ExprEngineCXX.cpp revision 1d26f48dc2eea1c07431ca1519d7034a21b9bcff
15f7643150411b16e71bc012c6ceb2d865c0a34d4Ted Kremenek//===- ExprEngineCXX.cpp - ExprEngine support for C++ -----------*- C++ -*-===// 2cb7464ab402d057849dda9749d62a62d86c35ab8Zhongxing Xu// 3cb7464ab402d057849dda9749d62a62d86c35ab8Zhongxing Xu// The LLVM Compiler Infrastructure 4cb7464ab402d057849dda9749d62a62d86c35ab8Zhongxing Xu// 5cb7464ab402d057849dda9749d62a62d86c35ab8Zhongxing Xu// This file is distributed under the University of Illinois Open Source 6cb7464ab402d057849dda9749d62a62d86c35ab8Zhongxing Xu// License. See LICENSE.TXT for details. 7cb7464ab402d057849dda9749d62a62d86c35ab8Zhongxing Xu// 8cb7464ab402d057849dda9749d62a62d86c35ab8Zhongxing Xu//===----------------------------------------------------------------------===// 9cb7464ab402d057849dda9749d62a62d86c35ab8Zhongxing Xu// 10cb7464ab402d057849dda9749d62a62d86c35ab8Zhongxing Xu// This file defines the C++ expression evaluation engine. 11cb7464ab402d057849dda9749d62a62d86c35ab8Zhongxing Xu// 12cb7464ab402d057849dda9749d62a62d86c35ab8Zhongxing Xu//===----------------------------------------------------------------------===// 13cb7464ab402d057849dda9749d62a62d86c35ab8Zhongxing Xu 14eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis#include "clang/StaticAnalyzer/Core/CheckerManager.h" 159b663716449b618ba0390b1dbebc54fa8e971124Ted Kremenek#include "clang/StaticAnalyzer/Core/PathSensitive/AnalysisManager.h" 169b663716449b618ba0390b1dbebc54fa8e971124Ted Kremenek#include "clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h" 17d1e5a89226da79f7e6f43d40facc46abda9e5245Jordy Rose#include "clang/StaticAnalyzer/Core/PathSensitive/ObjCMessage.h" 18cb7464ab402d057849dda9749d62a62d86c35ab8Zhongxing Xu#include "clang/AST/DeclCXX.h" 19cb7464ab402d057849dda9749d62a62d86c35ab8Zhongxing Xu 20cb7464ab402d057849dda9749d62a62d86c35ab8Zhongxing Xuusing namespace clang; 219ef6537a894c33003359b1f9b9676e9178e028b7Ted Kremenekusing namespace ento; 22cb7464ab402d057849dda9749d62a62d86c35ab8Zhongxing Xu 23c69c43845aa3ede95af837b8be52868eca55d64dTed Kremeneknamespace { 24c69c43845aa3ede95af837b8be52868eca55d64dTed Kremenekclass CallExprWLItem { 25c69c43845aa3ede95af837b8be52868eca55d64dTed Kremenekpublic: 26c69c43845aa3ede95af837b8be52868eca55d64dTed Kremenek CallExpr::const_arg_iterator I; 27c69c43845aa3ede95af837b8be52868eca55d64dTed Kremenek ExplodedNode *N; 28c69c43845aa3ede95af837b8be52868eca55d64dTed Kremenek 29c69c43845aa3ede95af837b8be52868eca55d64dTed Kremenek CallExprWLItem(const CallExpr::const_arg_iterator &i, ExplodedNode *n) 30c69c43845aa3ede95af837b8be52868eca55d64dTed Kremenek : I(i), N(n) {} 31c69c43845aa3ede95af837b8be52868eca55d64dTed Kremenek}; 32c69c43845aa3ede95af837b8be52868eca55d64dTed Kremenek} 33c69c43845aa3ede95af837b8be52868eca55d64dTed Kremenek 34d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidisvoid ExprEngine::evalArguments(ConstExprIterator AI, ConstExprIterator AE, 35b17b1b3cc2b0d4d3b263b9384571bbc7f3995771Zhongxing Xu const FunctionProtoType *FnType, 3682c63bfa0c5130e0cf274c1974b6157ebefc04feMarcin Swiderski ExplodedNode *Pred, ExplodedNodeSet &Dst, 3782c63bfa0c5130e0cf274c1974b6157ebefc04feMarcin Swiderski bool FstArgAsLValue) { 38c69c43845aa3ede95af837b8be52868eca55d64dTed Kremenek 39c69c43845aa3ede95af837b8be52868eca55d64dTed Kremenek 405f9e272e632e951b1efe824cd16acb4d96077930Chris Lattner SmallVector<CallExprWLItem, 20> WorkList; 41b17b1b3cc2b0d4d3b263b9384571bbc7f3995771Zhongxing Xu WorkList.reserve(AE - AI); 42b17b1b3cc2b0d4d3b263b9384571bbc7f3995771Zhongxing Xu WorkList.push_back(CallExprWLItem(AI, Pred)); 43b17b1b3cc2b0d4d3b263b9384571bbc7f3995771Zhongxing Xu 44b17b1b3cc2b0d4d3b263b9384571bbc7f3995771Zhongxing Xu while (!WorkList.empty()) { 45b17b1b3cc2b0d4d3b263b9384571bbc7f3995771Zhongxing Xu CallExprWLItem Item = WorkList.back(); 46b17b1b3cc2b0d4d3b263b9384571bbc7f3995771Zhongxing Xu WorkList.pop_back(); 47b17b1b3cc2b0d4d3b263b9384571bbc7f3995771Zhongxing Xu 48b17b1b3cc2b0d4d3b263b9384571bbc7f3995771Zhongxing Xu if (Item.I == AE) { 49b17b1b3cc2b0d4d3b263b9384571bbc7f3995771Zhongxing Xu Dst.insert(Item.N); 50b17b1b3cc2b0d4d3b263b9384571bbc7f3995771Zhongxing Xu continue; 51b17b1b3cc2b0d4d3b263b9384571bbc7f3995771Zhongxing Xu } 52b17b1b3cc2b0d4d3b263b9384571bbc7f3995771Zhongxing Xu 53c69c43845aa3ede95af837b8be52868eca55d64dTed Kremenek // Evaluate the argument. 54b17b1b3cc2b0d4d3b263b9384571bbc7f3995771Zhongxing Xu ExplodedNodeSet Tmp; 5582c63bfa0c5130e0cf274c1974b6157ebefc04feMarcin Swiderski if (FstArgAsLValue) { 5682c63bfa0c5130e0cf274c1974b6157ebefc04feMarcin Swiderski FstArgAsLValue = false; 5782c63bfa0c5130e0cf274c1974b6157ebefc04feMarcin Swiderski } 58c69c43845aa3ede95af837b8be52868eca55d64dTed Kremenek 59892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek Visit(*Item.I, Item.N, Tmp); 60b17b1b3cc2b0d4d3b263b9384571bbc7f3995771Zhongxing Xu ++(Item.I); 61b17b1b3cc2b0d4d3b263b9384571bbc7f3995771Zhongxing Xu for (ExplodedNodeSet::iterator NI=Tmp.begin(), NE=Tmp.end(); NI != NE; ++NI) 62b17b1b3cc2b0d4d3b263b9384571bbc7f3995771Zhongxing Xu WorkList.push_back(CallExprWLItem(Item.I, *NI)); 63b17b1b3cc2b0d4d3b263b9384571bbc7f3995771Zhongxing Xu } 64b17b1b3cc2b0d4d3b263b9384571bbc7f3995771Zhongxing Xu} 65b17b1b3cc2b0d4d3b263b9384571bbc7f3995771Zhongxing Xu 66b277159055933e610bbc80262b600d3ad7e0595cTed Kremenekvoid ExprEngine::evalCallee(const CallExpr *callExpr, 67b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek const ExplodedNodeSet &src, 68b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek ExplodedNodeSet &dest) { 69b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek 70b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek const Expr *callee = 0; 71b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek 72b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek switch (callExpr->getStmtClass()) { 73b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek case Stmt::CXXMemberCallExprClass: { 74b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek // Evaluate the implicit object argument that is the recipient of the 75b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek // call. 76b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek callee = cast<CXXMemberCallExpr>(callExpr)->getImplicitObjectArgument(); 77b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek 78b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek // FIXME: handle member pointers. 79b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek if (!callee) 80b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek return; 81b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek 82b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek break; 83b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek } 84b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek default: { 85b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek callee = callExpr->getCallee()->IgnoreParens(); 86b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek break; 87b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek } 88b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek } 89b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek 90b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek for (ExplodedNodeSet::iterator i = src.begin(), e = src.end(); i != e; ++i) 91b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek Visit(callee, *i, dest); 92b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek} 93b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek 94d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidisconst CXXThisRegion *ExprEngine::getCXXThisRegion(const CXXRecordDecl *D, 95cb7464ab402d057849dda9749d62a62d86c35ab8Zhongxing Xu const StackFrameContext *SFC) { 96f4c7371fb1d3cebcfb40abad4537bb82515704eaJohn McCall const Type *T = D->getTypeForDecl(); 97b168cbfa1ca9b50115f8dd787d11d272fff2ad81John McCall QualType PT = getContext().getPointerType(QualType(T, 0)); 98c8413fd03f73084a5c93028f8b4db619fc388087Ted Kremenek return svalBuilder.getRegionManager().getCXXThisRegion(PT, SFC); 99cb7464ab402d057849dda9749d62a62d86c35ab8Zhongxing Xu} 100cb7464ab402d057849dda9749d62a62d86c35ab8Zhongxing Xu 101d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidisconst CXXThisRegion *ExprEngine::getCXXThisRegion(const CXXMethodDecl *decl, 10232303020d0f1a21cbcab65ae0c69a4218dc8f0fbZhongxing Xu const StackFrameContext *frameCtx) { 103c8413fd03f73084a5c93028f8b4db619fc388087Ted Kremenek return svalBuilder.getRegionManager(). 10432303020d0f1a21cbcab65ae0c69a4218dc8f0fbZhongxing Xu getCXXThisRegion(decl->getThisType(getContext()), frameCtx); 10532303020d0f1a21cbcab65ae0c69a4218dc8f0fbZhongxing Xu} 10632303020d0f1a21cbcab65ae0c69a4218dc8f0fbZhongxing Xu 107eea72a925f294225391ecec876a342771c09b635Ted Kremenekvoid ExprEngine::CreateCXXTemporaryObject(const MaterializeTemporaryExpr *ME, 108eea72a925f294225391ecec876a342771c09b635Ted Kremenek ExplodedNode *Pred, 109eea72a925f294225391ecec876a342771c09b635Ted Kremenek ExplodedNodeSet &Dst) { 1106a835dddf45922e71a87637fdfac0863de65123cTed Kremenek const Expr *tempExpr = ME->GetTemporaryExpr()->IgnoreParens(); 1116a835dddf45922e71a87637fdfac0863de65123cTed Kremenek const ProgramState *state = Pred->getState(); 112cb7464ab402d057849dda9749d62a62d86c35ab8Zhongxing Xu 1136a835dddf45922e71a87637fdfac0863de65123cTed Kremenek // Bind the temporary object to the value of the expression. Then bind 1146a835dddf45922e71a87637fdfac0863de65123cTed Kremenek // the expression to the location of the object. 1156a835dddf45922e71a87637fdfac0863de65123cTed Kremenek SVal V = state->getSVal(tempExpr); 116cb7464ab402d057849dda9749d62a62d86c35ab8Zhongxing Xu 1176a835dddf45922e71a87637fdfac0863de65123cTed Kremenek const MemRegion *R = 1186a835dddf45922e71a87637fdfac0863de65123cTed Kremenek svalBuilder.getRegionManager().getCXXTempObjectRegion(ME, 1196a835dddf45922e71a87637fdfac0863de65123cTed Kremenek Pred->getLocationContext()); 120cb7464ab402d057849dda9749d62a62d86c35ab8Zhongxing Xu 1216a835dddf45922e71a87637fdfac0863de65123cTed Kremenek state = state->bindLoc(loc::MemRegionVal(R), V); 1226a835dddf45922e71a87637fdfac0863de65123cTed Kremenek MakeNode(Dst, ME, Pred, state->BindExpr(ME, loc::MemRegionVal(R))); 123cb7464ab402d057849dda9749d62a62d86c35ab8Zhongxing Xu} 124cb7464ab402d057849dda9749d62a62d86c35ab8Zhongxing Xu 125d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidisvoid ExprEngine::VisitCXXConstructExpr(const CXXConstructExpr *E, 1265fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek const MemRegion *Dest, 1275fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek ExplodedNode *Pred, 1285fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek ExplodedNodeSet &destNodes) { 129cb7464ab402d057849dda9749d62a62d86c35ab8Zhongxing Xu 130cb7464ab402d057849dda9749d62a62d86c35ab8Zhongxing Xu const CXXConstructorDecl *CD = E->getConstructor(); 131cb7464ab402d057849dda9749d62a62d86c35ab8Zhongxing Xu assert(CD); 1325fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek 1335fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek#if 0 13410620eb5164e31208fcbf0437cd79ae535ed0559Sean Hunt if (!(CD->doesThisDeclarationHaveABody() && AMgr.shouldInlineCall())) 135cb7464ab402d057849dda9749d62a62d86c35ab8Zhongxing Xu // FIXME: invalidate the object. 136cb7464ab402d057849dda9749d62a62d86c35ab8Zhongxing Xu return; 1375fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek#endif 138cb7464ab402d057849dda9749d62a62d86c35ab8Zhongxing Xu 139cb7464ab402d057849dda9749d62a62d86c35ab8Zhongxing Xu // Evaluate other arguments. 1409c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek ExplodedNodeSet argsEvaluated; 141107ccd1f56836ae57c1a5a9c13c881b0293d1e98Zhongxing Xu const FunctionProtoType *FnType = CD->getType()->getAs<FunctionProtoType>(); 1429c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek evalArguments(E->arg_begin(), E->arg_end(), FnType, Pred, argsEvaluated); 1435fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek 1445fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek#if 0 1455fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek // Is the constructor elidable? 1465fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek if (E->isElidable()) { 1475fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek VisitAggExpr(E->getArg(0), destNodes, Pred, Dst); 148fc8f0e14ad142ed811e90fbd9a30e419e301c717Chris Lattner // FIXME: this is here to force propagation if VisitAggExpr doesn't 1495fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek if (destNodes.empty()) 1505fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek destNodes.Add(Pred); 1515fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek return; 1525fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek } 1535fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek#endif 1545fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek 1555fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek // Perform the previsit of the constructor. 1565fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek ExplodedNodeSet destPreVisit; 1575fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek getCheckerManager().runCheckersForPreStmt(destPreVisit, argsEvaluated, E, 1585fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek *this); 1595fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek 1605fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek // Evaluate the constructor. Currently we don't now allow checker-specific 1615fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek // implementations of specific constructors (as we do with ordinary 1625fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek // function calls. We can re-evaluate this in the future. 1635fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek 1645fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek#if 0 1655fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek // Inlining currently isn't fully implemented. 1665fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek 1675fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek if (AMgr.shouldInlineCall()) { 1685fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek if (!Dest) 1695fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek Dest = 1705fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek svalBuilder.getRegionManager().getCXXTempObjectRegion(E, 1715fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek Pred->getLocationContext()); 1725fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek 1735fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek // The callee stack frame context used to create the 'this' 1745fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek // parameter region. 1755fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek const StackFrameContext *SFC = 1765fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek AMgr.getStackFrame(CD, Pred->getLocationContext(), 1775fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek E, Builder->getBlock(), Builder->getIndex()); 1785fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek 1795fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek // Create the 'this' region. 1805fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek const CXXThisRegion *ThisR = 1815fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek getCXXThisRegion(E->getConstructor()->getParent(), SFC); 1825fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek 1835fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek CallEnter Loc(E, SFC, Pred->getLocationContext()); 1845fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek 1855fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek 1865fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek for (ExplodedNodeSet::iterator NI = argsEvaluated.begin(), 1875fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek NE = argsEvaluated.end(); NI != NE; ++NI) { 18818c66fdc3c4008d335885695fe36fb5353c5f672Ted Kremenek const ProgramState *state = (*NI)->getState(); 1895fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek // Setup 'this' region, so that the ctor is evaluated on the object pointed 1905fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek // by 'Dest'. 1915fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek state = state->bindLoc(loc::MemRegionVal(ThisR), loc::MemRegionVal(Dest)); 1925fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek if (ExplodedNode *N = Builder->generateNode(Loc, state, *NI)) 1935fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek destNodes.Add(N); 1945fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek } 195cb7464ab402d057849dda9749d62a62d86c35ab8Zhongxing Xu } 1965fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek#endif 1975fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek 1985fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek // Default semantics: invalidate all regions passed as arguments. 1995fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek ExplodedNodeSet destCall; 2005fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek 2015fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek for (ExplodedNodeSet::iterator 2025fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek i = destPreVisit.begin(), e = destPreVisit.end(); 2035fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek i != e; ++i) 2045fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek { 2055fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek ExplodedNode *Pred = *i; 206e38dd95dddb8f1b38469c8d0e28aa1c660489324Jordy Rose const LocationContext *LC = Pred->getLocationContext(); 20718c66fdc3c4008d335885695fe36fb5353c5f672Ted Kremenek const ProgramState *state = Pred->getState(); 2085fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek 209e38dd95dddb8f1b38469c8d0e28aa1c660489324Jordy Rose state = invalidateArguments(state, CallOrObjCMessage(E, state), LC); 2105fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek Builder->MakeNode(destCall, E, Pred, state); 2115fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek } 2125fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek 2135fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek // Do the post visit. 2145fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek getCheckerManager().runCheckersForPostStmt(destNodes, destCall, E, *this); 215cb7464ab402d057849dda9749d62a62d86c35ab8Zhongxing Xu} 216cb7464ab402d057849dda9749d62a62d86c35ab8Zhongxing Xu 217d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidisvoid ExprEngine::VisitCXXDestructor(const CXXDestructorDecl *DD, 218b1b5daf30d2597e066936772bd206500232d7d65Ted Kremenek const MemRegion *Dest, 219b1b5daf30d2597e066936772bd206500232d7d65Ted Kremenek const Stmt *S, 220b1b5daf30d2597e066936772bd206500232d7d65Ted Kremenek ExplodedNode *Pred, 221b1b5daf30d2597e066936772bd206500232d7d65Ted Kremenek ExplodedNodeSet &Dst) { 22210620eb5164e31208fcbf0437cd79ae535ed0559Sean Hunt if (!(DD->doesThisDeclarationHaveABody() && AMgr.shouldInlineCall())) 223b13453bd8a91f331d0910ca95ad52aa41b52f648Zhongxing Xu return; 224b1b5daf30d2597e066936772bd206500232d7d65Ted Kremenek 225b13453bd8a91f331d0910ca95ad52aa41b52f648Zhongxing Xu // Create the context for 'this' region. 226b1b5daf30d2597e066936772bd206500232d7d65Ted Kremenek const StackFrameContext *SFC = 2271d26f48dc2eea1c07431ca1519d7034a21b9bcffTed Kremenek AnalysisDeclContexts.getContext(DD)-> 228b1b5daf30d2597e066936772bd206500232d7d65Ted Kremenek getStackFrame(Pred->getLocationContext(), S, 229b1b5daf30d2597e066936772bd206500232d7d65Ted Kremenek Builder->getBlock(), Builder->getIndex()); 230b13453bd8a91f331d0910ca95ad52aa41b52f648Zhongxing Xu 231b13453bd8a91f331d0910ca95ad52aa41b52f648Zhongxing Xu const CXXThisRegion *ThisR = getCXXThisRegion(DD->getParent(), SFC); 232b13453bd8a91f331d0910ca95ad52aa41b52f648Zhongxing Xu 23319b78d9e3dbbc27bbcbdd8c3017a00fe88849ecdZhongxing Xu CallEnter PP(S, SFC, Pred->getLocationContext()); 234b13453bd8a91f331d0910ca95ad52aa41b52f648Zhongxing Xu 23518c66fdc3c4008d335885695fe36fb5353c5f672Ted Kremenek const ProgramState *state = Pred->getState(); 236b13453bd8a91f331d0910ca95ad52aa41b52f648Zhongxing Xu state = state->bindLoc(loc::MemRegionVal(ThisR), loc::MemRegionVal(Dest)); 237b13453bd8a91f331d0910ca95ad52aa41b52f648Zhongxing Xu ExplodedNode *N = Builder->generateNode(PP, state, Pred); 238b13453bd8a91f331d0910ca95ad52aa41b52f648Zhongxing Xu if (N) 239b13453bd8a91f331d0910ca95ad52aa41b52f648Zhongxing Xu Dst.Add(N); 240b13453bd8a91f331d0910ca95ad52aa41b52f648Zhongxing Xu} 241b13453bd8a91f331d0910ca95ad52aa41b52f648Zhongxing Xu 242d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidisvoid ExprEngine::VisitCXXNewExpr(const CXXNewExpr *CNE, ExplodedNode *Pred, 243cb7464ab402d057849dda9749d62a62d86c35ab8Zhongxing Xu ExplodedNodeSet &Dst) { 24441c5f498b2d10fab683f1c5685ff79c90a737d24Ted Kremenek 2459d5d308c9be367ec41cc6a89f215d45f675b4617Ted Kremenek unsigned blockCount = Builder->getCurrentBlockCount(); 246c8413fd03f73084a5c93028f8b4db619fc388087Ted Kremenek DefinedOrUnknownSVal symVal = 2479d5d308c9be367ec41cc6a89f215d45f675b4617Ted Kremenek svalBuilder.getConjuredSymbolVal(NULL, CNE, CNE->getType(), blockCount); 24841c5f498b2d10fab683f1c5685ff79c90a737d24Ted Kremenek const MemRegion *NewReg = cast<loc::MemRegionVal>(symVal).getRegion(); 249cb7464ab402d057849dda9749d62a62d86c35ab8Zhongxing Xu QualType ObjTy = CNE->getType()->getAs<PointerType>()->getPointeeType(); 250cb7464ab402d057849dda9749d62a62d86c35ab8Zhongxing Xu const ElementRegion *EleReg = 25141c5f498b2d10fab683f1c5685ff79c90a737d24Ted Kremenek getStoreManager().GetElementZeroRegion(NewReg, ObjTy); 25241c5f498b2d10fab683f1c5685ff79c90a737d24Ted Kremenek 25341c5f498b2d10fab683f1c5685ff79c90a737d24Ted Kremenek if (CNE->isArray()) { 25441c5f498b2d10fab683f1c5685ff79c90a737d24Ted Kremenek // FIXME: allocating an array requires simulating the constructors. 25541c5f498b2d10fab683f1c5685ff79c90a737d24Ted Kremenek // For now, just return a symbolicated region. 25618c66fdc3c4008d335885695fe36fb5353c5f672Ted Kremenek const ProgramState *state = Pred->getState(); 25741c5f498b2d10fab683f1c5685ff79c90a737d24Ted Kremenek state = state->BindExpr(CNE, loc::MemRegionVal(EleReg)); 25841c5f498b2d10fab683f1c5685ff79c90a737d24Ted Kremenek MakeNode(Dst, CNE, Pred, state); 25941c5f498b2d10fab683f1c5685ff79c90a737d24Ted Kremenek return; 26041c5f498b2d10fab683f1c5685ff79c90a737d24Ted Kremenek } 261cb7464ab402d057849dda9749d62a62d86c35ab8Zhongxing Xu 262b17b1b3cc2b0d4d3b263b9384571bbc7f3995771Zhongxing Xu // Evaluate constructor arguments. 263b17b1b3cc2b0d4d3b263b9384571bbc7f3995771Zhongxing Xu const FunctionProtoType *FnType = NULL; 264b17b1b3cc2b0d4d3b263b9384571bbc7f3995771Zhongxing Xu const CXXConstructorDecl *CD = CNE->getConstructor(); 265b17b1b3cc2b0d4d3b263b9384571bbc7f3995771Zhongxing Xu if (CD) 266b17b1b3cc2b0d4d3b263b9384571bbc7f3995771Zhongxing Xu FnType = CD->getType()->getAs<FunctionProtoType>(); 2679c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek ExplodedNodeSet argsEvaluated; 2689c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek evalArguments(CNE->constructor_arg_begin(), CNE->constructor_arg_end(), 2699c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek FnType, Pred, argsEvaluated); 270cb7464ab402d057849dda9749d62a62d86c35ab8Zhongxing Xu 271b17b1b3cc2b0d4d3b263b9384571bbc7f3995771Zhongxing Xu // Initialize the object region and bind the 'new' expression. 2729c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek for (ExplodedNodeSet::iterator I = argsEvaluated.begin(), 2739c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek E = argsEvaluated.end(); I != E; ++I) { 2749d5d308c9be367ec41cc6a89f215d45f675b4617Ted Kremenek 27518c66fdc3c4008d335885695fe36fb5353c5f672Ted Kremenek const ProgramState *state = (*I)->getState(); 2769d5d308c9be367ec41cc6a89f215d45f675b4617Ted Kremenek 2779d5d308c9be367ec41cc6a89f215d45f675b4617Ted Kremenek // Accumulate list of regions that are invalidated. 2789d5d308c9be367ec41cc6a89f215d45f675b4617Ted Kremenek // FIXME: Eventually we should unify the logic for constructor 2799d5d308c9be367ec41cc6a89f215d45f675b4617Ted Kremenek // processing in one place. 2805f9e272e632e951b1efe824cd16acb4d96077930Chris Lattner SmallVector<const MemRegion*, 10> regionsToInvalidate; 2819d5d308c9be367ec41cc6a89f215d45f675b4617Ted Kremenek for (CXXNewExpr::const_arg_iterator 2829d5d308c9be367ec41cc6a89f215d45f675b4617Ted Kremenek ai = CNE->constructor_arg_begin(), ae = CNE->constructor_arg_end(); 2839d5d308c9be367ec41cc6a89f215d45f675b4617Ted Kremenek ai != ae; ++ai) 2849d5d308c9be367ec41cc6a89f215d45f675b4617Ted Kremenek { 2859d5d308c9be367ec41cc6a89f215d45f675b4617Ted Kremenek SVal val = state->getSVal(*ai); 2869d5d308c9be367ec41cc6a89f215d45f675b4617Ted Kremenek if (const MemRegion *region = val.getAsRegion()) 2879d5d308c9be367ec41cc6a89f215d45f675b4617Ted Kremenek regionsToInvalidate.push_back(region); 2889d5d308c9be367ec41cc6a89f215d45f675b4617Ted Kremenek } 289b17b1b3cc2b0d4d3b263b9384571bbc7f3995771Zhongxing Xu 290b17b1b3cc2b0d4d3b263b9384571bbc7f3995771Zhongxing Xu if (ObjTy->isRecordType()) { 2919d5d308c9be367ec41cc6a89f215d45f675b4617Ted Kremenek regionsToInvalidate.push_back(EleReg); 2929d5d308c9be367ec41cc6a89f215d45f675b4617Ted Kremenek // Invalidate the regions. 293537716ad8dd10f984b6cfe6985afade1185c5e3cJordy Rose state = state->invalidateRegions(regionsToInvalidate, 2949d5d308c9be367ec41cc6a89f215d45f675b4617Ted Kremenek CNE, blockCount, 0, 2959d5d308c9be367ec41cc6a89f215d45f675b4617Ted Kremenek /* invalidateGlobals = */ true); 2969d5d308c9be367ec41cc6a89f215d45f675b4617Ted Kremenek 297b17b1b3cc2b0d4d3b263b9384571bbc7f3995771Zhongxing Xu } else { 2989d5d308c9be367ec41cc6a89f215d45f675b4617Ted Kremenek // Invalidate the regions. 299537716ad8dd10f984b6cfe6985afade1185c5e3cJordy Rose state = state->invalidateRegions(regionsToInvalidate, 3009d5d308c9be367ec41cc6a89f215d45f675b4617Ted Kremenek CNE, blockCount, 0, 3019d5d308c9be367ec41cc6a89f215d45f675b4617Ted Kremenek /* invalidateGlobals = */ true); 3029d5d308c9be367ec41cc6a89f215d45f675b4617Ted Kremenek 303b17b1b3cc2b0d4d3b263b9384571bbc7f3995771Zhongxing Xu if (CNE->hasInitializer()) { 304b17b1b3cc2b0d4d3b263b9384571bbc7f3995771Zhongxing Xu SVal V = state->getSVal(*CNE->constructor_arg_begin()); 305b17b1b3cc2b0d4d3b263b9384571bbc7f3995771Zhongxing Xu state = state->bindLoc(loc::MemRegionVal(EleReg), V); 306b17b1b3cc2b0d4d3b263b9384571bbc7f3995771Zhongxing Xu } else { 307b17b1b3cc2b0d4d3b263b9384571bbc7f3995771Zhongxing Xu // Explicitly set to undefined, because currently we retrieve symbolic 308b17b1b3cc2b0d4d3b263b9384571bbc7f3995771Zhongxing Xu // value from symbolic region. 309b17b1b3cc2b0d4d3b263b9384571bbc7f3995771Zhongxing Xu state = state->bindLoc(loc::MemRegionVal(EleReg), UndefinedVal()); 310b17b1b3cc2b0d4d3b263b9384571bbc7f3995771Zhongxing Xu } 311b17b1b3cc2b0d4d3b263b9384571bbc7f3995771Zhongxing Xu } 312b17b1b3cc2b0d4d3b263b9384571bbc7f3995771Zhongxing Xu state = state->BindExpr(CNE, loc::MemRegionVal(EleReg)); 313978b935b069e9379e554a2126a525e7b9f458f62Zhongxing Xu MakeNode(Dst, CNE, *I, state); 314b17b1b3cc2b0d4d3b263b9384571bbc7f3995771Zhongxing Xu } 315cb7464ab402d057849dda9749d62a62d86c35ab8Zhongxing Xu} 316cb7464ab402d057849dda9749d62a62d86c35ab8Zhongxing Xu 317d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidisvoid ExprEngine::VisitCXXDeleteExpr(const CXXDeleteExpr *CDE, 31803509aea098772644bf4662dc1c88634818ceeccZhongxing Xu ExplodedNode *Pred,ExplodedNodeSet &Dst) { 3196b8513829895e56a7b97e787ea74520bc626512eZhongxing Xu // Should do more checking. 3209c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek ExplodedNodeSet Argevaluated; 3219c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek Visit(CDE->getArgument(), Pred, Argevaluated); 3229c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek for (ExplodedNodeSet::iterator I = Argevaluated.begin(), 3239c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek E = Argevaluated.end(); I != E; ++I) { 32418c66fdc3c4008d335885695fe36fb5353c5f672Ted Kremenek const ProgramState *state = (*I)->getState(); 3256b8513829895e56a7b97e787ea74520bc626512eZhongxing Xu MakeNode(Dst, CDE, *I, state); 3266b8513829895e56a7b97e787ea74520bc626512eZhongxing Xu } 3276b8513829895e56a7b97e787ea74520bc626512eZhongxing Xu} 328cb7464ab402d057849dda9749d62a62d86c35ab8Zhongxing Xu 329d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidisvoid ExprEngine::VisitCXXThisExpr(const CXXThisExpr *TE, ExplodedNode *Pred, 3306b8513829895e56a7b97e787ea74520bc626512eZhongxing Xu ExplodedNodeSet &Dst) { 331cb7464ab402d057849dda9749d62a62d86c35ab8Zhongxing Xu // Get the this object region from StoreManager. 332cb7464ab402d057849dda9749d62a62d86c35ab8Zhongxing Xu const MemRegion *R = 333c8413fd03f73084a5c93028f8b4db619fc388087Ted Kremenek svalBuilder.getRegionManager().getCXXThisRegion( 334cb7464ab402d057849dda9749d62a62d86c35ab8Zhongxing Xu getContext().getCanonicalType(TE->getType()), 335cb7464ab402d057849dda9749d62a62d86c35ab8Zhongxing Xu Pred->getLocationContext()); 336cb7464ab402d057849dda9749d62a62d86c35ab8Zhongxing Xu 33718c66fdc3c4008d335885695fe36fb5353c5f672Ted Kremenek const ProgramState *state = Pred->getState(); 338cb7464ab402d057849dda9749d62a62d86c35ab8Zhongxing Xu SVal V = state->getSVal(loc::MemRegionVal(R)); 339cb7464ab402d057849dda9749d62a62d86c35ab8Zhongxing Xu MakeNode(Dst, TE, Pred, state->BindExpr(TE, V)); 340cb7464ab402d057849dda9749d62a62d86c35ab8Zhongxing Xu} 341