1 // SValuator.cpp - Basic class for all SValuator implementations --*- C++ -*--//
3 // The LLVM Compiler Infrastructure
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
8 //===----------------------------------------------------------------------===//
10 // This file defines SValuator, the base class for all (complete) SValuator
13 //===----------------------------------------------------------------------===//
15 #include "clang/Checker/PathSensitive/SValuator.h"
16 #include "clang/Checker/PathSensitive/GRState.h"
18 using namespace clang
;
21 SVal
SValuator::EvalBinOp(const GRState
*ST
, BinaryOperator::Opcode Op
,
22 SVal L
, SVal R
, QualType T
) {
24 if (L
.isUndef() || R
.isUndef())
25 return UndefinedVal();
27 if (L
.isUnknown() || R
.isUnknown())
32 return EvalBinOpLL(ST
, Op
, cast
<Loc
>(L
), cast
<Loc
>(R
), T
);
34 return EvalBinOpLN(ST
, Op
, cast
<Loc
>(L
), cast
<NonLoc
>(R
), T
);
38 // Support pointer arithmetic where the addend is on the left
39 // and the pointer on the right.
42 // Commute the operands.
43 return EvalBinOpLN(ST
, Op
, cast
<Loc
>(R
), cast
<NonLoc
>(L
), T
);
46 return EvalBinOpNN(ST
, Op
, cast
<NonLoc
>(L
), cast
<NonLoc
>(R
), T
);
49 DefinedOrUnknownSVal
SValuator::EvalEQ(const GRState
*ST
,
50 DefinedOrUnknownSVal L
,
51 DefinedOrUnknownSVal R
) {
52 return cast
<DefinedOrUnknownSVal
>(EvalBinOp(ST
, BO_EQ
, L
, R
,
53 ValMgr
.getContext().IntTy
));
56 SVal
SValuator::EvalCast(SVal val
, QualType castTy
, QualType originalTy
) {
57 if (val
.isUnknownOrUndef() || castTy
== originalTy
)
60 ASTContext
&C
= ValMgr
.getContext();
62 // For const casts, just propagate the value.
63 if (!castTy
->isVariableArrayType() && !originalTy
->isVariableArrayType())
64 if (C
.hasSameUnqualifiedType(castTy
, originalTy
))
67 // Check for casts to real or complex numbers. We don't handle these at all
69 if (castTy
->isFloatingType() || castTy
->isAnyComplexType())
72 // Check for casts from integers to integers.
73 if (castTy
->isIntegerType() && originalTy
->isIntegerType())
74 return EvalCastNL(cast
<NonLoc
>(val
), castTy
);
76 // Check for casts from pointers to integers.
77 if (castTy
->isIntegerType() && Loc::IsLocType(originalTy
))
78 return EvalCastL(cast
<Loc
>(val
), castTy
);
80 // Check for casts from integers to pointers.
81 if (Loc::IsLocType(castTy
) && originalTy
->isIntegerType()) {
82 if (nonloc::LocAsInteger
*LV
= dyn_cast
<nonloc::LocAsInteger
>(&val
)) {
83 if (const MemRegion
*R
= LV
->getLoc().getAsRegion()) {
84 StoreManager
&storeMgr
= ValMgr
.getStateManager().getStoreManager();
85 R
= storeMgr
.CastRegion(R
, castTy
);
86 return R
? SVal(loc::MemRegionVal(R
)) : UnknownVal();
93 // Just pass through function and block pointers.
94 if (originalTy
->isBlockPointerType() || originalTy
->isFunctionPointerType()) {
95 assert(Loc::IsLocType(castTy
));
99 // Check for casts from array type to another type.
100 if (originalTy
->isArrayType()) {
101 // We will always decay to a pointer.
102 val
= ValMgr
.getStateManager().ArrayToPointer(cast
<Loc
>(val
));
104 // Are we casting from an array to a pointer? If so just pass on
105 // the decayed value.
106 if (castTy
->isPointerType())
109 // Are we casting from an array to an integer? If so, cast the decayed
110 // pointer value to an integer.
111 assert(castTy
->isIntegerType());
113 // FIXME: Keep these here for now in case we decide soon that we
114 // need the original decayed type.
115 // QualType elemTy = cast<ArrayType>(originalTy)->getElementType();
116 // QualType pointerTy = C.getPointerType(elemTy);
117 return EvalCastL(cast
<Loc
>(val
), castTy
);
120 // Check for casts from a region to a specific type.
121 if (const MemRegion
*R
= val
.getAsRegion()) {
122 // FIXME: We should handle the case where we strip off view layers to get
123 // to a desugared type.
125 if (!Loc::IsLocType(castTy
)) {
126 // FIXME: There can be gross cases where one casts the result of a function
127 // (that returns a pointer) to some other value that happens to fit
128 // within that pointer value. We currently have no good way to
129 // model such operations. When this happens, the underlying operation
130 // is that the caller is reasoning about bits. Conceptually we are
131 // layering a "view" of a location on top of those bits. Perhaps
132 // we need to be more lazy about mutual possible views, even on an
133 // SVal? This may be necessary for bit-level reasoning as well.
137 // We get a symbolic function pointer for a dereference of a function
138 // pointer, but it is of function type. Example:
141 // void (*my_func)(int * x);
146 // int f1_a(struct FPRec* foo) {
148 // (*foo->my_func)(&x);
149 // return bar(x)+1; // no-warning
152 assert(Loc::IsLocType(originalTy
) || originalTy
->isFunctionType() ||
153 originalTy
->isBlockPointerType());
155 StoreManager
&storeMgr
= ValMgr
.getStateManager().getStoreManager();
157 // Delegate to store manager to get the result of casting a region to a
158 // different type. If the MemRegion* returned is NULL, this expression
159 // evaluates to UnknownVal.
160 R
= storeMgr
.CastRegion(R
, castTy
);
161 return R
? SVal(loc::MemRegionVal(R
)) : UnknownVal();
166 return isa
<Loc
>(val
) ? EvalCastL(cast
<Loc
>(val
), castTy
)
167 : EvalCastNL(cast
<NonLoc
>(val
), castTy
);