StaticAnalyzer/Checkers/MallocChecker.cpp

197   ProgramStateRef checkPointerEscape(ProgramStateRef State,
201   ProgramStateRef checkConstPointerEscape(ProgramStateRef State,
206   void printState(raw_ostream &Out, ProgramStateRef State,
242                                      ProgramStateRef State,
245                         State->getSVal(SizeEx, C.getLocationContext()),
246                         Init, State, Family);
251                                      ProgramStateRef State,
256   MallocUpdateRefState(CheckerContext &C, const Expr *E, ProgramStateRef State,
268                              ProgramStateRef State,
293                                    ProgramStateRef State,
297   ProgramStateRef checkPointerEscapeAux(ProgramStateRef State,
580   ProgramStateRef State = C.getState();
590       State = MallocMemAux(C, CE, CE->getArg(0), UndefinedVal(), State);
592       State = ReallocMem(C, CE, false);
594       State = ReallocMem(C, CE, true);
596       State = CallocMem(C, CE);
598       State = FreeMemAux(C, CE, State, 0, false, ReleasedAllocatedMemory);
600       State = MallocUpdateRefState(C, CE, State);
602       State = MallocUpdateRefState(C, CE, State);
611         State = MallocMemAux(C, CE, CE->getArg(0), UndefinedVal(), State,
614         State = MallocMemAux(C, CE, CE->getArg(0), UndefinedVal(), State,
617         State = FreeMemAux(C, CE, State, 0, false, ReleasedAllocatedMemory);
633           State = MallocMemReturnsAttr(C, CE, *i);
637           State = FreeMemAttr(C, CE, *i);
642   C.addTransition(State);
657   ProgramStateRef State = C.getState();
662   State = MallocUpdateRefState(C, NE, State, NE->isArray() ? AF_CXXNewArray
664   C.addTransition(State);
677   ProgramStateRef State = C.getState();
679   State = FreeMemAux(C, DE->getArgument(), DE, State,
682   C.addTransition(State);
724   ProgramStateRef State = FreeMemAux(C, Call.getArgExpr(0),
729   C.addTransition(State);
748                                            ProgramStateRef State,
759   State = State->BindExpr(CE, C.getLocationContext(), RetVal);
766   State = State->bindDefault(RetVal, Init);
778         svalBuilder.evalEQ(State, Extent, *DefinedSize);
780     State = State->assume(extentMatchesSize, true);
781     assert(State);
784   return MallocUpdateRefState(C, CE, State, Family);
789                                                     ProgramStateRef State,
792   SVal retVal = State->getSVal(E, C.getLocationContext());
802   return State->set<RegionState>(Sym, RefState::getAllocated(Family, E));
811   ProgramStateRef State = C.getState();
816     ProgramStateRef StateI = FreeMemAux(C, CE, State, *I,
820       State = StateI;
822   return State;
841 static bool didPreviousFreeFail(ProgramStateRef State,
843   const SymbolRef *Ret = State->get<FreeReturnValue>(Sym);
846     ConstraintManager &CMgr = State->getConstraintManager();
847     ConditionTruthVal FreeFailed = CMgr.isNull(State, *Ret);
958                                           ProgramStateRef State,
963   SVal ArgVal = State->getSVal(ArgExpr, C.getLocationContext());
974   llvm::tie(notNullState, nullState) = State->assume(location);
1024   const RefState *RsBase = State->get<RegionState>(SymBase);
1031         !didPreviousFreeFail(State, SymBase, PreviousRetStatusSymbol)) {
1066   State = State->remove<FreeReturnValue>(SymBase);
1075       State = State->set<FreeReturnValue>(SymBase, RetStatusSymbol);
1083     return State->set<RegionState>(SymBase,
1087   return State->set<RegionState>(SymBase,
1546     ProgramStateRef State = N->getState();
1547     if (!State->get<RegionState>(Sym))
1554           SVal Val = State->getSVal(MR);
1739   ProgramStateRef State = C.getState();
1740   SVal RetVal = State->getSVal(E, C.getLocationContext());
1867                                               ProgramStateRef State,
1934   ASTContext &ASTC = State->getStateManager().getContext();
2024 ProgramStateRef MallocChecker::checkPointerEscape(ProgramStateRef State,
2028   return checkPointerEscapeAux(State, Escaped, Call, Kind, &retTrue);
2031 ProgramStateRef MallocChecker::checkConstPointerEscape(ProgramStateRef State,
2035   return checkPointerEscapeAux(State, Escaped, Call, Kind,
2039 ProgramStateRef MallocChecker::checkPointerEscapeAux(ProgramStateRef State,
2048       !mayFreeAnyEscapedMemoryOrIsModeledExplicitly(Call, State,
2051     return State;
2062     if (const RefState *RS = State->get<RegionState>(sym)) {
2064         State = State->remove<RegionState>(sym);
2065         State = State->set<RegionState>(sym, RefState::getEscaped(RS));
2069   return State;
2175 void MallocChecker::printState(raw_ostream &Out, ProgramStateRef State,
2178   RegionStateTy RS = State->get<RegionState>();