Home | History | Annotate | Download | only in PathSensitive
      1 //===-- ExprEngine.h - Path-Sensitive Expression-Level Dataflow ---*- C++ -*-=//
      2 //
      3 //                     The LLVM Compiler Infrastructure
      4 //
      5 // This file is distributed under the University of Illinois Open Source
      6 // License. See LICENSE.TXT for details.
      7 //
      8 //===----------------------------------------------------------------------===//
      9 //
     10 //  This file defines a meta-engine for path-sensitive dataflow analysis that
     11 //  is built on CoreEngine, but provides the boilerplate to execute transfer
     12 //  functions and build the ExplodedGraph at the expression level.
     13 //
     14 //===----------------------------------------------------------------------===//
     15 
     16 #ifndef LLVM_CLANG_STATICANALYZER_CORE_PATHSENSITIVE_EXPRENGINE_H
     17 #define LLVM_CLANG_STATICANALYZER_CORE_PATHSENSITIVE_EXPRENGINE_H
     18 
     19 #include "clang/AST/Expr.h"
     20 #include "clang/AST/Type.h"
     21 #include "clang/Analysis/DomainSpecific/ObjCNoReturn.h"
     22 #include "clang/StaticAnalyzer/Core/BugReporter/BugReporter.h"
     23 #include "clang/StaticAnalyzer/Core/PathSensitive/AnalysisManager.h"
     24 #include "clang/StaticAnalyzer/Core/PathSensitive/CoreEngine.h"
     25 #include "clang/StaticAnalyzer/Core/PathSensitive/ProgramState.h"
     26 #include "clang/StaticAnalyzer/Core/PathSensitive/ProgramStateTrait.h"
     27 #include "clang/StaticAnalyzer/Core/PathSensitive/SubEngine.h"
     28 
     29 namespace clang {
     30 
     31 class AnalysisDeclContextManager;
     32 class CXXCatchStmt;
     33 class CXXConstructExpr;
     34 class CXXDeleteExpr;
     35 class CXXNewExpr;
     36 class CXXTemporaryObjectExpr;
     37 class CXXThisExpr;
     38 class MaterializeTemporaryExpr;
     39 class ObjCAtSynchronizedStmt;
     40 class ObjCForCollectionStmt;
     41 
     42 namespace ento {
     43 
     44 class AnalysisManager;
     45 class CallEvent;
     46 class CXXConstructorCall;
     47 
     48 class ExprEngine : public SubEngine {
     49 public:
     50   /// The modes of inlining, which override the default analysis-wide settings.
     51   enum InliningModes {
     52     /// Follow the default settings for inlining callees.
     53     Inline_Regular = 0,
     54     /// Do minimal inlining of callees.
     55     Inline_Minimal = 0x1
     56   };
     57 
     58 private:
     59   AnalysisManager &AMgr;
     60 
     61   AnalysisDeclContextManager &AnalysisDeclContexts;
     62 
     63   CoreEngine Engine;
     64 
     65   /// G - the simulation graph.
     66   ExplodedGraph& G;
     67 
     68   /// StateMgr - Object that manages the data for all created states.
     69   ProgramStateManager StateMgr;
     70 
     71   /// SymMgr - Object that manages the symbol information.
     72   SymbolManager& SymMgr;
     73 
     74   /// svalBuilder - SValBuilder object that creates SVals from expressions.
     75   SValBuilder &svalBuilder;
     76 
     77   unsigned int currStmtIdx;
     78   const NodeBuilderContext *currBldrCtx;
     79 
     80   /// Helper object to determine if an Objective-C message expression
     81   /// implicitly never returns.
     82   ObjCNoReturn ObjCNoRet;
     83 
     84   /// Whether or not GC is enabled in this analysis.
     85   bool ObjCGCEnabled;
     86 
     87   /// The BugReporter associated with this engine.  It is important that
     88   ///  this object be placed at the very end of member variables so that its
     89   ///  destructor is called before the rest of the ExprEngine is destroyed.
     90   GRBugReporter BR;
     91 
     92   /// The functions which have been analyzed through inlining. This is owned by
     93   /// AnalysisConsumer. It can be null.
     94   SetOfConstDecls *VisitedCallees;
     95 
     96   /// The flag, which specifies the mode of inlining for the engine.
     97   InliningModes HowToInline;
     98 
     99 public:
    100   ExprEngine(AnalysisManager &mgr, bool gcEnabled,
    101              SetOfConstDecls *VisitedCalleesIn,
    102              FunctionSummariesTy *FS,
    103              InliningModes HowToInlineIn);
    104 
    105   ~ExprEngine() override;
    106 
    107   /// Returns true if there is still simulation state on the worklist.
    108   bool ExecuteWorkList(const LocationContext *L, unsigned Steps = 150000) {
    109     return Engine.ExecuteWorkList(L, Steps, nullptr);
    110   }
    111 
    112   /// Execute the work list with an initial state. Nodes that reaches the exit
    113   /// of the function are added into the Dst set, which represent the exit
    114   /// state of the function call. Returns true if there is still simulation
    115   /// state on the worklist.
    116   bool ExecuteWorkListWithInitialState(const LocationContext *L, unsigned Steps,
    117                                        ProgramStateRef InitState,
    118                                        ExplodedNodeSet &Dst) {
    119     return Engine.ExecuteWorkListWithInitialState(L, Steps, InitState, Dst);
    120   }
    121 
    122   /// getContext - Return the ASTContext associated with this analysis.
    123   ASTContext &getContext() const { return AMgr.getASTContext(); }
    124 
    125   AnalysisManager &getAnalysisManager() override { return AMgr; }
    126 
    127   CheckerManager &getCheckerManager() const {
    128     return *AMgr.getCheckerManager();
    129   }
    130 
    131   SValBuilder &getSValBuilder() { return svalBuilder; }
    132 
    133   BugReporter& getBugReporter() { return BR; }
    134 
    135   const NodeBuilderContext &getBuilderContext() {
    136     assert(currBldrCtx);
    137     return *currBldrCtx;
    138   }
    139 
    140   bool isObjCGCEnabled() { return ObjCGCEnabled; }
    141 
    142   const Stmt *getStmt() const;
    143 
    144   void GenerateAutoTransition(ExplodedNode *N);
    145   void enqueueEndOfPath(ExplodedNodeSet &S);
    146   void GenerateCallExitNode(ExplodedNode *N);
    147 
    148   /// Visualize the ExplodedGraph created by executing the simulation.
    149   void ViewGraph(bool trim = false);
    150 
    151   /// Visualize a trimmed ExplodedGraph that only contains paths to the given
    152   /// nodes.
    153   void ViewGraph(ArrayRef<const ExplodedNode*> Nodes);
    154 
    155   /// getInitialState - Return the initial state used for the root vertex
    156   ///  in the ExplodedGraph.
    157   ProgramStateRef getInitialState(const LocationContext *InitLoc) override;
    158 
    159   ExplodedGraph& getGraph() { return G; }
    160   const ExplodedGraph& getGraph() const { return G; }
    161 
    162   /// \brief Run the analyzer's garbage collection - remove dead symbols and
    163   /// bindings from the state.
    164   ///
    165   /// Checkers can participate in this process with two callbacks:
    166   /// \c checkLiveSymbols and \c checkDeadSymbols. See the CheckerDocumentation
    167   /// class for more information.
    168   ///
    169   /// \param Node The predecessor node, from which the processing should start.
    170   /// \param Out The returned set of output nodes.
    171   /// \param ReferenceStmt The statement which is about to be processed.
    172   ///        Everything needed for this statement should be considered live.
    173   ///        A null statement means that everything in child LocationContexts
    174   ///        is dead.
    175   /// \param LC The location context of the \p ReferenceStmt. A null location
    176   ///        context means that we have reached the end of analysis and that
    177   ///        all statements and local variables should be considered dead.
    178   /// \param DiagnosticStmt Used as a location for any warnings that should
    179   ///        occur while removing the dead (e.g. leaks). By default, the
    180   ///        \p ReferenceStmt is used.
    181   /// \param K Denotes whether this is a pre- or post-statement purge. This
    182   ///        must only be ProgramPoint::PostStmtPurgeDeadSymbolsKind if an
    183   ///        entire location context is being cleared, in which case the
    184   ///        \p ReferenceStmt must either be a ReturnStmt or \c NULL. Otherwise,
    185   ///        it must be ProgramPoint::PreStmtPurgeDeadSymbolsKind (the default)
    186   ///        and \p ReferenceStmt must be valid (non-null).
    187   void removeDead(ExplodedNode *Node, ExplodedNodeSet &Out,
    188             const Stmt *ReferenceStmt, const LocationContext *LC,
    189             const Stmt *DiagnosticStmt = nullptr,
    190             ProgramPoint::Kind K = ProgramPoint::PreStmtPurgeDeadSymbolsKind);
    191 
    192   /// processCFGElement - Called by CoreEngine. Used to generate new successor
    193   ///  nodes by processing the 'effects' of a CFG element.
    194   void processCFGElement(const CFGElement E, ExplodedNode *Pred,
    195                          unsigned StmtIdx, NodeBuilderContext *Ctx) override;
    196 
    197   void ProcessStmt(const CFGStmt S, ExplodedNode *Pred);
    198 
    199   void ProcessInitializer(const CFGInitializer I, ExplodedNode *Pred);
    200 
    201   void ProcessImplicitDtor(const CFGImplicitDtor D, ExplodedNode *Pred);
    202 
    203   void ProcessNewAllocator(const CXXNewExpr *NE, ExplodedNode *Pred);
    204 
    205   void ProcessAutomaticObjDtor(const CFGAutomaticObjDtor D,
    206                                ExplodedNode *Pred, ExplodedNodeSet &Dst);
    207   void ProcessDeleteDtor(const CFGDeleteDtor D,
    208                          ExplodedNode *Pred, ExplodedNodeSet &Dst);
    209   void ProcessBaseDtor(const CFGBaseDtor D,
    210                        ExplodedNode *Pred, ExplodedNodeSet &Dst);
    211   void ProcessMemberDtor(const CFGMemberDtor D,
    212                          ExplodedNode *Pred, ExplodedNodeSet &Dst);
    213   void ProcessTemporaryDtor(const CFGTemporaryDtor D,
    214                             ExplodedNode *Pred, ExplodedNodeSet &Dst);
    215 
    216   /// Called by CoreEngine when processing the entrance of a CFGBlock.
    217   void processCFGBlockEntrance(const BlockEdge &L,
    218                                NodeBuilderWithSinks &nodeBuilder,
    219                                ExplodedNode *Pred) override;
    220 
    221   /// ProcessBranch - Called by CoreEngine.  Used to generate successor
    222   ///  nodes by processing the 'effects' of a branch condition.
    223   void processBranch(const Stmt *Condition, const Stmt *Term,
    224                      NodeBuilderContext& BuilderCtx,
    225                      ExplodedNode *Pred,
    226                      ExplodedNodeSet &Dst,
    227                      const CFGBlock *DstT,
    228                      const CFGBlock *DstF) override;
    229 
    230   /// Called by CoreEngine.
    231   /// Used to generate successor nodes for temporary destructors depending
    232   /// on whether the corresponding constructor was visited.
    233   void processCleanupTemporaryBranch(const CXXBindTemporaryExpr *BTE,
    234                                      NodeBuilderContext &BldCtx,
    235                                      ExplodedNode *Pred, ExplodedNodeSet &Dst,
    236                                      const CFGBlock *DstT,
    237                                      const CFGBlock *DstF) override;
    238 
    239   /// Called by CoreEngine.  Used to processing branching behavior
    240   /// at static initalizers.
    241   void processStaticInitializer(const DeclStmt *DS,
    242                                 NodeBuilderContext& BuilderCtx,
    243                                 ExplodedNode *Pred,
    244                                 ExplodedNodeSet &Dst,
    245                                 const CFGBlock *DstT,
    246                                 const CFGBlock *DstF) override;
    247 
    248   /// processIndirectGoto - Called by CoreEngine.  Used to generate successor
    249   ///  nodes by processing the 'effects' of a computed goto jump.
    250   void processIndirectGoto(IndirectGotoNodeBuilder& builder) override;
    251 
    252   /// ProcessSwitch - Called by CoreEngine.  Used to generate successor
    253   ///  nodes by processing the 'effects' of a switch statement.
    254   void processSwitch(SwitchNodeBuilder& builder) override;
    255 
    256   /// Called by CoreEngine.  Used to generate end-of-path
    257   /// nodes when the control reaches the end of a function.
    258   void processEndOfFunction(NodeBuilderContext& BC,
    259                             ExplodedNode *Pred) override;
    260 
    261   /// Remove dead bindings/symbols before exiting a function.
    262   void removeDeadOnEndOfFunction(NodeBuilderContext& BC,
    263                                  ExplodedNode *Pred,
    264                                  ExplodedNodeSet &Dst);
    265 
    266   /// Generate the entry node of the callee.
    267   void processCallEnter(CallEnter CE, ExplodedNode *Pred) override;
    268 
    269   /// Generate the sequence of nodes that simulate the call exit and the post
    270   /// visit for CallExpr.
    271   void processCallExit(ExplodedNode *Pred) override;
    272 
    273   /// Called by CoreEngine when the analysis worklist has terminated.
    274   void processEndWorklist(bool hasWorkRemaining) override;
    275 
    276   /// evalAssume - Callback function invoked by the ConstraintManager when
    277   ///  making assumptions about state values.
    278   ProgramStateRef processAssume(ProgramStateRef state, SVal cond,
    279                                 bool assumption) override;
    280 
    281   /// wantsRegionChangeUpdate - Called by ProgramStateManager to determine if a
    282   ///  region change should trigger a processRegionChanges update.
    283   bool wantsRegionChangeUpdate(ProgramStateRef state) override;
    284 
    285   /// processRegionChanges - Called by ProgramStateManager whenever a change is made
    286   ///  to the store. Used to update checkers that track region values.
    287   ProgramStateRef
    288   processRegionChanges(ProgramStateRef state,
    289                        const InvalidatedSymbols *invalidated,
    290                        ArrayRef<const MemRegion *> ExplicitRegions,
    291                        ArrayRef<const MemRegion *> Regions,
    292                        const CallEvent *Call) override;
    293 
    294   /// printState - Called by ProgramStateManager to print checker-specific data.
    295   void printState(raw_ostream &Out, ProgramStateRef State,
    296                   const char *NL, const char *Sep) override;
    297 
    298   ProgramStateManager& getStateManager() override { return StateMgr; }
    299 
    300   StoreManager& getStoreManager() { return StateMgr.getStoreManager(); }
    301 
    302   ConstraintManager& getConstraintManager() {
    303     return StateMgr.getConstraintManager();
    304   }
    305 
    306   // FIXME: Remove when we migrate over to just using SValBuilder.
    307   BasicValueFactory& getBasicVals() {
    308     return StateMgr.getBasicVals();
    309   }
    310 
    311   // FIXME: Remove when we migrate over to just using ValueManager.
    312   SymbolManager& getSymbolManager() { return SymMgr; }
    313   const SymbolManager& getSymbolManager() const { return SymMgr; }
    314 
    315   // Functions for external checking of whether we have unfinished work
    316   bool wasBlocksExhausted() const { return Engine.wasBlocksExhausted(); }
    317   bool hasEmptyWorkList() const { return !Engine.getWorkList()->hasWork(); }
    318   bool hasWorkRemaining() const { return Engine.hasWorkRemaining(); }
    319 
    320   const CoreEngine &getCoreEngine() const { return Engine; }
    321 
    322 public:
    323   /// Visit - Transfer function logic for all statements.  Dispatches to
    324   ///  other functions that handle specific kinds of statements.
    325   void Visit(const Stmt *S, ExplodedNode *Pred, ExplodedNodeSet &Dst);
    326 
    327   /// VisitArraySubscriptExpr - Transfer function for array accesses.
    328   void VisitLvalArraySubscriptExpr(const ArraySubscriptExpr *Ex,
    329                                    ExplodedNode *Pred,
    330                                    ExplodedNodeSet &Dst);
    331 
    332   /// VisitGCCAsmStmt - Transfer function logic for inline asm.
    333   void VisitGCCAsmStmt(const GCCAsmStmt *A, ExplodedNode *Pred,
    334                        ExplodedNodeSet &Dst);
    335 
    336   /// VisitMSAsmStmt - Transfer function logic for MS inline asm.
    337   void VisitMSAsmStmt(const MSAsmStmt *A, ExplodedNode *Pred,
    338                       ExplodedNodeSet &Dst);
    339 
    340   /// VisitBlockExpr - Transfer function logic for BlockExprs.
    341   void VisitBlockExpr(const BlockExpr *BE, ExplodedNode *Pred,
    342                       ExplodedNodeSet &Dst);
    343 
    344   /// VisitLambdaExpr - Transfer function logic for LambdaExprs.
    345   void VisitLambdaExpr(const LambdaExpr *LE, ExplodedNode *Pred,
    346                        ExplodedNodeSet &Dst);
    347 
    348   /// VisitBinaryOperator - Transfer function logic for binary operators.
    349   void VisitBinaryOperator(const BinaryOperator* B, ExplodedNode *Pred,
    350                            ExplodedNodeSet &Dst);
    351 
    352 
    353   /// VisitCall - Transfer function for function calls.
    354   void VisitCallExpr(const CallExpr *CE, ExplodedNode *Pred,
    355                      ExplodedNodeSet &Dst);
    356 
    357   /// VisitCast - Transfer function logic for all casts (implicit and explicit).
    358   void VisitCast(const CastExpr *CastE, const Expr *Ex, ExplodedNode *Pred,
    359                 ExplodedNodeSet &Dst);
    360 
    361   /// VisitCompoundLiteralExpr - Transfer function logic for compound literals.
    362   void VisitCompoundLiteralExpr(const CompoundLiteralExpr *CL,
    363                                 ExplodedNode *Pred, ExplodedNodeSet &Dst);
    364 
    365   /// Transfer function logic for DeclRefExprs and BlockDeclRefExprs.
    366   void VisitCommonDeclRefExpr(const Expr *DR, const NamedDecl *D,
    367                               ExplodedNode *Pred, ExplodedNodeSet &Dst);
    368 
    369   /// VisitDeclStmt - Transfer function logic for DeclStmts.
    370   void VisitDeclStmt(const DeclStmt *DS, ExplodedNode *Pred,
    371                      ExplodedNodeSet &Dst);
    372 
    373   /// VisitGuardedExpr - Transfer function logic for ?, __builtin_choose
    374   void VisitGuardedExpr(const Expr *Ex, const Expr *L, const Expr *R,
    375                         ExplodedNode *Pred, ExplodedNodeSet &Dst);
    376 
    377   void VisitInitListExpr(const InitListExpr *E, ExplodedNode *Pred,
    378                          ExplodedNodeSet &Dst);
    379 
    380   /// VisitLogicalExpr - Transfer function logic for '&&', '||'
    381   void VisitLogicalExpr(const BinaryOperator* B, ExplodedNode *Pred,
    382                         ExplodedNodeSet &Dst);
    383 
    384   /// VisitMemberExpr - Transfer function for member expressions.
    385   void VisitMemberExpr(const MemberExpr *M, ExplodedNode *Pred,
    386                            ExplodedNodeSet &Dst);
    387 
    388   /// Transfer function logic for ObjCAtSynchronizedStmts.
    389   void VisitObjCAtSynchronizedStmt(const ObjCAtSynchronizedStmt *S,
    390                                    ExplodedNode *Pred, ExplodedNodeSet &Dst);
    391 
    392   /// Transfer function logic for computing the lvalue of an Objective-C ivar.
    393   void VisitLvalObjCIvarRefExpr(const ObjCIvarRefExpr *DR, ExplodedNode *Pred,
    394                                 ExplodedNodeSet &Dst);
    395 
    396   /// VisitObjCForCollectionStmt - Transfer function logic for
    397   ///  ObjCForCollectionStmt.
    398   void VisitObjCForCollectionStmt(const ObjCForCollectionStmt *S,
    399                                   ExplodedNode *Pred, ExplodedNodeSet &Dst);
    400 
    401   void VisitObjCMessage(const ObjCMessageExpr *ME, ExplodedNode *Pred,
    402                         ExplodedNodeSet &Dst);
    403 
    404   /// VisitReturnStmt - Transfer function logic for return statements.
    405   void VisitReturnStmt(const ReturnStmt *R, ExplodedNode *Pred,
    406                        ExplodedNodeSet &Dst);
    407 
    408   /// VisitOffsetOfExpr - Transfer function for offsetof.
    409   void VisitOffsetOfExpr(const OffsetOfExpr *Ex, ExplodedNode *Pred,
    410                          ExplodedNodeSet &Dst);
    411 
    412   /// VisitUnaryExprOrTypeTraitExpr - Transfer function for sizeof.
    413   void VisitUnaryExprOrTypeTraitExpr(const UnaryExprOrTypeTraitExpr *Ex,
    414                               ExplodedNode *Pred, ExplodedNodeSet &Dst);
    415 
    416   /// VisitUnaryOperator - Transfer function logic for unary operators.
    417   void VisitUnaryOperator(const UnaryOperator* B, ExplodedNode *Pred,
    418                           ExplodedNodeSet &Dst);
    419 
    420   /// Handle ++ and -- (both pre- and post-increment).
    421   void VisitIncrementDecrementOperator(const UnaryOperator* U,
    422                                        ExplodedNode *Pred,
    423                                        ExplodedNodeSet &Dst);
    424 
    425   void VisitCXXBindTemporaryExpr(const CXXBindTemporaryExpr *BTE,
    426                                  ExplodedNodeSet &PreVisit,
    427                                  ExplodedNodeSet &Dst);
    428 
    429   void VisitCXXCatchStmt(const CXXCatchStmt *CS, ExplodedNode *Pred,
    430                          ExplodedNodeSet &Dst);
    431 
    432   void VisitCXXThisExpr(const CXXThisExpr *TE, ExplodedNode *Pred,
    433                         ExplodedNodeSet & Dst);
    434 
    435   void VisitCXXConstructExpr(const CXXConstructExpr *E, ExplodedNode *Pred,
    436                              ExplodedNodeSet &Dst);
    437 
    438   void VisitCXXDestructor(QualType ObjectType, const MemRegion *Dest,
    439                           const Stmt *S, bool IsBaseDtor,
    440                           ExplodedNode *Pred, ExplodedNodeSet &Dst);
    441 
    442   void VisitCXXNewAllocatorCall(const CXXNewExpr *CNE,
    443                                 ExplodedNode *Pred,
    444                                 ExplodedNodeSet &Dst);
    445 
    446   void VisitCXXNewExpr(const CXXNewExpr *CNE, ExplodedNode *Pred,
    447                        ExplodedNodeSet &Dst);
    448 
    449   void VisitCXXDeleteExpr(const CXXDeleteExpr *CDE, ExplodedNode *Pred,
    450                           ExplodedNodeSet &Dst);
    451 
    452   /// Create a C++ temporary object for an rvalue.
    453   void CreateCXXTemporaryObject(const MaterializeTemporaryExpr *ME,
    454                                 ExplodedNode *Pred,
    455                                 ExplodedNodeSet &Dst);
    456 
    457   /// evalEagerlyAssumeBinOpBifurcation - Given the nodes in 'Src', eagerly assume symbolic
    458   ///  expressions of the form 'x != 0' and generate new nodes (stored in Dst)
    459   ///  with those assumptions.
    460   void evalEagerlyAssumeBinOpBifurcation(ExplodedNodeSet &Dst, ExplodedNodeSet &Src,
    461                          const Expr *Ex);
    462 
    463   std::pair<const ProgramPointTag *, const ProgramPointTag*>
    464     geteagerlyAssumeBinOpBifurcationTags();
    465 
    466   SVal evalMinus(SVal X) {
    467     return X.isValid() ? svalBuilder.evalMinus(X.castAs<NonLoc>()) : X;
    468   }
    469 
    470   SVal evalComplement(SVal X) {
    471     return X.isValid() ? svalBuilder.evalComplement(X.castAs<NonLoc>()) : X;
    472   }
    473 
    474 public:
    475 
    476   SVal evalBinOp(ProgramStateRef state, BinaryOperator::Opcode op,
    477                  NonLoc L, NonLoc R, QualType T) {
    478     return svalBuilder.evalBinOpNN(state, op, L, R, T);
    479   }
    480 
    481   SVal evalBinOp(ProgramStateRef state, BinaryOperator::Opcode op,
    482                  NonLoc L, SVal R, QualType T) {
    483     return R.isValid() ? svalBuilder.evalBinOpNN(state, op, L,
    484                                                  R.castAs<NonLoc>(), T) : R;
    485   }
    486 
    487   SVal evalBinOp(ProgramStateRef ST, BinaryOperator::Opcode Op,
    488                  SVal LHS, SVal RHS, QualType T) {
    489     return svalBuilder.evalBinOp(ST, Op, LHS, RHS, T);
    490   }
    491 
    492 protected:
    493   /// evalBind - Handle the semantics of binding a value to a specific location.
    494   ///  This method is used by evalStore, VisitDeclStmt, and others.
    495   void evalBind(ExplodedNodeSet &Dst, const Stmt *StoreE, ExplodedNode *Pred,
    496                 SVal location, SVal Val, bool atDeclInit = false,
    497                 const ProgramPoint *PP = nullptr);
    498 
    499   /// Call PointerEscape callback when a value escapes as a result of bind.
    500   ProgramStateRef processPointerEscapedOnBind(ProgramStateRef State,
    501                                               SVal Loc, SVal Val) override;
    502   /// Call PointerEscape callback when a value escapes as a result of
    503   /// region invalidation.
    504   /// \param[in] ITraits Specifies invalidation traits for regions/symbols.
    505   ProgramStateRef notifyCheckersOfPointerEscape(
    506                            ProgramStateRef State,
    507                            const InvalidatedSymbols *Invalidated,
    508                            ArrayRef<const MemRegion *> ExplicitRegions,
    509                            ArrayRef<const MemRegion *> Regions,
    510                            const CallEvent *Call,
    511                            RegionAndSymbolInvalidationTraits &ITraits) override;
    512 
    513 public:
    514   // FIXME: 'tag' should be removed, and a LocationContext should be used
    515   // instead.
    516   // FIXME: Comment on the meaning of the arguments, when 'St' may not
    517   // be the same as Pred->state, and when 'location' may not be the
    518   // same as state->getLValue(Ex).
    519   /// Simulate a read of the result of Ex.
    520   void evalLoad(ExplodedNodeSet &Dst,
    521                 const Expr *NodeEx,  /* Eventually will be a CFGStmt */
    522                 const Expr *BoundExpr,
    523                 ExplodedNode *Pred,
    524                 ProgramStateRef St,
    525                 SVal location,
    526                 const ProgramPointTag *tag = nullptr,
    527                 QualType LoadTy = QualType());
    528 
    529   // FIXME: 'tag' should be removed, and a LocationContext should be used
    530   // instead.
    531   void evalStore(ExplodedNodeSet &Dst, const Expr *AssignE, const Expr *StoreE,
    532                  ExplodedNode *Pred, ProgramStateRef St, SVal TargetLV, SVal Val,
    533                  const ProgramPointTag *tag = nullptr);
    534 
    535   /// \brief Create a new state in which the call return value is binded to the
    536   /// call origin expression.
    537   ProgramStateRef bindReturnValue(const CallEvent &Call,
    538                                   const LocationContext *LCtx,
    539                                   ProgramStateRef State);
    540 
    541   /// Evaluate a call, running pre- and post-call checks and allowing checkers
    542   /// to be responsible for handling the evaluation of the call itself.
    543   void evalCall(ExplodedNodeSet &Dst, ExplodedNode *Pred,
    544                 const CallEvent &Call);
    545 
    546   /// \brief Default implementation of call evaluation.
    547   void defaultEvalCall(NodeBuilder &B, ExplodedNode *Pred,
    548                        const CallEvent &Call);
    549 private:
    550   void evalLoadCommon(ExplodedNodeSet &Dst,
    551                       const Expr *NodeEx,  /* Eventually will be a CFGStmt */
    552                       const Expr *BoundEx,
    553                       ExplodedNode *Pred,
    554                       ProgramStateRef St,
    555                       SVal location,
    556                       const ProgramPointTag *tag,
    557                       QualType LoadTy);
    558 
    559   // FIXME: 'tag' should be removed, and a LocationContext should be used
    560   // instead.
    561   void evalLocation(ExplodedNodeSet &Dst,
    562                     const Stmt *NodeEx, /* This will eventually be a CFGStmt */
    563                     const Stmt *BoundEx,
    564                     ExplodedNode *Pred,
    565                     ProgramStateRef St, SVal location,
    566                     const ProgramPointTag *tag, bool isLoad);
    567 
    568   /// Count the stack depth and determine if the call is recursive.
    569   void examineStackFrames(const Decl *D, const LocationContext *LCtx,
    570                           bool &IsRecursive, unsigned &StackDepth);
    571 
    572   /// Checks our policies and decides weither the given call should be inlined.
    573   bool shouldInlineCall(const CallEvent &Call, const Decl *D,
    574                         const ExplodedNode *Pred);
    575 
    576   bool inlineCall(const CallEvent &Call, const Decl *D, NodeBuilder &Bldr,
    577                   ExplodedNode *Pred, ProgramStateRef State);
    578 
    579   /// \brief Conservatively evaluate call by invalidating regions and binding
    580   /// a conjured return value.
    581   void conservativeEvalCall(const CallEvent &Call, NodeBuilder &Bldr,
    582                             ExplodedNode *Pred, ProgramStateRef State);
    583 
    584   /// \brief Either inline or process the call conservatively (or both), based
    585   /// on DynamicDispatchBifurcation data.
    586   void BifurcateCall(const MemRegion *BifurReg,
    587                      const CallEvent &Call, const Decl *D, NodeBuilder &Bldr,
    588                      ExplodedNode *Pred);
    589 
    590   bool replayWithoutInlining(ExplodedNode *P, const LocationContext *CalleeLC);
    591 
    592   /// Models a trivial copy or move constructor or trivial assignment operator
    593   /// call with a simple bind.
    594   void performTrivialCopy(NodeBuilder &Bldr, ExplodedNode *Pred,
    595                           const CallEvent &Call);
    596 
    597   /// If the value of the given expression is a NonLoc, copy it into a new
    598   /// temporary object region, and replace the value of the expression with
    599   /// that.
    600   ///
    601   /// If \p ResultE is provided, the new region will be bound to this expression
    602   /// instead of \p E.
    603   ProgramStateRef createTemporaryRegionIfNeeded(ProgramStateRef State,
    604                                                 const LocationContext *LC,
    605                                                 const Expr *E,
    606                                                 const Expr *ResultE = nullptr);
    607 
    608   /// For a DeclStmt or CXXInitCtorInitializer, walk backward in the current CFG
    609   /// block to find the constructor expression that directly constructed into
    610   /// the storage for this statement. Returns null if the constructor for this
    611   /// statement created a temporary object region rather than directly
    612   /// constructing into an existing region.
    613   const CXXConstructExpr *findDirectConstructorForCurrentCFGElement();
    614 
    615   /// For a CXXConstructExpr, walk forward in the current CFG block to find the
    616   /// CFGElement for the DeclStmt or CXXInitCtorInitializer for which is
    617   /// directly constructed by this constructor. Returns None if the current
    618   /// constructor expression did not directly construct into an existing
    619   /// region.
    620   Optional<CFGElement> findElementDirectlyInitializedByCurrentConstructor();
    621 
    622   /// For a given constructor, look forward in the current CFG block to
    623   /// determine the region into which an object will be constructed by \p CE.
    624   /// Returns either a field or local variable region if the object will be
    625   /// directly constructed in an existing region or a temporary object region
    626   /// if not.
    627   const MemRegion *getRegionForConstructedObject(const CXXConstructExpr *CE,
    628                                                  ExplodedNode *Pred);
    629 };
    630 
    631 /// Traits for storing the call processing policy inside GDM.
    632 /// The GDM stores the corresponding CallExpr pointer.
    633 // FIXME: This does not use the nice trait macros because it must be accessible
    634 // from multiple translation units.
    635 struct ReplayWithoutInlining{};
    636 template <>
    637 struct ProgramStateTrait<ReplayWithoutInlining> :
    638   public ProgramStatePartialTrait<const void*> {
    639   static void *GDMIndex() { static int index = 0; return &index; }
    640 };
    641 
    642 } // end ento namespace
    643 
    644 } // end clang namespace
    645 
    646 #endif
    647