Added --trim-path-graph to the driver to trim paths from the ExplodedGraph
that are not related to error nodes.
Fixed bug where we did not detect some NULL dereferences.
Added "ExplodedGraph::Trim" to trim all nodes that cannot transitively reach
a set of provided nodes.
Fixed subtle bug in ExplodedNodeImpl where we could create predecessor
iterators that included the mangled "sink" bit. The better fix is to integrate
this bit into the void* for the wrapped State, not the NodeGroups representing
a node's predecessors and successors.
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@48036 91177308-0d34-0410-b5e6-96231b3b80d8
diff --git a/Analysis/GRExprEngine.cpp b/Analysis/GRExprEngine.cpp
index aaef2f8..3bf0151 100644
--- a/Analysis/GRExprEngine.cpp
+++ b/Analysis/GRExprEngine.cpp
@@ -732,7 +732,8 @@
}
-void GRExprEngine::VisitDeref(UnaryOperator* U, NodeTy* Pred, NodeSet& Dst) {
+void GRExprEngine::VisitDeref(UnaryOperator* U, NodeTy* Pred,
+ NodeSet& Dst, bool GetLVal) {
Expr* Ex = U->getSubExpr()->IgnoreParens();
@@ -787,12 +788,16 @@
ValueState* StNotNull = Assume(St, LV, true, isFeasibleNotNull);
if (isFeasibleNotNull) {
+
+ if (GetLVal) Nodify(Dst, U, N, SetRVal(StNotNull, U, LV));
+ else {
+
+ // FIXME: Currently symbolic analysis "generates" new symbols
+ // for the contents of values. We need a better approach.
- // FIXME: Currently symbolic analysis "generates" new symbols
- // for the contents of values. We need a better approach.
-
- Nodify(Dst, U, N, SetRVal(StNotNull, U,
- GetRVal(StNotNull, LV, U->getType())));
+ Nodify(Dst, U, N, SetRVal(StNotNull, U,
+ GetRVal(StNotNull, LV, U->getType())));
+ }
}
bool isFeasibleNull;
@@ -975,18 +980,11 @@
return;
}
- if (UnaryOperator* U = dyn_cast<UnaryOperator>(Ex)) {
+ if (UnaryOperator* U = dyn_cast<UnaryOperator>(Ex))
if (U->getOpcode() == UnaryOperator::Deref) {
- Ex = U->getSubExpr()->IgnoreParens();
-
- if (isa<DeclRefExpr>(Ex))
- Dst.Add(Pred);
- else
- Visit(Ex, Pred, Dst);
-
+ VisitDeref(U, Pred, Dst, true);
return;
}
- }
Visit(Ex, Pred, Dst);
}
@@ -1810,11 +1808,40 @@
} // end llvm namespace
#endif
-void GRExprEngine::ViewGraph() {
+#ifndef NDEBUG
+template <typename ITERATOR>
+static void AddSources(llvm::SmallVector<GRExprEngine::NodeTy*, 10>& Sources,
+ ITERATOR I, ITERATOR E) {
+
+ for ( ; I != E; ++I )
+ Sources.push_back(*I);
+}
+#endif
+
+void GRExprEngine::ViewGraph(bool trim) {
#ifndef NDEBUG
GraphPrintCheckerState = this;
GraphPrintSourceManager = &getContext().getSourceManager();
- llvm::ViewGraph(*G.roots_begin(), "GRExprEngine");
+
+ if (trim) {
+ llvm::SmallVector<NodeTy*, 10> Sources;
+ AddSources(Sources, null_derefs_begin(), null_derefs_end());
+ AddSources(Sources, undef_derefs_begin(), undef_derefs_end());
+
+ GRExprEngine::GraphTy* TrimmedG = G.Trim(&Sources[0],
+ &Sources[0]+Sources.size());
+
+ if (!TrimmedG)
+ llvm::cerr << "warning: Trimmed ExplodedGraph is empty.\n";
+ else {
+ llvm::ViewGraph(*TrimmedG->roots_begin(), "TrimmedGRExprEngine");
+ delete TrimmedG;
+ }
+ }
+ else
+ llvm::ViewGraph(*G.roots_begin(), "GRExprEngine");
+
+
GraphPrintCheckerState = NULL;
GraphPrintSourceManager = NULL;
#endif