Ted Kremenek | af33741 | 2008-11-12 19:24:17 +0000 | [diff] [blame] | 1 | //==- GRCoreEngine.cpp - Path-Sensitive Dataflow Engine ------------*- C++ -*-// |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2 | // |
Ted Kremenek | f24af5b | 2008-01-14 23:24:37 +0000 | [diff] [blame] | 3 | // The LLVM Compiler Infrastructure |
| 4 | // |
| 5 | // This file is distributed under the University of Illinois Open Source |
| 6 | // License. See LICENSE.TXT for details. |
| 7 | // |
| 8 | //===----------------------------------------------------------------------===// |
| 9 | // |
| 10 | // This file defines a generic engine for intraprocedural, path-sensitive, |
| 11 | // dataflow analysis via graph reachability engine. |
| 12 | // |
| 13 | //===----------------------------------------------------------------------===// |
| 14 | |
Ted Kremenek | 1309f9a | 2010-01-25 04:41:41 +0000 | [diff] [blame] | 15 | #include "clang/Checker/PathSensitive/GRCoreEngine.h" |
| 16 | #include "clang/Checker/PathSensitive/GRExprEngine.h" |
Ted Kremenek | f24af5b | 2008-01-14 23:24:37 +0000 | [diff] [blame] | 17 | #include "clang/AST/Expr.h" |
Ted Kremenek | f24af5b | 2008-01-14 23:24:37 +0000 | [diff] [blame] | 18 | #include "llvm/Support/Casting.h" |
| 19 | #include "llvm/ADT/DenseMap.h" |
| 20 | #include <vector> |
Ted Kremenek | e1efd4d | 2008-12-16 22:13:33 +0000 | [diff] [blame] | 21 | #include <queue> |
Ted Kremenek | f24af5b | 2008-01-14 23:24:37 +0000 | [diff] [blame] | 22 | |
| 23 | using llvm::cast; |
| 24 | using llvm::isa; |
| 25 | using namespace clang; |
| 26 | |
Ted Kremenek | e1efd4d | 2008-12-16 22:13:33 +0000 | [diff] [blame] | 27 | //===----------------------------------------------------------------------===// |
| 28 | // Worklist classes for exploration of reachable states. |
| 29 | //===----------------------------------------------------------------------===// |
| 30 | |
Ted Kremenek | f24af5b | 2008-01-14 23:24:37 +0000 | [diff] [blame] | 31 | namespace { |
Kovarththanan Rajaratnam | ba5fb5a | 2009-11-28 06:07:30 +0000 | [diff] [blame] | 32 | class DFS : public GRWorkList { |
Ted Kremenek | f24af5b | 2008-01-14 23:24:37 +0000 | [diff] [blame] | 33 | llvm::SmallVector<GRWorkListUnit,20> Stack; |
| 34 | public: |
| 35 | virtual bool hasWork() const { |
| 36 | return !Stack.empty(); |
| 37 | } |
| 38 | |
| 39 | virtual void Enqueue(const GRWorkListUnit& U) { |
| 40 | Stack.push_back(U); |
| 41 | } |
| 42 | |
| 43 | virtual GRWorkListUnit Dequeue() { |
| 44 | assert (!Stack.empty()); |
| 45 | const GRWorkListUnit& U = Stack.back(); |
| 46 | Stack.pop_back(); // This technically "invalidates" U, but we are fine. |
| 47 | return U; |
| 48 | } |
| 49 | }; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 50 | |
Kovarththanan Rajaratnam | ba5fb5a | 2009-11-28 06:07:30 +0000 | [diff] [blame] | 51 | class BFS : public GRWorkList { |
Ted Kremenek | 8ff59e8 | 2009-05-01 22:18:46 +0000 | [diff] [blame] | 52 | std::queue<GRWorkListUnit> Queue; |
| 53 | public: |
| 54 | virtual bool hasWork() const { |
| 55 | return !Queue.empty(); |
| 56 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 57 | |
Ted Kremenek | 8ff59e8 | 2009-05-01 22:18:46 +0000 | [diff] [blame] | 58 | virtual void Enqueue(const GRWorkListUnit& U) { |
| 59 | Queue.push(U); |
| 60 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 61 | |
Ted Kremenek | 8ff59e8 | 2009-05-01 22:18:46 +0000 | [diff] [blame] | 62 | virtual GRWorkListUnit Dequeue() { |
| 63 | // Don't use const reference. The subsequent pop_back() might make it |
| 64 | // unsafe. |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 65 | GRWorkListUnit U = Queue.front(); |
Ted Kremenek | 8ff59e8 | 2009-05-01 22:18:46 +0000 | [diff] [blame] | 66 | Queue.pop(); |
| 67 | return U; |
| 68 | } |
| 69 | }; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 70 | |
Ted Kremenek | f24af5b | 2008-01-14 23:24:37 +0000 | [diff] [blame] | 71 | } // end anonymous namespace |
| 72 | |
Ted Kremenek | ee98546 | 2008-01-16 18:18:48 +0000 | [diff] [blame] | 73 | // Place the dstor for GRWorkList here because it contains virtual member |
| 74 | // functions, and we the code for the dstor generated in one compilation unit. |
| 75 | GRWorkList::~GRWorkList() {} |
| 76 | |
Ted Kremenek | 8ff59e8 | 2009-05-01 22:18:46 +0000 | [diff] [blame] | 77 | GRWorkList *GRWorkList::MakeDFS() { return new DFS(); } |
| 78 | GRWorkList *GRWorkList::MakeBFS() { return new BFS(); } |
Ted Kremenek | f24af5b | 2008-01-14 23:24:37 +0000 | [diff] [blame] | 79 | |
Ted Kremenek | e1efd4d | 2008-12-16 22:13:33 +0000 | [diff] [blame] | 80 | namespace { |
Kovarththanan Rajaratnam | ba5fb5a | 2009-11-28 06:07:30 +0000 | [diff] [blame] | 81 | class BFSBlockDFSContents : public GRWorkList { |
Ted Kremenek | e1efd4d | 2008-12-16 22:13:33 +0000 | [diff] [blame] | 82 | std::queue<GRWorkListUnit> Queue; |
| 83 | llvm::SmallVector<GRWorkListUnit,20> Stack; |
| 84 | public: |
| 85 | virtual bool hasWork() const { |
| 86 | return !Queue.empty() || !Stack.empty(); |
| 87 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 88 | |
Ted Kremenek | e1efd4d | 2008-12-16 22:13:33 +0000 | [diff] [blame] | 89 | virtual void Enqueue(const GRWorkListUnit& U) { |
| 90 | if (isa<BlockEntrance>(U.getNode()->getLocation())) |
| 91 | Queue.push(U); |
| 92 | else |
| 93 | Stack.push_back(U); |
| 94 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 95 | |
Ted Kremenek | e1efd4d | 2008-12-16 22:13:33 +0000 | [diff] [blame] | 96 | virtual GRWorkListUnit Dequeue() { |
| 97 | // Process all basic blocks to completion. |
| 98 | if (!Stack.empty()) { |
| 99 | const GRWorkListUnit& U = Stack.back(); |
| 100 | Stack.pop_back(); // This technically "invalidates" U, but we are fine. |
| 101 | return U; |
| 102 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 103 | |
Ted Kremenek | e1efd4d | 2008-12-16 22:13:33 +0000 | [diff] [blame] | 104 | assert(!Queue.empty()); |
| 105 | // Don't use const reference. The subsequent pop_back() might make it |
| 106 | // unsafe. |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 107 | GRWorkListUnit U = Queue.front(); |
Ted Kremenek | e1efd4d | 2008-12-16 22:13:33 +0000 | [diff] [blame] | 108 | Queue.pop(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 109 | return U; |
Ted Kremenek | e1efd4d | 2008-12-16 22:13:33 +0000 | [diff] [blame] | 110 | } |
| 111 | }; |
| 112 | } // end anonymous namespace |
| 113 | |
| 114 | GRWorkList* GRWorkList::MakeBFSBlockDFSContents() { |
| 115 | return new BFSBlockDFSContents(); |
| 116 | } |
| 117 | |
| 118 | //===----------------------------------------------------------------------===// |
| 119 | // Core analysis engine. |
| 120 | //===----------------------------------------------------------------------===// |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 121 | void GRCoreEngine::ProcessEndPath(GREndPathNodeBuilder& Builder) { |
Zhongxing Xu | 0111f57 | 2009-08-06 10:00:15 +0000 | [diff] [blame] | 122 | SubEngine.ProcessEndPath(Builder); |
| 123 | } |
Ted Kremenek | e1efd4d | 2008-12-16 22:13:33 +0000 | [diff] [blame] | 124 | |
Ted Kremenek | 852274d | 2009-12-16 03:18:58 +0000 | [diff] [blame] | 125 | void GRCoreEngine::ProcessStmt(CFGElement E, GRStmtNodeBuilder& Builder) { |
| 126 | SubEngine.ProcessStmt(E, Builder); |
Zhongxing Xu | 0111f57 | 2009-08-06 10:00:15 +0000 | [diff] [blame] | 127 | } |
| 128 | |
Zhongxing Xu | d9e0c0f | 2010-03-23 05:05:02 +0000 | [diff] [blame] | 129 | bool GRCoreEngine::ProcessBlockEntrance(CFGBlock* Blk, const ExplodedNode *Pred, |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 130 | GRBlockCounter BC) { |
Zhongxing Xu | d9e0c0f | 2010-03-23 05:05:02 +0000 | [diff] [blame] | 131 | return SubEngine.ProcessBlockEntrance(Blk, Pred, BC); |
Zhongxing Xu | 0111f57 | 2009-08-06 10:00:15 +0000 | [diff] [blame] | 132 | } |
| 133 | |
| 134 | void GRCoreEngine::ProcessBranch(Stmt* Condition, Stmt* Terminator, |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 135 | GRBranchNodeBuilder& Builder) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 136 | SubEngine.ProcessBranch(Condition, Terminator, Builder); |
Zhongxing Xu | 0111f57 | 2009-08-06 10:00:15 +0000 | [diff] [blame] | 137 | } |
| 138 | |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 139 | void GRCoreEngine::ProcessIndirectGoto(GRIndirectGotoNodeBuilder& Builder) { |
Zhongxing Xu | 0111f57 | 2009-08-06 10:00:15 +0000 | [diff] [blame] | 140 | SubEngine.ProcessIndirectGoto(Builder); |
| 141 | } |
| 142 | |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 143 | void GRCoreEngine::ProcessSwitch(GRSwitchNodeBuilder& Builder) { |
Zhongxing Xu | 0111f57 | 2009-08-06 10:00:15 +0000 | [diff] [blame] | 144 | SubEngine.ProcessSwitch(Builder); |
| 145 | } |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 146 | |
Douglas Gregor | 102acd5 | 2010-02-25 19:01:53 +0000 | [diff] [blame] | 147 | void GRCoreEngine::ProcessCallEnter(GRCallEnterNodeBuilder &Builder) { |
| 148 | SubEngine.ProcessCallEnter(Builder); |
| 149 | } |
| 150 | |
| 151 | void GRCoreEngine::ProcessCallExit(GRCallExitNodeBuilder &Builder) { |
| 152 | SubEngine.ProcessCallExit(Builder); |
| 153 | } |
| 154 | |
Ted Kremenek | f24af5b | 2008-01-14 23:24:37 +0000 | [diff] [blame] | 155 | /// ExecuteWorkList - Run the worklist algorithm for a maximum number of steps. |
Zhongxing Xu | 25e695b | 2009-08-15 03:17:38 +0000 | [diff] [blame] | 156 | bool GRCoreEngine::ExecuteWorkList(const LocationContext *L, unsigned Steps) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 157 | |
Ted Kremenek | f24af5b | 2008-01-14 23:24:37 +0000 | [diff] [blame] | 158 | if (G->num_roots() == 0) { // Initialize the analysis by constructing |
| 159 | // the root if none exists. |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 160 | |
Zhongxing Xu | cc02553 | 2009-08-25 03:33:41 +0000 | [diff] [blame] | 161 | CFGBlock* Entry = &(L->getCFG()->getEntry()); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 162 | |
| 163 | assert (Entry->empty() && |
Ted Kremenek | f24af5b | 2008-01-14 23:24:37 +0000 | [diff] [blame] | 164 | "Entry block must be empty."); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 165 | |
Ted Kremenek | f24af5b | 2008-01-14 23:24:37 +0000 | [diff] [blame] | 166 | assert (Entry->succ_size() == 1 && |
| 167 | "Entry block must have 1 successor."); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 168 | |
Ted Kremenek | f24af5b | 2008-01-14 23:24:37 +0000 | [diff] [blame] | 169 | // Get the solitary successor. |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 170 | CFGBlock* Succ = *(Entry->succ_begin()); |
| 171 | |
Ted Kremenek | f24af5b | 2008-01-14 23:24:37 +0000 | [diff] [blame] | 172 | // Construct an edge representing the |
| 173 | // starting location in the function. |
Zhongxing Xu | 25e695b | 2009-08-15 03:17:38 +0000 | [diff] [blame] | 174 | BlockEdge StartLoc(Entry, Succ, L); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 175 | |
Ted Kremenek | 8e49dd6 | 2008-02-12 18:08:17 +0000 | [diff] [blame] | 176 | // Set the current block counter to being empty. |
| 177 | WList->setBlockCounter(BCounterFactory.GetEmptyCounter()); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 178 | |
Ted Kremenek | f24af5b | 2008-01-14 23:24:37 +0000 | [diff] [blame] | 179 | // Generate the root. |
Zhongxing Xu | 17fd863 | 2009-08-17 06:19:58 +0000 | [diff] [blame] | 180 | GenerateNode(StartLoc, getInitialState(L), 0); |
Ted Kremenek | f24af5b | 2008-01-14 23:24:37 +0000 | [diff] [blame] | 181 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 182 | |
Ted Kremenek | f24af5b | 2008-01-14 23:24:37 +0000 | [diff] [blame] | 183 | while (Steps && WList->hasWork()) { |
| 184 | --Steps; |
| 185 | const GRWorkListUnit& WU = WList->Dequeue(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 186 | |
Ted Kremenek | 8e49dd6 | 2008-02-12 18:08:17 +0000 | [diff] [blame] | 187 | // Set the current block counter. |
| 188 | WList->setBlockCounter(WU.getBlockCounter()); |
| 189 | |
| 190 | // Retrieve the node. |
Zhongxing Xu | c5619d9 | 2009-08-06 01:32:16 +0000 | [diff] [blame] | 191 | ExplodedNode* Node = WU.getNode(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 192 | |
Ted Kremenek | f24af5b | 2008-01-14 23:24:37 +0000 | [diff] [blame] | 193 | // Dispatch on the location type. |
| 194 | switch (Node->getLocation().getKind()) { |
Ted Kremenek | e1efd4d | 2008-12-16 22:13:33 +0000 | [diff] [blame] | 195 | case ProgramPoint::BlockEdgeKind: |
Ted Kremenek | f24af5b | 2008-01-14 23:24:37 +0000 | [diff] [blame] | 196 | HandleBlockEdge(cast<BlockEdge>(Node->getLocation()), Node); |
| 197 | break; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 198 | |
Ted Kremenek | f24af5b | 2008-01-14 23:24:37 +0000 | [diff] [blame] | 199 | case ProgramPoint::BlockEntranceKind: |
| 200 | HandleBlockEntrance(cast<BlockEntrance>(Node->getLocation()), Node); |
| 201 | break; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 202 | |
Ted Kremenek | f24af5b | 2008-01-14 23:24:37 +0000 | [diff] [blame] | 203 | case ProgramPoint::BlockExitKind: |
Ted Kremenek | 425c08c | 2008-01-15 00:24:08 +0000 | [diff] [blame] | 204 | assert (false && "BlockExit location never occur in forward analysis."); |
Ted Kremenek | f24af5b | 2008-01-14 23:24:37 +0000 | [diff] [blame] | 205 | break; |
Ted Kremenek | e1efd4d | 2008-12-16 22:13:33 +0000 | [diff] [blame] | 206 | |
Douglas Gregor | 102acd5 | 2010-02-25 19:01:53 +0000 | [diff] [blame] | 207 | case ProgramPoint::CallEnterKind: |
| 208 | HandleCallEnter(cast<CallEnter>(Node->getLocation()), WU.getBlock(), |
| 209 | WU.getIndex(), Node); |
| 210 | break; |
| 211 | |
| 212 | case ProgramPoint::CallExitKind: |
| 213 | HandleCallExit(cast<CallExit>(Node->getLocation()), Node); |
| 214 | break; |
| 215 | |
Ted Kremenek | e1efd4d | 2008-12-16 22:13:33 +0000 | [diff] [blame] | 216 | default: |
| 217 | assert(isa<PostStmt>(Node->getLocation())); |
Ted Kremenek | f24af5b | 2008-01-14 23:24:37 +0000 | [diff] [blame] | 218 | HandlePostStmt(cast<PostStmt>(Node->getLocation()), WU.getBlock(), |
| 219 | WU.getIndex(), Node); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 220 | break; |
Ted Kremenek | f24af5b | 2008-01-14 23:24:37 +0000 | [diff] [blame] | 221 | } |
| 222 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 223 | |
Ted Kremenek | e49f2ad | 2010-06-29 21:58:54 +0000 | [diff] [blame] | 224 | SubEngine.ProcessEndWorklist(WList->hasWork() || BlockAborted); |
Ted Kremenek | f24af5b | 2008-01-14 23:24:37 +0000 | [diff] [blame] | 225 | return WList->hasWork(); |
| 226 | } |
| 227 | |
Douglas Gregor | 102acd5 | 2010-02-25 19:01:53 +0000 | [diff] [blame] | 228 | void GRCoreEngine::HandleCallEnter(const CallEnter &L, const CFGBlock *Block, |
| 229 | unsigned Index, ExplodedNode *Pred) { |
| 230 | GRCallEnterNodeBuilder Builder(*this, Pred, L.getCallExpr(), L.getCallee(), |
| 231 | Block, Index); |
| 232 | ProcessCallEnter(Builder); |
| 233 | } |
| 234 | |
| 235 | void GRCoreEngine::HandleCallExit(const CallExit &L, ExplodedNode *Pred) { |
| 236 | GRCallExitNodeBuilder Builder(*this, Pred); |
| 237 | ProcessCallExit(Builder); |
| 238 | } |
Zhongxing Xu | 0111f57 | 2009-08-06 10:00:15 +0000 | [diff] [blame] | 239 | |
| 240 | void GRCoreEngine::HandleBlockEdge(const BlockEdge& L, ExplodedNode* Pred) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 241 | |
Ted Kremenek | f24af5b | 2008-01-14 23:24:37 +0000 | [diff] [blame] | 242 | CFGBlock* Blk = L.getDst(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 243 | |
| 244 | // Check if we are entering the EXIT block. |
Zhongxing Xu | cb74d72 | 2009-12-23 08:54:57 +0000 | [diff] [blame] | 245 | if (Blk == &(L.getLocationContext()->getCFG()->getExit())) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 246 | |
Zhongxing Xu | cb74d72 | 2009-12-23 08:54:57 +0000 | [diff] [blame] | 247 | assert (L.getLocationContext()->getCFG()->getExit().size() == 0 |
Ted Kremenek | cb48b9c | 2008-01-29 00:33:40 +0000 | [diff] [blame] | 248 | && "EXIT block cannot contain Stmts."); |
Ted Kremenek | f24af5b | 2008-01-14 23:24:37 +0000 | [diff] [blame] | 249 | |
Ted Kremenek | 11062b1 | 2008-04-11 22:03:04 +0000 | [diff] [blame] | 250 | // Process the final state transition. |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 251 | GREndPathNodeBuilder Builder(Blk, Pred, this); |
Ted Kremenek | 11062b1 | 2008-04-11 22:03:04 +0000 | [diff] [blame] | 252 | ProcessEndPath(Builder); |
Ted Kremenek | f24af5b | 2008-01-14 23:24:37 +0000 | [diff] [blame] | 253 | |
Ted Kremenek | f24af5b | 2008-01-14 23:24:37 +0000 | [diff] [blame] | 254 | // This path is done. Don't enqueue any more nodes. |
| 255 | return; |
| 256 | } |
Ted Kremenek | 6a6719a | 2008-02-29 20:27:50 +0000 | [diff] [blame] | 257 | |
| 258 | // FIXME: Should we allow ProcessBlockEntrance to also manipulate state? |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 259 | |
Zhongxing Xu | d9e0c0f | 2010-03-23 05:05:02 +0000 | [diff] [blame] | 260 | if (ProcessBlockEntrance(Blk, Pred, WList->getBlockCounter())) |
Ted Kremenek | e49f2ad | 2010-06-29 21:58:54 +0000 | [diff] [blame] | 261 | GenerateNode(BlockEntrance(Blk, Pred->getLocationContext()), |
| 262 | Pred->State, Pred); |
| 263 | else |
| 264 | BlockAborted = true; |
Ted Kremenek | f24af5b | 2008-01-14 23:24:37 +0000 | [diff] [blame] | 265 | } |
| 266 | |
Zhongxing Xu | 0111f57 | 2009-08-06 10:00:15 +0000 | [diff] [blame] | 267 | void GRCoreEngine::HandleBlockEntrance(const BlockEntrance& L, |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 268 | ExplodedNode* Pred) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 269 | |
Ted Kremenek | 8e49dd6 | 2008-02-12 18:08:17 +0000 | [diff] [blame] | 270 | // Increment the block counter. |
| 271 | GRBlockCounter Counter = WList->getBlockCounter(); |
Zhongxing Xu | d9e0c0f | 2010-03-23 05:05:02 +0000 | [diff] [blame] | 272 | Counter = BCounterFactory.IncrementCount(Counter, |
| 273 | Pred->getLocationContext()->getCurrentStackFrame(), |
| 274 | L.getBlock()->getBlockID()); |
Ted Kremenek | 8e49dd6 | 2008-02-12 18:08:17 +0000 | [diff] [blame] | 275 | WList->setBlockCounter(Counter); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 276 | |
| 277 | // Process the entrance of the block. |
Ted Kremenek | 852274d | 2009-12-16 03:18:58 +0000 | [diff] [blame] | 278 | if (CFGElement E = L.getFirstElement()) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 279 | GRStmtNodeBuilder Builder(L.getBlock(), 0, Pred, this, |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 280 | SubEngine.getStateManager()); |
Ted Kremenek | 852274d | 2009-12-16 03:18:58 +0000 | [diff] [blame] | 281 | ProcessStmt(E, Builder); |
Ted Kremenek | f24af5b | 2008-01-14 23:24:37 +0000 | [diff] [blame] | 282 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 283 | else |
Ted Kremenek | 425c08c | 2008-01-15 00:24:08 +0000 | [diff] [blame] | 284 | HandleBlockExit(L.getBlock(), Pred); |
Ted Kremenek | f24af5b | 2008-01-14 23:24:37 +0000 | [diff] [blame] | 285 | } |
| 286 | |
Zhongxing Xu | 0111f57 | 2009-08-06 10:00:15 +0000 | [diff] [blame] | 287 | void GRCoreEngine::HandleBlockExit(CFGBlock * B, ExplodedNode* Pred) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 288 | |
Ted Kremenek | 7d7fe6d | 2008-01-29 22:56:11 +0000 | [diff] [blame] | 289 | if (Stmt* Term = B->getTerminator()) { |
| 290 | switch (Term->getStmtClass()) { |
| 291 | default: |
| 292 | assert(false && "Analysis for this terminator not implemented."); |
| 293 | break; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 294 | |
Ted Kremenek | f810869 | 2008-02-12 21:51:20 +0000 | [diff] [blame] | 295 | case Stmt::BinaryOperatorClass: // '&&' and '||' |
| 296 | HandleBranch(cast<BinaryOperator>(Term)->getLHS(), Term, B, Pred); |
| 297 | return; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 298 | |
Ted Kremenek | f233d48 | 2008-02-05 00:26:40 +0000 | [diff] [blame] | 299 | case Stmt::ConditionalOperatorClass: |
| 300 | HandleBranch(cast<ConditionalOperator>(Term)->getCond(), Term, B, Pred); |
Ted Kremenek | f810869 | 2008-02-12 21:51:20 +0000 | [diff] [blame] | 301 | return; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 302 | |
Ted Kremenek | f810869 | 2008-02-12 21:51:20 +0000 | [diff] [blame] | 303 | // FIXME: Use constant-folding in CFG construction to simplify this |
| 304 | // case. |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 305 | |
Ted Kremenek | f233d48 | 2008-02-05 00:26:40 +0000 | [diff] [blame] | 306 | case Stmt::ChooseExprClass: |
| 307 | HandleBranch(cast<ChooseExpr>(Term)->getCond(), Term, B, Pred); |
Ted Kremenek | f810869 | 2008-02-12 21:51:20 +0000 | [diff] [blame] | 308 | return; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 309 | |
Ted Kremenek | f810869 | 2008-02-12 21:51:20 +0000 | [diff] [blame] | 310 | case Stmt::DoStmtClass: |
| 311 | HandleBranch(cast<DoStmt>(Term)->getCond(), Term, B, Pred); |
| 312 | return; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 313 | |
Ted Kremenek | f810869 | 2008-02-12 21:51:20 +0000 | [diff] [blame] | 314 | case Stmt::ForStmtClass: |
| 315 | HandleBranch(cast<ForStmt>(Term)->getCond(), Term, B, Pred); |
| 316 | return; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 317 | |
Ted Kremenek | a58e833 | 2008-02-13 16:56:51 +0000 | [diff] [blame] | 318 | case Stmt::ContinueStmtClass: |
| 319 | case Stmt::BreakStmtClass: |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 320 | case Stmt::GotoStmtClass: |
Ted Kremenek | f233d48 | 2008-02-05 00:26:40 +0000 | [diff] [blame] | 321 | break; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 322 | |
Ted Kremenek | 7d7fe6d | 2008-01-29 22:56:11 +0000 | [diff] [blame] | 323 | case Stmt::IfStmtClass: |
| 324 | HandleBranch(cast<IfStmt>(Term)->getCond(), Term, B, Pred); |
Ted Kremenek | f810869 | 2008-02-12 21:51:20 +0000 | [diff] [blame] | 325 | return; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 326 | |
Ted Kremenek | 754607e | 2008-02-13 00:24:44 +0000 | [diff] [blame] | 327 | case Stmt::IndirectGotoStmtClass: { |
| 328 | // Only 1 successor: the indirect goto dispatch block. |
| 329 | assert (B->succ_size() == 1); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 330 | |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 331 | GRIndirectGotoNodeBuilder |
Ted Kremenek | 754607e | 2008-02-13 00:24:44 +0000 | [diff] [blame] | 332 | builder(Pred, B, cast<IndirectGotoStmt>(Term)->getTarget(), |
| 333 | *(B->succ_begin()), this); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 334 | |
Ted Kremenek | 754607e | 2008-02-13 00:24:44 +0000 | [diff] [blame] | 335 | ProcessIndirectGoto(builder); |
| 336 | return; |
| 337 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 338 | |
Ted Kremenek | af33741 | 2008-11-12 19:24:17 +0000 | [diff] [blame] | 339 | case Stmt::ObjCForCollectionStmtClass: { |
| 340 | // In the case of ObjCForCollectionStmt, it appears twice in a CFG: |
| 341 | // |
| 342 | // (1) inside a basic block, which represents the binding of the |
| 343 | // 'element' variable to a value. |
| 344 | // (2) in a terminator, which represents the branch. |
| 345 | // |
| 346 | // For (1), subengines will bind a value (i.e., 0 or 1) indicating |
| 347 | // whether or not collection contains any more elements. We cannot |
| 348 | // just test to see if the element is nil because a container can |
| 349 | // contain nil elements. |
| 350 | HandleBranch(Term, Term, B, Pred); |
| 351 | return; |
| 352 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 353 | |
Ted Kremenek | daeb9a7 | 2008-02-13 23:08:21 +0000 | [diff] [blame] | 354 | case Stmt::SwitchStmtClass: { |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 355 | GRSwitchNodeBuilder builder(Pred, B, cast<SwitchStmt>(Term)->getCond(), |
| 356 | this); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 357 | |
Ted Kremenek | daeb9a7 | 2008-02-13 23:08:21 +0000 | [diff] [blame] | 358 | ProcessSwitch(builder); |
| 359 | return; |
| 360 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 361 | |
Ted Kremenek | 7d7fe6d | 2008-01-29 22:56:11 +0000 | [diff] [blame] | 362 | case Stmt::WhileStmtClass: |
| 363 | HandleBranch(cast<WhileStmt>(Term)->getCond(), Term, B, Pred); |
Ted Kremenek | f810869 | 2008-02-12 21:51:20 +0000 | [diff] [blame] | 364 | return; |
Ted Kremenek | 7d7fe6d | 2008-01-29 22:56:11 +0000 | [diff] [blame] | 365 | } |
| 366 | } |
Ted Kremenek | f810869 | 2008-02-12 21:51:20 +0000 | [diff] [blame] | 367 | |
| 368 | assert (B->succ_size() == 1 && |
| 369 | "Blocks with no terminator should have at most 1 successor."); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 370 | |
| 371 | GenerateNode(BlockEdge(B, *(B->succ_begin()), Pred->getLocationContext()), |
Zhongxing Xu | 25e695b | 2009-08-15 03:17:38 +0000 | [diff] [blame] | 372 | Pred->State, Pred); |
Ted Kremenek | f24af5b | 2008-01-14 23:24:37 +0000 | [diff] [blame] | 373 | } |
| 374 | |
Zhongxing Xu | 0111f57 | 2009-08-06 10:00:15 +0000 | [diff] [blame] | 375 | void GRCoreEngine::HandleBranch(Stmt* Cond, Stmt* Term, CFGBlock * B, |
| 376 | ExplodedNode* Pred) { |
Ted Kremenek | 7d7fe6d | 2008-01-29 22:56:11 +0000 | [diff] [blame] | 377 | assert (B->succ_size() == 2); |
| 378 | |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 379 | GRBranchNodeBuilder Builder(B, *(B->succ_begin()), *(B->succ_begin()+1), |
| 380 | Pred, this); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 381 | |
Ted Kremenek | 7d7fe6d | 2008-01-29 22:56:11 +0000 | [diff] [blame] | 382 | ProcessBranch(Cond, Term, Builder); |
| 383 | } |
| 384 | |
Zhongxing Xu | 0111f57 | 2009-08-06 10:00:15 +0000 | [diff] [blame] | 385 | void GRCoreEngine::HandlePostStmt(const PostStmt& L, CFGBlock* B, |
Zhongxing Xu | c5619d9 | 2009-08-06 01:32:16 +0000 | [diff] [blame] | 386 | unsigned StmtIdx, ExplodedNode* Pred) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 387 | |
Ted Kremenek | f24af5b | 2008-01-14 23:24:37 +0000 | [diff] [blame] | 388 | assert (!B->empty()); |
| 389 | |
Ted Kremenek | 425c08c | 2008-01-15 00:24:08 +0000 | [diff] [blame] | 390 | if (StmtIdx == B->size()) |
| 391 | HandleBlockExit(B, Pred); |
Ted Kremenek | f24af5b | 2008-01-14 23:24:37 +0000 | [diff] [blame] | 392 | else { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 393 | GRStmtNodeBuilder Builder(B, StmtIdx, Pred, this, |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 394 | SubEngine.getStateManager()); |
Ted Kremenek | 160760e | 2008-01-16 22:13:19 +0000 | [diff] [blame] | 395 | ProcessStmt((*B)[StmtIdx], Builder); |
Ted Kremenek | f24af5b | 2008-01-14 23:24:37 +0000 | [diff] [blame] | 396 | } |
| 397 | } |
| 398 | |
Ted Kremenek | f24af5b | 2008-01-14 23:24:37 +0000 | [diff] [blame] | 399 | /// GenerateNode - Utility method to generate nodes, hook up successors, |
| 400 | /// and add nodes to the worklist. |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 401 | void GRCoreEngine::GenerateNode(const ProgramPoint& Loc, |
Zhongxing Xu | 0111f57 | 2009-08-06 10:00:15 +0000 | [diff] [blame] | 402 | const GRState* State, ExplodedNode* Pred) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 403 | |
Ted Kremenek | f24af5b | 2008-01-14 23:24:37 +0000 | [diff] [blame] | 404 | bool IsNew; |
Zhongxing Xu | 38b02b9 | 2009-08-06 06:28:40 +0000 | [diff] [blame] | 405 | ExplodedNode* Node = G->getNode(Loc, State, &IsNew); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 406 | |
| 407 | if (Pred) |
Ted Kremenek | 5fe4d9d | 2009-10-07 00:42:52 +0000 | [diff] [blame] | 408 | Node->addPredecessor(Pred, *G); // Link 'Node' with its predecessor. |
Ted Kremenek | f24af5b | 2008-01-14 23:24:37 +0000 | [diff] [blame] | 409 | else { |
| 410 | assert (IsNew); |
| 411 | G->addRoot(Node); // 'Node' has no predecessor. Make it a root. |
| 412 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 413 | |
Ted Kremenek | f24af5b | 2008-01-14 23:24:37 +0000 | [diff] [blame] | 414 | // Only add 'Node' to the worklist if it was freshly generated. |
Ted Kremenek | 8e49dd6 | 2008-02-12 18:08:17 +0000 | [diff] [blame] | 415 | if (IsNew) WList->Enqueue(Node); |
Ted Kremenek | f24af5b | 2008-01-14 23:24:37 +0000 | [diff] [blame] | 416 | } |
| 417 | |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 418 | GRStmtNodeBuilder::GRStmtNodeBuilder(CFGBlock* b, unsigned idx, |
| 419 | ExplodedNode* N, GRCoreEngine* e, |
| 420 | GRStateManager &mgr) |
Zhongxing Xu | 25108a5 | 2010-02-26 02:38:09 +0000 | [diff] [blame] | 421 | : Eng(*e), B(*b), Idx(idx), Pred(N), Mgr(mgr), Auditor(0), |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 422 | PurgingDeadSymbols(false), BuildSinks(false), HasGeneratedNode(false), |
| 423 | PointKind(ProgramPoint::PostStmtKind), Tag(0) { |
Ted Kremenek | f24af5b | 2008-01-14 23:24:37 +0000 | [diff] [blame] | 424 | Deferred.insert(N); |
Zhongxing Xu | 25108a5 | 2010-02-26 02:38:09 +0000 | [diff] [blame] | 425 | CleanedState = Pred->getState(); |
Ted Kremenek | f24af5b | 2008-01-14 23:24:37 +0000 | [diff] [blame] | 426 | } |
| 427 | |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 428 | GRStmtNodeBuilder::~GRStmtNodeBuilder() { |
Ted Kremenek | f24af5b | 2008-01-14 23:24:37 +0000 | [diff] [blame] | 429 | for (DeferredTy::iterator I=Deferred.begin(), E=Deferred.end(); I!=E; ++I) |
Ted Kremenek | b38911f | 2008-01-30 23:03:39 +0000 | [diff] [blame] | 430 | if (!(*I)->isSink()) |
Ted Kremenek | f24af5b | 2008-01-14 23:24:37 +0000 | [diff] [blame] | 431 | GenerateAutoTransition(*I); |
| 432 | } |
| 433 | |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 434 | void GRStmtNodeBuilder::GenerateAutoTransition(ExplodedNode* N) { |
Ted Kremenek | b38911f | 2008-01-30 23:03:39 +0000 | [diff] [blame] | 435 | assert (!N->isSink()); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 436 | |
Douglas Gregor | 102acd5 | 2010-02-25 19:01:53 +0000 | [diff] [blame] | 437 | // Check if this node entered a callee. |
| 438 | if (isa<CallEnter>(N->getLocation())) { |
| 439 | // Still use the index of the CallExpr. It's needed to create the callee |
| 440 | // StackFrameContext. |
| 441 | Eng.WList->Enqueue(N, B, Idx); |
| 442 | return; |
| 443 | } |
| 444 | |
Zhongxing Xu | 25e695b | 2009-08-15 03:17:38 +0000 | [diff] [blame] | 445 | PostStmt Loc(getStmt(), N->getLocationContext()); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 446 | |
Ted Kremenek | f24af5b | 2008-01-14 23:24:37 +0000 | [diff] [blame] | 447 | if (Loc == N->getLocation()) { |
| 448 | // Note: 'N' should be a fresh node because otherwise it shouldn't be |
| 449 | // a member of Deferred. |
| 450 | Eng.WList->Enqueue(N, B, Idx+1); |
| 451 | return; |
| 452 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 453 | |
Ted Kremenek | f24af5b | 2008-01-14 23:24:37 +0000 | [diff] [blame] | 454 | bool IsNew; |
Zhongxing Xu | 38b02b9 | 2009-08-06 06:28:40 +0000 | [diff] [blame] | 455 | ExplodedNode* Succ = Eng.G->getNode(Loc, N->State, &IsNew); |
Ted Kremenek | 5fe4d9d | 2009-10-07 00:42:52 +0000 | [diff] [blame] | 456 | Succ->addPredecessor(N, *Eng.G); |
Ted Kremenek | f24af5b | 2008-01-14 23:24:37 +0000 | [diff] [blame] | 457 | |
| 458 | if (IsNew) |
| 459 | Eng.WList->Enqueue(Succ, B, Idx+1); |
| 460 | } |
| 461 | |
Zhongxing Xu | 868e78d | 2010-04-14 06:35:09 +0000 | [diff] [blame] | 462 | ExplodedNode* GRStmtNodeBuilder::MakeNode(ExplodedNodeSet& Dst, Stmt* S, |
| 463 | ExplodedNode* Pred, const GRState* St, |
| 464 | ProgramPoint::Kind K) { |
| 465 | const GRState* PredState = GetState(Pred); |
| 466 | |
| 467 | // If the state hasn't changed, don't generate a new node. |
| 468 | if (!BuildSinks && St == PredState && Auditor == 0) { |
| 469 | Dst.Add(Pred); |
| 470 | return NULL; |
| 471 | } |
| 472 | |
| 473 | ExplodedNode* N = generateNode(S, St, Pred, K); |
| 474 | |
| 475 | if (N) { |
| 476 | if (BuildSinks) |
| 477 | N->markAsSink(); |
| 478 | else { |
| 479 | if (Auditor && Auditor->Audit(N, Mgr)) |
| 480 | N->markAsSink(); |
| 481 | |
| 482 | Dst.Add(N); |
| 483 | } |
| 484 | } |
| 485 | |
| 486 | return N; |
| 487 | } |
| 488 | |
Ted Kremenek | b4b817d | 2009-11-11 03:26:34 +0000 | [diff] [blame] | 489 | static ProgramPoint GetProgramPoint(const Stmt *S, ProgramPoint::Kind K, |
| 490 | const LocationContext *LC, const void *tag){ |
Ted Kremenek | 331b0ac | 2008-06-18 05:34:07 +0000 | [diff] [blame] | 491 | switch (K) { |
| 492 | default: |
Ted Kremenek | b4b817d | 2009-11-11 03:26:34 +0000 | [diff] [blame] | 493 | assert(false && "Unhandled ProgramPoint kind"); |
| 494 | case ProgramPoint::PreStmtKind: |
| 495 | return PreStmt(S, LC, tag); |
Ted Kremenek | 331b0ac | 2008-06-18 05:34:07 +0000 | [diff] [blame] | 496 | case ProgramPoint::PostStmtKind: |
Ted Kremenek | b4b817d | 2009-11-11 03:26:34 +0000 | [diff] [blame] | 497 | return PostStmt(S, LC, tag); |
| 498 | case ProgramPoint::PreLoadKind: |
| 499 | return PreLoad(S, LC, tag); |
Ted Kremenek | 331b0ac | 2008-06-18 05:34:07 +0000 | [diff] [blame] | 500 | case ProgramPoint::PostLoadKind: |
Ted Kremenek | b4b817d | 2009-11-11 03:26:34 +0000 | [diff] [blame] | 501 | return PostLoad(S, LC, tag); |
| 502 | case ProgramPoint::PreStoreKind: |
| 503 | return PreStore(S, LC, tag); |
Ted Kremenek | bf4e419 | 2008-10-17 20:49:23 +0000 | [diff] [blame] | 504 | case ProgramPoint::PostStoreKind: |
Ted Kremenek | b4b817d | 2009-11-11 03:26:34 +0000 | [diff] [blame] | 505 | return PostStore(S, LC, tag); |
Ted Kremenek | 7090d54 | 2009-05-07 18:27:16 +0000 | [diff] [blame] | 506 | case ProgramPoint::PostLValueKind: |
Ted Kremenek | b4b817d | 2009-11-11 03:26:34 +0000 | [diff] [blame] | 507 | return PostLValue(S, LC, tag); |
Ted Kremenek | 331b0ac | 2008-06-18 05:34:07 +0000 | [diff] [blame] | 508 | case ProgramPoint::PostPurgeDeadSymbolsKind: |
Ted Kremenek | b4b817d | 2009-11-11 03:26:34 +0000 | [diff] [blame] | 509 | return PostPurgeDeadSymbols(S, LC, tag); |
Ted Kremenek | 331b0ac | 2008-06-18 05:34:07 +0000 | [diff] [blame] | 510 | } |
| 511 | } |
| 512 | |
Zhongxing Xu | c5619d9 | 2009-08-06 01:32:16 +0000 | [diff] [blame] | 513 | ExplodedNode* |
Ted Kremenek | b4b817d | 2009-11-11 03:26:34 +0000 | [diff] [blame] | 514 | GRStmtNodeBuilder::generateNodeInternal(const Stmt* S, const GRState* state, |
Zhongxing Xu | c5619d9 | 2009-08-06 01:32:16 +0000 | [diff] [blame] | 515 | ExplodedNode* Pred, |
Ted Kremenek | 1670e40 | 2009-04-11 00:11:10 +0000 | [diff] [blame] | 516 | ProgramPoint::Kind K, |
| 517 | const void *tag) { |
Ted Kremenek | b4b817d | 2009-11-11 03:26:34 +0000 | [diff] [blame] | 518 | |
Zhongxing Xu | cb74d72 | 2009-12-23 08:54:57 +0000 | [diff] [blame] | 519 | const ProgramPoint &L = GetProgramPoint(S, K, Pred->getLocationContext(),tag); |
Ted Kremenek | b4b817d | 2009-11-11 03:26:34 +0000 | [diff] [blame] | 520 | return generateNodeInternal(L, state, Pred); |
Ted Kremenek | 58e899b | 2009-02-19 23:45:28 +0000 | [diff] [blame] | 521 | } |
| 522 | |
Zhongxing Xu | c5619d9 | 2009-08-06 01:32:16 +0000 | [diff] [blame] | 523 | ExplodedNode* |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 524 | GRStmtNodeBuilder::generateNodeInternal(const ProgramPoint &Loc, |
Zhongxing Xu | 38b02b9 | 2009-08-06 06:28:40 +0000 | [diff] [blame] | 525 | const GRState* State, |
Zhongxing Xu | c5619d9 | 2009-08-06 01:32:16 +0000 | [diff] [blame] | 526 | ExplodedNode* Pred) { |
Ted Kremenek | f24af5b | 2008-01-14 23:24:37 +0000 | [diff] [blame] | 527 | bool IsNew; |
Zhongxing Xu | 38b02b9 | 2009-08-06 06:28:40 +0000 | [diff] [blame] | 528 | ExplodedNode* N = Eng.G->getNode(Loc, State, &IsNew); |
Ted Kremenek | 5fe4d9d | 2009-10-07 00:42:52 +0000 | [diff] [blame] | 529 | N->addPredecessor(Pred, *Eng.G); |
Ted Kremenek | f24af5b | 2008-01-14 23:24:37 +0000 | [diff] [blame] | 530 | Deferred.erase(Pred); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 531 | |
Ted Kremenek | f24af5b | 2008-01-14 23:24:37 +0000 | [diff] [blame] | 532 | if (IsNew) { |
| 533 | Deferred.insert(N); |
Ted Kremenek | f24af5b | 2008-01-14 23:24:37 +0000 | [diff] [blame] | 534 | return N; |
| 535 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 536 | |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 537 | return NULL; |
Ted Kremenek | f24af5b | 2008-01-14 23:24:37 +0000 | [diff] [blame] | 538 | } |
Ted Kremenek | 7d7fe6d | 2008-01-29 22:56:11 +0000 | [diff] [blame] | 539 | |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 540 | ExplodedNode* GRBranchNodeBuilder::generateNode(const GRState* State, |
| 541 | bool branch) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 542 | |
Ted Kremenek | 5200354 | 2009-07-20 18:44:36 +0000 | [diff] [blame] | 543 | // If the branch has been marked infeasible we should not generate a node. |
| 544 | if (!isFeasible(branch)) |
| 545 | return NULL; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 546 | |
Ted Kremenek | 7d7fe6d | 2008-01-29 22:56:11 +0000 | [diff] [blame] | 547 | bool IsNew; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 548 | |
Zhongxing Xu | c5619d9 | 2009-08-06 01:32:16 +0000 | [diff] [blame] | 549 | ExplodedNode* Succ = |
Zhongxing Xu | 25e695b | 2009-08-15 03:17:38 +0000 | [diff] [blame] | 550 | Eng.G->getNode(BlockEdge(Src,branch ? DstT:DstF,Pred->getLocationContext()), |
| 551 | State, &IsNew); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 552 | |
Ted Kremenek | 5fe4d9d | 2009-10-07 00:42:52 +0000 | [diff] [blame] | 553 | Succ->addPredecessor(Pred, *Eng.G); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 554 | |
Ted Kremenek | 5200354 | 2009-07-20 18:44:36 +0000 | [diff] [blame] | 555 | if (branch) |
| 556 | GeneratedTrue = true; |
| 557 | else |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 558 | GeneratedFalse = true; |
| 559 | |
Ted Kremenek | b38911f | 2008-01-30 23:03:39 +0000 | [diff] [blame] | 560 | if (IsNew) { |
Ted Kremenek | 3b4f670 | 2008-01-30 23:24:39 +0000 | [diff] [blame] | 561 | Deferred.push_back(Succ); |
Ted Kremenek | b38911f | 2008-01-30 23:03:39 +0000 | [diff] [blame] | 562 | return Succ; |
| 563 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 564 | |
Ted Kremenek | b38911f | 2008-01-30 23:03:39 +0000 | [diff] [blame] | 565 | return NULL; |
Ted Kremenek | 7d7fe6d | 2008-01-29 22:56:11 +0000 | [diff] [blame] | 566 | } |
Ted Kremenek | 71c29bd | 2008-01-29 23:32:35 +0000 | [diff] [blame] | 567 | |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 568 | GRBranchNodeBuilder::~GRBranchNodeBuilder() { |
| 569 | if (!GeneratedTrue) generateNode(Pred->State, true); |
| 570 | if (!GeneratedFalse) generateNode(Pred->State, false); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 571 | |
Ted Kremenek | 3b4f670 | 2008-01-30 23:24:39 +0000 | [diff] [blame] | 572 | for (DeferredTy::iterator I=Deferred.begin(), E=Deferred.end(); I!=E; ++I) |
Ted Kremenek | 8e49dd6 | 2008-02-12 18:08:17 +0000 | [diff] [blame] | 573 | if (!(*I)->isSink()) Eng.WList->Enqueue(*I); |
Ted Kremenek | 71c29bd | 2008-01-29 23:32:35 +0000 | [diff] [blame] | 574 | } |
Ted Kremenek | 754607e | 2008-02-13 00:24:44 +0000 | [diff] [blame] | 575 | |
Ted Kremenek | 754607e | 2008-02-13 00:24:44 +0000 | [diff] [blame] | 576 | |
Zhongxing Xu | c5619d9 | 2009-08-06 01:32:16 +0000 | [diff] [blame] | 577 | ExplodedNode* |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 578 | GRIndirectGotoNodeBuilder::generateNode(const iterator& I, const GRState* St, |
| 579 | bool isSink) { |
Ted Kremenek | 754607e | 2008-02-13 00:24:44 +0000 | [diff] [blame] | 580 | bool IsNew; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 581 | |
| 582 | ExplodedNode* Succ = Eng.G->getNode(BlockEdge(Src, I.getBlock(), |
Zhongxing Xu | 25e695b | 2009-08-15 03:17:38 +0000 | [diff] [blame] | 583 | Pred->getLocationContext()), St, &IsNew); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 584 | |
Ted Kremenek | 5fe4d9d | 2009-10-07 00:42:52 +0000 | [diff] [blame] | 585 | Succ->addPredecessor(Pred, *Eng.G); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 586 | |
Ted Kremenek | 754607e | 2008-02-13 00:24:44 +0000 | [diff] [blame] | 587 | if (IsNew) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 588 | |
Ted Kremenek | 754607e | 2008-02-13 00:24:44 +0000 | [diff] [blame] | 589 | if (isSink) |
| 590 | Succ->markAsSink(); |
| 591 | else |
| 592 | Eng.WList->Enqueue(Succ); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 593 | |
Ted Kremenek | 754607e | 2008-02-13 00:24:44 +0000 | [diff] [blame] | 594 | return Succ; |
| 595 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 596 | |
Ted Kremenek | 754607e | 2008-02-13 00:24:44 +0000 | [diff] [blame] | 597 | return NULL; |
| 598 | } |
Ted Kremenek | daeb9a7 | 2008-02-13 23:08:21 +0000 | [diff] [blame] | 599 | |
| 600 | |
Zhongxing Xu | c5619d9 | 2009-08-06 01:32:16 +0000 | [diff] [blame] | 601 | ExplodedNode* |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 602 | GRSwitchNodeBuilder::generateCaseStmtNode(const iterator& I, const GRState* St){ |
Ted Kremenek | daeb9a7 | 2008-02-13 23:08:21 +0000 | [diff] [blame] | 603 | |
| 604 | bool IsNew; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 605 | |
Zhongxing Xu | 25e695b | 2009-08-15 03:17:38 +0000 | [diff] [blame] | 606 | ExplodedNode* Succ = Eng.G->getNode(BlockEdge(Src, I.getBlock(), |
| 607 | Pred->getLocationContext()), St, &IsNew); |
Ted Kremenek | 5fe4d9d | 2009-10-07 00:42:52 +0000 | [diff] [blame] | 608 | Succ->addPredecessor(Pred, *Eng.G); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 609 | |
Ted Kremenek | daeb9a7 | 2008-02-13 23:08:21 +0000 | [diff] [blame] | 610 | if (IsNew) { |
| 611 | Eng.WList->Enqueue(Succ); |
| 612 | return Succ; |
| 613 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 614 | |
Ted Kremenek | daeb9a7 | 2008-02-13 23:08:21 +0000 | [diff] [blame] | 615 | return NULL; |
| 616 | } |
| 617 | |
| 618 | |
Zhongxing Xu | c5619d9 | 2009-08-06 01:32:16 +0000 | [diff] [blame] | 619 | ExplodedNode* |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 620 | GRSwitchNodeBuilder::generateDefaultCaseNode(const GRState* St, bool isSink) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 621 | |
Ted Kremenek | daeb9a7 | 2008-02-13 23:08:21 +0000 | [diff] [blame] | 622 | // Get the block for the default case. |
| 623 | assert (Src->succ_rbegin() != Src->succ_rend()); |
| 624 | CFGBlock* DefaultBlock = *Src->succ_rbegin(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 625 | |
Ted Kremenek | daeb9a7 | 2008-02-13 23:08:21 +0000 | [diff] [blame] | 626 | bool IsNew; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 627 | |
Zhongxing Xu | 25e695b | 2009-08-15 03:17:38 +0000 | [diff] [blame] | 628 | ExplodedNode* Succ = Eng.G->getNode(BlockEdge(Src, DefaultBlock, |
| 629 | Pred->getLocationContext()), St, &IsNew); |
Ted Kremenek | 5fe4d9d | 2009-10-07 00:42:52 +0000 | [diff] [blame] | 630 | Succ->addPredecessor(Pred, *Eng.G); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 631 | |
Ted Kremenek | daeb9a7 | 2008-02-13 23:08:21 +0000 | [diff] [blame] | 632 | if (IsNew) { |
| 633 | if (isSink) |
| 634 | Succ->markAsSink(); |
| 635 | else |
| 636 | Eng.WList->Enqueue(Succ); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 637 | |
Ted Kremenek | daeb9a7 | 2008-02-13 23:08:21 +0000 | [diff] [blame] | 638 | return Succ; |
| 639 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 640 | |
Ted Kremenek | daeb9a7 | 2008-02-13 23:08:21 +0000 | [diff] [blame] | 641 | return NULL; |
| 642 | } |
Ted Kremenek | 11062b1 | 2008-04-11 22:03:04 +0000 | [diff] [blame] | 643 | |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 644 | GREndPathNodeBuilder::~GREndPathNodeBuilder() { |
Ted Kremenek | 11062b1 | 2008-04-11 22:03:04 +0000 | [diff] [blame] | 645 | // Auto-generate an EOP node if one has not been generated. |
Douglas Gregor | 102acd5 | 2010-02-25 19:01:53 +0000 | [diff] [blame] | 646 | if (!HasGeneratedNode) { |
| 647 | // If we are in an inlined call, generate CallExit node. |
| 648 | if (Pred->getLocationContext()->getParent()) |
| 649 | GenerateCallExitNode(Pred->State); |
| 650 | else |
| 651 | generateNode(Pred->State); |
| 652 | } |
Ted Kremenek | 11062b1 | 2008-04-11 22:03:04 +0000 | [diff] [blame] | 653 | } |
| 654 | |
Zhongxing Xu | c5619d9 | 2009-08-06 01:32:16 +0000 | [diff] [blame] | 655 | ExplodedNode* |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 656 | GREndPathNodeBuilder::generateNode(const GRState* State, const void *tag, |
| 657 | ExplodedNode* P) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 658 | HasGeneratedNode = true; |
Ted Kremenek | 11062b1 | 2008-04-11 22:03:04 +0000 | [diff] [blame] | 659 | bool IsNew; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 660 | |
| 661 | ExplodedNode* Node = Eng.G->getNode(BlockEntrance(&B, |
Zhongxing Xu | 25e695b | 2009-08-15 03:17:38 +0000 | [diff] [blame] | 662 | Pred->getLocationContext(), tag), State, &IsNew); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 663 | |
Ted Kremenek | 5fe4d9d | 2009-10-07 00:42:52 +0000 | [diff] [blame] | 664 | Node->addPredecessor(P ? P : Pred, *Eng.G); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 665 | |
Ted Kremenek | 11062b1 | 2008-04-11 22:03:04 +0000 | [diff] [blame] | 666 | if (IsNew) { |
Ted Kremenek | 11062b1 | 2008-04-11 22:03:04 +0000 | [diff] [blame] | 667 | Eng.G->addEndOfPath(Node); |
Ted Kremenek | 4f28515 | 2008-04-18 16:30:14 +0000 | [diff] [blame] | 668 | return Node; |
Ted Kremenek | 11062b1 | 2008-04-11 22:03:04 +0000 | [diff] [blame] | 669 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 670 | |
Ted Kremenek | 4f28515 | 2008-04-18 16:30:14 +0000 | [diff] [blame] | 671 | return NULL; |
Ted Kremenek | 11062b1 | 2008-04-11 22:03:04 +0000 | [diff] [blame] | 672 | } |
Douglas Gregor | 102acd5 | 2010-02-25 19:01:53 +0000 | [diff] [blame] | 673 | |
| 674 | void GREndPathNodeBuilder::GenerateCallExitNode(const GRState *state) { |
| 675 | HasGeneratedNode = true; |
| 676 | // Create a CallExit node and enqueue it. |
| 677 | const StackFrameContext *LocCtx |
| 678 | = cast<StackFrameContext>(Pred->getLocationContext()); |
| 679 | const Stmt *CE = LocCtx->getCallSite(); |
| 680 | |
| 681 | // Use the the callee location context. |
| 682 | CallExit Loc(CE, LocCtx); |
| 683 | |
| 684 | bool isNew; |
| 685 | ExplodedNode *Node = Eng.G->getNode(Loc, state, &isNew); |
| 686 | Node->addPredecessor(Pred, *Eng.G); |
| 687 | |
| 688 | if (isNew) |
| 689 | Eng.WList->Enqueue(Node); |
| 690 | } |
| 691 | |
| 692 | |
| 693 | void GRCallEnterNodeBuilder::GenerateNode(const GRState *state, |
| 694 | const LocationContext *LocCtx) { |
| 695 | // Get the callee entry block. |
| 696 | const CFGBlock *Entry = &(LocCtx->getCFG()->getEntry()); |
| 697 | assert(Entry->empty()); |
| 698 | assert(Entry->succ_size() == 1); |
| 699 | |
| 700 | // Get the solitary successor. |
| 701 | const CFGBlock *SuccB = *(Entry->succ_begin()); |
| 702 | |
| 703 | // Construct an edge representing the starting location in the callee. |
| 704 | BlockEdge Loc(Entry, SuccB, LocCtx); |
| 705 | |
| 706 | bool isNew; |
| 707 | ExplodedNode *Node = Eng.G->getNode(Loc, state, &isNew); |
| 708 | Node->addPredecessor(const_cast<ExplodedNode*>(Pred), *Eng.G); |
| 709 | |
| 710 | if (isNew) |
| 711 | Eng.WList->Enqueue(Node); |
| 712 | } |
| 713 | |
| 714 | void GRCallExitNodeBuilder::GenerateNode(const GRState *state) { |
| 715 | // Get the callee's location context. |
| 716 | const StackFrameContext *LocCtx |
| 717 | = cast<StackFrameContext>(Pred->getLocationContext()); |
| 718 | |
| 719 | PostStmt Loc(LocCtx->getCallSite(), LocCtx->getParent()); |
| 720 | bool isNew; |
| 721 | ExplodedNode *Node = Eng.G->getNode(Loc, state, &isNew); |
| 722 | Node->addPredecessor(const_cast<ExplodedNode*>(Pred), *Eng.G); |
| 723 | if (isNew) |
| 724 | Eng.WList->Enqueue(Node, *const_cast<CFGBlock*>(LocCtx->getCallSiteBlock()), |
| 725 | LocCtx->getIndex() + 1); |
| 726 | } |