2008-10-08 10:50:44 +08:00
|
|
|
//== RegionStore.cpp - Field-sensitive store model --------------*- C++ -*--==//
|
|
|
|
//
|
2019-01-19 16:50:56 +08:00
|
|
|
// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
|
|
|
|
// See https://llvm.org/LICENSE.txt for license information.
|
|
|
|
// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
|
2008-10-08 10:50:44 +08:00
|
|
|
//
|
|
|
|
//===----------------------------------------------------------------------===//
|
|
|
|
//
|
|
|
|
// This file defines a basic region store model. In this model, we do have field
|
|
|
|
// sensitivity. But we assume nothing about the heap shape. So recursive data
|
|
|
|
// structures are largely ignored. Basically we do 1-limiting analysis.
|
|
|
|
// Parameter pointers are assumed with no aliasing. Pointee objects of
|
|
|
|
// parameters are created lazily.
|
|
|
|
//
|
|
|
|
//===----------------------------------------------------------------------===//
|
2016-05-27 22:27:13 +08:00
|
|
|
|
2012-12-01 23:09:41 +08:00
|
|
|
#include "clang/AST/Attr.h"
|
2010-01-18 16:54:31 +08:00
|
|
|
#include "clang/AST/CharUnits.h"
|
2018-08-11 02:28:04 +08:00
|
|
|
#include "clang/ASTMatchers/ASTMatchFinder.h"
|
2010-04-10 04:26:58 +08:00
|
|
|
#include "clang/Analysis/Analyses/LiveVariables.h"
|
2017-09-07 05:45:03 +08:00
|
|
|
#include "clang/Analysis/AnalysisDeclContext.h"
|
2019-05-29 23:25:19 +08:00
|
|
|
#include "clang/Basic/JsonSupport.h"
|
2010-04-10 04:26:58 +08:00
|
|
|
#include "clang/Basic/TargetInfo.h"
|
[analyzer] "Force" LazyCompoundVals on bind when they are simple enough.
The analyzer uses LazyCompoundVals to represent rvalues of aggregate types,
most importantly structs and arrays. This allows us to efficiently copy
around an entire struct, rather than doing a memberwise load every time a
struct rvalue is encountered. This can also keep memory usage down by
allowing several structs to "share" the same snapshotted bindings.
However, /lookup/ through LazyCompoundVals can be expensive, especially
since they can end up chaining back to the original value. While we try
to reuse LazyCompoundVals whenever it's safe, and cache information about
this transitivity, the fact is it's sometimes just not a good idea to
perpetuate LazyCompoundVals -- the tradeoffs just aren't worth it.
This commit changes RegionStore so that binding a LazyCompoundVal to struct
will do a memberwise copy if the struct is simple enough. Today's definition
of "simple enough" is "up to N scalar members" (see below), but that could
easily be changed in the future. This is enough to bring the test case in
PR15697 back down to a manageable analysis time (within 20% of its original
time, in an unfair test where the new analyzer is not compiled with LTO).
The actual value of "N" is controlled by a new -analyzer-config option,
'region-store-small-struct-limit'. It defaults to "2", meaning structs with
zero, one, or two scalar members will be considered "simple enough" for
this code path.
It's worth noting that a more straightforward implementation would do this
on load, not on bind, and make use of the structure we already have for this:
CompoundVal. A long time ago, this was actually how RegionStore modeled
aggregate-to-aggregate copies, but today it's only used for compound literals.
Unfortunately, it seems that we've special-cased LazyCompoundVal in certain
places (such as liveness checks) but failed to similarly special-case
CompoundVal in all of them. Until we're confident that CompoundVal is
handled properly everywhere, this solution is safer, since the entire
optimization is just an implementation detail of RegionStore.
<rdar://problem/13599304>
llvm-svn: 179767
2013-04-19 00:33:46 +08:00
|
|
|
#include "clang/StaticAnalyzer/Core/PathSensitive/AnalysisManager.h"
|
2012-07-27 05:39:41 +08:00
|
|
|
#include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
|
2020-05-26 19:48:20 +08:00
|
|
|
#include "clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h"
|
2012-12-01 23:09:41 +08:00
|
|
|
#include "clang/StaticAnalyzer/Core/PathSensitive/MemRegion.h"
|
2011-08-16 06:09:50 +08:00
|
|
|
#include "clang/StaticAnalyzer/Core/PathSensitive/ProgramState.h"
|
|
|
|
#include "clang/StaticAnalyzer/Core/PathSensitive/ProgramStateTrait.h"
|
2010-04-10 04:26:58 +08:00
|
|
|
#include "llvm/ADT/ImmutableMap.h"
|
|
|
|
#include "llvm/ADT/Optional.h"
|
2008-10-24 14:01:33 +08:00
|
|
|
#include "llvm/Support/raw_ostream.h"
|
2016-05-27 22:27:13 +08:00
|
|
|
#include <utility>
|
2008-10-08 10:50:44 +08:00
|
|
|
|
|
|
|
using namespace clang;
|
2010-12-23 15:20:52 +08:00
|
|
|
using namespace ento;
|
2008-10-08 10:50:44 +08:00
|
|
|
|
2010-01-11 08:07:44 +08:00
|
|
|
//===----------------------------------------------------------------------===//
|
2010-02-03 11:06:46 +08:00
|
|
|
// Representation of binding keys.
|
2010-01-11 08:07:44 +08:00
|
|
|
//===----------------------------------------------------------------------===//
|
|
|
|
|
2009-10-11 16:08:02 +08:00
|
|
|
namespace {
|
2010-02-03 11:06:46 +08:00
|
|
|
class BindingKey {
|
2009-10-11 16:08:02 +08:00
|
|
|
public:
|
2012-08-10 06:55:37 +08:00
|
|
|
enum Kind { Default = 0x0, Direct = 0x1 };
|
2009-10-11 16:08:02 +08:00
|
|
|
private:
|
2012-08-10 06:55:37 +08:00
|
|
|
enum { Symbolic = 0x2 };
|
2012-08-09 02:23:27 +08:00
|
|
|
|
2012-08-10 06:55:37 +08:00
|
|
|
llvm::PointerIntPair<const MemRegion *, 2> P;
|
|
|
|
uint64_t Data;
|
2010-03-10 15:20:03 +08:00
|
|
|
|
2013-02-15 08:32:03 +08:00
|
|
|
/// Create a key for a binding to region \p r, which has a symbolic offset
|
|
|
|
/// from region \p Base.
|
|
|
|
explicit BindingKey(const SubRegion *r, const SubRegion *Base, Kind k)
|
2012-08-10 06:55:37 +08:00
|
|
|
: P(r, k | Symbolic), Data(reinterpret_cast<uintptr_t>(Base)) {
|
|
|
|
assert(r && Base && "Must have known regions.");
|
|
|
|
assert(getConcreteOffsetRegion() == Base && "Failed to store base region");
|
|
|
|
}
|
2013-02-15 08:32:03 +08:00
|
|
|
|
|
|
|
/// Create a key for a binding at \p offset from base region \p r.
|
2010-02-03 11:06:46 +08:00
|
|
|
explicit BindingKey(const MemRegion *r, uint64_t offset, Kind k)
|
2012-08-10 06:55:37 +08:00
|
|
|
: P(r, k), Data(offset) {
|
|
|
|
assert(r && "Must have known regions.");
|
|
|
|
assert(getOffset() == offset && "Failed to store offset");
|
2021-10-20 23:43:31 +08:00
|
|
|
assert((r == r->getBaseRegion() ||
|
|
|
|
isa<ObjCIvarRegion, CXXDerivedObjectRegion>(r)) &&
|
2018-08-30 06:43:31 +08:00
|
|
|
"Not a base");
|
2012-08-10 06:55:37 +08:00
|
|
|
}
|
2009-10-11 16:08:02 +08:00
|
|
|
public:
|
2010-03-10 15:20:03 +08:00
|
|
|
|
2012-08-10 06:55:37 +08:00
|
|
|
bool isDirect() const { return P.getInt() & Direct; }
|
|
|
|
bool hasSymbolicOffset() const { return P.getInt() & Symbolic; }
|
2010-03-10 15:20:03 +08:00
|
|
|
|
2010-02-03 11:06:46 +08:00
|
|
|
const MemRegion *getRegion() const { return P.getPointer(); }
|
2012-08-09 02:23:27 +08:00
|
|
|
uint64_t getOffset() const {
|
|
|
|
assert(!hasSymbolicOffset());
|
2012-08-10 06:55:37 +08:00
|
|
|
return Data;
|
2012-08-09 02:23:27 +08:00
|
|
|
}
|
|
|
|
|
2013-02-15 08:32:03 +08:00
|
|
|
const SubRegion *getConcreteOffsetRegion() const {
|
2012-08-10 06:55:37 +08:00
|
|
|
assert(hasSymbolicOffset());
|
2013-02-15 08:32:03 +08:00
|
|
|
return reinterpret_cast<const SubRegion *>(static_cast<uintptr_t>(Data));
|
2012-08-10 06:55:37 +08:00
|
|
|
}
|
2010-03-10 15:20:03 +08:00
|
|
|
|
2012-08-10 06:55:51 +08:00
|
|
|
const MemRegion *getBaseRegion() const {
|
|
|
|
if (hasSymbolicOffset())
|
|
|
|
return getConcreteOffsetRegion()->getBaseRegion();
|
|
|
|
return getRegion()->getBaseRegion();
|
|
|
|
}
|
|
|
|
|
2009-10-11 16:08:02 +08:00
|
|
|
void Profile(llvm::FoldingSetNodeID& ID) const {
|
2010-02-03 11:06:46 +08:00
|
|
|
ID.AddPointer(P.getOpaqueValue());
|
2012-08-10 06:55:37 +08:00
|
|
|
ID.AddInteger(Data);
|
2009-10-11 16:08:02 +08:00
|
|
|
}
|
2010-03-10 15:20:03 +08:00
|
|
|
|
2010-02-03 11:06:46 +08:00
|
|
|
static BindingKey Make(const MemRegion *R, Kind k);
|
2010-03-10 15:20:03 +08:00
|
|
|
|
2010-02-03 11:06:46 +08:00
|
|
|
bool operator<(const BindingKey &X) const {
|
|
|
|
if (P.getOpaqueValue() < X.P.getOpaqueValue())
|
|
|
|
return true;
|
|
|
|
if (P.getOpaqueValue() > X.P.getOpaqueValue())
|
|
|
|
return false;
|
2012-08-10 06:55:37 +08:00
|
|
|
return Data < X.Data;
|
2010-02-03 11:06:46 +08:00
|
|
|
}
|
2010-03-10 15:20:03 +08:00
|
|
|
|
2010-02-03 11:06:46 +08:00
|
|
|
bool operator==(const BindingKey &X) const {
|
|
|
|
return P.getOpaqueValue() == X.P.getOpaqueValue() &&
|
2012-08-10 06:55:37 +08:00
|
|
|
Data == X.Data;
|
2010-01-11 08:07:44 +08:00
|
|
|
}
|
2010-08-16 09:15:17 +08:00
|
|
|
|
2019-07-22 12:14:09 +08:00
|
|
|
LLVM_DUMP_METHOD void dump() const;
|
2010-03-10 15:20:03 +08:00
|
|
|
};
|
2010-01-11 08:07:44 +08:00
|
|
|
} // end anonymous namespace
|
|
|
|
|
2010-08-21 20:24:38 +08:00
|
|
|
BindingKey BindingKey::Make(const MemRegion *R, Kind k) {
|
2012-05-09 05:49:54 +08:00
|
|
|
const RegionOffset &RO = R->getAsOffset();
|
2012-08-10 06:55:37 +08:00
|
|
|
if (RO.hasSymbolicOffset())
|
2013-02-15 08:32:03 +08:00
|
|
|
return BindingKey(cast<SubRegion>(R), cast<SubRegion>(RO.getRegion()), k);
|
2012-08-09 02:23:27 +08:00
|
|
|
|
2012-08-10 06:55:37 +08:00
|
|
|
return BindingKey(RO.getRegion(), RO.getOffset(), k);
|
2010-08-21 20:24:38 +08:00
|
|
|
}
|
|
|
|
|
2010-01-11 08:07:44 +08:00
|
|
|
namespace llvm {
|
2019-05-29 23:25:19 +08:00
|
|
|
static inline raw_ostream &operator<<(raw_ostream &Out, BindingKey K) {
|
|
|
|
Out << "\"kind\": \"" << (K.isDirect() ? "Direct" : "Default")
|
|
|
|
<< "\", \"offset\": ";
|
|
|
|
|
|
|
|
if (!K.hasSymbolicOffset())
|
|
|
|
Out << K.getOffset();
|
|
|
|
else
|
|
|
|
Out << "null";
|
2013-02-28 09:53:08 +08:00
|
|
|
|
2019-05-29 23:25:19 +08:00
|
|
|
return Out;
|
|
|
|
}
|
|
|
|
|
|
|
|
} // namespace llvm
|
2010-01-11 08:07:44 +08:00
|
|
|
|
2019-07-22 12:14:09 +08:00
|
|
|
#if !defined(NDEBUG) || defined(LLVM_ENABLE_DUMP)
|
|
|
|
void BindingKey::dump() const { llvm::errs() << *this; }
|
|
|
|
#endif
|
2012-08-10 06:55:51 +08:00
|
|
|
|
2010-01-11 08:07:44 +08:00
|
|
|
//===----------------------------------------------------------------------===//
|
2008-11-24 17:44:56 +08:00
|
|
|
// Actual Store type.
|
2010-01-11 08:07:44 +08:00
|
|
|
//===----------------------------------------------------------------------===//
|
|
|
|
|
2012-12-07 14:49:27 +08:00
|
|
|
typedef llvm::ImmutableMap<BindingKey, SVal> ClusterBindings;
|
|
|
|
typedef llvm::ImmutableMapRef<BindingKey, SVal> ClusterBindingsRef;
|
2013-02-28 09:53:08 +08:00
|
|
|
typedef std::pair<BindingKey, SVal> BindingPair;
|
2012-12-07 09:55:21 +08:00
|
|
|
|
|
|
|
typedef llvm::ImmutableMap<const MemRegion *, ClusterBindings>
|
|
|
|
RegionBindings;
|
|
|
|
|
|
|
|
namespace {
|
|
|
|
class RegionBindingsRef : public llvm::ImmutableMapRef<const MemRegion *,
|
|
|
|
ClusterBindings> {
|
2015-08-14 06:33:24 +08:00
|
|
|
ClusterBindings::Factory *CBFactory;
|
|
|
|
|
2019-08-29 02:44:32 +08:00
|
|
|
// This flag indicates whether the current bindings are within the analysis
|
|
|
|
// that has started from main(). It affects how we perform loads from
|
|
|
|
// global variables that have initializers: if we have observed the
|
|
|
|
// program execution from the start and we know that these variables
|
|
|
|
// have not been overwritten yet, we can be sure that their initializers
|
|
|
|
// are still relevant. This flag never gets changed when the bindings are
|
|
|
|
// updated, so it could potentially be moved into RegionStoreManager
|
|
|
|
// (as if it's the same bindings but a different loading procedure)
|
|
|
|
// however that would have made the manager needlessly stateful.
|
|
|
|
bool IsMainAnalysis;
|
|
|
|
|
2012-12-07 09:55:21 +08:00
|
|
|
public:
|
|
|
|
typedef llvm::ImmutableMapRef<const MemRegion *, ClusterBindings>
|
|
|
|
ParentTy;
|
|
|
|
|
|
|
|
RegionBindingsRef(ClusterBindings::Factory &CBFactory,
|
|
|
|
const RegionBindings::TreeTy *T,
|
2019-08-29 02:44:32 +08:00
|
|
|
RegionBindings::TreeTy::Factory *F,
|
|
|
|
bool IsMainAnalysis)
|
2015-08-14 06:33:24 +08:00
|
|
|
: llvm::ImmutableMapRef<const MemRegion *, ClusterBindings>(T, F),
|
2019-08-29 02:44:32 +08:00
|
|
|
CBFactory(&CBFactory), IsMainAnalysis(IsMainAnalysis) {}
|
2012-12-07 09:55:21 +08:00
|
|
|
|
2019-08-29 02:44:32 +08:00
|
|
|
RegionBindingsRef(const ParentTy &P,
|
|
|
|
ClusterBindings::Factory &CBFactory,
|
|
|
|
bool IsMainAnalysis)
|
2015-08-14 06:33:24 +08:00
|
|
|
: llvm::ImmutableMapRef<const MemRegion *, ClusterBindings>(P),
|
2019-08-29 02:44:32 +08:00
|
|
|
CBFactory(&CBFactory), IsMainAnalysis(IsMainAnalysis) {}
|
2012-12-07 09:55:21 +08:00
|
|
|
|
2012-12-08 03:54:25 +08:00
|
|
|
RegionBindingsRef add(key_type_ref K, data_type_ref D) const {
|
2015-08-14 06:33:24 +08:00
|
|
|
return RegionBindingsRef(static_cast<const ParentTy *>(this)->add(K, D),
|
2019-08-29 02:44:32 +08:00
|
|
|
*CBFactory, IsMainAnalysis);
|
2012-12-07 09:55:21 +08:00
|
|
|
}
|
|
|
|
|
2012-12-08 03:54:25 +08:00
|
|
|
RegionBindingsRef remove(key_type_ref K) const {
|
2015-08-14 06:33:24 +08:00
|
|
|
return RegionBindingsRef(static_cast<const ParentTy *>(this)->remove(K),
|
2019-08-29 02:44:32 +08:00
|
|
|
*CBFactory, IsMainAnalysis);
|
2012-12-07 09:55:21 +08:00
|
|
|
}
|
|
|
|
|
2012-12-08 03:54:25 +08:00
|
|
|
RegionBindingsRef addBinding(BindingKey K, SVal V) const;
|
2012-12-07 09:55:21 +08:00
|
|
|
|
|
|
|
RegionBindingsRef addBinding(const MemRegion *R,
|
2012-12-08 03:54:25 +08:00
|
|
|
BindingKey::Kind k, SVal V) const;
|
2012-12-07 09:55:21 +08:00
|
|
|
|
2012-12-08 03:54:25 +08:00
|
|
|
const SVal *lookup(BindingKey K) const;
|
|
|
|
const SVal *lookup(const MemRegion *R, BindingKey::Kind k) const;
|
2015-08-14 06:33:24 +08:00
|
|
|
using llvm::ImmutableMapRef<const MemRegion *, ClusterBindings>::lookup;
|
2012-12-07 09:55:21 +08:00
|
|
|
|
|
|
|
RegionBindingsRef removeBinding(BindingKey K);
|
|
|
|
|
|
|
|
RegionBindingsRef removeBinding(const MemRegion *R,
|
|
|
|
BindingKey::Kind k);
|
|
|
|
|
|
|
|
RegionBindingsRef removeBinding(const MemRegion *R) {
|
|
|
|
return removeBinding(R, BindingKey::Direct).
|
|
|
|
removeBinding(R, BindingKey::Default);
|
|
|
|
}
|
|
|
|
|
2012-12-08 03:54:25 +08:00
|
|
|
Optional<SVal> getDirectBinding(const MemRegion *R) const;
|
2012-12-07 09:55:21 +08:00
|
|
|
|
|
|
|
/// getDefaultBinding - Returns an SVal* representing an optional default
|
|
|
|
/// binding associated with a region and its subregions.
|
2012-12-08 03:54:25 +08:00
|
|
|
Optional<SVal> getDefaultBinding(const MemRegion *R) const;
|
2012-12-08 02:32:08 +08:00
|
|
|
|
|
|
|
/// Return the internal tree as a Store.
|
|
|
|
Store asStore() const {
|
2019-08-29 02:44:32 +08:00
|
|
|
llvm::PointerIntPair<Store, 1, bool> Ptr = {
|
|
|
|
asImmutableMap().getRootWithoutRetain(), IsMainAnalysis};
|
|
|
|
return reinterpret_cast<Store>(Ptr.getOpaqueValue());
|
|
|
|
}
|
|
|
|
|
|
|
|
bool isMainAnalysis() const {
|
|
|
|
return IsMainAnalysis;
|
2012-12-08 02:32:08 +08:00
|
|
|
}
|
2012-12-14 09:23:13 +08:00
|
|
|
|
2019-05-29 23:25:19 +08:00
|
|
|
void printJson(raw_ostream &Out, const char *NL = "\n",
|
|
|
|
unsigned int Space = 0, bool IsDot = false) const {
|
|
|
|
for (iterator I = begin(); I != end(); ++I) {
|
2019-06-20 07:33:55 +08:00
|
|
|
// TODO: We might need a .printJson for I.getKey() as well.
|
2019-05-29 23:25:19 +08:00
|
|
|
Indent(Out, Space, IsDot)
|
2019-06-20 07:33:51 +08:00
|
|
|
<< "{ \"cluster\": \"" << I.getKey() << "\", \"pointer\": \""
|
|
|
|
<< (const void *)I.getKey() << "\", \"items\": [" << NL;
|
2019-05-29 23:25:19 +08:00
|
|
|
|
|
|
|
++Space;
|
|
|
|
const ClusterBindings &CB = I.getData();
|
|
|
|
for (ClusterBindings::iterator CI = CB.begin(); CI != CB.end(); ++CI) {
|
2019-06-20 07:33:55 +08:00
|
|
|
Indent(Out, Space, IsDot) << "{ " << CI.getKey() << ", \"value\": ";
|
|
|
|
CI.getData().printJson(Out, /*AddQuotes=*/true);
|
|
|
|
Out << " }";
|
2019-05-29 23:25:19 +08:00
|
|
|
if (std::next(CI) != CB.end())
|
|
|
|
Out << ',';
|
|
|
|
Out << NL;
|
|
|
|
}
|
|
|
|
|
|
|
|
--Space;
|
|
|
|
Indent(Out, Space, IsDot) << "]}";
|
|
|
|
if (std::next(I) != end())
|
|
|
|
Out << ',';
|
|
|
|
Out << NL;
|
|
|
|
}
|
2012-12-14 09:23:13 +08:00
|
|
|
}
|
|
|
|
|
2019-05-29 23:25:19 +08:00
|
|
|
LLVM_DUMP_METHOD void dump() const { printJson(llvm::errs()); }
|
2012-12-07 09:55:21 +08:00
|
|
|
};
|
|
|
|
} // end anonymous namespace
|
|
|
|
|
2012-12-08 03:54:25 +08:00
|
|
|
typedef const RegionBindingsRef& RegionBindingsConstRef;
|
|
|
|
|
|
|
|
Optional<SVal> RegionBindingsRef::getDirectBinding(const MemRegion *R) const {
|
2013-02-21 11:12:21 +08:00
|
|
|
return Optional<SVal>::create(lookup(R, BindingKey::Direct));
|
2012-12-07 09:55:21 +08:00
|
|
|
}
|
|
|
|
|
2012-12-08 03:54:25 +08:00
|
|
|
Optional<SVal> RegionBindingsRef::getDefaultBinding(const MemRegion *R) const {
|
2013-02-21 11:12:21 +08:00
|
|
|
return Optional<SVal>::create(lookup(R, BindingKey::Default));
|
2012-12-07 09:55:21 +08:00
|
|
|
}
|
|
|
|
|
2012-12-08 03:54:25 +08:00
|
|
|
RegionBindingsRef RegionBindingsRef::addBinding(BindingKey K, SVal V) const {
|
2012-12-07 09:55:21 +08:00
|
|
|
const MemRegion *Base = K.getBaseRegion();
|
|
|
|
|
|
|
|
const ClusterBindings *ExistingCluster = lookup(Base);
|
2015-08-14 06:33:24 +08:00
|
|
|
ClusterBindings Cluster =
|
|
|
|
(ExistingCluster ? *ExistingCluster : CBFactory->getEmptyMap());
|
2012-12-07 09:55:21 +08:00
|
|
|
|
2015-08-14 06:33:24 +08:00
|
|
|
ClusterBindings NewCluster = CBFactory->add(Cluster, K, V);
|
2012-12-07 09:55:21 +08:00
|
|
|
return add(Base, NewCluster);
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
RegionBindingsRef RegionBindingsRef::addBinding(const MemRegion *R,
|
|
|
|
BindingKey::Kind k,
|
2012-12-08 03:54:25 +08:00
|
|
|
SVal V) const {
|
2012-12-07 09:55:21 +08:00
|
|
|
return addBinding(BindingKey::Make(R, k), V);
|
|
|
|
}
|
|
|
|
|
2012-12-08 03:54:25 +08:00
|
|
|
const SVal *RegionBindingsRef::lookup(BindingKey K) const {
|
2012-12-07 09:55:21 +08:00
|
|
|
const ClusterBindings *Cluster = lookup(K.getBaseRegion());
|
|
|
|
if (!Cluster)
|
2014-05-27 10:45:47 +08:00
|
|
|
return nullptr;
|
2012-12-07 09:55:21 +08:00
|
|
|
return Cluster->lookup(K);
|
|
|
|
}
|
|
|
|
|
|
|
|
const SVal *RegionBindingsRef::lookup(const MemRegion *R,
|
2012-12-08 03:54:25 +08:00
|
|
|
BindingKey::Kind k) const {
|
2012-12-07 09:55:21 +08:00
|
|
|
return lookup(BindingKey::Make(R, k));
|
|
|
|
}
|
|
|
|
|
|
|
|
RegionBindingsRef RegionBindingsRef::removeBinding(BindingKey K) {
|
|
|
|
const MemRegion *Base = K.getBaseRegion();
|
|
|
|
const ClusterBindings *Cluster = lookup(Base);
|
|
|
|
if (!Cluster)
|
|
|
|
return *this;
|
|
|
|
|
2015-08-14 06:33:24 +08:00
|
|
|
ClusterBindings NewCluster = CBFactory->remove(*Cluster, K);
|
2012-12-07 09:55:21 +08:00
|
|
|
if (NewCluster.isEmpty())
|
|
|
|
return remove(Base);
|
|
|
|
return add(Base, NewCluster);
|
|
|
|
}
|
|
|
|
|
|
|
|
RegionBindingsRef RegionBindingsRef::removeBinding(const MemRegion *R,
|
|
|
|
BindingKey::Kind k){
|
|
|
|
return removeBinding(BindingKey::Make(R, k));
|
|
|
|
}
|
2008-11-24 17:44:56 +08:00
|
|
|
|
2009-06-17 06:36:44 +08:00
|
|
|
//===----------------------------------------------------------------------===//
|
|
|
|
// Fine-grained control of RegionStoreManager.
|
|
|
|
//===----------------------------------------------------------------------===//
|
|
|
|
|
|
|
|
namespace {
|
2009-11-28 14:07:30 +08:00
|
|
|
struct minimal_features_tag {};
|
|
|
|
struct maximal_features_tag {};
|
2009-09-09 23:08:12 +08:00
|
|
|
|
2009-11-28 14:07:30 +08:00
|
|
|
class RegionStoreFeatures {
|
2009-06-17 06:36:44 +08:00
|
|
|
bool SupportsFields;
|
|
|
|
public:
|
|
|
|
RegionStoreFeatures(minimal_features_tag) :
|
2010-08-20 14:06:41 +08:00
|
|
|
SupportsFields(false) {}
|
2009-09-09 23:08:12 +08:00
|
|
|
|
2009-06-17 06:36:44 +08:00
|
|
|
RegionStoreFeatures(maximal_features_tag) :
|
2010-08-20 14:06:41 +08:00
|
|
|
SupportsFields(true) {}
|
2009-09-09 23:08:12 +08:00
|
|
|
|
2009-06-17 06:36:44 +08:00
|
|
|
void enableFields(bool t) { SupportsFields = t; }
|
2009-09-09 23:08:12 +08:00
|
|
|
|
2009-06-17 06:36:44 +08:00
|
|
|
bool supportsFields() const { return SupportsFields; }
|
|
|
|
};
|
2015-06-23 07:07:51 +08:00
|
|
|
}
|
2009-06-17 06:36:44 +08:00
|
|
|
|
2008-12-24 09:05:03 +08:00
|
|
|
//===----------------------------------------------------------------------===//
|
|
|
|
// Main RegionStore logic.
|
|
|
|
//===----------------------------------------------------------------------===//
|
2008-12-04 10:08:27 +08:00
|
|
|
|
2008-10-08 10:50:44 +08:00
|
|
|
namespace {
|
2018-08-30 04:28:13 +08:00
|
|
|
class InvalidateRegionsWorker;
|
2009-09-09 23:08:12 +08:00
|
|
|
|
2009-11-28 14:07:30 +08:00
|
|
|
class RegionStoreManager : public StoreManager {
|
2012-12-07 09:55:21 +08:00
|
|
|
public:
|
2009-06-17 06:36:44 +08:00
|
|
|
const RegionStoreFeatures Features;
|
[analyzer] "Force" LazyCompoundVals on bind when they are simple enough.
The analyzer uses LazyCompoundVals to represent rvalues of aggregate types,
most importantly structs and arrays. This allows us to efficiently copy
around an entire struct, rather than doing a memberwise load every time a
struct rvalue is encountered. This can also keep memory usage down by
allowing several structs to "share" the same snapshotted bindings.
However, /lookup/ through LazyCompoundVals can be expensive, especially
since they can end up chaining back to the original value. While we try
to reuse LazyCompoundVals whenever it's safe, and cache information about
this transitivity, the fact is it's sometimes just not a good idea to
perpetuate LazyCompoundVals -- the tradeoffs just aren't worth it.
This commit changes RegionStore so that binding a LazyCompoundVal to struct
will do a memberwise copy if the struct is simple enough. Today's definition
of "simple enough" is "up to N scalar members" (see below), but that could
easily be changed in the future. This is enough to bring the test case in
PR15697 back down to a manageable analysis time (within 20% of its original
time, in an unfair test where the new analyzer is not compiled with LTO).
The actual value of "N" is controlled by a new -analyzer-config option,
'region-store-small-struct-limit'. It defaults to "2", meaning structs with
zero, one, or two scalar members will be considered "simple enough" for
this code path.
It's worth noting that a more straightforward implementation would do this
on load, not on bind, and make use of the structure we already have for this:
CompoundVal. A long time ago, this was actually how RegionStore modeled
aggregate-to-aggregate copies, but today it's only used for compound literals.
Unfortunately, it seems that we've special-cased LazyCompoundVal in certain
places (such as liveness checks) but failed to similarly special-case
CompoundVal in all of them. Until we're confident that CompoundVal is
handled properly everywhere, this solution is safer, since the entire
optimization is just an implementation detail of RegionStore.
<rdar://problem/13599304>
llvm-svn: 179767
2013-04-19 00:33:46 +08:00
|
|
|
|
2009-08-06 12:50:20 +08:00
|
|
|
RegionBindings::Factory RBFactory;
|
2012-12-07 09:55:21 +08:00
|
|
|
mutable ClusterBindings::Factory CBFactory;
|
2010-03-10 15:20:03 +08:00
|
|
|
|
2013-02-15 08:32:12 +08:00
|
|
|
typedef std::vector<SVal> SValListTy;
|
|
|
|
private:
|
|
|
|
typedef llvm::DenseMap<const LazyCompoundValData *,
|
|
|
|
SValListTy> LazyBindingsMapTy;
|
|
|
|
LazyBindingsMapTy LazyBindingsMap;
|
|
|
|
|
[analyzer] "Force" LazyCompoundVals on bind when they are simple enough.
The analyzer uses LazyCompoundVals to represent rvalues of aggregate types,
most importantly structs and arrays. This allows us to efficiently copy
around an entire struct, rather than doing a memberwise load every time a
struct rvalue is encountered. This can also keep memory usage down by
allowing several structs to "share" the same snapshotted bindings.
However, /lookup/ through LazyCompoundVals can be expensive, especially
since they can end up chaining back to the original value. While we try
to reuse LazyCompoundVals whenever it's safe, and cache information about
this transitivity, the fact is it's sometimes just not a good idea to
perpetuate LazyCompoundVals -- the tradeoffs just aren't worth it.
This commit changes RegionStore so that binding a LazyCompoundVal to struct
will do a memberwise copy if the struct is simple enough. Today's definition
of "simple enough" is "up to N scalar members" (see below), but that could
easily be changed in the future. This is enough to bring the test case in
PR15697 back down to a manageable analysis time (within 20% of its original
time, in an unfair test where the new analyzer is not compiled with LTO).
The actual value of "N" is controlled by a new -analyzer-config option,
'region-store-small-struct-limit'. It defaults to "2", meaning structs with
zero, one, or two scalar members will be considered "simple enough" for
this code path.
It's worth noting that a more straightforward implementation would do this
on load, not on bind, and make use of the structure we already have for this:
CompoundVal. A long time ago, this was actually how RegionStore modeled
aggregate-to-aggregate copies, but today it's only used for compound literals.
Unfortunately, it seems that we've special-cased LazyCompoundVal in certain
places (such as liveness checks) but failed to similarly special-case
CompoundVal in all of them. Until we're confident that CompoundVal is
handled properly everywhere, this solution is safer, since the entire
optimization is just an implementation detail of RegionStore.
<rdar://problem/13599304>
llvm-svn: 179767
2013-04-19 00:33:46 +08:00
|
|
|
/// The largest number of fields a struct can have and still be
|
|
|
|
/// considered "small".
|
|
|
|
///
|
|
|
|
/// This is currently used to decide whether or not it is worth "forcing" a
|
|
|
|
/// LazyCompoundVal on bind.
|
|
|
|
///
|
|
|
|
/// This is controlled by 'region-store-small-struct-limit' option.
|
|
|
|
/// To disable all small-struct-dependent behavior, set the option to "0".
|
|
|
|
unsigned SmallStructLimit;
|
|
|
|
|
2018-05-09 09:00:01 +08:00
|
|
|
/// A helper used to populate the work list with the given set of
|
2013-04-02 09:28:24 +08:00
|
|
|
/// regions.
|
2018-08-30 04:28:13 +08:00
|
|
|
void populateWorkList(InvalidateRegionsWorker &W,
|
2013-04-02 09:28:24 +08:00
|
|
|
ArrayRef<SVal> Values,
|
|
|
|
InvalidatedRegions *TopLevelRegions);
|
|
|
|
|
2013-02-15 08:32:12 +08:00
|
|
|
public:
|
2011-08-16 06:09:50 +08:00
|
|
|
RegionStoreManager(ProgramStateManager& mgr, const RegionStoreFeatures &f)
|
2012-08-10 06:55:51 +08:00
|
|
|
: StoreManager(mgr), Features(f),
|
[analyzer] "Force" LazyCompoundVals on bind when they are simple enough.
The analyzer uses LazyCompoundVals to represent rvalues of aggregate types,
most importantly structs and arrays. This allows us to efficiently copy
around an entire struct, rather than doing a memberwise load every time a
struct rvalue is encountered. This can also keep memory usage down by
allowing several structs to "share" the same snapshotted bindings.
However, /lookup/ through LazyCompoundVals can be expensive, especially
since they can end up chaining back to the original value. While we try
to reuse LazyCompoundVals whenever it's safe, and cache information about
this transitivity, the fact is it's sometimes just not a good idea to
perpetuate LazyCompoundVals -- the tradeoffs just aren't worth it.
This commit changes RegionStore so that binding a LazyCompoundVal to struct
will do a memberwise copy if the struct is simple enough. Today's definition
of "simple enough" is "up to N scalar members" (see below), but that could
easily be changed in the future. This is enough to bring the test case in
PR15697 back down to a manageable analysis time (within 20% of its original
time, in an unfair test where the new analyzer is not compiled with LTO).
The actual value of "N" is controlled by a new -analyzer-config option,
'region-store-small-struct-limit'. It defaults to "2", meaning structs with
zero, one, or two scalar members will be considered "simple enough" for
this code path.
It's worth noting that a more straightforward implementation would do this
on load, not on bind, and make use of the structure we already have for this:
CompoundVal. A long time ago, this was actually how RegionStore modeled
aggregate-to-aggregate copies, but today it's only used for compound literals.
Unfortunately, it seems that we've special-cased LazyCompoundVal in certain
places (such as liveness checks) but failed to similarly special-case
CompoundVal in all of them. Until we're confident that CompoundVal is
handled properly everywhere, this solution is safer, since the entire
optimization is just an implementation detail of RegionStore.
<rdar://problem/13599304>
llvm-svn: 179767
2013-04-19 00:33:46 +08:00
|
|
|
RBFactory(mgr.getAllocator()), CBFactory(mgr.getAllocator()),
|
|
|
|
SmallStructLimit(0) {
|
2020-05-26 19:48:20 +08:00
|
|
|
ExprEngine &Eng = StateMgr.getOwningEngine();
|
2018-12-15 21:20:33 +08:00
|
|
|
AnalyzerOptions &Options = Eng.getAnalysisManager().options;
|
|
|
|
SmallStructLimit = Options.RegionStoreSmallStructLimit;
|
[analyzer] "Force" LazyCompoundVals on bind when they are simple enough.
The analyzer uses LazyCompoundVals to represent rvalues of aggregate types,
most importantly structs and arrays. This allows us to efficiently copy
around an entire struct, rather than doing a memberwise load every time a
struct rvalue is encountered. This can also keep memory usage down by
allowing several structs to "share" the same snapshotted bindings.
However, /lookup/ through LazyCompoundVals can be expensive, especially
since they can end up chaining back to the original value. While we try
to reuse LazyCompoundVals whenever it's safe, and cache information about
this transitivity, the fact is it's sometimes just not a good idea to
perpetuate LazyCompoundVals -- the tradeoffs just aren't worth it.
This commit changes RegionStore so that binding a LazyCompoundVal to struct
will do a memberwise copy if the struct is simple enough. Today's definition
of "simple enough" is "up to N scalar members" (see below), but that could
easily be changed in the future. This is enough to bring the test case in
PR15697 back down to a manageable analysis time (within 20% of its original
time, in an unfair test where the new analyzer is not compiled with LTO).
The actual value of "N" is controlled by a new -analyzer-config option,
'region-store-small-struct-limit'. It defaults to "2", meaning structs with
zero, one, or two scalar members will be considered "simple enough" for
this code path.
It's worth noting that a more straightforward implementation would do this
on load, not on bind, and make use of the structure we already have for this:
CompoundVal. A long time ago, this was actually how RegionStore modeled
aggregate-to-aggregate copies, but today it's only used for compound literals.
Unfortunately, it seems that we've special-cased LazyCompoundVal in certain
places (such as liveness checks) but failed to similarly special-case
CompoundVal in all of them. Until we're confident that CompoundVal is
handled properly everywhere, this solution is safer, since the entire
optimization is just an implementation detail of RegionStore.
<rdar://problem/13599304>
llvm-svn: 179767
2013-04-19 00:33:46 +08:00
|
|
|
}
|
2008-10-08 10:50:44 +08:00
|
|
|
|
2010-03-10 15:20:03 +08:00
|
|
|
|
2009-11-20 04:20:24 +08:00
|
|
|
/// setImplicitDefaultValue - Set the default binding for the provided
|
|
|
|
/// MemRegion to the value implicitly defined for compound literals when
|
2010-03-10 15:20:03 +08:00
|
|
|
/// the value is not specified.
|
2012-12-08 03:54:25 +08:00
|
|
|
RegionBindingsRef setImplicitDefaultValue(RegionBindingsConstRef B,
|
|
|
|
const MemRegion *R, QualType T);
|
2009-09-09 23:08:12 +08:00
|
|
|
|
2008-12-24 15:46:32 +08:00
|
|
|
/// ArrayToPointer - Emulates the "decay" of an array to a pointer
|
|
|
|
/// type. 'Array' represents the lvalue of the array being decayed
|
|
|
|
/// to a pointer, and the returned SVal represents the decayed
|
|
|
|
/// version of that lvalue (i.e., a pointer to the first element of
|
2010-12-23 02:53:44 +08:00
|
|
|
/// the array). This is called by ExprEngine when evaluating
|
2008-12-24 15:46:32 +08:00
|
|
|
/// casts from arrays to pointers.
|
2014-03-15 12:29:04 +08:00
|
|
|
SVal ArrayToPointer(Loc Array, QualType ElementTy) override;
|
2008-10-24 09:09:32 +08:00
|
|
|
|
2019-08-29 02:44:32 +08:00
|
|
|
/// Creates the Store that correctly represents memory contents before
|
|
|
|
/// the beginning of the analysis of the given top-level stack frame.
|
2014-03-15 12:29:04 +08:00
|
|
|
StoreRef getInitialStore(const LocationContext *InitLoc) override {
|
2019-08-29 02:44:32 +08:00
|
|
|
bool IsMainAnalysis = false;
|
|
|
|
if (const auto *FD = dyn_cast<FunctionDecl>(InitLoc->getDecl()))
|
|
|
|
IsMainAnalysis = FD->isMain() && !Ctx.getLangOpts().CPlusPlus;
|
|
|
|
return StoreRef(RegionBindingsRef(
|
|
|
|
RegionBindingsRef::ParentTy(RBFactory.getEmptyMap(), RBFactory),
|
|
|
|
CBFactory, IsMainAnalysis).asStore(), *this);
|
2009-08-17 14:19:58 +08:00
|
|
|
}
|
2009-08-22 07:25:54 +08:00
|
|
|
|
2009-06-18 06:02:04 +08:00
|
|
|
//===-------------------------------------------------------------------===//
|
|
|
|
// Binding values to regions.
|
|
|
|
//===-------------------------------------------------------------------===//
|
2012-12-07 09:55:21 +08:00
|
|
|
RegionBindingsRef invalidateGlobalRegion(MemRegion::Kind K,
|
|
|
|
const Expr *Ex,
|
|
|
|
unsigned Count,
|
|
|
|
const LocationContext *LCtx,
|
|
|
|
RegionBindingsRef B,
|
|
|
|
InvalidatedRegions *Invalidated);
|
2008-12-20 14:32:12 +08:00
|
|
|
|
2013-04-02 09:28:24 +08:00
|
|
|
StoreRef invalidateRegions(Store store,
|
|
|
|
ArrayRef<SVal> Values,
|
2011-02-19 09:59:33 +08:00
|
|
|
const Expr *E, unsigned Count,
|
2012-02-18 07:13:45 +08:00
|
|
|
const LocationContext *LCtx,
|
2012-07-03 03:27:35 +08:00
|
|
|
const CallEvent *Call,
|
2013-04-02 09:28:24 +08:00
|
|
|
InvalidatedSymbols &IS,
|
2013-09-25 07:47:29 +08:00
|
|
|
RegionAndSymbolInvalidationTraits &ITraits,
|
2013-04-02 09:28:24 +08:00
|
|
|
InvalidatedRegions *Invalidated,
|
2014-03-15 12:29:04 +08:00
|
|
|
InvalidatedRegions *InvalidatedTopLevel) override;
|
2009-09-09 23:08:12 +08:00
|
|
|
|
2012-08-09 02:23:27 +08:00
|
|
|
bool scanReachableSymbols(Store S, const MemRegion *R,
|
2014-03-15 12:29:04 +08:00
|
|
|
ScanReachableSymbols &Callbacks) override;
|
2012-08-09 02:23:27 +08:00
|
|
|
|
2012-12-08 03:54:25 +08:00
|
|
|
RegionBindingsRef removeSubRegionBindings(RegionBindingsConstRef B,
|
2012-12-07 09:55:21 +08:00
|
|
|
const SubRegion *R);
|
2012-08-10 06:55:51 +08:00
|
|
|
|
2010-02-03 11:06:46 +08:00
|
|
|
public: // Part of public interface to class.
|
|
|
|
|
2014-03-15 12:29:04 +08:00
|
|
|
StoreRef Bind(Store store, Loc LV, SVal V) override {
|
2012-12-08 03:54:25 +08:00
|
|
|
return StoreRef(bind(getRegionBindings(store), LV, V).asStore(), *this);
|
|
|
|
}
|
|
|
|
|
|
|
|
RegionBindingsRef bind(RegionBindingsConstRef B, Loc LV, SVal V);
|
2008-10-21 13:29:26 +08:00
|
|
|
|
2018-05-05 05:56:51 +08:00
|
|
|
// BindDefaultInitial is only used to initialize a region with
|
|
|
|
// a default value.
|
|
|
|
StoreRef BindDefaultInitial(Store store, const MemRegion *R,
|
|
|
|
SVal V) override {
|
|
|
|
RegionBindingsRef B = getRegionBindings(store);
|
|
|
|
// Use other APIs when you have to wipe the region that was initialized
|
|
|
|
// earlier.
|
|
|
|
assert(!(B.getDefaultBinding(R) || B.getDirectBinding(R)) &&
|
|
|
|
"Double initialization!");
|
|
|
|
B = B.addBinding(BindingKey::Make(R, BindingKey::Default), V);
|
|
|
|
return StoreRef(B.asImmutableMap().getRootWithoutRetain(), *this);
|
|
|
|
}
|
|
|
|
|
|
|
|
// BindDefaultZero is used for zeroing constructors that may accidentally
|
|
|
|
// overwrite existing bindings.
|
|
|
|
StoreRef BindDefaultZero(Store store, const MemRegion *R) override {
|
2017-08-19 02:20:43 +08:00
|
|
|
// FIXME: The offsets of empty bases can be tricky because of
|
|
|
|
// of the so called "empty base class optimization".
|
|
|
|
// If a base class has been optimized out
|
|
|
|
// we should not try to create a binding, otherwise we should.
|
|
|
|
// Unfortunately, at the moment ASTRecordLayout doesn't expose
|
|
|
|
// the actual sizes of the empty bases
|
|
|
|
// and trying to infer them from offsets/alignments
|
|
|
|
// seems to be error-prone and non-trivial because of the trailing padding.
|
|
|
|
// As a temporary mitigation we don't create bindings for empty bases.
|
2018-05-05 05:56:51 +08:00
|
|
|
if (const auto *BR = dyn_cast<CXXBaseObjectRegion>(R))
|
|
|
|
if (BR->getDecl()->isEmpty())
|
|
|
|
return StoreRef(store, *this);
|
2017-08-19 02:20:43 +08:00
|
|
|
|
2012-12-07 09:55:21 +08:00
|
|
|
RegionBindingsRef B = getRegionBindings(store);
|
2018-05-05 05:56:51 +08:00
|
|
|
SVal V = svalBuilder.makeZeroVal(Ctx.CharTy);
|
|
|
|
B = removeSubRegionBindings(B, cast<SubRegion>(R));
|
|
|
|
B = B.addBinding(BindingKey::Make(R, BindingKey::Default), V);
|
2013-09-12 00:46:50 +08:00
|
|
|
return StoreRef(B.asImmutableMap().getRootWithoutRetain(), *this);
|
2010-06-01 11:01:33 +08:00
|
|
|
}
|
|
|
|
|
[analyzer] "Force" LazyCompoundVals on bind when they are simple enough.
The analyzer uses LazyCompoundVals to represent rvalues of aggregate types,
most importantly structs and arrays. This allows us to efficiently copy
around an entire struct, rather than doing a memberwise load every time a
struct rvalue is encountered. This can also keep memory usage down by
allowing several structs to "share" the same snapshotted bindings.
However, /lookup/ through LazyCompoundVals can be expensive, especially
since they can end up chaining back to the original value. While we try
to reuse LazyCompoundVals whenever it's safe, and cache information about
this transitivity, the fact is it's sometimes just not a good idea to
perpetuate LazyCompoundVals -- the tradeoffs just aren't worth it.
This commit changes RegionStore so that binding a LazyCompoundVal to struct
will do a memberwise copy if the struct is simple enough. Today's definition
of "simple enough" is "up to N scalar members" (see below), but that could
easily be changed in the future. This is enough to bring the test case in
PR15697 back down to a manageable analysis time (within 20% of its original
time, in an unfair test where the new analyzer is not compiled with LTO).
The actual value of "N" is controlled by a new -analyzer-config option,
'region-store-small-struct-limit'. It defaults to "2", meaning structs with
zero, one, or two scalar members will be considered "simple enough" for
this code path.
It's worth noting that a more straightforward implementation would do this
on load, not on bind, and make use of the structure we already have for this:
CompoundVal. A long time ago, this was actually how RegionStore modeled
aggregate-to-aggregate copies, but today it's only used for compound literals.
Unfortunately, it seems that we've special-cased LazyCompoundVal in certain
places (such as liveness checks) but failed to similarly special-case
CompoundVal in all of them. Until we're confident that CompoundVal is
handled properly everywhere, this solution is safer, since the entire
optimization is just an implementation detail of RegionStore.
<rdar://problem/13599304>
llvm-svn: 179767
2013-04-19 00:33:46 +08:00
|
|
|
/// Attempt to extract the fields of \p LCV and bind them to the struct region
|
|
|
|
/// \p R.
|
|
|
|
///
|
|
|
|
/// This path is used when it seems advantageous to "force" loading the values
|
|
|
|
/// within a LazyCompoundVal to bind memberwise to the struct region, rather
|
|
|
|
/// than using a Default binding at the base of the entire region. This is a
|
|
|
|
/// heuristic attempting to avoid building long chains of LazyCompoundVals.
|
|
|
|
///
|
|
|
|
/// \returns The updated store bindings, or \c None if binding non-lazily
|
|
|
|
/// would be too expensive.
|
|
|
|
Optional<RegionBindingsRef> tryBindSmallStruct(RegionBindingsConstRef B,
|
|
|
|
const TypedValueRegion *R,
|
|
|
|
const RecordDecl *RD,
|
|
|
|
nonloc::LazyCompoundVal LCV);
|
|
|
|
|
2009-06-18 06:02:04 +08:00
|
|
|
/// BindStruct - Bind a compound value to a structure.
|
2012-12-08 03:54:25 +08:00
|
|
|
RegionBindingsRef bindStruct(RegionBindingsConstRef B,
|
|
|
|
const TypedValueRegion* R, SVal V);
|
2009-09-09 23:08:12 +08:00
|
|
|
|
2012-05-11 06:02:39 +08:00
|
|
|
/// BindVector - Bind a compound value to a vector.
|
2012-12-08 03:54:25 +08:00
|
|
|
RegionBindingsRef bindVector(RegionBindingsConstRef B,
|
|
|
|
const TypedValueRegion* R, SVal V);
|
2012-05-11 06:02:39 +08:00
|
|
|
|
2012-12-08 03:54:25 +08:00
|
|
|
RegionBindingsRef bindArray(RegionBindingsConstRef B,
|
|
|
|
const TypedValueRegion* R,
|
|
|
|
SVal V);
|
2009-09-09 23:08:12 +08:00
|
|
|
|
2012-08-10 06:55:54 +08:00
|
|
|
/// Clears out all bindings in the given region and assigns a new value
|
|
|
|
/// as a Default binding.
|
2012-12-08 03:54:25 +08:00
|
|
|
RegionBindingsRef bindAggregate(RegionBindingsConstRef B,
|
|
|
|
const TypedRegion *R,
|
|
|
|
SVal DefaultVal);
|
2008-10-24 09:38:55 +08:00
|
|
|
|
2018-05-09 09:00:01 +08:00
|
|
|
/// Create a new store with the specified binding removed.
|
2012-08-23 07:50:41 +08:00
|
|
|
/// \param ST the original store, that is the basis for the new store.
|
|
|
|
/// \param L the location whose binding should be removed.
|
2014-03-15 12:29:04 +08:00
|
|
|
StoreRef killBinding(Store ST, Loc L) override;
|
2010-03-10 15:20:03 +08:00
|
|
|
|
2014-03-15 12:29:04 +08:00
|
|
|
void incrementReferenceCount(Store store) override {
|
2015-09-08 11:50:52 +08:00
|
|
|
getRegionBindings(store).manualRetain();
|
2011-02-19 09:59:33 +08:00
|
|
|
}
|
2015-09-08 11:50:52 +08:00
|
|
|
|
2011-02-19 09:59:33 +08:00
|
|
|
/// If the StoreManager supports it, decrement the reference count of
|
|
|
|
/// the specified Store object. If the reference count hits 0, the memory
|
|
|
|
/// associated with the object is recycled.
|
2014-03-15 12:29:04 +08:00
|
|
|
void decrementReferenceCount(Store store) override {
|
2012-12-07 09:55:21 +08:00
|
|
|
getRegionBindings(store).manualRelease();
|
2011-02-19 09:59:33 +08:00
|
|
|
}
|
2014-03-15 12:29:04 +08:00
|
|
|
|
|
|
|
bool includedInBindings(Store store, const MemRegion *region) const override;
|
2009-06-18 06:02:04 +08:00
|
|
|
|
2018-05-09 09:00:01 +08:00
|
|
|
/// Return the value bound to specified location in a given state.
|
2012-01-12 10:22:40 +08:00
|
|
|
///
|
2009-06-18 06:02:04 +08:00
|
|
|
/// The high level logic for this method is this:
|
2012-01-12 10:22:40 +08:00
|
|
|
/// getBinding (L)
|
2009-06-18 06:02:04 +08:00
|
|
|
/// if L has binding
|
|
|
|
/// return L's binding
|
|
|
|
/// else if L is in killset
|
|
|
|
/// return unknown
|
|
|
|
/// else
|
|
|
|
/// if L is on stack or heap
|
|
|
|
/// return undefined
|
|
|
|
/// else
|
|
|
|
/// return symbolic
|
2014-03-15 12:29:04 +08:00
|
|
|
SVal getBinding(Store S, Loc L, QualType T) override {
|
2012-12-08 03:54:25 +08:00
|
|
|
return getBinding(getRegionBindings(S), L, T);
|
|
|
|
}
|
|
|
|
|
2017-03-09 08:01:16 +08:00
|
|
|
Optional<SVal> getDefaultBinding(Store S, const MemRegion *R) override {
|
|
|
|
RegionBindingsRef B = getRegionBindings(S);
|
2017-05-29 23:42:56 +08:00
|
|
|
// Default bindings are always applied over a base region so look up the
|
|
|
|
// base region's default binding, otherwise the lookup will fail when R
|
|
|
|
// is at an offset from R->getBaseRegion().
|
|
|
|
return B.getDefaultBinding(R->getBaseRegion());
|
2017-03-09 08:01:16 +08:00
|
|
|
}
|
|
|
|
|
2012-12-08 03:54:25 +08:00
|
|
|
SVal getBinding(RegionBindingsConstRef B, Loc L, QualType T = QualType());
|
2009-06-25 12:50:44 +08:00
|
|
|
|
2012-12-08 03:54:25 +08:00
|
|
|
SVal getBindingForElement(RegionBindingsConstRef B, const ElementRegion *R);
|
2009-06-25 13:29:39 +08:00
|
|
|
|
2012-12-08 03:54:25 +08:00
|
|
|
SVal getBindingForField(RegionBindingsConstRef B, const FieldRegion *R);
|
2009-09-09 23:08:12 +08:00
|
|
|
|
2012-12-08 03:54:25 +08:00
|
|
|
SVal getBindingForObjCIvar(RegionBindingsConstRef B, const ObjCIvarRegion *R);
|
2009-09-09 23:08:12 +08:00
|
|
|
|
2012-12-08 03:54:25 +08:00
|
|
|
SVal getBindingForVar(RegionBindingsConstRef B, const VarRegion *R);
|
2009-09-09 23:08:12 +08:00
|
|
|
|
2012-01-12 10:22:40 +08:00
|
|
|
SVal getBindingForLazySymbol(const TypedValueRegion *R);
|
2009-09-09 23:08:12 +08:00
|
|
|
|
2012-12-08 03:54:25 +08:00
|
|
|
SVal getBindingForFieldOrElementCommon(RegionBindingsConstRef B,
|
|
|
|
const TypedValueRegion *R,
|
2013-04-16 04:39:45 +08:00
|
|
|
QualType Ty);
|
2015-09-08 11:50:52 +08:00
|
|
|
|
2013-02-21 09:34:51 +08:00
|
|
|
SVal getLazyBinding(const SubRegion *LazyBindingRegion,
|
2012-12-08 03:54:25 +08:00
|
|
|
RegionBindingsRef LazyBinding);
|
2009-09-09 23:08:12 +08:00
|
|
|
|
2012-01-12 10:22:40 +08:00
|
|
|
/// Get bindings for the values in a struct and return a CompoundVal, used
|
|
|
|
/// when doing struct copy:
|
2009-09-09 23:08:12 +08:00
|
|
|
/// struct s x, y;
|
2008-12-04 09:12:41 +08:00
|
|
|
/// x = y;
|
|
|
|
/// y's value is retrieved by this method.
|
2013-02-02 03:49:57 +08:00
|
|
|
SVal getBindingForStruct(RegionBindingsConstRef B, const TypedValueRegion *R);
|
|
|
|
SVal getBindingForArray(RegionBindingsConstRef B, const TypedValueRegion *R);
|
|
|
|
NonLoc createLazyBinding(RegionBindingsConstRef B, const TypedValueRegion *R);
|
2009-09-09 23:08:12 +08:00
|
|
|
|
2010-07-02 04:16:50 +08:00
|
|
|
/// Used to lazily generate derived symbols for bindings that are defined
|
2013-02-27 08:05:29 +08:00
|
|
|
/// implicitly by default bindings in a super region.
|
|
|
|
///
|
|
|
|
/// Note that callers may need to specially handle LazyCompoundVals, which
|
|
|
|
/// are returned as is in case the caller needs to treat them differently.
|
2012-12-08 03:54:25 +08:00
|
|
|
Optional<SVal> getBindingForDerivedDefaultValue(RegionBindingsConstRef B,
|
2012-01-12 10:22:40 +08:00
|
|
|
const MemRegion *superR,
|
|
|
|
const TypedValueRegion *R,
|
|
|
|
QualType Ty);
|
2010-07-02 04:16:50 +08:00
|
|
|
|
2013-02-20 04:28:33 +08:00
|
|
|
/// Get the state and region whose binding this region \p R corresponds to.
|
|
|
|
///
|
|
|
|
/// If there is no lazy binding for \p R, the returned value will have a null
|
|
|
|
/// \c second. Note that a null pointer can represents a valid Store.
|
2013-02-21 09:34:51 +08:00
|
|
|
std::pair<Store, const SubRegion *>
|
|
|
|
findLazyBinding(RegionBindingsConstRef B, const SubRegion *R,
|
|
|
|
const SubRegion *originalRegion);
|
2009-09-09 23:08:12 +08:00
|
|
|
|
2013-02-15 08:32:12 +08:00
|
|
|
/// Returns the cached set of interesting SVals contained within a lazy
|
|
|
|
/// binding.
|
|
|
|
///
|
|
|
|
/// The precise value of "interesting" is determined for the purposes of
|
|
|
|
/// RegionStore's internal analysis. It must always contain all regions and
|
|
|
|
/// symbols, but may omit constants and other kinds of SVal.
|
|
|
|
const SValListTy &getInterestingValues(nonloc::LazyCompoundVal LCV);
|
|
|
|
|
2009-06-18 06:02:04 +08:00
|
|
|
//===------------------------------------------------------------------===//
|
|
|
|
// State pruning.
|
|
|
|
//===------------------------------------------------------------------===//
|
2009-09-09 23:08:12 +08:00
|
|
|
|
2011-01-15 04:34:15 +08:00
|
|
|
/// removeDeadBindings - Scans the RegionStore of 'state' for dead values.
|
2009-06-18 06:02:04 +08:00
|
|
|
/// It returns a new Store with these values removed.
|
2011-02-19 09:59:33 +08:00
|
|
|
StoreRef removeDeadBindings(Store store, const StackFrameContext *LCtx,
|
2014-03-15 12:29:04 +08:00
|
|
|
SymbolReaper& SymReaper) override;
|
|
|
|
|
2009-06-18 06:02:04 +08:00
|
|
|
//===------------------------------------------------------------------===//
|
2008-10-31 15:16:08 +08:00
|
|
|
// Utility methods.
|
2009-06-18 06:02:04 +08:00
|
|
|
//===------------------------------------------------------------------===//
|
2009-09-09 23:08:12 +08:00
|
|
|
|
2012-12-07 09:55:21 +08:00
|
|
|
RegionBindingsRef getRegionBindings(Store store) const {
|
2019-08-29 02:44:32 +08:00
|
|
|
llvm::PointerIntPair<Store, 1, bool> Ptr;
|
|
|
|
Ptr.setFromOpaqueValue(const_cast<void *>(store));
|
|
|
|
return RegionBindingsRef(
|
|
|
|
CBFactory,
|
|
|
|
static_cast<const RegionBindings::TreeTy *>(Ptr.getPointer()),
|
|
|
|
RBFactory.getTreeFactory(),
|
|
|
|
Ptr.getInt());
|
2009-06-18 06:02:04 +08:00
|
|
|
}
|
|
|
|
|
2019-05-29 23:25:19 +08:00
|
|
|
void printJson(raw_ostream &Out, Store S, const char *NL = "\n",
|
|
|
|
unsigned int Space = 0, bool IsDot = false) const override;
|
2009-05-08 09:33:18 +08:00
|
|
|
|
2014-03-15 12:29:04 +08:00
|
|
|
void iterBindings(Store store, BindingsHandler& f) override {
|
2012-12-07 09:55:21 +08:00
|
|
|
RegionBindingsRef B = getRegionBindings(store);
|
|
|
|
for (RegionBindingsRef::iterator I = B.begin(), E = B.end(); I != E; ++I) {
|
2012-08-10 06:55:51 +08:00
|
|
|
const ClusterBindings &Cluster = I.getData();
|
|
|
|
for (ClusterBindings::iterator CI = Cluster.begin(), CE = Cluster.end();
|
|
|
|
CI != CE; ++CI) {
|
|
|
|
const BindingKey &K = CI.getKey();
|
|
|
|
if (!K.isDirect())
|
|
|
|
continue;
|
|
|
|
if (const SubRegion *R = dyn_cast<SubRegion>(K.getRegion())) {
|
|
|
|
// FIXME: Possibly incorporate the offset?
|
|
|
|
if (!f.HandleBinding(*this, store, R, CI.getData()))
|
|
|
|
return;
|
|
|
|
}
|
2010-06-17 08:24:42 +08:00
|
|
|
}
|
|
|
|
}
|
2009-06-18 06:02:04 +08:00
|
|
|
}
|
2008-10-08 10:50:44 +08:00
|
|
|
};
|
|
|
|
|
|
|
|
} // end anonymous namespace
|
|
|
|
|
2009-06-17 06:36:44 +08:00
|
|
|
//===----------------------------------------------------------------------===//
|
|
|
|
// RegionStore creation.
|
|
|
|
//===----------------------------------------------------------------------===//
|
|
|
|
|
2014-09-05 07:54:37 +08:00
|
|
|
std::unique_ptr<StoreManager>
|
|
|
|
ento::CreateRegionStoreManager(ProgramStateManager &StMgr) {
|
2009-06-17 06:36:44 +08:00
|
|
|
RegionStoreFeatures F = maximal_features_tag();
|
2019-08-15 07:04:18 +08:00
|
|
|
return std::make_unique<RegionStoreManager>(StMgr, F);
|
2009-06-17 06:36:44 +08:00
|
|
|
}
|
|
|
|
|
2014-09-05 07:54:37 +08:00
|
|
|
std::unique_ptr<StoreManager>
|
2012-01-12 10:22:40 +08:00
|
|
|
ento::CreateFieldsOnlyRegionStoreManager(ProgramStateManager &StMgr) {
|
2009-06-17 06:36:44 +08:00
|
|
|
RegionStoreFeatures F = minimal_features_tag();
|
|
|
|
F.enableFields(true);
|
2019-08-15 07:04:18 +08:00
|
|
|
return std::make_unique<RegionStoreManager>(StMgr, F);
|
2008-10-24 09:04:59 +08:00
|
|
|
}
|
|
|
|
|
2009-08-06 09:20:57 +08:00
|
|
|
|
2010-03-10 15:19:59 +08:00
|
|
|
//===----------------------------------------------------------------------===//
|
|
|
|
// Region Cluster analysis.
|
|
|
|
//===----------------------------------------------------------------------===//
|
|
|
|
|
|
|
|
namespace {
|
2013-04-16 04:39:41 +08:00
|
|
|
/// Used to determine which global regions are automatically included in the
|
|
|
|
/// initial worklist of a ClusterAnalysis.
|
|
|
|
enum GlobalsFilterKind {
|
|
|
|
/// Don't include any global regions.
|
|
|
|
GFK_None,
|
|
|
|
/// Only include system globals.
|
|
|
|
GFK_SystemOnly,
|
|
|
|
/// Include all global regions.
|
|
|
|
GFK_All
|
|
|
|
};
|
|
|
|
|
2010-03-11 00:32:56 +08:00
|
|
|
template <typename DERIVED>
|
2010-03-10 15:19:59 +08:00
|
|
|
class ClusterAnalysis {
|
|
|
|
protected:
|
2012-08-10 06:55:51 +08:00
|
|
|
typedef llvm::DenseMap<const MemRegion *, const ClusterBindings *> ClusterMap;
|
2013-09-25 07:47:29 +08:00
|
|
|
typedef const MemRegion * WorkListElement;
|
2013-03-21 04:35:53 +08:00
|
|
|
typedef SmallVector<WorkListElement, 10> WorkList;
|
2012-08-10 06:55:51 +08:00
|
|
|
|
|
|
|
llvm::SmallPtrSet<const ClusterBindings *, 16> Visited;
|
|
|
|
|
2010-03-11 00:32:56 +08:00
|
|
|
WorkList WL;
|
2010-03-10 15:19:59 +08:00
|
|
|
|
|
|
|
RegionStoreManager &RM;
|
|
|
|
ASTContext &Ctx;
|
2010-12-02 15:49:45 +08:00
|
|
|
SValBuilder &svalBuilder;
|
2010-03-10 15:19:59 +08:00
|
|
|
|
2012-12-07 09:55:21 +08:00
|
|
|
RegionBindingsRef B;
|
2010-03-11 00:32:56 +08:00
|
|
|
|
2013-04-16 04:39:41 +08:00
|
|
|
|
|
|
|
protected:
|
2012-08-10 06:55:51 +08:00
|
|
|
const ClusterBindings *getCluster(const MemRegion *R) {
|
|
|
|
return B.lookup(R);
|
|
|
|
}
|
|
|
|
|
2015-10-02 04:09:11 +08:00
|
|
|
/// Returns true if all clusters in the given memspace should be initially
|
|
|
|
/// included in the cluster analysis. Subclasses may provide their
|
|
|
|
/// own implementation.
|
|
|
|
bool includeEntireMemorySpace(const MemRegion *Base) {
|
|
|
|
return false;
|
2013-04-16 04:39:41 +08:00
|
|
|
}
|
|
|
|
|
2010-03-10 15:19:59 +08:00
|
|
|
public:
|
2011-08-16 06:09:50 +08:00
|
|
|
ClusterAnalysis(RegionStoreManager &rm, ProgramStateManager &StateMgr,
|
2016-05-27 22:27:13 +08:00
|
|
|
RegionBindingsRef b)
|
|
|
|
: RM(rm), Ctx(StateMgr.getContext()),
|
|
|
|
svalBuilder(StateMgr.getSValBuilder()), B(std::move(b)) {}
|
2010-03-11 00:32:56 +08:00
|
|
|
|
2012-12-07 09:55:21 +08:00
|
|
|
RegionBindingsRef getRegionBindings() const { return B; }
|
2010-03-11 00:32:56 +08:00
|
|
|
|
|
|
|
bool isVisited(const MemRegion *R) {
|
2012-08-10 06:55:51 +08:00
|
|
|
return Visited.count(getCluster(R));
|
2010-03-11 00:32:56 +08:00
|
|
|
}
|
2010-03-10 15:19:59 +08:00
|
|
|
|
2010-10-26 08:06:15 +08:00
|
|
|
void GenerateClusters() {
|
2012-08-10 06:55:51 +08:00
|
|
|
// Scan the entire set of bindings and record the region clusters.
|
2012-12-07 09:55:21 +08:00
|
|
|
for (RegionBindingsRef::iterator RI = B.begin(), RE = B.end();
|
|
|
|
RI != RE; ++RI){
|
2012-08-10 06:55:51 +08:00
|
|
|
const MemRegion *Base = RI.getKey();
|
|
|
|
|
|
|
|
const ClusterBindings &Cluster = RI.getData();
|
|
|
|
assert(!Cluster.isEmpty() && "Empty clusters should be removed");
|
|
|
|
static_cast<DERIVED*>(this)->VisitAddedToCluster(Base, Cluster);
|
|
|
|
|
2015-10-02 04:09:11 +08:00
|
|
|
// If the base's memspace should be entirely invalidated, add the cluster
|
|
|
|
// to the workspace up front.
|
|
|
|
if (static_cast<DERIVED*>(this)->includeEntireMemorySpace(Base))
|
2013-04-16 04:39:41 +08:00
|
|
|
AddToWorkList(WorkListElement(Base), &Cluster);
|
2010-03-11 00:32:56 +08:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2013-03-21 04:35:53 +08:00
|
|
|
bool AddToWorkList(WorkListElement E, const ClusterBindings *C) {
|
2014-11-19 15:49:47 +08:00
|
|
|
if (C && !Visited.insert(C).second)
|
2012-08-22 08:02:08 +08:00
|
|
|
return false;
|
2013-03-21 04:35:53 +08:00
|
|
|
WL.push_back(E);
|
2010-03-11 00:32:56 +08:00
|
|
|
return true;
|
2010-03-10 15:19:59 +08:00
|
|
|
}
|
|
|
|
|
2013-09-25 07:47:29 +08:00
|
|
|
bool AddToWorkList(const MemRegion *R) {
|
2015-09-25 00:52:56 +08:00
|
|
|
return static_cast<DERIVED*>(this)->AddToWorkList(R);
|
2010-03-11 00:32:56 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
void RunWorkList() {
|
|
|
|
while (!WL.empty()) {
|
2013-03-21 04:35:53 +08:00
|
|
|
WorkListElement E = WL.pop_back_val();
|
2013-09-25 07:47:29 +08:00
|
|
|
const MemRegion *BaseR = E;
|
2010-03-11 00:32:56 +08:00
|
|
|
|
2013-09-25 07:47:29 +08:00
|
|
|
static_cast<DERIVED*>(this)->VisitCluster(BaseR, getCluster(BaseR));
|
2010-03-10 15:19:59 +08:00
|
|
|
}
|
|
|
|
}
|
2010-03-11 00:32:56 +08:00
|
|
|
|
2012-08-10 06:55:51 +08:00
|
|
|
void VisitAddedToCluster(const MemRegion *baseR, const ClusterBindings &C) {}
|
2013-03-21 04:35:53 +08:00
|
|
|
void VisitCluster(const MemRegion *baseR, const ClusterBindings *C) {}
|
|
|
|
|
|
|
|
void VisitCluster(const MemRegion *BaseR, const ClusterBindings *C,
|
|
|
|
bool Flag) {
|
|
|
|
static_cast<DERIVED*>(this)->VisitCluster(BaseR, C);
|
|
|
|
}
|
2010-03-11 00:32:56 +08:00
|
|
|
};
|
2015-06-23 07:07:51 +08:00
|
|
|
}
|
2010-03-10 15:19:59 +08:00
|
|
|
|
2009-07-30 02:16:25 +08:00
|
|
|
//===----------------------------------------------------------------------===//
|
|
|
|
// Binding invalidation.
|
|
|
|
//===----------------------------------------------------------------------===//
|
|
|
|
|
2012-08-09 02:23:27 +08:00
|
|
|
bool RegionStoreManager::scanReachableSymbols(Store S, const MemRegion *R,
|
|
|
|
ScanReachableSymbols &Callbacks) {
|
2012-08-10 06:55:51 +08:00
|
|
|
assert(R == R->getBaseRegion() && "Should only be called for base regions");
|
2012-12-07 09:55:21 +08:00
|
|
|
RegionBindingsRef B = getRegionBindings(S);
|
2012-08-10 06:55:51 +08:00
|
|
|
const ClusterBindings *Cluster = B.lookup(R);
|
|
|
|
|
|
|
|
if (!Cluster)
|
|
|
|
return true;
|
|
|
|
|
|
|
|
for (ClusterBindings::iterator RI = Cluster->begin(), RE = Cluster->end();
|
|
|
|
RI != RE; ++RI) {
|
|
|
|
if (!Callbacks.scan(RI.getData()))
|
|
|
|
return false;
|
2012-08-09 02:23:27 +08:00
|
|
|
}
|
2010-03-10 15:19:59 +08:00
|
|
|
|
2012-08-09 02:23:27 +08:00
|
|
|
return true;
|
|
|
|
}
|
|
|
|
|
2012-11-10 09:40:08 +08:00
|
|
|
static inline bool isUnionField(const FieldRegion *FR) {
|
|
|
|
return FR->getDecl()->getParent()->isUnion();
|
|
|
|
}
|
|
|
|
|
|
|
|
typedef SmallVector<const FieldDecl *, 8> FieldVector;
|
|
|
|
|
2015-03-10 00:47:52 +08:00
|
|
|
static void getSymbolicOffsetFields(BindingKey K, FieldVector &Fields) {
|
2012-11-10 09:40:08 +08:00
|
|
|
assert(K.hasSymbolicOffset() && "Not implemented for concrete offset keys");
|
|
|
|
|
|
|
|
const MemRegion *Base = K.getConcreteOffsetRegion();
|
|
|
|
const MemRegion *R = K.getRegion();
|
|
|
|
|
|
|
|
while (R != Base) {
|
|
|
|
if (const FieldRegion *FR = dyn_cast<FieldRegion>(R))
|
|
|
|
if (!isUnionField(FR))
|
|
|
|
Fields.push_back(FR->getDecl());
|
|
|
|
|
|
|
|
R = cast<SubRegion>(R)->getSuperRegion();
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
static bool isCompatibleWithFields(BindingKey K, const FieldVector &Fields) {
|
|
|
|
assert(K.hasSymbolicOffset() && "Not implemented for concrete offset keys");
|
|
|
|
|
|
|
|
if (Fields.empty())
|
|
|
|
return true;
|
|
|
|
|
|
|
|
FieldVector FieldsInBindingKey;
|
|
|
|
getSymbolicOffsetFields(K, FieldsInBindingKey);
|
|
|
|
|
|
|
|
ptrdiff_t Delta = FieldsInBindingKey.size() - Fields.size();
|
|
|
|
if (Delta >= 0)
|
|
|
|
return std::equal(FieldsInBindingKey.begin() + Delta,
|
|
|
|
FieldsInBindingKey.end(),
|
|
|
|
Fields.begin());
|
|
|
|
else
|
|
|
|
return std::equal(FieldsInBindingKey.begin(), FieldsInBindingKey.end(),
|
|
|
|
Fields.begin() - Delta);
|
|
|
|
}
|
|
|
|
|
2013-02-28 09:53:08 +08:00
|
|
|
/// Collects all bindings in \p Cluster that may refer to bindings within
|
|
|
|
/// \p Top.
|
|
|
|
///
|
|
|
|
/// Each binding is a pair whose \c first is the key (a BindingKey) and whose
|
|
|
|
/// \c second is the value (an SVal).
|
2013-02-15 08:32:06 +08:00
|
|
|
///
|
|
|
|
/// The \p IncludeAllDefaultBindings parameter specifies whether to include
|
|
|
|
/// default bindings that may extend beyond \p Top itself, e.g. if \p Top is
|
|
|
|
/// an aggregate within a larger aggregate with a default binding.
|
2013-02-28 09:53:08 +08:00
|
|
|
static void
|
|
|
|
collectSubRegionBindings(SmallVectorImpl<BindingPair> &Bindings,
|
|
|
|
SValBuilder &SVB, const ClusterBindings &Cluster,
|
|
|
|
const SubRegion *Top, BindingKey TopKey,
|
|
|
|
bool IncludeAllDefaultBindings) {
|
2012-11-10 09:40:08 +08:00
|
|
|
FieldVector FieldsInSymbolicSubregions;
|
2013-02-15 08:32:03 +08:00
|
|
|
if (TopKey.hasSymbolicOffset()) {
|
|
|
|
getSymbolicOffsetFields(TopKey, FieldsInSymbolicSubregions);
|
2018-03-01 13:43:23 +08:00
|
|
|
Top = TopKey.getConcreteOffsetRegion();
|
2013-02-15 08:32:03 +08:00
|
|
|
TopKey = BindingKey::Make(Top, BindingKey::Default);
|
2012-08-09 02:23:27 +08:00
|
|
|
}
|
|
|
|
|
2013-03-02 07:03:17 +08:00
|
|
|
// Find the length (in bits) of the region being invalidated.
|
2012-08-09 02:23:27 +08:00
|
|
|
uint64_t Length = UINT64_MAX;
|
2020-01-30 23:04:37 +08:00
|
|
|
SVal Extent = Top->getMemRegionManager().getStaticSize(Top, SVB);
|
2013-02-21 06:23:23 +08:00
|
|
|
if (Optional<nonloc::ConcreteInt> ExtentCI =
|
2013-02-20 13:52:05 +08:00
|
|
|
Extent.getAs<nonloc::ConcreteInt>()) {
|
2012-08-09 02:23:27 +08:00
|
|
|
const llvm::APSInt &ExtentInt = ExtentCI->getValue();
|
|
|
|
assert(ExtentInt.isNonNegative() || ExtentInt.isUnsigned());
|
|
|
|
// Extents are in bytes but region offsets are in bits. Be careful!
|
2013-02-15 08:32:03 +08:00
|
|
|
Length = ExtentInt.getLimitedValue() * SVB.getContext().getCharWidth();
|
2013-03-02 07:03:17 +08:00
|
|
|
} else if (const FieldRegion *FR = dyn_cast<FieldRegion>(Top)) {
|
|
|
|
if (FR->getDecl()->isBitField())
|
|
|
|
Length = FR->getDecl()->getBitWidthValue(SVB.getContext());
|
2012-08-09 02:23:27 +08:00
|
|
|
}
|
|
|
|
|
2013-02-15 08:32:03 +08:00
|
|
|
for (ClusterBindings::iterator I = Cluster.begin(), E = Cluster.end();
|
2012-08-10 06:55:51 +08:00
|
|
|
I != E; ++I) {
|
|
|
|
BindingKey NextKey = I.getKey();
|
2013-02-15 08:32:03 +08:00
|
|
|
if (NextKey.getRegion() == TopKey.getRegion()) {
|
2012-11-10 09:40:08 +08:00
|
|
|
// FIXME: This doesn't catch the case where we're really invalidating a
|
|
|
|
// region with a symbolic offset. Example:
|
|
|
|
// R: points[i].y
|
|
|
|
// Next: points[0].x
|
|
|
|
|
2013-02-15 08:32:03 +08:00
|
|
|
if (NextKey.getOffset() > TopKey.getOffset() &&
|
|
|
|
NextKey.getOffset() - TopKey.getOffset() < Length) {
|
2012-08-10 06:55:51 +08:00
|
|
|
// Case 1: The next binding is inside the region we're invalidating.
|
2013-02-28 09:53:08 +08:00
|
|
|
// Include it.
|
|
|
|
Bindings.push_back(*I);
|
2012-11-10 09:40:08 +08:00
|
|
|
|
2013-02-15 08:32:03 +08:00
|
|
|
} else if (NextKey.getOffset() == TopKey.getOffset()) {
|
2012-08-10 06:55:51 +08:00
|
|
|
// Case 2: The next binding is at the same offset as the region we're
|
|
|
|
// invalidating. In this case, we need to leave default bindings alone,
|
|
|
|
// since they may be providing a default value for a regions beyond what
|
|
|
|
// we're invalidating.
|
|
|
|
// FIXME: This is probably incorrect; consider invalidating an outer
|
|
|
|
// struct whose first field is bound to a LazyCompoundVal.
|
2013-02-15 08:32:06 +08:00
|
|
|
if (IncludeAllDefaultBindings || NextKey.isDirect())
|
2013-02-28 09:53:08 +08:00
|
|
|
Bindings.push_back(*I);
|
2012-08-10 06:55:51 +08:00
|
|
|
}
|
2013-02-15 08:32:03 +08:00
|
|
|
|
2012-08-09 02:23:27 +08:00
|
|
|
} else if (NextKey.hasSymbolicOffset()) {
|
|
|
|
const MemRegion *Base = NextKey.getConcreteOffsetRegion();
|
2018-01-18 04:27:26 +08:00
|
|
|
if (Top->isSubRegionOf(Base) && Top != Base) {
|
2012-08-10 06:55:51 +08:00
|
|
|
// Case 3: The next key is symbolic and we just changed something within
|
|
|
|
// its concrete region. We don't know if the binding is still valid, so
|
2013-02-28 09:53:08 +08:00
|
|
|
// we'll be conservative and include it.
|
2013-02-15 08:32:06 +08:00
|
|
|
if (IncludeAllDefaultBindings || NextKey.isDirect())
|
2012-11-10 09:40:08 +08:00
|
|
|
if (isCompatibleWithFields(NextKey, FieldsInSymbolicSubregions))
|
2013-02-28 09:53:08 +08:00
|
|
|
Bindings.push_back(*I);
|
2012-08-10 06:55:51 +08:00
|
|
|
} else if (const SubRegion *BaseSR = dyn_cast<SubRegion>(Base)) {
|
|
|
|
// Case 4: The next key is symbolic, but we changed a known
|
2013-02-28 09:53:08 +08:00
|
|
|
// super-region. In this case the binding is certainly included.
|
2018-01-18 04:27:26 +08:00
|
|
|
if (BaseSR->isSubRegionOf(Top))
|
2012-11-10 09:40:08 +08:00
|
|
|
if (isCompatibleWithFields(NextKey, FieldsInSymbolicSubregions))
|
2013-02-28 09:53:08 +08:00
|
|
|
Bindings.push_back(*I);
|
2012-08-10 06:55:51 +08:00
|
|
|
}
|
2012-08-09 02:23:27 +08:00
|
|
|
}
|
|
|
|
}
|
2013-02-15 08:32:03 +08:00
|
|
|
}
|
|
|
|
|
2013-02-28 09:53:08 +08:00
|
|
|
static void
|
|
|
|
collectSubRegionBindings(SmallVectorImpl<BindingPair> &Bindings,
|
|
|
|
SValBuilder &SVB, const ClusterBindings &Cluster,
|
|
|
|
const SubRegion *Top, bool IncludeAllDefaultBindings) {
|
|
|
|
collectSubRegionBindings(Bindings, SVB, Cluster, Top,
|
|
|
|
BindingKey::Make(Top, BindingKey::Default),
|
|
|
|
IncludeAllDefaultBindings);
|
2013-02-15 08:32:06 +08:00
|
|
|
}
|
|
|
|
|
2013-02-15 08:32:03 +08:00
|
|
|
RegionBindingsRef
|
|
|
|
RegionStoreManager::removeSubRegionBindings(RegionBindingsConstRef B,
|
|
|
|
const SubRegion *Top) {
|
|
|
|
BindingKey TopKey = BindingKey::Make(Top, BindingKey::Default);
|
|
|
|
const MemRegion *ClusterHead = TopKey.getBaseRegion();
|
2013-03-26 04:43:24 +08:00
|
|
|
|
2013-02-15 08:32:03 +08:00
|
|
|
if (Top == ClusterHead) {
|
|
|
|
// We can remove an entire cluster's bindings all in one go.
|
|
|
|
return B.remove(Top);
|
|
|
|
}
|
|
|
|
|
2013-03-27 02:57:51 +08:00
|
|
|
const ClusterBindings *Cluster = B.lookup(ClusterHead);
|
2013-03-26 04:43:24 +08:00
|
|
|
if (!Cluster) {
|
|
|
|
// If we're invalidating a region with a symbolic offset, we need to make
|
|
|
|
// sure we don't treat the base region as uninitialized anymore.
|
|
|
|
if (TopKey.hasSymbolicOffset()) {
|
|
|
|
const SubRegion *Concrete = TopKey.getConcreteOffsetRegion();
|
|
|
|
return B.addBinding(Concrete, BindingKey::Default, UnknownVal());
|
|
|
|
}
|
2013-02-15 08:32:03 +08:00
|
|
|
return B;
|
2013-03-26 04:43:24 +08:00
|
|
|
}
|
2013-02-15 08:32:03 +08:00
|
|
|
|
2013-02-28 09:53:08 +08:00
|
|
|
SmallVector<BindingPair, 32> Bindings;
|
|
|
|
collectSubRegionBindings(Bindings, svalBuilder, *Cluster, Top, TopKey,
|
|
|
|
/*IncludeAllDefaultBindings=*/false);
|
2013-02-15 08:32:03 +08:00
|
|
|
|
|
|
|
ClusterBindingsRef Result(*Cluster, CBFactory);
|
2013-02-28 09:53:08 +08:00
|
|
|
for (SmallVectorImpl<BindingPair>::const_iterator I = Bindings.begin(),
|
|
|
|
E = Bindings.end();
|
2013-02-15 08:32:03 +08:00
|
|
|
I != E; ++I)
|
2013-02-28 09:53:08 +08:00
|
|
|
Result = Result.remove(I->first);
|
2012-08-09 02:23:27 +08:00
|
|
|
|
2012-11-10 09:40:08 +08:00
|
|
|
// If we're invalidating a region with a symbolic offset, we need to make sure
|
|
|
|
// we don't treat the base region as uninitialized anymore.
|
2013-03-23 08:39:17 +08:00
|
|
|
// FIXME: This isn't very precise; see the example in
|
|
|
|
// collectSubRegionBindings.
|
2013-02-15 08:32:03 +08:00
|
|
|
if (TopKey.hasSymbolicOffset()) {
|
|
|
|
const SubRegion *Concrete = TopKey.getConcreteOffsetRegion();
|
|
|
|
Result = Result.add(BindingKey::Make(Concrete, BindingKey::Default),
|
|
|
|
UnknownVal());
|
|
|
|
}
|
2012-11-10 09:40:08 +08:00
|
|
|
|
2012-12-07 03:40:32 +08:00
|
|
|
if (Result.isEmpty())
|
2012-12-07 09:55:21 +08:00
|
|
|
return B.remove(ClusterHead);
|
2012-12-07 14:49:27 +08:00
|
|
|
return B.add(ClusterHead, Result.asImmutableMap());
|
2009-08-01 14:17:29 +08:00
|
|
|
}
|
|
|
|
|
2010-02-03 11:06:46 +08:00
|
|
|
namespace {
|
2018-08-30 04:28:13 +08:00
|
|
|
class InvalidateRegionsWorker : public ClusterAnalysis<InvalidateRegionsWorker>
|
2010-03-11 00:32:56 +08:00
|
|
|
{
|
|
|
|
const Expr *Ex;
|
|
|
|
unsigned Count;
|
2012-02-18 07:13:45 +08:00
|
|
|
const LocationContext *LCtx;
|
2012-12-20 08:38:25 +08:00
|
|
|
InvalidatedSymbols &IS;
|
2013-09-25 07:47:29 +08:00
|
|
|
RegionAndSymbolInvalidationTraits &ITraits;
|
2010-08-15 04:44:32 +08:00
|
|
|
StoreManager::InvalidatedRegions *Regions;
|
2015-10-02 04:09:11 +08:00
|
|
|
GlobalsFilterKind GlobalsFilter;
|
2010-02-03 11:06:46 +08:00
|
|
|
public:
|
2018-08-30 04:28:13 +08:00
|
|
|
InvalidateRegionsWorker(RegionStoreManager &rm,
|
2011-08-16 06:09:50 +08:00
|
|
|
ProgramStateManager &stateMgr,
|
2012-12-07 09:55:21 +08:00
|
|
|
RegionBindingsRef b,
|
2010-03-11 00:32:56 +08:00
|
|
|
const Expr *ex, unsigned count,
|
2012-02-18 07:13:45 +08:00
|
|
|
const LocationContext *lctx,
|
2012-12-20 08:38:25 +08:00
|
|
|
InvalidatedSymbols &is,
|
2013-09-25 07:47:29 +08:00
|
|
|
RegionAndSymbolInvalidationTraits &ITraitsIn,
|
2010-10-26 08:06:15 +08:00
|
|
|
StoreManager::InvalidatedRegions *r,
|
2013-04-16 04:39:41 +08:00
|
|
|
GlobalsFilterKind GFK)
|
2018-08-30 04:28:13 +08:00
|
|
|
: ClusterAnalysis<InvalidateRegionsWorker>(rm, stateMgr, b),
|
2015-10-02 04:09:11 +08:00
|
|
|
Ex(ex), Count(count), LCtx(lctx), IS(is), ITraits(ITraitsIn), Regions(r),
|
|
|
|
GlobalsFilter(GFK) {}
|
2010-03-10 15:19:59 +08:00
|
|
|
|
2013-09-25 07:47:29 +08:00
|
|
|
void VisitCluster(const MemRegion *baseR, const ClusterBindings *C);
|
2010-02-13 08:54:03 +08:00
|
|
|
void VisitBinding(SVal V);
|
2015-09-25 00:52:56 +08:00
|
|
|
|
|
|
|
using ClusterAnalysis::AddToWorkList;
|
|
|
|
|
|
|
|
bool AddToWorkList(const MemRegion *R);
|
2015-10-02 04:09:11 +08:00
|
|
|
|
|
|
|
/// Returns true if all clusters in the memory space for \p Base should be
|
|
|
|
/// be invalidated.
|
|
|
|
bool includeEntireMemorySpace(const MemRegion *Base);
|
|
|
|
|
|
|
|
/// Returns true if the memory space of the given region is one of the global
|
|
|
|
/// regions specially included at the start of invalidation.
|
|
|
|
bool isInitiallyIncludedGlobalRegion(const MemRegion *R);
|
2010-03-10 15:19:59 +08:00
|
|
|
};
|
2015-06-23 07:07:51 +08:00
|
|
|
}
|
2010-02-03 12:16:00 +08:00
|
|
|
|
2018-08-30 04:28:13 +08:00
|
|
|
bool InvalidateRegionsWorker::AddToWorkList(const MemRegion *R) {
|
2015-09-25 00:52:56 +08:00
|
|
|
bool doNotInvalidateSuperRegion = ITraits.hasTrait(
|
|
|
|
R, RegionAndSymbolInvalidationTraits::TK_DoNotInvalidateSuperRegion);
|
|
|
|
const MemRegion *BaseR = doNotInvalidateSuperRegion ? R : R->getBaseRegion();
|
|
|
|
return AddToWorkList(WorkListElement(BaseR), getCluster(BaseR));
|
|
|
|
}
|
|
|
|
|
2018-08-30 04:28:13 +08:00
|
|
|
void InvalidateRegionsWorker::VisitBinding(SVal V) {
|
2010-02-13 08:54:03 +08:00
|
|
|
// A symbol? Mark it touched by the invalidation.
|
2011-05-03 03:42:42 +08:00
|
|
|
if (SymbolRef Sym = V.getAsSymbol())
|
|
|
|
IS.insert(Sym);
|
2010-03-10 15:19:59 +08:00
|
|
|
|
2010-02-13 09:52:33 +08:00
|
|
|
if (const MemRegion *R = V.getAsRegion()) {
|
|
|
|
AddToWorkList(R);
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
|
|
|
|
// Is it a LazyCompoundVal? All references get invalidated as well.
|
2013-02-21 06:23:23 +08:00
|
|
|
if (Optional<nonloc::LazyCompoundVal> LCS =
|
2013-02-20 13:52:05 +08:00
|
|
|
V.getAs<nonloc::LazyCompoundVal>()) {
|
2010-02-13 09:52:33 +08:00
|
|
|
|
2013-02-15 08:32:12 +08:00
|
|
|
const RegionStoreManager::SValListTy &Vals = RM.getInterestingValues(*LCS);
|
2010-02-13 09:52:33 +08:00
|
|
|
|
2013-02-15 08:32:12 +08:00
|
|
|
for (RegionStoreManager::SValListTy::const_iterator I = Vals.begin(),
|
|
|
|
E = Vals.end();
|
|
|
|
I != E; ++I)
|
|
|
|
VisitBinding(*I);
|
2010-02-13 09:52:33 +08:00
|
|
|
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2018-08-30 04:28:13 +08:00
|
|
|
void InvalidateRegionsWorker::VisitCluster(const MemRegion *baseR,
|
2013-09-25 07:47:29 +08:00
|
|
|
const ClusterBindings *C) {
|
|
|
|
|
2015-09-08 11:50:52 +08:00
|
|
|
bool PreserveRegionsContents =
|
|
|
|
ITraits.hasTrait(baseR,
|
2013-09-25 07:47:29 +08:00
|
|
|
RegionAndSymbolInvalidationTraits::TK_PreserveContents);
|
|
|
|
|
2013-03-21 04:35:53 +08:00
|
|
|
if (C) {
|
|
|
|
for (ClusterBindings::iterator I = C->begin(), E = C->end(); I != E; ++I)
|
|
|
|
VisitBinding(I.getData());
|
2010-02-03 12:16:00 +08:00
|
|
|
|
2013-09-25 07:47:29 +08:00
|
|
|
// Invalidate regions contents.
|
|
|
|
if (!PreserveRegionsContents)
|
2013-03-21 04:35:53 +08:00
|
|
|
B = B.remove(baseR);
|
|
|
|
}
|
2010-03-10 15:19:59 +08:00
|
|
|
|
2018-08-11 02:28:04 +08:00
|
|
|
if (const auto *TO = dyn_cast<TypedValueRegion>(baseR)) {
|
|
|
|
if (const auto *RD = TO->getValueType()->getAsCXXRecordDecl()) {
|
|
|
|
|
|
|
|
// Lambdas can affect all static local variables without explicitly
|
|
|
|
// capturing those.
|
|
|
|
// We invalidate all static locals referenced inside the lambda body.
|
|
|
|
if (RD->isLambda() && RD->getLambdaCallOperator()->getBody()) {
|
|
|
|
using namespace ast_matchers;
|
|
|
|
|
|
|
|
const char *DeclBind = "DeclBind";
|
|
|
|
StatementMatcher RefToStatic = stmt(hasDescendant(declRefExpr(
|
|
|
|
to(varDecl(hasStaticStorageDuration()).bind(DeclBind)))));
|
|
|
|
auto Matches =
|
|
|
|
match(RefToStatic, *RD->getLambdaCallOperator()->getBody(),
|
|
|
|
RD->getASTContext());
|
|
|
|
|
|
|
|
for (BoundNodes &Match : Matches) {
|
|
|
|
auto *VD = Match.getNodeAs<VarDecl>(DeclBind);
|
|
|
|
const VarRegion *ToInvalidate =
|
|
|
|
RM.getRegionManager().getVarRegion(VD, LCtx);
|
|
|
|
AddToWorkList(ToInvalidate);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2010-03-11 00:32:56 +08:00
|
|
|
// BlockDataRegion? If so, invalidate captured variables that are passed
|
|
|
|
// by reference.
|
|
|
|
if (const BlockDataRegion *BR = dyn_cast<BlockDataRegion>(baseR)) {
|
|
|
|
for (BlockDataRegion::referenced_vars_iterator
|
|
|
|
BI = BR->referenced_vars_begin(), BE = BR->referenced_vars_end() ;
|
|
|
|
BI != BE; ++BI) {
|
2012-12-06 15:17:20 +08:00
|
|
|
const VarRegion *VR = BI.getCapturedRegion();
|
2010-03-11 00:32:56 +08:00
|
|
|
const VarDecl *VD = VR->getDecl();
|
2013-12-19 10:39:40 +08:00
|
|
|
if (VD->hasAttr<BlocksAttr>() || !VD->hasLocalStorage()) {
|
2010-03-11 00:32:56 +08:00
|
|
|
AddToWorkList(VR);
|
2012-05-05 05:48:42 +08:00
|
|
|
}
|
|
|
|
else if (Loc::isLocType(VR->getValueType())) {
|
|
|
|
// Map the current bindings to a Store to retrieve the value
|
|
|
|
// of the binding. If that binding itself is a region, we should
|
|
|
|
// invalidate that region. This is because a block may capture
|
|
|
|
// a pointer value, but the thing pointed by that pointer may
|
|
|
|
// get invalidated.
|
2012-12-08 03:54:25 +08:00
|
|
|
SVal V = RM.getBinding(B, loc::MemRegionVal(VR));
|
2013-02-21 06:23:23 +08:00
|
|
|
if (Optional<Loc> L = V.getAs<Loc>()) {
|
2012-05-05 05:48:42 +08:00
|
|
|
if (const MemRegion *LR = L->getAsRegion())
|
|
|
|
AddToWorkList(LR);
|
|
|
|
}
|
|
|
|
}
|
2010-02-03 12:16:00 +08:00
|
|
|
}
|
2010-03-11 00:32:56 +08:00
|
|
|
return;
|
|
|
|
}
|
2010-03-10 15:19:59 +08:00
|
|
|
|
2013-03-29 07:15:29 +08:00
|
|
|
// Symbolic region?
|
2013-09-25 07:47:29 +08:00
|
|
|
if (const SymbolicRegion *SR = dyn_cast<SymbolicRegion>(baseR))
|
|
|
|
IS.insert(SR->getSymbol());
|
2013-04-24 18:24:38 +08:00
|
|
|
|
2013-09-25 07:47:29 +08:00
|
|
|
// Nothing else should be done in the case when we preserve regions context.
|
|
|
|
if (PreserveRegionsContents)
|
2013-04-24 18:24:38 +08:00
|
|
|
return;
|
2013-03-21 04:35:53 +08:00
|
|
|
|
2010-08-15 04:44:32 +08:00
|
|
|
// Otherwise, we have a normal data region. Record that we touched the region.
|
|
|
|
if (Regions)
|
|
|
|
Regions->push_back(baseR);
|
|
|
|
|
2021-10-20 23:43:31 +08:00
|
|
|
if (isa<AllocaRegion, SymbolicRegion>(baseR)) {
|
2010-03-11 00:32:56 +08:00
|
|
|
// Invalidate the region by setting its default value to
|
2013-09-25 07:47:29 +08:00
|
|
|
// conjured symbol. The type of the symbol is irrelevant.
|
2010-11-24 08:54:37 +08:00
|
|
|
DefinedOrUnknownSVal V =
|
2012-08-22 14:26:06 +08:00
|
|
|
svalBuilder.conjureSymbolVal(baseR, Ex, LCtx, Ctx.IntTy, Count);
|
2012-12-07 09:55:21 +08:00
|
|
|
B = B.addBinding(baseR, BindingKey::Default, V);
|
2010-03-11 00:32:56 +08:00
|
|
|
return;
|
|
|
|
}
|
2010-03-10 15:19:59 +08:00
|
|
|
|
2010-03-11 00:32:56 +08:00
|
|
|
if (!baseR->isBoundable())
|
|
|
|
return;
|
2010-03-10 15:19:59 +08:00
|
|
|
|
2011-08-13 04:02:48 +08:00
|
|
|
const TypedValueRegion *TR = cast<TypedValueRegion>(baseR);
|
2010-08-11 14:10:55 +08:00
|
|
|
QualType T = TR->getValueType();
|
2010-03-10 15:19:59 +08:00
|
|
|
|
2013-04-16 04:39:48 +08:00
|
|
|
if (isInitiallyIncludedGlobalRegion(baseR)) {
|
|
|
|
// If the region is a global and we are invalidating all globals,
|
|
|
|
// erasing the entry is good enough. This causes all globals to be lazily
|
|
|
|
// symbolicated from the same base symbol.
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
|
2018-05-05 06:19:32 +08:00
|
|
|
if (T->isRecordType()) {
|
2010-08-21 14:26:59 +08:00
|
|
|
// Invalidate the region by setting its default value to
|
2013-09-25 07:47:29 +08:00
|
|
|
// conjured symbol. The type of the symbol is irrelevant.
|
2012-08-22 14:26:06 +08:00
|
|
|
DefinedOrUnknownSVal V = svalBuilder.conjureSymbolVal(baseR, Ex, LCtx,
|
|
|
|
Ctx.IntTy, Count);
|
2012-12-07 09:55:21 +08:00
|
|
|
B = B.addBinding(baseR, BindingKey::Default, V);
|
2010-03-11 00:32:56 +08:00
|
|
|
return;
|
|
|
|
}
|
2010-02-03 12:16:00 +08:00
|
|
|
|
2010-03-11 00:32:56 +08:00
|
|
|
if (const ArrayType *AT = Ctx.getAsArrayType(T)) {
|
2015-09-25 00:52:56 +08:00
|
|
|
bool doNotInvalidateSuperRegion = ITraits.hasTrait(
|
|
|
|
baseR,
|
|
|
|
RegionAndSymbolInvalidationTraits::TK_DoNotInvalidateSuperRegion);
|
|
|
|
|
|
|
|
if (doNotInvalidateSuperRegion) {
|
|
|
|
// We are not doing blank invalidation of the whole array region so we
|
|
|
|
// have to manually invalidate each elements.
|
|
|
|
Optional<uint64_t> NumElements;
|
|
|
|
|
|
|
|
// Compute lower and upper offsets for region within array.
|
|
|
|
if (const ConstantArrayType *CAT = dyn_cast<ConstantArrayType>(AT))
|
|
|
|
NumElements = CAT->getSize().getZExtValue();
|
|
|
|
if (!NumElements) // We are not dealing with a constant size array
|
|
|
|
goto conjure_default;
|
|
|
|
QualType ElementTy = AT->getElementType();
|
|
|
|
uint64_t ElemSize = Ctx.getTypeSize(ElementTy);
|
|
|
|
const RegionOffset &RO = baseR->getAsOffset();
|
|
|
|
const MemRegion *SuperR = baseR->getBaseRegion();
|
|
|
|
if (RO.hasSymbolicOffset()) {
|
|
|
|
// If base region has a symbolic offset,
|
|
|
|
// we revert to invalidating the super region.
|
|
|
|
if (SuperR)
|
|
|
|
AddToWorkList(SuperR);
|
|
|
|
goto conjure_default;
|
|
|
|
}
|
|
|
|
|
|
|
|
uint64_t LowerOffset = RO.getOffset();
|
|
|
|
uint64_t UpperOffset = LowerOffset + *NumElements * ElemSize;
|
|
|
|
bool UpperOverflow = UpperOffset < LowerOffset;
|
|
|
|
|
|
|
|
// Invalidate regions which are within array boundaries,
|
|
|
|
// or have a symbolic offset.
|
|
|
|
if (!SuperR)
|
|
|
|
goto conjure_default;
|
|
|
|
|
|
|
|
const ClusterBindings *C = B.lookup(SuperR);
|
|
|
|
if (!C)
|
|
|
|
goto conjure_default;
|
|
|
|
|
|
|
|
for (ClusterBindings::iterator I = C->begin(), E = C->end(); I != E;
|
|
|
|
++I) {
|
|
|
|
const BindingKey &BK = I.getKey();
|
|
|
|
Optional<uint64_t> ROffset =
|
|
|
|
BK.hasSymbolicOffset() ? Optional<uint64_t>() : BK.getOffset();
|
|
|
|
|
|
|
|
// Check offset is not symbolic and within array's boundaries.
|
|
|
|
// Handles arrays of 0 elements and of 0-sized elements as well.
|
|
|
|
if (!ROffset ||
|
2016-04-11 16:26:13 +08:00
|
|
|
((*ROffset >= LowerOffset && *ROffset < UpperOffset) ||
|
|
|
|
(UpperOverflow &&
|
|
|
|
(*ROffset >= LowerOffset || *ROffset < UpperOffset)) ||
|
|
|
|
(LowerOffset == UpperOffset && *ROffset == LowerOffset))) {
|
2015-09-25 00:52:56 +08:00
|
|
|
B = B.removeBinding(I.getKey());
|
|
|
|
// Bound symbolic regions need to be invalidated for dead symbol
|
|
|
|
// detection.
|
|
|
|
SVal V = I.getData();
|
|
|
|
const MemRegion *R = V.getAsRegion();
|
2021-10-20 23:43:31 +08:00
|
|
|
if (isa_and_nonnull<SymbolicRegion>(R))
|
2015-09-25 00:52:56 +08:00
|
|
|
VisitBinding(V);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
conjure_default:
|
2010-02-03 12:16:00 +08:00
|
|
|
// Set the default value of the array to conjured symbol.
|
2010-03-11 00:32:56 +08:00
|
|
|
DefinedOrUnknownSVal V =
|
2012-08-22 14:26:06 +08:00
|
|
|
svalBuilder.conjureSymbolVal(baseR, Ex, LCtx,
|
2012-02-18 07:13:45 +08:00
|
|
|
AT->getElementType(), Count);
|
2012-12-07 09:55:21 +08:00
|
|
|
B = B.addBinding(baseR, BindingKey::Default, V);
|
2010-03-11 00:32:56 +08:00
|
|
|
return;
|
2009-07-30 02:16:25 +08:00
|
|
|
}
|
2009-09-09 23:08:12 +08:00
|
|
|
|
2012-08-22 14:26:06 +08:00
|
|
|
DefinedOrUnknownSVal V = svalBuilder.conjureSymbolVal(baseR, Ex, LCtx,
|
|
|
|
T,Count);
|
2010-03-11 00:32:56 +08:00
|
|
|
assert(SymbolManager::canSymbolicate(T) || V.isUnknown());
|
2012-12-07 09:55:21 +08:00
|
|
|
B = B.addBinding(baseR, BindingKey::Direct, V);
|
2009-07-30 02:16:25 +08:00
|
|
|
}
|
|
|
|
|
2018-08-30 04:28:13 +08:00
|
|
|
bool InvalidateRegionsWorker::isInitiallyIncludedGlobalRegion(
|
2015-10-02 04:09:11 +08:00
|
|
|
const MemRegion *R) {
|
|
|
|
switch (GlobalsFilter) {
|
|
|
|
case GFK_None:
|
|
|
|
return false;
|
|
|
|
case GFK_SystemOnly:
|
|
|
|
return isa<GlobalSystemSpaceRegion>(R->getMemorySpace());
|
|
|
|
case GFK_All:
|
|
|
|
return isa<NonStaticGlobalSpaceRegion>(R->getMemorySpace());
|
|
|
|
}
|
|
|
|
|
|
|
|
llvm_unreachable("unknown globals filter");
|
|
|
|
}
|
|
|
|
|
2018-08-30 04:28:13 +08:00
|
|
|
bool InvalidateRegionsWorker::includeEntireMemorySpace(const MemRegion *Base) {
|
2015-10-02 04:09:11 +08:00
|
|
|
if (isInitiallyIncludedGlobalRegion(Base))
|
|
|
|
return true;
|
|
|
|
|
|
|
|
const MemSpaceRegion *MemSpace = Base->getMemorySpace();
|
|
|
|
return ITraits.hasTrait(MemSpace,
|
|
|
|
RegionAndSymbolInvalidationTraits::TK_EntireMemSpace);
|
|
|
|
}
|
|
|
|
|
2012-12-07 09:55:21 +08:00
|
|
|
RegionBindingsRef
|
|
|
|
RegionStoreManager::invalidateGlobalRegion(MemRegion::Kind K,
|
|
|
|
const Expr *Ex,
|
|
|
|
unsigned Count,
|
|
|
|
const LocationContext *LCtx,
|
|
|
|
RegionBindingsRef B,
|
|
|
|
InvalidatedRegions *Invalidated) {
|
2012-01-05 07:54:01 +08:00
|
|
|
// Bind the globals memory space to a new symbol that we will use to derive
|
|
|
|
// the bindings for all globals.
|
|
|
|
const GlobalsSpaceRegion *GS = MRMgr.getGlobalsRegion(K);
|
2019-07-16 12:46:31 +08:00
|
|
|
SVal V = svalBuilder.conjureSymbolVal(/* symbolTag = */ (const void*) GS, Ex, LCtx,
|
2012-08-22 14:26:06 +08:00
|
|
|
/* type does not matter */ Ctx.IntTy,
|
|
|
|
Count);
|
2012-01-05 07:54:01 +08:00
|
|
|
|
2012-12-07 09:55:21 +08:00
|
|
|
B = B.removeBinding(GS)
|
|
|
|
.addBinding(BindingKey::Make(GS, BindingKey::Default), V);
|
2012-01-05 07:54:01 +08:00
|
|
|
|
|
|
|
// Even if there are no bindings in the global scope, we still need to
|
|
|
|
// record that we touched it.
|
|
|
|
if (Invalidated)
|
|
|
|
Invalidated->push_back(GS);
|
|
|
|
|
|
|
|
return B;
|
|
|
|
}
|
|
|
|
|
2018-08-30 04:28:13 +08:00
|
|
|
void RegionStoreManager::populateWorkList(InvalidateRegionsWorker &W,
|
2013-04-02 09:28:24 +08:00
|
|
|
ArrayRef<SVal> Values,
|
|
|
|
InvalidatedRegions *TopLevelRegions) {
|
|
|
|
for (ArrayRef<SVal>::iterator I = Values.begin(),
|
|
|
|
E = Values.end(); I != E; ++I) {
|
|
|
|
SVal V = *I;
|
|
|
|
if (Optional<nonloc::LazyCompoundVal> LCS =
|
|
|
|
V.getAs<nonloc::LazyCompoundVal>()) {
|
|
|
|
|
|
|
|
const SValListTy &Vals = getInterestingValues(*LCS);
|
|
|
|
|
|
|
|
for (SValListTy::const_iterator I = Vals.begin(),
|
|
|
|
E = Vals.end(); I != E; ++I) {
|
2013-04-04 03:28:05 +08:00
|
|
|
// Note: the last argument is false here because these are
|
2013-04-02 09:28:24 +08:00
|
|
|
// non-top-level regions.
|
|
|
|
if (const MemRegion *R = (*I).getAsRegion())
|
2013-09-25 07:47:29 +08:00
|
|
|
W.AddToWorkList(R);
|
2013-04-02 09:28:24 +08:00
|
|
|
}
|
|
|
|
continue;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (const MemRegion *R = V.getAsRegion()) {
|
|
|
|
if (TopLevelRegions)
|
|
|
|
TopLevelRegions->push_back(R);
|
2013-09-25 07:47:29 +08:00
|
|
|
W.AddToWorkList(R);
|
2013-04-02 09:28:24 +08:00
|
|
|
continue;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2012-12-07 09:55:21 +08:00
|
|
|
StoreRef
|
|
|
|
RegionStoreManager::invalidateRegions(Store store,
|
2013-09-25 07:47:29 +08:00
|
|
|
ArrayRef<SVal> Values,
|
|
|
|
const Expr *Ex, unsigned Count,
|
|
|
|
const LocationContext *LCtx,
|
|
|
|
const CallEvent *Call,
|
|
|
|
InvalidatedSymbols &IS,
|
|
|
|
RegionAndSymbolInvalidationTraits &ITraits,
|
|
|
|
InvalidatedRegions *TopLevelRegions,
|
|
|
|
InvalidatedRegions *Invalidated) {
|
2013-04-16 04:39:41 +08:00
|
|
|
GlobalsFilterKind GlobalsFilter;
|
|
|
|
if (Call) {
|
|
|
|
if (Call->isInSystemHeader())
|
|
|
|
GlobalsFilter = GFK_SystemOnly;
|
|
|
|
else
|
|
|
|
GlobalsFilter = GFK_All;
|
|
|
|
} else {
|
|
|
|
GlobalsFilter = GFK_None;
|
|
|
|
}
|
|
|
|
|
|
|
|
RegionBindingsRef B = getRegionBindings(store);
|
2018-08-30 04:28:13 +08:00
|
|
|
InvalidateRegionsWorker W(*this, StateMgr, B, Ex, Count, LCtx, IS, ITraits,
|
2013-04-16 04:39:41 +08:00
|
|
|
Invalidated, GlobalsFilter);
|
2010-03-11 00:32:56 +08:00
|
|
|
|
|
|
|
// Scan the bindings and generate the clusters.
|
2010-10-26 08:06:15 +08:00
|
|
|
W.GenerateClusters();
|
2010-03-11 00:32:56 +08:00
|
|
|
|
2011-08-28 06:51:26 +08:00
|
|
|
// Add the regions to the worklist.
|
2013-09-25 07:47:29 +08:00
|
|
|
populateWorkList(W, Values, TopLevelRegions);
|
2010-03-11 00:32:56 +08:00
|
|
|
|
|
|
|
W.RunWorkList();
|
|
|
|
|
|
|
|
// Return the new bindings.
|
2013-03-21 04:35:53 +08:00
|
|
|
B = W.getRegionBindings();
|
2010-07-02 04:16:50 +08:00
|
|
|
|
2013-03-21 04:36:01 +08:00
|
|
|
// For calls, determine which global regions should be invalidated and
|
|
|
|
// invalidate them. (Note that function-static and immutable globals are never
|
|
|
|
// invalidated by this.)
|
2012-01-05 07:54:01 +08:00
|
|
|
// TODO: This could possibly be more precise with modules.
|
2013-04-16 04:39:41 +08:00
|
|
|
switch (GlobalsFilter) {
|
|
|
|
case GFK_All:
|
|
|
|
B = invalidateGlobalRegion(MemRegion::GlobalInternalSpaceRegionKind,
|
|
|
|
Ex, Count, LCtx, B, Invalidated);
|
Fix clang -Wimplicit-fallthrough warnings across llvm, NFC
This patch should not introduce any behavior changes. It consists of
mostly one of two changes:
1. Replacing fall through comments with the LLVM_FALLTHROUGH macro
2. Inserting 'break' before falling through into a case block consisting
of only 'break'.
We were already using this warning with GCC, but its warning behaves
slightly differently. In this patch, the following differences are
relevant:
1. GCC recognizes comments that say "fall through" as annotations, clang
doesn't
2. GCC doesn't warn on "case N: foo(); default: break;", clang does
3. GCC doesn't warn when the case contains a switch, but falls through
the outer case.
I will enable the warning separately in a follow-up patch so that it can
be cleanly reverted if necessary.
Reviewers: alexfh, rsmith, lattner, rtrieu, EricWF, bollu
Differential Revision: https://reviews.llvm.org/D53950
llvm-svn: 345882
2018-11-02 03:54:45 +08:00
|
|
|
LLVM_FALLTHROUGH;
|
2013-04-16 04:39:41 +08:00
|
|
|
case GFK_SystemOnly:
|
2012-01-05 07:54:01 +08:00
|
|
|
B = invalidateGlobalRegion(MemRegion::GlobalSystemSpaceRegionKind,
|
2012-02-18 07:13:45 +08:00
|
|
|
Ex, Count, LCtx, B, Invalidated);
|
Fix clang -Wimplicit-fallthrough warnings across llvm, NFC
This patch should not introduce any behavior changes. It consists of
mostly one of two changes:
1. Replacing fall through comments with the LLVM_FALLTHROUGH macro
2. Inserting 'break' before falling through into a case block consisting
of only 'break'.
We were already using this warning with GCC, but its warning behaves
slightly differently. In this patch, the following differences are
relevant:
1. GCC recognizes comments that say "fall through" as annotations, clang
doesn't
2. GCC doesn't warn on "case N: foo(); default: break;", clang does
3. GCC doesn't warn when the case contains a switch, but falls through
the outer case.
I will enable the warning separately in a follow-up patch so that it can
be cleanly reverted if necessary.
Reviewers: alexfh, rsmith, lattner, rtrieu, EricWF, bollu
Differential Revision: https://reviews.llvm.org/D53950
llvm-svn: 345882
2018-11-02 03:54:45 +08:00
|
|
|
LLVM_FALLTHROUGH;
|
2013-04-16 04:39:41 +08:00
|
|
|
case GFK_None:
|
|
|
|
break;
|
2010-07-02 04:16:50 +08:00
|
|
|
}
|
|
|
|
|
2012-12-08 02:32:08 +08:00
|
|
|
return StoreRef(B.asStore(), *this);
|
2010-02-03 11:06:46 +08:00
|
|
|
}
|
2010-03-10 15:20:03 +08:00
|
|
|
|
2009-06-17 06:36:44 +08:00
|
|
|
//===----------------------------------------------------------------------===//
|
|
|
|
// Location and region casting.
|
|
|
|
//===----------------------------------------------------------------------===//
|
|
|
|
|
2008-12-24 15:46:32 +08:00
|
|
|
/// ArrayToPointer - Emulates the "decay" of an array to a pointer
|
|
|
|
/// type. 'Array' represents the lvalue of the array being decayed
|
|
|
|
/// to a pointer, and the returned SVal represents the decayed
|
|
|
|
/// version of that lvalue (i.e., a pointer to the first element of
|
2010-12-23 02:53:44 +08:00
|
|
|
/// the array). This is called by ExprEngine when evaluating casts
|
2008-12-24 15:46:32 +08:00
|
|
|
/// from arrays to pointers.
|
2013-05-29 07:24:01 +08:00
|
|
|
SVal RegionStoreManager::ArrayToPointer(Loc Array, QualType T) {
|
2017-04-25 04:55:07 +08:00
|
|
|
if (Array.getAs<loc::ConcreteInt>())
|
|
|
|
return Array;
|
|
|
|
|
2013-02-20 13:52:05 +08:00
|
|
|
if (!Array.getAs<loc::MemRegionVal>())
|
2008-12-14 03:24:37 +08:00
|
|
|
return UnknownVal();
|
2009-09-09 23:08:12 +08:00
|
|
|
|
2017-04-13 17:56:07 +08:00
|
|
|
const SubRegion *R =
|
|
|
|
cast<SubRegion>(Array.castAs<loc::MemRegionVal>().getRegion());
|
2010-12-02 15:49:45 +08:00
|
|
|
NonLoc ZeroIdx = svalBuilder.makeZeroArrayIndex();
|
2013-05-29 07:24:01 +08:00
|
|
|
return loc::MemRegionVal(MRMgr.getElementRegion(T, ZeroIdx, R, Ctx));
|
2008-10-24 09:09:32 +08:00
|
|
|
}
|
|
|
|
|
2009-06-17 06:36:44 +08:00
|
|
|
//===----------------------------------------------------------------------===//
|
|
|
|
// Loading values from regions.
|
|
|
|
//===----------------------------------------------------------------------===//
|
|
|
|
|
2012-12-08 03:54:25 +08:00
|
|
|
SVal RegionStoreManager::getBinding(RegionBindingsConstRef B, Loc L, QualType T) {
|
2013-02-20 13:52:05 +08:00
|
|
|
assert(!L.getAs<UnknownVal>() && "location unknown");
|
|
|
|
assert(!L.getAs<UndefinedVal>() && "location undefined");
|
2010-03-10 15:20:03 +08:00
|
|
|
|
2010-11-12 07:10:10 +08:00
|
|
|
// For access to concrete addresses, return UnknownVal. Checks
|
|
|
|
// for null dereferences (and similar errors) are done by checkers, not
|
|
|
|
// the Store.
|
|
|
|
// FIXME: We can consider lazily symbolicating such memory, but we really
|
|
|
|
// should defer this when we can reason easily about symbolicating arrays
|
|
|
|
// of bytes.
|
2013-02-20 13:52:05 +08:00
|
|
|
if (L.getAs<loc::ConcreteInt>()) {
|
2010-11-12 07:10:10 +08:00
|
|
|
return UnknownVal();
|
|
|
|
}
|
2013-02-20 13:52:05 +08:00
|
|
|
if (!L.getAs<loc::MemRegionVal>()) {
|
2011-01-25 08:04:03 +08:00
|
|
|
return UnknownVal();
|
|
|
|
}
|
2010-03-10 15:20:03 +08:00
|
|
|
|
2013-02-20 13:52:05 +08:00
|
|
|
const MemRegion *MR = L.castAs<loc::MemRegionVal>().getRegion();
|
2009-04-03 15:33:13 +08:00
|
|
|
|
2015-11-06 02:56:42 +08:00
|
|
|
if (isa<BlockDataRegion>(MR)) {
|
|
|
|
return UnknownVal();
|
|
|
|
}
|
|
|
|
|
2017-10-04 23:59:40 +08:00
|
|
|
if (!isa<TypedValueRegion>(MR)) {
|
2010-06-26 02:22:31 +08:00
|
|
|
if (T.isNull()) {
|
2012-01-13 08:56:48 +08:00
|
|
|
if (const TypedRegion *TR = dyn_cast<TypedRegion>(MR))
|
2017-10-04 23:59:40 +08:00
|
|
|
T = TR->getLocationType()->getPointeeType();
|
|
|
|
else if (const SymbolicRegion *SR = dyn_cast<SymbolicRegion>(MR))
|
|
|
|
T = SR->getSymbol()->getType()->getPointeeType();
|
|
|
|
}
|
|
|
|
assert(!T.isNull() && "Unable to auto-detect binding type!");
|
2017-12-12 10:27:55 +08:00
|
|
|
assert(!T->isVoidType() && "Attempting to dereference a void pointer!");
|
2017-04-13 17:56:07 +08:00
|
|
|
MR = GetElementZeroRegion(cast<SubRegion>(MR), T);
|
2018-03-02 08:55:59 +08:00
|
|
|
} else {
|
|
|
|
T = cast<TypedValueRegion>(MR)->getValueType();
|
2010-06-26 02:22:31 +08:00
|
|
|
}
|
2009-09-09 23:08:12 +08:00
|
|
|
|
2008-12-24 15:46:32 +08:00
|
|
|
// FIXME: Perhaps this method should just take a 'const MemRegion*' argument
|
|
|
|
// instead of 'Loc', and have the other Loc cases handled at a higher level.
|
2011-08-13 04:02:48 +08:00
|
|
|
const TypedValueRegion *R = cast<TypedValueRegion>(MR);
|
2010-08-11 14:10:55 +08:00
|
|
|
QualType RTy = R->getValueType();
|
2008-10-21 13:29:26 +08:00
|
|
|
|
2013-01-10 02:46:17 +08:00
|
|
|
// FIXME: we do not yet model the parts of a complex type, so treat the
|
|
|
|
// whole thing as "unknown".
|
|
|
|
if (RTy->isAnyComplexType())
|
|
|
|
return UnknownVal();
|
|
|
|
|
2008-12-24 15:46:32 +08:00
|
|
|
// FIXME: We should eventually handle funny addressing. e.g.:
|
|
|
|
//
|
|
|
|
// int x = ...;
|
|
|
|
// int *p = &x;
|
|
|
|
// char *q = (char*) p;
|
|
|
|
// char c = *q; // returns the first byte of 'x'.
|
|
|
|
//
|
|
|
|
// Such funny addressing will occur due to layering of regions.
|
2010-04-27 05:31:17 +08:00
|
|
|
if (RTy->isStructureOrClassType())
|
2012-12-08 03:54:25 +08:00
|
|
|
return getBindingForStruct(B, R);
|
2009-09-09 23:08:12 +08:00
|
|
|
|
2009-08-07 05:43:54 +08:00
|
|
|
// FIXME: Handle unions.
|
|
|
|
if (RTy->isUnionType())
|
2013-10-24 04:08:55 +08:00
|
|
|
return createLazyBinding(B, R);
|
2009-05-03 08:27:40 +08:00
|
|
|
|
2012-06-16 09:28:00 +08:00
|
|
|
if (RTy->isArrayType()) {
|
|
|
|
if (RTy->isConstantArrayType())
|
2012-12-08 03:54:25 +08:00
|
|
|
return getBindingForArray(B, R);
|
2012-06-16 09:28:00 +08:00
|
|
|
else
|
|
|
|
return UnknownVal();
|
|
|
|
}
|
2009-05-03 08:27:40 +08:00
|
|
|
|
2009-03-09 17:15:51 +08:00
|
|
|
// FIXME: handle Vector types.
|
|
|
|
if (RTy->isVectorType())
|
2010-02-04 10:39:47 +08:00
|
|
|
return UnknownVal();
|
2009-06-28 22:16:39 +08:00
|
|
|
|
|
|
|
if (const FieldRegion* FR = dyn_cast<FieldRegion>(R))
|
2021-04-13 23:09:10 +08:00
|
|
|
return svalBuilder.evalCast(getBindingForField(B, FR), T, QualType{});
|
2010-01-11 10:33:26 +08:00
|
|
|
|
|
|
|
if (const ElementRegion* ER = dyn_cast<ElementRegion>(R)) {
|
|
|
|
// FIXME: Here we actually perform an implicit conversion from the loaded
|
|
|
|
// value to the element type. Eventually we want to compose these values
|
|
|
|
// more intelligently. For example, an 'element' can encompass multiple
|
|
|
|
// bound regions (e.g., several bound bytes), or could be a subset of
|
|
|
|
// a larger value.
|
2021-04-13 23:09:10 +08:00
|
|
|
return svalBuilder.evalCast(getBindingForElement(B, ER), T, QualType{});
|
2010-03-10 15:20:03 +08:00
|
|
|
}
|
2010-01-11 10:33:26 +08:00
|
|
|
|
|
|
|
if (const ObjCIvarRegion *IVR = dyn_cast<ObjCIvarRegion>(R)) {
|
|
|
|
// FIXME: Here we actually perform an implicit conversion from the loaded
|
|
|
|
// value to the ivar type. What we should model is stores to ivars
|
|
|
|
// that blow past the extent of the ivar. If the address of the ivar is
|
|
|
|
// reinterpretted, it is possible we stored a different value that could
|
|
|
|
// fit within the ivar. Either we need to cast these when storing them
|
|
|
|
// or reinterpret them lazily (as we do here).
|
2021-04-13 23:09:10 +08:00
|
|
|
return svalBuilder.evalCast(getBindingForObjCIvar(B, IVR), T, QualType{});
|
2010-01-11 10:33:26 +08:00
|
|
|
}
|
2009-09-09 23:08:12 +08:00
|
|
|
|
2010-01-11 10:33:26 +08:00
|
|
|
if (const VarRegion *VR = dyn_cast<VarRegion>(R)) {
|
|
|
|
// FIXME: Here we actually perform an implicit conversion from the loaded
|
|
|
|
// value to the variable type. What we should model is stores to variables
|
|
|
|
// that blow past the extent of the variable. If the address of the
|
|
|
|
// variable is reinterpretted, it is possible we stored a different value
|
|
|
|
// that could fit within the variable. Either we need to cast these when
|
2010-03-10 15:20:03 +08:00
|
|
|
// storing them or reinterpret them lazily (as we do here).
|
2021-04-13 23:09:10 +08:00
|
|
|
return svalBuilder.evalCast(getBindingForVar(B, VR), T, QualType{});
|
2010-01-11 10:33:26 +08:00
|
|
|
}
|
2009-07-21 06:58:02 +08:00
|
|
|
|
2012-12-07 09:55:21 +08:00
|
|
|
const SVal *V = B.lookup(R, BindingKey::Direct);
|
2008-10-21 13:29:26 +08:00
|
|
|
|
2008-12-20 14:32:12 +08:00
|
|
|
// Check if the region has a binding.
|
|
|
|
if (V)
|
2010-02-04 10:39:47 +08:00
|
|
|
return *V;
|
2008-12-24 15:46:32 +08:00
|
|
|
|
|
|
|
// The location does not have a bound value. This means that it has
|
|
|
|
// the value it had upon its creation and/or entry to the analyzed
|
|
|
|
// function/method. These are either symbolic values or 'undefined'.
|
2010-01-05 10:18:06 +08:00
|
|
|
if (R->hasStackNonParametersStorage()) {
|
2008-12-24 15:46:32 +08:00
|
|
|
// All stack variables are considered to have undefined values
|
|
|
|
// upon creation. All heap allocated blocks are considered to
|
|
|
|
// have undefined values as well unless they are explicitly bound
|
|
|
|
// to specific values.
|
2010-02-04 10:39:47 +08:00
|
|
|
return UndefinedVal();
|
2008-12-24 15:46:32 +08:00
|
|
|
}
|
|
|
|
|
2009-07-03 06:16:42 +08:00
|
|
|
// All other values are symbolic.
|
2010-12-02 15:49:45 +08:00
|
|
|
return svalBuilder.getRegionValueSymbolVal(R);
|
2008-10-21 13:29:26 +08:00
|
|
|
}
|
2009-09-09 23:08:12 +08:00
|
|
|
|
2013-03-20 06:38:09 +08:00
|
|
|
static QualType getUnderlyingType(const SubRegion *R) {
|
|
|
|
QualType RegionTy;
|
|
|
|
if (const TypedValueRegion *TVR = dyn_cast<TypedValueRegion>(R))
|
|
|
|
RegionTy = TVR->getValueType();
|
|
|
|
|
|
|
|
if (const SymbolicRegion *SR = dyn_cast<SymbolicRegion>(R))
|
|
|
|
RegionTy = SR->getSymbol()->getType();
|
|
|
|
|
|
|
|
return RegionTy;
|
|
|
|
}
|
|
|
|
|
2013-02-21 09:34:51 +08:00
|
|
|
/// Checks to see if store \p B has a lazy binding for region \p R.
|
|
|
|
///
|
|
|
|
/// If \p AllowSubregionBindings is \c false, a lazy binding will be rejected
|
|
|
|
/// if there are additional bindings within \p R.
|
|
|
|
///
|
|
|
|
/// Note that unlike RegionStoreManager::findLazyBinding, this will not search
|
|
|
|
/// for lazy bindings for super-regions of \p R.
|
|
|
|
static Optional<nonloc::LazyCompoundVal>
|
|
|
|
getExistingLazyBinding(SValBuilder &SVB, RegionBindingsConstRef B,
|
|
|
|
const SubRegion *R, bool AllowSubregionBindings) {
|
|
|
|
Optional<SVal> V = B.getDefaultBinding(R);
|
|
|
|
if (!V)
|
2013-02-21 11:12:21 +08:00
|
|
|
return None;
|
2013-02-21 09:34:51 +08:00
|
|
|
|
|
|
|
Optional<nonloc::LazyCompoundVal> LCV = V->getAs<nonloc::LazyCompoundVal>();
|
|
|
|
if (!LCV)
|
2013-02-21 11:12:21 +08:00
|
|
|
return None;
|
2013-02-21 09:34:51 +08:00
|
|
|
|
2013-03-20 06:38:09 +08:00
|
|
|
// If the LCV is for a subregion, the types might not match, and we shouldn't
|
|
|
|
// reuse the binding.
|
|
|
|
QualType RegionTy = getUnderlyingType(R);
|
|
|
|
if (!RegionTy.isNull() &&
|
|
|
|
!RegionTy->isVoidPointerType()) {
|
2013-02-21 09:34:51 +08:00
|
|
|
QualType SourceRegionTy = LCV->getRegion()->getValueType();
|
|
|
|
if (!SVB.getContext().hasSameUnqualifiedType(RegionTy, SourceRegionTy))
|
2013-02-21 11:12:21 +08:00
|
|
|
return None;
|
2013-02-21 09:34:51 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
if (!AllowSubregionBindings) {
|
|
|
|
// If there are any other bindings within this region, we shouldn't reuse
|
|
|
|
// the top-level binding.
|
2013-02-28 09:53:08 +08:00
|
|
|
SmallVector<BindingPair, 16> Bindings;
|
|
|
|
collectSubRegionBindings(Bindings, SVB, *B.lookup(R->getBaseRegion()), R,
|
|
|
|
/*IncludeAllDefaultBindings=*/true);
|
|
|
|
if (Bindings.size() > 1)
|
2013-02-21 11:12:21 +08:00
|
|
|
return None;
|
2013-02-21 09:34:51 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
return *LCV;
|
|
|
|
}
|
2013-02-20 04:28:33 +08:00
|
|
|
|
2013-02-21 09:34:51 +08:00
|
|
|
|
|
|
|
std::pair<Store, const SubRegion *>
|
|
|
|
RegionStoreManager::findLazyBinding(RegionBindingsConstRef B,
|
|
|
|
const SubRegion *R,
|
|
|
|
const SubRegion *originalRegion) {
|
2011-04-03 12:09:15 +08:00
|
|
|
if (originalRegion != R) {
|
2013-02-21 09:34:51 +08:00
|
|
|
if (Optional<nonloc::LazyCompoundVal> V =
|
|
|
|
getExistingLazyBinding(svalBuilder, B, R, true))
|
|
|
|
return std::make_pair(V->getStore(), V->getRegion());
|
2011-04-03 12:09:15 +08:00
|
|
|
}
|
2013-02-21 09:34:51 +08:00
|
|
|
|
|
|
|
typedef std::pair<Store, const SubRegion *> StoreRegionPair;
|
|
|
|
StoreRegionPair Result = StoreRegionPair();
|
|
|
|
|
2009-08-06 09:20:57 +08:00
|
|
|
if (const ElementRegion *ER = dyn_cast<ElementRegion>(R)) {
|
2013-02-21 09:34:51 +08:00
|
|
|
Result = findLazyBinding(B, cast<SubRegion>(ER->getSuperRegion()),
|
|
|
|
originalRegion);
|
2009-09-09 23:08:12 +08:00
|
|
|
|
2013-02-21 09:34:51 +08:00
|
|
|
if (Result.second)
|
|
|
|
Result.second = MRMgr.getElementRegionWithSuper(ER, Result.second);
|
|
|
|
|
|
|
|
} else if (const FieldRegion *FR = dyn_cast<FieldRegion>(R)) {
|
|
|
|
Result = findLazyBinding(B, cast<SubRegion>(FR->getSuperRegion()),
|
|
|
|
originalRegion);
|
|
|
|
|
|
|
|
if (Result.second)
|
|
|
|
Result.second = MRMgr.getFieldRegionWithSuper(FR, Result.second);
|
2009-09-09 23:08:12 +08:00
|
|
|
|
2013-02-20 04:28:33 +08:00
|
|
|
} else if (const CXXBaseObjectRegion *BaseReg =
|
|
|
|
dyn_cast<CXXBaseObjectRegion>(R)) {
|
|
|
|
// C++ base object region is another kind of region that we should blast
|
|
|
|
// through to look for lazy compound value. It is like a field region.
|
2013-02-21 09:34:51 +08:00
|
|
|
Result = findLazyBinding(B, cast<SubRegion>(BaseReg->getSuperRegion()),
|
|
|
|
originalRegion);
|
2015-09-08 11:50:52 +08:00
|
|
|
|
2013-02-21 09:34:51 +08:00
|
|
|
if (Result.second)
|
|
|
|
Result.second = MRMgr.getCXXBaseObjectRegionWithSuper(BaseReg,
|
|
|
|
Result.second);
|
2011-01-13 20:30:12 +08:00
|
|
|
}
|
2011-03-17 11:51:51 +08:00
|
|
|
|
2013-02-21 09:34:51 +08:00
|
|
|
return Result;
|
2009-08-06 09:20:57 +08:00
|
|
|
}
|
2008-10-21 13:29:26 +08:00
|
|
|
|
2012-12-08 03:54:25 +08:00
|
|
|
SVal RegionStoreManager::getBindingForElement(RegionBindingsConstRef B,
|
2012-05-09 07:40:38 +08:00
|
|
|
const ElementRegion* R) {
|
2009-06-25 13:29:39 +08:00
|
|
|
// Check if the region has a binding.
|
2012-12-07 09:55:21 +08:00
|
|
|
if (const Optional<SVal> &V = B.getDirectBinding(R))
|
2009-06-25 13:29:39 +08:00
|
|
|
return *V;
|
|
|
|
|
2009-07-02 07:19:52 +08:00
|
|
|
const MemRegion* superR = R->getSuperRegion();
|
|
|
|
|
2009-06-25 13:29:39 +08:00
|
|
|
// Check if the region is an element region of a string literal.
|
2018-05-05 04:52:39 +08:00
|
|
|
if (const StringRegion *StrR = dyn_cast<StringRegion>(superR)) {
|
2010-03-10 15:20:03 +08:00
|
|
|
// FIXME: Handle loads from strings where the literal is treated as
|
2009-09-30 00:36:48 +08:00
|
|
|
// an integer, e.g., *((unsigned int*)"hello")
|
2010-08-11 14:10:55 +08:00
|
|
|
QualType T = Ctx.getAsArrayType(StrR->getValueType())->getElementType();
|
2013-07-18 01:16:38 +08:00
|
|
|
if (!Ctx.hasSameUnqualifiedType(T, R->getElementType()))
|
2009-09-30 00:36:48 +08:00
|
|
|
return UnknownVal();
|
2010-03-10 15:20:03 +08:00
|
|
|
|
2009-06-25 13:29:39 +08:00
|
|
|
const StringLiteral *Str = StrR->getStringLiteral();
|
|
|
|
SVal Idx = R->getIndex();
|
2013-02-21 06:23:23 +08:00
|
|
|
if (Optional<nonloc::ConcreteInt> CI = Idx.getAs<nonloc::ConcreteInt>()) {
|
2009-06-25 13:29:39 +08:00
|
|
|
int64_t i = CI->getValue().getSExtValue();
|
2011-07-29 07:07:43 +08:00
|
|
|
// Abort on string underrun. This can be possible by arbitrary
|
2012-01-12 10:22:40 +08:00
|
|
|
// clients of getBindingForElement().
|
2011-07-29 07:07:43 +08:00
|
|
|
if (i < 0)
|
|
|
|
return UndefinedVal();
|
2011-11-15 04:05:54 +08:00
|
|
|
int64_t length = Str->getLength();
|
|
|
|
// Technically, only i == length is guaranteed to be null.
|
2010-07-29 14:40:33 +08:00
|
|
|
// However, such overflows should be caught before reaching this point;
|
|
|
|
// the only time such an access would be made is if a string literal was
|
|
|
|
// used to initialize a larger array.
|
2011-11-15 04:05:54 +08:00
|
|
|
char c = (i >= length) ? '\0' : Str->getCodeUnit(i);
|
2010-12-02 15:49:45 +08:00
|
|
|
return svalBuilder.makeIntVal(c, T);
|
2009-06-25 13:29:39 +08:00
|
|
|
}
|
2018-05-05 04:52:39 +08:00
|
|
|
} else if (const VarRegion *VR = dyn_cast<VarRegion>(superR)) {
|
2019-08-29 02:44:32 +08:00
|
|
|
// Check if the containing array has an initialized value that we can trust.
|
|
|
|
// We can trust a const value or a value of a global initializer in main().
|
2018-05-05 04:52:39 +08:00
|
|
|
const VarDecl *VD = VR->getDecl();
|
2019-08-29 02:44:32 +08:00
|
|
|
if (VD->getType().isConstQualified() ||
|
|
|
|
R->getElementType().isConstQualified() ||
|
|
|
|
(B.isMainAnalysis() && VD->hasGlobalStorage())) {
|
[analyzer][CrossTU] Extend CTU to VarDecls with initializer
Summary:
The existing CTU mechanism imports `FunctionDecl`s where the definition is available in another TU. This patch extends that to VarDecls, to bind more constants.
- Add VarDecl importing functionality to CrossTranslationUnitContext
- Import Decls while traversing them in AnalysisConsumer
- Add VarDecls to CTU external mappings generator
- Name changes from "external function map" to "external definition map"
Reviewers: NoQ, dcoughlin, xazax.hun, george.karpenkov, martong
Reviewed By: xazax.hun
Subscribers: Charusso, baloghadamsoftware, mikhail.ramalho, Szelethus, donat.nagy, dkrupp, george.karpenkov, mgorny, whisperity, szepet, rnkovacs, a.sidorin, cfe-commits
Tags: #clang
Differential Revision: https://reviews.llvm.org/D46421
llvm-svn: 358968
2019-04-23 19:04:41 +08:00
|
|
|
if (const Expr *Init = VD->getAnyInitializer()) {
|
2018-05-05 04:52:39 +08:00
|
|
|
if (const auto *InitList = dyn_cast<InitListExpr>(Init)) {
|
|
|
|
// The array index has to be known.
|
|
|
|
if (auto CI = R->getIndex().getAs<nonloc::ConcreteInt>()) {
|
2021-09-21 19:34:37 +08:00
|
|
|
// If it is not an array, return Undef.
|
|
|
|
QualType T = VD->getType();
|
|
|
|
const ConstantArrayType *CAT = Ctx.getAsConstantArrayType(T);
|
|
|
|
if (!CAT)
|
2018-05-29 22:14:22 +08:00
|
|
|
return UndefinedVal();
|
|
|
|
|
2021-09-21 19:34:37 +08:00
|
|
|
// Support one-dimensional array.
|
|
|
|
// C++20 [expr.add] 7.6.6.4 (excerpt):
|
|
|
|
// If P points to an array element i of an array object x with n
|
|
|
|
// elements, where i < 0 or i > n, the behavior is undefined.
|
|
|
|
// Dereferencing is not allowed on the "one past the last
|
|
|
|
// element", when i == n.
|
|
|
|
// Example:
|
|
|
|
// const int arr[4] = {1, 2};
|
|
|
|
// const int *ptr = arr;
|
|
|
|
// int x0 = ptr[0]; // 1
|
|
|
|
// int x1 = ptr[1]; // 2
|
|
|
|
// int x2 = ptr[2]; // 0
|
|
|
|
// int x3 = ptr[3]; // 0
|
|
|
|
// int x4 = ptr[4]; // UB
|
|
|
|
// TODO: Support multidimensional array.
|
|
|
|
if (!isa<ConstantArrayType>(CAT->getElementType())) {
|
|
|
|
// One-dimensional array.
|
|
|
|
const llvm::APSInt &Idx = CI->getValue();
|
|
|
|
const auto I = static_cast<uint64_t>(Idx.getExtValue());
|
|
|
|
// Use `getZExtValue` because array extent can not be negative.
|
|
|
|
const uint64_t Extent = CAT->getSize().getZExtValue();
|
|
|
|
// Check for `Idx < 0`, NOT for `I < 0`, because `Idx` CAN be
|
|
|
|
// negative, but `I` can NOT.
|
|
|
|
if (Idx < 0 || I >= Extent)
|
2018-05-29 22:14:22 +08:00
|
|
|
return UndefinedVal();
|
|
|
|
|
2021-09-21 19:34:37 +08:00
|
|
|
// C++20 [expr.add] 9.4.17.5 (excerpt):
|
|
|
|
// i-th array element is value-initialized for each k < i ≤ n,
|
|
|
|
// where k is an expression-list size and n is an array extent.
|
|
|
|
if (I >= InitList->getNumInits())
|
|
|
|
return svalBuilder.makeZeroVal(R->getElementType());
|
2018-05-05 04:52:39 +08:00
|
|
|
|
2021-09-21 19:34:37 +08:00
|
|
|
// Return a constant value, if it is presented.
|
|
|
|
// FIXME: Support other SVals.
|
|
|
|
const Expr *E = InitList->getInit(I);
|
|
|
|
if (Optional<SVal> V = svalBuilder.getConstantVal(E))
|
2018-05-05 04:52:39 +08:00
|
|
|
return *V;
|
2021-09-21 19:34:37 +08:00
|
|
|
}
|
2018-05-05 04:52:39 +08:00
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
2009-06-25 13:29:39 +08:00
|
|
|
}
|
2015-09-08 11:50:52 +08:00
|
|
|
|
2010-09-02 07:00:46 +08:00
|
|
|
// Check for loads from a code text region. For such loads, just give up.
|
2010-09-02 08:34:30 +08:00
|
|
|
if (isa<CodeTextRegion>(superR))
|
2010-09-02 07:00:46 +08:00
|
|
|
return UnknownVal();
|
2009-09-09 23:08:12 +08:00
|
|
|
|
2010-05-31 09:22:04 +08:00
|
|
|
// Handle the case where we are indexing into a larger scalar object.
|
|
|
|
// For example, this handles:
|
|
|
|
// int x = ...
|
|
|
|
// char *y = &x;
|
|
|
|
// return *y;
|
|
|
|
// FIXME: This is a hack, and doesn't do anything really intelligent yet.
|
2010-08-02 12:56:14 +08:00
|
|
|
const RegionRawOffset &O = R->getAsArrayOffset();
|
2015-09-08 11:50:52 +08:00
|
|
|
|
2011-05-20 07:37:58 +08:00
|
|
|
// If we cannot reason about the offset, return an unknown value.
|
|
|
|
if (!O.getRegion())
|
|
|
|
return UnknownVal();
|
2015-09-08 11:50:52 +08:00
|
|
|
|
|
|
|
if (const TypedValueRegion *baseR =
|
2011-08-13 04:02:48 +08:00
|
|
|
dyn_cast_or_null<TypedValueRegion>(O.getRegion())) {
|
2010-08-11 14:10:55 +08:00
|
|
|
QualType baseT = baseR->getValueType();
|
2010-05-31 09:22:04 +08:00
|
|
|
if (baseT->isScalarType()) {
|
|
|
|
QualType elemT = R->getElementType();
|
|
|
|
if (elemT->isScalarType()) {
|
|
|
|
if (Ctx.getTypeSizeInChars(baseT) >= Ctx.getTypeSizeInChars(elemT)) {
|
2012-12-07 09:55:21 +08:00
|
|
|
if (const Optional<SVal> &V = B.getDirectBinding(superR)) {
|
2010-05-31 09:22:04 +08:00
|
|
|
if (SymbolRef parentSym = V->getAsSymbol())
|
2010-12-02 15:49:45 +08:00
|
|
|
return svalBuilder.getDerivedRegionValueSymbolVal(parentSym, R);
|
2010-07-02 04:16:50 +08:00
|
|
|
|
2010-05-31 09:22:04 +08:00
|
|
|
if (V->isUnknownOrUndef())
|
|
|
|
return *V;
|
|
|
|
// Other cases: give up. We are indexing into a larger object
|
|
|
|
// that has some value, but we don't know how to handle that yet.
|
|
|
|
return UnknownVal();
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
2009-08-07 06:33:36 +08:00
|
|
|
}
|
2009-06-30 20:32:59 +08:00
|
|
|
}
|
2013-04-16 04:39:45 +08:00
|
|
|
return getBindingForFieldOrElementCommon(B, R, R->getElementType());
|
2009-06-25 13:29:39 +08:00
|
|
|
}
|
|
|
|
|
2012-12-08 03:54:25 +08:00
|
|
|
SVal RegionStoreManager::getBindingForField(RegionBindingsConstRef B,
|
|
|
|
const FieldRegion* R) {
|
2009-06-25 12:50:44 +08:00
|
|
|
|
|
|
|
// Check if the region has a binding.
|
2012-12-07 09:55:21 +08:00
|
|
|
if (const Optional<SVal> &V = B.getDirectBinding(R))
|
2009-06-25 12:50:44 +08:00
|
|
|
return *V;
|
|
|
|
|
2018-05-05 04:52:39 +08:00
|
|
|
// Is the field declared constant and has an in-class initializer?
|
|
|
|
const FieldDecl *FD = R->getDecl();
|
|
|
|
QualType Ty = FD->getType();
|
|
|
|
if (Ty.isConstQualified())
|
|
|
|
if (const Expr *Init = FD->getInClassInitializer())
|
|
|
|
if (Optional<SVal> V = svalBuilder.getConstantVal(Init))
|
|
|
|
return *V;
|
|
|
|
|
|
|
|
// If the containing record was initialized, try to get its constant value.
|
|
|
|
const MemRegion* superR = R->getSuperRegion();
|
|
|
|
if (const auto *VR = dyn_cast<VarRegion>(superR)) {
|
|
|
|
const VarDecl *VD = VR->getDecl();
|
|
|
|
QualType RecordVarTy = VD->getType();
|
2018-05-09 20:27:21 +08:00
|
|
|
unsigned Index = FD->getFieldIndex();
|
2019-08-29 02:44:32 +08:00
|
|
|
// Either the record variable or the field has an initializer that we can
|
|
|
|
// trust. We trust initializers of constants and, additionally, respect
|
|
|
|
// initializers of globals when analyzing main().
|
|
|
|
if (RecordVarTy.isConstQualified() || Ty.isConstQualified() ||
|
|
|
|
(B.isMainAnalysis() && VD->hasGlobalStorage()))
|
[analyzer][CrossTU] Extend CTU to VarDecls with initializer
Summary:
The existing CTU mechanism imports `FunctionDecl`s where the definition is available in another TU. This patch extends that to VarDecls, to bind more constants.
- Add VarDecl importing functionality to CrossTranslationUnitContext
- Import Decls while traversing them in AnalysisConsumer
- Add VarDecls to CTU external mappings generator
- Name changes from "external function map" to "external definition map"
Reviewers: NoQ, dcoughlin, xazax.hun, george.karpenkov, martong
Reviewed By: xazax.hun
Subscribers: Charusso, baloghadamsoftware, mikhail.ramalho, Szelethus, donat.nagy, dkrupp, george.karpenkov, mgorny, whisperity, szepet, rnkovacs, a.sidorin, cfe-commits
Tags: #clang
Differential Revision: https://reviews.llvm.org/D46421
llvm-svn: 358968
2019-04-23 19:04:41 +08:00
|
|
|
if (const Expr *Init = VD->getAnyInitializer())
|
2018-05-29 22:14:22 +08:00
|
|
|
if (const auto *InitList = dyn_cast<InitListExpr>(Init)) {
|
|
|
|
if (Index < InitList->getNumInits()) {
|
2018-05-09 20:27:21 +08:00
|
|
|
if (const Expr *FieldInit = InitList->getInit(Index))
|
|
|
|
if (Optional<SVal> V = svalBuilder.getConstantVal(FieldInit))
|
|
|
|
return *V;
|
2018-05-29 22:14:22 +08:00
|
|
|
} else {
|
|
|
|
return svalBuilder.makeZeroVal(Ty);
|
|
|
|
}
|
|
|
|
}
|
2018-05-05 04:52:39 +08:00
|
|
|
}
|
|
|
|
|
2013-04-16 04:39:45 +08:00
|
|
|
return getBindingForFieldOrElementCommon(B, R, Ty);
|
2009-08-07 06:33:36 +08:00
|
|
|
}
|
2009-09-09 23:08:12 +08:00
|
|
|
|
2010-07-02 04:16:50 +08:00
|
|
|
Optional<SVal>
|
2012-12-08 03:54:25 +08:00
|
|
|
RegionStoreManager::getBindingForDerivedDefaultValue(RegionBindingsConstRef B,
|
2012-01-12 10:22:40 +08:00
|
|
|
const MemRegion *superR,
|
|
|
|
const TypedValueRegion *R,
|
|
|
|
QualType Ty) {
|
2010-07-02 04:16:50 +08:00
|
|
|
|
2012-12-07 09:55:21 +08:00
|
|
|
if (const Optional<SVal> &D = B.getDefaultBinding(superR)) {
|
2011-03-17 11:51:51 +08:00
|
|
|
const SVal &val = D.getValue();
|
|
|
|
if (SymbolRef parentSym = val.getAsSymbol())
|
2010-12-02 15:49:45 +08:00
|
|
|
return svalBuilder.getDerivedRegionValueSymbolVal(parentSym, R);
|
2010-07-02 04:16:50 +08:00
|
|
|
|
2011-03-17 11:51:51 +08:00
|
|
|
if (val.isZeroConstant())
|
2010-12-02 15:49:45 +08:00
|
|
|
return svalBuilder.makeZeroVal(Ty);
|
2010-07-02 04:16:50 +08:00
|
|
|
|
2011-03-17 11:51:51 +08:00
|
|
|
if (val.isUnknownOrUndef())
|
|
|
|
return val;
|
|
|
|
|
2013-02-27 08:05:29 +08:00
|
|
|
// Lazy bindings are usually handled through getExistingLazyBinding().
|
|
|
|
// We should unify these two code paths at some point.
|
2016-11-22 12:29:23 +08:00
|
|
|
if (val.getAs<nonloc::LazyCompoundVal>() ||
|
|
|
|
val.getAs<nonloc::CompoundVal>())
|
2013-02-27 08:05:29 +08:00
|
|
|
return val;
|
2010-07-02 04:16:50 +08:00
|
|
|
|
2011-09-23 13:06:16 +08:00
|
|
|
llvm_unreachable("Unknown default value");
|
2010-07-02 04:16:50 +08:00
|
|
|
}
|
|
|
|
|
2013-02-21 09:47:18 +08:00
|
|
|
return None;
|
2010-07-02 04:16:50 +08:00
|
|
|
}
|
|
|
|
|
2013-02-21 09:34:51 +08:00
|
|
|
SVal RegionStoreManager::getLazyBinding(const SubRegion *LazyBindingRegion,
|
2012-12-08 03:54:25 +08:00
|
|
|
RegionBindingsRef LazyBinding) {
|
2013-01-31 10:57:06 +08:00
|
|
|
SVal Result;
|
2012-12-08 03:54:25 +08:00
|
|
|
if (const ElementRegion *ER = dyn_cast<ElementRegion>(LazyBindingRegion))
|
2013-01-31 10:57:06 +08:00
|
|
|
Result = getBindingForElement(LazyBinding, ER);
|
|
|
|
else
|
|
|
|
Result = getBindingForField(LazyBinding,
|
|
|
|
cast<FieldRegion>(LazyBindingRegion));
|
|
|
|
|
2013-02-27 08:05:29 +08:00
|
|
|
// FIXME: This is a hack to deal with RegionStore's inability to distinguish a
|
2013-01-31 10:57:06 +08:00
|
|
|
// default value for /part/ of an aggregate from a default value for the
|
|
|
|
// /entire/ aggregate. The most common case of this is when struct Outer
|
|
|
|
// has as its first member a struct Inner, which is copied in from a stack
|
|
|
|
// variable. In this case, even if the Outer's default value is symbolic, 0,
|
|
|
|
// or unknown, it gets overridden by the Inner's default value of undefined.
|
|
|
|
//
|
|
|
|
// This is a general problem -- if the Inner is zero-initialized, the Outer
|
|
|
|
// will now look zero-initialized. The proper way to solve this is with a
|
|
|
|
// new version of RegionStore that tracks the extent of a binding as well
|
|
|
|
// as the offset.
|
|
|
|
//
|
|
|
|
// This hack only takes care of the undefined case because that can very
|
|
|
|
// quickly result in a warning.
|
|
|
|
if (Result.isUndef())
|
|
|
|
Result = UnknownVal();
|
|
|
|
|
|
|
|
return Result;
|
2011-03-17 11:51:51 +08:00
|
|
|
}
|
2015-09-08 11:50:52 +08:00
|
|
|
|
2012-12-08 03:54:25 +08:00
|
|
|
SVal
|
|
|
|
RegionStoreManager::getBindingForFieldOrElementCommon(RegionBindingsConstRef B,
|
2011-08-13 04:02:48 +08:00
|
|
|
const TypedValueRegion *R,
|
2013-04-16 04:39:45 +08:00
|
|
|
QualType Ty) {
|
2009-08-07 06:33:36 +08:00
|
|
|
|
2012-01-12 10:22:40 +08:00
|
|
|
// At this point we have already checked in either getBindingForElement or
|
|
|
|
// getBindingForField if 'R' has a direct binding.
|
2012-04-26 13:08:26 +08:00
|
|
|
|
|
|
|
// Lazy binding?
|
2014-05-27 10:45:47 +08:00
|
|
|
Store lazyBindingStore = nullptr;
|
|
|
|
const SubRegion *lazyBindingRegion = nullptr;
|
2014-03-02 21:01:17 +08:00
|
|
|
std::tie(lazyBindingStore, lazyBindingRegion) = findLazyBinding(B, R, R);
|
2012-04-26 13:08:26 +08:00
|
|
|
if (lazyBindingRegion)
|
2012-12-08 03:54:25 +08:00
|
|
|
return getLazyBinding(lazyBindingRegion,
|
|
|
|
getRegionBindings(lazyBindingStore));
|
2012-04-26 13:08:26 +08:00
|
|
|
|
2012-04-03 08:03:34 +08:00
|
|
|
// Record whether or not we see a symbolic index. That can completely
|
|
|
|
// be out of scope of our lookup.
|
|
|
|
bool hasSymbolicIndex = false;
|
2009-09-09 23:08:12 +08:00
|
|
|
|
2013-02-27 08:05:29 +08:00
|
|
|
// FIXME: This is a hack to deal with RegionStore's inability to distinguish a
|
|
|
|
// default value for /part/ of an aggregate from a default value for the
|
|
|
|
// /entire/ aggregate. The most common case of this is when struct Outer
|
|
|
|
// has as its first member a struct Inner, which is copied in from a stack
|
|
|
|
// variable. In this case, even if the Outer's default value is symbolic, 0,
|
|
|
|
// or unknown, it gets overridden by the Inner's default value of undefined.
|
|
|
|
//
|
|
|
|
// This is a general problem -- if the Inner is zero-initialized, the Outer
|
|
|
|
// will now look zero-initialized. The proper way to solve this is with a
|
|
|
|
// new version of RegionStore that tracks the extent of a binding as well
|
|
|
|
// as the offset.
|
|
|
|
//
|
|
|
|
// This hack only takes care of the undefined case because that can very
|
|
|
|
// quickly result in a warning.
|
|
|
|
bool hasPartialLazyBinding = false;
|
|
|
|
|
2018-03-01 13:43:23 +08:00
|
|
|
const SubRegion *SR = R;
|
2013-04-16 04:39:45 +08:00
|
|
|
while (SR) {
|
|
|
|
const MemRegion *Base = SR->getSuperRegion();
|
2013-02-27 08:05:29 +08:00
|
|
|
if (Optional<SVal> D = getBindingForDerivedDefaultValue(B, Base, R, Ty)) {
|
|
|
|
if (D->getAs<nonloc::LazyCompoundVal>()) {
|
|
|
|
hasPartialLazyBinding = true;
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
|
2010-07-02 04:16:50 +08:00
|
|
|
return *D;
|
2013-02-27 08:05:29 +08:00
|
|
|
}
|
2009-09-09 23:08:12 +08:00
|
|
|
|
2013-02-27 08:05:29 +08:00
|
|
|
if (const ElementRegion *ER = dyn_cast<ElementRegion>(Base)) {
|
2012-04-03 08:03:34 +08:00
|
|
|
NonLoc index = ER->getIndex();
|
|
|
|
if (!index.isConstant())
|
|
|
|
hasSymbolicIndex = true;
|
|
|
|
}
|
2015-09-08 11:50:52 +08:00
|
|
|
|
2009-08-01 14:17:29 +08:00
|
|
|
// If our super region is a field or element itself, walk up the region
|
|
|
|
// hierarchy to see if there is a default value installed in an ancestor.
|
2013-04-16 04:39:45 +08:00
|
|
|
SR = dyn_cast<SubRegion>(Base);
|
2009-08-06 09:20:57 +08:00
|
|
|
}
|
2009-09-09 23:08:12 +08:00
|
|
|
|
2010-01-05 10:18:06 +08:00
|
|
|
if (R->hasStackNonParametersStorage()) {
|
2012-04-03 08:03:34 +08:00
|
|
|
if (isa<ElementRegion>(R)) {
|
2009-08-07 06:33:36 +08:00
|
|
|
// Currently we don't reason specially about Clang-style vectors. Check
|
|
|
|
// if superR is a vector and if so return Unknown.
|
2015-09-08 11:50:52 +08:00
|
|
|
if (const TypedValueRegion *typedSuperR =
|
2013-04-16 04:39:45 +08:00
|
|
|
dyn_cast<TypedValueRegion>(R->getSuperRegion())) {
|
2010-08-11 14:10:55 +08:00
|
|
|
if (typedSuperR->getValueType()->isVectorType())
|
2009-08-07 06:33:36 +08:00
|
|
|
return UnknownVal();
|
2009-09-09 23:08:12 +08:00
|
|
|
}
|
2009-08-07 06:33:36 +08:00
|
|
|
}
|
2009-09-09 23:08:12 +08:00
|
|
|
|
2012-04-03 08:03:34 +08:00
|
|
|
// FIXME: We also need to take ElementRegions with symbolic indexes into
|
|
|
|
// account. This case handles both directly accessing an ElementRegion
|
|
|
|
// with a symbolic offset, but also fields within an element with
|
|
|
|
// a symbolic offset.
|
|
|
|
if (hasSymbolicIndex)
|
|
|
|
return UnknownVal();
|
2013-02-27 08:05:29 +08:00
|
|
|
|
2019-12-07 05:20:36 +08:00
|
|
|
// Additionally allow introspection of a block's internal layout.
|
|
|
|
if (!hasPartialLazyBinding && !isa<BlockDataRegion>(R->getBaseRegion()))
|
2013-02-27 08:05:29 +08:00
|
|
|
return UndefinedVal();
|
2009-08-07 06:33:36 +08:00
|
|
|
}
|
2009-09-09 23:08:12 +08:00
|
|
|
|
2009-07-03 06:16:42 +08:00
|
|
|
// All other values are symbolic.
|
2010-12-02 15:49:45 +08:00
|
|
|
return svalBuilder.getRegionValueSymbolVal(R);
|
2009-06-25 12:50:44 +08:00
|
|
|
}
|
2009-09-09 23:08:12 +08:00
|
|
|
|
2012-12-08 03:54:25 +08:00
|
|
|
SVal RegionStoreManager::getBindingForObjCIvar(RegionBindingsConstRef B,
|
2012-01-12 10:22:40 +08:00
|
|
|
const ObjCIvarRegion* R) {
|
2012-12-08 03:54:25 +08:00
|
|
|
// Check if the region has a binding.
|
2012-12-07 09:55:21 +08:00
|
|
|
if (const Optional<SVal> &V = B.getDirectBinding(R))
|
2009-07-15 14:09:28 +08:00
|
|
|
return *V;
|
2009-09-09 23:08:12 +08:00
|
|
|
|
2009-07-15 14:09:28 +08:00
|
|
|
const MemRegion *superR = R->getSuperRegion();
|
|
|
|
|
2009-10-20 09:20:57 +08:00
|
|
|
// Check if the super region has a default binding.
|
2012-12-07 09:55:21 +08:00
|
|
|
if (const Optional<SVal> &V = B.getDefaultBinding(superR)) {
|
2009-07-15 14:09:28 +08:00
|
|
|
if (SymbolRef parentSym = V->getAsSymbol())
|
2010-12-02 15:49:45 +08:00
|
|
|
return svalBuilder.getDerivedRegionValueSymbolVal(parentSym, R);
|
2009-09-09 23:08:12 +08:00
|
|
|
|
2009-07-15 14:09:28 +08:00
|
|
|
// Other cases: give up.
|
|
|
|
return UnknownVal();
|
|
|
|
}
|
2009-09-09 23:08:12 +08:00
|
|
|
|
2012-01-12 10:22:40 +08:00
|
|
|
return getBindingForLazySymbol(R);
|
2009-07-21 06:58:02 +08:00
|
|
|
}
|
|
|
|
|
2012-12-08 03:54:25 +08:00
|
|
|
SVal RegionStoreManager::getBindingForVar(RegionBindingsConstRef B,
|
|
|
|
const VarRegion *R) {
|
2009-09-09 23:08:12 +08:00
|
|
|
|
2009-07-21 08:12:07 +08:00
|
|
|
// Check if the region has a binding.
|
[analyzer] Make default bindings to variables actually work.
Default RegionStore bindings represent values that can be obtained by loading
from anywhere within the region, not just the specific offset within the region
that they are said to be bound to. For example, default-binding a character \0
to an int (eg., via memset()) means that the whole int is 0, not just
that its lower byte is 0.
Even though memset and bzero were modeled this way, it didn't work correctly
when applied to simple variables. Eg., in
int x;
memset(x, 0, sizeof(x));
we did produce a default binding, but were unable to read it later, and 'x'
was perceived as an uninitialized variable even after memset.
At the same time, if we replace 'x' with a variable of a structure or array
type, accessing fields or elements of such variable was working correctly,
which was enough for most cases. So this was only a problem for variables of
simple integer/enumeration/floating-point/pointer types.
Fix loading default bindings from RegionStore for regions of simple variables.
Add a unit test to document the API contract as well.
Differential Revision: https://reviews.llvm.org/D60742
llvm-svn: 358722
2019-04-19 07:35:56 +08:00
|
|
|
if (Optional<SVal> V = B.getDirectBinding(R))
|
|
|
|
return *V;
|
|
|
|
|
|
|
|
if (Optional<SVal> V = B.getDefaultBinding(R))
|
2009-07-21 08:12:07 +08:00
|
|
|
return *V;
|
2009-09-09 23:08:12 +08:00
|
|
|
|
2009-07-21 08:12:07 +08:00
|
|
|
// Lazily derive a value for the VarRegion.
|
|
|
|
const VarDecl *VD = R->getDecl();
|
2010-02-06 11:57:59 +08:00
|
|
|
const MemSpaceRegion *MS = R->getMemorySpace();
|
2010-03-10 15:20:03 +08:00
|
|
|
|
[analyzer] Try constant-evaluation for all variables, not just globals.
In C++, constants captured by lambdas (and blocks) are not actually stored
in the closure object, since they can be expanded at compile time. In this
case, they will have no binding when we go to look them up. Previously,
RegionStore thought they were uninitialized stack variables; now, it checks
to see if they are a constant we know how to evaluate, using the same logic
as r175026.
This particular code path is only for scalar variables. Constant arrays and
structs are still unfortunately unhandled; we'll need a stronger solution
for those.
This may have a small performance impact, but only for truly-undefined
local variables, captures in a non-inlined block, and non-constant globals.
Even then, in the non-constant case we're only doing a quick type check.
<rdar://problem/13105553>
llvm-svn: 175194
2013-02-15 03:06:11 +08:00
|
|
|
// Arguments are always symbolic.
|
|
|
|
if (isa<StackArgumentsSpaceRegion>(MS))
|
|
|
|
return svalBuilder.getRegionValueSymbolVal(R);
|
|
|
|
|
|
|
|
// Is 'VD' declared constant? If so, retrieve the constant value.
|
2017-12-04 12:46:47 +08:00
|
|
|
if (VD->getType().isConstQualified()) {
|
[analyzer][CrossTU] Extend CTU to VarDecls with initializer
Summary:
The existing CTU mechanism imports `FunctionDecl`s where the definition is available in another TU. This patch extends that to VarDecls, to bind more constants.
- Add VarDecl importing functionality to CrossTranslationUnitContext
- Import Decls while traversing them in AnalysisConsumer
- Add VarDecls to CTU external mappings generator
- Name changes from "external function map" to "external definition map"
Reviewers: NoQ, dcoughlin, xazax.hun, george.karpenkov, martong
Reviewed By: xazax.hun
Subscribers: Charusso, baloghadamsoftware, mikhail.ramalho, Szelethus, donat.nagy, dkrupp, george.karpenkov, mgorny, whisperity, szepet, rnkovacs, a.sidorin, cfe-commits
Tags: #clang
Differential Revision: https://reviews.llvm.org/D46421
llvm-svn: 358968
2019-04-23 19:04:41 +08:00
|
|
|
if (const Expr *Init = VD->getAnyInitializer()) {
|
[analyzer] Consolidate constant evaluation logic in SValBuilder.
Previously, this was scattered across Environment (literal expressions),
ExprEngine (default arguments), and RegionStore (global constants). The
former special-cased several kinds of simple constant expressions, while
the latter two deferred to the AST's constant evaluator.
Now, these are all unified as SValBuilder::getConstantVal(). To keep
Environment fast, the special cases for simple constant expressions have
been left in, but the main benefits are that (a) unusual constants like
ObjCStringLiterals now work as default arguments and global constant
initializers, and (b) we're not duplicating code between ExprEngine and
RegionStore.
This actually caught a bug in our test suite, which is awesome: we stop
tracking allocated memory if it's passed as an argument along with some
kind of callback, but not if the callback is 0. We were testing this in
a case where the callback parameter had a default value, but that value
was 0. After this change, the analyzer now (correctly) flags that as a
leak!
<rdar://problem/13773117>
llvm-svn: 180894
2013-05-02 07:10:44 +08:00
|
|
|
if (Optional<SVal> V = svalBuilder.getConstantVal(Init))
|
|
|
|
return *V;
|
[analyzer] Try constant-evaluation for all variables, not just globals.
In C++, constants captured by lambdas (and blocks) are not actually stored
in the closure object, since they can be expanded at compile time. In this
case, they will have no binding when we go to look them up. Previously,
RegionStore thought they were uninitialized stack variables; now, it checks
to see if they are a constant we know how to evaluate, using the same logic
as r175026.
This particular code path is only for scalar variables. Constant arrays and
structs are still unfortunately unhandled; we'll need a stronger solution
for those.
This may have a small performance impact, but only for truly-undefined
local variables, captures in a non-inlined block, and non-constant globals.
Even then, in the non-constant case we're only doing a quick type check.
<rdar://problem/13105553>
llvm-svn: 175194
2013-02-15 03:06:11 +08:00
|
|
|
|
2017-12-04 12:46:47 +08:00
|
|
|
// If the variable is const qualified and has an initializer but
|
|
|
|
// we couldn't evaluate initializer to a value, treat the value as
|
|
|
|
// unknown.
|
|
|
|
return UnknownVal();
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
[analyzer] Try constant-evaluation for all variables, not just globals.
In C++, constants captured by lambdas (and blocks) are not actually stored
in the closure object, since they can be expanded at compile time. In this
case, they will have no binding when we go to look them up. Previously,
RegionStore thought they were uninitialized stack variables; now, it checks
to see if they are a constant we know how to evaluate, using the same logic
as r175026.
This particular code path is only for scalar variables. Constant arrays and
structs are still unfortunately unhandled; we'll need a stronger solution
for those.
This may have a small performance impact, but only for truly-undefined
local variables, captures in a non-inlined block, and non-constant globals.
Even then, in the non-constant case we're only doing a quick type check.
<rdar://problem/13105553>
llvm-svn: 175194
2013-02-15 03:06:11 +08:00
|
|
|
// This must come after the check for constants because closure-captured
|
|
|
|
// constant variables may appear in UnknownSpaceRegion.
|
|
|
|
if (isa<UnknownSpaceRegion>(MS))
|
2010-12-02 15:49:45 +08:00
|
|
|
return svalBuilder.getRegionValueSymbolVal(R);
|
2009-09-09 23:08:12 +08:00
|
|
|
|
2010-02-06 11:57:59 +08:00
|
|
|
if (isa<GlobalsSpaceRegion>(MS)) {
|
[analyzer] Try constant-evaluation for all variables, not just globals.
In C++, constants captured by lambdas (and blocks) are not actually stored
in the closure object, since they can be expanded at compile time. In this
case, they will have no binding when we go to look them up. Previously,
RegionStore thought they were uninitialized stack variables; now, it checks
to see if they are a constant we know how to evaluate, using the same logic
as r175026.
This particular code path is only for scalar variables. Constant arrays and
structs are still unfortunately unhandled; we'll need a stronger solution
for those.
This may have a small performance impact, but only for truly-undefined
local variables, captures in a non-inlined block, and non-constant globals.
Even then, in the non-constant case we're only doing a quick type check.
<rdar://problem/13105553>
llvm-svn: 175194
2013-02-15 03:06:11 +08:00
|
|
|
QualType T = VD->getType();
|
|
|
|
|
2019-08-29 02:44:32 +08:00
|
|
|
// If we're in main(), then global initializers have not become stale yet.
|
|
|
|
if (B.isMainAnalysis())
|
|
|
|
if (const Expr *Init = VD->getAnyInitializer())
|
|
|
|
if (Optional<SVal> V = svalBuilder.getConstantVal(Init))
|
|
|
|
return *V;
|
|
|
|
|
2013-02-13 11:11:01 +08:00
|
|
|
// Function-scoped static variables are default-initialized to 0; if they
|
|
|
|
// have an initializer, it would have been processed by now.
|
2017-01-25 18:21:45 +08:00
|
|
|
// FIXME: This is only true when we're starting analysis from main().
|
|
|
|
// We're losing a lot of coverage here.
|
2013-02-13 11:11:01 +08:00
|
|
|
if (isa<StaticGlobalSpaceRegion>(MS))
|
|
|
|
return svalBuilder.makeZeroVal(T);
|
|
|
|
|
2013-02-27 08:05:29 +08:00
|
|
|
if (Optional<SVal> V = getBindingForDerivedDefaultValue(B, MS, R, T)) {
|
|
|
|
assert(!V->getAs<nonloc::LazyCompoundVal>());
|
2013-02-13 11:11:01 +08:00
|
|
|
return V.getValue();
|
2013-02-27 08:05:29 +08:00
|
|
|
}
|
2010-02-06 12:04:46 +08:00
|
|
|
|
2013-02-13 11:11:01 +08:00
|
|
|
return svalBuilder.getRegionValueSymbolVal(R);
|
2010-02-06 11:57:59 +08:00
|
|
|
}
|
2010-03-10 15:20:03 +08:00
|
|
|
|
2009-07-21 08:12:07 +08:00
|
|
|
return UndefinedVal();
|
|
|
|
}
|
|
|
|
|
2012-01-12 10:22:40 +08:00
|
|
|
SVal RegionStoreManager::getBindingForLazySymbol(const TypedValueRegion *R) {
|
2009-07-15 14:09:28 +08:00
|
|
|
// All other values are symbolic.
|
2010-12-02 15:49:45 +08:00
|
|
|
return svalBuilder.getRegionValueSymbolVal(R);
|
2009-07-15 14:09:28 +08:00
|
|
|
}
|
|
|
|
|
2013-02-15 08:32:12 +08:00
|
|
|
const RegionStoreManager::SValListTy &
|
|
|
|
RegionStoreManager::getInterestingValues(nonloc::LazyCompoundVal LCV) {
|
|
|
|
// First, check the cache.
|
|
|
|
LazyBindingsMapTy::iterator I = LazyBindingsMap.find(LCV.getCVData());
|
|
|
|
if (I != LazyBindingsMap.end())
|
|
|
|
return I->second;
|
|
|
|
|
|
|
|
// If we don't have a list of values cached, start constructing it.
|
2013-02-20 08:27:26 +08:00
|
|
|
SValListTy List;
|
2013-02-15 08:32:12 +08:00
|
|
|
|
|
|
|
const SubRegion *LazyR = LCV.getRegion();
|
|
|
|
RegionBindingsRef B = getRegionBindings(LCV.getStore());
|
|
|
|
|
|
|
|
// If this region had /no/ bindings at the time, there are no interesting
|
|
|
|
// values to return.
|
|
|
|
const ClusterBindings *Cluster = B.lookup(LazyR->getBaseRegion());
|
|
|
|
if (!Cluster)
|
2014-03-02 12:02:40 +08:00
|
|
|
return (LazyBindingsMap[LCV.getCVData()] = std::move(List));
|
2013-02-15 08:32:12 +08:00
|
|
|
|
2013-02-28 09:53:08 +08:00
|
|
|
SmallVector<BindingPair, 32> Bindings;
|
|
|
|
collectSubRegionBindings(Bindings, svalBuilder, *Cluster, LazyR,
|
|
|
|
/*IncludeAllDefaultBindings=*/true);
|
|
|
|
for (SmallVectorImpl<BindingPair>::const_iterator I = Bindings.begin(),
|
|
|
|
E = Bindings.end();
|
2013-02-15 08:32:12 +08:00
|
|
|
I != E; ++I) {
|
2013-02-28 09:53:08 +08:00
|
|
|
SVal V = I->second;
|
2013-02-15 08:32:12 +08:00
|
|
|
if (V.isUnknownOrUndef() || V.isConstant())
|
|
|
|
continue;
|
|
|
|
|
2013-02-21 06:23:23 +08:00
|
|
|
if (Optional<nonloc::LazyCompoundVal> InnerLCV =
|
2013-02-20 13:52:05 +08:00
|
|
|
V.getAs<nonloc::LazyCompoundVal>()) {
|
2013-02-15 08:32:12 +08:00
|
|
|
const SValListTy &InnerList = getInterestingValues(*InnerLCV);
|
|
|
|
List.insert(List.end(), InnerList.begin(), InnerList.end());
|
|
|
|
continue;
|
|
|
|
}
|
2015-09-08 11:50:52 +08:00
|
|
|
|
2013-02-15 08:32:12 +08:00
|
|
|
List.push_back(V);
|
|
|
|
}
|
|
|
|
|
2014-03-02 12:02:40 +08:00
|
|
|
return (LazyBindingsMap[LCV.getCVData()] = std::move(List));
|
2013-02-15 08:32:12 +08:00
|
|
|
}
|
|
|
|
|
2013-02-02 03:49:57 +08:00
|
|
|
NonLoc RegionStoreManager::createLazyBinding(RegionBindingsConstRef B,
|
|
|
|
const TypedValueRegion *R) {
|
2013-02-21 09:34:51 +08:00
|
|
|
if (Optional<nonloc::LazyCompoundVal> V =
|
|
|
|
getExistingLazyBinding(svalBuilder, B, R, false))
|
|
|
|
return *V;
|
2013-02-02 03:49:57 +08:00
|
|
|
|
|
|
|
return svalBuilder.makeLazyCompoundVal(StoreRef(B.asStore(), *this), R);
|
2012-07-07 05:59:56 +08:00
|
|
|
}
|
|
|
|
|
2013-08-30 00:06:04 +08:00
|
|
|
static bool isRecordEmpty(const RecordDecl *RD) {
|
|
|
|
if (!RD->field_empty())
|
|
|
|
return false;
|
|
|
|
if (const CXXRecordDecl *CRD = dyn_cast<CXXRecordDecl>(RD))
|
|
|
|
return CRD->getNumBases() == 0;
|
|
|
|
return true;
|
|
|
|
}
|
|
|
|
|
2012-12-08 03:54:25 +08:00
|
|
|
SVal RegionStoreManager::getBindingForStruct(RegionBindingsConstRef B,
|
2013-02-02 03:49:57 +08:00
|
|
|
const TypedValueRegion *R) {
|
2012-07-07 05:59:56 +08:00
|
|
|
const RecordDecl *RD = R->getValueType()->castAs<RecordType>()->getDecl();
|
2013-08-31 03:17:26 +08:00
|
|
|
if (!RD->getDefinition() || isRecordEmpty(RD))
|
2012-07-07 05:59:56 +08:00
|
|
|
return UnknownVal();
|
|
|
|
|
2013-02-02 03:49:57 +08:00
|
|
|
return createLazyBinding(B, R);
|
2008-10-31 15:16:08 +08:00
|
|
|
}
|
|
|
|
|
2012-12-08 03:54:25 +08:00
|
|
|
SVal RegionStoreManager::getBindingForArray(RegionBindingsConstRef B,
|
2013-02-02 03:49:57 +08:00
|
|
|
const TypedValueRegion *R) {
|
|
|
|
assert(Ctx.getAsConstantArrayType(R->getValueType()) &&
|
|
|
|
"Only constant array types can have compound bindings.");
|
2015-09-08 11:50:52 +08:00
|
|
|
|
2013-02-02 03:49:57 +08:00
|
|
|
return createLazyBinding(B, R);
|
2009-05-03 08:27:40 +08:00
|
|
|
}
|
|
|
|
|
2011-07-29 07:07:46 +08:00
|
|
|
bool RegionStoreManager::includedInBindings(Store store,
|
|
|
|
const MemRegion *region) const {
|
2012-12-07 09:55:21 +08:00
|
|
|
RegionBindingsRef B = getRegionBindings(store);
|
2011-07-29 07:07:46 +08:00
|
|
|
region = region->getBaseRegion();
|
2012-08-10 06:55:51 +08:00
|
|
|
|
|
|
|
// Quick path: if the base is the head of a cluster, the region is live.
|
|
|
|
if (B.lookup(region))
|
|
|
|
return true;
|
|
|
|
|
|
|
|
// Slow path: if the region is the VALUE of any binding, it is live.
|
2012-12-07 09:55:21 +08:00
|
|
|
for (RegionBindingsRef::iterator RI = B.begin(), RE = B.end(); RI != RE; ++RI) {
|
2012-08-10 06:55:51 +08:00
|
|
|
const ClusterBindings &Cluster = RI.getData();
|
|
|
|
for (ClusterBindings::iterator CI = Cluster.begin(), CE = Cluster.end();
|
|
|
|
CI != CE; ++CI) {
|
|
|
|
const SVal &D = CI.getData();
|
|
|
|
if (const MemRegion *R = D.getAsRegion())
|
|
|
|
if (R->getBaseRegion() == region)
|
|
|
|
return true;
|
|
|
|
}
|
2011-07-29 07:07:46 +08:00
|
|
|
}
|
2012-08-10 06:55:51 +08:00
|
|
|
|
2011-07-29 07:07:46 +08:00
|
|
|
return false;
|
|
|
|
}
|
|
|
|
|
2009-06-17 06:36:44 +08:00
|
|
|
//===----------------------------------------------------------------------===//
|
|
|
|
// Binding values to regions.
|
|
|
|
//===----------------------------------------------------------------------===//
|
|
|
|
|
2012-08-22 14:37:46 +08:00
|
|
|
StoreRef RegionStoreManager::killBinding(Store ST, Loc L) {
|
2013-02-21 06:23:23 +08:00
|
|
|
if (Optional<loc::MemRegionVal> LV = L.getAs<loc::MemRegionVal>())
|
2013-02-20 13:52:05 +08:00
|
|
|
if (const MemRegion* R = LV->getRegion())
|
2012-12-07 09:55:21 +08:00
|
|
|
return StoreRef(getRegionBindings(ST).removeBinding(R)
|
|
|
|
.asImmutableMap()
|
|
|
|
.getRootWithoutRetain(),
|
2011-02-19 09:59:33 +08:00
|
|
|
*this);
|
2009-09-09 23:08:12 +08:00
|
|
|
|
2012-08-22 14:37:46 +08:00
|
|
|
return StoreRef(ST, *this);
|
2009-06-17 06:36:44 +08:00
|
|
|
}
|
|
|
|
|
2012-12-08 03:54:25 +08:00
|
|
|
RegionBindingsRef
|
|
|
|
RegionStoreManager::bind(RegionBindingsConstRef B, Loc L, SVal V) {
|
2013-02-20 13:52:05 +08:00
|
|
|
if (L.getAs<loc::ConcreteInt>())
|
2012-12-08 03:54:25 +08:00
|
|
|
return B;
|
2009-06-28 18:16:11 +08:00
|
|
|
|
2008-12-20 14:32:12 +08:00
|
|
|
// If we get here, the location should be a region.
|
2013-02-20 13:52:05 +08:00
|
|
|
const MemRegion *R = L.castAs<loc::MemRegionVal>().getRegion();
|
2009-09-09 23:08:12 +08:00
|
|
|
|
2008-12-20 14:32:12 +08:00
|
|
|
// Check if the region is a struct region.
|
2012-05-11 06:02:39 +08:00
|
|
|
if (const TypedValueRegion* TR = dyn_cast<TypedValueRegion>(R)) {
|
|
|
|
QualType Ty = TR->getValueType();
|
2012-08-22 14:00:18 +08:00
|
|
|
if (Ty->isArrayType())
|
2012-12-08 03:54:25 +08:00
|
|
|
return bindArray(B, TR, V);
|
2012-05-11 06:02:39 +08:00
|
|
|
if (Ty->isStructureOrClassType())
|
2012-12-08 03:54:25 +08:00
|
|
|
return bindStruct(B, TR, V);
|
2012-05-11 06:02:39 +08:00
|
|
|
if (Ty->isVectorType())
|
2012-12-08 03:54:25 +08:00
|
|
|
return bindVector(B, TR, V);
|
2013-10-24 04:08:55 +08:00
|
|
|
if (Ty->isUnionType())
|
|
|
|
return bindAggregate(B, TR, V);
|
2012-05-11 06:02:39 +08:00
|
|
|
}
|
2009-09-09 23:08:12 +08:00
|
|
|
|
2012-08-09 02:23:27 +08:00
|
|
|
if (const SymbolicRegion *SR = dyn_cast<SymbolicRegion>(R)) {
|
2009-09-24 12:11:44 +08:00
|
|
|
// Binding directly to a symbolic region should be treated as binding
|
|
|
|
// to element 0.
|
2012-09-26 14:00:14 +08:00
|
|
|
QualType T = SR->getSymbol()->getType();
|
2012-09-06 01:11:22 +08:00
|
|
|
if (T->isAnyPointerType() || T->isReferenceType())
|
|
|
|
T = T->getPointeeType();
|
Add (initial?) static analyzer support for handling C++ references.
This change was a lot bigger than I originally anticipated; among
other things it requires us storing more information in the CFG to
record what block-level expressions need to be evaluated as lvalues.
The big change is that CFGBlocks no longer contain Stmt*'s by
CFGElements. Currently CFGElements just wrap Stmt*, but they also
store a bit indicating whether the block-level expression should be
evalauted as an lvalue. DeclStmts involving the initialization of a
reference require us treating the initialization expression as an
lvalue, even though that information isn't recorded in the AST.
Conceptually this change isn't that complicated, but it required
bubbling up the data through the CFGBuilder, to GRCoreEngine, and
eventually to GRExprEngine.
The addition of CFGElement is also useful for when we want to handle
more control-flow constructs or other data we want to keep in the CFG
that isn't represented well with just a block of statements.
In GRExprEngine, this patch introduces logic for evaluating the
lvalues of references, which currently retrieves the internal "pointer
value" that the reference represents. EvalLoad does a two stage load
to catch null dereferences involving an invalid reference (although
this could possibly be caught earlier during the initialization of a
reference).
Symbols are currently symbolicated using the reference type, instead
of a pointer type, and special handling is required creating
ElementRegions that layer on SymbolicRegions (see the changes to
RegionStoreManager).
Along the way, the DeadStoresChecker also silences warnings involving
dead stores to references. This was the original change I introduced
(which I wrote test cases for) that I realized caused GRExprEngine to
crash.
llvm-svn: 91501
2009-12-16 11:18:58 +08:00
|
|
|
|
2009-09-24 12:11:44 +08:00
|
|
|
R = GetElementZeroRegion(SR, T);
|
|
|
|
}
|
2009-09-09 23:08:12 +08:00
|
|
|
|
[analyzer] Do not invalidate the `this` pointer.
Summary:
`this` pointer is not an l-value, although we have modeled `CXXThisRegion` for `this` pointer, we can only bind it once, which is when we start to inline method. And this patch fixes https://bugs.llvm.org/show_bug.cgi?id=35506.
In addition, I didn't find any other cases other than loop-widen that could invalidate `this` pointer.
Reviewers: NoQ, george.karpenkov, a.sidorin, seaneveson, szepet
Reviewed By: NoQ
Subscribers: xazax.hun, rnkovacs, cfe-commits, MTC
Differential Revision: https://reviews.llvm.org/D45491
llvm-svn: 330095
2018-04-15 18:34:06 +08:00
|
|
|
assert((!isa<CXXThisRegion>(R) || !B.lookup(R)) &&
|
|
|
|
"'this' pointer is not an l-value and is not assignable");
|
|
|
|
|
2012-08-09 02:23:27 +08:00
|
|
|
// Clear out bindings that may overlap with this binding.
|
2012-12-08 03:54:25 +08:00
|
|
|
RegionBindingsRef NewB = removeSubRegionBindings(B, cast<SubRegion>(R));
|
|
|
|
return NewB.addBinding(BindingKey::Make(R, BindingKey::Direct), V);
|
2008-12-16 10:36:30 +08:00
|
|
|
}
|
|
|
|
|
2012-12-08 03:54:25 +08:00
|
|
|
RegionBindingsRef
|
|
|
|
RegionStoreManager::setImplicitDefaultValue(RegionBindingsConstRef B,
|
|
|
|
const MemRegion *R,
|
|
|
|
QualType T) {
|
2009-11-20 04:20:24 +08:00
|
|
|
SVal V;
|
|
|
|
|
2011-02-17 05:13:32 +08:00
|
|
|
if (Loc::isLocType(T))
|
2010-12-02 15:49:45 +08:00
|
|
|
V = svalBuilder.makeNull();
|
2013-04-09 10:30:33 +08:00
|
|
|
else if (T->isIntegralOrEnumerationType())
|
2010-12-02 15:49:45 +08:00
|
|
|
V = svalBuilder.makeZeroVal(T);
|
2010-04-27 05:31:17 +08:00
|
|
|
else if (T->isStructureOrClassType() || T->isArrayType()) {
|
2009-11-20 04:20:24 +08:00
|
|
|
// Set the default value to a zero constant when it is a structure
|
|
|
|
// or array. The type doesn't really matter.
|
2010-12-02 15:49:45 +08:00
|
|
|
V = svalBuilder.makeZeroVal(Ctx.IntTy);
|
2009-11-20 04:20:24 +08:00
|
|
|
}
|
|
|
|
else {
|
2011-06-28 04:36:38 +08:00
|
|
|
// We can't represent values of this type, but we still need to set a value
|
|
|
|
// to record that the region has been initialized.
|
|
|
|
// If this assertion ever fires, a new case should be added above -- we
|
|
|
|
// should know how to default-initialize any value we can symbolicate.
|
|
|
|
assert(!SymbolManager::canSymbolicate(T) && "This type is representable");
|
|
|
|
V = UnknownVal();
|
2009-11-20 04:20:24 +08:00
|
|
|
}
|
2010-01-11 08:07:44 +08:00
|
|
|
|
2012-12-08 03:54:25 +08:00
|
|
|
return B.addBinding(R, BindingKey::Default, V);
|
2009-11-20 04:20:24 +08:00
|
|
|
}
|
2010-03-10 15:20:03 +08:00
|
|
|
|
2012-12-08 03:54:25 +08:00
|
|
|
RegionBindingsRef
|
|
|
|
RegionStoreManager::bindArray(RegionBindingsConstRef B,
|
|
|
|
const TypedValueRegion* R,
|
|
|
|
SVal Init) {
|
2010-03-10 15:20:03 +08:00
|
|
|
|
2010-08-11 14:10:55 +08:00
|
|
|
const ArrayType *AT =cast<ArrayType>(Ctx.getCanonicalType(R->getValueType()));
|
2010-03-10 15:20:03 +08:00
|
|
|
QualType ElementTy = AT->getElementType();
|
2010-01-27 07:51:00 +08:00
|
|
|
Optional<uint64_t> Size;
|
2010-03-10 15:20:03 +08:00
|
|
|
|
2010-01-27 07:51:00 +08:00
|
|
|
if (const ConstantArrayType* CAT = dyn_cast<ConstantArrayType>(AT))
|
|
|
|
Size = CAT->getSize().getZExtValue();
|
2010-03-10 15:20:03 +08:00
|
|
|
|
2017-10-14 04:54:56 +08:00
|
|
|
// Check if the init expr is a literal. If so, bind the rvalue instead.
|
|
|
|
// FIXME: It's not responsibility of the Store to transform this lvalue
|
|
|
|
// to rvalue. ExprEngine or maybe even CFG should do this before binding.
|
2013-02-21 06:23:23 +08:00
|
|
|
if (Optional<loc::MemRegionVal> MRV = Init.getAs<loc::MemRegionVal>()) {
|
2017-10-14 04:54:56 +08:00
|
|
|
SVal V = getBinding(B.asStore(), *MRV, R->getValueType());
|
|
|
|
return bindAggregate(B, R, V);
|
2008-11-30 13:49:49 +08:00
|
|
|
}
|
2008-10-31 18:24:47 +08:00
|
|
|
|
2009-08-06 09:20:57 +08:00
|
|
|
// Handle lazy compound values.
|
2013-02-20 13:52:05 +08:00
|
|
|
if (Init.getAs<nonloc::LazyCompoundVal>())
|
2012-12-08 03:54:25 +08:00
|
|
|
return bindAggregate(B, R, Init);
|
2009-09-09 23:08:12 +08:00
|
|
|
|
2009-11-20 04:20:24 +08:00
|
|
|
if (Init.isUnknown())
|
2016-12-14 08:03:17 +08:00
|
|
|
return bindAggregate(B, R, UnknownVal());
|
2010-03-10 15:20:03 +08:00
|
|
|
|
2016-12-14 08:03:17 +08:00
|
|
|
// Remaining case: explicit compound values.
|
2013-02-20 13:52:05 +08:00
|
|
|
const nonloc::CompoundVal& CV = Init.castAs<nonloc::CompoundVal>();
|
2008-10-31 18:24:47 +08:00
|
|
|
nonloc::CompoundVal::iterator VI = CV.begin(), VE = CV.end();
|
2009-07-16 09:33:37 +08:00
|
|
|
uint64_t i = 0;
|
2009-09-09 23:08:12 +08:00
|
|
|
|
2012-12-08 03:54:25 +08:00
|
|
|
RegionBindingsRef NewB(B);
|
|
|
|
|
2010-01-27 07:51:00 +08:00
|
|
|
for (; Size.hasValue() ? i < Size.getValue() : true ; ++i, ++VI) {
|
2009-06-23 13:23:38 +08:00
|
|
|
// The init list might be shorter than the array length.
|
2008-12-20 14:32:12 +08:00
|
|
|
if (VI == VE)
|
|
|
|
break;
|
2008-10-24 16:42:28 +08:00
|
|
|
|
2010-12-02 15:49:45 +08:00
|
|
|
const NonLoc &Idx = svalBuilder.makeArrayIndex(i);
|
2010-08-15 18:08:38 +08:00
|
|
|
const ElementRegion *ER = MRMgr.getElementRegion(ElementTy, Idx, R, Ctx);
|
2008-11-19 19:06:24 +08:00
|
|
|
|
2010-04-27 05:31:17 +08:00
|
|
|
if (ElementTy->isStructureOrClassType())
|
2012-12-08 03:54:25 +08:00
|
|
|
NewB = bindStruct(NewB, ER, *VI);
|
2010-08-20 09:05:59 +08:00
|
|
|
else if (ElementTy->isArrayType())
|
2012-12-08 03:54:25 +08:00
|
|
|
NewB = bindArray(NewB, ER, *VI);
|
2008-12-20 14:32:12 +08:00
|
|
|
else
|
[analyzer] "Force" LazyCompoundVals on bind when they are simple enough.
The analyzer uses LazyCompoundVals to represent rvalues of aggregate types,
most importantly structs and arrays. This allows us to efficiently copy
around an entire struct, rather than doing a memberwise load every time a
struct rvalue is encountered. This can also keep memory usage down by
allowing several structs to "share" the same snapshotted bindings.
However, /lookup/ through LazyCompoundVals can be expensive, especially
since they can end up chaining back to the original value. While we try
to reuse LazyCompoundVals whenever it's safe, and cache information about
this transitivity, the fact is it's sometimes just not a good idea to
perpetuate LazyCompoundVals -- the tradeoffs just aren't worth it.
This commit changes RegionStore so that binding a LazyCompoundVal to struct
will do a memberwise copy if the struct is simple enough. Today's definition
of "simple enough" is "up to N scalar members" (see below), but that could
easily be changed in the future. This is enough to bring the test case in
PR15697 back down to a manageable analysis time (within 20% of its original
time, in an unfair test where the new analyzer is not compiled with LTO).
The actual value of "N" is controlled by a new -analyzer-config option,
'region-store-small-struct-limit'. It defaults to "2", meaning structs with
zero, one, or two scalar members will be considered "simple enough" for
this code path.
It's worth noting that a more straightforward implementation would do this
on load, not on bind, and make use of the structure we already have for this:
CompoundVal. A long time ago, this was actually how RegionStore modeled
aggregate-to-aggregate copies, but today it's only used for compound literals.
Unfortunately, it seems that we've special-cased LazyCompoundVal in certain
places (such as liveness checks) but failed to similarly special-case
CompoundVal in all of them. Until we're confident that CompoundVal is
handled properly everywhere, this solution is safer, since the entire
optimization is just an implementation detail of RegionStore.
<rdar://problem/13599304>
llvm-svn: 179767
2013-04-19 00:33:46 +08:00
|
|
|
NewB = bind(NewB, loc::MemRegionVal(ER), *VI);
|
2008-11-19 19:06:24 +08:00
|
|
|
}
|
|
|
|
|
[analyzer] Fix zero-initialization of stack VLAs under ObjC ARC.
Using ARC, strong, weak, and autoreleasing stack variables are implicitly
initialized with nil. This includes variable-length arrays of Objective-C object
pointers. However, in the analyzer we don't zero-initialize them. We used to,
but it accidentally regressed after r289618.
Under ARC, the array variable's initializer within DeclStmt is an
ImplicitValueInitExpr. Environment doesn't maintain any bindings for this
expression kind - instead it always knows that it's a known constant
(0 in our case), so it just returns the known value by calling
SValBuilder::makeZeroVal() (see EnvironmentManager::getSVal().
Commit r289618 had introduced reasonable behavior of SValBuilder::makeZeroVal()
for the arrays, which produces a zero-length compoundVal{}. When such value
is bound to arrays, in RegionStoreManager::bindArray() "remaining" items in the
array are default-initialized with zero, as in
RegionStoreManager::setImplicitDefaultValue(). The similar mechanism works when
an array is initialized by an initializer list that is too short, eg.
int a[3] = { 1, 2 };
would result in a[2] initialized with 0. However, in case of variable-length
arrays it didn't know if any more items need to be added,
because, well, the length is variable.
Add the default binding anyway, regardless of how many actually need
to be added. We don't really care how many, because the default binding covers
the whole array anyway.
Differential Revision: https://reviews.llvm.org/D41478
rdar://problem/35477763
llvm-svn: 321290
2017-12-22 02:43:02 +08:00
|
|
|
// If the init list is shorter than the array length (or the array has
|
|
|
|
// variable length), set the array default value. Values that are already set
|
|
|
|
// are not overwritten.
|
|
|
|
if (!Size.hasValue() || i < Size.getValue())
|
2012-12-08 03:54:25 +08:00
|
|
|
NewB = setImplicitDefaultValue(NewB, R, ElementTy);
|
2009-06-23 13:23:38 +08:00
|
|
|
|
2012-12-08 03:54:25 +08:00
|
|
|
return NewB;
|
2008-11-19 19:06:24 +08:00
|
|
|
}
|
|
|
|
|
2012-12-08 03:54:25 +08:00
|
|
|
RegionBindingsRef RegionStoreManager::bindVector(RegionBindingsConstRef B,
|
|
|
|
const TypedValueRegion* R,
|
|
|
|
SVal V) {
|
2012-05-11 06:02:39 +08:00
|
|
|
QualType T = R->getValueType();
|
2019-08-29 02:44:38 +08:00
|
|
|
const VectorType *VT = T->castAs<VectorType>(); // Use castAs for typedefs.
|
2015-09-08 11:50:52 +08:00
|
|
|
|
2012-08-10 06:55:54 +08:00
|
|
|
// Handle lazy compound values and symbolic values.
|
2013-02-20 13:52:05 +08:00
|
|
|
if (V.getAs<nonloc::LazyCompoundVal>() || V.getAs<nonloc::SymbolVal>())
|
2012-12-08 03:54:25 +08:00
|
|
|
return bindAggregate(B, R, V);
|
2015-09-08 11:50:52 +08:00
|
|
|
|
2012-05-11 06:02:39 +08:00
|
|
|
// We may get non-CompoundVal accidentally due to imprecise cast logic or
|
|
|
|
// that we are binding symbolic struct value. Kill the field values, and if
|
|
|
|
// the value is symbolic go and bind it as a "default" binding.
|
2013-02-20 13:52:05 +08:00
|
|
|
if (!V.getAs<nonloc::CompoundVal>()) {
|
2012-12-08 03:54:25 +08:00
|
|
|
return bindAggregate(B, R, UnknownVal());
|
2012-05-11 06:02:39 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
QualType ElemType = VT->getElementType();
|
2013-02-20 13:52:05 +08:00
|
|
|
nonloc::CompoundVal CV = V.castAs<nonloc::CompoundVal>();
|
2012-05-11 06:02:39 +08:00
|
|
|
nonloc::CompoundVal::iterator VI = CV.begin(), VE = CV.end();
|
|
|
|
unsigned index = 0, numElements = VT->getNumElements();
|
2012-12-08 03:54:25 +08:00
|
|
|
RegionBindingsRef NewB(B);
|
|
|
|
|
2012-05-11 06:02:39 +08:00
|
|
|
for ( ; index != numElements ; ++index) {
|
|
|
|
if (VI == VE)
|
|
|
|
break;
|
2015-09-08 11:50:52 +08:00
|
|
|
|
2012-05-11 06:02:39 +08:00
|
|
|
NonLoc Idx = svalBuilder.makeArrayIndex(index);
|
|
|
|
const ElementRegion *ER = MRMgr.getElementRegion(ElemType, Idx, R, Ctx);
|
[analyzer] "Force" LazyCompoundVals on bind when they are simple enough.
The analyzer uses LazyCompoundVals to represent rvalues of aggregate types,
most importantly structs and arrays. This allows us to efficiently copy
around an entire struct, rather than doing a memberwise load every time a
struct rvalue is encountered. This can also keep memory usage down by
allowing several structs to "share" the same snapshotted bindings.
However, /lookup/ through LazyCompoundVals can be expensive, especially
since they can end up chaining back to the original value. While we try
to reuse LazyCompoundVals whenever it's safe, and cache information about
this transitivity, the fact is it's sometimes just not a good idea to
perpetuate LazyCompoundVals -- the tradeoffs just aren't worth it.
This commit changes RegionStore so that binding a LazyCompoundVal to struct
will do a memberwise copy if the struct is simple enough. Today's definition
of "simple enough" is "up to N scalar members" (see below), but that could
easily be changed in the future. This is enough to bring the test case in
PR15697 back down to a manageable analysis time (within 20% of its original
time, in an unfair test where the new analyzer is not compiled with LTO).
The actual value of "N" is controlled by a new -analyzer-config option,
'region-store-small-struct-limit'. It defaults to "2", meaning structs with
zero, one, or two scalar members will be considered "simple enough" for
this code path.
It's worth noting that a more straightforward implementation would do this
on load, not on bind, and make use of the structure we already have for this:
CompoundVal. A long time ago, this was actually how RegionStore modeled
aggregate-to-aggregate copies, but today it's only used for compound literals.
Unfortunately, it seems that we've special-cased LazyCompoundVal in certain
places (such as liveness checks) but failed to similarly special-case
CompoundVal in all of them. Until we're confident that CompoundVal is
handled properly everywhere, this solution is safer, since the entire
optimization is just an implementation detail of RegionStore.
<rdar://problem/13599304>
llvm-svn: 179767
2013-04-19 00:33:46 +08:00
|
|
|
|
2012-05-11 06:02:39 +08:00
|
|
|
if (ElemType->isArrayType())
|
2012-12-08 03:54:25 +08:00
|
|
|
NewB = bindArray(NewB, ER, *VI);
|
2012-05-11 06:02:39 +08:00
|
|
|
else if (ElemType->isStructureOrClassType())
|
2012-12-08 03:54:25 +08:00
|
|
|
NewB = bindStruct(NewB, ER, *VI);
|
2012-05-11 06:02:39 +08:00
|
|
|
else
|
[analyzer] "Force" LazyCompoundVals on bind when they are simple enough.
The analyzer uses LazyCompoundVals to represent rvalues of aggregate types,
most importantly structs and arrays. This allows us to efficiently copy
around an entire struct, rather than doing a memberwise load every time a
struct rvalue is encountered. This can also keep memory usage down by
allowing several structs to "share" the same snapshotted bindings.
However, /lookup/ through LazyCompoundVals can be expensive, especially
since they can end up chaining back to the original value. While we try
to reuse LazyCompoundVals whenever it's safe, and cache information about
this transitivity, the fact is it's sometimes just not a good idea to
perpetuate LazyCompoundVals -- the tradeoffs just aren't worth it.
This commit changes RegionStore so that binding a LazyCompoundVal to struct
will do a memberwise copy if the struct is simple enough. Today's definition
of "simple enough" is "up to N scalar members" (see below), but that could
easily be changed in the future. This is enough to bring the test case in
PR15697 back down to a manageable analysis time (within 20% of its original
time, in an unfair test where the new analyzer is not compiled with LTO).
The actual value of "N" is controlled by a new -analyzer-config option,
'region-store-small-struct-limit'. It defaults to "2", meaning structs with
zero, one, or two scalar members will be considered "simple enough" for
this code path.
It's worth noting that a more straightforward implementation would do this
on load, not on bind, and make use of the structure we already have for this:
CompoundVal. A long time ago, this was actually how RegionStore modeled
aggregate-to-aggregate copies, but today it's only used for compound literals.
Unfortunately, it seems that we've special-cased LazyCompoundVal in certain
places (such as liveness checks) but failed to similarly special-case
CompoundVal in all of them. Until we're confident that CompoundVal is
handled properly everywhere, this solution is safer, since the entire
optimization is just an implementation detail of RegionStore.
<rdar://problem/13599304>
llvm-svn: 179767
2013-04-19 00:33:46 +08:00
|
|
|
NewB = bind(NewB, loc::MemRegionVal(ER), *VI);
|
|
|
|
}
|
|
|
|
return NewB;
|
|
|
|
}
|
|
|
|
|
|
|
|
Optional<RegionBindingsRef>
|
|
|
|
RegionStoreManager::tryBindSmallStruct(RegionBindingsConstRef B,
|
|
|
|
const TypedValueRegion *R,
|
|
|
|
const RecordDecl *RD,
|
|
|
|
nonloc::LazyCompoundVal LCV) {
|
|
|
|
FieldVector Fields;
|
|
|
|
|
|
|
|
if (const CXXRecordDecl *Class = dyn_cast<CXXRecordDecl>(RD))
|
|
|
|
if (Class->getNumBases() != 0 || Class->getNumVBases() != 0)
|
|
|
|
return None;
|
|
|
|
|
2014-03-09 04:12:42 +08:00
|
|
|
for (const auto *FD : RD->fields()) {
|
[analyzer] "Force" LazyCompoundVals on bind when they are simple enough.
The analyzer uses LazyCompoundVals to represent rvalues of aggregate types,
most importantly structs and arrays. This allows us to efficiently copy
around an entire struct, rather than doing a memberwise load every time a
struct rvalue is encountered. This can also keep memory usage down by
allowing several structs to "share" the same snapshotted bindings.
However, /lookup/ through LazyCompoundVals can be expensive, especially
since they can end up chaining back to the original value. While we try
to reuse LazyCompoundVals whenever it's safe, and cache information about
this transitivity, the fact is it's sometimes just not a good idea to
perpetuate LazyCompoundVals -- the tradeoffs just aren't worth it.
This commit changes RegionStore so that binding a LazyCompoundVal to struct
will do a memberwise copy if the struct is simple enough. Today's definition
of "simple enough" is "up to N scalar members" (see below), but that could
easily be changed in the future. This is enough to bring the test case in
PR15697 back down to a manageable analysis time (within 20% of its original
time, in an unfair test where the new analyzer is not compiled with LTO).
The actual value of "N" is controlled by a new -analyzer-config option,
'region-store-small-struct-limit'. It defaults to "2", meaning structs with
zero, one, or two scalar members will be considered "simple enough" for
this code path.
It's worth noting that a more straightforward implementation would do this
on load, not on bind, and make use of the structure we already have for this:
CompoundVal. A long time ago, this was actually how RegionStore modeled
aggregate-to-aggregate copies, but today it's only used for compound literals.
Unfortunately, it seems that we've special-cased LazyCompoundVal in certain
places (such as liveness checks) but failed to similarly special-case
CompoundVal in all of them. Until we're confident that CompoundVal is
handled properly everywhere, this solution is safer, since the entire
optimization is just an implementation detail of RegionStore.
<rdar://problem/13599304>
llvm-svn: 179767
2013-04-19 00:33:46 +08:00
|
|
|
if (FD->isUnnamedBitfield())
|
|
|
|
continue;
|
|
|
|
|
|
|
|
// If there are too many fields, or if any of the fields are aggregates,
|
|
|
|
// just use the LCV as a default binding.
|
|
|
|
if (Fields.size() == SmallStructLimit)
|
|
|
|
return None;
|
|
|
|
|
|
|
|
QualType Ty = FD->getType();
|
|
|
|
if (!(Ty->isScalarType() || Ty->isReferenceType()))
|
|
|
|
return None;
|
|
|
|
|
2014-03-09 04:12:42 +08:00
|
|
|
Fields.push_back(FD);
|
2012-05-11 06:02:39 +08:00
|
|
|
}
|
[analyzer] "Force" LazyCompoundVals on bind when they are simple enough.
The analyzer uses LazyCompoundVals to represent rvalues of aggregate types,
most importantly structs and arrays. This allows us to efficiently copy
around an entire struct, rather than doing a memberwise load every time a
struct rvalue is encountered. This can also keep memory usage down by
allowing several structs to "share" the same snapshotted bindings.
However, /lookup/ through LazyCompoundVals can be expensive, especially
since they can end up chaining back to the original value. While we try
to reuse LazyCompoundVals whenever it's safe, and cache information about
this transitivity, the fact is it's sometimes just not a good idea to
perpetuate LazyCompoundVals -- the tradeoffs just aren't worth it.
This commit changes RegionStore so that binding a LazyCompoundVal to struct
will do a memberwise copy if the struct is simple enough. Today's definition
of "simple enough" is "up to N scalar members" (see below), but that could
easily be changed in the future. This is enough to bring the test case in
PR15697 back down to a manageable analysis time (within 20% of its original
time, in an unfair test where the new analyzer is not compiled with LTO).
The actual value of "N" is controlled by a new -analyzer-config option,
'region-store-small-struct-limit'. It defaults to "2", meaning structs with
zero, one, or two scalar members will be considered "simple enough" for
this code path.
It's worth noting that a more straightforward implementation would do this
on load, not on bind, and make use of the structure we already have for this:
CompoundVal. A long time ago, this was actually how RegionStore modeled
aggregate-to-aggregate copies, but today it's only used for compound literals.
Unfortunately, it seems that we've special-cased LazyCompoundVal in certain
places (such as liveness checks) but failed to similarly special-case
CompoundVal in all of them. Until we're confident that CompoundVal is
handled properly everywhere, this solution is safer, since the entire
optimization is just an implementation detail of RegionStore.
<rdar://problem/13599304>
llvm-svn: 179767
2013-04-19 00:33:46 +08:00
|
|
|
|
|
|
|
RegionBindingsRef NewB = B;
|
2015-09-08 11:50:52 +08:00
|
|
|
|
[analyzer] "Force" LazyCompoundVals on bind when they are simple enough.
The analyzer uses LazyCompoundVals to represent rvalues of aggregate types,
most importantly structs and arrays. This allows us to efficiently copy
around an entire struct, rather than doing a memberwise load every time a
struct rvalue is encountered. This can also keep memory usage down by
allowing several structs to "share" the same snapshotted bindings.
However, /lookup/ through LazyCompoundVals can be expensive, especially
since they can end up chaining back to the original value. While we try
to reuse LazyCompoundVals whenever it's safe, and cache information about
this transitivity, the fact is it's sometimes just not a good idea to
perpetuate LazyCompoundVals -- the tradeoffs just aren't worth it.
This commit changes RegionStore so that binding a LazyCompoundVal to struct
will do a memberwise copy if the struct is simple enough. Today's definition
of "simple enough" is "up to N scalar members" (see below), but that could
easily be changed in the future. This is enough to bring the test case in
PR15697 back down to a manageable analysis time (within 20% of its original
time, in an unfair test where the new analyzer is not compiled with LTO).
The actual value of "N" is controlled by a new -analyzer-config option,
'region-store-small-struct-limit'. It defaults to "2", meaning structs with
zero, one, or two scalar members will be considered "simple enough" for
this code path.
It's worth noting that a more straightforward implementation would do this
on load, not on bind, and make use of the structure we already have for this:
CompoundVal. A long time ago, this was actually how RegionStore modeled
aggregate-to-aggregate copies, but today it's only used for compound literals.
Unfortunately, it seems that we've special-cased LazyCompoundVal in certain
places (such as liveness checks) but failed to similarly special-case
CompoundVal in all of them. Until we're confident that CompoundVal is
handled properly everywhere, this solution is safer, since the entire
optimization is just an implementation detail of RegionStore.
<rdar://problem/13599304>
llvm-svn: 179767
2013-04-19 00:33:46 +08:00
|
|
|
for (FieldVector::iterator I = Fields.begin(), E = Fields.end(); I != E; ++I){
|
|
|
|
const FieldRegion *SourceFR = MRMgr.getFieldRegion(*I, LCV.getRegion());
|
|
|
|
SVal V = getBindingForField(getRegionBindings(LCV.getStore()), SourceFR);
|
|
|
|
|
|
|
|
const FieldRegion *DestFR = MRMgr.getFieldRegion(*I, R);
|
|
|
|
NewB = bind(NewB, loc::MemRegionVal(DestFR), V);
|
|
|
|
}
|
|
|
|
|
2012-12-08 03:54:25 +08:00
|
|
|
return NewB;
|
2012-05-11 06:02:39 +08:00
|
|
|
}
|
|
|
|
|
2012-12-08 03:54:25 +08:00
|
|
|
RegionBindingsRef RegionStoreManager::bindStruct(RegionBindingsConstRef B,
|
|
|
|
const TypedValueRegion* R,
|
|
|
|
SVal V) {
|
2009-06-18 06:02:04 +08:00
|
|
|
if (!Features.supportsFields())
|
2012-12-08 03:54:25 +08:00
|
|
|
return B;
|
2009-09-09 23:08:12 +08:00
|
|
|
|
2010-08-11 14:10:55 +08:00
|
|
|
QualType T = R->getValueType();
|
2010-04-27 05:31:17 +08:00
|
|
|
assert(T->isStructureOrClassType());
|
2008-10-31 18:53:01 +08:00
|
|
|
|
2019-08-29 02:44:38 +08:00
|
|
|
const RecordType* RT = T->castAs<RecordType>();
|
[analyzer] "Force" LazyCompoundVals on bind when they are simple enough.
The analyzer uses LazyCompoundVals to represent rvalues of aggregate types,
most importantly structs and arrays. This allows us to efficiently copy
around an entire struct, rather than doing a memberwise load every time a
struct rvalue is encountered. This can also keep memory usage down by
allowing several structs to "share" the same snapshotted bindings.
However, /lookup/ through LazyCompoundVals can be expensive, especially
since they can end up chaining back to the original value. While we try
to reuse LazyCompoundVals whenever it's safe, and cache information about
this transitivity, the fact is it's sometimes just not a good idea to
perpetuate LazyCompoundVals -- the tradeoffs just aren't worth it.
This commit changes RegionStore so that binding a LazyCompoundVal to struct
will do a memberwise copy if the struct is simple enough. Today's definition
of "simple enough" is "up to N scalar members" (see below), but that could
easily be changed in the future. This is enough to bring the test case in
PR15697 back down to a manageable analysis time (within 20% of its original
time, in an unfair test where the new analyzer is not compiled with LTO).
The actual value of "N" is controlled by a new -analyzer-config option,
'region-store-small-struct-limit'. It defaults to "2", meaning structs with
zero, one, or two scalar members will be considered "simple enough" for
this code path.
It's worth noting that a more straightforward implementation would do this
on load, not on bind, and make use of the structure we already have for this:
CompoundVal. A long time ago, this was actually how RegionStore modeled
aggregate-to-aggregate copies, but today it's only used for compound literals.
Unfortunately, it seems that we've special-cased LazyCompoundVal in certain
places (such as liveness checks) but failed to similarly special-case
CompoundVal in all of them. Until we're confident that CompoundVal is
handled properly everywhere, this solution is safer, since the entire
optimization is just an implementation detail of RegionStore.
<rdar://problem/13599304>
llvm-svn: 179767
2013-04-19 00:33:46 +08:00
|
|
|
const RecordDecl *RD = RT->getDecl();
|
2009-03-11 17:07:35 +08:00
|
|
|
|
2011-10-07 14:10:15 +08:00
|
|
|
if (!RD->isCompleteDefinition())
|
2012-12-08 03:54:25 +08:00
|
|
|
return B;
|
2008-10-31 18:53:01 +08:00
|
|
|
|
2012-08-10 06:55:54 +08:00
|
|
|
// Handle lazy compound values and symbolic values.
|
[analyzer] "Force" LazyCompoundVals on bind when they are simple enough.
The analyzer uses LazyCompoundVals to represent rvalues of aggregate types,
most importantly structs and arrays. This allows us to efficiently copy
around an entire struct, rather than doing a memberwise load every time a
struct rvalue is encountered. This can also keep memory usage down by
allowing several structs to "share" the same snapshotted bindings.
However, /lookup/ through LazyCompoundVals can be expensive, especially
since they can end up chaining back to the original value. While we try
to reuse LazyCompoundVals whenever it's safe, and cache information about
this transitivity, the fact is it's sometimes just not a good idea to
perpetuate LazyCompoundVals -- the tradeoffs just aren't worth it.
This commit changes RegionStore so that binding a LazyCompoundVal to struct
will do a memberwise copy if the struct is simple enough. Today's definition
of "simple enough" is "up to N scalar members" (see below), but that could
easily be changed in the future. This is enough to bring the test case in
PR15697 back down to a manageable analysis time (within 20% of its original
time, in an unfair test where the new analyzer is not compiled with LTO).
The actual value of "N" is controlled by a new -analyzer-config option,
'region-store-small-struct-limit'. It defaults to "2", meaning structs with
zero, one, or two scalar members will be considered "simple enough" for
this code path.
It's worth noting that a more straightforward implementation would do this
on load, not on bind, and make use of the structure we already have for this:
CompoundVal. A long time ago, this was actually how RegionStore modeled
aggregate-to-aggregate copies, but today it's only used for compound literals.
Unfortunately, it seems that we've special-cased LazyCompoundVal in certain
places (such as liveness checks) but failed to similarly special-case
CompoundVal in all of them. Until we're confident that CompoundVal is
handled properly everywhere, this solution is safer, since the entire
optimization is just an implementation detail of RegionStore.
<rdar://problem/13599304>
llvm-svn: 179767
2013-04-19 00:33:46 +08:00
|
|
|
if (Optional<nonloc::LazyCompoundVal> LCV =
|
|
|
|
V.getAs<nonloc::LazyCompoundVal>()) {
|
|
|
|
if (Optional<RegionBindingsRef> NewB = tryBindSmallStruct(B, R, RD, *LCV))
|
|
|
|
return *NewB;
|
|
|
|
return bindAggregate(B, R, V);
|
|
|
|
}
|
|
|
|
if (V.getAs<nonloc::SymbolVal>())
|
2012-12-08 03:54:25 +08:00
|
|
|
return bindAggregate(B, R, V);
|
2009-09-09 23:08:12 +08:00
|
|
|
|
2010-07-29 08:28:47 +08:00
|
|
|
// We may get non-CompoundVal accidentally due to imprecise cast logic or
|
|
|
|
// that we are binding symbolic struct value. Kill the field values, and if
|
|
|
|
// the value is symbolic go and bind it as a "default" binding.
|
2013-02-20 13:52:05 +08:00
|
|
|
if (V.isUnknown() || !V.getAs<nonloc::CompoundVal>())
|
2012-12-08 03:54:25 +08:00
|
|
|
return bindAggregate(B, R, UnknownVal());
|
2009-06-11 17:11:27 +08:00
|
|
|
|
2019-03-15 08:22:59 +08:00
|
|
|
// The raw CompoundVal is essentially a symbolic InitListExpr: an (immutable)
|
|
|
|
// list of other values. It appears pretty much only when there's an actual
|
|
|
|
// initializer list expression in the program, and the analyzer tries to
|
|
|
|
// unwrap it as soon as possible.
|
|
|
|
// This code is where such unwrap happens: when the compound value is put into
|
|
|
|
// the object that it was supposed to initialize (it's an *initializer* list,
|
|
|
|
// after all), instead of binding the whole value to the whole object, we bind
|
|
|
|
// sub-values to sub-objects. Sub-values may themselves be compound values,
|
|
|
|
// and in this case the procedure becomes recursive.
|
|
|
|
// FIXME: The annoying part about compound values is that they don't carry
|
|
|
|
// any sort of information about which value corresponds to which sub-object.
|
|
|
|
// It's simply a list of values in the middle of nowhere; we expect to match
|
|
|
|
// them to sub-objects, essentially, "by index": first value binds to
|
|
|
|
// the first field, second value binds to the second field, etc.
|
|
|
|
// It would have been much safer to organize non-lazy compound values as
|
|
|
|
// a mapping from fields/bases to values.
|
2013-02-20 13:52:05 +08:00
|
|
|
const nonloc::CompoundVal& CV = V.castAs<nonloc::CompoundVal>();
|
2008-10-31 18:53:01 +08:00
|
|
|
nonloc::CompoundVal::iterator VI = CV.begin(), VE = CV.end();
|
2009-06-23 13:43:16 +08:00
|
|
|
|
2012-12-08 03:54:25 +08:00
|
|
|
RegionBindingsRef NewB(B);
|
|
|
|
|
2019-03-15 08:22:59 +08:00
|
|
|
// In C++17 aggregates may have base classes, handle those as well.
|
|
|
|
// They appear before fields in the initializer list / compound value.
|
|
|
|
if (const auto *CRD = dyn_cast<CXXRecordDecl>(RD)) {
|
2019-04-26 10:05:12 +08:00
|
|
|
// If the object was constructed with a constructor, its value is a
|
|
|
|
// LazyCompoundVal. If it's a raw CompoundVal, it means that we're
|
|
|
|
// performing aggregate initialization. The only exception from this
|
|
|
|
// rule is sending an Objective-C++ message that returns a C++ object
|
|
|
|
// to a nil receiver; in this case the semantics is to return a
|
|
|
|
// zero-initialized object even if it's a C++ object that doesn't have
|
|
|
|
// this sort of constructor; the CompoundVal is empty in this case.
|
|
|
|
assert((CRD->isAggregate() || (Ctx.getLangOpts().ObjC && VI == VE)) &&
|
2019-03-15 08:22:59 +08:00
|
|
|
"Non-aggregates are constructed with a constructor!");
|
|
|
|
|
|
|
|
for (const auto &B : CRD->bases()) {
|
|
|
|
// (Multiple inheritance is fine though.)
|
|
|
|
assert(!B.isVirtual() && "Aggregates cannot have virtual base classes!");
|
|
|
|
|
|
|
|
if (VI == VE)
|
|
|
|
break;
|
|
|
|
|
|
|
|
QualType BTy = B.getType();
|
|
|
|
assert(BTy->isStructureOrClassType() && "Base classes must be classes!");
|
|
|
|
|
|
|
|
const CXXRecordDecl *BRD = BTy->getAsCXXRecordDecl();
|
|
|
|
assert(BRD && "Base classes must be C++ classes!");
|
|
|
|
|
|
|
|
const CXXBaseObjectRegion *BR =
|
|
|
|
MRMgr.getCXXBaseObjectRegion(BRD, R, /*IsVirtual=*/false);
|
|
|
|
|
|
|
|
NewB = bindStruct(NewB, BR, *VI);
|
|
|
|
|
|
|
|
++VI;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
RecordDecl::field_iterator FI, FE;
|
|
|
|
|
2011-11-17 04:29:27 +08:00
|
|
|
for (FI = RD->field_begin(), FE = RD->field_end(); FI != FE; ++FI) {
|
2008-10-31 18:53:01 +08:00
|
|
|
|
2009-06-23 13:43:16 +08:00
|
|
|
if (VI == VE)
|
2008-12-20 14:32:12 +08:00
|
|
|
break;
|
2008-10-31 19:02:48 +08:00
|
|
|
|
2011-11-17 04:29:27 +08:00
|
|
|
// Skip any unnamed bitfields to stay in sync with the initializers.
|
2012-04-30 10:36:29 +08:00
|
|
|
if (FI->isUnnamedBitfield())
|
2011-11-17 04:29:27 +08:00
|
|
|
continue;
|
|
|
|
|
2012-04-30 10:36:29 +08:00
|
|
|
QualType FTy = FI->getType();
|
2012-06-07 04:45:41 +08:00
|
|
|
const FieldRegion* FR = MRMgr.getFieldRegion(*FI, R);
|
2008-10-31 19:02:48 +08:00
|
|
|
|
2009-09-23 05:19:14 +08:00
|
|
|
if (FTy->isArrayType())
|
2012-12-08 03:54:25 +08:00
|
|
|
NewB = bindArray(NewB, FR, *VI);
|
2010-04-27 05:31:17 +08:00
|
|
|
else if (FTy->isStructureOrClassType())
|
2012-12-08 03:54:25 +08:00
|
|
|
NewB = bindStruct(NewB, FR, *VI);
|
2009-09-23 05:19:14 +08:00
|
|
|
else
|
[analyzer] "Force" LazyCompoundVals on bind when they are simple enough.
The analyzer uses LazyCompoundVals to represent rvalues of aggregate types,
most importantly structs and arrays. This allows us to efficiently copy
around an entire struct, rather than doing a memberwise load every time a
struct rvalue is encountered. This can also keep memory usage down by
allowing several structs to "share" the same snapshotted bindings.
However, /lookup/ through LazyCompoundVals can be expensive, especially
since they can end up chaining back to the original value. While we try
to reuse LazyCompoundVals whenever it's safe, and cache information about
this transitivity, the fact is it's sometimes just not a good idea to
perpetuate LazyCompoundVals -- the tradeoffs just aren't worth it.
This commit changes RegionStore so that binding a LazyCompoundVal to struct
will do a memberwise copy if the struct is simple enough. Today's definition
of "simple enough" is "up to N scalar members" (see below), but that could
easily be changed in the future. This is enough to bring the test case in
PR15697 back down to a manageable analysis time (within 20% of its original
time, in an unfair test where the new analyzer is not compiled with LTO).
The actual value of "N" is controlled by a new -analyzer-config option,
'region-store-small-struct-limit'. It defaults to "2", meaning structs with
zero, one, or two scalar members will be considered "simple enough" for
this code path.
It's worth noting that a more straightforward implementation would do this
on load, not on bind, and make use of the structure we already have for this:
CompoundVal. A long time ago, this was actually how RegionStore modeled
aggregate-to-aggregate copies, but today it's only used for compound literals.
Unfortunately, it seems that we've special-cased LazyCompoundVal in certain
places (such as liveness checks) but failed to similarly special-case
CompoundVal in all of them. Until we're confident that CompoundVal is
handled properly everywhere, this solution is safer, since the entire
optimization is just an implementation detail of RegionStore.
<rdar://problem/13599304>
llvm-svn: 179767
2013-04-19 00:33:46 +08:00
|
|
|
NewB = bind(NewB, loc::MemRegionVal(FR), *VI);
|
2011-11-17 04:29:27 +08:00
|
|
|
++VI;
|
2008-11-19 19:06:24 +08:00
|
|
|
}
|
|
|
|
|
2009-06-23 13:43:16 +08:00
|
|
|
// There may be fewer values in the initialize list than the fields of struct.
|
2009-10-11 16:08:02 +08:00
|
|
|
if (FI != FE) {
|
2012-12-08 03:54:25 +08:00
|
|
|
NewB = NewB.addBinding(R, BindingKey::Default,
|
|
|
|
svalBuilder.makeIntVal(0, false));
|
2009-10-11 16:08:02 +08:00
|
|
|
}
|
2009-06-23 13:43:16 +08:00
|
|
|
|
2012-12-08 03:54:25 +08:00
|
|
|
return NewB;
|
2008-11-19 19:06:24 +08:00
|
|
|
}
|
|
|
|
|
2012-12-08 03:54:25 +08:00
|
|
|
RegionBindingsRef
|
|
|
|
RegionStoreManager::bindAggregate(RegionBindingsConstRef B,
|
|
|
|
const TypedRegion *R,
|
|
|
|
SVal Val) {
|
2012-08-09 02:23:27 +08:00
|
|
|
// Remove the old bindings, using 'R' as the root of all regions
|
2012-08-10 06:55:54 +08:00
|
|
|
// we will invalidate. Then add the new binding.
|
2012-12-08 03:54:25 +08:00
|
|
|
return removeSubRegionBindings(B, R).addBinding(R, BindingKey::Default, Val);
|
2012-08-10 06:55:51 +08:00
|
|
|
}
|
|
|
|
|
2009-06-17 06:36:44 +08:00
|
|
|
//===----------------------------------------------------------------------===//
|
|
|
|
// State pruning.
|
|
|
|
//===----------------------------------------------------------------------===//
|
2010-03-10 15:20:03 +08:00
|
|
|
|
2010-03-11 00:32:56 +08:00
|
|
|
namespace {
|
2018-08-30 04:28:13 +08:00
|
|
|
class RemoveDeadBindingsWorker
|
|
|
|
: public ClusterAnalysis<RemoveDeadBindingsWorker> {
|
2019-02-07 07:56:43 +08:00
|
|
|
SmallVector<const SymbolicRegion *, 12> Postponed;
|
2010-03-11 00:32:56 +08:00
|
|
|
SymbolReaper &SymReaper;
|
2010-03-17 11:35:08 +08:00
|
|
|
const StackFrameContext *CurrentLCtx;
|
2010-07-02 04:16:50 +08:00
|
|
|
|
2010-03-11 00:32:56 +08:00
|
|
|
public:
|
2018-08-30 04:28:13 +08:00
|
|
|
RemoveDeadBindingsWorker(RegionStoreManager &rm,
|
2012-01-12 10:22:40 +08:00
|
|
|
ProgramStateManager &stateMgr,
|
2012-12-07 09:55:21 +08:00
|
|
|
RegionBindingsRef b, SymbolReaper &symReaper,
|
2010-07-02 04:09:55 +08:00
|
|
|
const StackFrameContext *LCtx)
|
2018-08-30 04:28:13 +08:00
|
|
|
: ClusterAnalysis<RemoveDeadBindingsWorker>(rm, stateMgr, b),
|
2010-07-02 04:09:55 +08:00
|
|
|
SymReaper(symReaper), CurrentLCtx(LCtx) {}
|
2010-03-11 00:32:56 +08:00
|
|
|
|
|
|
|
// Called by ClusterAnalysis.
|
2012-08-10 06:55:51 +08:00
|
|
|
void VisitAddedToCluster(const MemRegion *baseR, const ClusterBindings &C);
|
2013-03-21 04:35:53 +08:00
|
|
|
void VisitCluster(const MemRegion *baseR, const ClusterBindings *C);
|
2018-08-30 04:28:13 +08:00
|
|
|
using ClusterAnalysis<RemoveDeadBindingsWorker>::VisitCluster;
|
2010-03-11 00:32:56 +08:00
|
|
|
|
2015-09-25 00:52:56 +08:00
|
|
|
using ClusterAnalysis::AddToWorkList;
|
|
|
|
|
|
|
|
bool AddToWorkList(const MemRegion *R);
|
|
|
|
|
2019-02-07 07:56:43 +08:00
|
|
|
bool UpdatePostponed();
|
2010-03-11 00:32:56 +08:00
|
|
|
void VisitBinding(SVal V);
|
|
|
|
};
|
2015-06-23 07:07:51 +08:00
|
|
|
}
|
2009-09-09 23:08:12 +08:00
|
|
|
|
2018-08-30 04:28:13 +08:00
|
|
|
bool RemoveDeadBindingsWorker::AddToWorkList(const MemRegion *R) {
|
2015-09-25 00:52:56 +08:00
|
|
|
const MemRegion *BaseR = R->getBaseRegion();
|
|
|
|
return AddToWorkList(WorkListElement(BaseR), getCluster(BaseR));
|
|
|
|
}
|
|
|
|
|
2018-08-30 04:28:13 +08:00
|
|
|
void RemoveDeadBindingsWorker::VisitAddedToCluster(const MemRegion *baseR,
|
2012-08-10 06:55:51 +08:00
|
|
|
const ClusterBindings &C) {
|
2010-03-10 15:20:03 +08:00
|
|
|
|
2010-03-11 00:32:56 +08:00
|
|
|
if (const VarRegion *VR = dyn_cast<VarRegion>(baseR)) {
|
2010-07-02 04:09:55 +08:00
|
|
|
if (SymReaper.isLive(VR))
|
2012-08-10 06:55:51 +08:00
|
|
|
AddToWorkList(baseR, &C);
|
2010-03-10 15:20:03 +08:00
|
|
|
|
2010-03-11 00:32:56 +08:00
|
|
|
return;
|
2009-06-17 06:36:44 +08:00
|
|
|
}
|
2010-03-10 15:20:03 +08:00
|
|
|
|
2010-03-11 00:32:56 +08:00
|
|
|
if (const SymbolicRegion *SR = dyn_cast<SymbolicRegion>(baseR)) {
|
2019-02-07 07:56:43 +08:00
|
|
|
if (SymReaper.isLive(SR->getSymbol()))
|
2012-08-10 06:55:51 +08:00
|
|
|
AddToWorkList(SR, &C);
|
2019-02-07 07:56:43 +08:00
|
|
|
else
|
|
|
|
Postponed.push_back(SR);
|
2010-03-10 15:20:03 +08:00
|
|
|
|
2010-03-11 00:32:56 +08:00
|
|
|
return;
|
2009-06-17 06:36:44 +08:00
|
|
|
}
|
2010-03-17 11:35:08 +08:00
|
|
|
|
2010-07-02 04:16:50 +08:00
|
|
|
if (isa<NonStaticGlobalSpaceRegion>(baseR)) {
|
2012-08-10 06:55:51 +08:00
|
|
|
AddToWorkList(baseR, &C);
|
2010-07-02 04:16:50 +08:00
|
|
|
return;
|
|
|
|
}
|
|
|
|
|
2010-03-17 11:35:08 +08:00
|
|
|
// CXXThisRegion in the current or parent location context is live.
|
|
|
|
if (const CXXThisRegion *TR = dyn_cast<CXXThisRegion>(baseR)) {
|
2018-09-08 06:07:57 +08:00
|
|
|
const auto *StackReg =
|
2019-02-07 07:56:43 +08:00
|
|
|
cast<StackArgumentsSpaceRegion>(TR->getSuperRegion());
|
2010-03-17 11:35:08 +08:00
|
|
|
const StackFrameContext *RegCtx = StackReg->getStackFrame();
|
2012-11-03 10:54:20 +08:00
|
|
|
if (CurrentLCtx &&
|
|
|
|
(RegCtx == CurrentLCtx || RegCtx->isParentOf(CurrentLCtx)))
|
2012-08-10 06:55:51 +08:00
|
|
|
AddToWorkList(TR, &C);
|
2010-03-17 11:35:08 +08:00
|
|
|
}
|
2010-03-11 00:32:56 +08:00
|
|
|
}
|
2009-09-09 23:08:12 +08:00
|
|
|
|
2018-08-30 04:28:13 +08:00
|
|
|
void RemoveDeadBindingsWorker::VisitCluster(const MemRegion *baseR,
|
2013-03-21 04:35:53 +08:00
|
|
|
const ClusterBindings *C) {
|
|
|
|
if (!C)
|
|
|
|
return;
|
|
|
|
|
2012-09-08 09:24:49 +08:00
|
|
|
// Mark the symbol for any SymbolicRegion with live bindings as live itself.
|
|
|
|
// This means we should continue to track that symbol.
|
|
|
|
if (const SymbolicRegion *SymR = dyn_cast<SymbolicRegion>(baseR))
|
|
|
|
SymReaper.markLive(SymR->getSymbol());
|
|
|
|
|
2015-12-10 17:28:06 +08:00
|
|
|
for (ClusterBindings::iterator I = C->begin(), E = C->end(); I != E; ++I) {
|
|
|
|
// Element index of a binding key is live.
|
|
|
|
SymReaper.markElementIndicesLive(I.getKey().getRegion());
|
|
|
|
|
2012-08-10 06:55:51 +08:00
|
|
|
VisitBinding(I.getData());
|
2015-12-10 17:28:06 +08:00
|
|
|
}
|
2010-03-11 00:32:56 +08:00
|
|
|
}
|
2010-02-03 06:38:47 +08:00
|
|
|
|
2018-08-30 04:28:13 +08:00
|
|
|
void RemoveDeadBindingsWorker::VisitBinding(SVal V) {
|
2010-03-11 00:32:56 +08:00
|
|
|
// Is it a LazyCompoundVal? All referenced regions are live as well.
|
2013-02-21 06:23:23 +08:00
|
|
|
if (Optional<nonloc::LazyCompoundVal> LCS =
|
2013-02-20 13:52:05 +08:00
|
|
|
V.getAs<nonloc::LazyCompoundVal>()) {
|
2009-09-29 14:35:00 +08:00
|
|
|
|
2013-02-15 08:32:12 +08:00
|
|
|
const RegionStoreManager::SValListTy &Vals = RM.getInterestingValues(*LCS);
|
2013-02-15 08:32:06 +08:00
|
|
|
|
2013-02-15 08:32:12 +08:00
|
|
|
for (RegionStoreManager::SValListTy::const_iterator I = Vals.begin(),
|
|
|
|
E = Vals.end();
|
|
|
|
I != E; ++I)
|
|
|
|
VisitBinding(*I);
|
2012-08-10 06:55:51 +08:00
|
|
|
|
2010-03-11 00:32:56 +08:00
|
|
|
return;
|
|
|
|
}
|
2009-09-29 14:35:00 +08:00
|
|
|
|
2010-03-11 00:32:56 +08:00
|
|
|
// If V is a region, then add it to the worklist.
|
2012-06-02 04:04:04 +08:00
|
|
|
if (const MemRegion *R = V.getAsRegion()) {
|
2010-03-11 00:32:56 +08:00
|
|
|
AddToWorkList(R);
|
2015-12-10 17:28:06 +08:00
|
|
|
SymReaper.markLive(R);
|
2015-09-08 11:50:52 +08:00
|
|
|
|
2012-06-02 04:04:04 +08:00
|
|
|
// All regions captured by a block are also live.
|
|
|
|
if (const BlockDataRegion *BR = dyn_cast<BlockDataRegion>(R)) {
|
|
|
|
BlockDataRegion::referenced_vars_iterator I = BR->referenced_vars_begin(),
|
|
|
|
E = BR->referenced_vars_end();
|
2012-09-08 09:24:49 +08:00
|
|
|
for ( ; I != E; ++I)
|
|
|
|
AddToWorkList(I.getCapturedRegion());
|
2012-06-02 04:04:04 +08:00
|
|
|
}
|
|
|
|
}
|
2015-09-08 11:50:52 +08:00
|
|
|
|
2009-09-09 23:08:12 +08:00
|
|
|
|
2011-12-07 07:12:27 +08:00
|
|
|
// Update the set of live symbols.
|
2019-02-07 07:56:43 +08:00
|
|
|
for (auto SI = V.symbol_begin(), SE = V.symbol_end(); SI!=SE; ++SI)
|
2010-03-11 00:32:56 +08:00
|
|
|
SymReaper.markLive(*SI);
|
|
|
|
}
|
2010-03-10 15:20:03 +08:00
|
|
|
|
2019-02-07 07:56:43 +08:00
|
|
|
bool RemoveDeadBindingsWorker::UpdatePostponed() {
|
|
|
|
// See if any postponed SymbolicRegions are actually live now, after
|
|
|
|
// having done a scan.
|
|
|
|
bool Changed = false;
|
2018-09-08 06:07:57 +08:00
|
|
|
|
2019-02-07 07:56:43 +08:00
|
|
|
for (auto I = Postponed.begin(), E = Postponed.end(); I != E; ++I) {
|
|
|
|
if (const SymbolicRegion *SR = *I) {
|
|
|
|
if (SymReaper.isLive(SR->getSymbol())) {
|
|
|
|
Changed |= AddToWorkList(SR);
|
|
|
|
*I = nullptr;
|
|
|
|
}
|
2009-10-29 13:14:17 +08:00
|
|
|
}
|
|
|
|
}
|
2019-02-07 07:56:43 +08:00
|
|
|
|
|
|
|
return Changed;
|
2010-03-11 00:32:56 +08:00
|
|
|
}
|
|
|
|
|
2011-02-19 09:59:33 +08:00
|
|
|
StoreRef RegionStoreManager::removeDeadBindings(Store store,
|
|
|
|
const StackFrameContext *LCtx,
|
2011-08-06 08:29:57 +08:00
|
|
|
SymbolReaper& SymReaper) {
|
2012-12-07 09:55:21 +08:00
|
|
|
RegionBindingsRef B = getRegionBindings(store);
|
2018-08-30 04:28:13 +08:00
|
|
|
RemoveDeadBindingsWorker W(*this, StateMgr, B, SymReaper, LCtx);
|
2010-03-11 00:32:56 +08:00
|
|
|
W.GenerateClusters();
|
|
|
|
|
|
|
|
// Enqueue the region roots onto the worklist.
|
2011-08-06 08:29:57 +08:00
|
|
|
for (SymbolReaper::region_iterator I = SymReaper.region_begin(),
|
|
|
|
E = SymReaper.region_end(); I != E; ++I) {
|
2010-03-11 00:32:56 +08:00
|
|
|
W.AddToWorkList(*I);
|
2011-08-06 08:29:57 +08:00
|
|
|
}
|
2010-03-11 00:32:56 +08:00
|
|
|
|
2019-02-07 07:56:43 +08:00
|
|
|
do W.RunWorkList(); while (W.UpdatePostponed());
|
2010-03-10 15:20:03 +08:00
|
|
|
|
2009-06-17 06:36:44 +08:00
|
|
|
// We have now scanned the store, marking reachable regions and symbols
|
|
|
|
// as live. We now remove all the regions that are dead from the store
|
2009-09-09 23:08:12 +08:00
|
|
|
// as well as update DSymbols with the set symbols that are now dead.
|
2012-12-07 09:55:21 +08:00
|
|
|
for (RegionBindingsRef::iterator I = B.begin(), E = B.end(); I != E; ++I) {
|
2012-08-10 06:55:51 +08:00
|
|
|
const MemRegion *Base = I.getKey();
|
2010-03-11 00:32:56 +08:00
|
|
|
|
2010-03-11 00:38:41 +08:00
|
|
|
// If the cluster has been visited, we know the region has been marked.
|
2018-11-30 11:27:50 +08:00
|
|
|
// Otherwise, remove the dead entry.
|
|
|
|
if (!W.isVisited(Base))
|
|
|
|
B = B.remove(Base);
|
2009-08-02 13:00:15 +08:00
|
|
|
}
|
2010-08-15 20:45:09 +08:00
|
|
|
|
2012-12-08 02:32:08 +08:00
|
|
|
return StoreRef(B.asStore(), *this);
|
2009-06-17 06:36:44 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
//===----------------------------------------------------------------------===//
|
|
|
|
// Utility methods.
|
|
|
|
//===----------------------------------------------------------------------===//
|
|
|
|
|
2019-05-29 23:25:19 +08:00
|
|
|
void RegionStoreManager::printJson(raw_ostream &Out, Store S, const char *NL,
|
|
|
|
unsigned int Space, bool IsDot) const {
|
|
|
|
RegionBindingsRef Bindings = getRegionBindings(S);
|
|
|
|
|
|
|
|
Indent(Out, Space, IsDot) << "\"store\": ";
|
|
|
|
|
|
|
|
if (Bindings.isEmpty()) {
|
|
|
|
Out << "null," << NL;
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
|
2019-06-25 11:17:55 +08:00
|
|
|
Out << "{ \"pointer\": \"" << Bindings.asStore() << "\", \"items\": [" << NL;
|
|
|
|
Bindings.printJson(Out, NL, Space + 1, IsDot);
|
|
|
|
Indent(Out, Space, IsDot) << "]}," << NL;
|
2009-06-17 06:36:44 +08:00
|
|
|
}
|