diff options
Diffstat (limited to 'include/clang/Analysis')
8 files changed, 90 insertions, 73 deletions
diff --git a/include/clang/Analysis/PathSensitive/BugReporter.h b/include/clang/Analysis/PathSensitive/BugReporter.h index ccebf01..6f6681a 100644 --- a/include/clang/Analysis/PathSensitive/BugReporter.h +++ b/include/clang/Analysis/PathSensitive/BugReporter.h @@ -23,7 +23,6 @@ #include "llvm/ADT/SmallPtrSet.h" #include "llvm/ADT/SmallSet.h" #include "llvm/ADT/SmallString.h" -#include "llvm/ADT/StringExtras.h" #include "llvm/ADT/ImmutableSet.h" #include <list> @@ -104,9 +103,9 @@ public: // BugReporter. const Stmt* getStmt() const; - const std::string& getDescription() const { return Description; } + const llvm::StringRef getDescription() const { return Description; } - const std::string& getShortDescription() const { + const llvm::StringRef getShortDescription() const { return ShortDescription.empty() ? Description : ShortDescription; } @@ -444,7 +443,7 @@ public: // FIXME: Move out-of-line (virtual function). SourceLocation getLocation() const { return L; } - void addString(const std::string& s) { Strs.push_back(s); } + void addString(llvm::StringRef s) { Strs.push_back(s); } typedef std::list<std::string>::const_iterator str_iterator; str_iterator str_begin() const { return Strs.begin(); } diff --git a/include/clang/Analysis/PathSensitive/ConstraintManager.h b/include/clang/Analysis/PathSensitive/ConstraintManager.h index 37a1408..c829280 100644 --- a/include/clang/Analysis/PathSensitive/ConstraintManager.h +++ b/include/clang/Analysis/PathSensitive/ConstraintManager.h @@ -25,6 +25,7 @@ namespace clang { class GRState; class GRStateManager; +class GRSubEngine; class SVal; class ConstraintManager { @@ -64,8 +65,10 @@ public: virtual bool canReasonAbout(SVal X) const = 0; }; -ConstraintManager* CreateBasicConstraintManager(GRStateManager& statemgr); -ConstraintManager* CreateRangeConstraintManager(GRStateManager& statemgr); +ConstraintManager* CreateBasicConstraintManager(GRStateManager& statemgr, + GRSubEngine &subengine); +ConstraintManager* CreateRangeConstraintManager(GRStateManager& statemgr, + GRSubEngine &subengine); } // end clang namespace diff --git a/include/clang/Analysis/PathSensitive/GRExprEngine.h b/include/clang/Analysis/PathSensitive/GRExprEngine.h index e05c624..fb0e883 100644 --- a/include/clang/Analysis/PathSensitive/GRExprEngine.h +++ b/include/clang/Analysis/PathSensitive/GRExprEngine.h @@ -87,9 +87,11 @@ class GRExprEngine : public GRSubEngine { // this object be placed at the very end of member variables so that its // destructor is called before the rest of the GRExprEngine is destroyed. GRBugReporter BR; + + llvm::OwningPtr<GRTransferFuncs> TF; public: - GRExprEngine(AnalysisManager &mgr); + GRExprEngine(AnalysisManager &mgr, GRTransferFuncs *tf); ~GRExprEngine(); @@ -104,18 +106,14 @@ public: SValuator &getSValuator() { return SVator; } - GRTransferFuncs& getTF() { return *StateMgr.TF; } + GRTransferFuncs& getTF() { return *TF; } BugReporter& getBugReporter() { return BR; } GRStmtNodeBuilder &getBuilder() { assert(Builder); return *Builder; } - /// setTransferFunctions - void setTransferFunctionsAndCheckers(GRTransferFuncs* tf); - - void setTransferFunctions(GRTransferFuncs& tf) { - setTransferFunctionsAndCheckers(&tf); - } + // FIXME: Remove once GRTransferFuncs is no longer referenced. + void setTransferFunction(GRTransferFuncs* tf); /// ViewGraph - Visualize the ExplodedGraph created by executing the /// simulation. @@ -173,6 +171,10 @@ public: /// ProcessEndPath - Called by GRCoreEngine. Used to generate end-of-path /// nodes when the control reaches the end of a function. void ProcessEndPath(GREndPathNodeBuilder& builder); + + /// EvalAssume - Callback function invoked by the ConstraintManager when + /// making assumptions about state values. + const GRState *ProcessAssume(const GRState *state, SVal cond, bool assumption); GRStateManager& getStateManager() { return StateMgr; } const GRStateManager& getStateManager() const { return StateMgr; } @@ -351,6 +353,10 @@ protected: void VisitCXXThisExpr(CXXThisExpr *TE, ExplodedNode *Pred, ExplodedNodeSet & Dst); + /// Create a C++ temporary object for an rvalue. + void CreateCXXTemporaryObject(Expr *Ex, ExplodedNode *Pred, + ExplodedNodeSet &Dst); + /// EvalEagerlyAssume - Given the nodes in 'Src', eagerly assume symbolic /// expressions of the form 'x != 0' and generate new nodes (stored in Dst) /// with those assumptions. diff --git a/include/clang/Analysis/PathSensitive/GRState.h b/include/clang/Analysis/PathSensitive/GRState.h index 424b0d7..11cdac0 100644 --- a/include/clang/Analysis/PathSensitive/GRState.h +++ b/include/clang/Analysis/PathSensitive/GRState.h @@ -40,10 +40,10 @@ namespace clang { class GRStateManager; -class GRTransferFuncs; class Checker; -typedef ConstraintManager* (*ConstraintManagerCreator)(GRStateManager&); +typedef ConstraintManager* (*ConstraintManagerCreator)(GRStateManager&, + GRSubEngine&); typedef StoreManager* (*StoreManagerCreator)(GRStateManager&); //===----------------------------------------------------------------------===// @@ -159,10 +159,6 @@ public: BasicValueFactory &getBasicVals() const; SymbolManager &getSymbolManager() const; - GRTransferFuncs &getTransferFuncs() const; - - std::vector<std::pair<void *, Checker *> >::iterator checker_begin() const; - std::vector<std::pair<void *, Checker *> >::iterator checker_end() const; //==---------------------------------------------------------------------==// // Constraints on values. @@ -391,9 +387,8 @@ public: //===----------------------------------------------------------------------===// class GRStateManager { - friend class GRExprEngine; friend class GRState; - + friend class GRExprEngine; // FIXME: Remove. private: EnvironmentManager EnvMgr; llvm::OwningPtr<StoreManager> StoreMgr; @@ -416,27 +411,20 @@ private: ValueManager ValueMgr; /// Alloc - A BumpPtrAllocator to allocate states. - llvm::BumpPtrAllocator& Alloc; - - /// TF - Object that represents a bundle of transfer functions - /// for manipulating and creating SVals. - GRTransferFuncs* TF; - - /// Reference to all checkers in GRExprEngine. - std::vector<std::pair<void *, Checker*> > *Checkers; + llvm::BumpPtrAllocator &Alloc; public: - GRStateManager(ASTContext& Ctx, StoreManagerCreator CreateStoreManager, ConstraintManagerCreator CreateConstraintManager, - llvm::BumpPtrAllocator& alloc) + llvm::BumpPtrAllocator& alloc, + GRSubEngine &subeng) : EnvMgr(alloc), GDMFactory(alloc), ValueMgr(alloc, Ctx, *this), Alloc(alloc) { StoreMgr.reset((*CreateStoreManager)(*this)); - ConstraintMgr.reset((*CreateConstraintManager)(*this)); + ConstraintMgr.reset((*CreateConstraintManager)(*this, subeng)); } ~GRStateManager(); @@ -446,10 +434,6 @@ public: ASTContext &getContext() { return ValueMgr.getContext(); } const ASTContext &getContext() const { return ValueMgr.getContext(); } - GRTransferFuncs& getTransferFuncs() { return *TF; } - - std::vector<std::pair<void *, Checker *> > &getCheckers() { return *Checkers;} - BasicValueFactory &getBasicVals() { return ValueMgr.getBasicValueFactory(); } @@ -702,20 +686,6 @@ inline SymbolManager &GRState::getSymbolManager() const { return getStateManager().getSymbolManager(); } -inline GRTransferFuncs &GRState::getTransferFuncs() const { - return getStateManager().getTransferFuncs(); -} - -inline std::vector<std::pair<void *, Checker *> >::iterator -GRState::checker_begin() const { - return getStateManager().getCheckers().begin(); -} - -inline std::vector<std::pair<void *, Checker *> >::iterator -GRState::checker_end() const { - return getStateManager().getCheckers().end(); -} - template<typename T> const GRState *GRState::add(typename GRStateTrait<T>::key_type K) const { return getStateManager().add<T>(this, K, get_context<T>()); diff --git a/include/clang/Analysis/PathSensitive/GRSubEngine.h b/include/clang/Analysis/PathSensitive/GRSubEngine.h index 330742d..5b383fa 100644 --- a/include/clang/Analysis/PathSensitive/GRSubEngine.h +++ b/include/clang/Analysis/PathSensitive/GRSubEngine.h @@ -13,6 +13,8 @@ #ifndef LLVM_CLANG_ANALYSIS_GRSUBENGINE_H #define LLVM_CLANG_ANALYSIS_GRSUBENGINE_H +#include "clang/Analysis/PathSensitive/SVals.h" + namespace clang { class Stmt; @@ -62,8 +64,12 @@ public: /// ProcessEndPath - Called by GRCoreEngine. Used to generate end-of-path /// nodes when the control reaches the end of a function. virtual void ProcessEndPath(GREndPathNodeBuilder& builder) = 0; + + /// EvalAssume - Called by ConstraintManager. Used to call checker-specific + /// logic for handling assumptions on symbolic values. + virtual const GRState* ProcessAssume(const GRState *state, + SVal cond, bool assumption) = 0; }; - } #endif diff --git a/include/clang/Analysis/PathSensitive/MemRegion.h b/include/clang/Analysis/PathSensitive/MemRegion.h index b57cfd7..3bcedbe 100644 --- a/include/clang/Analysis/PathSensitive/MemRegion.h +++ b/include/clang/Analysis/PathSensitive/MemRegion.h @@ -65,6 +65,7 @@ public: BlockTextRegionKind, BlockDataRegionKind, CompoundLiteralRegionKind, + CXXThisRegionKind, StringRegionKind, ElementRegionKind, // Decl Regions. @@ -99,17 +100,13 @@ public: const MemRegion *StripCasts() const; - bool hasStackStorage() const; - - bool hasParametersStorage() const; - - bool hasGlobalsStorage() const; - bool hasGlobalsOrParametersStorage() const; - bool hasHeapStorage() const; - - bool hasHeapOrStackStorage() const; + bool hasStackStorage() const; + + bool hasStackNonParametersStorage() const; + + bool hasStackParametersStorage() const; virtual void dumpToStream(llvm::raw_ostream& os) const; @@ -634,6 +631,36 @@ public: return R->getKind() == VarRegionKind; } }; + +/// CXXThisRegion - Represents the region for the implicit 'this' parameter +/// in a call to a C++ method. This region doesn't represent the object +/// referred to by 'this', but rather 'this' itself. +class CXXThisRegion : public TypedRegion { + friend class MemRegionManager; + CXXThisRegion(const PointerType *thisPointerTy, + const MemRegion *sReg) + : TypedRegion(sReg, CXXThisRegionKind), ThisPointerTy(thisPointerTy) {} + + static void ProfileRegion(llvm::FoldingSetNodeID &ID, + const PointerType *PT, + const MemRegion *sReg); + + void Profile(llvm::FoldingSetNodeID &ID) const; + +public: + QualType getValueType(ASTContext &C) const { + return QualType(ThisPointerTy, 0); + } + + void dumpToStream(llvm::raw_ostream& os) const; + + static bool classof(const MemRegion* R) { + return R->getKind() == CXXThisRegionKind; + } + +private: + const PointerType *ThisPointerTy; +}; class FieldRegion : public DeclRegion { friend class MemRegionManager; @@ -725,21 +752,21 @@ public: } }; +// C++ temporary object associated with an expression. class CXXObjectRegion : public TypedRegion { friend class MemRegionManager; - // T - The object type. - QualType T; + Expr const *Ex; - CXXObjectRegion(QualType t, const MemRegion *sReg) - : TypedRegion(sReg, CXXObjectRegionKind), T(t) {} + CXXObjectRegion(Expr const *E, MemRegion const *sReg) + : TypedRegion(sReg, CXXObjectRegionKind), Ex(E) {} static void ProfileRegion(llvm::FoldingSetNodeID &ID, - QualType T, const MemRegion *sReg); + Expr const *E, const MemRegion *sReg); public: QualType getValueType(ASTContext& C) const { - return T; + return Ex->getType(); } void Profile(llvm::FoldingSetNodeID &ID) const; @@ -824,6 +851,11 @@ public: const CompoundLiteralRegion* getCompoundLiteralRegion(const CompoundLiteralExpr* CL, const LocationContext *LC); + + /// getCXXThisRegion - Retrieve the [artifical] region associated with the + /// parameter 'this'. + const CXXThisRegion *getCXXThisRegion(QualType thisPointerTy, + const LocationContext *LC); /// getSymbolicRegion - Retrieve or create a "symbolic" memory region. const SymbolicRegion* getSymbolicRegion(SymbolRef sym); @@ -869,7 +901,8 @@ public: const ObjCIvarRegion *getObjCIvarRegion(const ObjCIvarDecl* ivd, const MemRegion* superRegion); - const CXXObjectRegion *getCXXObjectRegion(QualType T); + const CXXObjectRegion *getCXXObjectRegion(Expr const *Ex, + LocationContext const *LC); const FunctionTextRegion *getFunctionTextRegion(const FunctionDecl *FD); const BlockTextRegion *getBlockTextRegion(const BlockDecl *BD, diff --git a/include/clang/Analysis/PathSensitive/SValuator.h b/include/clang/Analysis/PathSensitive/SValuator.h index e63eb12..4a4b502 100644 --- a/include/clang/Analysis/PathSensitive/SValuator.h +++ b/include/clang/Analysis/PathSensitive/SValuator.h @@ -28,8 +28,10 @@ class SValuator { protected: ValueManager &ValMgr; +public: + // FIXME: Make these protected again one RegionStoreManager correctly + // handles loads from differening bound value types. virtual SVal EvalCastNL(NonLoc val, QualType castTy) = 0; - virtual SVal EvalCastL(Loc val, QualType castTy) = 0; public: diff --git a/include/clang/Analysis/PathSensitive/Store.h b/include/clang/Analysis/PathSensitive/Store.h index 52d73da..70c17ac 100644 --- a/include/clang/Analysis/PathSensitive/Store.h +++ b/include/clang/Analysis/PathSensitive/Store.h @@ -103,9 +103,6 @@ public: virtual SVal getLValueElement(QualType elementType, SVal offset, SVal Base)=0; - // T - the object type. - Loc getThisObject(QualType T); - // FIXME: Make out-of-line. virtual DefinedOrUnknownSVal getSizeInElements(const GRState *state, const MemRegion *region) { @@ -192,7 +189,8 @@ protected: /// CastRetrievedVal - Used by subclasses of StoreManager to implement /// implicit casts that arise from loads from regions that are reinterpreted /// as another region. - SVal CastRetrievedVal(SVal val, const TypedRegion *R, QualType castTy); + SVal CastRetrievedVal(SVal val, const TypedRegion *R, QualType castTy, + bool performTestOnly = true); }; // FIXME: Do we still need this? |
