1 //== SubEngine.h - Interface of the subengine of CoreEngine --------*- C++ -*-//
3 // The LLVM Compiler Infrastructure
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
8 //===----------------------------------------------------------------------===//
10 // This file defines the interface of a subengine of the CoreEngine.
12 //===----------------------------------------------------------------------===//
13 #ifndef LLVM_CLANG_STATICANALYZER_CORE_PATHSENSITIVE_SUBENGINE_H
14 #define LLVM_CLANG_STATICANALYZER_CORE_PATHSENSITIVE_SUBENGINE_H
16 #include "clang/Analysis/ProgramPoint.h"
17 #include "clang/StaticAnalyzer/Core/PathSensitive/SVals.h"
18 #include "clang/StaticAnalyzer/Core/PathSensitive/Store.h"
24 class LocationContext;
28 class CrossTranslationUnitContext;
33 struct NodeBuilderContext;
34 class AnalysisManager;
35 class ExplodedNodeSet;
38 class ProgramStateManager;
40 class BranchNodeBuilder;
41 class IndirectGotoNodeBuilder;
42 class SwitchNodeBuilder;
43 class EndOfFunctionNodeBuilder;
44 class NodeBuilderWithSinks;
48 virtual void anchor();
50 virtual ~SubEngine() {}
52 virtual ProgramStateRef getInitialState(const LocationContext *InitLoc) = 0;
54 virtual AnalysisManager &getAnalysisManager() = 0;
56 virtual cross_tu::CrossTranslationUnitContext *
57 getCrossTranslationUnitContext() = 0;
59 virtual ProgramStateManager &getStateManager() = 0;
61 /// Called by CoreEngine. Used to generate new successor
62 /// nodes by processing the 'effects' of a block-level statement.
63 virtual void processCFGElement(const CFGElement E, ExplodedNode* Pred,
64 unsigned StmtIdx, NodeBuilderContext *Ctx)=0;
66 /// Called by CoreEngine when it starts processing a CFGBlock. The
67 /// SubEngine is expected to populate dstNodes with new nodes representing
68 /// updated analysis state, or generate no nodes at all if it doesn't.
69 virtual void processCFGBlockEntrance(const BlockEdge &L,
70 NodeBuilderWithSinks &nodeBuilder,
71 ExplodedNode *Pred) = 0;
73 /// Called by CoreEngine. Used to generate successor
74 /// nodes by processing the 'effects' of a branch condition.
75 virtual void processBranch(const Stmt *Condition, const Stmt *Term,
76 NodeBuilderContext& BuilderCtx,
80 const CFGBlock *DstF) = 0;
82 /// Called by CoreEngine.
83 /// Used to generate successor nodes for temporary destructors depending
84 /// on whether the corresponding constructor was visited.
85 virtual void processCleanupTemporaryBranch(const CXXBindTemporaryExpr *BTE,
86 NodeBuilderContext &BldCtx,
90 const CFGBlock *DstF) = 0;
92 /// Called by CoreEngine. Used to processing branching behavior
93 /// at static initializers.
94 virtual void processStaticInitializer(const DeclStmt *DS,
95 NodeBuilderContext& BuilderCtx,
99 const CFGBlock *DstF) = 0;
101 /// Called by CoreEngine. Used to generate successor
102 /// nodes by processing the 'effects' of a computed goto jump.
103 virtual void processIndirectGoto(IndirectGotoNodeBuilder& builder) = 0;
105 /// Called by CoreEngine. Used to generate successor
106 /// nodes by processing the 'effects' of a switch statement.
107 virtual void processSwitch(SwitchNodeBuilder& builder) = 0;
109 /// Called by CoreEngine. Used to notify checkers that processing a
110 /// function has begun. Called for both inlined and and top-level functions.
111 virtual void processBeginOfFunction(NodeBuilderContext &BC,
113 ExplodedNodeSet &Dst,
114 const BlockEdge &L) = 0;
116 /// Called by CoreEngine. Used to notify checkers that processing a
117 /// function has ended. Called for both inlined and and top-level functions.
118 virtual void processEndOfFunction(NodeBuilderContext& BC,
120 const ReturnStmt *RS = nullptr) = 0;
122 // Generate the entry node of the callee.
123 virtual void processCallEnter(NodeBuilderContext& BC, CallEnter CE,
124 ExplodedNode *Pred) = 0;
126 // Generate the first post callsite node.
127 virtual void processCallExit(ExplodedNode *Pred) = 0;
129 /// Called by ConstraintManager. Used to call checker-specific
130 /// logic for handling assumptions on symbolic values.
131 virtual ProgramStateRef processAssume(ProgramStateRef state,
132 SVal cond, bool assumption) = 0;
134 /// processRegionChanges - Called by ProgramStateManager whenever a change is
135 /// made to the store. Used to update checkers that track region values.
136 virtual ProgramStateRef
137 processRegionChanges(ProgramStateRef state,
138 const InvalidatedSymbols *invalidated,
139 ArrayRef<const MemRegion *> ExplicitRegions,
140 ArrayRef<const MemRegion *> Regions,
141 const LocationContext *LCtx,
142 const CallEvent *Call) = 0;
145 inline ProgramStateRef
146 processRegionChange(ProgramStateRef state,
148 const LocationContext *LCtx) {
149 return processRegionChanges(state, nullptr, MR, MR, LCtx, nullptr);
152 virtual ProgramStateRef
153 processPointerEscapedOnBind(ProgramStateRef State, SVal Loc, SVal Val, const LocationContext *LCtx) = 0;
155 virtual ProgramStateRef
156 notifyCheckersOfPointerEscape(ProgramStateRef State,
157 const InvalidatedSymbols *Invalidated,
158 ArrayRef<const MemRegion *> ExplicitRegions,
159 ArrayRef<const MemRegion *> Regions,
160 const CallEvent *Call,
161 RegionAndSymbolInvalidationTraits &HTraits) = 0;
163 /// printState - Called by ProgramStateManager to print checker-specific data.
164 virtual void printState(raw_ostream &Out, ProgramStateRef State,
165 const char *NL, const char *Sep,
166 const LocationContext *LCtx = nullptr) = 0;
168 /// Called by CoreEngine when the analysis worklist is either empty or the
169 // maximum number of analysis steps have been reached.
170 virtual void processEndWorklist(bool hasWorkRemaining) = 0;
173 } // end GR namespace
175 } // end clang namespace