aboutsummaryrefslogtreecommitdiff
path: root/include/clang/Analysis/PathSensitive/GRState.h
AgeCommit message (Collapse)Author
2009-05-07Bug fix: Not all ConstraintManagers always return a null state when settingTed Kremenek
isFeasible to false. This is something we may wish to do further validation on. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@71134 91177308-0d34-0410-b5e6-96231b3b80d8
2009-05-04Per conversations with Zhongxing, add an 'element type' toTed Kremenek
ElementRegion. I also removed 'ElementRegion::getArrayRegion', although we may need to add this back. This breaks a few test cases with RegionStore: - 'array-struct.c' triggers an infinite recursion in RegionStoreManager. Need to investigate. - misc-ps.m triggers a failure with RegionStoreManager as we now get the diagnostic: 'Line 159: Uninitialized or undefined return value returned to caller.' There were a bunch of places that needed to be edit RegionStoreManager, and we may not be passing all the correct 'element types' down from GRExprEngine. Zhongxing: When you get a chance, could you review this? I could have easily screwed up something basic in RegionStoreManager. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@70830 91177308-0d34-0410-b5e6-96231b3b80d8
2009-04-09- Move ownership of MemRegionManager into ValueManager.Ted Kremenek
- Pull SVal::GetConjuredSymbol() and friends into ValueManager. This greatly simplifies the calling interface to clients. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@68731 91177308-0d34-0410-b5e6-96231b3b80d8
2009-04-09analyzer: Introduce a new class, ValueManager, that serves as an aggregateTed Kremenek
"manager of symbolic values", wrapping BasicValueFactory, SymbolManager, and MemRegionManager. While these individual managers nicely separate functionality in the analyzer, constructing symbolic values can sometimes be cumbersome because it requires using multiple managers at once. The goal of this class is to create some factory methods to create SVals that require the use of these different managers, thus (hopefully) simplifying the analyzer API for clients. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@68709 91177308-0d34-0410-b5e6-96231b3b80d8
2009-03-30Implement a FIXME.Zhongxing Xu
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@68024 91177308-0d34-0410-b5e6-96231b3b80d8
2009-03-26analyzer infrastructure: make a bunch of changes to symbolic expressions thatTed Kremenek
Zhongxing and I discussed by email. Main changes: - Removed SymIntConstraintVal and SymIntConstraint - Added SymExpr as a parent class to SymbolData, SymSymExpr, SymIntExpr - Added nonloc::SymExprVal to wrap SymExpr - SymbolRef is now just a typedef of 'const SymbolData*' - Bunch of minor code cleanups in how some methods were invoked (no functionality change) This changes are part of a long-term plan to have full symbolic expression trees. This will be useful for lazily evaluating complicated expressions. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@67731 91177308-0d34-0410-b5e6-96231b3b80d8
2009-03-11Add accessor method to return a GRStateManager's internal ConstraintManager.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@66625 91177308-0d34-0410-b5e6-96231b3b80d8
2009-03-04Added the notion of a "boundable region", which is a region that can have a ↵Ted Kremenek
direct binding in the StoreManager. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@66005 91177308-0d34-0410-b5e6-96231b3b80d8
2009-03-04Add "GetSValAsScalarOrLoc" methods to GRState/GRStateRef that only perform aTed Kremenek
retrieval from the store/environment for locations or scalar types. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@65982 91177308-0d34-0410-b5e6-96231b3b80d8
2009-03-03Implement FIXME: GRStateManager::scanReachableSymbols now supports scanning ↵Ted Kremenek
MemRegions. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@65919 91177308-0d34-0410-b5e6-96231b3b80d8
2009-02-16Add getSymbolManager() and getBasicVals() accessors to GRStateRef.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@64675 91177308-0d34-0410-b5e6-96231b3b80d8
2009-02-14Added GRStateManager::scanReachableSymbols(), a method which scans the reachableTed Kremenek
symbols from an SVal. - Fixed a bug in EnvironmentManager::RemoveDeadBindings() where it did not mark live all the symbols reachable from a live block-level expression. - Fixed a bug in the retain/release checker where it did not stop tracking symbols that 'escaped' via compound literals being assigned to something the BasicStoreManager didn't reason about. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@64534 91177308-0d34-0410-b5e6-96231b3b80d8
2009-01-28Remove method 'AddNE' from the public interface of ConstraintManager.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@63249 91177308-0d34-0410-b5e6-96231b3b80d8
2009-01-28Add some comments to GRStateManager. No functionality change.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@63243 91177308-0d34-0410-b5e6-96231b3b80d8
2009-01-22Static analyzer: Remove a bunch of outdated SymbolData objects andTed Kremenek
their associated APIs. We no longer need separate SymbolData objects for fields, variables, etc. Instead, we now associated symbols with the "rvalue" of a MemRegion (i.e., the value stored at that region). Now we only have two kinds of SymbolData objects: SymbolRegionRValue and SymbolConjured. This cleanup also makes the distinction between a SymbolicRegion and a symbolic value that is a location much clearer. A SymbolicRegion represents a chunk of symbolic memory, while a symbolic location is just a "pointer" with different possible values. Without any specific knowledge, a symbolic location resolves (i.e., via a dereference) to a SymbolicRegion. In the future, when we do better alias reasoning, a symbolic location can become an alias for another location, thus merging the constraints on the referred SymbolicRegion with the other region. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@62769 91177308-0d34-0410-b5e6-96231b3b80d8
2009-01-21Static Analyzer: Replace LiveSymbols/DeadSymbols sets with a new object ↵Ted Kremenek
called "SymbolReaper". Right now it just consolidates the two and cleans up some client code, but shortly it will be used to enable "lazy computation" of live symbols for use with RegionStore. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@62722 91177308-0d34-0410-b5e6-96231b3b80d8
2009-01-07Update some doxygen comments to be more rich. Remove ↵Ted Kremenek
StoreManager::GetRegionSVal. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@61894 91177308-0d34-0410-b5e6-96231b3b80d8
2008-12-20Lazy bingding for region-store manager.Zhongxing Xu
* Now Bind() methods take and return GRState* because binding could also alter GDM. * No variables are initialized except those declared with initial values. * failed C test cases are due to bugs in RemoveDeadBindings(), which removes constraints that is still alive. This will be fixed in later patch. * default value of array and struct regions will be implemented in later patch. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@61274 91177308-0d34-0410-b5e6-96231b3b80d8
2008-12-17CF-retain/release checker:Ted Kremenek
- Fix regression reported in <rdar://problem/6452745>. After a null check, null references to resources should not have a retain count. This regression was caused by removing the call to "GRTransferFuncs::EvalAssume" in BasicConstraintManager. - Added a test case to test this behavior. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@61155 91177308-0d34-0410-b5e6-96231b3b80d8
2008-12-05Rename SymbolID to SymbolRef. This is a precursor to some overhauling of ↵Ted Kremenek
the representation of symbolic values. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@60575 91177308-0d34-0410-b5e6-96231b3b80d8
2008-12-05StoreManager::Retrieve and StoreManager::RemoveDeadBindings now take a ↵Ted Kremenek
GRState* argument instead of a Store. This allows them to use the GDM for storing other data. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@60570 91177308-0d34-0410-b5e6-96231b3b80d8
2008-12-03Added GDM query functions "contains" for the data types that support the ↵Ted Kremenek
"Contains" method. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@60505 91177308-0d34-0410-b5e6-96231b3b80d8
2008-11-28Enable the GRStateManager to do something when we finish a path. For example, Zhongxing Xu
the ConstraintManager can print its internal state before its solver instance is destroyed. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@60204 91177308-0d34-0410-b5e6-96231b3b80d8
2008-11-27Add support for pluggable components of static analyzer.Zhongxing Xu
- Creator function pointers are saved in ManagerRegistry. - The Register* class is used to notify ManagerRegistry new module is available. - AnalysisManager queries ManagerRegistry for configurable module. Then it passes them to GRExprEngine, in turn to GRStateManager. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@60143 91177308-0d34-0410-b5e6-96231b3b80d8
2008-11-22Initial support for checking out of bound memory access. Only support Zhongxing Xu
ConcreteInt index for now. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@59869 91177308-0d34-0410-b5e6-96231b3b80d8
2008-11-12GRStateRef:Ted Kremenek
- Rename SetSVal to BindLoc - Add BindDecl - Add BindExpr GRState: - Environment now binds to Stmt* instead of Expr*. This is needed for processing ObjCForCollectionStmt (essentially the declaration of the the 'element' variable can have an SVal attached to it). - BindDecl no longer accepts Expr* for the initialization value; use SVal* instead. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@59152 91177308-0d34-0410-b5e6-96231b3b80d8
2008-11-07Add simple get method.Zhongxing Xu
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@58848 91177308-0d34-0410-b5e6-96231b3b80d8
2008-11-07Finish the implementation of VisitCompoundLiteralExpr. As VisitInitListExpr is Zhongxing Xu
available, things get much simplified. One addition is that CompoundLiteralExpr can appear both in rvalue and lvalue context. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@58837 91177308-0d34-0410-b5e6-96231b3b80d8
2008-10-30Update #includes since SVals.h no longer includes BasicValueFactory.h.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@58439 91177308-0d34-0410-b5e6-96231b3b80d8
2008-10-30Rename:Zhongxing Xu
- SetSVal(GRState*, Loc, SVal) => BindLoc - SetSVal(GRState*, Expr*, SVal) => BindExpr git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@58421 91177308-0d34-0410-b5e6-96231b3b80d8
2008-10-29Rename: AddDecl => BindDeclZhongxing Xu
BindDecl better describes what the function does: - Bind the VarDecl to its memory region - Bind the memory region to some initial value. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@58359 91177308-0d34-0410-b5e6-96231b3b80d8
2008-10-27Added preliminary support for CompoundLiterals in the static analyzer:Ted Kremenek
- GRExprEngine::VisitCompoundLiteral... (1) visits the initializer list (generating ExplodedNodes) (2) creates a CompoundMemRegion for the literal (3) creates a new state with the bound literal values using GRStateManager::BindCompoundLiteral - GRStateManager::BindCompoundLiteral simply calls StoreManager::BindCompoundLiteral to get a new store and returns a persistent GRState with that store. - BasicStore::BindCompoundLiteral simply returns the same store, as it doesn't handle field sensitivity - RegionStore::BindCompoundLiteral currently fires an assert (pending discussion of how to best implement mappings for CompoundLiteralRegion). git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@58277 91177308-0d34-0410-b5e6-96231b3b80d8
2008-10-25Add code for get the lvalue for string literals. Now we return a StringRegionZhongxing Xu
for StringLiteral lvalue evaluation, instead of directly returning a loc::StringLiteralVal by the Environment. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@58138 91177308-0d34-0410-b5e6-96231b3b80d8
2008-10-24Added method "getSelfRegion" to Store. This method returns the region ↵Ted Kremenek
associated with the "this" or "self" object (C++ and Objective-C respectively). git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@58107 91177308-0d34-0410-b5e6-96231b3b80d8
2008-10-23Let StoreManager do different cast on arrays. BasicStore will just keep it ↵Zhongxing Xu
intact. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@58028 91177308-0d34-0410-b5e6-96231b3b80d8
2008-10-22Adjust parameter order to more natural one.Zhongxing Xu
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@57964 91177308-0d34-0410-b5e6-96231b3b80d8
2008-10-21Modify Store interface: GetSVal/SetSVal => Retrieve/Bind.Zhongxing Xu
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@57896 91177308-0d34-0410-b5e6-96231b3b80d8
2008-10-21Rename:Zhongxing Xu
RValues.h/cpp => SVals.h/cpp git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@57893 91177308-0d34-0410-b5e6-96231b3b80d8
2008-10-17- constify some uses of MemRegion* (MemRegion should be immutable).Ted Kremenek
- Added new region "SymbolicRegion", which maps symbol values to the region domain. - Enhanced BasicStore::getFieldLValue() to return a FieldRegion (using SymbolicRegion) - Added some utility methods to GRState for fetch svals from the store. - Fixed regression in CheckNSError (we weren't getting the value bound to the parameter) git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@57717 91177308-0d34-0410-b5e6-96231b3b80d8
2008-10-17This patch did the following renaming. There should be no functional changes.Zhongxing Xu
RVal => SVal LVal => Loc NonLVal => NonLoc lval => loc nonlval => nonloc git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@57671 91177308-0d34-0410-b5e6-96231b3b80d8
2008-10-17Remove lval::FieldOffset, lval::ArrayOffset. These will be replaced with ↵Ted Kremenek
regions. Remove GRExprEngine::getLVal and RValues::MakeVal. Enhance StoreManager "GetLValue" methods to dispatch for specific kinds of lvalue queries, as opposed to interogating the expression tree (GRExprEngine already does this). Added FIXMEs. In particular, we no longer "assume" that a base pointer in a field/array access is null (this logic was removed). Perhaps we should do this when fetching the lvalue for fields and array elements? git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@57657 91177308-0d34-0410-b5e6-96231b3b80d8
2008-10-17Add transfer function support for ObjCIvarRefExpr.Ted Kremenek
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@57654 91177308-0d34-0410-b5e6-96231b3b80d8
2008-10-16This is the first step to build a better evaluation model for GRExprEngine. AZhongxing Xu
new VisitLValue method is added to replace the old VisitLVal. The semantics model becomes more explicit to separate rvalue evaluation from lvalue evaluation. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@57627 91177308-0d34-0410-b5e6-96231b3b80d8
2008-10-07Migrate MemRegionManager from StateManager to StoreManager.Zhongxing Xu
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@57225 91177308-0d34-0410-b5e6-96231b3b80d8
2008-10-04This is a big patch, but the functionality change is small and the rest of ↵Ted Kremenek
the patch consists of deltas due to API changes. This patch overhauls the "memory region" abstraction that was prototyped (but never really used) as part of the Store.h. This patch adds MemRegion.h and MemRegion.cpp, which defines the class MemRegion and its subclasses. This classes serve to define an abstract representation of memory, with regions being layered on other regions to to capture the relationships between fields and variables, variables and the address space they are allocated in, and so on. The main motivation of this patch is that key parts of the analyzer assumed that all value bindings were to VarDecls. In the future this won't be the case, and this patch removes lval::DeclVal and replaces it with lval::MemRegionVal. Now all pieces of the analyzer must reason about abstract memory blocks instead of just variables. There should be no functionality change from this patch, but it opens the door for significant improvements to the analyzer such as field-sensitivity and object-sensitivity, both which were on hold until the memory abstraction got generalized. The memory region abstraction also allows type-information to literally be affixed to a memory region. This will allow the some now redundant logic to be removed from the retain/release checker. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@57042 91177308-0d34-0410-b5e6-96231b3b80d8
2008-09-18Implement second part of PR 2600: NSError** parameter may be null, and ↵Ted Kremenek
should be checked before being dereferenced. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@56318 91177308-0d34-0410-b5e6-96231b3b80d8
2008-08-29Migrate the rest symbolic analysis stuff to BasicConstraintManager.Zhongxing Xu
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@55536 91177308-0d34-0410-b5e6-96231b3b80d8
2008-08-29Added "getBindings" and "BindingAsString" to GRStateManager and StoreManager.Ted Kremenek
Migrated CFRefCount.cpp to use getBindings and BindingsAsString instead of making assumptions about the Store (removed dependence on GRState::vb_iterator). git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@55522 91177308-0d34-0410-b5e6-96231b3b80d8
2008-08-28Make store "Regions" and "Bindings" more abstract instead of concrete variants.Ted Kremenek
Their precise semantics will be implemented by a specific StoreManager. Use function pointer to create the StoreManager in GRStateManager. This matches how we create ConstraintsManager. git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@55514 91177308-0d34-0410-b5e6-96231b3b80d8
2008-08-27Refactor Assume logic into a separate class ConstraintManager.Zhongxing Xu
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@55412 91177308-0d34-0410-b5e6-96231b3b80d8
generated by cgit v1.2.3-18-g5258 (git 2.32.0) at 2025-05-02 04:26:57 +0000