blob: d7138b24667b42f7adb57b236dc59f818bfc59e6 [file] [log] [blame]
Ted Kremenek25a484d2008-02-14 18:28:23 +00001// GRSimpleVals.cpp - Transfer functions for tracking simple values -*- C++ -*--
2//
3// The LLVM Compiler Infrastructure
4//
5// This file is distributed under the University of Illinois Open Source
6// License. See LICENSE.TXT for details.
7//
8//===----------------------------------------------------------------------===//
9//
Gabor Greif2224fcb2008-03-06 10:40:09 +000010// This file defines GRSimpleVals, a sub-class of GRTransferFuncs that
Ted Kremenek25a484d2008-02-14 18:28:23 +000011// provides transfer functions for performing simple value tracking with
12// limited support for symbolics.
13//
14//===----------------------------------------------------------------------===//
15
16#include "GRSimpleVals.h"
Ted Kremenek7a681942008-03-27 17:17:22 +000017#include "BasicObjCFoundationChecks.h"
Ted Kremenek07d46202008-04-02 22:03:53 +000018#include "clang/Basic/SourceManager.h"
Ted Kremenekdd0126b2008-03-31 18:26:32 +000019#include "clang/Analysis/PathDiagnostic.h"
Ted Kremenek7d882202008-04-03 04:42:52 +000020#include "clang/Analysis/PathSensitive/ValueState.h"
21#include "clang/Analysis/PathSensitive/BugReporter.h"
22#include "llvm/Support/Compiler.h"
Ted Kremenek9cac66e2008-02-27 17:56:16 +000023#include <sstream>
Ted Kremenek25a484d2008-02-14 18:28:23 +000024
25using namespace clang;
26
Ted Kremenekd1d4d752008-04-02 07:05:46 +000027//===----------------------------------------------------------------------===//
28// Bug Descriptions.
29//===----------------------------------------------------------------------===//
Ted Kremenekf567a822008-02-26 21:31:18 +000030
Ted Kremenek7d882202008-04-03 04:42:52 +000031namespace {
32
33class VISIBILITY_HIDDEN NullDeref : public BugDescription {
34public:
35 virtual const char* getName() const {
36 return "null dereference";
37 }
38 virtual const char* getDescription() const {
39 return "Dereference of null pointer.";
40 }
Ted Kremenekd1d4d752008-04-02 07:05:46 +000041};
42
Ted Kremenek7d882202008-04-03 04:42:52 +000043class VISIBILITY_HIDDEN UndefDeref : public BugDescription {
44public:
45 virtual const char* getName() const {
46 return "bad dereference";
47 }
48 virtual const char* getDescription() const {
49 return "Dereference of undefined value.";
50 }
51};
Ted Kremenekd1d4d752008-04-02 07:05:46 +000052
Ted Kremenek7d882202008-04-03 04:42:52 +000053class VISIBILITY_HIDDEN UndefBranch : public BugDescription {
54public:
55 virtual const char* getName() const {
56 return "uninitialized value";
57 }
58 virtual const char* getDescription() const {
59 return "Branch condition evaluates to an uninitialized value.";
60 }
61};
Ted Kremenekd1d4d752008-04-02 07:05:46 +000062
Ted Kremenek7d882202008-04-03 04:42:52 +000063class VISIBILITY_HIDDEN DivZero : public BugDescription {
64public:
65 virtual const char* getName() const {
66 return "divide-by-zero";
67 }
68 virtual const char* getDescription() const {
69 return "Division by zero/undefined value.";
70 }
71};
Ted Kremenekd1d4d752008-04-02 07:05:46 +000072
Ted Kremenek7d882202008-04-03 04:42:52 +000073class VISIBILITY_HIDDEN UndefResult : public BugDescription {
74public:
75 virtual const char* getName() const {
76 return "undefined result";
77 }
78 virtual const char* getDescription() const {
79 return "Result of operation is undefined.";
80 }
81};
Ted Kremenekd1d4d752008-04-02 07:05:46 +000082
Ted Kremenek7d882202008-04-03 04:42:52 +000083class VISIBILITY_HIDDEN BadCall : public BugDescription {
84public:
85 virtual const char* getName() const {
86 return "invalid function call";
87 }
88 virtual const char* getDescription() const {
89 return "Called function is a NULL or undefined function pointer value.";
90 }
91};
Ted Kremenekd1d4d752008-04-02 07:05:46 +000092
Ted Kremenek7d882202008-04-03 04:42:52 +000093class VISIBILITY_HIDDEN BadArg : public BugDescription {
94public:
95 virtual const char* getName() const {
96 return "bad argument";
97 }
98 virtual const char* getDescription() const {
99 return "Pass-by-value argument in function is undefined.";
100 }
101};
102
103class VISIBILITY_HIDDEN BadMsgExprArg : public BugDescription {
104public:
105 virtual const char* getName() const {
Ted Kremenekccfa35b2008-04-03 18:46:16 +0000106 return "bad receiver";
Ted Kremenek7d882202008-04-03 04:42:52 +0000107 }
108 virtual const char* getDescription() const {
109 return "Pass-by-value argument in message expression is undefined.";
110 }
111};
112
113class VISIBILITY_HIDDEN BadReceiver : public BugDescription {
Ted Kremenekccfa35b2008-04-03 18:46:16 +0000114 SourceRange R;
Ted Kremenek7d882202008-04-03 04:42:52 +0000115public:
Ted Kremenekccfa35b2008-04-03 18:46:16 +0000116 BadReceiver(ExplodedNode<ValueState>* N) {
117 Stmt *S = cast<PostStmt>(N->getLocation()).getStmt();
118 Expr* E = cast<ObjCMessageExpr>(S)->getReceiver();
119 assert (E && "Receiver cannot be NULL");
120 R = E->getSourceRange();
121 }
122
Ted Kremenek7d882202008-04-03 04:42:52 +0000123 virtual const char* getName() const {
124 return "invalid message expression";
125 }
126 virtual const char* getDescription() const {
127 return "Receiver in message expression is an uninitialized value.";
128 }
Ted Kremenekccfa35b2008-04-03 18:46:16 +0000129
130 virtual void getRanges(const SourceRange*& B, const SourceRange*& E) const {
131 B = &R;
132 E = B+1;
133 }
Ted Kremenek7d882202008-04-03 04:42:52 +0000134};
135
136class VISIBILITY_HIDDEN RetStack : public BugDescription {
137public:
138 virtual const char* getName() const {
139 return "return of stack address";
140 }
141 virtual const char* getDescription() const {
142 return "Address of stack-allocated variable returned.";
143 }
144};
145
146} // end anonymous namespace
Ted Kremenekd1d4d752008-04-02 07:05:46 +0000147
148//===----------------------------------------------------------------------===//
149// Utility functions.
150//===----------------------------------------------------------------------===//
151
Ted Kremenek7d882202008-04-03 04:42:52 +0000152template <typename ITERATOR> static inline
153ExplodedNode<ValueState>* GetNode(ITERATOR I) {
Ted Kremenek139bf402008-04-02 05:15:22 +0000154 return *I;
155}
156
Ted Kremenek7d882202008-04-03 04:42:52 +0000157template <> static inline
158ExplodedNode<ValueState>* GetNode(GRExprEngine::undef_arg_iterator I) {
Ted Kremenek139bf402008-04-02 05:15:22 +0000159 return I->first;
160}
Ted Kremenekd1d4d752008-04-02 07:05:46 +0000161
162//===----------------------------------------------------------------------===//
Ted Kremenek139bf402008-04-02 05:15:22 +0000163// Analysis Driver.
164//===----------------------------------------------------------------------===//
Ted Kremenek7d882202008-04-03 04:42:52 +0000165
166template <typename ITERATOR>
167static void EmitWarning(Diagnostic& Diag, PathDiagnosticClient* PD,
168 ASTContext& Ctx, BugReporter& BR,
169 const BugDescription& Desc,
170 ExplodedGraph<GRExprEngine>& G,
171 ITERATOR I, ITERATOR E) {
Ted Kremenek139bf402008-04-02 05:15:22 +0000172
Ted Kremenek7d882202008-04-03 04:42:52 +0000173 for (; I != E; ++I)
174 BR.EmitPathWarning(Diag, PD, Ctx, Desc, G, GetNode(I));
175}
176
Ted Kremenekd1d4d752008-04-02 07:05:46 +0000177namespace clang {
178
Ted Kremenek5d257d42008-03-14 17:31:00 +0000179unsigned RunGRSimpleVals(CFG& cfg, Decl& CD, ASTContext& Ctx,
Ted Kremenekf00daf02008-04-03 17:57:38 +0000180 Diagnostic& Diag, PathDiagnosticClient* PD,
181 bool Visualize, bool TrimGraph) {
Ted Kremenek07baa252008-02-21 18:02:17 +0000182
Ted Kremenek5d257d42008-03-14 17:31:00 +0000183 GRCoreEngine<GRExprEngine> Eng(cfg, CD, Ctx);
Ted Kremenekd1d4d752008-04-02 07:05:46 +0000184 GRExprEngine* CS = &Eng.getCheckerState();
Ted Kremenek7a681942008-03-27 17:17:22 +0000185
186 // Set base transfer functions.
Ted Kremenek07baa252008-02-21 18:02:17 +0000187 GRSimpleVals GRSV;
Ted Kremenekd1d4d752008-04-02 07:05:46 +0000188 CS->setTransferFunctions(GRSV);
Ted Kremenek07baa252008-02-21 18:02:17 +0000189
Ted Kremenek7a681942008-03-27 17:17:22 +0000190 // Add extra checkers.
191 llvm::OwningPtr<GRSimpleAPICheck> FoundationCheck(
Ted Kremenekd1d4d752008-04-02 07:05:46 +0000192 CreateBasicObjCFoundationChecks(Ctx, &CS->getStateManager()));
Ted Kremenek7a681942008-03-27 17:17:22 +0000193
Ted Kremenekd1d4d752008-04-02 07:05:46 +0000194 CS->AddObjCMessageExprCheck(FoundationCheck.get());
Ted Kremenek7a681942008-03-27 17:17:22 +0000195
Ted Kremenek07baa252008-02-21 18:02:17 +0000196 // Execute the worklist algorithm.
Ted Kremenekdd0126b2008-03-31 18:26:32 +0000197 Eng.ExecuteWorkList(120000);
Ted Kremenek07baa252008-02-21 18:02:17 +0000198
Ted Kremenek7d882202008-04-03 04:42:52 +0000199 BugReporter BR;
200 ExplodedGraph<GRExprEngine>& G = Eng.getGraph();
201
202 EmitWarning(Diag, PD, Ctx, BR, NullDeref(), G,
203 CS->null_derefs_begin(), CS->null_derefs_end());
Ted Kremenekf567a822008-02-26 21:31:18 +0000204
Ted Kremenekd1d4d752008-04-02 07:05:46 +0000205
Ted Kremenek7d882202008-04-03 04:42:52 +0000206 EmitWarning(Diag, PD, Ctx, BR, UndefDeref(), G,
207 CS->undef_derefs_begin(), CS->undef_derefs_end());
208
209 EmitWarning(Diag, PD, Ctx, BR, UndefBranch(), G,
210 CS->undef_branches_begin(), CS->undef_branches_end());
Ted Kremenekf567a822008-02-26 21:31:18 +0000211
Ted Kremenek7d882202008-04-03 04:42:52 +0000212 EmitWarning(Diag, PD, Ctx, BR, DivZero(), G,
213 CS->explicit_bad_divides_begin(), CS->explicit_bad_divides_end());
Ted Kremenekf567a822008-02-26 21:31:18 +0000214
Ted Kremenek7d882202008-04-03 04:42:52 +0000215 EmitWarning(Diag, PD, Ctx, BR, UndefResult(), G,
216 CS->undef_results_begin(), CS->undef_results_end());
Ted Kremenekf567a822008-02-26 21:31:18 +0000217
Ted Kremenek7d882202008-04-03 04:42:52 +0000218 EmitWarning(Diag, PD, Ctx, BR, BadCall(), G,
219 CS->bad_calls_begin(), CS->bad_calls_end());
Ted Kremenekc2d07202008-02-28 20:32:03 +0000220
Ted Kremenek7d882202008-04-03 04:42:52 +0000221 EmitWarning(Diag, PD, Ctx, BR, BadArg(), G,
222 CS->undef_arg_begin(), CS->undef_arg_end());
Ted Kremenek43863eb2008-02-29 23:14:48 +0000223
Ted Kremenek7d882202008-04-03 04:42:52 +0000224 EmitWarning(Diag, PD, Ctx, BR, BadMsgExprArg(), G,
225 CS->msg_expr_undef_arg_begin(), CS->msg_expr_undef_arg_end());
Ted Kremenek9b31f5b2008-02-29 23:53:11 +0000226
Ted Kremenekccfa35b2008-04-03 18:46:16 +0000227 for (GRExprEngine::UndefReceiversTy::iterator I = CS->undef_receivers_begin(),
228 E = CS->undef_receivers_end(); I!=E; ++I) {
229
230 BadReceiver Desc(*I);
231 BR.EmitPathWarning(Diag, PD, Ctx, Desc, G, *I);
232 }
Ted Kremenek2f0c0e12008-03-14 18:14:50 +0000233
Ted Kremenek7d882202008-04-03 04:42:52 +0000234 EmitWarning(Diag, PD, Ctx, BR, RetStack(), G,
235 CS->ret_stackaddr_begin(), CS->ret_stackaddr_end());
Ted Kremenekd58da2b2008-03-25 16:40:05 +0000236
Ted Kremenekf00daf02008-04-03 17:57:38 +0000237
238 FoundationCheck.get()->ReportResults(Diag, PD, Ctx, BR, G);
Ted Kremenek07baa252008-02-21 18:02:17 +0000239#ifndef NDEBUG
Ted Kremenekd1d4d752008-04-02 07:05:46 +0000240 if (Visualize) CS->ViewGraph(TrimGraph);
Ted Kremenek07baa252008-02-21 18:02:17 +0000241#endif
242
Ted Kremenekce3ed1e2008-03-12 01:21:45 +0000243 return Eng.getGraph().size();
Ted Kremenek07baa252008-02-21 18:02:17 +0000244}
245
Ted Kremenek3862eb12008-02-14 22:36:46 +0000246} // end clang namespace
247
Ted Kremenek25a484d2008-02-14 18:28:23 +0000248//===----------------------------------------------------------------------===//
249// Transfer function for Casts.
250//===----------------------------------------------------------------------===//
251
Ted Kremenekce3ed1e2008-03-12 01:21:45 +0000252RVal GRSimpleVals::EvalCast(GRExprEngine& Eng, NonLVal X, QualType T) {
Ted Kremenekbc965a62008-02-18 22:57:02 +0000253
Ted Kremenek25a484d2008-02-14 18:28:23 +0000254 if (!isa<nonlval::ConcreteInt>(X))
255 return UnknownVal();
Ted Kremenekce3ed1e2008-03-12 01:21:45 +0000256
257 BasicValueFactory& BasicVals = Eng.getBasicVals();
Ted Kremenek25a484d2008-02-14 18:28:23 +0000258
259 llvm::APSInt V = cast<nonlval::ConcreteInt>(X).getValue();
Ted Kremenek2f0c0e12008-03-14 18:14:50 +0000260 V.setIsUnsigned(T->isUnsignedIntegerType() || T->isPointerType()
261 || T->isObjCQualifiedIdType());
Ted Kremenekce3ed1e2008-03-12 01:21:45 +0000262 V.extOrTrunc(Eng.getContext().getTypeSize(T));
Ted Kremenek25a484d2008-02-14 18:28:23 +0000263
Ted Kremenek9cfda3f2008-02-21 18:43:30 +0000264 if (T->isPointerType())
Ted Kremenek8ad19872008-03-07 20:13:31 +0000265 return lval::ConcreteInt(BasicVals.getValue(V));
Ted Kremenek25a484d2008-02-14 18:28:23 +0000266 else
Ted Kremenek8ad19872008-03-07 20:13:31 +0000267 return nonlval::ConcreteInt(BasicVals.getValue(V));
Ted Kremenek25a484d2008-02-14 18:28:23 +0000268}
269
270// Casts.
271
Ted Kremenekce3ed1e2008-03-12 01:21:45 +0000272RVal GRSimpleVals::EvalCast(GRExprEngine& Eng, LVal X, QualType T) {
Ted Kremenekbc965a62008-02-18 22:57:02 +0000273
Chris Lattnera05f7d22008-04-02 17:45:06 +0000274 if (T->isPointerLikeType() || T->isObjCQualifiedIdType())
Ted Kremenek25a484d2008-02-14 18:28:23 +0000275 return X;
276
Ted Kremenek9cfda3f2008-02-21 18:43:30 +0000277 assert (T->isIntegerType());
Ted Kremenek25a484d2008-02-14 18:28:23 +0000278
279 if (!isa<lval::ConcreteInt>(X))
280 return UnknownVal();
281
Ted Kremenekce3ed1e2008-03-12 01:21:45 +0000282 BasicValueFactory& BasicVals = Eng.getBasicVals();
283
Ted Kremenek25a484d2008-02-14 18:28:23 +0000284 llvm::APSInt V = cast<lval::ConcreteInt>(X).getValue();
Ted Kremenek25a484d2008-02-14 18:28:23 +0000285 V.setIsUnsigned(T->isUnsignedIntegerType() || T->isPointerType());
Ted Kremenekce3ed1e2008-03-12 01:21:45 +0000286 V.extOrTrunc(Eng.getContext().getTypeSize(T));
Ted Kremenek25a484d2008-02-14 18:28:23 +0000287
Ted Kremenek8ad19872008-03-07 20:13:31 +0000288 return nonlval::ConcreteInt(BasicVals.getValue(V));
Ted Kremenekc9922fd2008-02-14 18:40:24 +0000289}
290
291// Unary operators.
292
Ted Kremenekce3ed1e2008-03-12 01:21:45 +0000293RVal GRSimpleVals::EvalMinus(GRExprEngine& Eng, UnaryOperator* U, NonLVal X){
Ted Kremenekbc965a62008-02-18 22:57:02 +0000294
Ted Kremenekc9922fd2008-02-14 18:40:24 +0000295 switch (X.getSubKind()) {
Ted Kremenek07baa252008-02-21 18:02:17 +0000296
Ted Kremenekc9922fd2008-02-14 18:40:24 +0000297 case nonlval::ConcreteIntKind:
Ted Kremenekce3ed1e2008-03-12 01:21:45 +0000298 return cast<nonlval::ConcreteInt>(X).EvalMinus(Eng.getBasicVals(), U);
Ted Kremenek07baa252008-02-21 18:02:17 +0000299
Ted Kremenekc9922fd2008-02-14 18:40:24 +0000300 default:
Ted Kremenek07baa252008-02-21 18:02:17 +0000301 return UnknownVal();
Ted Kremenekc9922fd2008-02-14 18:40:24 +0000302 }
303}
304
Ted Kremenekce3ed1e2008-03-12 01:21:45 +0000305RVal GRSimpleVals::EvalComplement(GRExprEngine& Eng, NonLVal X) {
Ted Kremenek07baa252008-02-21 18:02:17 +0000306
Ted Kremenek0cd96352008-02-20 04:12:31 +0000307 switch (X.getSubKind()) {
Ted Kremenek07baa252008-02-21 18:02:17 +0000308
Ted Kremenekc9922fd2008-02-14 18:40:24 +0000309 case nonlval::ConcreteIntKind:
Ted Kremenekce3ed1e2008-03-12 01:21:45 +0000310 return cast<nonlval::ConcreteInt>(X).EvalComplement(Eng.getBasicVals());
Ted Kremenek07baa252008-02-21 18:02:17 +0000311
Ted Kremenekc9922fd2008-02-14 18:40:24 +0000312 default:
Ted Kremenek07baa252008-02-21 18:02:17 +0000313 return UnknownVal();
Ted Kremenekc9922fd2008-02-14 18:40:24 +0000314 }
315}
Ted Kremenekb1934132008-02-14 19:37:24 +0000316
317// Binary operators.
318
Ted Kremenekce3ed1e2008-03-12 01:21:45 +0000319RVal GRSimpleVals::EvalBinOp(GRExprEngine& Eng, BinaryOperator::Opcode Op,
320 NonLVal L, NonLVal R) {
321
322 BasicValueFactory& BasicVals = Eng.getBasicVals();
323
Ted Kremenek07baa252008-02-21 18:02:17 +0000324 while (1) {
Ted Kremenekb1934132008-02-14 19:37:24 +0000325
Ted Kremenek07baa252008-02-21 18:02:17 +0000326 switch (L.getSubKind()) {
Ted Kremenekb1934132008-02-14 19:37:24 +0000327 default:
Ted Kremenekde89ec02008-02-21 19:10:12 +0000328 return UnknownVal();
Ted Kremenekb1934132008-02-14 19:37:24 +0000329
330 case nonlval::ConcreteIntKind:
331
Ted Kremenek07baa252008-02-21 18:02:17 +0000332 if (isa<nonlval::ConcreteInt>(R)) {
333 const nonlval::ConcreteInt& L_CI = cast<nonlval::ConcreteInt>(L);
334 const nonlval::ConcreteInt& R_CI = cast<nonlval::ConcreteInt>(R);
Ted Kremenek8ad19872008-03-07 20:13:31 +0000335 return L_CI.EvalBinOp(BasicVals, Op, R_CI);
Ted Kremenekb1934132008-02-14 19:37:24 +0000336 }
Ted Kremenekb1934132008-02-14 19:37:24 +0000337 else {
Ted Kremenek07baa252008-02-21 18:02:17 +0000338 NonLVal tmp = R;
339 R = L;
340 L = tmp;
Ted Kremenekb1934132008-02-14 19:37:24 +0000341 continue;
342 }
343
344 case nonlval::SymbolValKind: {
Ted Kremenek07baa252008-02-21 18:02:17 +0000345
346 if (isa<nonlval::ConcreteInt>(R)) {
Ted Kremenekb1934132008-02-14 19:37:24 +0000347 const SymIntConstraint& C =
Ted Kremenek8ad19872008-03-07 20:13:31 +0000348 BasicVals.getConstraint(cast<nonlval::SymbolVal>(L).getSymbol(), Op,
Ted Kremenekce3ed1e2008-03-12 01:21:45 +0000349 cast<nonlval::ConcreteInt>(R).getValue());
Ted Kremenekb1934132008-02-14 19:37:24 +0000350
351 return nonlval::SymIntConstraintVal(C);
352 }
353 else
Ted Kremenek07baa252008-02-21 18:02:17 +0000354 return UnknownVal();
Ted Kremenekb1934132008-02-14 19:37:24 +0000355 }
356 }
357 }
358}
359
Ted Kremenek775e0d82008-02-15 00:52:26 +0000360
Ted Kremenek521d9722008-02-15 23:15:23 +0000361// Binary Operators (except assignments and comma).
362
Ted Kremenekce3ed1e2008-03-12 01:21:45 +0000363RVal GRSimpleVals::EvalBinOp(GRExprEngine& Eng, BinaryOperator::Opcode Op,
Ted Kremenek07baa252008-02-21 18:02:17 +0000364 LVal L, LVal R) {
Ted Kremenekbc965a62008-02-18 22:57:02 +0000365
Ted Kremenek521d9722008-02-15 23:15:23 +0000366 switch (Op) {
Ted Kremenek07baa252008-02-21 18:02:17 +0000367
Ted Kremenek521d9722008-02-15 23:15:23 +0000368 default:
369 return UnknownVal();
370
371 case BinaryOperator::EQ:
Ted Kremenekce3ed1e2008-03-12 01:21:45 +0000372 return EvalEQ(Eng, L, R);
Ted Kremenek521d9722008-02-15 23:15:23 +0000373
374 case BinaryOperator::NE:
Ted Kremenekce3ed1e2008-03-12 01:21:45 +0000375 return EvalNE(Eng, L, R);
Ted Kremenek521d9722008-02-15 23:15:23 +0000376 }
377}
378
Ted Kremenek775e0d82008-02-15 00:52:26 +0000379// Pointer arithmetic.
380
Ted Kremenekce3ed1e2008-03-12 01:21:45 +0000381RVal GRSimpleVals::EvalBinOp(GRExprEngine& Eng, BinaryOperator::Opcode Op,
Ted Kremenek07baa252008-02-21 18:02:17 +0000382 LVal L, NonLVal R) {
383 return UnknownVal();
Ted Kremenek775e0d82008-02-15 00:52:26 +0000384}
385
Ted Kremenek07baa252008-02-21 18:02:17 +0000386// Equality operators for LVals.
Ted Kremenekb1934132008-02-14 19:37:24 +0000387
Ted Kremenekce3ed1e2008-03-12 01:21:45 +0000388RVal GRSimpleVals::EvalEQ(GRExprEngine& Eng, LVal L, LVal R) {
389
390 BasicValueFactory& BasicVals = Eng.getBasicVals();
Ted Kremenek07baa252008-02-21 18:02:17 +0000391
392 switch (L.getSubKind()) {
Ted Kremenekb1934132008-02-14 19:37:24 +0000393
Ted Kremenekb1934132008-02-14 19:37:24 +0000394 default:
Ted Kremenek07baa252008-02-21 18:02:17 +0000395 assert(false && "EQ not implemented for this LVal.");
396 return UnknownVal();
Ted Kremenekb1934132008-02-14 19:37:24 +0000397
398 case lval::ConcreteIntKind:
Ted Kremenek07baa252008-02-21 18:02:17 +0000399
400 if (isa<lval::ConcreteInt>(R)) {
401 bool b = cast<lval::ConcreteInt>(L).getValue() ==
402 cast<lval::ConcreteInt>(R).getValue();
Ted Kremenekb1934132008-02-14 19:37:24 +0000403
Ted Kremenek8ad19872008-03-07 20:13:31 +0000404 return NonLVal::MakeIntTruthVal(BasicVals, b);
Ted Kremenekb1934132008-02-14 19:37:24 +0000405 }
Ted Kremenek07baa252008-02-21 18:02:17 +0000406 else if (isa<lval::SymbolVal>(R)) {
Ted Kremenekb1934132008-02-14 19:37:24 +0000407
408 const SymIntConstraint& C =
Ted Kremenek8ad19872008-03-07 20:13:31 +0000409 BasicVals.getConstraint(cast<lval::SymbolVal>(R).getSymbol(),
Ted Kremenekb1934132008-02-14 19:37:24 +0000410 BinaryOperator::EQ,
Ted Kremenek07baa252008-02-21 18:02:17 +0000411 cast<lval::ConcreteInt>(L).getValue());
Ted Kremenekb1934132008-02-14 19:37:24 +0000412
413 return nonlval::SymIntConstraintVal(C);
414 }
415
416 break;
417
Ted Kremenek07baa252008-02-21 18:02:17 +0000418 case lval::SymbolValKind: {
419
420 if (isa<lval::ConcreteInt>(R)) {
421 const SymIntConstraint& C =
Ted Kremenek8ad19872008-03-07 20:13:31 +0000422 BasicVals.getConstraint(cast<lval::SymbolVal>(L).getSymbol(),
Ted Kremenek07baa252008-02-21 18:02:17 +0000423 BinaryOperator::EQ,
424 cast<lval::ConcreteInt>(R).getValue());
Ted Kremenekb1934132008-02-14 19:37:24 +0000425
Ted Kremenek07baa252008-02-21 18:02:17 +0000426 return nonlval::SymIntConstraintVal(C);
Ted Kremenekb1934132008-02-14 19:37:24 +0000427 }
428
Ted Kremenekfe944c42008-02-22 18:41:59 +0000429 // FIXME: Implement == for lval Symbols. This is mainly useful
430 // in iterator loops when traversing a buffer, e.g. while(z != zTerm).
431 // Since this is not useful for many checkers we'll punt on this for
432 // now.
433
434 return UnknownVal();
Ted Kremenek07baa252008-02-21 18:02:17 +0000435 }
Ted Kremenekb1934132008-02-14 19:37:24 +0000436
Ted Kremenek07baa252008-02-21 18:02:17 +0000437 case lval::DeclValKind:
Ted Kremenek38706192008-02-22 00:54:56 +0000438 case lval::FuncValKind:
439 case lval::GotoLabelKind:
Ted Kremenek8ad19872008-03-07 20:13:31 +0000440 return NonLVal::MakeIntTruthVal(BasicVals, L == R);
Ted Kremenekb1934132008-02-14 19:37:24 +0000441 }
442
Ted Kremenek8ad19872008-03-07 20:13:31 +0000443 return NonLVal::MakeIntTruthVal(BasicVals, false);
Ted Kremenekb1934132008-02-14 19:37:24 +0000444}
445
Ted Kremenekce3ed1e2008-03-12 01:21:45 +0000446RVal GRSimpleVals::EvalNE(GRExprEngine& Eng, LVal L, LVal R) {
Ted Kremenekbc965a62008-02-18 22:57:02 +0000447
Ted Kremenekce3ed1e2008-03-12 01:21:45 +0000448 BasicValueFactory& BasicVals = Eng.getBasicVals();
449
Ted Kremenek07baa252008-02-21 18:02:17 +0000450 switch (L.getSubKind()) {
Ted Kremenekb1934132008-02-14 19:37:24 +0000451
Ted Kremenekb1934132008-02-14 19:37:24 +0000452 default:
Ted Kremenek07baa252008-02-21 18:02:17 +0000453 assert(false && "NE not implemented for this LVal.");
454 return UnknownVal();
Ted Kremenekb1934132008-02-14 19:37:24 +0000455
456 case lval::ConcreteIntKind:
Ted Kremenek07baa252008-02-21 18:02:17 +0000457
458 if (isa<lval::ConcreteInt>(R)) {
459 bool b = cast<lval::ConcreteInt>(L).getValue() !=
460 cast<lval::ConcreteInt>(R).getValue();
Ted Kremenekb1934132008-02-14 19:37:24 +0000461
Ted Kremenek8ad19872008-03-07 20:13:31 +0000462 return NonLVal::MakeIntTruthVal(BasicVals, b);
Ted Kremenekb1934132008-02-14 19:37:24 +0000463 }
Ted Kremenek07baa252008-02-21 18:02:17 +0000464 else if (isa<lval::SymbolVal>(R)) {
Ted Kremenekb1934132008-02-14 19:37:24 +0000465 const SymIntConstraint& C =
Ted Kremenek8ad19872008-03-07 20:13:31 +0000466 BasicVals.getConstraint(cast<lval::SymbolVal>(R).getSymbol(),
Ted Kremenekce3ed1e2008-03-12 01:21:45 +0000467 BinaryOperator::NE,
468 cast<lval::ConcreteInt>(L).getValue());
Ted Kremenekb1934132008-02-14 19:37:24 +0000469
470 return nonlval::SymIntConstraintVal(C);
471 }
472
473 break;
474
Ted Kremenek07baa252008-02-21 18:02:17 +0000475 case lval::SymbolValKind: {
476 if (isa<lval::ConcreteInt>(R)) {
477 const SymIntConstraint& C =
Ted Kremenek8ad19872008-03-07 20:13:31 +0000478 BasicVals.getConstraint(cast<lval::SymbolVal>(L).getSymbol(),
Ted Kremenekce3ed1e2008-03-12 01:21:45 +0000479 BinaryOperator::NE,
480 cast<lval::ConcreteInt>(R).getValue());
Ted Kremenekb1934132008-02-14 19:37:24 +0000481
Ted Kremenek07baa252008-02-21 18:02:17 +0000482 return nonlval::SymIntConstraintVal(C);
Ted Kremenekb1934132008-02-14 19:37:24 +0000483 }
484
Ted Kremenekfe944c42008-02-22 18:41:59 +0000485 // FIXME: Implement != for lval Symbols. This is mainly useful
486 // in iterator loops when traversing a buffer, e.g. while(z != zTerm).
487 // Since this is not useful for many checkers we'll punt on this for
488 // now.
489
490 return UnknownVal();
Ted Kremenekb1934132008-02-14 19:37:24 +0000491
492 break;
Ted Kremenek07baa252008-02-21 18:02:17 +0000493 }
494
495 case lval::DeclValKind:
Ted Kremenek38706192008-02-22 00:54:56 +0000496 case lval::FuncValKind:
497 case lval::GotoLabelKind:
Ted Kremenek8ad19872008-03-07 20:13:31 +0000498 return NonLVal::MakeIntTruthVal(BasicVals, L != R);
Ted Kremenekb1934132008-02-14 19:37:24 +0000499 }
500
Ted Kremenek8ad19872008-03-07 20:13:31 +0000501 return NonLVal::MakeIntTruthVal(BasicVals, true);
Ted Kremenekb1934132008-02-14 19:37:24 +0000502}
Ted Kremenek348d7852008-02-26 23:04:29 +0000503
504//===----------------------------------------------------------------------===//
505// Transfer function for Function Calls.
506//===----------------------------------------------------------------------===//
507
Ted Kremenek3eea8dd2008-03-05 00:33:14 +0000508void GRSimpleVals::EvalCall(ExplodedNodeSet<ValueState>& Dst,
Ted Kremenekce3ed1e2008-03-12 01:21:45 +0000509 GRExprEngine& Eng,
Ted Kremenek3eea8dd2008-03-05 00:33:14 +0000510 GRStmtNodeBuilder<ValueState>& Builder,
Ted Kremenek3eea8dd2008-03-05 00:33:14 +0000511 CallExpr* CE, LVal L,
512 ExplodedNode<ValueState>* Pred) {
513
Ted Kremenek1a531942008-03-12 21:04:07 +0000514 ValueStateManager& StateMgr = Eng.getStateManager();
515 ValueState* St = Builder.GetState(Pred);
Ted Kremenek348d7852008-02-26 23:04:29 +0000516
517 // Invalidate all arguments passed in by reference (LVals).
518
519 for (CallExpr::arg_iterator I = CE->arg_begin(), E = CE->arg_end();
520 I != E; ++I) {
521
Ted Kremenek1a531942008-03-12 21:04:07 +0000522 RVal V = StateMgr.GetRVal(St, *I);
Ted Kremenek348d7852008-02-26 23:04:29 +0000523
524 if (isa<LVal>(V))
Ted Kremenek1a531942008-03-12 21:04:07 +0000525 St = StateMgr.SetRVal(St, cast<LVal>(V), UnknownVal());
Ted Kremenek348d7852008-02-26 23:04:29 +0000526 }
Ted Kremenek1a531942008-03-12 21:04:07 +0000527
528 // Make up a symbol for the return value of this function.
529
530 if (CE->getType() != Eng.getContext().VoidTy) {
531 unsigned Count = Builder.getCurrentBlockCount();
Ted Kremenekd4676512008-03-12 21:45:47 +0000532 SymbolID Sym = Eng.getSymbolManager().getConjuredSymbol(CE, Count);
Ted Kremenek1a531942008-03-12 21:04:07 +0000533
534 RVal X = CE->getType()->isPointerType()
535 ? cast<RVal>(lval::SymbolVal(Sym))
536 : cast<RVal>(nonlval::SymbolVal(Sym));
537
538 St = StateMgr.SetRVal(St, CE, X, Eng.getCFG().isBlkExpr(CE), false);
539 }
Ted Kremenek3eea8dd2008-03-05 00:33:14 +0000540
Ted Kremenekf10f2882008-03-21 21:30:14 +0000541 Builder.MakeNode(Dst, CE, Pred, St);
Ted Kremenek348d7852008-02-26 23:04:29 +0000542}