Ted Kremenek | 50df4f4 | 2008-02-14 22:13:12 +0000 | [diff] [blame] | 1 | //=-- GRExprEngine.cpp - Path-Sensitive Expression-Level Dataflow ---*- C++ -*-= |
Ted Kremenek | c48b8e4 | 2008-01-31 02:35:41 +0000 | [diff] [blame] | 2 | // |
Ted Kremenek | 2e16060 | 2008-01-31 06:49:09 +0000 | [diff] [blame] | 3 | // The LLVM Compiler Infrastructure |
Ted Kremenek | 68d70a8 | 2008-01-15 23:55:06 +0000 | [diff] [blame] | 4 | // |
| 5 | // This file is distributed under the University of Illinois Open Source |
| 6 | // License. See LICENSE.TXT for details. |
| 7 | // |
| 8 | //===----------------------------------------------------------------------===// |
| 9 | // |
Ted Kremenek | 50df4f4 | 2008-02-14 22:13:12 +0000 | [diff] [blame] | 10 | // This file defines a meta-engine for path-sensitive dataflow analysis that |
| 11 | // is built on GREngine, but provides the boilerplate to execute transfer |
| 12 | // functions and build the ExplodedGraph at the expression level. |
Ted Kremenek | 68d70a8 | 2008-01-15 23:55:06 +0000 | [diff] [blame] | 13 | // |
| 14 | //===----------------------------------------------------------------------===// |
| 15 | |
Ted Kremenek | 50df4f4 | 2008-02-14 22:13:12 +0000 | [diff] [blame] | 16 | #include "clang/Analysis/PathSensitive/GRExprEngine.h" |
Ted Kremenek | 3862eb1 | 2008-02-14 22:36:46 +0000 | [diff] [blame] | 17 | #include "clang/Analysis/PathSensitive/GRTransferFuncs.h" |
| 18 | |
| 19 | #include "llvm/Support/Streams.h" |
Ted Kremenek | d446743 | 2008-02-14 22:16:04 +0000 | [diff] [blame] | 20 | |
| 21 | using namespace clang; |
| 22 | using llvm::dyn_cast; |
| 23 | using llvm::cast; |
| 24 | using llvm::APSInt; |
Ted Kremenek | f031b87 | 2008-01-23 19:59:44 +0000 | [diff] [blame] | 25 | |
Ted Kremenek | 30fa28b | 2008-02-13 17:41:41 +0000 | [diff] [blame] | 26 | GRExprEngine::StateTy |
| 27 | GRExprEngine::SetValue(StateTy St, Expr* S, const RValue& V) { |
Ted Kremenek | 9b32cd0 | 2008-02-07 04:16:04 +0000 | [diff] [blame] | 28 | |
Ted Kremenek | 7f5ebc7 | 2008-02-04 21:59:01 +0000 | [diff] [blame] | 29 | if (!StateCleaned) { |
| 30 | St = RemoveDeadBindings(CurrentStmt, St); |
| 31 | StateCleaned = true; |
| 32 | } |
Ted Kremenek | 9b32cd0 | 2008-02-07 04:16:04 +0000 | [diff] [blame] | 33 | |
Ted Kremenek | 7f5ebc7 | 2008-02-04 21:59:01 +0000 | [diff] [blame] | 34 | bool isBlkExpr = false; |
Ted Kremenek | 9b32cd0 | 2008-02-07 04:16:04 +0000 | [diff] [blame] | 35 | |
Ted Kremenek | 7f5ebc7 | 2008-02-04 21:59:01 +0000 | [diff] [blame] | 36 | if (S == CurrentStmt) { |
| 37 | isBlkExpr = getCFG().isBlkExpr(S); |
| 38 | |
| 39 | if (!isBlkExpr) |
| 40 | return St; |
| 41 | } |
Ted Kremenek | 9b32cd0 | 2008-02-07 04:16:04 +0000 | [diff] [blame] | 42 | |
Ted Kremenek | 7f5ebc7 | 2008-02-04 21:59:01 +0000 | [diff] [blame] | 43 | return StateMgr.SetValue(St, S, isBlkExpr, V); |
| 44 | } |
| 45 | |
Ted Kremenek | 30fa28b | 2008-02-13 17:41:41 +0000 | [diff] [blame] | 46 | const GRExprEngine::StateTy::BufferTy& |
| 47 | GRExprEngine::SetValue(StateTy St, Expr* S, const RValue::BufferTy& RB, |
Ted Kremenek | f20c201 | 2008-02-05 19:35:18 +0000 | [diff] [blame] | 48 | StateTy::BufferTy& RetBuf) { |
| 49 | |
| 50 | assert (RetBuf.empty()); |
| 51 | |
| 52 | for (RValue::BufferTy::const_iterator I=RB.begin(), E=RB.end(); I!=E; ++I) |
| 53 | RetBuf.push_back(SetValue(St, S, *I)); |
| 54 | |
| 55 | return RetBuf; |
| 56 | } |
| 57 | |
Ted Kremenek | 30fa28b | 2008-02-13 17:41:41 +0000 | [diff] [blame] | 58 | GRExprEngine::StateTy |
| 59 | GRExprEngine::SetValue(StateTy St, const LValue& LV, const RValue& V) { |
Ted Kremenek | 7f5ebc7 | 2008-02-04 21:59:01 +0000 | [diff] [blame] | 60 | |
Ted Kremenek | 0428e02 | 2008-02-08 03:02:48 +0000 | [diff] [blame] | 61 | if (LV.isUnknown()) |
Ted Kremenek | 7f5ebc7 | 2008-02-04 21:59:01 +0000 | [diff] [blame] | 62 | return St; |
| 63 | |
| 64 | if (!StateCleaned) { |
| 65 | St = RemoveDeadBindings(CurrentStmt, St); |
| 66 | StateCleaned = true; |
| 67 | } |
| 68 | |
| 69 | return StateMgr.SetValue(St, LV, V); |
| 70 | } |
| 71 | |
Ted Kremenek | 30fa28b | 2008-02-13 17:41:41 +0000 | [diff] [blame] | 72 | void GRExprEngine::ProcessBranch(Expr* Condition, Stmt* Term, |
Ted Kremenek | 6ff3cea | 2008-01-29 23:32:35 +0000 | [diff] [blame] | 73 | BranchNodeBuilder& builder) { |
Ted Kremenek | 9096097 | 2008-01-30 23:03:39 +0000 | [diff] [blame] | 74 | |
Ted Kremenek | 17c5f11 | 2008-02-11 19:21:59 +0000 | [diff] [blame] | 75 | // Remove old bindings for subexpressions. |
| 76 | StateTy PrevState = StateMgr.RemoveSubExprBindings(builder.getState()); |
Ted Kremenek | 1f0eb99 | 2008-02-05 00:26:40 +0000 | [diff] [blame] | 77 | |
Ted Kremenek | 9096097 | 2008-01-30 23:03:39 +0000 | [diff] [blame] | 78 | RValue V = GetValue(PrevState, Condition); |
| 79 | |
| 80 | switch (V.getBaseKind()) { |
| 81 | default: |
| 82 | break; |
| 83 | |
Ted Kremenek | 0428e02 | 2008-02-08 03:02:48 +0000 | [diff] [blame] | 84 | case RValue::UnknownKind: |
Ted Kremenek | 9096097 | 2008-01-30 23:03:39 +0000 | [diff] [blame] | 85 | builder.generateNode(PrevState, true); |
| 86 | builder.generateNode(PrevState, false); |
| 87 | return; |
| 88 | |
| 89 | case RValue::UninitializedKind: { |
| 90 | NodeTy* N = builder.generateNode(PrevState, true); |
| 91 | |
| 92 | if (N) { |
| 93 | N->markAsSink(); |
| 94 | UninitBranches.insert(N); |
| 95 | } |
| 96 | |
| 97 | builder.markInfeasible(false); |
| 98 | return; |
| 99 | } |
| 100 | } |
| 101 | |
Ted Kremenek | 4b170e5 | 2008-02-12 18:08:17 +0000 | [diff] [blame] | 102 | // Get the current block counter. |
| 103 | GRBlockCounter BC = builder.getBlockCounter(); |
| 104 | |
Ted Kremenek | fd85f29 | 2008-02-12 19:49:57 +0000 | [diff] [blame] | 105 | unsigned BlockID = builder.getTargetBlock(true)->getBlockID(); |
| 106 | unsigned NumVisited = BC.getNumVisited(BlockID); |
Ted Kremenek | 1f0eb99 | 2008-02-05 00:26:40 +0000 | [diff] [blame] | 107 | |
Ted Kremenek | 4b170e5 | 2008-02-12 18:08:17 +0000 | [diff] [blame] | 108 | if (isa<nonlval::ConcreteInt>(V) || |
| 109 | BC.getNumVisited(builder.getTargetBlock(true)->getBlockID()) < 1) { |
| 110 | |
| 111 | // Process the true branch. |
Ted Kremenek | 9096097 | 2008-01-30 23:03:39 +0000 | [diff] [blame] | 112 | |
Ted Kremenek | 4b170e5 | 2008-02-12 18:08:17 +0000 | [diff] [blame] | 113 | bool isFeasible = true; |
| 114 | |
| 115 | StateTy St = Assume(PrevState, V, true, isFeasible); |
| 116 | |
| 117 | if (isFeasible) |
| 118 | builder.generateNode(St, true); |
| 119 | else |
| 120 | builder.markInfeasible(true); |
Ted Kremenek | 9096097 | 2008-01-30 23:03:39 +0000 | [diff] [blame] | 121 | } |
Ted Kremenek | 4b170e5 | 2008-02-12 18:08:17 +0000 | [diff] [blame] | 122 | else |
| 123 | builder.markInfeasible(true); |
Ted Kremenek | 9096097 | 2008-01-30 23:03:39 +0000 | [diff] [blame] | 124 | |
Ted Kremenek | fd85f29 | 2008-02-12 19:49:57 +0000 | [diff] [blame] | 125 | BlockID = builder.getTargetBlock(false)->getBlockID(); |
| 126 | NumVisited = BC.getNumVisited(BlockID); |
Ted Kremenek | 9096097 | 2008-01-30 23:03:39 +0000 | [diff] [blame] | 127 | |
Ted Kremenek | 4b170e5 | 2008-02-12 18:08:17 +0000 | [diff] [blame] | 128 | if (isa<nonlval::ConcreteInt>(V) || |
| 129 | BC.getNumVisited(builder.getTargetBlock(false)->getBlockID()) < 1) { |
| 130 | |
| 131 | // Process the false branch. |
| 132 | |
| 133 | bool isFeasible = false; |
| 134 | |
| 135 | StateTy St = Assume(PrevState, V, false, isFeasible); |
| 136 | |
| 137 | if (isFeasible) |
| 138 | builder.generateNode(St, false); |
| 139 | else |
| 140 | builder.markInfeasible(false); |
| 141 | } |
Ted Kremenek | 1f0eb99 | 2008-02-05 00:26:40 +0000 | [diff] [blame] | 142 | else |
| 143 | builder.markInfeasible(false); |
Ted Kremenek | 6ff3cea | 2008-01-29 23:32:35 +0000 | [diff] [blame] | 144 | } |
| 145 | |
Ted Kremenek | 30fa28b | 2008-02-13 17:41:41 +0000 | [diff] [blame] | 146 | /// ProcessIndirectGoto - Called by GRCoreEngine. Used to generate successor |
Ted Kremenek | 677f4ef | 2008-02-13 00:24:44 +0000 | [diff] [blame] | 147 | /// nodes by processing the 'effects' of a computed goto jump. |
Ted Kremenek | 30fa28b | 2008-02-13 17:41:41 +0000 | [diff] [blame] | 148 | void GRExprEngine::ProcessIndirectGoto(IndirectGotoNodeBuilder& builder) { |
Ted Kremenek | 677f4ef | 2008-02-13 00:24:44 +0000 | [diff] [blame] | 149 | |
| 150 | StateTy St = builder.getState(); |
| 151 | LValue V = cast<LValue>(GetValue(St, builder.getTarget())); |
| 152 | |
| 153 | // Three possibilities: |
| 154 | // |
| 155 | // (1) We know the computed label. |
| 156 | // (2) The label is NULL (or some other constant), or Uninitialized. |
| 157 | // (3) We have no clue about the label. Dispatch to all targets. |
| 158 | // |
| 159 | |
| 160 | typedef IndirectGotoNodeBuilder::iterator iterator; |
| 161 | |
| 162 | if (isa<lval::GotoLabel>(V)) { |
| 163 | LabelStmt* L = cast<lval::GotoLabel>(V).getLabel(); |
| 164 | |
| 165 | for (iterator I=builder.begin(), E=builder.end(); I != E; ++I) { |
Ted Kremenek | 79f63f5 | 2008-02-13 17:27:37 +0000 | [diff] [blame] | 166 | if (I.getLabel() == L) { |
| 167 | builder.generateNode(I, St); |
Ted Kremenek | 677f4ef | 2008-02-13 00:24:44 +0000 | [diff] [blame] | 168 | return; |
| 169 | } |
| 170 | } |
| 171 | |
| 172 | assert (false && "No block with label."); |
| 173 | return; |
| 174 | } |
| 175 | |
| 176 | if (isa<lval::ConcreteInt>(V) || isa<UninitializedVal>(V)) { |
| 177 | // Dispatch to the first target and mark it as a sink. |
Ted Kremenek | 79f63f5 | 2008-02-13 17:27:37 +0000 | [diff] [blame] | 178 | NodeTy* N = builder.generateNode(builder.begin(), St, true); |
Ted Kremenek | 677f4ef | 2008-02-13 00:24:44 +0000 | [diff] [blame] | 179 | UninitBranches.insert(N); |
| 180 | return; |
| 181 | } |
| 182 | |
| 183 | // This is really a catch-all. We don't support symbolics yet. |
| 184 | |
| 185 | assert (isa<UnknownVal>(V)); |
| 186 | |
| 187 | for (iterator I=builder.begin(), E=builder.end(); I != E; ++I) |
Ted Kremenek | 79f63f5 | 2008-02-13 17:27:37 +0000 | [diff] [blame] | 188 | builder.generateNode(I, St); |
Ted Kremenek | 677f4ef | 2008-02-13 00:24:44 +0000 | [diff] [blame] | 189 | } |
Ted Kremenek | 1f0eb99 | 2008-02-05 00:26:40 +0000 | [diff] [blame] | 190 | |
Ted Kremenek | aee121c | 2008-02-13 23:08:21 +0000 | [diff] [blame] | 191 | /// ProcessSwitch - Called by GRCoreEngine. Used to generate successor |
| 192 | /// nodes by processing the 'effects' of a switch statement. |
| 193 | void GRExprEngine::ProcessSwitch(SwitchNodeBuilder& builder) { |
| 194 | |
| 195 | typedef SwitchNodeBuilder::iterator iterator; |
| 196 | |
| 197 | StateTy St = builder.getState(); |
| 198 | NonLValue CondV = cast<NonLValue>(GetValue(St, builder.getCondition())); |
| 199 | |
| 200 | if (isa<UninitializedVal>(CondV)) { |
| 201 | NodeTy* N = builder.generateDefaultCaseNode(St, true); |
| 202 | UninitBranches.insert(N); |
| 203 | return; |
| 204 | } |
| 205 | |
| 206 | StateTy DefaultSt = St; |
| 207 | |
| 208 | // While most of this can be assumed (such as the signedness), having it |
| 209 | // just computed makes sure everything makes the same assumptions end-to-end. |
| 210 | unsigned bits = getContext().getTypeSize(getContext().IntTy,SourceLocation()); |
| 211 | APSInt V1(bits, false); |
| 212 | APSInt V2 = V1; |
| 213 | |
| 214 | for (iterator I=builder.begin(), E=builder.end(); I!=E; ++I) { |
| 215 | |
| 216 | CaseStmt* Case = cast<CaseStmt>(I.getCase()); |
| 217 | |
| 218 | // Evaluate the case. |
| 219 | if (!Case->getLHS()->isIntegerConstantExpr(V1, getContext(), 0, true)) { |
| 220 | assert (false && "Case condition must evaluate to an integer constant."); |
| 221 | return; |
| 222 | } |
| 223 | |
| 224 | // Get the RHS of the case, if it exists. |
| 225 | |
| 226 | if (Expr* E = Case->getRHS()) { |
| 227 | if (!E->isIntegerConstantExpr(V2, getContext(), 0, true)) { |
| 228 | assert (false && |
| 229 | "Case condition (RHS) must evaluate to an integer constant."); |
| 230 | return ; |
| 231 | } |
| 232 | |
| 233 | assert (V1 <= V2); |
| 234 | } |
| 235 | else V2 = V1; |
| 236 | |
| 237 | // FIXME: Eventually we should replace the logic below with a range |
| 238 | // comparison, rather than concretize the values within the range. |
| 239 | // This should be easy once we have "ranges" for NonLValues. |
| 240 | |
| 241 | do { |
| 242 | nonlval::ConcreteInt CaseVal(ValMgr.getValue(V1)); |
| 243 | |
Ted Kremenek | b193413 | 2008-02-14 19:37:24 +0000 | [diff] [blame] | 244 | NonLValue Res = EvalBinaryOp(ValMgr, BinaryOperator::EQ, CondV, CaseVal); |
Ted Kremenek | aee121c | 2008-02-13 23:08:21 +0000 | [diff] [blame] | 245 | |
| 246 | // Now "assume" that the case matches. |
| 247 | bool isFeasible; |
| 248 | |
Ted Kremenek | b193413 | 2008-02-14 19:37:24 +0000 | [diff] [blame] | 249 | StateTy StNew = Assume(St, Res, true, isFeasible); |
Ted Kremenek | aee121c | 2008-02-13 23:08:21 +0000 | [diff] [blame] | 250 | |
| 251 | if (isFeasible) { |
| 252 | builder.generateCaseStmtNode(I, StNew); |
| 253 | |
| 254 | // If CondV evaluates to a constant, then we know that this |
| 255 | // is the *only* case that we can take, so stop evaluating the |
| 256 | // others. |
| 257 | if (isa<nonlval::ConcreteInt>(CondV)) |
| 258 | return; |
| 259 | } |
| 260 | |
| 261 | // Now "assume" that the case doesn't match. Add this state |
| 262 | // to the default state (if it is feasible). |
| 263 | |
Ted Kremenek | b193413 | 2008-02-14 19:37:24 +0000 | [diff] [blame] | 264 | StNew = Assume(DefaultSt, Res, false, isFeasible); |
Ted Kremenek | aee121c | 2008-02-13 23:08:21 +0000 | [diff] [blame] | 265 | |
| 266 | if (isFeasible) |
| 267 | DefaultSt = StNew; |
| 268 | |
| 269 | // Concretize the next value in the range. |
| 270 | ++V1; |
| 271 | |
| 272 | } while (V1 < V2); |
| 273 | } |
| 274 | |
| 275 | // If we reach here, than we know that the default branch is |
| 276 | // possible. |
| 277 | builder.generateDefaultCaseNode(DefaultSt); |
| 278 | } |
| 279 | |
| 280 | |
Ted Kremenek | 30fa28b | 2008-02-13 17:41:41 +0000 | [diff] [blame] | 281 | void GRExprEngine::VisitLogicalExpr(BinaryOperator* B, NodeTy* Pred, |
Ted Kremenek | 1f0eb99 | 2008-02-05 00:26:40 +0000 | [diff] [blame] | 282 | NodeSet& Dst) { |
| 283 | |
| 284 | bool hasR2; |
| 285 | StateTy PrevState = Pred->getState(); |
| 286 | |
| 287 | RValue R1 = GetValue(PrevState, B->getLHS()); |
| 288 | RValue R2 = GetValue(PrevState, B->getRHS(), hasR2); |
| 289 | |
Ted Kremenek | adec14b | 2008-02-08 02:57:34 +0000 | [diff] [blame] | 290 | if (isa<UnknownVal>(R1) && |
| 291 | (isa<UnknownVal>(R2) || |
| 292 | isa<UninitializedVal>(R2))) { |
Ted Kremenek | 1f0eb99 | 2008-02-05 00:26:40 +0000 | [diff] [blame] | 293 | |
| 294 | Nodify(Dst, B, Pred, SetValue(PrevState, B, R2)); |
| 295 | return; |
| 296 | } |
Ted Kremenek | adec14b | 2008-02-08 02:57:34 +0000 | [diff] [blame] | 297 | else if (isa<UninitializedVal>(R1)) { |
Ted Kremenek | 1f0eb99 | 2008-02-05 00:26:40 +0000 | [diff] [blame] | 298 | Nodify(Dst, B, Pred, SetValue(PrevState, B, R1)); |
| 299 | return; |
| 300 | } |
| 301 | |
| 302 | // R1 is an expression that can evaluate to either 'true' or 'false'. |
| 303 | if (B->getOpcode() == BinaryOperator::LAnd) { |
| 304 | // hasR2 == 'false' means that LHS evaluated to 'false' and that |
| 305 | // we short-circuited, leading to a value of '0' for the '&&' expression. |
| 306 | if (hasR2 == false) { |
| 307 | Nodify(Dst, B, Pred, SetValue(PrevState, B, GetRValueConstant(0U, B))); |
| 308 | return; |
| 309 | } |
| 310 | } |
| 311 | else { |
| 312 | assert (B->getOpcode() == BinaryOperator::LOr); |
| 313 | // hasR2 == 'false' means that the LHS evaluate to 'true' and that |
| 314 | // we short-circuited, leading to a value of '1' for the '||' expression. |
| 315 | if (hasR2 == false) { |
| 316 | Nodify(Dst, B, Pred, SetValue(PrevState, B, GetRValueConstant(1U, B))); |
| 317 | return; |
| 318 | } |
| 319 | } |
| 320 | |
| 321 | // If we reach here we did not short-circuit. Assume R2 == true and |
| 322 | // R2 == false. |
| 323 | |
| 324 | bool isFeasible; |
| 325 | StateTy St = Assume(PrevState, R2, true, isFeasible); |
| 326 | |
| 327 | if (isFeasible) |
| 328 | Nodify(Dst, B, Pred, SetValue(PrevState, B, GetRValueConstant(1U, B))); |
| 329 | |
| 330 | St = Assume(PrevState, R2, false, isFeasible); |
| 331 | |
| 332 | if (isFeasible) |
| 333 | Nodify(Dst, B, Pred, SetValue(PrevState, B, GetRValueConstant(0U, B))); |
| 334 | } |
| 335 | |
| 336 | |
| 337 | |
Ted Kremenek | 30fa28b | 2008-02-13 17:41:41 +0000 | [diff] [blame] | 338 | void GRExprEngine::ProcessStmt(Stmt* S, StmtNodeBuilder& builder) { |
Ted Kremenek | 68d70a8 | 2008-01-15 23:55:06 +0000 | [diff] [blame] | 339 | Builder = &builder; |
Ted Kremenek | f031b87 | 2008-01-23 19:59:44 +0000 | [diff] [blame] | 340 | |
| 341 | StmtEntryNode = builder.getLastNode(); |
| 342 | CurrentStmt = S; |
| 343 | NodeSet Dst; |
| 344 | StateCleaned = false; |
| 345 | |
| 346 | Visit(S, StmtEntryNode, Dst); |
| 347 | |
| 348 | // If no nodes were generated, generate a new node that has all the |
| 349 | // dead mappings removed. |
| 350 | if (Dst.size() == 1 && *Dst.begin() == StmtEntryNode) { |
| 351 | StateTy St = RemoveDeadBindings(S, StmtEntryNode->getState()); |
| 352 | builder.generateNode(S, St, StmtEntryNode); |
| 353 | } |
Ted Kremenek | a57214f | 2008-01-18 00:41:32 +0000 | [diff] [blame] | 354 | |
Ted Kremenek | f031b87 | 2008-01-23 19:59:44 +0000 | [diff] [blame] | 355 | CurrentStmt = NULL; |
| 356 | StmtEntryNode = NULL; |
| 357 | Builder = NULL; |
Ted Kremenek | 68d70a8 | 2008-01-15 23:55:06 +0000 | [diff] [blame] | 358 | } |
| 359 | |
Ted Kremenek | 30fa28b | 2008-02-13 17:41:41 +0000 | [diff] [blame] | 360 | GRExprEngine::NodeTy* |
| 361 | GRExprEngine::Nodify(NodeSet& Dst, Stmt* S, NodeTy* Pred, StateTy St) { |
Ted Kremenek | f031b87 | 2008-01-23 19:59:44 +0000 | [diff] [blame] | 362 | |
| 363 | // If the state hasn't changed, don't generate a new node. |
Ted Kremenek | 02b5b40 | 2008-02-07 15:20:13 +0000 | [diff] [blame] | 364 | if (St == Pred->getState()) |
Ted Kremenek | 80d52d0 | 2008-02-07 05:48:01 +0000 | [diff] [blame] | 365 | return NULL; |
Ted Kremenek | afba4b2 | 2008-01-16 00:53:15 +0000 | [diff] [blame] | 366 | |
Ted Kremenek | 80d52d0 | 2008-02-07 05:48:01 +0000 | [diff] [blame] | 367 | NodeTy* N = Builder->generateNode(S, St, Pred); |
| 368 | Dst.Add(N); |
| 369 | return N; |
Ted Kremenek | afba4b2 | 2008-01-16 00:53:15 +0000 | [diff] [blame] | 370 | } |
Ted Kremenek | 68d70a8 | 2008-01-15 23:55:06 +0000 | [diff] [blame] | 371 | |
Ted Kremenek | 30fa28b | 2008-02-13 17:41:41 +0000 | [diff] [blame] | 372 | void GRExprEngine::Nodify(NodeSet& Dst, Stmt* S, NodeTy* Pred, |
Ted Kremenek | f20c201 | 2008-02-05 19:35:18 +0000 | [diff] [blame] | 373 | const StateTy::BufferTy& SB) { |
| 374 | |
| 375 | for (StateTy::BufferTy::const_iterator I=SB.begin(), E=SB.end(); I!=E; ++I) |
| 376 | Nodify(Dst, S, Pred, *I); |
| 377 | } |
| 378 | |
Ted Kremenek | 6d40992 | 2008-02-13 18:06:44 +0000 | [diff] [blame] | 379 | void GRExprEngine::VisitDeclRefExpr(DeclRefExpr* D, NodeTy* Pred, NodeSet& Dst){ |
Ted Kremenek | 9b32cd0 | 2008-02-07 04:16:04 +0000 | [diff] [blame] | 380 | if (D != CurrentStmt) { |
| 381 | Dst.Add(Pred); // No-op. Simply propagate the current state unchanged. |
| 382 | return; |
| 383 | } |
| 384 | |
| 385 | // If we are here, we are loading the value of the decl and binding |
| 386 | // it to the block-level expression. |
| 387 | |
| 388 | StateTy St = Pred->getState(); |
| 389 | |
| 390 | Nodify(Dst, D, Pred, |
| 391 | SetValue(St, D, GetValue(St, lval::DeclVal(D->getDecl())))); |
| 392 | } |
| 393 | |
Ted Kremenek | 30fa28b | 2008-02-13 17:41:41 +0000 | [diff] [blame] | 394 | void GRExprEngine::VisitCast(Expr* CastE, Expr* E, NodeTy* Pred, NodeSet& Dst) { |
Ted Kremenek | 54eddae | 2008-01-24 02:02:54 +0000 | [diff] [blame] | 395 | |
| 396 | QualType T = CastE->getType(); |
| 397 | |
| 398 | // Check for redundant casts. |
| 399 | if (E->getType() == T) { |
| 400 | Dst.Add(Pred); |
| 401 | return; |
| 402 | } |
| 403 | |
| 404 | NodeSet S1; |
| 405 | Visit(E, Pred, S1); |
| 406 | |
| 407 | for (NodeSet::iterator I1=S1.begin(), E1=S1.end(); I1 != E1; ++I1) { |
| 408 | NodeTy* N = *I1; |
| 409 | StateTy St = N->getState(); |
Ted Kremenek | 0922ec8 | 2008-01-28 22:09:13 +0000 | [diff] [blame] | 410 | const RValue& V = GetValue(St, E); |
Ted Kremenek | 25a484d | 2008-02-14 18:28:23 +0000 | [diff] [blame] | 411 | Nodify(Dst, CastE, N, SetValue(St, CastE, EvalCast(ValMgr, V, CastE))); |
Ted Kremenek | 54eddae | 2008-01-24 02:02:54 +0000 | [diff] [blame] | 412 | } |
Ted Kremenek | b9c30e3 | 2008-01-24 20:55:43 +0000 | [diff] [blame] | 413 | } |
| 414 | |
Ted Kremenek | 30fa28b | 2008-02-13 17:41:41 +0000 | [diff] [blame] | 415 | void GRExprEngine::VisitDeclStmt(DeclStmt* DS, GRExprEngine::NodeTy* Pred, |
| 416 | GRExprEngine::NodeSet& Dst) { |
Ted Kremenek | b9c30e3 | 2008-01-24 20:55:43 +0000 | [diff] [blame] | 417 | |
| 418 | StateTy St = Pred->getState(); |
| 419 | |
| 420 | for (const ScopedDecl* D = DS->getDecl(); D; D = D->getNextDeclarator()) |
Ted Kremenek | 8c9bc34 | 2008-01-28 22:51:57 +0000 | [diff] [blame] | 421 | if (const VarDecl* VD = dyn_cast<VarDecl>(D)) { |
| 422 | const Expr* E = VD->getInit(); |
Ted Kremenek | 1b63a3b | 2008-02-05 21:52:21 +0000 | [diff] [blame] | 423 | St = SetValue(St, lval::DeclVal(VD), |
Ted Kremenek | adec14b | 2008-02-08 02:57:34 +0000 | [diff] [blame] | 424 | E ? GetValue(St, E) : UninitializedVal()); |
Ted Kremenek | 8c9bc34 | 2008-01-28 22:51:57 +0000 | [diff] [blame] | 425 | } |
Ted Kremenek | b9c30e3 | 2008-01-24 20:55:43 +0000 | [diff] [blame] | 426 | |
| 427 | Nodify(Dst, DS, Pred, St); |
| 428 | |
| 429 | if (Dst.empty()) |
| 430 | Dst.Add(Pred); |
| 431 | } |
Ted Kremenek | 54eddae | 2008-01-24 02:02:54 +0000 | [diff] [blame] | 432 | |
Ted Kremenek | 1f0eb99 | 2008-02-05 00:26:40 +0000 | [diff] [blame] | 433 | |
Ted Kremenek | 30fa28b | 2008-02-13 17:41:41 +0000 | [diff] [blame] | 434 | void GRExprEngine::VisitGuardedExpr(Expr* S, Expr* LHS, Expr* RHS, |
Ted Kremenek | 1f0eb99 | 2008-02-05 00:26:40 +0000 | [diff] [blame] | 435 | NodeTy* Pred, NodeSet& Dst) { |
| 436 | |
| 437 | StateTy St = Pred->getState(); |
| 438 | |
| 439 | RValue R = GetValue(St, LHS); |
Ted Kremenek | adec14b | 2008-02-08 02:57:34 +0000 | [diff] [blame] | 440 | if (isa<UnknownVal>(R)) R = GetValue(St, RHS); |
Ted Kremenek | 1f0eb99 | 2008-02-05 00:26:40 +0000 | [diff] [blame] | 441 | |
| 442 | Nodify(Dst, S, Pred, SetValue(St, S, R)); |
| 443 | } |
| 444 | |
Ted Kremenek | fd85f29 | 2008-02-12 19:49:57 +0000 | [diff] [blame] | 445 | /// VisitSizeOfAlignOfTypeExpr - Transfer function for sizeof(type). |
Ted Kremenek | 30fa28b | 2008-02-13 17:41:41 +0000 | [diff] [blame] | 446 | void GRExprEngine::VisitSizeOfAlignOfTypeExpr(SizeOfAlignOfTypeExpr* S, |
Ted Kremenek | fd85f29 | 2008-02-12 19:49:57 +0000 | [diff] [blame] | 447 | NodeTy* Pred, |
| 448 | NodeSet& Dst) { |
| 449 | |
| 450 | // 6.5.3.4 sizeof: "The result type is an integer." |
| 451 | |
| 452 | QualType T = S->getArgumentType(); |
| 453 | |
| 454 | // FIXME: Add support for VLAs. |
| 455 | if (isa<VariableArrayType>(T.getTypePtr())) |
| 456 | return; |
| 457 | |
| 458 | SourceLocation L = S->getExprLoc(); |
| 459 | uint64_t size = getContext().getTypeSize(T, L) / 8; |
| 460 | |
| 461 | Nodify(Dst, S, Pred, |
| 462 | SetValue(Pred->getState(), S, |
| 463 | NonLValue::GetValue(ValMgr, size, getContext().IntTy, L))); |
| 464 | |
| 465 | } |
| 466 | |
Ted Kremenek | 30fa28b | 2008-02-13 17:41:41 +0000 | [diff] [blame] | 467 | void GRExprEngine::VisitUnaryOperator(UnaryOperator* U, |
| 468 | GRExprEngine::NodeTy* Pred, |
| 469 | GRExprEngine::NodeSet& Dst) { |
Ted Kremenek | 9b32cd0 | 2008-02-07 04:16:04 +0000 | [diff] [blame] | 470 | |
Ted Kremenek | 1be5eb9 | 2008-01-24 02:28:56 +0000 | [diff] [blame] | 471 | NodeSet S1; |
Ted Kremenek | 9b32cd0 | 2008-02-07 04:16:04 +0000 | [diff] [blame] | 472 | UnaryOperator::Opcode Op = U->getOpcode(); |
| 473 | |
| 474 | // FIXME: This is a hack so that for '*' and '&' we don't recurse |
| 475 | // on visiting the subexpression if it is a DeclRefExpr. We should |
| 476 | // probably just handle AddrOf and Deref in their own methods to make |
| 477 | // this cleaner. |
| 478 | if ((Op == UnaryOperator::Deref || Op == UnaryOperator::AddrOf) && |
| 479 | isa<DeclRefExpr>(U->getSubExpr())) |
| 480 | S1.Add(Pred); |
| 481 | else |
| 482 | Visit(U->getSubExpr(), Pred, S1); |
Ted Kremenek | 1be5eb9 | 2008-01-24 02:28:56 +0000 | [diff] [blame] | 483 | |
| 484 | for (NodeSet::iterator I1=S1.begin(), E1=S1.end(); I1 != E1; ++I1) { |
| 485 | NodeTy* N1 = *I1; |
| 486 | StateTy St = N1->getState(); |
| 487 | |
| 488 | switch (U->getOpcode()) { |
| 489 | case UnaryOperator::PostInc: { |
| 490 | const LValue& L1 = GetLValue(St, U->getSubExpr()); |
Ted Kremenek | 0922ec8 | 2008-01-28 22:09:13 +0000 | [diff] [blame] | 491 | NonLValue R1 = cast<NonLValue>(GetValue(St, L1)); |
Ted Kremenek | 15cb078 | 2008-02-06 22:50:25 +0000 | [diff] [blame] | 492 | |
Ted Kremenek | b193413 | 2008-02-14 19:37:24 +0000 | [diff] [blame] | 493 | NonLValue Result = EvalBinaryOp(ValMgr, BinaryOperator::Add, |
| 494 | R1, GetRValueConstant(1U, U)); |
Ted Kremenek | 15cb078 | 2008-02-06 22:50:25 +0000 | [diff] [blame] | 495 | |
Ted Kremenek | 1be5eb9 | 2008-01-24 02:28:56 +0000 | [diff] [blame] | 496 | Nodify(Dst, U, N1, SetValue(SetValue(St, U, R1), L1, Result)); |
| 497 | break; |
| 498 | } |
| 499 | |
| 500 | case UnaryOperator::PostDec: { |
| 501 | const LValue& L1 = GetLValue(St, U->getSubExpr()); |
Ted Kremenek | 0922ec8 | 2008-01-28 22:09:13 +0000 | [diff] [blame] | 502 | NonLValue R1 = cast<NonLValue>(GetValue(St, L1)); |
Ted Kremenek | 15cb078 | 2008-02-06 22:50:25 +0000 | [diff] [blame] | 503 | |
Ted Kremenek | b193413 | 2008-02-14 19:37:24 +0000 | [diff] [blame] | 504 | NonLValue Result = EvalBinaryOp(ValMgr, BinaryOperator::Sub, |
| 505 | R1, GetRValueConstant(1U, U)); |
Ted Kremenek | 15cb078 | 2008-02-06 22:50:25 +0000 | [diff] [blame] | 506 | |
Ted Kremenek | 1be5eb9 | 2008-01-24 02:28:56 +0000 | [diff] [blame] | 507 | Nodify(Dst, U, N1, SetValue(SetValue(St, U, R1), L1, Result)); |
| 508 | break; |
| 509 | } |
| 510 | |
| 511 | case UnaryOperator::PreInc: { |
| 512 | const LValue& L1 = GetLValue(St, U->getSubExpr()); |
Ted Kremenek | 0922ec8 | 2008-01-28 22:09:13 +0000 | [diff] [blame] | 513 | NonLValue R1 = cast<NonLValue>(GetValue(St, L1)); |
Ted Kremenek | 15cb078 | 2008-02-06 22:50:25 +0000 | [diff] [blame] | 514 | |
Ted Kremenek | b193413 | 2008-02-14 19:37:24 +0000 | [diff] [blame] | 515 | NonLValue Result = EvalBinaryOp(ValMgr, BinaryOperator::Add, |
| 516 | R1, GetRValueConstant(1U, U)); |
Ted Kremenek | 15cb078 | 2008-02-06 22:50:25 +0000 | [diff] [blame] | 517 | |
Ted Kremenek | 1be5eb9 | 2008-01-24 02:28:56 +0000 | [diff] [blame] | 518 | Nodify(Dst, U, N1, SetValue(SetValue(St, U, Result), L1, Result)); |
| 519 | break; |
| 520 | } |
| 521 | |
| 522 | case UnaryOperator::PreDec: { |
| 523 | const LValue& L1 = GetLValue(St, U->getSubExpr()); |
Ted Kremenek | 0922ec8 | 2008-01-28 22:09:13 +0000 | [diff] [blame] | 524 | NonLValue R1 = cast<NonLValue>(GetValue(St, L1)); |
Ted Kremenek | 15cb078 | 2008-02-06 22:50:25 +0000 | [diff] [blame] | 525 | |
Ted Kremenek | b193413 | 2008-02-14 19:37:24 +0000 | [diff] [blame] | 526 | NonLValue Result = EvalBinaryOp(ValMgr, BinaryOperator::Sub, |
| 527 | R1, GetRValueConstant(1U, U)); |
Ted Kremenek | 15cb078 | 2008-02-06 22:50:25 +0000 | [diff] [blame] | 528 | |
Ted Kremenek | 1be5eb9 | 2008-01-24 02:28:56 +0000 | [diff] [blame] | 529 | Nodify(Dst, U, N1, SetValue(SetValue(St, U, Result), L1, Result)); |
| 530 | break; |
| 531 | } |
| 532 | |
Ted Kremenek | cacd736 | 2008-01-24 08:20:02 +0000 | [diff] [blame] | 533 | case UnaryOperator::Minus: { |
Ted Kremenek | 0922ec8 | 2008-01-28 22:09:13 +0000 | [diff] [blame] | 534 | const NonLValue& R1 = cast<NonLValue>(GetValue(St, U->getSubExpr())); |
Ted Kremenek | c9922fd | 2008-02-14 18:40:24 +0000 | [diff] [blame] | 535 | Nodify(Dst, U, N1, SetValue(St, U, EvalMinus(ValMgr, U, R1))); |
Ted Kremenek | cacd736 | 2008-01-24 08:20:02 +0000 | [diff] [blame] | 536 | break; |
| 537 | } |
| 538 | |
Ted Kremenek | 2cb4664 | 2008-02-04 16:58:30 +0000 | [diff] [blame] | 539 | case UnaryOperator::Not: { |
| 540 | const NonLValue& R1 = cast<NonLValue>(GetValue(St, U->getSubExpr())); |
Ted Kremenek | c9922fd | 2008-02-14 18:40:24 +0000 | [diff] [blame] | 541 | Nodify(Dst, U, N1, SetValue(St, U, EvalComplement(ValMgr, R1))); |
Ted Kremenek | 2cb4664 | 2008-02-04 16:58:30 +0000 | [diff] [blame] | 542 | break; |
| 543 | } |
| 544 | |
Ted Kremenek | a6683bf | 2008-02-06 17:56:00 +0000 | [diff] [blame] | 545 | case UnaryOperator::LNot: { |
| 546 | // C99 6.5.3.3: "The expression !E is equivalent to (0==E)." |
| 547 | // |
| 548 | // Note: technically we do "E == 0", but this is the same in the |
| 549 | // transfer functions as "0 == E". |
| 550 | |
| 551 | RValue V1 = GetValue(St, U->getSubExpr()); |
| 552 | |
| 553 | if (isa<LValue>(V1)) { |
Ted Kremenek | 15cb078 | 2008-02-06 22:50:25 +0000 | [diff] [blame] | 554 | const LValue& L1 = cast<LValue>(V1); |
| 555 | lval::ConcreteInt V2(ValMgr.getZeroWithPtrWidth()); |
| 556 | Nodify(Dst, U, N1, |
Ted Kremenek | b193413 | 2008-02-14 19:37:24 +0000 | [diff] [blame] | 557 | SetValue(St, U, EvalBinaryOp(ValMgr, BinaryOperator::EQ, |
| 558 | L1, V2))); |
Ted Kremenek | a6683bf | 2008-02-06 17:56:00 +0000 | [diff] [blame] | 559 | } |
| 560 | else { |
Ted Kremenek | 15cb078 | 2008-02-06 22:50:25 +0000 | [diff] [blame] | 561 | const NonLValue& R1 = cast<NonLValue>(V1); |
Ted Kremenek | a6683bf | 2008-02-06 17:56:00 +0000 | [diff] [blame] | 562 | nonlval::ConcreteInt V2(ValMgr.getZeroWithPtrWidth()); |
Ted Kremenek | 15cb078 | 2008-02-06 22:50:25 +0000 | [diff] [blame] | 563 | Nodify(Dst, U, N1, |
Ted Kremenek | b193413 | 2008-02-14 19:37:24 +0000 | [diff] [blame] | 564 | SetValue(St, U, EvalBinaryOp(ValMgr, BinaryOperator::EQ, |
| 565 | R1, V2))); |
Ted Kremenek | a6683bf | 2008-02-06 17:56:00 +0000 | [diff] [blame] | 566 | } |
| 567 | |
| 568 | break; |
| 569 | } |
Ted Kremenek | fd85f29 | 2008-02-12 19:49:57 +0000 | [diff] [blame] | 570 | |
| 571 | case UnaryOperator::SizeOf: { |
| 572 | // 6.5.3.4 sizeof: "The result type is an integer." |
| 573 | |
| 574 | QualType T = U->getSubExpr()->getType(); |
| 575 | |
| 576 | // FIXME: Add support for VLAs. |
| 577 | if (isa<VariableArrayType>(T.getTypePtr())) |
| 578 | return; |
| 579 | |
| 580 | SourceLocation L = U->getExprLoc(); |
| 581 | uint64_t size = getContext().getTypeSize(T, L) / 8; |
| 582 | |
| 583 | Nodify(Dst, U, N1, |
| 584 | SetValue(St, U, NonLValue::GetValue(ValMgr, size, |
| 585 | getContext().IntTy, L))); |
| 586 | |
| 587 | break; |
| 588 | } |
Ted Kremenek | a6683bf | 2008-02-06 17:56:00 +0000 | [diff] [blame] | 589 | |
Ted Kremenek | c48b8e4 | 2008-01-31 02:35:41 +0000 | [diff] [blame] | 590 | case UnaryOperator::AddrOf: { |
| 591 | const LValue& L1 = GetLValue(St, U->getSubExpr()); |
| 592 | Nodify(Dst, U, N1, SetValue(St, U, L1)); |
| 593 | break; |
| 594 | } |
| 595 | |
| 596 | case UnaryOperator::Deref: { |
Ted Kremenek | 9b32cd0 | 2008-02-07 04:16:04 +0000 | [diff] [blame] | 597 | // FIXME: Stop when dereferencing an uninitialized value. |
| 598 | // FIXME: Bifurcate when dereferencing a symbolic with no constraints? |
| 599 | |
| 600 | const RValue& V = GetValue(St, U->getSubExpr()); |
| 601 | const LValue& L1 = cast<LValue>(V); |
| 602 | |
Ted Kremenek | 80d52d0 | 2008-02-07 05:48:01 +0000 | [diff] [blame] | 603 | // After a dereference, one of two possible situations arise: |
| 604 | // (1) A crash, because the pointer was NULL. |
| 605 | // (2) The pointer is not NULL, and the dereference works. |
| 606 | // |
| 607 | // We add these assumptions. |
| 608 | |
Ted Kremenek | ae7bdc1 | 2008-02-07 06:04:18 +0000 | [diff] [blame] | 609 | bool isFeasibleNotNull; |
| 610 | |
Ted Kremenek | 80d52d0 | 2008-02-07 05:48:01 +0000 | [diff] [blame] | 611 | // "Assume" that the pointer is Not-NULL. |
Ted Kremenek | ae7bdc1 | 2008-02-07 06:04:18 +0000 | [diff] [blame] | 612 | StateTy StNotNull = Assume(St, L1, true, isFeasibleNotNull); |
| 613 | |
| 614 | if (isFeasibleNotNull) { |
Ted Kremenek | 80d52d0 | 2008-02-07 05:48:01 +0000 | [diff] [blame] | 615 | QualType T = U->getType(); |
| 616 | Nodify(Dst, U, N1, SetValue(StNotNull, U, |
| 617 | GetValue(StNotNull, L1, &T))); |
| 618 | } |
| 619 | |
Ted Kremenek | ae7bdc1 | 2008-02-07 06:04:18 +0000 | [diff] [blame] | 620 | bool isFeasibleNull; |
| 621 | |
| 622 | // "Assume" that the pointer is NULL. |
| 623 | StateTy StNull = Assume(St, L1, false, isFeasibleNull); |
| 624 | |
| 625 | if (isFeasibleNull) { |
Ted Kremenek | 02b5b40 | 2008-02-07 15:20:13 +0000 | [diff] [blame] | 626 | // We don't use "Nodify" here because the node will be a sink |
| 627 | // and we have no intention of processing it later. |
| 628 | NodeTy* NullNode = Builder->generateNode(U, StNull, N1); |
| 629 | |
Ted Kremenek | ae7bdc1 | 2008-02-07 06:04:18 +0000 | [diff] [blame] | 630 | if (NullNode) { |
| 631 | NullNode->markAsSink(); |
| 632 | |
| 633 | if (isFeasibleNotNull) |
| 634 | ImplicitNullDeref.insert(NullNode); |
| 635 | else |
| 636 | ExplicitNullDeref.insert(NullNode); |
| 637 | } |
| 638 | } |
| 639 | |
Ted Kremenek | c48b8e4 | 2008-01-31 02:35:41 +0000 | [diff] [blame] | 640 | break; |
| 641 | } |
| 642 | |
Ted Kremenek | 1be5eb9 | 2008-01-24 02:28:56 +0000 | [diff] [blame] | 643 | default: ; |
| 644 | assert (false && "Not implemented."); |
| 645 | } |
| 646 | } |
| 647 | } |
| 648 | |
Ted Kremenek | 30fa28b | 2008-02-13 17:41:41 +0000 | [diff] [blame] | 649 | void GRExprEngine::VisitAssignmentLHS(Expr* E, GRExprEngine::NodeTy* Pred, |
| 650 | GRExprEngine::NodeSet& Dst) { |
Ted Kremenek | e1f38b6 | 2008-02-07 01:08:27 +0000 | [diff] [blame] | 651 | |
Ted Kremenek | 9b32cd0 | 2008-02-07 04:16:04 +0000 | [diff] [blame] | 652 | if (isa<DeclRefExpr>(E)) { |
| 653 | Dst.Add(Pred); |
Ted Kremenek | e1f38b6 | 2008-02-07 01:08:27 +0000 | [diff] [blame] | 654 | return; |
Ted Kremenek | 9b32cd0 | 2008-02-07 04:16:04 +0000 | [diff] [blame] | 655 | } |
Ted Kremenek | e1f38b6 | 2008-02-07 01:08:27 +0000 | [diff] [blame] | 656 | |
| 657 | if (UnaryOperator* U = dyn_cast<UnaryOperator>(E)) { |
| 658 | if (U->getOpcode() == UnaryOperator::Deref) { |
| 659 | Visit(U->getSubExpr(), Pred, Dst); |
| 660 | return; |
| 661 | } |
| 662 | } |
| 663 | |
| 664 | Visit(E, Pred, Dst); |
| 665 | } |
| 666 | |
Ted Kremenek | 30fa28b | 2008-02-13 17:41:41 +0000 | [diff] [blame] | 667 | void GRExprEngine::VisitBinaryOperator(BinaryOperator* B, |
Ted Kremenek | aee121c | 2008-02-13 23:08:21 +0000 | [diff] [blame] | 668 | GRExprEngine::NodeTy* Pred, |
| 669 | GRExprEngine::NodeSet& Dst) { |
Ted Kremenek | f031b87 | 2008-01-23 19:59:44 +0000 | [diff] [blame] | 670 | NodeSet S1; |
Ted Kremenek | e1f38b6 | 2008-02-07 01:08:27 +0000 | [diff] [blame] | 671 | |
| 672 | if (B->isAssignmentOp()) |
| 673 | VisitAssignmentLHS(B->getLHS(), Pred, S1); |
| 674 | else |
| 675 | Visit(B->getLHS(), Pred, S1); |
Ted Kremenek | afba4b2 | 2008-01-16 00:53:15 +0000 | [diff] [blame] | 676 | |
Ted Kremenek | f031b87 | 2008-01-23 19:59:44 +0000 | [diff] [blame] | 677 | for (NodeSet::iterator I1=S1.begin(), E1=S1.end(); I1 != E1; ++I1) { |
| 678 | NodeTy* N1 = *I1; |
Ted Kremenek | e860db8 | 2008-01-17 00:52:48 +0000 | [diff] [blame] | 679 | |
Ted Kremenek | f031b87 | 2008-01-23 19:59:44 +0000 | [diff] [blame] | 680 | // When getting the value for the LHS, check if we are in an assignment. |
| 681 | // In such cases, we want to (initially) treat the LHS as an LValue, |
| 682 | // so we use GetLValue instead of GetValue so that DeclRefExpr's are |
Ted Kremenek | 0922ec8 | 2008-01-28 22:09:13 +0000 | [diff] [blame] | 683 | // evaluated to LValueDecl's instead of to an NonLValue. |
| 684 | const RValue& V1 = |
Ted Kremenek | f031b87 | 2008-01-23 19:59:44 +0000 | [diff] [blame] | 685 | B->isAssignmentOp() ? GetLValue(N1->getState(), B->getLHS()) |
| 686 | : GetValue(N1->getState(), B->getLHS()); |
Ted Kremenek | afba4b2 | 2008-01-16 00:53:15 +0000 | [diff] [blame] | 687 | |
Ted Kremenek | f031b87 | 2008-01-23 19:59:44 +0000 | [diff] [blame] | 688 | NodeSet S2; |
| 689 | Visit(B->getRHS(), N1, S2); |
| 690 | |
| 691 | for (NodeSet::iterator I2=S2.begin(), E2=S2.end(); I2 != E2; ++I2) { |
Ted Kremenek | 15cb078 | 2008-02-06 22:50:25 +0000 | [diff] [blame] | 692 | |
Ted Kremenek | f031b87 | 2008-01-23 19:59:44 +0000 | [diff] [blame] | 693 | NodeTy* N2 = *I2; |
| 694 | StateTy St = N2->getState(); |
Ted Kremenek | 0922ec8 | 2008-01-28 22:09:13 +0000 | [diff] [blame] | 695 | const RValue& V2 = GetValue(St, B->getRHS()); |
Ted Kremenek | f031b87 | 2008-01-23 19:59:44 +0000 | [diff] [blame] | 696 | |
Ted Kremenek | 15cb078 | 2008-02-06 22:50:25 +0000 | [diff] [blame] | 697 | BinaryOperator::Opcode Op = B->getOpcode(); |
| 698 | |
| 699 | if (Op <= BinaryOperator::Or) { |
| 700 | |
Ted Kremenek | adec14b | 2008-02-08 02:57:34 +0000 | [diff] [blame] | 701 | if (isa<UnknownVal>(V1) || isa<UninitializedVal>(V1)) { |
Ted Kremenek | e1f38b6 | 2008-02-07 01:08:27 +0000 | [diff] [blame] | 702 | Nodify(Dst, B, N2, SetValue(St, B, V1)); |
| 703 | continue; |
| 704 | } |
| 705 | |
Ted Kremenek | 15cb078 | 2008-02-06 22:50:25 +0000 | [diff] [blame] | 706 | if (isa<LValue>(V1)) { |
| 707 | // FIXME: Add support for RHS being a non-lvalue. |
| 708 | const LValue& L1 = cast<LValue>(V1); |
| 709 | const LValue& L2 = cast<LValue>(V2); |
Ted Kremenek | 19072e0 | 2008-01-29 19:43:15 +0000 | [diff] [blame] | 710 | |
Ted Kremenek | b193413 | 2008-02-14 19:37:24 +0000 | [diff] [blame] | 711 | Nodify(Dst, B, N2, SetValue(St, B, EvalBinaryOp(ValMgr, Op, L1, L2))); |
Ted Kremenek | 15cb078 | 2008-02-06 22:50:25 +0000 | [diff] [blame] | 712 | } |
| 713 | else { |
Ted Kremenek | 0922ec8 | 2008-01-28 22:09:13 +0000 | [diff] [blame] | 714 | const NonLValue& R1 = cast<NonLValue>(V1); |
| 715 | const NonLValue& R2 = cast<NonLValue>(V2); |
Ted Kremenek | 15cb078 | 2008-02-06 22:50:25 +0000 | [diff] [blame] | 716 | |
Ted Kremenek | b193413 | 2008-02-14 19:37:24 +0000 | [diff] [blame] | 717 | Nodify(Dst, B, N2, SetValue(St, B, EvalBinaryOp(ValMgr, Op, R1, R2))); |
Ted Kremenek | f031b87 | 2008-01-23 19:59:44 +0000 | [diff] [blame] | 718 | } |
Ted Kremenek | 15cb078 | 2008-02-06 22:50:25 +0000 | [diff] [blame] | 719 | |
| 720 | continue; |
Ted Kremenek | 9b32cd0 | 2008-02-07 04:16:04 +0000 | [diff] [blame] | 721 | |
Ted Kremenek | 15cb078 | 2008-02-06 22:50:25 +0000 | [diff] [blame] | 722 | } |
| 723 | |
| 724 | switch (Op) { |
Ted Kremenek | f031b87 | 2008-01-23 19:59:44 +0000 | [diff] [blame] | 725 | case BinaryOperator::Assign: { |
| 726 | const LValue& L1 = cast<LValue>(V1); |
Ted Kremenek | 46a1977 | 2008-02-06 04:41:14 +0000 | [diff] [blame] | 727 | Nodify(Dst, B, N2, SetValue(SetValue(St, B, V2), L1, V2)); |
Ted Kremenek | f031b87 | 2008-01-23 19:59:44 +0000 | [diff] [blame] | 728 | break; |
| 729 | } |
| 730 | |
Ted Kremenek | 15cb078 | 2008-02-06 22:50:25 +0000 | [diff] [blame] | 731 | default: { // Compound assignment operators. |
Ted Kremenek | 19072e0 | 2008-01-29 19:43:15 +0000 | [diff] [blame] | 732 | |
Ted Kremenek | 15cb078 | 2008-02-06 22:50:25 +0000 | [diff] [blame] | 733 | assert (B->isCompoundAssignmentOp()); |
| 734 | |
| 735 | const LValue& L1 = cast<LValue>(V1); |
Ted Kremenek | adec14b | 2008-02-08 02:57:34 +0000 | [diff] [blame] | 736 | RValue Result = cast<NonLValue>(UnknownVal()); |
Ted Kremenek | 15cb078 | 2008-02-06 22:50:25 +0000 | [diff] [blame] | 737 | |
Ted Kremenek | 106f37c | 2008-02-08 07:05:39 +0000 | [diff] [blame] | 738 | if (Op >= BinaryOperator::AndAssign) |
| 739 | ((int&) Op) -= (BinaryOperator::AndAssign - BinaryOperator::And); |
| 740 | else |
| 741 | ((int&) Op) -= BinaryOperator::MulAssign; |
Ted Kremenek | 15cb078 | 2008-02-06 22:50:25 +0000 | [diff] [blame] | 742 | |
| 743 | if (isa<LValue>(V2)) { |
| 744 | // FIXME: Add support for Non-LValues on RHS. |
Ted Kremenek | 19072e0 | 2008-01-29 19:43:15 +0000 | [diff] [blame] | 745 | const LValue& L2 = cast<LValue>(V2); |
Ted Kremenek | b193413 | 2008-02-14 19:37:24 +0000 | [diff] [blame] | 746 | Result = EvalBinaryOp(ValMgr, Op, L1, L2); |
Ted Kremenek | 19072e0 | 2008-01-29 19:43:15 +0000 | [diff] [blame] | 747 | } |
| 748 | else { |
Ted Kremenek | 15cb078 | 2008-02-06 22:50:25 +0000 | [diff] [blame] | 749 | const NonLValue& R1 = cast<NonLValue>(GetValue(N1->getState(), L1)); |
Ted Kremenek | 19072e0 | 2008-01-29 19:43:15 +0000 | [diff] [blame] | 750 | const NonLValue& R2 = cast<NonLValue>(V2); |
Ted Kremenek | b193413 | 2008-02-14 19:37:24 +0000 | [diff] [blame] | 751 | Result = EvalBinaryOp(ValMgr, Op, R1, R2); |
Ted Kremenek | 19072e0 | 2008-01-29 19:43:15 +0000 | [diff] [blame] | 752 | } |
| 753 | |
Ted Kremenek | 15cb078 | 2008-02-06 22:50:25 +0000 | [diff] [blame] | 754 | Nodify(Dst, B, N2, SetValue(SetValue(St, B, Result), L1, Result)); |
Ted Kremenek | f031b87 | 2008-01-23 19:59:44 +0000 | [diff] [blame] | 755 | break; |
Ted Kremenek | 15cb078 | 2008-02-06 22:50:25 +0000 | [diff] [blame] | 756 | } |
Ted Kremenek | f031b87 | 2008-01-23 19:59:44 +0000 | [diff] [blame] | 757 | } |
Ted Kremenek | afba4b2 | 2008-01-16 00:53:15 +0000 | [diff] [blame] | 758 | } |
Ted Kremenek | 68d70a8 | 2008-01-15 23:55:06 +0000 | [diff] [blame] | 759 | } |
Ted Kremenek | 68d70a8 | 2008-01-15 23:55:06 +0000 | [diff] [blame] | 760 | } |
Ted Kremenek | d2500ab | 2008-01-16 18:18:48 +0000 | [diff] [blame] | 761 | |
Ted Kremenek | be96245 | 2008-01-16 19:42:59 +0000 | [diff] [blame] | 762 | |
Ted Kremenek | 30fa28b | 2008-02-13 17:41:41 +0000 | [diff] [blame] | 763 | void GRExprEngine::Visit(Stmt* S, GRExprEngine::NodeTy* Pred, |
| 764 | GRExprEngine::NodeSet& Dst) { |
Ted Kremenek | f031b87 | 2008-01-23 19:59:44 +0000 | [diff] [blame] | 765 | |
| 766 | // FIXME: add metadata to the CFG so that we can disable |
| 767 | // this check when we KNOW that there is no block-level subexpression. |
| 768 | // The motivation is that this check requires a hashtable lookup. |
| 769 | |
| 770 | if (S != CurrentStmt && getCFG().isBlkExpr(S)) { |
| 771 | Dst.Add(Pred); |
| 772 | return; |
| 773 | } |
| 774 | |
| 775 | switch (S->getStmtClass()) { |
Ted Kremenek | 5bde36b | 2008-02-12 21:37:25 +0000 | [diff] [blame] | 776 | |
| 777 | default: |
| 778 | // Cases we intentionally have "default" handle: |
| 779 | // AddrLabelExpr, CharacterLiteral, IntegerLiteral |
| 780 | |
| 781 | Dst.Add(Pred); // No-op. Simply propagate the current state unchanged. |
| 782 | break; |
| 783 | |
Ted Kremenek | 744a786 | 2008-02-08 20:29:23 +0000 | [diff] [blame] | 784 | case Stmt::BinaryOperatorClass: { |
| 785 | BinaryOperator* B = cast<BinaryOperator>(S); |
Ted Kremenek | 1f0eb99 | 2008-02-05 00:26:40 +0000 | [diff] [blame] | 786 | |
Ted Kremenek | 744a786 | 2008-02-08 20:29:23 +0000 | [diff] [blame] | 787 | if (B->isLogicalOp()) { |
| 788 | VisitLogicalExpr(B, Pred, Dst); |
Ted Kremenek | 1f0eb99 | 2008-02-05 00:26:40 +0000 | [diff] [blame] | 789 | break; |
| 790 | } |
Ted Kremenek | 744a786 | 2008-02-08 20:29:23 +0000 | [diff] [blame] | 791 | else if (B->getOpcode() == BinaryOperator::Comma) { |
Ted Kremenek | 106f37c | 2008-02-08 07:05:39 +0000 | [diff] [blame] | 792 | StateTy St = Pred->getState(); |
Ted Kremenek | 744a786 | 2008-02-08 20:29:23 +0000 | [diff] [blame] | 793 | Nodify(Dst, B, Pred, SetValue(St, B, GetValue(St, B->getRHS()))); |
Ted Kremenek | 106f37c | 2008-02-08 07:05:39 +0000 | [diff] [blame] | 794 | break; |
| 795 | } |
Ted Kremenek | fd85f29 | 2008-02-12 19:49:57 +0000 | [diff] [blame] | 796 | |
| 797 | VisitBinaryOperator(cast<BinaryOperator>(S), Pred, Dst); |
| 798 | break; |
| 799 | } |
| 800 | |
| 801 | case Stmt::CastExprClass: { |
| 802 | CastExpr* C = cast<CastExpr>(S); |
| 803 | VisitCast(C, C->getSubExpr(), Pred, Dst); |
| 804 | break; |
Ted Kremenek | 744a786 | 2008-02-08 20:29:23 +0000 | [diff] [blame] | 805 | } |
Ted Kremenek | 1f0eb99 | 2008-02-05 00:26:40 +0000 | [diff] [blame] | 806 | |
Ted Kremenek | fd85f29 | 2008-02-12 19:49:57 +0000 | [diff] [blame] | 807 | case Stmt::ChooseExprClass: { // __builtin_choose_expr |
| 808 | ChooseExpr* C = cast<ChooseExpr>(S); |
| 809 | VisitGuardedExpr(C, C->getLHS(), C->getRHS(), Pred, Dst); |
| 810 | break; |
| 811 | } |
Ted Kremenek | 1f0eb99 | 2008-02-05 00:26:40 +0000 | [diff] [blame] | 812 | |
Ted Kremenek | 9914e9c | 2008-01-23 23:38:00 +0000 | [diff] [blame] | 813 | case Stmt::CompoundAssignOperatorClass: |
Ted Kremenek | f031b87 | 2008-01-23 19:59:44 +0000 | [diff] [blame] | 814 | VisitBinaryOperator(cast<BinaryOperator>(S), Pred, Dst); |
| 815 | break; |
| 816 | |
Ted Kremenek | fd85f29 | 2008-02-12 19:49:57 +0000 | [diff] [blame] | 817 | case Stmt::ConditionalOperatorClass: { // '?' operator |
| 818 | ConditionalOperator* C = cast<ConditionalOperator>(S); |
| 819 | VisitGuardedExpr(C, C->getLHS(), C->getRHS(), Pred, Dst); |
| 820 | break; |
| 821 | } |
| 822 | |
| 823 | case Stmt::DeclRefExprClass: |
| 824 | VisitDeclRefExpr(cast<DeclRefExpr>(S), Pred, Dst); |
| 825 | break; |
| 826 | |
| 827 | case Stmt::DeclStmtClass: |
| 828 | VisitDeclStmt(cast<DeclStmt>(S), Pred, Dst); |
| 829 | break; |
| 830 | |
| 831 | case Stmt::ImplicitCastExprClass: { |
| 832 | ImplicitCastExpr* C = cast<ImplicitCastExpr>(S); |
| 833 | VisitCast(C, C->getSubExpr(), Pred, Dst); |
| 834 | break; |
| 835 | } |
| 836 | |
| 837 | case Stmt::ParenExprClass: |
| 838 | Visit(cast<ParenExpr>(S)->getSubExpr(), Pred, Dst); |
| 839 | break; |
| 840 | |
| 841 | case Stmt::SizeOfAlignOfTypeExprClass: |
| 842 | VisitSizeOfAlignOfTypeExpr(cast<SizeOfAlignOfTypeExpr>(S), Pred, Dst); |
| 843 | break; |
| 844 | |
Ted Kremenek | 106f37c | 2008-02-08 07:05:39 +0000 | [diff] [blame] | 845 | case Stmt::StmtExprClass: { |
Ted Kremenek | 744a786 | 2008-02-08 20:29:23 +0000 | [diff] [blame] | 846 | StmtExpr* SE = cast<StmtExpr>(S); |
| 847 | |
Ted Kremenek | 106f37c | 2008-02-08 07:05:39 +0000 | [diff] [blame] | 848 | StateTy St = Pred->getState(); |
Ted Kremenek | 744a786 | 2008-02-08 20:29:23 +0000 | [diff] [blame] | 849 | Expr* LastExpr = cast<Expr>(*SE->getSubStmt()->body_rbegin()); |
| 850 | Nodify(Dst, SE, Pred, SetValue(St, SE, GetValue(St, LastExpr))); |
Ted Kremenek | 106f37c | 2008-02-08 07:05:39 +0000 | [diff] [blame] | 851 | break; |
| 852 | } |
| 853 | |
Ted Kremenek | fd85f29 | 2008-02-12 19:49:57 +0000 | [diff] [blame] | 854 | case Stmt::ReturnStmtClass: { |
Ted Kremenek | e1f38b6 | 2008-02-07 01:08:27 +0000 | [diff] [blame] | 855 | if (Expr* R = cast<ReturnStmt>(S)->getRetValue()) |
| 856 | Visit(R, Pred, Dst); |
| 857 | else |
| 858 | Dst.Add(Pred); |
| 859 | |
| 860 | break; |
Ted Kremenek | fd85f29 | 2008-02-12 19:49:57 +0000 | [diff] [blame] | 861 | } |
Ted Kremenek | e1f38b6 | 2008-02-07 01:08:27 +0000 | [diff] [blame] | 862 | |
Ted Kremenek | fd85f29 | 2008-02-12 19:49:57 +0000 | [diff] [blame] | 863 | case Stmt::UnaryOperatorClass: |
| 864 | VisitUnaryOperator(cast<UnaryOperator>(S), Pred, Dst); |
Ted Kremenek | b9c30e3 | 2008-01-24 20:55:43 +0000 | [diff] [blame] | 865 | break; |
Ted Kremenek | ab8ed95 | 2008-01-17 18:25:22 +0000 | [diff] [blame] | 866 | } |
Ted Kremenek | be96245 | 2008-01-16 19:42:59 +0000 | [diff] [blame] | 867 | } |
| 868 | |
Ted Kremenek | d2500ab | 2008-01-16 18:18:48 +0000 | [diff] [blame] | 869 | //===----------------------------------------------------------------------===// |
Ted Kremenek | 9096097 | 2008-01-30 23:03:39 +0000 | [diff] [blame] | 870 | // "Assume" logic. |
| 871 | //===----------------------------------------------------------------------===// |
| 872 | |
Ted Kremenek | 30fa28b | 2008-02-13 17:41:41 +0000 | [diff] [blame] | 873 | GRExprEngine::StateTy GRExprEngine::Assume(StateTy St, LValue Cond, |
Ted Kremenek | 13f3156 | 2008-02-06 00:54:14 +0000 | [diff] [blame] | 874 | bool Assumption, |
Ted Kremenek | 7219790 | 2008-01-31 19:34:24 +0000 | [diff] [blame] | 875 | bool& isFeasible) { |
Ted Kremenek | 6e24a80 | 2008-02-01 06:36:40 +0000 | [diff] [blame] | 876 | |
| 877 | switch (Cond.getSubKind()) { |
| 878 | default: |
Ted Kremenek | 13f3156 | 2008-02-06 00:54:14 +0000 | [diff] [blame] | 879 | assert (false && "'Assume' not implemented for this LValue."); |
Ted Kremenek | 6e24a80 | 2008-02-01 06:36:40 +0000 | [diff] [blame] | 880 | return St; |
| 881 | |
Ted Kremenek | 13f3156 | 2008-02-06 00:54:14 +0000 | [diff] [blame] | 882 | case lval::SymbolValKind: |
| 883 | if (Assumption) |
| 884 | return AssumeSymNE(St, cast<lval::SymbolVal>(Cond).getSymbol(), |
| 885 | ValMgr.getZeroWithPtrWidth(), isFeasible); |
| 886 | else |
| 887 | return AssumeSymEQ(St, cast<lval::SymbolVal>(Cond).getSymbol(), |
| 888 | ValMgr.getZeroWithPtrWidth(), isFeasible); |
| 889 | |
Ted Kremenek | 0033fbb | 2008-02-06 04:31:33 +0000 | [diff] [blame] | 890 | |
Ted Kremenek | 1b63a3b | 2008-02-05 21:52:21 +0000 | [diff] [blame] | 891 | case lval::DeclValKind: |
Ted Kremenek | 6e24a80 | 2008-02-01 06:36:40 +0000 | [diff] [blame] | 892 | isFeasible = Assumption; |
| 893 | return St; |
Ted Kremenek | 13f3156 | 2008-02-06 00:54:14 +0000 | [diff] [blame] | 894 | |
Ted Kremenek | 1b63a3b | 2008-02-05 21:52:21 +0000 | [diff] [blame] | 895 | case lval::ConcreteIntKind: { |
| 896 | bool b = cast<lval::ConcreteInt>(Cond).getValue() != 0; |
Ted Kremenek | 6e24a80 | 2008-02-01 06:36:40 +0000 | [diff] [blame] | 897 | isFeasible = b ? Assumption : !Assumption; |
| 898 | return St; |
| 899 | } |
| 900 | } |
Ted Kremenek | 9096097 | 2008-01-30 23:03:39 +0000 | [diff] [blame] | 901 | } |
| 902 | |
Ted Kremenek | 30fa28b | 2008-02-13 17:41:41 +0000 | [diff] [blame] | 903 | GRExprEngine::StateTy GRExprEngine::Assume(StateTy St, NonLValue Cond, |
Ted Kremenek | 13f3156 | 2008-02-06 00:54:14 +0000 | [diff] [blame] | 904 | bool Assumption, |
Ted Kremenek | 7219790 | 2008-01-31 19:34:24 +0000 | [diff] [blame] | 905 | bool& isFeasible) { |
Ted Kremenek | 9096097 | 2008-01-30 23:03:39 +0000 | [diff] [blame] | 906 | |
| 907 | switch (Cond.getSubKind()) { |
| 908 | default: |
| 909 | assert (false && "'Assume' not implemented for this NonLValue."); |
| 910 | return St; |
| 911 | |
Ted Kremenek | ab359c1 | 2008-02-06 17:32:17 +0000 | [diff] [blame] | 912 | |
| 913 | case nonlval::SymbolValKind: { |
Ted Kremenek | 5bde36b | 2008-02-12 21:37:25 +0000 | [diff] [blame] | 914 | nonlval::SymbolVal& SV = cast<nonlval::SymbolVal>(Cond); |
Ted Kremenek | ab359c1 | 2008-02-06 17:32:17 +0000 | [diff] [blame] | 915 | SymbolID sym = SV.getSymbol(); |
| 916 | |
| 917 | if (Assumption) |
| 918 | return AssumeSymNE(St, sym, ValMgr.getValue(0, SymMgr.getType(sym)), |
| 919 | isFeasible); |
| 920 | else |
| 921 | return AssumeSymEQ(St, sym, ValMgr.getValue(0, SymMgr.getType(sym)), |
| 922 | isFeasible); |
| 923 | } |
| 924 | |
Ted Kremenek | 0033fbb | 2008-02-06 04:31:33 +0000 | [diff] [blame] | 925 | case nonlval::SymIntConstraintValKind: |
| 926 | return |
| 927 | AssumeSymInt(St, Assumption, |
| 928 | cast<nonlval::SymIntConstraintVal>(Cond).getConstraint(), |
| 929 | isFeasible); |
| 930 | |
Ted Kremenek | 1b63a3b | 2008-02-05 21:52:21 +0000 | [diff] [blame] | 931 | case nonlval::ConcreteIntKind: { |
| 932 | bool b = cast<nonlval::ConcreteInt>(Cond).getValue() != 0; |
Ted Kremenek | 9096097 | 2008-01-30 23:03:39 +0000 | [diff] [blame] | 933 | isFeasible = b ? Assumption : !Assumption; |
| 934 | return St; |
| 935 | } |
| 936 | } |
| 937 | } |
| 938 | |
Ted Kremenek | 30fa28b | 2008-02-13 17:41:41 +0000 | [diff] [blame] | 939 | GRExprEngine::StateTy |
| 940 | GRExprEngine::AssumeSymNE(StateTy St, SymbolID sym, |
Ted Kremenek | 13f3156 | 2008-02-06 00:54:14 +0000 | [diff] [blame] | 941 | const llvm::APSInt& V, bool& isFeasible) { |
| 942 | |
| 943 | // First, determine if sym == X, where X != V. |
| 944 | if (const llvm::APSInt* X = St.getSymVal(sym)) { |
| 945 | isFeasible = *X != V; |
| 946 | return St; |
| 947 | } |
| 948 | |
| 949 | // Second, determine if sym != V. |
| 950 | if (St.isNotEqual(sym, V)) { |
| 951 | isFeasible = true; |
| 952 | return St; |
| 953 | } |
| 954 | |
| 955 | // If we reach here, sym is not a constant and we don't know if it is != V. |
| 956 | // Make that assumption. |
| 957 | |
| 958 | isFeasible = true; |
| 959 | return StateMgr.AddNE(St, sym, V); |
| 960 | } |
| 961 | |
Ted Kremenek | 30fa28b | 2008-02-13 17:41:41 +0000 | [diff] [blame] | 962 | GRExprEngine::StateTy |
| 963 | GRExprEngine::AssumeSymEQ(StateTy St, SymbolID sym, |
Ted Kremenek | 13f3156 | 2008-02-06 00:54:14 +0000 | [diff] [blame] | 964 | const llvm::APSInt& V, bool& isFeasible) { |
| 965 | |
| 966 | // First, determine if sym == X, where X != V. |
| 967 | if (const llvm::APSInt* X = St.getSymVal(sym)) { |
| 968 | isFeasible = *X == V; |
| 969 | return St; |
| 970 | } |
| 971 | |
| 972 | // Second, determine if sym != V. |
| 973 | if (St.isNotEqual(sym, V)) { |
| 974 | isFeasible = false; |
| 975 | return St; |
| 976 | } |
| 977 | |
| 978 | // If we reach here, sym is not a constant and we don't know if it is == V. |
| 979 | // Make that assumption. |
| 980 | |
| 981 | isFeasible = true; |
| 982 | return StateMgr.AddEQ(St, sym, V); |
| 983 | } |
Ted Kremenek | 9096097 | 2008-01-30 23:03:39 +0000 | [diff] [blame] | 984 | |
Ted Kremenek | 30fa28b | 2008-02-13 17:41:41 +0000 | [diff] [blame] | 985 | GRExprEngine::StateTy |
| 986 | GRExprEngine::AssumeSymInt(StateTy St, bool Assumption, |
Ted Kremenek | 0033fbb | 2008-02-06 04:31:33 +0000 | [diff] [blame] | 987 | const SymIntConstraint& C, bool& isFeasible) { |
| 988 | |
| 989 | switch (C.getOpcode()) { |
| 990 | default: |
| 991 | // No logic yet for other operators. |
| 992 | return St; |
| 993 | |
| 994 | case BinaryOperator::EQ: |
| 995 | if (Assumption) |
| 996 | return AssumeSymEQ(St, C.getSymbol(), C.getInt(), isFeasible); |
| 997 | else |
| 998 | return AssumeSymNE(St, C.getSymbol(), C.getInt(), isFeasible); |
| 999 | |
| 1000 | case BinaryOperator::NE: |
| 1001 | if (Assumption) |
| 1002 | return AssumeSymNE(St, C.getSymbol(), C.getInt(), isFeasible); |
| 1003 | else |
| 1004 | return AssumeSymEQ(St, C.getSymbol(), C.getInt(), isFeasible); |
| 1005 | } |
| 1006 | } |
| 1007 | |
Ted Kremenek | 9096097 | 2008-01-30 23:03:39 +0000 | [diff] [blame] | 1008 | //===----------------------------------------------------------------------===// |
Ted Kremenek | 3862eb1 | 2008-02-14 22:36:46 +0000 | [diff] [blame] | 1009 | // Visualization. |
Ted Kremenek | d2500ab | 2008-01-16 18:18:48 +0000 | [diff] [blame] | 1010 | //===----------------------------------------------------------------------===// |
| 1011 | |
Ted Kremenek | dd9e97d | 2008-01-16 21:46:15 +0000 | [diff] [blame] | 1012 | #ifndef NDEBUG |
Ted Kremenek | 30fa28b | 2008-02-13 17:41:41 +0000 | [diff] [blame] | 1013 | static GRExprEngine* GraphPrintCheckerState; |
Ted Kremenek | 428d39e | 2008-01-30 23:24:39 +0000 | [diff] [blame] | 1014 | |
Ted Kremenek | dd9e97d | 2008-01-16 21:46:15 +0000 | [diff] [blame] | 1015 | namespace llvm { |
| 1016 | template<> |
Ted Kremenek | 30fa28b | 2008-02-13 17:41:41 +0000 | [diff] [blame] | 1017 | struct VISIBILITY_HIDDEN DOTGraphTraits<GRExprEngine::NodeTy*> : |
Ted Kremenek | dd9e97d | 2008-01-16 21:46:15 +0000 | [diff] [blame] | 1018 | public DefaultDOTGraphTraits { |
Ted Kremenek | 08cfd83 | 2008-02-08 21:10:02 +0000 | [diff] [blame] | 1019 | |
Ted Kremenek | 30fa28b | 2008-02-13 17:41:41 +0000 | [diff] [blame] | 1020 | static void PrintVarBindings(std::ostream& Out, GRExprEngine::StateTy St) { |
Ted Kremenek | 08cfd83 | 2008-02-08 21:10:02 +0000 | [diff] [blame] | 1021 | |
| 1022 | Out << "Variables:\\l"; |
| 1023 | |
Ted Kremenek | 3ec7be9 | 2008-01-24 22:27:20 +0000 | [diff] [blame] | 1024 | bool isFirst = true; |
| 1025 | |
Ted Kremenek | 30fa28b | 2008-02-13 17:41:41 +0000 | [diff] [blame] | 1026 | for (GRExprEngine::StateTy::vb_iterator I=St.vb_begin(), |
Ted Kremenek | 08cfd83 | 2008-02-08 21:10:02 +0000 | [diff] [blame] | 1027 | E=St.vb_end(); I!=E;++I) { |
| 1028 | |
| 1029 | if (isFirst) |
| 1030 | isFirst = false; |
| 1031 | else |
| 1032 | Out << "\\l"; |
| 1033 | |
| 1034 | Out << ' ' << I.getKey()->getName() << " : "; |
| 1035 | I.getData().print(Out); |
| 1036 | } |
| 1037 | |
| 1038 | } |
| 1039 | |
Ted Kremenek | 17c5f11 | 2008-02-11 19:21:59 +0000 | [diff] [blame] | 1040 | |
Ted Kremenek | 6d40992 | 2008-02-13 18:06:44 +0000 | [diff] [blame] | 1041 | static void PrintSubExprBindings(std::ostream& Out, GRExprEngine::StateTy St){ |
Ted Kremenek | 17c5f11 | 2008-02-11 19:21:59 +0000 | [diff] [blame] | 1042 | |
| 1043 | bool isFirst = true; |
| 1044 | |
Ted Kremenek | 30fa28b | 2008-02-13 17:41:41 +0000 | [diff] [blame] | 1045 | for (GRExprEngine::StateTy::seb_iterator I=St.seb_begin(), E=St.seb_end(); |
Ted Kremenek | 17c5f11 | 2008-02-11 19:21:59 +0000 | [diff] [blame] | 1046 | I != E;++I) { |
| 1047 | |
| 1048 | if (isFirst) { |
| 1049 | Out << "\\l\\lSub-Expressions:\\l"; |
| 1050 | isFirst = false; |
| 1051 | } |
| 1052 | else |
| 1053 | Out << "\\l"; |
| 1054 | |
| 1055 | Out << " (" << (void*) I.getKey() << ") "; |
| 1056 | I.getKey()->printPretty(Out); |
| 1057 | Out << " : "; |
| 1058 | I.getData().print(Out); |
| 1059 | } |
| 1060 | } |
| 1061 | |
Ted Kremenek | 6d40992 | 2008-02-13 18:06:44 +0000 | [diff] [blame] | 1062 | static void PrintBlkExprBindings(std::ostream& Out, GRExprEngine::StateTy St){ |
Ted Kremenek | 17c5f11 | 2008-02-11 19:21:59 +0000 | [diff] [blame] | 1063 | |
Ted Kremenek | 08cfd83 | 2008-02-08 21:10:02 +0000 | [diff] [blame] | 1064 | bool isFirst = true; |
| 1065 | |
Ted Kremenek | 30fa28b | 2008-02-13 17:41:41 +0000 | [diff] [blame] | 1066 | for (GRExprEngine::StateTy::beb_iterator I=St.beb_begin(), E=St.beb_end(); |
Ted Kremenek | 17c5f11 | 2008-02-11 19:21:59 +0000 | [diff] [blame] | 1067 | I != E; ++I) { |
Ted Kremenek | 3ec7be9 | 2008-01-24 22:27:20 +0000 | [diff] [blame] | 1068 | if (isFirst) { |
Ted Kremenek | 17c5f11 | 2008-02-11 19:21:59 +0000 | [diff] [blame] | 1069 | Out << "\\l\\lBlock-level Expressions:\\l"; |
Ted Kremenek | 3ec7be9 | 2008-01-24 22:27:20 +0000 | [diff] [blame] | 1070 | isFirst = false; |
| 1071 | } |
| 1072 | else |
| 1073 | Out << "\\l"; |
Ted Kremenek | 08cfd83 | 2008-02-08 21:10:02 +0000 | [diff] [blame] | 1074 | |
Ted Kremenek | 17c5f11 | 2008-02-11 19:21:59 +0000 | [diff] [blame] | 1075 | Out << " (" << (void*) I.getKey() << ") "; |
| 1076 | I.getKey()->printPretty(Out); |
Ted Kremenek | 3ec7be9 | 2008-01-24 22:27:20 +0000 | [diff] [blame] | 1077 | Out << " : "; |
| 1078 | I.getData().print(Out); |
| 1079 | } |
| 1080 | } |
| 1081 | |
Ted Kremenek | 30fa28b | 2008-02-13 17:41:41 +0000 | [diff] [blame] | 1082 | static void PrintEQ(std::ostream& Out, GRExprEngine::StateTy St) { |
Ted Kremenek | e653669 | 2008-02-06 03:56:15 +0000 | [diff] [blame] | 1083 | ValueState::ConstantEqTy CE = St.getImpl()->ConstantEq; |
| 1084 | |
| 1085 | if (CE.isEmpty()) |
| 1086 | return; |
| 1087 | |
| 1088 | Out << "\\l\\|'==' constraints:"; |
| 1089 | |
| 1090 | for (ValueState::ConstantEqTy::iterator I=CE.begin(), E=CE.end(); I!=E;++I) |
| 1091 | Out << "\\l $" << I.getKey() << " : " << I.getData()->toString(); |
| 1092 | } |
| 1093 | |
Ted Kremenek | 30fa28b | 2008-02-13 17:41:41 +0000 | [diff] [blame] | 1094 | static void PrintNE(std::ostream& Out, GRExprEngine::StateTy St) { |
Ted Kremenek | e653669 | 2008-02-06 03:56:15 +0000 | [diff] [blame] | 1095 | ValueState::ConstantNotEqTy NE = St.getImpl()->ConstantNotEq; |
| 1096 | |
| 1097 | if (NE.isEmpty()) |
| 1098 | return; |
| 1099 | |
| 1100 | Out << "\\l\\|'!=' constraints:"; |
| 1101 | |
| 1102 | for (ValueState::ConstantNotEqTy::iterator I=NE.begin(), EI=NE.end(); |
| 1103 | I != EI; ++I){ |
| 1104 | |
| 1105 | Out << "\\l $" << I.getKey() << " : "; |
| 1106 | bool isFirst = true; |
| 1107 | |
| 1108 | ValueState::IntSetTy::iterator J=I.getData().begin(), |
| 1109 | EJ=I.getData().end(); |
| 1110 | for ( ; J != EJ; ++J) { |
| 1111 | if (isFirst) isFirst = false; |
| 1112 | else Out << ", "; |
| 1113 | |
| 1114 | Out << (*J)->toString(); |
| 1115 | } |
| 1116 | } |
Ted Kremenek | a853de6 | 2008-02-14 22:54:53 +0000 | [diff] [blame^] | 1117 | } |
| 1118 | |
| 1119 | static std::string getNodeAttributes(const GRExprEngine::NodeTy* N, void*) { |
| 1120 | |
| 1121 | if (GraphPrintCheckerState->isImplicitNullDeref(N) || |
| 1122 | GraphPrintCheckerState->isExplicitNullDeref(N)) |
| 1123 | return "color=\"red\",style=\"filled\""; |
| 1124 | |
| 1125 | return ""; |
| 1126 | } |
Ted Kremenek | e653669 | 2008-02-06 03:56:15 +0000 | [diff] [blame] | 1127 | |
Ted Kremenek | 30fa28b | 2008-02-13 17:41:41 +0000 | [diff] [blame] | 1128 | static std::string getNodeLabel(const GRExprEngine::NodeTy* N, void*) { |
Ted Kremenek | dd9e97d | 2008-01-16 21:46:15 +0000 | [diff] [blame] | 1129 | std::ostringstream Out; |
Ted Kremenek | bacd6cd | 2008-01-23 22:30:44 +0000 | [diff] [blame] | 1130 | |
| 1131 | // Program Location. |
Ted Kremenek | dd9e97d | 2008-01-16 21:46:15 +0000 | [diff] [blame] | 1132 | ProgramPoint Loc = N->getLocation(); |
| 1133 | |
| 1134 | switch (Loc.getKind()) { |
| 1135 | case ProgramPoint::BlockEntranceKind: |
| 1136 | Out << "Block Entrance: B" |
| 1137 | << cast<BlockEntrance>(Loc).getBlock()->getBlockID(); |
| 1138 | break; |
| 1139 | |
| 1140 | case ProgramPoint::BlockExitKind: |
| 1141 | assert (false); |
| 1142 | break; |
| 1143 | |
| 1144 | case ProgramPoint::PostStmtKind: { |
| 1145 | const PostStmt& L = cast<PostStmt>(Loc); |
Ted Kremenek | 3ec7be9 | 2008-01-24 22:27:20 +0000 | [diff] [blame] | 1146 | Out << L.getStmt()->getStmtClassName() << ':' |
| 1147 | << (void*) L.getStmt() << ' '; |
| 1148 | |
Ted Kremenek | dd9e97d | 2008-01-16 21:46:15 +0000 | [diff] [blame] | 1149 | L.getStmt()->printPretty(Out); |
Ted Kremenek | 80d52d0 | 2008-02-07 05:48:01 +0000 | [diff] [blame] | 1150 | |
| 1151 | if (GraphPrintCheckerState->isImplicitNullDeref(N)) { |
| 1152 | Out << "\\|Implicit-Null Dereference.\\l"; |
| 1153 | } |
Ted Kremenek | ae7bdc1 | 2008-02-07 06:04:18 +0000 | [diff] [blame] | 1154 | else if (GraphPrintCheckerState->isExplicitNullDeref(N)) { |
| 1155 | Out << "\\|Explicit-Null Dereference.\\l"; |
| 1156 | } |
Ted Kremenek | 80d52d0 | 2008-02-07 05:48:01 +0000 | [diff] [blame] | 1157 | |
Ted Kremenek | dd9e97d | 2008-01-16 21:46:15 +0000 | [diff] [blame] | 1158 | break; |
| 1159 | } |
| 1160 | |
| 1161 | default: { |
| 1162 | const BlockEdge& E = cast<BlockEdge>(Loc); |
| 1163 | Out << "Edge: (B" << E.getSrc()->getBlockID() << ", B" |
| 1164 | << E.getDst()->getBlockID() << ')'; |
Ted Kremenek | 9096097 | 2008-01-30 23:03:39 +0000 | [diff] [blame] | 1165 | |
| 1166 | if (Stmt* T = E.getSrc()->getTerminator()) { |
| 1167 | Out << "\\|Terminator: "; |
| 1168 | E.getSrc()->printTerminator(Out); |
| 1169 | |
Ted Kremenek | aee121c | 2008-02-13 23:08:21 +0000 | [diff] [blame] | 1170 | if (isa<SwitchStmt>(T)) { |
| 1171 | Stmt* Label = E.getDst()->getLabel(); |
| 1172 | |
| 1173 | if (Label) { |
| 1174 | if (CaseStmt* C = dyn_cast<CaseStmt>(Label)) { |
| 1175 | Out << "\\lcase "; |
| 1176 | C->getLHS()->printPretty(Out); |
| 1177 | |
| 1178 | if (Stmt* RHS = C->getRHS()) { |
| 1179 | Out << " .. "; |
| 1180 | RHS->printPretty(Out); |
| 1181 | } |
| 1182 | |
| 1183 | Out << ":"; |
| 1184 | } |
| 1185 | else { |
| 1186 | assert (isa<DefaultStmt>(Label)); |
| 1187 | Out << "\\ldefault:"; |
| 1188 | } |
| 1189 | } |
| 1190 | else |
| 1191 | Out << "\\l(implicit) default:"; |
| 1192 | } |
| 1193 | else if (isa<IndirectGotoStmt>(T)) { |
Ted Kremenek | 9096097 | 2008-01-30 23:03:39 +0000 | [diff] [blame] | 1194 | // FIXME |
| 1195 | } |
| 1196 | else { |
| 1197 | Out << "\\lCondition: "; |
| 1198 | if (*E.getSrc()->succ_begin() == E.getDst()) |
| 1199 | Out << "true"; |
| 1200 | else |
| 1201 | Out << "false"; |
| 1202 | } |
| 1203 | |
| 1204 | Out << "\\l"; |
| 1205 | } |
Ted Kremenek | 428d39e | 2008-01-30 23:24:39 +0000 | [diff] [blame] | 1206 | |
| 1207 | if (GraphPrintCheckerState->isUninitControlFlow(N)) { |
| 1208 | Out << "\\|Control-flow based on\\lUninitialized value.\\l"; |
| 1209 | } |
Ted Kremenek | dd9e97d | 2008-01-16 21:46:15 +0000 | [diff] [blame] | 1210 | } |
| 1211 | } |
| 1212 | |
Ted Kremenek | 2d8dce3 | 2008-02-05 07:17:49 +0000 | [diff] [blame] | 1213 | Out << "\\|StateID: " << (void*) N->getState().getImpl() << "\\|"; |
Ted Kremenek | 08cfd83 | 2008-02-08 21:10:02 +0000 | [diff] [blame] | 1214 | |
Ted Kremenek | 17c5f11 | 2008-02-11 19:21:59 +0000 | [diff] [blame] | 1215 | N->getState().printDOT(Out); |
Ted Kremenek | bacd6cd | 2008-01-23 22:30:44 +0000 | [diff] [blame] | 1216 | |
Ted Kremenek | bacd6cd | 2008-01-23 22:30:44 +0000 | [diff] [blame] | 1217 | Out << "\\l"; |
Ted Kremenek | dd9e97d | 2008-01-16 21:46:15 +0000 | [diff] [blame] | 1218 | return Out.str(); |
| 1219 | } |
| 1220 | }; |
| 1221 | } // end llvm namespace |
| 1222 | #endif |
| 1223 | |
Ted Kremenek | 3862eb1 | 2008-02-14 22:36:46 +0000 | [diff] [blame] | 1224 | void GRExprEngine::ViewGraph() { |
Ted Kremenek | dd9e97d | 2008-01-16 21:46:15 +0000 | [diff] [blame] | 1225 | #ifndef NDEBUG |
Ted Kremenek | 3862eb1 | 2008-02-14 22:36:46 +0000 | [diff] [blame] | 1226 | GraphPrintCheckerState = this; |
| 1227 | llvm::ViewGraph(*G.roots_begin(), "GRExprEngine"); |
Ted Kremenek | 428d39e | 2008-01-30 23:24:39 +0000 | [diff] [blame] | 1228 | GraphPrintCheckerState = NULL; |
Ted Kremenek | 3862eb1 | 2008-02-14 22:36:46 +0000 | [diff] [blame] | 1229 | #endif |
Ted Kremenek | d2500ab | 2008-01-16 18:18:48 +0000 | [diff] [blame] | 1230 | } |