ExprEngine.cpp revision 46fc3fae1cf1926a3b8138bca4adeda37c41f92c
1d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidis//=-- ExprEngine.cpp - Path-Sensitive Expression-Level Dataflow ---*- C++ -*-= 264924859b6b09d1cfb62fecf5954ec6c27cb58feTed Kremenek// 34af84313df0d2710fd57af89132e680294225cadTed Kremenek// The LLVM Compiler Infrastructure 4d27f8169f4b68337a489547a41ac45bf7a5d1ddfTed Kremenek// 5d27f8169f4b68337a489547a41ac45bf7a5d1ddfTed Kremenek// This file is distributed under the University of Illinois Open Source 6d27f8169f4b68337a489547a41ac45bf7a5d1ddfTed Kremenek// License. See LICENSE.TXT for details. 7d27f8169f4b68337a489547a41ac45bf7a5d1ddfTed Kremenek// 8d27f8169f4b68337a489547a41ac45bf7a5d1ddfTed Kremenek//===----------------------------------------------------------------------===// 9d27f8169f4b68337a489547a41ac45bf7a5d1ddfTed Kremenek// 1077349cb20bfd7069d081f84c91975bfa8ef60a32Ted Kremenek// This file defines a meta-engine for path-sensitive dataflow analysis that 1177349cb20bfd7069d081f84c91975bfa8ef60a32Ted Kremenek// is built on GREngine, but provides the boilerplate to execute transfer 1277349cb20bfd7069d081f84c91975bfa8ef60a32Ted Kremenek// functions and build the ExplodedGraph at the expression level. 13d27f8169f4b68337a489547a41ac45bf7a5d1ddfTed Kremenek// 14d27f8169f4b68337a489547a41ac45bf7a5d1ddfTed Kremenek//===----------------------------------------------------------------------===// 15a7af5ea88a6c5bdf87497cca6c20831e8c546751Argyrios Kyrtzidis 1643dee220252ef0b42c5f8a3bb1eca97f84f2565fArgyrios Kyrtzidis#include "clang/StaticAnalyzer/Core/CheckerManager.h" 179b663716449b618ba0390b1dbebc54fa8e971124Ted Kremenek#include "clang/StaticAnalyzer/Core/BugReporter/BugType.h" 189b663716449b618ba0390b1dbebc54fa8e971124Ted Kremenek#include "clang/StaticAnalyzer/Core/PathSensitive/AnalysisManager.h" 199b663716449b618ba0390b1dbebc54fa8e971124Ted Kremenek#include "clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h" 209b663716449b618ba0390b1dbebc54fa8e971124Ted Kremenek#include "clang/StaticAnalyzer/Core/PathSensitive/ExprEngineBuilders.h" 21199c3d6cd16aebbb9c7f0d42af9d922c9628bf70Ken Dyck#include "clang/AST/CharUnits.h" 2216f0049415ec596504891259e2a83e19871c0d52Chris Lattner#include "clang/AST/ParentMap.h" 2316f0049415ec596504891259e2a83e19871c0d52Chris Lattner#include "clang/AST/StmtObjC.h" 24c506357c3778092c2a3251243f12524e8eb89274Zhongxing Xu#include "clang/AST/DeclCXX.h" 251b63e4f732dbc73d90abf886b4d21f8e3a165f6dChris Lattner#include "clang/Basic/Builtins.h" 2616f0049415ec596504891259e2a83e19871c0d52Chris Lattner#include "clang/Basic/SourceManager.h" 27e97ca065c91ff9ca2a2a42eb443eaa553c40441cTed Kremenek#include "clang/Basic/SourceManager.h" 280bed8a12f2878d3cd94fb8bdba55b593d92dd11aTed Kremenek#include "clang/Basic/PrettyStackTrace.h" 29a95d3750441ac8ad03e36af8e6e74039c9a3109dTed Kremenek#include "llvm/Support/raw_ostream.h" 306cb7c1a43b0c8f739d1f54b7fdae5ede86033496Benjamin Kramer#include "llvm/ADT/ImmutableList.h" 314323a57627e796dcfdfdb7d47672dc09ed308edaTed Kremenek 320f5f0595d6a038843a7051c5a65fca7bce2915a0Ted Kremenek#ifndef NDEBUG 330f5f0595d6a038843a7051c5a65fca7bce2915a0Ted Kremenek#include "llvm/Support/GraphWriter.h" 340f5f0595d6a038843a7051c5a65fca7bce2915a0Ted Kremenek#endif 350f5f0595d6a038843a7051c5a65fca7bce2915a0Ted Kremenek 36b387a3f23e423d62c053be86294b703da1d1a222Ted Kremenekusing namespace clang; 379ef6537a894c33003359b1f9b9676e9178e028b7Ted Kremenekusing namespace ento; 38b387a3f23e423d62c053be86294b703da1d1a222Ted Kremenekusing llvm::dyn_cast; 39852274d4257134906995cb252fb3dfd2d71deae8Ted Kremenekusing llvm::dyn_cast_or_null; 40b387a3f23e423d62c053be86294b703da1d1a222Ted Kremenekusing llvm::cast; 41b387a3f23e423d62c053be86294b703da1d1a222Ted Kremenekusing llvm::APSInt; 42ab2b8c54bca82866876f91e756788916d3fa20c3Ted Kremenek 436190ec29f0895185bbec95a932429b8832917fecZhongxing Xunamespace { 446190ec29f0895185bbec95a932429b8832917fecZhongxing Xu // Trait class for recording returned expression in the state. 456190ec29f0895185bbec95a932429b8832917fecZhongxing Xu struct ReturnExpr { 466190ec29f0895185bbec95a932429b8832917fecZhongxing Xu static int TagInt; 476190ec29f0895185bbec95a932429b8832917fecZhongxing Xu typedef const Stmt *data_type; 486190ec29f0895185bbec95a932429b8832917fecZhongxing Xu }; 496190ec29f0895185bbec95a932429b8832917fecZhongxing Xu int ReturnExpr::TagInt; 506190ec29f0895185bbec95a932429b8832917fecZhongxing Xu} 516190ec29f0895185bbec95a932429b8832917fecZhongxing Xu 52e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek//===----------------------------------------------------------------------===// 5332c4995826c76f282fc05fbbc3241d2dded4fb57Ted Kremenek// Utility functions. 5432c4995826c76f282fc05fbbc3241d2dded4fb57Ted Kremenek//===----------------------------------------------------------------------===// 5532c4995826c76f282fc05fbbc3241d2dded4fb57Ted Kremenek 5632c4995826c76f282fc05fbbc3241d2dded4fb57Ted Kremenekstatic inline Selector GetNullarySelector(const char* name, ASTContext& Ctx) { 5732c4995826c76f282fc05fbbc3241d2dded4fb57Ted Kremenek IdentifierInfo* II = &Ctx.Idents.get(name); 5832c4995826c76f282fc05fbbc3241d2dded4fb57Ted Kremenek return Ctx.Selectors.getSelector(0, &II); 5932c4995826c76f282fc05fbbc3241d2dded4fb57Ted Kremenek} 6032c4995826c76f282fc05fbbc3241d2dded4fb57Ted Kremenek 6132c4995826c76f282fc05fbbc3241d2dded4fb57Ted Kremenek//===----------------------------------------------------------------------===// 62bdb435ddaafd5069becd543d638112f68825b89dTed Kremenek// Engine construction and deletion. 63bdb435ddaafd5069becd543d638112f68825b89dTed Kremenek//===----------------------------------------------------------------------===// 64bdb435ddaafd5069becd543d638112f68825b89dTed Kremenek 65d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios KyrtzidisExprEngine::ExprEngine(AnalysisManager &mgr, TransferFuncs *tf) 6625e695b2d574d919cc1bbddf3a2efe073d449b1cZhongxing Xu : AMgr(mgr), 67d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidis Engine(*this), 68d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidis G(Engine.getGraph()), 6950a6d0ce344c02782e0207574005c3b2aaa5077cTed Kremenek Builder(NULL), 70c77a55126fcad66fb086f8e100a494caa2496a2dZhongxing Xu StateMgr(getContext(), mgr.getStoreManagerCreator(), 7132a58084a4c53e6938dd81bfce224db25a5976d1Ted Kremenek mgr.getConstraintManagerCreator(), G.getAllocator(), 7232a58084a4c53e6938dd81bfce224db25a5976d1Ted Kremenek *this), 7350a6d0ce344c02782e0207574005c3b2aaa5077cTed Kremenek SymMgr(StateMgr.getSymbolManager()), 74c8413fd03f73084a5c93028f8b4db619fc388087Ted Kremenek svalBuilder(StateMgr.getSValBuilder()), 750a3ed3143b00f237decb1288c1ff574ae09eba4eTed Kremenek EntryNode(NULL), currentStmt(NULL), 76a5a4166f8cb04490b7b27355874edfb98837cd45Zhongxing Xu NSExceptionII(NULL), NSExceptionInstanceRaiseSelectors(NULL), 77c77a55126fcad66fb086f8e100a494caa2496a2dZhongxing Xu RaiseSel(GetNullarySelector("raise", getContext())), 7832a58084a4c53e6938dd81bfce224db25a5976d1Ted Kremenek BR(mgr, *this), TF(tf) { 79b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 8032a58084a4c53e6938dd81bfce224db25a5976d1Ted Kremenek // FIXME: Eventually remove the TF object entirely. 8132a58084a4c53e6938dd81bfce224db25a5976d1Ted Kremenek TF->RegisterChecks(*this); 8232a58084a4c53e6938dd81bfce224db25a5976d1Ted Kremenek TF->RegisterPrinters(getStateManager().Printers); 83d767d81290288c030f3be0be1d3e62b9c8df51dcTed Kremenek 84d767d81290288c030f3be0be1d3e62b9c8df51dcTed Kremenek if (mgr.shouldEagerlyTrimExplodedGraph()) { 85d767d81290288c030f3be0be1d3e62b9c8df51dcTed Kremenek // Enable eager node reclaimation when constructing the ExplodedGraph. 86d767d81290288c030f3be0be1d3e62b9c8df51dcTed Kremenek G.enableNodeReclamation(); 87d767d81290288c030f3be0be1d3e62b9c8df51dcTed Kremenek } 88c80135ba857da48173578b9c528fce6777e18168Ted Kremenek} 8950a6d0ce344c02782e0207574005c3b2aaa5077cTed Kremenek 90d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios KyrtzidisExprEngine::~ExprEngine() { 91cf118d41f7930a18dce97416ef7834a62642f587Ted Kremenek BR.FlushReports(); 92e448ab4f9dd162802f5d7cfea60f7830cc61c654Ted Kremenek delete [] NSExceptionInstanceRaiseSelectors; 9350a6d0ce344c02782e0207574005c3b2aaa5077cTed Kremenek} 9450a6d0ce344c02782e0207574005c3b2aaa5077cTed Kremenek 95e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek//===----------------------------------------------------------------------===// 96e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek// Utility methods. 97e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek//===----------------------------------------------------------------------===// 98e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek 99d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidisconst GRState* ExprEngine::getInitialState(const LocationContext *InitLoc) { 10017fd8632dcda97022a51effc24060eacdad9dbe0Zhongxing Xu const GRState *state = StateMgr.getInitialState(InitLoc); 1011eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 102cfcd7fd0de701c5ce05e96de1ed2d0bf8c7035d9Ted Kremenek // Preconditions. 103cfcd7fd0de701c5ce05e96de1ed2d0bf8c7035d9Ted Kremenek 10452e5602056e4cade24cbcca57767e94e1d430b03Ted Kremenek // FIXME: It would be nice if we had a more general mechanism to add 10552e5602056e4cade24cbcca57767e94e1d430b03Ted Kremenek // such preconditions. Some day. 1065974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek do { 107b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek const Decl *D = InitLoc->getDecl(); 1085974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek if (const FunctionDecl *FD = dyn_cast<FunctionDecl>(D)) { 1095974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek // Precondition: the first argument of 'main' is an integer guaranteed 1105974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek // to be > 0. 1115974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek const IdentifierInfo *II = FD->getIdentifier(); 1125974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek if (!II || !(II->getName() == "main" && FD->getNumParams() > 0)) 1135974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek break; 1145974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek 1155974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek const ParmVarDecl *PD = FD->getParamDecl(0); 1165974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek QualType T = PD->getType(); 1175974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek if (!T->isIntegerType()) 1185974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek break; 119b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 1205974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek const MemRegion *R = state->getRegion(PD, InitLoc); 1215974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek if (!R) 1225974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek break; 123b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 1241397663af9dbcc24dbf0e11de43931b3dc08fdbbTed Kremenek SVal V = state->getSVal(loc::MemRegionVal(R)); 1259c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek SVal Constraint_untested = evalBinOp(state, BO_GT, V, 126c8413fd03f73084a5c93028f8b4db619fc388087Ted Kremenek svalBuilder.makeZeroVal(T), 1275974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek getContext().IntTy); 1285974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek 1295974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek DefinedOrUnknownSVal *Constraint = 1305974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek dyn_cast<DefinedOrUnknownSVal>(&Constraint_untested); 131b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 1325974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek if (!Constraint) 1335974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek break; 134b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 13528f47b92e760ccf641ac91cb0fe1c12d9ca89795Ted Kremenek if (const GRState *newState = state->assume(*Constraint, true)) 1365974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek state = newState; 137b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 1385974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek break; 13952e5602056e4cade24cbcca57767e94e1d430b03Ted Kremenek } 1405974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek 141b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek if (const ObjCMethodDecl *MD = dyn_cast<ObjCMethodDecl>(D)) { 1425974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek // Precondition: 'self' is always non-null upon entry to an Objective-C 1435974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek // method. 1445974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek const ImplicitParamDecl *SelfD = MD->getSelfDecl(); 1455974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek const MemRegion *R = state->getRegion(SelfD, InitLoc); 1461397663af9dbcc24dbf0e11de43931b3dc08fdbbTed Kremenek SVal V = state->getSVal(loc::MemRegionVal(R)); 147b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 1485974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek if (const Loc *LV = dyn_cast<Loc>(&V)) { 1495974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek // Assume that the pointer value in 'self' is non-null. 15028f47b92e760ccf641ac91cb0fe1c12d9ca89795Ted Kremenek state = state->assume(*LV, true); 1515974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek assert(state && "'self' cannot be null"); 1525974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek } 153cfcd7fd0de701c5ce05e96de1ed2d0bf8c7035d9Ted Kremenek } 1545974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek } while (0); 155b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 15652e5602056e4cade24cbcca57767e94e1d430b03Ted Kremenek return state; 157e070a1df66aab6d4168fb28f7559fdf996df3567Ted Kremenek} 158e070a1df66aab6d4168fb28f7559fdf996df3567Ted Kremenek 159e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek//===----------------------------------------------------------------------===// 160e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek// Top-level transfer function logic (Dispatcher). 161e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek//===----------------------------------------------------------------------===// 162e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek 1639c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek/// evalAssume - Called by ConstraintManager. Used to call checker-specific 16432a58084a4c53e6938dd81bfce224db25a5976d1Ted Kremenek/// logic for handling assumptions on symbolic values. 165e36de1fe51c39d9161915dd3dbef880954af6476Ted Kremenekconst GRState *ExprEngine::processAssume(const GRState *state, SVal cond, 166b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek bool assumption) { 167312dbec867f6b8d6b86fd562c53352cd4db27468Argyrios Kyrtzidis state = getCheckerManager().runCheckersForEvalAssume(state, cond, assumption); 168312dbec867f6b8d6b86fd562c53352cd4db27468Argyrios Kyrtzidis 16972905cfa81cfd126f322c4173f56d332aac5539eJordy Rose // If the state is infeasible at this point, bail out. 17032a58084a4c53e6938dd81bfce224db25a5976d1Ted Kremenek if (!state) 17132a58084a4c53e6938dd81bfce224db25a5976d1Ted Kremenek return NULL; 172b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 1739c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek return TF->evalAssume(state, cond, assumption); 17432a58084a4c53e6938dd81bfce224db25a5976d1Ted Kremenek} 17532a58084a4c53e6938dd81bfce224db25a5976d1Ted Kremenek 176e36de1fe51c39d9161915dd3dbef880954af6476Ted Kremenekbool ExprEngine::wantsRegionChangeUpdate(const GRState* state) { 177183ff98f425d470c2a0276880aaf43496c9dad14Argyrios Kyrtzidis return getCheckerManager().wantsRegionChangeUpdate(state); 178c2b7dfaad674587cfd220ff447b3710d252130c3Jordy Rose} 179c2b7dfaad674587cfd220ff447b3710d252130c3Jordy Rose 180c2b7dfaad674587cfd220ff447b3710d252130c3Jordy Roseconst GRState * 181e36de1fe51c39d9161915dd3dbef880954af6476Ted KremenekExprEngine::processRegionChanges(const GRState *state, 182c2b7dfaad674587cfd220ff447b3710d252130c3Jordy Rose const MemRegion * const *Begin, 183c2b7dfaad674587cfd220ff447b3710d252130c3Jordy Rose const MemRegion * const *End) { 184183ff98f425d470c2a0276880aaf43496c9dad14Argyrios Kyrtzidis return getCheckerManager().runCheckersForRegionChanges(state, Begin, End); 185c2b7dfaad674587cfd220ff447b3710d252130c3Jordy Rose} 186c2b7dfaad674587cfd220ff447b3710d252130c3Jordy Rose 187e36de1fe51c39d9161915dd3dbef880954af6476Ted Kremenekvoid ExprEngine::processEndWorklist(bool hasWorkRemaining) { 18830726c6baee1417307236e854f1474fdb3cedb98Argyrios Kyrtzidis getCheckerManager().runCheckersForEndAnalysis(G, BR, *this); 189ccc263b44c62ce3a02f797a3ddb3d6017cf0e5e4Ted Kremenek} 190ccc263b44c62ce3a02f797a3ddb3d6017cf0e5e4Ted Kremenek 191e36de1fe51c39d9161915dd3dbef880954af6476Ted Kremenekvoid ExprEngine::processCFGElement(const CFGElement E, 192d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidis StmtNodeBuilder& builder) { 1939c6cd67ea416bace666d614c84d5531124287653Zhongxing Xu switch (E.getKind()) { 1943c0349e87cdbd7316d06d2411d86ee1086e717a5Ted Kremenek case CFGElement::Invalid: 1953c0349e87cdbd7316d06d2411d86ee1086e717a5Ted Kremenek llvm_unreachable("Unexpected CFGElement kind."); 1963c0349e87cdbd7316d06d2411d86ee1086e717a5Ted Kremenek case CFGElement::Statement: 1973c0349e87cdbd7316d06d2411d86ee1086e717a5Ted Kremenek ProcessStmt(E.getAs<CFGStmt>()->getStmt(), builder); 1983c0349e87cdbd7316d06d2411d86ee1086e717a5Ted Kremenek return; 1993c0349e87cdbd7316d06d2411d86ee1086e717a5Ted Kremenek case CFGElement::Initializer: 2003c0349e87cdbd7316d06d2411d86ee1086e717a5Ted Kremenek ProcessInitializer(E.getAs<CFGInitializer>()->getInitializer(), builder); 2013c0349e87cdbd7316d06d2411d86ee1086e717a5Ted Kremenek return; 2023c0349e87cdbd7316d06d2411d86ee1086e717a5Ted Kremenek case CFGElement::AutomaticObjectDtor: 2033c0349e87cdbd7316d06d2411d86ee1086e717a5Ted Kremenek case CFGElement::BaseDtor: 2043c0349e87cdbd7316d06d2411d86ee1086e717a5Ted Kremenek case CFGElement::MemberDtor: 2053c0349e87cdbd7316d06d2411d86ee1086e717a5Ted Kremenek case CFGElement::TemporaryDtor: 2063c0349e87cdbd7316d06d2411d86ee1086e717a5Ted Kremenek ProcessImplicitDtor(*E.getAs<CFGImplicitDtor>(), builder); 2073c0349e87cdbd7316d06d2411d86ee1086e717a5Ted Kremenek return; 2089c6cd67ea416bace666d614c84d5531124287653Zhongxing Xu } 2099c6cd67ea416bace666d614c84d5531124287653Zhongxing Xu} 2109c6cd67ea416bace666d614c84d5531124287653Zhongxing Xu 211d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidisvoid ExprEngine::ProcessStmt(const CFGStmt S, StmtNodeBuilder& builder) { 212d767d81290288c030f3be0be1d3e62b9c8df51dcTed Kremenek // Reclaim any unnecessary nodes in the ExplodedGraph. 213d767d81290288c030f3be0be1d3e62b9c8df51dcTed Kremenek G.reclaimRecentlyAllocatedNodes(); 214e3115e257163321ecde429aeae75f1702f099d4cTed Kremenek // Recycle any unused states in the GRStateManager. 215e3115e257163321ecde429aeae75f1702f099d4cTed Kremenek StateMgr.recycleUnusedStates(); 216e3115e257163321ecde429aeae75f1702f099d4cTed Kremenek 2170a3ed3143b00f237decb1288c1ff574ae09eba4eTed Kremenek currentStmt = S.getStmt(); 2180bed8a12f2878d3cd94fb8bdba55b593d92dd11aTed Kremenek PrettyStackTraceLoc CrashInfo(getContext().getSourceManager(), 2190a3ed3143b00f237decb1288c1ff574ae09eba4eTed Kremenek currentStmt->getLocStart(), 2200bed8a12f2878d3cd94fb8bdba55b593d92dd11aTed Kremenek "Error evaluating statement"); 2211eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 222e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek Builder = &builder; 223b4857264b8d3d861f688cdaa174aab30e0729a73Ted Kremenek EntryNode = builder.getPredecessor(); 2241eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 2251eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump // Create the cleaned state. 226bd533aa4ff8895c676d4634d0d3de254962569d0Jordy Rose const LocationContext *LC = EntryNode->getLocationContext(); 2270a3ed3143b00f237decb1288c1ff574ae09eba4eTed Kremenek SymbolReaper SymReaper(LC, currentStmt, SymMgr); 228c179a7fbb294fe3ff6cf5479f6239a10f39628c7Zhongxing Xu 229bd533aa4ff8895c676d4634d0d3de254962569d0Jordy Rose if (AMgr.shouldPurgeDead()) { 230bd533aa4ff8895c676d4634d0d3de254962569d0Jordy Rose const GRState *St = EntryNode->getState(); 231183ff98f425d470c2a0276880aaf43496c9dad14Argyrios Kyrtzidis getCheckerManager().runCheckersForLiveSymbols(St, SymReaper); 232183ff98f425d470c2a0276880aaf43496c9dad14Argyrios Kyrtzidis 233bd533aa4ff8895c676d4634d0d3de254962569d0Jordy Rose const StackFrameContext *SFC = LC->getCurrentStackFrame(); 234db0594bfc013131f88429add4eb653c285fa94fbTed Kremenek CleanedState = StateMgr.removeDeadBindings(St, SFC, SymReaper); 235bd533aa4ff8895c676d4634d0d3de254962569d0Jordy Rose } else { 236bd533aa4ff8895c676d4634d0d3de254962569d0Jordy Rose CleanedState = EntryNode->getState(); 237bd533aa4ff8895c676d4634d0d3de254962569d0Jordy Rose } 238241677a13cc46647a8f5098b3e3239bd9480dca2Ted Kremenek 23977d7ef8d8a80ccb2ab3d25c80810571e3ab14ee4Ted Kremenek // Process any special transfer function for dead symbols. 240031ccc0555a82afc2e8afe29e19dd57ff204e2deZhongxing Xu ExplodedNodeSet Tmp; 2411eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 242241677a13cc46647a8f5098b3e3239bd9480dca2Ted Kremenek if (!SymReaper.hasDeadSymbols()) 243846d4e923bf11bcdc2816758aafa331795f29230Ted Kremenek Tmp.Add(EntryNode); 24477d7ef8d8a80ccb2ab3d25c80810571e3ab14ee4Ted Kremenek else { 24577d7ef8d8a80ccb2ab3d25c80810571e3ab14ee4Ted Kremenek SaveAndRestore<bool> OldSink(Builder->BuildSinks); 246b4857264b8d3d861f688cdaa174aab30e0729a73Ted Kremenek SaveOr OldHasGen(Builder->hasGeneratedNode); 247846d4e923bf11bcdc2816758aafa331795f29230Ted Kremenek 248331b0ac44b9eb0ffcba66b4f3f3f9adb27c2434fTed Kremenek SaveAndRestore<bool> OldPurgeDeadSymbols(Builder->PurgingDeadSymbols); 249331b0ac44b9eb0ffcba66b4f3f3f9adb27c2434fTed Kremenek Builder->PurgingDeadSymbols = true; 2501eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 2519400613b54bf56c317786d778f58f45f1080d619Zhongxing Xu // FIXME: This should soon be removed. 2529400613b54bf56c317786d778f58f45f1080d619Zhongxing Xu ExplodedNodeSet Tmp2; 2539c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek getTF().evalDeadSymbols(Tmp2, *this, *Builder, EntryNode, 254241677a13cc46647a8f5098b3e3239bd9480dca2Ted Kremenek CleanedState, SymReaper); 255846d4e923bf11bcdc2816758aafa331795f29230Ted Kremenek 256eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis getCheckerManager().runCheckersForDeadSymbols(Tmp, Tmp2, 257183ff98f425d470c2a0276880aaf43496c9dad14Argyrios Kyrtzidis SymReaper, currentStmt, *this); 258183ff98f425d470c2a0276880aaf43496c9dad14Argyrios Kyrtzidis 259b4857264b8d3d861f688cdaa174aab30e0729a73Ted Kremenek if (!Builder->BuildSinks && !Builder->hasGeneratedNode) 260846d4e923bf11bcdc2816758aafa331795f29230Ted Kremenek Tmp.Add(EntryNode); 26177d7ef8d8a80ccb2ab3d25c80810571e3ab14ee4Ted Kremenek } 2621eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 263846d4e923bf11bcdc2816758aafa331795f29230Ted Kremenek bool HasAutoGenerated = false; 264846d4e923bf11bcdc2816758aafa331795f29230Ted Kremenek 265031ccc0555a82afc2e8afe29e19dd57ff204e2deZhongxing Xu for (ExplodedNodeSet::iterator I=Tmp.begin(), E=Tmp.end(); I!=E; ++I) { 266031ccc0555a82afc2e8afe29e19dd57ff204e2deZhongxing Xu ExplodedNodeSet Dst; 2671eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 2681eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump // Set the cleaned state. 269846d4e923bf11bcdc2816758aafa331795f29230Ted Kremenek Builder->SetCleanedState(*I == EntryNode ? CleanedState : GetState(*I)); 2701eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 2711eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump // Visit the statement. 2720a3ed3143b00f237decb1288c1ff574ae09eba4eTed Kremenek Visit(currentStmt, *I, Dst); 273846d4e923bf11bcdc2816758aafa331795f29230Ted Kremenek 274846d4e923bf11bcdc2816758aafa331795f29230Ted Kremenek // Do we need to auto-generate a node? We only need to do this to generate 275d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidis // a node with a "cleaned" state; CoreEngine will actually handle 2761eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump // auto-transitions for other cases. 277846d4e923bf11bcdc2816758aafa331795f29230Ted Kremenek if (Dst.size() == 1 && *Dst.begin() == EntryNode 278b4857264b8d3d861f688cdaa174aab30e0729a73Ted Kremenek && !Builder->hasGeneratedNode && !HasAutoGenerated) { 279846d4e923bf11bcdc2816758aafa331795f29230Ted Kremenek HasAutoGenerated = true; 2800a3ed3143b00f237decb1288c1ff574ae09eba4eTed Kremenek builder.generateNode(currentStmt, GetState(EntryNode), *I); 281846d4e923bf11bcdc2816758aafa331795f29230Ted Kremenek } 28277d7ef8d8a80ccb2ab3d25c80810571e3ab14ee4Ted Kremenek } 2831eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 284e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek // NULL out these variables to cleanup. 285846d4e923bf11bcdc2816758aafa331795f29230Ted Kremenek CleanedState = NULL; 286846d4e923bf11bcdc2816758aafa331795f29230Ted Kremenek EntryNode = NULL; 287df7533b5e523a3def04b5c33b56361a94dd97d35Ted Kremenek 2880a3ed3143b00f237decb1288c1ff574ae09eba4eTed Kremenek currentStmt = 0; 2891eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 290e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek Builder = NULL; 291e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek} 292e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek 293d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidisvoid ExprEngine::ProcessInitializer(const CFGInitializer Init, 294d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidis StmtNodeBuilder &builder) { 2950a3ed3143b00f237decb1288c1ff574ae09eba4eTed Kremenek // We don't set EntryNode and currentStmt. And we don't clean up state. 296cbb67480094b3bcb5b715acd827cbad55e2a204cSean Hunt const CXXCtorInitializer *BMI = Init.getInitializer(); 2979dc84c9455df2a77195147d0210c915dc1775a88Zhongxing Xu 298d074441e027471a914cbb909a7aad1d43224950fZhongxing Xu ExplodedNode *pred = builder.getPredecessor(); 299d074441e027471a914cbb909a7aad1d43224950fZhongxing Xu 300d074441e027471a914cbb909a7aad1d43224950fZhongxing Xu const StackFrameContext *stackFrame = cast<StackFrameContext>(pred->getLocationContext()); 301d074441e027471a914cbb909a7aad1d43224950fZhongxing Xu const CXXConstructorDecl *decl = cast<CXXConstructorDecl>(stackFrame->getDecl()); 302d074441e027471a914cbb909a7aad1d43224950fZhongxing Xu const CXXThisRegion *thisReg = getCXXThisRegion(decl, stackFrame); 303d074441e027471a914cbb909a7aad1d43224950fZhongxing Xu 304d074441e027471a914cbb909a7aad1d43224950fZhongxing Xu SVal thisVal = pred->getState()->getSVal(thisReg); 3059dc84c9455df2a77195147d0210c915dc1775a88Zhongxing Xu 30600eb3f9c5b33e3d99aee1f8b75dd9c9678fdd66bFrancois Pichet if (BMI->isAnyMemberInitializer()) { 3079dc84c9455df2a77195147d0210c915dc1775a88Zhongxing Xu ExplodedNodeSet Dst; 3089dc84c9455df2a77195147d0210c915dc1775a88Zhongxing Xu 3099dc84c9455df2a77195147d0210c915dc1775a88Zhongxing Xu // Evaluate the initializer. 310d074441e027471a914cbb909a7aad1d43224950fZhongxing Xu Visit(BMI->getInit(), pred, Dst); 3119dc84c9455df2a77195147d0210c915dc1775a88Zhongxing Xu 3129dc84c9455df2a77195147d0210c915dc1775a88Zhongxing Xu for (ExplodedNodeSet::iterator I = Dst.begin(), E = Dst.end(); I != E; ++I){ 3139dc84c9455df2a77195147d0210c915dc1775a88Zhongxing Xu ExplodedNode *Pred = *I; 3149dc84c9455df2a77195147d0210c915dc1775a88Zhongxing Xu const GRState *state = Pred->getState(); 3159dc84c9455df2a77195147d0210c915dc1775a88Zhongxing Xu 31600eb3f9c5b33e3d99aee1f8b75dd9c9678fdd66bFrancois Pichet const FieldDecl *FD = BMI->getAnyMember(); 3179dc84c9455df2a77195147d0210c915dc1775a88Zhongxing Xu 318d074441e027471a914cbb909a7aad1d43224950fZhongxing Xu SVal FieldLoc = state->getLValue(FD, thisVal); 3199dc84c9455df2a77195147d0210c915dc1775a88Zhongxing Xu SVal InitVal = state->getSVal(BMI->getInit()); 3209dc84c9455df2a77195147d0210c915dc1775a88Zhongxing Xu state = state->bindLoc(FieldLoc, InitVal); 3219dc84c9455df2a77195147d0210c915dc1775a88Zhongxing Xu 3229dc84c9455df2a77195147d0210c915dc1775a88Zhongxing Xu // Use a custom node building process. 323d074441e027471a914cbb909a7aad1d43224950fZhongxing Xu PostInitializer PP(BMI, stackFrame); 3249dc84c9455df2a77195147d0210c915dc1775a88Zhongxing Xu // Builder automatically add the generated node to the deferred set, 3259dc84c9455df2a77195147d0210c915dc1775a88Zhongxing Xu // which are processed in the builder's dtor. 3269dc84c9455df2a77195147d0210c915dc1775a88Zhongxing Xu builder.generateNode(PP, state, Pred); 3279dc84c9455df2a77195147d0210c915dc1775a88Zhongxing Xu } 328d074441e027471a914cbb909a7aad1d43224950fZhongxing Xu return; 3299dc84c9455df2a77195147d0210c915dc1775a88Zhongxing Xu } 330d074441e027471a914cbb909a7aad1d43224950fZhongxing Xu 331d074441e027471a914cbb909a7aad1d43224950fZhongxing Xu assert(BMI->isBaseInitializer()); 332d074441e027471a914cbb909a7aad1d43224950fZhongxing Xu 333d074441e027471a914cbb909a7aad1d43224950fZhongxing Xu // Get the base class declaration. 334d074441e027471a914cbb909a7aad1d43224950fZhongxing Xu const CXXConstructExpr *ctorExpr = cast<CXXConstructExpr>(BMI->getInit()); 335d074441e027471a914cbb909a7aad1d43224950fZhongxing Xu 336d074441e027471a914cbb909a7aad1d43224950fZhongxing Xu // Create the base object region. 337d074441e027471a914cbb909a7aad1d43224950fZhongxing Xu SVal baseVal = 338d074441e027471a914cbb909a7aad1d43224950fZhongxing Xu getStoreManager().evalDerivedToBase(thisVal, ctorExpr->getType()); 339d074441e027471a914cbb909a7aad1d43224950fZhongxing Xu const MemRegion *baseReg = baseVal.getAsRegion(); 340d074441e027471a914cbb909a7aad1d43224950fZhongxing Xu assert(baseReg); 341d074441e027471a914cbb909a7aad1d43224950fZhongxing Xu Builder = &builder; 342d074441e027471a914cbb909a7aad1d43224950fZhongxing Xu ExplodedNodeSet dst; 343d074441e027471a914cbb909a7aad1d43224950fZhongxing Xu VisitCXXConstructExpr(ctorExpr, baseReg, pred, dst); 3449c6cd67ea416bace666d614c84d5531124287653Zhongxing Xu} 3459c6cd67ea416bace666d614c84d5531124287653Zhongxing Xu 346d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidisvoid ExprEngine::ProcessImplicitDtor(const CFGImplicitDtor D, 347d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidis StmtNodeBuilder &builder) { 348b13453bd8a91f331d0910ca95ad52aa41b52f648Zhongxing Xu Builder = &builder; 349b13453bd8a91f331d0910ca95ad52aa41b52f648Zhongxing Xu 3503c0349e87cdbd7316d06d2411d86ee1086e717a5Ted Kremenek switch (D.getKind()) { 3514ffcb9974c6b7142c4a1483abfcb1f88b6371c45Zhongxing Xu case CFGElement::AutomaticObjectDtor: 3524ffcb9974c6b7142c4a1483abfcb1f88b6371c45Zhongxing Xu ProcessAutomaticObjDtor(cast<CFGAutomaticObjDtor>(D), builder); 3534ffcb9974c6b7142c4a1483abfcb1f88b6371c45Zhongxing Xu break; 3544ffcb9974c6b7142c4a1483abfcb1f88b6371c45Zhongxing Xu case CFGElement::BaseDtor: 3554ffcb9974c6b7142c4a1483abfcb1f88b6371c45Zhongxing Xu ProcessBaseDtor(cast<CFGBaseDtor>(D), builder); 3564ffcb9974c6b7142c4a1483abfcb1f88b6371c45Zhongxing Xu break; 3574ffcb9974c6b7142c4a1483abfcb1f88b6371c45Zhongxing Xu case CFGElement::MemberDtor: 3584ffcb9974c6b7142c4a1483abfcb1f88b6371c45Zhongxing Xu ProcessMemberDtor(cast<CFGMemberDtor>(D), builder); 3594ffcb9974c6b7142c4a1483abfcb1f88b6371c45Zhongxing Xu break; 3604ffcb9974c6b7142c4a1483abfcb1f88b6371c45Zhongxing Xu case CFGElement::TemporaryDtor: 3614ffcb9974c6b7142c4a1483abfcb1f88b6371c45Zhongxing Xu ProcessTemporaryDtor(cast<CFGTemporaryDtor>(D), builder); 3624ffcb9974c6b7142c4a1483abfcb1f88b6371c45Zhongxing Xu break; 3634ffcb9974c6b7142c4a1483abfcb1f88b6371c45Zhongxing Xu default: 3644ffcb9974c6b7142c4a1483abfcb1f88b6371c45Zhongxing Xu llvm_unreachable("Unexpected dtor kind."); 3654ffcb9974c6b7142c4a1483abfcb1f88b6371c45Zhongxing Xu } 3664ffcb9974c6b7142c4a1483abfcb1f88b6371c45Zhongxing Xu} 3674ffcb9974c6b7142c4a1483abfcb1f88b6371c45Zhongxing Xu 368d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidisvoid ExprEngine::ProcessAutomaticObjDtor(const CFGAutomaticObjDtor dtor, 369d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidis StmtNodeBuilder &builder) { 370b4857264b8d3d861f688cdaa174aab30e0729a73Ted Kremenek ExplodedNode *pred = builder.getPredecessor(); 3712210490e6d099b7a5b4f68f44a136e4dcf3cdea2Zhongxing Xu const GRState *state = pred->getState(); 3722210490e6d099b7a5b4f68f44a136e4dcf3cdea2Zhongxing Xu const VarDecl *varDecl = dtor.getVarDecl(); 3732210490e6d099b7a5b4f68f44a136e4dcf3cdea2Zhongxing Xu 3742210490e6d099b7a5b4f68f44a136e4dcf3cdea2Zhongxing Xu QualType varType = varDecl->getType(); 3752210490e6d099b7a5b4f68f44a136e4dcf3cdea2Zhongxing Xu 3762210490e6d099b7a5b4f68f44a136e4dcf3cdea2Zhongxing Xu if (const ReferenceType *refType = varType->getAs<ReferenceType>()) 3772210490e6d099b7a5b4f68f44a136e4dcf3cdea2Zhongxing Xu varType = refType->getPointeeType(); 3782210490e6d099b7a5b4f68f44a136e4dcf3cdea2Zhongxing Xu 3792210490e6d099b7a5b4f68f44a136e4dcf3cdea2Zhongxing Xu const CXXRecordDecl *recordDecl = varType->getAsCXXRecordDecl(); 3802210490e6d099b7a5b4f68f44a136e4dcf3cdea2Zhongxing Xu assert(recordDecl && "get CXXRecordDecl fail"); 3812210490e6d099b7a5b4f68f44a136e4dcf3cdea2Zhongxing Xu const CXXDestructorDecl *dtorDecl = recordDecl->getDestructor(); 382b13453bd8a91f331d0910ca95ad52aa41b52f648Zhongxing Xu 3832210490e6d099b7a5b4f68f44a136e4dcf3cdea2Zhongxing Xu Loc dest = state->getLValue(varDecl, pred->getLocationContext()); 384b13453bd8a91f331d0910ca95ad52aa41b52f648Zhongxing Xu 3852210490e6d099b7a5b4f68f44a136e4dcf3cdea2Zhongxing Xu ExplodedNodeSet dstSet; 3862210490e6d099b7a5b4f68f44a136e4dcf3cdea2Zhongxing Xu VisitCXXDestructor(dtorDecl, cast<loc::MemRegionVal>(dest).getRegion(), 3872210490e6d099b7a5b4f68f44a136e4dcf3cdea2Zhongxing Xu dtor.getTriggerStmt(), pred, dstSet); 3884ffcb9974c6b7142c4a1483abfcb1f88b6371c45Zhongxing Xu} 3894ffcb9974c6b7142c4a1483abfcb1f88b6371c45Zhongxing Xu 390d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidisvoid ExprEngine::ProcessBaseDtor(const CFGBaseDtor D, 391d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidis StmtNodeBuilder &builder) { 3924ffcb9974c6b7142c4a1483abfcb1f88b6371c45Zhongxing Xu} 3934ffcb9974c6b7142c4a1483abfcb1f88b6371c45Zhongxing Xu 394d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidisvoid ExprEngine::ProcessMemberDtor(const CFGMemberDtor D, 395d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidis StmtNodeBuilder &builder) { 3964ffcb9974c6b7142c4a1483abfcb1f88b6371c45Zhongxing Xu} 3974ffcb9974c6b7142c4a1483abfcb1f88b6371c45Zhongxing Xu 398d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidisvoid ExprEngine::ProcessTemporaryDtor(const CFGTemporaryDtor D, 399d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidis StmtNodeBuilder &builder) { 4009c6cd67ea416bace666d614c84d5531124287653Zhongxing Xu} 4019c6cd67ea416bace666d614c84d5531124287653Zhongxing Xu 402d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidisvoid ExprEngine::Visit(const Stmt* S, ExplodedNode* Pred, 40303509aea098772644bf4662dc1c88634818ceeccZhongxing Xu ExplodedNodeSet& Dst) { 4040bed8a12f2878d3cd94fb8bdba55b593d92dd11aTed Kremenek PrettyStackTraceLoc CrashInfo(getContext().getSourceManager(), 4050bed8a12f2878d3cd94fb8bdba55b593d92dd11aTed Kremenek S->getLocStart(), 4060bed8a12f2878d3cd94fb8bdba55b593d92dd11aTed Kremenek "Error evaluating statement"); 4070bed8a12f2878d3cd94fb8bdba55b593d92dd11aTed Kremenek 408f6a1648197562e0b133440d612d9af297d0a86ccJohn McCall // Expressions to ignore. 409f6a1648197562e0b133440d612d9af297d0a86ccJohn McCall if (const Expr *Ex = dyn_cast<Expr>(S)) 410892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek S = Ex->IgnoreParens(); 411f6a1648197562e0b133440d612d9af297d0a86ccJohn McCall 412e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek // FIXME: add metadata to the CFG so that we can disable 413e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek // this check when we KNOW that there is no block-level subexpression. 414e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek // The motivation is that this check requires a hashtable lookup. 4151eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 4160a3ed3143b00f237decb1288c1ff574ae09eba4eTed Kremenek if (S != currentStmt && Pred->getLocationContext()->getCFG()->isBlkExpr(S)) { 417e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek Dst.Add(Pred); 418e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek return; 419e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek } 4201eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 421e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek switch (S->getStmtClass()) { 422c768a0c46e6c064c3281d663777ee95aea8652eeTed Kremenek // C++ stuff we don't support yet. 4231b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::CXXBindTemporaryExprClass: 4241b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::CXXCatchStmtClass: 425c768a0c46e6c064c3281d663777ee95aea8652eeTed Kremenek case Stmt::CXXDefaultArgExprClass: 4261b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::CXXDependentScopeMemberExprClass: 4271b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::CXXNullPtrLiteralExprClass: 4281b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::CXXPseudoDestructorExprClass: 429c768a0c46e6c064c3281d663777ee95aea8652eeTed Kremenek case Stmt::CXXTemporaryObjectExprClass: 4301b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::CXXThrowExprClass: 4311b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::CXXTryStmtClass: 4321b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::CXXTypeidExprClass: 4339be88403e965cc49af76c9d33d818781d44b333eFrancois Pichet case Stmt::CXXUuidofExprClass: 434c768a0c46e6c064c3281d663777ee95aea8652eeTed Kremenek case Stmt::CXXUnresolvedConstructExprClass: 435ed8abf18329df67b0abcbb3a10458bd8c1d2a595Douglas Gregor case Stmt::CXXScalarValueInitExprClass: 4361b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::DependentScopeDeclRefExprClass: 4371b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::UnaryTypeTraitExprClass: 4386ad6f2848d7652ab2991286eb48be440d3493b28Francois Pichet case Stmt::BinaryTypeTraitExprClass: 4391b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::UnresolvedLookupExprClass: 440c768a0c46e6c064c3281d663777ee95aea8652eeTed Kremenek case Stmt::UnresolvedMemberExprClass: 4416b219d082434394c1ac401390ec1d1967727815aSebastian Redl case Stmt::CXXNoexceptExprClass: 442be230c36e32142cbdcdbe9c97511d097beeecbabDouglas Gregor case Stmt::PackExpansionExprClass: 443c7793c73ba8a343de3f2552d984851985a46f159Douglas Gregor case Stmt::SubstNonTypeTemplateParmPackExprClass: 4441b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek { 445c768a0c46e6c064c3281d663777ee95aea8652eeTed Kremenek SaveAndRestore<bool> OldSink(Builder->BuildSinks); 446c768a0c46e6c064c3281d663777ee95aea8652eeTed Kremenek Builder->BuildSinks = true; 447c768a0c46e6c064c3281d663777ee95aea8652eeTed Kremenek MakeNode(Dst, S, Pred, GetState(Pred)); 448c768a0c46e6c064c3281d663777ee95aea8652eeTed Kremenek break; 449c768a0c46e6c064c3281d663777ee95aea8652eeTed Kremenek } 450f6a1648197562e0b133440d612d9af297d0a86ccJohn McCall 451f6a1648197562e0b133440d612d9af297d0a86ccJohn McCall case Stmt::ParenExprClass: 452f6a1648197562e0b133440d612d9af297d0a86ccJohn McCall llvm_unreachable("ParenExprs already handled."); 4531b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek // Cases that should never be evaluated simply because they shouldn't 4541b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek // appear in the CFG. 4551b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::BreakStmtClass: 4561b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::CaseStmtClass: 4571b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::CompoundStmtClass: 4581b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::ContinueStmtClass: 4591b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::DefaultStmtClass: 4601b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::DoStmtClass: 4611b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::GotoStmtClass: 4621b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::IndirectGotoStmtClass: 4631b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::LabelStmtClass: 4641b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::NoStmtClass: 4651b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::NullStmtClass: 4661b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek llvm_unreachable("Stmt should not be in analyzer evaluation loop"); 4671b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek break; 4681b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek 4698ad9cbc518a603176462f1fa1efe389023590082Ted Kremenek case Stmt::GNUNullExprClass: { 470c8413fd03f73084a5c93028f8b4db619fc388087Ted Kremenek MakeNode(Dst, S, Pred, GetState(Pred)->BindExpr(S, svalBuilder.makeNull())); 4718ad9cbc518a603176462f1fa1efe389023590082Ted Kremenek break; 4728ad9cbc518a603176462f1fa1efe389023590082Ted Kremenek } 4738ad9cbc518a603176462f1fa1efe389023590082Ted Kremenek 4744beaa9f51b2da57c64740cef2bd1c2fdb0c325d5Ted Kremenek case Stmt::ObjCAtSynchronizedStmtClass: 4754beaa9f51b2da57c64740cef2bd1c2fdb0c325d5Ted Kremenek VisitObjCAtSynchronizedStmt(cast<ObjCAtSynchronizedStmt>(S), Pred, Dst); 4764beaa9f51b2da57c64740cef2bd1c2fdb0c325d5Ted Kremenek break; 4774beaa9f51b2da57c64740cef2bd1c2fdb0c325d5Ted Kremenek 47814429b918bd2f4cb52abc75546a7fe37142054caArgyrios Kyrtzidis case Stmt::ObjCPropertyRefExprClass: 47914429b918bd2f4cb52abc75546a7fe37142054caArgyrios Kyrtzidis VisitObjCPropertyRefExpr(cast<ObjCPropertyRefExpr>(S), Pred, Dst); 48014429b918bd2f4cb52abc75546a7fe37142054caArgyrios Kyrtzidis break; 48114429b918bd2f4cb52abc75546a7fe37142054caArgyrios Kyrtzidis 4821b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek // Cases not handled yet; but will handle some day. 4831b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::DesignatedInitExprClass: 4841b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::ExtVectorElementExprClass: 4851b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::ImaginaryLiteralClass: 4861b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::ImplicitValueInitExprClass: 4871b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::ObjCAtCatchStmtClass: 4881b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::ObjCAtFinallyStmtClass: 4891b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::ObjCAtTryStmtClass: 4901b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::ObjCEncodeExprClass: 4911b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::ObjCIsaExprClass: 4921b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::ObjCProtocolExprClass: 4931b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::ObjCSelectorExprClass: 4941b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::ObjCStringLiteralClass: 4951b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::ParenListExprClass: 4961b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::PredefinedExprClass: 4971b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::ShuffleVectorExprClass: 4981b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::VAArgExprClass: 499e08ce650a2b02410eddd1f60a4aa6b3d4be71e73Peter Collingbourne case Stmt::CUDAKernelCallExprClass: 50056ca35d396d8692c384c785f9aeebcf22563fe1eJohn McCall case Stmt::OpaqueValueExprClass: 5011b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek // Fall through. 5021b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek 5031b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek // Cases we intentionally don't evaluate, since they don't need 5041b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek // to be explicitly evaluated. 505bc9ad74a13e83303a3a5251f8bacbbca17341c17Zhongxing Xu case Stmt::AddrLabelExprClass: 506bc9ad74a13e83303a3a5251f8bacbbca17341c17Zhongxing Xu case Stmt::IntegerLiteralClass: 507bc9ad74a13e83303a3a5251f8bacbbca17341c17Zhongxing Xu case Stmt::CharacterLiteralClass: 508477323d58a0de352c6a61e08b5a83127c4adc904Zhongxing Xu case Stmt::CXXBoolLiteralExprClass: 50946fc3fae1cf1926a3b8138bca4adeda37c41f92cTed Kremenek case Stmt::ExprWithCleanupsClass: 510bc9ad74a13e83303a3a5251f8bacbbca17341c17Zhongxing Xu case Stmt::FloatingLiteralClass: 511f901a7de97f46ba2b1ff153f9fb83d00dc37cfcfDouglas Gregor case Stmt::SizeOfPackExprClass: 512e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek Dst.Add(Pred); // No-op. Simply propagate the current state unchanged. 513e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek break; 5141eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 515540cbe2b60294fe7b926c26b4f1840f544fe3011Ted Kremenek case Stmt::ArraySubscriptExprClass: 516892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek VisitLvalArraySubscriptExpr(cast<ArraySubscriptExpr>(S), Pred, Dst); 517540cbe2b60294fe7b926c26b4f1840f544fe3011Ted Kremenek break; 5181eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 519e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek case Stmt::AsmStmtClass: 520e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek VisitAsmStmt(cast<AsmStmt>(S), Pred, Dst); 521e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek break; 522b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 523892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek case Stmt::BlockDeclRefExprClass: { 524892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek const BlockDeclRefExpr *BE = cast<BlockDeclRefExpr>(S); 525892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek VisitCommonDeclRefExpr(BE, BE->getDecl(), Pred, Dst); 52667d1287035767f4f6c8ca0c2bb755990012a44caTed Kremenek break; 527892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek } 5281eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 529c95ad9ff6e574aecdd759542d5578bc65d586d93Ted Kremenek case Stmt::BlockExprClass: 530c95ad9ff6e574aecdd759542d5578bc65d586d93Ted Kremenek VisitBlockExpr(cast<BlockExpr>(S), Pred, Dst); 531c95ad9ff6e574aecdd759542d5578bc65d586d93Ted Kremenek break; 532c95ad9ff6e574aecdd759542d5578bc65d586d93Ted Kremenek 533e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek case Stmt::BinaryOperatorClass: { 53403509aea098772644bf4662dc1c88634818ceeccZhongxing Xu const BinaryOperator* B = cast<BinaryOperator>(S); 535e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek if (B->isLogicalOp()) { 536e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek VisitLogicalExpr(B, Pred, Dst); 537e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek break; 538e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek } 5392de56d1d0c3a504ad1529de2677628bdfbb95cd4John McCall else if (B->getOpcode() == BO_Comma) { 540a8538d902fce9cfec20f39b34492268b51643819Ted Kremenek const GRState* state = GetState(Pred); 5411397663af9dbcc24dbf0e11de43931b3dc08fdbbTed Kremenek MakeNode(Dst, B, Pred, state->BindExpr(B, state->getSVal(B->getRHS()))); 542e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek break; 543e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek } 54406fb99fb403bff1651429923f666a2ebe2b1522fTed Kremenek 545b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek if (AMgr.shouldEagerlyAssume() && 546bb141217871e93767aa3f2de1b9946fa6d37066aZhongxing Xu (B->isRelationalOp() || B->isEqualityOp())) { 547031ccc0555a82afc2e8afe29e19dd57ff204e2deZhongxing Xu ExplodedNodeSet Tmp; 548892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek VisitBinaryOperator(cast<BinaryOperator>(S), Pred, Tmp); 5499c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek evalEagerlyAssume(Dst, Tmp, cast<Expr>(S)); 55048af2a9c1ed3259512f2d1431720add1fbe8fb5fTed Kremenek } 55148af2a9c1ed3259512f2d1431720add1fbe8fb5fTed Kremenek else 552892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek VisitBinaryOperator(cast<BinaryOperator>(S), Pred, Dst); 55348af2a9c1ed3259512f2d1431720add1fbe8fb5fTed Kremenek 554e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek break; 555e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek } 55606fb99fb403bff1651429923f666a2ebe2b1522fTed Kremenek 5576a02b609c2e23b28d24f9db4c8006137c6b55ae4Marcin Swiderski case Stmt::CallExprClass: { 55803509aea098772644bf4662dc1c88634818ceeccZhongxing Xu const CallExpr* C = cast<CallExpr>(S); 559892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek VisitCall(C, Pred, C->arg_begin(), C->arg_end(), Dst); 56006fb99fb403bff1651429923f666a2ebe2b1522fTed Kremenek break; 561e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek } 56206fb99fb403bff1651429923f666a2ebe2b1522fTed Kremenek 5637ce351db56fbce162a3b650518ce05b5c61ebf36Zhongxing Xu case Stmt::CXXConstructExprClass: { 5647ce351db56fbce162a3b650518ce05b5c61ebf36Zhongxing Xu const CXXConstructExpr *C = cast<CXXConstructExpr>(S); 5657ce351db56fbce162a3b650518ce05b5c61ebf36Zhongxing Xu // For block-level CXXConstructExpr, we don't have a destination region. 5667ce351db56fbce162a3b650518ce05b5c61ebf36Zhongxing Xu // Let VisitCXXConstructExpr() create one. 567892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek VisitCXXConstructExpr(C, 0, Pred, Dst); 5687ce351db56fbce162a3b650518ce05b5c61ebf36Zhongxing Xu break; 5697ce351db56fbce162a3b650518ce05b5c61ebf36Zhongxing Xu } 5707ce351db56fbce162a3b650518ce05b5c61ebf36Zhongxing Xu 571950db87e5efe2ff0c7234116929f8637aaf7ae7aZhongxing Xu case Stmt::CXXMemberCallExprClass: { 57203509aea098772644bf4662dc1c88634818ceeccZhongxing Xu const CXXMemberCallExpr *MCE = cast<CXXMemberCallExpr>(S); 573950db87e5efe2ff0c7234116929f8637aaf7ae7aZhongxing Xu VisitCXXMemberCallExpr(MCE, Pred, Dst); 574950db87e5efe2ff0c7234116929f8637aaf7ae7aZhongxing Xu break; 575950db87e5efe2ff0c7234116929f8637aaf7ae7aZhongxing Xu } 576950db87e5efe2ff0c7234116929f8637aaf7ae7aZhongxing Xu 5776a02b609c2e23b28d24f9db4c8006137c6b55ae4Marcin Swiderski case Stmt::CXXOperatorCallExprClass: { 5786a02b609c2e23b28d24f9db4c8006137c6b55ae4Marcin Swiderski const CXXOperatorCallExpr *C = cast<CXXOperatorCallExpr>(S); 5796a02b609c2e23b28d24f9db4c8006137c6b55ae4Marcin Swiderski VisitCXXOperatorCallExpr(C, Pred, Dst); 5806a02b609c2e23b28d24f9db4c8006137c6b55ae4Marcin Swiderski break; 5816a02b609c2e23b28d24f9db4c8006137c6b55ae4Marcin Swiderski } 5826a02b609c2e23b28d24f9db4c8006137c6b55ae4Marcin Swiderski 583856c6bcaea56e05255e9f3997ddd56b5c18a14f0Zhongxing Xu case Stmt::CXXNewExprClass: { 58403509aea098772644bf4662dc1c88634818ceeccZhongxing Xu const CXXNewExpr *NE = cast<CXXNewExpr>(S); 585856c6bcaea56e05255e9f3997ddd56b5c18a14f0Zhongxing Xu VisitCXXNewExpr(NE, Pred, Dst); 586856c6bcaea56e05255e9f3997ddd56b5c18a14f0Zhongxing Xu break; 587856c6bcaea56e05255e9f3997ddd56b5c18a14f0Zhongxing Xu } 588856c6bcaea56e05255e9f3997ddd56b5c18a14f0Zhongxing Xu 5896b8513829895e56a7b97e787ea74520bc626512eZhongxing Xu case Stmt::CXXDeleteExprClass: { 59003509aea098772644bf4662dc1c88634818ceeccZhongxing Xu const CXXDeleteExpr *CDE = cast<CXXDeleteExpr>(S); 5916b8513829895e56a7b97e787ea74520bc626512eZhongxing Xu VisitCXXDeleteExpr(CDE, Pred, Dst); 5926b8513829895e56a7b97e787ea74520bc626512eZhongxing Xu break; 5936b8513829895e56a7b97e787ea74520bc626512eZhongxing Xu } 594e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek // FIXME: ChooseExpr is really a constant. We need to fix 595e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek // the CFG do not model them as explicit control-flow. 5961eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 597e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek case Stmt::ChooseExprClass: { // __builtin_choose_expr 59803509aea098772644bf4662dc1c88634818ceeccZhongxing Xu const ChooseExpr* C = cast<ChooseExpr>(S); 599e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek VisitGuardedExpr(C, C->getLHS(), C->getRHS(), Pred, Dst); 600e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek break; 601e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek } 6021eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 603e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek case Stmt::CompoundAssignOperatorClass: 604892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek VisitBinaryOperator(cast<BinaryOperator>(S), Pred, Dst); 605e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek break; 606f22679e3e5d5f5754931952e58112b4c863a4137Zhongxing Xu 607f22679e3e5d5f5754931952e58112b4c863a4137Zhongxing Xu case Stmt::CompoundLiteralExprClass: 608892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek VisitCompoundLiteralExpr(cast<CompoundLiteralExpr>(S), Pred, Dst); 609f22679e3e5d5f5754931952e58112b4c863a4137Zhongxing Xu break; 6101eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 61156ca35d396d8692c384c785f9aeebcf22563fe1eJohn McCall case Stmt::BinaryConditionalOperatorClass: 612e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek case Stmt::ConditionalOperatorClass: { // '?' operator 61356ca35d396d8692c384c785f9aeebcf22563fe1eJohn McCall const AbstractConditionalOperator *C 61456ca35d396d8692c384c785f9aeebcf22563fe1eJohn McCall = cast<AbstractConditionalOperator>(S); 61556ca35d396d8692c384c785f9aeebcf22563fe1eJohn McCall VisitGuardedExpr(C, C->getTrueExpr(), C->getFalseExpr(), Pred, Dst); 616e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek break; 617e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek } 6181eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 619bb141217871e93767aa3f2de1b9946fa6d37066aZhongxing Xu case Stmt::CXXThisExprClass: 620bb141217871e93767aa3f2de1b9946fa6d37066aZhongxing Xu VisitCXXThisExpr(cast<CXXThisExpr>(S), Pred, Dst); 621bb141217871e93767aa3f2de1b9946fa6d37066aZhongxing Xu break; 622bb141217871e93767aa3f2de1b9946fa6d37066aZhongxing Xu 623892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek case Stmt::DeclRefExprClass: { 624892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek const DeclRefExpr *DE = cast<DeclRefExpr>(S); 625892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek VisitCommonDeclRefExpr(DE, DE->getDecl(), Pred, Dst); 626e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek break; 627892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek } 6281eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 629e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek case Stmt::DeclStmtClass: 630e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek VisitDeclStmt(cast<DeclStmt>(S), Pred, Dst); 631e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek break; 6321eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 633919f0665c35f76636d600f0e351920f6a37ee6cfTed Kremenek case Stmt::ForStmtClass: 634919f0665c35f76636d600f0e351920f6a37ee6cfTed Kremenek // This case isn't for branch processing, but for handling the 635919f0665c35f76636d600f0e351920f6a37ee6cfTed Kremenek // initialization of a condition variable. 636919f0665c35f76636d600f0e351920f6a37ee6cfTed Kremenek VisitCondInit(cast<ForStmt>(S)->getConditionVariable(), S, Pred, Dst); 637b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek break; 638919f0665c35f76636d600f0e351920f6a37ee6cfTed Kremenek 6390835a3cdeefe714b4959d31127ea155e56393125Argyrios Kyrtzidis case Stmt::ImplicitCastExprClass: 6400d9d736c49b51691ced96759ec99399824e2a602Zhongxing Xu case Stmt::CStyleCastExprClass: 6410d9d736c49b51691ced96759ec99399824e2a602Zhongxing Xu case Stmt::CXXStaticCastExprClass: 6420d9d736c49b51691ced96759ec99399824e2a602Zhongxing Xu case Stmt::CXXDynamicCastExprClass: 6430d9d736c49b51691ced96759ec99399824e2a602Zhongxing Xu case Stmt::CXXReinterpretCastExprClass: 6440d9d736c49b51691ced96759ec99399824e2a602Zhongxing Xu case Stmt::CXXConstCastExprClass: 6450d9d736c49b51691ced96759ec99399824e2a602Zhongxing Xu case Stmt::CXXFunctionalCastExprClass: { 64603509aea098772644bf4662dc1c88634818ceeccZhongxing Xu const CastExpr* C = cast<CastExpr>(S); 647892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek VisitCast(C, C->getSubExpr(), Pred, Dst); 648e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek break; 649e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek } 650b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 65161dfbecd8e6181b2ba42ffb5feede27a2bab3b8aTed Kremenek case Stmt::IfStmtClass: 65261dfbecd8e6181b2ba42ffb5feede27a2bab3b8aTed Kremenek // This case isn't for branch processing, but for handling the 65361dfbecd8e6181b2ba42ffb5feede27a2bab3b8aTed Kremenek // initialization of a condition variable. 654fcfb503c280ed8c66d428fed911b2846c0f434fcTed Kremenek VisitCondInit(cast<IfStmt>(S)->getConditionVariable(), S, Pred, Dst); 65561dfbecd8e6181b2ba42ffb5feede27a2bab3b8aTed Kremenek break; 656c4f8706b6539e06a5de153bd72850bb2e0a71456Zhongxing Xu 657c4f8706b6539e06a5de153bd72850bb2e0a71456Zhongxing Xu case Stmt::InitListExprClass: 658c4f8706b6539e06a5de153bd72850bb2e0a71456Zhongxing Xu VisitInitListExpr(cast<InitListExpr>(S), Pred, Dst); 659c4f8706b6539e06a5de153bd72850bb2e0a71456Zhongxing Xu break; 6601eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 66197ed4f68f5dba3e21e7a490ef0f9ffd3bfead7f8Ted Kremenek case Stmt::MemberExprClass: 662892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek VisitMemberExpr(cast<MemberExpr>(S), Pred, Dst); 663469ecbded3616416ef938ed94a67f86149faf226Ted Kremenek break; 66497ed4f68f5dba3e21e7a490ef0f9ffd3bfead7f8Ted Kremenek case Stmt::ObjCIvarRefExprClass: 665892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek VisitLvalObjCIvarRefExpr(cast<ObjCIvarRefExpr>(S), Pred, Dst); 66697ed4f68f5dba3e21e7a490ef0f9ffd3bfead7f8Ted Kremenek break; 667af3374187c47acea45706eab6744be6b1c66a856Ted Kremenek 668af3374187c47acea45706eab6744be6b1c66a856Ted Kremenek case Stmt::ObjCForCollectionStmtClass: 669af3374187c47acea45706eab6744be6b1c66a856Ted Kremenek VisitObjCForCollectionStmt(cast<ObjCForCollectionStmt>(S), Pred, Dst); 670af3374187c47acea45706eab6744be6b1c66a856Ted Kremenek break; 6711eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 67238ac4f504bf8ed514520b5a82be538bdb0860687Ted Kremenek case Stmt::ObjCMessageExprClass: 673892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek VisitObjCMessageExpr(cast<ObjCMessageExpr>(S), Pred, Dst); 674e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek break; 6751eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 676bbfd07a0c94f659beaf74316029ef73769cefb81Ted Kremenek case Stmt::ObjCAtThrowStmtClass: { 677bbfd07a0c94f659beaf74316029ef73769cefb81Ted Kremenek // FIXME: This is not complete. We basically treat @throw as 678bbfd07a0c94f659beaf74316029ef73769cefb81Ted Kremenek // an abort. 679bbfd07a0c94f659beaf74316029ef73769cefb81Ted Kremenek SaveAndRestore<bool> OldSink(Builder->BuildSinks); 680bbfd07a0c94f659beaf74316029ef73769cefb81Ted Kremenek Builder->BuildSinks = true; 681bbfd07a0c94f659beaf74316029ef73769cefb81Ted Kremenek MakeNode(Dst, S, Pred, GetState(Pred)); 682bbfd07a0c94f659beaf74316029ef73769cefb81Ted Kremenek break; 683bbfd07a0c94f659beaf74316029ef73769cefb81Ted Kremenek } 6841eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 6851b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek case Stmt::ReturnStmtClass: 6861b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek VisitReturnStmt(cast<ReturnStmt>(S), Pred, Dst); 6871b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek break; 6881eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 6898ecdb65716cd7914ffb2eeee993fa9039fcd31e8Douglas Gregor case Stmt::OffsetOfExprClass: 6908ecdb65716cd7914ffb2eeee993fa9039fcd31e8Douglas Gregor VisitOffsetOfExpr(cast<OffsetOfExpr>(S), Pred, Dst); 6918ecdb65716cd7914ffb2eeee993fa9039fcd31e8Douglas Gregor break; 6928ecdb65716cd7914ffb2eeee993fa9039fcd31e8Douglas Gregor 693f4e3cfbe8abd124be6341ef5d714819b4fbd9082Peter Collingbourne case Stmt::UnaryExprOrTypeTraitExprClass: 694f4e3cfbe8abd124be6341ef5d714819b4fbd9082Peter Collingbourne VisitUnaryExprOrTypeTraitExpr(cast<UnaryExprOrTypeTraitExpr>(S), 695f4e3cfbe8abd124be6341ef5d714819b4fbd9082Peter Collingbourne Pred, Dst); 696e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek break; 6971eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 698e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek case Stmt::StmtExprClass: { 69903509aea098772644bf4662dc1c88634818ceeccZhongxing Xu const StmtExpr* SE = cast<StmtExpr>(S); 700a3d1eb85853eae7b719f679b40923826b5e4b7dfTed Kremenek 701a3d1eb85853eae7b719f679b40923826b5e4b7dfTed Kremenek if (SE->getSubStmt()->body_empty()) { 702a3d1eb85853eae7b719f679b40923826b5e4b7dfTed Kremenek // Empty statement expression. 703a3d1eb85853eae7b719f679b40923826b5e4b7dfTed Kremenek assert(SE->getType() == getContext().VoidTy 704a3d1eb85853eae7b719f679b40923826b5e4b7dfTed Kremenek && "Empty statement expression must have void type."); 705a3d1eb85853eae7b719f679b40923826b5e4b7dfTed Kremenek Dst.Add(Pred); 706a3d1eb85853eae7b719f679b40923826b5e4b7dfTed Kremenek break; 707a3d1eb85853eae7b719f679b40923826b5e4b7dfTed Kremenek } 7081eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 709a3d1eb85853eae7b719f679b40923826b5e4b7dfTed Kremenek if (Expr* LastExpr = dyn_cast<Expr>(*SE->getSubStmt()->body_rbegin())) { 710a3d1eb85853eae7b719f679b40923826b5e4b7dfTed Kremenek const GRState* state = GetState(Pred); 7111397663af9dbcc24dbf0e11de43931b3dc08fdbbTed Kremenek MakeNode(Dst, SE, Pred, state->BindExpr(SE, state->getSVal(LastExpr))); 712a3d1eb85853eae7b719f679b40923826b5e4b7dfTed Kremenek } 713e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek else 714e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek Dst.Add(Pred); 7151eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 716e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek break; 717e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek } 7186987c7b74146b9658b1925c5981f8b0cd0672b55Zhongxing Xu 719892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek case Stmt::StringLiteralClass: { 720892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek const GRState* state = GetState(Pred); 721892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek SVal V = state->getLValue(cast<StringLiteral>(S)); 722892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek MakeNode(Dst, S, Pred, state->BindExpr(S, V)); 723892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek return; 724892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek } 725b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 726fcfb503c280ed8c66d428fed911b2846c0f434fcTed Kremenek case Stmt::SwitchStmtClass: 727fcfb503c280ed8c66d428fed911b2846c0f434fcTed Kremenek // This case isn't for branch processing, but for handling the 728fcfb503c280ed8c66d428fed911b2846c0f434fcTed Kremenek // initialization of a condition variable. 729fcfb503c280ed8c66d428fed911b2846c0f434fcTed Kremenek VisitCondInit(cast<SwitchStmt>(S)->getConditionVariable(), S, Pred, Dst); 730fcfb503c280ed8c66d428fed911b2846c0f434fcTed Kremenek break; 7311eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 73272374594c5d9ade02451bc85cf9dfa5b0ea106e7Ted Kremenek case Stmt::UnaryOperatorClass: { 73303509aea098772644bf4662dc1c88634818ceeccZhongxing Xu const UnaryOperator *U = cast<UnaryOperator>(S); 7342de56d1d0c3a504ad1529de2677628bdfbb95cd4John McCall if (AMgr.shouldEagerlyAssume()&&(U->getOpcode() == UO_LNot)) { 735031ccc0555a82afc2e8afe29e19dd57ff204e2deZhongxing Xu ExplodedNodeSet Tmp; 736892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek VisitUnaryOperator(U, Pred, Tmp); 7379c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek evalEagerlyAssume(Dst, Tmp, U); 73872374594c5d9ade02451bc85cf9dfa5b0ea106e7Ted Kremenek } 73972374594c5d9ade02451bc85cf9dfa5b0ea106e7Ted Kremenek else 740892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek VisitUnaryOperator(U, Pred, Dst); 7411b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek break; 74272374594c5d9ade02451bc85cf9dfa5b0ea106e7Ted Kremenek } 743b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 7444c508a12cedcf2896412a3700c1b2a35bf339828Ted Kremenek case Stmt::WhileStmtClass: 7454c508a12cedcf2896412a3700c1b2a35bf339828Ted Kremenek // This case isn't for branch processing, but for handling the 7464c508a12cedcf2896412a3700c1b2a35bf339828Ted Kremenek // initialization of a condition variable. 7474c508a12cedcf2896412a3700c1b2a35bf339828Ted Kremenek VisitCondInit(cast<WhileStmt>(S)->getConditionVariable(), S, Pred, Dst); 748b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek break; 7491b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek } 7501b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek} 7511b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek 752e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek//===----------------------------------------------------------------------===// 753e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek// Block entrance. (Update counters). 754e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek//===----------------------------------------------------------------------===// 755e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek 75627c54e57c4a012dcdf2b40cf985b70d0b9caa69eTed Kremenekvoid ExprEngine::processCFGBlockEntrance(ExplodedNodeSet &dstNodes, 75727c54e57c4a012dcdf2b40cf985b70d0b9caa69eTed Kremenek GenericNodeBuilder<BlockEntrance> &nodeBuilder){ 75827c54e57c4a012dcdf2b40cf985b70d0b9caa69eTed Kremenek 75927c54e57c4a012dcdf2b40cf985b70d0b9caa69eTed Kremenek // FIXME: Refactor this into a checker. 76027c54e57c4a012dcdf2b40cf985b70d0b9caa69eTed Kremenek const CFGBlock *block = nodeBuilder.getProgramPoint().getBlock(); 76127c54e57c4a012dcdf2b40cf985b70d0b9caa69eTed Kremenek ExplodedNode *pred = nodeBuilder.getPredecessor(); 76227c54e57c4a012dcdf2b40cf985b70d0b9caa69eTed Kremenek 76327c54e57c4a012dcdf2b40cf985b70d0b9caa69eTed Kremenek if (nodeBuilder.getBlockCounter().getNumVisited( 76427c54e57c4a012dcdf2b40cf985b70d0b9caa69eTed Kremenek pred->getLocationContext()->getCurrentStackFrame(), 76527c54e57c4a012dcdf2b40cf985b70d0b9caa69eTed Kremenek block->getBlockID()) >= AMgr.getMaxVisit()) { 76627c54e57c4a012dcdf2b40cf985b70d0b9caa69eTed Kremenek 76727c54e57c4a012dcdf2b40cf985b70d0b9caa69eTed Kremenek static int tag = 0; 768b6a2b08a6b3fbce1a6a4b69d4185165de970696cTed Kremenek nodeBuilder.generateNode(pred->getState(), pred, &tag, true); 76927c54e57c4a012dcdf2b40cf985b70d0b9caa69eTed Kremenek } 770e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek} 771e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek 772e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek//===----------------------------------------------------------------------===// 7731670e403c48f3af4fceff3f6773a0e1cfc6c4eb3Ted Kremenek// Generic node creation. 7741670e403c48f3af4fceff3f6773a0e1cfc6c4eb3Ted Kremenek//===----------------------------------------------------------------------===// 7751670e403c48f3af4fceff3f6773a0e1cfc6c4eb3Ted Kremenek 776d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios KyrtzidisExplodedNode* ExprEngine::MakeNode(ExplodedNodeSet& Dst, const Stmt* S, 777031ccc0555a82afc2e8afe29e19dd57ff204e2deZhongxing Xu ExplodedNode* Pred, const GRState* St, 778031ccc0555a82afc2e8afe29e19dd57ff204e2deZhongxing Xu ProgramPoint::Kind K, const void *tag) { 779d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidis assert (Builder && "StmtNodeBuilder not present."); 7801670e403c48f3af4fceff3f6773a0e1cfc6c4eb3Ted Kremenek SaveAndRestore<const void*> OldTag(Builder->Tag); 7811670e403c48f3af4fceff3f6773a0e1cfc6c4eb3Ted Kremenek Builder->Tag = tag; 7821670e403c48f3af4fceff3f6773a0e1cfc6c4eb3Ted Kremenek return Builder->MakeNode(Dst, S, Pred, St, K); 7831670e403c48f3af4fceff3f6773a0e1cfc6c4eb3Ted Kremenek} 7841670e403c48f3af4fceff3f6773a0e1cfc6c4eb3Ted Kremenek 7851670e403c48f3af4fceff3f6773a0e1cfc6c4eb3Ted Kremenek//===----------------------------------------------------------------------===// 786e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek// Branch processing. 787e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek//===----------------------------------------------------------------------===// 788e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek 789d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidisconst GRState* ExprEngine::MarkBranch(const GRState* state, 79003509aea098772644bf4662dc1c88634818ceeccZhongxing Xu const Stmt* Terminator, 79103509aea098772644bf4662dc1c88634818ceeccZhongxing Xu bool branchTaken) { 7921eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 79305a2378c708688c8ef498a5cea40ed7f5db15fa5Ted Kremenek switch (Terminator->getStmtClass()) { 79405a2378c708688c8ef498a5cea40ed7f5db15fa5Ted Kremenek default: 795a8538d902fce9cfec20f39b34492268b51643819Ted Kremenek return state; 7961eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 79705a2378c708688c8ef498a5cea40ed7f5db15fa5Ted Kremenek case Stmt::BinaryOperatorClass: { // '&&' and '||' 7981eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 79903509aea098772644bf4662dc1c88634818ceeccZhongxing Xu const BinaryOperator* B = cast<BinaryOperator>(Terminator); 80005a2378c708688c8ef498a5cea40ed7f5db15fa5Ted Kremenek BinaryOperator::Opcode Op = B->getOpcode(); 8011eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 8022de56d1d0c3a504ad1529de2677628bdfbb95cd4John McCall assert (Op == BO_LAnd || Op == BO_LOr); 8031eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 80405a2378c708688c8ef498a5cea40ed7f5db15fa5Ted Kremenek // For &&, if we take the true branch, then the value of the whole 80505a2378c708688c8ef498a5cea40ed7f5db15fa5Ted Kremenek // expression is that of the RHS expression. 80605a2378c708688c8ef498a5cea40ed7f5db15fa5Ted Kremenek // 80705a2378c708688c8ef498a5cea40ed7f5db15fa5Ted Kremenek // For ||, if we take the false branch, then the value of the whole 80805a2378c708688c8ef498a5cea40ed7f5db15fa5Ted Kremenek // expression is that of the RHS expression. 8091eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 8102de56d1d0c3a504ad1529de2677628bdfbb95cd4John McCall const Expr* Ex = (Op == BO_LAnd && branchTaken) || 8112de56d1d0c3a504ad1529de2677628bdfbb95cd4John McCall (Op == BO_LOr && !branchTaken) 81203509aea098772644bf4662dc1c88634818ceeccZhongxing Xu ? B->getRHS() : B->getLHS(); 8131eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 8148e0293406f9d62a293be6be3b1fb89d359f5ea40Ted Kremenek return state->BindExpr(B, UndefinedVal(Ex)); 81505a2378c708688c8ef498a5cea40ed7f5db15fa5Ted Kremenek } 8161eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 81756ca35d396d8692c384c785f9aeebcf22563fe1eJohn McCall case Stmt::BinaryConditionalOperatorClass: 81805a2378c708688c8ef498a5cea40ed7f5db15fa5Ted Kremenek case Stmt::ConditionalOperatorClass: { // ?: 81956ca35d396d8692c384c785f9aeebcf22563fe1eJohn McCall const AbstractConditionalOperator* C 82056ca35d396d8692c384c785f9aeebcf22563fe1eJohn McCall = cast<AbstractConditionalOperator>(Terminator); 8211eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 82205a2378c708688c8ef498a5cea40ed7f5db15fa5Ted Kremenek // For ?, if branchTaken == true then the value is either the LHS or 82305a2378c708688c8ef498a5cea40ed7f5db15fa5Ted Kremenek // the condition itself. (GNU extension). 8241eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 82503509aea098772644bf4662dc1c88634818ceeccZhongxing Xu const Expr* Ex; 8261eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 82705a2378c708688c8ef498a5cea40ed7f5db15fa5Ted Kremenek if (branchTaken) 82856ca35d396d8692c384c785f9aeebcf22563fe1eJohn McCall Ex = C->getTrueExpr(); 82905a2378c708688c8ef498a5cea40ed7f5db15fa5Ted Kremenek else 83056ca35d396d8692c384c785f9aeebcf22563fe1eJohn McCall Ex = C->getFalseExpr(); 8311eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 8328e0293406f9d62a293be6be3b1fb89d359f5ea40Ted Kremenek return state->BindExpr(C, UndefinedVal(Ex)); 83305a2378c708688c8ef498a5cea40ed7f5db15fa5Ted Kremenek } 8341eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 83505a2378c708688c8ef498a5cea40ed7f5db15fa5Ted Kremenek case Stmt::ChooseExprClass: { // ?: 8361eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 83703509aea098772644bf4662dc1c88634818ceeccZhongxing Xu const ChooseExpr* C = cast<ChooseExpr>(Terminator); 8381eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 83903509aea098772644bf4662dc1c88634818ceeccZhongxing Xu const Expr* Ex = branchTaken ? C->getLHS() : C->getRHS(); 8408e0293406f9d62a293be6be3b1fb89d359f5ea40Ted Kremenek return state->BindExpr(C, UndefinedVal(Ex)); 84105a2378c708688c8ef498a5cea40ed7f5db15fa5Ted Kremenek } 84205a2378c708688c8ef498a5cea40ed7f5db15fa5Ted Kremenek } 84305a2378c708688c8ef498a5cea40ed7f5db15fa5Ted Kremenek} 84405a2378c708688c8ef498a5cea40ed7f5db15fa5Ted Kremenek 8456ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek/// RecoverCastedSymbol - A helper function for ProcessBranch that is used 8466ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek/// to try to recover some path-sensitivity for casts of symbolic 8476ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek/// integers that promote their values (which are currently not tracked well). 8486ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek/// This function returns the SVal bound to Condition->IgnoreCasts if all the 8496ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek// cast(s) did was sign-extend the original value. 8506ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenekstatic SVal RecoverCastedSymbol(GRStateManager& StateMgr, const GRState* state, 85103509aea098772644bf4662dc1c88634818ceeccZhongxing Xu const Stmt* Condition, ASTContext& Ctx) { 8526ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek 85303509aea098772644bf4662dc1c88634818ceeccZhongxing Xu const Expr *Ex = dyn_cast<Expr>(Condition); 8546ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek if (!Ex) 8556ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek return UnknownVal(); 8566ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek 8576ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek uint64_t bits = 0; 8586ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek bool bitsInit = false; 8591eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 86003509aea098772644bf4662dc1c88634818ceeccZhongxing Xu while (const CastExpr *CE = dyn_cast<CastExpr>(Ex)) { 8616ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek QualType T = CE->getType(); 8626ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek 8636ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek if (!T->isIntegerType()) 8646ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek return UnknownVal(); 8651eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 8666ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek uint64_t newBits = Ctx.getTypeSize(T); 8676ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek if (!bitsInit || newBits < bits) { 8686ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek bitsInit = true; 8696ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek bits = newBits; 8706ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek } 8711eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 8726ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek Ex = CE->getSubExpr(); 8736ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek } 8746ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek 8756ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek // We reached a non-cast. Is it a symbolic value? 8766ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek QualType T = Ex->getType(); 8776ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek 8786ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek if (!bitsInit || !T->isIntegerType() || Ctx.getTypeSize(T) > bits) 8796ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek return UnknownVal(); 8801eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 8811397663af9dbcc24dbf0e11de43931b3dc08fdbbTed Kremenek return state->getSVal(Ex); 8826ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek} 8836ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek 884e36de1fe51c39d9161915dd3dbef880954af6476Ted Kremenekvoid ExprEngine::processBranch(const Stmt* Condition, const Stmt* Term, 885d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidis BranchNodeBuilder& builder) { 8861eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 887b2331834a0515c80862ee51325c758a053829f15Ted Kremenek // Check for NULL conditions; e.g. "for(;;)" 8881eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump if (!Condition) { 889b2331834a0515c80862ee51325c758a053829f15Ted Kremenek builder.markInfeasible(false); 890b2331834a0515c80862ee51325c758a053829f15Ted Kremenek return; 891b2331834a0515c80862ee51325c758a053829f15Ted Kremenek } 8921eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 89321028dd8850c64a414f7a82dfddcc291351203d6Ted Kremenek PrettyStackTraceLoc CrashInfo(getContext().getSourceManager(), 89421028dd8850c64a414f7a82dfddcc291351203d6Ted Kremenek Condition->getLocStart(), 89521028dd8850c64a414f7a82dfddcc291351203d6Ted Kremenek "Error evaluating branch"); 8960fb0bc4067d6c9d7c0e655300ef309b05d3adfc9Ted Kremenek 897cc05d511b26ac6dc80fcbcc78ac305d2755aa0b9Argyrios Kyrtzidis getCheckerManager().runCheckersForBranchCondition(Condition, builder, *this); 898cc05d511b26ac6dc80fcbcc78ac305d2755aa0b9Argyrios Kyrtzidis 8990835e4cccfef3ea5346962722b79484f6b3ca602Zhongxing Xu // If the branch condition is undefined, return; 9000835e4cccfef3ea5346962722b79484f6b3ca602Zhongxing Xu if (!builder.isFeasible(true) && !builder.isFeasible(false)) 9010835e4cccfef3ea5346962722b79484f6b3ca602Zhongxing Xu return; 9021eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 9030835e4cccfef3ea5346962722b79484f6b3ca602Zhongxing Xu const GRState* PrevState = builder.getState(); 9041397663af9dbcc24dbf0e11de43931b3dc08fdbbTed Kremenek SVal X = PrevState->getSVal(Condition); 905b38911f16b4943548db6a3695fc6ae23070b25d2Ted Kremenek 90673c498a08f4968b6987d1453c7b77929dcc6d5f7Argyrios Kyrtzidis if (X.isUnknownOrUndef()) { 9070835e4cccfef3ea5346962722b79484f6b3ca602Zhongxing Xu // Give it a chance to recover from unknown. 9080835e4cccfef3ea5346962722b79484f6b3ca602Zhongxing Xu if (const Expr *Ex = dyn_cast<Expr>(Condition)) { 9090835e4cccfef3ea5346962722b79484f6b3ca602Zhongxing Xu if (Ex->getType()->isIntegerType()) { 9100835e4cccfef3ea5346962722b79484f6b3ca602Zhongxing Xu // Try to recover some path-sensitivity. Right now casts of symbolic 9110835e4cccfef3ea5346962722b79484f6b3ca602Zhongxing Xu // integers that promote their values are currently not tracked well. 9120835e4cccfef3ea5346962722b79484f6b3ca602Zhongxing Xu // If 'Condition' is such an expression, try and recover the 9130835e4cccfef3ea5346962722b79484f6b3ca602Zhongxing Xu // underlying value and use that instead. 9140835e4cccfef3ea5346962722b79484f6b3ca602Zhongxing Xu SVal recovered = RecoverCastedSymbol(getStateManager(), 9150835e4cccfef3ea5346962722b79484f6b3ca602Zhongxing Xu builder.getState(), Condition, 9160835e4cccfef3ea5346962722b79484f6b3ca602Zhongxing Xu getContext()); 917b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 9180835e4cccfef3ea5346962722b79484f6b3ca602Zhongxing Xu if (!recovered.isUnknown()) { 9190835e4cccfef3ea5346962722b79484f6b3ca602Zhongxing Xu X = recovered; 9200835e4cccfef3ea5346962722b79484f6b3ca602Zhongxing Xu } 921b38911f16b4943548db6a3695fc6ae23070b25d2Ted Kremenek } 9220835e4cccfef3ea5346962722b79484f6b3ca602Zhongxing Xu } 9230835e4cccfef3ea5346962722b79484f6b3ca602Zhongxing Xu // If the condition is still unknown, give up. 92473c498a08f4968b6987d1453c7b77929dcc6d5f7Argyrios Kyrtzidis if (X.isUnknownOrUndef()) { 9250835e4cccfef3ea5346962722b79484f6b3ca602Zhongxing Xu builder.generateNode(MarkBranch(PrevState, Term, true), true); 9260835e4cccfef3ea5346962722b79484f6b3ca602Zhongxing Xu builder.generateNode(MarkBranch(PrevState, Term, false), false); 927b38911f16b4943548db6a3695fc6ae23070b25d2Ted Kremenek return; 9281eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump } 929b38911f16b4943548db6a3695fc6ae23070b25d2Ted Kremenek } 9301eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 9310835e4cccfef3ea5346962722b79484f6b3ca602Zhongxing Xu DefinedSVal V = cast<DefinedSVal>(X); 9320835e4cccfef3ea5346962722b79484f6b3ca602Zhongxing Xu 9336a6719a3a11087b48d9f1a4eb08b3bd43cb05a65Ted Kremenek // Process the true branch. 934520035439d7133064325c4df6378c5a8f2f05539Ted Kremenek if (builder.isFeasible(true)) { 93528f47b92e760ccf641ac91cb0fe1c12d9ca89795Ted Kremenek if (const GRState *state = PrevState->assume(V, true)) 936520035439d7133064325c4df6378c5a8f2f05539Ted Kremenek builder.generateNode(MarkBranch(state, Term, true), true); 937520035439d7133064325c4df6378c5a8f2f05539Ted Kremenek else 938520035439d7133064325c4df6378c5a8f2f05539Ted Kremenek builder.markInfeasible(true); 939520035439d7133064325c4df6378c5a8f2f05539Ted Kremenek } 9401eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 9411eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump // Process the false branch. 942520035439d7133064325c4df6378c5a8f2f05539Ted Kremenek if (builder.isFeasible(false)) { 94328f47b92e760ccf641ac91cb0fe1c12d9ca89795Ted Kremenek if (const GRState *state = PrevState->assume(V, false)) 944520035439d7133064325c4df6378c5a8f2f05539Ted Kremenek builder.generateNode(MarkBranch(state, Term, false), false); 945520035439d7133064325c4df6378c5a8f2f05539Ted Kremenek else 946520035439d7133064325c4df6378c5a8f2f05539Ted Kremenek builder.markInfeasible(false); 947520035439d7133064325c4df6378c5a8f2f05539Ted Kremenek } 948f233d48cfc513b045e2c2cfca5c175220fbd0a82Ted Kremenek} 949f233d48cfc513b045e2c2cfca5c175220fbd0a82Ted Kremenek 950e36de1fe51c39d9161915dd3dbef880954af6476Ted Kremenek/// processIndirectGoto - Called by CoreEngine. Used to generate successor 951754607e7cff2d902d9af8b771409449fb2f8d2bfTed Kremenek/// nodes by processing the 'effects' of a computed goto jump. 952ad8dcf4a9df0e24051dc31bf9e6f3cd138a34298Chris Lattnervoid ExprEngine::processIndirectGoto(IndirectGotoNodeBuilder &builder) { 953754607e7cff2d902d9af8b771409449fb2f8d2bfTed Kremenek 9541eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump const GRState *state = builder.getState(); 9551397663af9dbcc24dbf0e11de43931b3dc08fdbbTed Kremenek SVal V = state->getSVal(builder.getTarget()); 9561eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 957754607e7cff2d902d9af8b771409449fb2f8d2bfTed Kremenek // Three possibilities: 958754607e7cff2d902d9af8b771409449fb2f8d2bfTed Kremenek // 959754607e7cff2d902d9af8b771409449fb2f8d2bfTed Kremenek // (1) We know the computed label. 9604a4e524afef40d6f3ddb25d0e407c814e4ca56a8Ted Kremenek // (2) The label is NULL (or some other constant), or Undefined. 961754607e7cff2d902d9af8b771409449fb2f8d2bfTed Kremenek // (3) We have no clue about the label. Dispatch to all targets. 962754607e7cff2d902d9af8b771409449fb2f8d2bfTed Kremenek // 9631eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 964d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidis typedef IndirectGotoNodeBuilder::iterator iterator; 965754607e7cff2d902d9af8b771409449fb2f8d2bfTed Kremenek 9661c96b24285d05c0eac455ae96d7c9ff43d42bc96Zhongxing Xu if (isa<loc::GotoLabel>(V)) { 967ad8dcf4a9df0e24051dc31bf9e6f3cd138a34298Chris Lattner const LabelDecl *L = cast<loc::GotoLabel>(V).getLabel(); 9681eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 969ad8dcf4a9df0e24051dc31bf9e6f3cd138a34298Chris Lattner for (iterator I = builder.begin(), E = builder.end(); I != E; ++I) { 97024f1a967741ff9f8025ee23be12ba6feacc31f77Ted Kremenek if (I.getLabel() == L) { 971a8538d902fce9cfec20f39b34492268b51643819Ted Kremenek builder.generateNode(I, state); 972754607e7cff2d902d9af8b771409449fb2f8d2bfTed Kremenek return; 973754607e7cff2d902d9af8b771409449fb2f8d2bfTed Kremenek } 974754607e7cff2d902d9af8b771409449fb2f8d2bfTed Kremenek } 9751eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 976ad8dcf4a9df0e24051dc31bf9e6f3cd138a34298Chris Lattner assert(false && "No block with label."); 977754607e7cff2d902d9af8b771409449fb2f8d2bfTed Kremenek return; 978754607e7cff2d902d9af8b771409449fb2f8d2bfTed Kremenek } 979754607e7cff2d902d9af8b771409449fb2f8d2bfTed Kremenek 9801c96b24285d05c0eac455ae96d7c9ff43d42bc96Zhongxing Xu if (isa<loc::ConcreteInt>(V) || isa<UndefinedVal>(V)) { 981754607e7cff2d902d9af8b771409449fb2f8d2bfTed Kremenek // Dispatch to the first target and mark it as a sink. 9822055effed54d614b51e3501a174c9b1fe92e4de4Zhongxing Xu //ExplodedNode* N = builder.generateNode(builder.begin(), state, true); 9832055effed54d614b51e3501a174c9b1fe92e4de4Zhongxing Xu // FIXME: add checker visit. 9842055effed54d614b51e3501a174c9b1fe92e4de4Zhongxing Xu // UndefBranches.insert(N); 985754607e7cff2d902d9af8b771409449fb2f8d2bfTed Kremenek return; 986754607e7cff2d902d9af8b771409449fb2f8d2bfTed Kremenek } 9871eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 988754607e7cff2d902d9af8b771409449fb2f8d2bfTed Kremenek // This is really a catch-all. We don't support symbolics yet. 989b3cfd58c9b13325d994e5f9b5065e6a22d91911dTed Kremenek // FIXME: Implement dispatch for symbolic pointers. 9901eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 991754607e7cff2d902d9af8b771409449fb2f8d2bfTed Kremenek for (iterator I=builder.begin(), E=builder.end(); I != E; ++I) 992a8538d902fce9cfec20f39b34492268b51643819Ted Kremenek builder.generateNode(I, state); 993754607e7cff2d902d9af8b771409449fb2f8d2bfTed Kremenek} 994f233d48cfc513b045e2c2cfca5c175220fbd0a82Ted Kremenek 995e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek 996d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidisvoid ExprEngine::VisitGuardedExpr(const Expr* Ex, const Expr* L, 99703509aea098772644bf4662dc1c88634818ceeccZhongxing Xu const Expr* R, 998031ccc0555a82afc2e8afe29e19dd57ff204e2deZhongxing Xu ExplodedNode* Pred, ExplodedNodeSet& Dst) { 9991eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 10000a3ed3143b00f237decb1288c1ff574ae09eba4eTed Kremenek assert(Ex == currentStmt && 1001bb141217871e93767aa3f2de1b9946fa6d37066aZhongxing Xu Pred->getLocationContext()->getCFG()->isBlkExpr(Ex)); 10021eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1003a8538d902fce9cfec20f39b34492268b51643819Ted Kremenek const GRState* state = GetState(Pred); 10041397663af9dbcc24dbf0e11de43931b3dc08fdbbTed Kremenek SVal X = state->getSVal(Ex); 10051eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1006e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek assert (X.isUndef()); 10071eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 100803509aea098772644bf4662dc1c88634818ceeccZhongxing Xu const Expr *SE = (Expr*) cast<UndefinedVal>(X).getData(); 10091eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump assert(SE); 10101397663af9dbcc24dbf0e11de43931b3dc08fdbbTed Kremenek X = state->getSVal(SE); 10111eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1012e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek // Make sure that we invalidate the previous binding. 10138e0293406f9d62a293be6be3b1fb89d359f5ea40Ted Kremenek MakeNode(Dst, Ex, Pred, state->BindExpr(Ex, X, true)); 1014e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek} 1015e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek 1016d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidis/// ProcessEndPath - Called by CoreEngine. Used to generate end-of-path 101773099bfea9f5d4ec05265170bbefec3d76fb6b5eTed Kremenek/// nodes when the control reaches the end of a function. 1018e36de1fe51c39d9161915dd3dbef880954af6476Ted Kremenekvoid ExprEngine::processEndOfFunction(EndOfFunctionNodeBuilder& builder) { 10199c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek getTF().evalEndPath(*this, builder); 102073099bfea9f5d4ec05265170bbefec3d76fb6b5eTed Kremenek StateMgr.EndPath(builder.getState()); 1021af5800a1e287990bb547e052f257adeeae5ab476Argyrios Kyrtzidis getCheckerManager().runCheckersForEndPath(builder, *this); 102273099bfea9f5d4ec05265170bbefec3d76fb6b5eTed Kremenek} 102373099bfea9f5d4ec05265170bbefec3d76fb6b5eTed Kremenek 1024d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidis/// ProcessSwitch - Called by CoreEngine. Used to generate successor 1025daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek/// nodes by processing the 'effects' of a switch statement. 1026e36de1fe51c39d9161915dd3dbef880954af6476Ted Kremenekvoid ExprEngine::processSwitch(SwitchNodeBuilder& builder) { 1027d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidis typedef SwitchNodeBuilder::iterator iterator; 10281eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump const GRState* state = builder.getState(); 102903509aea098772644bf4662dc1c88634818ceeccZhongxing Xu const Expr* CondE = builder.getCondition(); 10301397663af9dbcc24dbf0e11de43931b3dc08fdbbTed Kremenek SVal CondV_untested = state->getSVal(CondE); 1031daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek 10325b9bd2137ebef350af803c634e3fdf5d74678100Ted Kremenek if (CondV_untested.isUndef()) { 10332055effed54d614b51e3501a174c9b1fe92e4de4Zhongxing Xu //ExplodedNode* N = builder.generateDefaultCaseNode(state, true); 1034b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek // FIXME: add checker 10352055effed54d614b51e3501a174c9b1fe92e4de4Zhongxing Xu //UndefBranches.insert(N); 10362055effed54d614b51e3501a174c9b1fe92e4de4Zhongxing Xu 1037daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek return; 1038daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek } 10395b9bd2137ebef350af803c634e3fdf5d74678100Ted Kremenek DefinedOrUnknownSVal CondV = cast<DefinedOrUnknownSVal>(CondV_untested); 1040692416c214a3b234236dedcf875735a9cc29e90bTed Kremenek 10415b9bd2137ebef350af803c634e3fdf5d74678100Ted Kremenek const GRState *DefaultSt = state; 104234feff654c6304e0a59ceb1376989d28dbc956ffTed Kremenek 104334feff654c6304e0a59ceb1376989d28dbc956ffTed Kremenek iterator I = builder.begin(), EI = builder.end(); 104434feff654c6304e0a59ceb1376989d28dbc956ffTed Kremenek bool defaultIsFeasible = I == EI; 10451eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 104634feff654c6304e0a59ceb1376989d28dbc956ffTed Kremenek for ( ; I != EI; ++I) { 1047e71f3d587844110d836c82250830b27b1651afdbTed Kremenek // Successor may be pruned out during CFG construction. 1048e71f3d587844110d836c82250830b27b1651afdbTed Kremenek if (!I.getBlock()) 1049e71f3d587844110d836c82250830b27b1651afdbTed Kremenek continue; 1050e71f3d587844110d836c82250830b27b1651afdbTed Kremenek 1051412711774cf912bac8e81ef86da33acac6856b8aTed Kremenek const CaseStmt* Case = I.getCase(); 105272afb3739da0da02158242ae41a50cfe0bea78b4Ted Kremenek 105372afb3739da0da02158242ae41a50cfe0bea78b4Ted Kremenek // Evaluate the LHS of the case value. 105472afb3739da0da02158242ae41a50cfe0bea78b4Ted Kremenek Expr::EvalResult V1; 10551eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump bool b = Case->getLHS()->Evaluate(V1, getContext()); 10561eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 105772afb3739da0da02158242ae41a50cfe0bea78b4Ted Kremenek // Sanity checks. These go away in Release builds. 10581eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump assert(b && V1.Val.isInt() && !V1.HasSideEffects 105972afb3739da0da02158242ae41a50cfe0bea78b4Ted Kremenek && "Case condition must evaluate to an integer constant."); 1060c6ed729f669044f5072a49d79041f455d971ece3Jeffrey Yasskin (void)b; // silence unused variable warning 10611eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump assert(V1.Val.getInt().getBitWidth() == 106272afb3739da0da02158242ae41a50cfe0bea78b4Ted Kremenek getContext().getTypeSize(CondE->getType())); 10631eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1064daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek // Get the RHS of the case, if it exists. 106572afb3739da0da02158242ae41a50cfe0bea78b4Ted Kremenek Expr::EvalResult V2; 10661eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 106703509aea098772644bf4662dc1c88634818ceeccZhongxing Xu if (const Expr* E = Case->getRHS()) { 106872afb3739da0da02158242ae41a50cfe0bea78b4Ted Kremenek b = E->Evaluate(V2, getContext()); 10691eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump assert(b && V2.Val.isInt() && !V2.HasSideEffects 107072afb3739da0da02158242ae41a50cfe0bea78b4Ted Kremenek && "Case condition must evaluate to an integer constant."); 1071c6ed729f669044f5072a49d79041f455d971ece3Jeffrey Yasskin (void)b; // silence unused variable warning 1072daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek } 107314a1140c9f4e20b12a54db8745b74699b9872cd2Ted Kremenek else 107414a1140c9f4e20b12a54db8745b74699b9872cd2Ted Kremenek V2 = V1; 10751eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1076daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek // FIXME: Eventually we should replace the logic below with a range 1077daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek // comparison, rather than concretize the values within the range. 1078aa1c4e5a6b87b62d991c55a0d4522bcd778068d7Ted Kremenek // This should be easy once we have "ranges" for NonLVals. 10791eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 108014a1140c9f4e20b12a54db8745b74699b9872cd2Ted Kremenek do { 10811eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump nonloc::ConcreteInt CaseVal(getBasicVals().getValue(V1.Val.getInt())); 10829c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek DefinedOrUnknownSVal Res = svalBuilder.evalEQ(DefaultSt ? DefaultSt : state, 108348569f9562740ac1f4b175cb17ce3d49035402c4Ted Kremenek CondV, CaseVal); 1084b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 10851eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump // Now "assume" that the case matches. 108628f47b92e760ccf641ac91cb0fe1c12d9ca89795Ted Kremenek if (const GRState* stateNew = state->assume(Res, true)) { 1087a591bc04d21fa62ebffcb2c7814d738ca8f5e2f9Ted Kremenek builder.generateCaseStmtNode(I, stateNew); 10881eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1089daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek // If CondV evaluates to a constant, then we know that this 1090daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek // is the *only* case that we can take, so stop evaluating the 1091daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek // others. 10921c96b24285d05c0eac455ae96d7c9ff43d42bc96Zhongxing Xu if (isa<nonloc::ConcreteInt>(CondV)) 1093daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek return; 1094daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek } 10951eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1096daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek // Now "assume" that the case doesn't match. Add this state 1097daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek // to the default state (if it is feasible). 109848569f9562740ac1f4b175cb17ce3d49035402c4Ted Kremenek if (DefaultSt) { 109928f47b92e760ccf641ac91cb0fe1c12d9ca89795Ted Kremenek if (const GRState *stateNew = DefaultSt->assume(Res, false)) { 110048569f9562740ac1f4b175cb17ce3d49035402c4Ted Kremenek defaultIsFeasible = true; 110148569f9562740ac1f4b175cb17ce3d49035402c4Ted Kremenek DefaultSt = stateNew; 110248569f9562740ac1f4b175cb17ce3d49035402c4Ted Kremenek } 110348569f9562740ac1f4b175cb17ce3d49035402c4Ted Kremenek else { 110448569f9562740ac1f4b175cb17ce3d49035402c4Ted Kremenek defaultIsFeasible = false; 110548569f9562740ac1f4b175cb17ce3d49035402c4Ted Kremenek DefaultSt = NULL; 110648569f9562740ac1f4b175cb17ce3d49035402c4Ted Kremenek } 11075014ab113eb211b8320ae30b173d7020352663c6Ted Kremenek } 1108b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 110914a1140c9f4e20b12a54db8745b74699b9872cd2Ted Kremenek // Concretize the next value in the range. 111072afb3739da0da02158242ae41a50cfe0bea78b4Ted Kremenek if (V1.Val.getInt() == V2.Val.getInt()) 111114a1140c9f4e20b12a54db8745b74699b9872cd2Ted Kremenek break; 11121eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 111372afb3739da0da02158242ae41a50cfe0bea78b4Ted Kremenek ++V1.Val.getInt(); 111472afb3739da0da02158242ae41a50cfe0bea78b4Ted Kremenek assert (V1.Val.getInt() <= V2.Val.getInt()); 11151eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 111614a1140c9f4e20b12a54db8745b74699b9872cd2Ted Kremenek } while (true); 1117daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek } 11181eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 11194d3175c1e5a44251ea97b0c81e80f060629d9c08Ted Kremenek if (!defaultIsFeasible) 11204d3175c1e5a44251ea97b0c81e80f060629d9c08Ted Kremenek return; 11214d3175c1e5a44251ea97b0c81e80f060629d9c08Ted Kremenek 11224d3175c1e5a44251ea97b0c81e80f060629d9c08Ted Kremenek // If we have switch(enum value), the default branch is not 11234d3175c1e5a44251ea97b0c81e80f060629d9c08Ted Kremenek // feasible if all of the enum constants not covered by 'case:' statements 11244d3175c1e5a44251ea97b0c81e80f060629d9c08Ted Kremenek // are not feasible values for the switch condition. 11254d3175c1e5a44251ea97b0c81e80f060629d9c08Ted Kremenek // 11264d3175c1e5a44251ea97b0c81e80f060629d9c08Ted Kremenek // Note that this isn't as accurate as it could be. Even if there isn't 11274d3175c1e5a44251ea97b0c81e80f060629d9c08Ted Kremenek // a case for a particular enum value as long as that enum value isn't 11284d3175c1e5a44251ea97b0c81e80f060629d9c08Ted Kremenek // feasible then it shouldn't be considered for making 'default:' reachable. 11294d3175c1e5a44251ea97b0c81e80f060629d9c08Ted Kremenek const SwitchStmt *SS = builder.getSwitch(); 11304d3175c1e5a44251ea97b0c81e80f060629d9c08Ted Kremenek const Expr *CondExpr = SS->getCond()->IgnoreParenImpCasts(); 11314d3175c1e5a44251ea97b0c81e80f060629d9c08Ted Kremenek if (CondExpr->getType()->getAs<EnumType>()) { 11324d3175c1e5a44251ea97b0c81e80f060629d9c08Ted Kremenek if (SS->isAllEnumCasesCovered()) 11334d3175c1e5a44251ea97b0c81e80f060629d9c08Ted Kremenek return; 11344d3175c1e5a44251ea97b0c81e80f060629d9c08Ted Kremenek } 11354d3175c1e5a44251ea97b0c81e80f060629d9c08Ted Kremenek 11364d3175c1e5a44251ea97b0c81e80f060629d9c08Ted Kremenek builder.generateDefaultCaseNode(DefaultSt); 1137daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek} 1138daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek 1139e36de1fe51c39d9161915dd3dbef880954af6476Ted Kremenekvoid ExprEngine::processCallEnter(CallEnterNodeBuilder &B) { 11402ccf047adf877f5e821210b1ce1a2c8289acadc0Ted Kremenek const GRState *state = B.getState()->enterStackFrame(B.getCalleeContext()); 1141d048c6ef5b6cfaa0cecb8cc1d4bdace32ed21d07Ted Kremenek B.generateNode(state); 1142102acd5369bbb17c0d6ab868af376671acff7a93Douglas Gregor} 1143102acd5369bbb17c0d6ab868af376671acff7a93Douglas Gregor 1144e36de1fe51c39d9161915dd3dbef880954af6476Ted Kremenekvoid ExprEngine::processCallExit(CallExitNodeBuilder &B) { 1145102acd5369bbb17c0d6ab868af376671acff7a93Douglas Gregor const GRState *state = B.getState(); 1146102acd5369bbb17c0d6ab868af376671acff7a93Douglas Gregor const ExplodedNode *Pred = B.getPredecessor(); 114719b78d9e3dbbc27bbcbdd8c3017a00fe88849ecdZhongxing Xu const StackFrameContext *calleeCtx = 1148102acd5369bbb17c0d6ab868af376671acff7a93Douglas Gregor cast<StackFrameContext>(Pred->getLocationContext()); 114919b78d9e3dbbc27bbcbdd8c3017a00fe88849ecdZhongxing Xu const Stmt *CE = calleeCtx->getCallSite(); 1150102acd5369bbb17c0d6ab868af376671acff7a93Douglas Gregor 11516190ec29f0895185bbec95a932429b8832917fecZhongxing Xu // If the callee returns an expression, bind its value to CallExpr. 11526190ec29f0895185bbec95a932429b8832917fecZhongxing Xu const Stmt *ReturnedExpr = state->get<ReturnExpr>(); 11536190ec29f0895185bbec95a932429b8832917fecZhongxing Xu if (ReturnedExpr) { 11546190ec29f0895185bbec95a932429b8832917fecZhongxing Xu SVal RetVal = state->getSVal(ReturnedExpr); 11556190ec29f0895185bbec95a932429b8832917fecZhongxing Xu state = state->BindExpr(CE, RetVal); 1156bd2b2084e58577f17308f910770a5563a344251aZhongxing Xu // Clear the return expr GDM. 11570541d106eae48f4238097df03a72028a610e0dceZhongxing Xu state = state->remove<ReturnExpr>(); 11586190ec29f0895185bbec95a932429b8832917fecZhongxing Xu } 11596190ec29f0895185bbec95a932429b8832917fecZhongxing Xu 11608e18c1b840882d26039503629d7e4ad4822f3bdaZhongxing Xu // Bind the constructed object value to CXXConstructExpr. 11618e18c1b840882d26039503629d7e4ad4822f3bdaZhongxing Xu if (const CXXConstructExpr *CCE = dyn_cast<CXXConstructExpr>(CE)) { 11629dc84c9455df2a77195147d0210c915dc1775a88Zhongxing Xu const CXXThisRegion *ThisR = 116319b78d9e3dbbc27bbcbdd8c3017a00fe88849ecdZhongxing Xu getCXXThisRegion(CCE->getConstructor()->getParent(), calleeCtx); 1164d706434b0231c76fd9acf30060646a7aa8f69aefZhongxing Xu 11658e18c1b840882d26039503629d7e4ad4822f3bdaZhongxing Xu SVal ThisV = state->getSVal(ThisR); 116605e539175d9bac678fca8e77665e88b685729850Zhongxing Xu // Always bind the region to the CXXConstructExpr. 116705e539175d9bac678fca8e77665e88b685729850Zhongxing Xu state = state->BindExpr(CCE, ThisV); 11688e18c1b840882d26039503629d7e4ad4822f3bdaZhongxing Xu } 11698e18c1b840882d26039503629d7e4ad4822f3bdaZhongxing Xu 1170d048c6ef5b6cfaa0cecb8cc1d4bdace32ed21d07Ted Kremenek B.generateNode(state); 1171102acd5369bbb17c0d6ab868af376671acff7a93Douglas Gregor} 1172102acd5369bbb17c0d6ab868af376671acff7a93Douglas Gregor 1173e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek//===----------------------------------------------------------------------===// 1174e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek// Transfer functions: logical operations ('&&', '||'). 1175e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek//===----------------------------------------------------------------------===// 1176daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek 1177d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidisvoid ExprEngine::VisitLogicalExpr(const BinaryOperator* B, ExplodedNode* Pred, 1178031ccc0555a82afc2e8afe29e19dd57ff204e2deZhongxing Xu ExplodedNodeSet& Dst) { 11791eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 11802de56d1d0c3a504ad1529de2677628bdfbb95cd4John McCall assert(B->getOpcode() == BO_LAnd || 11812de56d1d0c3a504ad1529de2677628bdfbb95cd4John McCall B->getOpcode() == BO_LOr); 11821eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 11830a3ed3143b00f237decb1288c1ff574ae09eba4eTed Kremenek assert(B==currentStmt && Pred->getLocationContext()->getCFG()->isBlkExpr(B)); 11841eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1185a8538d902fce9cfec20f39b34492268b51643819Ted Kremenek const GRState* state = GetState(Pred); 11861397663af9dbcc24dbf0e11de43931b3dc08fdbbTed Kremenek SVal X = state->getSVal(B); 11873ff12591494a3cb3d3a24427975df58714ac3b2fTed Kremenek assert(X.isUndef()); 11881eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 11895b9bd2137ebef350af803c634e3fdf5d74678100Ted Kremenek const Expr *Ex = (const Expr*) cast<UndefinedVal>(X).getData(); 11903ff12591494a3cb3d3a24427975df58714ac3b2fTed Kremenek assert(Ex); 11911eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 119205a2378c708688c8ef498a5cea40ed7f5db15fa5Ted Kremenek if (Ex == B->getRHS()) { 11931397663af9dbcc24dbf0e11de43931b3dc08fdbbTed Kremenek X = state->getSVal(Ex); 11941eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 11954a4e524afef40d6f3ddb25d0e407c814e4ca56a8Ted Kremenek // Handle undefined values. 11964a4e524afef40d6f3ddb25d0e407c814e4ca56a8Ted Kremenek if (X.isUndef()) { 11978e0293406f9d62a293be6be3b1fb89d359f5ea40Ted Kremenek MakeNode(Dst, B, Pred, state->BindExpr(B, X)); 119858b3321009b3f750fb4587b12c2024bb77e6ebf0Ted Kremenek return; 119958b3321009b3f750fb4587b12c2024bb77e6ebf0Ted Kremenek } 1200b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 12015b9bd2137ebef350af803c634e3fdf5d74678100Ted Kremenek DefinedOrUnknownSVal XD = cast<DefinedOrUnknownSVal>(X); 12021eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 120305a2378c708688c8ef498a5cea40ed7f5db15fa5Ted Kremenek // We took the RHS. Because the value of the '&&' or '||' expression must 120405a2378c708688c8ef498a5cea40ed7f5db15fa5Ted Kremenek // evaluate to 0 or 1, we must assume the value of the RHS evaluates to 0 120505a2378c708688c8ef498a5cea40ed7f5db15fa5Ted Kremenek // or 1. Alternatively, we could take a lazy approach, and calculate this 120605a2378c708688c8ef498a5cea40ed7f5db15fa5Ted Kremenek // value later when necessary. We don't have the machinery in place for 120705a2378c708688c8ef498a5cea40ed7f5db15fa5Ted Kremenek // this right now, and since most logical expressions are used for branches, 12081eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump // the payoff is not likely to be large. Instead, we do eager evaluation. 120928f47b92e760ccf641ac91cb0fe1c12d9ca89795Ted Kremenek if (const GRState *newState = state->assume(XD, true)) 12101eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump MakeNode(Dst, B, Pred, 1211c8413fd03f73084a5c93028f8b4db619fc388087Ted Kremenek newState->BindExpr(B, svalBuilder.makeIntVal(1U, B->getType()))); 12121eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 121328f47b92e760ccf641ac91cb0fe1c12d9ca89795Ted Kremenek if (const GRState *newState = state->assume(XD, false)) 12141eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump MakeNode(Dst, B, Pred, 1215c8413fd03f73084a5c93028f8b4db619fc388087Ted Kremenek newState->BindExpr(B, svalBuilder.makeIntVal(0U, B->getType()))); 1216f233d48cfc513b045e2c2cfca5c175220fbd0a82Ted Kremenek } 1217f233d48cfc513b045e2c2cfca5c175220fbd0a82Ted Kremenek else { 121805a2378c708688c8ef498a5cea40ed7f5db15fa5Ted Kremenek // We took the LHS expression. Depending on whether we are '&&' or 121905a2378c708688c8ef498a5cea40ed7f5db15fa5Ted Kremenek // '||' we know what the value of the expression is via properties of 122005a2378c708688c8ef498a5cea40ed7f5db15fa5Ted Kremenek // the short-circuiting. 1221c8413fd03f73084a5c93028f8b4db619fc388087Ted Kremenek X = svalBuilder.makeIntVal(B->getOpcode() == BO_LAnd ? 0U : 1U, 1222d91ee27950ef5c321db1ac2aa5becb75ffe7cb14Zhongxing Xu B->getType()); 12238e0293406f9d62a293be6be3b1fb89d359f5ea40Ted Kremenek MakeNode(Dst, B, Pred, state->BindExpr(B, X)); 122405a2378c708688c8ef498a5cea40ed7f5db15fa5Ted Kremenek } 122571c29bdc931bc49644c581ec7d698f0dbf01a0aaTed Kremenek} 12261eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1227e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek//===----------------------------------------------------------------------===// 1228ec96a2d52d16e150baaf629cd35e3fabff5d8915Ted Kremenek// Transfer functions: Loads and stores. 1229e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek//===----------------------------------------------------------------------===// 1230d27f8169f4b68337a489547a41ac45bf7a5d1ddfTed Kremenek 1231d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidisvoid ExprEngine::VisitBlockExpr(const BlockExpr *BE, ExplodedNode *Pred, 1232c95ad9ff6e574aecdd759542d5578bc65d586d93Ted Kremenek ExplodedNodeSet &Dst) { 1233b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 123466078610be5e4319de02efa283b07887c73c2e27Ted Kremenek ExplodedNodeSet Tmp; 1235b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 1236c95ad9ff6e574aecdd759542d5578bc65d586d93Ted Kremenek CanQualType T = getContext().getCanonicalType(BE->getType()); 1237c8413fd03f73084a5c93028f8b4db619fc388087Ted Kremenek SVal V = svalBuilder.getBlockPointer(BE->getBlockDecl(), T, 12380a8112a78d00b5140c5b7f16c3b34c2c0c13c1a0Ted Kremenek Pred->getLocationContext()); 12390a8112a78d00b5140c5b7f16c3b34c2c0c13c1a0Ted Kremenek 124066078610be5e4319de02efa283b07887c73c2e27Ted Kremenek MakeNode(Tmp, BE, Pred, GetState(Pred)->BindExpr(BE, V), 1241c95ad9ff6e574aecdd759542d5578bc65d586d93Ted Kremenek ProgramPoint::PostLValueKind); 1242b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 124366078610be5e4319de02efa283b07887c73c2e27Ted Kremenek // Post-visit the BlockExpr. 1244eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis getCheckerManager().runCheckersForPostStmt(Dst, Tmp, BE, *this); 1245c95ad9ff6e574aecdd759542d5578bc65d586d93Ted Kremenek} 1246c95ad9ff6e574aecdd759542d5578bc65d586d93Ted Kremenek 1247d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidisvoid ExprEngine::VisitCommonDeclRefExpr(const Expr *Ex, const NamedDecl *D, 1248d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidis ExplodedNode *Pred, 1249d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidis ExplodedNodeSet &Dst) { 12505b9bd2137ebef350af803c634e3fdf5d74678100Ted Kremenek const GRState *state = GetState(Pred); 12516d69b5d82281992e981caa9bc038e3f6cac6594aZhongxing Xu 12526d69b5d82281992e981caa9bc038e3f6cac6594aZhongxing Xu if (const VarDecl* VD = dyn_cast<VarDecl>(D)) { 1253892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek assert(Ex->isLValue()); 1254d17da2b99f323fa91b01e1dd119cc32e0ee8197dTed Kremenek SVal V = state->getLValue(VD, Pred->getLocationContext()); 1255a7581731b1453b51b26154d2409d42a5b6395079Zhongxing Xu 1256892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek // For references, the 'lvalue' is the pointer address stored in the 1257892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek // reference region. 1258892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek if (VD->getType()->isReferenceType()) { 1259892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek if (const MemRegion *R = V.getAsRegion()) 1260892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek V = state->getSVal(R); 1261892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek else 1262892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek V = UnknownVal(); 1263852274d4257134906995cb252fb3dfd2d71deae8Ted Kremenek } 12646d69b5d82281992e981caa9bc038e3f6cac6594aZhongxing Xu 1265892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek MakeNode(Dst, Ex, Pred, state->BindExpr(Ex, V), 1266892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek ProgramPoint::PostLValueKind); 1267852274d4257134906995cb252fb3dfd2d71deae8Ted Kremenek return; 1268892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek } 1269892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek if (const EnumConstantDecl* ED = dyn_cast<EnumConstantDecl>(D)) { 1270892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek assert(!Ex->isLValue()); 1271c8413fd03f73084a5c93028f8b4db619fc388087Ted Kremenek SVal V = svalBuilder.makeIntVal(ED->getInitVal()); 12728e0293406f9d62a293be6be3b1fb89d359f5ea40Ted Kremenek MakeNode(Dst, Ex, Pred, state->BindExpr(Ex, V)); 12736d69b5d82281992e981caa9bc038e3f6cac6594aZhongxing Xu return; 1274892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek } 1275892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek if (const FunctionDecl* FD = dyn_cast<FunctionDecl>(D)) { 1276c8413fd03f73084a5c93028f8b4db619fc388087Ted Kremenek SVal V = svalBuilder.getFunctionPointer(FD); 12778e0293406f9d62a293be6be3b1fb89d359f5ea40Ted Kremenek MakeNode(Dst, Ex, Pred, state->BindExpr(Ex, V), 12787090d5465de7ca620da16211cf886edf1edc1f1fTed Kremenek ProgramPoint::PostLValueKind); 12796d69b5d82281992e981caa9bc038e3f6cac6594aZhongxing Xu return; 12801b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek } 12816d69b5d82281992e981caa9bc038e3f6cac6594aZhongxing Xu assert (false && 12826d69b5d82281992e981caa9bc038e3f6cac6594aZhongxing Xu "ValueDecl support for this ValueDecl not implemented."); 12833271f8d315712885ac87747369bb1d9f4b1ea81fTed Kremenek} 12843271f8d315712885ac87747369bb1d9f4b1ea81fTed Kremenek 1285540cbe2b60294fe7b926c26b4f1840f544fe3011Ted Kremenek/// VisitArraySubscriptExpr - Transfer function for array accesses 1286d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidisvoid ExprEngine::VisitLvalArraySubscriptExpr(const ArraySubscriptExpr* A, 1287d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidis ExplodedNode* Pred, 1288d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidis ExplodedNodeSet& Dst){ 12891eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 129003509aea098772644bf4662dc1c88634818ceeccZhongxing Xu const Expr* Base = A->getBase()->IgnoreParens(); 129103509aea098772644bf4662dc1c88634818ceeccZhongxing Xu const Expr* Idx = A->getIdx()->IgnoreParens(); 1292892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek 1293892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek // Evaluate the base. 1294031ccc0555a82afc2e8afe29e19dd57ff204e2deZhongxing Xu ExplodedNodeSet Tmp; 1295892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek Visit(Base, Pred, Tmp); 12961eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1297031ccc0555a82afc2e8afe29e19dd57ff204e2deZhongxing Xu for (ExplodedNodeSet::iterator I1=Tmp.begin(), E1=Tmp.end(); I1!=E1; ++I1) { 1298031ccc0555a82afc2e8afe29e19dd57ff204e2deZhongxing Xu ExplodedNodeSet Tmp2; 1299d9bc33efa195114d6f2a365c26e5b8dba4e1cc38Ted Kremenek Visit(Idx, *I1, Tmp2); // Evaluate the index. 1300d694485f9d6e3ea7b458df8241dfffd38f62aca8Zhongxing Xu ExplodedNodeSet Tmp3; 1301eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis getCheckerManager().runCheckersForPreStmt(Tmp3, Tmp2, A, *this); 1302d694485f9d6e3ea7b458df8241dfffd38f62aca8Zhongxing Xu 1303d694485f9d6e3ea7b458df8241dfffd38f62aca8Zhongxing Xu for (ExplodedNodeSet::iterator I2=Tmp3.begin(),E2=Tmp3.end();I2!=E2; ++I2) { 1304a8538d902fce9cfec20f39b34492268b51643819Ted Kremenek const GRState* state = GetState(*I2); 13051397663af9dbcc24dbf0e11de43931b3dc08fdbbTed Kremenek SVal V = state->getLValue(A->getType(), state->getSVal(Idx), 13061397663af9dbcc24dbf0e11de43931b3dc08fdbbTed Kremenek state->getSVal(Base)); 1307892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek assert(A->isLValue()); 1308892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek MakeNode(Dst, A, *I2, state->BindExpr(A, V), ProgramPoint::PostLValueKind); 13094d0348b6c74d2710a3693bbfbcfc5fcb3bc132eeTed Kremenek } 13101b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek } 1311540cbe2b60294fe7b926c26b4f1840f544fe3011Ted Kremenek} 1312540cbe2b60294fe7b926c26b4f1840f544fe3011Ted Kremenek 1313469ecbded3616416ef938ed94a67f86149faf226Ted Kremenek/// VisitMemberExpr - Transfer function for member expressions. 1314d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidisvoid ExprEngine::VisitMemberExpr(const MemberExpr* M, ExplodedNode* Pred, 1315d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidis ExplodedNodeSet& Dst) { 13161eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1317892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek Expr *baseExpr = M->getBase()->IgnoreParens(); 1318892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek ExplodedNodeSet dstBase; 1319892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek Visit(baseExpr, Pred, dstBase); 13201eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1321892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek FieldDecl *field = dyn_cast<FieldDecl>(M->getMemberDecl()); 1322892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek if (!field) // FIXME: skipping member expressions for non-fields 132386f194083504938df72135b5b66bf0c5cafd9498Douglas Gregor return; 132486f194083504938df72135b5b66bf0c5cafd9498Douglas Gregor 1325892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek for (ExplodedNodeSet::iterator I = dstBase.begin(), E = dstBase.end(); 1326892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek I != E; ++I) { 1327a8538d902fce9cfec20f39b34492268b51643819Ted Kremenek const GRState* state = GetState(*I); 1328892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek SVal baseExprVal = state->getSVal(baseExpr); 1329892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek if (isa<nonloc::LazyCompoundVal>(baseExprVal) || 1330c2e20d0c42cf085940c9a9cb495a7116d1b0eb07Argyrios Kyrtzidis isa<nonloc::CompoundVal>(baseExprVal) || 1331c2e20d0c42cf085940c9a9cb495a7116d1b0eb07Argyrios Kyrtzidis // FIXME: This can originate by conjuring a symbol for an unknown 1332c2e20d0c42cf085940c9a9cb495a7116d1b0eb07Argyrios Kyrtzidis // temporary struct object, see test/Analysis/fields.c: 1333c2e20d0c42cf085940c9a9cb495a7116d1b0eb07Argyrios Kyrtzidis // (p = getit()).x 1334c2e20d0c42cf085940c9a9cb495a7116d1b0eb07Argyrios Kyrtzidis isa<nonloc::SymbolVal>(baseExprVal)) { 1335892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek MakeNode(Dst, M, *I, state->BindExpr(M, UnknownVal())); 1336892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek continue; 1337892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek } 1338892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek 1339d9bc33efa195114d6f2a365c26e5b8dba4e1cc38Ted Kremenek // FIXME: Should we insert some assumption logic in here to determine 1340d9bc33efa195114d6f2a365c26e5b8dba4e1cc38Ted Kremenek // if "Base" is a valid piece of memory? Before we put this assumption 134186f194083504938df72135b5b66bf0c5cafd9498Douglas Gregor // later when using FieldOffset lvals (which we no longer have). 1342d9bc33efa195114d6f2a365c26e5b8dba4e1cc38Ted Kremenek 1343892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek // For all other cases, compute an lvalue. 1344892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek SVal L = state->getLValue(field, baseExprVal); 1345892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek if (M->isLValue()) 1346662174ca204cb520f634bdcb34a3708f45389d14Zhongxing Xu MakeNode(Dst, M, *I, state->BindExpr(M, L), ProgramPoint::PostLValueKind); 1347662174ca204cb520f634bdcb34a3708f45389d14Zhongxing Xu else 13489c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek evalLoad(Dst, M, *I, state, L); 1349469ecbded3616416ef938ed94a67f86149faf226Ted Kremenek } 1350469ecbded3616416ef938ed94a67f86149faf226Ted Kremenek} 1351469ecbded3616416ef938ed94a67f86149faf226Ted Kremenek 13529c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek/// evalBind - Handle the semantics of binding a value to a specific location. 13539c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek/// This method is used by evalStore and (soon) VisitDeclStmt, and others. 1354d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidisvoid ExprEngine::evalBind(ExplodedNodeSet& Dst, const Stmt* StoreE, 135579d73044b7d0adfbd18ee34285395e1d5135f662Ted Kremenek ExplodedNode* Pred, const GRState* state, 135679d73044b7d0adfbd18ee34285395e1d5135f662Ted Kremenek SVal location, SVal Val, bool atDeclInit) { 1357b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 1358b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 1359b107c4b7efb907d75620cd3c17f82fe27dc5b745Ted Kremenek // Do a previsit of the bind. 1360b107c4b7efb907d75620cd3c17f82fe27dc5b745Ted Kremenek ExplodedNodeSet CheckedSet, Src; 1361b107c4b7efb907d75620cd3c17f82fe27dc5b745Ted Kremenek Src.Add(Pred); 1362eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis getCheckerManager().runCheckersForBind(CheckedSet, Src, location, Val, StoreE, 1363eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis *this); 1364b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 1365b107c4b7efb907d75620cd3c17f82fe27dc5b745Ted Kremenek for (ExplodedNodeSet::iterator I = CheckedSet.begin(), E = CheckedSet.end(); 1366b107c4b7efb907d75620cd3c17f82fe27dc5b745Ted Kremenek I!=E; ++I) { 1367b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 1368b107c4b7efb907d75620cd3c17f82fe27dc5b745Ted Kremenek if (Pred != *I) 1369b107c4b7efb907d75620cd3c17f82fe27dc5b745Ted Kremenek state = GetState(*I); 1370b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 1371b107c4b7efb907d75620cd3c17f82fe27dc5b745Ted Kremenek const GRState* newState = 0; 1372a8538d902fce9cfec20f39b34492268b51643819Ted Kremenek 1373b107c4b7efb907d75620cd3c17f82fe27dc5b745Ted Kremenek if (atDeclInit) { 1374b107c4b7efb907d75620cd3c17f82fe27dc5b745Ted Kremenek const VarRegion *VR = 1375b107c4b7efb907d75620cd3c17f82fe27dc5b745Ted Kremenek cast<VarRegion>(cast<loc::MemRegionVal>(location).getRegion()); 1376f6f56d4fc8ebce17e7b83eb2c35f57a055c22283Ted Kremenek 1377b107c4b7efb907d75620cd3c17f82fe27dc5b745Ted Kremenek newState = state->bindDecl(VR, Val); 1378f6f56d4fc8ebce17e7b83eb2c35f57a055c22283Ted Kremenek } 1379f6f56d4fc8ebce17e7b83eb2c35f57a055c22283Ted Kremenek else { 1380b107c4b7efb907d75620cd3c17f82fe27dc5b745Ted Kremenek if (location.isUnknown()) { 1381b107c4b7efb907d75620cd3c17f82fe27dc5b745Ted Kremenek // We know that the new state will be the same as the old state since 1382b107c4b7efb907d75620cd3c17f82fe27dc5b745Ted Kremenek // the location of the binding is "unknown". Consequently, there 1383b107c4b7efb907d75620cd3c17f82fe27dc5b745Ted Kremenek // is no reason to just create a new node. 1384b107c4b7efb907d75620cd3c17f82fe27dc5b745Ted Kremenek newState = state; 1385b107c4b7efb907d75620cd3c17f82fe27dc5b745Ted Kremenek } 1386b107c4b7efb907d75620cd3c17f82fe27dc5b745Ted Kremenek else { 1387b107c4b7efb907d75620cd3c17f82fe27dc5b745Ted Kremenek // We are binding to a value other than 'unknown'. Perform the binding 1388b107c4b7efb907d75620cd3c17f82fe27dc5b745Ted Kremenek // using the StoreManager. 1389b107c4b7efb907d75620cd3c17f82fe27dc5b745Ted Kremenek newState = state->bindLoc(cast<Loc>(location), Val); 1390b107c4b7efb907d75620cd3c17f82fe27dc5b745Ted Kremenek } 1391f6f56d4fc8ebce17e7b83eb2c35f57a055c22283Ted Kremenek } 1392a8538d902fce9cfec20f39b34492268b51643819Ted Kremenek 1393d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidis // The next thing to do is check if the TransferFuncs object wants to 1394b107c4b7efb907d75620cd3c17f82fe27dc5b745Ted Kremenek // update the state based on the new binding. If the GRTransferFunc object 1395b107c4b7efb907d75620cd3c17f82fe27dc5b745Ted Kremenek // doesn't do anything, just auto-propagate the current state. 139679d73044b7d0adfbd18ee34285395e1d5135f662Ted Kremenek 139779d73044b7d0adfbd18ee34285395e1d5135f662Ted Kremenek // NOTE: We use 'AssignE' for the location of the PostStore if 'AssignE' 139879d73044b7d0adfbd18ee34285395e1d5135f662Ted Kremenek // is non-NULL. Checkers typically care about 139979d73044b7d0adfbd18ee34285395e1d5135f662Ted Kremenek 1400d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidis StmtNodeBuilderRef BuilderRef(Dst, *Builder, *this, *I, newState, StoreE, 140196ebad66c451d79c9f57b1edb31efaeeb23b9a01Ted Kremenek true); 14021eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 14039c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek getTF().evalBind(BuilderRef, location, Val); 1404b107c4b7efb907d75620cd3c17f82fe27dc5b745Ted Kremenek } 1405a8538d902fce9cfec20f39b34492268b51643819Ted Kremenek} 1406a8538d902fce9cfec20f39b34492268b51643819Ted Kremenek 14079c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek/// evalStore - Handle the semantics of a store via an assignment. 1408a8538d902fce9cfec20f39b34492268b51643819Ted Kremenek/// @param Dst The node set to store generated state nodes 1409e8a4d7d0064b357a30fe7ee4f2ddc02f9ffc0357Zhongxing Xu/// @param AssignE The assignment expression if the store happens in an 1410e8a4d7d0064b357a30fe7ee4f2ddc02f9ffc0357Zhongxing Xu/// assignment. 1411e8a4d7d0064b357a30fe7ee4f2ddc02f9ffc0357Zhongxing Xu/// @param LocatioinE The location expression that is stored to. 1412a8538d902fce9cfec20f39b34492268b51643819Ted Kremenek/// @param state The current simulation state 1413a8538d902fce9cfec20f39b34492268b51643819Ted Kremenek/// @param location The location to store the value 1414a8538d902fce9cfec20f39b34492268b51643819Ted Kremenek/// @param Val The value to be stored 1415d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidisvoid ExprEngine::evalStore(ExplodedNodeSet& Dst, const Expr *AssignE, 141679d73044b7d0adfbd18ee34285395e1d5135f662Ted Kremenek const Expr* LocationE, 141750ecd1536a2b70327e9eb2c2c2a652cde3dae365Ted Kremenek ExplodedNode* Pred, 14181670e403c48f3af4fceff3f6773a0e1cfc6c4eb3Ted Kremenek const GRState* state, SVal location, SVal Val, 14191670e403c48f3af4fceff3f6773a0e1cfc6c4eb3Ted Kremenek const void *tag) { 14201eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1421d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidis assert(Builder && "StmtNodeBuilder must be defined."); 14221eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 142314429b918bd2f4cb52abc75546a7fe37142054caArgyrios Kyrtzidis // Proceed with the store. We use AssignE as the anchor for the PostStore 142414429b918bd2f4cb52abc75546a7fe37142054caArgyrios Kyrtzidis // ProgramPoint if it is non-NULL, and LocationE otherwise. 142514429b918bd2f4cb52abc75546a7fe37142054caArgyrios Kyrtzidis const Expr *StoreE = AssignE ? AssignE : LocationE; 142614429b918bd2f4cb52abc75546a7fe37142054caArgyrios Kyrtzidis 142714429b918bd2f4cb52abc75546a7fe37142054caArgyrios Kyrtzidis if (isa<loc::ObjCPropRef>(location)) { 142814429b918bd2f4cb52abc75546a7fe37142054caArgyrios Kyrtzidis loc::ObjCPropRef prop = cast<loc::ObjCPropRef>(location); 142914429b918bd2f4cb52abc75546a7fe37142054caArgyrios Kyrtzidis ExplodedNodeSet src = Pred; 143014429b918bd2f4cb52abc75546a7fe37142054caArgyrios Kyrtzidis return VisitObjCMessage(ObjCPropertySetter(prop.getPropRefExpr(), 143114429b918bd2f4cb52abc75546a7fe37142054caArgyrios Kyrtzidis StoreE, Val), src, Dst); 143214429b918bd2f4cb52abc75546a7fe37142054caArgyrios Kyrtzidis } 143314429b918bd2f4cb52abc75546a7fe37142054caArgyrios Kyrtzidis 14341b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek // Evaluate the location (checks for bad dereferences). 1435b4b817d704287836b52b34369009e682f208aa2bTed Kremenek ExplodedNodeSet Tmp; 14369c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek evalLocation(Tmp, LocationE, Pred, state, location, tag, false); 14371eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1438b4b817d704287836b52b34369009e682f208aa2bTed Kremenek if (Tmp.empty()) 14391b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek return; 1440b0533965f1b4db020692e3b23ca7b3bc15bf5897Ted Kremenek 144173c498a08f4968b6987d1453c7b77929dcc6d5f7Argyrios Kyrtzidis if (location.isUndef()) 144273c498a08f4968b6987d1453c7b77929dcc6d5f7Argyrios Kyrtzidis return; 1443a8538d902fce9cfec20f39b34492268b51643819Ted Kremenek 1444b4b817d704287836b52b34369009e682f208aa2bTed Kremenek SaveAndRestore<ProgramPoint::Kind> OldSPointKind(Builder->PointKind, 1445b4b817d704287836b52b34369009e682f208aa2bTed Kremenek ProgramPoint::PostStoreKind); 1446b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 1447b4b817d704287836b52b34369009e682f208aa2bTed Kremenek for (ExplodedNodeSet::iterator NI=Tmp.begin(), NE=Tmp.end(); NI!=NE; ++NI) 14489c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek evalBind(Dst, StoreE, *NI, GetState(*NI), location, Val); 14491b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek} 14501b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek 1451d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidisvoid ExprEngine::evalLoad(ExplodedNodeSet& Dst, const Expr *Ex, 14523992a50eea030a2913f1d267554f55ecd00d694cZhongxing Xu ExplodedNode* Pred, 14531670e403c48f3af4fceff3f6773a0e1cfc6c4eb3Ted Kremenek const GRState* state, SVal location, 1454652be346f74feba027bcbdeb6a3e3f4755a0e62cZhongxing Xu const void *tag, QualType LoadTy) { 1455cca8ab155e8c20b98ba2d90eb2b1c228895e06fdZhanyong Wan assert(!isa<NonLoc>(location) && "location cannot be a NonLoc."); 14561b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek 145714429b918bd2f4cb52abc75546a7fe37142054caArgyrios Kyrtzidis if (isa<loc::ObjCPropRef>(location)) { 145814429b918bd2f4cb52abc75546a7fe37142054caArgyrios Kyrtzidis loc::ObjCPropRef prop = cast<loc::ObjCPropRef>(location); 145914429b918bd2f4cb52abc75546a7fe37142054caArgyrios Kyrtzidis ExplodedNodeSet src = Pred; 146014429b918bd2f4cb52abc75546a7fe37142054caArgyrios Kyrtzidis return VisitObjCMessage(ObjCPropertyGetter(prop.getPropRefExpr(), Ex), 146114429b918bd2f4cb52abc75546a7fe37142054caArgyrios Kyrtzidis src, Dst); 146214429b918bd2f4cb52abc75546a7fe37142054caArgyrios Kyrtzidis } 146314429b918bd2f4cb52abc75546a7fe37142054caArgyrios Kyrtzidis 1464852274d4257134906995cb252fb3dfd2d71deae8Ted Kremenek // Are we loading from a region? This actually results in two loads; one 1465852274d4257134906995cb252fb3dfd2d71deae8Ted Kremenek // to fetch the address of the referenced value and one to fetch the 1466852274d4257134906995cb252fb3dfd2d71deae8Ted Kremenek // referenced value. 1467b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek if (const TypedRegion *TR = 1468852274d4257134906995cb252fb3dfd2d71deae8Ted Kremenek dyn_cast_or_null<TypedRegion>(location.getAsRegion())) { 1469b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 1470018220c343c103b7dfaa117a7a474c7a7fd6d068Zhongxing Xu QualType ValTy = TR->getValueType(); 1471852274d4257134906995cb252fb3dfd2d71deae8Ted Kremenek if (const ReferenceType *RT = ValTy->getAs<ReferenceType>()) { 1472b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek static int loadReferenceTag = 0; 1473852274d4257134906995cb252fb3dfd2d71deae8Ted Kremenek ExplodedNodeSet Tmp; 14749c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek evalLoadCommon(Tmp, Ex, Pred, state, location, &loadReferenceTag, 1475852274d4257134906995cb252fb3dfd2d71deae8Ted Kremenek getContext().getPointerType(RT->getPointeeType())); 1476852274d4257134906995cb252fb3dfd2d71deae8Ted Kremenek 1477852274d4257134906995cb252fb3dfd2d71deae8Ted Kremenek // Perform the load from the referenced value. 1478852274d4257134906995cb252fb3dfd2d71deae8Ted Kremenek for (ExplodedNodeSet::iterator I=Tmp.begin(), E=Tmp.end() ; I!=E; ++I) { 1479852274d4257134906995cb252fb3dfd2d71deae8Ted Kremenek state = GetState(*I); 14801397663af9dbcc24dbf0e11de43931b3dc08fdbbTed Kremenek location = state->getSVal(Ex); 14819c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek evalLoadCommon(Dst, Ex, *I, state, location, tag, LoadTy); 1482b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek } 1483852274d4257134906995cb252fb3dfd2d71deae8Ted Kremenek return; 1484852274d4257134906995cb252fb3dfd2d71deae8Ted Kremenek } 1485852274d4257134906995cb252fb3dfd2d71deae8Ted Kremenek } 1486b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 14879c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek evalLoadCommon(Dst, Ex, Pred, state, location, tag, LoadTy); 1488852274d4257134906995cb252fb3dfd2d71deae8Ted Kremenek} 1489852274d4257134906995cb252fb3dfd2d71deae8Ted Kremenek 1490d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidisvoid ExprEngine::evalLoadCommon(ExplodedNodeSet& Dst, const Expr *Ex, 1491852274d4257134906995cb252fb3dfd2d71deae8Ted Kremenek ExplodedNode* Pred, 1492852274d4257134906995cb252fb3dfd2d71deae8Ted Kremenek const GRState* state, SVal location, 1493852274d4257134906995cb252fb3dfd2d71deae8Ted Kremenek const void *tag, QualType LoadTy) { 1494b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 14951eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump // Evaluate the location (checks for bad dereferences). 1496b4b817d704287836b52b34369009e682f208aa2bTed Kremenek ExplodedNodeSet Tmp; 14979c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek evalLocation(Tmp, Ex, Pred, state, location, tag, true); 14981eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1499b4b817d704287836b52b34369009e682f208aa2bTed Kremenek if (Tmp.empty()) 15001b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek return; 1501b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 150273c498a08f4968b6987d1453c7b77929dcc6d5f7Argyrios Kyrtzidis if (location.isUndef()) 150373c498a08f4968b6987d1453c7b77929dcc6d5f7Argyrios Kyrtzidis return; 1504b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 1505b4b817d704287836b52b34369009e682f208aa2bTed Kremenek SaveAndRestore<ProgramPoint::Kind> OldSPointKind(Builder->PointKind); 15061eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 15071b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek // Proceed with the load. 1508b4b817d704287836b52b34369009e682f208aa2bTed Kremenek for (ExplodedNodeSet::iterator NI=Tmp.begin(), NE=Tmp.end(); NI!=NE; ++NI) { 1509b4b817d704287836b52b34369009e682f208aa2bTed Kremenek state = GetState(*NI); 151096ebad66c451d79c9f57b1edb31efaeeb23b9a01Ted Kremenek 1511b4b817d704287836b52b34369009e682f208aa2bTed Kremenek if (location.isUnknown()) { 1512b4b817d704287836b52b34369009e682f208aa2bTed Kremenek // This is important. We must nuke the old binding. 1513b4b817d704287836b52b34369009e682f208aa2bTed Kremenek MakeNode(Dst, Ex, *NI, state->BindExpr(Ex, UnknownVal()), 1514b4b817d704287836b52b34369009e682f208aa2bTed Kremenek ProgramPoint::PostLoadKind, tag); 1515b4b817d704287836b52b34369009e682f208aa2bTed Kremenek } 1516b4b817d704287836b52b34369009e682f208aa2bTed Kremenek else { 151796ebad66c451d79c9f57b1edb31efaeeb23b9a01Ted Kremenek if (LoadTy.isNull()) 151896ebad66c451d79c9f57b1edb31efaeeb23b9a01Ted Kremenek LoadTy = Ex->getType(); 151996ebad66c451d79c9f57b1edb31efaeeb23b9a01Ted Kremenek SVal V = state->getSVal(cast<Loc>(location), LoadTy); 152096ebad66c451d79c9f57b1edb31efaeeb23b9a01Ted Kremenek MakeNode(Dst, Ex, *NI, state->bindExprAndLocation(Ex, location, V), 152196ebad66c451d79c9f57b1edb31efaeeb23b9a01Ted Kremenek ProgramPoint::PostLoadKind, tag); 1522b4b817d704287836b52b34369009e682f208aa2bTed Kremenek } 1523d5b499d43c3526fae7f9ebb6e2d50e79d3496cedZhongxing Xu } 15241b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek} 15251b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek 1526d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidisvoid ExprEngine::evalLocation(ExplodedNodeSet &Dst, const Stmt *S, 1527b4b817d704287836b52b34369009e682f208aa2bTed Kremenek ExplodedNode* Pred, 1528b4b817d704287836b52b34369009e682f208aa2bTed Kremenek const GRState* state, SVal location, 1529b4b817d704287836b52b34369009e682f208aa2bTed Kremenek const void *tag, bool isLoad) { 153000b1ad2d56f3e39f95c3f61bf511a531ab6a4fa5Zhongxing Xu // Early checks for performance reason. 1531769ce3e93ad35bd9ac28e4d8b8f035ae4fd9a5b5Argyrios Kyrtzidis if (location.isUnknown()) { 1532b4b817d704287836b52b34369009e682f208aa2bTed Kremenek Dst.Add(Pred); 1533b4b817d704287836b52b34369009e682f208aa2bTed Kremenek return; 1534b4b817d704287836b52b34369009e682f208aa2bTed Kremenek } 1535b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 15369c0d6891b3ec4b0d20b8a295946c0dc5426d147cArgyrios Kyrtzidis ExplodedNodeSet Src; 1537eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis if (Builder->GetState(Pred) == state) { 1538eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis Src.Add(Pred); 1539eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis } else { 1540eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis // Associate this new state with an ExplodedNode. 1541eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis // FIXME: If I pass null tag, the graph is incorrect, e.g for 1542eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis // int *p; 1543eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis // p = 0; 1544eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis // *p = 0xDEADBEEF; 1545eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis // "p = 0" is not noted as "Null pointer value stored to 'p'" but 1546eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis // instead "int *p" is noted as 1547eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis // "Variable 'p' initialized to a null pointer value" 1548eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis ExplodedNode *N = Builder->generateNode(S, state, Pred, this); 1549eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis Src.Add(N ? N : Pred); 15500296c22557b3735e2ffeff690eb46fb0e9152bccTed Kremenek } 1551eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis getCheckerManager().runCheckersForLocation(Dst, Src, location, isLoad, S, 1552eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis *this); 1553ec96a2d52d16e150baaf629cd35e3fabff5d8915Ted Kremenek} 1554ec96a2d52d16e150baaf629cd35e3fabff5d8915Ted Kremenek 1555d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidisbool ExprEngine::InlineCall(ExplodedNodeSet &Dst, const CallExpr *CE, 15561c625f25055331bf76ab5479a8060d2b0f61e8b8Zhongxing Xu ExplodedNode *Pred) { 15571c625f25055331bf76ab5479a8060d2b0f61e8b8Zhongxing Xu const GRState *state = GetState(Pred); 15581c625f25055331bf76ab5479a8060d2b0f61e8b8Zhongxing Xu const Expr *Callee = CE->getCallee(); 15591c625f25055331bf76ab5479a8060d2b0f61e8b8Zhongxing Xu SVal L = state->getSVal(Callee); 15601c625f25055331bf76ab5479a8060d2b0f61e8b8Zhongxing Xu 15611c625f25055331bf76ab5479a8060d2b0f61e8b8Zhongxing Xu const FunctionDecl *FD = L.getAsFunctionDecl(); 15621c625f25055331bf76ab5479a8060d2b0f61e8b8Zhongxing Xu if (!FD) 15631c625f25055331bf76ab5479a8060d2b0f61e8b8Zhongxing Xu return false; 15641c625f25055331bf76ab5479a8060d2b0f61e8b8Zhongxing Xu 1565c6238d2786cfd961b94580b3d3675a1b3ff0721cZhongxing Xu // Check if the function definition is in the same translation unit. 1566c6238d2786cfd961b94580b3d3675a1b3ff0721cZhongxing Xu if (FD->hasBody(FD)) { 156719b78d9e3dbbc27bbcbdd8c3017a00fe88849ecdZhongxing Xu const StackFrameContext *stackFrame = 156819b78d9e3dbbc27bbcbdd8c3017a00fe88849ecdZhongxing Xu AMgr.getStackFrame(AMgr.getAnalysisContext(FD), 156919b78d9e3dbbc27bbcbdd8c3017a00fe88849ecdZhongxing Xu Pred->getLocationContext(), 1570892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek CE, Builder->getBlock(), Builder->getIndex()); 1571c6238d2786cfd961b94580b3d3675a1b3ff0721cZhongxing Xu // Now we have the definition of the callee, create a CallEnter node. 157219b78d9e3dbbc27bbcbdd8c3017a00fe88849ecdZhongxing Xu CallEnter Loc(CE, stackFrame, Pred->getLocationContext()); 1573c6238d2786cfd961b94580b3d3675a1b3ff0721cZhongxing Xu 1574c6238d2786cfd961b94580b3d3675a1b3ff0721cZhongxing Xu ExplodedNode *N = Builder->generateNode(Loc, state, Pred); 1575c6238d2786cfd961b94580b3d3675a1b3ff0721cZhongxing Xu Dst.Add(N); 1576c6238d2786cfd961b94580b3d3675a1b3ff0721cZhongxing Xu return true; 1577c6238d2786cfd961b94580b3d3675a1b3ff0721cZhongxing Xu } 15781c625f25055331bf76ab5479a8060d2b0f61e8b8Zhongxing Xu 1579c6238d2786cfd961b94580b3d3675a1b3ff0721cZhongxing Xu // Check if we can find the function definition in other translation units. 1580c6238d2786cfd961b94580b3d3675a1b3ff0721cZhongxing Xu if (AMgr.hasIndexer()) { 158119b78d9e3dbbc27bbcbdd8c3017a00fe88849ecdZhongxing Xu AnalysisContext *C = AMgr.getAnalysisContextInAnotherTU(FD); 1582c6238d2786cfd961b94580b3d3675a1b3ff0721cZhongxing Xu if (C == 0) 1583c6238d2786cfd961b94580b3d3675a1b3ff0721cZhongxing Xu return false; 158419b78d9e3dbbc27bbcbdd8c3017a00fe88849ecdZhongxing Xu const StackFrameContext *stackFrame = 158519b78d9e3dbbc27bbcbdd8c3017a00fe88849ecdZhongxing Xu AMgr.getStackFrame(C, Pred->getLocationContext(), 1586892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek CE, Builder->getBlock(), Builder->getIndex()); 158719b78d9e3dbbc27bbcbdd8c3017a00fe88849ecdZhongxing Xu CallEnter Loc(CE, stackFrame, Pred->getLocationContext()); 1588c6238d2786cfd961b94580b3d3675a1b3ff0721cZhongxing Xu ExplodedNode *N = Builder->generateNode(Loc, state, Pred); 15891c625f25055331bf76ab5479a8060d2b0f61e8b8Zhongxing Xu Dst.Add(N); 1590c6238d2786cfd961b94580b3d3675a1b3ff0721cZhongxing Xu return true; 1591c6238d2786cfd961b94580b3d3675a1b3ff0721cZhongxing Xu } 1592c6238d2786cfd961b94580b3d3675a1b3ff0721cZhongxing Xu 1593c6238d2786cfd961b94580b3d3675a1b3ff0721cZhongxing Xu return false; 15941c625f25055331bf76ab5479a8060d2b0f61e8b8Zhongxing Xu} 15951c625f25055331bf76ab5479a8060d2b0f61e8b8Zhongxing Xu 1596d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidisvoid ExprEngine::VisitCall(const CallExpr* CE, ExplodedNode* Pred, 159703509aea098772644bf4662dc1c88634818ceeccZhongxing Xu CallExpr::const_arg_iterator AI, 159803509aea098772644bf4662dc1c88634818ceeccZhongxing Xu CallExpr::const_arg_iterator AE, 1599892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek ExplodedNodeSet& Dst) { 16003cead901aab394fe8e84953235959ece8002854fTed Kremenek 16019d293dfc0ad7c44ae0b5eb9517f1ed8c8d8b7ff7Douglas Gregor // Determine the type of function we're calling (if available). 160272564e73277e29f6db3305d1f27ba408abb7ed88Douglas Gregor const FunctionProtoType *Proto = NULL; 16039d293dfc0ad7c44ae0b5eb9517f1ed8c8d8b7ff7Douglas Gregor QualType FnType = CE->getCallee()->IgnoreParens()->getType(); 16046217b80b7a1379b74cced1c076338262c3c980b3Ted Kremenek if (const PointerType *FnTypePtr = FnType->getAs<PointerType>()) 1605183700f494ec9b6701b6efe82bcb25f4c79ba561John McCall Proto = FnTypePtr->getPointeeType()->getAs<FunctionProtoType>(); 16069d293dfc0ad7c44ae0b5eb9517f1ed8c8d8b7ff7Douglas Gregor 1607c69c43845aa3ede95af837b8be52868eca55d64dTed Kremenek // Evaluate the arguments. 16083cead901aab394fe8e84953235959ece8002854fTed Kremenek ExplodedNodeSet ArgsEvaluated; 16099c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek evalArguments(CE->arg_begin(), CE->arg_end(), Proto, Pred, ArgsEvaluated); 1610de43424560f1a744de6214dab6bbee28ad8437f5Ted Kremenek 16117f14e6f23b0899ed0969cbebef7785f00d488372Ted Kremenek // Now process the call itself. 1612031ccc0555a82afc2e8afe29e19dd57ff204e2deZhongxing Xu ExplodedNodeSet DstTmp; 161303509aea098772644bf4662dc1c88634818ceeccZhongxing Xu const Expr* Callee = CE->getCallee()->IgnoreParens(); 1614b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 16153cead901aab394fe8e84953235959ece8002854fTed Kremenek for (ExplodedNodeSet::iterator NI=ArgsEvaluated.begin(), 16167f14e6f23b0899ed0969cbebef7785f00d488372Ted Kremenek NE=ArgsEvaluated.end(); NI != NE; ++NI) { 16177f14e6f23b0899ed0969cbebef7785f00d488372Ted Kremenek // Evaluate the callee. 1618031ccc0555a82afc2e8afe29e19dd57ff204e2deZhongxing Xu ExplodedNodeSet DstTmp2; 1619b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek Visit(Callee, *NI, DstTmp2); 16205a5d98bc6962dc2d1aaa5e0e522f1bf84273b9c1Ted Kremenek // Perform the previsit of the CallExpr, storing the results in DstTmp. 1621eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis getCheckerManager().runCheckersForPreStmt(DstTmp, DstTmp2, CE, *this); 16225a5d98bc6962dc2d1aaa5e0e522f1bf84273b9c1Ted Kremenek } 1623b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 1624eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis class DefaultEval : public GraphExpander { 1625eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis ExprEngine &Eng; 1626eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis const CallExpr *CE; 1627eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis public: 1628eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis bool Inlined; 1629eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis 1630eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis DefaultEval(ExprEngine &eng, const CallExpr *ce) 1631eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis : Eng(eng), CE(ce), Inlined(false) { } 1632eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis virtual void expandGraph(ExplodedNodeSet &Dst, ExplodedNode *Pred) { 1633eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis if (Eng.getAnalysisManager().shouldInlineCall() && 1634eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis Eng.InlineCall(Dst, CE, Pred)) { 1635eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis Inlined = true; 1636eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis } else { 1637eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis StmtNodeBuilder &Builder = Eng.getBuilder(); 1638eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis assert(&Builder && "StmtNodeBuilder must be defined."); 1639b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 16403cead901aab394fe8e84953235959ece8002854fTed Kremenek // Dispatch to the plug-in transfer function. 1641eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis unsigned oldSize = Dst.size(); 1642eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis SaveOr OldHasGen(Builder.hasGeneratedNode); 1643b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 164417f4da8f150f6b9dfb571cebd6299b06948e5385Ted Kremenek // Dispatch to transfer function logic to handle the call itself. 1645eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis const Expr* Callee = CE->getCallee()->IgnoreParens(); 1646eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis const GRState* state = Eng.GetState(Pred); 1647eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis SVal L = state->getSVal(Callee); 1648eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis Eng.getTF().evalCall(Dst, Eng, Builder, CE, L, Pred); 1649b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 165017f4da8f150f6b9dfb571cebd6299b06948e5385Ted Kremenek // Handle the case where no nodes where generated. Auto-generate that 165117f4da8f150f6b9dfb571cebd6299b06948e5385Ted Kremenek // contains the updated state if we aren't generating sinks. 1652eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis if (!Builder.BuildSinks && Dst.size() == oldSize && 1653eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis !Builder.hasGeneratedNode) 1654eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis Eng.MakeNode(Dst, CE, Pred, state); 165517f4da8f150f6b9dfb571cebd6299b06948e5385Ted Kremenek } 1656935ef90f4b065c7c865ee5b2a99c5f9b1a115d72Zhongxing Xu } 1657eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis }; 1658eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis 1659eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis // Finally, evaluate the function call. We try each of the checkers 1660eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis // to see if the can evaluate the function call. 1661eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis ExplodedNodeSet DstTmp3; 1662eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis DefaultEval defEval(*this, CE); 1663eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis 1664eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis getCheckerManager().runCheckersForEvalCall(DstTmp3, DstTmp, CE, 1665eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis *this, &defEval); 1666eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis 1667eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis // Callee is inlined. We shouldn't do post call checking. 1668eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis if (defEval.Inlined) 1669eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis return; 1670b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 16713cead901aab394fe8e84953235959ece8002854fTed Kremenek // Finally, perform the post-condition check of the CallExpr and store 16723cead901aab394fe8e84953235959ece8002854fTed Kremenek // the created nodes in 'Dst'. 1673eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis getCheckerManager().runCheckersForPostStmt(Dst, DstTmp3, CE, *this); 1674e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek} 1675e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek 1676e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek//===----------------------------------------------------------------------===// 167714429b918bd2f4cb52abc75546a7fe37142054caArgyrios Kyrtzidis// Transfer function: Objective-C dot-syntax to access a property. 167814429b918bd2f4cb52abc75546a7fe37142054caArgyrios Kyrtzidis//===----------------------------------------------------------------------===// 167914429b918bd2f4cb52abc75546a7fe37142054caArgyrios Kyrtzidis 168014429b918bd2f4cb52abc75546a7fe37142054caArgyrios Kyrtzidisvoid ExprEngine::VisitObjCPropertyRefExpr(const ObjCPropertyRefExpr *Ex, 168114429b918bd2f4cb52abc75546a7fe37142054caArgyrios Kyrtzidis ExplodedNode *Pred, 168214429b918bd2f4cb52abc75546a7fe37142054caArgyrios Kyrtzidis ExplodedNodeSet &Dst) { 168314429b918bd2f4cb52abc75546a7fe37142054caArgyrios Kyrtzidis ExplodedNodeSet dstBase; 16849319b56154cfd9e3c781e54d2ee1c10c5858efedArgyrios Kyrtzidis 16859319b56154cfd9e3c781e54d2ee1c10c5858efedArgyrios Kyrtzidis // Visit the receiver (if any). 16869319b56154cfd9e3c781e54d2ee1c10c5858efedArgyrios Kyrtzidis if (Ex->isObjectReceiver()) 16879319b56154cfd9e3c781e54d2ee1c10c5858efedArgyrios Kyrtzidis Visit(Ex->getBase(), Pred, dstBase); 16889319b56154cfd9e3c781e54d2ee1c10c5858efedArgyrios Kyrtzidis else 16899319b56154cfd9e3c781e54d2ee1c10c5858efedArgyrios Kyrtzidis dstBase = Pred; 169014429b918bd2f4cb52abc75546a7fe37142054caArgyrios Kyrtzidis 169114429b918bd2f4cb52abc75546a7fe37142054caArgyrios Kyrtzidis ExplodedNodeSet dstPropRef; 169214429b918bd2f4cb52abc75546a7fe37142054caArgyrios Kyrtzidis 169314429b918bd2f4cb52abc75546a7fe37142054caArgyrios Kyrtzidis // Using the base, compute the lvalue of the instance variable. 169414429b918bd2f4cb52abc75546a7fe37142054caArgyrios Kyrtzidis for (ExplodedNodeSet::iterator I = dstBase.begin(), E = dstBase.end(); 169514429b918bd2f4cb52abc75546a7fe37142054caArgyrios Kyrtzidis I!=E; ++I) { 169614429b918bd2f4cb52abc75546a7fe37142054caArgyrios Kyrtzidis ExplodedNode *nodeBase = *I; 169714429b918bd2f4cb52abc75546a7fe37142054caArgyrios Kyrtzidis const GRState *state = GetState(nodeBase); 169814429b918bd2f4cb52abc75546a7fe37142054caArgyrios Kyrtzidis MakeNode(dstPropRef, Ex, *I, state->BindExpr(Ex, loc::ObjCPropRef(Ex))); 169914429b918bd2f4cb52abc75546a7fe37142054caArgyrios Kyrtzidis } 170014429b918bd2f4cb52abc75546a7fe37142054caArgyrios Kyrtzidis 170114429b918bd2f4cb52abc75546a7fe37142054caArgyrios Kyrtzidis Dst.insert(dstPropRef); 170214429b918bd2f4cb52abc75546a7fe37142054caArgyrios Kyrtzidis} 170314429b918bd2f4cb52abc75546a7fe37142054caArgyrios Kyrtzidis 170414429b918bd2f4cb52abc75546a7fe37142054caArgyrios Kyrtzidis//===----------------------------------------------------------------------===// 170597ed4f68f5dba3e21e7a490ef0f9ffd3bfead7f8Ted Kremenek// Transfer function: Objective-C ivar references. 170697ed4f68f5dba3e21e7a490ef0f9ffd3bfead7f8Ted Kremenek//===----------------------------------------------------------------------===// 170748af2a9c1ed3259512f2d1431720add1fbe8fb5fTed Kremenek 1708f5cae63463cdb325a0bed146595607cba6da1ebcTed Kremenekstatic std::pair<const void*,const void*> EagerlyAssumeTag 1709a5fdd9ce694b1c2dbfd225cb6f55ef743d1ab562Douglas Gregor = std::pair<const void*,const void*>(&EagerlyAssumeTag,static_cast<void*>(0)); 1710f5cae63463cdb325a0bed146595607cba6da1ebcTed Kremenek 1711d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidisvoid ExprEngine::evalEagerlyAssume(ExplodedNodeSet &Dst, ExplodedNodeSet &Src, 171203509aea098772644bf4662dc1c88634818ceeccZhongxing Xu const Expr *Ex) { 1713031ccc0555a82afc2e8afe29e19dd57ff204e2deZhongxing Xu for (ExplodedNodeSet::iterator I=Src.begin(), E=Src.end(); I!=E; ++I) { 1714031ccc0555a82afc2e8afe29e19dd57ff204e2deZhongxing Xu ExplodedNode *Pred = *I; 17151eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1716b293902c5cfa18365ffb0e00763849c9808a2ad1Ted Kremenek // Test if the previous node was as the same expression. This can happen 1717b293902c5cfa18365ffb0e00763849c9808a2ad1Ted Kremenek // when the expression fails to evaluate to anything meaningful and 1718b293902c5cfa18365ffb0e00763849c9808a2ad1Ted Kremenek // (as an optimization) we don't generate a node. 17191eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump ProgramPoint P = Pred->getLocation(); 1720b293902c5cfa18365ffb0e00763849c9808a2ad1Ted Kremenek if (!isa<PostStmt>(P) || cast<PostStmt>(P).getStmt() != Ex) { 17211eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump Dst.Add(Pred); 1722b293902c5cfa18365ffb0e00763849c9808a2ad1Ted Kremenek continue; 17231eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump } 1724b293902c5cfa18365ffb0e00763849c9808a2ad1Ted Kremenek 172559fea60cc3dde7a14eeafab9469cb911023fdd7fZhongxing Xu const GRState* state = GetState(Pred); 17261397663af9dbcc24dbf0e11de43931b3dc08fdbbTed Kremenek SVal V = state->getSVal(Ex); 17275b9bd2137ebef350af803c634e3fdf5d74678100Ted Kremenek if (nonloc::SymExprVal *SEV = dyn_cast<nonloc::SymExprVal>(&V)) { 172848af2a9c1ed3259512f2d1431720add1fbe8fb5fTed Kremenek // First assume that the condition is true. 172928f47b92e760ccf641ac91cb0fe1c12d9ca89795Ted Kremenek if (const GRState *stateTrue = state->assume(*SEV, true)) { 17301eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump stateTrue = stateTrue->BindExpr(Ex, 1731c8413fd03f73084a5c93028f8b4db619fc388087Ted Kremenek svalBuilder.makeIntVal(1U, Ex->getType())); 17321eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump Dst.Add(Builder->generateNode(PostStmtCustom(Ex, 173325e695b2d574d919cc1bbddf3a2efe073d449b1cZhongxing Xu &EagerlyAssumeTag, Pred->getLocationContext()), 173448af2a9c1ed3259512f2d1431720add1fbe8fb5fTed Kremenek stateTrue, Pred)); 173548af2a9c1ed3259512f2d1431720add1fbe8fb5fTed Kremenek } 17361eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 173748af2a9c1ed3259512f2d1431720add1fbe8fb5fTed Kremenek // Next, assume that the condition is false. 173828f47b92e760ccf641ac91cb0fe1c12d9ca89795Ted Kremenek if (const GRState *stateFalse = state->assume(*SEV, false)) { 17391eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump stateFalse = stateFalse->BindExpr(Ex, 1740c8413fd03f73084a5c93028f8b4db619fc388087Ted Kremenek svalBuilder.makeIntVal(0U, Ex->getType())); 174125e695b2d574d919cc1bbddf3a2efe073d449b1cZhongxing Xu Dst.Add(Builder->generateNode(PostStmtCustom(Ex, &EagerlyAssumeTag, 174225e695b2d574d919cc1bbddf3a2efe073d449b1cZhongxing Xu Pred->getLocationContext()), 174348af2a9c1ed3259512f2d1431720add1fbe8fb5fTed Kremenek stateFalse, Pred)); 174448af2a9c1ed3259512f2d1431720add1fbe8fb5fTed Kremenek } 174548af2a9c1ed3259512f2d1431720add1fbe8fb5fTed Kremenek } 174648af2a9c1ed3259512f2d1431720add1fbe8fb5fTed Kremenek else 174748af2a9c1ed3259512f2d1431720add1fbe8fb5fTed Kremenek Dst.Add(Pred); 174848af2a9c1ed3259512f2d1431720add1fbe8fb5fTed Kremenek } 174948af2a9c1ed3259512f2d1431720add1fbe8fb5fTed Kremenek} 175048af2a9c1ed3259512f2d1431720add1fbe8fb5fTed Kremenek 175148af2a9c1ed3259512f2d1431720add1fbe8fb5fTed Kremenek//===----------------------------------------------------------------------===// 17524beaa9f51b2da57c64740cef2bd1c2fdb0c325d5Ted Kremenek// Transfer function: Objective-C @synchronized. 17534beaa9f51b2da57c64740cef2bd1c2fdb0c325d5Ted Kremenek//===----------------------------------------------------------------------===// 17544beaa9f51b2da57c64740cef2bd1c2fdb0c325d5Ted Kremenek 1755d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidisvoid ExprEngine::VisitObjCAtSynchronizedStmt(const ObjCAtSynchronizedStmt *S, 17564beaa9f51b2da57c64740cef2bd1c2fdb0c325d5Ted Kremenek ExplodedNode *Pred, 17574beaa9f51b2da57c64740cef2bd1c2fdb0c325d5Ted Kremenek ExplodedNodeSet &Dst) { 17584beaa9f51b2da57c64740cef2bd1c2fdb0c325d5Ted Kremenek 17594beaa9f51b2da57c64740cef2bd1c2fdb0c325d5Ted Kremenek // The mutex expression is a CFGElement, so we don't need to explicitly 17604beaa9f51b2da57c64740cef2bd1c2fdb0c325d5Ted Kremenek // visit it since it will already be processed. 17614beaa9f51b2da57c64740cef2bd1c2fdb0c325d5Ted Kremenek 17624beaa9f51b2da57c64740cef2bd1c2fdb0c325d5Ted Kremenek // Pre-visit the ObjCAtSynchronizedStmt. 17634beaa9f51b2da57c64740cef2bd1c2fdb0c325d5Ted Kremenek ExplodedNodeSet Tmp; 17644beaa9f51b2da57c64740cef2bd1c2fdb0c325d5Ted Kremenek Tmp.Add(Pred); 1765eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis getCheckerManager().runCheckersForPreStmt(Dst, Tmp, S, *this); 17664beaa9f51b2da57c64740cef2bd1c2fdb0c325d5Ted Kremenek} 17674beaa9f51b2da57c64740cef2bd1c2fdb0c325d5Ted Kremenek 17684beaa9f51b2da57c64740cef2bd1c2fdb0c325d5Ted Kremenek//===----------------------------------------------------------------------===// 176948af2a9c1ed3259512f2d1431720add1fbe8fb5fTed Kremenek// Transfer function: Objective-C ivar references. 177048af2a9c1ed3259512f2d1431720add1fbe8fb5fTed Kremenek//===----------------------------------------------------------------------===// 177197ed4f68f5dba3e21e7a490ef0f9ffd3bfead7f8Ted Kremenek 1772d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidisvoid ExprEngine::VisitLvalObjCIvarRefExpr(const ObjCIvarRefExpr* Ex, 1773d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidis ExplodedNode* Pred, 1774d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidis ExplodedNodeSet& Dst) { 17751eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1776892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek // Visit the base expression, which is needed for computing the lvalue 1777892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek // of the ivar. 1778892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek ExplodedNodeSet dstBase; 1779892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek const Expr *baseExpr = Ex->getBase(); 1780892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek Visit(baseExpr, Pred, dstBase); 17811eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 17826547884b9c20096594bdc652669df82c322c5eb6Argyrios Kyrtzidis ExplodedNodeSet dstIvar; 17836547884b9c20096594bdc652669df82c322c5eb6Argyrios Kyrtzidis 1784892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek // Using the base, compute the lvalue of the instance variable. 1785892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek for (ExplodedNodeSet::iterator I = dstBase.begin(), E = dstBase.end(); 1786892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek I!=E; ++I) { 1787892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek ExplodedNode *nodeBase = *I; 1788892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek const GRState *state = GetState(nodeBase); 1789892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek SVal baseVal = state->getSVal(baseExpr); 1790892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek SVal location = state->getLValue(Ex->getDecl(), baseVal); 17916547884b9c20096594bdc652669df82c322c5eb6Argyrios Kyrtzidis MakeNode(dstIvar, Ex, *I, state->BindExpr(Ex, location)); 179297ed4f68f5dba3e21e7a490ef0f9ffd3bfead7f8Ted Kremenek } 17936547884b9c20096594bdc652669df82c322c5eb6Argyrios Kyrtzidis 17946547884b9c20096594bdc652669df82c322c5eb6Argyrios Kyrtzidis // Perform the post-condition check of the ObjCIvarRefExpr and store 17956547884b9c20096594bdc652669df82c322c5eb6Argyrios Kyrtzidis // the created nodes in 'Dst'. 1796eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis getCheckerManager().runCheckersForPostStmt(Dst, dstIvar, Ex, *this); 179797ed4f68f5dba3e21e7a490ef0f9ffd3bfead7f8Ted Kremenek} 179897ed4f68f5dba3e21e7a490ef0f9ffd3bfead7f8Ted Kremenek 179997ed4f68f5dba3e21e7a490ef0f9ffd3bfead7f8Ted Kremenek//===----------------------------------------------------------------------===// 1800af3374187c47acea45706eab6744be6b1c66a856Ted Kremenek// Transfer function: Objective-C fast enumeration 'for' statements. 1801af3374187c47acea45706eab6744be6b1c66a856Ted Kremenek//===----------------------------------------------------------------------===// 1802af3374187c47acea45706eab6744be6b1c66a856Ted Kremenek 1803d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidisvoid ExprEngine::VisitObjCForCollectionStmt(const ObjCForCollectionStmt* S, 1804b317f8f5ca8737a5bbad97a3f7566a2dbd2ed61bZhongxing Xu ExplodedNode* Pred, ExplodedNodeSet& Dst) { 18051eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1806af3374187c47acea45706eab6744be6b1c66a856Ted Kremenek // ObjCForCollectionStmts are processed in two places. This method 1807af3374187c47acea45706eab6744be6b1c66a856Ted Kremenek // handles the case where an ObjCForCollectionStmt* occurs as one of the 1808af3374187c47acea45706eab6744be6b1c66a856Ted Kremenek // statements within a basic block. This transfer function does two things: 1809af3374187c47acea45706eab6744be6b1c66a856Ted Kremenek // 1810af3374187c47acea45706eab6744be6b1c66a856Ted Kremenek // (1) binds the next container value to 'element'. This creates a new 1811af3374187c47acea45706eab6744be6b1c66a856Ted Kremenek // node in the ExplodedGraph. 1812af3374187c47acea45706eab6744be6b1c66a856Ted Kremenek // 1813af3374187c47acea45706eab6744be6b1c66a856Ted Kremenek // (2) binds the value 0/1 to the ObjCForCollectionStmt* itself, indicating 1814af3374187c47acea45706eab6744be6b1c66a856Ted Kremenek // whether or not the container has any more elements. This value 1815af3374187c47acea45706eab6744be6b1c66a856Ted Kremenek // will be tested in ProcessBranch. We need to explicitly bind 1816af3374187c47acea45706eab6744be6b1c66a856Ted Kremenek // this value because a container can contain nil elements. 18171eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump // 1818af3374187c47acea45706eab6744be6b1c66a856Ted Kremenek // FIXME: Eventually this logic should actually do dispatches to 1819af3374187c47acea45706eab6744be6b1c66a856Ted Kremenek // 'countByEnumeratingWithState:objects:count:' (NSFastEnumeration). 1820af3374187c47acea45706eab6744be6b1c66a856Ted Kremenek // This will require simulating a temporary NSFastEnumerationState, either 1821af3374187c47acea45706eab6744be6b1c66a856Ted Kremenek // through an SVal or through the use of MemRegions. This value can 1822af3374187c47acea45706eab6744be6b1c66a856Ted Kremenek // be affixed to the ObjCForCollectionStmt* instead of 0/1; when the loop 1823af3374187c47acea45706eab6744be6b1c66a856Ted Kremenek // terminates we reclaim the temporary (it goes out of scope) and we 1824af3374187c47acea45706eab6744be6b1c66a856Ted Kremenek // we can test if the SVal is 0 or if the MemRegion is null (depending 1825af3374187c47acea45706eab6744be6b1c66a856Ted Kremenek // on what approach we take). 1826af3374187c47acea45706eab6744be6b1c66a856Ted Kremenek // 1827af3374187c47acea45706eab6744be6b1c66a856Ted Kremenek // For now: simulate (1) by assigning either a symbol or nil if the 1828af3374187c47acea45706eab6744be6b1c66a856Ted Kremenek // container is empty. Thus this transfer function will by default 1829af3374187c47acea45706eab6744be6b1c66a856Ted Kremenek // result in state splitting. 18301eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 183103509aea098772644bf4662dc1c88634818ceeccZhongxing Xu const Stmt* elem = S->getElement(); 183206fb99fb403bff1651429923f666a2ebe2b1522fTed Kremenek SVal ElementV; 18331eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 183403509aea098772644bf4662dc1c88634818ceeccZhongxing Xu if (const DeclStmt* DS = dyn_cast<DeclStmt>(elem)) { 183503509aea098772644bf4662dc1c88634818ceeccZhongxing Xu const VarDecl* ElemD = cast<VarDecl>(DS->getSingleDecl()); 1836af3374187c47acea45706eab6744be6b1c66a856Ted Kremenek assert (ElemD->getInit() == 0); 1837d17da2b99f323fa91b01e1dd119cc32e0ee8197dTed Kremenek ElementV = GetState(Pred)->getLValue(ElemD, Pred->getLocationContext()); 183806fb99fb403bff1651429923f666a2ebe2b1522fTed Kremenek VisitObjCForCollectionStmtAux(S, Pred, Dst, ElementV); 183906fb99fb403bff1651429923f666a2ebe2b1522fTed Kremenek return; 1840af3374187c47acea45706eab6744be6b1c66a856Ted Kremenek } 184106fb99fb403bff1651429923f666a2ebe2b1522fTed Kremenek 1842031ccc0555a82afc2e8afe29e19dd57ff204e2deZhongxing Xu ExplodedNodeSet Tmp; 1843892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek Visit(cast<Expr>(elem), Pred, Tmp); 1844031ccc0555a82afc2e8afe29e19dd57ff204e2deZhongxing Xu for (ExplodedNodeSet::iterator I = Tmp.begin(), E = Tmp.end(); I!=E; ++I) { 184506fb99fb403bff1651429923f666a2ebe2b1522fTed Kremenek const GRState* state = GetState(*I); 18461397663af9dbcc24dbf0e11de43931b3dc08fdbbTed Kremenek VisitObjCForCollectionStmtAux(S, *I, Dst, state->getSVal(elem)); 184706fb99fb403bff1651429923f666a2ebe2b1522fTed Kremenek } 184806fb99fb403bff1651429923f666a2ebe2b1522fTed Kremenek} 184906fb99fb403bff1651429923f666a2ebe2b1522fTed Kremenek 1850d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidisvoid ExprEngine::VisitObjCForCollectionStmtAux(const ObjCForCollectionStmt* S, 1851b317f8f5ca8737a5bbad97a3f7566a2dbd2ed61bZhongxing Xu ExplodedNode* Pred, ExplodedNodeSet& Dst, 185206fb99fb403bff1651429923f666a2ebe2b1522fTed Kremenek SVal ElementV) { 185306fb99fb403bff1651429923f666a2ebe2b1522fTed Kremenek 1854b4b817d704287836b52b34369009e682f208aa2bTed Kremenek // Check if the location we are writing back to is a null pointer. 185503509aea098772644bf4662dc1c88634818ceeccZhongxing Xu const Stmt* elem = S->getElement(); 1856b4b817d704287836b52b34369009e682f208aa2bTed Kremenek ExplodedNodeSet Tmp; 18579c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek evalLocation(Tmp, elem, Pred, GetState(Pred), ElementV, NULL, false); 1858b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 1859b4b817d704287836b52b34369009e682f208aa2bTed Kremenek if (Tmp.empty()) 186006fb99fb403bff1651429923f666a2ebe2b1522fTed Kremenek return; 1861b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 1862b4b817d704287836b52b34369009e682f208aa2bTed Kremenek for (ExplodedNodeSet::iterator NI=Tmp.begin(), NE=Tmp.end(); NI!=NE; ++NI) { 1863b4b817d704287836b52b34369009e682f208aa2bTed Kremenek Pred = *NI; 1864b4b817d704287836b52b34369009e682f208aa2bTed Kremenek const GRState *state = GetState(Pred); 1865b4b817d704287836b52b34369009e682f208aa2bTed Kremenek 1866b4b817d704287836b52b34369009e682f208aa2bTed Kremenek // Handle the case where the container still has elements. 1867c8413fd03f73084a5c93028f8b4db619fc388087Ted Kremenek SVal TrueV = svalBuilder.makeTruthVal(1); 1868b4b817d704287836b52b34369009e682f208aa2bTed Kremenek const GRState *hasElems = state->BindExpr(S, TrueV); 1869b4b817d704287836b52b34369009e682f208aa2bTed Kremenek 1870b4b817d704287836b52b34369009e682f208aa2bTed Kremenek // Handle the case where the container has no elements. 1871c8413fd03f73084a5c93028f8b4db619fc388087Ted Kremenek SVal FalseV = svalBuilder.makeTruthVal(0); 1872b4b817d704287836b52b34369009e682f208aa2bTed Kremenek const GRState *noElems = state->BindExpr(S, FalseV); 1873b4b817d704287836b52b34369009e682f208aa2bTed Kremenek 1874b4b817d704287836b52b34369009e682f208aa2bTed Kremenek if (loc::MemRegionVal* MV = dyn_cast<loc::MemRegionVal>(&ElementV)) 1875b4b817d704287836b52b34369009e682f208aa2bTed Kremenek if (const TypedRegion* R = dyn_cast<TypedRegion>(MV->getRegion())) { 1876b4b817d704287836b52b34369009e682f208aa2bTed Kremenek // FIXME: The proper thing to do is to really iterate over the 1877b4b817d704287836b52b34369009e682f208aa2bTed Kremenek // container. We will do this with dispatch logic to the store. 1878b4b817d704287836b52b34369009e682f208aa2bTed Kremenek // For now, just 'conjure' up a symbolic value. 1879018220c343c103b7dfaa117a7a474c7a7fd6d068Zhongxing Xu QualType T = R->getValueType(); 18807dfc9420babe83e236a47e752f8723bd06070d9dZhanyong Wan assert(Loc::isLocType(T)); 1881b4b817d704287836b52b34369009e682f208aa2bTed Kremenek unsigned Count = Builder->getCurrentBlockCount(); 1882b4b817d704287836b52b34369009e682f208aa2bTed Kremenek SymbolRef Sym = SymMgr.getConjuredSymbol(elem, T, Count); 1883c8413fd03f73084a5c93028f8b4db619fc388087Ted Kremenek SVal V = svalBuilder.makeLoc(Sym); 1884b4b817d704287836b52b34369009e682f208aa2bTed Kremenek hasElems = hasElems->bindLoc(ElementV, V); 1885b4b817d704287836b52b34369009e682f208aa2bTed Kremenek 1886b4b817d704287836b52b34369009e682f208aa2bTed Kremenek // Bind the location to 'nil' on the false branch. 1887c8413fd03f73084a5c93028f8b4db619fc388087Ted Kremenek SVal nilV = svalBuilder.makeIntVal(0, T); 1888b4b817d704287836b52b34369009e682f208aa2bTed Kremenek noElems = noElems->bindLoc(ElementV, nilV); 1889b4b817d704287836b52b34369009e682f208aa2bTed Kremenek } 18901eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1891b4b817d704287836b52b34369009e682f208aa2bTed Kremenek // Create the new nodes. 1892b4b817d704287836b52b34369009e682f208aa2bTed Kremenek MakeNode(Dst, S, Pred, hasElems); 1893b4b817d704287836b52b34369009e682f208aa2bTed Kremenek MakeNode(Dst, S, Pred, noElems); 1894b4b817d704287836b52b34369009e682f208aa2bTed Kremenek } 1895af3374187c47acea45706eab6744be6b1c66a856Ted Kremenek} 1896af3374187c47acea45706eab6744be6b1c66a856Ted Kremenek 1897af3374187c47acea45706eab6744be6b1c66a856Ted Kremenek//===----------------------------------------------------------------------===// 1898e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek// Transfer function: Objective-C message expressions. 1899e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek//===----------------------------------------------------------------------===// 1900e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek 1901b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremeneknamespace { 1902b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenekclass ObjCMsgWLItem { 1903b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenekpublic: 190403509aea098772644bf4662dc1c88634818ceeccZhongxing Xu ObjCMessageExpr::const_arg_iterator I; 1905b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek ExplodedNode *N; 1906b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 190703509aea098772644bf4662dc1c88634818ceeccZhongxing Xu ObjCMsgWLItem(const ObjCMessageExpr::const_arg_iterator &i, ExplodedNode *n) 1908b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek : I(i), N(n) {} 1909b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek}; 1910b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek} // end anonymous namespace 1911b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 1912d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidisvoid ExprEngine::VisitObjCMessageExpr(const ObjCMessageExpr* ME, 191303509aea098772644bf4662dc1c88634818ceeccZhongxing Xu ExplodedNode* Pred, 1914892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek ExplodedNodeSet& Dst){ 19151eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1916b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek // Create a worklist to process both the arguments. 1917b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek llvm::SmallVector<ObjCMsgWLItem, 20> WL; 1918e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek 1919b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek // But first evaluate the receiver (if any). 192003509aea098772644bf4662dc1c88634818ceeccZhongxing Xu ObjCMessageExpr::const_arg_iterator AI = ME->arg_begin(), AE = ME->arg_end(); 192103509aea098772644bf4662dc1c88634818ceeccZhongxing Xu if (const Expr *Receiver = ME->getInstanceReceiver()) { 1922b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek ExplodedNodeSet Tmp; 1923b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek Visit(Receiver, Pred, Tmp); 19241eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1925b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek if (Tmp.empty()) 1926b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek return; 19271eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1928b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek for (ExplodedNodeSet::iterator I=Tmp.begin(), E=Tmp.end(); I!=E; ++I) 1929b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek WL.push_back(ObjCMsgWLItem(AI, *I)); 1930b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek } 1931b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek else 1932b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek WL.push_back(ObjCMsgWLItem(AI, Pred)); 19331eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1934b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek // Evaluate the arguments. 1935b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek ExplodedNodeSet ArgsEvaluated; 1936b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek while (!WL.empty()) { 1937b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek ObjCMsgWLItem Item = WL.back(); 1938b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek WL.pop_back(); 19391eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1940b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek if (Item.I == AE) { 1941b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek ArgsEvaluated.insert(Item.N); 1942b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek continue; 1943e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek } 19441eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1945b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek // Evaluate the subexpression. 1946b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek ExplodedNodeSet Tmp; 19471eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1948b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek // FIXME: [Objective-C++] handle arguments that are references 1949b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek Visit(*Item.I, Item.N, Tmp); 19501eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1951b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek // Enqueue evaluating the next argument on the worklist. 1952b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek ++(Item.I); 1953b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek for (ExplodedNodeSet::iterator NI=Tmp.begin(), NE=Tmp.end(); NI!=NE; ++NI) 1954b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek WL.push_back(ObjCMsgWLItem(Item.I, *NI)); 1955b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek } 1956e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek 19575286e2ddfd8332520de4c076e49991d6fe557adbArgyrios Kyrtzidis // Now that the arguments are processed, handle the ObjC message. 19585286e2ddfd8332520de4c076e49991d6fe557adbArgyrios Kyrtzidis VisitObjCMessage(ME, ArgsEvaluated, Dst); 19595286e2ddfd8332520de4c076e49991d6fe557adbArgyrios Kyrtzidis} 19605286e2ddfd8332520de4c076e49991d6fe557adbArgyrios Kyrtzidis 19615286e2ddfd8332520de4c076e49991d6fe557adbArgyrios Kyrtzidisvoid ExprEngine::VisitObjCMessage(const ObjCMessage &msg, 19625286e2ddfd8332520de4c076e49991d6fe557adbArgyrios Kyrtzidis ExplodedNodeSet &Src, ExplodedNodeSet& Dst) { 19635286e2ddfd8332520de4c076e49991d6fe557adbArgyrios Kyrtzidis 19645286e2ddfd8332520de4c076e49991d6fe557adbArgyrios Kyrtzidis // Handle the previsits checks. 1965b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek ExplodedNodeSet DstPrevisit; 1966eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis getCheckerManager().runCheckersForPreObjCMessage(DstPrevisit, Src, msg,*this); 19671eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1968b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek // Proceed with evaluate the message expression. 19699c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek ExplodedNodeSet dstEval; 19701eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1971b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek for (ExplodedNodeSet::iterator DI = DstPrevisit.begin(), 1972b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek DE = DstPrevisit.end(); DI != DE; ++DI) { 197338ac4f504bf8ed514520b5a82be538bdb0860687Ted Kremenek 19745286e2ddfd8332520de4c076e49991d6fe557adbArgyrios Kyrtzidis ExplodedNode *Pred = *DI; 1975c79d7d49c5ec42e8bb6ac34350ebb5bc24ca663dTed Kremenek bool RaisesException = false; 19769c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek unsigned oldSize = dstEval.size(); 197738ac4f504bf8ed514520b5a82be538bdb0860687Ted Kremenek SaveAndRestore<bool> OldSink(Builder->BuildSinks); 1978b4857264b8d3d861f688cdaa174aab30e0729a73Ted Kremenek SaveOr OldHasGen(Builder->hasGeneratedNode); 19791eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 19805286e2ddfd8332520de4c076e49991d6fe557adbArgyrios Kyrtzidis if (const Expr *Receiver = msg.getInstanceReceiver()) { 198159fea60cc3dde7a14eeafab9469cb911023fdd7fZhongxing Xu const GRState *state = GetState(Pred); 19822b3ca9c420e90f131642d7e7d47af6387dad7e1dArgyrios Kyrtzidis SVal recVal = state->getSVal(Receiver); 19832b3ca9c420e90f131642d7e7d47af6387dad7e1dArgyrios Kyrtzidis if (!recVal.isUndef()) { 19842b3ca9c420e90f131642d7e7d47af6387dad7e1dArgyrios Kyrtzidis // Bifurcate the state into nil and non-nil ones. 19852b3ca9c420e90f131642d7e7d47af6387dad7e1dArgyrios Kyrtzidis DefinedOrUnknownSVal receiverVal = cast<DefinedOrUnknownSVal>(recVal); 19862b3ca9c420e90f131642d7e7d47af6387dad7e1dArgyrios Kyrtzidis 19872b3ca9c420e90f131642d7e7d47af6387dad7e1dArgyrios Kyrtzidis const GRState *notNilState, *nilState; 19882b3ca9c420e90f131642d7e7d47af6387dad7e1dArgyrios Kyrtzidis llvm::tie(notNilState, nilState) = state->assume(receiverVal); 19892b3ca9c420e90f131642d7e7d47af6387dad7e1dArgyrios Kyrtzidis 19902b3ca9c420e90f131642d7e7d47af6387dad7e1dArgyrios Kyrtzidis // There are three cases: can be nil or non-nil, must be nil, must be 1991eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis // non-nil. We ignore must be nil, and merge the rest two into non-nil. 19922b3ca9c420e90f131642d7e7d47af6387dad7e1dArgyrios Kyrtzidis if (nilState && !notNilState) { 1993eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis dstEval.insert(Pred); 19942b3ca9c420e90f131642d7e7d47af6387dad7e1dArgyrios Kyrtzidis continue; 19952b3ca9c420e90f131642d7e7d47af6387dad7e1dArgyrios Kyrtzidis } 19962b3ca9c420e90f131642d7e7d47af6387dad7e1dArgyrios Kyrtzidis 19972b3ca9c420e90f131642d7e7d47af6387dad7e1dArgyrios Kyrtzidis // Check if the "raise" message was sent. 19982b3ca9c420e90f131642d7e7d47af6387dad7e1dArgyrios Kyrtzidis assert(notNilState); 19992b3ca9c420e90f131642d7e7d47af6387dad7e1dArgyrios Kyrtzidis if (msg.getSelector() == RaiseSel) 20002b3ca9c420e90f131642d7e7d47af6387dad7e1dArgyrios Kyrtzidis RaisesException = true; 20012b3ca9c420e90f131642d7e7d47af6387dad7e1dArgyrios Kyrtzidis 20022b3ca9c420e90f131642d7e7d47af6387dad7e1dArgyrios Kyrtzidis // Check if we raise an exception. For now treat these as sinks. 20032b3ca9c420e90f131642d7e7d47af6387dad7e1dArgyrios Kyrtzidis // Eventually we will want to handle exceptions properly. 20042b3ca9c420e90f131642d7e7d47af6387dad7e1dArgyrios Kyrtzidis if (RaisesException) 20052b3ca9c420e90f131642d7e7d47af6387dad7e1dArgyrios Kyrtzidis Builder->BuildSinks = true; 20062b3ca9c420e90f131642d7e7d47af6387dad7e1dArgyrios Kyrtzidis 20072b3ca9c420e90f131642d7e7d47af6387dad7e1dArgyrios Kyrtzidis // Dispatch to plug-in transfer function. 20082b3ca9c420e90f131642d7e7d47af6387dad7e1dArgyrios Kyrtzidis evalObjCMessage(dstEval, msg, Pred, notNilState); 2009a46e4d91d8f3eb341f2387768db66dcfe8dd0afaZhongxing Xu } 201021fe8370f660a30e3a0493c74728dcb369b9c58bTed Kremenek } 20115286e2ddfd8332520de4c076e49991d6fe557adbArgyrios Kyrtzidis else if (const ObjCInterfaceDecl *Iface = msg.getReceiverInterface()) { 201204badcf84c8d504d8491c7c7e29b58f52cb16640Douglas Gregor IdentifierInfo* ClsName = Iface->getIdentifier(); 20135286e2ddfd8332520de4c076e49991d6fe557adbArgyrios Kyrtzidis Selector S = msg.getSelector(); 20141eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 2015c79d7d49c5ec42e8bb6ac34350ebb5bc24ca663dTed Kremenek // Check for special instance methods. 2016c79d7d49c5ec42e8bb6ac34350ebb5bc24ca663dTed Kremenek if (!NSExceptionII) { 2017c79d7d49c5ec42e8bb6ac34350ebb5bc24ca663dTed Kremenek ASTContext& Ctx = getContext(); 2018c79d7d49c5ec42e8bb6ac34350ebb5bc24ca663dTed Kremenek NSExceptionII = &Ctx.Idents.get("NSException"); 2019c79d7d49c5ec42e8bb6ac34350ebb5bc24ca663dTed Kremenek } 20201eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 2021c79d7d49c5ec42e8bb6ac34350ebb5bc24ca663dTed Kremenek if (ClsName == NSExceptionII) { 2022c79d7d49c5ec42e8bb6ac34350ebb5bc24ca663dTed Kremenek enum { NUM_RAISE_SELECTORS = 2 }; 20231eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 2024c79d7d49c5ec42e8bb6ac34350ebb5bc24ca663dTed Kremenek // Lazily create a cache of the selectors. 2025c79d7d49c5ec42e8bb6ac34350ebb5bc24ca663dTed Kremenek if (!NSExceptionInstanceRaiseSelectors) { 2026c79d7d49c5ec42e8bb6ac34350ebb5bc24ca663dTed Kremenek ASTContext& Ctx = getContext(); 2027b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek NSExceptionInstanceRaiseSelectors = 2028b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek new Selector[NUM_RAISE_SELECTORS]; 2029c79d7d49c5ec42e8bb6ac34350ebb5bc24ca663dTed Kremenek llvm::SmallVector<IdentifierInfo*, NUM_RAISE_SELECTORS> II; 2030c79d7d49c5ec42e8bb6ac34350ebb5bc24ca663dTed Kremenek unsigned idx = 0; 20311eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 2032c79d7d49c5ec42e8bb6ac34350ebb5bc24ca663dTed Kremenek // raise:format: 2033c79d7d49c5ec42e8bb6ac34350ebb5bc24ca663dTed Kremenek II.push_back(&Ctx.Idents.get("raise")); 2034c79d7d49c5ec42e8bb6ac34350ebb5bc24ca663dTed Kremenek II.push_back(&Ctx.Idents.get("format")); 2035c79d7d49c5ec42e8bb6ac34350ebb5bc24ca663dTed Kremenek NSExceptionInstanceRaiseSelectors[idx++] = 2036c79d7d49c5ec42e8bb6ac34350ebb5bc24ca663dTed Kremenek Ctx.Selectors.getSelector(II.size(), &II[0]); 20371eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 2038c79d7d49c5ec42e8bb6ac34350ebb5bc24ca663dTed Kremenek // raise:format::arguments: 2039c79d7d49c5ec42e8bb6ac34350ebb5bc24ca663dTed Kremenek II.push_back(&Ctx.Idents.get("arguments")); 2040c79d7d49c5ec42e8bb6ac34350ebb5bc24ca663dTed Kremenek NSExceptionInstanceRaiseSelectors[idx++] = 2041c79d7d49c5ec42e8bb6ac34350ebb5bc24ca663dTed Kremenek Ctx.Selectors.getSelector(II.size(), &II[0]); 2042c79d7d49c5ec42e8bb6ac34350ebb5bc24ca663dTed Kremenek } 20431eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 2044c79d7d49c5ec42e8bb6ac34350ebb5bc24ca663dTed Kremenek for (unsigned i = 0; i < NUM_RAISE_SELECTORS; ++i) 2045c79d7d49c5ec42e8bb6ac34350ebb5bc24ca663dTed Kremenek if (S == NSExceptionInstanceRaiseSelectors[i]) { 204638ac4f504bf8ed514520b5a82be538bdb0860687Ted Kremenek RaisesException = true; 204738ac4f504bf8ed514520b5a82be538bdb0860687Ted Kremenek break; 2048c79d7d49c5ec42e8bb6ac34350ebb5bc24ca663dTed Kremenek } 2049e448ab4f9dd162802f5d7cfea60f7830cc61c654Ted Kremenek } 20501eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 2051a46e4d91d8f3eb341f2387768db66dcfe8dd0afaZhongxing Xu // Check if we raise an exception. For now treat these as sinks. 2052a46e4d91d8f3eb341f2387768db66dcfe8dd0afaZhongxing Xu // Eventually we will want to handle exceptions properly. 2053a46e4d91d8f3eb341f2387768db66dcfe8dd0afaZhongxing Xu if (RaisesException) 2054a46e4d91d8f3eb341f2387768db66dcfe8dd0afaZhongxing Xu Builder->BuildSinks = true; 20551eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 2056a46e4d91d8f3eb341f2387768db66dcfe8dd0afaZhongxing Xu // Dispatch to plug-in transfer function. 20575286e2ddfd8332520de4c076e49991d6fe557adbArgyrios Kyrtzidis evalObjCMessage(dstEval, msg, Pred, Builder->GetState(Pred)); 2058a46e4d91d8f3eb341f2387768db66dcfe8dd0afaZhongxing Xu } 2059b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 206038ac4f504bf8ed514520b5a82be538bdb0860687Ted Kremenek // Handle the case where no nodes where generated. Auto-generate that 206138ac4f504bf8ed514520b5a82be538bdb0860687Ted Kremenek // contains the updated state if we aren't generating sinks. 20629c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek if (!Builder->BuildSinks && dstEval.size() == oldSize && 2063b4857264b8d3d861f688cdaa174aab30e0729a73Ted Kremenek !Builder->hasGeneratedNode) 20645286e2ddfd8332520de4c076e49991d6fe557adbArgyrios Kyrtzidis MakeNode(dstEval, msg.getOriginExpr(), Pred, GetState(Pred)); 2065c79d7d49c5ec42e8bb6ac34350ebb5bc24ca663dTed Kremenek } 20661eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 206738ac4f504bf8ed514520b5a82be538bdb0860687Ted Kremenek // Finally, perform the post-condition check of the ObjCMessageExpr and store 206838ac4f504bf8ed514520b5a82be538bdb0860687Ted Kremenek // the created nodes in 'Dst'. 2069eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis getCheckerManager().runCheckersForPostObjCMessage(Dst, dstEval, msg, *this); 2070de43424560f1a744de6214dab6bbee28ad8437f5Ted Kremenek} 2071de43424560f1a744de6214dab6bbee28ad8437f5Ted Kremenek 2072e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek//===----------------------------------------------------------------------===// 2073e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek// Transfer functions: Miscellaneous statements. 2074e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek//===----------------------------------------------------------------------===// 2075e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek 2076d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidisvoid ExprEngine::VisitCast(const CastExpr *CastE, const Expr *Ex, 2077d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidis ExplodedNode *Pred, ExplodedNodeSet &Dst) { 2078892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek 2079031ccc0555a82afc2e8afe29e19dd57ff204e2deZhongxing Xu ExplodedNodeSet S1; 2080892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek Visit(Ex, Pred, S1); 2081892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek ExplodedNodeSet S2; 2082eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis getCheckerManager().runCheckersForPreStmt(S2, S1, CastE, *this); 2083892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek 208414429b918bd2f4cb52abc75546a7fe37142054caArgyrios Kyrtzidis if (CastE->getCastKind() == CK_LValueToRValue || 208514429b918bd2f4cb52abc75546a7fe37142054caArgyrios Kyrtzidis CastE->getCastKind() == CK_GetObjCProperty) { 2086892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek for (ExplodedNodeSet::iterator I = S2.begin(), E = S2.end(); I!=E; ++I) { 2087892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek ExplodedNode *subExprNode = *I; 2088892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek const GRState *state = GetState(subExprNode); 2089892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek evalLoad(Dst, CastE, subExprNode, state, state->getSVal(Ex)); 2090892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek } 2091892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek return; 2092892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek } 2093892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek 2094892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek // All other casts. 20955d3003a9d10cc6da4ef716c350bf53c187774c93Ted Kremenek QualType T = CastE->getType(); 2096933c3e1dca3bb88bf113290ef0ade8f5262a89c0Zhongxing Xu QualType ExTy = Ex->getType(); 2097ed340f7d26b3a8fedeb2aebeb5b23429e79d18e0Zhongxing Xu 2098d3118bd7daed36417c8e8bdb0390495a4c829d86Zhongxing Xu if (const ExplicitCastExpr *ExCast=dyn_cast_or_null<ExplicitCastExpr>(CastE)) 209949badde06e066d058d6c7fcf4e628a72999b65a9Douglas Gregor T = ExCast->getTypeAsWritten(); 2100892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek 2101892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek#if 0 2102949bdb43bf370b23a79a37b017e0a0566c0d66e0Ted Kremenek // If we are evaluating the cast in an lvalue context, we implicitly want 2103949bdb43bf370b23a79a37b017e0a0566c0d66e0Ted Kremenek // the cast to evaluate to a location. 2104949bdb43bf370b23a79a37b017e0a0566c0d66e0Ted Kremenek if (asLValue) { 2105949bdb43bf370b23a79a37b017e0a0566c0d66e0Ted Kremenek ASTContext &Ctx = getContext(); 2106949bdb43bf370b23a79a37b017e0a0566c0d66e0Ted Kremenek T = Ctx.getPointerType(Ctx.getCanonicalType(T)); 2107077a40df258beb46cb746af61da115e9718a6affTed Kremenek ExTy = Ctx.getPointerType(Ctx.getCanonicalType(ExTy)); 2108949bdb43bf370b23a79a37b017e0a0566c0d66e0Ted Kremenek } 2109892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek#endif 211032c3fa4195762ba93f0b7114ab36c0941bc34432Ted Kremenek 2111b79b117d3b76da58b14ef835ccfcf2e988b7345fZhongxing Xu switch (CastE->getCastKind()) { 21122de56d1d0c3a504ad1529de2677628bdfbb95cd4John McCall case CK_ToVoid: 2113b79b117d3b76da58b14ef835ccfcf2e988b7345fZhongxing Xu for (ExplodedNodeSet::iterator I = S2.begin(), E = S2.end(); I != E; ++I) 2114b79b117d3b76da58b14ef835ccfcf2e988b7345fZhongxing Xu Dst.Add(*I); 2115b79b117d3b76da58b14ef835ccfcf2e988b7345fZhongxing Xu return; 2116b79b117d3b76da58b14ef835ccfcf2e988b7345fZhongxing Xu 21170ae287a498b8cec2086fe6b7e753cbb3df63e74aJohn McCall case CK_LValueToRValue: 21182de56d1d0c3a504ad1529de2677628bdfbb95cd4John McCall case CK_NoOp: 21192de56d1d0c3a504ad1529de2677628bdfbb95cd4John McCall case CK_FunctionToPointerDecay: 2120b79b117d3b76da58b14ef835ccfcf2e988b7345fZhongxing Xu for (ExplodedNodeSet::iterator I = S2.begin(), E = S2.end(); I != E; ++I) { 2121b79b117d3b76da58b14ef835ccfcf2e988b7345fZhongxing Xu // Copy the SVal of Ex to CastE. 2122b79b117d3b76da58b14ef835ccfcf2e988b7345fZhongxing Xu ExplodedNode *N = *I; 2123b79b117d3b76da58b14ef835ccfcf2e988b7345fZhongxing Xu const GRState *state = GetState(N); 21241397663af9dbcc24dbf0e11de43931b3dc08fdbbTed Kremenek SVal V = state->getSVal(Ex); 2125b79b117d3b76da58b14ef835ccfcf2e988b7345fZhongxing Xu state = state->BindExpr(CastE, V); 2126b79b117d3b76da58b14ef835ccfcf2e988b7345fZhongxing Xu MakeNode(Dst, CastE, N, state); 2127b79b117d3b76da58b14ef835ccfcf2e988b7345fZhongxing Xu } 2128b79b117d3b76da58b14ef835ccfcf2e988b7345fZhongxing Xu return; 2129b79b117d3b76da58b14ef835ccfcf2e988b7345fZhongxing Xu 2130f6a1648197562e0b133440d612d9af297d0a86ccJohn McCall case CK_GetObjCProperty: 2131daa8e4e888758d55a7a759dd4a91b83921cef222John McCall case CK_Dependent: 21322de56d1d0c3a504ad1529de2677628bdfbb95cd4John McCall case CK_ArrayToPointerDecay: 21332de56d1d0c3a504ad1529de2677628bdfbb95cd4John McCall case CK_BitCast: 21342de56d1d0c3a504ad1529de2677628bdfbb95cd4John McCall case CK_LValueBitCast: 21352de56d1d0c3a504ad1529de2677628bdfbb95cd4John McCall case CK_IntegralCast: 2136404cd1669c3ba138a9ae0a619bd689cce5aae271John McCall case CK_NullToPointer: 21372de56d1d0c3a504ad1529de2677628bdfbb95cd4John McCall case CK_IntegralToPointer: 21382de56d1d0c3a504ad1529de2677628bdfbb95cd4John McCall case CK_PointerToIntegral: 2139daa8e4e888758d55a7a759dd4a91b83921cef222John McCall case CK_PointerToBoolean: 2140daa8e4e888758d55a7a759dd4a91b83921cef222John McCall case CK_IntegralToBoolean: 21412de56d1d0c3a504ad1529de2677628bdfbb95cd4John McCall case CK_IntegralToFloating: 21422de56d1d0c3a504ad1529de2677628bdfbb95cd4John McCall case CK_FloatingToIntegral: 2143daa8e4e888758d55a7a759dd4a91b83921cef222John McCall case CK_FloatingToBoolean: 21442de56d1d0c3a504ad1529de2677628bdfbb95cd4John McCall case CK_FloatingCast: 21452bb5d00fcf71a7b4d478d478be778fff0494aff6John McCall case CK_FloatingRealToComplex: 2146f3ea8cfe6b1c2ef0702efe130561e9e66708d799John McCall case CK_FloatingComplexToReal: 2147f3ea8cfe6b1c2ef0702efe130561e9e66708d799John McCall case CK_FloatingComplexToBoolean: 21482bb5d00fcf71a7b4d478d478be778fff0494aff6John McCall case CK_FloatingComplexCast: 2149f3ea8cfe6b1c2ef0702efe130561e9e66708d799John McCall case CK_FloatingComplexToIntegralComplex: 21502bb5d00fcf71a7b4d478d478be778fff0494aff6John McCall case CK_IntegralRealToComplex: 2151f3ea8cfe6b1c2ef0702efe130561e9e66708d799John McCall case CK_IntegralComplexToReal: 2152f3ea8cfe6b1c2ef0702efe130561e9e66708d799John McCall case CK_IntegralComplexToBoolean: 21532bb5d00fcf71a7b4d478d478be778fff0494aff6John McCall case CK_IntegralComplexCast: 2154f3ea8cfe6b1c2ef0702efe130561e9e66708d799John McCall case CK_IntegralComplexToFloatingComplex: 21552de56d1d0c3a504ad1529de2677628bdfbb95cd4John McCall case CK_AnyPointerToObjCPointerCast: 21562de56d1d0c3a504ad1529de2677628bdfbb95cd4John McCall case CK_AnyPointerToBlockPointerCast: 21574fd56816e0925c04f2c92e75399f5c9018d5d6fbZhongxing Xu 21582de56d1d0c3a504ad1529de2677628bdfbb95cd4John McCall case CK_ObjCObjectLValueCast: { 2159846eabd187be4bfe992e8bca131166b734d86e0dTed Kremenek // Delegate to SValBuilder to process. 2160b79b117d3b76da58b14ef835ccfcf2e988b7345fZhongxing Xu for (ExplodedNodeSet::iterator I = S2.begin(), E = S2.end(); I != E; ++I) { 2161b79b117d3b76da58b14ef835ccfcf2e988b7345fZhongxing Xu ExplodedNode* N = *I; 2162b79b117d3b76da58b14ef835ccfcf2e988b7345fZhongxing Xu const GRState* state = GetState(N); 21631397663af9dbcc24dbf0e11de43931b3dc08fdbbTed Kremenek SVal V = state->getSVal(Ex); 21649c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek V = svalBuilder.evalCast(V, T, ExTy); 2165814e6b915450456eb2a1ba15d82fc7f8ae3bc8a6Zhongxing Xu state = state->BindExpr(CastE, V); 2166b79b117d3b76da58b14ef835ccfcf2e988b7345fZhongxing Xu MakeNode(Dst, CastE, N, state); 2167b79b117d3b76da58b14ef835ccfcf2e988b7345fZhongxing Xu } 2168b79b117d3b76da58b14ef835ccfcf2e988b7345fZhongxing Xu return; 21698ad9cbc518a603176462f1fa1efe389023590082Ted Kremenek } 21704fd56816e0925c04f2c92e75399f5c9018d5d6fbZhongxing Xu 21714fd56816e0925c04f2c92e75399f5c9018d5d6fbZhongxing Xu case CK_DerivedToBase: 21724fd56816e0925c04f2c92e75399f5c9018d5d6fbZhongxing Xu case CK_UncheckedDerivedToBase: 21734fd56816e0925c04f2c92e75399f5c9018d5d6fbZhongxing Xu // For DerivedToBase cast, delegate to the store manager. 21744fd56816e0925c04f2c92e75399f5c9018d5d6fbZhongxing Xu for (ExplodedNodeSet::iterator I = S2.begin(), E = S2.end(); I != E; ++I) { 21754fd56816e0925c04f2c92e75399f5c9018d5d6fbZhongxing Xu ExplodedNode *node = *I; 21764fd56816e0925c04f2c92e75399f5c9018d5d6fbZhongxing Xu const GRState *state = GetState(node); 21774fd56816e0925c04f2c92e75399f5c9018d5d6fbZhongxing Xu SVal val = state->getSVal(Ex); 21784fd56816e0925c04f2c92e75399f5c9018d5d6fbZhongxing Xu val = getStoreManager().evalDerivedToBase(val, T); 21794fd56816e0925c04f2c92e75399f5c9018d5d6fbZhongxing Xu state = state->BindExpr(CastE, val); 21804fd56816e0925c04f2c92e75399f5c9018d5d6fbZhongxing Xu MakeNode(Dst, CastE, node, state); 21814fd56816e0925c04f2c92e75399f5c9018d5d6fbZhongxing Xu } 21824fd56816e0925c04f2c92e75399f5c9018d5d6fbZhongxing Xu return; 21834fd56816e0925c04f2c92e75399f5c9018d5d6fbZhongxing Xu 21848ad9cbc518a603176462f1fa1efe389023590082Ted Kremenek // Various C++ casts that are not handled yet. 21852de56d1d0c3a504ad1529de2677628bdfbb95cd4John McCall case CK_Dynamic: 21862de56d1d0c3a504ad1529de2677628bdfbb95cd4John McCall case CK_ToUnion: 21872de56d1d0c3a504ad1529de2677628bdfbb95cd4John McCall case CK_BaseToDerived: 21882de56d1d0c3a504ad1529de2677628bdfbb95cd4John McCall case CK_NullToMemberPointer: 21892de56d1d0c3a504ad1529de2677628bdfbb95cd4John McCall case CK_BaseToDerivedMemberPointer: 21902de56d1d0c3a504ad1529de2677628bdfbb95cd4John McCall case CK_DerivedToBaseMemberPointer: 21912de56d1d0c3a504ad1529de2677628bdfbb95cd4John McCall case CK_UserDefinedConversion: 21922de56d1d0c3a504ad1529de2677628bdfbb95cd4John McCall case CK_ConstructorConversion: 21932de56d1d0c3a504ad1529de2677628bdfbb95cd4John McCall case CK_VectorSplat: 21942de56d1d0c3a504ad1529de2677628bdfbb95cd4John McCall case CK_MemberPointerToBoolean: { 21958ad9cbc518a603176462f1fa1efe389023590082Ted Kremenek SaveAndRestore<bool> OldSink(Builder->BuildSinks); 21968ad9cbc518a603176462f1fa1efe389023590082Ted Kremenek Builder->BuildSinks = true; 21978ad9cbc518a603176462f1fa1efe389023590082Ted Kremenek MakeNode(Dst, CastE, Pred, GetState(Pred)); 21988ad9cbc518a603176462f1fa1efe389023590082Ted Kremenek return; 21998ad9cbc518a603176462f1fa1efe389023590082Ted Kremenek } 2200874d63fc63387365a21775a14c01963b10fde689Ted Kremenek } 22019de04c4415bd31c0c0e888e9ad5673f6c972e12eTed Kremenek} 22029de04c4415bd31c0c0e888e9ad5673f6c972e12eTed Kremenek 2203d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidisvoid ExprEngine::VisitCompoundLiteralExpr(const CompoundLiteralExpr* CL, 22041eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump ExplodedNode* Pred, 2205892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek ExplodedNodeSet& Dst) { 220603509aea098772644bf4662dc1c88634818ceeccZhongxing Xu const InitListExpr* ILE 220703509aea098772644bf4662dc1c88634818ceeccZhongxing Xu = cast<InitListExpr>(CL->getInitializer()->IgnoreParens()); 2208031ccc0555a82afc2e8afe29e19dd57ff204e2deZhongxing Xu ExplodedNodeSet Tmp; 22094f09027385466f1f4c382c80ca77157e2aef97d9Ted Kremenek Visit(ILE, Pred, Tmp); 22101eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 2211031ccc0555a82afc2e8afe29e19dd57ff204e2deZhongxing Xu for (ExplodedNodeSet::iterator I = Tmp.begin(), EI = Tmp.end(); I!=EI; ++I) { 2212a8538d902fce9cfec20f39b34492268b51643819Ted Kremenek const GRState* state = GetState(*I); 22131397663af9dbcc24dbf0e11de43931b3dc08fdbbTed Kremenek SVal ILV = state->getSVal(ILE); 221467d1287035767f4f6c8ca0c2bb755990012a44caTed Kremenek const LocationContext *LC = (*I)->getLocationContext(); 221567d1287035767f4f6c8ca0c2bb755990012a44caTed Kremenek state = state->bindCompoundLiteral(CL, LC, ILV); 22164f09027385466f1f4c382c80ca77157e2aef97d9Ted Kremenek 2217892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek if (CL->isLValue()) { 221867d1287035767f4f6c8ca0c2bb755990012a44caTed Kremenek MakeNode(Dst, CL, *I, state->BindExpr(CL, state->getLValue(CL, LC))); 221967d1287035767f4f6c8ca0c2bb755990012a44caTed Kremenek } 2220f22679e3e5d5f5754931952e58112b4c863a4137Zhongxing Xu else 22218e0293406f9d62a293be6be3b1fb89d359f5ea40Ted Kremenek MakeNode(Dst, CL, *I, state->BindExpr(CL, ILV)); 22224f09027385466f1f4c382c80ca77157e2aef97d9Ted Kremenek } 22234f09027385466f1f4c382c80ca77157e2aef97d9Ted Kremenek} 22244f09027385466f1f4c382c80ca77157e2aef97d9Ted Kremenek 2225d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidisvoid ExprEngine::VisitDeclStmt(const DeclStmt *DS, ExplodedNode *Pred, 22261eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump ExplodedNodeSet& Dst) { 22275b7dcce86c79370f16fd89ecebd454a3b4eec73cTed Kremenek 22281eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump // The CFG has one DeclStmt per Decl. 222903509aea098772644bf4662dc1c88634818ceeccZhongxing Xu const Decl* D = *DS->decl_begin(); 22301eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 2231e6c62e3d43728b0a4477fffd543723dd2170af1aTed Kremenek if (!D || !isa<VarDecl>(D)) 22325b7dcce86c79370f16fd89ecebd454a3b4eec73cTed Kremenek return; 22331eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 22341eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump const VarDecl* VD = dyn_cast<VarDecl>(D); 22351f19124c70093d2ef0c06eed63ca6080611800a3Zhongxing Xu const Expr* InitEx = VD->getInit(); 22365b7dcce86c79370f16fd89ecebd454a3b4eec73cTed Kremenek 22375b7dcce86c79370f16fd89ecebd454a3b4eec73cTed Kremenek // FIXME: static variables may have an initializer, but the second 22385b7dcce86c79370f16fd89ecebd454a3b4eec73cTed Kremenek // time a function is called those values may not be current. 2239031ccc0555a82afc2e8afe29e19dd57ff204e2deZhongxing Xu ExplodedNodeSet Tmp; 22405b7dcce86c79370f16fd89ecebd454a3b4eec73cTed Kremenek 2241f45fbad13ee1f143a2cb6e806fefe22b48f68940Zhongxing Xu if (InitEx) { 2242f45fbad13ee1f143a2cb6e806fefe22b48f68940Zhongxing Xu if (VD->getType()->isReferenceType() && !InitEx->isLValue()) { 224305e539175d9bac678fca8e77665e88b685729850Zhongxing Xu // If the initializer is C++ record type, it should already has a 224405e539175d9bac678fca8e77665e88b685729850Zhongxing Xu // temp object. 224505e539175d9bac678fca8e77665e88b685729850Zhongxing Xu if (!InitEx->getType()->isRecordType()) 224605e539175d9bac678fca8e77665e88b685729850Zhongxing Xu CreateCXXTemporaryObject(InitEx, Pred, Tmp); 224705e539175d9bac678fca8e77665e88b685729850Zhongxing Xu else 224805e539175d9bac678fca8e77665e88b685729850Zhongxing Xu Tmp.Add(Pred); 2249f45fbad13ee1f143a2cb6e806fefe22b48f68940Zhongxing Xu } else 2250f45fbad13ee1f143a2cb6e806fefe22b48f68940Zhongxing Xu Visit(InitEx, Pred, Tmp); 2251f45fbad13ee1f143a2cb6e806fefe22b48f68940Zhongxing Xu } else 2252e6c62e3d43728b0a4477fffd543723dd2170af1aTed Kremenek Tmp.Add(Pred); 22531eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 2254ae1623345aed43dcd2e069970a00618378a37b34Ted Kremenek ExplodedNodeSet Tmp2; 2255eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis getCheckerManager().runCheckersForPreStmt(Tmp2, Tmp, DS, *this); 2256b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 2257ae1623345aed43dcd2e069970a00618378a37b34Ted Kremenek for (ExplodedNodeSet::iterator I=Tmp2.begin(), E=Tmp2.end(); I!=E; ++I) { 22585206f0b913d1a11744c9436c83b24f8daa21152cZhongxing Xu ExplodedNode *N = *I; 2259ae1623345aed43dcd2e069970a00618378a37b34Ted Kremenek const GRState *state = GetState(N); 22601eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 22615b8d9019e317e3e0abc4ad1d89066908413339aaTed Kremenek // Decls without InitExpr are not initialized explicitly. 22625206f0b913d1a11744c9436c83b24f8daa21152cZhongxing Xu const LocationContext *LC = N->getLocationContext(); 2263d17da2b99f323fa91b01e1dd119cc32e0ee8197dTed Kremenek 22645b8d9019e317e3e0abc4ad1d89066908413339aaTed Kremenek if (InitEx) { 22651397663af9dbcc24dbf0e11de43931b3dc08fdbbTed Kremenek SVal InitVal = state->getSVal(InitEx); 22661eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 226705e539175d9bac678fca8e77665e88b685729850Zhongxing Xu // We bound the temp obj region to the CXXConstructExpr. Now recover 226805e539175d9bac678fca8e77665e88b685729850Zhongxing Xu // the lazy compound value when the variable is not a reference. 226905e539175d9bac678fca8e77665e88b685729850Zhongxing Xu if (AMgr.getLangOptions().CPlusPlus && VD->getType()->isRecordType() && 227005e539175d9bac678fca8e77665e88b685729850Zhongxing Xu !VD->getType()->isReferenceType() && isa<loc::MemRegionVal>(InitVal)){ 227105e539175d9bac678fca8e77665e88b685729850Zhongxing Xu InitVal = state->getSVal(cast<loc::MemRegionVal>(InitVal).getRegion()); 227205e539175d9bac678fca8e77665e88b685729850Zhongxing Xu assert(isa<nonloc::LazyCompoundVal>(InitVal)); 227305e539175d9bac678fca8e77665e88b685729850Zhongxing Xu } 227405e539175d9bac678fca8e77665e88b685729850Zhongxing Xu 22755b8d9019e317e3e0abc4ad1d89066908413339aaTed Kremenek // Recover some path-sensitivity if a scalar value evaluated to 22765b8d9019e317e3e0abc4ad1d89066908413339aaTed Kremenek // UnknownVal. 2277a804a68f5a1ad739eb17ff2fd942d12abbc30b08Ted Kremenek if ((InitVal.isUnknown() || 2278a804a68f5a1ad739eb17ff2fd942d12abbc30b08Ted Kremenek !getConstraintManager().canReasonAbout(InitVal)) && 2279a804a68f5a1ad739eb17ff2fd942d12abbc30b08Ted Kremenek !VD->getType()->isReferenceType()) { 2280c8413fd03f73084a5c93028f8b4db619fc388087Ted Kremenek InitVal = svalBuilder.getConjuredSymbolVal(NULL, InitEx, 22815206f0b913d1a11744c9436c83b24f8daa21152cZhongxing Xu Builder->getCurrentBlockCount()); 22821eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump } 2283b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 22849c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek evalBind(Dst, DS, *I, state, 2285b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek loc::MemRegionVal(state->getRegion(VD, LC)), InitVal, true); 22861eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump } 22875b8d9019e317e3e0abc4ad1d89066908413339aaTed Kremenek else { 2288f6f56d4fc8ebce17e7b83eb2c35f57a055c22283Ted Kremenek state = state->bindDeclWithNoInit(state->getRegion(VD, LC)); 22895b8d9019e317e3e0abc4ad1d89066908413339aaTed Kremenek MakeNode(Dst, DS, *I, state); 22905b8d9019e317e3e0abc4ad1d89066908413339aaTed Kremenek } 22915b7dcce86c79370f16fd89ecebd454a3b4eec73cTed Kremenek } 22925b7dcce86c79370f16fd89ecebd454a3b4eec73cTed Kremenek} 2293f233d48cfc513b045e2c2cfca5c175220fbd0a82Ted Kremenek 2294d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidisvoid ExprEngine::VisitCondInit(const VarDecl *VD, const Stmt *S, 2295fcfb503c280ed8c66d428fed911b2846c0f434fcTed Kremenek ExplodedNode *Pred, ExplodedNodeSet& Dst) { 2296b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 229703509aea098772644bf4662dc1c88634818ceeccZhongxing Xu const Expr* InitEx = VD->getInit(); 229861dfbecd8e6181b2ba42ffb5feede27a2bab3b8aTed Kremenek ExplodedNodeSet Tmp; 229961dfbecd8e6181b2ba42ffb5feede27a2bab3b8aTed Kremenek Visit(InitEx, Pred, Tmp); 230061dfbecd8e6181b2ba42ffb5feede27a2bab3b8aTed Kremenek 230161dfbecd8e6181b2ba42ffb5feede27a2bab3b8aTed Kremenek for (ExplodedNodeSet::iterator I=Tmp.begin(), E=Tmp.end(); I!=E; ++I) { 230261dfbecd8e6181b2ba42ffb5feede27a2bab3b8aTed Kremenek ExplodedNode *N = *I; 230361dfbecd8e6181b2ba42ffb5feede27a2bab3b8aTed Kremenek const GRState *state = GetState(N); 2304b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 230561dfbecd8e6181b2ba42ffb5feede27a2bab3b8aTed Kremenek const LocationContext *LC = N->getLocationContext(); 23061397663af9dbcc24dbf0e11de43931b3dc08fdbbTed Kremenek SVal InitVal = state->getSVal(InitEx); 2307b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 230861dfbecd8e6181b2ba42ffb5feede27a2bab3b8aTed Kremenek // Recover some path-sensitivity if a scalar value evaluated to 230961dfbecd8e6181b2ba42ffb5feede27a2bab3b8aTed Kremenek // UnknownVal. 231061dfbecd8e6181b2ba42ffb5feede27a2bab3b8aTed Kremenek if (InitVal.isUnknown() || 231161dfbecd8e6181b2ba42ffb5feede27a2bab3b8aTed Kremenek !getConstraintManager().canReasonAbout(InitVal)) { 2312c8413fd03f73084a5c93028f8b4db619fc388087Ted Kremenek InitVal = svalBuilder.getConjuredSymbolVal(NULL, InitEx, 231361dfbecd8e6181b2ba42ffb5feede27a2bab3b8aTed Kremenek Builder->getCurrentBlockCount()); 231461dfbecd8e6181b2ba42ffb5feede27a2bab3b8aTed Kremenek } 2315b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 23169c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek evalBind(Dst, S, N, state, 231761dfbecd8e6181b2ba42ffb5feede27a2bab3b8aTed Kremenek loc::MemRegionVal(state->getRegion(VD, LC)), InitVal, true); 231861dfbecd8e6181b2ba42ffb5feede27a2bab3b8aTed Kremenek } 231961dfbecd8e6181b2ba42ffb5feede27a2bab3b8aTed Kremenek} 232061dfbecd8e6181b2ba42ffb5feede27a2bab3b8aTed Kremenek 2321f75b186893b3461610668dbb627d6f95abead973Ted Kremeneknamespace { 2322f75b186893b3461610668dbb627d6f95abead973Ted Kremenek // This class is used by VisitInitListExpr as an item in a worklist 2323f75b186893b3461610668dbb627d6f95abead973Ted Kremenek // for processing the values contained in an InitListExpr. 2324ba5fb5a955c896815c439289fc51c03cf0635129Kovarththanan Rajaratnamclass InitListWLItem { 2325f75b186893b3461610668dbb627d6f95abead973Ted Kremenekpublic: 2326f75b186893b3461610668dbb627d6f95abead973Ted Kremenek llvm::ImmutableList<SVal> Vals; 2327031ccc0555a82afc2e8afe29e19dd57ff204e2deZhongxing Xu ExplodedNode* N; 232803509aea098772644bf4662dc1c88634818ceeccZhongxing Xu InitListExpr::const_reverse_iterator Itr; 23291eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 2330031ccc0555a82afc2e8afe29e19dd57ff204e2deZhongxing Xu InitListWLItem(ExplodedNode* n, llvm::ImmutableList<SVal> vals, 233103509aea098772644bf4662dc1c88634818ceeccZhongxing Xu InitListExpr::const_reverse_iterator itr) 2332f75b186893b3461610668dbb627d6f95abead973Ted Kremenek : Vals(vals), N(n), Itr(itr) {} 2333f75b186893b3461610668dbb627d6f95abead973Ted Kremenek}; 2334f75b186893b3461610668dbb627d6f95abead973Ted Kremenek} 2335f75b186893b3461610668dbb627d6f95abead973Ted Kremenek 2336f75b186893b3461610668dbb627d6f95abead973Ted Kremenek 2337d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidisvoid ExprEngine::VisitInitListExpr(const InitListExpr* E, ExplodedNode* Pred, 2338031ccc0555a82afc2e8afe29e19dd57ff204e2deZhongxing Xu ExplodedNodeSet& Dst) { 2339c4f8706b6539e06a5de153bd72850bb2e0a71456Zhongxing Xu 2340a49e3674e44104e34342d2c35ece7cb4f9bd96cbTed Kremenek const GRState* state = GetState(Pred); 234176dba7b67a36b2d6311e4ad4714df5dbd39dbebeTed Kremenek QualType T = getContext().getCanonicalType(E->getType()); 23421eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump unsigned NumInitElements = E->getNumInits(); 2343c4f8706b6539e06a5de153bd72850bb2e0a71456Zhongxing Xu 2344fb87b89fc9eb103e19fb8e4b925c23f0bd091b99Douglas Gregor if (T->isArrayType() || T->isRecordType() || T->isVectorType()) { 2345a49e3674e44104e34342d2c35ece7cb4f9bd96cbTed Kremenek llvm::ImmutableList<SVal> StartVals = getBasicVals().getEmptySValList(); 23461eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 2347a49e3674e44104e34342d2c35ece7cb4f9bd96cbTed Kremenek // Handle base case where the initializer has no elements. 2348a49e3674e44104e34342d2c35ece7cb4f9bd96cbTed Kremenek // e.g: static int* myArray[] = {}; 2349a49e3674e44104e34342d2c35ece7cb4f9bd96cbTed Kremenek if (NumInitElements == 0) { 2350c8413fd03f73084a5c93028f8b4db619fc388087Ted Kremenek SVal V = svalBuilder.makeCompoundVal(T, StartVals); 23518e0293406f9d62a293be6be3b1fb89d359f5ea40Ted Kremenek MakeNode(Dst, E, Pred, state->BindExpr(E, V)); 2352a49e3674e44104e34342d2c35ece7cb4f9bd96cbTed Kremenek return; 23531eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump } 23541eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 2355a49e3674e44104e34342d2c35ece7cb4f9bd96cbTed Kremenek // Create a worklist to process the initializers. 2356a49e3674e44104e34342d2c35ece7cb4f9bd96cbTed Kremenek llvm::SmallVector<InitListWLItem, 10> WorkList; 23571eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump WorkList.reserve(NumInitElements); 23581eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump WorkList.push_back(InitListWLItem(Pred, StartVals, E->rbegin())); 235903509aea098772644bf4662dc1c88634818ceeccZhongxing Xu InitListExpr::const_reverse_iterator ItrEnd = E->rend(); 2360cf54959eae25fb3050f41833f0eab91042fb1269Ted Kremenek assert(!(E->rbegin() == E->rend())); 23611eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 2362a49e3674e44104e34342d2c35ece7cb4f9bd96cbTed Kremenek // Process the worklist until it is empty. 2363f75b186893b3461610668dbb627d6f95abead973Ted Kremenek while (!WorkList.empty()) { 2364f75b186893b3461610668dbb627d6f95abead973Ted Kremenek InitListWLItem X = WorkList.back(); 2365f75b186893b3461610668dbb627d6f95abead973Ted Kremenek WorkList.pop_back(); 23661eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 2367031ccc0555a82afc2e8afe29e19dd57ff204e2deZhongxing Xu ExplodedNodeSet Tmp; 2368f75b186893b3461610668dbb627d6f95abead973Ted Kremenek Visit(*X.Itr, X.N, Tmp); 23691eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 237003509aea098772644bf4662dc1c88634818ceeccZhongxing Xu InitListExpr::const_reverse_iterator NewItr = X.Itr + 1; 2371c4f8706b6539e06a5de153bd72850bb2e0a71456Zhongxing Xu 2372bb141217871e93767aa3f2de1b9946fa6d37066aZhongxing Xu for (ExplodedNodeSet::iterator NI=Tmp.begin(),NE=Tmp.end();NI!=NE;++NI) { 2373f75b186893b3461610668dbb627d6f95abead973Ted Kremenek // Get the last initializer value. 2374f75b186893b3461610668dbb627d6f95abead973Ted Kremenek state = GetState(*NI); 23751397663af9dbcc24dbf0e11de43931b3dc08fdbbTed Kremenek SVal InitV = state->getSVal(cast<Expr>(*X.Itr)); 23761eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 2377f75b186893b3461610668dbb627d6f95abead973Ted Kremenek // Construct the new list of values by prepending the new value to 2378f75b186893b3461610668dbb627d6f95abead973Ted Kremenek // the already constructed list. 2379f75b186893b3461610668dbb627d6f95abead973Ted Kremenek llvm::ImmutableList<SVal> NewVals = 2380f75b186893b3461610668dbb627d6f95abead973Ted Kremenek getBasicVals().consVals(InitV, X.Vals); 23811eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 2382f75b186893b3461610668dbb627d6f95abead973Ted Kremenek if (NewItr == ItrEnd) { 2383a189dcaf0315ce86e76ea1491e739357b6f3f620Zhongxing Xu // Now we have a list holding all init values. Make CompoundValData. 2384c8413fd03f73084a5c93028f8b4db619fc388087Ted Kremenek SVal V = svalBuilder.makeCompoundVal(T, NewVals); 2385c4f8706b6539e06a5de153bd72850bb2e0a71456Zhongxing Xu 2386f75b186893b3461610668dbb627d6f95abead973Ted Kremenek // Make final state and node. 23878e0293406f9d62a293be6be3b1fb89d359f5ea40Ted Kremenek MakeNode(Dst, E, *NI, state->BindExpr(E, V)); 2388f75b186893b3461610668dbb627d6f95abead973Ted Kremenek } 2389f75b186893b3461610668dbb627d6f95abead973Ted Kremenek else { 2390f75b186893b3461610668dbb627d6f95abead973Ted Kremenek // Still some initializer values to go. Push them onto the worklist. 2391f75b186893b3461610668dbb627d6f95abead973Ted Kremenek WorkList.push_back(InitListWLItem(*NI, NewVals, NewItr)); 2392f75b186893b3461610668dbb627d6f95abead973Ted Kremenek } 2393f75b186893b3461610668dbb627d6f95abead973Ted Kremenek } 2394f75b186893b3461610668dbb627d6f95abead973Ted Kremenek } 23951eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 23968790307d116eef2c23d665ca75d1e44db232117cTed Kremenek return; 2397c4f8706b6539e06a5de153bd72850bb2e0a71456Zhongxing Xu } 2398c4f8706b6539e06a5de153bd72850bb2e0a71456Zhongxing Xu 23997dfc9420babe83e236a47e752f8723bd06070d9dZhanyong Wan if (Loc::isLocType(T) || T->isIntegerType()) { 2400c4f8706b6539e06a5de153bd72850bb2e0a71456Zhongxing Xu assert (E->getNumInits() == 1); 2401031ccc0555a82afc2e8afe29e19dd57ff204e2deZhongxing Xu ExplodedNodeSet Tmp; 240203509aea098772644bf4662dc1c88634818ceeccZhongxing Xu const Expr* Init = E->getInit(0); 2403c4f8706b6539e06a5de153bd72850bb2e0a71456Zhongxing Xu Visit(Init, Pred, Tmp); 2404bb141217871e93767aa3f2de1b9946fa6d37066aZhongxing Xu for (ExplodedNodeSet::iterator I=Tmp.begin(), EI=Tmp.end(); I != EI; ++I) { 2405c4f8706b6539e06a5de153bd72850bb2e0a71456Zhongxing Xu state = GetState(*I); 24061397663af9dbcc24dbf0e11de43931b3dc08fdbbTed Kremenek MakeNode(Dst, E, *I, state->BindExpr(E, state->getSVal(Init))); 2407c4f8706b6539e06a5de153bd72850bb2e0a71456Zhongxing Xu } 2408c4f8706b6539e06a5de153bd72850bb2e0a71456Zhongxing Xu return; 2409c4f8706b6539e06a5de153bd72850bb2e0a71456Zhongxing Xu } 2410c4f8706b6539e06a5de153bd72850bb2e0a71456Zhongxing Xu 2411c4f8706b6539e06a5de153bd72850bb2e0a71456Zhongxing Xu assert(0 && "unprocessed InitListExpr type"); 2412c4f8706b6539e06a5de153bd72850bb2e0a71456Zhongxing Xu} 2413f233d48cfc513b045e2c2cfca5c175220fbd0a82Ted Kremenek 2414f4e3cfbe8abd124be6341ef5d714819b4fbd9082Peter Collingbourne/// VisitUnaryExprOrTypeTraitExpr - Transfer function for sizeof(type). 2415f4e3cfbe8abd124be6341ef5d714819b4fbd9082Peter Collingbournevoid ExprEngine::VisitUnaryExprOrTypeTraitExpr( 2416f4e3cfbe8abd124be6341ef5d714819b4fbd9082Peter Collingbourne const UnaryExprOrTypeTraitExpr* Ex, 2417031ccc0555a82afc2e8afe29e19dd57ff204e2deZhongxing Xu ExplodedNode* Pred, 2418031ccc0555a82afc2e8afe29e19dd57ff204e2deZhongxing Xu ExplodedNodeSet& Dst) { 24190518999d3adcc289997bd974dce90cc97f5c1c44Sebastian Redl QualType T = Ex->getTypeOfArgument(); 24201eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 2421f4e3cfbe8abd124be6341ef5d714819b4fbd9082Peter Collingbourne if (Ex->getKind() == UETT_SizeOf) { 2422f4e3cfbe8abd124be6341ef5d714819b4fbd9082Peter Collingbourne if (!T->isIncompleteType() && !T->isConstantSizeType()) { 2423b7e3aabf8f0fe4210d6a0aaec8a2b5770cab9186Jordy Rose assert(T->isVariableArrayType() && "Unknown non-constant-sized type."); 2424b7e3aabf8f0fe4210d6a0aaec8a2b5770cab9186Jordy Rose 2425b7e3aabf8f0fe4210d6a0aaec8a2b5770cab9186Jordy Rose // FIXME: Add support for VLA type arguments, not just VLA expressions. 2426b7e3aabf8f0fe4210d6a0aaec8a2b5770cab9186Jordy Rose // When that happens, we should probably refactor VLASizeChecker's code. 2427b7e3aabf8f0fe4210d6a0aaec8a2b5770cab9186Jordy Rose if (Ex->isArgumentType()) { 2428b7e3aabf8f0fe4210d6a0aaec8a2b5770cab9186Jordy Rose Dst.Add(Pred); 2429b7e3aabf8f0fe4210d6a0aaec8a2b5770cab9186Jordy Rose return; 2430b7e3aabf8f0fe4210d6a0aaec8a2b5770cab9186Jordy Rose } 2431b7e3aabf8f0fe4210d6a0aaec8a2b5770cab9186Jordy Rose 2432b7e3aabf8f0fe4210d6a0aaec8a2b5770cab9186Jordy Rose // Get the size by getting the extent of the sub-expression. 2433b7e3aabf8f0fe4210d6a0aaec8a2b5770cab9186Jordy Rose // First, visit the sub-expression to find its region. 243403509aea098772644bf4662dc1c88634818ceeccZhongxing Xu const Expr *Arg = Ex->getArgumentExpr(); 2435b7e3aabf8f0fe4210d6a0aaec8a2b5770cab9186Jordy Rose ExplodedNodeSet Tmp; 2436892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek Visit(Arg, Pred, Tmp); 2437b7e3aabf8f0fe4210d6a0aaec8a2b5770cab9186Jordy Rose 2438b7e3aabf8f0fe4210d6a0aaec8a2b5770cab9186Jordy Rose for (ExplodedNodeSet::iterator I=Tmp.begin(), E=Tmp.end(); I!=E; ++I) { 2439b7e3aabf8f0fe4210d6a0aaec8a2b5770cab9186Jordy Rose const GRState* state = GetState(*I); 2440b7e3aabf8f0fe4210d6a0aaec8a2b5770cab9186Jordy Rose const MemRegion *MR = state->getSVal(Arg).getAsRegion(); 2441b7e3aabf8f0fe4210d6a0aaec8a2b5770cab9186Jordy Rose 2442b7e3aabf8f0fe4210d6a0aaec8a2b5770cab9186Jordy Rose // If the subexpression can't be resolved to a region, we don't know 2443b7e3aabf8f0fe4210d6a0aaec8a2b5770cab9186Jordy Rose // anything about its size. Just leave the state as is and continue. 2444b7e3aabf8f0fe4210d6a0aaec8a2b5770cab9186Jordy Rose if (!MR) { 2445b7e3aabf8f0fe4210d6a0aaec8a2b5770cab9186Jordy Rose Dst.Add(*I); 2446b7e3aabf8f0fe4210d6a0aaec8a2b5770cab9186Jordy Rose continue; 2447b7e3aabf8f0fe4210d6a0aaec8a2b5770cab9186Jordy Rose } 2448b7e3aabf8f0fe4210d6a0aaec8a2b5770cab9186Jordy Rose 2449b7e3aabf8f0fe4210d6a0aaec8a2b5770cab9186Jordy Rose // The result is the extent of the VLA. 2450c8413fd03f73084a5c93028f8b4db619fc388087Ted Kremenek SVal Extent = cast<SubRegion>(MR)->getExtent(svalBuilder); 2451b7e3aabf8f0fe4210d6a0aaec8a2b5770cab9186Jordy Rose MakeNode(Dst, Ex, *I, state->BindExpr(Ex, Extent)); 2452b7e3aabf8f0fe4210d6a0aaec8a2b5770cab9186Jordy Rose } 2453b7e3aabf8f0fe4210d6a0aaec8a2b5770cab9186Jordy Rose 245487e8034faf994b1e13143e6e0b5062a38d979d21Ted Kremenek return; 245555f7bcbda37964d3c0e8928d0e50a6e1692b7dceTed Kremenek } 2456c12c5bba6ceb6acd4e51e7a0fc03257da9cfd44eJohn McCall else if (T->getAs<ObjCObjectType>()) { 2457c12c5bba6ceb6acd4e51e7a0fc03257da9cfd44eJohn McCall // Some code tries to take the sizeof an ObjCObjectType, relying that 245855f7bcbda37964d3c0e8928d0e50a6e1692b7dceTed Kremenek // the compiler has laid out its representation. Just report Unknown 24591eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump // for these. 246061e8e1b84292e882553a47edec830a79606c78f4Ted Kremenek Dst.Add(Pred); 2461f342d1887c9b2ef24d029c0546d536e2277b9976Ted Kremenek return; 246255f7bcbda37964d3c0e8928d0e50a6e1692b7dceTed Kremenek } 246387e8034faf994b1e13143e6e0b5062a38d979d21Ted Kremenek } 2464f4e3cfbe8abd124be6341ef5d714819b4fbd9082Peter Collingbourne 2465f4e3cfbe8abd124be6341ef5d714819b4fbd9082Peter Collingbourne Expr::EvalResult Result; 2466f4e3cfbe8abd124be6341ef5d714819b4fbd9082Peter Collingbourne Ex->Evaluate(Result, getContext()); 2467f4e3cfbe8abd124be6341ef5d714819b4fbd9082Peter Collingbourne CharUnits amt = CharUnits::fromQuantity(Result.Val.getInt().getZExtValue()); 24681eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 24690e561a3e6755c4f248a8bb05d49071ddf4f2ef7bTed Kremenek MakeNode(Dst, Ex, Pred, 2470b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek GetState(Pred)->BindExpr(Ex, 2471c8413fd03f73084a5c93028f8b4db619fc388087Ted Kremenek svalBuilder.makeIntVal(amt.getQuantity(), Ex->getType()))); 2472469ecbded3616416ef938ed94a67f86149faf226Ted Kremenek} 2473469ecbded3616416ef938ed94a67f86149faf226Ted Kremenek 2474d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidisvoid ExprEngine::VisitOffsetOfExpr(const OffsetOfExpr* OOE, 247503509aea098772644bf4662dc1c88634818ceeccZhongxing Xu ExplodedNode* Pred, ExplodedNodeSet& Dst) { 24768ecdb65716cd7914ffb2eeee993fa9039fcd31e8Douglas Gregor Expr::EvalResult Res; 24778ecdb65716cd7914ffb2eeee993fa9039fcd31e8Douglas Gregor if (OOE->Evaluate(Res, getContext()) && Res.Val.isInt()) { 24788ecdb65716cd7914ffb2eeee993fa9039fcd31e8Douglas Gregor const APSInt &IV = Res.Val.getInt(); 24798ecdb65716cd7914ffb2eeee993fa9039fcd31e8Douglas Gregor assert(IV.getBitWidth() == getContext().getTypeSize(OOE->getType())); 24808ecdb65716cd7914ffb2eeee993fa9039fcd31e8Douglas Gregor assert(OOE->getType()->isIntegerType()); 24818ecdb65716cd7914ffb2eeee993fa9039fcd31e8Douglas Gregor assert(IV.isSigned() == OOE->getType()->isSignedIntegerType()); 2482c8413fd03f73084a5c93028f8b4db619fc388087Ted Kremenek SVal X = svalBuilder.makeIntVal(IV); 24838ecdb65716cd7914ffb2eeee993fa9039fcd31e8Douglas Gregor MakeNode(Dst, OOE, Pred, GetState(Pred)->BindExpr(OOE, X)); 24848ecdb65716cd7914ffb2eeee993fa9039fcd31e8Douglas Gregor return; 24858ecdb65716cd7914ffb2eeee993fa9039fcd31e8Douglas Gregor } 24868ecdb65716cd7914ffb2eeee993fa9039fcd31e8Douglas Gregor // FIXME: Handle the case where __builtin_offsetof is not a constant. 24878ecdb65716cd7914ffb2eeee993fa9039fcd31e8Douglas Gregor Dst.Add(Pred); 24888ecdb65716cd7914ffb2eeee993fa9039fcd31e8Douglas Gregor} 2489d8e9f0dc737133d4e8342f39389064620f5a7f8fTed Kremenek 2490d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidisvoid ExprEngine::VisitUnaryOperator(const UnaryOperator* U, 249103509aea098772644bf4662dc1c88634818ceeccZhongxing Xu ExplodedNode* Pred, 2492892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek ExplodedNodeSet& Dst) { 24931b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek 2494d8e9f0dc737133d4e8342f39389064620f5a7f8fTed Kremenek switch (U->getOpcode()) { 24951eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 2496d8e9f0dc737133d4e8342f39389064620f5a7f8fTed Kremenek default: 2497d8e9f0dc737133d4e8342f39389064620f5a7f8fTed Kremenek break; 24981eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 24992de56d1d0c3a504ad1529de2677628bdfbb95cd4John McCall case UO_Real: { 250003509aea098772644bf4662dc1c88634818ceeccZhongxing Xu const Expr* Ex = U->getSubExpr()->IgnoreParens(); 2501031ccc0555a82afc2e8afe29e19dd57ff204e2deZhongxing Xu ExplodedNodeSet Tmp; 2502b8e26e63d9dcc09351d75677721c6c9ff7045b54Ted Kremenek Visit(Ex, Pred, Tmp); 25031eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 2504031ccc0555a82afc2e8afe29e19dd57ff204e2deZhongxing Xu for (ExplodedNodeSet::iterator I=Tmp.begin(), E=Tmp.end(); I!=E; ++I) { 25051eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 25061c96b24285d05c0eac455ae96d7c9ff43d42bc96Zhongxing Xu // FIXME: We don't have complex SValues yet. 2507b8e26e63d9dcc09351d75677721c6c9ff7045b54Ted Kremenek if (Ex->getType()->isAnyComplexType()) { 2508b8e26e63d9dcc09351d75677721c6c9ff7045b54Ted Kremenek // Just report "Unknown." 2509b8e26e63d9dcc09351d75677721c6c9ff7045b54Ted Kremenek Dst.Add(*I); 2510b8e26e63d9dcc09351d75677721c6c9ff7045b54Ted Kremenek continue; 2511b8e26e63d9dcc09351d75677721c6c9ff7045b54Ted Kremenek } 25121eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 25132de56d1d0c3a504ad1529de2677628bdfbb95cd4John McCall // For all other types, UO_Real is an identity operation. 2514b8e26e63d9dcc09351d75677721c6c9ff7045b54Ted Kremenek assert (U->getType() == Ex->getType()); 2515a8538d902fce9cfec20f39b34492268b51643819Ted Kremenek const GRState* state = GetState(*I); 25161397663af9dbcc24dbf0e11de43931b3dc08fdbbTed Kremenek MakeNode(Dst, U, *I, state->BindExpr(U, state->getSVal(Ex))); 25171eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump } 25181eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 2519b8e26e63d9dcc09351d75677721c6c9ff7045b54Ted Kremenek return; 2520b8e26e63d9dcc09351d75677721c6c9ff7045b54Ted Kremenek } 25211eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 25222de56d1d0c3a504ad1529de2677628bdfbb95cd4John McCall case UO_Imag: { 25231eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 252403509aea098772644bf4662dc1c88634818ceeccZhongxing Xu const Expr* Ex = U->getSubExpr()->IgnoreParens(); 2525031ccc0555a82afc2e8afe29e19dd57ff204e2deZhongxing Xu ExplodedNodeSet Tmp; 2526b8e26e63d9dcc09351d75677721c6c9ff7045b54Ted Kremenek Visit(Ex, Pred, Tmp); 25271eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 2528031ccc0555a82afc2e8afe29e19dd57ff204e2deZhongxing Xu for (ExplodedNodeSet::iterator I=Tmp.begin(), E=Tmp.end(); I!=E; ++I) { 25291c96b24285d05c0eac455ae96d7c9ff43d42bc96Zhongxing Xu // FIXME: We don't have complex SValues yet. 2530b8e26e63d9dcc09351d75677721c6c9ff7045b54Ted Kremenek if (Ex->getType()->isAnyComplexType()) { 2531b8e26e63d9dcc09351d75677721c6c9ff7045b54Ted Kremenek // Just report "Unknown." 2532b8e26e63d9dcc09351d75677721c6c9ff7045b54Ted Kremenek Dst.Add(*I); 2533b8e26e63d9dcc09351d75677721c6c9ff7045b54Ted Kremenek continue; 2534b8e26e63d9dcc09351d75677721c6c9ff7045b54Ted Kremenek } 25351eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 25362de56d1d0c3a504ad1529de2677628bdfbb95cd4John McCall // For all other types, UO_Imag returns 0. 2537a8538d902fce9cfec20f39b34492268b51643819Ted Kremenek const GRState* state = GetState(*I); 2538c8413fd03f73084a5c93028f8b4db619fc388087Ted Kremenek SVal X = svalBuilder.makeZeroVal(Ex->getType()); 25398e0293406f9d62a293be6be3b1fb89d359f5ea40Ted Kremenek MakeNode(Dst, U, *I, state->BindExpr(U, X)); 2540b8e26e63d9dcc09351d75677721c6c9ff7045b54Ted Kremenek } 25411eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 2542b8e26e63d9dcc09351d75677721c6c9ff7045b54Ted Kremenek return; 2543b8e26e63d9dcc09351d75677721c6c9ff7045b54Ted Kremenek } 25448ecdb65716cd7914ffb2eeee993fa9039fcd31e8Douglas Gregor 2545892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek case UO_Plus: 2546892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek assert(!U->isLValue()); 2547892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek // FALL-THROUGH. 2548892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek case UO_Deref: 25499c2bac02c1d1204bcf2c5a025ab901d09bc7ae26Zhongxing Xu case UO_AddrOf: 25502de56d1d0c3a504ad1529de2677628bdfbb95cd4John McCall case UO_Extension: { 25511eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 25521b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek // Unary "+" is a no-op, similar to a parentheses. We still have places 25531b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek // where it may be a block-level expression, so we need to 25541b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek // generate an extra node that just propagates the value of the 25551b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek // subexpression. 25561b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek 255703509aea098772644bf4662dc1c88634818ceeccZhongxing Xu const Expr* Ex = U->getSubExpr()->IgnoreParens(); 2558031ccc0555a82afc2e8afe29e19dd57ff204e2deZhongxing Xu ExplodedNodeSet Tmp; 2559892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek Visit(Ex, Pred, Tmp); 25601eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 25611eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump for (ExplodedNodeSet::iterator I=Tmp.begin(), E=Tmp.end(); I!=E; ++I) { 2562a8538d902fce9cfec20f39b34492268b51643819Ted Kremenek const GRState* state = GetState(*I); 25631397663af9dbcc24dbf0e11de43931b3dc08fdbbTed Kremenek MakeNode(Dst, U, *I, state->BindExpr(U, state->getSVal(Ex))); 25641b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek } 25651eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 25661b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek return; 25671b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek } 25681eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 25692de56d1d0c3a504ad1529de2677628bdfbb95cd4John McCall case UO_LNot: 25702de56d1d0c3a504ad1529de2677628bdfbb95cd4John McCall case UO_Minus: 25712de56d1d0c3a504ad1529de2677628bdfbb95cd4John McCall case UO_Not: { 2572892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek assert (!U->isLValue()); 257303509aea098772644bf4662dc1c88634818ceeccZhongxing Xu const Expr* Ex = U->getSubExpr()->IgnoreParens(); 2574031ccc0555a82afc2e8afe29e19dd57ff204e2deZhongxing Xu ExplodedNodeSet Tmp; 25751b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek Visit(Ex, Pred, Tmp); 25761eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 25771eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump for (ExplodedNodeSet::iterator I=Tmp.begin(), E=Tmp.end(); I!=E; ++I) { 2578a8538d902fce9cfec20f39b34492268b51643819Ted Kremenek const GRState* state = GetState(*I); 25791eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 2580855cd903beadc056ea300464b46c6c46b91d290fTed Kremenek // Get the value of the subexpression. 25811397663af9dbcc24dbf0e11de43931b3dc08fdbbTed Kremenek SVal V = state->getSVal(Ex); 2582855cd903beadc056ea300464b46c6c46b91d290fTed Kremenek 2583e04a5cb9afb5faa205c0bfa93103d6df691e05b2Ted Kremenek if (V.isUnknownOrUndef()) { 25848e0293406f9d62a293be6be3b1fb89d359f5ea40Ted Kremenek MakeNode(Dst, U, *I, state->BindExpr(U, V)); 2585e04a5cb9afb5faa205c0bfa93103d6df691e05b2Ted Kremenek continue; 2586e04a5cb9afb5faa205c0bfa93103d6df691e05b2Ted Kremenek } 25871eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 258860595dab8bd9800f6b0b724fa4d859ada78c264fTed Kremenek// QualType DstT = getContext().getCanonicalType(U->getType()); 258960595dab8bd9800f6b0b724fa4d859ada78c264fTed Kremenek// QualType SrcT = getContext().getCanonicalType(Ex->getType()); 25901eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump// 259160595dab8bd9800f6b0b724fa4d859ada78c264fTed Kremenek// if (DstT != SrcT) // Perform promotions. 25929c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek// V = evalCast(V, DstT); 25931eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump// 259460595dab8bd9800f6b0b724fa4d859ada78c264fTed Kremenek// if (V.isUnknownOrUndef()) { 259560595dab8bd9800f6b0b724fa4d859ada78c264fTed Kremenek// MakeNode(Dst, U, *I, BindExpr(St, U, V)); 259660595dab8bd9800f6b0b724fa4d859ada78c264fTed Kremenek// continue; 259760595dab8bd9800f6b0b724fa4d859ada78c264fTed Kremenek// } 25981eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 25991b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek switch (U->getOpcode()) { 26001b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek default: 26011b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek assert(false && "Invalid Opcode."); 26021b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek break; 26031eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 26042de56d1d0c3a504ad1529de2677628bdfbb95cd4John McCall case UO_Not: 260560a6e0ce72a24d6247602625c631fc3dc7bfd8d4Ted Kremenek // FIXME: Do we need to handle promotions? 26069c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek state = state->BindExpr(U, evalComplement(cast<NonLoc>(V))); 26071eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump break; 26081eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 26092de56d1d0c3a504ad1529de2677628bdfbb95cd4John McCall case UO_Minus: 261060a6e0ce72a24d6247602625c631fc3dc7bfd8d4Ted Kremenek // FIXME: Do we need to handle promotions? 26119c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek state = state->BindExpr(U, evalMinus(cast<NonLoc>(V))); 26121eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump break; 26131eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 26142de56d1d0c3a504ad1529de2677628bdfbb95cd4John McCall case UO_LNot: 26151eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 26161b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek // C99 6.5.3.3: "The expression !E is equivalent to (0==E)." 26171b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek // 26181b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek // Note: technically we do "E == 0", but this is the same in the 26191b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek // transfer functions as "0 == E". 26206c07bdba93b095b66e2c8c82dd5ed458fa8285eaTed Kremenek SVal Result; 26211eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 26221c96b24285d05c0eac455ae96d7c9ff43d42bc96Zhongxing Xu if (isa<Loc>(V)) { 2623c8413fd03f73084a5c93028f8b4db619fc388087Ted Kremenek Loc X = svalBuilder.makeNull(); 26249c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek Result = evalBinOp(state, BO_EQ, cast<Loc>(V), X, 26256c07bdba93b095b66e2c8c82dd5ed458fa8285eaTed Kremenek U->getType()); 26261b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek } 26271b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek else { 262860595dab8bd9800f6b0b724fa4d859ada78c264fTed Kremenek nonloc::ConcreteInt X(getBasicVals().getValue(0, Ex->getType())); 26299c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek Result = evalBinOp(state, BO_EQ, cast<NonLoc>(V), X, 26306c07bdba93b095b66e2c8c82dd5ed458fa8285eaTed Kremenek U->getType()); 26311b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek } 26321eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 26338e0293406f9d62a293be6be3b1fb89d359f5ea40Ted Kremenek state = state->BindExpr(U, Result); 26341eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 26351b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek break; 26361b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek } 26371eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 2638a8538d902fce9cfec20f39b34492268b51643819Ted Kremenek MakeNode(Dst, U, *I, state); 26391b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek } 26401eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 26411b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek return; 26421b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek } 26437b8009a3e3a1479203d315b74712552a4ce3e200Ted Kremenek } 26442ad886836c3a9111f24144a8fe5da3d72958a01cTed Kremenek 26451b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek // Handle ++ and -- (both pre- and post-increment). 26461b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek assert (U->isIncrementDecrementOp()); 2647031ccc0555a82afc2e8afe29e19dd57ff204e2deZhongxing Xu ExplodedNodeSet Tmp; 264803509aea098772644bf4662dc1c88634818ceeccZhongxing Xu const Expr* Ex = U->getSubExpr()->IgnoreParens(); 2649892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek Visit(Ex, Pred, Tmp); 26501eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 2651031ccc0555a82afc2e8afe29e19dd57ff204e2deZhongxing Xu for (ExplodedNodeSet::iterator I = Tmp.begin(), E = Tmp.end(); I!=E; ++I) { 26521eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 2653a8538d902fce9cfec20f39b34492268b51643819Ted Kremenek const GRState* state = GetState(*I); 2654250704bc525361e8612ea01f245a41a1193c13f0Zhongxing Xu SVal loc = state->getSVal(Ex); 26551eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 26561eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump // Perform a load. 2657031ccc0555a82afc2e8afe29e19dd57ff204e2deZhongxing Xu ExplodedNodeSet Tmp2; 2658250704bc525361e8612ea01f245a41a1193c13f0Zhongxing Xu evalLoad(Tmp2, Ex, *I, state, loc); 2659540cbe2b60294fe7b926c26b4f1840f544fe3011Ted Kremenek 2660bb141217871e93767aa3f2de1b9946fa6d37066aZhongxing Xu for (ExplodedNodeSet::iterator I2=Tmp2.begin(), E2=Tmp2.end();I2!=E2;++I2) { 26611eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 2662a8538d902fce9cfec20f39b34492268b51643819Ted Kremenek state = GetState(*I2); 26631397663af9dbcc24dbf0e11de43931b3dc08fdbbTed Kremenek SVal V2_untested = state->getSVal(Ex); 26641eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 26651eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump // Propagate unknown and undefined values. 26665b9bd2137ebef350af803c634e3fdf5d74678100Ted Kremenek if (V2_untested.isUnknownOrUndef()) { 26675b9bd2137ebef350af803c634e3fdf5d74678100Ted Kremenek MakeNode(Dst, U, *I2, state->BindExpr(U, V2_untested)); 26681b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek continue; 2669b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek } 26705b9bd2137ebef350af803c634e3fdf5d74678100Ted Kremenek DefinedSVal V2 = cast<DefinedSVal>(V2_untested); 26711eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 26721eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump // Handle all other values. 26732de56d1d0c3a504ad1529de2677628bdfbb95cd4John McCall BinaryOperator::Opcode Op = U->isIncrementOp() ? BO_Add 26742de56d1d0c3a504ad1529de2677628bdfbb95cd4John McCall : BO_Sub; 267521028dd8850c64a414f7a82dfddcc291351203d6Ted Kremenek 2676a52ad4e1f423bed2e9e0dcb12661268091d20a54Zhongxing Xu // If the UnaryOperator has non-location type, use its type to create the 2677a52ad4e1f423bed2e9e0dcb12661268091d20a54Zhongxing Xu // constant value. If the UnaryOperator has location type, create the 2678a52ad4e1f423bed2e9e0dcb12661268091d20a54Zhongxing Xu // constant with int type and pointer width. 2679a52ad4e1f423bed2e9e0dcb12661268091d20a54Zhongxing Xu SVal RHS; 2680a52ad4e1f423bed2e9e0dcb12661268091d20a54Zhongxing Xu 2681a52ad4e1f423bed2e9e0dcb12661268091d20a54Zhongxing Xu if (U->getType()->isAnyPointerType()) 2682a6b0b96e5376cd9cf182a3e240e0537feed43cdeTed Kremenek RHS = svalBuilder.makeArrayIndex(1); 2683a52ad4e1f423bed2e9e0dcb12661268091d20a54Zhongxing Xu else 2684c8413fd03f73084a5c93028f8b4db619fc388087Ted Kremenek RHS = svalBuilder.makeIntVal(1, U->getType()); 2685a52ad4e1f423bed2e9e0dcb12661268091d20a54Zhongxing Xu 26869c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek SVal Result = evalBinOp(state, Op, V2, RHS, U->getType()); 26871eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 2688bb9b2711ded08d39f9c9aa08b06ac5e288f32c62Ted Kremenek // Conjure a new symbol if necessary to recover precision. 2689af48fdd35633f53c74e982ba7922ca7b2051c1f5Ted Kremenek if (Result.isUnknown() || !getConstraintManager().canReasonAbout(Result)){ 26905b9bd2137ebef350af803c634e3fdf5d74678100Ted Kremenek DefinedOrUnknownSVal SymVal = 2691c8413fd03f73084a5c93028f8b4db619fc388087Ted Kremenek svalBuilder.getConjuredSymbolVal(NULL, Ex, 26928780679b02bea5ab6360f3f8ebf3b221aaeda93fTed Kremenek Builder->getCurrentBlockCount()); 26935b9bd2137ebef350af803c634e3fdf5d74678100Ted Kremenek Result = SymVal; 26941eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 2695af48fdd35633f53c74e982ba7922ca7b2051c1f5Ted Kremenek // If the value is a location, ++/-- should always preserve 26966c07bdba93b095b66e2c8c82dd5ed458fa8285eaTed Kremenek // non-nullness. Check if the original value was non-null, and if so 26971eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump // propagate that constraint. 26987dfc9420babe83e236a47e752f8723bd06070d9dZhanyong Wan if (Loc::isLocType(U->getType())) { 26995b9bd2137ebef350af803c634e3fdf5d74678100Ted Kremenek DefinedOrUnknownSVal Constraint = 2700250704bc525361e8612ea01f245a41a1193c13f0Zhongxing Xu svalBuilder.evalEQ(state, V2,svalBuilder.makeZeroVal(U->getType())); 27011eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 270228f47b92e760ccf641ac91cb0fe1c12d9ca89795Ted Kremenek if (!state->assume(Constraint, true)) { 2703af48fdd35633f53c74e982ba7922ca7b2051c1f5Ted Kremenek // It isn't feasible for the original value to be null. 2704af48fdd35633f53c74e982ba7922ca7b2051c1f5Ted Kremenek // Propagate this constraint. 27059c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek Constraint = svalBuilder.evalEQ(state, SymVal, 2706c8413fd03f73084a5c93028f8b4db619fc388087Ted Kremenek svalBuilder.makeZeroVal(U->getType())); 27075b9bd2137ebef350af803c634e3fdf5d74678100Ted Kremenek 27081eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 270928f47b92e760ccf641ac91cb0fe1c12d9ca89795Ted Kremenek state = state->assume(Constraint, false); 2710a591bc04d21fa62ebffcb2c7814d738ca8f5e2f9Ted Kremenek assert(state); 27111eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump } 27121eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump } 2713af48fdd35633f53c74e982ba7922ca7b2051c1f5Ted Kremenek } 27141eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 2715250704bc525361e8612ea01f245a41a1193c13f0Zhongxing Xu // Since the lvalue-to-rvalue conversion is explicit in the AST, 2716250704bc525361e8612ea01f245a41a1193c13f0Zhongxing Xu // we bind an l-value if the operator is prefix and an lvalue (in C++). 2717b08624414a923e0df93dd7630fee51b0ff3cb7b1Zhongxing Xu if (U->isLValue()) 2718250704bc525361e8612ea01f245a41a1193c13f0Zhongxing Xu state = state->BindExpr(U, loc); 2719250704bc525361e8612ea01f245a41a1193c13f0Zhongxing Xu else 2720250704bc525361e8612ea01f245a41a1193c13f0Zhongxing Xu state = state->BindExpr(U, V2); 27211b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek 27221eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump // Perform the store. 2723250704bc525361e8612ea01f245a41a1193c13f0Zhongxing Xu evalStore(Dst, NULL, U, *I2, state, loc, Result); 27245b6dc2d72bf1bcf2b61fe5dbcd57bfa4aee76b29Ted Kremenek } 2725469ecbded3616416ef938ed94a67f86149faf226Ted Kremenek } 27265b6dc2d72bf1bcf2b61fe5dbcd57bfa4aee76b29Ted Kremenek} 27275b6dc2d72bf1bcf2b61fe5dbcd57bfa4aee76b29Ted Kremenek 2728d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidisvoid ExprEngine::VisitAsmStmt(const AsmStmt* A, ExplodedNode* Pred, 2729bb141217871e93767aa3f2de1b9946fa6d37066aZhongxing Xu ExplodedNodeSet& Dst) { 2730ef44bfb9d0f15ba0391f8346c9f01355fb450a09Ted Kremenek VisitAsmStmtHelperOutputs(A, A->begin_outputs(), A->end_outputs(), Pred, Dst); 27311eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump} 2732ef44bfb9d0f15ba0391f8346c9f01355fb450a09Ted Kremenek 2733d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidisvoid ExprEngine::VisitAsmStmtHelperOutputs(const AsmStmt* A, 273403509aea098772644bf4662dc1c88634818ceeccZhongxing Xu AsmStmt::const_outputs_iterator I, 273503509aea098772644bf4662dc1c88634818ceeccZhongxing Xu AsmStmt::const_outputs_iterator E, 2736bb141217871e93767aa3f2de1b9946fa6d37066aZhongxing Xu ExplodedNode* Pred, ExplodedNodeSet& Dst) { 2737ef44bfb9d0f15ba0391f8346c9f01355fb450a09Ted Kremenek if (I == E) { 2738ef44bfb9d0f15ba0391f8346c9f01355fb450a09Ted Kremenek VisitAsmStmtHelperInputs(A, A->begin_inputs(), A->end_inputs(), Pred, Dst); 2739ef44bfb9d0f15ba0391f8346c9f01355fb450a09Ted Kremenek return; 2740ef44bfb9d0f15ba0391f8346c9f01355fb450a09Ted Kremenek } 27411eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 2742031ccc0555a82afc2e8afe29e19dd57ff204e2deZhongxing Xu ExplodedNodeSet Tmp; 2743892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek Visit(*I, Pred, Tmp); 2744ef44bfb9d0f15ba0391f8346c9f01355fb450a09Ted Kremenek ++I; 27451eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 2746bb141217871e93767aa3f2de1b9946fa6d37066aZhongxing Xu for (ExplodedNodeSet::iterator NI = Tmp.begin(), NE = Tmp.end();NI != NE;++NI) 2747ef44bfb9d0f15ba0391f8346c9f01355fb450a09Ted Kremenek VisitAsmStmtHelperOutputs(A, I, E, *NI, Dst); 2748ef44bfb9d0f15ba0391f8346c9f01355fb450a09Ted Kremenek} 2749ef44bfb9d0f15ba0391f8346c9f01355fb450a09Ted Kremenek 2750d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidisvoid ExprEngine::VisitAsmStmtHelperInputs(const AsmStmt* A, 275103509aea098772644bf4662dc1c88634818ceeccZhongxing Xu AsmStmt::const_inputs_iterator I, 275203509aea098772644bf4662dc1c88634818ceeccZhongxing Xu AsmStmt::const_inputs_iterator E, 2753b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek ExplodedNode* Pred, 2754bb141217871e93767aa3f2de1b9946fa6d37066aZhongxing Xu ExplodedNodeSet& Dst) { 2755ef44bfb9d0f15ba0391f8346c9f01355fb450a09Ted Kremenek if (I == E) { 27561eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 2757ef44bfb9d0f15ba0391f8346c9f01355fb450a09Ted Kremenek // We have processed both the inputs and the outputs. All of the outputs 27581c96b24285d05c0eac455ae96d7c9ff43d42bc96Zhongxing Xu // should evaluate to Locs. Nuke all of their values. 27591eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 2760ef44bfb9d0f15ba0391f8346c9f01355fb450a09Ted Kremenek // FIXME: Some day in the future it would be nice to allow a "plug-in" 2761ef44bfb9d0f15ba0391f8346c9f01355fb450a09Ted Kremenek // which interprets the inline asm and stores proper results in the 2762ef44bfb9d0f15ba0391f8346c9f01355fb450a09Ted Kremenek // outputs. 27631eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 2764a8538d902fce9cfec20f39b34492268b51643819Ted Kremenek const GRState* state = GetState(Pred); 27651eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 276603509aea098772644bf4662dc1c88634818ceeccZhongxing Xu for (AsmStmt::const_outputs_iterator OI = A->begin_outputs(), 2767ef44bfb9d0f15ba0391f8346c9f01355fb450a09Ted Kremenek OE = A->end_outputs(); OI != OE; ++OI) { 27681eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 27691397663af9dbcc24dbf0e11de43931b3dc08fdbbTed Kremenek SVal X = state->getSVal(*OI); 27701c96b24285d05c0eac455ae96d7c9ff43d42bc96Zhongxing Xu assert (!isa<NonLoc>(X)); // Should be an Lval, or unknown, undef. 27711eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 27721c96b24285d05c0eac455ae96d7c9ff43d42bc96Zhongxing Xu if (isa<Loc>(X)) 27733ff12591494a3cb3d3a24427975df58714ac3b2fTed Kremenek state = state->bindLoc(cast<Loc>(X), UnknownVal()); 2774ef44bfb9d0f15ba0391f8346c9f01355fb450a09Ted Kremenek } 27751eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 2776a8538d902fce9cfec20f39b34492268b51643819Ted Kremenek MakeNode(Dst, A, Pred, state); 2777ef44bfb9d0f15ba0391f8346c9f01355fb450a09Ted Kremenek return; 2778ef44bfb9d0f15ba0391f8346c9f01355fb450a09Ted Kremenek } 27791eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 2780031ccc0555a82afc2e8afe29e19dd57ff204e2deZhongxing Xu ExplodedNodeSet Tmp; 2781ef44bfb9d0f15ba0391f8346c9f01355fb450a09Ted Kremenek Visit(*I, Pred, Tmp); 27821eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 2783ef44bfb9d0f15ba0391f8346c9f01355fb450a09Ted Kremenek ++I; 27841eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 2785e1ccccff777f6bad6b25e9c6a762f98fd8003181Ted Kremenek for (ExplodedNodeSet::iterator NI = Tmp.begin(), NE = Tmp.end(); NI!=NE; ++NI) 2786ef44bfb9d0f15ba0391f8346c9f01355fb450a09Ted Kremenek VisitAsmStmtHelperInputs(A, I, E, *NI, Dst); 2787ef44bfb9d0f15ba0391f8346c9f01355fb450a09Ted Kremenek} 2788ef44bfb9d0f15ba0391f8346c9f01355fb450a09Ted Kremenek 2789d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidisvoid ExprEngine::VisitReturnStmt(const ReturnStmt *RS, ExplodedNode *Pred, 27901053d246f451c399468248625d1146e3d845e21eTed Kremenek ExplodedNodeSet &Dst) { 27911053d246f451c399468248625d1146e3d845e21eTed Kremenek ExplodedNodeSet Src; 279203509aea098772644bf4662dc1c88634818ceeccZhongxing Xu if (const Expr *RetE = RS->getRetValue()) { 2793bd2b2084e58577f17308f910770a5563a344251aZhongxing Xu // Record the returned expression in the state. It will be used in 2794e36de1fe51c39d9161915dd3dbef880954af6476Ted Kremenek // processCallExit to bind the return value to the call expr. 27956190ec29f0895185bbec95a932429b8832917fecZhongxing Xu { 2796b4857264b8d3d861f688cdaa174aab30e0729a73Ted Kremenek static int tag = 0; 27976190ec29f0895185bbec95a932429b8832917fecZhongxing Xu const GRState *state = GetState(Pred); 27986190ec29f0895185bbec95a932429b8832917fecZhongxing Xu state = state->set<ReturnExpr>(RetE); 2799b4857264b8d3d861f688cdaa174aab30e0729a73Ted Kremenek Pred = Builder->generateNode(RetE, state, Pred, &tag); 28006190ec29f0895185bbec95a932429b8832917fecZhongxing Xu } 28016190ec29f0895185bbec95a932429b8832917fecZhongxing Xu // We may get a NULL Pred because we generated a cached node. 28026190ec29f0895185bbec95a932429b8832917fecZhongxing Xu if (Pred) 28036190ec29f0895185bbec95a932429b8832917fecZhongxing Xu Visit(RetE, Pred, Src); 280402737ed29d7fff2206f7c7ee958cdf0665e35542Ted Kremenek } 28051053d246f451c399468248625d1146e3d845e21eTed Kremenek else { 28061053d246f451c399468248625d1146e3d845e21eTed Kremenek Src.Add(Pred); 28071053d246f451c399468248625d1146e3d845e21eTed Kremenek } 2808b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 28091053d246f451c399468248625d1146e3d845e21eTed Kremenek ExplodedNodeSet CheckedSet; 2810eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis getCheckerManager().runCheckersForPreStmt(CheckedSet, Src, RS, *this); 2811b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 28121053d246f451c399468248625d1146e3d845e21eTed Kremenek for (ExplodedNodeSet::iterator I = CheckedSet.begin(), E = CheckedSet.end(); 28131053d246f451c399468248625d1146e3d845e21eTed Kremenek I != E; ++I) { 28146b31e8ed11721505645860f40486e091ecd23dd0Ted Kremenek 2815d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidis assert(Builder && "StmtNodeBuilder must be defined."); 2816b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 28171053d246f451c399468248625d1146e3d845e21eTed Kremenek Pred = *I; 28181053d246f451c399468248625d1146e3d845e21eTed Kremenek unsigned size = Dst.size(); 2819b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 28201053d246f451c399468248625d1146e3d845e21eTed Kremenek SaveAndRestore<bool> OldSink(Builder->BuildSinks); 2821b4857264b8d3d861f688cdaa174aab30e0729a73Ted Kremenek SaveOr OldHasGen(Builder->hasGeneratedNode); 2822b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 28239c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek getTF().evalReturn(Dst, *this, *Builder, RS, Pred); 2824b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 2825b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek // Handle the case where no nodes where generated. 2826b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek if (!Builder->BuildSinks && Dst.size() == size && 2827b4857264b8d3d861f688cdaa174aab30e0729a73Ted Kremenek !Builder->hasGeneratedNode) 28281053d246f451c399468248625d1146e3d845e21eTed Kremenek MakeNode(Dst, RS, Pred, GetState(Pred)); 28295917d7894e8274b9625275dd4dd86c5d0040a242Ted Kremenek } 283002737ed29d7fff2206f7c7ee958cdf0665e35542Ted Kremenek} 283155deb97341819080d6d127d29e25b9502e4f2e3cTed Kremenek 2832e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek//===----------------------------------------------------------------------===// 2833e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek// Transfer functions: Binary operators. 2834e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek//===----------------------------------------------------------------------===// 2835e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek 2836d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidisvoid ExprEngine::VisitBinaryOperator(const BinaryOperator* B, 2837031ccc0555a82afc2e8afe29e19dd57ff204e2deZhongxing Xu ExplodedNode* Pred, 2838892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek ExplodedNodeSet& Dst) { 2839031ccc0555a82afc2e8afe29e19dd57ff204e2deZhongxing Xu ExplodedNodeSet Tmp1; 28401b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek Expr* LHS = B->getLHS()->IgnoreParens(); 28411b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek Expr* RHS = B->getRHS()->IgnoreParens(); 28421eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 2843892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek Visit(LHS, Pred, Tmp1); 2844668399b23cf18124c8c8c41a14a7712212f6fa45Zhongxing Xu ExplodedNodeSet Tmp3; 2845668399b23cf18124c8c8c41a14a7712212f6fa45Zhongxing Xu 2846e1ccccff777f6bad6b25e9c6a762f98fd8003181Ted Kremenek for (ExplodedNodeSet::iterator I1=Tmp1.begin(), E1=Tmp1.end(); I1!=E1; ++I1) { 284759fea60cc3dde7a14eeafab9469cb911023fdd7fZhongxing Xu SVal LeftV = GetState(*I1)->getSVal(LHS); 2848031ccc0555a82afc2e8afe29e19dd57ff204e2deZhongxing Xu ExplodedNodeSet Tmp2; 28491b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek Visit(RHS, *I1, Tmp2); 28506403b57eda05a22273d920ad0bd2991d11eaa7b8Zhongxing Xu 28516403b57eda05a22273d920ad0bd2991d11eaa7b8Zhongxing Xu ExplodedNodeSet CheckedSet; 2852eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis getCheckerManager().runCheckersForPreStmt(CheckedSet, Tmp2, B, *this); 28531eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 28541b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek // With both the LHS and RHS evaluated, process the operation itself. 28551eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 28561eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump for (ExplodedNodeSet::iterator I2=CheckedSet.begin(), E2=CheckedSet.end(); 28576403b57eda05a22273d920ad0bd2991d11eaa7b8Zhongxing Xu I2 != E2; ++I2) { 2858cf78b6a771bb4537d5ee8fa44e718e842c2f70c7Ted Kremenek 28595b9bd2137ebef350af803c634e3fdf5d74678100Ted Kremenek const GRState *state = GetState(*I2); 28601397663af9dbcc24dbf0e11de43931b3dc08fdbbTed Kremenek SVal RightV = state->getSVal(RHS); 28611eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 28625b9bd2137ebef350af803c634e3fdf5d74678100Ted Kremenek BinaryOperator::Opcode Op = B->getOpcode(); 28631eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 28642de56d1d0c3a504ad1529de2677628bdfbb95cd4John McCall if (Op == BO_Assign) { 286573af2d5c92420e9cd8b6a9fefcdc2c744aedda1fZhongxing Xu // EXPERIMENTAL: "Conjured" symbols. 286673af2d5c92420e9cd8b6a9fefcdc2c744aedda1fZhongxing Xu // FIXME: Handle structs. 28670e82a936389ead8f22077d5b021cab4ab7bd9899Ted Kremenek if (RightV.isUnknown() ||!getConstraintManager().canReasonAbout(RightV)) 28680e82a936389ead8f22077d5b021cab4ab7bd9899Ted Kremenek { 286973af2d5c92420e9cd8b6a9fefcdc2c744aedda1fZhongxing Xu unsigned Count = Builder->getCurrentBlockCount(); 2870c8413fd03f73084a5c93028f8b4db619fc388087Ted Kremenek RightV = svalBuilder.getConjuredSymbolVal(NULL, B->getRHS(), Count); 2871ab2b8c54bca82866876f91e756788916d3fa20c3Ted Kremenek } 2872662174ca204cb520f634bdcb34a3708f45389d14Zhongxing Xu 2873892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek SVal ExprVal = B->isLValue() ? LeftV : RightV; 2874662174ca204cb520f634bdcb34a3708f45389d14Zhongxing Xu 287573af2d5c92420e9cd8b6a9fefcdc2c744aedda1fZhongxing Xu // Simulate the effects of a "store": bind the value of the RHS 287673af2d5c92420e9cd8b6a9fefcdc2c744aedda1fZhongxing Xu // to the L-Value represented by the LHS. 28779c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek evalStore(Tmp3, B, LHS, *I2, state->BindExpr(B, ExprVal), LeftV,RightV); 287873af2d5c92420e9cd8b6a9fefcdc2c744aedda1fZhongxing Xu continue; 287973af2d5c92420e9cd8b6a9fefcdc2c744aedda1fZhongxing Xu } 2880b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 288173af2d5c92420e9cd8b6a9fefcdc2c744aedda1fZhongxing Xu if (!B->isAssignmentOp()) { 288273af2d5c92420e9cd8b6a9fefcdc2c744aedda1fZhongxing Xu // Process non-assignments except commas or short-circuited 288373af2d5c92420e9cd8b6a9fefcdc2c744aedda1fZhongxing Xu // logical expressions (LAnd and LOr). 28849c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek SVal Result = evalBinOp(state, Op, LeftV, RightV, B->getType()); 2885b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 288673af2d5c92420e9cd8b6a9fefcdc2c744aedda1fZhongxing Xu if (Result.isUnknown()) { 288796ebad66c451d79c9f57b1edb31efaeeb23b9a01Ted Kremenek MakeNode(Tmp3, B, *I2, state); 288873af2d5c92420e9cd8b6a9fefcdc2c744aedda1fZhongxing Xu continue; 288973af2d5c92420e9cd8b6a9fefcdc2c744aedda1fZhongxing Xu } 2890b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 289173af2d5c92420e9cd8b6a9fefcdc2c744aedda1fZhongxing Xu state = state->BindExpr(B, Result); 2892b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 2893668399b23cf18124c8c8c41a14a7712212f6fa45Zhongxing Xu MakeNode(Tmp3, B, *I2, state); 289473af2d5c92420e9cd8b6a9fefcdc2c744aedda1fZhongxing Xu continue; 28951b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek } 28961eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 28971b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek assert (B->isCompoundAssignmentOp()); 28981b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek 2899cad2996edf303978932c621ab02729dc11debb81Ted Kremenek switch (Op) { 2900cad2996edf303978932c621ab02729dc11debb81Ted Kremenek default: 2901cad2996edf303978932c621ab02729dc11debb81Ted Kremenek assert(0 && "Invalid opcode for compound assignment."); 29022de56d1d0c3a504ad1529de2677628bdfbb95cd4John McCall case BO_MulAssign: Op = BO_Mul; break; 29032de56d1d0c3a504ad1529de2677628bdfbb95cd4John McCall case BO_DivAssign: Op = BO_Div; break; 29042de56d1d0c3a504ad1529de2677628bdfbb95cd4John McCall case BO_RemAssign: Op = BO_Rem; break; 29052de56d1d0c3a504ad1529de2677628bdfbb95cd4John McCall case BO_AddAssign: Op = BO_Add; break; 29062de56d1d0c3a504ad1529de2677628bdfbb95cd4John McCall case BO_SubAssign: Op = BO_Sub; break; 29072de56d1d0c3a504ad1529de2677628bdfbb95cd4John McCall case BO_ShlAssign: Op = BO_Shl; break; 29082de56d1d0c3a504ad1529de2677628bdfbb95cd4John McCall case BO_ShrAssign: Op = BO_Shr; break; 29092de56d1d0c3a504ad1529de2677628bdfbb95cd4John McCall case BO_AndAssign: Op = BO_And; break; 29102de56d1d0c3a504ad1529de2677628bdfbb95cd4John McCall case BO_XorAssign: Op = BO_Xor; break; 29112de56d1d0c3a504ad1529de2677628bdfbb95cd4John McCall case BO_OrAssign: Op = BO_Or; break; 2912934e3e93eface34e73257a4a80cc6752edd588ceTed Kremenek } 29131eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 29141b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek // Perform a load (the LHS). This performs the checks for 29151b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek // null dereferences, and so on. 2916c39b2bdd4cef51021fe90de91c9fb6d1a15f4d0aZhongxing Xu ExplodedNodeSet Tmp4; 29171397663af9dbcc24dbf0e11de43931b3dc08fdbbTed Kremenek SVal location = state->getSVal(LHS); 29189c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek evalLoad(Tmp4, LHS, *I2, state, location); 29191eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 2920c39b2bdd4cef51021fe90de91c9fb6d1a15f4d0aZhongxing Xu for (ExplodedNodeSet::iterator I4=Tmp4.begin(), E4=Tmp4.end(); I4!=E4; 2921c39b2bdd4cef51021fe90de91c9fb6d1a15f4d0aZhongxing Xu ++I4) { 2922c39b2bdd4cef51021fe90de91c9fb6d1a15f4d0aZhongxing Xu state = GetState(*I4); 29231397663af9dbcc24dbf0e11de43931b3dc08fdbbTed Kremenek SVal V = state->getSVal(LHS); 29241b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek 29251b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek // Get the computation type. 292632c3fa4195762ba93f0b7114ab36c0941bc34432Ted Kremenek QualType CTy = 292732c3fa4195762ba93f0b7114ab36c0941bc34432Ted Kremenek cast<CompoundAssignOperator>(B)->getComputationResultType(); 292860595dab8bd9800f6b0b724fa4d859ada78c264fTed Kremenek CTy = getContext().getCanonicalType(CTy); 2929ab3a852ae713189444dcbf75e70accf1e8c2b7f2Eli Friedman 293032c3fa4195762ba93f0b7114ab36c0941bc34432Ted Kremenek QualType CLHSTy = 293132c3fa4195762ba93f0b7114ab36c0941bc34432Ted Kremenek cast<CompoundAssignOperator>(B)->getComputationLHSType(); 293232c3fa4195762ba93f0b7114ab36c0941bc34432Ted Kremenek CLHSTy = getContext().getCanonicalType(CLHSTy); 2933ab3a852ae713189444dcbf75e70accf1e8c2b7f2Eli Friedman 293460595dab8bd9800f6b0b724fa4d859ada78c264fTed Kremenek QualType LTy = getContext().getCanonicalType(LHS->getType()); 2935ab3a852ae713189444dcbf75e70accf1e8c2b7f2Eli Friedman 2936ab3a852ae713189444dcbf75e70accf1e8c2b7f2Eli Friedman // Promote LHS. 29379c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek V = svalBuilder.evalCast(V, CLHSTy, LTy); 2938ab3a852ae713189444dcbf75e70accf1e8c2b7f2Eli Friedman 29391eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump // Compute the result of the operation. 29409c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek SVal Result = svalBuilder.evalCast(evalBinOp(state, Op, V, RightV, CTy), 2941814e6b915450456eb2a1ba15d82fc7f8ae3bc8a6Zhongxing Xu B->getType(), CTy); 29421eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 29439ff267d0d6b8249a017fca0b56a0c5a6bcb7ef8aTed Kremenek // EXPERIMENTAL: "Conjured" symbols. 29449ff267d0d6b8249a017fca0b56a0c5a6bcb7ef8aTed Kremenek // FIXME: Handle structs. 29451eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 294660595dab8bd9800f6b0b724fa4d859ada78c264fTed Kremenek SVal LHSVal; 29471eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 29480e82a936389ead8f22077d5b021cab4ab7bd9899Ted Kremenek if (Result.isUnknown() || 29490e82a936389ead8f22077d5b021cab4ab7bd9899Ted Kremenek !getConstraintManager().canReasonAbout(Result)) { 29501eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 29519ff267d0d6b8249a017fca0b56a0c5a6bcb7ef8aTed Kremenek unsigned Count = Builder->getCurrentBlockCount(); 29521eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 295360595dab8bd9800f6b0b724fa4d859ada78c264fTed Kremenek // The symbolic value is actually for the type of the left-hand side 295460595dab8bd9800f6b0b724fa4d859ada78c264fTed Kremenek // expression, not the computation type, as this is the value the 295560595dab8bd9800f6b0b724fa4d859ada78c264fTed Kremenek // LValue on the LHS will bind to. 2956c8413fd03f73084a5c93028f8b4db619fc388087Ted Kremenek LHSVal = svalBuilder.getConjuredSymbolVal(NULL, B->getRHS(), LTy, Count); 29571eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 29581c0c23325312df5d40fe788ffcb48484f190e9a3Zhongxing Xu // However, we need to convert the symbol to the computation type. 29599c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek Result = svalBuilder.evalCast(LHSVal, CTy, LTy); 29609ff267d0d6b8249a017fca0b56a0c5a6bcb7ef8aTed Kremenek } 296160595dab8bd9800f6b0b724fa4d859ada78c264fTed Kremenek else { 296260595dab8bd9800f6b0b724fa4d859ada78c264fTed Kremenek // The left-hand side may bind to a different value then the 296360595dab8bd9800f6b0b724fa4d859ada78c264fTed Kremenek // computation type. 29649c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek LHSVal = svalBuilder.evalCast(Result, LTy, CTy); 296560595dab8bd9800f6b0b724fa4d859ada78c264fTed Kremenek } 29661eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 2967f9d3cbbe07afa05c2414c7120d7141409e5a3663Zhongxing Xu // In C++, assignment and compound assignment operators return an 2968f9d3cbbe07afa05c2414c7120d7141409e5a3663Zhongxing Xu // lvalue. 2969f9d3cbbe07afa05c2414c7120d7141409e5a3663Zhongxing Xu if (B->isLValue()) 2970f9d3cbbe07afa05c2414c7120d7141409e5a3663Zhongxing Xu state = state->BindExpr(B, location); 2971f9d3cbbe07afa05c2414c7120d7141409e5a3663Zhongxing Xu else 2972f9d3cbbe07afa05c2414c7120d7141409e5a3663Zhongxing Xu state = state->BindExpr(B, Result); 2973f9d3cbbe07afa05c2414c7120d7141409e5a3663Zhongxing Xu 2974f9d3cbbe07afa05c2414c7120d7141409e5a3663Zhongxing Xu evalStore(Tmp3, B, LHS, *I4, state, location, LHSVal); 2975ab2b8c54bca82866876f91e756788916d3fa20c3Ted Kremenek } 2976cb448ca8b372710d48a232fddcec615164eee574Ted Kremenek } 2977d27f8169f4b68337a489547a41ac45bf7a5d1ddfTed Kremenek } 2978668399b23cf18124c8c8c41a14a7712212f6fa45Zhongxing Xu 2979eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis getCheckerManager().runCheckersForPostStmt(Dst, Tmp3, B, *this); 2980094bef56a7900f13bb777f9a352704104b1458e7Ted Kremenek} 2981094bef56a7900f13bb777f9a352704104b1458e7Ted Kremenek 2982094bef56a7900f13bb777f9a352704104b1458e7Ted Kremenek//===----------------------------------------------------------------------===// 2983e01c98767dfd7153c3c84637c36659e3bbe16ff7Ted Kremenek// Visualization. 2984ee98546b0d5f3439c4a590b0d7d1545af794a0ecTed Kremenek//===----------------------------------------------------------------------===// 2985ee98546b0d5f3439c4a590b0d7d1545af794a0ecTed Kremenek 2986aa66a32ba177338763cd0cf9df8310dfa2e24ff7Ted Kremenek#ifndef NDEBUG 2987d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidisstatic ExprEngine* GraphPrintCheckerState; 2988e97ca065c91ff9ca2a2a42eb443eaa553c40441cTed Kremenekstatic SourceManager* GraphPrintSourceManager; 29893b4f6702860208692f6ef28401e68de4e3ff9af9Ted Kremenek 2990aa66a32ba177338763cd0cf9df8310dfa2e24ff7Ted Kremeneknamespace llvm { 2991aa66a32ba177338763cd0cf9df8310dfa2e24ff7Ted Kremenektemplate<> 299247491f8b7adf9d42a404d44c073e8a5308fa6cfcDouglas Gregorstruct DOTGraphTraits<ExplodedNode*> : 2993aa66a32ba177338763cd0cf9df8310dfa2e24ff7Ted Kremenek public DefaultDOTGraphTraits { 2994006b0eb3e11162d8c06372db813ac9f71a7a16e8Tobias Grosser 2995006b0eb3e11162d8c06372db813ac9f71a7a16e8Tobias Grosser DOTGraphTraits (bool isSimple=false) : DefaultDOTGraphTraits(isSimple) {} 2996006b0eb3e11162d8c06372db813ac9f71a7a16e8Tobias Grosser 2997d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidis // FIXME: Since we do not cache error nodes in ExprEngine now, this does not 2998ec9227fea66c3439991fc84b0d33b0a8b4b8875eZhongxing Xu // work. 2999031ccc0555a82afc2e8afe29e19dd57ff204e2deZhongxing Xu static std::string getNodeAttributes(const ExplodedNode* N, void*) { 30001eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 300110f51e8785e43d5a22acc2d2a638307c582949c2Ted Kremenek#if 0 300210f51e8785e43d5a22acc2d2a638307c582949c2Ted Kremenek // FIXME: Replace with a general scheme to tell if the node is 300310f51e8785e43d5a22acc2d2a638307c582949c2Ted Kremenek // an error node. 3004a3fadfcce5911742801a302cac82d4fe54d5c682Ted Kremenek if (GraphPrintCheckerState->isImplicitNullDeref(N) || 30059dca062461a6244cf0f733346657fa3eee853f9bTed Kremenek GraphPrintCheckerState->isExplicitNullDeref(N) || 30064a4e524afef40d6f3ddb25d0e407c814e4ca56a8Ted Kremenek GraphPrintCheckerState->isUndefDeref(N) || 30074a4e524afef40d6f3ddb25d0e407c814e4ca56a8Ted Kremenek GraphPrintCheckerState->isUndefStore(N) || 30084a4e524afef40d6f3ddb25d0e407c814e4ca56a8Ted Kremenek GraphPrintCheckerState->isUndefControlFlow(N) || 30095e03fcb5420c33207433dd6f800588e256dd9bdbTed Kremenek GraphPrintCheckerState->isUndefResult(N) || 30102ded35a576e3899553ea0ccfcbf5cbdb3d8cf664Ted Kremenek GraphPrintCheckerState->isBadCall(N) || 30112ded35a576e3899553ea0ccfcbf5cbdb3d8cf664Ted Kremenek GraphPrintCheckerState->isUndefArg(N)) 3012a3fadfcce5911742801a302cac82d4fe54d5c682Ted Kremenek return "color=\"red\",style=\"filled\""; 30131eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 30148cc13ea74fea1c04042a2f4087665bc5182e8408Ted Kremenek if (GraphPrintCheckerState->isNoReturnCall(N)) 30158cc13ea74fea1c04042a2f4087665bc5182e8408Ted Kremenek return "color=\"blue\",style=\"filled\""; 30162055effed54d614b51e3501a174c9b1fe92e4de4Zhongxing Xu#endif 3017a3fadfcce5911742801a302cac82d4fe54d5c682Ted Kremenek return ""; 3018a3fadfcce5911742801a302cac82d4fe54d5c682Ted Kremenek } 30191eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 3020006b0eb3e11162d8c06372db813ac9f71a7a16e8Tobias Grosser static std::string getNodeLabel(const ExplodedNode* N, void*){ 30211eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 302253ba0b636194dbeaa65a6f85316c9397a0c5298bTed Kremenek std::string sbuf; 302353ba0b636194dbeaa65a6f85316c9397a0c5298bTed Kremenek llvm::raw_string_ostream Out(sbuf); 3024803c9edd06e8f936821525d36b1d8cc131e37d44Ted Kremenek 3025803c9edd06e8f936821525d36b1d8cc131e37d44Ted Kremenek // Program Location. 3026aa66a32ba177338763cd0cf9df8310dfa2e24ff7Ted Kremenek ProgramPoint Loc = N->getLocation(); 30271eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 3028aa66a32ba177338763cd0cf9df8310dfa2e24ff7Ted Kremenek switch (Loc.getKind()) { 3029aa66a32ba177338763cd0cf9df8310dfa2e24ff7Ted Kremenek case ProgramPoint::BlockEntranceKind: 30301eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump Out << "Block Entrance: B" 3031aa66a32ba177338763cd0cf9df8310dfa2e24ff7Ted Kremenek << cast<BlockEntrance>(Loc).getBlock()->getBlockID(); 3032aa66a32ba177338763cd0cf9df8310dfa2e24ff7Ted Kremenek break; 30331eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 3034aa66a32ba177338763cd0cf9df8310dfa2e24ff7Ted Kremenek case ProgramPoint::BlockExitKind: 3035aa66a32ba177338763cd0cf9df8310dfa2e24ff7Ted Kremenek assert (false); 3036aa66a32ba177338763cd0cf9df8310dfa2e24ff7Ted Kremenek break; 30371eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 3038102acd5369bbb17c0d6ab868af376671acff7a93Douglas Gregor case ProgramPoint::CallEnterKind: 3039102acd5369bbb17c0d6ab868af376671acff7a93Douglas Gregor Out << "CallEnter"; 3040102acd5369bbb17c0d6ab868af376671acff7a93Douglas Gregor break; 3041102acd5369bbb17c0d6ab868af376671acff7a93Douglas Gregor 3042102acd5369bbb17c0d6ab868af376671acff7a93Douglas Gregor case ProgramPoint::CallExitKind: 3043102acd5369bbb17c0d6ab868af376671acff7a93Douglas Gregor Out << "CallExit"; 3044102acd5369bbb17c0d6ab868af376671acff7a93Douglas Gregor break; 3045102acd5369bbb17c0d6ab868af376671acff7a93Douglas Gregor 3046aa66a32ba177338763cd0cf9df8310dfa2e24ff7Ted Kremenek default: { 30475f85e17df3f5b0a8021443f2b590daecfb2cbd17Ted Kremenek if (StmtPoint *L = dyn_cast<StmtPoint>(&Loc)) { 30485f85e17df3f5b0a8021443f2b590daecfb2cbd17Ted Kremenek const Stmt* S = L->getStmt(); 30498c354758c2d39db87c77c723d81e34b4d967f762Ted Kremenek SourceLocation SLoc = S->getLocStart(); 30508c354758c2d39db87c77c723d81e34b4d967f762Ted Kremenek 30511eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump Out << S->getStmtClassName() << ' ' << (void*) S << ' '; 3052e4f2142d00fa5fdb580c4e2413da91882d955381Chris Lattner LangOptions LO; // FIXME. 3053e4f2142d00fa5fdb580c4e2413da91882d955381Chris Lattner S->printPretty(Out, 0, PrintingPolicy(LO)); 30541eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 30551eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump if (SLoc.isFileID()) { 30568c354758c2d39db87c77c723d81e34b4d967f762Ted Kremenek Out << "\\lline=" 30577da5aea7669e6db3e593162b8a123aef06a04d07Chris Lattner << GraphPrintSourceManager->getInstantiationLineNumber(SLoc) 30587da5aea7669e6db3e593162b8a123aef06a04d07Chris Lattner << " col=" 30597da5aea7669e6db3e593162b8a123aef06a04d07Chris Lattner << GraphPrintSourceManager->getInstantiationColumnNumber(SLoc) 30607da5aea7669e6db3e593162b8a123aef06a04d07Chris Lattner << "\\l"; 30618c354758c2d39db87c77c723d81e34b4d967f762Ted Kremenek } 30621eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 30635f85e17df3f5b0a8021443f2b590daecfb2cbd17Ted Kremenek if (isa<PreStmt>(Loc)) 30641eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump Out << "\\lPreStmt\\l;"; 30655f85e17df3f5b0a8021443f2b590daecfb2cbd17Ted Kremenek else if (isa<PostLoad>(Loc)) 30667090d5465de7ca620da16211cf886edf1edc1f1fTed Kremenek Out << "\\lPostLoad\\l;"; 30677090d5465de7ca620da16211cf886edf1edc1f1fTed Kremenek else if (isa<PostStore>(Loc)) 30687090d5465de7ca620da16211cf886edf1edc1f1fTed Kremenek Out << "\\lPostStore\\l"; 30697090d5465de7ca620da16211cf886edf1edc1f1fTed Kremenek else if (isa<PostLValue>(Loc)) 30707090d5465de7ca620da16211cf886edf1edc1f1fTed Kremenek Out << "\\lPostLValue\\l"; 30711eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 307210f51e8785e43d5a22acc2d2a638307c582949c2Ted Kremenek#if 0 307310f51e8785e43d5a22acc2d2a638307c582949c2Ted Kremenek // FIXME: Replace with a general scheme to determine 307410f51e8785e43d5a22acc2d2a638307c582949c2Ted Kremenek // the name of the check. 30758c354758c2d39db87c77c723d81e34b4d967f762Ted Kremenek if (GraphPrintCheckerState->isImplicitNullDeref(N)) 30768c354758c2d39db87c77c723d81e34b4d967f762Ted Kremenek Out << "\\|Implicit-Null Dereference.\\l"; 30778c354758c2d39db87c77c723d81e34b4d967f762Ted Kremenek else if (GraphPrintCheckerState->isExplicitNullDeref(N)) 30788c354758c2d39db87c77c723d81e34b4d967f762Ted Kremenek Out << "\\|Explicit-Null Dereference.\\l"; 30798c354758c2d39db87c77c723d81e34b4d967f762Ted Kremenek else if (GraphPrintCheckerState->isUndefDeref(N)) 30808c354758c2d39db87c77c723d81e34b4d967f762Ted Kremenek Out << "\\|Dereference of undefialied value.\\l"; 30818c354758c2d39db87c77c723d81e34b4d967f762Ted Kremenek else if (GraphPrintCheckerState->isUndefStore(N)) 30828c354758c2d39db87c77c723d81e34b4d967f762Ted Kremenek Out << "\\|Store to Undefined Loc."; 30838c354758c2d39db87c77c723d81e34b4d967f762Ted Kremenek else if (GraphPrintCheckerState->isUndefResult(N)) 30848c354758c2d39db87c77c723d81e34b4d967f762Ted Kremenek Out << "\\|Result of operation is undefined."; 30858c354758c2d39db87c77c723d81e34b4d967f762Ted Kremenek else if (GraphPrintCheckerState->isNoReturnCall(N)) 30868c354758c2d39db87c77c723d81e34b4d967f762Ted Kremenek Out << "\\|Call to function marked \"noreturn\"."; 30878c354758c2d39db87c77c723d81e34b4d967f762Ted Kremenek else if (GraphPrintCheckerState->isBadCall(N)) 30888c354758c2d39db87c77c723d81e34b4d967f762Ted Kremenek Out << "\\|Call to NULL/Undefined."; 30898c354758c2d39db87c77c723d81e34b4d967f762Ted Kremenek else if (GraphPrintCheckerState->isUndefArg(N)) 30908c354758c2d39db87c77c723d81e34b4d967f762Ted Kremenek Out << "\\|Argument in call is undefined"; 309110f51e8785e43d5a22acc2d2a638307c582949c2Ted Kremenek#endif 30921eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 30938c354758c2d39db87c77c723d81e34b4d967f762Ted Kremenek break; 30948c354758c2d39db87c77c723d81e34b4d967f762Ted Kremenek } 30958c354758c2d39db87c77c723d81e34b4d967f762Ted Kremenek 3096aa66a32ba177338763cd0cf9df8310dfa2e24ff7Ted Kremenek const BlockEdge& E = cast<BlockEdge>(Loc); 3097aa66a32ba177338763cd0cf9df8310dfa2e24ff7Ted Kremenek Out << "Edge: (B" << E.getSrc()->getBlockID() << ", B" 3098aa66a32ba177338763cd0cf9df8310dfa2e24ff7Ted Kremenek << E.getDst()->getBlockID() << ')'; 30991eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 310003509aea098772644bf4662dc1c88634818ceeccZhongxing Xu if (const Stmt* T = E.getSrc()->getTerminator()) { 31011eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 3102e97ca065c91ff9ca2a2a42eb443eaa553c40441cTed Kremenek SourceLocation SLoc = T->getLocStart(); 31031eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 3104b38911f16b4943548db6a3695fc6ae23070b25d2Ted Kremenek Out << "\\|Terminator: "; 3105e4f2142d00fa5fdb580c4e2413da91882d955381Chris Lattner LangOptions LO; // FIXME. 3106e4f2142d00fa5fdb580c4e2413da91882d955381Chris Lattner E.getSrc()->printTerminator(Out, LO); 31071eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 31089b5551d7f0209cec8b9c555cf70e893940674e5cTed Kremenek if (SLoc.isFileID()) { 31099b5551d7f0209cec8b9c555cf70e893940674e5cTed Kremenek Out << "\\lline=" 31107da5aea7669e6db3e593162b8a123aef06a04d07Chris Lattner << GraphPrintSourceManager->getInstantiationLineNumber(SLoc) 31117da5aea7669e6db3e593162b8a123aef06a04d07Chris Lattner << " col=" 31127da5aea7669e6db3e593162b8a123aef06a04d07Chris Lattner << GraphPrintSourceManager->getInstantiationColumnNumber(SLoc); 31139b5551d7f0209cec8b9c555cf70e893940674e5cTed Kremenek } 31141eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 3115daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek if (isa<SwitchStmt>(T)) { 311603509aea098772644bf4662dc1c88634818ceeccZhongxing Xu const Stmt* Label = E.getDst()->getLabel(); 31171eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 31181eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump if (Label) { 311903509aea098772644bf4662dc1c88634818ceeccZhongxing Xu if (const CaseStmt* C = dyn_cast<CaseStmt>(Label)) { 3120daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek Out << "\\lcase "; 3121e4f2142d00fa5fdb580c4e2413da91882d955381Chris Lattner LangOptions LO; // FIXME. 3122e4f2142d00fa5fdb580c4e2413da91882d955381Chris Lattner C->getLHS()->printPretty(Out, 0, PrintingPolicy(LO)); 31231eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 312403509aea098772644bf4662dc1c88634818ceeccZhongxing Xu if (const Stmt* RHS = C->getRHS()) { 3125daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek Out << " .. "; 3126e4f2142d00fa5fdb580c4e2413da91882d955381Chris Lattner RHS->printPretty(Out, 0, PrintingPolicy(LO)); 3127daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek } 31281eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 3129daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek Out << ":"; 3130daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek } 3131daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek else { 3132daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek assert (isa<DefaultStmt>(Label)); 3133daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek Out << "\\ldefault:"; 3134daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek } 3135daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek } 31361eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump else 3137daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek Out << "\\l(implicit) default:"; 3138daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek } 3139daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek else if (isa<IndirectGotoStmt>(T)) { 3140b38911f16b4943548db6a3695fc6ae23070b25d2Ted Kremenek // FIXME 3141b38911f16b4943548db6a3695fc6ae23070b25d2Ted Kremenek } 3142b38911f16b4943548db6a3695fc6ae23070b25d2Ted Kremenek else { 3143b38911f16b4943548db6a3695fc6ae23070b25d2Ted Kremenek Out << "\\lCondition: "; 3144b38911f16b4943548db6a3695fc6ae23070b25d2Ted Kremenek if (*E.getSrc()->succ_begin() == E.getDst()) 3145b38911f16b4943548db6a3695fc6ae23070b25d2Ted Kremenek Out << "true"; 3146b38911f16b4943548db6a3695fc6ae23070b25d2Ted Kremenek else 31471eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump Out << "false"; 3148b38911f16b4943548db6a3695fc6ae23070b25d2Ted Kremenek } 31491eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 3150b38911f16b4943548db6a3695fc6ae23070b25d2Ted Kremenek Out << "\\l"; 3151b38911f16b4943548db6a3695fc6ae23070b25d2Ted Kremenek } 31521eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 315310f51e8785e43d5a22acc2d2a638307c582949c2Ted Kremenek#if 0 315410f51e8785e43d5a22acc2d2a638307c582949c2Ted Kremenek // FIXME: Replace with a general scheme to determine 315510f51e8785e43d5a22acc2d2a638307c582949c2Ted Kremenek // the name of the check. 31564a4e524afef40d6f3ddb25d0e407c814e4ca56a8Ted Kremenek if (GraphPrintCheckerState->isUndefControlFlow(N)) { 31574a4e524afef40d6f3ddb25d0e407c814e4ca56a8Ted Kremenek Out << "\\|Control-flow based on\\lUndefined value.\\l"; 31583b4f6702860208692f6ef28401e68de4e3ff9af9Ted Kremenek } 315910f51e8785e43d5a22acc2d2a638307c582949c2Ted Kremenek#endif 3160aa66a32ba177338763cd0cf9df8310dfa2e24ff7Ted Kremenek } 3161aa66a32ba177338763cd0cf9df8310dfa2e24ff7Ted Kremenek } 31621eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 3163b65be70779bdaf75e91731bfd89362bf4118ae31Ted Kremenek const GRState *state = N->getState(); 31648673a68a8ab55a2bd03f92d636a50e6b0bfad2daTed Kremenek Out << "\\|StateID: " << (void*) state 31658673a68a8ab55a2bd03f92d636a50e6b0bfad2daTed Kremenek << " NodeID: " << (void*) N << "\\|"; 3166c179a7fbb294fe3ff6cf5479f6239a10f39628c7Zhongxing Xu state->printDOT(Out, *N->getLocationContext()->getCFG()); 3167803c9edd06e8f936821525d36b1d8cc131e37d44Ted Kremenek Out << "\\l"; 3168aa66a32ba177338763cd0cf9df8310dfa2e24ff7Ted Kremenek return Out.str(); 3169aa66a32ba177338763cd0cf9df8310dfa2e24ff7Ted Kremenek } 3170aa66a32ba177338763cd0cf9df8310dfa2e24ff7Ted Kremenek}; 31711eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump} // end llvm namespace 3172aa66a32ba177338763cd0cf9df8310dfa2e24ff7Ted Kremenek#endif 3173aa66a32ba177338763cd0cf9df8310dfa2e24ff7Ted Kremenek 3174ffe0f43806d4823271c2406c1fccc2373115c36aTed Kremenek#ifndef NDEBUG 31757ec07fd91f6eae8bd619ebb8512805222ca41c92Ted Kremenektemplate <typename ITERATOR> 3176031ccc0555a82afc2e8afe29e19dd57ff204e2deZhongxing XuExplodedNode* GetGraphNode(ITERATOR I) { return *I; } 31777ec07fd91f6eae8bd619ebb8512805222ca41c92Ted Kremenek 3178031ccc0555a82afc2e8afe29e19dd57ff204e2deZhongxing Xutemplate <> ExplodedNode* 3179031ccc0555a82afc2e8afe29e19dd57ff204e2deZhongxing XuGetGraphNode<llvm::DenseMap<ExplodedNode*, Expr*>::iterator> 3180031ccc0555a82afc2e8afe29e19dd57ff204e2deZhongxing Xu (llvm::DenseMap<ExplodedNode*, Expr*>::iterator I) { 31817ec07fd91f6eae8bd619ebb8512805222ca41c92Ted Kremenek return I->first; 31827ec07fd91f6eae8bd619ebb8512805222ca41c92Ted Kremenek} 3183ffe0f43806d4823271c2406c1fccc2373115c36aTed Kremenek#endif 3184ffe0f43806d4823271c2406c1fccc2373115c36aTed Kremenek 3185d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidisvoid ExprEngine::ViewGraph(bool trim) { 31861eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump#ifndef NDEBUG 3187ffe0f43806d4823271c2406c1fccc2373115c36aTed Kremenek if (trim) { 3188031ccc0555a82afc2e8afe29e19dd57ff204e2deZhongxing Xu std::vector<ExplodedNode*> Src; 3189940abcc574580e454689be801f38a3d4d41ab01fTed Kremenek 3190940abcc574580e454689be801f38a3d4d41ab01fTed Kremenek // Flush any outstanding reports to make sure we cover all the nodes. 3191940abcc574580e454689be801f38a3d4d41ab01fTed Kremenek // This does not cause them to get displayed. 3192940abcc574580e454689be801f38a3d4d41ab01fTed Kremenek for (BugReporter::iterator I=BR.begin(), E=BR.end(); I!=E; ++I) 3193940abcc574580e454689be801f38a3d4d41ab01fTed Kremenek const_cast<BugType*>(*I)->FlushReports(BR); 3194940abcc574580e454689be801f38a3d4d41ab01fTed Kremenek 3195940abcc574580e454689be801f38a3d4d41ab01fTed Kremenek // Iterate through the reports and get their nodes. 3196404fc3ad6bd844bf8ce70cbf9974ab297704a122Argyrios Kyrtzidis for (BugReporter::EQClasses_iterator 3197404fc3ad6bd844bf8ce70cbf9974ab297704a122Argyrios Kyrtzidis EI = BR.EQClasses_begin(), EE = BR.EQClasses_end(); EI != EE; ++EI) { 3198404fc3ad6bd844bf8ce70cbf9974ab297704a122Argyrios Kyrtzidis BugReportEquivClass& EQ = *EI; 3199404fc3ad6bd844bf8ce70cbf9974ab297704a122Argyrios Kyrtzidis const BugReport &R = **EQ.begin(); 3200404fc3ad6bd844bf8ce70cbf9974ab297704a122Argyrios Kyrtzidis ExplodedNode *N = const_cast<ExplodedNode*>(R.getErrorNode()); 3201404fc3ad6bd844bf8ce70cbf9974ab297704a122Argyrios Kyrtzidis if (N) Src.push_back(N); 3202940abcc574580e454689be801f38a3d4d41ab01fTed Kremenek } 32031eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 32047ec07fd91f6eae8bd619ebb8512805222ca41c92Ted Kremenek ViewGraph(&Src[0], &Src[0]+Src.size()); 3205ffe0f43806d4823271c2406c1fccc2373115c36aTed Kremenek } 3206493d7a26d5ea319770ba904b43f2740d43b820cbTed Kremenek else { 3207493d7a26d5ea319770ba904b43f2740d43b820cbTed Kremenek GraphPrintCheckerState = this; 3208493d7a26d5ea319770ba904b43f2740d43b820cbTed Kremenek GraphPrintSourceManager = &getContext().getSourceManager(); 3209ae6814efb6c41bd0c0f6413d25097105284d5be7Ted Kremenek 3210d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidis llvm::ViewGraph(*G.roots_begin(), "ExprEngine"); 32111eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 3212493d7a26d5ea319770ba904b43f2740d43b820cbTed Kremenek GraphPrintCheckerState = NULL; 3213493d7a26d5ea319770ba904b43f2740d43b820cbTed Kremenek GraphPrintSourceManager = NULL; 3214493d7a26d5ea319770ba904b43f2740d43b820cbTed Kremenek } 3215493d7a26d5ea319770ba904b43f2740d43b820cbTed Kremenek#endif 3216493d7a26d5ea319770ba904b43f2740d43b820cbTed Kremenek} 3217493d7a26d5ea319770ba904b43f2740d43b820cbTed Kremenek 3218d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidisvoid ExprEngine::ViewGraph(ExplodedNode** Beg, ExplodedNode** End) { 3219493d7a26d5ea319770ba904b43f2740d43b820cbTed Kremenek#ifndef NDEBUG 3220493d7a26d5ea319770ba904b43f2740d43b820cbTed Kremenek GraphPrintCheckerState = this; 3221493d7a26d5ea319770ba904b43f2740d43b820cbTed Kremenek GraphPrintSourceManager = &getContext().getSourceManager(); 32221eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 3223031ccc0555a82afc2e8afe29e19dd57ff204e2deZhongxing Xu std::auto_ptr<ExplodedGraph> TrimmedG(G.Trim(Beg, End).first); 3224493d7a26d5ea319770ba904b43f2740d43b820cbTed Kremenek 3225cf118d41f7930a18dce97416ef7834a62642f587Ted Kremenek if (!TrimmedG.get()) 32266cb7c1a43b0c8f739d1f54b7fdae5ede86033496Benjamin Kramer llvm::errs() << "warning: Trimmed ExplodedGraph is empty.\n"; 3227cf118d41f7930a18dce97416ef7834a62642f587Ted Kremenek else 3228d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidis llvm::ViewGraph(*TrimmedG->roots_begin(), "TrimmedExprEngine"); 32291eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 32303b4f6702860208692f6ef28401e68de4e3ff9af9Ted Kremenek GraphPrintCheckerState = NULL; 3231e97ca065c91ff9ca2a2a42eb443eaa553c40441cTed Kremenek GraphPrintSourceManager = NULL; 3232e01c98767dfd7153c3c84637c36659e3bbe16ff7Ted Kremenek#endif 3233ee98546b0d5f3439c4a590b0d7d1545af794a0ecTed Kremenek} 3234