ProgramState.h

Go to the documentation of this file.

//== ProgramState.h - Path-sensitive "State" for tracking values -*- C++ -*--=//
//
// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
// See https://llvm.org/LICENSE.txt for license information.
// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
//
//===----------------------------------------------------------------------===//
//
// This file defines the state of the program along the analysisa path.
//
//===----------------------------------------------------------------------===//
 
#ifndef LLVM_CLANG_STATICANALYZER_CORE_PATHSENSITIVE_PROGRAMSTATE_H
#define LLVM_CLANG_STATICANALYZER_CORE_PATHSENSITIVE_PROGRAMSTATE_H
 
#include "clang/Basic/LLVM.h"
#include "clang/StaticAnalyzer/Core/PathSensitive/ConstraintManager.h"
#include "clang/StaticAnalyzer/Core/PathSensitive/DynamicTypeInfo.h"
#include "clang/StaticAnalyzer/Core/PathSensitive/Environment.h"
#include "clang/StaticAnalyzer/Core/PathSensitive/ProgramState_Fwd.h"
#include "clang/StaticAnalyzer/Core/PathSensitive/SValBuilder.h"
#include "clang/StaticAnalyzer/Core/PathSensitive/Store.h"
#include "llvm/ADT/FoldingSet.h"
#include "llvm/ADT/ImmutableMap.h"
#include "llvm/Support/Allocator.h"
#include <optional>
#include <utility>
 
namespace llvm {
class APSInt;
}
 
namespace clang {
class ASTContext;
 
namespace ento {
 
class AnalysisManager;
class CallEvent;
class CallEventManager;
 
typedef std::unique_ptr<ConstraintManager>(*ConstraintManagerCreator)(
    ProgramStateManager &, ExprEngine *);
typedef std::unique_ptr<StoreManager>(*StoreManagerCreator)(
    ProgramStateManager &);
 
//===----------------------------------------------------------------------===//
// ProgramStateTrait - Traits used by the Generic Data Map of a ProgramState.
//===----------------------------------------------------------------------===//
 
template <typename T> struct ProgramStateTrait {
  typedef typename T::data_type data_type;
  static inline void *MakeVoidPtr(data_type D) { return (void*) D; }
  static inline data_type MakeData(void *const* P) {
    return P ? (data_type) *P : (data_type) 0;
  }
};
 
/// \class ProgramState
/// ProgramState - This class encapsulates:
///
///    1. A mapping from expressions to values (Environment)
///    2. A mapping from locations to values (Store)
///    3. Constraints on symbolic values (GenericDataMap)
///
///  Together these represent the "abstract state" of a program.
///
///  ProgramState is intended to be used as a functional object; that is,
///  once it is created and made "persistent" in a FoldingSet, its
///  values will never change.
class ProgramState : public llvm::FoldingSetNode {
public:
  typedef llvm::ImmutableMap<void*, void*>                 GenericDataMap;
 
private:
  void operator=(const ProgramState& R) = delete;
 
  friend class ProgramStateManager;
  friend class ExplodedGraph;
  friend class ExplodedNode;
  friend class NodeBuilder;
 
  ProgramStateManager *stateMgr;
  Environment Env;           // Maps a Stmt to its current SVal.
  Store store;               // Maps a location to its current value.
  GenericDataMap   GDM;      // Custom data stored by a client of this class.
 
  // A state is infeasible if there is a contradiction among the constraints.
  // An infeasible state is represented by a `nullptr`.
  // In the sense of `assumeDual`, a state can have two children by adding a
  // new constraint and the negation of that new constraint. A parent state is
  // over-constrained if both of its children are infeasible. In the
  // mathematical sense, it means that the parent is infeasible and we should
  // have realized that at the moment when we have created it. However, we
  // could not recognize that because of the imperfection of the underlying
  // constraint solver. We say it is posteriorly over-constrained because we
  // recognize that a parent is infeasible only *after* a new and more specific
  // constraint and its negation are evaluated.
  //
  // Example:
  //
  // x * x = 4 and x is in the range [0, 1]
  // This is an already infeasible state, but the constraint solver is not
  // capable of handling sqrt, thus we don't know it yet.
  //
  // Then a new constraint `x = 0` is added. At this moment the constraint
  // solver re-evaluates the existing constraints and realizes the
  // contradiction `0 * 0 = 4`.
  // We also evaluate the negated constraint `x != 0`;  the constraint solver
  // deduces `x = 1` and then realizes the contradiction `1 * 1 = 4`.
  // Both children are infeasible, thus the parent state is marked as
  // posteriorly over-constrained. These parents are handled with special care:
  // we do not allow transitions to exploded nodes with such states.
  bool PosteriorlyOverconstrained = false;
  // Make internal constraint solver entities friends so they can access the
  // overconstrained-related functions. We want to keep this API inaccessible
  // for Checkers.
  friend class ConstraintManager;
  bool isPosteriorlyOverconstrained() const {
    return PosteriorlyOverconstrained;
  }
  ProgramStateRef cloneAsPosteriorlyOverconstrained() const;
 
  unsigned refCount;
 
  /// makeWithStore - Return a ProgramState with the same values as the current
  ///  state with the exception of using the specified Store.
  ProgramStateRef makeWithStore(const StoreRef &store) const;
 
  void setStore(const StoreRef &storeRef);
 
public:
  /// This ctor is used when creating the first ProgramState object.
  ProgramState(ProgramStateManager *mgr, const Environment& env,
          StoreRef st, GenericDataMap gdm);
 
  /// Copy ctor - We must explicitly define this or else the "Next" ptr
  ///  in FoldingSetNode will also get copied.
  ProgramState(const ProgramState &RHS);
 
  ~ProgramState();
 
  int64_t getID() const;
 
  /// Return the ProgramStateManager associated with this state.
  ProgramStateManager &getStateManager() const {
    return *stateMgr;
  }
 
  AnalysisManager &getAnalysisManager() const;
 
  /// Return the ConstraintManager.
  ConstraintManager &getConstraintManager() const;
 
  /// getEnvironment - Return the environment associated with this state.
  ///  The environment is the mapping from expressions to values.
  const Environment& getEnvironment() const { return Env; }
 
  /// Return the store associated with this state.  The store
  ///  is a mapping from locations to values.
  Store getStore() const { return store; }
 
 
  /// getGDM - Return the generic data map associated with this state.
  GenericDataMap getGDM() const { return GDM; }
 
  void setGDM(GenericDataMap gdm) { GDM = gdm; }
 
  /// Profile - Profile the contents of a ProgramState object for use in a
  ///  FoldingSet.  Two ProgramState objects are considered equal if they
  ///  have the same Environment, Store, and GenericDataMap.
  static void Profile(llvm::FoldingSetNodeID& ID, const ProgramState *V) {
    V->Env.Profile(ID);
    ID.AddPointer(V->store);
    V->GDM.Profile(ID);
    ID.AddBoolean(V->PosteriorlyOverconstrained);
  }
 
  /// Profile - Used to profile the contents of this object for inclusion
  ///  in a FoldingSet.
  void Profile(llvm::FoldingSetNodeID& ID) const {
    Profile(ID, this);
  }
 
  BasicValueFactory &getBasicVals() const;
  SymbolManager &getSymbolManager() const;
 
  //==---------------------------------------------------------------------==//
  // Constraints on values.
  //==---------------------------------------------------------------------==//
  //
  // Each ProgramState records constraints on symbolic values.  These constraints
  // are managed using the ConstraintManager associated with a ProgramStateManager.
  // As constraints gradually accrue on symbolic values, added constraints
  // may conflict and indicate that a state is infeasible (as no real values
  // could satisfy all the constraints).  This is the principal mechanism
  // for modeling path-sensitivity in ExprEngine/ProgramState.
  //
  // Various "assume" methods form the interface for adding constraints to
  // symbolic values.  A call to 'assume' indicates an assumption being placed
  // on one or symbolic values.  'assume' methods take the following inputs:
  //
  //  (1) A ProgramState object representing the current state.
  //
  //  (2) The assumed constraint (which is specific to a given "assume" method).
  //
  //  (3) A binary value "Assumption" that indicates whether the constraint is
  //      assumed to be true or false.
  //
  // The output of "assume*" is a new ProgramState object with the added constraints.
  // If no new state is feasible, NULL is returned.
  //
 
  /// Assumes that the value of \p cond is zero (if \p assumption is "false")
  /// or non-zero (if \p assumption is "true").
  ///
  /// This returns a new state with the added constraint on \p cond.
  /// If no new state is feasible, NULL is returned.
  [[nodiscard]] ProgramStateRef assume(DefinedOrUnknownSVal cond,
                                       bool assumption) const;
 
  /// Assumes both "true" and "false" for \p cond, and returns both
  /// corresponding states (respectively).
  ///
  /// This is more efficient than calling assume() twice. Note that one (but not
  /// both) of the returned states may be NULL.
  [[nodiscard]] std::pair<ProgramStateRef, ProgramStateRef>
  assume(DefinedOrUnknownSVal cond) const;
 
  [[nodiscard]] std::pair<ProgramStateRef, ProgramStateRef>
  assumeInBoundDual(DefinedOrUnknownSVal idx, DefinedOrUnknownSVal upperBound,
                    QualType IndexType = QualType()) const;
 
  [[nodiscard]] ProgramStateRef
  assumeInBound(DefinedOrUnknownSVal idx, DefinedOrUnknownSVal upperBound,
                bool assumption, QualType IndexType = QualType()) const;
 
  /// Assumes that the value of \p Val is bounded with [\p From; \p To]
  /// (if \p assumption is "true") or it is fully out of this range
  /// (if \p assumption is "false").
  ///
  /// This returns a new state with the added constraint on \p cond.
  /// If no new state is feasible, NULL is returned.
  [[nodiscard]] ProgramStateRef assumeInclusiveRange(DefinedOrUnknownSVal Val,
                                                     const llvm::APSInt &From,
                                                     const llvm::APSInt &To,
                                                     bool assumption) const;
 
  /// Assumes given range both "true" and "false" for \p Val, and returns both
  /// corresponding states (respectively).
  ///
  /// This is more efficient than calling assume() twice. Note that one (but not
  /// both) of the returned states may be NULL.
  [[nodiscard]] std::pair<ProgramStateRef, ProgramStateRef>
  assumeInclusiveRange(DefinedOrUnknownSVal Val, const llvm::APSInt &From,
                       const llvm::APSInt &To) const;
 
  /// Check if the given SVal is not constrained to zero and is not
  ///        a zero constant.
  ConditionTruthVal isNonNull(SVal V) const;
 
  /// Check if the given SVal is constrained to zero or is a zero
  ///        constant.
  ConditionTruthVal isNull(SVal V) const;
 
  /// \return Whether values \p Lhs and \p Rhs are equal.
  ConditionTruthVal areEqual(SVal Lhs, SVal Rhs) const;
 
  /// Utility method for getting regions.
  LLVM_ATTRIBUTE_RETURNS_NONNULL
  const VarRegion* getRegion(const VarDecl *D, const LocationContext *LC) const;
 
  //==---------------------------------------------------------------------==//
  // Binding and retrieving values to/from the environment and symbolic store.
  //==---------------------------------------------------------------------==//
 
  /// Create a new state by binding the value 'V' to the statement 'S' in the
  /// state's environment.
  [[nodiscard]] ProgramStateRef BindExpr(const Stmt *S,
                                         const LocationContext *LCtx, SVal V,
                                         bool Invalidate = true) const;
 
  [[nodiscard]] ProgramStateRef bindLoc(Loc location, SVal V,
                                        const LocationContext *LCtx,
                                        bool notifyChanges = true) const;
 
  [[nodiscard]] ProgramStateRef bindLoc(SVal location, SVal V,
                                        const LocationContext *LCtx) const;
 
  /// Initializes the region of memory represented by \p loc with an initial
  /// value. Once initialized, all values loaded from any sub-regions of that
  /// region will be equal to \p V, unless overwritten later by the program.
  /// This method should not be used on regions that are already initialized.
  /// If you need to indicate that memory contents have suddenly become unknown
  /// within a certain region of memory, consider invalidateRegions().
  [[nodiscard]] ProgramStateRef
  bindDefaultInitial(SVal loc, SVal V, const LocationContext *LCtx) const;
 
  /// Performs C++ zero-initialization procedure on the region of memory
  /// represented by \p loc.
  [[nodiscard]] ProgramStateRef
  bindDefaultZero(SVal loc, const LocationContext *LCtx) const;
 
  [[nodiscard]] ProgramStateRef killBinding(Loc LV) const;
 
  /// Returns the state with bindings for the given regions cleared from the
  /// store. If \p Call is non-null, also invalidates global regions (but if
  /// \p Call is from a system header, then this is limited to globals declared
  /// in system headers).
  ///
  /// This calls the lower-level method \c StoreManager::invalidateRegions to
  /// do the actual invalidation, then calls the checker callbacks which should
  /// be triggered by this event.
  ///
  /// \param Regions the set of regions to be invalidated.
  /// \param E the expression that caused the invalidation.
  /// \param BlockCount The number of times the current basic block has been
  ///        visited.
  /// \param CausesPointerEscape the flag is set to true when the invalidation
  ///        entails escape of a symbol (representing a pointer). For example,
  ///        due to it being passed as an argument in a call.
  /// \param IS the set of invalidated symbols.
  /// \param Call if non-null, the invalidated regions represent parameters to
  ///        the call and should be considered directly invalidated.
  /// \param ITraits information about special handling for particular regions
  ///        or symbols.
  [[nodiscard]] ProgramStateRef
  invalidateRegions(ArrayRef<const MemRegion *> Regions, const Stmt *S,
                    unsigned BlockCount, const LocationContext *LCtx,
                    bool CausesPointerEscape, InvalidatedSymbols *IS = nullptr,
                    const CallEvent *Call = nullptr,
                    RegionAndSymbolInvalidationTraits *ITraits = nullptr) const;
 
  [[nodiscard]] ProgramStateRef
  invalidateRegions(ArrayRef<SVal> Values, const Stmt *S, unsigned BlockCount,
                    const LocationContext *LCtx, bool CausesPointerEscape,
                    InvalidatedSymbols *IS = nullptr,
                    const CallEvent *Call = nullptr,
                    RegionAndSymbolInvalidationTraits *ITraits = nullptr) const;
 
  /// enterStackFrame - Returns the state for entry to the given stack frame,
  ///  preserving the current state.
  [[nodiscard]] ProgramStateRef
  enterStackFrame(const CallEvent &Call,
                  const StackFrameContext *CalleeCtx) const;
 
  /// Return the value of 'self' if available in the given context.
  SVal getSelfSVal(const LocationContext *LC) const;
 
  /// Get the lvalue for a base class object reference.
  Loc getLValue(const CXXBaseSpecifier &BaseSpec, const SubRegion *Super) const;
 
  /// Get the lvalue for a base class object reference.
  Loc getLValue(const CXXRecordDecl *BaseClass, const SubRegion *Super,
                bool IsVirtual) const;
 
  /// Get the lvalue for a variable reference.
  Loc getLValue(const VarDecl *D, const LocationContext *LC) const;
 
  Loc getLValue(const CompoundLiteralExpr *literal,
                const LocationContext *LC) const;
 
  /// Get the lvalue for an ivar reference.
  SVal getLValue(const ObjCIvarDecl *decl, SVal base) const;
 
  /// Get the lvalue for a field reference.
  SVal getLValue(const FieldDecl *decl, SVal Base) const;
 
  /// Get the lvalue for an indirect field reference.
  SVal getLValue(const IndirectFieldDecl *decl, SVal Base) const;
 
  /// Get the lvalue for an array index.
  SVal getLValue(QualType ElementType, SVal Idx, SVal Base) const;
 
  /// Returns the SVal bound to the statement 'S' in the state's environment.
  SVal getSVal(const Stmt *S, const LocationContext *LCtx) const;
 
  SVal getSValAsScalarOrLoc(const Stmt *Ex, const LocationContext *LCtx) const;
 
  /// Return the value bound to the specified location.
  /// Returns UnknownVal() if none found.
  SVal getSVal(Loc LV, QualType T = QualType()) const;
 
  /// Returns the "raw" SVal bound to LV before any value simplfication.
  SVal getRawSVal(Loc LV, QualType T= QualType()) const;
 
  /// Return the value bound to the specified location.
  /// Returns UnknownVal() if none found.
  SVal getSVal(const MemRegion* R, QualType T = QualType()) const;
 
  /// Return the value bound to the specified location, assuming
  /// that the value is a scalar integer or an enumeration or a pointer.
  /// Returns UnknownVal() if none found or the region is not known to hold
  /// a value of such type.
  SVal getSValAsScalarOrLoc(const MemRegion *R) const;
 
  using region_iterator = const MemRegion **;
 
  /// Visits the symbols reachable from the given SVal using the provided