1 // SimpleSValuator.cpp - A basic SValuator ------------------------*- C++ -*--//
3 // The LLVM Compiler Infrastructure
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
8 //===----------------------------------------------------------------------===//
10 // This file defines SimpleSValuator, a basic implementation of SValuator.
12 //===----------------------------------------------------------------------===//
14 #include "clang/Checker/PathSensitive/SValuator.h"
15 #include "clang/Checker/PathSensitive/GRState.h"
17 using namespace clang
;
20 class SimpleSValuator
: public SValuator
{
22 virtual SVal
EvalCastNL(NonLoc val
, QualType castTy
);
23 virtual SVal
EvalCastL(Loc val
, QualType castTy
);
26 SimpleSValuator(ValueManager
&valMgr
) : SValuator(valMgr
) {}
27 virtual ~SimpleSValuator() {}
29 virtual SVal
EvalMinus(NonLoc val
);
30 virtual SVal
EvalComplement(NonLoc val
);
31 virtual SVal
EvalBinOpNN(const GRState
*state
, BinaryOperator::Opcode op
,
32 NonLoc lhs
, NonLoc rhs
, QualType resultTy
);
33 virtual SVal
EvalBinOpLL(const GRState
*state
, BinaryOperator::Opcode op
,
34 Loc lhs
, Loc rhs
, QualType resultTy
);
35 virtual SVal
EvalBinOpLN(const GRState
*state
, BinaryOperator::Opcode op
,
36 Loc lhs
, NonLoc rhs
, QualType resultTy
);
38 /// getKnownValue - Evaluates a given SVal. If the SVal has only one possible
39 /// (integer) value, that value is returned. Otherwise, returns NULL.
40 virtual const llvm::APSInt
*getKnownValue(const GRState
*state
, SVal V
);
42 SVal
MakeSymIntVal(const SymExpr
*LHS
, BinaryOperator::Opcode op
,
43 const llvm::APSInt
&RHS
, QualType resultTy
);
45 } // end anonymous namespace
47 SValuator
*clang::CreateSimpleSValuator(ValueManager
&valMgr
) {
48 return new SimpleSValuator(valMgr
);
51 //===----------------------------------------------------------------------===//
52 // Transfer function for Casts.
53 //===----------------------------------------------------------------------===//
55 SVal
SimpleSValuator::EvalCastNL(NonLoc val
, QualType castTy
) {
57 bool isLocType
= Loc::IsLocType(castTy
);
59 if (nonloc::LocAsInteger
*LI
= dyn_cast
<nonloc::LocAsInteger
>(&val
)) {
63 // FIXME: Correctly support promotions/truncations.
64 ASTContext
&Ctx
= ValMgr
.getContext();
65 unsigned castSize
= Ctx
.getTypeSize(castTy
);
66 if (castSize
== LI
->getNumBits())
69 return ValMgr
.makeLocAsInteger(LI
->getLoc(), castSize
);
72 if (const SymExpr
*se
= val
.getAsSymbolicExpression()) {
73 ASTContext
&Ctx
= ValMgr
.getContext();
74 QualType T
= Ctx
.getCanonicalType(se
->getType(Ctx
));
75 if (T
== Ctx
.getCanonicalType(castTy
))
78 // FIXME: Remove this hack when we support symbolic truncation/extension.
79 // HACK: If both castTy and T are integers, ignore the cast. This is
80 // not a permanent solution. Eventually we want to precisely handle
81 // extension/truncation of symbolic integers. This prevents us from losing
82 // precision when we assign 'x = y' and 'y' is symbolic and x and y are
83 // different integer types.
84 if (T
->isIntegerType() && castTy
->isIntegerType())
90 if (!isa
<nonloc::ConcreteInt
>(val
))
93 // Only handle casts from integers to integers.
94 if (!isLocType
&& !castTy
->isIntegerType())
97 llvm::APSInt i
= cast
<nonloc::ConcreteInt
>(val
).getValue();
98 i
.setIsUnsigned(castTy
->isUnsignedIntegerType() || Loc::IsLocType(castTy
));
99 i
.extOrTrunc(ValMgr
.getContext().getTypeSize(castTy
));
102 return ValMgr
.makeIntLocVal(i
);
104 return ValMgr
.makeIntVal(i
);
107 SVal
SimpleSValuator::EvalCastL(Loc val
, QualType castTy
) {
109 // Casts from pointers -> pointers, just return the lval.
111 // Casts from pointers -> references, just return the lval. These
112 // can be introduced by the frontend for corner cases, e.g
113 // casting from va_list* to __builtin_va_list&.
115 if (Loc::IsLocType(castTy
) || castTy
->isReferenceType())
118 // FIXME: Handle transparent unions where a value can be "transparently"
119 // lifted into a union type.
120 if (castTy
->isUnionType())
123 if (castTy
->isIntegerType()) {
124 unsigned BitWidth
= ValMgr
.getContext().getTypeSize(castTy
);
126 if (!isa
<loc::ConcreteInt
>(val
))
127 return ValMgr
.makeLocAsInteger(val
, BitWidth
);
129 llvm::APSInt i
= cast
<loc::ConcreteInt
>(val
).getValue();
130 i
.setIsUnsigned(castTy
->isUnsignedIntegerType() || Loc::IsLocType(castTy
));
131 i
.extOrTrunc(BitWidth
);
132 return ValMgr
.makeIntVal(i
);
135 // All other cases: return 'UnknownVal'. This includes casting pointers
136 // to floats, which is probably badness it itself, but this is a good
137 // intermediate solution until we do something better.
141 //===----------------------------------------------------------------------===//
142 // Transfer function for unary operators.
143 //===----------------------------------------------------------------------===//
145 SVal
SimpleSValuator::EvalMinus(NonLoc val
) {
146 switch (val
.getSubKind()) {
147 case nonloc::ConcreteIntKind
:
148 return cast
<nonloc::ConcreteInt
>(val
).evalMinus(ValMgr
);
154 SVal
SimpleSValuator::EvalComplement(NonLoc X
) {
155 switch (X
.getSubKind()) {
156 case nonloc::ConcreteIntKind
:
157 return cast
<nonloc::ConcreteInt
>(X
).evalComplement(ValMgr
);
163 //===----------------------------------------------------------------------===//
164 // Transfer function for binary operators.
165 //===----------------------------------------------------------------------===//
167 static BinaryOperator::Opcode
NegateComparison(BinaryOperator::Opcode op
) {
170 assert(false && "Invalid opcode.");
171 case BO_LT
: return BO_GE
;
172 case BO_GT
: return BO_LE
;
173 case BO_LE
: return BO_GT
;
174 case BO_GE
: return BO_LT
;
175 case BO_EQ
: return BO_NE
;
176 case BO_NE
: return BO_EQ
;
180 static BinaryOperator::Opcode
ReverseComparison(BinaryOperator::Opcode op
) {
183 assert(false && "Invalid opcode.");
184 case BO_LT
: return BO_GT
;
185 case BO_GT
: return BO_LT
;
186 case BO_LE
: return BO_GE
;
187 case BO_GE
: return BO_LE
;
194 SVal
SimpleSValuator::MakeSymIntVal(const SymExpr
*LHS
,
195 BinaryOperator::Opcode op
,
196 const llvm::APSInt
&RHS
,
198 bool isIdempotent
= false;
200 // Check for a few special cases with known reductions first.
203 // We can't reduce this case; just treat it normally.
208 return ValMgr
.makeIntVal(0, resultTy
);
215 // This is also handled elsewhere.
216 return UndefinedVal();
223 // This is also handled elsewhere.
224 return UndefinedVal();
226 return ValMgr
.makeIntVal(0, resultTy
);
233 // a+0, a-0, a<<0, a>>0, a^0
240 return ValMgr
.makeIntVal(0, resultTy
);
241 else if (RHS
.isAllOnesValue())
248 else if (RHS
.isAllOnesValue()) {
249 BasicValueFactory
&BVF
= ValMgr
.getBasicValueFactory();
250 const llvm::APSInt
&Result
= BVF
.Convert(resultTy
, RHS
);
251 return nonloc::ConcreteInt(Result
);
256 // Idempotent ops (like a*1) can still change the type of an expression.
257 // Wrap the LHS up in a NonLoc again and let EvalCastNL do the dirty work.
259 if (SymbolRef LHSSym
= dyn_cast
<SymbolData
>(LHS
))
260 return EvalCastNL(nonloc::SymbolVal(LHSSym
), resultTy
);
261 return EvalCastNL(nonloc::SymExprVal(LHS
), resultTy
);
264 // If we reach this point, the expression cannot be simplified.
265 // Make a SymExprVal for the entire thing.
266 return ValMgr
.makeNonLoc(LHS
, op
, RHS
, resultTy
);
269 SVal
SimpleSValuator::EvalBinOpNN(const GRState
*state
,
270 BinaryOperator::Opcode op
,
271 NonLoc lhs
, NonLoc rhs
,
273 // Handle trivial case where left-side and right-side are the same.
281 return ValMgr
.makeTruthVal(true, resultTy
);
285 return ValMgr
.makeTruthVal(false, resultTy
);
288 return ValMgr
.makeIntVal(0, resultTy
);
291 return EvalCastNL(lhs
, resultTy
);
295 switch (lhs
.getSubKind()) {
298 case nonloc::LocAsIntegerKind
: {
299 Loc lhsL
= cast
<nonloc::LocAsInteger
>(lhs
).getLoc();
300 switch (rhs
.getSubKind()) {
301 case nonloc::LocAsIntegerKind
:
302 return EvalBinOpLL(state
, op
, lhsL
,
303 cast
<nonloc::LocAsInteger
>(rhs
).getLoc(),
305 case nonloc::ConcreteIntKind
: {
306 // Transform the integer into a location and compare.
307 ASTContext
& Ctx
= ValMgr
.getContext();
308 llvm::APSInt i
= cast
<nonloc::ConcreteInt
>(rhs
).getValue();
309 i
.setIsUnsigned(true);
310 i
.extOrTrunc(Ctx
.getTypeSize(Ctx
.VoidPtrTy
));
311 return EvalBinOpLL(state
, op
, lhsL
, ValMgr
.makeLoc(i
), resultTy
);
316 return ValMgr
.makeTruthVal(false, resultTy
);
318 return ValMgr
.makeTruthVal(true, resultTy
);
320 // This case also handles pointer arithmetic.
325 case nonloc::SymExprValKind
: {
326 nonloc::SymExprVal
*selhs
= cast
<nonloc::SymExprVal
>(&lhs
);
328 // Only handle LHS of the form "$sym op constant", at least for now.
329 const SymIntExpr
*symIntExpr
=
330 dyn_cast
<SymIntExpr
>(selhs
->getSymbolicExpression());
335 // Is this a logical not? (!x is represented as x == 0.)
336 if (op
== BO_EQ
&& rhs
.isZeroConstant()) {
337 // We know how to negate certain expressions. Simplify them here.
339 BinaryOperator::Opcode opc
= symIntExpr
->getOpcode();
342 // We don't know how to negate this operation.
343 // Just handle it as if it were a normal comparison to 0.
347 assert(false && "Logical operators handled by branching logic.");
361 assert(false && "'=' and ',' operators handled by GRExprEngine.");
365 assert(false && "Pointer arithmetic not handled here.");
373 // Negate the comparison and make a value.
374 opc
= NegateComparison(opc
);
375 assert(symIntExpr
->getType(ValMgr
.getContext()) == resultTy
);
376 return ValMgr
.makeNonLoc(symIntExpr
->getLHS(), opc
,
377 symIntExpr
->getRHS(), resultTy
);
381 // For now, only handle expressions whose RHS is a constant.
382 const nonloc::ConcreteInt
*rhsInt
= dyn_cast
<nonloc::ConcreteInt
>(&rhs
);
386 // If both the LHS and the current expression are additive,
387 // fold their constants.
388 if (BinaryOperator::isAdditiveOp(op
)) {
389 BinaryOperator::Opcode lop
= symIntExpr
->getOpcode();
390 if (BinaryOperator::isAdditiveOp(lop
)) {
391 BasicValueFactory
&BVF
= ValMgr
.getBasicValueFactory();
393 // resultTy may not be the best type to convert to, but it's
394 // probably the best choice in expressions with mixed type
395 // (such as x+1U+2LL). The rules for implicit conversions should
396 // choose a reasonable type to preserve the expression, and will
397 // at least match how the value is going to be used.
398 const llvm::APSInt
&first
=
399 BVF
.Convert(resultTy
, symIntExpr
->getRHS());
400 const llvm::APSInt
&second
=
401 BVF
.Convert(resultTy
, rhsInt
->getValue());
403 const llvm::APSInt
*newRHS
;
405 newRHS
= BVF
.EvaluateAPSInt(BO_Add
, first
, second
);
407 newRHS
= BVF
.EvaluateAPSInt(BO_Sub
, first
, second
);
408 return MakeSymIntVal(symIntExpr
->getLHS(), lop
, *newRHS
, resultTy
);
412 // Otherwise, make a SymExprVal out of the expression.
413 return MakeSymIntVal(symIntExpr
, op
, rhsInt
->getValue(), resultTy
);
415 case nonloc::ConcreteIntKind
: {
416 const nonloc::ConcreteInt
& lhsInt
= cast
<nonloc::ConcreteInt
>(lhs
);
418 if (isa
<nonloc::ConcreteInt
>(rhs
)) {
419 return lhsInt
.evalBinOp(ValMgr
, op
, cast
<nonloc::ConcreteInt
>(rhs
));
421 const llvm::APSInt
& lhsValue
= lhsInt
.getValue();
423 // Swap the left and right sides and flip the operator if doing so
424 // allows us to better reason about the expression (this is a form
425 // of expression canonicalization).
426 // While we're at it, catch some special cases for non-commutative ops.
436 op
= ReverseComparison(op
);
447 if (lhsValue
.isAllOnesValue() && lhsValue
.isSigned())
448 // At this point lhs and rhs have been swapped.
453 // At this point lhs and rhs have been swapped.
461 case nonloc::SymbolValKind
: {
462 nonloc::SymbolVal
*slhs
= cast
<nonloc::SymbolVal
>(&lhs
);
463 SymbolRef Sym
= slhs
->getSymbol();
465 ASTContext
& Ctx
= ValMgr
.getContext();
467 // Does the symbol simplify to a constant? If so, "fold" the constant
468 // by setting 'lhs' to a ConcreteInt and try again.
469 if (Sym
->getType(Ctx
)->isIntegerType())
470 if (const llvm::APSInt
*Constant
= state
->getSymVal(Sym
)) {
471 // The symbol evaluates to a constant. If necessary, promote the
472 // folded constant (LHS) to the result type.
473 BasicValueFactory
&BVF
= ValMgr
.getBasicValueFactory();
474 const llvm::APSInt
&lhs_I
= BVF
.Convert(resultTy
, *Constant
);
475 lhs
= nonloc::ConcreteInt(lhs_I
);
477 // Also promote the RHS (if necessary).
479 // For shifts, it is not necessary to promote the RHS.
480 if (BinaryOperator::isShiftOp(op
))
483 // Other operators: do an implicit conversion. This shouldn't be
484 // necessary once we support truncation/extension of symbolic values.
485 if (nonloc::ConcreteInt
*rhs_I
= dyn_cast
<nonloc::ConcreteInt
>(&rhs
)){
486 rhs
= nonloc::ConcreteInt(BVF
.Convert(resultTy
, rhs_I
->getValue()));
492 // Is the RHS a symbol we can simplify?
493 if (const nonloc::SymbolVal
*srhs
= dyn_cast
<nonloc::SymbolVal
>(&rhs
)) {
494 SymbolRef RSym
= srhs
->getSymbol();
495 if (RSym
->getType(Ctx
)->isIntegerType()) {
496 if (const llvm::APSInt
*Constant
= state
->getSymVal(RSym
)) {
497 // The symbol evaluates to a constant.
498 BasicValueFactory
&BVF
= ValMgr
.getBasicValueFactory();
499 const llvm::APSInt
&rhs_I
= BVF
.Convert(resultTy
, *Constant
);
500 rhs
= nonloc::ConcreteInt(rhs_I
);
505 if (isa
<nonloc::ConcreteInt
>(rhs
)) {
506 return MakeSymIntVal(slhs
->getSymbol(), op
,
507 cast
<nonloc::ConcreteInt
>(rhs
).getValue(),
517 // FIXME: all this logic will change if/when we have MemRegion::getLocation().
518 SVal
SimpleSValuator::EvalBinOpLL(const GRState
*state
,
519 BinaryOperator::Opcode op
,
522 // Only comparisons and subtractions are valid operations on two pointers.
523 // See [C99 6.5.5 through 6.5.14] or [C++0x 5.6 through 5.15].
524 // However, if a pointer is casted to an integer, EvalBinOpNN may end up
525 // calling this function with another operation (PR7527). We don't attempt to
526 // model this for now, but it could be useful, particularly when the
527 // "location" is actually an integer value that's been passed through a void*.
528 if (!(BinaryOperator::isComparisonOp(op
) || op
== BO_Sub
))
531 // Special cases for when both sides are identical.
535 assert(false && "Unimplemented operation for two identical values");
538 return ValMgr
.makeZeroVal(resultTy
);
542 return ValMgr
.makeTruthVal(true, resultTy
);
546 return ValMgr
.makeTruthVal(false, resultTy
);
550 switch (lhs
.getSubKind()) {
552 assert(false && "Ordering not implemented for this Loc.");
555 case loc::GotoLabelKind
:
556 // The only thing we know about labels is that they're non-null.
557 if (rhs
.isZeroConstant()) {
562 return EvalCastL(lhs
, resultTy
);
566 return ValMgr
.makeTruthVal(false, resultTy
);
570 return ValMgr
.makeTruthVal(true, resultTy
);
573 // There may be two labels for the same location, and a function region may
574 // have the same address as a label at the start of the function (depending
576 // FIXME: we can probably do a comparison against other MemRegions, though.
577 // FIXME: is there a way to tell if two labels refer to the same location?
580 case loc::ConcreteIntKind
: {
581 // If one of the operands is a symbol and the other is a constant,
582 // build an expression for use by the constraint manager.
583 if (SymbolRef rSym
= rhs
.getAsLocSymbol()) {
584 // We can only build expressions with symbols on the left,
585 // so we need a reversible operator.
586 if (!BinaryOperator::isComparisonOp(op
))
589 const llvm::APSInt
&lVal
= cast
<loc::ConcreteInt
>(lhs
).getValue();
590 return ValMgr
.makeNonLoc(rSym
, ReverseComparison(op
), lVal
, resultTy
);
593 // If both operands are constants, just perform the operation.
594 if (loc::ConcreteInt
*rInt
= dyn_cast
<loc::ConcreteInt
>(&rhs
)) {
595 BasicValueFactory
&BVF
= ValMgr
.getBasicValueFactory();
596 SVal ResultVal
= cast
<loc::ConcreteInt
>(lhs
).EvalBinOp(BVF
, op
, *rInt
);
597 if (Loc
*Result
= dyn_cast
<Loc
>(&ResultVal
))
598 return EvalCastL(*Result
, resultTy
);
603 // Special case comparisons against NULL.
604 // This must come after the test if the RHS is a symbol, which is used to
605 // build constraints. The address of any non-symbolic region is guaranteed
606 // to be non-NULL, as is any label.
607 assert(isa
<loc::MemRegionVal
>(rhs
) || isa
<loc::GotoLabel
>(rhs
));
608 if (lhs
.isZeroConstant()) {
615 return ValMgr
.makeTruthVal(false, resultTy
);
619 return ValMgr
.makeTruthVal(true, resultTy
);
623 // Comparing an arbitrary integer to a region or label address is
624 // completely unknowable.
627 case loc::MemRegionKind
: {
628 if (loc::ConcreteInt
*rInt
= dyn_cast
<loc::ConcreteInt
>(&rhs
)) {
629 // If one of the operands is a symbol and the other is a constant,
630 // build an expression for use by the constraint manager.
631 if (SymbolRef lSym
= lhs
.getAsLocSymbol())
632 return MakeSymIntVal(lSym
, op
, rInt
->getValue(), resultTy
);
634 // Special case comparisons to NULL.
635 // This must come after the test if the LHS is a symbol, which is used to
636 // build constraints. The address of any non-symbolic region is guaranteed
638 if (rInt
->isZeroConstant()) {
643 return EvalCastL(lhs
, resultTy
);
647 return ValMgr
.makeTruthVal(false, resultTy
);
651 return ValMgr
.makeTruthVal(true, resultTy
);
655 // Comparing a region to an arbitrary integer is completely unknowable.
659 // Get both values as regions, if possible.
660 const MemRegion
*LeftMR
= lhs
.getAsRegion();
661 assert(LeftMR
&& "MemRegionKind SVal doesn't have a region!");
663 const MemRegion
*RightMR
= rhs
.getAsRegion();
665 // The RHS is probably a label, which in theory could address a region.
666 // FIXME: we can probably make a more useful statement about non-code
670 // If both values wrap regions, see if they're from different base regions.
671 const MemRegion
*LeftBase
= LeftMR
->getBaseRegion();
672 const MemRegion
*RightBase
= RightMR
->getBaseRegion();
673 if (LeftBase
!= RightBase
&&
674 !isa
<SymbolicRegion
>(LeftBase
) && !isa
<SymbolicRegion
>(RightBase
)) {
679 return ValMgr
.makeTruthVal(false, resultTy
);
681 return ValMgr
.makeTruthVal(true, resultTy
);
685 // The two regions are from the same base region. See if they're both a
686 // type of region we know how to compare.
688 // FIXME: If/when there is a getAsRawOffset() for FieldRegions, this
689 // ElementRegion path and the FieldRegion path below should be unified.
690 if (const ElementRegion
*LeftER
= dyn_cast
<ElementRegion
>(LeftMR
)) {
691 // First see if the right region is also an ElementRegion.
692 const ElementRegion
*RightER
= dyn_cast
<ElementRegion
>(RightMR
);
696 // Next, see if the two ERs have the same super-region and matching types.
697 // FIXME: This should do something useful even if the types don't match,
698 // though if both indexes are constant the RegionRawOffset path will
699 // give the correct answer.
700 if (LeftER
->getSuperRegion() == RightER
->getSuperRegion() &&
701 LeftER
->getElementType() == RightER
->getElementType()) {
702 // Get the left index and cast it to the correct type.
703 // If the index is unknown or undefined, bail out here.
704 SVal LeftIndexVal
= LeftER
->getIndex();
705 NonLoc
*LeftIndex
= dyn_cast
<NonLoc
>(&LeftIndexVal
);
708 LeftIndexVal
= EvalCastNL(*LeftIndex
, resultTy
);
709 LeftIndex
= dyn_cast
<NonLoc
>(&LeftIndexVal
);
713 // Do the same for the right index.
714 SVal RightIndexVal
= RightER
->getIndex();
715 NonLoc
*RightIndex
= dyn_cast
<NonLoc
>(&RightIndexVal
);
718 RightIndexVal
= EvalCastNL(*RightIndex
, resultTy
);
719 RightIndex
= dyn_cast
<NonLoc
>(&RightIndexVal
);
723 // Actually perform the operation.
724 // EvalBinOpNN expects the two indexes to already be the right type.
725 return EvalBinOpNN(state
, op
, *LeftIndex
, *RightIndex
, resultTy
);
728 // If the element indexes aren't comparable, see if the raw offsets are.
729 RegionRawOffset LeftOffset
= LeftER
->getAsArrayOffset();
730 RegionRawOffset RightOffset
= RightER
->getAsArrayOffset();
732 if (LeftOffset
.getRegion() != NULL
&&
733 LeftOffset
.getRegion() == RightOffset
.getRegion()) {
734 int64_t left
= LeftOffset
.getByteOffset();
735 int64_t right
= RightOffset
.getByteOffset();
741 return ValMgr
.makeTruthVal(left
< right
, resultTy
);
743 return ValMgr
.makeTruthVal(left
> right
, resultTy
);
745 return ValMgr
.makeTruthVal(left
<= right
, resultTy
);
747 return ValMgr
.makeTruthVal(left
>= right
, resultTy
);
749 return ValMgr
.makeTruthVal(left
== right
, resultTy
);
751 return ValMgr
.makeTruthVal(left
!= right
, resultTy
);
755 // If we get here, we have no way of comparing the ElementRegions.
759 // See if both regions are fields of the same structure.
760 // FIXME: This doesn't handle nesting, inheritance, or Objective-C ivars.
761 if (const FieldRegion
*LeftFR
= dyn_cast
<FieldRegion
>(LeftMR
)) {
762 // Only comparisons are meaningful here!
763 if (!BinaryOperator::isComparisonOp(op
))
766 // First see if the right region is also a FieldRegion.
767 const FieldRegion
*RightFR
= dyn_cast
<FieldRegion
>(RightMR
);
771 // Next, see if the two FRs have the same super-region.
772 // FIXME: This doesn't handle casts yet, and simply stripping the casts
774 if (LeftFR
->getSuperRegion() != RightFR
->getSuperRegion())
777 const FieldDecl
*LeftFD
= LeftFR
->getDecl();
778 const FieldDecl
*RightFD
= RightFR
->getDecl();
779 const RecordDecl
*RD
= LeftFD
->getParent();
781 // Make sure the two FRs are from the same kind of record. Just in case!
782 // FIXME: This is probably where inheritance would be a problem.
783 if (RD
!= RightFD
->getParent())
786 // We know for sure that the two fields are not the same, since that
787 // would have given us the same SVal.
789 return ValMgr
.makeTruthVal(false, resultTy
);
791 return ValMgr
.makeTruthVal(true, resultTy
);
793 // Iterate through the fields and see which one comes first.
794 // [C99 6.7.2.1.13] "Within a structure object, the non-bit-field
795 // members and the units in which bit-fields reside have addresses that
796 // increase in the order in which they are declared."
797 bool leftFirst
= (op
== BO_LT
|| op
== BO_LE
);
798 for (RecordDecl::field_iterator I
= RD
->field_begin(),
799 E
= RD
->field_end(); I
!=E
; ++I
) {
801 return ValMgr
.makeTruthVal(leftFirst
, resultTy
);
803 return ValMgr
.makeTruthVal(!leftFirst
, resultTy
);
806 assert(false && "Fields not found in parent record's definition");
809 // If we get here, we have no way of comparing the regions.
815 SVal
SimpleSValuator::EvalBinOpLN(const GRState
*state
,
816 BinaryOperator::Opcode op
,
817 Loc lhs
, NonLoc rhs
, QualType resultTy
) {
818 // Special case: 'rhs' is an integer that has the same width as a pointer and
819 // we are using the integer location in a comparison. Normally this cannot be
820 // triggered, but transfer functions like those for OSCommpareAndSwapBarrier32
821 // can generate comparisons that trigger this code.
822 // FIXME: Are all locations guaranteed to have pointer width?
823 if (BinaryOperator::isComparisonOp(op
)) {
824 if (nonloc::ConcreteInt
*rhsInt
= dyn_cast
<nonloc::ConcreteInt
>(&rhs
)) {
825 const llvm::APSInt
*x
= &rhsInt
->getValue();
826 ASTContext
&ctx
= ValMgr
.getContext();
827 if (ctx
.getTypeSize(ctx
.VoidPtrTy
) == x
->getBitWidth()) {
828 // Convert the signedness of the integer (if necessary).
830 x
= &ValMgr
.getBasicValueFactory().getValue(*x
, true);
832 return EvalBinOpLL(state
, op
, lhs
, loc::ConcreteInt(*x
), resultTy
);
837 // We are dealing with pointer arithmetic.
839 // Handle pointer arithmetic on constant values.
840 if (nonloc::ConcreteInt
*rhsInt
= dyn_cast
<nonloc::ConcreteInt
>(&rhs
)) {
841 if (loc::ConcreteInt
*lhsInt
= dyn_cast
<loc::ConcreteInt
>(&lhs
)) {
842 const llvm::APSInt
&leftI
= lhsInt
->getValue();
843 assert(leftI
.isUnsigned());
844 llvm::APSInt
rightI(rhsInt
->getValue(), /* isUnsigned */ true);
846 // Convert the bitwidth of rightI. This should deal with overflow
847 // since we are dealing with concrete values.
848 rightI
.extOrTrunc(leftI
.getBitWidth());
850 // Offset the increment by the pointer size.
851 llvm::APSInt
Multiplicand(rightI
.getBitWidth(), /* isUnsigned */ true);
852 rightI
*= Multiplicand
;
854 // Compute the adjusted pointer.
857 rightI
= leftI
+ rightI
;
860 rightI
= leftI
- rightI
;
863 llvm_unreachable("Invalid pointer arithmetic operation");
865 return loc::ConcreteInt(ValMgr
.getBasicValueFactory().getValue(rightI
));
870 // Delegate remaining pointer arithmetic to the StoreManager.
871 return state
->getStateManager().getStoreManager().EvalBinOp(op
, lhs
,
875 const llvm::APSInt
*SimpleSValuator::getKnownValue(const GRState
*state
,
877 if (V
.isUnknownOrUndef())
880 if (loc::ConcreteInt
* X
= dyn_cast
<loc::ConcreteInt
>(&V
))
881 return &X
->getValue();
883 if (nonloc::ConcreteInt
* X
= dyn_cast
<nonloc::ConcreteInt
>(&V
))
884 return &X
->getValue();
886 if (SymbolRef Sym
= V
.getAsSymbol())
887 return state
->getSymVal(Sym
);
889 // FIXME: Add support for SymExprs.