[analyzer] Modularize builder use in processBranch.
Take advantage of the new builders for branch processing. As part of this change pass generic NodeBuilder (instead of BranchNodeBuilder) to the BranchCondition callback and remove the unused methods form BranchBuilder.
git-svn-id: https://llvm.org/svn/llvm-project/cfe/trunk@142448 91177308-0d34-0410-b5e6-96231b3b80d8
diff --git a/include/clang/StaticAnalyzer/Core/Checker.h b/include/clang/StaticAnalyzer/Core/Checker.h
index 1e4edeb..5153348 100644
--- a/include/clang/StaticAnalyzer/Core/Checker.h
+++ b/include/clang/StaticAnalyzer/Core/Checker.h
@@ -215,7 +215,7 @@
class BranchCondition {
template <typename CHECKER>
static void _checkBranchCondition(void *checker, const Stmt *condition,
- BranchNodeBuilder &B, ExprEngine &Eng) {
+ NodeBuilder &B, ExprEngine &Eng) {
((const CHECKER *)checker)->checkBranchCondition(condition, B, Eng);
}
diff --git a/include/clang/StaticAnalyzer/Core/CheckerManager.h b/include/clang/StaticAnalyzer/Core/CheckerManager.h
index e3e4c49..6026aec 100644
--- a/include/clang/StaticAnalyzer/Core/CheckerManager.h
+++ b/include/clang/StaticAnalyzer/Core/CheckerManager.h
@@ -39,7 +39,7 @@
class ExplodedGraph;
class ProgramState;
class EndOfFunctionNodeBuilder;
- class BranchNodeBuilder;
+ class NodeBuilder;
class MemRegion;
class SymbolReaper;
@@ -232,7 +232,7 @@
/// \brief Run checkers for branch condition.
void runCheckersForBranchCondition(const Stmt *condition,
- BranchNodeBuilder &B, ExprEngine &Eng);
+ NodeBuilder &B, ExprEngine &Eng);
/// \brief Run checkers for live symbols.
///
@@ -334,7 +334,7 @@
typedef CheckerFn<void (EndOfFunctionNodeBuilder &, ExprEngine &)>
CheckEndPathFunc;
- typedef CheckerFn<void (const Stmt *, BranchNodeBuilder &, ExprEngine &)>
+ typedef CheckerFn<void (const Stmt *, NodeBuilder &, ExprEngine &)>
CheckBranchConditionFunc;
typedef CheckerFn<void (SymbolReaper &, CheckerContext &)>
diff --git a/include/clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h b/include/clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h
index e366b06..1bbc66c 100644
--- a/include/clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h
+++ b/include/clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h
@@ -51,7 +51,7 @@
ST(st),
size(Dst.size()),
Ctx(builder.Eng, builder.getBlock()),
- NB(Ctx, pred),
+ NB(pred, Ctx),
respondsToCallback(respondsToCB) {
assert(!(ST && ST != Pred->getState()));
}
diff --git a/include/clang/StaticAnalyzer/Core/PathSensitive/CoreEngine.h b/include/clang/StaticAnalyzer/Core/PathSensitive/CoreEngine.h
index 7629ac4..ac174c4 100644
--- a/include/clang/StaticAnalyzer/Core/PathSensitive/CoreEngine.h
+++ b/include/clang/StaticAnalyzer/Core/PathSensitive/CoreEngine.h
@@ -181,7 +181,7 @@
friend class StmtNodeBuilder;
ExplodedNode *BuilderPred;
- NodeBuilderContext &C;
+ const NodeBuilderContext &C;
bool Finalized;
/// \brief The frontier set - a set of nodes which need to be propagated after
@@ -212,12 +212,19 @@
bool MarkAsSink = false);
public:
- NodeBuilder(NodeBuilderContext &Ctx, ExplodedNode *N)
+ NodeBuilder(ExplodedNode *N, NodeBuilderContext &Ctx)
: BuilderPred(N), C(Ctx), Finalized(false) {
assert(!N->isSink());
Deferred.insert(N);
}
+ /// Create a new builder using the parent builder's context.
+ NodeBuilder(ExplodedNode *N, const NodeBuilder &ParentBldr)
+ : BuilderPred(N), C(ParentBldr.C), Finalized(false) {
+ assert(!N->isSink());
+ Deferred.insert(N);
+ }
+
virtual ~NodeBuilder() {}
/// \brief Generates a node in the ExplodedGraph.
@@ -258,7 +265,11 @@
C.Block->getBlockID());
}
+ // \brief Get the builder's predecessor - the parent to all the other nodes.
ExplodedNode *getPredecessor() const { return BuilderPred; }
+
+ // \brief Returns state of the predecessor.
+ const ProgramState *getState() const { return BuilderPred->getState(); }
};
class CommonNodeBuilder {
@@ -409,19 +420,19 @@
}
public:
- BranchNodeBuilder(NodeBuilderContext &C, ExplodedNode *Pred,
+ BranchNodeBuilder(ExplodedNode *Pred, NodeBuilderContext &C,
const CFGBlock *dstT, const CFGBlock *dstF)
- : NodeBuilder(C, Pred), DstT(dstT), DstF(dstF),
+ : NodeBuilder(Pred, C), DstT(dstT), DstF(dstF),
GeneratedTrue(false), GeneratedFalse(false),
InFeasibleTrue(!DstT), InFeasibleFalse(!DstF) {
}
- /// This function generate a new ExplodedNode but not a new
- /// branch(block edge). Creates a transition from the Builder's top
- /// predecessor.
- ExplodedNode *generateNode(const Stmt *Condition, const ProgramState *State,
- const ProgramPointTag *Tag = 0,
- bool MarkAsSink = false);
+ /// Create a new builder using the parent builder's context.
+ BranchNodeBuilder(ExplodedNode *Pred, BranchNodeBuilder &ParentBldr)
+ : NodeBuilder(Pred, ParentBldr), DstT(ParentBldr.DstT), DstF(ParentBldr.DstF),
+ GeneratedTrue(false), GeneratedFalse(false),
+ InFeasibleTrue(!DstT), InFeasibleFalse(!DstF) {
+ }
ExplodedNode *generateNode(const ProgramState *State, bool branch,
ExplodedNode *Pred = 0);
@@ -440,10 +451,6 @@
bool isFeasible(bool branch) {
return branch ? !InFeasibleTrue : !InFeasibleFalse;
}
-
- const ProgramState *getState() const {
- return getPredecessor()->getState();
- }
};
class IndirectGotoNodeBuilder {
diff --git a/lib/StaticAnalyzer/Checkers/UndefBranchChecker.cpp b/lib/StaticAnalyzer/Checkers/UndefBranchChecker.cpp
index 8663893..451fa91 100644
--- a/lib/StaticAnalyzer/Checkers/UndefBranchChecker.cpp
+++ b/lib/StaticAnalyzer/Checkers/UndefBranchChecker.cpp
@@ -49,20 +49,27 @@
};
public:
- void checkBranchCondition(const Stmt *Condition, BranchNodeBuilder &Builder,
+ void checkBranchCondition(const Stmt *Condition, NodeBuilder &Builder,
ExprEngine &Eng) const;
};
}
void UndefBranchChecker::checkBranchCondition(const Stmt *Condition,
- BranchNodeBuilder &Builder,
+ NodeBuilder &Builder,
ExprEngine &Eng) const {
const ProgramState *state = Builder.getState();
SVal X = state->getSVal(Condition);
if (X.isUndef()) {
- // Generate a sink node.
- ExplodedNode *N = Builder.generateNode(Condition, state, 0, true);
+ // TODO: The PP will be generated with the correct tag by the CheckerManager
+ // after we migrate the callback to CheckerContext.
+ const ProgramPointTag *Tag = 0;
+ ProgramPoint PP = PostCondition(Condition,
+ Builder.getPredecessor()->getLocationContext(), Tag);
+ // Generate a sink node, which implicitly marks both outgoing branches as
+ // infeasible.
+ ExplodedNode *N = Builder.generateNode(PP, state,
+ Builder.getPredecessor(), true);
if (N) {
if (!BT)
BT.reset(
@@ -102,9 +109,6 @@
Eng.getBugReporter().EmitReport(R);
}
-
- Builder.markInfeasible(true);
- Builder.markInfeasible(false);
}
}
diff --git a/lib/StaticAnalyzer/Core/CheckerManager.cpp b/lib/StaticAnalyzer/Core/CheckerManager.cpp
index acacfb0..d47033a 100644
--- a/lib/StaticAnalyzer/Core/CheckerManager.cpp
+++ b/lib/StaticAnalyzer/Core/CheckerManager.cpp
@@ -297,7 +297,7 @@
/// \brief Run checkers for branch condition.
void CheckerManager::runCheckersForBranchCondition(const Stmt *condition,
- BranchNodeBuilder &B,
+ NodeBuilder &B,
ExprEngine &Eng) {
for (unsigned i = 0, e = BranchConditionCheckers.size(); i != e; ++i) {
CheckBranchConditionFunc fn = BranchConditionCheckers[i];
diff --git a/lib/StaticAnalyzer/Core/CoreEngine.cpp b/lib/StaticAnalyzer/Core/CoreEngine.cpp
index d1c1e39..91aa9a5 100644
--- a/lib/StaticAnalyzer/Core/CoreEngine.cpp
+++ b/lib/StaticAnalyzer/Core/CoreEngine.cpp
@@ -602,21 +602,6 @@
return NULL;
}
-// This function generate a new ExplodedNode but not a new branch(block edge).
-// Creates a transition from the Builder's top predecessor.
-ExplodedNode *BranchNodeBuilder::generateNode(const Stmt *Condition,
- const ProgramState *State,
- const ProgramPointTag *Tag,
- bool MarkAsSink) {
- ProgramPoint PP = PostCondition(Condition,
- BuilderPred->getLocationContext(), Tag);
- ExplodedNode *N = generateNodeImpl(PP, State, BuilderPred, MarkAsSink);
- assert(N);
- // TODO: This needs to go - we should not change Pred!!!
- BuilderPred = N;
- return N;
-}
-
ExplodedNode *BranchNodeBuilder::generateNode(const ProgramState *State,
bool branch,
ExplodedNode *NodePred) {
diff --git a/lib/StaticAnalyzer/Core/ExprEngine.cpp b/lib/StaticAnalyzer/Core/ExprEngine.cpp
index dba1ce1..70142c8 100644
--- a/lib/StaticAnalyzer/Core/ExprEngine.cpp
+++ b/lib/StaticAnalyzer/Core/ExprEngine.cpp
@@ -945,11 +945,9 @@
const CFGBlock *DstT,
const CFGBlock *DstF) {
- BranchNodeBuilder builder(BldCtx, Pred, DstT, DstF);
-
// Check for NULL conditions; e.g. "for(;;)"
if (!Condition) {
- BranchNodeBuilder NullCondBldr(BldCtx, Pred, DstT, DstF);
+ BranchNodeBuilder NullCondBldr(Pred, BldCtx, DstT, DstF);
NullCondBldr.markInfeasible(false);
Engine.enqueue(NullCondBldr);
return;
@@ -959,27 +957,36 @@
Condition->getLocStart(),
"Error evaluating branch");
- //TODO: This should take the NodeBuiolder.
- getCheckerManager().runCheckersForBranchCondition(Condition, builder,
+ NodeBuilder CheckerBldr(Pred, BldCtx);
+ getCheckerManager().runCheckersForBranchCondition(Condition, CheckerBldr,
*this);
- const ProgramState *PrevState = builder.getState();
- SVal X = PrevState->getSVal(Condition);
+ for (NodeBuilder::iterator I = CheckerBldr.results_begin(),
+ E = CheckerBldr.results_end(); E != I; ++I) {
+ ExplodedNode *PredI = *I;
- if (X.isUnknownOrUndef()) {
- // Give it a chance to recover from unknown.
- if (const Expr *Ex = dyn_cast<Expr>(Condition)) {
- if (Ex->getType()->isIntegerType()) {
- // Try to recover some path-sensitivity. Right now casts of symbolic
- // integers that promote their values are currently not tracked well.
- // If 'Condition' is such an expression, try and recover the
- // underlying value and use that instead.
- SVal recovered = RecoverCastedSymbol(getStateManager(),
- builder.getState(), Condition,
- getContext());
+ if (PredI->isSink())
+ continue;
- if (!recovered.isUnknown()) {
- X = recovered;
+ BranchNodeBuilder builder(PredI, BldCtx, DstT, DstF);
+ const ProgramState *PrevState = builder.getState();
+ SVal X = PrevState->getSVal(Condition);
+
+ if (X.isUnknownOrUndef()) {
+ // Give it a chance to recover from unknown.
+ if (const Expr *Ex = dyn_cast<Expr>(Condition)) {
+ if (Ex->getType()->isIntegerType()) {
+ // Try to recover some path-sensitivity. Right now casts of symbolic
+ // integers that promote their values are currently not tracked well.
+ // If 'Condition' is such an expression, try and recover the
+ // underlying value and use that instead.
+ SVal recovered = RecoverCastedSymbol(getStateManager(),
+ PrevState, Condition,
+ getContext());
+
+ if (!recovered.isUnknown()) {
+ X = recovered;
+ }
}
}
}
@@ -989,30 +996,30 @@
builder.generateNode(MarkBranch(PrevState, Term, false), false);
// Enqueue the results into the work list.
Engine.enqueue(builder);
- return;
+ continue;
}
+
+ DefinedSVal V = cast<DefinedSVal>(X);
+
+ // Process the true branch.
+ if (builder.isFeasible(true)) {
+ if (const ProgramState *state = PrevState->assume(V, true))
+ builder.generateNode(MarkBranch(state, Term, true), true);
+ else
+ builder.markInfeasible(true);
+ }
+
+ // Process the false branch.
+ if (builder.isFeasible(false)) {
+ if (const ProgramState *state = PrevState->assume(V, false))
+ builder.generateNode(MarkBranch(state, Term, false), false);
+ else
+ builder.markInfeasible(false);
+ }
+
+ // Enqueue the results into the work list.
+ Engine.enqueue(builder);
}
-
- DefinedSVal V = cast<DefinedSVal>(X);
-
- // Process the true branch.
- if (builder.isFeasible(true)) {
- if (const ProgramState *state = PrevState->assume(V, true))
- builder.generateNode(MarkBranch(state, Term, true), true);
- else
- builder.markInfeasible(true);
- }
-
- // Process the false branch.
- if (builder.isFeasible(false)) {
- if (const ProgramState *state = PrevState->assume(V, false))
- builder.generateNode(MarkBranch(state, Term, false), false);
- else
- builder.markInfeasible(false);
- }
-
- // Enqueue the results into the work list.
- Engine.enqueue(builder);
}
/// processIndirectGoto - Called by CoreEngine. Used to generate successor
