ConstraintManager.cpp 4.8 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123
  1. //===- ConstraintManager.cpp - Constraints on symbolic values. ------------===//
  2. //
  3. // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
  4. // See https://llvm.org/LICENSE.txt for license information.
  5. // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
  6. //
  7. //===----------------------------------------------------------------------===//
  8. //
  9. // This file defined the interface to manage constraints on symbolic values.
  10. //
  11. //===----------------------------------------------------------------------===//
  12. #include "clang/StaticAnalyzer/Core/PathSensitive/ConstraintManager.h"
  13. #include "clang/AST/Type.h"
  14. #include "clang/StaticAnalyzer/Core/PathSensitive/MemRegion.h"
  15. #include "clang/StaticAnalyzer/Core/PathSensitive/ProgramState.h"
  16. #include "clang/StaticAnalyzer/Core/PathSensitive/ProgramState_Fwd.h"
  17. #include "clang/StaticAnalyzer/Core/PathSensitive/SVals.h"
  18. #include "llvm/ADT/ScopeExit.h"
  19. using namespace clang;
  20. using namespace ento;
  21. ConstraintManager::~ConstraintManager() = default;
  22. static DefinedSVal getLocFromSymbol(const ProgramStateRef &State,
  23. SymbolRef Sym) {
  24. const MemRegion *R =
  25. State->getStateManager().getRegionManager().getSymbolicRegion(Sym);
  26. return loc::MemRegionVal(R);
  27. }
  28. ConditionTruthVal ConstraintManager::checkNull(ProgramStateRef State,
  29. SymbolRef Sym) {
  30. QualType Ty = Sym->getType();
  31. DefinedSVal V = Loc::isLocType(Ty) ? getLocFromSymbol(State, Sym)
  32. : nonloc::SymbolVal(Sym);
  33. const ProgramStatePair &P = assumeDual(State, V);
  34. if (P.first && !P.second)
  35. return ConditionTruthVal(false);
  36. if (!P.first && P.second)
  37. return ConditionTruthVal(true);
  38. return {};
  39. }
  40. template <typename AssumeFunction>
  41. ConstraintManager::ProgramStatePair
  42. ConstraintManager::assumeDualImpl(ProgramStateRef &State,
  43. AssumeFunction &Assume) {
  44. if (LLVM_UNLIKELY(State->isPosteriorlyOverconstrained()))
  45. return {State, State};
  46. // Assume functions might recurse (see `reAssume` or `tryRearrange`). During
  47. // the recursion the State might not change anymore, that means we reached a
  48. // fixpoint.
  49. // We avoid infinite recursion of assume calls by checking already visited
  50. // States on the stack of assume function calls.
  51. const ProgramState *RawSt = State.get();
  52. if (LLVM_UNLIKELY(AssumeStack.contains(RawSt)))
  53. return {State, State};
  54. AssumeStack.push(RawSt);
  55. auto AssumeStackBuilder =
  56. llvm::make_scope_exit([this]() { AssumeStack.pop(); });
  57. ProgramStateRef StTrue = Assume(true);
  58. if (!StTrue) {
  59. ProgramStateRef StFalse = Assume(false);
  60. if (LLVM_UNLIKELY(!StFalse)) { // both infeasible
  61. ProgramStateRef StInfeasible = State->cloneAsPosteriorlyOverconstrained();
  62. assert(StInfeasible->isPosteriorlyOverconstrained());
  63. // Checkers might rely on the API contract that both returned states
  64. // cannot be null. Thus, we return StInfeasible for both branches because
  65. // it might happen that a Checker uncoditionally uses one of them if the
  66. // other is a nullptr. This may also happen with the non-dual and
  67. // adjacent `assume(true)` and `assume(false)` calls. By implementing
  68. // assume in therms of assumeDual, we can keep our API contract there as
  69. // well.
  70. return ProgramStatePair(StInfeasible, StInfeasible);
  71. }
  72. return ProgramStatePair(nullptr, StFalse);
  73. }
  74. ProgramStateRef StFalse = Assume(false);
  75. if (!StFalse) {
  76. return ProgramStatePair(StTrue, nullptr);
  77. }
  78. return ProgramStatePair(StTrue, StFalse);
  79. }
  80. ConstraintManager::ProgramStatePair
  81. ConstraintManager::assumeDual(ProgramStateRef State, DefinedSVal Cond) {
  82. auto AssumeFun = [&](bool Assumption) {
  83. return assumeInternal(State, Cond, Assumption);
  84. };
  85. return assumeDualImpl(State, AssumeFun);
  86. }
  87. ConstraintManager::ProgramStatePair
  88. ConstraintManager::assumeInclusiveRangeDual(ProgramStateRef State, NonLoc Value,
  89. const llvm::APSInt &From,
  90. const llvm::APSInt &To) {
  91. auto AssumeFun = [&](bool Assumption) {
  92. return assumeInclusiveRangeInternal(State, Value, From, To, Assumption);
  93. };
  94. return assumeDualImpl(State, AssumeFun);
  95. }
  96. ProgramStateRef ConstraintManager::assume(ProgramStateRef State,
  97. DefinedSVal Cond, bool Assumption) {
  98. ConstraintManager::ProgramStatePair R = assumeDual(State, Cond);
  99. return Assumption ? R.first : R.second;
  100. }
  101. ProgramStateRef
  102. ConstraintManager::assumeInclusiveRange(ProgramStateRef State, NonLoc Value,
  103. const llvm::APSInt &From,
  104. const llvm::APSInt &To, bool InBound) {
  105. ConstraintManager::ProgramStatePair R =
  106. assumeInclusiveRangeDual(State, Value, From, To);
  107. return InBound ? R.first : R.second;
  108. }