Lines Matching full:state
83 const GRState *evalAssume(const GRState *state, SVal Cond,
94 const GRState *state) {
95 return MallocMemAux(C, CE, state->getSVal(SizeEx), Init, state);
99 const GRState *state);
105 const GRState *state, unsigned Num, bool Hold) const;
129 const GRState *state = C.getState();
131 SVal L = state->getSVal(Callee);
196 const GRState *state = MallocMemAux(C, CE, CE->getArg(0), UndefinedVal(),
198 C.addTransition(state);
208 const GRState *state =
210 C.addTransition(state);
213 const GRState *state = MallocMemAux(C, CE, UnknownVal(), UndefinedVal(),
215 C.addTransition(state);
221 const GRState *state) {
227 state = state->BindExpr(CE, retVal);
230 state = state->bindDefault(retVal, Init);
237 svalBuilder.evalEQ(state, Extent, DefinedSize);
239 state = state->assume(extentMatchesSize, true);
240 assert(state);
245 // Set the symbol's state to Allocated.
246 return state->set<RegionState>(Sym, RefState::getAllocateUnchecked(CE));
250 const GRState *state = FreeMemAux(C, CE, C.getState(), 0, false);
252 if (state)
253 C.addTransition(state);
263 const GRState *state = FreeMemAux(C, CE, C.getState(), *I,
265 if (state)
266 C.addTransition(state);
271 const GRState *state, unsigned Num,
274 SVal ArgVal = state->getSVal(ArgExpr);
280 return state;
285 llvm::tie(notNullState, nullState) = state->assume(location);
338 const RefState *RS = state->get<RegionState>(Sym);
494 const GRState *state = C.getState();
497 = cast<DefinedOrUnknownSVal>(state->getSVal(arg0Expr));
502 svalBuilder.evalEQ(state, arg0Val, svalBuilder.makeNull());
511 cast<DefinedOrUnknownSVal>(state->getSVal(Arg1));
515 svalBuilder.evalEQ(state, Arg1Val,
520 const GRState *stateEqual = state->assume(PtrEQ, true);
521 if (stateEqual && state->assume(SizeZero, false)) {
535 if (const GRState *stateNotEqual = state->assume(PtrEQ, false)) {
541 // Add the state transition to set input pointer argument to be free.
559 const GRState *state = C.getState();
562 SVal count = state->getSVal(CE->getArg(0));
563 SVal elementSize = state->getSVal(CE->getArg(1));
564 SVal TotalSize = svalBuilder.evalBinOp(state, BO_Mul, count, elementSize,
568 C.addTransition(MallocMemAux(C, CE, TotalSize, zeroVal, state));
577 const GRState *state = C.getState();
578 RegionStateTy RS = state->get<RegionState>();
579 RegionStateTy::Factory &F = state->get_context<RegionState>();
598 C.generateNode(state->set<RegionState>(RS));
603 const GRState *state = B.getState();
604 RegionStateTy M = state->get<RegionState>();
609 ExplodedNode *N = B.generateNode(state);
626 const GRState *state = C.getState();
628 SymbolRef Sym = state->getSVal(retExpr).getAsSymbol();
632 const RefState *RS = state->get<RegionState>(Sym);
638 state = state->set<RegionState>(Sym, RefState::getEscaped(S));
640 C.addTransition(state);
643 const GRState *MallocChecker::evalAssume(const GRState *state, SVal Cond,
645 // If a symblic region is assumed to NULL, set its state to AllocateFailed.
648 RegionStateTy RS = state->get<RegionState>();
652 if (state->getSymVal(I.getKey()))
653 state = state->set<RegionState>(I.getKey(),RefState::getAllocateFailed());
656 return state;
684 const GRState *state = C.getState();
691 // Before checking if the state is null, check if 'val' has a RefState.
692 // Only then should we check for null and bifurcate the state.
695 if (const RefState *RS = state->get<RegionState>(Sym)) {
698 llvm::tie(notNullState, nullState) = state->assume(l);
701 // that the state was null.
719 // If the state can't represent this binding, we still own it.
