[cfe-commits] r66005 - in /cfe/trunk: include/clang/Analysis/PathSensitive/GRState.h include/clang/Analysis/PathSensitive/MemRegion.h lib/Analysis/CFRefCount.cpp lib/Analysis/MemRegion.cpp

[Ted Kremenek]

Author: kremenek
Date: Tue Mar  3 20:43:08 2009
New Revision: 66005

URL: http://llvm.org/viewvc/llvm-project?rev=66005&view=rev
Log:
Added the notion of a "boundable region", which is a region that can have a direct binding in the StoreManager.

Modified:
    cfe/trunk/include/clang/Analysis/PathSensitive/GRState.h
    cfe/trunk/include/clang/Analysis/PathSensitive/MemRegion.h
    cfe/trunk/lib/Analysis/CFRefCount.cpp
    cfe/trunk/lib/Analysis/MemRegion.cpp

Modified: cfe/trunk/include/clang/Analysis/PathSensitive/GRState.h
URL: http://llvm.org/viewvc/llvm-project/cfe/trunk/include/clang/Analysis/PathSensitive/GRState.h?rev=66005&r1=66004&r2=66005&view=diff

==============================================================================
--- cfe/trunk/include/clang/Analysis/PathSensitive/GRState.h (original)
+++ cfe/trunk/include/clang/Analysis/PathSensitive/GRState.h Tue Mar  3 20:43:08 2009
@@ -488,6 +488,12 @@
   }  
 
   SVal GetSValAsScalarOrLoc(const GRState* state, const MemRegion *R) {
+    // We only want to do fetches from regions that we can actually bind
+    // values.  For example, SymbolicRegions of type 'id<...>' cannot
+    // have direct bindings (but their can be bindings on their subregions).
+    if (!R->isBoundable(getContext()))
+      return UnknownVal();
+    
     if (const TypedRegion *TR = dyn_cast<TypedRegion>(R)) {
       QualType T = TR->getRValueType(getContext());
       if (Loc::IsLocType(T) || T->isIntegerType())

Modified: cfe/trunk/include/clang/Analysis/PathSensitive/MemRegion.h
URL: http://llvm.org/viewvc/llvm-project/cfe/trunk/include/clang/Analysis/PathSensitive/MemRegion.h?rev=66005&r1=66004&r2=66005&view=diff

==============================================================================
--- cfe/trunk/include/clang/Analysis/PathSensitive/MemRegion.h (original)
+++ cfe/trunk/include/clang/Analysis/PathSensitive/MemRegion.h Tue Mar  3 20:43:08 2009
@@ -69,6 +69,8 @@
   virtual void print(llvm::raw_ostream& os) const;  
   
   Kind getKind() const { return kind; }  
+  
+  virtual bool isBoundable(ASTContext&) const { return true; }
 
   static bool classof(const MemRegion*) { return true; }
 };
@@ -84,6 +86,8 @@
 
   void Profile(llvm::FoldingSetNodeID& ID) const;
 
+  bool isBoundable(ASTContext &) const { return false; }
+
   static bool classof(const MemRegion* R) {
     return R->getKind() == MemSpaceRegionKind;
   }
@@ -156,6 +160,13 @@
   QualType getDesugaredLValueType(ASTContext& C) const {
     return getLValueType(C)->getDesugaredType();
   }
+  
+  bool isBoundable(ASTContext &C) const {
+    // FIXME: This needs to be adjusted for structures and arrays.
+    // All this will reject right now is ObjCQualifiedIdType and
+    // BlockPointerType.
+    return getLValueType(C)->isPointerType();
+  }
 
   static bool classof(const MemRegion* R) {
     unsigned k = R->getKind();
@@ -182,6 +193,7 @@
   }
 
   QualType getRValueType(ASTContext& C) const;
+  QualType getLValueType(ASTContext& C) const;
 
   void Profile(llvm::FoldingSetNodeID& ID) const;
 

Modified: cfe/trunk/lib/Analysis/CFRefCount.cpp
URL: http://llvm.org/viewvc/llvm-project/cfe/trunk/lib/Analysis/CFRefCount.cpp?rev=66005&r1=66004&r2=66005&view=diff

==============================================================================
--- cfe/trunk/lib/Analysis/CFRefCount.cpp (original)
+++ cfe/trunk/lib/Analysis/CFRefCount.cpp Tue Mar  3 20:43:08 2009
@@ -1650,7 +1650,7 @@
           R = dyn_cast<TypedRegion>(ATR->getSuperRegion());
         }
         
-        if (R) {          
+        if (R && R->isBoundable(Ctx)) {          
           // Is the invalidated variable something that we were tracking?
           SymbolRef Sym = state.GetSValAsScalarOrLoc(R).getAsLocSymbol();
           if (Sym.isValid())

Modified: cfe/trunk/lib/Analysis/MemRegion.cpp
URL: http://llvm.org/viewvc/llvm-project/cfe/trunk/lib/Analysis/MemRegion.cpp?rev=66005&r1=66004&r2=66005&view=diff

==============================================================================
--- cfe/trunk/lib/Analysis/MemRegion.cpp (original)
+++ cfe/trunk/lib/Analysis/MemRegion.cpp Tue Mar  3 20:43:08 2009
@@ -117,12 +117,22 @@
   // Get the type of the symbol.
   QualType T = data.getType(C);
 
-  // Only when the symbol has pointer type it can have a symbolic region
-  // associated with it.
-  PointerType* PTy = cast<PointerType>(T.getTypePtr()->getDesugaredType());
+  if (const PointerType* PTy = T->getAsPointerType())
+    return PTy->getPointeeType();
+    
+  if (const BlockPointerType* PTy = T->getAsBlockPointerType())
+    return PTy->getPointeeType();
+
+  assert(!T->getAsObjCQualifiedIdType() &&
+         "There is no rvalue type for id<...>");  
+  
+  assert(Loc::IsLocType(T) && "Non-location type.");
+  return QualType();
+}
 
-  // The type of the symbolic region is the pointee type of the symbol.
-  return PTy->getPointeeType();
+QualType SymbolicRegion::getLValueType(ASTContext& C) const {
+  const SymbolData& data = SymMgr.getSymbolData(sym);
+  return data.getType(C);
 }
 
 QualType ElementRegion::getRValueType(ASTContext& C) const {
@@ -161,7 +171,7 @@
 }
 
 void TypedViewRegion::print(llvm::raw_ostream& os) const {
-  os << "anon_type{" << T.getAsString() << ',';
+  os << "typed_view{" << T.getAsString() << ',';
   getSuperRegion()->print(os);
   os << '}';
 }