<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<p><font size="+1">Hi,</font></p>
<p><font size="+1">I read the comment "avoid loops in the exploded
graph" in the following snippet of code which is on page 32 of
the <a moz-do-not-send="true"
href="https://github.com/haoNoQ/clang-analyzer-guide/releases/download/v0.1/clang-analyzer-guide-v0.1.pdf">workbook</a>.</font></p>
<p><tt><font size="+1">LocationContext *LC = C. getLocationContext
();
<br>
ProgramStateRef State = C. getState ();
<br>
const Expr *E = /* Obtain an expression value of which is
untrusted */;
<br>
ProgramStateRef NewState = State -> addTaint (E, LC );
<br>
if ( NewState != State ) // avoid loops in the exploded graph
<br>
C. addTransition ( NewState );</font></tt></p>
<p><font size="+1">My question is why the new tainted state requires
the if statement to prevent loops, while other new states in the
book do not have the if statement when C.addTransition(State) is
used? Do other states which are not tainted not need to prevent
loops? For example, on page 30, when a new state is added, it
reads:</font></p>
<p><tt><font size="+1">ProgramStateRef State = C. getState ();
<br>
State = modifyState ( State ); // do stuff
<br>
C. addTransition ( State );</font></tt></p>
<p><font size="+1">There is no if state to prevent a loop.<br>
</font></p>
<pre class="moz-signature" cols="72">--
Love,
Lou
</pre>
</body>
</html>