#include <store.h>

Collaboration diagram for ana::uncertainty_t:

[legend]

Public Types
typedef hash_set< constsvalue * >::iterator	iterator

Public Member Functions
void	on_maybe_bound_sval (const svalue *sval)

void	on_mutable_sval_at_unknown_call (const svalue *sval)

bool	unknown_sm_state_p (const svalue *sval)

void	dump_to_pp (pretty_printer *pp, bool simple) const

void	dump (bool simple) const

iterator	begin_maybe_bound_svals () const

iterator	end_maybe_bound_svals () const

Private Attributes
hash_set< const svalue * >	m_maybe_bound_svals

hash_set< const svalue * >	m_mutable_at_unknown_call_svals

Detailed Description

A class for keeping track of aspects of a program_state that we don't
know about, to avoid false positives about leaks.

Consider:

   p->field = malloc (1024);
   q->field = NULL;

where we don't know whether or not p and q point to the same memory,
and:

   p->field = malloc (1024);
   unknown_fn (p);

In both cases, the svalue for the address of the allocated buffer
goes from being bound to p->field to not having anything explicitly bound
to it.

Given that we conservatively discard bindings due to possible aliasing or
calls to unknown function, the store loses references to svalues,
but these svalues could still be live.  We don't want to warn about
them leaking - they're effectively in a "maybe live" state.

This "maybe live" information is somewhat transient.

We don't want to store this "maybe live" information in the program_state,
region_model, or store, since we don't want to bloat these objects (and
potentially bloat the exploded_graph with more nodes).
However, we can't store it in the region_model_context, as these context
objects sometimes don't last long enough to be around when comparing the
old vs the new state.

This class is a way to track a set of such svalues, so that we can
temporarily capture that they are in a "maybe live" state whilst
comparing old and new states.