================ @@ -0,0 +1,206 @@ +//===- InvalidationCause.h - Cause of a region invalidation ------*- C++ -*-==// +// +// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions. +// See https://llvm.org/LICENSE.txt for license information. +// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception +// +//===----------------------------------------------------------------------===// +// +// This file defines InvalidationCause, a small class hierarchy describing why +// a memory region was invalidated by ProgramState::invalidateRegions. The +// cause is carried by SymbolInvalidationArtifact symbols so that downstream +// machinery (bug-report suppression, diagnostics) can distinguish symbolic +// values produced by an invalidation event from ordinary conjured symbols. +// +//===----------------------------------------------------------------------===// + +#ifndef LLVM_CLANG_STATICANALYZER_CORE_PATHSENSITIVE_INVALIDATIONCAUSE_H +#define LLVM_CLANG_STATICANALYZER_CORE_PATHSENSITIVE_INVALIDATIONCAUSE_H + +#include "clang/Basic/LLVM.h" +#include "llvm/ADT/FoldingSet.h" +#include "llvm/Support/Compiler.h" + +namespace clang { + +class CallExpr; +class Stmt; + +namespace ento { + +class SymbolManager; + +/// Describes why a memory region was invalidated. Instances are uniqued by +/// SymbolManager::acquireCause<T>(...) and are stable for the analysis +/// lifetime; callers must not allocate them on the stack. +class InvalidationCause : public llvm::FoldingSetNode { +public: + virtual ~InvalidationCause() = default; + + enum Kind { + // UnmodeledCall range + ConservativeEvalCallKind, + PartiallyModeledCallKind, + BEGIN_UNMODELED_CALL = ConservativeEvalCallKind, + END_UNMODELED_CALL = PartiallyModeledCallKind, + + // UnmodeledStmt range ---------------- Xazax-hun wrote:
I wonder what granularity do we want here: * Invalidation and Escaping are not completely orthogonal, and in some cases the analyzer can make a difference if something is directly invalidated or indirectly (was in a cone of impact, e.g., could be invalidated through multiple pointer deref, or through pointer arithmetic). * I wonder if it would be interesting to get more info out of the solver, e.g., if the path split happened because it gave up on the complexity of the expression, or if it had unmodeled parts, or just not enough information. Is that a form of invalidation? Although we potantially do not want to represent that with a symbol? https://github.com/llvm/llvm-project/pull/207155 _______________________________________________ cfe-commits mailing list [email protected] https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
