1218887Sdim// SimpleSValBuilder.cpp - A basic SValBuilder -----------------------*- C++ -*- 2218887Sdim// 3218887Sdim// The LLVM Compiler Infrastructure 4218887Sdim// 5218887Sdim// This file is distributed under the University of Illinois Open Source 6218887Sdim// License. See LICENSE.TXT for details. 7218887Sdim// 8218887Sdim//===----------------------------------------------------------------------===// 9218887Sdim// 10218887Sdim// This file defines SimpleSValBuilder, a basic implementation of SValBuilder. 11218887Sdim// 12218887Sdim//===----------------------------------------------------------------------===// 13218887Sdim 14249423Sdim#include "clang/StaticAnalyzer/Core/PathSensitive/SValBuilder.h" 15239462Sdim#include "clang/StaticAnalyzer/Core/PathSensitive/APSIntType.h" 16226633Sdim#include "clang/StaticAnalyzer/Core/PathSensitive/ProgramState.h" 17218887Sdim 18218887Sdimusing namespace clang; 19218887Sdimusing namespace ento; 20218887Sdim 21218887Sdimnamespace { 22218887Sdimclass SimpleSValBuilder : public SValBuilder { 23218887Sdimprotected: 24234353Sdim virtual SVal dispatchCast(SVal val, QualType castTy); 25221345Sdim virtual SVal evalCastFromNonLoc(NonLoc val, QualType castTy); 26221345Sdim virtual SVal evalCastFromLoc(Loc val, QualType castTy); 27218887Sdim 28218887Sdimpublic: 29218887Sdim SimpleSValBuilder(llvm::BumpPtrAllocator &alloc, ASTContext &context, 30226633Sdim ProgramStateManager &stateMgr) 31218887Sdim : SValBuilder(alloc, context, stateMgr) {} 32218887Sdim virtual ~SimpleSValBuilder() {} 33218887Sdim 34218887Sdim virtual SVal evalMinus(NonLoc val); 35218887Sdim virtual SVal evalComplement(NonLoc val); 36234353Sdim virtual SVal evalBinOpNN(ProgramStateRef state, BinaryOperator::Opcode op, 37218887Sdim NonLoc lhs, NonLoc rhs, QualType resultTy); 38234353Sdim virtual SVal evalBinOpLL(ProgramStateRef state, BinaryOperator::Opcode op, 39218887Sdim Loc lhs, Loc rhs, QualType resultTy); 40234353Sdim virtual SVal evalBinOpLN(ProgramStateRef state, BinaryOperator::Opcode op, 41218887Sdim Loc lhs, NonLoc rhs, QualType resultTy); 42218887Sdim 43218887Sdim /// getKnownValue - evaluates a given SVal. If the SVal has only one possible 44218887Sdim /// (integer) value, that value is returned. Otherwise, returns NULL. 45234353Sdim virtual const llvm::APSInt *getKnownValue(ProgramStateRef state, SVal V); 46218887Sdim 47218887Sdim SVal MakeSymIntVal(const SymExpr *LHS, BinaryOperator::Opcode op, 48218887Sdim const llvm::APSInt &RHS, QualType resultTy); 49218887Sdim}; 50218887Sdim} // end anonymous namespace 51218887Sdim 52218887SdimSValBuilder *ento::createSimpleSValBuilder(llvm::BumpPtrAllocator &alloc, 53218887Sdim ASTContext &context, 54226633Sdim ProgramStateManager &stateMgr) { 55218887Sdim return new SimpleSValBuilder(alloc, context, stateMgr); 56218887Sdim} 57218887Sdim 58218887Sdim//===----------------------------------------------------------------------===// 59218887Sdim// Transfer function for Casts. 60218887Sdim//===----------------------------------------------------------------------===// 61218887Sdim 62234353SdimSVal SimpleSValBuilder::dispatchCast(SVal Val, QualType CastTy) { 63249423Sdim assert(Val.getAs<Loc>() || Val.getAs<NonLoc>()); 64249423Sdim return Val.getAs<Loc>() ? evalCastFromLoc(Val.castAs<Loc>(), CastTy) 65249423Sdim : evalCastFromNonLoc(Val.castAs<NonLoc>(), CastTy); 66234353Sdim} 67234353Sdim 68221345SdimSVal SimpleSValBuilder::evalCastFromNonLoc(NonLoc val, QualType castTy) { 69218887Sdim 70218887Sdim bool isLocType = Loc::isLocType(castTy); 71218887Sdim 72249423Sdim if (Optional<nonloc::LocAsInteger> LI = val.getAs<nonloc::LocAsInteger>()) { 73218887Sdim if (isLocType) 74218887Sdim return LI->getLoc(); 75218887Sdim 76218887Sdim // FIXME: Correctly support promotions/truncations. 77218887Sdim unsigned castSize = Context.getTypeSize(castTy); 78218887Sdim if (castSize == LI->getNumBits()) 79218887Sdim return val; 80218887Sdim return makeLocAsInteger(LI->getLoc(), castSize); 81218887Sdim } 82218887Sdim 83218887Sdim if (const SymExpr *se = val.getAsSymbolicExpression()) { 84243830Sdim QualType T = Context.getCanonicalType(se->getType()); 85234353Sdim // If types are the same or both are integers, ignore the cast. 86218887Sdim // FIXME: Remove this hack when we support symbolic truncation/extension. 87218887Sdim // HACK: If both castTy and T are integers, ignore the cast. This is 88218887Sdim // not a permanent solution. Eventually we want to precisely handle 89218887Sdim // extension/truncation of symbolic integers. This prevents us from losing 90218887Sdim // precision when we assign 'x = y' and 'y' is symbolic and x and y are 91218887Sdim // different integer types. 92234353Sdim if (haveSameType(T, castTy)) 93218887Sdim return val; 94218887Sdim 95234353Sdim if (!isLocType) 96234353Sdim return makeNonLoc(se, T, castTy); 97218887Sdim return UnknownVal(); 98218887Sdim } 99218887Sdim 100234353Sdim // If value is a non integer constant, produce unknown. 101249423Sdim if (!val.getAs<nonloc::ConcreteInt>()) 102218887Sdim return UnknownVal(); 103218887Sdim 104249423Sdim // Handle casts to a boolean type. 105249423Sdim if (castTy->isBooleanType()) { 106249423Sdim bool b = val.castAs<nonloc::ConcreteInt>().getValue().getBoolValue(); 107249423Sdim return makeTruthVal(b, castTy); 108249423Sdim } 109249423Sdim 110234353Sdim // Only handle casts from integers to integers - if val is an integer constant 111234353Sdim // being cast to a non integer type, produce unknown. 112251662Sdim if (!isLocType && !castTy->isIntegralOrEnumerationType()) 113218887Sdim return UnknownVal(); 114218887Sdim 115249423Sdim llvm::APSInt i = val.castAs<nonloc::ConcreteInt>().getValue(); 116239462Sdim BasicVals.getAPSIntType(castTy).apply(i); 117218887Sdim 118218887Sdim if (isLocType) 119218887Sdim return makeIntLocVal(i); 120218887Sdim else 121218887Sdim return makeIntVal(i); 122218887Sdim} 123218887Sdim 124221345SdimSVal SimpleSValBuilder::evalCastFromLoc(Loc val, QualType castTy) { 125218887Sdim 126218887Sdim // Casts from pointers -> pointers, just return the lval. 127218887Sdim // 128218887Sdim // Casts from pointers -> references, just return the lval. These 129218887Sdim // can be introduced by the frontend for corner cases, e.g 130218887Sdim // casting from va_list* to __builtin_va_list&. 131218887Sdim // 132218887Sdim if (Loc::isLocType(castTy) || castTy->isReferenceType()) 133218887Sdim return val; 134218887Sdim 135218887Sdim // FIXME: Handle transparent unions where a value can be "transparently" 136218887Sdim // lifted into a union type. 137218887Sdim if (castTy->isUnionType()) 138218887Sdim return UnknownVal(); 139218887Sdim 140263508Sdim // Casting a Loc to a bool will almost always be true, 141263508Sdim // unless this is a weak function or a symbolic region. 142263508Sdim if (castTy->isBooleanType()) { 143263508Sdim switch (val.getSubKind()) { 144263508Sdim case loc::MemRegionKind: { 145263508Sdim const MemRegion *R = val.castAs<loc::MemRegionVal>().getRegion(); 146263508Sdim if (const FunctionTextRegion *FTR = dyn_cast<FunctionTextRegion>(R)) 147263508Sdim if (const FunctionDecl *FD = dyn_cast<FunctionDecl>(FTR->getDecl())) 148263508Sdim if (FD->isWeak()) 149263508Sdim // FIXME: Currently we are using an extent symbol here, 150263508Sdim // because there are no generic region address metadata 151263508Sdim // symbols to use, only content metadata. 152263508Sdim return nonloc::SymbolVal(SymMgr.getExtentSymbol(FTR)); 153263508Sdim 154263508Sdim if (const SymbolicRegion *SymR = R->getSymbolicBase()) 155263508Sdim return nonloc::SymbolVal(SymR->getSymbol()); 156263508Sdim 157263508Sdim // FALL-THROUGH 158263508Sdim } 159263508Sdim 160263508Sdim case loc::GotoLabelKind: 161263508Sdim // Labels and non symbolic memory regions are always true. 162263508Sdim return makeTruthVal(true, castTy); 163263508Sdim } 164263508Sdim } 165263508Sdim 166251662Sdim if (castTy->isIntegralOrEnumerationType()) { 167218887Sdim unsigned BitWidth = Context.getTypeSize(castTy); 168218887Sdim 169249423Sdim if (!val.getAs<loc::ConcreteInt>()) 170218887Sdim return makeLocAsInteger(val, BitWidth); 171218887Sdim 172249423Sdim llvm::APSInt i = val.castAs<loc::ConcreteInt>().getValue(); 173239462Sdim BasicVals.getAPSIntType(castTy).apply(i); 174218887Sdim return makeIntVal(i); 175218887Sdim } 176218887Sdim 177218887Sdim // All other cases: return 'UnknownVal'. This includes casting pointers 178218887Sdim // to floats, which is probably badness it itself, but this is a good 179218887Sdim // intermediate solution until we do something better. 180218887Sdim return UnknownVal(); 181218887Sdim} 182218887Sdim 183218887Sdim//===----------------------------------------------------------------------===// 184218887Sdim// Transfer function for unary operators. 185218887Sdim//===----------------------------------------------------------------------===// 186218887Sdim 187218887SdimSVal SimpleSValBuilder::evalMinus(NonLoc val) { 188218887Sdim switch (val.getSubKind()) { 189218887Sdim case nonloc::ConcreteIntKind: 190249423Sdim return val.castAs<nonloc::ConcreteInt>().evalMinus(*this); 191218887Sdim default: 192218887Sdim return UnknownVal(); 193218887Sdim } 194218887Sdim} 195218887Sdim 196218887SdimSVal SimpleSValBuilder::evalComplement(NonLoc X) { 197218887Sdim switch (X.getSubKind()) { 198218887Sdim case nonloc::ConcreteIntKind: 199249423Sdim return X.castAs<nonloc::ConcreteInt>().evalComplement(*this); 200218887Sdim default: 201218887Sdim return UnknownVal(); 202218887Sdim } 203218887Sdim} 204218887Sdim 205218887Sdim//===----------------------------------------------------------------------===// 206218887Sdim// Transfer function for binary operators. 207218887Sdim//===----------------------------------------------------------------------===// 208218887Sdim 209218887SdimSVal SimpleSValBuilder::MakeSymIntVal(const SymExpr *LHS, 210218887Sdim BinaryOperator::Opcode op, 211218887Sdim const llvm::APSInt &RHS, 212218887Sdim QualType resultTy) { 213218887Sdim bool isIdempotent = false; 214218887Sdim 215218887Sdim // Check for a few special cases with known reductions first. 216218887Sdim switch (op) { 217218887Sdim default: 218218887Sdim // We can't reduce this case; just treat it normally. 219218887Sdim break; 220218887Sdim case BO_Mul: 221218887Sdim // a*0 and a*1 222218887Sdim if (RHS == 0) 223218887Sdim return makeIntVal(0, resultTy); 224218887Sdim else if (RHS == 1) 225218887Sdim isIdempotent = true; 226218887Sdim break; 227218887Sdim case BO_Div: 228218887Sdim // a/0 and a/1 229218887Sdim if (RHS == 0) 230218887Sdim // This is also handled elsewhere. 231218887Sdim return UndefinedVal(); 232218887Sdim else if (RHS == 1) 233218887Sdim isIdempotent = true; 234218887Sdim break; 235218887Sdim case BO_Rem: 236218887Sdim // a%0 and a%1 237218887Sdim if (RHS == 0) 238218887Sdim // This is also handled elsewhere. 239218887Sdim return UndefinedVal(); 240218887Sdim else if (RHS == 1) 241218887Sdim return makeIntVal(0, resultTy); 242218887Sdim break; 243218887Sdim case BO_Add: 244218887Sdim case BO_Sub: 245218887Sdim case BO_Shl: 246218887Sdim case BO_Shr: 247218887Sdim case BO_Xor: 248218887Sdim // a+0, a-0, a<<0, a>>0, a^0 249218887Sdim if (RHS == 0) 250218887Sdim isIdempotent = true; 251218887Sdim break; 252218887Sdim case BO_And: 253218887Sdim // a&0 and a&(~0) 254218887Sdim if (RHS == 0) 255218887Sdim return makeIntVal(0, resultTy); 256218887Sdim else if (RHS.isAllOnesValue()) 257218887Sdim isIdempotent = true; 258218887Sdim break; 259218887Sdim case BO_Or: 260218887Sdim // a|0 and a|(~0) 261218887Sdim if (RHS == 0) 262218887Sdim isIdempotent = true; 263218887Sdim else if (RHS.isAllOnesValue()) { 264218887Sdim const llvm::APSInt &Result = BasicVals.Convert(resultTy, RHS); 265218887Sdim return nonloc::ConcreteInt(Result); 266218887Sdim } 267218887Sdim break; 268218887Sdim } 269218887Sdim 270218887Sdim // Idempotent ops (like a*1) can still change the type of an expression. 271221345Sdim // Wrap the LHS up in a NonLoc again and let evalCastFromNonLoc do the 272221345Sdim // dirty work. 273234353Sdim if (isIdempotent) 274234353Sdim return evalCastFromNonLoc(nonloc::SymbolVal(LHS), resultTy); 275218887Sdim 276218887Sdim // If we reach this point, the expression cannot be simplified. 277239462Sdim // Make a SymbolVal for the entire expression, after converting the RHS. 278239462Sdim const llvm::APSInt *ConvertedRHS = &RHS; 279239462Sdim if (BinaryOperator::isComparisonOp(op)) { 280239462Sdim // We're looking for a type big enough to compare the symbolic value 281239462Sdim // with the given constant. 282239462Sdim // FIXME: This is an approximation of Sema::UsualArithmeticConversions. 283239462Sdim ASTContext &Ctx = getContext(); 284243830Sdim QualType SymbolType = LHS->getType(); 285239462Sdim uint64_t ValWidth = RHS.getBitWidth(); 286239462Sdim uint64_t TypeWidth = Ctx.getTypeSize(SymbolType); 287239462Sdim 288239462Sdim if (ValWidth < TypeWidth) { 289239462Sdim // If the value is too small, extend it. 290239462Sdim ConvertedRHS = &BasicVals.Convert(SymbolType, RHS); 291239462Sdim } else if (ValWidth == TypeWidth) { 292239462Sdim // If the value is signed but the symbol is unsigned, do the comparison 293239462Sdim // in unsigned space. [C99 6.3.1.8] 294239462Sdim // (For the opposite case, the value is already unsigned.) 295239462Sdim if (RHS.isSigned() && !SymbolType->isSignedIntegerOrEnumerationType()) 296239462Sdim ConvertedRHS = &BasicVals.Convert(SymbolType, RHS); 297239462Sdim } 298239462Sdim } else 299239462Sdim ConvertedRHS = &BasicVals.Convert(resultTy, RHS); 300239462Sdim 301239462Sdim return makeNonLoc(LHS, op, *ConvertedRHS, resultTy); 302218887Sdim} 303218887Sdim 304234353SdimSVal SimpleSValBuilder::evalBinOpNN(ProgramStateRef state, 305218887Sdim BinaryOperator::Opcode op, 306218887Sdim NonLoc lhs, NonLoc rhs, 307218887Sdim QualType resultTy) { 308239462Sdim NonLoc InputLHS = lhs; 309239462Sdim NonLoc InputRHS = rhs; 310239462Sdim 311218887Sdim // Handle trivial case where left-side and right-side are the same. 312218887Sdim if (lhs == rhs) 313218887Sdim switch (op) { 314218887Sdim default: 315218887Sdim break; 316218887Sdim case BO_EQ: 317218887Sdim case BO_LE: 318218887Sdim case BO_GE: 319218887Sdim return makeTruthVal(true, resultTy); 320218887Sdim case BO_LT: 321218887Sdim case BO_GT: 322218887Sdim case BO_NE: 323218887Sdim return makeTruthVal(false, resultTy); 324218887Sdim case BO_Xor: 325218887Sdim case BO_Sub: 326243830Sdim if (resultTy->isIntegralOrEnumerationType()) 327243830Sdim return makeIntVal(0, resultTy); 328243830Sdim return evalCastFromNonLoc(makeIntVal(0, /*Unsigned=*/false), resultTy); 329218887Sdim case BO_Or: 330218887Sdim case BO_And: 331221345Sdim return evalCastFromNonLoc(lhs, resultTy); 332218887Sdim } 333218887Sdim 334218887Sdim while (1) { 335218887Sdim switch (lhs.getSubKind()) { 336218887Sdim default: 337239462Sdim return makeSymExprValNN(state, op, lhs, rhs, resultTy); 338218887Sdim case nonloc::LocAsIntegerKind: { 339249423Sdim Loc lhsL = lhs.castAs<nonloc::LocAsInteger>().getLoc(); 340218887Sdim switch (rhs.getSubKind()) { 341218887Sdim case nonloc::LocAsIntegerKind: 342218887Sdim return evalBinOpLL(state, op, lhsL, 343249423Sdim rhs.castAs<nonloc::LocAsInteger>().getLoc(), 344218887Sdim resultTy); 345218887Sdim case nonloc::ConcreteIntKind: { 346218887Sdim // Transform the integer into a location and compare. 347249423Sdim llvm::APSInt i = rhs.castAs<nonloc::ConcreteInt>().getValue(); 348239462Sdim BasicVals.getAPSIntType(Context.VoidPtrTy).apply(i); 349218887Sdim return evalBinOpLL(state, op, lhsL, makeLoc(i), resultTy); 350218887Sdim } 351218887Sdim default: 352218887Sdim switch (op) { 353218887Sdim case BO_EQ: 354218887Sdim return makeTruthVal(false, resultTy); 355218887Sdim case BO_NE: 356218887Sdim return makeTruthVal(true, resultTy); 357218887Sdim default: 358218887Sdim // This case also handles pointer arithmetic. 359239462Sdim return makeSymExprValNN(state, op, InputLHS, InputRHS, resultTy); 360218887Sdim } 361218887Sdim } 362218887Sdim } 363218887Sdim case nonloc::ConcreteIntKind: { 364249423Sdim llvm::APSInt LHSValue = lhs.castAs<nonloc::ConcreteInt>().getValue(); 365218887Sdim 366239462Sdim // If we're dealing with two known constants, just perform the operation. 367239462Sdim if (const llvm::APSInt *KnownRHSValue = getKnownValue(state, rhs)) { 368239462Sdim llvm::APSInt RHSValue = *KnownRHSValue; 369239462Sdim if (BinaryOperator::isComparisonOp(op)) { 370239462Sdim // We're looking for a type big enough to compare the two values. 371239462Sdim // FIXME: This is not correct. char + short will result in a promotion 372239462Sdim // to int. Unfortunately we have lost types by this point. 373239462Sdim APSIntType CompareType = std::max(APSIntType(LHSValue), 374239462Sdim APSIntType(RHSValue)); 375239462Sdim CompareType.apply(LHSValue); 376239462Sdim CompareType.apply(RHSValue); 377239462Sdim } else if (!BinaryOperator::isShiftOp(op)) { 378239462Sdim APSIntType IntType = BasicVals.getAPSIntType(resultTy); 379239462Sdim IntType.apply(LHSValue); 380239462Sdim IntType.apply(RHSValue); 381224145Sdim } 382224145Sdim 383239462Sdim const llvm::APSInt *Result = 384239462Sdim BasicVals.evalAPSInt(op, LHSValue, RHSValue); 385239462Sdim if (!Result) 386239462Sdim return UndefinedVal(); 387218887Sdim 388239462Sdim return nonloc::ConcreteInt(*Result); 389218887Sdim } 390239462Sdim 391239462Sdim // Swap the left and right sides and flip the operator if doing so 392239462Sdim // allows us to better reason about the expression (this is a form 393239462Sdim // of expression canonicalization). 394239462Sdim // While we're at it, catch some special cases for non-commutative ops. 395239462Sdim switch (op) { 396239462Sdim case BO_LT: 397239462Sdim case BO_GT: 398239462Sdim case BO_LE: 399239462Sdim case BO_GE: 400249423Sdim op = BinaryOperator::reverseComparisonOp(op); 401239462Sdim // FALL-THROUGH 402239462Sdim case BO_EQ: 403239462Sdim case BO_NE: 404239462Sdim case BO_Add: 405239462Sdim case BO_Mul: 406239462Sdim case BO_And: 407239462Sdim case BO_Xor: 408239462Sdim case BO_Or: 409239462Sdim std::swap(lhs, rhs); 410239462Sdim continue; 411239462Sdim case BO_Shr: 412239462Sdim // (~0)>>a 413239462Sdim if (LHSValue.isAllOnesValue() && LHSValue.isSigned()) 414239462Sdim return evalCastFromNonLoc(lhs, resultTy); 415239462Sdim // FALL-THROUGH 416239462Sdim case BO_Shl: 417239462Sdim // 0<<a and 0>>a 418239462Sdim if (LHSValue == 0) 419239462Sdim return evalCastFromNonLoc(lhs, resultTy); 420239462Sdim return makeSymExprValNN(state, op, InputLHS, InputRHS, resultTy); 421239462Sdim default: 422239462Sdim return makeSymExprValNN(state, op, InputLHS, InputRHS, resultTy); 423239462Sdim } 424218887Sdim } 425218887Sdim case nonloc::SymbolValKind: { 426239462Sdim // We only handle LHS as simple symbols or SymIntExprs. 427249423Sdim SymbolRef Sym = lhs.castAs<nonloc::SymbolVal>().getSymbol(); 428224145Sdim 429234353Sdim // LHS is a symbolic expression. 430239462Sdim if (const SymIntExpr *symIntExpr = dyn_cast<SymIntExpr>(Sym)) { 431224145Sdim 432234353Sdim // Is this a logical not? (!x is represented as x == 0.) 433234353Sdim if (op == BO_EQ && rhs.isZeroConstant()) { 434234353Sdim // We know how to negate certain expressions. Simplify them here. 435234353Sdim 436234353Sdim BinaryOperator::Opcode opc = symIntExpr->getOpcode(); 437234353Sdim switch (opc) { 438234353Sdim default: 439234353Sdim // We don't know how to negate this operation. 440234353Sdim // Just handle it as if it were a normal comparison to 0. 441234353Sdim break; 442234353Sdim case BO_LAnd: 443234353Sdim case BO_LOr: 444234353Sdim llvm_unreachable("Logical operators handled by branching logic."); 445234353Sdim case BO_Assign: 446234353Sdim case BO_MulAssign: 447234353Sdim case BO_DivAssign: 448234353Sdim case BO_RemAssign: 449234353Sdim case BO_AddAssign: 450234353Sdim case BO_SubAssign: 451234353Sdim case BO_ShlAssign: 452234353Sdim case BO_ShrAssign: 453234353Sdim case BO_AndAssign: 454234353Sdim case BO_XorAssign: 455234353Sdim case BO_OrAssign: 456234353Sdim case BO_Comma: 457234353Sdim llvm_unreachable("'=' and ',' operators handled by ExprEngine."); 458234353Sdim case BO_PtrMemD: 459234353Sdim case BO_PtrMemI: 460234353Sdim llvm_unreachable("Pointer arithmetic not handled here."); 461234353Sdim case BO_LT: 462234353Sdim case BO_GT: 463234353Sdim case BO_LE: 464234353Sdim case BO_GE: 465234353Sdim case BO_EQ: 466234353Sdim case BO_NE: 467251662Sdim assert(resultTy->isBooleanType() || 468251662Sdim resultTy == getConditionType()); 469251662Sdim assert(symIntExpr->getType()->isBooleanType() || 470251662Sdim getContext().hasSameUnqualifiedType(symIntExpr->getType(), 471251662Sdim getConditionType())); 472234353Sdim // Negate the comparison and make a value. 473249423Sdim opc = BinaryOperator::negateComparisonOp(opc); 474234353Sdim return makeNonLoc(symIntExpr->getLHS(), opc, 475234353Sdim symIntExpr->getRHS(), resultTy); 476218887Sdim } 477218887Sdim } 478218887Sdim 479234353Sdim // For now, only handle expressions whose RHS is a constant. 480239462Sdim if (const llvm::APSInt *RHSValue = getKnownValue(state, rhs)) { 481239462Sdim // If both the LHS and the current expression are additive, 482239462Sdim // fold their constants and try again. 483239462Sdim if (BinaryOperator::isAdditiveOp(op)) { 484239462Sdim BinaryOperator::Opcode lop = symIntExpr->getOpcode(); 485239462Sdim if (BinaryOperator::isAdditiveOp(lop)) { 486239462Sdim // Convert the two constants to a common type, then combine them. 487234353Sdim 488239462Sdim // resultTy may not be the best type to convert to, but it's 489239462Sdim // probably the best choice in expressions with mixed type 490239462Sdim // (such as x+1U+2LL). The rules for implicit conversions should 491239462Sdim // choose a reasonable type to preserve the expression, and will 492239462Sdim // at least match how the value is going to be used. 493239462Sdim APSIntType IntType = BasicVals.getAPSIntType(resultTy); 494239462Sdim const llvm::APSInt &first = IntType.convert(symIntExpr->getRHS()); 495239462Sdim const llvm::APSInt &second = IntType.convert(*RHSValue); 496218887Sdim 497239462Sdim const llvm::APSInt *newRHS; 498239462Sdim if (lop == op) 499239462Sdim newRHS = BasicVals.evalAPSInt(BO_Add, first, second); 500239462Sdim else 501239462Sdim newRHS = BasicVals.evalAPSInt(BO_Sub, first, second); 502234353Sdim 503239462Sdim assert(newRHS && "Invalid operation despite common type!"); 504239462Sdim rhs = nonloc::ConcreteInt(*newRHS); 505239462Sdim lhs = nonloc::SymbolVal(symIntExpr->getLHS()); 506239462Sdim op = lop; 507234353Sdim continue; 508234353Sdim } 509234353Sdim } 510234353Sdim 511239462Sdim // Otherwise, make a SymIntExpr out of the expression. 512239462Sdim return MakeSymIntVal(symIntExpr, op, *RHSValue, resultTy); 513234353Sdim } 514249423Sdim } 515234353Sdim 516249423Sdim // Does the symbolic expression simplify to a constant? 517249423Sdim // If so, "fold" the constant by setting 'lhs' to a ConcreteInt 518249423Sdim // and try again. 519249423Sdim ConstraintManager &CMgr = state->getConstraintManager(); 520249423Sdim if (const llvm::APSInt *Constant = CMgr.getSymVal(state, Sym)) { 521249423Sdim lhs = nonloc::ConcreteInt(*Constant); 522249423Sdim continue; 523249423Sdim } 524239462Sdim 525249423Sdim // Is the RHS a constant? 526249423Sdim if (const llvm::APSInt *RHSValue = getKnownValue(state, rhs)) 527249423Sdim return MakeSymIntVal(Sym, op, *RHSValue, resultTy); 528234353Sdim 529239462Sdim // Give up -- this is not a symbolic expression we can handle. 530239462Sdim return makeSymExprValNN(state, op, InputLHS, InputRHS, resultTy); 531218887Sdim } 532218887Sdim } 533218887Sdim } 534218887Sdim} 535218887Sdim 536263508Sdimstatic SVal evalBinOpFieldRegionFieldRegion(const FieldRegion *LeftFR, 537263508Sdim const FieldRegion *RightFR, 538263508Sdim BinaryOperator::Opcode op, 539263508Sdim QualType resultTy, 540263508Sdim SimpleSValBuilder &SVB) { 541263508Sdim // Only comparisons are meaningful here! 542263508Sdim if (!BinaryOperator::isComparisonOp(op)) 543263508Sdim return UnknownVal(); 544263508Sdim 545263508Sdim // Next, see if the two FRs have the same super-region. 546263508Sdim // FIXME: This doesn't handle casts yet, and simply stripping the casts 547263508Sdim // doesn't help. 548263508Sdim if (LeftFR->getSuperRegion() != RightFR->getSuperRegion()) 549263508Sdim return UnknownVal(); 550263508Sdim 551263508Sdim const FieldDecl *LeftFD = LeftFR->getDecl(); 552263508Sdim const FieldDecl *RightFD = RightFR->getDecl(); 553263508Sdim const RecordDecl *RD = LeftFD->getParent(); 554263508Sdim 555263508Sdim // Make sure the two FRs are from the same kind of record. Just in case! 556263508Sdim // FIXME: This is probably where inheritance would be a problem. 557263508Sdim if (RD != RightFD->getParent()) 558263508Sdim return UnknownVal(); 559263508Sdim 560263508Sdim // We know for sure that the two fields are not the same, since that 561263508Sdim // would have given us the same SVal. 562263508Sdim if (op == BO_EQ) 563263508Sdim return SVB.makeTruthVal(false, resultTy); 564263508Sdim if (op == BO_NE) 565263508Sdim return SVB.makeTruthVal(true, resultTy); 566263508Sdim 567263508Sdim // Iterate through the fields and see which one comes first. 568263508Sdim // [C99 6.7.2.1.13] "Within a structure object, the non-bit-field 569263508Sdim // members and the units in which bit-fields reside have addresses that 570263508Sdim // increase in the order in which they are declared." 571263508Sdim bool leftFirst = (op == BO_LT || op == BO_LE); 572263508Sdim for (RecordDecl::field_iterator I = RD->field_begin(), 573263508Sdim E = RD->field_end(); I!=E; ++I) { 574263508Sdim if (*I == LeftFD) 575263508Sdim return SVB.makeTruthVal(leftFirst, resultTy); 576263508Sdim if (*I == RightFD) 577263508Sdim return SVB.makeTruthVal(!leftFirst, resultTy); 578263508Sdim } 579263508Sdim 580263508Sdim llvm_unreachable("Fields not found in parent record's definition"); 581263508Sdim} 582263508Sdim 583218887Sdim// FIXME: all this logic will change if/when we have MemRegion::getLocation(). 584234353SdimSVal SimpleSValBuilder::evalBinOpLL(ProgramStateRef state, 585218887Sdim BinaryOperator::Opcode op, 586218887Sdim Loc lhs, Loc rhs, 587218887Sdim QualType resultTy) { 588218887Sdim // Only comparisons and subtractions are valid operations on two pointers. 589218887Sdim // See [C99 6.5.5 through 6.5.14] or [C++0x 5.6 through 5.15]. 590218887Sdim // However, if a pointer is casted to an integer, evalBinOpNN may end up 591218887Sdim // calling this function with another operation (PR7527). We don't attempt to 592218887Sdim // model this for now, but it could be useful, particularly when the 593218887Sdim // "location" is actually an integer value that's been passed through a void*. 594218887Sdim if (!(BinaryOperator::isComparisonOp(op) || op == BO_Sub)) 595218887Sdim return UnknownVal(); 596218887Sdim 597218887Sdim // Special cases for when both sides are identical. 598218887Sdim if (lhs == rhs) { 599218887Sdim switch (op) { 600218887Sdim default: 601226633Sdim llvm_unreachable("Unimplemented operation for two identical values"); 602218887Sdim case BO_Sub: 603218887Sdim return makeZeroVal(resultTy); 604218887Sdim case BO_EQ: 605218887Sdim case BO_LE: 606218887Sdim case BO_GE: 607218887Sdim return makeTruthVal(true, resultTy); 608218887Sdim case BO_NE: 609218887Sdim case BO_LT: 610218887Sdim case BO_GT: 611218887Sdim return makeTruthVal(false, resultTy); 612218887Sdim } 613218887Sdim } 614218887Sdim 615218887Sdim switch (lhs.getSubKind()) { 616218887Sdim default: 617226633Sdim llvm_unreachable("Ordering not implemented for this Loc."); 618218887Sdim 619218887Sdim case loc::GotoLabelKind: 620218887Sdim // The only thing we know about labels is that they're non-null. 621218887Sdim if (rhs.isZeroConstant()) { 622218887Sdim switch (op) { 623218887Sdim default: 624218887Sdim break; 625218887Sdim case BO_Sub: 626221345Sdim return evalCastFromLoc(lhs, resultTy); 627218887Sdim case BO_EQ: 628218887Sdim case BO_LE: 629218887Sdim case BO_LT: 630218887Sdim return makeTruthVal(false, resultTy); 631218887Sdim case BO_NE: 632218887Sdim case BO_GT: 633218887Sdim case BO_GE: 634218887Sdim return makeTruthVal(true, resultTy); 635218887Sdim } 636218887Sdim } 637218887Sdim // There may be two labels for the same location, and a function region may 638218887Sdim // have the same address as a label at the start of the function (depending 639218887Sdim // on the ABI). 640218887Sdim // FIXME: we can probably do a comparison against other MemRegions, though. 641218887Sdim // FIXME: is there a way to tell if two labels refer to the same location? 642218887Sdim return UnknownVal(); 643218887Sdim 644218887Sdim case loc::ConcreteIntKind: { 645218887Sdim // If one of the operands is a symbol and the other is a constant, 646218887Sdim // build an expression for use by the constraint manager. 647218887Sdim if (SymbolRef rSym = rhs.getAsLocSymbol()) { 648218887Sdim // We can only build expressions with symbols on the left, 649218887Sdim // so we need a reversible operator. 650218887Sdim if (!BinaryOperator::isComparisonOp(op)) 651218887Sdim return UnknownVal(); 652218887Sdim 653249423Sdim const llvm::APSInt &lVal = lhs.castAs<loc::ConcreteInt>().getValue(); 654249423Sdim op = BinaryOperator::reverseComparisonOp(op); 655249423Sdim return makeNonLoc(rSym, op, lVal, resultTy); 656218887Sdim } 657218887Sdim 658218887Sdim // If both operands are constants, just perform the operation. 659249423Sdim if (Optional<loc::ConcreteInt> rInt = rhs.getAs<loc::ConcreteInt>()) { 660249423Sdim SVal ResultVal = 661249423Sdim lhs.castAs<loc::ConcreteInt>().evalBinOp(BasicVals, op, *rInt); 662249423Sdim if (Optional<NonLoc> Result = ResultVal.getAs<NonLoc>()) 663249423Sdim return evalCastFromNonLoc(*Result, resultTy); 664249423Sdim 665249423Sdim assert(!ResultVal.getAs<Loc>() && "Loc-Loc ops should not produce Locs"); 666249423Sdim return UnknownVal(); 667218887Sdim } 668218887Sdim 669218887Sdim // Special case comparisons against NULL. 670218887Sdim // This must come after the test if the RHS is a symbol, which is used to 671218887Sdim // build constraints. The address of any non-symbolic region is guaranteed 672218887Sdim // to be non-NULL, as is any label. 673249423Sdim assert(rhs.getAs<loc::MemRegionVal>() || rhs.getAs<loc::GotoLabel>()); 674218887Sdim if (lhs.isZeroConstant()) { 675218887Sdim switch (op) { 676218887Sdim default: 677218887Sdim break; 678218887Sdim case BO_EQ: 679218887Sdim case BO_GT: 680218887Sdim case BO_GE: 681218887Sdim return makeTruthVal(false, resultTy); 682218887Sdim case BO_NE: 683218887Sdim case BO_LT: 684218887Sdim case BO_LE: 685218887Sdim return makeTruthVal(true, resultTy); 686218887Sdim } 687218887Sdim } 688218887Sdim 689218887Sdim // Comparing an arbitrary integer to a region or label address is 690218887Sdim // completely unknowable. 691218887Sdim return UnknownVal(); 692218887Sdim } 693218887Sdim case loc::MemRegionKind: { 694249423Sdim if (Optional<loc::ConcreteInt> rInt = rhs.getAs<loc::ConcreteInt>()) { 695218887Sdim // If one of the operands is a symbol and the other is a constant, 696218887Sdim // build an expression for use by the constraint manager. 697263508Sdim if (SymbolRef lSym = lhs.getAsLocSymbol(true)) 698218887Sdim return MakeSymIntVal(lSym, op, rInt->getValue(), resultTy); 699218887Sdim 700218887Sdim // Special case comparisons to NULL. 701218887Sdim // This must come after the test if the LHS is a symbol, which is used to 702218887Sdim // build constraints. The address of any non-symbolic region is guaranteed 703218887Sdim // to be non-NULL. 704218887Sdim if (rInt->isZeroConstant()) { 705263508Sdim if (op == BO_Sub) 706221345Sdim return evalCastFromLoc(lhs, resultTy); 707263508Sdim 708263508Sdim if (BinaryOperator::isComparisonOp(op)) { 709263508Sdim QualType boolType = getContext().BoolTy; 710263508Sdim NonLoc l = evalCastFromLoc(lhs, boolType).castAs<NonLoc>(); 711263508Sdim NonLoc r = makeTruthVal(false, boolType).castAs<NonLoc>(); 712263508Sdim return evalBinOpNN(state, op, l, r, resultTy); 713218887Sdim } 714218887Sdim } 715218887Sdim 716218887Sdim // Comparing a region to an arbitrary integer is completely unknowable. 717218887Sdim return UnknownVal(); 718218887Sdim } 719218887Sdim 720218887Sdim // Get both values as regions, if possible. 721218887Sdim const MemRegion *LeftMR = lhs.getAsRegion(); 722218887Sdim assert(LeftMR && "MemRegionKind SVal doesn't have a region!"); 723218887Sdim 724218887Sdim const MemRegion *RightMR = rhs.getAsRegion(); 725218887Sdim if (!RightMR) 726218887Sdim // The RHS is probably a label, which in theory could address a region. 727218887Sdim // FIXME: we can probably make a more useful statement about non-code 728218887Sdim // regions, though. 729218887Sdim return UnknownVal(); 730218887Sdim 731218887Sdim const MemRegion *LeftBase = LeftMR->getBaseRegion(); 732218887Sdim const MemRegion *RightBase = RightMR->getBaseRegion(); 733249423Sdim const MemSpaceRegion *LeftMS = LeftBase->getMemorySpace(); 734249423Sdim const MemSpaceRegion *RightMS = RightBase->getMemorySpace(); 735249423Sdim const MemSpaceRegion *UnknownMS = MemMgr.getUnknownRegion(); 736239462Sdim 737239462Sdim // If the two regions are from different known memory spaces they cannot be 738239462Sdim // equal. Also, assume that no symbolic region (whose memory space is 739239462Sdim // unknown) is on the stack. 740239462Sdim if (LeftMS != RightMS && 741239462Sdim ((LeftMS != UnknownMS && RightMS != UnknownMS) || 742239462Sdim (isa<StackSpaceRegion>(LeftMS) || isa<StackSpaceRegion>(RightMS)))) { 743218887Sdim switch (op) { 744218887Sdim default: 745218887Sdim return UnknownVal(); 746218887Sdim case BO_EQ: 747218887Sdim return makeTruthVal(false, resultTy); 748218887Sdim case BO_NE: 749218887Sdim return makeTruthVal(true, resultTy); 750218887Sdim } 751218887Sdim } 752218887Sdim 753239462Sdim // If both values wrap regions, see if they're from different base regions. 754239462Sdim // Note, heap base symbolic regions are assumed to not alias with 755239462Sdim // each other; for example, we assume that malloc returns different address 756239462Sdim // on each invocation. 757239462Sdim if (LeftBase != RightBase && 758239462Sdim ((!isa<SymbolicRegion>(LeftBase) && !isa<SymbolicRegion>(RightBase)) || 759239462Sdim (isa<HeapSpaceRegion>(LeftMS) || isa<HeapSpaceRegion>(RightMS))) ){ 760234353Sdim switch (op) { 761239462Sdim default: 762239462Sdim return UnknownVal(); 763239462Sdim case BO_EQ: 764239462Sdim return makeTruthVal(false, resultTy); 765239462Sdim case BO_NE: 766239462Sdim return makeTruthVal(true, resultTy); 767234353Sdim } 768234353Sdim } 769234353Sdim 770263508Sdim // Handle special cases for when both regions are element regions. 771263508Sdim const ElementRegion *RightER = dyn_cast<ElementRegion>(RightMR); 772263508Sdim const ElementRegion *LeftER = dyn_cast<ElementRegion>(LeftMR); 773263508Sdim if (RightER && LeftER) { 774218887Sdim // Next, see if the two ERs have the same super-region and matching types. 775218887Sdim // FIXME: This should do something useful even if the types don't match, 776218887Sdim // though if both indexes are constant the RegionRawOffset path will 777218887Sdim // give the correct answer. 778218887Sdim if (LeftER->getSuperRegion() == RightER->getSuperRegion() && 779218887Sdim LeftER->getElementType() == RightER->getElementType()) { 780218887Sdim // Get the left index and cast it to the correct type. 781218887Sdim // If the index is unknown or undefined, bail out here. 782218887Sdim SVal LeftIndexVal = LeftER->getIndex(); 783249423Sdim Optional<NonLoc> LeftIndex = LeftIndexVal.getAs<NonLoc>(); 784218887Sdim if (!LeftIndex) 785218887Sdim return UnknownVal(); 786249423Sdim LeftIndexVal = evalCastFromNonLoc(*LeftIndex, ArrayIndexTy); 787249423Sdim LeftIndex = LeftIndexVal.getAs<NonLoc>(); 788218887Sdim if (!LeftIndex) 789218887Sdim return UnknownVal(); 790218887Sdim 791218887Sdim // Do the same for the right index. 792218887Sdim SVal RightIndexVal = RightER->getIndex(); 793249423Sdim Optional<NonLoc> RightIndex = RightIndexVal.getAs<NonLoc>(); 794218887Sdim if (!RightIndex) 795218887Sdim return UnknownVal(); 796249423Sdim RightIndexVal = evalCastFromNonLoc(*RightIndex, ArrayIndexTy); 797249423Sdim RightIndex = RightIndexVal.getAs<NonLoc>(); 798218887Sdim if (!RightIndex) 799218887Sdim return UnknownVal(); 800218887Sdim 801218887Sdim // Actually perform the operation. 802218887Sdim // evalBinOpNN expects the two indexes to already be the right type. 803218887Sdim return evalBinOpNN(state, op, *LeftIndex, *RightIndex, resultTy); 804218887Sdim } 805263508Sdim } 806218887Sdim 807263508Sdim // Special handling of the FieldRegions, even with symbolic offsets. 808263508Sdim const FieldRegion *RightFR = dyn_cast<FieldRegion>(RightMR); 809263508Sdim const FieldRegion *LeftFR = dyn_cast<FieldRegion>(LeftMR); 810263508Sdim if (RightFR && LeftFR) { 811263508Sdim SVal R = evalBinOpFieldRegionFieldRegion(LeftFR, RightFR, op, resultTy, 812263508Sdim *this); 813263508Sdim if (!R.isUnknown()) 814263508Sdim return R; 815263508Sdim } 816218887Sdim 817263508Sdim // Compare the regions using the raw offsets. 818263508Sdim RegionOffset LeftOffset = LeftMR->getAsOffset(); 819263508Sdim RegionOffset RightOffset = RightMR->getAsOffset(); 820218887Sdim 821263508Sdim if (LeftOffset.getRegion() != NULL && 822263508Sdim LeftOffset.getRegion() == RightOffset.getRegion() && 823263508Sdim !LeftOffset.hasSymbolicOffset() && !RightOffset.hasSymbolicOffset()) { 824263508Sdim int64_t left = LeftOffset.getOffset(); 825263508Sdim int64_t right = RightOffset.getOffset(); 826263508Sdim 827263508Sdim switch (op) { 828218887Sdim default: 829218887Sdim return UnknownVal(); 830218887Sdim case BO_LT: 831218887Sdim return makeTruthVal(left < right, resultTy); 832218887Sdim case BO_GT: 833218887Sdim return makeTruthVal(left > right, resultTy); 834218887Sdim case BO_LE: 835218887Sdim return makeTruthVal(left <= right, resultTy); 836218887Sdim case BO_GE: 837218887Sdim return makeTruthVal(left >= right, resultTy); 838218887Sdim case BO_EQ: 839218887Sdim return makeTruthVal(left == right, resultTy); 840218887Sdim case BO_NE: 841218887Sdim return makeTruthVal(left != right, resultTy); 842218887Sdim } 843218887Sdim } 844218887Sdim 845249423Sdim // At this point we're not going to get a good answer, but we can try 846249423Sdim // conjuring an expression instead. 847249423Sdim SymbolRef LHSSym = lhs.getAsLocSymbol(); 848249423Sdim SymbolRef RHSSym = rhs.getAsLocSymbol(); 849249423Sdim if (LHSSym && RHSSym) 850249423Sdim return makeNonLoc(LHSSym, op, RHSSym, resultTy); 851249423Sdim 852218887Sdim // If we get here, we have no way of comparing the regions. 853218887Sdim return UnknownVal(); 854218887Sdim } 855218887Sdim } 856218887Sdim} 857218887Sdim 858234353SdimSVal SimpleSValBuilder::evalBinOpLN(ProgramStateRef state, 859218887Sdim BinaryOperator::Opcode op, 860218887Sdim Loc lhs, NonLoc rhs, QualType resultTy) { 861263508Sdim assert(!BinaryOperator::isComparisonOp(op) && 862263508Sdim "arguments to comparison ops must be of the same type"); 863263508Sdim 864218887Sdim // Special case: rhs is a zero constant. 865218887Sdim if (rhs.isZeroConstant()) 866218887Sdim return lhs; 867218887Sdim 868218887Sdim // We are dealing with pointer arithmetic. 869218887Sdim 870218887Sdim // Handle pointer arithmetic on constant values. 871249423Sdim if (Optional<nonloc::ConcreteInt> rhsInt = rhs.getAs<nonloc::ConcreteInt>()) { 872249423Sdim if (Optional<loc::ConcreteInt> lhsInt = lhs.getAs<loc::ConcreteInt>()) { 873218887Sdim const llvm::APSInt &leftI = lhsInt->getValue(); 874218887Sdim assert(leftI.isUnsigned()); 875218887Sdim llvm::APSInt rightI(rhsInt->getValue(), /* isUnsigned */ true); 876218887Sdim 877218887Sdim // Convert the bitwidth of rightI. This should deal with overflow 878218887Sdim // since we are dealing with concrete values. 879218887Sdim rightI = rightI.extOrTrunc(leftI.getBitWidth()); 880218887Sdim 881218887Sdim // Offset the increment by the pointer size. 882218887Sdim llvm::APSInt Multiplicand(rightI.getBitWidth(), /* isUnsigned */ true); 883218887Sdim rightI *= Multiplicand; 884218887Sdim 885218887Sdim // Compute the adjusted pointer. 886218887Sdim switch (op) { 887218887Sdim case BO_Add: 888218887Sdim rightI = leftI + rightI; 889218887Sdim break; 890218887Sdim case BO_Sub: 891218887Sdim rightI = leftI - rightI; 892218887Sdim break; 893218887Sdim default: 894218887Sdim llvm_unreachable("Invalid pointer arithmetic operation"); 895218887Sdim } 896218887Sdim return loc::ConcreteInt(getBasicValueFactory().getValue(rightI)); 897218887Sdim } 898218887Sdim } 899218887Sdim 900218887Sdim // Handle cases where 'lhs' is a region. 901218887Sdim if (const MemRegion *region = lhs.getAsRegion()) { 902249423Sdim rhs = convertToArrayIndex(rhs).castAs<NonLoc>(); 903218887Sdim SVal index = UnknownVal(); 904218887Sdim const MemRegion *superR = 0; 905218887Sdim QualType elementType; 906218887Sdim 907218887Sdim if (const ElementRegion *elemReg = dyn_cast<ElementRegion>(region)) { 908221345Sdim assert(op == BO_Add || op == BO_Sub); 909221345Sdim index = evalBinOpNN(state, op, elemReg->getIndex(), rhs, 910218887Sdim getArrayIndexType()); 911218887Sdim superR = elemReg->getSuperRegion(); 912218887Sdim elementType = elemReg->getElementType(); 913218887Sdim } 914218887Sdim else if (isa<SubRegion>(region)) { 915218887Sdim superR = region; 916218887Sdim index = rhs; 917243830Sdim if (resultTy->isAnyPointerType()) 918243830Sdim elementType = resultTy->getPointeeType(); 919218887Sdim } 920218887Sdim 921249423Sdim if (Optional<NonLoc> indexV = index.getAs<NonLoc>()) { 922218887Sdim return loc::MemRegionVal(MemMgr.getElementRegion(elementType, *indexV, 923218887Sdim superR, getContext())); 924218887Sdim } 925218887Sdim } 926218887Sdim return UnknownVal(); 927218887Sdim} 928218887Sdim 929234353Sdimconst llvm::APSInt *SimpleSValBuilder::getKnownValue(ProgramStateRef state, 930218887Sdim SVal V) { 931218887Sdim if (V.isUnknownOrUndef()) 932218887Sdim return NULL; 933218887Sdim 934249423Sdim if (Optional<loc::ConcreteInt> X = V.getAs<loc::ConcreteInt>()) 935218887Sdim return &X->getValue(); 936218887Sdim 937249423Sdim if (Optional<nonloc::ConcreteInt> X = V.getAs<nonloc::ConcreteInt>()) 938218887Sdim return &X->getValue(); 939218887Sdim 940218887Sdim if (SymbolRef Sym = V.getAsSymbol()) 941243830Sdim return state->getConstraintManager().getSymVal(state, Sym); 942218887Sdim 943218887Sdim // FIXME: Add support for SymExprs. 944218887Sdim return NULL; 945218887Sdim} 946