContext().VoidTy) |
| 1882 | amt = getContext().getTypeSize(T) / 8; |
| 1883 | |
| 1884 | } |
| 1885 | else // Get alignment of the type. |
Ted Kremenek | 897781a | 2008-03-15 03:13:55 +0000 | [diff] [blame] | 1886 | amt = getContext().getTypeAlign(T) / 8; |
Ted Kremenek | d9435bf | 2008-02-12 19:49:57 +0000 | [diff] [blame] | 1887 | |
Ted Kremenek | 0e561a3 | 2008-03-21 21:30:14 +0000 | [diff] [blame] | 1888 | MakeNode(Dst, Ex, Pred, |
Zhongxing Xu | 8cd5aae | 2008-10-30 05:33:54 +0000 | [diff] [blame] | 1889 | BindExpr(GetState(Pred), Ex, |
| 1890 | NonLoc::MakeVal(getBasicVals(), amt, Ex->getType()))); |
Ted Kremenek | d9435bf | 2008-02-12 19:49:57 +0000 | [diff] [blame] | 1891 | } |
| 1892 | |
Ted Kremenek | d8e9f0d | 2008-02-20 04:02:35 +0000 | [diff] [blame] | 1893 | |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 1894 | void GRExprEngine::VisitUnaryOperator(UnaryOperator* U, NodeTy* Pred, |
Zhongxing Xu | 6d69b5d | 2008-10-16 06:09:51 +0000 | [diff] [blame] | 1895 | NodeSet& Dst, bool asLValue) { |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 1896 | |
Ted Kremenek | d8e9f0d | 2008-02-20 04:02:35 +0000 | [diff] [blame] | 1897 | switch (U->getOpcode()) { |
Ted Kremenek | d8e9f0d | 2008-02-20 04:02:35 +0000 | [diff] [blame] | 1898 | |
| 1899 | default: |
Ted Kremenek | d8e9f0d | 2008-02-20 04:02:35 +0000 | [diff] [blame] | 1900 | break; |
Ted Kremenek | b8e26e6 | 2008-06-19 17:55:38 +0000 | [diff] [blame] | 1901 | |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 1902 | case UnaryOperator::Deref: { |
| 1903 | |
| 1904 | Expr* Ex = U->getSubExpr()->IgnoreParens(); |
| 1905 | NodeSet Tmp; |
| 1906 | Visit(Ex, Pred, Tmp); |
| 1907 | |
| 1908 | for (NodeSet::iterator I=Tmp.begin(), E=Tmp.end(); I!=E; ++I) { |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 1909 | |
Ted Kremenek | 4adc81e | 2008-08-13 04:27:00 +0000 | [diff] [blame] | 1910 | const GRState* St = GetState(*I); |
Zhongxing Xu | 1c96b24 | 2008-10-17 05:57:07 +0000 | [diff] [blame] | 1911 | SVal location = GetSVal(St, Ex); |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 1912 | |
Zhongxing Xu | 6d69b5d | 2008-10-16 06:09:51 +0000 | [diff] [blame] | 1913 | if (asLValue) |
Zhongxing Xu | 8cd5aae | 2008-10-30 05:33:54 +0000 | [diff] [blame] | 1914 | MakeNode(Dst, U, *I, BindExpr(St, U, location)); |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 1915 | else |
Ted Kremenek | 5c96c27 | 2008-05-21 15:48:33 +0000 | [diff] [blame] | 1916 | EvalLoad(Dst, U, *I, St, location); |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 1917 | } |
| 1918 | |
| 1919 | return; |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 1920 | } |
Ted Kremenek | a084bb6 | 2008-04-30 21:45:55 +0000 | [diff] [blame] | 1921 | |
Ted Kremenek | b8e26e6 | 2008-06-19 17:55:38 +0000 | [diff] [blame] | 1922 | case UnaryOperator::Real: { |
| 1923 | |
| 1924 | Expr* Ex = U->getSubExpr()->IgnoreParens(); |
| 1925 | NodeSet Tmp; |
| 1926 | Visit(Ex, Pred, Tmp); |
| 1927 | |
| 1928 | for (NodeSet::iterator I=Tmp.begin(), E=Tmp.end(); I!=E; ++I) { |
| 1929 | |
Zhongxing Xu | 1c96b24 | 2008-10-17 05:57:07 +0000 | [diff] [blame] | 1930 | // FIXME: We don't have complex SValues yet. |
Ted Kremenek | b8e26e6 | 2008-06-19 17:55:38 +0000 | [diff] [blame] | 1931 | if (Ex->getType()->isAnyComplexType()) { |
| 1932 | // Just report "Unknown." |
| 1933 | Dst.Add(*I); |
| 1934 | continue; |
| 1935 | } |
| 1936 | |
| 1937 | // For all other types, UnaryOperator::Real is an identity operation. |
| 1938 | assert (U->getType() == Ex->getType()); |
Ted Kremenek | 4adc81e | 2008-08-13 04:27:00 +0000 | [diff] [blame] | 1939 | const GRState* St = GetState(*I); |
Zhongxing Xu | 8cd5aae | 2008-10-30 05:33:54 +0000 | [diff] [blame] | 1940 | MakeNode(Dst, U, *I, BindExpr(St, U, GetSVal(St, Ex))); |
Ted Kremenek | b8e26e6 | 2008-06-19 17:55:38 +0000 | [diff] [blame] | 1941 | } |
| 1942 | |
| 1943 | return; |
| 1944 | } |
| 1945 | |
| 1946 | case UnaryOperator::Imag: { |
| 1947 | |
| 1948 | Expr* Ex = U->getSubExpr()->IgnoreParens(); |
| 1949 | NodeSet Tmp; |
| 1950 | Visit(Ex, Pred, Tmp); |
| 1951 | |
| 1952 | for (NodeSet::iterator I=Tmp.begin(), E=Tmp.end(); I!=E; ++I) { |
Zhongxing Xu | 1c96b24 | 2008-10-17 05:57:07 +0000 | [diff] [blame] | 1953 | // FIXME: We don't have complex SValues yet. |
Ted Kremenek | b8e26e6 | 2008-06-19 17:55:38 +0000 | [diff] [blame] | 1954 | if (Ex->getType()->isAnyComplexType()) { |
| 1955 | // Just report "Unknown." |
| 1956 | Dst.Add(*I); |
| 1957 | continue; |
| 1958 | } |
| 1959 | |
| 1960 | // For all other types, UnaryOperator::Float returns 0. |
| 1961 | assert (Ex->getType()->isIntegerType()); |
Ted Kremenek | 4adc81e | 2008-08-13 04:27:00 +0000 | [diff] [blame] | 1962 | const GRState* St = GetState(*I); |
Zhongxing Xu | 1c96b24 | 2008-10-17 05:57:07 +0000 | [diff] [blame] | 1963 | SVal X = NonLoc::MakeVal(getBasicVals(), 0, Ex->getType()); |
Zhongxing Xu | 8cd5aae | 2008-10-30 05:33:54 +0000 | [diff] [blame] | 1964 | MakeNode(Dst, U, *I, BindExpr(St, U, X)); |
Ted Kremenek | b8e26e6 | 2008-06-19 17:55:38 +0000 | [diff] [blame] | 1965 | } |
| 1966 | |
| 1967 | return; |
| 1968 | } |
| 1969 | |
| 1970 | // FIXME: Just report "Unknown" for OffsetOf. |
Ted Kremenek | a084bb6 | 2008-04-30 21:45:55 +0000 | [diff] [blame] | 1971 | case UnaryOperator::OffsetOf: |
Ted Kremenek | a084bb6 | 2008-04-30 21:45:55 +0000 | [diff] [blame] | 1972 | Dst.Add(Pred); |
| 1973 | return; |
| 1974 | |
Zhongxing Xu | 6d69b5d | 2008-10-16 06:09:51 +0000 | [diff] [blame] | 1975 | case UnaryOperator::Plus: assert (!asLValue); // FALL-THROUGH. |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 1976 | case UnaryOperator::Extension: { |
| 1977 | |
| 1978 | // Unary "+" is a no-op, similar to a parentheses. We still have places |
| 1979 | // where it may be a block-level expression, so we need to |
| 1980 | // generate an extra node that just propagates the value of the |
| 1981 | // subexpression. |
| 1982 | |
| 1983 | Expr* Ex = U->getSubExpr()->IgnoreParens(); |
| 1984 | NodeSet Tmp; |
| 1985 | Visit(Ex, Pred, Tmp); |
| 1986 | |
| 1987 | for (NodeSet::iterator I=Tmp.begin(), E=Tmp.end(); I!=E; ++I) { |
Ted Kremenek | 4adc81e | 2008-08-13 04:27:00 +0000 | [diff] [blame] | 1988 | const GRState* St = GetState(*I); |
Zhongxing Xu | 8cd5aae | 2008-10-30 05:33:54 +0000 | [diff] [blame] | 1989 | MakeNode(Dst, U, *I, BindExpr(St, U, GetSVal(St, Ex))); |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 1990 | } |
| 1991 | |
| 1992 | return; |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 1993 | } |
Ted Kremenek | 7b8009a | 2008-01-24 02:28:56 +0000 | [diff] [blame] | 1994 | |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 1995 | case UnaryOperator::AddrOf: { |
Ted Kremenek | d8e9f0d | 2008-02-20 04:02:35 +0000 | [diff] [blame] | 1996 | |
Zhongxing Xu | 6d69b5d | 2008-10-16 06:09:51 +0000 | [diff] [blame] | 1997 | assert(!asLValue); |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 1998 | Expr* Ex = U->getSubExpr()->IgnoreParens(); |
| 1999 | NodeSet Tmp; |
Zhongxing Xu | 6d69b5d | 2008-10-16 06:09:51 +0000 | [diff] [blame] | 2000 | VisitLValue(Ex, Pred, Tmp); |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 2001 | |
| 2002 | for (NodeSet::iterator I=Tmp.begin(), E=Tmp.end(); I!=E; ++I) { |
Ted Kremenek | 4adc81e | 2008-08-13 04:27:00 +0000 | [diff] [blame] | 2003 | const GRState* St = GetState(*I); |
Zhongxing Xu | 1c96b24 | 2008-10-17 05:57:07 +0000 | [diff] [blame] | 2004 | SVal V = GetSVal(St, Ex); |
Zhongxing Xu | 8cd5aae | 2008-10-30 05:33:54 +0000 | [diff] [blame] | 2005 | St = BindExpr(St, U, V); |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 2006 | MakeNode(Dst, U, *I, St); |
Ted Kremenek | 89063af | 2008-02-21 19:15:37 +0000 | [diff] [blame] | 2007 | } |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 2008 | |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 2009 | return; |
| 2010 | } |
| 2011 | |
| 2012 | case UnaryOperator::LNot: |
| 2013 | case UnaryOperator::Minus: |
| 2014 | case UnaryOperator::Not: { |
| 2015 | |
Zhongxing Xu | 6d69b5d | 2008-10-16 06:09:51 +0000 | [diff] [blame] | 2016 | assert (!asLValue); |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 2017 | Expr* Ex = U->getSubExpr()->IgnoreParens(); |
| 2018 | NodeSet Tmp; |
| 2019 | Visit(Ex, Pred, Tmp); |
| 2020 | |
| 2021 | for (NodeSet::iterator I=Tmp.begin(), E=Tmp.end(); I!=E; ++I) { |
Ted Kremenek | 4adc81e | 2008-08-13 04:27:00 +0000 | [diff] [blame] | 2022 | const GRState* St = GetState(*I); |
Ted Kremenek | 855cd90 | 2008-09-30 05:32:44 +0000 | [diff] [blame] | 2023 | |
| 2024 | // Get the value of the subexpression. |
Zhongxing Xu | 1c96b24 | 2008-10-17 05:57:07 +0000 | [diff] [blame] | 2025 | SVal V = GetSVal(St, Ex); |
Ted Kremenek | 855cd90 | 2008-09-30 05:32:44 +0000 | [diff] [blame] | 2026 | |
| 2027 | // Perform promotions. |
Ted Kremenek | 5a236cb | 2008-09-30 05:35:42 +0000 | [diff] [blame] | 2028 | // FIXME: This is the right thing to do, but it currently breaks |
| 2029 | // a bunch of tests. |
| 2030 | // V = EvalCast(V, U->getType()); |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 2031 | |
| 2032 | if (V.isUnknownOrUndef()) { |
Zhongxing Xu | 8cd5aae | 2008-10-30 05:33:54 +0000 | [diff] [blame] | 2033 | MakeNode(Dst, U, *I, BindExpr(St, U, V)); |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 2034 | continue; |
| 2035 | } |
| 2036 | |
| 2037 | switch (U->getOpcode()) { |
| 2038 | default: |
| 2039 | assert(false && "Invalid Opcode."); |
| 2040 | break; |
| 2041 | |
| 2042 | case UnaryOperator::Not: |
Ted Kremenek | 60a6e0c | 2008-10-01 00:21:14 +0000 | [diff] [blame] | 2043 | // FIXME: Do we need to handle promotions? |
Zhongxing Xu | 8cd5aae | 2008-10-30 05:33:54 +0000 | [diff] [blame] | 2044 | St = BindExpr(St, U, EvalComplement(cast<NonLoc>(V))); |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 2045 | break; |
| 2046 | |
| 2047 | case UnaryOperator::Minus: |
Ted Kremenek | 60a6e0c | 2008-10-01 00:21:14 +0000 | [diff] [blame] | 2048 | // FIXME: Do we need to handle promotions? |
Zhongxing Xu | 8cd5aae | 2008-10-30 05:33:54 +0000 | [diff] [blame] | 2049 | St = BindExpr(St, U, EvalMinus(U, cast<NonLoc>(V))); |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 2050 | break; |
| 2051 | |
| 2052 | case UnaryOperator::LNot: |
| 2053 | |
| 2054 | // C99 6.5.3.3: "The expression !E is equivalent to (0==E)." |
| 2055 | // |
| 2056 | // Note: technically we do "E == 0", but this is the same in the |
| 2057 | // transfer functions as "0 == E". |
| 2058 | |
Zhongxing Xu | 1c96b24 | 2008-10-17 05:57:07 +0000 | [diff] [blame] | 2059 | if (isa<Loc>(V)) { |
| 2060 | loc::ConcreteInt X(getBasicVals().getZeroWithPtrWidth()); |
| 2061 | SVal Result = EvalBinOp(BinaryOperator::EQ, cast<Loc>(V), X); |
Zhongxing Xu | 8cd5aae | 2008-10-30 05:33:54 +0000 | [diff] [blame] | 2062 | St = BindExpr(St, U, Result); |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 2063 | } |
| 2064 | else { |
Zhongxing Xu | 1c96b24 | 2008-10-17 05:57:07 +0000 | [diff] [blame] | 2065 | nonloc::ConcreteInt X(getBasicVals().getValue(0, Ex->getType())); |
Ted Kremenek | df7533b | 2008-07-17 21:27:31 +0000 | [diff] [blame] | 2066 | #if 0 |
Zhongxing Xu | 1c96b24 | 2008-10-17 05:57:07 +0000 | [diff] [blame] | 2067 | SVal Result = EvalBinOp(BinaryOperator::EQ, cast<NonLoc>(V), X); |
| 2068 | St = SetSVal(St, U, Result); |
Ted Kremenek | df7533b | 2008-07-17 21:27:31 +0000 | [diff] [blame] | 2069 | #else |
Zhongxing Xu | 1c96b24 | 2008-10-17 05:57:07 +0000 | [diff] [blame] | 2070 | EvalBinOp(Dst, U, BinaryOperator::EQ, cast<NonLoc>(V), X, *I); |
Ted Kremenek | df7533b | 2008-07-17 21:27:31 +0000 | [diff] [blame] | 2071 | continue; |
| 2072 | #endif |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 2073 | } |
| 2074 | |
| 2075 | break; |
| 2076 | } |
| 2077 | |
| 2078 | MakeNode(Dst, U, *I, St); |
| 2079 | } |
| 2080 | |
| 2081 | return; |
| 2082 | } |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 2083 | } |
| 2084 | |
| 2085 | // Handle ++ and -- (both pre- and post-increment). |
| 2086 | |
| 2087 | assert (U->isIncrementDecrementOp()); |
| 2088 | NodeSet Tmp; |
| 2089 | Expr* Ex = U->getSubExpr()->IgnoreParens(); |
Zhongxing Xu | 6d69b5d | 2008-10-16 06:09:51 +0000 | [diff] [blame] | 2090 | VisitLValue(Ex, Pred, Tmp); |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 2091 | |
| 2092 | for (NodeSet::iterator I = Tmp.begin(), E = Tmp.end(); I!=E; ++I) { |
| 2093 | |
Ted Kremenek | 4adc81e | 2008-08-13 04:27:00 +0000 | [diff] [blame] | 2094 | const GRState* St = GetState(*I); |
Zhongxing Xu | 1c96b24 | 2008-10-17 05:57:07 +0000 | [diff] [blame] | 2095 | SVal V1 = GetSVal(St, Ex); |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 2096 | |
| 2097 | // Perform a load. |
| 2098 | NodeSet Tmp2; |
| 2099 | EvalLoad(Tmp2, Ex, *I, St, V1); |
| 2100 | |
| 2101 | for (NodeSet::iterator I2 = Tmp2.begin(), E2 = Tmp2.end(); I2!=E2; ++I2) { |
| 2102 | |
| 2103 | St = GetState(*I2); |
Zhongxing Xu | 1c96b24 | 2008-10-17 05:57:07 +0000 | [diff] [blame] | 2104 | SVal V2 = GetSVal(St, Ex); |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 2105 | |
| 2106 | // Propagate unknown and undefined values. |
| 2107 | if (V2.isUnknownOrUndef()) { |
Zhongxing Xu | 8cd5aae | 2008-10-30 05:33:54 +0000 | [diff] [blame] | 2108 | MakeNode(Dst, U, *I2, BindExpr(St, U, V2)); |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 2109 | continue; |
| 2110 | } |
| 2111 | |
Ted Kremenek | 443003b | 2008-02-21 19:29:23 +0000 | [diff] [blame] | 2112 | // Handle all other values. |
Ted Kremenek | 50d0ac2 | 2008-02-15 22:09:30 +0000 | [diff] [blame] | 2113 | |
| 2114 | BinaryOperator::Opcode Op = U->isIncrementOp() ? BinaryOperator::Add |
| 2115 | : BinaryOperator::Sub; |
| 2116 | |
Zhongxing Xu | 1c96b24 | 2008-10-17 05:57:07 +0000 | [diff] [blame] | 2117 | SVal Result = EvalBinOp(Op, V2, MakeConstantVal(1U, U)); |
Zhongxing Xu | 8cd5aae | 2008-10-30 05:33:54 +0000 | [diff] [blame] | 2118 | St = BindExpr(St, U, U->isPostfix() ? V2 : Result); |
Ted Kremenek | cf78b6a | 2008-02-06 22:50:25 +0000 | [diff] [blame] | 2119 | |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 2120 | // Perform the store. |
Ted Kremenek | 436f2b9 | 2008-04-30 04:23:07 +0000 | [diff] [blame] | 2121 | EvalStore(Dst, U, *I2, St, V1, Result); |
Ted Kremenek | 5b6dc2d | 2008-02-07 01:08:27 +0000 | [diff] [blame] | 2122 | } |
Ted Kremenek | 469ecbd | 2008-04-21 23:43:38 +0000 | [diff] [blame] | 2123 | } |
Ted Kremenek | 5b6dc2d | 2008-02-07 01:08:27 +0000 | [diff] [blame] | 2124 | } |
| 2125 | |
Ted Kremenek | ef44bfb | 2008-03-17 21:11:24 +0000 | [diff] [blame] | 2126 | void GRExprEngine::VisitAsmStmt(AsmStmt* A, NodeTy* Pred, NodeSet& Dst) { |
| 2127 | VisitAsmStmtHelperOutputs(A, A->begin_outputs(), A->end_outputs(), Pred, Dst); |
| 2128 | } |
| 2129 | |
| 2130 | void GRExprEngine::VisitAsmStmtHelperOutputs(AsmStmt* A, |
| 2131 | AsmStmt::outputs_iterator I, |
| 2132 | AsmStmt::outputs_iterator E, |
| 2133 | NodeTy* Pred, NodeSet& Dst) { |
| 2134 | if (I == E) { |
| 2135 | VisitAsmStmtHelperInputs(A, A->begin_inputs(), A->end_inputs(), Pred, Dst); |
| 2136 | return; |
| 2137 | } |
| 2138 | |
| 2139 | NodeSet Tmp; |
Zhongxing Xu | 6d69b5d | 2008-10-16 06:09:51 +0000 | [diff] [blame] | 2140 | VisitLValue(*I, Pred, Tmp); |
Ted Kremenek | ef44bfb | 2008-03-17 21:11:24 +0000 | [diff] [blame] | 2141 | |
| 2142 | ++I; |
| 2143 | |
| 2144 | for (NodeSet::iterator NI = Tmp.begin(), NE = Tmp.end(); NI != NE; ++NI) |
| 2145 | VisitAsmStmtHelperOutputs(A, I, E, *NI, Dst); |
| 2146 | } |
| 2147 | |
| 2148 | void GRExprEngine::VisitAsmStmtHelperInputs(AsmStmt* A, |
| 2149 | AsmStmt::inputs_iterator I, |
| 2150 | AsmStmt::inputs_iterator E, |
| 2151 | NodeTy* Pred, NodeSet& Dst) { |
| 2152 | if (I == E) { |
| 2153 | |
| 2154 | // We have processed both the inputs and the outputs. All of the outputs |
Zhongxing Xu | 1c96b24 | 2008-10-17 05:57:07 +0000 | [diff] [blame] | 2155 | // should evaluate to Locs. Nuke all of their values. |
Ted Kremenek | ef44bfb | 2008-03-17 21:11:24 +0000 | [diff] [blame] | 2156 | |
| 2157 | // FIXME: Some day in the future it would be nice to allow a "plug-in" |
| 2158 | // which interprets the inline asm and stores proper results in the |
| 2159 | // outputs. |
| 2160 | |
Ted Kremenek | 4adc81e | 2008-08-13 04:27:00 +0000 | [diff] [blame] | 2161 | const GRState* St = GetState(Pred); |
Ted Kremenek | ef44bfb | 2008-03-17 21:11:24 +0000 | [diff] [blame] | 2162 | |
| 2163 | for (AsmStmt::outputs_iterator OI = A->begin_outputs(), |
| 2164 | OE = A->end_outputs(); OI != OE; ++OI) { |
| 2165 | |
Zhongxing Xu | 1c96b24 | 2008-10-17 05:57:07 +0000 | [diff] [blame] | 2166 | SVal X = GetSVal(St, *OI); |
| 2167 | assert (!isa<NonLoc>(X)); // Should be an Lval, or unknown, undef. |
Ted Kremenek | ef44bfb | 2008-03-17 21:11:24 +0000 | [diff] [blame] | 2168 | |
Zhongxing Xu | 1c96b24 | 2008-10-17 05:57:07 +0000 | [diff] [blame] | 2169 | if (isa<Loc>(X)) |
Zhongxing Xu | 8cd5aae | 2008-10-30 05:33:54 +0000 | [diff] [blame] | 2170 | St = BindLoc(St, cast<Loc>(X), UnknownVal()); |
Ted Kremenek | ef44bfb | 2008-03-17 21:11:24 +0000 | [diff] [blame] | 2171 | } |
| 2172 | |
Ted Kremenek | 0e561a3 | 2008-03-21 21:30:14 +0000 | [diff] [blame] | 2173 | MakeNode(Dst, A, Pred, St); |
Ted Kremenek | ef44bfb | 2008-03-17 21:11:24 +0000 | [diff] [blame] | 2174 | return; |
| 2175 | } |
| 2176 | |
| 2177 | NodeSet Tmp; |
| 2178 | Visit(*I, Pred, Tmp); |
| 2179 | |
| 2180 | ++I; |
| 2181 | |
| 2182 | for (NodeSet::iterator NI = Tmp.begin(), NE = Tmp.end(); NI != NE; ++NI) |
| 2183 | VisitAsmStmtHelperInputs(A, I, E, *NI, Dst); |
| 2184 | } |
| 2185 | |
Ted Kremenek | 6b31e8e | 2008-04-16 23:05:51 +0000 | [diff] [blame] | 2186 | void GRExprEngine::EvalReturn(NodeSet& Dst, ReturnStmt* S, NodeTy* Pred) { |
| 2187 | assert (Builder && "GRStmtNodeBuilder must be defined."); |
| 2188 | |
| 2189 | unsigned size = Dst.size(); |
Ted Kremenek | b053396 | 2008-04-18 20:35:30 +0000 | [diff] [blame] | 2190 | |
Ted Kremenek | 186350f | 2008-04-23 20:12:28 +0000 | [diff] [blame] | 2191 | SaveAndRestore<bool> OldSink(Builder->BuildSinks); |
| 2192 | SaveOr OldHasGen(Builder->HasGeneratedNode); |
Ted Kremenek | b053396 | 2008-04-18 20:35:30 +0000 | [diff] [blame] | 2193 | |
Ted Kremenek | 729a9a2 | 2008-07-17 23:15:45 +0000 | [diff] [blame] | 2194 | getTF().EvalReturn(Dst, *this, *Builder, S, Pred); |
Ted Kremenek | 6b31e8e | 2008-04-16 23:05:51 +0000 | [diff] [blame] | 2195 | |
Ted Kremenek | b053396 | 2008-04-18 20:35:30 +0000 | [diff] [blame] | 2196 | // Handle the case where no nodes where generated. |
Ted Kremenek | 6b31e8e | 2008-04-16 23:05:51 +0000 | [diff] [blame] | 2197 | |
Ted Kremenek | b053396 | 2008-04-18 20:35:30 +0000 | [diff] [blame] | 2198 | if (!Builder->BuildSinks && Dst.size() == size && !Builder->HasGeneratedNode) |
Ted Kremenek | 6b31e8e | 2008-04-16 23:05:51 +0000 | [diff] [blame] | 2199 | MakeNode(Dst, S, Pred, GetState(Pred)); |
| 2200 | } |
| 2201 | |
Ted Kremenek | 02737ed | 2008-03-31 15:02:58 +0000 | [diff] [blame] | 2202 | void GRExprEngine::VisitReturnStmt(ReturnStmt* S, NodeTy* Pred, NodeSet& Dst) { |
| 2203 | |
| 2204 | Expr* R = S->getRetValue(); |
| 2205 | |
| 2206 | if (!R) { |
Ted Kremenek | 6b31e8e | 2008-04-16 23:05:51 +0000 | [diff] [blame] | 2207 | EvalReturn(Dst, S, Pred); |
Ted Kremenek | 02737ed | 2008-03-31 15:02:58 +0000 | [diff] [blame] | 2208 | return; |
| 2209 | } |
Ted Kremenek | 6b31e8e | 2008-04-16 23:05:51 +0000 | [diff] [blame] | 2210 | |
| 2211 | NodeSet DstRet; |
Ted Kremenek | 02737ed | 2008-03-31 15:02:58 +0000 | [diff] [blame] | 2212 | QualType T = R->getType(); |
| 2213 | |
Chris Lattner | 423a3c9 | 2008-04-02 17:45:06 +0000 | [diff] [blame] | 2214 | if (T->isPointerLikeType()) { |
Ted Kremenek | 02737ed | 2008-03-31 15:02:58 +0000 | [diff] [blame] | 2215 | |
| 2216 | // Check if any of the return values return the address of a stack variable. |
| 2217 | |
| 2218 | NodeSet Tmp; |
| 2219 | Visit(R, Pred, Tmp); |
| 2220 | |
| 2221 | for (NodeSet::iterator I=Tmp.begin(), E=Tmp.end(); I!=E; ++I) { |
Zhongxing Xu | 1c96b24 | 2008-10-17 05:57:07 +0000 | [diff] [blame] | 2222 | SVal X = GetSVal((*I)->getState(), R); |
Ted Kremenek | 02737ed | 2008-03-31 15:02:58 +0000 | [diff] [blame] | 2223 | |
Zhongxing Xu | 1c96b24 | 2008-10-17 05:57:07 +0000 | [diff] [blame] | 2224 | if (isa<loc::MemRegionVal>(X)) { |
Ted Kremenek | 02737ed | 2008-03-31 15:02:58 +0000 | [diff] [blame] | 2225 | |
Ted Kremenek | 9e24049 | 2008-10-04 05:50:14 +0000 | [diff] [blame] | 2226 | // Determine if the value is on the stack. |
Zhongxing Xu | 1c96b24 | 2008-10-17 05:57:07 +0000 | [diff] [blame] | 2227 | const MemRegion* R = cast<loc::MemRegionVal>(&X)->getRegion(); |
Ted Kremenek | 9e24049 | 2008-10-04 05:50:14 +0000 | [diff] [blame] | 2228 | |
| 2229 | if (R && getStateManager().hasStackStorage(R)) { |
Ted Kremenek | 02737ed | 2008-03-31 15:02:58 +0000 | [diff] [blame] | 2230 | |
| 2231 | // Create a special node representing the v |
| 2232 | |
| 2233 | NodeTy* RetStackNode = Builder->generateNode(S, GetState(*I), *I); |
| 2234 | |
| 2235 | if (RetStackNode) { |
| 2236 | RetStackNode->markAsSink(); |
| 2237 | RetsStackAddr.insert(RetStackNode); |
| 2238 | } |
| 2239 | |
| 2240 | continue; |
| 2241 | } |
| 2242 | } |
| 2243 | |
Ted Kremenek | 6b31e8e | 2008-04-16 23:05:51 +0000 | [diff] [blame] | 2244 | DstRet.Add(*I); |
Ted Kremenek | 02737ed | 2008-03-31 15:02:58 +0000 | [diff] [blame] | 2245 | } |
| 2246 | } |
| 2247 | else |
Ted Kremenek | 6b31e8e | 2008-04-16 23:05:51 +0000 | [diff] [blame] | 2248 | Visit(R, Pred, DstRet); |
| 2249 | |
| 2250 | for (NodeSet::iterator I=DstRet.begin(), E=DstRet.end(); I!=E; ++I) |
| 2251 | EvalReturn(Dst, S, *I); |
Ted Kremenek | 02737ed | 2008-03-31 15:02:58 +0000 | [diff] [blame] | 2252 | } |
Ted Kremenek | 55deb97 | 2008-03-25 00:34:37 +0000 | [diff] [blame] | 2253 | |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 2254 | //===----------------------------------------------------------------------===// |
| 2255 | // Transfer functions: Binary operators. |
| 2256 | //===----------------------------------------------------------------------===// |
| 2257 | |
Ted Kremenek | c13b6e2 | 2008-10-20 23:40:25 +0000 | [diff] [blame] | 2258 | const GRState* GRExprEngine::CheckDivideZero(Expr* Ex, const GRState* St, |
| 2259 | NodeTy* Pred, SVal Denom) { |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 2260 | |
| 2261 | // Divide by undefined? (potentially zero) |
| 2262 | |
| 2263 | if (Denom.isUndef()) { |
| 2264 | NodeTy* DivUndef = Builder->generateNode(Ex, St, Pred); |
| 2265 | |
| 2266 | if (DivUndef) { |
| 2267 | DivUndef->markAsSink(); |
| 2268 | ExplicitBadDivides.insert(DivUndef); |
| 2269 | } |
| 2270 | |
Ted Kremenek | c13b6e2 | 2008-10-20 23:40:25 +0000 | [diff] [blame] | 2271 | return 0; |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 2272 | } |
| 2273 | |
| 2274 | // Check for divide/remainder-by-zero. |
| 2275 | // First, "assume" that the denominator is 0 or undefined. |
| 2276 | |
| 2277 | bool isFeasibleZero = false; |
Ted Kremenek | 4adc81e | 2008-08-13 04:27:00 +0000 | [diff] [blame] | 2278 | const GRState* ZeroSt = Assume(St, Denom, false, isFeasibleZero); |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 2279 | |
| 2280 | // Second, "assume" that the denominator cannot be 0. |
| 2281 | |
| 2282 | bool isFeasibleNotZero = false; |
| 2283 | St = Assume(St, Denom, true, isFeasibleNotZero); |
| 2284 | |
| 2285 | // Create the node for the divide-by-zero (if it occurred). |
| 2286 | |
| 2287 | if (isFeasibleZero) |
| 2288 | if (NodeTy* DivZeroNode = Builder->generateNode(Ex, ZeroSt, Pred)) { |
| 2289 | DivZeroNode->markAsSink(); |
| 2290 | |
| 2291 | if (isFeasibleNotZero) |
| 2292 | ImplicitBadDivides.insert(DivZeroNode); |
| 2293 | else |
| 2294 | ExplicitBadDivides.insert(DivZeroNode); |
| 2295 | |
| 2296 | } |
| 2297 | |
Ted Kremenek | c13b6e2 | 2008-10-20 23:40:25 +0000 | [diff] [blame] | 2298 | return isFeasibleNotZero ? St : 0; |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 2299 | } |
| 2300 | |
Ted Kremenek | 4d4dd85 | 2008-02-13 17:41:41 +0000 | [diff] [blame] | 2301 | void GRExprEngine::VisitBinaryOperator(BinaryOperator* B, |
Ted Kremenek | daeb9a7 | 2008-02-13 23:08:21 +0000 | [diff] [blame] | 2302 | GRExprEngine::NodeTy* Pred, |
| 2303 | GRExprEngine::NodeSet& Dst) { |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 2304 | |
| 2305 | NodeSet Tmp1; |
| 2306 | Expr* LHS = B->getLHS()->IgnoreParens(); |
| 2307 | Expr* RHS = B->getRHS()->IgnoreParens(); |
Ted Kremenek | 5b6dc2d | 2008-02-07 01:08:27 +0000 | [diff] [blame] | 2308 | |
| 2309 | if (B->isAssignmentOp()) |
Zhongxing Xu | 6d69b5d | 2008-10-16 06:09:51 +0000 | [diff] [blame] | 2310 | VisitLValue(LHS, Pred, Tmp1); |
Ted Kremenek | 5b6dc2d | 2008-02-07 01:08:27 +0000 | [diff] [blame] | 2311 | else |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 2312 | Visit(LHS, Pred, Tmp1); |
Ted Kremenek | cb448ca | 2008-01-16 00:53:15 +0000 | [diff] [blame] | 2313 | |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 2314 | for (NodeSet::iterator I1=Tmp1.begin(), E1=Tmp1.end(); I1 != E1; ++I1) { |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 2315 | |
Zhongxing Xu | 1c96b24 | 2008-10-17 05:57:07 +0000 | [diff] [blame] | 2316 | SVal LeftV = GetSVal((*I1)->getState(), LHS); |
Ted Kremenek | e00fe3f | 2008-01-17 00:52:48 +0000 | [diff] [blame] | 2317 | |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 2318 | // Process the RHS. |
| 2319 | |
| 2320 | NodeSet Tmp2; |
| 2321 | Visit(RHS, *I1, Tmp2); |
| 2322 | |
| 2323 | // With both the LHS and RHS evaluated, process the operation itself. |
| 2324 | |
| 2325 | for (NodeSet::iterator I2=Tmp2.begin(), E2=Tmp2.end(); I2 != E2; ++I2) { |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 2326 | |
Ted Kremenek | 4adc81e | 2008-08-13 04:27:00 +0000 | [diff] [blame] | 2327 | const GRState* St = GetState(*I2); |
Ted Kremenek | c13b6e2 | 2008-10-20 23:40:25 +0000 | [diff] [blame] | 2328 | const GRState* OldSt = St; |
| 2329 | |
Zhongxing Xu | 1c96b24 | 2008-10-17 05:57:07 +0000 | [diff] [blame] | 2330 | SVal RightV = GetSVal(St, RHS); |
Ted Kremenek | cf78b6a | 2008-02-06 22:50:25 +0000 | [diff] [blame] | 2331 | BinaryOperator::Opcode Op = B->getOpcode(); |
| 2332 | |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 2333 | switch (Op) { |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 2334 | |
Ted Kremenek | ab2b8c5 | 2008-01-23 19:59:44 +0000 | [diff] [blame] | 2335 | case BinaryOperator::Assign: { |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 2336 | |
Ted Kremenek | 361fa8e | 2008-03-12 21:45:47 +0000 | [diff] [blame] | 2337 | // EXPERIMENTAL: "Conjured" symbols. |
Ted Kremenek | fd30194 | 2008-10-17 22:23:12 +0000 | [diff] [blame] | 2338 | // FIXME: Handle structs. |
| 2339 | QualType T = RHS->getType(); |
Ted Kremenek | 361fa8e | 2008-03-12 21:45:47 +0000 | [diff] [blame] | 2340 | |
Zhongxing Xu | d3118bd | 2008-10-31 07:26:14 +0000 | [diff] [blame] | 2341 | if (RightV.isUnknown() && (T->isIntegerType() || Loc::IsLocType(T))) { |
Ted Kremenek | 361fa8e | 2008-03-12 21:45:47 +0000 | [diff] [blame] | 2342 | unsigned Count = Builder->getCurrentBlockCount(); |
| 2343 | SymbolID Sym = SymMgr.getConjuredSymbol(B->getRHS(), Count); |
| 2344 | |
Zhongxing Xu | 1c96b24 | 2008-10-17 05:57:07 +0000 | [diff] [blame] | 2345 | RightV = Loc::IsLocType(B->getRHS()->getType()) |
| 2346 | ? cast<SVal>(loc::SymbolVal(Sym)) |
| 2347 | : cast<SVal>(nonloc::SymbolVal(Sym)); |
Ted Kremenek | 361fa8e | 2008-03-12 21:45:47 +0000 | [diff] [blame] | 2348 | } |
| 2349 | |
Ted Kremenek | 361fa8e | 2008-03-12 21:45:47 +0000 | [diff] [blame] | 2350 | // Simulate the effects of a "store": bind the value of the RHS |
| 2351 | // to the L-Value represented by the LHS. |
Ted Kremenek | e38718e | 2008-04-16 18:21:25 +0000 | [diff] [blame] | 2352 | |
Zhongxing Xu | 8cd5aae | 2008-10-30 05:33:54 +0000 | [diff] [blame] | 2353 | EvalStore(Dst, B, LHS, *I2, BindExpr(St, B, RightV), LeftV, RightV); |
Ted Kremenek | e38718e | 2008-04-16 18:21:25 +0000 | [diff] [blame] | 2354 | continue; |
Ted Kremenek | ab2b8c5 | 2008-01-23 19:59:44 +0000 | [diff] [blame] | 2355 | } |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 2356 | |
| 2357 | case BinaryOperator::Div: |
| 2358 | case BinaryOperator::Rem: |
| 2359 | |
Ted Kremenek | c13b6e2 | 2008-10-20 23:40:25 +0000 | [diff] [blame] | 2360 | // Special checking for integer denominators. |
| 2361 | if (RHS->getType()->isIntegerType()) { |
| 2362 | St = CheckDivideZero(B, St, *I2, RightV); |
| 2363 | if (!St) continue; |
| 2364 | } |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 2365 | |
| 2366 | // FALL-THROUGH. |
Ted Kremenek | ab2b8c5 | 2008-01-23 19:59:44 +0000 | [diff] [blame] | 2367 | |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 2368 | default: { |
| 2369 | |
| 2370 | if (B->isAssignmentOp()) |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 2371 | break; |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 2372 | |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 2373 | // Process non-assignements except commas or short-circuited |
| 2374 | // logical expressions (LAnd and LOr). |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 2375 | |
Zhongxing Xu | 1c96b24 | 2008-10-17 05:57:07 +0000 | [diff] [blame] | 2376 | SVal Result = EvalBinOp(Op, LeftV, RightV); |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 2377 | |
| 2378 | if (Result.isUnknown()) { |
Ted Kremenek | c13b6e2 | 2008-10-20 23:40:25 +0000 | [diff] [blame] | 2379 | if (OldSt != St) { |
| 2380 | // Generate a new node if we have already created a new state. |
| 2381 | MakeNode(Dst, B, *I2, St); |
| 2382 | } |
| 2383 | else |
| 2384 | Dst.Add(*I2); |
| 2385 | |
Ted Kremenek | 89063af | 2008-02-21 19:15:37 +0000 | [diff] [blame] | 2386 | continue; |
| 2387 | } |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 2388 | |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 2389 | if (Result.isUndef() && !LeftV.isUndef() && !RightV.isUndef()) { |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 2390 | |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 2391 | // The operands were *not* undefined, but the result is undefined. |
| 2392 | // This is a special node that should be flagged as an error. |
Ted Kremenek | 3c8d0c5 | 2008-02-25 18:42:54 +0000 | [diff] [blame] | 2393 | |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 2394 | if (NodeTy* UndefNode = Builder->generateNode(B, St, *I2)) { |
Ted Kremenek | 8cc13ea | 2008-02-28 20:32:03 +0000 | [diff] [blame] | 2395 | UndefNode->markAsSink(); |
| 2396 | UndefResults.insert(UndefNode); |
| 2397 | } |
| 2398 | |
| 2399 | continue; |
| 2400 | } |
| 2401 | |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 2402 | // Otherwise, create a new node. |
| 2403 | |
Zhongxing Xu | 8cd5aae | 2008-10-30 05:33:54 +0000 | [diff] [blame] | 2404 | MakeNode(Dst, B, *I2, BindExpr(St, B, Result)); |
Ted Kremenek | e38718e | 2008-04-16 18:21:25 +0000 | [diff] [blame] | 2405 | continue; |
Ted Kremenek | cf78b6a | 2008-02-06 22:50:25 +0000 | [diff] [blame] | 2406 | } |
Ted Kremenek | ab2b8c5 | 2008-01-23 19:59:44 +0000 | [diff] [blame] | 2407 | } |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 2408 | |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 2409 | assert (B->isCompoundAssignmentOp()); |
| 2410 | |
Ted Kremenek | 934e3e9 | 2008-10-27 23:02:39 +0000 | [diff] [blame] | 2411 | if (Op >= BinaryOperator::AndAssign) { |
| 2412 | Op = (BinaryOperator::Opcode) (Op - (BinaryOperator::AndAssign - |
| 2413 | BinaryOperator::And)); |
| 2414 | } |
| 2415 | else { |
| 2416 | Op = (BinaryOperator::Opcode) (Op - BinaryOperator::MulAssign); |
| 2417 | } |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 2418 | |
| 2419 | // Perform a load (the LHS). This performs the checks for |
| 2420 | // null dereferences, and so on. |
| 2421 | NodeSet Tmp3; |
Zhongxing Xu | 1c96b24 | 2008-10-17 05:57:07 +0000 | [diff] [blame] | 2422 | SVal location = GetSVal(St, LHS); |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 2423 | EvalLoad(Tmp3, LHS, *I2, St, location); |
| 2424 | |
| 2425 | for (NodeSet::iterator I3=Tmp3.begin(), E3=Tmp3.end(); I3!=E3; ++I3) { |
| 2426 | |
| 2427 | St = GetState(*I3); |
Zhongxing Xu | 1c96b24 | 2008-10-17 05:57:07 +0000 | [diff] [blame] | 2428 | SVal V = GetSVal(St, LHS); |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 2429 | |
Ted Kremenek | c13b6e2 | 2008-10-20 23:40:25 +0000 | [diff] [blame] | 2430 | // Check for divide-by-zero. |
| 2431 | if ((Op == BinaryOperator::Div || Op == BinaryOperator::Rem) |
| 2432 | && RHS->getType()->isIntegerType()) { |
| 2433 | |
| 2434 | // CheckDivideZero returns a new state where the denominator |
| 2435 | // is assumed to be non-zero. |
| 2436 | St = CheckDivideZero(B, St, *I3, RightV); |
| 2437 | |
| 2438 | if (!St) |
| 2439 | continue; |
| 2440 | } |
| 2441 | |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 2442 | // Propagate undefined values (left-side). |
| 2443 | if (V.isUndef()) { |
Zhongxing Xu | 8cd5aae | 2008-10-30 05:33:54 +0000 | [diff] [blame] | 2444 | EvalStore(Dst, B, LHS, *I3, BindExpr(St, B, V), location, V); |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 2445 | continue; |
| 2446 | } |
| 2447 | |
| 2448 | // Propagate unknown values (left and right-side). |
| 2449 | if (RightV.isUnknown() || V.isUnknown()) { |
Zhongxing Xu | 8cd5aae | 2008-10-30 05:33:54 +0000 | [diff] [blame] | 2450 | EvalStore(Dst, B, LHS, *I3, BindExpr(St, B, UnknownVal()), location, |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 2451 | UnknownVal()); |
| 2452 | continue; |
| 2453 | } |
| 2454 | |
| 2455 | // At this point: |
| 2456 | // |
| 2457 | // The LHS is not Undef/Unknown. |
| 2458 | // The RHS is not Unknown. |
| 2459 | |
| 2460 | // Get the computation type. |
| 2461 | QualType CTy = cast<CompoundAssignOperator>(B)->getComputationType(); |
| 2462 | |
| 2463 | // Perform promotions. |
| 2464 | V = EvalCast(V, CTy); |
| 2465 | RightV = EvalCast(RightV, CTy); |
| 2466 | |
| 2467 | // Evaluate operands and promote to result type. |
Ted Kremenek | c13b6e2 | 2008-10-20 23:40:25 +0000 | [diff] [blame] | 2468 | if (RightV.isUndef()) { |
Ted Kremenek | 82bae3f | 2008-09-20 01:50:34 +0000 | [diff] [blame] | 2469 | // Propagate undefined values (right-side). |
Zhongxing Xu | 8cd5aae | 2008-10-30 05:33:54 +0000 | [diff] [blame] | 2470 | EvalStore(Dst,B, LHS, *I3, BindExpr(St, B, RightV), location, RightV); |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 2471 | continue; |
| 2472 | } |
| 2473 | |
| 2474 | // Compute the result of the operation. |
| 2475 | |
Zhongxing Xu | 1c96b24 | 2008-10-17 05:57:07 +0000 | [diff] [blame] | 2476 | SVal Result = EvalCast(EvalBinOp(Op, V, RightV), B->getType()); |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 2477 | |
| 2478 | if (Result.isUndef()) { |
| 2479 | |
| 2480 | // The operands were not undefined, but the result is undefined. |
| 2481 | |
| 2482 | if (NodeTy* UndefNode = Builder->generateNode(B, St, *I3)) { |
| 2483 | UndefNode->markAsSink(); |
| 2484 | UndefResults.insert(UndefNode); |
| 2485 | } |
| 2486 | |
| 2487 | continue; |
| 2488 | } |
Ted Kremenek | 9ff267d | 2008-10-20 23:13:25 +0000 | [diff] [blame] | 2489 | |
| 2490 | // EXPERIMENTAL: "Conjured" symbols. |
| 2491 | // FIXME: Handle structs. |
Ted Kremenek | 0944ccc | 2008-10-21 19:49:01 +0000 | [diff] [blame] | 2492 | if (Result.isUnknown() && |
| 2493 | (CTy->isIntegerType() || Loc::IsLocType(CTy))) { |
| 2494 | |
Ted Kremenek | 9ff267d | 2008-10-20 23:13:25 +0000 | [diff] [blame] | 2495 | unsigned Count = Builder->getCurrentBlockCount(); |
| 2496 | SymbolID Sym = SymMgr.getConjuredSymbol(B->getRHS(), Count); |
| 2497 | |
Ted Kremenek | 0944ccc | 2008-10-21 19:49:01 +0000 | [diff] [blame] | 2498 | Result = Loc::IsLocType(CTy) |
Ted Kremenek | 9ff267d | 2008-10-20 23:13:25 +0000 | [diff] [blame] | 2499 | ? cast<SVal>(loc::SymbolVal(Sym)) |
| 2500 | : cast<SVal>(nonloc::SymbolVal(Sym)); |
| 2501 | } |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 2502 | |
Zhongxing Xu | 8cd5aae | 2008-10-30 05:33:54 +0000 | [diff] [blame] | 2503 | EvalStore(Dst, B, LHS, *I3, BindExpr(St, B, Result), location, Result); |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 2504 | } |
Ted Kremenek | cb448ca | 2008-01-16 00:53:15 +0000 | [diff] [blame] | 2505 | } |
Ted Kremenek | d27f816 | 2008-01-15 23:55:06 +0000 | [diff] [blame] | 2506 | } |
Ted Kremenek | d27f816 | 2008-01-15 23:55:06 +0000 | [diff] [blame] | 2507 | } |
Ted Kremenek | ee98546 | 2008-01-16 18:18:48 +0000 | [diff] [blame] | 2508 | |
| 2509 | //===----------------------------------------------------------------------===// |
Ted Kremenek | df7533b | 2008-07-17 21:27:31 +0000 | [diff] [blame] | 2510 | // Transfer-function Helpers. |
| 2511 | //===----------------------------------------------------------------------===// |
| 2512 | |
Ted Kremenek | 4adc81e | 2008-08-13 04:27:00 +0000 | [diff] [blame] | 2513 | void GRExprEngine::EvalBinOp(ExplodedNodeSet<GRState>& Dst, Expr* Ex, |
Ted Kremenek | df7533b | 2008-07-17 21:27:31 +0000 | [diff] [blame] | 2514 | BinaryOperator::Opcode Op, |
Zhongxing Xu | 1c96b24 | 2008-10-17 05:57:07 +0000 | [diff] [blame] | 2515 | NonLoc L, NonLoc R, |
Ted Kremenek | 4adc81e | 2008-08-13 04:27:00 +0000 | [diff] [blame] | 2516 | ExplodedNode<GRState>* Pred) { |
Ted Kremenek | 6297a8e | 2008-07-18 05:53:58 +0000 | [diff] [blame] | 2517 | |
Ted Kremenek | 4adc81e | 2008-08-13 04:27:00 +0000 | [diff] [blame] | 2518 | GRStateSet OStates; |
Ted Kremenek | 6297a8e | 2008-07-18 05:53:58 +0000 | [diff] [blame] | 2519 | EvalBinOp(OStates, GetState(Pred), Ex, Op, L, R); |
| 2520 | |
Ted Kremenek | 4adc81e | 2008-08-13 04:27:00 +0000 | [diff] [blame] | 2521 | for (GRStateSet::iterator I=OStates.begin(), E=OStates.end(); I!=E; ++I) |
Ted Kremenek | 6297a8e | 2008-07-18 05:53:58 +0000 | [diff] [blame] | 2522 | MakeNode(Dst, Ex, Pred, *I); |
| 2523 | } |
| 2524 | |
Ted Kremenek | 4adc81e | 2008-08-13 04:27:00 +0000 | [diff] [blame] | 2525 | void GRExprEngine::EvalBinOp(GRStateSet& OStates, const GRState* St, |
Ted Kremenek | 6297a8e | 2008-07-18 05:53:58 +0000 | [diff] [blame] | 2526 | Expr* Ex, BinaryOperator::Opcode Op, |
Zhongxing Xu | 1c96b24 | 2008-10-17 05:57:07 +0000 | [diff] [blame] | 2527 | NonLoc L, NonLoc R) { |
Ted Kremenek | df7533b | 2008-07-17 21:27:31 +0000 | [diff] [blame] | 2528 | |
Ted Kremenek | 4adc81e | 2008-08-13 04:27:00 +0000 | [diff] [blame] | 2529 | GRStateSet::AutoPopulate AP(OStates, St); |
Ted Kremenek | 6297a8e | 2008-07-18 05:53:58 +0000 | [diff] [blame] | 2530 | if (R.isValid()) getTF().EvalBinOpNN(OStates, StateMgr, St, Ex, Op, L, R); |
Ted Kremenek | df7533b | 2008-07-17 21:27:31 +0000 | [diff] [blame] | 2531 | } |
| 2532 | |
| 2533 | //===----------------------------------------------------------------------===// |
Ted Kremenek | e01c987 | 2008-02-14 22:36:46 +0000 | [diff] [blame] | 2534 | // Visualization. |
Ted Kremenek | ee98546 | 2008-01-16 18:18:48 +0000 | [diff] [blame] | 2535 | //===----------------------------------------------------------------------===// |
| 2536 | |
Ted Kremenek | aa66a32 | 2008-01-16 21:46:15 +0000 | [diff] [blame] | 2537 | #ifndef NDEBUG |
Ted Kremenek | 4d4dd85 | 2008-02-13 17:41:41 +0000 | [diff] [blame] | 2538 | static GRExprEngine* GraphPrintCheckerState; |
Ted Kremenek | e97ca06 | 2008-03-07 20:57:30 +0000 | [diff] [blame] | 2539 | static SourceManager* GraphPrintSourceManager; |
Ted Kremenek | 3b4f670 | 2008-01-30 23:24:39 +0000 | [diff] [blame] | 2540 | |
Ted Kremenek | aa66a32 | 2008-01-16 21:46:15 +0000 | [diff] [blame] | 2541 | namespace llvm { |
| 2542 | template<> |
Ted Kremenek | 4d4dd85 | 2008-02-13 17:41:41 +0000 | [diff] [blame] | 2543 | struct VISIBILITY_HIDDEN DOTGraphTraits<GRExprEngine::NodeTy*> : |
Ted Kremenek | aa66a32 | 2008-01-16 21:46:15 +0000 | [diff] [blame] | 2544 | public DefaultDOTGraphTraits { |
Ted Kremenek | 016f52f | 2008-02-08 21:10:02 +0000 | [diff] [blame] | 2545 | |
Ted Kremenek | a3fadfc | 2008-02-14 22:54:53 +0000 | [diff] [blame] | 2546 | static std::string getNodeAttributes(const GRExprEngine::NodeTy* N, void*) { |
| 2547 | |
| 2548 | if (GraphPrintCheckerState->isImplicitNullDeref(N) || |
Ted Kremenek | 9dca062 | 2008-02-19 00:22:37 +0000 | [diff] [blame] | 2549 | GraphPrintCheckerState->isExplicitNullDeref(N) || |
Ted Kremenek | 4a4e524 | 2008-02-28 09:25:22 +0000 | [diff] [blame] | 2550 | GraphPrintCheckerState->isUndefDeref(N) || |
| 2551 | GraphPrintCheckerState->isUndefStore(N) || |
| 2552 | GraphPrintCheckerState->isUndefControlFlow(N) || |
Ted Kremenek | 4d839b4 | 2008-03-07 19:04:53 +0000 | [diff] [blame] | 2553 | GraphPrintCheckerState->isExplicitBadDivide(N) || |
| 2554 | GraphPrintCheckerState->isImplicitBadDivide(N) || |
Ted Kremenek | 5e03fcb | 2008-02-29 23:14:48 +0000 | [diff] [blame] | 2555 | GraphPrintCheckerState->isUndefResult(N) || |
Ted Kremenek | 2ded35a | 2008-02-29 23:53:11 +0000 | [diff] [blame] | 2556 | GraphPrintCheckerState->isBadCall(N) || |
| 2557 | GraphPrintCheckerState->isUndefArg(N)) |
Ted Kremenek | a3fadfc | 2008-02-14 22:54:53 +0000 | [diff] [blame] | 2558 | return "color=\"red\",style=\"filled\""; |
| 2559 | |
Ted Kremenek | 8cc13ea | 2008-02-28 20:32:03 +0000 | [diff] [blame] | 2560 | if (GraphPrintCheckerState->isNoReturnCall(N)) |
| 2561 | return "color=\"blue\",style=\"filled\""; |
| 2562 | |
Ted Kremenek | a3fadfc | 2008-02-14 22:54:53 +0000 | [diff] [blame] | 2563 | return ""; |
| 2564 | } |
Ted Kremenek | ed4de31 | 2008-02-06 03:56:15 +0000 | [diff] [blame] | 2565 | |
Ted Kremenek | 4d4dd85 | 2008-02-13 17:41:41 +0000 | [diff] [blame] | 2566 | static std::string getNodeLabel(const GRExprEngine::NodeTy* N, void*) { |
Ted Kremenek | aa66a32 | 2008-01-16 21:46:15 +0000 | [diff] [blame] | 2567 | std::ostringstream Out; |
Ted Kremenek | 803c9ed | 2008-01-23 22:30:44 +0000 | [diff] [blame] | 2568 | |
| 2569 | // Program Location. |
Ted Kremenek | aa66a32 | 2008-01-16 21:46:15 +0000 | [diff] [blame] | 2570 | ProgramPoint Loc = N->getLocation(); |
| 2571 | |
| 2572 | switch (Loc.getKind()) { |
| 2573 | case ProgramPoint::BlockEntranceKind: |
| 2574 | Out << "Block Entrance: B" |
| 2575 | << cast<BlockEntrance>(Loc).getBlock()->getBlockID(); |
| 2576 | break; |
| 2577 | |
| 2578 | case ProgramPoint::BlockExitKind: |
| 2579 | assert (false); |
| 2580 | break; |
| 2581 | |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 2582 | case ProgramPoint::PostLoadKind: |
Ted Kremenek | 331b0ac | 2008-06-18 05:34:07 +0000 | [diff] [blame] | 2583 | case ProgramPoint::PostPurgeDeadSymbolsKind: |
Ted Kremenek | aa66a32 | 2008-01-16 21:46:15 +0000 | [diff] [blame] | 2584 | case ProgramPoint::PostStmtKind: { |
Ted Kremenek | e97ca06 | 2008-03-07 20:57:30 +0000 | [diff] [blame] | 2585 | const PostStmt& L = cast<PostStmt>(Loc); |
| 2586 | Stmt* S = L.getStmt(); |
| 2587 | SourceLocation SLoc = S->getLocStart(); |
| 2588 | |
| 2589 | Out << S->getStmtClassName() << ' ' << (void*) S << ' '; |
Ted Kremenek | a95d375 | 2008-09-13 05:16:45 +0000 | [diff] [blame] | 2590 | llvm::raw_os_ostream OutS(Out); |
| 2591 | S->printPretty(OutS); |
| 2592 | OutS.flush(); |
Ted Kremenek | 9ff731d | 2008-01-24 22:27:20 +0000 | [diff] [blame] | 2593 | |
Ted Kremenek | 9b5551d | 2008-03-09 03:30:59 +0000 | [diff] [blame] | 2594 | if (SLoc.isFileID()) { |
| 2595 | Out << "\\lline=" |
| 2596 | << GraphPrintSourceManager->getLineNumber(SLoc) << " col=" |
Zhongxing Xu | 5b8b6f2 | 2008-10-24 04:33:15 +0000 | [diff] [blame] | 2597 | << GraphPrintSourceManager->getColumnNumber(SLoc) << "\\l"; |
Ted Kremenek | 9b5551d | 2008-03-09 03:30:59 +0000 | [diff] [blame] | 2598 | } |
Ted Kremenek | d131c4f | 2008-02-07 05:48:01 +0000 | [diff] [blame] | 2599 | |
Ted Kremenek | 5e03fcb | 2008-02-29 23:14:48 +0000 | [diff] [blame] | 2600 | if (GraphPrintCheckerState->isImplicitNullDeref(N)) |
Ted Kremenek | d131c4f | 2008-02-07 05:48:01 +0000 | [diff] [blame] | 2601 | Out << "\\|Implicit-Null Dereference.\\l"; |
Ted Kremenek | 5e03fcb | 2008-02-29 23:14:48 +0000 | [diff] [blame] | 2602 | else if (GraphPrintCheckerState->isExplicitNullDeref(N)) |
Ted Kremenek | 63a4f69 | 2008-02-07 06:04:18 +0000 | [diff] [blame] | 2603 | Out << "\\|Explicit-Null Dereference.\\l"; |
Ted Kremenek | 5e03fcb | 2008-02-29 23:14:48 +0000 | [diff] [blame] | 2604 | else if (GraphPrintCheckerState->isUndefDeref(N)) |
Ted Kremenek | 4a4e524 | 2008-02-28 09:25:22 +0000 | [diff] [blame] | 2605 | Out << "\\|Dereference of undefialied value.\\l"; |
Ted Kremenek | 5e03fcb | 2008-02-29 23:14:48 +0000 | [diff] [blame] | 2606 | else if (GraphPrintCheckerState->isUndefStore(N)) |
Zhongxing Xu | 1c96b24 | 2008-10-17 05:57:07 +0000 | [diff] [blame] | 2607 | Out << "\\|Store to Undefined Loc."; |
Ted Kremenek | 4d839b4 | 2008-03-07 19:04:53 +0000 | [diff] [blame] | 2608 | else if (GraphPrintCheckerState->isExplicitBadDivide(N)) |
| 2609 | Out << "\\|Explicit divide-by zero or undefined value."; |
| 2610 | else if (GraphPrintCheckerState->isImplicitBadDivide(N)) |
| 2611 | Out << "\\|Implicit divide-by zero or undefined value."; |
Ted Kremenek | 5e03fcb | 2008-02-29 23:14:48 +0000 | [diff] [blame] | 2612 | else if (GraphPrintCheckerState->isUndefResult(N)) |
Ted Kremenek | 8cc13ea | 2008-02-28 20:32:03 +0000 | [diff] [blame] | 2613 | Out << "\\|Result of operation is undefined."; |
Ted Kremenek | 8cc13ea | 2008-02-28 20:32:03 +0000 | [diff] [blame] | 2614 | else if (GraphPrintCheckerState->isNoReturnCall(N)) |
| 2615 | Out << "\\|Call to function marked \"noreturn\"."; |
Ted Kremenek | 5e03fcb | 2008-02-29 23:14:48 +0000 | [diff] [blame] | 2616 | else if (GraphPrintCheckerState->isBadCall(N)) |
| 2617 | Out << "\\|Call to NULL/Undefined."; |
Ted Kremenek | 2ded35a | 2008-02-29 23:53:11 +0000 | [diff] [blame] | 2618 | else if (GraphPrintCheckerState->isUndefArg(N)) |
| 2619 | Out << "\\|Argument in call is undefined"; |
Ted Kremenek | d131c4f | 2008-02-07 05:48:01 +0000 | [diff] [blame] | 2620 | |
Ted Kremenek | aa66a32 | 2008-01-16 21:46:15 +0000 | [diff] [blame] | 2621 | break; |
| 2622 | } |
| 2623 | |
| 2624 | default: { |
| 2625 | const BlockEdge& E = cast<BlockEdge>(Loc); |
| 2626 | Out << "Edge: (B" << E.getSrc()->getBlockID() << ", B" |
| 2627 | << E.getDst()->getBlockID() << ')'; |
Ted Kremenek | b38911f | 2008-01-30 23:03:39 +0000 | [diff] [blame] | 2628 | |
| 2629 | if (Stmt* T = E.getSrc()->getTerminator()) { |
Ted Kremenek | e97ca06 | 2008-03-07 20:57:30 +0000 | [diff] [blame] | 2630 | |
| 2631 | SourceLocation SLoc = T->getLocStart(); |
| 2632 | |
Ted Kremenek | b38911f | 2008-01-30 23:03:39 +0000 | [diff] [blame] | 2633 | Out << "\\|Terminator: "; |
Ted Kremenek | e97ca06 | 2008-03-07 20:57:30 +0000 | [diff] [blame] | 2634 | |
Ted Kremenek | a95d375 | 2008-09-13 05:16:45 +0000 | [diff] [blame] | 2635 | llvm::raw_os_ostream OutS(Out); |
| 2636 | E.getSrc()->printTerminator(OutS); |
| 2637 | OutS.flush(); |
Ted Kremenek | b38911f | 2008-01-30 23:03:39 +0000 | [diff] [blame] | 2638 | |
Ted Kremenek | 9b5551d | 2008-03-09 03:30:59 +0000 | [diff] [blame] | 2639 | if (SLoc.isFileID()) { |
| 2640 | Out << "\\lline=" |
| 2641 | << GraphPrintSourceManager->getLineNumber(SLoc) << " col=" |
| 2642 | << GraphPrintSourceManager->getColumnNumber(SLoc); |
| 2643 | } |
Ted Kremenek | e97ca06 | 2008-03-07 20:57:30 +0000 | [diff] [blame] | 2644 | |
Ted Kremenek | daeb9a7 | 2008-02-13 23:08:21 +0000 | [diff] [blame] | 2645 | if (isa<SwitchStmt>(T)) { |
| 2646 | Stmt* Label = E.getDst()->getLabel(); |
| 2647 | |
| 2648 | if (Label) { |
| 2649 | if (CaseStmt* C = dyn_cast<CaseStmt>(Label)) { |
| 2650 | Out << "\\lcase "; |
Ted Kremenek | a95d375 | 2008-09-13 05:16:45 +0000 | [diff] [blame] | 2651 | llvm::raw_os_ostream OutS(Out); |
| 2652 | C->getLHS()->printPretty(OutS); |
| 2653 | OutS.flush(); |
| 2654 | |
Ted Kremenek | daeb9a7 | 2008-02-13 23:08:21 +0000 | [diff] [blame] | 2655 | if (Stmt* RHS = C->getRHS()) { |
| 2656 | Out << " .. "; |
Ted Kremenek | a95d375 | 2008-09-13 05:16:45 +0000 | [diff] [blame] | 2657 | RHS->printPretty(OutS); |
| 2658 | OutS.flush(); |
Ted Kremenek | daeb9a7 | 2008-02-13 23:08:21 +0000 | [diff] [blame] | 2659 | } |
| 2660 | |
| 2661 | Out << ":"; |
| 2662 | } |
| 2663 | else { |
| 2664 | assert (isa<DefaultStmt>(Label)); |
| 2665 | Out << "\\ldefault:"; |
| 2666 | } |
| 2667 | } |
| 2668 | else |
| 2669 | Out << "\\l(implicit) default:"; |
| 2670 | } |
| 2671 | else if (isa<IndirectGotoStmt>(T)) { |
Ted Kremenek | b38911f | 2008-01-30 23:03:39 +0000 | [diff] [blame] | 2672 | // FIXME |
| 2673 | } |
| 2674 | else { |
| 2675 | Out << "\\lCondition: "; |
| 2676 | if (*E.getSrc()->succ_begin() == E.getDst()) |
| 2677 | Out << "true"; |
| 2678 | else |
| 2679 | Out << "false"; |
| 2680 | } |
| 2681 | |
| 2682 | Out << "\\l"; |
| 2683 | } |
Ted Kremenek | 3b4f670 | 2008-01-30 23:24:39 +0000 | [diff] [blame] | 2684 | |
Ted Kremenek | 4a4e524 | 2008-02-28 09:25:22 +0000 | [diff] [blame] | 2685 | if (GraphPrintCheckerState->isUndefControlFlow(N)) { |
| 2686 | Out << "\\|Control-flow based on\\lUndefined value.\\l"; |
Ted Kremenek | 3b4f670 | 2008-01-30 23:24:39 +0000 | [diff] [blame] | 2687 | } |
Ted Kremenek | aa66a32 | 2008-01-16 21:46:15 +0000 | [diff] [blame] | 2688 | } |
| 2689 | } |
| 2690 | |
Ted Kremenek | aed9b6a | 2008-02-28 10:21:43 +0000 | [diff] [blame] | 2691 | Out << "\\|StateID: " << (void*) N->getState() << "\\|"; |
Ted Kremenek | 016f52f | 2008-02-08 21:10:02 +0000 | [diff] [blame] | 2692 | |
Ted Kremenek | 1c72ef0 | 2008-08-16 00:49:49 +0000 | [diff] [blame] | 2693 | GRStateRef state(N->getState(), GraphPrintCheckerState->getStateManager()); |
| 2694 | state.printDOT(Out); |
Ted Kremenek | 803c9ed | 2008-01-23 22:30:44 +0000 | [diff] [blame] | 2695 | |
Ted Kremenek | 803c9ed | 2008-01-23 22:30:44 +0000 | [diff] [blame] | 2696 | Out << "\\l"; |
Ted Kremenek | aa66a32 | 2008-01-16 21:46:15 +0000 | [diff] [blame] | 2697 | return Out.str(); |
| 2698 | } |
| 2699 | }; |
| 2700 | } // end llvm namespace |
| 2701 | #endif |
| 2702 | |
Ted Kremenek | ffe0f43 | 2008-03-07 22:58:01 +0000 | [diff] [blame] | 2703 | #ifndef NDEBUG |
Ted Kremenek | 7ec07fd | 2008-03-12 17:18:20 +0000 | [diff] [blame] | 2704 | |
| 2705 | template <typename ITERATOR> |
| 2706 | GRExprEngine::NodeTy* GetGraphNode(ITERATOR I) { return *I; } |
| 2707 | |
| 2708 | template <> |
| 2709 | GRExprEngine::NodeTy* |
| 2710 | GetGraphNode<llvm::DenseMap<GRExprEngine::NodeTy*, Expr*>::iterator> |
| 2711 | (llvm::DenseMap<GRExprEngine::NodeTy*, Expr*>::iterator I) { |
| 2712 | return I->first; |
| 2713 | } |
| 2714 | |
Ted Kremenek | ffe0f43 | 2008-03-07 22:58:01 +0000 | [diff] [blame] | 2715 | template <typename ITERATOR> |
Ted Kremenek | cb61292 | 2008-04-18 19:23:43 +0000 | [diff] [blame] | 2716 | static void AddSources(std::vector<GRExprEngine::NodeTy*>& Sources, |
Ted Kremenek | 7ec07fd | 2008-03-12 17:18:20 +0000 | [diff] [blame] | 2717 | ITERATOR I, ITERATOR E) { |
Ted Kremenek | ffe0f43 | 2008-03-07 22:58:01 +0000 | [diff] [blame] | 2718 | |
Ted Kremenek | d452758 | 2008-09-16 18:44:52 +0000 | [diff] [blame] | 2719 | llvm::SmallSet<ProgramPoint,10> CachedSources; |
Ted Kremenek | 7ec07fd | 2008-03-12 17:18:20 +0000 | [diff] [blame] | 2720 | |
| 2721 | for ( ; I != E; ++I ) { |
| 2722 | GRExprEngine::NodeTy* N = GetGraphNode(I); |
Ted Kremenek | d452758 | 2008-09-16 18:44:52 +0000 | [diff] [blame] | 2723 | ProgramPoint P = N->getLocation(); |
Ted Kremenek | 7ec07fd | 2008-03-12 17:18:20 +0000 | [diff] [blame] | 2724 | |
Ted Kremenek | d452758 | 2008-09-16 18:44:52 +0000 | [diff] [blame] | 2725 | if (CachedSources.count(P)) |
Ted Kremenek | 7ec07fd | 2008-03-12 17:18:20 +0000 | [diff] [blame] | 2726 | continue; |
| 2727 | |
Ted Kremenek | d452758 | 2008-09-16 18:44:52 +0000 | [diff] [blame] | 2728 | CachedSources.insert(P); |
Ted Kremenek | 7ec07fd | 2008-03-12 17:18:20 +0000 | [diff] [blame] | 2729 | Sources.push_back(N); |
| 2730 | } |
Ted Kremenek | ffe0f43 | 2008-03-07 22:58:01 +0000 | [diff] [blame] | 2731 | } |
| 2732 | #endif |
| 2733 | |
| 2734 | void GRExprEngine::ViewGraph(bool trim) { |
Ted Kremenek | 493d7a2 | 2008-03-11 18:25:33 +0000 | [diff] [blame] | 2735 | #ifndef NDEBUG |
Ted Kremenek | ffe0f43 | 2008-03-07 22:58:01 +0000 | [diff] [blame] | 2736 | if (trim) { |
Ted Kremenek | cb61292 | 2008-04-18 19:23:43 +0000 | [diff] [blame] | 2737 | std::vector<NodeTy*> Src; |
| 2738 | |
| 2739 | // Fixme: Migrate over to the new way of adding nodes. |
Ted Kremenek | 7ec07fd | 2008-03-12 17:18:20 +0000 | [diff] [blame] | 2740 | AddSources(Src, null_derefs_begin(), null_derefs_end()); |
| 2741 | AddSources(Src, undef_derefs_begin(), undef_derefs_end()); |
| 2742 | AddSources(Src, explicit_bad_divides_begin(), explicit_bad_divides_end()); |
| 2743 | AddSources(Src, undef_results_begin(), undef_results_end()); |
| 2744 | AddSources(Src, bad_calls_begin(), bad_calls_end()); |
| 2745 | AddSources(Src, undef_arg_begin(), undef_arg_end()); |
Ted Kremenek | 1b9df4c | 2008-03-14 18:14:50 +0000 | [diff] [blame] | 2746 | AddSources(Src, undef_branches_begin(), undef_branches_end()); |
Ted Kremenek | ffe0f43 | 2008-03-07 22:58:01 +0000 | [diff] [blame] | 2747 | |
Ted Kremenek | cb61292 | 2008-04-18 19:23:43 +0000 | [diff] [blame] | 2748 | // The new way. |
| 2749 | for (BugTypeSet::iterator I=BugTypes.begin(), E=BugTypes.end(); I!=E; ++I) |
| 2750 | (*I)->GetErrorNodes(Src); |
| 2751 | |
| 2752 | |
Ted Kremenek | 7ec07fd | 2008-03-12 17:18:20 +0000 | [diff] [blame] | 2753 | ViewGraph(&Src[0], &Src[0]+Src.size()); |
Ted Kremenek | ffe0f43 | 2008-03-07 22:58:01 +0000 | [diff] [blame] | 2754 | } |
Ted Kremenek | 493d7a2 | 2008-03-11 18:25:33 +0000 | [diff] [blame] | 2755 | else { |
| 2756 | GraphPrintCheckerState = this; |
| 2757 | GraphPrintSourceManager = &getContext().getSourceManager(); |
Ted Kremenek | ae6814e | 2008-08-13 21:24:49 +0000 | [diff] [blame] | 2758 | |
Ted Kremenek | ffe0f43 | 2008-03-07 22:58:01 +0000 | [diff] [blame] | 2759 | llvm::ViewGraph(*G.roots_begin(), "GRExprEngine"); |
Ted Kremenek | 493d7a2 | 2008-03-11 18:25:33 +0000 | [diff] [blame] | 2760 | |
| 2761 | GraphPrintCheckerState = NULL; |
| 2762 | GraphPrintSourceManager = NULL; |
| 2763 | } |
| 2764 | #endif |
| 2765 | } |
| 2766 | |
| 2767 | void GRExprEngine::ViewGraph(NodeTy** Beg, NodeTy** End) { |
| 2768 | #ifndef NDEBUG |
| 2769 | GraphPrintCheckerState = this; |
| 2770 | GraphPrintSourceManager = &getContext().getSourceManager(); |
Ted Kremenek | 1c72ef0 | 2008-08-16 00:49:49 +0000 | [diff] [blame] | 2771 | |
Ted Kremenek | 493d7a2 | 2008-03-11 18:25:33 +0000 | [diff] [blame] | 2772 | GRExprEngine::GraphTy* TrimmedG = G.Trim(Beg, End); |
| 2773 | |
| 2774 | if (!TrimmedG) |
| 2775 | llvm::cerr << "warning: Trimmed ExplodedGraph is empty.\n"; |
| 2776 | else { |
| 2777 | llvm::ViewGraph(*TrimmedG->roots_begin(), "TrimmedGRExprEngine"); |
| 2778 | delete TrimmedG; |
| 2779 | } |
Ted Kremenek | ffe0f43 | 2008-03-07 22:58:01 +0000 | [diff] [blame] | 2780 | |
Ted Kremenek | 3b4f670 | 2008-01-30 23:24:39 +0000 | [diff] [blame] | 2781 | GraphPrintCheckerState = NULL; |
Ted Kremenek | e97ca06 | 2008-03-07 20:57:30 +0000 | [diff] [blame] | 2782 | GraphPrintSourceManager = NULL; |
Ted Kremenek | e01c987 | 2008-02-14 22:36:46 +0000 | [diff] [blame] | 2783 | #endif |
Ted Kremenek | ee98546 | 2008-01-16 18:18:48 +0000 | [diff] [blame] | 2784 | } |