ExprEngineCXX.cpp revision 5eca482fe895ea57bc82410222e6426c09e63284
15f7643150411b16e71bc012c6ceb2d865c0a34d4Ted Kremenek//===- ExprEngineCXX.cpp - ExprEngine support for C++ -----------*- C++ -*-===// 2cb7464ab402d057849dda9749d62a62d86c35ab8Zhongxing Xu// 3cb7464ab402d057849dda9749d62a62d86c35ab8Zhongxing Xu// The LLVM Compiler Infrastructure 4cb7464ab402d057849dda9749d62a62d86c35ab8Zhongxing Xu// 5cb7464ab402d057849dda9749d62a62d86c35ab8Zhongxing Xu// This file is distributed under the University of Illinois Open Source 6cb7464ab402d057849dda9749d62a62d86c35ab8Zhongxing Xu// License. See LICENSE.TXT for details. 7cb7464ab402d057849dda9749d62a62d86c35ab8Zhongxing Xu// 8cb7464ab402d057849dda9749d62a62d86c35ab8Zhongxing Xu//===----------------------------------------------------------------------===// 9cb7464ab402d057849dda9749d62a62d86c35ab8Zhongxing Xu// 10cb7464ab402d057849dda9749d62a62d86c35ab8Zhongxing Xu// This file defines the C++ expression evaluation engine. 11cb7464ab402d057849dda9749d62a62d86c35ab8Zhongxing Xu// 12cb7464ab402d057849dda9749d62a62d86c35ab8Zhongxing Xu//===----------------------------------------------------------------------===// 13cb7464ab402d057849dda9749d62a62d86c35ab8Zhongxing Xu 14eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis#include "clang/StaticAnalyzer/Core/CheckerManager.h" 159b663716449b618ba0390b1dbebc54fa8e971124Ted Kremenek#include "clang/StaticAnalyzer/Core/PathSensitive/AnalysisManager.h" 169b663716449b618ba0390b1dbebc54fa8e971124Ted Kremenek#include "clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h" 17d1e5a89226da79f7e6f43d40facc46abda9e5245Jordy Rose#include "clang/StaticAnalyzer/Core/PathSensitive/ObjCMessage.h" 18cb7464ab402d057849dda9749d62a62d86c35ab8Zhongxing Xu#include "clang/AST/DeclCXX.h" 19cb7464ab402d057849dda9749d62a62d86c35ab8Zhongxing Xu 20cb7464ab402d057849dda9749d62a62d86c35ab8Zhongxing Xuusing namespace clang; 219ef6537a894c33003359b1f9b9676e9178e028b7Ted Kremenekusing namespace ento; 22cb7464ab402d057849dda9749d62a62d86c35ab8Zhongxing Xu 23c69c43845aa3ede95af837b8be52868eca55d64dTed Kremeneknamespace { 24c69c43845aa3ede95af837b8be52868eca55d64dTed Kremenekclass CallExprWLItem { 25c69c43845aa3ede95af837b8be52868eca55d64dTed Kremenekpublic: 26c69c43845aa3ede95af837b8be52868eca55d64dTed Kremenek CallExpr::const_arg_iterator I; 27c69c43845aa3ede95af837b8be52868eca55d64dTed Kremenek ExplodedNode *N; 28c69c43845aa3ede95af837b8be52868eca55d64dTed Kremenek 29c69c43845aa3ede95af837b8be52868eca55d64dTed Kremenek CallExprWLItem(const CallExpr::const_arg_iterator &i, ExplodedNode *n) 30c69c43845aa3ede95af837b8be52868eca55d64dTed Kremenek : I(i), N(n) {} 31c69c43845aa3ede95af837b8be52868eca55d64dTed Kremenek}; 32c69c43845aa3ede95af837b8be52868eca55d64dTed Kremenek} 33c69c43845aa3ede95af837b8be52868eca55d64dTed Kremenek 34d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidisvoid ExprEngine::evalArguments(ConstExprIterator AI, ConstExprIterator AE, 35b17b1b3cc2b0d4d3b263b9384571bbc7f3995771Zhongxing Xu const FunctionProtoType *FnType, 3682c63bfa0c5130e0cf274c1974b6157ebefc04feMarcin Swiderski ExplodedNode *Pred, ExplodedNodeSet &Dst, 3782c63bfa0c5130e0cf274c1974b6157ebefc04feMarcin Swiderski bool FstArgAsLValue) { 38c69c43845aa3ede95af837b8be52868eca55d64dTed Kremenek 39c69c43845aa3ede95af837b8be52868eca55d64dTed Kremenek 405f9e272e632e951b1efe824cd16acb4d96077930Chris Lattner SmallVector<CallExprWLItem, 20> WorkList; 41b17b1b3cc2b0d4d3b263b9384571bbc7f3995771Zhongxing Xu WorkList.reserve(AE - AI); 42b17b1b3cc2b0d4d3b263b9384571bbc7f3995771Zhongxing Xu WorkList.push_back(CallExprWLItem(AI, Pred)); 43b17b1b3cc2b0d4d3b263b9384571bbc7f3995771Zhongxing Xu 44b17b1b3cc2b0d4d3b263b9384571bbc7f3995771Zhongxing Xu while (!WorkList.empty()) { 45b17b1b3cc2b0d4d3b263b9384571bbc7f3995771Zhongxing Xu CallExprWLItem Item = WorkList.back(); 46b17b1b3cc2b0d4d3b263b9384571bbc7f3995771Zhongxing Xu WorkList.pop_back(); 47b17b1b3cc2b0d4d3b263b9384571bbc7f3995771Zhongxing Xu 48b17b1b3cc2b0d4d3b263b9384571bbc7f3995771Zhongxing Xu if (Item.I == AE) { 49b17b1b3cc2b0d4d3b263b9384571bbc7f3995771Zhongxing Xu Dst.insert(Item.N); 50b17b1b3cc2b0d4d3b263b9384571bbc7f3995771Zhongxing Xu continue; 51b17b1b3cc2b0d4d3b263b9384571bbc7f3995771Zhongxing Xu } 52b17b1b3cc2b0d4d3b263b9384571bbc7f3995771Zhongxing Xu 53c69c43845aa3ede95af837b8be52868eca55d64dTed Kremenek // Evaluate the argument. 54b17b1b3cc2b0d4d3b263b9384571bbc7f3995771Zhongxing Xu ExplodedNodeSet Tmp; 5582c63bfa0c5130e0cf274c1974b6157ebefc04feMarcin Swiderski if (FstArgAsLValue) { 5682c63bfa0c5130e0cf274c1974b6157ebefc04feMarcin Swiderski FstArgAsLValue = false; 5782c63bfa0c5130e0cf274c1974b6157ebefc04feMarcin Swiderski } 58c69c43845aa3ede95af837b8be52868eca55d64dTed Kremenek 59892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek Visit(*Item.I, Item.N, Tmp); 60b17b1b3cc2b0d4d3b263b9384571bbc7f3995771Zhongxing Xu ++(Item.I); 61b17b1b3cc2b0d4d3b263b9384571bbc7f3995771Zhongxing Xu for (ExplodedNodeSet::iterator NI=Tmp.begin(), NE=Tmp.end(); NI != NE; ++NI) 62b17b1b3cc2b0d4d3b263b9384571bbc7f3995771Zhongxing Xu WorkList.push_back(CallExprWLItem(Item.I, *NI)); 63b17b1b3cc2b0d4d3b263b9384571bbc7f3995771Zhongxing Xu } 64b17b1b3cc2b0d4d3b263b9384571bbc7f3995771Zhongxing Xu} 65b17b1b3cc2b0d4d3b263b9384571bbc7f3995771Zhongxing Xu 66b277159055933e610bbc80262b600d3ad7e0595cTed Kremenekvoid ExprEngine::evalCallee(const CallExpr *callExpr, 67b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek const ExplodedNodeSet &src, 68b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek ExplodedNodeSet &dest) { 69b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek 70b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek const Expr *callee = 0; 71b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek 72b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek switch (callExpr->getStmtClass()) { 73b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek case Stmt::CXXMemberCallExprClass: { 74b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek // Evaluate the implicit object argument that is the recipient of the 75b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek // call. 76b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek callee = cast<CXXMemberCallExpr>(callExpr)->getImplicitObjectArgument(); 77b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek 78b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek // FIXME: handle member pointers. 79b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek if (!callee) 80b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek return; 81b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek 82b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek break; 83b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek } 84b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek default: { 85b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek callee = callExpr->getCallee()->IgnoreParens(); 86b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek break; 87b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek } 88b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek } 89b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek 90b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek for (ExplodedNodeSet::iterator i = src.begin(), e = src.end(); i != e; ++i) 91b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek Visit(callee, *i, dest); 92b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek} 93b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek 94d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidisconst CXXThisRegion *ExprEngine::getCXXThisRegion(const CXXRecordDecl *D, 95cb7464ab402d057849dda9749d62a62d86c35ab8Zhongxing Xu const StackFrameContext *SFC) { 96f4c7371fb1d3cebcfb40abad4537bb82515704eaJohn McCall const Type *T = D->getTypeForDecl(); 97b168cbfa1ca9b50115f8dd787d11d272fff2ad81John McCall QualType PT = getContext().getPointerType(QualType(T, 0)); 98c8413fd03f73084a5c93028f8b4db619fc388087Ted Kremenek return svalBuilder.getRegionManager().getCXXThisRegion(PT, SFC); 99cb7464ab402d057849dda9749d62a62d86c35ab8Zhongxing Xu} 100cb7464ab402d057849dda9749d62a62d86c35ab8Zhongxing Xu 101d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidisconst CXXThisRegion *ExprEngine::getCXXThisRegion(const CXXMethodDecl *decl, 10232303020d0f1a21cbcab65ae0c69a4218dc8f0fbZhongxing Xu const StackFrameContext *frameCtx) { 103c8413fd03f73084a5c93028f8b4db619fc388087Ted Kremenek return svalBuilder.getRegionManager(). 10432303020d0f1a21cbcab65ae0c69a4218dc8f0fbZhongxing Xu getCXXThisRegion(decl->getThisType(getContext()), frameCtx); 10532303020d0f1a21cbcab65ae0c69a4218dc8f0fbZhongxing Xu} 10632303020d0f1a21cbcab65ae0c69a4218dc8f0fbZhongxing Xu 107eea72a925f294225391ecec876a342771c09b635Ted Kremenekvoid ExprEngine::CreateCXXTemporaryObject(const MaterializeTemporaryExpr *ME, 108eea72a925f294225391ecec876a342771c09b635Ted Kremenek ExplodedNode *Pred, 109eea72a925f294225391ecec876a342771c09b635Ted Kremenek ExplodedNodeSet &Dst) { 110aa0aeb1cbe117db68d35700cb3a34aace0f99b99Anna Zaks StmtNodeBuilder Bldr(Pred, Dst, *currentBuilderContext); 1116a835dddf45922e71a87637fdfac0863de65123cTed Kremenek const Expr *tempExpr = ME->GetTemporaryExpr()->IgnoreParens(); 1126a835dddf45922e71a87637fdfac0863de65123cTed Kremenek const ProgramState *state = Pred->getState(); 1135eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek const LocationContext *LCtx = Pred->getLocationContext(); 114cb7464ab402d057849dda9749d62a62d86c35ab8Zhongxing Xu 1156a835dddf45922e71a87637fdfac0863de65123cTed Kremenek // Bind the temporary object to the value of the expression. Then bind 1166a835dddf45922e71a87637fdfac0863de65123cTed Kremenek // the expression to the location of the object. 1175eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek SVal V = state->getSVal(tempExpr, Pred->getLocationContext()); 118cb7464ab402d057849dda9749d62a62d86c35ab8Zhongxing Xu 1196a835dddf45922e71a87637fdfac0863de65123cTed Kremenek const MemRegion *R = 1205eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek svalBuilder.getRegionManager().getCXXTempObjectRegion(ME, LCtx); 121cb7464ab402d057849dda9749d62a62d86c35ab8Zhongxing Xu 1226a835dddf45922e71a87637fdfac0863de65123cTed Kremenek state = state->bindLoc(loc::MemRegionVal(R), V); 1235eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek Bldr.generateNode(ME, Pred, state->BindExpr(ME, LCtx, loc::MemRegionVal(R))); 124cb7464ab402d057849dda9749d62a62d86c35ab8Zhongxing Xu} 125cb7464ab402d057849dda9749d62a62d86c35ab8Zhongxing Xu 126d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidisvoid ExprEngine::VisitCXXConstructExpr(const CXXConstructExpr *E, 1275fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek const MemRegion *Dest, 1285fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek ExplodedNode *Pred, 1295fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek ExplodedNodeSet &destNodes) { 130cb7464ab402d057849dda9749d62a62d86c35ab8Zhongxing Xu 131cb7464ab402d057849dda9749d62a62d86c35ab8Zhongxing Xu const CXXConstructorDecl *CD = E->getConstructor(); 132cb7464ab402d057849dda9749d62a62d86c35ab8Zhongxing Xu assert(CD); 1335fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek 1345fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek#if 0 13510620eb5164e31208fcbf0437cd79ae535ed0559Sean Hunt if (!(CD->doesThisDeclarationHaveABody() && AMgr.shouldInlineCall())) 136cb7464ab402d057849dda9749d62a62d86c35ab8Zhongxing Xu // FIXME: invalidate the object. 137cb7464ab402d057849dda9749d62a62d86c35ab8Zhongxing Xu return; 1385fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek#endif 139cb7464ab402d057849dda9749d62a62d86c35ab8Zhongxing Xu 140cb7464ab402d057849dda9749d62a62d86c35ab8Zhongxing Xu // Evaluate other arguments. 1419c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek ExplodedNodeSet argsEvaluated; 142107ccd1f56836ae57c1a5a9c13c881b0293d1e98Zhongxing Xu const FunctionProtoType *FnType = CD->getType()->getAs<FunctionProtoType>(); 1439c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek evalArguments(E->arg_begin(), E->arg_end(), FnType, Pred, argsEvaluated); 1445fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek 1455fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek#if 0 1465fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek // Is the constructor elidable? 1475fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek if (E->isElidable()) { 1485fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek VisitAggExpr(E->getArg(0), destNodes, Pred, Dst); 149fc8f0e14ad142ed811e90fbd9a30e419e301c717Chris Lattner // FIXME: this is here to force propagation if VisitAggExpr doesn't 1505fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek if (destNodes.empty()) 1515fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek destNodes.Add(Pred); 1525fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek return; 1535fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek } 1545fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek#endif 1555fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek 1565fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek // Perform the previsit of the constructor. 1575fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek ExplodedNodeSet destPreVisit; 1585fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek getCheckerManager().runCheckersForPreStmt(destPreVisit, argsEvaluated, E, 1595fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek *this); 1605fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek 1615fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek // Evaluate the constructor. Currently we don't now allow checker-specific 1625fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek // implementations of specific constructors (as we do with ordinary 1635fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek // function calls. We can re-evaluate this in the future. 1645fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek 1655fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek#if 0 1665fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek // Inlining currently isn't fully implemented. 1675fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek 1685fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek if (AMgr.shouldInlineCall()) { 1695fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek if (!Dest) 1705fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek Dest = 1715fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek svalBuilder.getRegionManager().getCXXTempObjectRegion(E, 1725fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek Pred->getLocationContext()); 1735fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek 1745fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek // The callee stack frame context used to create the 'this' 1755fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek // parameter region. 1765fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek const StackFrameContext *SFC = 1775fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek AMgr.getStackFrame(CD, Pred->getLocationContext(), 178ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks E, currentBuilderContext->getBlock(), 179ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks currentStmtIdx); 1805fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek 1815fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek // Create the 'this' region. 1825fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek const CXXThisRegion *ThisR = 1835fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek getCXXThisRegion(E->getConstructor()->getParent(), SFC); 1845fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek 1855fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek CallEnter Loc(E, SFC, Pred->getLocationContext()); 1865fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek 187aa0aeb1cbe117db68d35700cb3a34aace0f99b99Anna Zaks StmtNodeBuilder Bldr(argsEvaluated, destNodes, *currentBuilderContext); 1885fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek for (ExplodedNodeSet::iterator NI = argsEvaluated.begin(), 1895fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek NE = argsEvaluated.end(); NI != NE; ++NI) { 19018c66fdc3c4008d335885695fe36fb5353c5f672Ted Kremenek const ProgramState *state = (*NI)->getState(); 1915fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek // Setup 'this' region, so that the ctor is evaluated on the object pointed 1925fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek // by 'Dest'. 1935fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek state = state->bindLoc(loc::MemRegionVal(ThisR), loc::MemRegionVal(Dest)); 194ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.generateNode(Loc, *NI, state); 1955fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek } 196cb7464ab402d057849dda9749d62a62d86c35ab8Zhongxing Xu } 1975fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek#endif 1985fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek 1995fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek // Default semantics: invalidate all regions passed as arguments. 2005fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek ExplodedNodeSet destCall; 2015fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek { 202aa0aeb1cbe117db68d35700cb3a34aace0f99b99Anna Zaks StmtNodeBuilder Bldr(destPreVisit, destCall, *currentBuilderContext); 203ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks for (ExplodedNodeSet::iterator 204ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks i = destPreVisit.begin(), e = destPreVisit.end(); 205ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks i != e; ++i) 206ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks { 207ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks ExplodedNode *Pred = *i; 208ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks const LocationContext *LC = Pred->getLocationContext(); 209ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks const ProgramState *state = Pred->getState(); 2105fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek 2115eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek state = invalidateArguments(state, CallOrObjCMessage(E, state, LC), LC); 212ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.generateNode(E, Pred, state); 213ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks } 2145fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek } 2155fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek // Do the post visit. 2165fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek getCheckerManager().runCheckersForPostStmt(destNodes, destCall, E, *this); 217cb7464ab402d057849dda9749d62a62d86c35ab8Zhongxing Xu} 218cb7464ab402d057849dda9749d62a62d86c35ab8Zhongxing Xu 219d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidisvoid ExprEngine::VisitCXXDestructor(const CXXDestructorDecl *DD, 220ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks const MemRegion *Dest, 221ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks const Stmt *S, 222ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks ExplodedNode *Pred, 223ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks ExplodedNodeSet &Dst) { 224aa0aeb1cbe117db68d35700cb3a34aace0f99b99Anna Zaks StmtNodeBuilder Bldr(Pred, Dst, *currentBuilderContext); 22510620eb5164e31208fcbf0437cd79ae535ed0559Sean Hunt if (!(DD->doesThisDeclarationHaveABody() && AMgr.shouldInlineCall())) 226b13453bd8a91f331d0910ca95ad52aa41b52f648Zhongxing Xu return; 227b1b5daf30d2597e066936772bd206500232d7d65Ted Kremenek 228b13453bd8a91f331d0910ca95ad52aa41b52f648Zhongxing Xu // Create the context for 'this' region. 229b1b5daf30d2597e066936772bd206500232d7d65Ted Kremenek const StackFrameContext *SFC = 2301d26f48dc2eea1c07431ca1519d7034a21b9bcffTed Kremenek AnalysisDeclContexts.getContext(DD)-> 231b1b5daf30d2597e066936772bd206500232d7d65Ted Kremenek getStackFrame(Pred->getLocationContext(), S, 232ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks currentBuilderContext->getBlock(), currentStmtIdx); 233b13453bd8a91f331d0910ca95ad52aa41b52f648Zhongxing Xu 234b13453bd8a91f331d0910ca95ad52aa41b52f648Zhongxing Xu const CXXThisRegion *ThisR = getCXXThisRegion(DD->getParent(), SFC); 235b13453bd8a91f331d0910ca95ad52aa41b52f648Zhongxing Xu 23619b78d9e3dbbc27bbcbdd8c3017a00fe88849ecdZhongxing Xu CallEnter PP(S, SFC, Pred->getLocationContext()); 237b13453bd8a91f331d0910ca95ad52aa41b52f648Zhongxing Xu 23818c66fdc3c4008d335885695fe36fb5353c5f672Ted Kremenek const ProgramState *state = Pred->getState(); 239b13453bd8a91f331d0910ca95ad52aa41b52f648Zhongxing Xu state = state->bindLoc(loc::MemRegionVal(ThisR), loc::MemRegionVal(Dest)); 240ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.generateNode(PP, Pred, state); 241b13453bd8a91f331d0910ca95ad52aa41b52f648Zhongxing Xu} 242b13453bd8a91f331d0910ca95ad52aa41b52f648Zhongxing Xu 243d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidisvoid ExprEngine::VisitCXXNewExpr(const CXXNewExpr *CNE, ExplodedNode *Pred, 244cb7464ab402d057849dda9749d62a62d86c35ab8Zhongxing Xu ExplodedNodeSet &Dst) { 245aa0aeb1cbe117db68d35700cb3a34aace0f99b99Anna Zaks StmtNodeBuilder Bldr(Pred, Dst, *currentBuilderContext); 24641c5f498b2d10fab683f1c5685ff79c90a737d24Ted Kremenek 247ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks unsigned blockCount = currentBuilderContext->getCurrentBlockCount(); 248c8413fd03f73084a5c93028f8b4db619fc388087Ted Kremenek DefinedOrUnknownSVal symVal = 2499d5d308c9be367ec41cc6a89f215d45f675b4617Ted Kremenek svalBuilder.getConjuredSymbolVal(NULL, CNE, CNE->getType(), blockCount); 25041c5f498b2d10fab683f1c5685ff79c90a737d24Ted Kremenek const MemRegion *NewReg = cast<loc::MemRegionVal>(symVal).getRegion(); 251cb7464ab402d057849dda9749d62a62d86c35ab8Zhongxing Xu QualType ObjTy = CNE->getType()->getAs<PointerType>()->getPointeeType(); 252cb7464ab402d057849dda9749d62a62d86c35ab8Zhongxing Xu const ElementRegion *EleReg = 25341c5f498b2d10fab683f1c5685ff79c90a737d24Ted Kremenek getStoreManager().GetElementZeroRegion(NewReg, ObjTy); 25441c5f498b2d10fab683f1c5685ff79c90a737d24Ted Kremenek 25541c5f498b2d10fab683f1c5685ff79c90a737d24Ted Kremenek if (CNE->isArray()) { 25641c5f498b2d10fab683f1c5685ff79c90a737d24Ted Kremenek // FIXME: allocating an array requires simulating the constructors. 25741c5f498b2d10fab683f1c5685ff79c90a737d24Ted Kremenek // For now, just return a symbolicated region. 25818c66fdc3c4008d335885695fe36fb5353c5f672Ted Kremenek const ProgramState *state = Pred->getState(); 2595eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek state = state->BindExpr(CNE, Pred->getLocationContext(), 2605eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek loc::MemRegionVal(EleReg)); 261ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.generateNode(CNE, Pred, state); 26241c5f498b2d10fab683f1c5685ff79c90a737d24Ted Kremenek return; 26341c5f498b2d10fab683f1c5685ff79c90a737d24Ted Kremenek } 264cb7464ab402d057849dda9749d62a62d86c35ab8Zhongxing Xu 265b17b1b3cc2b0d4d3b263b9384571bbc7f3995771Zhongxing Xu // Evaluate constructor arguments. 266b17b1b3cc2b0d4d3b263b9384571bbc7f3995771Zhongxing Xu const FunctionProtoType *FnType = NULL; 267b17b1b3cc2b0d4d3b263b9384571bbc7f3995771Zhongxing Xu const CXXConstructorDecl *CD = CNE->getConstructor(); 268b17b1b3cc2b0d4d3b263b9384571bbc7f3995771Zhongxing Xu if (CD) 269b17b1b3cc2b0d4d3b263b9384571bbc7f3995771Zhongxing Xu FnType = CD->getType()->getAs<FunctionProtoType>(); 2709c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek ExplodedNodeSet argsEvaluated; 271ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.takeNodes(Pred); 2729c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek evalArguments(CNE->constructor_arg_begin(), CNE->constructor_arg_end(), 2739c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek FnType, Pred, argsEvaluated); 274ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.addNodes(argsEvaluated); 275cb7464ab402d057849dda9749d62a62d86c35ab8Zhongxing Xu 276b17b1b3cc2b0d4d3b263b9384571bbc7f3995771Zhongxing Xu // Initialize the object region and bind the 'new' expression. 2779c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek for (ExplodedNodeSet::iterator I = argsEvaluated.begin(), 2789c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek E = argsEvaluated.end(); I != E; ++I) { 2799d5d308c9be367ec41cc6a89f215d45f675b4617Ted Kremenek 28018c66fdc3c4008d335885695fe36fb5353c5f672Ted Kremenek const ProgramState *state = (*I)->getState(); 2819d5d308c9be367ec41cc6a89f215d45f675b4617Ted Kremenek 2829d5d308c9be367ec41cc6a89f215d45f675b4617Ted Kremenek // Accumulate list of regions that are invalidated. 2839d5d308c9be367ec41cc6a89f215d45f675b4617Ted Kremenek // FIXME: Eventually we should unify the logic for constructor 2849d5d308c9be367ec41cc6a89f215d45f675b4617Ted Kremenek // processing in one place. 2855f9e272e632e951b1efe824cd16acb4d96077930Chris Lattner SmallVector<const MemRegion*, 10> regionsToInvalidate; 2869d5d308c9be367ec41cc6a89f215d45f675b4617Ted Kremenek for (CXXNewExpr::const_arg_iterator 2879d5d308c9be367ec41cc6a89f215d45f675b4617Ted Kremenek ai = CNE->constructor_arg_begin(), ae = CNE->constructor_arg_end(); 2889d5d308c9be367ec41cc6a89f215d45f675b4617Ted Kremenek ai != ae; ++ai) 2899d5d308c9be367ec41cc6a89f215d45f675b4617Ted Kremenek { 2905eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek SVal val = state->getSVal(*ai, (*I)->getLocationContext()); 2919d5d308c9be367ec41cc6a89f215d45f675b4617Ted Kremenek if (const MemRegion *region = val.getAsRegion()) 2929d5d308c9be367ec41cc6a89f215d45f675b4617Ted Kremenek regionsToInvalidate.push_back(region); 2939d5d308c9be367ec41cc6a89f215d45f675b4617Ted Kremenek } 294b17b1b3cc2b0d4d3b263b9384571bbc7f3995771Zhongxing Xu 295b17b1b3cc2b0d4d3b263b9384571bbc7f3995771Zhongxing Xu if (ObjTy->isRecordType()) { 2969d5d308c9be367ec41cc6a89f215d45f675b4617Ted Kremenek regionsToInvalidate.push_back(EleReg); 2979d5d308c9be367ec41cc6a89f215d45f675b4617Ted Kremenek // Invalidate the regions. 298eb31a76d1cdaaf8874c549dc6bd964ff270d3822Anna Zaks // TODO: Pass the call to new information as the last argument, to limit 299eb31a76d1cdaaf8874c549dc6bd964ff270d3822Anna Zaks // the globals which will get invalidated. 300537716ad8dd10f984b6cfe6985afade1185c5e3cJordy Rose state = state->invalidateRegions(regionsToInvalidate, 301eb31a76d1cdaaf8874c549dc6bd964ff270d3822Anna Zaks CNE, blockCount, 0, 0); 3029d5d308c9be367ec41cc6a89f215d45f675b4617Ted Kremenek 303b17b1b3cc2b0d4d3b263b9384571bbc7f3995771Zhongxing Xu } else { 3049d5d308c9be367ec41cc6a89f215d45f675b4617Ted Kremenek // Invalidate the regions. 305eb31a76d1cdaaf8874c549dc6bd964ff270d3822Anna Zaks // TODO: Pass the call to new information as the last argument, to limit 306eb31a76d1cdaaf8874c549dc6bd964ff270d3822Anna Zaks // the globals which will get invalidated. 307537716ad8dd10f984b6cfe6985afade1185c5e3cJordy Rose state = state->invalidateRegions(regionsToInvalidate, 308eb31a76d1cdaaf8874c549dc6bd964ff270d3822Anna Zaks CNE, blockCount, 0, 0); 3099d5d308c9be367ec41cc6a89f215d45f675b4617Ted Kremenek 310b17b1b3cc2b0d4d3b263b9384571bbc7f3995771Zhongxing Xu if (CNE->hasInitializer()) { 3115eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek SVal V = state->getSVal(*CNE->constructor_arg_begin(), 3125eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek (*I)->getLocationContext()); 313b17b1b3cc2b0d4d3b263b9384571bbc7f3995771Zhongxing Xu state = state->bindLoc(loc::MemRegionVal(EleReg), V); 314b17b1b3cc2b0d4d3b263b9384571bbc7f3995771Zhongxing Xu } else { 315b17b1b3cc2b0d4d3b263b9384571bbc7f3995771Zhongxing Xu // Explicitly set to undefined, because currently we retrieve symbolic 316b17b1b3cc2b0d4d3b263b9384571bbc7f3995771Zhongxing Xu // value from symbolic region. 317b17b1b3cc2b0d4d3b263b9384571bbc7f3995771Zhongxing Xu state = state->bindLoc(loc::MemRegionVal(EleReg), UndefinedVal()); 318b17b1b3cc2b0d4d3b263b9384571bbc7f3995771Zhongxing Xu } 319b17b1b3cc2b0d4d3b263b9384571bbc7f3995771Zhongxing Xu } 3205eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek state = state->BindExpr(CNE, (*I)->getLocationContext(), 3215eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek loc::MemRegionVal(EleReg)); 322ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.generateNode(CNE, *I, state); 323b17b1b3cc2b0d4d3b263b9384571bbc7f3995771Zhongxing Xu } 324cb7464ab402d057849dda9749d62a62d86c35ab8Zhongxing Xu} 325cb7464ab402d057849dda9749d62a62d86c35ab8Zhongxing Xu 326d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidisvoid ExprEngine::VisitCXXDeleteExpr(const CXXDeleteExpr *CDE, 327ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks ExplodedNode *Pred, ExplodedNodeSet &Dst) { 3286b8513829895e56a7b97e787ea74520bc626512eZhongxing Xu // Should do more checking. 3299c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek ExplodedNodeSet Argevaluated; 3309c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek Visit(CDE->getArgument(), Pred, Argevaluated); 331aa0aeb1cbe117db68d35700cb3a34aace0f99b99Anna Zaks StmtNodeBuilder Bldr(Argevaluated, Dst, *currentBuilderContext); 3329c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek for (ExplodedNodeSet::iterator I = Argevaluated.begin(), 3339c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek E = Argevaluated.end(); I != E; ++I) { 33418c66fdc3c4008d335885695fe36fb5353c5f672Ted Kremenek const ProgramState *state = (*I)->getState(); 335ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.generateNode(CDE, *I, state); 3366b8513829895e56a7b97e787ea74520bc626512eZhongxing Xu } 3376b8513829895e56a7b97e787ea74520bc626512eZhongxing Xu} 338cb7464ab402d057849dda9749d62a62d86c35ab8Zhongxing Xu 339d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidisvoid ExprEngine::VisitCXXThisExpr(const CXXThisExpr *TE, ExplodedNode *Pred, 3406b8513829895e56a7b97e787ea74520bc626512eZhongxing Xu ExplodedNodeSet &Dst) { 341aa0aeb1cbe117db68d35700cb3a34aace0f99b99Anna Zaks StmtNodeBuilder Bldr(Pred, Dst, *currentBuilderContext); 342ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks 343cb7464ab402d057849dda9749d62a62d86c35ab8Zhongxing Xu // Get the this object region from StoreManager. 3445eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek const LocationContext *LCtx = Pred->getLocationContext(); 345cb7464ab402d057849dda9749d62a62d86c35ab8Zhongxing Xu const MemRegion *R = 346c8413fd03f73084a5c93028f8b4db619fc388087Ted Kremenek svalBuilder.getRegionManager().getCXXThisRegion( 347cb7464ab402d057849dda9749d62a62d86c35ab8Zhongxing Xu getContext().getCanonicalType(TE->getType()), 3485eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek LCtx); 349cb7464ab402d057849dda9749d62a62d86c35ab8Zhongxing Xu 35018c66fdc3c4008d335885695fe36fb5353c5f672Ted Kremenek const ProgramState *state = Pred->getState(); 351cb7464ab402d057849dda9749d62a62d86c35ab8Zhongxing Xu SVal V = state->getSVal(loc::MemRegionVal(R)); 3525eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek Bldr.generateNode(TE, Pred, state->BindExpr(TE, LCtx, V)); 353cb7464ab402d057849dda9749d62a62d86c35ab8Zhongxing Xu} 354