Zhongxing Xu | 1789275 | 2008-10-08 02:50:44 +0000 | [diff] [blame] | 1 | //== RegionStore.cpp - Field-sensitive store model --------------*- C++ -*--==// |
| 2 | // |
| 3 | // The LLVM Compiler Infrastructure |
| 4 | // |
| 5 | // This file is distributed under the University of Illinois Open Source |
| 6 | // License. See LICENSE.TXT for details. |
| 7 | // |
| 8 | //===----------------------------------------------------------------------===// |
| 9 | // |
| 10 | // This file defines a basic region store model. In this model, we do have field |
| 11 | // sensitivity. But we assume nothing about the heap shape. So recursive data |
| 12 | // structures are largely ignored. Basically we do 1-limiting analysis. |
| 13 | // Parameter pointers are assumed with no aliasing. Pointee objects of |
| 14 | // parameters are created lazily. |
| 15 | // |
| 16 | //===----------------------------------------------------------------------===// |
| 17 | #include "clang/Analysis/PathSensitive/MemRegion.h" |
| 18 | #include "clang/Analysis/PathSensitive/GRState.h" |
| 19 | #include "clang/Analysis/Analyses/LiveVariables.h" |
| 20 | |
| 21 | #include "llvm/ADT/ImmutableMap.h" |
| 22 | #include "llvm/Support/Compiler.h" |
| 23 | |
| 24 | using namespace clang; |
| 25 | |
Zhongxing Xu | 1c96b24 | 2008-10-17 05:57:07 +0000 | [diff] [blame] | 26 | typedef llvm::ImmutableMap<const MemRegion*, SVal> RegionBindingsTy; |
Zhongxing Xu | 1789275 | 2008-10-08 02:50:44 +0000 | [diff] [blame] | 27 | |
| 28 | namespace { |
| 29 | |
| 30 | class VISIBILITY_HIDDEN RegionStoreManager : public StoreManager { |
| 31 | RegionBindingsTy::Factory RBFactory; |
| 32 | GRStateManager& StateMgr; |
| 33 | MemRegionManager MRMgr; |
| 34 | |
| 35 | public: |
| 36 | RegionStoreManager(GRStateManager& mgr) |
| 37 | : StateMgr(mgr), MRMgr(StateMgr.getAllocator()) {} |
| 38 | |
| 39 | virtual ~RegionStoreManager() {} |
| 40 | |
Zhongxing Xu | c4bf72c | 2008-10-22 13:44:38 +0000 | [diff] [blame] | 41 | SVal getLValueVar(const GRState* St, const VarDecl* VD); |
| 42 | |
| 43 | SVal getLValueIvar(const GRState* St, const ObjCIvarDecl* D, SVal Base); |
| 44 | |
| 45 | SVal getLValueField(const GRState* St, SVal Base, const FieldDecl* D); |
| 46 | |
Zhongxing Xu | 8485ec6 | 2008-10-21 06:27:32 +0000 | [diff] [blame] | 47 | SVal Retrieve(Store S, Loc L, QualType T); |
Zhongxing Xu | c4bf72c | 2008-10-22 13:44:38 +0000 | [diff] [blame] | 48 | |
Zhongxing Xu | 8485ec6 | 2008-10-21 06:27:32 +0000 | [diff] [blame] | 49 | Store Bind(Store St, Loc LV, SVal V); |
Zhongxing Xu | 1789275 | 2008-10-08 02:50:44 +0000 | [diff] [blame] | 50 | |
| 51 | Store getInitialStore(); |
| 52 | |
Zhongxing Xu | 53bcdd4 | 2008-10-21 05:29:26 +0000 | [diff] [blame] | 53 | Store AddDecl(Store store, const VarDecl* VD, Expr* Ex, SVal InitVal, |
| 54 | unsigned Count); |
| 55 | |
| 56 | Loc getVarLoc(const VarDecl* VD) { |
| 57 | return loc::MemRegionVal(MRMgr.getVarRegion(VD)); |
| 58 | } |
| 59 | |
| 60 | Loc getElementLoc(const VarDecl* VD, SVal Idx); |
| 61 | |
Zhongxing Xu | 1789275 | 2008-10-08 02:50:44 +0000 | [diff] [blame] | 62 | static inline RegionBindingsTy GetRegionBindings(Store store) { |
| 63 | return RegionBindingsTy(static_cast<const RegionBindingsTy::TreeTy*>(store)); |
| 64 | } |
| 65 | }; |
| 66 | |
| 67 | } // end anonymous namespace |
| 68 | |
Ted Kremenek | 95c7b00 | 2008-10-24 01:04:59 +0000 | [diff] [blame^] | 69 | StoreManager* clang::CreateRegionStoreManager(GRStateManager& StMgr) { |
| 70 | // return new RegionStoreManager(StMgr); |
| 71 | return 0; // Uncomment the above line when RegionStoreManager is not abstract. |
| 72 | } |
| 73 | |
Zhongxing Xu | 53bcdd4 | 2008-10-21 05:29:26 +0000 | [diff] [blame] | 74 | Loc RegionStoreManager::getElementLoc(const VarDecl* VD, SVal Idx) { |
| 75 | MemRegion* R = MRMgr.getVarRegion(VD); |
| 76 | ElementRegion* ER = MRMgr.getElementRegion(Idx, R); |
| 77 | return loc::MemRegionVal(ER); |
| 78 | } |
| 79 | |
Zhongxing Xu | c4bf72c | 2008-10-22 13:44:38 +0000 | [diff] [blame] | 80 | SVal RegionStoreManager::getLValueVar(const GRState* St, const VarDecl* VD) { |
| 81 | return loc::MemRegionVal(MRMgr.getVarRegion(VD)); |
| 82 | } |
| 83 | |
| 84 | SVal RegionStoreManager::getLValueIvar(const GRState* St, const ObjCIvarDecl* D, |
| 85 | SVal Base) { |
| 86 | return UnknownVal(); |
| 87 | } |
| 88 | |
| 89 | SVal RegionStoreManager::getLValueField(const GRState* St, SVal Base, |
| 90 | const FieldDecl* D) { |
| 91 | if (Base.isUnknownOrUndef()) |
| 92 | return Base; |
| 93 | |
| 94 | Loc BaseL = cast<Loc>(Base); |
| 95 | const MemRegion* BaseR = 0; |
| 96 | |
| 97 | switch (BaseL.getSubKind()) { |
| 98 | case loc::MemRegionKind: |
| 99 | BaseR = cast<loc::MemRegionVal>(BaseL).getRegion(); |
| 100 | break; |
| 101 | |
| 102 | case loc::SymbolValKind: |
| 103 | BaseR = MRMgr.getSymbolicRegion(cast<loc::SymbolVal>(&BaseL)->getSymbol()); |
| 104 | break; |
| 105 | |
| 106 | case loc::GotoLabelKind: |
| 107 | case loc::FuncValKind: |
| 108 | // These are anormal cases. Flag an undefined value. |
| 109 | return UndefinedVal(); |
| 110 | |
| 111 | case loc::ConcreteIntKind: |
| 112 | case loc::StringLiteralValKind: |
| 113 | // While these seem funny, this can happen through casts. |
| 114 | // FIXME: What we should return is the field offset. For example, |
| 115 | // add the field offset to the integer value. That way funny things |
| 116 | // like this work properly: &(((struct foo *) 0xa)->f) |
| 117 | return Base; |
| 118 | |
| 119 | default: |
| 120 | assert("Unhandled Base."); |
| 121 | return Base; |
| 122 | } |
| 123 | |
| 124 | return loc::MemRegionVal(MRMgr.getFieldRegion(D, BaseR)); |
| 125 | } |
| 126 | |
Zhongxing Xu | 8485ec6 | 2008-10-21 06:27:32 +0000 | [diff] [blame] | 127 | SVal RegionStoreManager::Retrieve(Store S, Loc L, QualType T) { |
Zhongxing Xu | 53bcdd4 | 2008-10-21 05:29:26 +0000 | [diff] [blame] | 128 | assert(!isa<UnknownVal>(L) && "location unknown"); |
| 129 | assert(!isa<UndefinedVal>(L) && "location undefined"); |
| 130 | |
| 131 | switch (L.getSubKind()) { |
| 132 | case loc::MemRegionKind: { |
| 133 | const MemRegion* R = cast<loc::MemRegionVal>(L).getRegion(); |
| 134 | assert(R && "bad region"); |
| 135 | |
| 136 | RegionBindingsTy B(static_cast<const RegionBindingsTy::TreeTy*>(S)); |
| 137 | RegionBindingsTy::data_type* V = B.lookup(R); |
| 138 | return V ? *V : UnknownVal(); |
| 139 | } |
| 140 | |
| 141 | case loc::SymbolValKind: |
| 142 | return UnknownVal(); |
| 143 | |
| 144 | case loc::ConcreteIntKind: |
| 145 | return UndefinedVal(); // As in BasicStoreManager. |
| 146 | |
| 147 | case loc::FuncValKind: |
| 148 | return L; |
| 149 | |
| 150 | case loc::StringLiteralValKind: |
| 151 | return UnknownVal(); |
| 152 | |
| 153 | default: |
| 154 | assert(false && "Invalid Location"); |
| 155 | break; |
| 156 | } |
| 157 | } |
| 158 | |
Zhongxing Xu | 8485ec6 | 2008-10-21 06:27:32 +0000 | [diff] [blame] | 159 | Store RegionStoreManager::Bind(Store store, Loc LV, SVal V) { |
Zhongxing Xu | 1c96b24 | 2008-10-17 05:57:07 +0000 | [diff] [blame] | 160 | assert(LV.getSubKind() == loc::MemRegionKind); |
Zhongxing Xu | 1789275 | 2008-10-08 02:50:44 +0000 | [diff] [blame] | 161 | |
Ted Kremenek | 993f1c7 | 2008-10-17 20:28:54 +0000 | [diff] [blame] | 162 | const MemRegion* R = cast<loc::MemRegionVal>(LV).getRegion(); |
Zhongxing Xu | 1789275 | 2008-10-08 02:50:44 +0000 | [diff] [blame] | 163 | |
| 164 | if (!R) |
| 165 | return store; |
| 166 | |
| 167 | RegionBindingsTy B = GetRegionBindings(store); |
| 168 | return V.isUnknown() |
| 169 | ? RBFactory.Remove(B, R).getRoot() |
| 170 | : RBFactory.Add(B, R, V).getRoot(); |
| 171 | } |
| 172 | |
| 173 | Store RegionStoreManager::getInitialStore() { |
| 174 | typedef LiveVariables::AnalysisDataTy LVDataTy; |
| 175 | LVDataTy& D = StateMgr.getLiveVariables().getAnalysisData(); |
| 176 | |
| 177 | Store St = RBFactory.GetEmptyMap().getRoot(); |
| 178 | |
| 179 | for (LVDataTy::decl_iterator I=D.begin_decl(), E=D.end_decl(); I != E; ++I) { |
Douglas Gregor | 8e9bebd | 2008-10-21 16:13:35 +0000 | [diff] [blame] | 180 | NamedDecl* ND = const_cast<NamedDecl*>(I->first); |
Zhongxing Xu | 1789275 | 2008-10-08 02:50:44 +0000 | [diff] [blame] | 181 | |
Douglas Gregor | 8e9bebd | 2008-10-21 16:13:35 +0000 | [diff] [blame] | 182 | if (VarDecl* VD = dyn_cast<VarDecl>(ND)) { |
Zhongxing Xu | 1789275 | 2008-10-08 02:50:44 +0000 | [diff] [blame] | 183 | // Punt on static variables for now. |
| 184 | if (VD->getStorageClass() == VarDecl::Static) |
| 185 | continue; |
| 186 | |
| 187 | QualType T = VD->getType(); |
| 188 | // Only handle pointers and integers for now. |
Zhongxing Xu | 1c96b24 | 2008-10-17 05:57:07 +0000 | [diff] [blame] | 189 | if (Loc::IsLocType(T) || T->isIntegerType()) { |
Zhongxing Xu | 1789275 | 2008-10-08 02:50:44 +0000 | [diff] [blame] | 190 | // Initialize globals and parameters to symbolic values. |
| 191 | // Initialize local variables to undefined. |
Zhongxing Xu | 1c96b24 | 2008-10-17 05:57:07 +0000 | [diff] [blame] | 192 | SVal X = (VD->hasGlobalStorage() || isa<ParmVarDecl>(VD) || |
Zhongxing Xu | 1789275 | 2008-10-08 02:50:44 +0000 | [diff] [blame] | 193 | isa<ImplicitParamDecl>(VD)) |
Zhongxing Xu | 1c96b24 | 2008-10-17 05:57:07 +0000 | [diff] [blame] | 194 | ? SVal::GetSymbolValue(StateMgr.getSymbolManager(), VD) |
Zhongxing Xu | 1789275 | 2008-10-08 02:50:44 +0000 | [diff] [blame] | 195 | : UndefinedVal(); |
| 196 | |
Zhongxing Xu | 8485ec6 | 2008-10-21 06:27:32 +0000 | [diff] [blame] | 197 | St = Bind(St, getVarLoc(VD), X); |
Zhongxing Xu | 1789275 | 2008-10-08 02:50:44 +0000 | [diff] [blame] | 198 | } |
| 199 | } |
| 200 | } |
| 201 | return St; |
| 202 | } |
Zhongxing Xu | 53bcdd4 | 2008-10-21 05:29:26 +0000 | [diff] [blame] | 203 | |
| 204 | Store RegionStoreManager::AddDecl(Store store, |
| 205 | const VarDecl* VD, Expr* Ex, |
| 206 | SVal InitVal, unsigned Count) { |
| 207 | BasicValueFactory& BasicVals = StateMgr.getBasicVals(); |
| 208 | SymbolManager& SymMgr = StateMgr.getSymbolManager(); |
| 209 | |
| 210 | if (VD->hasGlobalStorage()) { |
| 211 | // Static global variables should not be visited here. |
| 212 | assert(!(VD->getStorageClass() == VarDecl::Static && |
| 213 | VD->isFileVarDecl())); |
| 214 | // Process static variables. |
| 215 | if (VD->getStorageClass() == VarDecl::Static) { |
| 216 | if (!Ex) { |
| 217 | // Only handle pointer and integer static variables. |
| 218 | |
| 219 | QualType T = VD->getType(); |
| 220 | |
| 221 | if (Loc::IsLocType(T)) |
Zhongxing Xu | 8485ec6 | 2008-10-21 06:27:32 +0000 | [diff] [blame] | 222 | store = Bind(store, getVarLoc(VD), |
| 223 | loc::ConcreteInt(BasicVals.getValue(0, T))); |
Zhongxing Xu | 53bcdd4 | 2008-10-21 05:29:26 +0000 | [diff] [blame] | 224 | |
| 225 | else if (T->isIntegerType()) |
Zhongxing Xu | 8485ec6 | 2008-10-21 06:27:32 +0000 | [diff] [blame] | 226 | store = Bind(store, getVarLoc(VD), |
| 227 | loc::ConcreteInt(BasicVals.getValue(0, T))); |
Zhongxing Xu | 53bcdd4 | 2008-10-21 05:29:26 +0000 | [diff] [blame] | 228 | else |
| 229 | assert("ignore other types of variables"); |
| 230 | } else { |
Zhongxing Xu | 8485ec6 | 2008-10-21 06:27:32 +0000 | [diff] [blame] | 231 | store = Bind(store, getVarLoc(VD), InitVal); |
Zhongxing Xu | 53bcdd4 | 2008-10-21 05:29:26 +0000 | [diff] [blame] | 232 | } |
| 233 | } |
| 234 | } else { |
| 235 | // Process local variables. |
| 236 | |
| 237 | QualType T = VD->getType(); |
| 238 | |
| 239 | if (Loc::IsLocType(T) || T->isIntegerType()) { |
| 240 | SVal V = Ex ? InitVal : UndefinedVal(); |
| 241 | if (Ex && InitVal.isUnknown()) { |
| 242 | // "Conjured" symbols. |
| 243 | SymbolID Sym = SymMgr.getConjuredSymbol(Ex, Count); |
| 244 | V = Loc::IsLocType(Ex->getType()) |
| 245 | ? cast<SVal>(loc::SymbolVal(Sym)) |
| 246 | : cast<SVal>(nonloc::SymbolVal(Sym)); |
| 247 | } |
Zhongxing Xu | 8485ec6 | 2008-10-21 06:27:32 +0000 | [diff] [blame] | 248 | store = Bind(store, getVarLoc(VD), V); |
Zhongxing Xu | 53bcdd4 | 2008-10-21 05:29:26 +0000 | [diff] [blame] | 249 | |
| 250 | } else if (T->isArrayType()) { |
| 251 | // Only handle constant size array. |
| 252 | if (ConstantArrayType* CAT=dyn_cast<ConstantArrayType>(T.getTypePtr())) { |
| 253 | |
| 254 | llvm::APInt Size = CAT->getSize(); |
| 255 | |
| 256 | for (llvm::APInt i = llvm::APInt::getNullValue(Size.getBitWidth()); |
| 257 | i != Size; ++i) { |
| 258 | nonloc::ConcreteInt Idx(BasicVals.getValue(llvm::APSInt(i))); |
Zhongxing Xu | 8485ec6 | 2008-10-21 06:27:32 +0000 | [diff] [blame] | 259 | store = Bind(store, getElementLoc(VD, Idx), UndefinedVal()); |
Zhongxing Xu | 53bcdd4 | 2008-10-21 05:29:26 +0000 | [diff] [blame] | 260 | } |
| 261 | } |
| 262 | } else if (T->isStructureType()) { |
| 263 | // FIXME: Implement struct initialization. |
| 264 | } |
| 265 | } |
| 266 | return store; |
| 267 | } |
| 268 | |