Lines Matching refs:state
112 void checkLiveSymbols(ProgramStateRef state, SymbolReaper &SR) const;
116 checkRegionChanges(ProgramStateRef state,
168 ProgramStateRef state, SizeArgExpr Size,
212 ProgramStateRef state, SVal V, QualType Ty);
214 static ProgramStateRef setCStringLength(ProgramStateRef state,
218 ProgramStateRef &state,
223 ProgramStateRef &state,
229 ProgramStateRef &state,
234 ProgramStateRef state,
249 ProgramStateRef CheckLocation(CheckerContext &C, ProgramStateRef state,
256 ProgramStateRef CheckOverlap(CheckerContext &C, ProgramStateRef state,
260 ProgramStateRef state,
274 ProgramStateRef state,
282 ProgramStateRef state,
296 CStringChecker::assumeZero(CheckerContext &C, ProgramStateRef state, SVal V, in REGISTER_MAP_WITH_PROGRAMSTATE()
300 return std::pair<ProgramStateRef , ProgramStateRef >(state, state); in REGISTER_MAP_WITH_PROGRAMSTATE()
304 return state->assume(svalBuilder.evalEQ(state, *val, zero)); in REGISTER_MAP_WITH_PROGRAMSTATE()
339 ProgramStateRef state, in CheckLocation() argument
345 if (!state) in CheckLocation()
351 return state; in CheckLocation()
355 return state; in CheckLocation()
365 return state; in CheckLocation()
368 return state; in CheckLocation()
376 SVal Offset = svalBuilder.evalBinOpNN(state, BO_Mul, Idx, WideSize, SizeTy); in CheckLocation()
378 return state; in CheckLocation()
385 getDynamicExtent(state, superReg, C.getSValBuilder()); in CheckLocation()
388 std::tie(StInBound, StOutBound) = state->assumeInBoundDual(Idx, Size); in CheckLocation()
475 ProgramStateRef state, in CheckOverlap() argument
480 return state; in CheckOverlap()
487 if (!state) in CheckOverlap()
495 return state; in CheckOverlap()
499 SVal firstVal = state->getSVal(First.Expression, LCtx); in CheckOverlap()
500 SVal secondVal = state->getSVal(Second.Expression, LCtx); in CheckOverlap()
504 return state; in CheckOverlap()
508 return state; in CheckOverlap()
513 state->assume(svalBuilder.evalEQ(state, *firstLoc, *secondLoc)); in CheckOverlap()
523 state = stateFalse; in CheckOverlap()
528 svalBuilder.evalBinOpLL(state, BO_GT, *firstLoc, *secondLoc, cmpTy); in CheckOverlap()
532 return state; in CheckOverlap()
534 std::tie(stateTrue, stateFalse) = state->assume(*reverseTest); in CheckOverlap()
538 return state; in CheckOverlap()
549 SVal LengthVal = state->getSVal(Size.Expression, LCtx); in CheckOverlap()
552 return state; in CheckOverlap()
562 return state; in CheckOverlap()
565 SVal FirstEnd = svalBuilder.evalBinOpLN(state, BO_Add, *FirstStartLoc, in CheckOverlap()
569 return state; in CheckOverlap()
573 svalBuilder.evalBinOpLL(state, BO_GT, *FirstEndLoc, *secondLoc, cmpTy); in CheckOverlap()
577 return state; in CheckOverlap()
579 std::tie(stateTrue, stateFalse) = state->assume(*OverlapTest); in CheckOverlap()
592 void CStringChecker::emitOverlapBug(CheckerContext &C, ProgramStateRef state, in emitOverlapBug() argument
594 ExplodedNode *N = C.generateErrorNode(state); in emitOverlapBug()
709 ProgramStateRef state, in checkAdditionOverflow() argument
714 return state; in checkAdditionOverflow()
717 if (!state) in checkAdditionOverflow()
729 maxMinusRight = svalBuilder.evalBinOpNN(state, BO_Sub, maxVal, right, in checkAdditionOverflow()
734 maxMinusRight = svalBuilder.evalBinOpNN(state, BO_Sub, maxVal, left, in checkAdditionOverflow()
742 SVal willOverflow = svalBuilder.evalBinOpNN(state, BO_GT, left, in checkAdditionOverflow()
747 state->assume(willOverflow.castAs<DefinedOrUnknownSVal>()); in checkAdditionOverflow()
757 state = stateOkay; in checkAdditionOverflow()
760 return state; in checkAdditionOverflow()
763 ProgramStateRef CStringChecker::setCStringLength(ProgramStateRef state, in setCStringLength() argument
774 return state; in setCStringLength()
788 return state; in setCStringLength()
795 return state; in setCStringLength()
799 return state->remove<CStringLength>(MR); in setCStringLength()
801 return state->set<CStringLength>(MR, strLength); in setCStringLength()
805 ProgramStateRef &state, in getCStringLengthForRegion() argument
811 const SVal *Recorded = state->get<CStringLength>(MR); in getCStringLengthForRegion()
833 SVal evalLength = svalBuilder.evalBinOpNN(state, BO_LE, *strLn, in getCStringLengthForRegion()
835 state = state->assume(evalLength.castAs<DefinedOrUnknownSVal>(), true); in getCStringLengthForRegion()
837 state = state->set<CStringLength>(MR, strLength); in getCStringLengthForRegion()
843 SVal CStringChecker::getCStringLength(CheckerContext &C, ProgramStateRef &state, in getCStringLength() argument
860 emitNotCStringBug(C, state, Ex, os.str()); in getCStringLength()
888 return getCStringLengthForRegion(C, state, Ex, MR, hypothetical); in getCStringLength()
912 emitNotCStringBug(C, state, Ex, os.str()); in getCStringLength()
919 ProgramStateRef &state, const Expr *expr, SVal val) const { in getCStringLiteral() argument
939 ProgramStateRef state, in IsFirstBufInBound() argument
953 SVal BufVal = state->getSVal(FirstBuf, LCtx); in IsFirstBufInBound()
955 SVal LengthVal = state->getSVal(Size, LCtx); in IsFirstBufInBound()
962 SVal Offset = svalBuilder.evalBinOpNN(state, BO_Sub, *Length, One, sizeTy); in IsFirstBufInBound()
974 svalBuilder.evalBinOpLN(state, BO_Add, *BufLoc, LastOffset, PtrTy); in IsFirstBufInBound()
992 DefinedOrUnknownSVal SizeDV = getDynamicExtent(state, superReg, svalBuilder); in IsFirstBufInBound()
997 ProgramStateRef StInBound = state->assumeInBound(Idx, SizeDV, true); in IsFirstBufInBound()
1003 ProgramStateRef state, in InvalidateBuffer() argument
1009 return state; in InvalidateBuffer()
1039 if (Size && IsFirstBufInBound(C, state, E, Size)) { in InvalidateBuffer()
1048 return state->invalidateRegions(R, E, C.blockCount(), LCtx, in InvalidateBuffer()
1056 return state->killBinding(*L); in InvalidateBuffer()
1190 ProgramStateRef state, SizeArgExpr Size, in evalCopyCommon() argument
1198 SVal sizeVal = state->getSVal(Size.Expression, LCtx); in evalCopyCommon()
1203 assumeZero(C, state, sizeVal, sizeTy); in evalCopyCommon()
1206 SVal destVal = state->getSVal(Dest.Expression, LCtx); in evalCopyCommon()
1218 state = stateNonZeroSize; in evalCopyCommon()
1222 state = checkNonNull(C, state, Dest, destVal); in evalCopyCommon()
1223 if (!state) in evalCopyCommon()
1227 SVal srcVal = state->getSVal(Source.Expression, LCtx); in evalCopyCommon()
1231 state = checkNonNull(C, state, Source, srcVal); in evalCopyCommon()
1232 if (!state) in evalCopyCommon()
1236 state = CheckBufferAccess(C, state, Dest, Size, AccessKind::write, IsWide); in evalCopyCommon()
1237 state = CheckBufferAccess(C, state, Source, Size, AccessKind::read, IsWide); in evalCopyCommon()
1240 state = CheckOverlap(C, state, Size, Dest, Source, IsWide); in evalCopyCommon()
1242 if (!state) in evalCopyCommon()
1255 state, BO_Add, DestRegCharVal, sizeVal, Dest.Expression->getType()); in evalCopyCommon()
1263 state = state->BindExpr(CE, LCtx, lastElement); in evalCopyCommon()
1267 state = state->BindExpr(CE, LCtx, destVal); in evalCopyCommon()
1276 state = in evalCopyCommon()
1277 InvalidateBuffer(C, state, Dest.Expression, C.getSVal(Dest.Expression), in evalCopyCommon()
1282 state = InvalidateBuffer(C, state, Source.Expression, in evalCopyCommon()
1286 C.addTransition(state); in evalCopyCommon()
1430 ProgramStateRef state = C.getState(); in evalstrLengthCommon() local
1435 SVal maxlenVal = state->getSVal(maxlenExpr, LCtx); in evalstrLengthCommon()
1439 assumeZero(C, state, maxlenVal, maxlenExpr->getType()); in evalstrLengthCommon()
1454 state = stateNonZeroSize; in evalstrLengthCommon()
1459 SVal ArgVal = state->getSVal(Arg.Expression, LCtx); in evalstrLengthCommon()
1460 state = checkNonNull(C, state, Arg, ArgVal); in evalstrLengthCommon()
1462 if (!state) in evalstrLengthCommon()
1465 SVal strLength = getCStringLength(C, state, Arg.Expression, ArgVal); in evalstrLengthCommon()
1482 SVal maxlenVal = state->getSVal(maxlenExpr, LCtx); in evalstrLengthCommon()
1491 std::tie(stateStringTooLong, stateStringNotTooLong) = state->assume( in evalstrLengthCommon()
1493 .evalBinOpNN(state, BO_GT, *strLengthNL, *maxlenValNL, cmpTy) in evalstrLengthCommon()
1515 state = state->assume(C.getSValBuilder().evalBinOpNN( in evalstrLengthCommon()
1516 state, BO_LE, resultNL, *strLengthNL, cmpTy) in evalstrLengthCommon()
1521 state = state->assume(C.getSValBuilder().evalBinOpNN( in evalstrLengthCommon()
1522 state, BO_LE, resultNL, *maxlenValNL, cmpTy) in evalstrLengthCommon()
1541 state = state->BindExpr(CE, LCtx, result); in evalstrLengthCommon()
1542 C.addTransition(state); in evalstrLengthCommon()
1614 ProgramStateRef state = C.getState(); in evalStrcpyCommon() local
1619 SVal DstVal = state->getSVal(Dst.Expression, LCtx); in evalStrcpyCommon()
1620 state = checkNonNull(C, state, Dst, DstVal); in evalStrcpyCommon()
1621 if (!state) in evalStrcpyCommon()
1626 SVal srcVal = state->getSVal(srcExpr.Expression, LCtx); in evalStrcpyCommon()
1627 state = checkNonNull(C, state, srcExpr, srcVal); in evalStrcpyCommon()
1628 if (!state) in evalStrcpyCommon()
1632 SVal strLength = getCStringLength(C, state, srcExpr.Expression, srcVal); in evalStrcpyCommon()
1636 SVal dstStrLength = getCStringLength(C, state, Dst.Expression, DstVal); in evalStrcpyCommon()
1657 state = CheckOverlap( in evalStrcpyCommon()
1658 C, state, in evalStrcpyCommon()
1662 if (!state) in evalStrcpyCommon()
1669 SVal lenVal = state->getSVal(lenExpr.Expression, LCtx); in evalStrcpyCommon()
1687 std::tie(stateSourceTooLong, stateSourceNotTooLong) = state->assume( in evalStrcpyCommon()
1689 .evalBinOpNN(state, BO_GE, *strLengthNL, *lenValNL, cmpTy) in evalStrcpyCommon()
1695 state = stateSourceTooLong; in evalStrcpyCommon()
1700 state = stateSourceNotTooLong; in evalStrcpyCommon()
1710 SVal freeSpace = svalBuilder.evalBinOpNN(state, BO_Sub, *lenValNL, in evalStrcpyCommon()
1715 svalBuilder.evalBinOp(state, BO_Sub, freeSpace, in evalStrcpyCommon()
1724 state, BO_LE, *strLengthNL, *freeSpaceNL, cmpTy); in evalStrcpyCommon()
1728 state->assume(hasEnoughSpace.castAs<DefinedOrUnknownSVal>()); in evalStrcpyCommon()
1759 state, BO_Add, *lenValNL, *dstStrLengthNL, sizeTy); in evalStrcpyCommon()
1777 assumeZero(C, state, *lenValNL, sizeTy); in evalStrcpyCommon()
1790 state, BO_Add, strLength, dstStrLength, sizeTy); in evalStrcpyCommon()
1803 svalBuilder.evalBinOpNN(state, BO_Sub, *lenValNL, one, sizeTy); in evalStrcpyCommon()
1815 assert(state); in evalStrcpyCommon()
1838 strlRetVal = svalBuilder.evalBinOpNN(state, BO_Add, *strLengthNL, in evalStrcpyCommon()
1847 state = checkAdditionOverflow(C, state, *amountCopiedNL, *dstStrLengthNL); in evalStrcpyCommon()
1848 if (!state) in evalStrcpyCommon()
1851 finalStrLength = svalBuilder.evalBinOpNN(state, BO_Add, *amountCopiedNL, in evalStrcpyCommon()
1860 finalStrLength = getCStringLength(C, state, CE, DstVal, true); in evalStrcpyCommon()
1868 state, BO_GE, *finalStrLengthNL, *amountCopiedNL, cmpTy); in evalStrcpyCommon()
1869 state = state->assume(sourceInResult.castAs<DefinedOrUnknownSVal>(), in evalStrcpyCommon()
1871 if (!state) in evalStrcpyCommon()
1878 SVal destInResult = svalBuilder.evalBinOpNN(state, BO_GE, in evalStrcpyCommon()
1882 state = in evalStrcpyCommon()
1883 state->assume(destInResult.castAs<DefinedOrUnknownSVal>(), true); in evalStrcpyCommon()
1884 if (!state) in evalStrcpyCommon()
1910 assert(state); in evalStrcpyCommon()
1922 svalBuilder.evalBinOpLN(state, BO_Add, *dstRegVal, *maxLastNL, ptrTy); in evalStrcpyCommon()
1924 state = CheckLocation(C, state, Dst, maxLastElement, AccessKind::write); in evalStrcpyCommon()
1925 if (!state) in evalStrcpyCommon()
1931 SVal lastElement = svalBuilder.evalBinOpLN(state, BO_Add, *dstRegVal, in evalStrcpyCommon()
1936 state = CheckLocation(C, state, Dst, lastElement, AccessKind::write); in evalStrcpyCommon()
1937 if (!state) in evalStrcpyCommon()
1953 state = InvalidateBuffer(C, state, Dst.Expression, *dstRegVal, in evalStrcpyCommon()
1958 state = InvalidateBuffer(C, state, srcExpr.Expression, srcVal, in evalStrcpyCommon()
1970 state = setCStringLength(state, dstRegVal->getRegion(), finalStrLength); in evalStrcpyCommon()
1973 assert(state); in evalStrcpyCommon()
1983 state = state->BindExpr(CE, LCtx, Result); in evalStrcpyCommon()
1984 C.addTransition(state); in evalStrcpyCommon()
2012 ProgramStateRef state = C.getState(); in evalStrcmpCommon() local
2017 SVal LeftVal = state->getSVal(Left.Expression, LCtx); in evalStrcmpCommon()
2018 state = checkNonNull(C, state, Left, LeftVal); in evalStrcmpCommon()
2019 if (!state) in evalStrcmpCommon()
2024 SVal RightVal = state->getSVal(Right.Expression, LCtx); in evalStrcmpCommon()
2025 state = checkNonNull(C, state, Right, RightVal); in evalStrcmpCommon()
2026 if (!state) in evalStrcmpCommon()
2030 SVal LeftLength = getCStringLength(C, state, Left.Expression, LeftVal); in evalStrcmpCommon()
2035 SVal RightLength = getCStringLength(C, state, Right.Expression, RightVal); in evalStrcmpCommon()
2047 DefinedOrUnknownSVal SameBuf = svalBuilder.evalEQ(state, LV, RV); in evalStrcmpCommon()
2049 std::tie(StSameBuf, StNotSameBuf) = state->assume(SameBuf); in evalStrcmpCommon()
2064 state = StNotSameBuf; in evalStrcmpCommon()
2071 getCStringLiteral(C, state, Left.Expression, LeftVal); in evalStrcmpCommon()
2073 getCStringLiteral(C, state, Right.Expression, RightVal); in evalStrcmpCommon()
2085 SVal lenVal = state->getSVal(lenExpr, LCtx); in evalStrcmpCommon()
2088 if (const llvm::APSInt *len = svalBuilder.getKnownValue(state, lenVal)) { in evalStrcmpCommon()
2124 svalBuilder.evalBinOp(state, op, resultVal, zeroVal, in evalStrcmpCommon()
2127 state = state->assume(compareWithZeroVal, true); in evalStrcmpCommon()
2132 state = state->BindExpr(CE, LCtx, resultVal); in evalStrcmpCommon()
2135 C.addTransition(state); in evalStrcmpCommon()
2386 ProgramStateRef state = C.getState(); in checkPreStmt() local
2403 Loc VarLoc = state->getLValue(D, C.getLocationContext()); in checkPreStmt()
2411 getCStringLength(C, state, Init, StrVal).castAs<DefinedOrUnknownSVal>(); in checkPreStmt()
2413 state = state->set<CStringLength>(MR, strLength); in checkPreStmt()
2416 C.addTransition(state); in checkPreStmt()
2420 CStringChecker::checkRegionChanges(ProgramStateRef state, in checkRegionChanges() argument
2426 CStringLengthTy Entries = state->get<CStringLength>(); in checkRegionChanges()
2428 return state; in checkRegionChanges()
2446 CStringLengthTy::Factory &F = state->get_context<CStringLength>(); in checkRegionChanges()
2470 return state->set<CStringLength>(Entries); in checkRegionChanges()
2473 void CStringChecker::checkLiveSymbols(ProgramStateRef state, in checkLiveSymbols() argument
2476 CStringLengthTy Entries = state->get<CStringLength>(); in checkLiveSymbols()
2490 ProgramStateRef state = C.getState(); in checkDeadSymbols() local
2491 CStringLengthTy Entries = state->get<CStringLength>(); in checkDeadSymbols()
2495 CStringLengthTy::Factory &F = state->get_context<CStringLength>(); in checkDeadSymbols()
2505 state = state->set<CStringLength>(Entries); in checkDeadSymbols()
2506 C.addTransition(state); in checkDeadSymbols()