StaticAnalyzer/Core/RegionStore.cpp

5 // This file is distributed under the University of Illinois Open Source
341   /// This is currently used to decide whether or not it is worth "forcing" a
344   /// This is controlled by 'region-store-small-struct-limit' option.
369   ///  the value is not specified.
377   ///  the array).  This is called by ExprEngine when evaluating
419   // BindDefault is only used to initialize a region with a default value.
441   /// This path is used when it seems advantageous to "force" loading the values
443   /// than using a Default binding at the base of the entire region. This is a
472   /// \param ST the original store, that is the basis for the new store.
482   /// associated with the object is recycled.
491   /// The high level logic for this method is this:
495   ///   else if L is in killset
498   ///     if L is on stack or heap
529   /// y's value is retrieved by this method.
538   /// are returned as is in case the caller needs to treat them differently.
546   /// If there is no lazy binding for \p R, the returned value will have a null
555   /// The precise value of "interesting" is determined for the purposes of
669   /// Returns true if the memory space of the given region is one of the global
707       // If this is an interesting global region, add it the work list up front.
809 /// Each binding is a pair whose \c first is the key (a BindingKey) and whose
810 /// \c second is the value (an SVal).
813 /// default bindings that may extend beyond \p Top itself, e.g. if \p Top is
852         // Case 1: The next binding is inside the region we're invalidating.
857         // Case 2: The next binding is at the same offset as the region we're
861         // FIXME: This is probably incorrect; consider invalidating an outer
862         // struct whose first field is bound to a LazyCompoundVal.
870         // Case 3: The next key is symbolic and we just changed something within
871         // its concrete region. We don't know if the binding is still valid, so
877         // Case 4: The next key is symbolic, but we changed a known
878         // super-region. In this case the binding is certainly included.
958                           InvalidatedSymbols &is,
963       Ex(ex), Count(count), LCtx(lctx), IS(is), ITraits(ITraitsIn), Regions(r){}
1024         // of the binding.  If that binding itself is a region, we should
1025         // invalidate that region.  This is because a block may capture
1052     // conjured symbol. The type of the symbol is irrelevant.
1066     // If the region is a global and we are invalidating all globals,
1067     // erasing the entry is good enough.  This causes all globals to be lazily
1074     // conjured symbol. The type of the symbol is irrelevant.
1134         // Note: the last argument is false here because these are
1223     // of VLAs.  Returning UnknownVal here, however, is a stop-gap so that
1230   // If a variable is reinterpreted as a type that doesn't fit into a larger
1232   // This is a signed value, since it's used in arithmetic with signed indices.
1244 ///  the array).  This is called by ExprEngine when evaluating casts
1342     // value to the ivar type.  What we should model is stores to ivars
1343     // that blow past the extent of the ivar.  If the address of the ivar is
1344     // reinterpretted, it is possible we stored a different value that could
1352     // value to the variable type.  What we should model is stores to variables
1354     // variable is reinterpretted, it is possible we stored a different value
1394 /// If \p AllowSubregionBindings is \c false, a lazy binding will be rejected
1410   // If the LCV is for a subregion, the types might not match, and we shouldn't
1463     // C++ base object region is another kind of region that we should blast
1464     // through to look for lazy compound value. It is like a field region.
1488   // Check if the region is an element region of a string literal.
1490     // FIXME: Handle loads from strings where the literal is treated as
1505       // Technically, only i == length is guaranteed to be null.
1507       // the only time such an access would be made is if a string literal was
1523   // FIXME: This is a hack, and doesn't do anything really intelligent yet.
1602   // FIXME: This is a hack to deal with RegionStore's inability to distinguish a
1604   // /entire/ aggregate. The most common case of this is when struct Outer
1605   // has as its first member a struct Inner, which is copied in from a stack
1606   // variable. In this case, even if the Outer's default value is symbolic, 0,
1609   // This is a general problem -- if the Inner is zero-initialized, the Outer
1610   // will now look zero-initialized. The proper way to solve this is with a
1642   // FIXME: This is a hack to deal with RegionStore's inability to distinguish a
1644   // /entire/ aggregate. The most common case of this is when struct Outer
1645   // has as its first member a struct Inner, which is copied in from a stack
1646   // variable. In this case, even if the Outer's default value is symbolic, 0,
1649   // This is a general problem -- if the Inner is zero-initialized, the Outer
1650   // will now look zero-initialized. The proper way to solve this is with a
1676     // If our super region is a field or element itself, walk up the region
1677     // hierarchy to see if there is a default value installed in an ancestor.
1684       // if superR is a vector and if so return Unknown.
1858   // Quick path: if the base is the head of a cluster, the region is live.
1862   // Slow path: if the region is the VALUE of any binding, it is live.
1900   // Check if the region is a struct region.
1939     // Set the default value to a zero constant when it is a structure
1948     assert(!SymbolManager::canSymbolicate(T) && "This type is representable");
1967   // Check if the init expr is a string literal.
2009   // If the init list is shorter than the array length, set the
2030   // the value is symbolic go and bind it as a "default" binding.
2127   // the value is symbolic go and bind it as a "default" binding.
2229   // CXXThisRegion in the current or parent location context is live.
2269   // If V is a region, then add it to the worklist.