<div dir="ltr"><div><div><div><div>Hello,<br><br>After a bit of research, I've concluded the following:<br><br></div><div>Bearing in mind this signature:<br><br><span style="font-family:courier new,monospace">void checkBind(SVal VLoc, SVal Val, const Stmt *S, CheckerContext &C) const;</span><br>
<br></div>To solve questions #1 and #2 in my previous message as:<br><br><span style="font-family:courier new,monospace"> Optional<Loc> L = VLoc.getAs<Loc>();<br> if (L) {<br> // VLoc is of type Loc<br>
if (Optional<loc::MemRegionVal> MR = L->getAs<loc::MemRegionVal>()) {<br>
// VLoc isa MemRegionVal<br> const MemRegion *R = MR->getRegion()->StripCasts();<br> // Are we dealing with an ElementRegion?<br> if (const ElementRegion *ER = dyn_cast<ElementRegion>(R)) {<br>
// VLoc is an ElementRegion<br> } else {<br> // VLoc is NOT an ElementRegion<br> }<br> } else {<br> // VLoc is NOT a MemRegionVal<br> }<br><span style="font-family:arial,helvetica,sans-serif"><br>
</span></span></div><span style="font-family:courier new,monospace"><span style="font-family:arial,helvetica,sans-serif">I'm a bit confused about SVals and SymbolRefs. I've read this thread (<a href="http://lists.cs.uiuc.edu/pipermail/cfe-dev/2012-December/026641.html" target="_blank">http://lists.cs.uiuc.edu/pipermail/cfe-dev/2012-December/026641.html</a>) which is quite clarifying. I wonder what the difference is between the following 3 statements:<br>
<br>SymbolRef sym = L->getAsLocSymbol();<br></span></span></div><span style="font-family:courier new,monospace"><span style="font-family:arial,helvetica,sans-serif"></span></span><span style="font-family:courier new,monospace"><span style="font-family:arial,helvetica,sans-serif">SymbolRef sym = VLoc.getAsLocSymbol();<br>
</span></span></div><span style="font-family:courier new,monospace"><span style="font-family:arial,helvetica,sans-serif"></span></span><span style="font-family:courier new,monospace"><span style="font-family:arial,helvetica,sans-serif">SymbolRef sym = VLoc.getAsSymbol()</span></span>;<br>
<div><div><span style="font-family:courier new,monospace"><span style="font-family:arial,helvetica,sans-serif"><br></span></span></div><div><span style="font-family:courier new,monospace"><span style="font-family:arial,helvetica,sans-serif">My goal is to be able to detect something like the following. For that, I'd like the checker to store (as the checker's ProgramState info) a variable name (symbol?). In the example below, when statement #1 is processed, the checker should store "p" as a means of tracking "p" for future references. Thus, the checker would be able to signal a warning </span></span><span style="font-family:courier new,monospace"><span style="font-family:arial,helvetica,sans-serif"><span style="font-family:courier new,monospace"><span style="font-family:arial,helvetica,sans-serif">when statement #2 is processed:</span></span><br>
<br></span></span><span style="font-family:courier new,monospace"><span style="font-family:arial,helvetica,sans-serif">1) <span style="font-family:courier new,monospace">p = "/tmp/file"; // p is declared as char *p;</span><br>
2) <span style="font-family:courier new,monospace">*(p+3) = 'S'; // I'm aware this is undefined behavior</span><br></span></span><div><br></div><span style="font-family:courier new,monospace"><span style="font-family:arial,helvetica,sans-serif">How can I get the symbolic value of variable "p"? I think the best is as a SymbolRef (because depending on variables scope, I might come across with another "p", but I'm unsure)<br>
<br></span></span></div><div><span style="font-family:courier new,monospace"><span style="font-family:arial,helvetica,sans-serif">Any hint or suggestion would be highly appreciated.<br></span></span></div><div><span style="font-family:courier new,monospace"><span style="font-family:arial,helvetica,sans-serif">Many thanks.<br>
</span></span></div><div><span style="font-family:courier new,monospace"><span style="font-family:arial,helvetica,sans-serif"><br></span></span></div></div></div><div class="gmail_extra"><br><br><div class="gmail_quote">
2014-05-05 11:09 GMT+02:00 Aitor San Juan <span dir="ltr"><<a href="mailto:aitor.sj@opendeusto.es" target="_blank">aitor.sj@opendeusto.es</a>></span>:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div dir="ltr"><div><div><div><div>Hello,<br><br></div>In a checker, I want to distinguish between these kinds of statements:<br><br></div>1) <span style="font-family:courier new,monospace">p = "/tmp/file"; // p is declared as char *p;</span><br>
</div>2) <span style="font-family:courier new,monospace">*(p+3) = 'S'; // I'm aware this is undefined behavior</span><br><div><br></div><div>If I'm not wrong, I've decided that the best place to be aware of that is in a check::Bind event:<br>
<br><span style="font-family:courier new,monospace">void checkBind(SVal Loc, SVal Val, const Stmt *S, CheckerContext &C) const;</span><br><br>In the first case above, the location Loc is a MemRegionVal, and in the 2nd, it is an ElementRegion. <br>
<br>1) To test if Loc is a MemRegionVal I use the following, but there's something wrong I can't figure out (it doesn't compile), and I'm stuck (as far as I know, MemRegionVal is a subclass of SVal):<br>
<br><span style="font-family:courier new,monospace">if (clang::isa<loc::MemRegionVal></span><span style="font-family:courier new,monospace">(Loc)) ...<br><span style="font-family:arial,helvetica,sans-serif"></span></span><span style="font-family:arial,helvetica,sans-serif"><br>
</span><span style="font-family:courier new,monospace"><span style="font-family:arial,helvetica,sans-serif">2) ElementRegion doesn't belong to the SVal class hierarchy</span></span>. <span style="font-family:courier new,monospace"><span style="font-family:arial,helvetica,sans-serif">How can I know if Loc is an ElementRegin? </span></span></div>
<br></div><div>Thanks a lot.<br></div></div>
</blockquote></div><br></div>