1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
|
//===--- CallInliner.cpp - Transfer function that inlines callee ----------===//
//
// The LLVM Compiler Infrastructure
//
// This file is distributed under the University of Illinois Open Source
// License. See LICENSE.TXT for details.
//
//===----------------------------------------------------------------------===//
//
// This file implements the callee inlining transfer function.
//
//===----------------------------------------------------------------------===//
#include "clang/Analysis/PathSensitive/CheckerVisitor.h"
#include "clang/Analysis/PathSensitive/GRState.h"
#include "clang/Analysis/LocalCheckers.h"
using namespace clang;
namespace {
class CallInliner : public Checker {
public:
static void *getTag() {
static int x;
return &x;
}
virtual bool EvalCallExpr(CheckerContext &C, const CallExpr *CE);
virtual void EvalEndPath(GREndPathNodeBuilder &B,void *tag,GRExprEngine &Eng);
};
}
void clang::RegisterCallInliner(GRExprEngine &Eng) {
Eng.registerCheck(new CallInliner());
}
bool CallInliner::EvalCallExpr(CheckerContext &C, const CallExpr *CE) {
const GRState *state = C.getState();
const Expr *Callee = CE->getCallee();
SVal L = state->getSVal(Callee);
const FunctionDecl *FD = L.getAsFunctionDecl();
if (!FD)
return false;
if (!FD->isThisDeclarationADefinition())
return false;
GRStmtNodeBuilder &Builder = C.getNodeBuilder();
// Make a new LocationContext.
const StackFrameContext *LocCtx = C.getAnalysisManager().getStackFrame(FD,
C.getPredecessor()->getLocationContext(), CE,
Builder.getBlock(), Builder.getIndex());
CFGBlock const *Entry = &(LocCtx->getCFG()->getEntry());
assert (Entry->empty() && "Entry block must be empty.");
assert (Entry->succ_size() == 1 && "Entry block must have 1 successor.");
// Get the solitary successor.
CFGBlock const *SuccB = *(Entry->succ_begin());
// Construct an edge representing the starting location in the function.
BlockEdge Loc(Entry, SuccB, LocCtx);
state = C.getStoreManager().EnterStackFrame(state, LocCtx);
// This is a hack. We really should not use the GRStmtNodeBuilder.
bool isNew;
GRExprEngine &Eng = C.getEngine();
ExplodedNode *Pred = C.getPredecessor();
ExplodedNode *SuccN = Eng.getGraph().getNode(Loc, state, &isNew);
SuccN->addPredecessor(Pred, Eng.getGraph());
C.getNodeBuilder().Deferred.erase(Pred);
if (isNew)
Builder.getWorkList()->Enqueue(SuccN);
Builder.HasGeneratedNode = true;
return true;
}
void CallInliner::EvalEndPath(GREndPathNodeBuilder &B, void *tag,
GRExprEngine &Eng) {
const GRState *state = B.getState();
ExplodedNode *Pred = B.getPredecessor();
const StackFrameContext *LocCtx =
cast<StackFrameContext>(Pred->getLocationContext());
const Stmt *CE = LocCtx->getCallSite();
// Check if this is the top level stack frame.
if (!LocCtx->getParent())
return;
PostStmt NodeLoc(CE, LocCtx->getParent());
bool isNew;
ExplodedNode *Succ = Eng.getGraph().getNode(NodeLoc, state, &isNew);
Succ->addPredecessor(Pred, Eng.getGraph());
// When creating the new work list unit, increment the statement index to
// point to the statement after the CallExpr.
if (isNew)
B.getWorkList().Enqueue(Succ,
*const_cast<CFGBlock*>(LocCtx->getCallSiteBlock()),
LocCtx->getIndex() + 1);
B.HasGeneratedNode = true;
}
|
