ExprEngineCallAndReturn.cpp revision 3a0a9e3e8bbaa45f3ca22b1e20b3beaac0f5861e
1294fd0a62b95f512637910bf85c7efa6c2354b50Ted Kremenek//=-- ExprEngineCallAndReturn.cpp - Support for call/return -----*- C++ -*-===//
2294fd0a62b95f512637910bf85c7efa6c2354b50Ted Kremenek//
3294fd0a62b95f512637910bf85c7efa6c2354b50Ted Kremenek//                     The LLVM Compiler Infrastructure
4294fd0a62b95f512637910bf85c7efa6c2354b50Ted Kremenek//
5294fd0a62b95f512637910bf85c7efa6c2354b50Ted Kremenek// This file is distributed under the University of Illinois Open Source
6294fd0a62b95f512637910bf85c7efa6c2354b50Ted Kremenek// License. See LICENSE.TXT for details.
7294fd0a62b95f512637910bf85c7efa6c2354b50Ted Kremenek//
8294fd0a62b95f512637910bf85c7efa6c2354b50Ted Kremenek//===----------------------------------------------------------------------===//
9294fd0a62b95f512637910bf85c7efa6c2354b50Ted Kremenek//
10294fd0a62b95f512637910bf85c7efa6c2354b50Ted Kremenek//  This file defines ExprEngine's support for calls and returns.
11294fd0a62b95f512637910bf85c7efa6c2354b50Ted Kremenek//
12294fd0a62b95f512637910bf85c7efa6c2354b50Ted Kremenek//===----------------------------------------------------------------------===//
13294fd0a62b95f512637910bf85c7efa6c2354b50Ted Kremenek
14d4aeb8050a1d0fe47c53a73361c8b0b8ac310f46Ted Kremenek#include "clang/Analysis/Analyses/LiveVariables.h"
15294fd0a62b95f512637910bf85c7efa6c2354b50Ted Kremenek#include "clang/StaticAnalyzer/Core/CheckerManager.h"
16294fd0a62b95f512637910bf85c7efa6c2354b50Ted Kremenek#include "clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h"
17740d490593e0de8732a697c9f77b90ddd463863bJordan Rose#include "clang/StaticAnalyzer/Core/PathSensitive/Calls.h"
18294fd0a62b95f512637910bf85c7efa6c2354b50Ted Kremenek#include "clang/AST/DeclCXX.h"
194a5f724538cbc275370c9504e8169ce92503256cBenjamin Kramer#include "llvm/ADT/SmallSet.h"
204a5f724538cbc275370c9504e8169ce92503256cBenjamin Kramer#include "llvm/Support/SaveAndRestore.h"
21294fd0a62b95f512637910bf85c7efa6c2354b50Ted Kremenek
22294fd0a62b95f512637910bf85c7efa6c2354b50Ted Kremenekusing namespace clang;
23294fd0a62b95f512637910bf85c7efa6c2354b50Ted Kremenekusing namespace ento;
24294fd0a62b95f512637910bf85c7efa6c2354b50Ted Kremenek
25fdaa33818cf9bad8d092136e73bd2e489cb821baJordan Rosestatic CallEventKind classifyCallExpr(const CallExpr *CE) {
26fdaa33818cf9bad8d092136e73bd2e489cb821baJordan Rose  if (isa<CXXMemberCallExpr>(CE))
27fdaa33818cf9bad8d092136e73bd2e489cb821baJordan Rose    return CE_CXXMember;
28fdaa33818cf9bad8d092136e73bd2e489cb821baJordan Rose
29fdaa33818cf9bad8d092136e73bd2e489cb821baJordan Rose  const CXXOperatorCallExpr *OpCE = dyn_cast<CXXOperatorCallExpr>(CE);
30fdaa33818cf9bad8d092136e73bd2e489cb821baJordan Rose  if (OpCE) {
31fdaa33818cf9bad8d092136e73bd2e489cb821baJordan Rose    const FunctionDecl *DirectCallee = CE->getDirectCallee();
32fdaa33818cf9bad8d092136e73bd2e489cb821baJordan Rose    if (const CXXMethodDecl *MD = dyn_cast<CXXMethodDecl>(DirectCallee))
33fdaa33818cf9bad8d092136e73bd2e489cb821baJordan Rose      if (MD->isInstance())
34fdaa33818cf9bad8d092136e73bd2e489cb821baJordan Rose        return CE_CXXMemberOperator;
35fdaa33818cf9bad8d092136e73bd2e489cb821baJordan Rose  } else if (CE->getCallee()->getType()->isBlockPointerType()) {
36fdaa33818cf9bad8d092136e73bd2e489cb821baJordan Rose    return CE_Block;
37fdaa33818cf9bad8d092136e73bd2e489cb821baJordan Rose  }
38fdaa33818cf9bad8d092136e73bd2e489cb821baJordan Rose
39fdaa33818cf9bad8d092136e73bd2e489cb821baJordan Rose  return CE_Function;
40fdaa33818cf9bad8d092136e73bd2e489cb821baJordan Rose}
41fdaa33818cf9bad8d092136e73bd2e489cb821baJordan Rose
423070e13dca5bbefa32acb80ce4a7b217a6220983Ted Kremenekvoid ExprEngine::processCallEnter(CallEnter CE, ExplodedNode *Pred) {
433070e13dca5bbefa32acb80ce4a7b217a6220983Ted Kremenek  // Get the entry block in the CFG of the callee.
440849ade4bb3e90c2fc0ce01ccd330f76f91da732Ted Kremenek  const StackFrameContext *calleeCtx = CE.getCalleeContext();
450849ade4bb3e90c2fc0ce01ccd330f76f91da732Ted Kremenek  const CFG *CalleeCFG = calleeCtx->getCFG();
463070e13dca5bbefa32acb80ce4a7b217a6220983Ted Kremenek  const CFGBlock *Entry = &(CalleeCFG->getEntry());
473070e13dca5bbefa32acb80ce4a7b217a6220983Ted Kremenek
483070e13dca5bbefa32acb80ce4a7b217a6220983Ted Kremenek  // Validate the CFG.
493070e13dca5bbefa32acb80ce4a7b217a6220983Ted Kremenek  assert(Entry->empty());
503070e13dca5bbefa32acb80ce4a7b217a6220983Ted Kremenek  assert(Entry->succ_size() == 1);
513070e13dca5bbefa32acb80ce4a7b217a6220983Ted Kremenek
523070e13dca5bbefa32acb80ce4a7b217a6220983Ted Kremenek  // Get the solitary sucessor.
533070e13dca5bbefa32acb80ce4a7b217a6220983Ted Kremenek  const CFGBlock *Succ = *(Entry->succ_begin());
543070e13dca5bbefa32acb80ce4a7b217a6220983Ted Kremenek
553070e13dca5bbefa32acb80ce4a7b217a6220983Ted Kremenek  // Construct an edge representing the starting location in the callee.
560849ade4bb3e90c2fc0ce01ccd330f76f91da732Ted Kremenek  BlockEdge Loc(Entry, Succ, calleeCtx);
573070e13dca5bbefa32acb80ce4a7b217a6220983Ted Kremenek
58e54cfc7b9990acffd0a8a4ba381717b4bb9f3011Jordan Rose  ProgramStateRef state = Pred->getState();
593070e13dca5bbefa32acb80ce4a7b217a6220983Ted Kremenek
603070e13dca5bbefa32acb80ce4a7b217a6220983Ted Kremenek  // Construct a new node and add it to the worklist.
613070e13dca5bbefa32acb80ce4a7b217a6220983Ted Kremenek  bool isNew;
623070e13dca5bbefa32acb80ce4a7b217a6220983Ted Kremenek  ExplodedNode *Node = G.getNode(Loc, state, false, &isNew);
633070e13dca5bbefa32acb80ce4a7b217a6220983Ted Kremenek  Node->addPredecessor(Pred, G);
643070e13dca5bbefa32acb80ce4a7b217a6220983Ted Kremenek  if (isNew)
653070e13dca5bbefa32acb80ce4a7b217a6220983Ted Kremenek    Engine.getWorkList()->enqueue(Node);
66294fd0a62b95f512637910bf85c7efa6c2354b50Ted Kremenek}
67294fd0a62b95f512637910bf85c7efa6c2354b50Ted Kremenek
680b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks// Find the last statement on the path to the exploded node and the
690b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks// corresponding Block.
700b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaksstatic std::pair<const Stmt*,
710b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks                 const CFGBlock*> getLastStmt(const ExplodedNode *Node) {
720b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks  const Stmt *S = 0;
730b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks  const StackFrameContext *SF =
740b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks          Node->getLocation().getLocationContext()->getCurrentStackFrame();
75888c90ac0ef6baf7d47e86cf5cc4715707d223b1Jordan Rose
76888c90ac0ef6baf7d47e86cf5cc4715707d223b1Jordan Rose  // Back up through the ExplodedGraph until we reach a statement node.
77256ef642f8feef22fd53be7efa868e8e34752eedTed Kremenek  while (Node) {
78256ef642f8feef22fd53be7efa868e8e34752eedTed Kremenek    const ProgramPoint &PP = Node->getLocation();
79888c90ac0ef6baf7d47e86cf5cc4715707d223b1Jordan Rose
80256ef642f8feef22fd53be7efa868e8e34752eedTed Kremenek    if (const StmtPoint *SP = dyn_cast<StmtPoint>(&PP)) {
810b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks      S = SP->getStmt();
820b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks      break;
83888c90ac0ef6baf7d47e86cf5cc4715707d223b1Jordan Rose    } else if (const CallExitEnd *CEE = dyn_cast<CallExitEnd>(&PP)) {
84888c90ac0ef6baf7d47e86cf5cc4715707d223b1Jordan Rose      S = CEE->getCalleeContext()->getCallSite();
85888c90ac0ef6baf7d47e86cf5cc4715707d223b1Jordan Rose      if (S)
86888c90ac0ef6baf7d47e86cf5cc4715707d223b1Jordan Rose        break;
87888c90ac0ef6baf7d47e86cf5cc4715707d223b1Jordan Rose      // If we have an implicit call, we'll probably end up with a
88888c90ac0ef6baf7d47e86cf5cc4715707d223b1Jordan Rose      // StmtPoint inside the callee, which is acceptable.
89888c90ac0ef6baf7d47e86cf5cc4715707d223b1Jordan Rose      // (It's possible a function ONLY contains implicit calls -- such as an
90888c90ac0ef6baf7d47e86cf5cc4715707d223b1Jordan Rose      // implicitly-generated destructor -- so we shouldn't just skip back to
91888c90ac0ef6baf7d47e86cf5cc4715707d223b1Jordan Rose      // the CallEnter node and keep going.)
92888c90ac0ef6baf7d47e86cf5cc4715707d223b1Jordan Rose    } else if (const CallEnter *CE = dyn_cast<CallEnter>(&PP)) {
93888c90ac0ef6baf7d47e86cf5cc4715707d223b1Jordan Rose      // If we reached the CallEnter for this function, it has no statements.
94888c90ac0ef6baf7d47e86cf5cc4715707d223b1Jordan Rose      if (CE->getCalleeContext() == SF)
95888c90ac0ef6baf7d47e86cf5cc4715707d223b1Jordan Rose        break;
96256ef642f8feef22fd53be7efa868e8e34752eedTed Kremenek    }
97888c90ac0ef6baf7d47e86cf5cc4715707d223b1Jordan Rose
98888c90ac0ef6baf7d47e86cf5cc4715707d223b1Jordan Rose    Node = *Node->pred_begin();
99256ef642f8feef22fd53be7efa868e8e34752eedTed Kremenek  }
100888c90ac0ef6baf7d47e86cf5cc4715707d223b1Jordan Rose
101888c90ac0ef6baf7d47e86cf5cc4715707d223b1Jordan Rose  const CFGBlock *Blk = 0;
102888c90ac0ef6baf7d47e86cf5cc4715707d223b1Jordan Rose  if (S) {
103888c90ac0ef6baf7d47e86cf5cc4715707d223b1Jordan Rose    // Now, get the enclosing basic block.
104888c90ac0ef6baf7d47e86cf5cc4715707d223b1Jordan Rose    while (Node && Node->pred_size() >=1 ) {
105888c90ac0ef6baf7d47e86cf5cc4715707d223b1Jordan Rose      const ProgramPoint &PP = Node->getLocation();
106888c90ac0ef6baf7d47e86cf5cc4715707d223b1Jordan Rose      if (isa<BlockEdge>(PP) &&
107888c90ac0ef6baf7d47e86cf5cc4715707d223b1Jordan Rose          (PP.getLocationContext()->getCurrentStackFrame() == SF)) {
108888c90ac0ef6baf7d47e86cf5cc4715707d223b1Jordan Rose        BlockEdge &EPP = cast<BlockEdge>(PP);
109888c90ac0ef6baf7d47e86cf5cc4715707d223b1Jordan Rose        Blk = EPP.getDst();
110888c90ac0ef6baf7d47e86cf5cc4715707d223b1Jordan Rose        break;
111888c90ac0ef6baf7d47e86cf5cc4715707d223b1Jordan Rose      }
112888c90ac0ef6baf7d47e86cf5cc4715707d223b1Jordan Rose      Node = *Node->pred_begin();
113888c90ac0ef6baf7d47e86cf5cc4715707d223b1Jordan Rose    }
114888c90ac0ef6baf7d47e86cf5cc4715707d223b1Jordan Rose  }
115888c90ac0ef6baf7d47e86cf5cc4715707d223b1Jordan Rose
1160b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks  return std::pair<const Stmt*, const CFGBlock*>(S, Blk);
117256ef642f8feef22fd53be7efa868e8e34752eedTed Kremenek}
118256ef642f8feef22fd53be7efa868e8e34752eedTed Kremenek
1190b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks/// The call exit is simulated with a sequence of nodes, which occur between
1200b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks/// CallExitBegin and CallExitEnd. The following operations occur between the
1210b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks/// two program points:
1220b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks/// 1. CallExitBegin (triggers the start of call exit sequence)
1230b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks/// 2. Bind the return value
1240b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks/// 3. Run Remove dead bindings to clean up the dead symbols from the callee.
1250b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks/// 4. CallExitEnd (switch to the caller context)
1260b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks/// 5. PostStmt<CallExpr>
1270b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaksvoid ExprEngine::processCallExit(ExplodedNode *CEBNode) {
1280b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks  // Step 1 CEBNode was generated before the call.
1290b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks
1300b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks  const StackFrameContext *calleeCtx =
1310b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks      CEBNode->getLocationContext()->getCurrentStackFrame();
1327fa9b4f258636d89342eda28f21a986c8ac353b1Ted Kremenek
1337fa9b4f258636d89342eda28f21a986c8ac353b1Ted Kremenek  // The parent context might not be a stack frame, so make sure we
1347fa9b4f258636d89342eda28f21a986c8ac353b1Ted Kremenek  // look up the first enclosing stack frame.
1357fa9b4f258636d89342eda28f21a986c8ac353b1Ted Kremenek  const StackFrameContext *callerCtx =
1367fa9b4f258636d89342eda28f21a986c8ac353b1Ted Kremenek    calleeCtx->getParent()->getCurrentStackFrame();
1377fa9b4f258636d89342eda28f21a986c8ac353b1Ted Kremenek
138294fd0a62b95f512637910bf85c7efa6c2354b50Ted Kremenek  const Stmt *CE = calleeCtx->getCallSite();
1390b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks  ProgramStateRef state = CEBNode->getState();
1400b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks  // Find the last statement in the function and the corresponding basic block.
1410b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks  const Stmt *LastSt = 0;
1420b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks  const CFGBlock *Blk = 0;
1430b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks  llvm::tie(LastSt, Blk) = getLastStmt(CEBNode);
1440b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks
145852aa0d2c5d2d1faf2d77b5aa3c0848068a342c5Jordan Rose  // Step 2: generate node with bound return value: CEBNode -> BindedRetNode.
1460b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks
147294fd0a62b95f512637910bf85c7efa6c2354b50Ted Kremenek  // If the callee returns an expression, bind its value to CallExpr.
148852aa0d2c5d2d1faf2d77b5aa3c0848068a342c5Jordan Rose  if (CE) {
149852aa0d2c5d2d1faf2d77b5aa3c0848068a342c5Jordan Rose    if (const ReturnStmt *RS = dyn_cast_or_null<ReturnStmt>(LastSt)) {
150852aa0d2c5d2d1faf2d77b5aa3c0848068a342c5Jordan Rose      const LocationContext *LCtx = CEBNode->getLocationContext();
151852aa0d2c5d2d1faf2d77b5aa3c0848068a342c5Jordan Rose      SVal V = state->getSVal(RS, LCtx);
15248b6247804eacc262cc5508e0fbb74ed819fbb6eJordan Rose      state = state->BindExpr(CE, calleeCtx->getParent(), V);
153852aa0d2c5d2d1faf2d77b5aa3c0848068a342c5Jordan Rose    }
1540b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks
155852aa0d2c5d2d1faf2d77b5aa3c0848068a342c5Jordan Rose    // Bind the constructed object value to CXXConstructExpr.
156852aa0d2c5d2d1faf2d77b5aa3c0848068a342c5Jordan Rose    if (const CXXConstructExpr *CCE = dyn_cast<CXXConstructExpr>(CE)) {
157852aa0d2c5d2d1faf2d77b5aa3c0848068a342c5Jordan Rose      loc::MemRegionVal This =
158852aa0d2c5d2d1faf2d77b5aa3c0848068a342c5Jordan Rose        svalBuilder.getCXXThis(CCE->getConstructor()->getParent(), calleeCtx);
159852aa0d2c5d2d1faf2d77b5aa3c0848068a342c5Jordan Rose      SVal ThisV = state->getSVal(This);
1600b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks
161852aa0d2c5d2d1faf2d77b5aa3c0848068a342c5Jordan Rose      // Always bind the region to the CXXConstructExpr.
16248b6247804eacc262cc5508e0fbb74ed819fbb6eJordan Rose      state = state->BindExpr(CCE, calleeCtx->getParent(), ThisV);
163852aa0d2c5d2d1faf2d77b5aa3c0848068a342c5Jordan Rose    }
164294fd0a62b95f512637910bf85c7efa6c2354b50Ted Kremenek  }
1650b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks
1660b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks  // Step 3: BindedRetNode -> CleanedNodes
1670b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks  // If we can find a statement and a block in the inlined function, run remove
1680b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks  // dead bindings before returning from the call. This is important to ensure
1690b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks  // that we report the issues such as leaks in the stack contexts in which
1700b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks  // they occurred.
1710b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks  ExplodedNodeSet CleanedNodes;
1720b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks  if (LastSt && Blk) {
17348b6247804eacc262cc5508e0fbb74ed819fbb6eJordan Rose    static SimpleProgramPointTag retValBind("ExprEngine : Bind Return Value");
17448b6247804eacc262cc5508e0fbb74ed819fbb6eJordan Rose    PostStmt Loc(LastSt, calleeCtx, &retValBind);
17548b6247804eacc262cc5508e0fbb74ed819fbb6eJordan Rose    bool isNew;
17648b6247804eacc262cc5508e0fbb74ed819fbb6eJordan Rose    ExplodedNode *BindedRetNode = G.getNode(Loc, state, false, &isNew);
17748b6247804eacc262cc5508e0fbb74ed819fbb6eJordan Rose    BindedRetNode->addPredecessor(CEBNode, G);
17848b6247804eacc262cc5508e0fbb74ed819fbb6eJordan Rose    if (!isNew)
17948b6247804eacc262cc5508e0fbb74ed819fbb6eJordan Rose      return;
18048b6247804eacc262cc5508e0fbb74ed819fbb6eJordan Rose
1810b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks    NodeBuilderContext Ctx(getCoreEngine(), Blk, BindedRetNode);
1820b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks    currentBuilderContext = &Ctx;
1830b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks    // Here, we call the Symbol Reaper with 0 statement and caller location
1840b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks    // context, telling it to clean up everything in the callee's context
1850b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks    // (and it's children). We use LastStmt as a diagnostic statement, which
1860b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks    // which the PreStmtPurge Dead point will be associated.
1870b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks    removeDead(BindedRetNode, CleanedNodes, 0, callerCtx, LastSt,
1880b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks               ProgramPoint::PostStmtPurgeDeadSymbolsKind);
1890b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks    currentBuilderContext = 0;
190144e52be486a3906aec90c51b0ac94a30313152eAnna Zaks  } else {
191144e52be486a3906aec90c51b0ac94a30313152eAnna Zaks    CleanedNodes.Add(CEBNode);
1920b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks  }
1930b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks
1940b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks  for (ExplodedNodeSet::iterator I = CleanedNodes.begin(),
1950b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks                                 E = CleanedNodes.end(); I != E; ++I) {
1960b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks
1970b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks    // Step 4: Generate the CallExit and leave the callee's context.
1980b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks    // CleanedNodes -> CEENode
199852aa0d2c5d2d1faf2d77b5aa3c0848068a342c5Jordan Rose    CallExitEnd Loc(calleeCtx, callerCtx);
2000b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks    bool isNew;
20148b6247804eacc262cc5508e0fbb74ed819fbb6eJordan Rose    ProgramStateRef CEEState = (*I == CEBNode) ? state : (*I)->getState();
20248b6247804eacc262cc5508e0fbb74ed819fbb6eJordan Rose    ExplodedNode *CEENode = G.getNode(Loc, CEEState, false, &isNew);
2030b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks    CEENode->addPredecessor(*I, G);
2040b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks    if (!isNew)
2050b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks      return;
2060b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks
2070b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks    // Step 5: Perform the post-condition check of the CallExpr and enqueue the
2080b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks    // result onto the work list.
2090b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks    // CEENode -> Dst -> WorkList
2100b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks    ExplodedNodeSet Dst;
2110b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks    NodeBuilderContext Ctx(Engine, calleeCtx->getCallSiteBlock(), CEENode);
2120b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks    SaveAndRestore<const NodeBuilderContext*> NBCSave(currentBuilderContext,
2130b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks        &Ctx);
2140b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks    SaveAndRestore<unsigned> CBISave(currentStmtIdx, calleeCtx->getIndex());
2150b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks
216852aa0d2c5d2d1faf2d77b5aa3c0848068a342c5Jordan Rose    // FIXME: This needs to call PostCall.
21748b6247804eacc262cc5508e0fbb74ed819fbb6eJordan Rose    // FIXME: If/when we inline Objective-C messages, this also needs to call
21848b6247804eacc262cc5508e0fbb74ed819fbb6eJordan Rose    // PostObjCMessage.
219852aa0d2c5d2d1faf2d77b5aa3c0848068a342c5Jordan Rose    if (CE)
220852aa0d2c5d2d1faf2d77b5aa3c0848068a342c5Jordan Rose      getCheckerManager().runCheckersForPostStmt(Dst, CEENode, CE, *this, true);
22148b6247804eacc262cc5508e0fbb74ed819fbb6eJordan Rose    else
22248b6247804eacc262cc5508e0fbb74ed819fbb6eJordan Rose      Dst.Add(CEENode);
2230b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks
2240b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks    // Enqueue the next element in the block.
2250b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks    for (ExplodedNodeSet::iterator PSI = Dst.begin(), PSE = Dst.end();
2260b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks                                   PSI != PSE; ++PSI) {
2270b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks      Engine.getWorkList()->enqueue(*PSI, calleeCtx->getCallSiteBlock(),
2280b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks                                    calleeCtx->getIndex()+1);
2290b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks    }
230242384ddb0e0b65dd7e9e0ac0cf3c31cf98b06a6Ted Kremenek  }
231294fd0a62b95f512637910bf85c7efa6c2354b50Ted Kremenek}
232294fd0a62b95f512637910bf85c7efa6c2354b50Ted Kremenek
2330849ade4bb3e90c2fc0ce01ccd330f76f91da732Ted Kremenekstatic unsigned getNumberStackFrames(const LocationContext *LCtx) {
2340849ade4bb3e90c2fc0ce01ccd330f76f91da732Ted Kremenek  unsigned count = 0;
2350849ade4bb3e90c2fc0ce01ccd330f76f91da732Ted Kremenek  while (LCtx) {
2360849ade4bb3e90c2fc0ce01ccd330f76f91da732Ted Kremenek    if (isa<StackFrameContext>(LCtx))
2370849ade4bb3e90c2fc0ce01ccd330f76f91da732Ted Kremenek      ++count;
2380849ade4bb3e90c2fc0ce01ccd330f76f91da732Ted Kremenek    LCtx = LCtx->getParent();
2390849ade4bb3e90c2fc0ce01ccd330f76f91da732Ted Kremenek  }
2400849ade4bb3e90c2fc0ce01ccd330f76f91da732Ted Kremenek  return count;
2410849ade4bb3e90c2fc0ce01ccd330f76f91da732Ted Kremenek}
2420849ade4bb3e90c2fc0ce01ccd330f76f91da732Ted Kremenek
2436cc0969ab37c614d6cf496f2ed6d2fca397a0133Anna Zaks// Determine if we should inline the call.
2447fa9b4f258636d89342eda28f21a986c8ac353b1Ted Kremenekbool ExprEngine::shouldInlineDecl(const Decl *D, ExplodedNode *Pred) {
2457fa9b4f258636d89342eda28f21a986c8ac353b1Ted Kremenek  AnalysisDeclContext *CalleeADC = AMgr.getAnalysisDeclContext(D);
2466cc0969ab37c614d6cf496f2ed6d2fca397a0133Anna Zaks  const CFG *CalleeCFG = CalleeADC->getCFG();
2476cc0969ab37c614d6cf496f2ed6d2fca397a0133Anna Zaks
24801561d1039bfdda61edd20eed939011a8632c7c7Ted Kremenek  // It is possible that the CFG cannot be constructed.
24901561d1039bfdda61edd20eed939011a8632c7c7Ted Kremenek  // Be safe, and check if the CalleeCFG is valid.
25001561d1039bfdda61edd20eed939011a8632c7c7Ted Kremenek  if (!CalleeCFG)
25101561d1039bfdda61edd20eed939011a8632c7c7Ted Kremenek    return false;
25201561d1039bfdda61edd20eed939011a8632c7c7Ted Kremenek
2536cc0969ab37c614d6cf496f2ed6d2fca397a0133Anna Zaks  if (getNumberStackFrames(Pred->getLocationContext())
2546cc0969ab37c614d6cf496f2ed6d2fca397a0133Anna Zaks        == AMgr.InlineMaxStackDepth)
2556cc0969ab37c614d6cf496f2ed6d2fca397a0133Anna Zaks    return false;
2566cc0969ab37c614d6cf496f2ed6d2fca397a0133Anna Zaks
2577fa9b4f258636d89342eda28f21a986c8ac353b1Ted Kremenek  if (Engine.FunctionSummaries->hasReachedMaxBlockCount(D))
2583bbd8cd831788c506f2980293eb3c7e1b3ca2501Anna Zaks    return false;
2593bbd8cd831788c506f2980293eb3c7e1b3ca2501Anna Zaks
2606cc0969ab37c614d6cf496f2ed6d2fca397a0133Anna Zaks  if (CalleeCFG->getNumBlockIDs() > AMgr.InlineMaxFunctionSize)
2616cc0969ab37c614d6cf496f2ed6d2fca397a0133Anna Zaks    return false;
2626cc0969ab37c614d6cf496f2ed6d2fca397a0133Anna Zaks
26310f77ad7fc5e5cf3f37a9b14ff5843468b8b84d2Ted Kremenek  // Do not inline variadic calls (for now).
26410f77ad7fc5e5cf3f37a9b14ff5843468b8b84d2Ted Kremenek  if (const BlockDecl *BD = dyn_cast<BlockDecl>(D)) {
26510f77ad7fc5e5cf3f37a9b14ff5843468b8b84d2Ted Kremenek    if (BD->isVariadic())
26610f77ad7fc5e5cf3f37a9b14ff5843468b8b84d2Ted Kremenek      return false;
26710f77ad7fc5e5cf3f37a9b14ff5843468b8b84d2Ted Kremenek  }
26810f77ad7fc5e5cf3f37a9b14ff5843468b8b84d2Ted Kremenek  else if (const FunctionDecl *FD = dyn_cast<FunctionDecl>(D)) {
26910f77ad7fc5e5cf3f37a9b14ff5843468b8b84d2Ted Kremenek    if (FD->isVariadic())
27010f77ad7fc5e5cf3f37a9b14ff5843468b8b84d2Ted Kremenek      return false;
2715903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks  }
2725903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks
273d4aeb8050a1d0fe47c53a73361c8b0b8ac310f46Ted Kremenek  // It is possible that the live variables analysis cannot be
274d4aeb8050a1d0fe47c53a73361c8b0b8ac310f46Ted Kremenek  // run.  If so, bail out.
275d4aeb8050a1d0fe47c53a73361c8b0b8ac310f46Ted Kremenek  if (!CalleeADC->getAnalysis<RelaxedLiveVariables>())
276d4aeb8050a1d0fe47c53a73361c8b0b8ac310f46Ted Kremenek    return false;
277d4aeb8050a1d0fe47c53a73361c8b0b8ac310f46Ted Kremenek
27810f77ad7fc5e5cf3f37a9b14ff5843468b8b84d2Ted Kremenek  return true;
2795903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks}
2805903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks
281e81ce256b62717dd846bd19aecc4115a0dcd4995Anna Zaksbool ExprEngine::inlineCall(const CallEvent &Call,
282256ef642f8feef22fd53be7efa868e8e34752eedTed Kremenek                            ExplodedNode *Pred) {
28310f77ad7fc5e5cf3f37a9b14ff5843468b8b84d2Ted Kremenek  if (!getAnalysisManager().shouldInlineCall())
2845903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks    return false;
2855903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks
2869dc5167e4017ef4c8b327abb6f72225eec2e0f19Anna Zaks  const Decl *D = Call.getRuntimeDefinition();
2879dc5167e4017ef4c8b327abb6f72225eec2e0f19Anna Zaks  if (!D)
288ee158bc29bc12ce544996f7cdfde14aba63acf4dJordan Rose    return false;
289ee158bc29bc12ce544996f7cdfde14aba63acf4dJordan Rose
290c36b30c92c78b95fd29fb5d9d6214d737b3bcb02Jordan Rose  const LocationContext *CurLC = Pred->getLocationContext();
291c36b30c92c78b95fd29fb5d9d6214d737b3bcb02Jordan Rose  const StackFrameContext *CallerSFC = CurLC->getCurrentStackFrame();
2927fa9b4f258636d89342eda28f21a986c8ac353b1Ted Kremenek  const LocationContext *ParentOfCallee = 0;
29369f87c956b3ac2b80124fd9604af012e1061473aJordan Rose
29469f87c956b3ac2b80124fd9604af012e1061473aJordan Rose  switch (Call.getKind()) {
29569f87c956b3ac2b80124fd9604af012e1061473aJordan Rose  case CE_Function:
29669f87c956b3ac2b80124fd9604af012e1061473aJordan Rose  case CE_CXXMember:
297e54cfc7b9990acffd0a8a4ba381717b4bb9f3011Jordan Rose  case CE_CXXMemberOperator:
29869f87c956b3ac2b80124fd9604af012e1061473aJordan Rose    // These are always at least possible to inline.
29969f87c956b3ac2b80124fd9604af012e1061473aJordan Rose    break;
30070cbf3cc09eb21db1108396d30a414ea66d842ccJordan Rose  case CE_CXXConstructor:
301da5fc53d6b024872c4c1d2c8c5da11e08bf116aaJordan Rose  case CE_CXXDestructor: {
302da5fc53d6b024872c4c1d2c8c5da11e08bf116aaJordan Rose    // Only inline constructors and destructors if we built the CFGs for them
303da5fc53d6b024872c4c1d2c8c5da11e08bf116aaJordan Rose    // properly.
304da5fc53d6b024872c4c1d2c8c5da11e08bf116aaJordan Rose    const AnalysisDeclContext *ADC = CallerSFC->getAnalysisDeclContext();
305da5fc53d6b024872c4c1d2c8c5da11e08bf116aaJordan Rose    if (!ADC->getCFGBuildOptions().AddImplicitDtors ||
306da5fc53d6b024872c4c1d2c8c5da11e08bf116aaJordan Rose        !ADC->getCFGBuildOptions().AddInitializers)
307da5fc53d6b024872c4c1d2c8c5da11e08bf116aaJordan Rose      return false;
3083a0a9e3e8bbaa45f3ca22b1e20b3beaac0f5861eJordan Rose
3093a0a9e3e8bbaa45f3ca22b1e20b3beaac0f5861eJordan Rose    // FIXME: This is a hack. We don't handle temporary destructors
310888c90ac0ef6baf7d47e86cf5cc4715707d223b1Jordan Rose    // right now, so we shouldn't inline their constructors.
311888c90ac0ef6baf7d47e86cf5cc4715707d223b1Jordan Rose    if (const CXXConstructorCall *Ctor = dyn_cast<CXXConstructorCall>(&Call)) {
312888c90ac0ef6baf7d47e86cf5cc4715707d223b1Jordan Rose      const CXXConstructExpr *CtorExpr = Ctor->getOriginExpr();
313888c90ac0ef6baf7d47e86cf5cc4715707d223b1Jordan Rose      if (CtorExpr->getConstructionKind() == CXXConstructExpr::CK_Complete)
3143a0a9e3e8bbaa45f3ca22b1e20b3beaac0f5861eJordan Rose        if (const MemRegion *Target = Ctor->getCXXThisVal().getAsRegion())
3153a0a9e3e8bbaa45f3ca22b1e20b3beaac0f5861eJordan Rose          if (!isa<DeclRegion>(Target))
3163a0a9e3e8bbaa45f3ca22b1e20b3beaac0f5861eJordan Rose            return false;
317888c90ac0ef6baf7d47e86cf5cc4715707d223b1Jordan Rose    }
318da5fc53d6b024872c4c1d2c8c5da11e08bf116aaJordan Rose    break;
319da5fc53d6b024872c4c1d2c8c5da11e08bf116aaJordan Rose  }
32070cbf3cc09eb21db1108396d30a414ea66d842ccJordan Rose  case CE_CXXAllocator:
32170cbf3cc09eb21db1108396d30a414ea66d842ccJordan Rose    // Do not inline allocators until we model deallocators.
32270cbf3cc09eb21db1108396d30a414ea66d842ccJordan Rose    // This is unfortunate, but basically necessary for smart pointers and such.
32370cbf3cc09eb21db1108396d30a414ea66d842ccJordan Rose    return false;
32469f87c956b3ac2b80124fd9604af012e1061473aJordan Rose  case CE_Block: {
32569f87c956b3ac2b80124fd9604af012e1061473aJordan Rose    const BlockDataRegion *BR = cast<BlockCall>(Call).getBlockRegion();
326ee158bc29bc12ce544996f7cdfde14aba63acf4dJordan Rose    assert(BR && "If we have the block definition we should have its region");
32769f87c956b3ac2b80124fd9604af012e1061473aJordan Rose    AnalysisDeclContext *BlockCtx = AMgr.getAnalysisDeclContext(D);
3287fa9b4f258636d89342eda28f21a986c8ac353b1Ted Kremenek    ParentOfCallee = BlockCtx->getBlockInvocationContext(CallerSFC,
32969f87c956b3ac2b80124fd9604af012e1061473aJordan Rose                                                         cast<BlockDecl>(D),
3307fa9b4f258636d89342eda28f21a986c8ac353b1Ted Kremenek                                                         BR);
33169f87c956b3ac2b80124fd9604af012e1061473aJordan Rose    break;
33269f87c956b3ac2b80124fd9604af012e1061473aJordan Rose  }
33369f87c956b3ac2b80124fd9604af012e1061473aJordan Rose  case CE_ObjCMessage:
3349dc5167e4017ef4c8b327abb6f72225eec2e0f19Anna Zaks    break;
335256ef642f8feef22fd53be7efa868e8e34752eedTed Kremenek  }
336ee158bc29bc12ce544996f7cdfde14aba63acf4dJordan Rose
337ee158bc29bc12ce544996f7cdfde14aba63acf4dJordan Rose  if (!shouldInlineDecl(D, Pred))
3387fa9b4f258636d89342eda28f21a986c8ac353b1Ted Kremenek    return false;
3397fa9b4f258636d89342eda28f21a986c8ac353b1Ted Kremenek
3407fa9b4f258636d89342eda28f21a986c8ac353b1Ted Kremenek  if (!ParentOfCallee)
3417fa9b4f258636d89342eda28f21a986c8ac353b1Ted Kremenek    ParentOfCallee = CallerSFC;
3427fa9b4f258636d89342eda28f21a986c8ac353b1Ted Kremenek
343852aa0d2c5d2d1faf2d77b5aa3c0848068a342c5Jordan Rose  // This may be NULL, but that's fine.
34469f87c956b3ac2b80124fd9604af012e1061473aJordan Rose  const Expr *CallE = Call.getOriginExpr();
34569f87c956b3ac2b80124fd9604af012e1061473aJordan Rose
3467fa9b4f258636d89342eda28f21a986c8ac353b1Ted Kremenek  // Construct a new stack frame for the callee.
3477fa9b4f258636d89342eda28f21a986c8ac353b1Ted Kremenek  AnalysisDeclContext *CalleeADC = AMgr.getAnalysisDeclContext(D);
3487fa9b4f258636d89342eda28f21a986c8ac353b1Ted Kremenek  const StackFrameContext *CalleeSFC =
34969f87c956b3ac2b80124fd9604af012e1061473aJordan Rose    CalleeADC->getStackFrame(ParentOfCallee, CallE,
3507fa9b4f258636d89342eda28f21a986c8ac353b1Ted Kremenek                             currentBuilderContext->getBlock(),
3517fa9b4f258636d89342eda28f21a986c8ac353b1Ted Kremenek                             currentStmtIdx);
3527fa9b4f258636d89342eda28f21a986c8ac353b1Ted Kremenek
353c36b30c92c78b95fd29fb5d9d6214d737b3bcb02Jordan Rose  CallEnter Loc(CallE, CalleeSFC, CurLC);
354e54cfc7b9990acffd0a8a4ba381717b4bb9f3011Jordan Rose
355e54cfc7b9990acffd0a8a4ba381717b4bb9f3011Jordan Rose  // Construct a new state which contains the mapping from actual to
356e54cfc7b9990acffd0a8a4ba381717b4bb9f3011Jordan Rose  // formal arguments.
357e54cfc7b9990acffd0a8a4ba381717b4bb9f3011Jordan Rose  ProgramStateRef State = Pred->getState()->enterStackFrame(Call, CalleeSFC);
358e54cfc7b9990acffd0a8a4ba381717b4bb9f3011Jordan Rose
3597fa9b4f258636d89342eda28f21a986c8ac353b1Ted Kremenek  bool isNew;
360e54cfc7b9990acffd0a8a4ba381717b4bb9f3011Jordan Rose  if (ExplodedNode *N = G.getNode(Loc, State, false, &isNew)) {
3617fa9b4f258636d89342eda28f21a986c8ac353b1Ted Kremenek    N->addPredecessor(Pred, G);
3627fa9b4f258636d89342eda28f21a986c8ac353b1Ted Kremenek    if (isNew)
3637fa9b4f258636d89342eda28f21a986c8ac353b1Ted Kremenek      Engine.getWorkList()->enqueue(N);
3647fa9b4f258636d89342eda28f21a986c8ac353b1Ted Kremenek  }
3657fa9b4f258636d89342eda28f21a986c8ac353b1Ted Kremenek  return true;
366256ef642f8feef22fd53be7efa868e8e34752eedTed Kremenek}
367256ef642f8feef22fd53be7efa868e8e34752eedTed Kremenek
368e81ce256b62717dd846bd19aecc4115a0dcd4995Anna Zaksstatic ProgramStateRef getInlineFailedState(ProgramStateRef State,
36969f87c956b3ac2b80124fd9604af012e1061473aJordan Rose                                            const Stmt *CallE) {
370e81ce256b62717dd846bd19aecc4115a0dcd4995Anna Zaks  void *ReplayState = State->get<ReplayWithoutInlining>();
3715903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks  if (!ReplayState)
3725903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks    return 0;
37328038f33aa2db4833881fea757a1f0daf85ac02bJordan Rose
37428038f33aa2db4833881fea757a1f0daf85ac02bJordan Rose  assert(ReplayState == (const void*)CallE && "Backtracked to the wrong call.");
37528038f33aa2db4833881fea757a1f0daf85ac02bJordan Rose  (void)CallE;
37628038f33aa2db4833881fea757a1f0daf85ac02bJordan Rose
377e81ce256b62717dd846bd19aecc4115a0dcd4995Anna Zaks  return State->remove<ReplayWithoutInlining>();
37810520d76044e8fff71d414f30c21b449fd104960Ted Kremenek}
37910520d76044e8fff71d414f30c21b449fd104960Ted Kremenek
380294fd0a62b95f512637910bf85c7efa6c2354b50Ted Kremenekvoid ExprEngine::VisitCallExpr(const CallExpr *CE, ExplodedNode *Pred,
381294fd0a62b95f512637910bf85c7efa6c2354b50Ted Kremenek                               ExplodedNodeSet &dst) {
382294fd0a62b95f512637910bf85c7efa6c2354b50Ted Kremenek  // Perform the previsit of the CallExpr.
383294fd0a62b95f512637910bf85c7efa6c2354b50Ted Kremenek  ExplodedNodeSet dstPreVisit;
384294fd0a62b95f512637910bf85c7efa6c2354b50Ted Kremenek  getCheckerManager().runCheckersForPreStmt(dstPreVisit, Pred, CE, *this);
385500abad7edfcc2409b18dd616cdbc28a094926f5Jordy Rose
38669f87c956b3ac2b80124fd9604af012e1061473aJordan Rose  // Get the callee kind.
387fdaa33818cf9bad8d092136e73bd2e489cb821baJordan Rose  CallEventKind K = classifyCallExpr(CE);
38869f87c956b3ac2b80124fd9604af012e1061473aJordan Rose
38969f87c956b3ac2b80124fd9604af012e1061473aJordan Rose  // Evaluate the function call.  We try each of the checkers
390294fd0a62b95f512637910bf85c7efa6c2354b50Ted Kremenek  // to see if the can evaluate the function call.
391294fd0a62b95f512637910bf85c7efa6c2354b50Ted Kremenek  ExplodedNodeSet dstCallEvaluated;
39269f87c956b3ac2b80124fd9604af012e1061473aJordan Rose  for (ExplodedNodeSet::iterator I = dstPreVisit.begin(), E = dstPreVisit.end();
39369f87c956b3ac2b80124fd9604af012e1061473aJordan Rose       I != E; ++I) {
39469f87c956b3ac2b80124fd9604af012e1061473aJordan Rose    ProgramStateRef State = (*I)->getState();
39569f87c956b3ac2b80124fd9604af012e1061473aJordan Rose    const LocationContext *LCtx = (*I)->getLocationContext();
39669f87c956b3ac2b80124fd9604af012e1061473aJordan Rose
39769f87c956b3ac2b80124fd9604af012e1061473aJordan Rose    // Evaluate the call.
398fdaa33818cf9bad8d092136e73bd2e489cb821baJordan Rose    switch (K) {
399fdaa33818cf9bad8d092136e73bd2e489cb821baJordan Rose    case CE_Function:
40069f87c956b3ac2b80124fd9604af012e1061473aJordan Rose      evalCall(dstCallEvaluated, *I, FunctionCall(CE, State, LCtx));
401fdaa33818cf9bad8d092136e73bd2e489cb821baJordan Rose      break;
402fdaa33818cf9bad8d092136e73bd2e489cb821baJordan Rose    case CE_CXXMember:
403fdaa33818cf9bad8d092136e73bd2e489cb821baJordan Rose      evalCall(dstCallEvaluated, *I, CXXMemberCall(cast<CXXMemberCallExpr>(CE),
404fdaa33818cf9bad8d092136e73bd2e489cb821baJordan Rose                                                   State, LCtx));
405fdaa33818cf9bad8d092136e73bd2e489cb821baJordan Rose      break;
406fdaa33818cf9bad8d092136e73bd2e489cb821baJordan Rose    case CE_CXXMemberOperator:
407fdaa33818cf9bad8d092136e73bd2e489cb821baJordan Rose      evalCall(dstCallEvaluated, *I,
408fdaa33818cf9bad8d092136e73bd2e489cb821baJordan Rose               CXXMemberOperatorCall(cast<CXXOperatorCallExpr>(CE),
409fdaa33818cf9bad8d092136e73bd2e489cb821baJordan Rose                                     State, LCtx));
410fdaa33818cf9bad8d092136e73bd2e489cb821baJordan Rose      break;
411fdaa33818cf9bad8d092136e73bd2e489cb821baJordan Rose    case CE_Block:
412fdaa33818cf9bad8d092136e73bd2e489cb821baJordan Rose      evalCall(dstCallEvaluated, *I, BlockCall(CE, State, LCtx));
413fdaa33818cf9bad8d092136e73bd2e489cb821baJordan Rose      break;
414fdaa33818cf9bad8d092136e73bd2e489cb821baJordan Rose    default:
415fdaa33818cf9bad8d092136e73bd2e489cb821baJordan Rose      llvm_unreachable("Non-CallExpr CallEventKind");
416fdaa33818cf9bad8d092136e73bd2e489cb821baJordan Rose    }
41769f87c956b3ac2b80124fd9604af012e1061473aJordan Rose  }
41869f87c956b3ac2b80124fd9604af012e1061473aJordan Rose
419294fd0a62b95f512637910bf85c7efa6c2354b50Ted Kremenek  // Finally, perform the post-condition check of the CallExpr and store
420294fd0a62b95f512637910bf85c7efa6c2354b50Ted Kremenek  // the created nodes in 'Dst'.
42169f87c956b3ac2b80124fd9604af012e1061473aJordan Rose  // Note that if the call was inlined, dstCallEvaluated will be empty.
42269f87c956b3ac2b80124fd9604af012e1061473aJordan Rose  // The post-CallExpr check will occur in processCallExit.
423294fd0a62b95f512637910bf85c7efa6c2354b50Ted Kremenek  getCheckerManager().runCheckersForPostStmt(dst, dstCallEvaluated, CE,
424294fd0a62b95f512637910bf85c7efa6c2354b50Ted Kremenek                                             *this);
425294fd0a62b95f512637910bf85c7efa6c2354b50Ted Kremenek}
426294fd0a62b95f512637910bf85c7efa6c2354b50Ted Kremenek
42769f87c956b3ac2b80124fd9604af012e1061473aJordan Rosevoid ExprEngine::evalCall(ExplodedNodeSet &Dst, ExplodedNode *Pred,
42869f87c956b3ac2b80124fd9604af012e1061473aJordan Rose                          const SimpleCall &Call) {
42996479da6ad9d921d875e7be29fe1bfa127be8069Jordan Rose  // Run any pre-call checks using the generic call interface.
43096479da6ad9d921d875e7be29fe1bfa127be8069Jordan Rose  ExplodedNodeSet dstPreVisit;
43196479da6ad9d921d875e7be29fe1bfa127be8069Jordan Rose  getCheckerManager().runCheckersForPreCall(dstPreVisit, Pred, Call, *this);
43296479da6ad9d921d875e7be29fe1bfa127be8069Jordan Rose
43396479da6ad9d921d875e7be29fe1bfa127be8069Jordan Rose  // Actually evaluate the function call.  We try each of the checkers
43496479da6ad9d921d875e7be29fe1bfa127be8069Jordan Rose  // to see if the can evaluate the function call, and get a callback at
43596479da6ad9d921d875e7be29fe1bfa127be8069Jordan Rose  // defaultEvalCall if all of them fail.
43696479da6ad9d921d875e7be29fe1bfa127be8069Jordan Rose  ExplodedNodeSet dstCallEvaluated;
43796479da6ad9d921d875e7be29fe1bfa127be8069Jordan Rose  getCheckerManager().runCheckersForEvalCall(dstCallEvaluated, dstPreVisit,
43896479da6ad9d921d875e7be29fe1bfa127be8069Jordan Rose                                             Call, *this);
43996479da6ad9d921d875e7be29fe1bfa127be8069Jordan Rose
44096479da6ad9d921d875e7be29fe1bfa127be8069Jordan Rose  // Finally, run any post-call checks.
44196479da6ad9d921d875e7be29fe1bfa127be8069Jordan Rose  getCheckerManager().runCheckersForPostCall(Dst, dstCallEvaluated,
44296479da6ad9d921d875e7be29fe1bfa127be8069Jordan Rose                                             Call, *this);
44369f87c956b3ac2b80124fd9604af012e1061473aJordan Rose}
44469f87c956b3ac2b80124fd9604af012e1061473aJordan Rose
445e81ce256b62717dd846bd19aecc4115a0dcd4995Anna ZaksProgramStateRef ExprEngine::bindReturnValue(const CallEvent &Call,
446e81ce256b62717dd846bd19aecc4115a0dcd4995Anna Zaks                                            const LocationContext *LCtx,
447e81ce256b62717dd846bd19aecc4115a0dcd4995Anna Zaks                                            ProgramStateRef State) {
448e81ce256b62717dd846bd19aecc4115a0dcd4995Anna Zaks  const Expr *E = Call.getOriginExpr();
449e81ce256b62717dd846bd19aecc4115a0dcd4995Anna Zaks  if (!E)
450e81ce256b62717dd846bd19aecc4115a0dcd4995Anna Zaks    return State;
451e81ce256b62717dd846bd19aecc4115a0dcd4995Anna Zaks
452e81ce256b62717dd846bd19aecc4115a0dcd4995Anna Zaks  // Some method families have known return values.
453e81ce256b62717dd846bd19aecc4115a0dcd4995Anna Zaks  if (const ObjCMethodCall *Msg = dyn_cast<ObjCMethodCall>(&Call)) {
454e81ce256b62717dd846bd19aecc4115a0dcd4995Anna Zaks    switch (Msg->getMethodFamily()) {
455e81ce256b62717dd846bd19aecc4115a0dcd4995Anna Zaks    default:
456e81ce256b62717dd846bd19aecc4115a0dcd4995Anna Zaks      break;
457e81ce256b62717dd846bd19aecc4115a0dcd4995Anna Zaks    case OMF_autorelease:
458e81ce256b62717dd846bd19aecc4115a0dcd4995Anna Zaks    case OMF_retain:
459e81ce256b62717dd846bd19aecc4115a0dcd4995Anna Zaks    case OMF_self: {
460e81ce256b62717dd846bd19aecc4115a0dcd4995Anna Zaks      // These methods return their receivers.
461e81ce256b62717dd846bd19aecc4115a0dcd4995Anna Zaks      return State->BindExpr(E, LCtx, Msg->getReceiverSVal());
462e81ce256b62717dd846bd19aecc4115a0dcd4995Anna Zaks    }
463e81ce256b62717dd846bd19aecc4115a0dcd4995Anna Zaks    }
464e81ce256b62717dd846bd19aecc4115a0dcd4995Anna Zaks  }
465e81ce256b62717dd846bd19aecc4115a0dcd4995Anna Zaks
466e81ce256b62717dd846bd19aecc4115a0dcd4995Anna Zaks  // Conjure a symbol if the return value is unknown.
467e81ce256b62717dd846bd19aecc4115a0dcd4995Anna Zaks  QualType ResultTy = Call.getResultType();
468e81ce256b62717dd846bd19aecc4115a0dcd4995Anna Zaks  SValBuilder &SVB = getSValBuilder();
469e81ce256b62717dd846bd19aecc4115a0dcd4995Anna Zaks  unsigned Count = currentBuilderContext->getCurrentBlockCount();
470e81ce256b62717dd846bd19aecc4115a0dcd4995Anna Zaks  SVal R = SVB.getConjuredSymbolVal(0, E, LCtx, ResultTy, Count);
471e81ce256b62717dd846bd19aecc4115a0dcd4995Anna Zaks  return State->BindExpr(E, LCtx, R);
472e81ce256b62717dd846bd19aecc4115a0dcd4995Anna Zaks}
473e81ce256b62717dd846bd19aecc4115a0dcd4995Anna Zaks
474e81ce256b62717dd846bd19aecc4115a0dcd4995Anna Zaksvoid ExprEngine::defaultEvalCall(NodeBuilder &Bldr, ExplodedNode *Pred,
47569f87c956b3ac2b80124fd9604af012e1061473aJordan Rose                                 const CallEvent &Call) {
476e81ce256b62717dd846bd19aecc4115a0dcd4995Anna Zaks  ProgramStateRef State = 0;
477e81ce256b62717dd846bd19aecc4115a0dcd4995Anna Zaks  const Expr *E = Call.getOriginExpr();
478e81ce256b62717dd846bd19aecc4115a0dcd4995Anna Zaks
47969f87c956b3ac2b80124fd9604af012e1061473aJordan Rose  // Try to inline the call.
48028038f33aa2db4833881fea757a1f0daf85ac02bJordan Rose  // The origin expression here is just used as a kind of checksum;
48128038f33aa2db4833881fea757a1f0daf85ac02bJordan Rose  // for CallEvents that do not have origin expressions, this should still be
48228038f33aa2db4833881fea757a1f0daf85ac02bJordan Rose  // safe.
4839dc5167e4017ef4c8b327abb6f72225eec2e0f19Anna Zaks  State = getInlineFailedState(Pred->getState(), E);
4849dc5167e4017ef4c8b327abb6f72225eec2e0f19Anna Zaks  if (State == 0 && inlineCall(Call, Pred)) {
4859dc5167e4017ef4c8b327abb6f72225eec2e0f19Anna Zaks    // If we inlined the call, the successor has been manually added onto
4869dc5167e4017ef4c8b327abb6f72225eec2e0f19Anna Zaks    // the work list and we should not consider it for subsequent call
4879dc5167e4017ef4c8b327abb6f72225eec2e0f19Anna Zaks    // handling steps.
4889dc5167e4017ef4c8b327abb6f72225eec2e0f19Anna Zaks    Bldr.takeNodes(Pred);
4899dc5167e4017ef4c8b327abb6f72225eec2e0f19Anna Zaks    return;
490e81ce256b62717dd846bd19aecc4115a0dcd4995Anna Zaks  }
49169f87c956b3ac2b80124fd9604af012e1061473aJordan Rose
49269f87c956b3ac2b80124fd9604af012e1061473aJordan Rose  // If we can't inline it, handle the return value and invalidate the regions.
493e81ce256b62717dd846bd19aecc4115a0dcd4995Anna Zaks  if (State == 0)
494e81ce256b62717dd846bd19aecc4115a0dcd4995Anna Zaks    State = Pred->getState();
49569f87c956b3ac2b80124fd9604af012e1061473aJordan Rose
49669f87c956b3ac2b80124fd9604af012e1061473aJordan Rose  // Invalidate any regions touched by the call.
49769f87c956b3ac2b80124fd9604af012e1061473aJordan Rose  unsigned Count = currentBuilderContext->getCurrentBlockCount();
498e81ce256b62717dd846bd19aecc4115a0dcd4995Anna Zaks  State = Call.invalidateRegions(Count, State);
499e81ce256b62717dd846bd19aecc4115a0dcd4995Anna Zaks
500e81ce256b62717dd846bd19aecc4115a0dcd4995Anna Zaks  // Construct and bind the return value.
501e81ce256b62717dd846bd19aecc4115a0dcd4995Anna Zaks  State = bindReturnValue(Call, Pred->getLocationContext(), State);
50269f87c956b3ac2b80124fd9604af012e1061473aJordan Rose
50369f87c956b3ac2b80124fd9604af012e1061473aJordan Rose  // And make the result node.
504e81ce256b62717dd846bd19aecc4115a0dcd4995Anna Zaks  Bldr.generateNode(Call.getProgramPoint(), State, Pred);
50569f87c956b3ac2b80124fd9604af012e1061473aJordan Rose}
50669f87c956b3ac2b80124fd9604af012e1061473aJordan Rose
507294fd0a62b95f512637910bf85c7efa6c2354b50Ted Kremenekvoid ExprEngine::VisitReturnStmt(const ReturnStmt *RS, ExplodedNode *Pred,
508294fd0a62b95f512637910bf85c7efa6c2354b50Ted Kremenek                                 ExplodedNodeSet &Dst) {
509256ef642f8feef22fd53be7efa868e8e34752eedTed Kremenek
510256ef642f8feef22fd53be7efa868e8e34752eedTed Kremenek  ExplodedNodeSet dstPreVisit;
511256ef642f8feef22fd53be7efa868e8e34752eedTed Kremenek  getCheckerManager().runCheckersForPreStmt(dstPreVisit, Pred, RS, *this);
512256ef642f8feef22fd53be7efa868e8e34752eedTed Kremenek
513256ef642f8feef22fd53be7efa868e8e34752eedTed Kremenek  StmtNodeBuilder B(dstPreVisit, Dst, *currentBuilderContext);
514256ef642f8feef22fd53be7efa868e8e34752eedTed Kremenek
515256ef642f8feef22fd53be7efa868e8e34752eedTed Kremenek  if (RS->getRetValue()) {
516256ef642f8feef22fd53be7efa868e8e34752eedTed Kremenek    for (ExplodedNodeSet::iterator it = dstPreVisit.begin(),
517256ef642f8feef22fd53be7efa868e8e34752eedTed Kremenek                                  ei = dstPreVisit.end(); it != ei; ++it) {
518256ef642f8feef22fd53be7efa868e8e34752eedTed Kremenek      B.generateNode(RS, *it, (*it)->getState());
519294fd0a62b95f512637910bf85c7efa6c2354b50Ted Kremenek    }
520294fd0a62b95f512637910bf85c7efa6c2354b50Ted Kremenek  }
521294fd0a62b95f512637910bf85c7efa6c2354b50Ted Kremenek}
522