forked from OSchip/llvm-project
Removed some files related to the path-sensitive solver as part of some
code restructuring. (new files will be introduced shortly) llvm-svn: 45785
This commit is contained in:
Ted Kremenek
parent
c6edcbdb5d
commit
fed4cce0cc
|
|
@ -1,96 +0,0 @@
|
||||||
//===-- GRConstantPropagation.cpp --------------------------------*- C++ -*-==//
|
|
||||||
//
|
|
||||||
// The LLVM Compiler Infrastructure
|
|
||||||
//
|
|
||||||
// This file is distributed under the University of Illinois Open Source
|
|
||||||
// License. See LICENSE.TXT for details.
|
|
||||||
//
|
|
||||||
//===----------------------------------------------------------------------===//
|
|
||||||
//
|
|
||||||
// Constant Propagation via Graph Reachability
|
|
||||||
//
|
|
||||||
// This files defines a simple analysis that performs path-sensitive
|
|
||||||
// constant propagation within a function. An example use of this analysis
|
|
||||||
// is to perform simple checks for NULL dereferences.
|
|
||||||
//
|
|
||||||
//===----------------------------------------------------------------------===//
|
|
||||||
|
|
||||||
#include "clang/Analysis/PathSensitive/ExplodedGraph.h"
|
|
||||||
#include "clang/AST/Expr.h"
|
|
||||||
#include "clang/AST/CFG.h"
|
|
||||||
#include "llvm/Support/Casting.h"
|
|
||||||
#include "llvm/Support/DataTypes.h"
|
|
||||||
#include "llvm/ADT/APInt.h"
|
|
||||||
#include "llvm/ADT/APFloat.h"
|
|
||||||
#include "llvm/ADT/ImmutableMap.h"
|
|
||||||
|
|
||||||
using namespace clang;
|
|
||||||
using llvm::APInt;
|
|
||||||
using llvm::APFloat;
|
|
||||||
using llvm::dyn_cast;
|
|
||||||
using llvm::cast;
|
|
||||||
|
|
||||||
//===----------------------------------------------------------------------===//
|
|
||||||
// ConstV - Represents a variant over APInt, APFloat, and const char
|
|
||||||
//===----------------------------------------------------------------------===//
|
|
||||||
|
|
||||||
namespace {
|
|
||||||
class ConstV {
|
|
||||||
uintptr_t Data;
|
|
||||||
public:
|
|
||||||
enum VariantType { VTString = 0x0, VTObjCString = 0x1,
|
|
||||||
VTFloat = 0x2, VTInt = 0x3,
|
|
||||||
Flags = 0x3 };
|
|
||||||
|
|
||||||
ConstV(const StringLiteral* v)
|
|
||||||
: Data(reinterpret_cast<uintptr_t>(v) | VTString) {}
|
|
||||||
|
|
||||||
ConstV(const ObjCStringLiteral* v)
|
|
||||||
: Data(reinterpret_cast<uintptr_t>(v) | VTObjCString) {}
|
|
||||||
|
|
||||||
ConstV(llvm::APInt* v)
|
|
||||||
: Data(reinterpret_cast<uintptr_t>(v) | VTInt) {}
|
|
||||||
|
|
||||||
ConstV(llvm::APFloat* v)
|
|
||||||
: Data(reinterpret_cast<uintptr_t>(v) | VTFloat) {}
|
|
||||||
|
|
||||||
|
|
||||||
inline void* getData() const { return (void*) (Data & ~Flags); }
|
|
||||||
inline VariantType getVT() const { return (VariantType) (Data & Flags); }
|
|
||||||
|
|
||||||
inline void Profile(llvm::FoldingSetNodeID& ID) const {
|
|
||||||
ID.AddPointer(getData());
|
|
||||||
}
|
|
||||||
};
|
|
||||||
} // end anonymous namespace
|
|
||||||
|
|
||||||
// Overload machinery for casting from ConstV to contained classes.
|
|
||||||
|
|
||||||
namespace llvm {
|
|
||||||
|
|
||||||
#define CV_OBJ_CAST(CLASS,FLAG)\
|
|
||||||
template<> inline bool isa<CLASS,ConstV>(const ConstV& V) {\
|
|
||||||
return V.getVT() == FLAG;\
|
|
||||||
}\
|
|
||||||
\
|
|
||||||
template <> struct cast_retty_impl<CLASS, ConstV> {\
|
|
||||||
typedef const CLASS* ret_type;\
|
|
||||||
};
|
|
||||||
|
|
||||||
CV_OBJ_CAST(APInt,ConstV::VTInt)
|
|
||||||
CV_OBJ_CAST(APFloat,ConstV::VTFloat)
|
|
||||||
CV_OBJ_CAST(StringLiteral,ConstV::VTString)
|
|
||||||
CV_OBJ_CAST(ObjCStringLiteral,ConstV::VTObjCString)
|
|
||||||
|
|
||||||
#undef CV_OBJ_CAST
|
|
||||||
|
|
||||||
template <> struct simplify_type<ConstV> {
|
|
||||||
typedef void* SimpleType;
|
|
||||||
static SimpleType getSimplifiedValue(const ConstV &Val) {
|
|
||||||
return Val.getData();
|
|
||||||
}
|
|
||||||
};
|
|
||||||
|
|
||||||
} // end llvm namespace
|
|
||||||
|
|
||||||
|
|
||||||
|
|
@ -1,177 +0,0 @@
|
||||||
//= ReachabilityEngine.cpp - Path-Sens. Dataflow Engine ------------*- C++ -*-//
|
|
||||||
//
|
|
||||||
// The LLVM Compiler Infrastructure
|
|
||||||
//
|
|
||||||
// This file is distributed under the University of Illinois Open Source
|
|
||||||
// License. See LICENSE.TXT for details.
|
|
||||||
//
|
|
||||||
//===----------------------------------------------------------------------===//
|
|
||||||
//
|
|
||||||
// This file defines a generic engine for intraprocedural, path-sensitive,
|
|
||||||
// dataflow analysis via graph reachability engine.
|
|
||||||
//
|
|
||||||
//===----------------------------------------------------------------------===//
|
|
||||||
|
|
||||||
#include "clang/Analysis/PathSensitive/ReachabilityEngine.h"
|
|
||||||
#include "clang/AST/Stmt.h"
|
|
||||||
#include "llvm/Support/Casting.h"
|
|
||||||
|
|
||||||
using namespace clang;
|
|
||||||
using clang::reng::WorkList;
|
|
||||||
using llvm::isa;
|
|
||||||
using llvm::cast;
|
|
||||||
|
|
||||||
// Place dstor here so that all of the virtual functions in DFS have their
|
|
||||||
// code placed in the object file of this translation unit.
|
|
||||||
clang::reng::DFS::~DFS() {}
|
|
||||||
|
|
||||||
ReachabilityEngineImpl::ReachabilityEngineImpl(CFG& c,
|
|
||||||
clang::reng::WorkList* wlist)
|
|
||||||
: cfg(c), WList(wlist) {}
|
|
||||||
|
|
||||||
ExplodedNodeImpl* ReachabilityEngineImpl::getNode(const ProgramEdge& Loc,
|
|
||||||
void* State,
|
|
||||||
ExplodedNodeImpl* Pred) {
|
|
||||||
|
|
||||||
bool IsNew;
|
|
||||||
ExplodedNodeImpl* V = G->getNodeImpl(Loc,State,&IsNew);
|
|
||||||
|
|
||||||
// Link the node with its predecessor.
|
|
||||||
V->addUntypedPredecessor(Pred);
|
|
||||||
|
|
||||||
if (IsNew) {
|
|
||||||
// Only add the node to the worklist if it was freshly generated.
|
|
||||||
WList->Enqueue(V);
|
|
||||||
|
|
||||||
// Check if the node's edge is a StmtStmtEdge where the destination
|
|
||||||
// statement is not a BlockLevelExpr. In this case, we must lazily
|
|
||||||
// populate ParentMap.
|
|
||||||
if (isa<StmtStmtEdge>(Loc)) {
|
|
||||||
Stmt* S = cast<StmtStmtEdge>(Loc).Dst();
|
|
||||||
assert (CurrentBlkExpr != NULL);
|
|
||||||
|
|
||||||
if (S != CurrentBlkExpr && ParentMap.find(S) == ParentMap.end()) {
|
|
||||||
// Populate ParentMap starting from CurrentBlkExpr.
|
|
||||||
PopulateParentMap(CurrentBlkExpr);
|
|
||||||
assert (ParentMap.find(S) != ParentMap.end());
|
|
||||||
}
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
return V;
|
|
||||||
}
|
|
||||||
|
|
||||||
void ReachabilityEngineImpl::PopulateParentMap(Stmt* Parent) {
|
|
||||||
for (Stmt::child_iterator I=Parent->child_begin(),
|
|
||||||
E=Parent->child_end(); I!=E; ++I) {
|
|
||||||
|
|
||||||
assert (ParentMap.find(*I) == ParentMap.end());
|
|
||||||
ParentMap[*I] = Parent;
|
|
||||||
PopulateParentMap(*I);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
bool ReachabilityEngineImpl::ExecuteWorkList(unsigned Steps) {
|
|
||||||
|
|
||||||
// Initialize the analysis by constructing the root if none exists.
|
|
||||||
if (G->num_roots() == 0) {
|
|
||||||
// Get the entry block. Make sure that it has 1 (and only 1) successor.
|
|
||||||
CFGBlock* Entry = &cfg.getEntry();
|
|
||||||
assert (Entry->empty() && "Entry block must be empty.");
|
|
||||||
assert (Entry->succ_size() == 1 && "Entry block must have 1 successor.");
|
|
||||||
|
|
||||||
// Get the first (and only) successor of Entry.
|
|
||||||
CFGBlock* Succ = *(Entry->succ_begin());
|
|
||||||
|
|
||||||
// Construct an edge representing the starting location in the function.
|
|
||||||
BlkBlkEdge StartLoc(Entry,Succ);
|
|
||||||
|
|
||||||
// Create the root node.
|
|
||||||
WList->Enqueue(G->addRoot(G->getNodeImpl(StartLoc,getInitialState(),NULL)));
|
|
||||||
}
|
|
||||||
|
|
||||||
while (Steps && WList->hasWork()) {
|
|
||||||
--Steps;
|
|
||||||
ExplodedNodeImpl* V = WList->Dequeue();
|
|
||||||
|
|
||||||
// Dispatch on the location type.
|
|
||||||
switch (V->getLocation().getKind()) {
|
|
||||||
case ProgramEdge::BlkBlk:
|
|
||||||
ProcessBlkBlk(cast<BlkBlkEdge>(V->getLocation()),V);
|
|
||||||
break;
|
|
||||||
|
|
||||||
case ProgramEdge::BlkStmt:
|
|
||||||
ProcessBlkStmt(cast<BlkStmtEdge>(V->getLocation()),V);
|
|
||||||
break;
|
|
||||||
|
|
||||||
case ProgramEdge::StmtBlk:
|
|
||||||
ProcessStmtBlk(cast<StmtBlkEdge>(V->getLocation()),V);
|
|
||||||
break;
|
|
||||||
|
|
||||||
case ProgramEdge::StmtStmt:
|
|
||||||
ProcessStmt(cast<StmtStmtEdge>(V->getLocation()).Dst(),V);
|
|
||||||
break;
|
|
||||||
|
|
||||||
default:
|
|
||||||
assert (false && "Unsupported edge type.");
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
return WList->hasWork();
|
|
||||||
}
|
|
||||||
|
|
||||||
|
|
||||||
void ReachabilityEngineImpl::ProcessBlkBlk(const BlkBlkEdge& E,
|
|
||||||
ExplodedNodeImpl* Pred) {
|
|
||||||
|
|
||||||
CFGBlock* Blk = E.Dst();
|
|
||||||
|
|
||||||
// Check if we are entering the EXIT block.
|
|
||||||
if (Blk == &cfg.getExit()) {
|
|
||||||
assert (cfg.getExit().size() == 0 && "EXIT block cannot contain Stmts.");
|
|
||||||
// Process the End-Of-Path.
|
|
||||||
void* State = ProcessEOP(Blk, Pred->State);
|
|
||||||
bool IsNew;
|
|
||||||
ExplodedNodeImpl* V = G->getNodeImpl(BlkStmtEdge(Blk,NULL),State,&IsNew);
|
|
||||||
V->addUntypedPredecessor(Pred);
|
|
||||||
if (IsNew) G->addEndOfPath(V);
|
|
||||||
return;
|
|
||||||
}
|
|
||||||
|
|
||||||
// FIXME: we will dispatch to a function that manipulates the state
|
|
||||||
// at the entrance to a block.
|
|
||||||
|
|
||||||
if (!Blk->empty()) {
|
|
||||||
// If 'Blk' has at least one statement, create a BlkStmtEdge and create
|
|
||||||
// the appropriate node. This is the common case.
|
|
||||||
getNode(BlkStmtEdge(Blk,Blk->front()), Pred->State, Pred);
|
|
||||||
}
|
|
||||||
else {
|
|
||||||
// Otherwise, create a node at the BlkStmtEdge right before the terminator
|
|
||||||
// (if any) is evaluated.
|
|
||||||
getNode(StmtBlkEdge(NULL,Blk),Pred->State, Pred);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
void ReachabilityEngineImpl::ProcessBlkStmt(const BlkStmtEdge& E,
|
|
||||||
ExplodedNodeImpl* Pred) {
|
|
||||||
if (Stmt* S = E.Dst())
|
|
||||||
ProcessStmt(S,Pred);
|
|
||||||
else {
|
|
||||||
// No statement. Create an edge right before the terminator is evaluated.
|
|
||||||
getNode(StmtBlkEdge(NULL,E.Src()), Pred->State, Pred);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
void ReachabilityEngineImpl::ProcessStmtBlk(const StmtBlkEdge& E,
|
|
||||||
ExplodedNodeImpl* Pred) {
|
|
||||||
CFGBlock* Blk = E.Dst();
|
|
||||||
|
|
||||||
if (Stmt* Terminator = Blk->getTerminator())
|
|
||||||
ProcessTerminator(Terminator,Pred);
|
|
||||||
else {
|
|
||||||
// No terminator. We should have only 1 successor.
|
|
||||||
assert (Blk->succ_size() == 1);
|
|
||||||
getNode(BlkBlkEdge(Blk,*(Blk->succ_begin())), Pred);
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
@ -1,182 +0,0 @@
|
||||||
//==- ReachabilityEngine.h - Path-Sens. Dataflow Engine ------------*- C++ -*-//
|
|
||||||
//
|
|
||||||
// The LLVM Compiler Infrastructure
|
|
||||||
//
|
|
||||||
// This file is distributed under the University of Illinois Open Source
|
|
||||||
// License. See LICENSE.TXT for details.
|
|
||||||
//
|
|
||||||
//===----------------------------------------------------------------------===//
|
|
||||||
//
|
|
||||||
// This file defines a generic engine for intraprocedural, path-sensitive,
|
|
||||||
// dataflow analysis via graph reachability engine.
|
|
||||||
//
|
|
||||||
//===----------------------------------------------------------------------===//
|
|
||||||
|
|
||||||
#ifndef LLVM_CLANG_ANALYSIS_REACHABILITYENGINE
|
|
||||||
#define LLVM_CLANG_ANALYSIS_REACHABILITYENGINE
|
|
||||||
|
|
||||||
#include "clang/AST/CFG.h"
|
|
||||||
#include "clang/Analysis/PathSensitive/ExplodedGraph.h"
|
|
||||||
#include "llvm/ADT/SmallVector.h"
|
|
||||||
#include "llvm/ADT/OwningPtr.h"
|
|
||||||
|
|
||||||
namespace clang {
|
|
||||||
|
|
||||||
namespace reng {
|
|
||||||
class WorkList {
|
|
||||||
public:
|
|
||||||
virtual ~WorkList();
|
|
||||||
virtual bool hasWork() const = 0;
|
|
||||||
virtual void Enqueue(ExplodedNodeImpl* V) = 0;
|
|
||||||
virtual ExplodedNodeImpl* Dequeue() = 0;
|
|
||||||
};
|
|
||||||
|
|
||||||
class DFS : public WorkList {
|
|
||||||
llvm::SmallVector<ExplodedNodeImpl*,20> Stack;
|
|
||||||
public:
|
|
||||||
virtual ~DFS();
|
|
||||||
|
|
||||||
virtual bool hasWork() const {
|
|
||||||
return !Stack.empty();
|
|
||||||
}
|
|
||||||
|
|
||||||
virtual void Enqueue(ExplodedNodeImpl* V) {
|
|
||||||
Stack.push_back(V);
|
|
||||||
}
|
|
||||||
|
|
||||||
virtual ExplodedNodeImpl* Dequeue() {
|
|
||||||
ExplodedNodeImpl* V = Stack.back();
|
|
||||||
Stack.pop_back();
|
|
||||||
return V;
|
|
||||||
}
|
|
||||||
};
|
|
||||||
}
|
|
||||||
|
|
||||||
class ReachabilityEngineImpl {
|
|
||||||
protected:
|
|
||||||
typedef llvm::DenseMap<Stmt*,Stmt*> ParentMapTy;
|
|
||||||
|
|
||||||
/// cfg - The control-flow graph of the function being analyzed.
|
|
||||||
CFG& cfg;
|
|
||||||
|
|
||||||
/// G - The simulation graph. Each node is a (location,state) pair.
|
|
||||||
llvm::OwningPtr<ExplodedGraphImpl> G;
|
|
||||||
|
|
||||||
/// ParentMap - A lazily populated map from a Stmt* to its parent Stmt*.
|
|
||||||
ParentMapTy ParentMap;
|
|
||||||
|
|
||||||
/// CurrentBlkExpr - The current Block-level expression being processed.
|
|
||||||
/// This is used when lazily populating ParentMap.
|
|
||||||
Stmt* CurrentBlkExpr;
|
|
||||||
|
|
||||||
/// WList - A set of queued nodes that need to be processed by the
|
|
||||||
/// worklist algorithm. It is up to the implementation of WList to decide
|
|
||||||
/// the order that nodes are processed.
|
|
||||||
llvm::OwningPtr<reng::WorkList> WList;
|
|
||||||
|
|
||||||
//==----------------------------------------------------------------------==//
|
|
||||||
// Internal methods.
|
|
||||||
|
|
||||||
/// getNode - Implemented by ReachabilityEngine<> subclass.
|
|
||||||
/// Creates/fetches a node and inserts it into the
|
|
||||||
ExplodedNodeImpl* getNode(const ProgramEdge& Loc, void* State,
|
|
||||||
ExplodedNodeImpl* Pred);
|
|
||||||
|
|
||||||
inline ExplodedNodeImpl* getNode(const ProgramEdge& Loc,
|
|
||||||
ExplodedNodeImpl* Pred) {
|
|
||||||
|
|
||||||
return getNode(Loc,Pred->State,Pred);
|
|
||||||
}
|
|
||||||
|
|
||||||
/// getInitialState - Gets the void* representing the initial 'state'
|
|
||||||
/// of the analysis. This is simply a wrapper (implemented
|
|
||||||
/// in ReachabilityEngine) that performs type erasure on the initial
|
|
||||||
/// state returned by the checker object.
|
|
||||||
virtual void* getInitialState() = 0;
|
|
||||||
|
|
||||||
/// PopulateParentMap - Populates ParentMap starting from the specified
|
|
||||||
/// expression.
|
|
||||||
void PopulateParentMap(Stmt* Parent);
|
|
||||||
|
|
||||||
void ProcessBlkBlk(const BlkBlkEdge& E, ExplodedNodeImpl* Pred);
|
|
||||||
void ProcessBlkStmt(const BlkStmtEdge& E, ExplodedNodeImpl* Pred);
|
|
||||||
void ProcessStmtBlk(const StmtBlkEdge& E, ExplodedNodeImpl* Pred);
|
|
||||||
|
|
||||||
virtual void* ProcessEOP(CFGBlock* Blk, void* State);
|
|
||||||
virtual void ProcessStmt(Stmt* S, ExplodedNodeImpl* Pred);
|
|
||||||
virtual void ProcessTerminator(Stmt* Terminator, ExplodedNodeImpl* Pred);
|
|
||||||
|
|
||||||
private:
|
|
||||||
ReachabilityEngineImpl(const ReachabilityEngineImpl&); // Do not implement.
|
|
||||||
ReachabilityEngineImpl& operator=(const ReachabilityEngineImpl&);
|
|
||||||
|
|
||||||
protected:
|
|
||||||
ReachabilityEngineImpl(CFG& c, reng::WorkList* wl);
|
|
||||||
|
|
||||||
public:
|
|
||||||
/// ExecuteWorkList - Run the worklist algorithm for a maximum number of
|
|
||||||
/// steps. Returns true if there is still simulation state on the worklist.
|
|
||||||
bool ExecuteWorkList(unsigned Steps = 1000000);
|
|
||||||
|
|
||||||
virtual ~ReachabilityEngineImpl() {}
|
|
||||||
};
|
|
||||||
|
|
||||||
|
|
||||||
template<typename CHECKER>
|
|
||||||
class ReachabilityEngine : public ReachabilityEngineImpl {
|
|
||||||
public:
|
|
||||||
typedef CHECKER CheckerTy;
|
|
||||||
typedef typename CheckerTy::StateTy StateTy;
|
|
||||||
typedef ExplodedGraph<CheckerTy> GraphTy;
|
|
||||||
typedef typename GraphTy::NodeTy NodeTy;
|
|
||||||
|
|
||||||
protected:
|
|
||||||
|
|
||||||
virtual void* getInitialState() {
|
|
||||||
return (void*) getCheckerState()->getInitialState();
|
|
||||||
}
|
|
||||||
|
|
||||||
virtual void* ProcessEOP(CFGBlock* Blk, void* State) {
|
|
||||||
// FIXME: Perform dispatch to adjust state.
|
|
||||||
return State;
|
|
||||||
}
|
|
||||||
|
|
||||||
virtual void ProcessStmt(Stmt* S, ExplodedNodeImpl* Pred) {
|
|
||||||
CurrentBlkExpr = S;
|
|
||||||
assert(false && "Not implemented.");
|
|
||||||
CurrentBlkExpr = NULL;
|
|
||||||
}
|
|
||||||
|
|
||||||
virtual void ProcessTerminator(Stmt* Terminator, ExplodedNodeImpl* Pred) {
|
|
||||||
assert(false && "Not implemented.");
|
|
||||||
}
|
|
||||||
|
|
||||||
|
|
||||||
public:
|
|
||||||
/// Construct a ReachabilityEngine object to analyze the provided CFG using
|
|
||||||
/// a DFS exploration of the exploded graph.
|
|
||||||
ReachabilityEngine(CFG& Cfg)
|
|
||||||
: ReachabilityEngineImpl(cfg,new reng::DFS()) {}
|
|
||||||
|
|
||||||
/// Construct a ReachabilityEngine object to analyze the provided CFG and to
|
|
||||||
/// use the provided worklist object to execute the worklist algorithm.
|
|
||||||
/// The ReachabilityEngine object assumes ownership of 'wlist'.
|
|
||||||
ReachabilityEngine(CFG& cfg, reng::WorkList* wlist)
|
|
||||||
: ReachabilityEngineImpl(cfg,wlist) {}
|
|
||||||
|
|
||||||
/// getGraph - Returns the exploded graph.
|
|
||||||
GraphTy& getGraph() { return *static_cast<GraphTy*>(G.get()); }
|
|
||||||
|
|
||||||
/// getCheckerState - Returns the internal checker state.
|
|
||||||
CheckerTy& getCheckerState() {
|
|
||||||
return *static_cast<GraphTy*>(G.get())->getCheckerState();
|
|
||||||
}
|
|
||||||
|
|
||||||
/// takeGraph - Returns the exploded graph. Ownership of the graph is
|
|
||||||
/// transfered to the caller.
|
|
||||||
GraphTy* takeGraph() { return static_cast<GraphTy*>(G.take()); }
|
|
||||||
};
|
|
||||||
|
|
||||||
} // end clang namespace
|
|
||||||
|
|
||||||
#endif
|
|
||||||
Loading…
Reference in New Issue