[analyzer] Rename assumeWithinInclusiveRange*()

[ddcc]

Summary

The name is slightly confusing, since the constraint is not necessarily within the range unless Assumption is true. Split out renaming for ConstraintManager.h from D26061

[dcoughlin]

LGTM, other then some indentation issues for arguments and parameters after the rename. Please fix those and commit! And thanks for splitting this up.

include/clang/StaticAnalyzer/Core/PathSensitive/ConstraintManager.h

101–102

Nit: The indentation here (and elsewhere) is off after the rename.

[ddcc]

Fix formatting

include/clang/StaticAnalyzer/Core/PathSensitive/ConstraintManager.h

class ConditionTruthVal {
   Optional<bool> Val;
 public:
   /// Construct a ConditionTruthVal indicating the constraint is constrained
   /// to either true or false, depending on the boolean value provided.
   ConditionTruthVal(bool constraint) : Val(constraint) {}
 
   /// Construct a ConstraintVal indicating the constraint is underconstrained.
   ConditionTruthVal() {}
-  
   /// Return true if the constraint is perfectly constrained to 'true'.
   bool isConstrainedTrue() const {
     return Val.hasValue() && Val.getValue();
   }
 
   /// Return true if the constraint is perfectly constrained to 'false'.
   bool isConstrainedFalse() const {
     return Val.hasValue() && !Val.getValue();
   }
 
   /// Return true if the constrained is perfectly constrained.
   bool isConstrained() const {
     return Val.hasValue();
   }
 
   /// Return true if the constrained is underconstrained and we do not know
   /// if the constraint is true of value.
   bool isUnderconstrained() const {
     return !Val.hasValue();
   }
 };
-  
 class ConstraintManager {
 public:
   ConstraintManager() : NotifyAssumeClients(true) {}
-  
   virtual ~ConstraintManager();
   virtual ProgramStateRef assume(ProgramStateRef state,
                                  DefinedSVal Cond,
                                  bool Assumption) = 0;
 
   typedef std::pair<ProgramStateRef, ProgramStateRef> ProgramStatePair;
 
   /// Returns a pair of states (StTrue, StFalse) where the given condition is
if (!StFalse) {
       // We are careful to return the original state, /not/ StTrue,
       // because we want to avoid having callers generate a new node
       // in the ExplodedGraph.
       return ProgramStatePair(State, (ProgramStateRef)nullptr);
     }
 
     return ProgramStatePair(StTrue, StFalse);
   }
 
-  virtual ProgramStateRef assumeWithinInclusiveRange(ProgramStateRef State,
-                                                     NonLoc Value,
-                                                     const llvm::APSInt &From,
-                                                     const llvm::APSInt &To,
-                                                     bool InBound) = 0;
+  virtual ProgramStateRef assumeInclusiveRange(ProgramStateRef State,
 
-  virtual ProgramStatePair assumeWithinInclusiveRangeDual(
-      ProgramStateRef State, NonLoc Value, const llvm::APSInt &From,
+  virtual ProgramStatePair assumeInclusiveRangeDual(ProgramStateRef State,
+                                                    NonLoc Value,
+                                                    const llvm::APSInt &From,
                                                     const llvm::APSInt &To) {
-    ProgramStateRef StInRange = assumeWithinInclusiveRange(State, Value, From,
-                                                           To, true);
+    ProgramStateRef StInRange =
+        assumeInclusiveRange(State, Value, From, To, true);
 
     // If StTrue is infeasible, asserting the falseness of Cond is unnecessary
     // because the existing constraints already establish this.
     if (!StInRange)
       return ProgramStatePair((ProgramStateRef)nullptr, State);
 
-    ProgramStateRef StOutOfRange = assumeWithinInclusiveRange(State, Value,
-                                                              From, To, false);
+    ProgramStateRef StOutOfRange =
+        assumeInclusiveRange(State, Value, From, To, false);
     if (!StOutOfRange) {
       // We are careful to return the original state, /not/ StTrue,
       // because we want to avoid having callers generate a new node
       // in the ExplodedGraph.
       return ProgramStatePair(State, (ProgramStateRef)nullptr);
     }
 
     return ProgramStatePair(StInRange, StOutOfRange);
virtual ProgramStateRef removeDeadBindings(ProgramStateRef state,
                                                  SymbolReaper& SymReaper) = 0;
 
   virtual void print(ProgramStateRef state,
                      raw_ostream &Out,
                      const char* nl,
                      const char *sep) = 0;
 
   virtual void EndPath(ProgramStateRef state) {}
-  
   /// Convenience method to query the state to see if a symbol is null or
   /// not null, or if neither assumption can be made.
   ConditionTruthVal isNull(ProgramStateRef State, SymbolRef Sym) {
     SaveAndRestore<bool> DisableNotify(NotifyAssumeClients, false);
 
     return checkNull(State, Sym);
   }
 
protected:
   /// canReasonAbout - Not all ConstraintManagers can accurately reason about
   ///  all SVal values.  This method returns true if the ConstraintManager can
   ///  reasonably handle a given SVal value.  This is typically queried by
   ///  ExprEngine to determine if the value should be replaced with a
   ///  conjured symbolic value in order to recover some precision.
   virtual bool canReasonAbout(SVal X) const = 0;
 
   /// Returns whether or not a symbol is known to be null ("true"), known to be
-  /// non-null ("false"), or may be either ("underconstrained"). 
+  /// non-null ("false"), or may be either ("underconstrained").
   virtual ConditionTruthVal checkNull(ProgramStateRef State, SymbolRef Sym);
 };
 
 std::unique_ptr<ConstraintManager>
 CreateRangeConstraintManager(ProgramStateManager &statemgr,
                              SubEngine *subengine);
 
 } // end GR namespace
 
 } // end clang namespace
 
 #endif

include/clang/StaticAnalyzer/Core/PathSensitive/ProgramState.h

private:
   ProgramStateRef makeWithStore(const StoreRef &store) const;
 
   void setStore(const StoreRef &storeRef);
 
 public:
   /// This ctor is used when creating the first ProgramState object.
   ProgramState(ProgramStateManager *mgr, const Environment& env,
           StoreRef st, GenericDataMap gdm);
-    
   /// Copy ctor - We must explicitly define this or else the "Next" ptr
   ///  in FoldingSetNode will also get copied.
   ProgramState(const ProgramState &RHS);
-  
   ~ProgramState();
 
   /// Return the ProgramStateManager associated with this state.
   ProgramStateManager &getStateManager() const {
     return *stateMgr;
   }
-  
   /// Return the ConstraintManager.
   ConstraintManager &getConstraintManager() const;
 
   /// getEnvironment - Return the environment associated with this state.
   ///  The environment is the mapping from expressions to values.
   const Environment& getEnvironment() const { return Env; }
 
   /// Return the store associated with this state.  The store
   ///  is a mapping from locations to values.
   Store getStore() const { return store; }
 
-  
   /// getGDM - Return the generic data map associated with this state.
   GenericDataMap getGDM() const { return GDM; }
 
   void setGDM(GenericDataMap gdm) { GDM = gdm; }
 
   /// Profile - Profile the contents of a ProgramState object for use in a
   ///  FoldingSet.  Two ProgramState objects are considered equal if they
   ///  have the same Environment, Store, and GenericDataMap.
ProgramStateRef assumeInBound(DefinedOrUnknownSVal idx,
                                QualType IndexType = QualType()) const;
 
   /// Assumes that the value of \p Val is bounded with [\p From; \p To]
   /// (if \p assumption is "true") or it is fully out of this range
   /// (if \p assumption is "false").
   ///
   /// This returns a new state with the added constraint on \p cond.
   /// If no new state is feasible, NULL is returned.
-  ProgramStateRef assumeWithinInclusiveRange(DefinedOrUnknownSVal Val,
-                                             const llvm::APSInt &From,
-                                             const llvm::APSInt &To,
-                                             bool assumption) const;
+  ProgramStateRef assumeInclusiveRange(DefinedOrUnknownSVal Val,
 
   /// Assumes given range both "true" and "false" for \p Val, and returns both
   /// corresponding states (respectively).
   ///
   /// This is more efficient than calling assume() twice. Note that one (but not
   /// both) of the returned states may be NULL.
   std::pair<ProgramStateRef, ProgramStateRef>
-  assumeWithinInclusiveRange(DefinedOrUnknownSVal Val, const llvm::APSInt &From,
-                             const llvm::APSInt &To) const;
+  assumeInclusiveRange(DefinedOrUnknownSVal Val, const llvm::APSInt &From,
 
-  
   /// \brief Check if the given SVal is constrained to zero or is a zero
   ///        constant.
   ConditionTruthVal isNull(SVal V) const;
-  
   /// Utility method for getting regions.
   const VarRegion* getRegion(const VarDecl *D, const LocationContext *LC) const;
 
   //==---------------------------------------------------------------------==//
   // Binding and retrieving values to/from the environment and symbolic store.
   //==---------------------------------------------------------------------==//
 
   /// Create a new state by binding the value 'V' to the statement 'S' in the
public:
   //         visited.
   /// \param CausesPointerEscape the flag is set to true when
   ///        the invalidation entails escape of a symbol (representing a
   ///        pointer). For example, due to it being passed as an argument in a
   ///        call.
   /// \param IS the set of invalidated symbols.
   /// \param Call if non-null, the invalidated regions represent parameters to
   ///        the call and should be considered directly invalidated.
-  /// \param ITraits information about special handling for a particular 
+  /// \param ITraits information about special handling for a particular
   ///        region/symbol.
   ProgramStateRef
   invalidateRegions(ArrayRef<const MemRegion *> Regions, const Expr *E,
                     unsigned BlockCount, const LocationContext *LCtx,
                     bool CausesPointerEscape, InvalidatedSymbols *IS = nullptr,
                     const CallEvent *Call = nullptr,
                     RegionAndSymbolInvalidationTraits *ITraits = nullptr) const;
 
   ProgramStateRef
   invalidateRegions(ArrayRef<SVal> Regions, const Expr *E,
                     unsigned BlockCount, const LocationContext *LCtx,
                     bool CausesPointerEscape, InvalidatedSymbols *IS = nullptr,
                     const CallEvent *Call = nullptr,
                     RegionAndSymbolInvalidationTraits *ITraits = nullptr) const;
 
   /// enterStackFrame - Returns the state for entry to the given stack frame,
   ///  preserving the current state.
   ProgramStateRef enterStackFrame(const CallEvent &Call,
                                   const StackFrameContext *CalleeCtx) const;
 
   /// Get the lvalue for a variable reference.
   Loc getLValue(const VarDecl *D, const LocationContext *LC) const;
 
-  Loc getLValue(const CompoundLiteralExpr *literal, 
+  Loc getLValue(const CompoundLiteralExpr *literal,
                 const LocationContext *LC) const;
 
   /// Get the lvalue for an ivar reference.
   SVal getLValue(const ObjCIvarDecl *decl, SVal base) const;
 
   /// Get the lvalue for a field reference.
   SVal getLValue(const FieldDecl *decl, SVal Base) const;
 
   /// Get the lvalue for an indirect field reference.
   SVal getLValue(const IndirectFieldDecl *decl, SVal Base) const;
 
   /// Get the lvalue for an array index.
   SVal getLValue(QualType ElementType, SVal Idx, SVal Base) const;
 
   /// Returns the SVal bound to the statement 'S' in the state's environment.
   SVal getSVal(const Stmt *S, const LocationContext *LCtx) const;
-  
   SVal getSValAsScalarOrLoc(const Stmt *Ex, const LocationContext *LCtx) const;
 
   /// \brief Return the value bound to the specified location.
   /// Returns UnknownVal() if none found.
   SVal getSVal(Loc LV, QualType T = QualType()) const;
 
   /// Returns the "raw" SVal bound to LV before any value simplfication.
   SVal getRawSVal(Loc LV, QualType T= QualType()) const;
 
   /// \brief Return the value bound to the specified location.
   /// Returns UnknownVal() if none found.
   SVal getSVal(const MemRegion* R) const;
 
   SVal getSValAsScalarOrLoc(const MemRegion *R) const;
-  
   /// \brief Visits the symbols reachable from the given SVal using the provided
   /// SymbolVisitor.
   ///
   /// This is a convenience API. Consider using ScanReachableSymbols class
   /// directly when making multiple scans on the same state with the same
   /// visitor to avoid repeated initialization cost.
   /// \sa ScanReachableSymbols
   bool scanReachableSymbols(SVal val, SymbolVisitor& visitor) const;
-  
   /// \brief Visits the symbols reachable from the SVals in the given range
   /// using the provided SymbolVisitor.
   bool scanReachableSymbols(const SVal *I, const SVal *E,
                             SymbolVisitor &visitor) const;
-  
   /// \brief Visits the symbols reachable from the regions in the given
   /// MemRegions range using the provided SymbolVisitor.
-  bool scanReachableSymbols(const MemRegion * const *I, 
+  bool scanReachableSymbols(const MemRegion * const *I,
                             const MemRegion * const *E,
                             SymbolVisitor &visitor) const;
 
   template <typename CB> CB scanReachableSymbols(SVal val) const;
   template <typename CB> CB scanReachableSymbols(const SVal *beg,
                                                  const SVal *end) const;
-  
   template <typename CB> CB
   scanReachableSymbols(const MemRegion * const *beg,
                        const MemRegion * const *end) const;
 
   /// Create a new state in which the statement is marked as tainted.
   ProgramStateRef addTaint(const Stmt *S, const LocationContext *LCtx,
                                TaintTagType Kind = TaintTagGeneric) const;
 
private:
   /// Object that manages the data for all created SVals.
   std::unique_ptr<SValBuilder> svalBuilder;
 
   /// Manages memory for created CallEvents.
   std::unique_ptr<CallEventManager> CallEventMgr;
 
   /// A BumpPtrAllocator to allocate states.
   llvm::BumpPtrAllocator &Alloc;
-  
   /// A vector of ProgramStates that we can reuse.
   std::vector<ProgramState *> freeStates;
 
 public:
   ProgramStateManager(ASTContext &Ctx,
                  StoreManagerCreator CreateStoreManager,
                  ConstraintManagerCreator CreateConstraintManager,
                  llvm::BumpPtrAllocator& alloc,

 
 //===----------------------------------------------------------------------===//
 // Out-of-line method definitions for ProgramState.
 //===----------------------------------------------------------------------===//
 
 inline ConstraintManager &ProgramState::getConstraintManager() const {
   return stateMgr->getConstraintManager();
 }
-  
 inline const VarRegion* ProgramState::getRegion(const VarDecl *D,
-                                                const LocationContext *LC) const 
+                                                const LocationContext *LC) const
 {
   return getStateManager().getRegionManager().getVarRegion(D, LC);
 }
 
 inline ProgramStateRef ProgramState::assume(DefinedOrUnknownSVal Cond,
                                       bool Assumption) const {
   if (Cond.isUnknown())
     return this;
 
   return getStateManager().ConstraintMgr
       ->assume(this, Cond.castAs<DefinedSVal>(), Assumption);
 }
-  
 inline std::pair<ProgramStateRef , ProgramStateRef >
 ProgramState::assume(DefinedOrUnknownSVal Cond) const {
   if (Cond.isUnknown())
     return std::make_pair(this, this);
 
   return getStateManager().ConstraintMgr
       ->assumeDual(this, Cond.castAs<DefinedSVal>());
 }
 
-inline ProgramStateRef
-ProgramState::assumeWithinInclusiveRange(DefinedOrUnknownSVal Val,
-                                         const llvm::APSInt &From,
-                                         const llvm::APSInt &To,
-                                         bool Assumption) const {
+inline ProgramStateRef ProgramState::assumeInclusiveRange(
+    DefinedOrUnknownSVal Val, const llvm::APSInt &From, const llvm::APSInt &To,
   if (Val.isUnknown())
     return this;
 
   assert(Val.getAs<NonLoc>() && "Only NonLocs are supported!");
 
-  return getStateManager().ConstraintMgr->assumeWithinInclusiveRange(
-        this, Val.castAs<NonLoc>(), From, To, Assumption);
+  return getStateManager().ConstraintMgr->assumeInclusiveRange(
 }
 
 inline std::pair<ProgramStateRef, ProgramStateRef>
-ProgramState::assumeWithinInclusiveRange(DefinedOrUnknownSVal Val,
-                                         const llvm::APSInt &From,
-                                         const llvm::APSInt &To) const {
+ProgramState::assumeInclusiveRange(DefinedOrUnknownSVal Val,
   if (Val.isUnknown())
     return std::make_pair(this, this);
 
   assert(Val.getAs<NonLoc>() && "Only NonLocs are supported!");
 
-  return getStateManager().ConstraintMgr
-      ->assumeWithinInclusiveRangeDual(this, Val.castAs<NonLoc>(), From, To);
+  return getStateManager().ConstraintMgr->assumeInclusiveRangeDual(
+      this, Val.castAs<NonLoc>(), From, To);
 }
 
 inline ProgramStateRef ProgramState::bindLoc(SVal LV, SVal V) const {
   if (Optional<Loc> L = LV.getAs<Loc>())
     return bindLoc(*L, V);
   return this;
 }
 

 }
 
 template <typename CB>
 CB ProgramState::scanReachableSymbols(SVal val) const {
   CB cb(this);
   scanReachableSymbols(val, cb);
   return cb;
 }
-  
 template <typename CB>
 CB ProgramState::scanReachableSymbols(const SVal *beg, const SVal *end) const {
   CB cb(this);
   scanReachableSymbols(beg, end, cb);
   return cb;
 }
 
 template <typename CB>

lib/StaticAnalyzer/Checkers/StdLibraryFunctionsChecker.cpp

ProgramStateRef StdLibraryFunctionsChecker::ValueRange::applyAsOutOfRange(
 
   if (auto N = V.getAs<NonLoc>()) {
     const IntRangeVectorTy &R = getRanges();
     size_t E = R.size();
     for (size_t I = 0; I != E; ++I) {
       const llvm::APSInt &Min = BVF.getValue(R[I].first, T);
       const llvm::APSInt &Max = BVF.getValue(R[I].second, T);
       assert(Min <= Max);
-      State = CM.assumeWithinInclusiveRange(State, *N, Min, Max, false);
+      State = CM.assumeInclusiveRange(State, *N, Min, Max, false);
       if (!State)
         break;
     }
   }
 
   return State;
 }
 
if (auto N = V.getAs<NonLoc>()) {
     size_t E = R.size();
 
     const llvm::APSInt &MinusInf = BVF.getMinValue(T);
     const llvm::APSInt &PlusInf = BVF.getMaxValue(T);
 
     const llvm::APSInt &Left = BVF.getValue(R[0].first - 1ULL, T);
     if (Left != PlusInf) {
       assert(MinusInf <= Left);
-      State = CM.assumeWithinInclusiveRange(State, *N, MinusInf, Left, false);
+      State = CM.assumeInclusiveRange(State, *N, MinusInf, Left, false);
       if (!State)
         return nullptr;
     }
 
     const llvm::APSInt &Right = BVF.getValue(R[E - 1].second + 1ULL, T);
     if (Right != MinusInf) {
       assert(Right <= PlusInf);
-      State = CM.assumeWithinInclusiveRange(State, *N, Right, PlusInf, false);
+      State = CM.assumeInclusiveRange(State, *N, Right, PlusInf, false);
       if (!State)
         return nullptr;
     }
 
     for (size_t I = 1; I != E; ++I) {
       const llvm::APSInt &Min = BVF.getValue(R[I - 1].second + 1ULL, T);
       const llvm::APSInt &Max = BVF.getValue(R[I].first - 1ULL, T);
       assert(Min <= Max);
-      State = CM.assumeWithinInclusiveRange(State, *N, Min, Max, false);
+      State = CM.assumeInclusiveRange(State, *N, Min, Max, false);
       if (!State)
         return nullptr;
     }
   }
 
   return State;
 }
 

lib/StaticAnalyzer/Core/ExprEngine.cpp

for ( ; I != EI; ++I) {
     if (const Expr *E = Case->getRHS())
       V2 = E->EvaluateKnownConstInt(getContext());
     else
       V2 = V1;
 
     ProgramStateRef StateCase;
     if (Optional<NonLoc> NL = CondV.getAs<NonLoc>())
       std::tie(StateCase, DefaultSt) =
-          DefaultSt->assumeWithinInclusiveRange(*NL, V1, V2);
+          DefaultSt->assumeInclusiveRange(*NL, V1, V2);
     else // UnknownVal
       StateCase = DefaultSt;
 
     if (StateCase)
       builder.generateCaseStmtNode(I, StateCase);
 
     // Now "assume" that the case doesn't match.  Add this state
     // to the default state (if it is feasible).

lib/StaticAnalyzer/Core/SimpleConstraintManager.h

public:
   // Common implementation for the interface provided by ConstraintManager.
   //===------------------------------------------------------------------===//
 
   ProgramStateRef assume(ProgramStateRef state, DefinedSVal Cond,
                         bool Assumption) override;
 
   ProgramStateRef assume(ProgramStateRef state, NonLoc Cond, bool Assumption);
 
-  ProgramStateRef assumeWithinInclusiveRange(ProgramStateRef State,
+  ProgramStateRef assumeInclusiveRange(ProgramStateRef State,
                                              NonLoc Value,
                                              const llvm::APSInt &From,
                                              const llvm::APSInt &To,
                                              bool InRange) override;
 
   ProgramStateRef assumeSymRel(ProgramStateRef state,
                               const SymExpr *LHS,
                               BinaryOperator::Opcode op,

lib/StaticAnalyzer/Core/SimpleConstraintManager.cpp

ProgramStateRef SimpleConstraintManager::assumeAux(ProgramStateRef state,
   }
 
   case nonloc::LocAsIntegerKind:
     return assume(state, Cond.castAs<nonloc::LocAsInteger>().getLoc(),
                   Assumption);
   } // end switch
 }
 
-ProgramStateRef SimpleConstraintManager::assumeWithinInclusiveRange(
+ProgramStateRef SimpleConstraintManager::assumeInclusiveRange(
     ProgramStateRef State, NonLoc Value, const llvm::APSInt &From,
     const llvm::APSInt &To, bool InRange) {
 
   assert(From.isUnsigned() == To.isUnsigned() &&
          From.getBitWidth() == To.getBitWidth() &&
          "Values should have same types!");
 
   if (!canReasonAbout(Value)) {
     // Just add the constraint to the expression without trying to simplify.
     SymbolRef Sym = Value.getAsSymExpr();
     assert(Sym);
     return assumeSymWithinInclusiveRange(State, Sym, From, To, InRange);
   }
 
   switch (Value.getSubKind()) {
   default:
-    llvm_unreachable("'assumeWithinInclusiveRange' is not implemented"
+    llvm_unreachable("'assumeInclusiveRange' is not implemented"
                      "for this NonLoc");
 
   case nonloc::LocAsIntegerKind:
   case nonloc::SymbolValKind: {
     if (SymbolRef Sym = Value.getAsSymbol())
       return assumeSymWithinInclusiveRange(State, Sym, From, To, InRange);
     return State;
   } // end switch