class CoreEngine

Declaration

class CoreEngine { /* full declaration omitted */ };

Description

CoreEngine - Implements the core logic of the graph-reachability analysis. It traverses the CFG and generates the ExplodedGraph. Program "states" are treated as opaque void pointers. The template class CoreEngine (which subclasses CoreEngine) provides the matching component to the engine that knows the actual types for states. Note that this engine only dispatches to transfer functions at the statement and block-level. The analyses themselves must implement any transfer function logic and the sub-expression level (if any).

Declared at: clang/include/clang/StaticAnalyzer/Core/PathSensitive/CoreEngine.h:55

Member Variables

private clang::ento::ExprEngine& ExprEng
private clang::ento::ExplodedGraph G
G - The simulation graph. Each node is a (location,state) pair.
private std::unique_ptr<WorkList> WList
WList - A set of queued nodes that need to be processed by the worklist algorithm. It is up to the implementation of WList to decide the order that nodes are processed.
private std::unique_ptr<WorkList> CTUWList
private BlockCounter::Factory BCounterFactory
BCounterFactory - A factory object for created BlockCounter objects. These are used to record for key nodes in the ExplodedGraph the number of times different CFGBlocks have been visited along a path.
private clang::ento::CoreEngine::BlocksExhausted blocksExhausted
The locations where we stopped doing work because we visited a location too many times.
private clang::ento::CoreEngine::BlocksAborted blocksAborted
The locations where we stopped because the engine aborted analysis, usually because it could not reason about something.
private clang::ento::FunctionSummariesTy* FunctionSummaries
The information about functions shared by the whole translation unit. (This data is owned by AnalysisConsumer.)
private DataTag::Factory DataTags
Add path tags with some useful data along the path when we see that something interesting is happening. This field is the allocator for such tags.

Method Overview

  • public CoreEngine(const clang::ento::CoreEngine &)
  • public CoreEngine(clang::ento::ExprEngine & exprengine, clang::ento::FunctionSummariesTy * FS, clang::AnalyzerOptions & Opts)
  • public bool ExecuteWorkList(const clang::LocationContext * L, unsigned int Steps, clang::ento::ProgramStateRef InitState)
  • public bool ExecuteWorkListWithInitialState(const clang::LocationContext * L, unsigned int Steps, clang::ento::ProgramStateRef InitState, clang::ento::ExplodedNodeSet & Dst)
  • private void HandleBlockEdge(const clang::BlockEdge & E, clang::ento::ExplodedNode * Pred)
  • private void HandleBlockEntrance(const clang::BlockEntrance & E, clang::ento::ExplodedNode * Pred)
  • private void HandleBlockExit(const clang::CFGBlock * B, clang::ento::ExplodedNode * Pred)
  • private void HandleBranch(const clang::Stmt * Cond, const clang::Stmt * Term, const clang::CFGBlock * B, clang::ento::ExplodedNode * Pred)
  • private void HandleCallEnter(const clang::CallEnter & CE, clang::ento::ExplodedNode * Pred)
  • private void HandleCleanupTemporaryBranch(const clang::CXXBindTemporaryExpr * BTE, const clang::CFGBlock * B, clang::ento::ExplodedNode * Pred)
  • private void HandlePostStmt(const clang::CFGBlock * B, unsigned int StmtIdx, clang::ento::ExplodedNode * Pred)
  • private void HandleStaticInit(const clang::DeclStmt * DS, const clang::CFGBlock * B, clang::ento::ExplodedNode * Pred)
  • private void HandleVirtualBaseBranch(const clang::CFGBlock * B, clang::ento::ExplodedNode * Pred)
  • public void addAbortedBlock(const clang::ento::ExplodedNode * node, const clang::CFGBlock * block)
  • public BlocksAborted::const_iterator blocks_aborted_begin() const
  • public BlocksAborted::const_iterator blocks_aborted_end() const
  • public BlocksExhausted::const_iterator blocks_exhausted_begin() const
  • public BlocksExhausted::const_iterator blocks_exhausted_end() const
  • public void dispatchWorkItem(clang::ento::ExplodedNode * Pred, clang::ProgramPoint Loc, const clang::ento::WorkListUnit & WU)
  • public void enqueue(clang::ento::ExplodedNodeSet & Set, const clang::CFGBlock * Block, unsigned int Idx)
  • public void enqueue(clang::ento::ExplodedNodeSet & Set)
  • public void enqueueEndOfFunction(clang::ento::ExplodedNodeSet & Set, const clang::ReturnStmt * RS)
  • public void enqueueStmtNode(clang::ento::ExplodedNode * N, const clang::CFGBlock * Block, unsigned int Idx)
  • private clang::ento::ExplodedNode * generateCallExitBeginNode(clang::ento::ExplodedNode * N, const clang::ReturnStmt * RS)
  • private void generateNode(const clang::ProgramPoint & Loc, clang::ento::ProgramStateRef State, clang::ento::ExplodedNode * Pred)
  • public clang::ento::WorkList * getCTUWorkList() const
  • public DataTag::Factory & getDataTags()
  • public clang::ento::ExplodedGraph & getGraph()
  • public clang::ento::WorkList * getWorkList() const
  • public bool hasWorkRemaining() const
  • private void setBlockCounter(clang::ento::BlockCounter C)
  • public bool wasBlockAborted() const
  • public bool wasBlocksExhausted() const

Methods

CoreEngine(const clang::ento::CoreEngine&)

Declared at: clang/include/clang/StaticAnalyzer/Core/PathSensitive/CoreEngine.h:140

Parameters

const clang::ento::CoreEngine&

CoreEngine(clang::ento::ExprEngine& exprengine,
           clang::ento::FunctionSummariesTy* FS,
           clang::AnalyzerOptions& Opts)

Description

Construct a CoreEngine object to analyze the provided CFG.

Declared at: clang/include/clang/StaticAnalyzer/Core/PathSensitive/CoreEngine.h:136

Parameters

clang::ento::ExprEngine& exprengine
clang::ento::FunctionSummariesTy* FS
clang::AnalyzerOptions& Opts

bool ExecuteWorkList(
    const clang::LocationContext* L,
    unsigned int Steps,
    clang::ento::ProgramStateRef InitState)

Description

ExecuteWorkList - Run the worklist algorithm for a maximum number of steps. Returns true if there is still simulation state on the worklist.

Declared at: clang/include/clang/StaticAnalyzer/Core/PathSensitive/CoreEngine.h:148

Parameters

const clang::LocationContext* L
unsigned int Steps
clang::ento::ProgramStateRef InitState

bool ExecuteWorkListWithInitialState(
    const clang::LocationContext* L,
    unsigned int Steps,
    clang::ento::ProgramStateRef InitState,
    clang::ento::ExplodedNodeSet& Dst)

Description

Returns true if there is still simulation state on the worklist.

Declared at: clang/include/clang/StaticAnalyzer/Core/PathSensitive/CoreEngine.h:152

Parameters

const clang::LocationContext* L
unsigned int Steps
clang::ento::ProgramStateRef InitState
clang::ento::ExplodedNodeSet& Dst

void HandleBlockEdge(
    const clang::BlockEdge& E,
    clang::ento::ExplodedNode* Pred)

Declared at: clang/include/clang/StaticAnalyzer/Core/PathSensitive/CoreEngine.h:111

Parameters

const clang::BlockEdge& E
clang::ento::ExplodedNode* Pred

void HandleBlockEntrance(
    const clang::BlockEntrance& E,
    clang::ento::ExplodedNode* Pred)

Declared at: clang/include/clang/StaticAnalyzer/Core/PathSensitive/CoreEngine.h:112

Parameters

const clang::BlockEntrance& E
clang::ento::ExplodedNode* Pred

void HandleBlockExit(
    const clang::CFGBlock* B,
    clang::ento::ExplodedNode* Pred)

Declared at: clang/include/clang/StaticAnalyzer/Core/PathSensitive/CoreEngine.h:113

Parameters

const clang::CFGBlock* B
clang::ento::ExplodedNode* Pred

void HandleBranch(const clang::Stmt* Cond,
                  const clang::Stmt* Term,
                  const clang::CFGBlock* B,
                  clang::ento::ExplodedNode* Pred)

Declared at: clang/include/clang/StaticAnalyzer/Core/PathSensitive/CoreEngine.h:119

Parameters

const clang::Stmt* Cond
const clang::Stmt* Term
const clang::CFGBlock* B
clang::ento::ExplodedNode* Pred

void HandleCallEnter(
    const clang::CallEnter& CE,
    clang::ento::ExplodedNode* Pred)

Declared at: clang/include/clang/StaticAnalyzer/Core/PathSensitive/CoreEngine.h:115

Parameters

const clang::CallEnter& CE
clang::ento::ExplodedNode* Pred

void HandleCleanupTemporaryBranch(
    const clang::CXXBindTemporaryExpr* BTE,
    const clang::CFGBlock* B,
    clang::ento::ExplodedNode* Pred)

Declared at: clang/include/clang/StaticAnalyzer/Core/PathSensitive/CoreEngine.h:121

Parameters

const clang::CXXBindTemporaryExpr* BTE
const clang::CFGBlock* B
clang::ento::ExplodedNode* Pred

void HandlePostStmt(
    const clang::CFGBlock* B,
    unsigned int StmtIdx,
    clang::ento::ExplodedNode* Pred)

Declared at: clang/include/clang/StaticAnalyzer/Core/PathSensitive/CoreEngine.h:117

Parameters

const clang::CFGBlock* B
unsigned int StmtIdx
clang::ento::ExplodedNode* Pred

void HandleStaticInit(
    const clang::DeclStmt* DS,
    const clang::CFGBlock* B,
    clang::ento::ExplodedNode* Pred)

Description

Handle conditional logic for running static initializers.

Declared at: clang/include/clang/StaticAnalyzer/Core/PathSensitive/CoreEngine.h:125

Parameters

const clang::DeclStmt* DS
const clang::CFGBlock* B
clang::ento::ExplodedNode* Pred

void HandleVirtualBaseBranch(
    const clang::CFGBlock* B,
    clang::ento::ExplodedNode* Pred)

Declared at: clang/include/clang/StaticAnalyzer/Core/PathSensitive/CoreEngine.h:128

Parameters

const clang::CFGBlock* B
clang::ento::ExplodedNode* Pred

void addAbortedBlock(
    const clang::ento::ExplodedNode* node,
    const clang::CFGBlock* block)

Description

Inform the CoreEngine that a basic block was aborted because it could not be completely analyzed.

Declared at: clang/include/clang/StaticAnalyzer/Core/PathSensitive/CoreEngine.h:171

Parameters

const clang::ento::ExplodedNode* node
const clang::CFGBlock* block

BlocksAborted::const_iterator
blocks_aborted_begin() const

Declared at: clang/include/clang/StaticAnalyzer/Core/PathSensitive/CoreEngine.h:186

BlocksAborted::const_iterator blocks_aborted_end()
    const

Declared at: clang/include/clang/StaticAnalyzer/Core/PathSensitive/CoreEngine.h:190

BlocksExhausted::const_iterator
blocks_exhausted_begin() const

Declared at: clang/include/clang/StaticAnalyzer/Core/PathSensitive/CoreEngine.h:178

BlocksExhausted::const_iterator
blocks_exhausted_end() const

Declared at: clang/include/clang/StaticAnalyzer/Core/PathSensitive/CoreEngine.h:182

void dispatchWorkItem(
    clang::ento::ExplodedNode* Pred,
    clang::ProgramPoint Loc,
    const clang::ento::WorkListUnit& WU)

Description

Dispatch the work list item based on the given location information. Use Pred parameter as the predecessor state.

Declared at: clang/include/clang/StaticAnalyzer/Core/PathSensitive/CoreEngine.h:159

Parameters

clang::ento::ExplodedNode* Pred
clang::ProgramPoint Loc
const clang::ento::WorkListUnit& WU

void enqueue(clang::ento::ExplodedNodeSet& Set,
             const clang::CFGBlock* Block,
             unsigned int Idx)

Description

Enqueue nodes that were created as a result of processing a statement onto the work list.

Declared at: clang/include/clang/StaticAnalyzer/Core/PathSensitive/CoreEngine.h:199

Parameters

clang::ento::ExplodedNodeSet& Set
const clang::CFGBlock* Block
unsigned int Idx

void enqueue(clang::ento::ExplodedNodeSet& Set)

Description

Enqueue the given set of nodes onto the work list.

Declared at: clang/include/clang/StaticAnalyzer/Core/PathSensitive/CoreEngine.h:195

Parameters

clang::ento::ExplodedNodeSet& Set

void enqueueEndOfFunction(
    clang::ento::ExplodedNodeSet& Set,
    const clang::ReturnStmt* RS)

Description

enqueue the nodes corresponding to the end of function onto the end of path / work list.

Declared at: clang/include/clang/StaticAnalyzer/Core/PathSensitive/CoreEngine.h:203

Parameters

clang::ento::ExplodedNodeSet& Set
const clang::ReturnStmt* RS

void enqueueStmtNode(clang::ento::ExplodedNode* N,
                     const clang::CFGBlock* Block,
                     unsigned int Idx)

Description

Enqueue a single node created as a result of statement processing.

Declared at: clang/include/clang/StaticAnalyzer/Core/PathSensitive/CoreEngine.h:206

Parameters

clang::ento::ExplodedNode* N
const clang::CFGBlock* Block
unsigned int Idx

clang::ento::ExplodedNode*
generateCallExitBeginNode(
    clang::ento::ExplodedNode* N,
    const clang::ReturnStmt* RS)

Declared at: clang/include/clang/StaticAnalyzer/Core/PathSensitive/CoreEngine.h:131

Parameters

clang::ento::ExplodedNode* N
const clang::ReturnStmt* RS

void generateNode(
    const clang::ProgramPoint& Loc,
    clang::ento::ProgramStateRef State,
    clang::ento::ExplodedNode* Pred)

Declared at: clang/include/clang/StaticAnalyzer/Core/PathSensitive/CoreEngine.h:107

Parameters

const clang::ProgramPoint& Loc
clang::ento::ProgramStateRef State
clang::ento::ExplodedNode* Pred

clang::ento::WorkList* getCTUWorkList() const

Declared at: clang/include/clang/StaticAnalyzer/Core/PathSensitive/CoreEngine.h:176

DataTag::Factory& getDataTags()

Declared at: clang/include/clang/StaticAnalyzer/Core/PathSensitive/CoreEngine.h:208

clang::ento::ExplodedGraph& getGraph()

Description

getGraph - Returns the exploded graph.

Declared at: clang/include/clang/StaticAnalyzer/Core/PathSensitive/CoreEngine.h:144

clang::ento::WorkList* getWorkList() const

Declared at: clang/include/clang/StaticAnalyzer/Core/PathSensitive/CoreEngine.h:175

bool hasWorkRemaining() const

Declared at: clang/include/clang/StaticAnalyzer/Core/PathSensitive/CoreEngine.h:165

void setBlockCounter(clang::ento::BlockCounter C)

Declared at: clang/include/clang/StaticAnalyzer/Core/PathSensitive/CoreEngine.h:105

Parameters

clang::ento::BlockCounter C

bool wasBlockAborted() const

Declared at: clang/include/clang/StaticAnalyzer/Core/PathSensitive/CoreEngine.h:163

bool wasBlocksExhausted() const

Declared at: clang/include/clang/StaticAnalyzer/Core/PathSensitive/CoreEngine.h:164