#include "clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h"#include "PrettyStackTraceLocationContext.h"#include "clang/AST/CXXInheritance.h"#include "clang/AST/DeclCXX.h"#include "clang/AST/ParentMap.h"#include "clang/Analysis/Analyses/LiveVariables.h"#include "clang/StaticAnalyzer/Core/CheckerManager.h"#include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"#include "llvm/ADT/SmallSet.h"#include "llvm/ADT/Statistic.h"#include "llvm/Support/SaveAndRestore.h"
Go to the source code of this file.
Defines | |
| #define | DEBUG_TYPE "ExprEngine" |
Enumerations | |
| enum | DynamicDispatchMode |
| enum | CallInlinePolicy { CIP_Allowed, CIP_DisallowedOnce, CIP_DisallowedAlways } |
Functions | |
| STATISTIC (NumOfDynamicDispatchPathSplits,"The # of times we split the path due to imprecise dynamic dispatch info") | |
| STATISTIC (NumInlinedCalls,"The # of times we inlined a call") | |
| STATISTIC (NumReachedInlineCountMax,"The # of times we reached inline count maximum") | |
| static std::pair< const Stmt *, const CFGBlock * > | getLastStmt (const ExplodedNode *Node) |
| static SVal | adjustReturnValue (SVal V, QualType ExpectedTy, QualType ActualTy, StoreManager &StoreMgr) |
| static bool | wasDifferentDeclUsedForInlining (CallEventRef<> Call, const StackFrameContext *calleeCtx) |
| static bool | isTemporaryPRValue (const CXXConstructExpr *E, SVal V) |
| static bool | IsInStdNamespace (const FunctionDecl *FD) |
| REGISTER_TRAIT_WITH_PROGRAMSTATE (DynamicDispatchBifurcationMap, CLANG_ENTO_PROGRAMSTATE_MAP(const MemRegion *, unsigned)) bool ExprEngine | |
| static ProgramStateRef | getInlineFailedState (ProgramStateRef State, const Stmt *CallE) |
| static CallInlinePolicy | mayInlineCallKind (const CallEvent &Call, const ExplodedNode *Pred, AnalyzerOptions &Opts) |
| static bool | hasMember (const ASTContext &Ctx, const CXXRecordDecl *RD, StringRef Name) |
| Returns true if the given C++ class contains a member with the given name. | |
| static bool | isContainerClass (const ASTContext &Ctx, const CXXRecordDecl *RD) |
| static bool | isContainerMethod (const ASTContext &Ctx, const FunctionDecl *FD) |
| static bool | isCXXSharedPtrDtor (const FunctionDecl *FD) |
| static bool | mayInlineDecl (AnalysisDeclContext *CalleeADC, AnalyzerOptions &Opts) |
| static bool | isTrivialObjectAssignment (const CallEvent &Call) |
Define Documentation
| #define DEBUG_TYPE "ExprEngine" |
Definition at line 29 of file ExprEngineCallAndReturn.cpp.
Enumeration Type Documentation
| enum CallInlinePolicy |
Definition at line 584 of file ExprEngineCallAndReturn.cpp.
| enum DynamicDispatchMode |
Definition at line 407 of file ExprEngineCallAndReturn.cpp.
Function Documentation
| static SVal adjustReturnValue | ( | SVal | V, |
| QualType | ExpectedTy, | ||
| QualType | ActualTy, | ||
| StoreManager & | StoreMgr | ||
| ) | [static] |
Adjusts a return value when the called function's return type does not match the caller's expression type. This can happen when a dynamic call is devirtualized, and the overridding method has a covariant (more specific) return type than the parent's method. For C++ objects, this means we need to add base casts.
Definition at line 124 of file ExprEngineCallAndReturn.cpp.
References clang::ento::StoreManager::evalDerivedToBase(), clang::ExpectedClass, clang::CXXBasePaths::front(), clang::ento::SVal::getAs(), clang::QualType::getCanonicalType(), clang::Type::getCanonicalTypeUnqualified(), clang::Type::getPointeeCXXRecordDecl(), clang::CXXBasePaths::isAmbiguous(), clang::CXXRecordDecl::isDerivedFrom(), and clang::Type::isObjCObjectPointerType().
Referenced by clang::ento::ExprEngine::processCallExit().
| static ProgramStateRef getInlineFailedState | ( | ProgramStateRef | State, |
| const Stmt * | CallE | ||
| ) | [static] |
Definition at line 470 of file ExprEngineCallAndReturn.cpp.
Referenced by clang::ento::ExprEngine::defaultEvalCall().
| static std::pair<const Stmt*, const CFGBlock*> getLastStmt | ( | const ExplodedNode * | Node | ) | [static] |
Definition at line 71 of file ExprEngineCallAndReturn.cpp.
References clang::ProgramPoint::getAs(), clang::LocationContext::getCurrentStackFrame(), clang::ento::ExplodedNode::getFirstPred(), clang::ento::ExplodedNode::getLocation(), clang::ento::ExplodedNode::getLocationAs(), clang::ProgramPoint::getLocationContext(), clang::ento::ExplodedNode::pred_begin(), clang::ento::ExplodedNode::pred_empty(), and S.
Referenced by clang::ento::ExprEngine::processCallExit(), and clang::ento::ExprEngine::removeDeadOnEndOfFunction().
| static bool hasMember | ( | const ASTContext & | Ctx, |
| const CXXRecordDecl * | RD, | ||
| StringRef | Name | ||
| ) | [static] |
Returns true if the given C++ class contains a member with the given name.
Definition at line 685 of file ExprEngineCallAndReturn.cpp.
References clang::ASTContext::DeclarationNames, clang::CXXRecordDecl::FindOrdinaryMember(), clang::IdentifierTable::get(), clang::DeclarationName::getAsOpaquePtr(), clang::DeclarationNameTable::getIdentifier(), clang::ASTContext::Idents, clang::DeclContext::lookup(), and clang::CXXRecordDecl::lookupInBases().
Referenced by isContainerClass().
| static bool isContainerClass | ( | const ASTContext & | Ctx, |
| const CXXRecordDecl * | RD | ||
| ) | [static] |
Returns true if the given C++ class is a container or iterator.
Our heuristic for this is whether it contains a method named 'begin()' or a nested type named 'iterator' or 'iterator_category'.
Definition at line 705 of file ExprEngineCallAndReturn.cpp.
References hasMember().
Referenced by isContainerMethod().
| static bool isContainerMethod | ( | const ASTContext & | Ctx, |
| const FunctionDecl * | FD | ||
| ) | [static] |
Returns true if the given function refers to a method of a C++ container or iterator.
We generally do a poor job modeling most containers right now, and might prefer not to inline their methods.
Definition at line 716 of file ExprEngineCallAndReturn.cpp.
References isContainerClass().
Referenced by mayInlineDecl().
| static bool isCXXSharedPtrDtor | ( | const FunctionDecl * | FD | ) | [static] |
Returns true if the given function is the destructor of a class named "shared_ptr".
Definition at line 725 of file ExprEngineCallAndReturn.cpp.
References clang::DeclarationName::getAsIdentifierInfo(), clang::NamedDecl::getDeclName(), and clang::CXXMethodDecl::getParent().
Referenced by mayInlineDecl().
| static bool IsInStdNamespace | ( | const FunctionDecl * | FD | ) | [static] |
Definition at line 385 of file ExprEngineCallAndReturn.cpp.
References clang::DeclContext::getEnclosingNamespaceContext(), clang::DeclContext::getParent(), and clang::DeclContext::isStdNamespace().
Referenced by mayInlineDecl().
| static bool isTemporaryPRValue | ( | const CXXConstructExpr * | E, |
| SVal | V | ||
| ) | [static] |
Returns true if the CXXConstructExpr E was intended to construct a prvalue for the region in V.
Note that we can't just test for rvalue vs. glvalue because CXXConstructExprs embedded in DeclStmts and initializers are considered rvalues by the AST, and the analyzer would like to treat them as lvalues.
Definition at line 199 of file ExprEngineCallAndReturn.cpp.
References clang::ento::SVal::getAsRegion(), and clang::Expr::isGLValue().
Referenced by clang::ento::ExprEngine::bindReturnValue(), and clang::ento::ExprEngine::processCallExit().
| static bool isTrivialObjectAssignment | ( | const CallEvent & | Call | ) | [static] |
Definition at line 886 of file ExprEngineCallAndReturn.cpp.
References clang::CXXInstanceCall::getDecl(), clang::CXXMethodDecl::isCopyAssignmentOperator(), clang::CXXMethodDecl::isMoveAssignmentOperator(), and clang::FunctionDecl::isTrivial().
Referenced by clang::ento::ExprEngine::defaultEvalCall().
| static CallInlinePolicy mayInlineCallKind | ( | const CallEvent & | Call, |
| const ExplodedNode * | Pred, | ||
| AnalyzerOptions & | Opts | ||
| ) | [static] |
Definition at line 590 of file ExprEngineCallAndReturn.cpp.
References clang::CFG::BuildOptions::AddImplicitDtors, clang::CFG::BuildOptions::AddInitializers, clang::ento::CE_Block, clang::ento::CE_CXXAllocator, clang::ento::CE_CXXConstructor, clang::ento::CE_CXXDestructor, clang::ento::CE_CXXMember, clang::ento::CE_CXXMemberOperator, clang::ento::CE_Function, clang::ento::CE_ObjCMessage, clang::CIMK_Constructors, clang::CIMK_Destructors, clang::CIMK_MemberFunctions, CIP_Allowed, CIP_DisallowedAlways, CIP_DisallowedOnce, clang::CXXConstructExpr::CK_Complete, clang::LocationContext::getAnalysisDeclContext(), clang::ento::SVal::getAsRegion(), clang::AnalysisDeclContext::getCFGBuildOptions(), clang::CXXConstructExpr::getConstructionKind(), clang::LocationContext::getCurrentStackFrame(), clang::CXXConstructorCall::getCXXThisVal(), clang::CXXConstructorCall::getDecl(), clang::AnalyzerOptions::getIPAMode(), clang::ento::CallEvent::getKind(), clang::ento::ExplodedNode::getLocationContext(), clang::CXXConstructorCall::getOriginExpr(), clang::ParentMap::getParent(), clang::CXXMethodDecl::getParent(), clang::LocationContext::getParentMap(), clang::CXXRecordDecl::hasTrivialDestructor(), clang::IPAK_DynamicDispatch, clang::IPAK_DynamicDispatchBifurcate, clang::AnalyzerOptions::mayInlineCXXAllocator(), clang::AnalyzerOptions::mayInlineCXXMemberFunction(), and clang::AnalyzerOptions::mayInlineObjCMethod().
| static bool mayInlineDecl | ( | AnalysisDeclContext * | CalleeADC, |
| AnalyzerOptions & | Opts | ||
| ) | [static] |
Returns true if the function in CalleeADC may be inlined in general.
This checks static properties of the function, such as its signature and CFG, to determine whether the analyzer should ever consider inlining it, in any context.
Definition at line 743 of file ExprEngineCallAndReturn.cpp.
References clang::AnalysisDeclContext::getAnalysis(), clang::AnalysisDeclContext::getASTContext(), clang::AnalysisDeclContext::getCFG(), clang::AnalysisDeclContext::getDecl(), clang::ASTContext::getLangOpts(), clang::AnalyzerOptions::getMaxInlinableSize(), clang::CFG::getNumBlockIDs(), clang::ASTContext::getSourceManager(), isContainerMethod(), isCXXSharedPtrDtor(), clang::SourceManager::isInMainFile(), IsInStdNamespace(), clang::SourceManager::isInSystemHeader(), clang::ento::CallEvent::isVariadic(), clang::AnalyzerOptions::mayInlineCXXContainerMethods(), clang::AnalyzerOptions::mayInlineCXXSharedPtrDtor(), clang::AnalyzerOptions::mayInlineCXXStandardLibrary(), clang::AnalyzerOptions::mayInlineTemplateFunctions(), and clang::FunctionDecl::TK_NonTemplate.
| REGISTER_TRAIT_WITH_PROGRAMSTATE | ( | DynamicDispatchBifurcationMap | , |
| CLANG_ENTO_PROGRAMSTATE_MAP(const MemRegion *,unsigned) | |||
| ) |
Definition at line 412 of file ExprEngineCallAndReturn.cpp.
References clang::ento::CE_Block, clang::AnalysisDeclContext::getBlockInvocationContext(), clang::LocationContext::getCurrentStackFrame(), and clang::AnalysisDeclContext::getStackFrame().
| STATISTIC | ( | NumOfDynamicDispatchPathSplits | , |
| "The # of times we split the path due to imprecise dynamic dispatch info" | |||
| ) |
| STATISTIC | ( | NumInlinedCalls | , |
| "The # of times we inlined a call" | |||
| ) |
| STATISTIC | ( | NumReachedInlineCountMax | , |
| "The # of times we reached inline count maximum" | |||
| ) |
| static bool wasDifferentDeclUsedForInlining | ( | CallEventRef<> | Call, |
| const StackFrameContext * | calleeCtx | ||
| ) | [static] |
Definition at line 183 of file ExprEngineCallAndReturn.cpp.
References clang::Decl::getCanonicalDecl(), and clang::LocationContext::getDecl().
Referenced by clang::ento::ExprEngine::processCallExit().