Coverage Report

Created: 2022-01-22 13:19

/Users/buildslave/jenkins/workspace/coverage/llvm-project/clang/include/clang/StaticAnalyzer/Core/PathSensitive/SValBuilder.h
Line
Count
Source (jump to first uncovered line)
1
// SValBuilder.h - Construction of SVals from evaluating expressions -*- C++ -*-
2
//
3
// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4
// See https://llvm.org/LICENSE.txt for license information.
5
// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6
//
7
//===----------------------------------------------------------------------===//
8
//
9
//  This file defines SValBuilder, a class that defines the interface for
10
//  "symbolical evaluators" which construct an SVal from an expression.
11
//
12
//===----------------------------------------------------------------------===//
13
14
#ifndef LLVM_CLANG_STATICANALYZER_CORE_PATHSENSITIVE_SVALBUILDER_H
15
#define LLVM_CLANG_STATICANALYZER_CORE_PATHSENSITIVE_SVALBUILDER_H
16
17
#include "clang/AST/ASTContext.h"
18
#include "clang/AST/DeclarationName.h"
19
#include "clang/AST/Expr.h"
20
#include "clang/AST/ExprObjC.h"
21
#include "clang/AST/Type.h"
22
#include "clang/Basic/LLVM.h"
23
#include "clang/Basic/LangOptions.h"
24
#include "clang/StaticAnalyzer/Core/PathSensitive/BasicValueFactory.h"
25
#include "clang/StaticAnalyzer/Core/PathSensitive/MemRegion.h"
26
#include "clang/StaticAnalyzer/Core/PathSensitive/ProgramState_Fwd.h"
27
#include "clang/StaticAnalyzer/Core/PathSensitive/SVals.h"
28
#include "clang/StaticAnalyzer/Core/PathSensitive/SymExpr.h"
29
#include "clang/StaticAnalyzer/Core/PathSensitive/SymbolManager.h"
30
#include "llvm/ADT/ImmutableList.h"
31
#include "llvm/ADT/Optional.h"
32
#include <cstdint>
33
34
namespace clang {
35
36
class AnalyzerOptions;
37
class BlockDecl;
38
class CXXBoolLiteralExpr;
39
class CXXMethodDecl;
40
class CXXRecordDecl;
41
class DeclaratorDecl;
42
class FunctionDecl;
43
class LocationContext;
44
class StackFrameContext;
45
class Stmt;
46
47
namespace ento {
48
49
class ConditionTruthVal;
50
class ProgramStateManager;
51
class StoreRef;
52
53
class SValBuilder {
54
  virtual void anchor();
55
56
protected:
57
  ASTContext &Context;
58
59
  /// Manager of APSInt values.
60
  BasicValueFactory BasicVals;
61
62
  /// Manages the creation of symbols.
63
  SymbolManager SymMgr;
64
65
  /// Manages the creation of memory regions.
66
  MemRegionManager MemMgr;
67
68
  ProgramStateManager &StateMgr;
69
70
  const AnalyzerOptions &AnOpts;
71
72
  /// The scalar type to use for array indices.
73
  const QualType ArrayIndexTy;
74
75
  /// The width of the scalar type used for array indices.
76
  const unsigned ArrayIndexWidth;
77
78
  SVal evalCastKind(UndefinedVal V, QualType CastTy, QualType OriginalTy);
79
  SVal evalCastKind(UnknownVal V, QualType CastTy, QualType OriginalTy);
80
  SVal evalCastKind(Loc V, QualType CastTy, QualType OriginalTy);
81
  SVal evalCastKind(NonLoc V, QualType CastTy, QualType OriginalTy);
82
  SVal evalCastSubKind(loc::ConcreteInt V, QualType CastTy,
83
                       QualType OriginalTy);
84
  SVal evalCastSubKind(loc::GotoLabel V, QualType CastTy, QualType OriginalTy);
85
  SVal evalCastSubKind(loc::MemRegionVal V, QualType CastTy,
86
                       QualType OriginalTy);
87
  SVal evalCastSubKind(nonloc::CompoundVal V, QualType CastTy,
88
                       QualType OriginalTy);
89
  SVal evalCastSubKind(nonloc::ConcreteInt V, QualType CastTy,
90
                       QualType OriginalTy);
91
  SVal evalCastSubKind(nonloc::LazyCompoundVal V, QualType CastTy,
92
                       QualType OriginalTy);
93
  SVal evalCastSubKind(nonloc::LocAsInteger V, QualType CastTy,
94
                       QualType OriginalTy);
95
  SVal evalCastSubKind(nonloc::SymbolVal V, QualType CastTy,
96
                       QualType OriginalTy);
97
  SVal evalCastSubKind(nonloc::PointerToMember V, QualType CastTy,
98
                       QualType OriginalTy);
99
  /// Reduce cast expression by removing redundant intermediate casts.
100
  /// E.g.
101
  /// - (char)(short)(int x) -> (char)(int x)
102
  /// - (int)(int x) -> int x
103
  ///
104
  /// \param V -- SymbolVal, which pressumably contains SymbolCast or any symbol
105
  /// that is applicable for cast operation.
106
  /// \param CastTy -- QualType, which `V` shall be cast to.
107
  /// \return SVal with simplified cast expression.
108
  /// \note: Currently only support integral casts.
109
  SVal simplifySymbolCast(nonloc::SymbolVal V, QualType CastTy);
110
111
public:
112
  SValBuilder(llvm::BumpPtrAllocator &alloc, ASTContext &context,
113
              ProgramStateManager &stateMgr);
114
115
14.8k
  virtual ~SValBuilder() = default;
116
117
  SVal evalCast(SVal V, QualType CastTy, QualType OriginalTy);
118
119
  // Handles casts of type CK_IntegralCast.
120
  SVal evalIntegralCast(ProgramStateRef state, SVal val, QualType castTy,
121
                        QualType originalType);
122
123
  virtual SVal evalMinus(NonLoc val) = 0;
124
125
  virtual SVal evalComplement(NonLoc val) = 0;
126
127
  /// Create a new value which represents a binary expression with two non-
128
  /// location operands.
129
  virtual SVal evalBinOpNN(ProgramStateRef state, BinaryOperator::Opcode op,
130
                           NonLoc lhs, NonLoc rhs, QualType resultTy) = 0;
131
132
  /// Create a new value which represents a binary expression with two memory
133
  /// location operands.
134
  virtual SVal evalBinOpLL(ProgramStateRef state, BinaryOperator::Opcode op,
135
                           Loc lhs, Loc rhs, QualType resultTy) = 0;
136
137
  /// Create a new value which represents a binary expression with a memory
138
  /// location and non-location operands. For example, this would be used to
139
  /// evaluate a pointer arithmetic operation.
140
  virtual SVal evalBinOpLN(ProgramStateRef state, BinaryOperator::Opcode op,
141
                           Loc lhs, NonLoc rhs, QualType resultTy) = 0;
142
143
  /// Evaluates a given SVal. If the SVal has only one possible (integer) value,
144
  /// that value is returned. Otherwise, returns NULL.
145
  virtual const llvm::APSInt *getKnownValue(ProgramStateRef state, SVal val) = 0;
146
147
  /// Simplify symbolic expressions within a given SVal. Return an SVal
148
  /// that represents the same value, but is hopefully easier to work with
149
  /// than the original SVal.
150
  virtual SVal simplifySVal(ProgramStateRef State, SVal Val) = 0;
151
152
  /// Constructs a symbolic expression for two non-location values.
153
  SVal makeSymExprValNN(BinaryOperator::Opcode op,
154
                        NonLoc lhs, NonLoc rhs, QualType resultTy);
155
156
  SVal evalBinOp(ProgramStateRef state, BinaryOperator::Opcode op,
157
                 SVal lhs, SVal rhs, QualType type);
158
159
  /// \return Whether values in \p lhs and \p rhs are equal at \p state.
160
  ConditionTruthVal areEqual(ProgramStateRef state, SVal lhs, SVal rhs);
161
162
  SVal evalEQ(ProgramStateRef state, SVal lhs, SVal rhs);
163
164
  DefinedOrUnknownSVal evalEQ(ProgramStateRef state, DefinedOrUnknownSVal lhs,
165
                              DefinedOrUnknownSVal rhs);
166
167
1.53M
  ASTContext &getContext() { return Context; }
168
0
  const ASTContext &getContext() const { return Context; }
169
170
0
  ProgramStateManager &getStateManager() { return StateMgr; }
171
172
58.9k
  QualType getConditionType() const {
173
58.9k
    return Context.getLangOpts().CPlusPlus ? 
Context.BoolTy38.4k
:
Context.IntTy20.5k
;
174
58.9k
  }
175
176
42.3k
  QualType getArrayIndexType() const {
177
42.3k
    return ArrayIndexTy;
178
42.3k
  }
179
180
268k
  BasicValueFactory &getBasicValueFactory() { return BasicVals; }
181
0
  const BasicValueFactory &getBasicValueFactory() const { return BasicVals; }
182
183
56.2k
  SymbolManager &getSymbolManager() { return SymMgr; }
184
0
  const SymbolManager &getSymbolManager() const { return SymMgr; }
185
186
234k
  MemRegionManager &getRegionManager() { return MemMgr; }
187
0
  const MemRegionManager &getRegionManager() const { return MemMgr; }
188
189
12.5k
  const AnalyzerOptions &getAnalyzerOptions() const { return AnOpts; }
190
191
  // Forwarding methods to SymbolManager.
192
193
  const SymbolConjured* conjureSymbol(const Stmt *stmt,
194
                                      const LocationContext *LCtx,
195
                                      QualType type,
196
                                      unsigned visitCount,
197
0
                                      const void *symbolTag = nullptr) {
198
0
    return SymMgr.conjureSymbol(stmt, LCtx, type, visitCount, symbolTag);
199
0
  }
200
201
  const SymbolConjured* conjureSymbol(const Expr *expr,
202
                                      const LocationContext *LCtx,
203
                                      unsigned visitCount,
204
0
                                      const void *symbolTag = nullptr) {
205
0
    return SymMgr.conjureSymbol(expr, LCtx, visitCount, symbolTag);
206
0
  }
207
208
  /// Construct an SVal representing '0' for the specified type.
209
  DefinedOrUnknownSVal makeZeroVal(QualType type);
210
211
  /// Make a unique symbol for value of region.
212
  DefinedOrUnknownSVal getRegionValueSymbolVal(const TypedValueRegion *region);
213
214
  /// Create a new symbol with a unique 'name'.
215
  ///
216
  /// We resort to conjured symbols when we cannot construct a derived symbol.
217
  /// The advantage of symbols derived/built from other symbols is that we
218
  /// preserve the relation between related(or even equivalent) expressions, so
219
  /// conjured symbols should be used sparingly.
220
  DefinedOrUnknownSVal conjureSymbolVal(const void *symbolTag,
221
                                        const Expr *expr,
222
                                        const LocationContext *LCtx,
223
                                        unsigned count);
224
  DefinedOrUnknownSVal conjureSymbolVal(const void *symbolTag,
225
                                        const Expr *expr,
226
                                        const LocationContext *LCtx,
227
                                        QualType type,
228
                                        unsigned count);
229
  DefinedOrUnknownSVal conjureSymbolVal(const Stmt *stmt,
230
                                        const LocationContext *LCtx,
231
                                        QualType type,
232
                                        unsigned visitCount);
233
234
  /// Conjure a symbol representing heap allocated memory region.
235
  ///
236
  /// Note, the expression should represent a location.
237
  DefinedOrUnknownSVal getConjuredHeapSymbolVal(const Expr *E,
238
                                                const LocationContext *LCtx,
239
                                                unsigned Count);
240
241
  /// Conjure a symbol representing heap allocated memory region.
242
  ///
243
  /// Note, now, the expression *doesn't* need to represent a location.
244
  /// But the type need to!
245
  DefinedOrUnknownSVal getConjuredHeapSymbolVal(const Expr *E,
246
                                                const LocationContext *LCtx,
247
                                                QualType type, unsigned Count);
248
249
  DefinedOrUnknownSVal getDerivedRegionValueSymbolVal(
250
      SymbolRef parentSymbol, const TypedValueRegion *region);
251
252
  DefinedSVal getMetadataSymbolVal(const void *symbolTag,
253
                                   const MemRegion *region,
254
                                   const Expr *expr, QualType type,
255
                                   const LocationContext *LCtx,
256
                                   unsigned count);
257
258
  DefinedSVal getMemberPointer(const NamedDecl *ND);
259
260
  DefinedSVal getFunctionPointer(const FunctionDecl *func);
261
262
  DefinedSVal getBlockPointer(const BlockDecl *block, CanQualType locTy,
263
                              const LocationContext *locContext,
264
                              unsigned blockCount);
265
266
  /// Returns the value of \p E, if it can be determined in a non-path-sensitive
267
  /// manner.
268
  ///
269
  /// If \p E is not a constant or cannot be modeled, returns \c None.
270
  Optional<SVal> getConstantVal(const Expr *E);
271
272
1.22k
  NonLoc makeCompoundVal(QualType type, llvm::ImmutableList<SVal> vals) {
273
1.22k
    return nonloc::CompoundVal(BasicVals.getCompoundValData(type, vals));
274
1.22k
  }
275
276
  NonLoc makeLazyCompoundVal(const StoreRef &store,
277
55.9k
                             const TypedValueRegion *region) {
278
55.9k
    return nonloc::LazyCompoundVal(
279
55.9k
        BasicVals.getLazyCompoundValData(store, region));
280
55.9k
  }
281
282
0
  NonLoc makePointerToMember(const DeclaratorDecl *DD) {
283
0
    return nonloc::PointerToMember(DD);
284
0
  }
285
286
31
  NonLoc makePointerToMember(const PointerToMemberData *PTMD) {
287
31
    return nonloc::PointerToMember(PTMD);
288
31
  }
289
290
20.7k
  NonLoc makeZeroArrayIndex() {
291
20.7k
    return nonloc::ConcreteInt(BasicVals.getValue(0, ArrayIndexTy));
292
20.7k
  }
293
294
12.9k
  NonLoc makeArrayIndex(uint64_t idx) {
295
12.9k
    return nonloc::ConcreteInt(BasicVals.getValue(idx, ArrayIndexTy));
296
12.9k
  }
297
298
  SVal convertToArrayIndex(SVal val);
299
300
71.3k
  nonloc::ConcreteInt makeIntVal(const IntegerLiteral* integer) {
301
71.3k
    return nonloc::ConcreteInt(
302
71.3k
        BasicVals.getValue(integer->getValue(),
303
71.3k
                     integer->getType()->isUnsignedIntegerOrEnumerationType()));
304
71.3k
  }
305
306
244
  nonloc::ConcreteInt makeBoolVal(const ObjCBoolLiteralExpr *boolean) {
307
244
    return makeTruthVal(boolean->getValue(), boolean->getType());
308
244
  }
309
310
  nonloc::ConcreteInt makeBoolVal(const CXXBoolLiteralExpr *boolean);
311
312
87.5k
  nonloc::ConcreteInt makeIntVal(const llvm::APSInt& integer) {
313
87.5k
    return nonloc::ConcreteInt(BasicVals.getValue(integer));
314
87.5k
  }
315
316
1.00k
  loc::ConcreteInt makeIntLocVal(const llvm::APSInt &integer) {
317
1.00k
    return loc::ConcreteInt(BasicVals.getValue(integer));
318
1.00k
  }
319
320
0
  NonLoc makeIntVal(const llvm::APInt& integer, bool isUnsigned) {
321
0
    return nonloc::ConcreteInt(BasicVals.getValue(integer, isUnsigned));
322
0
  }
323
324
56.8k
  DefinedSVal makeIntVal(uint64_t integer, QualType type) {
325
56.8k
    if (Loc::isLocType(type))
326
260
      return loc::ConcreteInt(BasicVals.getValue(integer, type));
327
328
56.6k
    return nonloc::ConcreteInt(BasicVals.getValue(integer, type));
329
56.8k
  }
330
331
917
  NonLoc makeIntVal(uint64_t integer, bool isUnsigned) {
332
917
    return nonloc::ConcreteInt(BasicVals.getIntValue(integer, isUnsigned));
333
917
  }
334
335
151
  NonLoc makeIntValWithPtrWidth(uint64_t integer, bool isUnsigned) {
336
151
    return nonloc::ConcreteInt(
337
151
        BasicVals.getIntWithPtrWidth(integer, isUnsigned));
338
151
  }
339
340
517
  NonLoc makeLocAsInteger(Loc loc, unsigned bits) {
341
517
    return nonloc::LocAsInteger(BasicVals.getPersistentSValWithData(loc, bits));
342
517
  }
343
344
  NonLoc makeNonLoc(const SymExpr *lhs, BinaryOperator::Opcode op,
345
                    const llvm::APSInt& rhs, QualType type);
346
347
  NonLoc makeNonLoc(const llvm::APSInt& rhs, BinaryOperator::Opcode op,
348
                    const SymExpr *lhs, QualType type);
349
350
  NonLoc makeNonLoc(const SymExpr *lhs, BinaryOperator::Opcode op,
351
                    const SymExpr *rhs, QualType type);
352
353
  /// Create a NonLoc value for cast.
354
  NonLoc makeNonLoc(const SymExpr *operand, QualType fromTy, QualType toTy);
355
356
563k
  nonloc::ConcreteInt makeTruthVal(bool b, QualType type) {
357
563k
    return nonloc::ConcreteInt(BasicVals.getTruthValue(b, type));
358
563k
  }
359
360
3.00k
  nonloc::ConcreteInt makeTruthVal(bool b) {
361
3.00k
    return nonloc::ConcreteInt(BasicVals.getTruthValue(b));
362
3.00k
  }
363
364
  /// Create NULL pointer, with proper pointer bit-width for given address
365
  /// space.
366
  /// \param type pointer type.
367
285
  Loc makeNullWithType(QualType type) {
368
285
    return loc::ConcreteInt(BasicVals.getZeroWithTypeSize(type));
369
285
  }
370
371
8.70k
  Loc makeNull() {
372
8.70k
    return loc::ConcreteInt(BasicVals.getZeroWithPtrWidth());
373
8.70k
  }
374
375
243k
  Loc makeLoc(SymbolRef sym) {
376
243k
    return loc::MemRegionVal(MemMgr.getSymbolicRegion(sym));
377
243k
  }
378
379
252k
  Loc makeLoc(const MemRegion* region) {
380
252k
    return loc::MemRegionVal(region);
381
252k
  }
382
383
156
  Loc makeLoc(const AddrLabelExpr *expr) {
384
156
    return loc::GotoLabel(expr->getLabel());
385
156
  }
386
387
36
  Loc makeLoc(const llvm::APSInt& integer) {
388
36
    return loc::ConcreteInt(BasicVals.getValue(integer));
389
36
  }
390
391
  /// Return MemRegionVal on success cast, otherwise return None.
392
  Optional<loc::MemRegionVal> getCastedMemRegionVal(const MemRegion *region,
393
                                                    QualType type);
394
395
  /// Make an SVal that represents the given symbol. This follows the convention
396
  /// of representing Loc-type symbols (symbolic pointers and references)
397
  /// as Loc values wrapping the symbol rather than as plain symbol values.
398
2.81M
  SVal makeSymbolVal(SymbolRef Sym) {
399
2.81M
    if (Loc::isLocType(Sym->getType()))
400
242k
      return makeLoc(Sym);
401
2.56M
    return nonloc::SymbolVal(Sym);
402
2.81M
  }
403
404
  /// Return a memory region for the 'this' object reference.
405
  loc::MemRegionVal getCXXThis(const CXXMethodDecl *D,
406
                               const StackFrameContext *SFC);
407
408
  /// Return a memory region for the 'this' object reference.
409
  loc::MemRegionVal getCXXThis(const CXXRecordDecl *D,
410
                               const StackFrameContext *SFC);
411
};
412
413
SValBuilder* createSimpleSValBuilder(llvm::BumpPtrAllocator &alloc,
414
                                     ASTContext &context,
415
                                     ProgramStateManager &stateMgr);
416
417
} // namespace ento
418
419
} // namespace clang
420
421
#endif // LLVM_CLANG_STATICANALYZER_CORE_PATHSENSITIVE_SVALBUILDER_H