include/clang/Checker/PathSensitive/GRExprEngine.h

   1 //===-- GRExprEngine.h - Path-Sensitive Expression-Level Dataflow ---*- C++ -*-=
   2 //
   3 //                     The LLVM Compiler Infrastructure
   4 //
   5 // This file is distributed under the University of Illinois Open Source
   6 // License. See LICENSE.TXT for details.
   7 //
   8 //===----------------------------------------------------------------------===//
   9 //
  10 //  This file defines a meta-engine for path-sensitive dataflow analysis that
  11 //  is built on GRCoreEngine, but provides the boilerplate to execute transfer
  12 //  functions and build the ExplodedGraph at the expression level.
  13 //
  14 //===----------------------------------------------------------------------===//
  15
  16 #ifndef LLVM_CLANG_ANALYSIS_GREXPRENGINE
  17 #define LLVM_CLANG_ANALYSIS_GREXPRENGINE
  18
  19 #include "clang/Checker/PathSensitive/AnalysisManager.h"
  20 #include "clang/Checker/PathSensitive/GRSubEngine.h"
  21 #include "clang/Checker/PathSensitive/GRCoreEngine.h"
  22 #include "clang/Checker/PathSensitive/GRState.h"
  23 #include "clang/Checker/PathSensitive/GRTransferFuncs.h"
  24 #include "clang/Checker/BugReporter/BugReporter.h"
  25 #include "clang/AST/Type.h"
  26 #include "clang/AST/ExprObjC.h"
  27 #include "clang/AST/ExprCXX.h"
  28 #include "clang/AST/StmtObjC.h"
  29
  30 namespace clang {
  31 class AnalysisManager;
  32 class Checker;
  33 class ObjCForCollectionStmt;
  34
  35 class GRExprEngine : public GRSubEngine {
  36   AnalysisManager &AMgr;
  37
  38   GRCoreEngine CoreEngine;
  39
  40   /// G - the simulation graph.
  41   ExplodedGraph& G;
  42
  43   /// Builder - The current GRStmtNodeBuilder which is used when building the
  44   ///  nodes for a given statement.
  45   GRStmtNodeBuilder* Builder;
  46
  47   /// StateMgr - Object that manages the data for all created states.
  48   GRStateManager StateMgr;
  49
  50   /// SymMgr - Object that manages the symbol information.
  51   SymbolManager& SymMgr;
  52
  53   /// svalBuilder - SValBuilder object that creates SVals from expressions.
  54   SValBuilder &svalBuilder;
  55
  56   /// EntryNode - The immediate predecessor node.
  57   ExplodedNode* EntryNode;
  58
  59   /// CleanedState - The state for EntryNode "cleaned" of all dead
  60   ///  variables and symbols (as determined by a liveness analysis).
  61   const GRState* CleanedState;
  62
  63   /// currentStmt - The current block-level statement.
  64   const Stmt* currentStmt;
  65
  66   // Obj-C Class Identifiers.
  67   IdentifierInfo* NSExceptionII;
  68
  69   // Obj-C Selectors.
  70   Selector* NSExceptionInstanceRaiseSelectors;
  71   Selector RaiseSel;
  72
  73   enum CallbackKind {
  74     PreVisitStmtCallback,
  75     PostVisitStmtCallback,
  76     ProcessAssumeCallback,
  77     EvalRegionChangesCallback
  78   };
  79
  80   typedef uint32_t CallbackTag;
  81
  82   /// GetCallbackTag - Create a tag for a certain kind of callback. The 'Sub'
  83   ///  argument can be used to differentiate callbacks that depend on another
  84   ///  value from a small set of possibilities, such as statement classes.
  85   static inline CallbackTag GetCallbackTag(CallbackKind K, uint32_t Sub = 0) {
  86     assert(Sub == ((Sub << 8) >> 8) && "Tag sub-kind must fit into 24 bits");
  87     return K | (Sub << 8);
  88   }
  89
  90   typedef llvm::DenseMap<void *, unsigned> CheckerMap;
  91   typedef std::vector<std::pair<void *, Checker*> > CheckersOrdered;
  92   typedef llvm::DenseMap<CallbackTag, CheckersOrdered *> CheckersOrderedCache;
  93
  94   /// A registration map from checker tag to the index into the
  95   ///  ordered checkers vector.
  96   CheckerMap CheckerM;
  97
  98   /// An ordered vector of checkers that are called when evaluating
  99   ///  various expressions and statements.
 100   CheckersOrdered Checkers;
 101
 102   /// A map used for caching the checkers that respond to the callback for
 103   ///  a particular callback tag.
 104   CheckersOrderedCache COCache;
 105
 106   /// The BugReporter associated with this engine.  It is important that
 107   ///  this object be placed at the very end of member variables so that its
 108   ///  destructor is called before the rest of the GRExprEngine is destroyed.
 109   GRBugReporter BR;
 110
 111   llvm::OwningPtr<GRTransferFuncs> TF;
 112
 113 public:
 114   GRExprEngine(AnalysisManager &mgr, GRTransferFuncs *tf);
 115
 116   ~GRExprEngine();
 117
 118   void ExecuteWorkList(const LocationContext *L, unsigned Steps = 150000) {
 119     CoreEngine.ExecuteWorkList(L, Steps, 0);
 120   }
 121
 122   /// Execute the work list with an initial state. Nodes that reaches the exit
 123   /// of the function are added into the Dst set, which represent the exit
 124   /// state of the function call.
 125   void ExecuteWorkListWithInitialState(const LocationContext *L, unsigned Steps,
 126                                        const GRState *InitState,
 127                                        ExplodedNodeSet &Dst) {
 128     CoreEngine.ExecuteWorkListWithInitialState(L, Steps, InitState, Dst);
 129   }
 130
 131   /// getContext - Return the ASTContext associated with this analysis.
 132   ASTContext& getContext() const { return AMgr.getASTContext(); }
 133
 134   virtual AnalysisManager &getAnalysisManager() { return AMgr; }
 135
 136   SValBuilder &getSValBuilder() { return svalBuilder; }
 137
 138   GRTransferFuncs& getTF() { return *TF; }
 139
 140   BugReporter& getBugReporter() { return BR; }
 141
 142   GRStmtNodeBuilder &getBuilder() { assert(Builder); return *Builder; }
 143
 144   // FIXME: Remove once GRTransferFuncs is no longer referenced.
 145   void setTransferFunction(GRTransferFuncs* tf);
 146
 147   /// ViewGraph - Visualize the ExplodedGraph created by executing the
 148   ///  simulation.
 149   void ViewGraph(bool trim = false);
 150
 151   void ViewGraph(ExplodedNode** Beg, ExplodedNode** End);
 152
 153   /// getInitialState - Return the initial state used for the root vertex
 154   ///  in the ExplodedGraph.
 155   const GRState* getInitialState(const LocationContext *InitLoc);
 156
 157   ExplodedGraph& getGraph() { return G; }
 158   const ExplodedGraph& getGraph() const { return G; }
 159
 160   template <typename CHECKER>
 161   void registerCheck(CHECKER *check) {
 162     unsigned entry = Checkers.size();
 163     void *tag = CHECKER::getTag();
 164     Checkers.push_back(std::make_pair(tag, check));
 165     CheckerM[tag] = entry;
 166   }
 167
 168   Checker *lookupChecker(void *tag) const;
 169
 170   template <typename CHECKER>
 171   CHECKER *getChecker() const {
 172      return static_cast<CHECKER*>(lookupChecker(CHECKER::getTag()));
 173   }
 174
 175   /// ProcessElement - Called by GRCoreEngine. Used to generate new successor
 176   ///  nodes by processing the 'effects' of a CFG element.
 177   void ProcessElement(const CFGElement E, GRStmtNodeBuilder& builder);
 178
 179   void ProcessStmt(const CFGStmt S, GRStmtNodeBuilder &builder);
 180
 181   void ProcessInitializer(const CFGInitializer I, GRStmtNodeBuilder &builder);
 182
 183   void ProcessImplicitDtor(const CFGImplicitDtor D, GRStmtNodeBuilder &builder);
 184
 185   void ProcessAutomaticObjDtor(const CFGAutomaticObjDtor D,
 186                             GRStmtNodeBuilder &builder);
 187   void ProcessBaseDtor(const CFGBaseDtor D, GRStmtNodeBuilder &builder);
 188   void ProcessMemberDtor(const CFGMemberDtor D, GRStmtNodeBuilder &builder);
 189   void ProcessTemporaryDtor(const CFGTemporaryDtor D,
 190                             GRStmtNodeBuilder &builder);
 191
 192   /// ProcessBlockEntrance - Called by GRCoreEngine when start processing
 193   ///  a CFGBlock.  This method returns true if the analysis should continue
 194   ///  exploring the given path, and false otherwise.
 195   bool ProcessBlockEntrance(const CFGBlock* B, const ExplodedNode *Pred,
 196                             GRBlockCounter BC);
 197
 198   /// ProcessBranch - Called by GRCoreEngine.  Used to generate successor
 199   ///  nodes by processing the 'effects' of a branch condition.
 200   void ProcessBranch(const Stmt* Condition, const Stmt* Term,
 201                      GRBranchNodeBuilder& builder);
 202
 203   /// ProcessIndirectGoto - Called by GRCoreEngine.  Used to generate successor
 204   ///  nodes by processing the 'effects' of a computed goto jump.
 205   void ProcessIndirectGoto(GRIndirectGotoNodeBuilder& builder);
 206
 207   /// ProcessSwitch - Called by GRCoreEngine.  Used to generate successor
 208   ///  nodes by processing the 'effects' of a switch statement.
 209   void ProcessSwitch(GRSwitchNodeBuilder& builder);
 210
 211   /// ProcessEndPath - Called by GRCoreEngine.  Used to generate end-of-path
 212   ///  nodes when the control reaches the end of a function.
 213   void ProcessEndPath(GREndPathNodeBuilder& builder);
 214
 215   /// Generate the entry node of the callee.
 216   void ProcessCallEnter(GRCallEnterNodeBuilder &builder);
 217
 218   /// Generate the first post callsite node.
 219   void ProcessCallExit(GRCallExitNodeBuilder &builder);
 220
 221   /// Called by GRCoreEngine when the analysis worklist has terminated.
 222   void ProcessEndWorklist(bool hasWorkRemaining);
 223
 224   /// evalAssume - Callback function invoked by the ConstraintManager when
 225   ///  making assumptions about state values.
 226   const GRState *ProcessAssume(const GRState *state, SVal cond,bool assumption);
 227
 228   /// WantsRegionChangeUpdate - Called by GRStateManager to determine if a
 229   ///  region change should trigger a ProcessRegionChanges update.
 230   bool WantsRegionChangeUpdate(const GRState* state);
 231
 232   /// ProcessRegionChanges - Called by GRStateManager whenever a change is made
 233   ///  to the store. Used to update checkers that track region values.
 234   const GRState* ProcessRegionChanges(const GRState *state,
 235                                       const MemRegion * const *Begin,
 236                                       const MemRegion * const *End);
 237
 238   virtual GRStateManager& getStateManager() { return StateMgr; }
 239
 240   StoreManager& getStoreManager() { return StateMgr.getStoreManager(); }
 241
 242   ConstraintManager& getConstraintManager() {
 243     return StateMgr.getConstraintManager();
 244   }
 245
 246   // FIXME: Remove when we migrate over to just using SValBuilder.
 247   BasicValueFactory& getBasicVals() {
 248     return StateMgr.getBasicVals();
 249   }
 250   const BasicValueFactory& getBasicVals() const {
 251     return StateMgr.getBasicVals();
 252   }
 253
 254   // FIXME: Remove when we migrate over to just using ValueManager.
 255   SymbolManager& getSymbolManager() { return SymMgr; }
 256   const SymbolManager& getSymbolManager() const { return SymMgr; }
 257
 258   // Functions for external checking of whether we have unfinished work
 259   bool wasBlockAborted() const { return CoreEngine.wasBlockAborted(); }
 260   bool hasEmptyWorkList() const { return !CoreEngine.getWorkList()->hasWork(); }
 261   bool hasWorkRemaining() const {
 262     return wasBlockAborted() || CoreEngine.getWorkList()->hasWork();
 263   }
 264
 265   const GRCoreEngine &getCoreEngine() const { return CoreEngine; }
 266
 267 protected:
 268   const GRState* GetState(ExplodedNode* N) {
 269     return N == EntryNode ? CleanedState : N->getState();
 270   }
 271
 272 public:
 273   ExplodedNode* MakeNode(ExplodedNodeSet& Dst, const Stmt* S,
 274                          ExplodedNode* Pred, const GRState* St,
 275                          ProgramPoint::Kind K = ProgramPoint::PostStmtKind,
 276                          const void *tag = 0);
 277
 278   /// CheckerVisit - Dispatcher for performing checker-specific logic
 279   ///  at specific statements.
 280   void CheckerVisit(const Stmt *S, ExplodedNodeSet &Dst, ExplodedNodeSet &Src,
 281                     CallbackKind Kind);
 282
 283   bool CheckerEvalCall(const CallExpr *CE,
 284                        ExplodedNodeSet &Dst,
 285                        ExplodedNode *Pred);
 286
 287   void CheckerEvalNilReceiver(const ObjCMessageExpr *ME,
 288                               ExplodedNodeSet &Dst,
 289                               const GRState *state,
 290                               ExplodedNode *Pred);
 291
 292   void CheckerVisitBind(const Stmt *StoreE, ExplodedNodeSet &Dst,
 293                         ExplodedNodeSet &Src,  SVal location, SVal val,
 294                         bool isPrevisit);
 295
 296   /// Visit - Transfer function logic for all statements.  Dispatches to
 297   ///  other functions that handle specific kinds of statements.
 298   void Visit(const Stmt* S, ExplodedNode* Pred, ExplodedNodeSet& Dst);
 299
 300   /// VisitArraySubscriptExpr - Transfer function for array accesses.
 301   void VisitLvalArraySubscriptExpr(const ArraySubscriptExpr* Ex,
 302                                    ExplodedNode* Pred,
 303                                    ExplodedNodeSet& Dst);
 304
 305   /// VisitAsmStmt - Transfer function logic for inline asm.
 306   void VisitAsmStmt(const AsmStmt* A, ExplodedNode* Pred, ExplodedNodeSet& Dst);
 307
 308   void VisitAsmStmtHelperOutputs(const AsmStmt* A,
 309                                  AsmStmt::const_outputs_iterator I,
 310                                  AsmStmt::const_outputs_iterator E,
 311                                  ExplodedNode* Pred, ExplodedNodeSet& Dst);
 312
 313   void VisitAsmStmtHelperInputs(const AsmStmt* A,
 314                                 AsmStmt::const_inputs_iterator I,
 315                                 AsmStmt::const_inputs_iterator E,
 316                                 ExplodedNode* Pred, ExplodedNodeSet& Dst);
 317
 318   /// VisitBlockExpr - Transfer function logic for BlockExprs.
 319   void VisitBlockExpr(const BlockExpr *BE, ExplodedNode *Pred,
 320                       ExplodedNodeSet &Dst);
 321
 322   /// VisitBinaryOperator - Transfer function logic for binary operators.
 323   void VisitBinaryOperator(const BinaryOperator* B, ExplodedNode* Pred,
 324                            ExplodedNodeSet& Dst);
 325
 326
 327   /// VisitCall - Transfer function for function calls.
 328   void VisitCall(const CallExpr* CE, ExplodedNode* Pred,
 329                  CallExpr::const_arg_iterator AI,
 330                  CallExpr::const_arg_iterator AE,
 331                  ExplodedNodeSet& Dst);
 332
 333   /// VisitCast - Transfer function logic for all casts (implicit and explicit).
 334   void VisitCast(const CastExpr *CastE, const Expr *Ex, ExplodedNode *Pred,
 335                 ExplodedNodeSet &Dst);
 336
 337   /// VisitCompoundLiteralExpr - Transfer function logic for compound literals.
 338   void VisitCompoundLiteralExpr(const CompoundLiteralExpr* CL,
 339                                 ExplodedNode* Pred, ExplodedNodeSet& Dst);
 340
 341   /// Transfer function logic for DeclRefExprs and BlockDeclRefExprs.
 342   void VisitCommonDeclRefExpr(const Expr* DR, const NamedDecl *D,
 343                               ExplodedNode* Pred, ExplodedNodeSet& Dst);
 344
 345   /// VisitDeclStmt - Transfer function logic for DeclStmts.
 346   void VisitDeclStmt(const DeclStmt* DS, ExplodedNode* Pred,
 347                      ExplodedNodeSet& Dst);
 348
 349   /// VisitGuardedExpr - Transfer function logic for ?, __builtin_choose
 350   void VisitGuardedExpr(const Expr* Ex, const Expr* L, const Expr* R,
 351                         ExplodedNode* Pred, ExplodedNodeSet& Dst);
 352
 353   /// VisitCondInit - Transfer function for handling the initialization
 354   ///  of a condition variable in an IfStmt, SwitchStmt, etc.
 355   void VisitCondInit(const VarDecl *VD, const Stmt *S, ExplodedNode *Pred,
 356                      ExplodedNodeSet& Dst);
 357
 358   void VisitInitListExpr(const InitListExpr* E, ExplodedNode* Pred,
 359                          ExplodedNodeSet& Dst);
 360
 361   /// VisitLogicalExpr - Transfer function logic for '&&', '||'
 362   void VisitLogicalExpr(const BinaryOperator* B, ExplodedNode* Pred,
 363                         ExplodedNodeSet& Dst);
 364
 365   /// VisitMemberExpr - Transfer function for member expressions.
 366   void VisitMemberExpr(const MemberExpr* M, ExplodedNode* Pred,
 367                            ExplodedNodeSet& Dst);
 368
 369   /// Transfer function logic for ObjCAtSynchronizedStmts.
 370   void VisitObjCAtSynchronizedStmt(const ObjCAtSynchronizedStmt *S,
 371                                    ExplodedNode *Pred, ExplodedNodeSet &Dst);
 372
 373   /// Transfer function logic for computing the lvalue of an Objective-C ivar.
 374   void VisitLvalObjCIvarRefExpr(const ObjCIvarRefExpr* DR, ExplodedNode* Pred,
 375                                 ExplodedNodeSet& Dst);
 376
 377   /// VisitObjCForCollectionStmt - Transfer function logic for
 378   ///  ObjCForCollectionStmt.
 379   void VisitObjCForCollectionStmt(const ObjCForCollectionStmt* S,
 380                                   ExplodedNode* Pred, ExplodedNodeSet& Dst);
 381
 382   void VisitObjCForCollectionStmtAux(const ObjCForCollectionStmt* S,
 383                                      ExplodedNode* Pred,
 384                                      ExplodedNodeSet& Dst, SVal ElementV);
 385
 386   /// VisitObjCMessageExpr - Transfer function for ObjC message expressions.
 387   void VisitObjCMessageExpr(const ObjCMessageExpr* ME, ExplodedNode* Pred,
 388                             ExplodedNodeSet& Dst);
 389
 390   /// VisitReturnStmt - Transfer function logic for return statements.
 391   void VisitReturnStmt(const ReturnStmt* R, ExplodedNode* Pred,
 392                        ExplodedNodeSet& Dst);
 393
 394   /// VisitOffsetOfExpr - Transfer function for offsetof.
 395   void VisitOffsetOfExpr(const OffsetOfExpr* Ex, ExplodedNode* Pred,
 396                          ExplodedNodeSet& Dst);
 397
 398   /// VisitSizeOfAlignOfExpr - Transfer function for sizeof.
 399   void VisitSizeOfAlignOfExpr(const SizeOfAlignOfExpr* Ex, ExplodedNode* Pred,
 400                               ExplodedNodeSet& Dst);
 401
 402   /// VisitUnaryOperator - Transfer function logic for unary operators.
 403   void VisitUnaryOperator(const UnaryOperator* B, ExplodedNode* Pred,
 404                           ExplodedNodeSet& Dst);
 405
 406   void VisitCXXThisExpr(const CXXThisExpr *TE, ExplodedNode *Pred,
 407                         ExplodedNodeSet & Dst);
 408
 409   void VisitCXXTemporaryObjectExpr(const CXXTemporaryObjectExpr *expr,
 410                                    ExplodedNode *Pred, ExplodedNodeSet &Dst) {
 411     VisitCXXConstructExpr(expr, 0, Pred, Dst);
 412   }
 413
 414   void VisitCXXConstructExpr(const CXXConstructExpr *E, const MemRegion *Dest,
 415                              ExplodedNode *Pred, ExplodedNodeSet &Dst);
 416
 417   void VisitCXXDestructor(const CXXDestructorDecl *DD,
 418                           const MemRegion *Dest, const Stmt *S,
 419                           ExplodedNode *Pred, ExplodedNodeSet &Dst);
 420
 421   void VisitCXXMemberCallExpr(const CXXMemberCallExpr *MCE, ExplodedNode *Pred,
 422                               ExplodedNodeSet &Dst);
 423
 424   void VisitCXXOperatorCallExpr(const CXXOperatorCallExpr *C,
 425                                 ExplodedNode *Pred, ExplodedNodeSet &Dst);
 426
 427   void VisitCXXNewExpr(const CXXNewExpr *CNE, ExplodedNode *Pred,
 428                        ExplodedNodeSet &Dst);
 429
 430   void VisitCXXDeleteExpr(const CXXDeleteExpr *CDE, ExplodedNode *Pred,
 431                           ExplodedNodeSet &Dst);
 432
 433   void VisitAggExpr(const Expr *E, const MemRegion *Dest, ExplodedNode *Pred,
 434                     ExplodedNodeSet &Dst);
 435
 436   /// Create a C++ temporary object for an rvalue.
 437   void CreateCXXTemporaryObject(const Expr *Ex, ExplodedNode *Pred,
 438                                 ExplodedNodeSet &Dst);
 439
 440   /// Synthesize CXXThisRegion.
 441   const CXXThisRegion *getCXXThisRegion(const CXXRecordDecl *RD,
 442                                         const StackFrameContext *SFC);
 443
 444   const CXXThisRegion *getCXXThisRegion(const CXXMethodDecl *decl,
 445                                         const StackFrameContext *frameCtx);
 446
 447   /// Evaluate arguments with a work list algorithm.
 448   void evalArguments(ConstExprIterator AI, ConstExprIterator AE,
 449                      const FunctionProtoType *FnType,
 450                      ExplodedNode *Pred, ExplodedNodeSet &Dst,
 451                      bool FstArgAsLValue = false);
 452
 453   /// Evaluate method call itself. Used for CXXMethodCallExpr and
 454   /// CXXOperatorCallExpr.
 455   void evalMethodCall(const CallExpr *MCE, const CXXMethodDecl *MD,
 456                       const Expr *ThisExpr, ExplodedNode *Pred,
 457                       ExplodedNodeSet &Src, ExplodedNodeSet &Dst);
 458
 459   /// evalEagerlyAssume - Given the nodes in 'Src', eagerly assume symbolic
 460   ///  expressions of the form 'x != 0' and generate new nodes (stored in Dst)
 461   ///  with those assumptions.
 462   void evalEagerlyAssume(ExplodedNodeSet& Dst, ExplodedNodeSet& Src,
 463                          const Expr *Ex);
 464
 465   SVal evalMinus(SVal X) {
 466     return X.isValid() ? svalBuilder.evalMinus(cast<NonLoc>(X)) : X;
 467   }
 468
 469   SVal evalComplement(SVal X) {
 470     return X.isValid() ? svalBuilder.evalComplement(cast<NonLoc>(X)) : X;
 471   }
 472
 473 public:
 474
 475   SVal evalBinOp(const GRState *state, BinaryOperator::Opcode op,
 476                  NonLoc L, NonLoc R, QualType T) {
 477     return svalBuilder.evalBinOpNN(state, op, L, R, T);
 478   }
 479
 480   SVal evalBinOp(const GRState *state, BinaryOperator::Opcode op,
 481                  NonLoc L, SVal R, QualType T) {
 482     return R.isValid() ? svalBuilder.evalBinOpNN(state,op,L, cast<NonLoc>(R), T) : R;
 483   }
 484
 485   SVal evalBinOp(const GRState *ST, BinaryOperator::Opcode Op,
 486                  SVal LHS, SVal RHS, QualType T) {
 487     return svalBuilder.evalBinOp(ST, Op, LHS, RHS, T);
 488   }
 489
 490 protected:
 491   void evalObjCMessageExpr(ExplodedNodeSet& Dst, const ObjCMessageExpr* ME,
 492                            ExplodedNode* Pred, const GRState *state) {
 493     assert (Builder && "GRStmtNodeBuilder must be defined.");
 494     getTF().evalObjCMessageExpr(Dst, *this, *Builder, ME, Pred, state);
 495   }
 496
 497   const GRState* MarkBranch(const GRState* St, const Stmt* Terminator,
 498                             bool branchTaken);
 499
 500   /// evalBind - Handle the semantics of binding a value to a specific location.
 501   ///  This method is used by evalStore, VisitDeclStmt, and others.
 502   void evalBind(ExplodedNodeSet& Dst, const Stmt* StoreE, ExplodedNode* Pred,
 503                 const GRState* St, SVal location, SVal Val,
 504                 bool atDeclInit = false);
 505
 506 public:
 507   // FIXME: 'tag' should be removed, and a LocationContext should be used
 508   // instead.
 509   // FIXME: Comment on the meaning of the arguments, when 'St' may not
 510   // be the same as Pred->state, and when 'location' may not be the
 511   // same as state->getLValue(Ex).
 512   /// Simulate a read of the result of Ex.
 513   void evalLoad(ExplodedNodeSet& Dst, const Expr* Ex, ExplodedNode* Pred,
 514                 const GRState* St, SVal location, const void *tag = 0,
 515                 QualType LoadTy = QualType());
 516
 517   // FIXME: 'tag' should be removed, and a LocationContext should be used
 518   // instead.
 519   void evalStore(ExplodedNodeSet& Dst, const Expr* AssignE, const Expr* StoreE,
 520                  ExplodedNode* Pred, const GRState* St, SVal TargetLV, SVal Val,
 521                  const void *tag = 0);
 522 private:
 523   void evalLoadCommon(ExplodedNodeSet& Dst, const Expr* Ex, ExplodedNode* Pred,
 524                       const GRState* St, SVal location, const void *tag,
 525                       QualType LoadTy);
 526
 527   // FIXME: 'tag' should be removed, and a LocationContext should be used
 528   // instead.
 529   void evalLocation(ExplodedNodeSet &Dst, const Stmt *S, ExplodedNode* Pred,
 530                     const GRState* St, SVal location,
 531                     const void *tag, bool isLoad);
 532
 533   bool InlineCall(ExplodedNodeSet &Dst, const CallExpr *CE, ExplodedNode *Pred);
 534 };
 535
 536 } // end clang namespace
 537
 538 #endif