Coverage Report

Created: 2023-11-11 10:31

/Users/buildslave/jenkins/workspace/coverage/llvm-project/clang/lib/StaticAnalyzer/Core/ConstraintManager.cpp
Line
Count
Source (jump to first uncovered line)
1
//===- ConstraintManager.cpp - Constraints on symbolic values. ------------===//
2
//
3
// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4
// See https://llvm.org/LICENSE.txt for license information.
5
// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6
//
7
//===----------------------------------------------------------------------===//
8
//
9
//  This file defined the interface to manage constraints on symbolic values.
10
//
11
//===----------------------------------------------------------------------===//
12
13
#include "clang/StaticAnalyzer/Core/PathSensitive/ConstraintManager.h"
14
#include "clang/AST/Type.h"
15
#include "clang/StaticAnalyzer/Core/PathSensitive/MemRegion.h"
16
#include "clang/StaticAnalyzer/Core/PathSensitive/ProgramState.h"
17
#include "clang/StaticAnalyzer/Core/PathSensitive/ProgramState_Fwd.h"
18
#include "clang/StaticAnalyzer/Core/PathSensitive/SVals.h"
19
#include "llvm/ADT/ScopeExit.h"
20
21
using namespace clang;
22
using namespace ento;
23
24
16.2k
ConstraintManager::~ConstraintManager() = default;
25
26
static DefinedSVal getLocFromSymbol(const ProgramStateRef &State,
27
0
                                    SymbolRef Sym) {
28
0
  const MemRegion *R =
29
0
      State->getStateManager().getRegionManager().getSymbolicRegion(Sym);
30
0
  return loc::MemRegionVal(R);
31
0
}
32
33
ConditionTruthVal ConstraintManager::checkNull(ProgramStateRef State,
34
0
                                               SymbolRef Sym) {
35
0
  QualType Ty = Sym->getType();
36
0
  DefinedSVal V = Loc::isLocType(Ty) ? getLocFromSymbol(State, Sym)
37
0
                                     : nonloc::SymbolVal(Sym);
38
0
  const ProgramStatePair &P = assumeDual(State, V);
39
0
  if (P.first && !P.second)
40
0
    return ConditionTruthVal(false);
41
0
  if (!P.first && P.second)
42
0
    return ConditionTruthVal(true);
43
0
  return {};
44
0
}
45
46
template <typename AssumeFunction>
47
ConstraintManager::ProgramStatePair
48
ConstraintManager::assumeDualImpl(ProgramStateRef &State,
49
543k
                                  AssumeFunction &Assume) {
50
543k
  if (LLVM_UNLIKELY(State->isPosteriorlyOverconstrained()))
51
318
    return {State, State};
52
53
  // Assume functions might recurse (see `reAssume` or `tryRearrange`). During
54
  // the recursion the State might not change anymore, that means we reached a
55
  // fixpoint.
56
  // We avoid infinite recursion of assume calls by checking already visited
57
  // States on the stack of assume function calls.
58
542k
  const ProgramState *RawSt = State.get();
59
542k
  if (LLVM_UNLIKELY(AssumeStack.contains(RawSt)))
60
0
    return {State, State};
61
542k
  AssumeStack.push(RawSt);
62
542k
  auto AssumeStackBuilder =
63
542k
      llvm::make_scope_exit([this]() { AssumeStack.pop(); });
ConstraintManager.cpp:std::__1::pair<llvm::IntrusiveRefCntPtr<clang::ento::ProgramState const>, llvm::IntrusiveRefCntPtr<clang::ento::ProgramState const> > clang::ento::ConstraintManager::assumeDualImpl<clang::ento::ConstraintManager::assumeDual(llvm::IntrusiveRefCntPtr<clang::ento::ProgramState const>, clang::ento::DefinedSVal)::$_0>(llvm::IntrusiveRefCntPtr<clang::ento::ProgramState const>&, clang::ento::ConstraintManager::assumeDual(llvm::IntrusiveRefCntPtr<clang::ento::ProgramState const>, clang::ento::DefinedSVal)::$_0&)::'lambda'()::operator()() const
Line
Count
Source
63
534k
      llvm::make_scope_exit([this]() { AssumeStack.pop(); });
ConstraintManager.cpp:std::__1::pair<llvm::IntrusiveRefCntPtr<clang::ento::ProgramState const>, llvm::IntrusiveRefCntPtr<clang::ento::ProgramState const> > clang::ento::ConstraintManager::assumeDualImpl<clang::ento::ConstraintManager::assumeInclusiveRangeDual(llvm::IntrusiveRefCntPtr<clang::ento::ProgramState const>, clang::ento::NonLoc, llvm::APSInt const&, llvm::APSInt const&)::$_0>(llvm::IntrusiveRefCntPtr<clang::ento::ProgramState const>&, clang::ento::ConstraintManager::assumeInclusiveRangeDual(llvm::IntrusiveRefCntPtr<clang::ento::ProgramState const>, clang::ento::NonLoc, llvm::APSInt const&, llvm::APSInt const&)::$_0&)::'lambda'()::operator()() const
Line
Count
Source
63
8.15k
      llvm::make_scope_exit([this]() { AssumeStack.pop(); });
64
65
542k
  ProgramStateRef StTrue = Assume(true);
66
67
542k
  if (!StTrue) {
68
30.9k
    ProgramStateRef StFalse = Assume(false);
69
30.9k
    if (LLVM_UNLIKELY(!StFalse)) { // both infeasible
70
76
      ProgramStateRef StInfeasible = State->cloneAsPosteriorlyOverconstrained();
71
76
      assert(StInfeasible->isPosteriorlyOverconstrained());
72
      // Checkers might rely on the API contract that both returned states
73
      // cannot be null. Thus, we return StInfeasible for both branches because
74
      // it might happen that a Checker uncoditionally uses one of them if the
75
      // other is a nullptr. This may also happen with the non-dual and
76
      // adjacent `assume(true)` and `assume(false)` calls. By implementing
77
      // assume in therms of assumeDual, we can keep our API contract there as
78
      // well.
79
76
      return ProgramStatePair(StInfeasible, StInfeasible);
80
76
    }
81
30.8k
    return ProgramStatePair(nullptr, StFalse);
82
30.9k
  }
83
84
511k
  ProgramStateRef StFalse = Assume(false);
85
511k
  if (!StFalse) {
86
442k
    return ProgramStatePair(StTrue, nullptr);
87
442k
  }
88
89
69.1k
  return ProgramStatePair(StTrue, StFalse);
90
511k
}
ConstraintManager.cpp:std::__1::pair<llvm::IntrusiveRefCntPtr<clang::ento::ProgramState const>, llvm::IntrusiveRefCntPtr<clang::ento::ProgramState const> > clang::ento::ConstraintManager::assumeDualImpl<clang::ento::ConstraintManager::assumeDual(llvm::IntrusiveRefCntPtr<clang::ento::ProgramState const>, clang::ento::DefinedSVal)::$_0>(llvm::IntrusiveRefCntPtr<clang::ento::ProgramState const>&, clang::ento::ConstraintManager::assumeDual(llvm::IntrusiveRefCntPtr<clang::ento::ProgramState const>, clang::ento::DefinedSVal)::$_0&)
Line
Count
Source
49
534k
                                  AssumeFunction &Assume) {
50
534k
  if (LLVM_UNLIKELY(State->isPosteriorlyOverconstrained()))
51
160
    return {State, State};
52
53
  // Assume functions might recurse (see `reAssume` or `tryRearrange`). During
54
  // the recursion the State might not change anymore, that means we reached a
55
  // fixpoint.
56
  // We avoid infinite recursion of assume calls by checking already visited
57
  // States on the stack of assume function calls.
58
534k
  const ProgramState *RawSt = State.get();
59
534k
  if (LLVM_UNLIKELY(AssumeStack.contains(RawSt)))
60
0
    return {State, State};
61
534k
  AssumeStack.push(RawSt);
62
534k
  auto AssumeStackBuilder =
63
534k
      llvm::make_scope_exit([this]() { AssumeStack.pop(); });
64
65
534k
  ProgramStateRef StTrue = Assume(true);
66
67
534k
  if (!StTrue) {
68
29.4k
    ProgramStateRef StFalse = Assume(false);
69
29.4k
    if (LLVM_UNLIKELY(!StFalse)) { // both infeasible
70
74
      ProgramStateRef StInfeasible = State->cloneAsPosteriorlyOverconstrained();
71
74
      assert(StInfeasible->isPosteriorlyOverconstrained());
72
      // Checkers might rely on the API contract that both returned states
73
      // cannot be null. Thus, we return StInfeasible for both branches because
74
      // it might happen that a Checker uncoditionally uses one of them if the
75
      // other is a nullptr. This may also happen with the non-dual and
76
      // adjacent `assume(true)` and `assume(false)` calls. By implementing
77
      // assume in therms of assumeDual, we can keep our API contract there as
78
      // well.
79
74
      return ProgramStatePair(StInfeasible, StInfeasible);
80
74
    }
81
29.4k
    return ProgramStatePair(nullptr, StFalse);
82
29.4k
  }
83
84
505k
  ProgramStateRef StFalse = Assume(false);
85
505k
  if (!StFalse) {
86
438k
    return ProgramStatePair(StTrue, nullptr);
87
438k
  }
88
89
66.6k
  return ProgramStatePair(StTrue, StFalse);
90
505k
}
ConstraintManager.cpp:std::__1::pair<llvm::IntrusiveRefCntPtr<clang::ento::ProgramState const>, llvm::IntrusiveRefCntPtr<clang::ento::ProgramState const> > clang::ento::ConstraintManager::assumeDualImpl<clang::ento::ConstraintManager::assumeInclusiveRangeDual(llvm::IntrusiveRefCntPtr<clang::ento::ProgramState const>, clang::ento::NonLoc, llvm::APSInt const&, llvm::APSInt const&)::$_0>(llvm::IntrusiveRefCntPtr<clang::ento::ProgramState const>&, clang::ento::ConstraintManager::assumeInclusiveRangeDual(llvm::IntrusiveRefCntPtr<clang::ento::ProgramState const>, clang::ento::NonLoc, llvm::APSInt const&, llvm::APSInt const&)::$_0&)
Line
Count
Source
49
8.30k
                                  AssumeFunction &Assume) {
50
8.30k
  if (LLVM_UNLIKELY(State->isPosteriorlyOverconstrained()))
51
158
    return {State, State};
52
53
  // Assume functions might recurse (see `reAssume` or `tryRearrange`). During
54
  // the recursion the State might not change anymore, that means we reached a
55
  // fixpoint.
56
  // We avoid infinite recursion of assume calls by checking already visited
57
  // States on the stack of assume function calls.
58
8.15k
  const ProgramState *RawSt = State.get();
59
8.15k
  if (LLVM_UNLIKELY(AssumeStack.contains(RawSt)))
60
0
    return {State, State};
61
8.15k
  AssumeStack.push(RawSt);
62
8.15k
  auto AssumeStackBuilder =
63
8.15k
      llvm::make_scope_exit([this]() { AssumeStack.pop(); });
64
65
8.15k
  ProgramStateRef StTrue = Assume(true);
66
67
8.15k
  if (!StTrue) {
68
1.46k
    ProgramStateRef StFalse = Assume(false);
69
1.46k
    if (LLVM_UNLIKELY(!StFalse)) { // both infeasible
70
2
      ProgramStateRef StInfeasible = State->cloneAsPosteriorlyOverconstrained();
71
2
      assert(StInfeasible->isPosteriorlyOverconstrained());
72
      // Checkers might rely on the API contract that both returned states
73
      // cannot be null. Thus, we return StInfeasible for both branches because
74
      // it might happen that a Checker uncoditionally uses one of them if the
75
      // other is a nullptr. This may also happen with the non-dual and
76
      // adjacent `assume(true)` and `assume(false)` calls. By implementing
77
      // assume in therms of assumeDual, we can keep our API contract there as
78
      // well.
79
2
      return ProgramStatePair(StInfeasible, StInfeasible);
80
2
    }
81
1.46k
    return ProgramStatePair(nullptr, StFalse);
82
1.46k
  }
83
84
6.68k
  ProgramStateRef StFalse = Assume(false);
85
6.68k
  if (!StFalse) {
86
4.20k
    return ProgramStatePair(StTrue, nullptr);
87
4.20k
  }
88
89
2.47k
  return ProgramStatePair(StTrue, StFalse);
90
6.68k
}
91
92
ConstraintManager::ProgramStatePair
93
534k
ConstraintManager::assumeDual(ProgramStateRef State, DefinedSVal Cond) {
94
1.06M
  auto AssumeFun = [&, Cond](bool Assumption) {
95
1.06M
    return assumeInternal(State, Cond, Assumption);
96
1.06M
  };
97
534k
  return assumeDualImpl(State, AssumeFun);
98
534k
}
99
100
ConstraintManager::ProgramStatePair
101
ConstraintManager::assumeInclusiveRangeDual(ProgramStateRef State, NonLoc Value,
102
                                            const llvm::APSInt &From,
103
8.30k
                                            const llvm::APSInt &To) {
104
16.3k
  auto AssumeFun = [&](bool Assumption) {
105
16.3k
    return assumeInclusiveRangeInternal(State, Value, From, To, Assumption);
106
16.3k
  };
107
8.30k
  return assumeDualImpl(State, AssumeFun);
108
8.30k
}
109
110
ProgramStateRef ConstraintManager::assume(ProgramStateRef State,
111
31.2k
                                          DefinedSVal Cond, bool Assumption) {
112
31.2k
  ConstraintManager::ProgramStatePair R = assumeDual(State, Cond);
113
31.2k
  return Assumption ? 
R.first17.2k
:
R.second13.9k
;
114
31.2k
}
115
116
ProgramStateRef
117
ConstraintManager::assumeInclusiveRange(ProgramStateRef State, NonLoc Value,
118
                                        const llvm::APSInt &From,
119
7.26k
                                        const llvm::APSInt &To, bool InBound) {
120
7.26k
  ConstraintManager::ProgramStatePair R =
121
7.26k
      assumeInclusiveRangeDual(State, Value, From, To);
122
7.26k
  return InBound ? 
R.first3.97k
:
R.second3.29k
;
123
7.26k
}