Skip to content

Commit fa68972

Browse files
committed
[dataflow] document flow condition
There's some documentation of this concept at https://clang.llvm.org/docs/DataFlowAnalysisIntro.html but it would be nice to have it closer to the code. I also was laboring under an obvious but wrong mental model that the flow condition token represented "execution reached this point", I'd like to explicitly call that out as wrong. Differential Revision: https://reviews.llvm.org/D154969
1 parent 0bcef1d commit fa68972

File tree

1 file changed

+19
-4
lines changed

1 file changed

+19
-4
lines changed

clang/include/clang/Analysis/FlowSensitive/DataflowEnvironment.h

Lines changed: 19 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@
2222
#include "clang/Analysis/FlowSensitive/ControlFlowContext.h"
2323
#include "clang/Analysis/FlowSensitive/DataflowAnalysisContext.h"
2424
#include "clang/Analysis/FlowSensitive/DataflowLattice.h"
25+
#include "clang/Analysis/FlowSensitive/Formula.h"
2526
#include "clang/Analysis/FlowSensitive/Logger.h"
2627
#include "clang/Analysis/FlowSensitive/StorageLocation.h"
2728
#include "clang/Analysis/FlowSensitive/Value.h"
@@ -524,16 +525,30 @@ class Environment {
524525
arena().makeEquals(LHS.formula(), RHS.formula()));
525526
}
526527

527-
/// Returns the token that identifies the flow condition of the environment.
528+
/// Returns a boolean variable that identifies the flow condition (FC).
529+
///
530+
/// The flow condition is a set of facts that are necessarily true when the
531+
/// program reaches the current point, expressed as boolean formulas.
532+
/// The flow condition token is equivalent to the AND of these facts.
533+
///
534+
/// These may e.g. constrain the value of certain variables. A pointer
535+
/// variable may have a consistent modeled PointerValue throughout, but at a
536+
/// given point the Environment may tell us that the value must be non-null.
537+
///
538+
/// The FC is necessary but not sufficient for this point to be reachable.
539+
/// In particular, where the FC token appears in flow conditions of successor
540+
/// environments, it means "point X may have been reached", not
541+
/// "point X was reached".
528542
Atom getFlowConditionToken() const { return FlowConditionToken; }
529543

530-
/// Adds `Val` to the set of clauses that constitute the flow condition.
544+
/// Record a fact that must be true if this point in the program is reached.
531545
void addToFlowCondition(const Formula &);
532546
/// Deprecated: Use Formula version instead.
533547
void addToFlowCondition(BoolValue &Val);
534548

535-
/// Returns true if and only if the clauses that constitute the flow condition
536-
/// imply that `Val` is true.
549+
/// Returns true if the formula is always true when this point is reached.
550+
/// Returns false if the formula may be false, or if the flow condition isn't
551+
/// sufficiently precise to prove that it is true.
537552
bool flowConditionImplies(const Formula &) const;
538553
/// Deprecated: Use Formula version instead.
539554
bool flowConditionImplies(BoolValue &Val) const;

0 commit comments

Comments
 (0)