/// CastRetrievedVal - Used by subclasses of StoreManager to implement /// implicit casts that arise from loads from regions that are reinterpreted /// as another region. SVal StoreManager::CastRetrievedVal(SVal V, const TypedValueRegion *R, QualType castTy) { if (castTy.isNull() || V.isUnknownOrUndef()) return V; // The dispatchCast() call below would convert the int into a float. // What we want, however, is a bit-by-bit reinterpretation of the int // as a float, which usually yields nothing garbage. For now skip casts // from ints to floats. // TODO: What other combinations of types are affected? if (castTy->isFloatingType()) { SymbolRef Sym = V.getAsSymbol(); if (Sym && !Sym->getType()->isFloatingType()) return UnknownVal(); } // When retrieving symbolic pointer and expecting a non-void pointer, // wrap them into element regions of the expected type if necessary. // SValBuilder::dispatchCast() doesn't do that, but it is necessary to // make sure that the retrieved value makes sense, because there's no other // cast in the AST that would tell us to cast it to the correct pointer type. // We might need to do that for non-void pointers as well. // FIXME: We really need a single good function to perform casts for us // correctly every time we need it. if (castTy->isPointerType() && !castTy->isVoidPointerType()) if (const auto *SR = dyn_cast_or_null<SymbolicRegion>(V.getAsRegion())) if (SR->getSymbol()->getType().getCanonicalType() != castTy.getCanonicalType()) return loc::MemRegionVal(castRegion(SR, castTy)); return svalBuilder.dispatchCast(V, castTy); }
explicit symbol(const SymbolRef& sym) { StringRef name; if(error_code err = sym.getName(name)) llvm_binary_fail(err); this->name_ = name.str(); if (error_code err = sym.getType(this->kind_)) llvm_binary_fail(err); if (error_code err = sym.getAddress(this->addr_)) llvm_binary_fail(err); if (error_code err = sym.getSize(this->size_)) llvm_binary_fail(err); uint32_t flags; if (error_code err = sym.getFlags(flags)) llvm_binary_fail(err); if (flags & SymbolRef::SF_Undefined) { uint64_t addr; if (error_code err = sym.getValue(addr)) llvm_binary_fail(err); // This will not work for x86-64, since they usually zero // the value. BFD library uses index correspondence // between plt entry and relocation, to name the plt // entry. We can't afford this. if (addr) { addr_ = addr; size_ = 8; } } }
bool operator()(const SymbolRef &A, const SymbolRef &B) { SymbolRef::Type AType, BType; A.getType(AType); B.getType(BType); uint64_t AAddr, BAddr; if (AType != SymbolRef::ST_Function) AAddr = 0; else A.getAddress(AAddr); if (BType != SymbolRef::ST_Function) BAddr = 0; else B.getAddress(BAddr); return AAddr < BAddr; }
void ModuleInfo::addSymbol(const SymbolRef &Symbol) { SymbolRef::Type SymbolType; if (error(Symbol.getType(SymbolType))) return; if (SymbolType != SymbolRef::ST_Function && SymbolType != SymbolRef::ST_Data) return; uint64_t SymbolAddress; if (error(Symbol.getAddress(SymbolAddress)) || SymbolAddress == UnknownAddressOrSize) return; uint64_t SymbolSize; // Getting symbol size is linear for Mach-O files, so assume that symbol // occupies the memory range up to the following symbol. if (isa<MachOObjectFile>(Module)) SymbolSize = 0; else if (error(Symbol.getSize(SymbolSize)) || SymbolSize == UnknownAddressOrSize) return; StringRef SymbolName; if (error(Symbol.getName(SymbolName))) return; // Mach-O symbol table names have leading underscore, skip it. if (Module->isMachO() && SymbolName.size() > 0 && SymbolName[0] == '_') SymbolName = SymbolName.drop_front(); // FIXME: If a function has alias, there are two entries in symbol table // with same address size. Make sure we choose the correct one. SymbolMapTy &M = SymbolType == SymbolRef::ST_Function ? Functions : Objects; SymbolDesc SD = { SymbolAddress, SymbolSize }; M.insert(std::make_pair(SD, SymbolName)); }
ProgramStateRef SimpleConstraintManager::assumeSymWithinInclusiveRange( ProgramStateRef State, SymbolRef Sym, const llvm::APSInt &From, const llvm::APSInt &To, bool InRange) { // Get the type used for calculating wraparound. BasicValueFactory &BVF = getBasicVals(); APSIntType WraparoundType = BVF.getAPSIntType(Sym->getType()); llvm::APSInt Adjustment = WraparoundType.getZeroValue(); SymbolRef AdjustedSym = Sym; computeAdjustment(AdjustedSym, Adjustment); // Convert the right-hand side integer as necessary. APSIntType ComparisonType = std::max(WraparoundType, APSIntType(From)); llvm::APSInt ConvertedFrom = ComparisonType.convert(From); llvm::APSInt ConvertedTo = ComparisonType.convert(To); // Prefer unsigned comparisons. if (ComparisonType.getBitWidth() == WraparoundType.getBitWidth() && ComparisonType.isUnsigned() && !WraparoundType.isUnsigned()) Adjustment.setIsSigned(false); if (InRange) return assumeSymbolWithinInclusiveRange(State, AdjustedSym, ConvertedFrom, ConvertedTo, Adjustment); return assumeSymbolOutOfInclusiveRange(State, AdjustedSym, ConvertedFrom, ConvertedTo, Adjustment); }
RangeSet RangeConstraintManager::getRange(ProgramStateRef State, SymbolRef Sym) { if (ConstraintRangeTy::data_type *V = State->get<ConstraintRange>(Sym)) return *V; BasicValueFactory &BV = getBasicVals(); // If Sym is a difference of symbols A - B, then maybe we have range set // stored for B - A. if (const RangeSet *R = getRangeForMinusSymbol(State, Sym)) return R->Negate(BV, F); // Lazily generate a new RangeSet representing all possible values for the // given symbol type. QualType T = Sym->getType(); RangeSet Result(F, BV.getMinValue(T), BV.getMaxValue(T)); // References are known to be non-zero. if (T->isReferenceType()) return assumeNonZero(BV, F, Sym, Result); // Known constraints on ranges of bitwise expressions. if (const SymIntExpr* SIE = dyn_cast<SymIntExpr>(Sym)) return applyBitwiseConstraints(BV, F, Result, SIE); return Result; }
static const MemRegion *unwrapRValueReferenceIndirection(const MemRegion *MR) { if (const auto *SR = dyn_cast_or_null<SymbolicRegion>(MR)) { SymbolRef Sym = SR->getSymbol(); if (Sym->getType()->isRValueReferenceType()) if (const MemRegion *OriginMR = Sym->getOriginRegion()) return OriginMR; } return MR; }
/// Return a range set subtracting zero from \p Domain. static RangeSet assumeNonZero( BasicValueFactory &BV, RangeSet::Factory &F, SymbolRef Sym, RangeSet Domain) { APSIntType IntType = BV.getAPSIntType(Sym->getType()); return Domain.Intersect(BV, F, ++IntType.getZeroValue(), --IntType.getZeroValue()); }
ConditionTruthVal ConstraintManager::checkNull(ProgramStateRef State, SymbolRef Sym) { QualType Ty = Sym->getType(); DefinedSVal V = Loc::isLocType(Ty) ? getLocFromSymbol(State, Sym) : nonloc::SymbolVal(Sym); const ProgramStatePair &P = assumeDual(State, V); if (P.first && !P.second) return ConditionTruthVal(false); if (!P.first && P.second) return ConditionTruthVal(true); return ConditionTruthVal(); }
explicit symbol(const SymbolRef& sym) { StringRef name; if(error_code err = sym.getName(name)) llvm_binary_fail(err); this->name_ = name.str(); if (error_code err = sym.getType(this->kind_)) llvm_binary_fail(err); if (error_code err = sym.getAddress(this->addr_)) llvm_binary_fail(err); if (error_code err = sym.getSize(this->size_)) llvm_binary_fail(err); }
ProgramStateRef SimpleConstraintManager::assumeAuxForSymbol(ProgramStateRef State, SymbolRef Sym, bool Assumption) { BasicValueFactory &BVF = getBasicVals(); QualType T = Sym->getType(); // None of the constraint solvers currently support non-integer types. if (!T->isIntegralOrEnumerationType()) return State; const llvm::APSInt &zero = BVF.getValue(0, T); if (Assumption) return assumeSymNE(State, Sym, zero, zero); else return assumeSymEQ(State, Sym, zero, zero); }
ProgramStateRef RangedConstraintManager::assumeSymUnsupported(ProgramStateRef State, SymbolRef Sym, bool Assumption) { BasicValueFactory &BVF = getBasicVals(); QualType T = Sym->getType(); // Non-integer types are not supported. if (!T->isIntegralOrEnumerationType()) return State; // Reverse the operation and add directly to state. const llvm::APSInt &Zero = BVF.getValue(0, T); if (Assumption) return assumeSymNE(State, Sym, Zero, Zero); else return assumeSymEQ(State, Sym, Zero, Zero); }
DynamicTypeInfo ProgramState::getDynamicTypeInfo(const MemRegion *Reg) const { Reg = Reg->StripCasts(); // Look up the dynamic type in the GDM. const DynamicTypeInfo *GDMType = get<DynamicTypeMap>(Reg); if (GDMType) return *GDMType; // Otherwise, fall back to what we know about the region. if (const TypedRegion *TR = dyn_cast<TypedRegion>(Reg)) return DynamicTypeInfo(TR->getLocationType(), /*CanBeSubclass=*/false); if (const SymbolicRegion *SR = dyn_cast<SymbolicRegion>(Reg)) { SymbolRef Sym = SR->getSymbol(); return DynamicTypeInfo(Sym->getType(getStateManager().getContext())); } return DynamicTypeInfo(); }
DynamicTypeInfo getDynamicTypeInfo(ProgramStateRef State, const MemRegion *Reg) { Reg = Reg->StripCasts(); // Look up the dynamic type in the GDM. const DynamicTypeInfo *GDMType = State->get<DynamicTypeMap>(Reg); if (GDMType) return *GDMType; // Otherwise, fall back to what we know about the region. if (const auto *TR = dyn_cast<TypedRegion>(Reg)) return DynamicTypeInfo(TR->getLocationType(), /*CanBeSubclass=*/false); if (const auto *SR = dyn_cast<SymbolicRegion>(Reg)) { SymbolRef Sym = SR->getSymbol(); return DynamicTypeInfo(Sym->getType()); } return {}; }
RangeSet RangeConstraintManager::GetRange(ProgramStateRef state, SymbolRef sym) { if (ConstraintRangeTy::data_type* V = state->get<ConstraintRange>(sym)) return *V; // Lazily generate a new RangeSet representing all possible values for the // given symbol type. BasicValueFactory &BV = getBasicVals(); QualType T = sym->getType(); RangeSet Result(F, BV.getMinValue(T), BV.getMaxValue(T)); // Special case: references are known to be non-zero. if (T->isReferenceType()) { APSIntType IntType = BV.getAPSIntType(T); Result = Result.Intersect(BV, F, ++IntType.getZeroValue(), --IntType.getZeroValue()); } return Result; }
std::error_code SymbolizableObjectFile::addSymbol(const SymbolRef &Symbol, uint64_t SymbolSize, DataExtractor *OpdExtractor, uint64_t OpdAddress) { ErrorOr<SymbolRef::Type> SymbolTypeOrErr = Symbol.getType(); if (auto EC = SymbolTypeOrErr.getError()) return EC; SymbolRef::Type SymbolType = *SymbolTypeOrErr; if (SymbolType != SymbolRef::ST_Function && SymbolType != SymbolRef::ST_Data) return std::error_code(); ErrorOr<uint64_t> SymbolAddressOrErr = Symbol.getAddress(); if (auto EC = SymbolAddressOrErr.getError()) return EC; uint64_t SymbolAddress = *SymbolAddressOrErr; if (OpdExtractor) { // For big-endian PowerPC64 ELF, symbols in the .opd section refer to // function descriptors. The first word of the descriptor is a pointer to // the function's code. // For the purposes of symbolization, pretend the symbol's address is that // of the function's code, not the descriptor. uint64_t OpdOffset = SymbolAddress - OpdAddress; uint32_t OpdOffset32 = OpdOffset; if (OpdOffset == OpdOffset32 && OpdExtractor->isValidOffsetForAddress(OpdOffset32)) SymbolAddress = OpdExtractor->getAddress(&OpdOffset32); } Expected<StringRef> SymbolNameOrErr = Symbol.getName(); if (!SymbolNameOrErr) return errorToErrorCode(SymbolNameOrErr.takeError()); StringRef SymbolName = *SymbolNameOrErr; // Mach-O symbol table names have leading underscore, skip it. if (Module->isMachO() && SymbolName.size() > 0 && SymbolName[0] == '_') SymbolName = SymbolName.drop_front(); // FIXME: If a function has alias, there are two entries in symbol table // with same address size. Make sure we choose the correct one. auto &M = SymbolType == SymbolRef::ST_Function ? Functions : Objects; SymbolDesc SD = { SymbolAddress, SymbolSize }; M.insert(std::make_pair(SD, SymbolName)); return std::error_code(); }
ConditionTruthVal RangeConstraintManager::checkNull(ProgramStateRef State, SymbolRef Sym) { const RangeSet *Ranges = State->get<ConstraintRange>(Sym); // If we don't have any information about this symbol, it's underconstrained. if (!Ranges) return ConditionTruthVal(); // If we have a concrete value, see if it's zero. if (const llvm::APSInt *Value = Ranges->getConcreteValue()) return *Value == 0; BasicValueFactory &BV = getBasicVals(); APSIntType IntType = BV.getAPSIntType(Sym->getType()); llvm::APSInt Zero = IntType.getZeroValue(); // Check if zero is in the set of possible values. if (Ranges->Intersect(BV, F, Zero, Zero).isEmpty()) return false; // Zero is a possible value, but it is not the /only/ possible value. return ConditionTruthVal(); }
static void generateDiagnosticsForCallLike(ProgramStateRef CurrSt, const LocationContext *LCtx, const RefVal &CurrV, SymbolRef &Sym, const Stmt *S, llvm::raw_string_ostream &os) { CallEventManager &Mgr = CurrSt->getStateManager().getCallEventManager(); if (const CallExpr *CE = dyn_cast<CallExpr>(S)) { // Get the name of the callee (if it is available) // from the tracked SVal. SVal X = CurrSt->getSValAsScalarOrLoc(CE->getCallee(), LCtx); const FunctionDecl *FD = X.getAsFunctionDecl(); // If failed, try to get it from AST. if (!FD) FD = dyn_cast<FunctionDecl>(CE->getCalleeDecl()); if (const auto *MD = dyn_cast<CXXMethodDecl>(CE->getCalleeDecl())) { os << "Call to method '" << MD->getQualifiedNameAsString() << '\''; } else if (FD) { os << "Call to function '" << FD->getQualifiedNameAsString() << '\''; } else { os << "function call"; } } else if (isa<CXXNewExpr>(S)) { os << "Operator 'new'"; } else { assert(isa<ObjCMessageExpr>(S)); CallEventRef<ObjCMethodCall> Call = Mgr.getObjCMethodCall(cast<ObjCMessageExpr>(S), CurrSt, LCtx); switch (Call->getMessageKind()) { case OCM_Message: os << "Method"; break; case OCM_PropertyAccess: os << "Property"; break; case OCM_Subscript: os << "Subscript"; break; } } Optional<CallEventRef<>> CE = Mgr.getCall(S, CurrSt, LCtx); auto Idx = findArgIdxOfSymbol(CurrSt, LCtx, Sym, CE); // If index is not found, we assume that the symbol was returned. if (!Idx) { os << " returns "; } else { os << " writes "; } if (CurrV.getObjKind() == ObjKind::CF) { os << "a Core Foundation object of type '" << Sym->getType().getAsString() << "' with a "; } else if (CurrV.getObjKind() == ObjKind::OS) { os << "an OSObject of type '" << getPrettyTypeName(Sym->getType()) << "' with a "; } else if (CurrV.getObjKind() == ObjKind::Generalized) { os << "an object of type '" << Sym->getType().getAsString() << "' with a "; } else { assert(CurrV.getObjKind() == ObjKind::ObjC); QualType T = Sym->getType(); if (!isa<ObjCObjectPointerType>(T)) { os << "an Objective-C object with a "; } else { const ObjCObjectPointerType *PT = cast<ObjCObjectPointerType>(T); os << "an instance of " << PT->getPointeeType().getAsString() << " with a "; } } if (CurrV.isOwned()) { os << "+1 retain count"; } else { assert(CurrV.isNotOwned()); os << "+0 retain count"; } if (Idx) { os << " into an out parameter '"; const ParmVarDecl *PVD = (*CE)->parameters()[*Idx]; PVD->getNameForDiagnostic(os, PVD->getASTContext().getPrintingPolicy(), /*Qualified=*/false); os << "'"; QualType RT = (*CE)->getResultType(); if (!RT.isNull() && !RT->isVoidType()) { SVal RV = (*CE)->getReturnValue(); if (CurrSt->isNull(RV).isConstrainedTrue()) { os << " (assuming the call returns zero)"; } else if (CurrSt->isNonNull(RV).isConstrainedTrue()) { os << " (assuming the call returns non-zero)"; } } } }
ProgramStateRef RangedConstraintManager::assumeSymRel(ProgramStateRef State, SymbolRef Sym, BinaryOperator::Opcode Op, const llvm::APSInt &Int) { assert(BinaryOperator::isComparisonOp(Op) && "Non-comparison ops should be rewritten as comparisons to zero."); // Simplification: translate an assume of a constraint of the form // "(exp comparison_op expr) != 0" to true into an assume of // "exp comparison_op expr" to true. (And similarly, an assume of the form // "(exp comparison_op expr) == 0" to true into an assume of // "exp comparison_op expr" to false.) if (Int == 0 && (Op == BO_EQ || Op == BO_NE)) { if (const BinarySymExpr *SE = dyn_cast<BinarySymExpr>(Sym)) if (BinaryOperator::isComparisonOp(SE->getOpcode())) return assumeSym(State, Sym, (Op == BO_NE ? true : false)); } // Get the type used for calculating wraparound. BasicValueFactory &BVF = getBasicVals(); APSIntType WraparoundType = BVF.getAPSIntType(Sym->getType()); // We only handle simple comparisons of the form "$sym == constant" // or "($sym+constant1) == constant2". // The adjustment is "constant1" in the above expression. It's used to // "slide" the solution range around for modular arithmetic. For example, // x < 4 has the solution [0, 3]. x+2 < 4 has the solution [0-2, 3-2], which // in modular arithmetic is [0, 1] U [UINT_MAX-1, UINT_MAX]. It's up to // the subclasses of SimpleConstraintManager to handle the adjustment. llvm::APSInt Adjustment = WraparoundType.getZeroValue(); computeAdjustment(Sym, Adjustment); // Convert the right-hand side integer as necessary. APSIntType ComparisonType = std::max(WraparoundType, APSIntType(Int)); llvm::APSInt ConvertedInt = ComparisonType.convert(Int); // Prefer unsigned comparisons. if (ComparisonType.getBitWidth() == WraparoundType.getBitWidth() && ComparisonType.isUnsigned() && !WraparoundType.isUnsigned()) Adjustment.setIsSigned(false); switch (Op) { default: llvm_unreachable("invalid operation not caught by assertion above"); case BO_EQ: return assumeSymEQ(State, Sym, ConvertedInt, Adjustment); case BO_NE: return assumeSymNE(State, Sym, ConvertedInt, Adjustment); case BO_GT: return assumeSymGT(State, Sym, ConvertedInt, Adjustment); case BO_GE: return assumeSymGE(State, Sym, ConvertedInt, Adjustment); case BO_LT: return assumeSymLT(State, Sym, ConvertedInt, Adjustment); case BO_LE: return assumeSymLE(State, Sym, ConvertedInt, Adjustment); } // end switch }
error_or<kind_type> get_kind(const SymbolRef &sym) { auto er_type = sym.getType(); return success(er_type); }
SVal SimpleSValBuilder::evalBinOpNN(const ProgramState *state, BinaryOperator::Opcode op, NonLoc lhs, NonLoc rhs, QualType resultTy) { // Handle trivial case where left-side and right-side are the same. if (lhs == rhs) switch (op) { default: break; case BO_EQ: case BO_LE: case BO_GE: return makeTruthVal(true, resultTy); case BO_LT: case BO_GT: case BO_NE: return makeTruthVal(false, resultTy); case BO_Xor: case BO_Sub: return makeIntVal(0, resultTy); case BO_Or: case BO_And: return evalCastFromNonLoc(lhs, resultTy); } while (1) { switch (lhs.getSubKind()) { default: return generateUnknownVal(state, op, lhs, rhs, resultTy); case nonloc::LocAsIntegerKind: { Loc lhsL = cast<nonloc::LocAsInteger>(lhs).getLoc(); switch (rhs.getSubKind()) { case nonloc::LocAsIntegerKind: return evalBinOpLL(state, op, lhsL, cast<nonloc::LocAsInteger>(rhs).getLoc(), resultTy); case nonloc::ConcreteIntKind: { // Transform the integer into a location and compare. llvm::APSInt i = cast<nonloc::ConcreteInt>(rhs).getValue(); i.setIsUnsigned(true); i = i.extOrTrunc(Context.getTypeSize(Context.VoidPtrTy)); return evalBinOpLL(state, op, lhsL, makeLoc(i), resultTy); } default: switch (op) { case BO_EQ: return makeTruthVal(false, resultTy); case BO_NE: return makeTruthVal(true, resultTy); default: // This case also handles pointer arithmetic. return generateUnknownVal(state, op, lhs, rhs, resultTy); } } } case nonloc::SymExprValKind: { nonloc::SymExprVal *selhs = cast<nonloc::SymExprVal>(&lhs); // Only handle LHS of the form "$sym op constant", at least for now. const SymIntExpr *symIntExpr = dyn_cast<SymIntExpr>(selhs->getSymbolicExpression()); if (!symIntExpr) return generateUnknownVal(state, op, lhs, rhs, resultTy); // Is this a logical not? (!x is represented as x == 0.) if (op == BO_EQ && rhs.isZeroConstant()) { // We know how to negate certain expressions. Simplify them here. BinaryOperator::Opcode opc = symIntExpr->getOpcode(); switch (opc) { default: // We don't know how to negate this operation. // Just handle it as if it were a normal comparison to 0. break; case BO_LAnd: case BO_LOr: llvm_unreachable("Logical operators handled by branching logic."); case BO_Assign: case BO_MulAssign: case BO_DivAssign: case BO_RemAssign: case BO_AddAssign: case BO_SubAssign: case BO_ShlAssign: case BO_ShrAssign: case BO_AndAssign: case BO_XorAssign: case BO_OrAssign: case BO_Comma: llvm_unreachable("'=' and ',' operators handled by ExprEngine."); case BO_PtrMemD: case BO_PtrMemI: llvm_unreachable("Pointer arithmetic not handled here."); case BO_LT: case BO_GT: case BO_LE: case BO_GE: case BO_EQ: case BO_NE: // Negate the comparison and make a value. opc = NegateComparison(opc); assert(symIntExpr->getType(Context) == resultTy); return makeNonLoc(symIntExpr->getLHS(), opc, symIntExpr->getRHS(), resultTy); } } // For now, only handle expressions whose RHS is a constant. const nonloc::ConcreteInt *rhsInt = dyn_cast<nonloc::ConcreteInt>(&rhs); if (!rhsInt) return generateUnknownVal(state, op, lhs, rhs, resultTy); // If both the LHS and the current expression are additive, // fold their constants. if (BinaryOperator::isAdditiveOp(op)) { BinaryOperator::Opcode lop = symIntExpr->getOpcode(); if (BinaryOperator::isAdditiveOp(lop)) { // resultTy may not be the best type to convert to, but it's // probably the best choice in expressions with mixed type // (such as x+1U+2LL). The rules for implicit conversions should // choose a reasonable type to preserve the expression, and will // at least match how the value is going to be used. const llvm::APSInt &first = BasicVals.Convert(resultTy, symIntExpr->getRHS()); const llvm::APSInt &second = BasicVals.Convert(resultTy, rhsInt->getValue()); const llvm::APSInt *newRHS; if (lop == op) newRHS = BasicVals.evalAPSInt(BO_Add, first, second); else newRHS = BasicVals.evalAPSInt(BO_Sub, first, second); return MakeSymIntVal(symIntExpr->getLHS(), lop, *newRHS, resultTy); } } // Otherwise, make a SymExprVal out of the expression. return MakeSymIntVal(symIntExpr, op, rhsInt->getValue(), resultTy); } case nonloc::ConcreteIntKind: { const nonloc::ConcreteInt& lhsInt = cast<nonloc::ConcreteInt>(lhs); // Is the RHS a symbol we can simplify? // FIXME: This was mostly copy/pasted from the LHS-is-a-symbol case. if (const nonloc::SymbolVal *srhs = dyn_cast<nonloc::SymbolVal>(&rhs)) { SymbolRef RSym = srhs->getSymbol(); if (RSym->getType(Context)->isIntegerType()) { if (const llvm::APSInt *Constant = state->getSymVal(RSym)) { // The symbol evaluates to a constant. const llvm::APSInt *rhs_I; if (BinaryOperator::isRelationalOp(op)) rhs_I = &BasicVals.Convert(lhsInt.getValue(), *Constant); else rhs_I = &BasicVals.Convert(resultTy, *Constant); rhs = nonloc::ConcreteInt(*rhs_I); } } } if (isa<nonloc::ConcreteInt>(rhs)) { return lhsInt.evalBinOp(*this, op, cast<nonloc::ConcreteInt>(rhs)); } else { const llvm::APSInt& lhsValue = lhsInt.getValue(); // Swap the left and right sides and flip the operator if doing so // allows us to better reason about the expression (this is a form // of expression canonicalization). // While we're at it, catch some special cases for non-commutative ops. NonLoc tmp = rhs; rhs = lhs; lhs = tmp; switch (op) { case BO_LT: case BO_GT: case BO_LE: case BO_GE: op = ReverseComparison(op); continue; case BO_EQ: case BO_NE: case BO_Add: case BO_Mul: case BO_And: case BO_Xor: case BO_Or: continue; case BO_Shr: if (lhsValue.isAllOnesValue() && lhsValue.isSigned()) // At this point lhs and rhs have been swapped. return rhs; // FALL-THROUGH case BO_Shl: if (lhsValue == 0) // At this point lhs and rhs have been swapped. return rhs; return generateUnknownVal(state, op, lhs, rhs, resultTy); default: return generateUnknownVal(state, op, lhs, rhs, resultTy); } } } case nonloc::SymbolValKind: { nonloc::SymbolVal *slhs = cast<nonloc::SymbolVal>(&lhs); SymbolRef Sym = slhs->getSymbol(); QualType lhsType = Sym->getType(Context); // The conversion type is usually the result type, but not in the case // of relational expressions. QualType conversionType = resultTy; if (BinaryOperator::isRelationalOp(op)) conversionType = lhsType; // Does the symbol simplify to a constant? If so, "fold" the constant // by setting 'lhs' to a ConcreteInt and try again. if (lhsType->isIntegerType()) if (const llvm::APSInt *Constant = state->getSymVal(Sym)) { // The symbol evaluates to a constant. If necessary, promote the // folded constant (LHS) to the result type. const llvm::APSInt &lhs_I = BasicVals.Convert(conversionType, *Constant); lhs = nonloc::ConcreteInt(lhs_I); // Also promote the RHS (if necessary). // For shifts, it is not necessary to promote the RHS. if (BinaryOperator::isShiftOp(op)) continue; // Other operators: do an implicit conversion. This shouldn't be // necessary once we support truncation/extension of symbolic values. if (nonloc::ConcreteInt *rhs_I = dyn_cast<nonloc::ConcreteInt>(&rhs)){ rhs = nonloc::ConcreteInt(BasicVals.Convert(conversionType, rhs_I->getValue())); } continue; } // Is the RHS a symbol we can simplify? if (const nonloc::SymbolVal *srhs = dyn_cast<nonloc::SymbolVal>(&rhs)) { SymbolRef RSym = srhs->getSymbol(); if (RSym->getType(Context)->isIntegerType()) { if (const llvm::APSInt *Constant = state->getSymVal(RSym)) { // The symbol evaluates to a constant. const llvm::APSInt &rhs_I = BasicVals.Convert(conversionType, *Constant); rhs = nonloc::ConcreteInt(rhs_I); } } } if (isa<nonloc::ConcreteInt>(rhs)) { return MakeSymIntVal(slhs->getSymbol(), op, cast<nonloc::ConcreteInt>(rhs).getValue(), resultTy); } return generateUnknownVal(state, op, lhs, rhs, resultTy); } } } }
const GRState *SimpleConstraintManager::AssumeSymRel(const GRState *state, const SymExpr *LHS, BinaryOperator::Opcode op, const llvm::APSInt& Int) { assert(BinaryOperator::isComparisonOp(op) && "Non-comparison ops should be rewritten as comparisons to zero."); // We only handle simple comparisons of the form "$sym == constant" // or "($sym+constant1) == constant2". // The adjustment is "constant1" in the above expression. It's used to // "slide" the solution range around for modular arithmetic. For example, // x < 4 has the solution [0, 3]. x+2 < 4 has the solution [0-2, 3-2], which // in modular arithmetic is [0, 1] U [UINT_MAX-1, UINT_MAX]. It's up to // the subclasses of SimpleConstraintManager to handle the adjustment. llvm::APSInt Adjustment; // First check if the LHS is a simple symbol reference. SymbolRef Sym = dyn_cast<SymbolData>(LHS); if (Sym) { Adjustment = 0; } else { // Next, see if it's a "($sym+constant1)" expression. const SymIntExpr *SE = dyn_cast<SymIntExpr>(LHS); // We don't handle "($sym1+$sym2)". // Give up and assume the constraint is feasible. if (!SE) return state; // We don't handle "(<expr>+constant1)". // Give up and assume the constraint is feasible. Sym = dyn_cast<SymbolData>(SE->getLHS()); if (!Sym) return state; // Get the constant out of the expression "($sym+constant1)". switch (SE->getOpcode()) { case BO_Add: Adjustment = SE->getRHS(); break; case BO_Sub: Adjustment = -SE->getRHS(); break; default: // We don't handle non-additive operators. // Give up and assume the constraint is feasible. return state; } } // FIXME: This next section is a hack. It silently converts the integers to // be of the same type as the symbol, which is not always correct. Really the // comparisons should be performed using the Int's type, then mapped back to // the symbol's range of values. GRStateManager &StateMgr = state->getStateManager(); ASTContext &Ctx = StateMgr.getContext(); QualType T = Sym->getType(Ctx); assert(T->isIntegerType() || Loc::IsLocType(T)); unsigned bitwidth = Ctx.getTypeSize(T); bool isSymUnsigned = T->isUnsignedIntegerType() || Loc::IsLocType(T); // Convert the adjustment. Adjustment.setIsUnsigned(isSymUnsigned); Adjustment.extOrTrunc(bitwidth); // Convert the right-hand side integer. llvm::APSInt ConvertedInt(Int, isSymUnsigned); ConvertedInt.extOrTrunc(bitwidth); switch (op) { default: // No logic yet for other operators. Assume the constraint is feasible. return state; case BO_EQ: return AssumeSymEQ(state, Sym, ConvertedInt, Adjustment); case BO_NE: return AssumeSymNE(state, Sym, ConvertedInt, Adjustment); case BO_GT: return AssumeSymGT(state, Sym, ConvertedInt, Adjustment); case BO_GE: return AssumeSymGE(state, Sym, ConvertedInt, Adjustment); case BO_LT: return AssumeSymLT(state, Sym, ConvertedInt, Adjustment); case BO_LE: return AssumeSymLE(state, Sym, ConvertedInt, Adjustment); } // end switch }