1 // SimpleSValBuilder.cpp - A basic SValBuilder -----------------------*- C++ -*-
3 // The LLVM Compiler Infrastructure
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
8 //===----------------------------------------------------------------------===//
10 // This file defines SimpleSValBuilder, a basic implementation of SValBuilder.
12 //===----------------------------------------------------------------------===//
14 #include "clang/StaticAnalyzer/PathSensitive/SValBuilder.h"
15 #include "clang/StaticAnalyzer/PathSensitive/GRState.h"
17 using namespace clang
;
21 class SimpleSValBuilder
: public SValBuilder
{
23 virtual SVal
evalCastNL(NonLoc val
, QualType castTy
);
24 virtual SVal
evalCastL(Loc val
, QualType castTy
);
27 SimpleSValBuilder(llvm::BumpPtrAllocator
&alloc
, ASTContext
&context
,
28 GRStateManager
&stateMgr
)
29 : SValBuilder(alloc
, context
, stateMgr
) {}
30 virtual ~SimpleSValBuilder() {}
32 virtual SVal
evalMinus(NonLoc val
);
33 virtual SVal
evalComplement(NonLoc val
);
34 virtual SVal
evalBinOpNN(const GRState
*state
, BinaryOperator::Opcode op
,
35 NonLoc lhs
, NonLoc rhs
, QualType resultTy
);
36 virtual SVal
evalBinOpLL(const GRState
*state
, BinaryOperator::Opcode op
,
37 Loc lhs
, Loc rhs
, QualType resultTy
);
38 virtual SVal
evalBinOpLN(const GRState
*state
, BinaryOperator::Opcode op
,
39 Loc lhs
, NonLoc rhs
, QualType resultTy
);
41 /// getKnownValue - evaluates a given SVal. If the SVal has only one possible
42 /// (integer) value, that value is returned. Otherwise, returns NULL.
43 virtual const llvm::APSInt
*getKnownValue(const GRState
*state
, SVal V
);
45 SVal
MakeSymIntVal(const SymExpr
*LHS
, BinaryOperator::Opcode op
,
46 const llvm::APSInt
&RHS
, QualType resultTy
);
48 } // end anonymous namespace
50 SValBuilder
*ento::createSimpleSValBuilder(llvm::BumpPtrAllocator
&alloc
,
52 GRStateManager
&stateMgr
) {
53 return new SimpleSValBuilder(alloc
, context
, stateMgr
);
56 //===----------------------------------------------------------------------===//
57 // Transfer function for Casts.
58 //===----------------------------------------------------------------------===//
60 SVal
SimpleSValBuilder::evalCastNL(NonLoc val
, QualType castTy
) {
62 bool isLocType
= Loc::IsLocType(castTy
);
64 if (nonloc::LocAsInteger
*LI
= dyn_cast
<nonloc::LocAsInteger
>(&val
)) {
68 // FIXME: Correctly support promotions/truncations.
69 unsigned castSize
= Context
.getTypeSize(castTy
);
70 if (castSize
== LI
->getNumBits())
72 return makeLocAsInteger(LI
->getLoc(), castSize
);
75 if (const SymExpr
*se
= val
.getAsSymbolicExpression()) {
76 QualType T
= Context
.getCanonicalType(se
->getType(Context
));
77 if (T
== Context
.getCanonicalType(castTy
))
80 // FIXME: Remove this hack when we support symbolic truncation/extension.
81 // HACK: If both castTy and T are integers, ignore the cast. This is
82 // not a permanent solution. Eventually we want to precisely handle
83 // extension/truncation of symbolic integers. This prevents us from losing
84 // precision when we assign 'x = y' and 'y' is symbolic and x and y are
85 // different integer types.
86 if (T
->isIntegerType() && castTy
->isIntegerType())
92 if (!isa
<nonloc::ConcreteInt
>(val
))
95 // Only handle casts from integers to integers.
96 if (!isLocType
&& !castTy
->isIntegerType())
99 llvm::APSInt i
= cast
<nonloc::ConcreteInt
>(val
).getValue();
100 i
.setIsUnsigned(castTy
->isUnsignedIntegerType() || Loc::IsLocType(castTy
));
101 i
= i
.extOrTrunc(Context
.getTypeSize(castTy
));
104 return makeIntLocVal(i
);
106 return makeIntVal(i
);
109 SVal
SimpleSValBuilder::evalCastL(Loc val
, QualType castTy
) {
111 // Casts from pointers -> pointers, just return the lval.
113 // Casts from pointers -> references, just return the lval. These
114 // can be introduced by the frontend for corner cases, e.g
115 // casting from va_list* to __builtin_va_list&.
117 if (Loc::IsLocType(castTy
) || castTy
->isReferenceType())
120 // FIXME: Handle transparent unions where a value can be "transparently"
121 // lifted into a union type.
122 if (castTy
->isUnionType())
125 if (castTy
->isIntegerType()) {
126 unsigned BitWidth
= Context
.getTypeSize(castTy
);
128 if (!isa
<loc::ConcreteInt
>(val
))
129 return makeLocAsInteger(val
, BitWidth
);
131 llvm::APSInt i
= cast
<loc::ConcreteInt
>(val
).getValue();
132 i
.setIsUnsigned(castTy
->isUnsignedIntegerType() || Loc::IsLocType(castTy
));
133 i
= i
.extOrTrunc(BitWidth
);
134 return makeIntVal(i
);
137 // All other cases: return 'UnknownVal'. This includes casting pointers
138 // to floats, which is probably badness it itself, but this is a good
139 // intermediate solution until we do something better.
143 //===----------------------------------------------------------------------===//
144 // Transfer function for unary operators.
145 //===----------------------------------------------------------------------===//
147 SVal
SimpleSValBuilder::evalMinus(NonLoc val
) {
148 switch (val
.getSubKind()) {
149 case nonloc::ConcreteIntKind
:
150 return cast
<nonloc::ConcreteInt
>(val
).evalMinus(*this);
156 SVal
SimpleSValBuilder::evalComplement(NonLoc X
) {
157 switch (X
.getSubKind()) {
158 case nonloc::ConcreteIntKind
:
159 return cast
<nonloc::ConcreteInt
>(X
).evalComplement(*this);
165 //===----------------------------------------------------------------------===//
166 // Transfer function for binary operators.
167 //===----------------------------------------------------------------------===//
169 static BinaryOperator::Opcode
NegateComparison(BinaryOperator::Opcode op
) {
172 assert(false && "Invalid opcode.");
173 case BO_LT
: return BO_GE
;
174 case BO_GT
: return BO_LE
;
175 case BO_LE
: return BO_GT
;
176 case BO_GE
: return BO_LT
;
177 case BO_EQ
: return BO_NE
;
178 case BO_NE
: return BO_EQ
;
182 static BinaryOperator::Opcode
ReverseComparison(BinaryOperator::Opcode op
) {
185 assert(false && "Invalid opcode.");
186 case BO_LT
: return BO_GT
;
187 case BO_GT
: return BO_LT
;
188 case BO_LE
: return BO_GE
;
189 case BO_GE
: return BO_LE
;
196 SVal
SimpleSValBuilder::MakeSymIntVal(const SymExpr
*LHS
,
197 BinaryOperator::Opcode op
,
198 const llvm::APSInt
&RHS
,
200 bool isIdempotent
= false;
202 // Check for a few special cases with known reductions first.
205 // We can't reduce this case; just treat it normally.
210 return makeIntVal(0, resultTy
);
217 // This is also handled elsewhere.
218 return UndefinedVal();
225 // This is also handled elsewhere.
226 return UndefinedVal();
228 return makeIntVal(0, resultTy
);
235 // a+0, a-0, a<<0, a>>0, a^0
242 return makeIntVal(0, resultTy
);
243 else if (RHS
.isAllOnesValue())
250 else if (RHS
.isAllOnesValue()) {
251 const llvm::APSInt
&Result
= BasicVals
.Convert(resultTy
, RHS
);
252 return nonloc::ConcreteInt(Result
);
257 // Idempotent ops (like a*1) can still change the type of an expression.
258 // Wrap the LHS up in a NonLoc again and let evalCastNL do the dirty work.
260 if (SymbolRef LHSSym
= dyn_cast
<SymbolData
>(LHS
))
261 return evalCastNL(nonloc::SymbolVal(LHSSym
), resultTy
);
262 return evalCastNL(nonloc::SymExprVal(LHS
), resultTy
);
265 // If we reach this point, the expression cannot be simplified.
266 // Make a SymExprVal for the entire thing.
267 return makeNonLoc(LHS
, op
, RHS
, resultTy
);
270 SVal
SimpleSValBuilder::evalBinOpNN(const GRState
*state
,
271 BinaryOperator::Opcode op
,
272 NonLoc lhs
, NonLoc rhs
,
274 // Handle trivial case where left-side and right-side are the same.
282 return makeTruthVal(true, resultTy
);
286 return makeTruthVal(false, resultTy
);
289 return makeIntVal(0, resultTy
);
292 return evalCastNL(lhs
, resultTy
);
296 switch (lhs
.getSubKind()) {
299 case nonloc::LocAsIntegerKind
: {
300 Loc lhsL
= cast
<nonloc::LocAsInteger
>(lhs
).getLoc();
301 switch (rhs
.getSubKind()) {
302 case nonloc::LocAsIntegerKind
:
303 return evalBinOpLL(state
, op
, lhsL
,
304 cast
<nonloc::LocAsInteger
>(rhs
).getLoc(),
306 case nonloc::ConcreteIntKind
: {
307 // Transform the integer into a location and compare.
308 llvm::APSInt i
= cast
<nonloc::ConcreteInt
>(rhs
).getValue();
309 i
.setIsUnsigned(true);
310 i
= i
.extOrTrunc(Context
.getTypeSize(Context
.VoidPtrTy
));
311 return evalBinOpLL(state
, op
, lhsL
, makeLoc(i
), resultTy
);
316 return makeTruthVal(false, resultTy
);
318 return makeTruthVal(true, resultTy
);
320 // This case also handles pointer arithmetic.
325 case nonloc::SymExprValKind
: {
326 nonloc::SymExprVal
*selhs
= cast
<nonloc::SymExprVal
>(&lhs
);
328 // Only handle LHS of the form "$sym op constant", at least for now.
329 const SymIntExpr
*symIntExpr
=
330 dyn_cast
<SymIntExpr
>(selhs
->getSymbolicExpression());
335 // Is this a logical not? (!x is represented as x == 0.)
336 if (op
== BO_EQ
&& rhs
.isZeroConstant()) {
337 // We know how to negate certain expressions. Simplify them here.
339 BinaryOperator::Opcode opc
= symIntExpr
->getOpcode();
342 // We don't know how to negate this operation.
343 // Just handle it as if it were a normal comparison to 0.
347 assert(false && "Logical operators handled by branching logic.");
361 assert(false && "'=' and ',' operators handled by ExprEngine.");
365 assert(false && "Pointer arithmetic not handled here.");
373 // Negate the comparison and make a value.
374 opc
= NegateComparison(opc
);
375 assert(symIntExpr
->getType(Context
) == resultTy
);
376 return makeNonLoc(symIntExpr
->getLHS(), opc
,
377 symIntExpr
->getRHS(), resultTy
);
381 // For now, only handle expressions whose RHS is a constant.
382 const nonloc::ConcreteInt
*rhsInt
= dyn_cast
<nonloc::ConcreteInt
>(&rhs
);
386 // If both the LHS and the current expression are additive,
387 // fold their constants.
388 if (BinaryOperator::isAdditiveOp(op
)) {
389 BinaryOperator::Opcode lop
= symIntExpr
->getOpcode();
390 if (BinaryOperator::isAdditiveOp(lop
)) {
391 // resultTy may not be the best type to convert to, but it's
392 // probably the best choice in expressions with mixed type
393 // (such as x+1U+2LL). The rules for implicit conversions should
394 // choose a reasonable type to preserve the expression, and will
395 // at least match how the value is going to be used.
396 const llvm::APSInt
&first
=
397 BasicVals
.Convert(resultTy
, symIntExpr
->getRHS());
398 const llvm::APSInt
&second
=
399 BasicVals
.Convert(resultTy
, rhsInt
->getValue());
400 const llvm::APSInt
*newRHS
;
402 newRHS
= BasicVals
.evalAPSInt(BO_Add
, first
, second
);
404 newRHS
= BasicVals
.evalAPSInt(BO_Sub
, first
, second
);
405 return MakeSymIntVal(symIntExpr
->getLHS(), lop
, *newRHS
, resultTy
);
409 // Otherwise, make a SymExprVal out of the expression.
410 return MakeSymIntVal(symIntExpr
, op
, rhsInt
->getValue(), resultTy
);
412 case nonloc::ConcreteIntKind
: {
413 const nonloc::ConcreteInt
& lhsInt
= cast
<nonloc::ConcreteInt
>(lhs
);
415 if (isa
<nonloc::ConcreteInt
>(rhs
)) {
416 return lhsInt
.evalBinOp(*this, op
, cast
<nonloc::ConcreteInt
>(rhs
));
418 const llvm::APSInt
& lhsValue
= lhsInt
.getValue();
420 // Swap the left and right sides and flip the operator if doing so
421 // allows us to better reason about the expression (this is a form
422 // of expression canonicalization).
423 // While we're at it, catch some special cases for non-commutative ops.
433 op
= ReverseComparison(op
);
444 if (lhsValue
.isAllOnesValue() && lhsValue
.isSigned())
445 // At this point lhs and rhs have been swapped.
450 // At this point lhs and rhs have been swapped.
458 case nonloc::SymbolValKind
: {
459 nonloc::SymbolVal
*slhs
= cast
<nonloc::SymbolVal
>(&lhs
);
460 SymbolRef Sym
= slhs
->getSymbol();
461 // Does the symbol simplify to a constant? If so, "fold" the constant
462 // by setting 'lhs' to a ConcreteInt and try again.
463 if (Sym
->getType(Context
)->isIntegerType())
464 if (const llvm::APSInt
*Constant
= state
->getSymVal(Sym
)) {
465 // The symbol evaluates to a constant. If necessary, promote the
466 // folded constant (LHS) to the result type.
467 const llvm::APSInt
&lhs_I
= BasicVals
.Convert(resultTy
, *Constant
);
468 lhs
= nonloc::ConcreteInt(lhs_I
);
470 // Also promote the RHS (if necessary).
472 // For shifts, it is not necessary to promote the RHS.
473 if (BinaryOperator::isShiftOp(op
))
476 // Other operators: do an implicit conversion. This shouldn't be
477 // necessary once we support truncation/extension of symbolic values.
478 if (nonloc::ConcreteInt
*rhs_I
= dyn_cast
<nonloc::ConcreteInt
>(&rhs
)){
479 rhs
= nonloc::ConcreteInt(BasicVals
.Convert(resultTy
,
486 // Is the RHS a symbol we can simplify?
487 if (const nonloc::SymbolVal
*srhs
= dyn_cast
<nonloc::SymbolVal
>(&rhs
)) {
488 SymbolRef RSym
= srhs
->getSymbol();
489 if (RSym
->getType(Context
)->isIntegerType()) {
490 if (const llvm::APSInt
*Constant
= state
->getSymVal(RSym
)) {
491 // The symbol evaluates to a constant.
492 const llvm::APSInt
&rhs_I
= BasicVals
.Convert(resultTy
, *Constant
);
493 rhs
= nonloc::ConcreteInt(rhs_I
);
498 if (isa
<nonloc::ConcreteInt
>(rhs
)) {
499 return MakeSymIntVal(slhs
->getSymbol(), op
,
500 cast
<nonloc::ConcreteInt
>(rhs
).getValue(),
510 // FIXME: all this logic will change if/when we have MemRegion::getLocation().
511 SVal
SimpleSValBuilder::evalBinOpLL(const GRState
*state
,
512 BinaryOperator::Opcode op
,
515 // Only comparisons and subtractions are valid operations on two pointers.
516 // See [C99 6.5.5 through 6.5.14] or [C++0x 5.6 through 5.15].
517 // However, if a pointer is casted to an integer, evalBinOpNN may end up
518 // calling this function with another operation (PR7527). We don't attempt to
519 // model this for now, but it could be useful, particularly when the
520 // "location" is actually an integer value that's been passed through a void*.
521 if (!(BinaryOperator::isComparisonOp(op
) || op
== BO_Sub
))
524 // Special cases for when both sides are identical.
528 assert(false && "Unimplemented operation for two identical values");
531 return makeZeroVal(resultTy
);
535 return makeTruthVal(true, resultTy
);
539 return makeTruthVal(false, resultTy
);
543 switch (lhs
.getSubKind()) {
545 assert(false && "Ordering not implemented for this Loc.");
548 case loc::GotoLabelKind
:
549 // The only thing we know about labels is that they're non-null.
550 if (rhs
.isZeroConstant()) {
555 return evalCastL(lhs
, resultTy
);
559 return makeTruthVal(false, resultTy
);
563 return makeTruthVal(true, resultTy
);
566 // There may be two labels for the same location, and a function region may
567 // have the same address as a label at the start of the function (depending
569 // FIXME: we can probably do a comparison against other MemRegions, though.
570 // FIXME: is there a way to tell if two labels refer to the same location?
573 case loc::ConcreteIntKind
: {
574 // If one of the operands is a symbol and the other is a constant,
575 // build an expression for use by the constraint manager.
576 if (SymbolRef rSym
= rhs
.getAsLocSymbol()) {
577 // We can only build expressions with symbols on the left,
578 // so we need a reversible operator.
579 if (!BinaryOperator::isComparisonOp(op
))
582 const llvm::APSInt
&lVal
= cast
<loc::ConcreteInt
>(lhs
).getValue();
583 return makeNonLoc(rSym
, ReverseComparison(op
), lVal
, resultTy
);
586 // If both operands are constants, just perform the operation.
587 if (loc::ConcreteInt
*rInt
= dyn_cast
<loc::ConcreteInt
>(&rhs
)) {
588 SVal ResultVal
= cast
<loc::ConcreteInt
>(lhs
).evalBinOp(BasicVals
, op
,
590 if (Loc
*Result
= dyn_cast
<Loc
>(&ResultVal
))
591 return evalCastL(*Result
, resultTy
);
596 // Special case comparisons against NULL.
597 // This must come after the test if the RHS is a symbol, which is used to
598 // build constraints. The address of any non-symbolic region is guaranteed
599 // to be non-NULL, as is any label.
600 assert(isa
<loc::MemRegionVal
>(rhs
) || isa
<loc::GotoLabel
>(rhs
));
601 if (lhs
.isZeroConstant()) {
608 return makeTruthVal(false, resultTy
);
612 return makeTruthVal(true, resultTy
);
616 // Comparing an arbitrary integer to a region or label address is
617 // completely unknowable.
620 case loc::MemRegionKind
: {
621 if (loc::ConcreteInt
*rInt
= dyn_cast
<loc::ConcreteInt
>(&rhs
)) {
622 // If one of the operands is a symbol and the other is a constant,
623 // build an expression for use by the constraint manager.
624 if (SymbolRef lSym
= lhs
.getAsLocSymbol())
625 return MakeSymIntVal(lSym
, op
, rInt
->getValue(), resultTy
);
627 // Special case comparisons to NULL.
628 // This must come after the test if the LHS is a symbol, which is used to
629 // build constraints. The address of any non-symbolic region is guaranteed
631 if (rInt
->isZeroConstant()) {
636 return evalCastL(lhs
, resultTy
);
640 return makeTruthVal(false, resultTy
);
644 return makeTruthVal(true, resultTy
);
648 // Comparing a region to an arbitrary integer is completely unknowable.
652 // Get both values as regions, if possible.
653 const MemRegion
*LeftMR
= lhs
.getAsRegion();
654 assert(LeftMR
&& "MemRegionKind SVal doesn't have a region!");
656 const MemRegion
*RightMR
= rhs
.getAsRegion();
658 // The RHS is probably a label, which in theory could address a region.
659 // FIXME: we can probably make a more useful statement about non-code
663 // If both values wrap regions, see if they're from different base regions.
664 const MemRegion
*LeftBase
= LeftMR
->getBaseRegion();
665 const MemRegion
*RightBase
= RightMR
->getBaseRegion();
666 if (LeftBase
!= RightBase
&&
667 !isa
<SymbolicRegion
>(LeftBase
) && !isa
<SymbolicRegion
>(RightBase
)) {
672 return makeTruthVal(false, resultTy
);
674 return makeTruthVal(true, resultTy
);
678 // The two regions are from the same base region. See if they're both a
679 // type of region we know how to compare.
681 // FIXME: If/when there is a getAsRawOffset() for FieldRegions, this
682 // ElementRegion path and the FieldRegion path below should be unified.
683 if (const ElementRegion
*LeftER
= dyn_cast
<ElementRegion
>(LeftMR
)) {
684 // First see if the right region is also an ElementRegion.
685 const ElementRegion
*RightER
= dyn_cast
<ElementRegion
>(RightMR
);
689 // Next, see if the two ERs have the same super-region and matching types.
690 // FIXME: This should do something useful even if the types don't match,
691 // though if both indexes are constant the RegionRawOffset path will
692 // give the correct answer.
693 if (LeftER
->getSuperRegion() == RightER
->getSuperRegion() &&
694 LeftER
->getElementType() == RightER
->getElementType()) {
695 // Get the left index and cast it to the correct type.
696 // If the index is unknown or undefined, bail out here.
697 SVal LeftIndexVal
= LeftER
->getIndex();
698 NonLoc
*LeftIndex
= dyn_cast
<NonLoc
>(&LeftIndexVal
);
701 LeftIndexVal
= evalCastNL(*LeftIndex
, resultTy
);
702 LeftIndex
= dyn_cast
<NonLoc
>(&LeftIndexVal
);
706 // Do the same for the right index.
707 SVal RightIndexVal
= RightER
->getIndex();
708 NonLoc
*RightIndex
= dyn_cast
<NonLoc
>(&RightIndexVal
);
711 RightIndexVal
= evalCastNL(*RightIndex
, resultTy
);
712 RightIndex
= dyn_cast
<NonLoc
>(&RightIndexVal
);
716 // Actually perform the operation.
717 // evalBinOpNN expects the two indexes to already be the right type.
718 return evalBinOpNN(state
, op
, *LeftIndex
, *RightIndex
, resultTy
);
721 // If the element indexes aren't comparable, see if the raw offsets are.
722 RegionRawOffset LeftOffset
= LeftER
->getAsArrayOffset();
723 RegionRawOffset RightOffset
= RightER
->getAsArrayOffset();
725 if (LeftOffset
.getRegion() != NULL
&&
726 LeftOffset
.getRegion() == RightOffset
.getRegion()) {
727 CharUnits left
= LeftOffset
.getOffset();
728 CharUnits right
= RightOffset
.getOffset();
734 return makeTruthVal(left
< right
, resultTy
);
736 return makeTruthVal(left
> right
, resultTy
);
738 return makeTruthVal(left
<= right
, resultTy
);
740 return makeTruthVal(left
>= right
, resultTy
);
742 return makeTruthVal(left
== right
, resultTy
);
744 return makeTruthVal(left
!= right
, resultTy
);
748 // If we get here, we have no way of comparing the ElementRegions.
752 // See if both regions are fields of the same structure.
753 // FIXME: This doesn't handle nesting, inheritance, or Objective-C ivars.
754 if (const FieldRegion
*LeftFR
= dyn_cast
<FieldRegion
>(LeftMR
)) {
755 // Only comparisons are meaningful here!
756 if (!BinaryOperator::isComparisonOp(op
))
759 // First see if the right region is also a FieldRegion.
760 const FieldRegion
*RightFR
= dyn_cast
<FieldRegion
>(RightMR
);
764 // Next, see if the two FRs have the same super-region.
765 // FIXME: This doesn't handle casts yet, and simply stripping the casts
767 if (LeftFR
->getSuperRegion() != RightFR
->getSuperRegion())
770 const FieldDecl
*LeftFD
= LeftFR
->getDecl();
771 const FieldDecl
*RightFD
= RightFR
->getDecl();
772 const RecordDecl
*RD
= LeftFD
->getParent();
774 // Make sure the two FRs are from the same kind of record. Just in case!
775 // FIXME: This is probably where inheritance would be a problem.
776 if (RD
!= RightFD
->getParent())
779 // We know for sure that the two fields are not the same, since that
780 // would have given us the same SVal.
782 return makeTruthVal(false, resultTy
);
784 return makeTruthVal(true, resultTy
);
786 // Iterate through the fields and see which one comes first.
787 // [C99 6.7.2.1.13] "Within a structure object, the non-bit-field
788 // members and the units in which bit-fields reside have addresses that
789 // increase in the order in which they are declared."
790 bool leftFirst
= (op
== BO_LT
|| op
== BO_LE
);
791 for (RecordDecl::field_iterator I
= RD
->field_begin(),
792 E
= RD
->field_end(); I
!=E
; ++I
) {
794 return makeTruthVal(leftFirst
, resultTy
);
796 return makeTruthVal(!leftFirst
, resultTy
);
799 assert(false && "Fields not found in parent record's definition");
802 // If we get here, we have no way of comparing the regions.
808 SVal
SimpleSValBuilder::evalBinOpLN(const GRState
*state
,
809 BinaryOperator::Opcode op
,
810 Loc lhs
, NonLoc rhs
, QualType resultTy
) {
812 // Special case: rhs is a zero constant.
813 if (rhs
.isZeroConstant())
816 // Special case: 'rhs' is an integer that has the same width as a pointer and
817 // we are using the integer location in a comparison. Normally this cannot be
818 // triggered, but transfer functions like those for OSCommpareAndSwapBarrier32
819 // can generate comparisons that trigger this code.
820 // FIXME: Are all locations guaranteed to have pointer width?
821 if (BinaryOperator::isComparisonOp(op
)) {
822 if (nonloc::ConcreteInt
*rhsInt
= dyn_cast
<nonloc::ConcreteInt
>(&rhs
)) {
823 const llvm::APSInt
*x
= &rhsInt
->getValue();
824 ASTContext
&ctx
= Context
;
825 if (ctx
.getTypeSize(ctx
.VoidPtrTy
) == x
->getBitWidth()) {
826 // Convert the signedness of the integer (if necessary).
828 x
= &getBasicValueFactory().getValue(*x
, true);
830 return evalBinOpLL(state
, op
, lhs
, loc::ConcreteInt(*x
), resultTy
);
835 // We are dealing with pointer arithmetic.
837 // Handle pointer arithmetic on constant values.
838 if (nonloc::ConcreteInt
*rhsInt
= dyn_cast
<nonloc::ConcreteInt
>(&rhs
)) {
839 if (loc::ConcreteInt
*lhsInt
= dyn_cast
<loc::ConcreteInt
>(&lhs
)) {
840 const llvm::APSInt
&leftI
= lhsInt
->getValue();
841 assert(leftI
.isUnsigned());
842 llvm::APSInt
rightI(rhsInt
->getValue(), /* isUnsigned */ true);
844 // Convert the bitwidth of rightI. This should deal with overflow
845 // since we are dealing with concrete values.
846 rightI
= rightI
.extOrTrunc(leftI
.getBitWidth());
848 // Offset the increment by the pointer size.
849 llvm::APSInt
Multiplicand(rightI
.getBitWidth(), /* isUnsigned */ true);
850 rightI
*= Multiplicand
;
852 // Compute the adjusted pointer.
855 rightI
= leftI
+ rightI
;
858 rightI
= leftI
- rightI
;
861 llvm_unreachable("Invalid pointer arithmetic operation");
863 return loc::ConcreteInt(getBasicValueFactory().getValue(rightI
));
867 // Handle cases where 'lhs' is a region.
868 if (const MemRegion
*region
= lhs
.getAsRegion()) {
869 rhs
= cast
<NonLoc
>(convertToArrayIndex(rhs
));
870 SVal index
= UnknownVal();
871 const MemRegion
*superR
= 0;
872 QualType elementType
;
874 if (const ElementRegion
*elemReg
= dyn_cast
<ElementRegion
>(region
)) {
875 index
= evalBinOpNN(state
, BO_Add
, elemReg
->getIndex(), rhs
,
876 getArrayIndexType());
877 superR
= elemReg
->getSuperRegion();
878 elementType
= elemReg
->getElementType();
880 else if (isa
<SubRegion
>(region
)) {
883 if (const PointerType
*PT
= resultTy
->getAs
<PointerType
>()) {
884 elementType
= PT
->getPointeeType();
887 const ObjCObjectPointerType
*OT
=
888 resultTy
->getAs
<ObjCObjectPointerType
>();
889 elementType
= OT
->getPointeeType();
893 if (NonLoc
*indexV
= dyn_cast
<NonLoc
>(&index
)) {
894 return loc::MemRegionVal(MemMgr
.getElementRegion(elementType
, *indexV
,
895 superR
, getContext()));
901 const llvm::APSInt
*SimpleSValBuilder::getKnownValue(const GRState
*state
,
903 if (V
.isUnknownOrUndef())
906 if (loc::ConcreteInt
* X
= dyn_cast
<loc::ConcreteInt
>(&V
))
907 return &X
->getValue();
909 if (nonloc::ConcreteInt
* X
= dyn_cast
<nonloc::ConcreteInt
>(&V
))
910 return &X
->getValue();
912 if (SymbolRef Sym
= V
.getAsSymbol())
913 return state
->getSymVal(Sym
);
915 // FIXME: Add support for SymExprs.