Home | History | Annotate | Download | only in PathSensitive 
      1 //== SubEngine.h - Interface of the subengine of CoreEngine --------*- C++ -*-//
      2 //
      3 //                     The LLVM Compiler Infrastructure
      4 //
      5 // This file is distributed under the University of Illinois Open Source
      6 // License. See LICENSE.TXT for details.
      7 //
      8 //===----------------------------------------------------------------------===//
      9 //
     10 // This file defines the interface of a subengine of the CoreEngine.
     11 //
     12 //===----------------------------------------------------------------------===//
     13 #ifndef LLVM_CLANG_GR_SUBENGINE_H
     14 #define LLVM_CLANG_GR_SUBENGINE_H
     15 
     16 #include "clang/Analysis/ProgramPoint.h"
     17 #include "clang/StaticAnalyzer/Core/PathSensitive/SVals.h"
     18 #include "clang/StaticAnalyzer/Core/PathSensitive/Store.h"
     19 
     20 namespace clang {
     21 
     22 class CFGBlock;
     23 class CFGElement;
     24 class LocationContext;
     25 class Stmt;
     26 
     27 namespace ento {
     28 
     29 struct NodeBuilderContext;
     30 class AnalysisManager;
     31 class ExplodedNodeSet;
     32 class ExplodedNode;
     33 class ProgramState;
     34 class ProgramStateManager;
     35 class BlockCounter;
     36 class BranchNodeBuilder;
     37 class IndirectGotoNodeBuilder;
     38 class SwitchNodeBuilder;
     39 class EndOfFunctionNodeBuilder;
     40 class NodeBuilderWithSinks;
     41 class MemRegion;
     42 
     43 class SubEngine {
     44   virtual void anchor();
     45 public:
     46   virtual ~SubEngine() {}
     47 
     48   virtual ProgramStateRef getInitialState(const LocationContext *InitLoc) = 0;
     49 
     50   virtual AnalysisManager &getAnalysisManager() = 0;
     51 
     52   virtual ProgramStateManager &getStateManager() = 0;
     53 
     54   /// Called by CoreEngine. Used to generate new successor
     55   /// nodes by processing the 'effects' of a block-level statement.
     56   virtual void processCFGElement(const CFGElement E, ExplodedNode* Pred,
     57                                  unsigned StmtIdx, NodeBuilderContext *Ctx)=0;
     58 
     59   /// Called by CoreEngine when it starts processing a CFGBlock.  The
     60   /// SubEngine is expected to populate dstNodes with new nodes representing
     61   /// updated analysis state, or generate no nodes at all if it doesn't.
     62   virtual void processCFGBlockEntrance(const BlockEdge &L,
     63                                        NodeBuilderWithSinks &nodeBuilder,
     64                                        ExplodedNode *Pred) = 0;
     65 
     66   /// Called by CoreEngine.  Used to generate successor
     67   ///  nodes by processing the 'effects' of a branch condition.
     68   virtual void processBranch(const Stmt *Condition, const Stmt *Term,
     69                              NodeBuilderContext& BuilderCtx,
     70                              ExplodedNode *Pred,
     71                              ExplodedNodeSet &Dst,
     72                              const CFGBlock *DstT,
     73                              const CFGBlock *DstF) = 0;
     74 
     75   /// Called by CoreEngine.  Used to generate successor
     76   /// nodes by processing the 'effects' of a computed goto jump.
     77   virtual void processIndirectGoto(IndirectGotoNodeBuilder& builder) = 0;
     78 
     79   /// Called by CoreEngine.  Used to generate successor
     80   /// nodes by processing the 'effects' of a switch statement.
     81   virtual void processSwitch(SwitchNodeBuilder& builder) = 0;
     82 
     83   /// Called by CoreEngine.  Used to generate end-of-path
     84   /// nodes when the control reaches the end of a function.
     85   virtual void processEndOfFunction(NodeBuilderContext& BC,
     86                                     ExplodedNode *Pred) = 0;
     87 
     88   // Generate the entry node of the callee.
     89   virtual void processCallEnter(CallEnter CE, ExplodedNode *Pred) = 0;
     90 
     91   // Generate the first post callsite node.
     92   virtual void processCallExit(ExplodedNode *Pred) = 0;
     93 
     94   /// Called by ConstraintManager. Used to call checker-specific
     95   /// logic for handling assumptions on symbolic values.
     96   virtual ProgramStateRef processAssume(ProgramStateRef state,
     97                                        SVal cond, bool assumption) = 0;
     98 
     99   /// wantsRegionChangeUpdate - Called by ProgramStateManager to determine if a
    100   ///  region change should trigger a processRegionChanges update.
    101   virtual bool wantsRegionChangeUpdate(ProgramStateRef state) = 0;
    102 
    103   /// processRegionChanges - Called by ProgramStateManager whenever a change is
    104   /// made to the store. Used to update checkers that track region values.
    105   virtual ProgramStateRef
    106   processRegionChanges(ProgramStateRef state,
    107                        const InvalidatedSymbols *invalidated,
    108                        ArrayRef<const MemRegion *> ExplicitRegions,
    109                        ArrayRef<const MemRegion *> Regions,
    110                        const CallEvent *Call) = 0;
    111 
    112 
    113   inline ProgramStateRef
    114   processRegionChange(ProgramStateRef state,
    115                       const MemRegion* MR) {
    116     return processRegionChanges(state, 0, MR, MR, 0);
    117   }
    118 
    119   virtual ProgramStateRef
    120   processPointerEscapedOnBind(ProgramStateRef State, SVal Loc, SVal Val) = 0;
    121 
    122   virtual ProgramStateRef
    123   processPointerEscapedOnInvalidateRegions(ProgramStateRef State,
    124                            const InvalidatedSymbols *Invalidated,
    125                            ArrayRef<const MemRegion *> ExplicitRegions,
    126                            ArrayRef<const MemRegion *> Regions,
    127                            const CallEvent *Call) = 0;
    128 
    129   /// printState - Called by ProgramStateManager to print checker-specific data.
    130   virtual void printState(raw_ostream &Out, ProgramStateRef State,
    131                           const char *NL, const char *Sep) = 0;
    132 
    133   /// Called by CoreEngine when the analysis worklist is either empty or the
    134   //  maximum number of analysis steps have been reached.
    135   virtual void processEndWorklist(bool hasWorkRemaining) = 0;
    136 };
    137 
    138 } // end GR namespace
    139 
    140 } // end clang namespace
    141 
    142 #endif
    143