ExprEngine.cpp revision 5bd04952d4ae7ca894f583583208f0cec4735a90
1d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidis//=-- ExprEngine.cpp - Path-Sensitive Expression-Level Dataflow ---*- C++ -*-= 264924859b6b09d1cfb62fecf5954ec6c27cb58feTed Kremenek// 34af84313df0d2710fd57af89132e680294225cadTed Kremenek// The LLVM Compiler Infrastructure 4d27f8169f4b68337a489547a41ac45bf7a5d1ddfTed Kremenek// 5d27f8169f4b68337a489547a41ac45bf7a5d1ddfTed Kremenek// This file is distributed under the University of Illinois Open Source 6d27f8169f4b68337a489547a41ac45bf7a5d1ddfTed Kremenek// License. See LICENSE.TXT for details. 7d27f8169f4b68337a489547a41ac45bf7a5d1ddfTed Kremenek// 8d27f8169f4b68337a489547a41ac45bf7a5d1ddfTed Kremenek//===----------------------------------------------------------------------===// 9d27f8169f4b68337a489547a41ac45bf7a5d1ddfTed Kremenek// 1077349cb20bfd7069d081f84c91975bfa8ef60a32Ted Kremenek// This file defines a meta-engine for path-sensitive dataflow analysis that 1177349cb20bfd7069d081f84c91975bfa8ef60a32Ted Kremenek// is built on GREngine, but provides the boilerplate to execute transfer 1277349cb20bfd7069d081f84c91975bfa8ef60a32Ted Kremenek// functions and build the ExplodedGraph at the expression level. 13d27f8169f4b68337a489547a41ac45bf7a5d1ddfTed Kremenek// 14d27f8169f4b68337a489547a41ac45bf7a5d1ddfTed Kremenek//===----------------------------------------------------------------------===// 15a7af5ea88a6c5bdf87497cca6c20831e8c546751Argyrios Kyrtzidis 1643dee220252ef0b42c5f8a3bb1eca97f84f2565fArgyrios Kyrtzidis#include "clang/StaticAnalyzer/Core/CheckerManager.h" 179b663716449b618ba0390b1dbebc54fa8e971124Ted Kremenek#include "clang/StaticAnalyzer/Core/BugReporter/BugType.h" 189b663716449b618ba0390b1dbebc54fa8e971124Ted Kremenek#include "clang/StaticAnalyzer/Core/PathSensitive/AnalysisManager.h" 199b663716449b618ba0390b1dbebc54fa8e971124Ted Kremenek#include "clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h" 209b663716449b618ba0390b1dbebc54fa8e971124Ted Kremenek#include "clang/StaticAnalyzer/Core/PathSensitive/ExprEngineBuilders.h" 21199c3d6cd16aebbb9c7f0d42af9d922c9628bf70Ken Dyck#include "clang/AST/CharUnits.h" 2216f0049415ec596504891259e2a83e19871c0d52Chris Lattner#include "clang/AST/ParentMap.h" 2316f0049415ec596504891259e2a83e19871c0d52Chris Lattner#include "clang/AST/StmtObjC.h" 24c506357c3778092c2a3251243f12524e8eb89274Zhongxing Xu#include "clang/AST/DeclCXX.h" 251b63e4f732dbc73d90abf886b4d21f8e3a165f6dChris Lattner#include "clang/Basic/Builtins.h" 2616f0049415ec596504891259e2a83e19871c0d52Chris Lattner#include "clang/Basic/SourceManager.h" 27e97ca065c91ff9ca2a2a42eb443eaa553c40441cTed Kremenek#include "clang/Basic/SourceManager.h" 280bed8a12f2878d3cd94fb8bdba55b593d92dd11aTed Kremenek#include "clang/Basic/PrettyStackTrace.h" 29a95d3750441ac8ad03e36af8e6e74039c9a3109dTed Kremenek#include "llvm/Support/raw_ostream.h" 306cb7c1a43b0c8f739d1f54b7fdae5ede86033496Benjamin Kramer#include "llvm/ADT/ImmutableList.h" 314323a57627e796dcfdfdb7d47672dc09ed308edaTed Kremenek 320f5f0595d6a038843a7051c5a65fca7bce2915a0Ted Kremenek#ifndef NDEBUG 330f5f0595d6a038843a7051c5a65fca7bce2915a0Ted Kremenek#include "llvm/Support/GraphWriter.h" 340f5f0595d6a038843a7051c5a65fca7bce2915a0Ted Kremenek#endif 350f5f0595d6a038843a7051c5a65fca7bce2915a0Ted Kremenek 36b387a3f23e423d62c053be86294b703da1d1a222Ted Kremenekusing namespace clang; 379ef6537a894c33003359b1f9b9676e9178e028b7Ted Kremenekusing namespace ento; 38b387a3f23e423d62c053be86294b703da1d1a222Ted Kremenekusing llvm::APSInt; 39ab2b8c54bca82866876f91e756788916d3fa20c3Ted Kremenek 406190ec29f0895185bbec95a932429b8832917fecZhongxing Xunamespace { 416190ec29f0895185bbec95a932429b8832917fecZhongxing Xu // Trait class for recording returned expression in the state. 426190ec29f0895185bbec95a932429b8832917fecZhongxing Xu struct ReturnExpr { 436190ec29f0895185bbec95a932429b8832917fecZhongxing Xu static int TagInt; 446190ec29f0895185bbec95a932429b8832917fecZhongxing Xu typedef const Stmt *data_type; 456190ec29f0895185bbec95a932429b8832917fecZhongxing Xu }; 466190ec29f0895185bbec95a932429b8832917fecZhongxing Xu int ReturnExpr::TagInt; 476190ec29f0895185bbec95a932429b8832917fecZhongxing Xu} 486190ec29f0895185bbec95a932429b8832917fecZhongxing Xu 49e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek//===----------------------------------------------------------------------===// 5032c4995826c76f282fc05fbbc3241d2dded4fb57Ted Kremenek// Utility functions. 5132c4995826c76f282fc05fbbc3241d2dded4fb57Ted Kremenek//===----------------------------------------------------------------------===// 5232c4995826c76f282fc05fbbc3241d2dded4fb57Ted Kremenek 539c378f705405d37f49795d5e915989de774fe11fTed Kremenekstatic inline Selector GetNullarySelector(const char* name, ASTContext &Ctx) { 5432c4995826c76f282fc05fbbc3241d2dded4fb57Ted Kremenek IdentifierInfo* II = &Ctx.Idents.get(name); 5532c4995826c76f282fc05fbbc3241d2dded4fb57Ted Kremenek return Ctx.Selectors.getSelector(0, &II); 5632c4995826c76f282fc05fbbc3241d2dded4fb57Ted Kremenek} 5732c4995826c76f282fc05fbbc3241d2dded4fb57Ted Kremenek 5832c4995826c76f282fc05fbbc3241d2dded4fb57Ted Kremenek//===----------------------------------------------------------------------===// 59bdb435ddaafd5069becd543d638112f68825b89dTed Kremenek// Engine construction and deletion. 60bdb435ddaafd5069becd543d638112f68825b89dTed Kremenek//===----------------------------------------------------------------------===// 61bdb435ddaafd5069becd543d638112f68825b89dTed Kremenek 62d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios KyrtzidisExprEngine::ExprEngine(AnalysisManager &mgr, TransferFuncs *tf) 6325e695b2d574d919cc1bbddf3a2efe073d449b1cZhongxing Xu : AMgr(mgr), 64d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidis Engine(*this), 65d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidis G(Engine.getGraph()), 6650a6d0ce344c02782e0207574005c3b2aaa5077cTed Kremenek Builder(NULL), 67c77a55126fcad66fb086f8e100a494caa2496a2dZhongxing Xu StateMgr(getContext(), mgr.getStoreManagerCreator(), 6832a58084a4c53e6938dd81bfce224db25a5976d1Ted Kremenek mgr.getConstraintManagerCreator(), G.getAllocator(), 6932a58084a4c53e6938dd81bfce224db25a5976d1Ted Kremenek *this), 7050a6d0ce344c02782e0207574005c3b2aaa5077cTed Kremenek SymMgr(StateMgr.getSymbolManager()), 71c8413fd03f73084a5c93028f8b4db619fc388087Ted Kremenek svalBuilder(StateMgr.getSValBuilder()), 720a3ed3143b00f237decb1288c1ff574ae09eba4eTed Kremenek EntryNode(NULL), currentStmt(NULL), 73a5a4166f8cb04490b7b27355874edfb98837cd45Zhongxing Xu NSExceptionII(NULL), NSExceptionInstanceRaiseSelectors(NULL), 74c77a55126fcad66fb086f8e100a494caa2496a2dZhongxing Xu RaiseSel(GetNullarySelector("raise", getContext())), 7532a58084a4c53e6938dd81bfce224db25a5976d1Ted Kremenek BR(mgr, *this), TF(tf) { 76b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 7732a58084a4c53e6938dd81bfce224db25a5976d1Ted Kremenek // FIXME: Eventually remove the TF object entirely. 7832a58084a4c53e6938dd81bfce224db25a5976d1Ted Kremenek TF->RegisterChecks(*this); 7932a58084a4c53e6938dd81bfce224db25a5976d1Ted Kremenek TF->RegisterPrinters(getStateManager().Printers); 80d767d81290288c030f3be0be1d3e62b9c8df51dcTed Kremenek 81d767d81290288c030f3be0be1d3e62b9c8df51dcTed Kremenek if (mgr.shouldEagerlyTrimExplodedGraph()) { 82d767d81290288c030f3be0be1d3e62b9c8df51dcTed Kremenek // Enable eager node reclaimation when constructing the ExplodedGraph. 83d767d81290288c030f3be0be1d3e62b9c8df51dcTed Kremenek G.enableNodeReclamation(); 84d767d81290288c030f3be0be1d3e62b9c8df51dcTed Kremenek } 85c80135ba857da48173578b9c528fce6777e18168Ted Kremenek} 8650a6d0ce344c02782e0207574005c3b2aaa5077cTed Kremenek 87d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios KyrtzidisExprEngine::~ExprEngine() { 88cf118d41f7930a18dce97416ef7834a62642f587Ted Kremenek BR.FlushReports(); 89e448ab4f9dd162802f5d7cfea60f7830cc61c654Ted Kremenek delete [] NSExceptionInstanceRaiseSelectors; 9050a6d0ce344c02782e0207574005c3b2aaa5077cTed Kremenek} 9150a6d0ce344c02782e0207574005c3b2aaa5077cTed Kremenek 92e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek//===----------------------------------------------------------------------===// 93e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek// Utility methods. 94e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek//===----------------------------------------------------------------------===// 95e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek 9618c66fdc3c4008d335885695fe36fb5353c5f672Ted Kremenekconst ProgramState *ExprEngine::getInitialState(const LocationContext *InitLoc) { 9718c66fdc3c4008d335885695fe36fb5353c5f672Ted Kremenek const ProgramState *state = StateMgr.getInitialState(InitLoc); 981eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 99cfcd7fd0de701c5ce05e96de1ed2d0bf8c7035d9Ted Kremenek // Preconditions. 100cfcd7fd0de701c5ce05e96de1ed2d0bf8c7035d9Ted Kremenek 10152e5602056e4cade24cbcca57767e94e1d430b03Ted Kremenek // FIXME: It would be nice if we had a more general mechanism to add 10252e5602056e4cade24cbcca57767e94e1d430b03Ted Kremenek // such preconditions. Some day. 1035974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek do { 104b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek const Decl *D = InitLoc->getDecl(); 1055974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek if (const FunctionDecl *FD = dyn_cast<FunctionDecl>(D)) { 1065974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek // Precondition: the first argument of 'main' is an integer guaranteed 1075974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek // to be > 0. 1085974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek const IdentifierInfo *II = FD->getIdentifier(); 1095974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek if (!II || !(II->getName() == "main" && FD->getNumParams() > 0)) 1105974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek break; 1115974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek 1125974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek const ParmVarDecl *PD = FD->getParamDecl(0); 1135974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek QualType T = PD->getType(); 1145974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek if (!T->isIntegerType()) 1155974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek break; 116b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 1175974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek const MemRegion *R = state->getRegion(PD, InitLoc); 1185974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek if (!R) 1195974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek break; 120b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 1211397663af9dbcc24dbf0e11de43931b3dc08fdbbTed Kremenek SVal V = state->getSVal(loc::MemRegionVal(R)); 1229c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek SVal Constraint_untested = evalBinOp(state, BO_GT, V, 123c8413fd03f73084a5c93028f8b4db619fc388087Ted Kremenek svalBuilder.makeZeroVal(T), 1245974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek getContext().IntTy); 1255974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek 1265974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek DefinedOrUnknownSVal *Constraint = 1275974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek dyn_cast<DefinedOrUnknownSVal>(&Constraint_untested); 128b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 1295974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek if (!Constraint) 1305974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek break; 131b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 13218c66fdc3c4008d335885695fe36fb5353c5f672Ted Kremenek if (const ProgramState *newState = state->assume(*Constraint, true)) 1335974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek state = newState; 134b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 1355974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek break; 13652e5602056e4cade24cbcca57767e94e1d430b03Ted Kremenek } 1375974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek 138b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek if (const ObjCMethodDecl *MD = dyn_cast<ObjCMethodDecl>(D)) { 1395974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek // Precondition: 'self' is always non-null upon entry to an Objective-C 1405974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek // method. 1415974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek const ImplicitParamDecl *SelfD = MD->getSelfDecl(); 1425974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek const MemRegion *R = state->getRegion(SelfD, InitLoc); 1431397663af9dbcc24dbf0e11de43931b3dc08fdbbTed Kremenek SVal V = state->getSVal(loc::MemRegionVal(R)); 144b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 1455974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek if (const Loc *LV = dyn_cast<Loc>(&V)) { 1465974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek // Assume that the pointer value in 'self' is non-null. 14728f47b92e760ccf641ac91cb0fe1c12d9ca89795Ted Kremenek state = state->assume(*LV, true); 1485974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek assert(state && "'self' cannot be null"); 1495974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek } 150cfcd7fd0de701c5ce05e96de1ed2d0bf8c7035d9Ted Kremenek } 1515974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek } while (0); 152b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 15352e5602056e4cade24cbcca57767e94e1d430b03Ted Kremenek return state; 154e070a1df66aab6d4168fb28f7559fdf996df3567Ted Kremenek} 155e070a1df66aab6d4168fb28f7559fdf996df3567Ted Kremenek 156e5cfd52a3a5d4bb46f77323fa8fa0b973fcde7bcTed Kremenekbool 157e5cfd52a3a5d4bb46f77323fa8fa0b973fcde7bcTed KremenekExprEngine::doesInvalidateGlobals(const CallOrObjCMessage &callOrMessage) const 158e5cfd52a3a5d4bb46f77323fa8fa0b973fcde7bcTed Kremenek{ 159e5cfd52a3a5d4bb46f77323fa8fa0b973fcde7bcTed Kremenek if (callOrMessage.isFunctionCall() && !callOrMessage.isCXXCall()) { 160e5cfd52a3a5d4bb46f77323fa8fa0b973fcde7bcTed Kremenek SVal calleeV = callOrMessage.getFunctionCallee(); 161e5cfd52a3a5d4bb46f77323fa8fa0b973fcde7bcTed Kremenek if (const FunctionTextRegion *codeR = 1625f9e272e632e951b1efe824cd16acb4d96077930Chris Lattner dyn_cast_or_null<FunctionTextRegion>(calleeV.getAsRegion())) { 163e5cfd52a3a5d4bb46f77323fa8fa0b973fcde7bcTed Kremenek 164e5cfd52a3a5d4bb46f77323fa8fa0b973fcde7bcTed Kremenek const FunctionDecl *fd = codeR->getDecl(); 165e5cfd52a3a5d4bb46f77323fa8fa0b973fcde7bcTed Kremenek if (const IdentifierInfo *ii = fd->getIdentifier()) { 1665f9e272e632e951b1efe824cd16acb4d96077930Chris Lattner StringRef fname = ii->getName(); 167e5cfd52a3a5d4bb46f77323fa8fa0b973fcde7bcTed Kremenek if (fname == "strlen") 168e5cfd52a3a5d4bb46f77323fa8fa0b973fcde7bcTed Kremenek return false; 169e5cfd52a3a5d4bb46f77323fa8fa0b973fcde7bcTed Kremenek } 170e5cfd52a3a5d4bb46f77323fa8fa0b973fcde7bcTed Kremenek } 171e5cfd52a3a5d4bb46f77323fa8fa0b973fcde7bcTed Kremenek } 172e5cfd52a3a5d4bb46f77323fa8fa0b973fcde7bcTed Kremenek 173e5cfd52a3a5d4bb46f77323fa8fa0b973fcde7bcTed Kremenek // The conservative answer: invalidates globals. 174e5cfd52a3a5d4bb46f77323fa8fa0b973fcde7bcTed Kremenek return true; 175e5cfd52a3a5d4bb46f77323fa8fa0b973fcde7bcTed Kremenek} 176e5cfd52a3a5d4bb46f77323fa8fa0b973fcde7bcTed Kremenek 177e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek//===----------------------------------------------------------------------===// 178e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek// Top-level transfer function logic (Dispatcher). 179e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek//===----------------------------------------------------------------------===// 180e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek 1819c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek/// evalAssume - Called by ConstraintManager. Used to call checker-specific 18232a58084a4c53e6938dd81bfce224db25a5976d1Ted Kremenek/// logic for handling assumptions on symbolic values. 18318c66fdc3c4008d335885695fe36fb5353c5f672Ted Kremenekconst ProgramState *ExprEngine::processAssume(const ProgramState *state, SVal cond, 184b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek bool assumption) { 185312dbec867f6b8d6b86fd562c53352cd4db27468Argyrios Kyrtzidis state = getCheckerManager().runCheckersForEvalAssume(state, cond, assumption); 186312dbec867f6b8d6b86fd562c53352cd4db27468Argyrios Kyrtzidis 18772905cfa81cfd126f322c4173f56d332aac5539eJordy Rose // If the state is infeasible at this point, bail out. 18832a58084a4c53e6938dd81bfce224db25a5976d1Ted Kremenek if (!state) 18932a58084a4c53e6938dd81bfce224db25a5976d1Ted Kremenek return NULL; 190b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 1919c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek return TF->evalAssume(state, cond, assumption); 19232a58084a4c53e6938dd81bfce224db25a5976d1Ted Kremenek} 19332a58084a4c53e6938dd81bfce224db25a5976d1Ted Kremenek 19418c66fdc3c4008d335885695fe36fb5353c5f672Ted Kremenekbool ExprEngine::wantsRegionChangeUpdate(const ProgramState *state) { 195183ff98f425d470c2a0276880aaf43496c9dad14Argyrios Kyrtzidis return getCheckerManager().wantsRegionChangeUpdate(state); 196c2b7dfaad674587cfd220ff447b3710d252130c3Jordy Rose} 197c2b7dfaad674587cfd220ff447b3710d252130c3Jordy Rose 19818c66fdc3c4008d335885695fe36fb5353c5f672Ted Kremenekconst ProgramState * 19918c66fdc3c4008d335885695fe36fb5353c5f672Ted KremenekExprEngine::processRegionChanges(const ProgramState *state, 20035bdbf40624beba3fc00cb72ab444659939c1a6bTed Kremenek const StoreManager::InvalidatedSymbols *invalidated, 20135bdbf40624beba3fc00cb72ab444659939c1a6bTed Kremenek const MemRegion * const *Begin, 20235bdbf40624beba3fc00cb72ab444659939c1a6bTed Kremenek const MemRegion * const *End) { 20335bdbf40624beba3fc00cb72ab444659939c1a6bTed Kremenek return getCheckerManager().runCheckersForRegionChanges(state, invalidated, 20435bdbf40624beba3fc00cb72ab444659939c1a6bTed Kremenek Begin, End); 205c2b7dfaad674587cfd220ff447b3710d252130c3Jordy Rose} 206c2b7dfaad674587cfd220ff447b3710d252130c3Jordy Rose 207e36de1fe51c39d9161915dd3dbef880954af6476Ted Kremenekvoid ExprEngine::processEndWorklist(bool hasWorkRemaining) { 20830726c6baee1417307236e854f1474fdb3cedb98Argyrios Kyrtzidis getCheckerManager().runCheckersForEndAnalysis(G, BR, *this); 209ccc263b44c62ce3a02f797a3ddb3d6017cf0e5e4Ted Kremenek} 210ccc263b44c62ce3a02f797a3ddb3d6017cf0e5e4Ted Kremenek 211e36de1fe51c39d9161915dd3dbef880954af6476Ted Kremenekvoid ExprEngine::processCFGElement(const CFGElement E, 212d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidis StmtNodeBuilder& builder) { 2139c6cd67ea416bace666d614c84d5531124287653Zhongxing Xu switch (E.getKind()) { 2143c0349e87cdbd7316d06d2411d86ee1086e717a5Ted Kremenek case CFGElement::Invalid: 2153c0349e87cdbd7316d06d2411d86ee1086e717a5Ted Kremenek llvm_unreachable("Unexpected CFGElement kind."); 2163c0349e87cdbd7316d06d2411d86ee1086e717a5Ted Kremenek case CFGElement::Statement: 2173c0349e87cdbd7316d06d2411d86ee1086e717a5Ted Kremenek ProcessStmt(E.getAs<CFGStmt>()->getStmt(), builder); 2183c0349e87cdbd7316d06d2411d86ee1086e717a5Ted Kremenek return; 2193c0349e87cdbd7316d06d2411d86ee1086e717a5Ted Kremenek case CFGElement::Initializer: 2203c0349e87cdbd7316d06d2411d86ee1086e717a5Ted Kremenek ProcessInitializer(E.getAs<CFGInitializer>()->getInitializer(), builder); 2213c0349e87cdbd7316d06d2411d86ee1086e717a5Ted Kremenek return; 2223c0349e87cdbd7316d06d2411d86ee1086e717a5Ted Kremenek case CFGElement::AutomaticObjectDtor: 2233c0349e87cdbd7316d06d2411d86ee1086e717a5Ted Kremenek case CFGElement::BaseDtor: 2243c0349e87cdbd7316d06d2411d86ee1086e717a5Ted Kremenek case CFGElement::MemberDtor: 2253c0349e87cdbd7316d06d2411d86ee1086e717a5Ted Kremenek case CFGElement::TemporaryDtor: 2263c0349e87cdbd7316d06d2411d86ee1086e717a5Ted Kremenek ProcessImplicitDtor(*E.getAs<CFGImplicitDtor>(), builder); 2273c0349e87cdbd7316d06d2411d86ee1086e717a5Ted Kremenek return; 2289c6cd67ea416bace666d614c84d5531124287653Zhongxing Xu } 2299c6cd67ea416bace666d614c84d5531124287653Zhongxing Xu} 2309c6cd67ea416bace666d614c84d5531124287653Zhongxing Xu 231d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidisvoid ExprEngine::ProcessStmt(const CFGStmt S, StmtNodeBuilder& builder) { 2326bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks // TODO: Use RAII to remove the unnecessary, tagged nodes. 2336bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks //RegisterCreatedNodes registerCreatedNodes(getGraph()); 2346bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks 235d767d81290288c030f3be0be1d3e62b9c8df51dcTed Kremenek // Reclaim any unnecessary nodes in the ExplodedGraph. 236d767d81290288c030f3be0be1d3e62b9c8df51dcTed Kremenek G.reclaimRecentlyAllocatedNodes(); 23718c66fdc3c4008d335885695fe36fb5353c5f672Ted Kremenek // Recycle any unused states in the ProgramStateManager. 238e3115e257163321ecde429aeae75f1702f099d4cTed Kremenek StateMgr.recycleUnusedStates(); 239e3115e257163321ecde429aeae75f1702f099d4cTed Kremenek 2400a3ed3143b00f237decb1288c1ff574ae09eba4eTed Kremenek currentStmt = S.getStmt(); 2410bed8a12f2878d3cd94fb8bdba55b593d92dd11aTed Kremenek PrettyStackTraceLoc CrashInfo(getContext().getSourceManager(), 2420a3ed3143b00f237decb1288c1ff574ae09eba4eTed Kremenek currentStmt->getLocStart(), 2430bed8a12f2878d3cd94fb8bdba55b593d92dd11aTed Kremenek "Error evaluating statement"); 2441eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 2456bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks // A tag to track convenience transitions, which can be removed at cleanup. 246ca804539d908d3a0e8c72a0df5f1f571d29490bbTed Kremenek static SimpleProgramPointTag cleanupTag("ExprEngine : Clean Node"); 247e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek Builder = &builder; 248b4857264b8d3d861f688cdaa174aab30e0729a73Ted Kremenek EntryNode = builder.getPredecessor(); 2491eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 25018c66fdc3c4008d335885695fe36fb5353c5f672Ted Kremenek const ProgramState *EntryState = EntryNode->getState(); 2516bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks CleanedState = EntryState; 2526bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks ExplodedNode *CleanedNode = 0; 2536bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks 2541eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump // Create the cleaned state. 255bd533aa4ff8895c676d4634d0d3de254962569d0Jordy Rose const LocationContext *LC = EntryNode->getLocationContext(); 256882998923889a2fcce9b49696506c499e22cf38fTed Kremenek SymbolReaper SymReaper(LC, currentStmt, SymMgr, getStoreManager()); 257c179a7fbb294fe3ff6cf5479f6239a10f39628c7Zhongxing Xu 258bd533aa4ff8895c676d4634d0d3de254962569d0Jordy Rose if (AMgr.shouldPurgeDead()) { 2596bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks getCheckerManager().runCheckersForLiveSymbols(CleanedState, SymReaper); 260183ff98f425d470c2a0276880aaf43496c9dad14Argyrios Kyrtzidis 261bd533aa4ff8895c676d4634d0d3de254962569d0Jordy Rose const StackFrameContext *SFC = LC->getCurrentStackFrame(); 2626bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks 2636bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks // Create a state in which dead bindings are removed from the environment 2646bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks // and the store. TODO: The function should just return new env and store, 2656bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks // not a new state. 2666bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks CleanedState = StateMgr.removeDeadBindings(CleanedState, SFC, SymReaper); 267bd533aa4ff8895c676d4634d0d3de254962569d0Jordy Rose } 268241677a13cc46647a8f5098b3e3239bd9480dca2Ted Kremenek 26977d7ef8d8a80ccb2ab3d25c80810571e3ab14ee4Ted Kremenek // Process any special transfer function for dead symbols. 270031ccc0555a82afc2e8afe29e19dd57ff204e2deZhongxing Xu ExplodedNodeSet Tmp; 2716bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks if (!SymReaper.hasDeadSymbols()) { 2726bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks // Generate a CleanedNode that has the environment and store cleaned 2736bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks // up. Since no symbols are dead, we can optimize and not clean out 2746bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks // the constraint manager. 2756bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks CleanedNode = 276ca804539d908d3a0e8c72a0df5f1f571d29490bbTed Kremenek Builder->generateNode(currentStmt, CleanedState, EntryNode, &cleanupTag); 2776bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks Tmp.Add(CleanedNode); 2781eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 2796bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks } else { 28077d7ef8d8a80ccb2ab3d25c80810571e3ab14ee4Ted Kremenek SaveAndRestore<bool> OldSink(Builder->BuildSinks); 281b4857264b8d3d861f688cdaa174aab30e0729a73Ted Kremenek SaveOr OldHasGen(Builder->hasGeneratedNode); 282846d4e923bf11bcdc2816758aafa331795f29230Ted Kremenek 283331b0ac44b9eb0ffcba66b4f3f3f9adb27c2434fTed Kremenek SaveAndRestore<bool> OldPurgeDeadSymbols(Builder->PurgingDeadSymbols); 284331b0ac44b9eb0ffcba66b4f3f3f9adb27c2434fTed Kremenek Builder->PurgingDeadSymbols = true; 2851eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 2866bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks // Call checkers with the non-cleaned state so that they could query the 2876bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks // values of the soon to be dead symbols. 2889400613b54bf56c317786d778f58f45f1080d619Zhongxing Xu // FIXME: This should soon be removed. 2899400613b54bf56c317786d778f58f45f1080d619Zhongxing Xu ExplodedNodeSet Tmp2; 2909c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek getTF().evalDeadSymbols(Tmp2, *this, *Builder, EntryNode, 2916bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks EntryState, SymReaper); 292846d4e923bf11bcdc2816758aafa331795f29230Ted Kremenek 2936bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks ExplodedNodeSet Tmp3; 2946bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks getCheckerManager().runCheckersForDeadSymbols(Tmp3, Tmp2, 295183ff98f425d470c2a0276880aaf43496c9dad14Argyrios Kyrtzidis SymReaper, currentStmt, *this); 296183ff98f425d470c2a0276880aaf43496c9dad14Argyrios Kyrtzidis 2976bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks // For each node in Tmp3, generate CleanedNodes that have the environment, 2986bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks // the store, and the constraints cleaned up but have the user supplied 2996bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks // states as the predecessors. 3006bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks for (ExplodedNodeSet::const_iterator I = Tmp3.begin(), E = Tmp3.end(); 3016bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks I != E; ++I) { 30218c66fdc3c4008d335885695fe36fb5353c5f672Ted Kremenek const ProgramState *CheckerState = (*I)->getState(); 3036bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks 3046bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks // The constraint manager has not been cleaned up yet, so clean up now. 3056bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks CheckerState = getConstraintManager().removeDeadBindings(CheckerState, 3066bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks SymReaper); 3076bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks 3086bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks assert(StateMgr.haveEqualEnvironments(CheckerState, EntryState) && 3096bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks "Checkers are not allowed to modify the Environment as a part of " 3106bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks "checkDeadSymbols processing."); 3116bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks assert(StateMgr.haveEqualStores(CheckerState, EntryState) && 3126bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks "Checkers are not allowed to modify the Store as a part of " 3136bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks "checkDeadSymbols processing."); 3146bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks 3156bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks // Create a state based on CleanedState with CheckerState GDM and 3166bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks // generate a transition to that state. 31718c66fdc3c4008d335885695fe36fb5353c5f672Ted Kremenek const ProgramState *CleanedCheckerSt = 3186bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks StateMgr.getPersistentStateWithGDM(CleanedState, CheckerState); 3196bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks ExplodedNode *CleanedNode = Builder->generateNode(currentStmt, 3206bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks CleanedCheckerSt, *I, 321ca804539d908d3a0e8c72a0df5f1f571d29490bbTed Kremenek &cleanupTag); 3226bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks Tmp.Add(CleanedNode); 3236bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks } 32477d7ef8d8a80ccb2ab3d25c80810571e3ab14ee4Ted Kremenek } 3251eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 326031ccc0555a82afc2e8afe29e19dd57ff204e2deZhongxing Xu for (ExplodedNodeSet::iterator I=Tmp.begin(), E=Tmp.end(); I!=E; ++I) { 3276bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks // TODO: Remove Dest set, it's no longer needed. 328031ccc0555a82afc2e8afe29e19dd57ff204e2deZhongxing Xu ExplodedNodeSet Dst; 3291eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump // Visit the statement. 3300a3ed3143b00f237decb1288c1ff574ae09eba4eTed Kremenek Visit(currentStmt, *I, Dst); 33177d7ef8d8a80ccb2ab3d25c80810571e3ab14ee4Ted Kremenek } 3321eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 333e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek // NULL out these variables to cleanup. 334846d4e923bf11bcdc2816758aafa331795f29230Ted Kremenek CleanedState = NULL; 335846d4e923bf11bcdc2816758aafa331795f29230Ted Kremenek EntryNode = NULL; 3360a3ed3143b00f237decb1288c1ff574ae09eba4eTed Kremenek currentStmt = 0; 337e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek Builder = NULL; 338e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek} 339e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek 340d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidisvoid ExprEngine::ProcessInitializer(const CFGInitializer Init, 341d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidis StmtNodeBuilder &builder) { 3420a3ed3143b00f237decb1288c1ff574ae09eba4eTed Kremenek // We don't set EntryNode and currentStmt. And we don't clean up state. 343cbb67480094b3bcb5b715acd827cbad55e2a204cSean Hunt const CXXCtorInitializer *BMI = Init.getInitializer(); 3449dc84c9455df2a77195147d0210c915dc1775a88Zhongxing Xu 345d074441e027471a914cbb909a7aad1d43224950fZhongxing Xu ExplodedNode *pred = builder.getPredecessor(); 346d074441e027471a914cbb909a7aad1d43224950fZhongxing Xu 347d074441e027471a914cbb909a7aad1d43224950fZhongxing Xu const StackFrameContext *stackFrame = cast<StackFrameContext>(pred->getLocationContext()); 348d074441e027471a914cbb909a7aad1d43224950fZhongxing Xu const CXXConstructorDecl *decl = cast<CXXConstructorDecl>(stackFrame->getDecl()); 349d074441e027471a914cbb909a7aad1d43224950fZhongxing Xu const CXXThisRegion *thisReg = getCXXThisRegion(decl, stackFrame); 350d074441e027471a914cbb909a7aad1d43224950fZhongxing Xu 351d074441e027471a914cbb909a7aad1d43224950fZhongxing Xu SVal thisVal = pred->getState()->getSVal(thisReg); 3529dc84c9455df2a77195147d0210c915dc1775a88Zhongxing Xu 35300eb3f9c5b33e3d99aee1f8b75dd9c9678fdd66bFrancois Pichet if (BMI->isAnyMemberInitializer()) { 3549dc84c9455df2a77195147d0210c915dc1775a88Zhongxing Xu ExplodedNodeSet Dst; 3559dc84c9455df2a77195147d0210c915dc1775a88Zhongxing Xu 3569dc84c9455df2a77195147d0210c915dc1775a88Zhongxing Xu // Evaluate the initializer. 357d074441e027471a914cbb909a7aad1d43224950fZhongxing Xu Visit(BMI->getInit(), pred, Dst); 3589dc84c9455df2a77195147d0210c915dc1775a88Zhongxing Xu 3599dc84c9455df2a77195147d0210c915dc1775a88Zhongxing Xu for (ExplodedNodeSet::iterator I = Dst.begin(), E = Dst.end(); I != E; ++I){ 3609dc84c9455df2a77195147d0210c915dc1775a88Zhongxing Xu ExplodedNode *Pred = *I; 36118c66fdc3c4008d335885695fe36fb5353c5f672Ted Kremenek const ProgramState *state = Pred->getState(); 3629dc84c9455df2a77195147d0210c915dc1775a88Zhongxing Xu 36300eb3f9c5b33e3d99aee1f8b75dd9c9678fdd66bFrancois Pichet const FieldDecl *FD = BMI->getAnyMember(); 3649dc84c9455df2a77195147d0210c915dc1775a88Zhongxing Xu 365d074441e027471a914cbb909a7aad1d43224950fZhongxing Xu SVal FieldLoc = state->getLValue(FD, thisVal); 3669dc84c9455df2a77195147d0210c915dc1775a88Zhongxing Xu SVal InitVal = state->getSVal(BMI->getInit()); 3679dc84c9455df2a77195147d0210c915dc1775a88Zhongxing Xu state = state->bindLoc(FieldLoc, InitVal); 3689dc84c9455df2a77195147d0210c915dc1775a88Zhongxing Xu 3699dc84c9455df2a77195147d0210c915dc1775a88Zhongxing Xu // Use a custom node building process. 370d074441e027471a914cbb909a7aad1d43224950fZhongxing Xu PostInitializer PP(BMI, stackFrame); 3719dc84c9455df2a77195147d0210c915dc1775a88Zhongxing Xu // Builder automatically add the generated node to the deferred set, 3729dc84c9455df2a77195147d0210c915dc1775a88Zhongxing Xu // which are processed in the builder's dtor. 3739dc84c9455df2a77195147d0210c915dc1775a88Zhongxing Xu builder.generateNode(PP, state, Pred); 3749dc84c9455df2a77195147d0210c915dc1775a88Zhongxing Xu } 375d074441e027471a914cbb909a7aad1d43224950fZhongxing Xu return; 3769dc84c9455df2a77195147d0210c915dc1775a88Zhongxing Xu } 377d074441e027471a914cbb909a7aad1d43224950fZhongxing Xu 378d074441e027471a914cbb909a7aad1d43224950fZhongxing Xu assert(BMI->isBaseInitializer()); 379d074441e027471a914cbb909a7aad1d43224950fZhongxing Xu 380d074441e027471a914cbb909a7aad1d43224950fZhongxing Xu // Get the base class declaration. 381d074441e027471a914cbb909a7aad1d43224950fZhongxing Xu const CXXConstructExpr *ctorExpr = cast<CXXConstructExpr>(BMI->getInit()); 382d074441e027471a914cbb909a7aad1d43224950fZhongxing Xu 383d074441e027471a914cbb909a7aad1d43224950fZhongxing Xu // Create the base object region. 384d074441e027471a914cbb909a7aad1d43224950fZhongxing Xu SVal baseVal = 385d074441e027471a914cbb909a7aad1d43224950fZhongxing Xu getStoreManager().evalDerivedToBase(thisVal, ctorExpr->getType()); 386d074441e027471a914cbb909a7aad1d43224950fZhongxing Xu const MemRegion *baseReg = baseVal.getAsRegion(); 387d074441e027471a914cbb909a7aad1d43224950fZhongxing Xu assert(baseReg); 388d074441e027471a914cbb909a7aad1d43224950fZhongxing Xu Builder = &builder; 389d074441e027471a914cbb909a7aad1d43224950fZhongxing Xu ExplodedNodeSet dst; 390d074441e027471a914cbb909a7aad1d43224950fZhongxing Xu VisitCXXConstructExpr(ctorExpr, baseReg, pred, dst); 3919c6cd67ea416bace666d614c84d5531124287653Zhongxing Xu} 3929c6cd67ea416bace666d614c84d5531124287653Zhongxing Xu 393d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidisvoid ExprEngine::ProcessImplicitDtor(const CFGImplicitDtor D, 394d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidis StmtNodeBuilder &builder) { 395b13453bd8a91f331d0910ca95ad52aa41b52f648Zhongxing Xu Builder = &builder; 396b13453bd8a91f331d0910ca95ad52aa41b52f648Zhongxing Xu 3973c0349e87cdbd7316d06d2411d86ee1086e717a5Ted Kremenek switch (D.getKind()) { 3984ffcb9974c6b7142c4a1483abfcb1f88b6371c45Zhongxing Xu case CFGElement::AutomaticObjectDtor: 3994ffcb9974c6b7142c4a1483abfcb1f88b6371c45Zhongxing Xu ProcessAutomaticObjDtor(cast<CFGAutomaticObjDtor>(D), builder); 4004ffcb9974c6b7142c4a1483abfcb1f88b6371c45Zhongxing Xu break; 4014ffcb9974c6b7142c4a1483abfcb1f88b6371c45Zhongxing Xu case CFGElement::BaseDtor: 4024ffcb9974c6b7142c4a1483abfcb1f88b6371c45Zhongxing Xu ProcessBaseDtor(cast<CFGBaseDtor>(D), builder); 4034ffcb9974c6b7142c4a1483abfcb1f88b6371c45Zhongxing Xu break; 4044ffcb9974c6b7142c4a1483abfcb1f88b6371c45Zhongxing Xu case CFGElement::MemberDtor: 4054ffcb9974c6b7142c4a1483abfcb1f88b6371c45Zhongxing Xu ProcessMemberDtor(cast<CFGMemberDtor>(D), builder); 4064ffcb9974c6b7142c4a1483abfcb1f88b6371c45Zhongxing Xu break; 4074ffcb9974c6b7142c4a1483abfcb1f88b6371c45Zhongxing Xu case CFGElement::TemporaryDtor: 4084ffcb9974c6b7142c4a1483abfcb1f88b6371c45Zhongxing Xu ProcessTemporaryDtor(cast<CFGTemporaryDtor>(D), builder); 4094ffcb9974c6b7142c4a1483abfcb1f88b6371c45Zhongxing Xu break; 4104ffcb9974c6b7142c4a1483abfcb1f88b6371c45Zhongxing Xu default: 4114ffcb9974c6b7142c4a1483abfcb1f88b6371c45Zhongxing Xu llvm_unreachable("Unexpected dtor kind."); 4124ffcb9974c6b7142c4a1483abfcb1f88b6371c45Zhongxing Xu } 4134ffcb9974c6b7142c4a1483abfcb1f88b6371c45Zhongxing Xu} 4144ffcb9974c6b7142c4a1483abfcb1f88b6371c45Zhongxing Xu 415d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidisvoid ExprEngine::ProcessAutomaticObjDtor(const CFGAutomaticObjDtor dtor, 416d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidis StmtNodeBuilder &builder) { 417b4857264b8d3d861f688cdaa174aab30e0729a73Ted Kremenek ExplodedNode *pred = builder.getPredecessor(); 41818c66fdc3c4008d335885695fe36fb5353c5f672Ted Kremenek const ProgramState *state = pred->getState(); 4192210490e6d099b7a5b4f68f44a136e4dcf3cdea2Zhongxing Xu const VarDecl *varDecl = dtor.getVarDecl(); 4202210490e6d099b7a5b4f68f44a136e4dcf3cdea2Zhongxing Xu 4212210490e6d099b7a5b4f68f44a136e4dcf3cdea2Zhongxing Xu QualType varType = varDecl->getType(); 4222210490e6d099b7a5b4f68f44a136e4dcf3cdea2Zhongxing Xu 4232210490e6d099b7a5b4f68f44a136e4dcf3cdea2Zhongxing Xu if (const ReferenceType *refType = varType->getAs<ReferenceType>()) 4242210490e6d099b7a5b4f68f44a136e4dcf3cdea2Zhongxing Xu varType = refType->getPointeeType(); 4252210490e6d099b7a5b4f68f44a136e4dcf3cdea2Zhongxing Xu 4262210490e6d099b7a5b4f68f44a136e4dcf3cdea2Zhongxing Xu const CXXRecordDecl *recordDecl = varType->getAsCXXRecordDecl(); 4272210490e6d099b7a5b4f68f44a136e4dcf3cdea2Zhongxing Xu assert(recordDecl && "get CXXRecordDecl fail"); 4282210490e6d099b7a5b4f68f44a136e4dcf3cdea2Zhongxing Xu const CXXDestructorDecl *dtorDecl = recordDecl->getDestructor(); 429b13453bd8a91f331d0910ca95ad52aa41b52f648Zhongxing Xu 4302210490e6d099b7a5b4f68f44a136e4dcf3cdea2Zhongxing Xu Loc dest = state->getLValue(varDecl, pred->getLocationContext()); 431b13453bd8a91f331d0910ca95ad52aa41b52f648Zhongxing Xu 4322210490e6d099b7a5b4f68f44a136e4dcf3cdea2Zhongxing Xu ExplodedNodeSet dstSet; 4332210490e6d099b7a5b4f68f44a136e4dcf3cdea2Zhongxing Xu VisitCXXDestructor(dtorDecl, cast<loc::MemRegionVal>(dest).getRegion(), 4342210490e6d099b7a5b4f68f44a136e4dcf3cdea2Zhongxing Xu dtor.getTriggerStmt(), pred, dstSet); 4354ffcb9974c6b7142c4a1483abfcb1f88b6371c45Zhongxing Xu} 4364ffcb9974c6b7142c4a1483abfcb1f88b6371c45Zhongxing Xu 437d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidisvoid ExprEngine::ProcessBaseDtor(const CFGBaseDtor D, 438d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidis StmtNodeBuilder &builder) { 4394ffcb9974c6b7142c4a1483abfcb1f88b6371c45Zhongxing Xu} 4404ffcb9974c6b7142c4a1483abfcb1f88b6371c45Zhongxing Xu 441d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidisvoid ExprEngine::ProcessMemberDtor(const CFGMemberDtor D, 442d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidis StmtNodeBuilder &builder) { 4434ffcb9974c6b7142c4a1483abfcb1f88b6371c45Zhongxing Xu} 4444ffcb9974c6b7142c4a1483abfcb1f88b6371c45Zhongxing Xu 445d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidisvoid ExprEngine::ProcessTemporaryDtor(const CFGTemporaryDtor D, 446d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidis StmtNodeBuilder &builder) { 4479c6cd67ea416bace666d614c84d5531124287653Zhongxing Xu} 4489c6cd67ea416bace666d614c84d5531124287653Zhongxing Xu 4499c378f705405d37f49795d5e915989de774fe11fTed Kremenekvoid ExprEngine::Visit(const Stmt *S, ExplodedNode *Pred, 4509c378f705405d37f49795d5e915989de774fe11fTed Kremenek ExplodedNodeSet &Dst) { 4510bed8a12f2878d3cd94fb8bdba55b593d92dd11aTed Kremenek PrettyStackTraceLoc CrashInfo(getContext().getSourceManager(), 4520bed8a12f2878d3cd94fb8bdba55b593d92dd11aTed Kremenek S->getLocStart(), 4530bed8a12f2878d3cd94fb8bdba55b593d92dd11aTed Kremenek "Error evaluating statement"); 4540bed8a12f2878d3cd94fb8bdba55b593d92dd11aTed Kremenek 455f6a1648197562e0b133440d612d9af297d0a86ccJohn McCall // Expressions to ignore. 456f6a1648197562e0b133440d612d9af297d0a86ccJohn McCall if (const Expr *Ex = dyn_cast<Expr>(S)) 457892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek S = Ex->IgnoreParens(); 458f6a1648197562e0b133440d612d9af297d0a86ccJohn McCall 459e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek // FIXME: add metadata to the CFG so that we can disable 460e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek // this check when we KNOW that there is no block-level subexpression. 461e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek // The motivation is that this check requires a hashtable lookup. 4621eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 4630a3ed3143b00f237decb1288c1ff574ae09eba4eTed Kremenek if (S != currentStmt && Pred->getLocationContext()->getCFG()->isBlkExpr(S)) { 464e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek Dst.Add(Pred); 465e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek return; 466e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek } 4671eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 468e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek switch (S->getStmtClass()) { 469f85e193739c953358c865005855253af4f68a497John McCall // C++ and ARC stuff we don't support yet. 470f85e193739c953358c865005855253af4f68a497John McCall case Expr::ObjCIndirectCopyRestoreExprClass: 4711b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::CXXBindTemporaryExprClass: 4721b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::CXXCatchStmtClass: 4731b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::CXXDependentScopeMemberExprClass: 474ad762fcdc16b9e4705b12b09d92b8c026212b906Richard Smith case Stmt::CXXForRangeStmtClass: 4751b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::CXXPseudoDestructorExprClass: 476c768a0c46e6c064c3281d663777ee95aea8652eeTed Kremenek case Stmt::CXXTemporaryObjectExprClass: 4771b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::CXXThrowExprClass: 4781b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::CXXTryStmtClass: 4791b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::CXXTypeidExprClass: 4809be88403e965cc49af76c9d33d818781d44b333eFrancois Pichet case Stmt::CXXUuidofExprClass: 481c768a0c46e6c064c3281d663777ee95aea8652eeTed Kremenek case Stmt::CXXUnresolvedConstructExprClass: 482ed8abf18329df67b0abcbb3a10458bd8c1d2a595Douglas Gregor case Stmt::CXXScalarValueInitExprClass: 4831b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::DependentScopeDeclRefExprClass: 4841b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::UnaryTypeTraitExprClass: 4856ad6f2848d7652ab2991286eb48be440d3493b28Francois Pichet case Stmt::BinaryTypeTraitExprClass: 48621ff2e516b0e0bc8c1dbf965cb3d44bac3c64330John Wiegley case Stmt::ArrayTypeTraitExprClass: 487552622067dc45013d240f73952fece703f5e63bdJohn Wiegley case Stmt::ExpressionTraitExprClass: 4881b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::UnresolvedLookupExprClass: 489c768a0c46e6c064c3281d663777ee95aea8652eeTed Kremenek case Stmt::UnresolvedMemberExprClass: 4906b219d082434394c1ac401390ec1d1967727815aSebastian Redl case Stmt::CXXNoexceptExprClass: 491be230c36e32142cbdcdbe9c97511d097beeecbabDouglas Gregor case Stmt::PackExpansionExprClass: 492c7793c73ba8a343de3f2552d984851985a46f159Douglas Gregor case Stmt::SubstNonTypeTemplateParmPackExprClass: 49328bbe4b8acc338476fe0825769b41fb32b423c72John Wiegley case Stmt::SEHTryStmtClass: 49428bbe4b8acc338476fe0825769b41fb32b423c72John Wiegley case Stmt::SEHExceptStmtClass: 49528bbe4b8acc338476fe0825769b41fb32b423c72John Wiegley case Stmt::SEHFinallyStmtClass: 4961b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek { 497c768a0c46e6c064c3281d663777ee95aea8652eeTed Kremenek SaveAndRestore<bool> OldSink(Builder->BuildSinks); 498c768a0c46e6c064c3281d663777ee95aea8652eeTed Kremenek Builder->BuildSinks = true; 499db5e8cd095d1ffdd18f5620ad2348b5f386bebe3Anna Zaks const ExplodedNode *node = MakeNode(Dst, S, Pred, Pred->getState()); 500422ab7a49a9a4252dbc6350e49d7a5708337b9c7Ted Kremenek Engine.addAbortedBlock(node, Builder->getBlock()); 501c768a0c46e6c064c3281d663777ee95aea8652eeTed Kremenek break; 502c768a0c46e6c064c3281d663777ee95aea8652eeTed Kremenek } 5035fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek 5045fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek // We don't handle default arguments either yet, but we can fake it 5055fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek // for now by just skipping them. 50691a5755ad73c5dc1dfb167e448fdd74e75a6df56John McCall case Stmt::SubstNonTypeTemplateParmExprClass: 5075fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek case Stmt::CXXDefaultArgExprClass: { 5085fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek Dst.Add(Pred); 5095fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek break; 5105fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek } 5115fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek 512f6a1648197562e0b133440d612d9af297d0a86ccJohn McCall case Stmt::ParenExprClass: 513f6a1648197562e0b133440d612d9af297d0a86ccJohn McCall llvm_unreachable("ParenExprs already handled."); 514f111d935722ed488144600cea5ed03a6b5069e8fPeter Collingbourne case Stmt::GenericSelectionExprClass: 515f111d935722ed488144600cea5ed03a6b5069e8fPeter Collingbourne llvm_unreachable("GenericSelectionExprs already handled."); 5161b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek // Cases that should never be evaluated simply because they shouldn't 5171b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek // appear in the CFG. 5181b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::BreakStmtClass: 5191b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::CaseStmtClass: 5201b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::CompoundStmtClass: 5211b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::ContinueStmtClass: 5221b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::DefaultStmtClass: 5231b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::DoStmtClass: 524d40066b0fb883839a9100e5455e33190b9b8abacTed Kremenek case Stmt::ForStmtClass: 5251b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::GotoStmtClass: 526d40066b0fb883839a9100e5455e33190b9b8abacTed Kremenek case Stmt::IfStmtClass: 5271b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::IndirectGotoStmtClass: 5281b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::LabelStmtClass: 5291b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::NoStmtClass: 5301b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::NullStmtClass: 531d40066b0fb883839a9100e5455e33190b9b8abacTed Kremenek case Stmt::SwitchStmtClass: 532d40066b0fb883839a9100e5455e33190b9b8abacTed Kremenek case Stmt::WhileStmtClass: 5331b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek llvm_unreachable("Stmt should not be in analyzer evaluation loop"); 5341b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek break; 5351b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek 5368ad9cbc518a603176462f1fa1efe389023590082Ted Kremenek case Stmt::GNUNullExprClass: { 5378f08426e6f54ed20b959018f24dbea106a00b4adJordy Rose // GNU __null is a pointer-width integer, not an actual pointer. 53818c66fdc3c4008d335885695fe36fb5353c5f672Ted Kremenek const ProgramState *state = Pred->getState(); 5398f08426e6f54ed20b959018f24dbea106a00b4adJordy Rose state = state->BindExpr(S, svalBuilder.makeIntValWithPtrWidth(0, false)); 5408f08426e6f54ed20b959018f24dbea106a00b4adJordy Rose MakeNode(Dst, S, Pred, state); 5418ad9cbc518a603176462f1fa1efe389023590082Ted Kremenek break; 5428ad9cbc518a603176462f1fa1efe389023590082Ted Kremenek } 5438ad9cbc518a603176462f1fa1efe389023590082Ted Kremenek 5444beaa9f51b2da57c64740cef2bd1c2fdb0c325d5Ted Kremenek case Stmt::ObjCAtSynchronizedStmtClass: 5454beaa9f51b2da57c64740cef2bd1c2fdb0c325d5Ted Kremenek VisitObjCAtSynchronizedStmt(cast<ObjCAtSynchronizedStmt>(S), Pred, Dst); 5464beaa9f51b2da57c64740cef2bd1c2fdb0c325d5Ted Kremenek break; 5474beaa9f51b2da57c64740cef2bd1c2fdb0c325d5Ted Kremenek 54814429b918bd2f4cb52abc75546a7fe37142054caArgyrios Kyrtzidis case Stmt::ObjCPropertyRefExprClass: 54914429b918bd2f4cb52abc75546a7fe37142054caArgyrios Kyrtzidis VisitObjCPropertyRefExpr(cast<ObjCPropertyRefExpr>(S), Pred, Dst); 55014429b918bd2f4cb52abc75546a7fe37142054caArgyrios Kyrtzidis break; 55114429b918bd2f4cb52abc75546a7fe37142054caArgyrios Kyrtzidis 552f85e193739c953358c865005855253af4f68a497John McCall case Stmt::ImplicitValueInitExprClass: { 55318c66fdc3c4008d335885695fe36fb5353c5f672Ted Kremenek const ProgramState *state = Pred->getState(); 554f85e193739c953358c865005855253af4f68a497John McCall QualType ty = cast<ImplicitValueInitExpr>(S)->getType(); 555f85e193739c953358c865005855253af4f68a497John McCall SVal val = svalBuilder.makeZeroVal(ty); 556f85e193739c953358c865005855253af4f68a497John McCall MakeNode(Dst, S, Pred, state->BindExpr(S, val)); 557f85e193739c953358c865005855253af4f68a497John McCall break; 558f85e193739c953358c865005855253af4f68a497John McCall } 559f85e193739c953358c865005855253af4f68a497John McCall 560f85e193739c953358c865005855253af4f68a497John McCall case Stmt::ExprWithCleanupsClass: { 561f85e193739c953358c865005855253af4f68a497John McCall Visit(cast<ExprWithCleanups>(S)->getSubExpr(), Pred, Dst); 562f85e193739c953358c865005855253af4f68a497John McCall break; 563f85e193739c953358c865005855253af4f68a497John McCall } 564f85e193739c953358c865005855253af4f68a497John McCall 5651b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek // Cases not handled yet; but will handle some day. 5661b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::DesignatedInitExprClass: 5671b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::ExtVectorElementExprClass: 5681b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::ImaginaryLiteralClass: 5691b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::ObjCAtCatchStmtClass: 5701b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::ObjCAtFinallyStmtClass: 5711b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::ObjCAtTryStmtClass: 572f85e193739c953358c865005855253af4f68a497John McCall case Stmt::ObjCAutoreleasePoolStmtClass: 5731b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::ObjCEncodeExprClass: 5741b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::ObjCIsaExprClass: 5751b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::ObjCProtocolExprClass: 5761b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::ObjCSelectorExprClass: 5771b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::ObjCStringLiteralClass: 5781b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::ParenListExprClass: 5791b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::PredefinedExprClass: 5801b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::ShuffleVectorExprClass: 5811b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::VAArgExprClass: 582e08ce650a2b02410eddd1f60a4aa6b3d4be71e73Peter Collingbourne case Stmt::CUDAKernelCallExprClass: 58356ca35d396d8692c384c785f9aeebcf22563fe1eJohn McCall case Stmt::OpaqueValueExprClass: 58461eee0ca33b29e102f11bab77c8b74cc00e2392bTanya Lattner case Stmt::AsTypeExprClass: 5851b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek // Fall through. 5861b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek 5871b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek // Cases we intentionally don't evaluate, since they don't need 5881b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek // to be explicitly evaluated. 589bc9ad74a13e83303a3a5251f8bacbbca17341c17Zhongxing Xu case Stmt::AddrLabelExprClass: 590bc9ad74a13e83303a3a5251f8bacbbca17341c17Zhongxing Xu case Stmt::IntegerLiteralClass: 591bc9ad74a13e83303a3a5251f8bacbbca17341c17Zhongxing Xu case Stmt::CharacterLiteralClass: 592477323d58a0de352c6a61e08b5a83127c4adc904Zhongxing Xu case Stmt::CXXBoolLiteralExprClass: 593bc9ad74a13e83303a3a5251f8bacbbca17341c17Zhongxing Xu case Stmt::FloatingLiteralClass: 594f901a7de97f46ba2b1ff153f9fb83d00dc37cfcfDouglas Gregor case Stmt::SizeOfPackExprClass: 595e970c60dadaf22019743724bac879dbefbc4f5e3Ted Kremenek case Stmt::CXXNullPtrLiteralExprClass: 596e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek Dst.Add(Pred); // No-op. Simply propagate the current state unchanged. 597e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek break; 5981eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 599540cbe2b60294fe7b926c26b4f1840f544fe3011Ted Kremenek case Stmt::ArraySubscriptExprClass: 600892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek VisitLvalArraySubscriptExpr(cast<ArraySubscriptExpr>(S), Pred, Dst); 601540cbe2b60294fe7b926c26b4f1840f544fe3011Ted Kremenek break; 6021eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 603e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek case Stmt::AsmStmtClass: 604e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek VisitAsmStmt(cast<AsmStmt>(S), Pred, Dst); 605e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek break; 606b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 607892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek case Stmt::BlockDeclRefExprClass: { 608892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek const BlockDeclRefExpr *BE = cast<BlockDeclRefExpr>(S); 609892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek VisitCommonDeclRefExpr(BE, BE->getDecl(), Pred, Dst); 61067d1287035767f4f6c8ca0c2bb755990012a44caTed Kremenek break; 611892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek } 6121eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 613c95ad9ff6e574aecdd759542d5578bc65d586d93Ted Kremenek case Stmt::BlockExprClass: 614c95ad9ff6e574aecdd759542d5578bc65d586d93Ted Kremenek VisitBlockExpr(cast<BlockExpr>(S), Pred, Dst); 615c95ad9ff6e574aecdd759542d5578bc65d586d93Ted Kremenek break; 616c95ad9ff6e574aecdd759542d5578bc65d586d93Ted Kremenek 617e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek case Stmt::BinaryOperatorClass: { 61803509aea098772644bf4662dc1c88634818ceeccZhongxing Xu const BinaryOperator* B = cast<BinaryOperator>(S); 619e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek if (B->isLogicalOp()) { 620e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek VisitLogicalExpr(B, Pred, Dst); 621e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek break; 622e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek } 6232de56d1d0c3a504ad1529de2677628bdfbb95cd4John McCall else if (B->getOpcode() == BO_Comma) { 62418c66fdc3c4008d335885695fe36fb5353c5f672Ted Kremenek const ProgramState *state = Pred->getState(); 6251397663af9dbcc24dbf0e11de43931b3dc08fdbbTed Kremenek MakeNode(Dst, B, Pred, state->BindExpr(B, state->getSVal(B->getRHS()))); 626e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek break; 627e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek } 62806fb99fb403bff1651429923f666a2ebe2b1522fTed Kremenek 629b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek if (AMgr.shouldEagerlyAssume() && 630bb141217871e93767aa3f2de1b9946fa6d37066aZhongxing Xu (B->isRelationalOp() || B->isEqualityOp())) { 631031ccc0555a82afc2e8afe29e19dd57ff204e2deZhongxing Xu ExplodedNodeSet Tmp; 632892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek VisitBinaryOperator(cast<BinaryOperator>(S), Pred, Tmp); 6339c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek evalEagerlyAssume(Dst, Tmp, cast<Expr>(S)); 63448af2a9c1ed3259512f2d1431720add1fbe8fb5fTed Kremenek } 63548af2a9c1ed3259512f2d1431720add1fbe8fb5fTed Kremenek else 636892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek VisitBinaryOperator(cast<BinaryOperator>(S), Pred, Dst); 63748af2a9c1ed3259512f2d1431720add1fbe8fb5fTed Kremenek 638e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek break; 639e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek } 64006fb99fb403bff1651429923f666a2ebe2b1522fTed Kremenek 641b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek case Stmt::CallExprClass: 642b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek case Stmt::CXXOperatorCallExprClass: 643b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek case Stmt::CXXMemberCallExprClass: { 644b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek VisitCallExpr(cast<CallExpr>(S), Pred, Dst); 64506fb99fb403bff1651429923f666a2ebe2b1522fTed Kremenek break; 646e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek } 64706fb99fb403bff1651429923f666a2ebe2b1522fTed Kremenek 6487ce351db56fbce162a3b650518ce05b5c61ebf36Zhongxing Xu case Stmt::CXXConstructExprClass: { 6497ce351db56fbce162a3b650518ce05b5c61ebf36Zhongxing Xu const CXXConstructExpr *C = cast<CXXConstructExpr>(S); 6507ce351db56fbce162a3b650518ce05b5c61ebf36Zhongxing Xu // For block-level CXXConstructExpr, we don't have a destination region. 6517ce351db56fbce162a3b650518ce05b5c61ebf36Zhongxing Xu // Let VisitCXXConstructExpr() create one. 652892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek VisitCXXConstructExpr(C, 0, Pred, Dst); 6537ce351db56fbce162a3b650518ce05b5c61ebf36Zhongxing Xu break; 6547ce351db56fbce162a3b650518ce05b5c61ebf36Zhongxing Xu } 6557ce351db56fbce162a3b650518ce05b5c61ebf36Zhongxing Xu 656856c6bcaea56e05255e9f3997ddd56b5c18a14f0Zhongxing Xu case Stmt::CXXNewExprClass: { 65703509aea098772644bf4662dc1c88634818ceeccZhongxing Xu const CXXNewExpr *NE = cast<CXXNewExpr>(S); 658856c6bcaea56e05255e9f3997ddd56b5c18a14f0Zhongxing Xu VisitCXXNewExpr(NE, Pred, Dst); 659856c6bcaea56e05255e9f3997ddd56b5c18a14f0Zhongxing Xu break; 660856c6bcaea56e05255e9f3997ddd56b5c18a14f0Zhongxing Xu } 661856c6bcaea56e05255e9f3997ddd56b5c18a14f0Zhongxing Xu 6626b8513829895e56a7b97e787ea74520bc626512eZhongxing Xu case Stmt::CXXDeleteExprClass: { 66303509aea098772644bf4662dc1c88634818ceeccZhongxing Xu const CXXDeleteExpr *CDE = cast<CXXDeleteExpr>(S); 6646b8513829895e56a7b97e787ea74520bc626512eZhongxing Xu VisitCXXDeleteExpr(CDE, Pred, Dst); 6656b8513829895e56a7b97e787ea74520bc626512eZhongxing Xu break; 6666b8513829895e56a7b97e787ea74520bc626512eZhongxing Xu } 667e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek // FIXME: ChooseExpr is really a constant. We need to fix 668e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek // the CFG do not model them as explicit control-flow. 6691eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 670e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek case Stmt::ChooseExprClass: { // __builtin_choose_expr 6719c378f705405d37f49795d5e915989de774fe11fTed Kremenek const ChooseExpr *C = cast<ChooseExpr>(S); 672e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek VisitGuardedExpr(C, C->getLHS(), C->getRHS(), Pred, Dst); 673e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek break; 674e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek } 6751eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 676e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek case Stmt::CompoundAssignOperatorClass: 677892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek VisitBinaryOperator(cast<BinaryOperator>(S), Pred, Dst); 678e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek break; 679f22679e3e5d5f5754931952e58112b4c863a4137Zhongxing Xu 680f22679e3e5d5f5754931952e58112b4c863a4137Zhongxing Xu case Stmt::CompoundLiteralExprClass: 681892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek VisitCompoundLiteralExpr(cast<CompoundLiteralExpr>(S), Pred, Dst); 682f22679e3e5d5f5754931952e58112b4c863a4137Zhongxing Xu break; 6831eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 68456ca35d396d8692c384c785f9aeebcf22563fe1eJohn McCall case Stmt::BinaryConditionalOperatorClass: 685e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek case Stmt::ConditionalOperatorClass: { // '?' operator 68656ca35d396d8692c384c785f9aeebcf22563fe1eJohn McCall const AbstractConditionalOperator *C 68756ca35d396d8692c384c785f9aeebcf22563fe1eJohn McCall = cast<AbstractConditionalOperator>(S); 68856ca35d396d8692c384c785f9aeebcf22563fe1eJohn McCall VisitGuardedExpr(C, C->getTrueExpr(), C->getFalseExpr(), Pred, Dst); 689e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek break; 690e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek } 6911eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 692bb141217871e93767aa3f2de1b9946fa6d37066aZhongxing Xu case Stmt::CXXThisExprClass: 693bb141217871e93767aa3f2de1b9946fa6d37066aZhongxing Xu VisitCXXThisExpr(cast<CXXThisExpr>(S), Pred, Dst); 694bb141217871e93767aa3f2de1b9946fa6d37066aZhongxing Xu break; 695bb141217871e93767aa3f2de1b9946fa6d37066aZhongxing Xu 696892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek case Stmt::DeclRefExprClass: { 697892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek const DeclRefExpr *DE = cast<DeclRefExpr>(S); 698892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek VisitCommonDeclRefExpr(DE, DE->getDecl(), Pred, Dst); 699e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek break; 700892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek } 7011eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 702e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek case Stmt::DeclStmtClass: 703e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek VisitDeclStmt(cast<DeclStmt>(S), Pred, Dst); 704e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek break; 7051eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 7060835a3cdeefe714b4959d31127ea155e56393125Argyrios Kyrtzidis case Stmt::ImplicitCastExprClass: 7070d9d736c49b51691ced96759ec99399824e2a602Zhongxing Xu case Stmt::CStyleCastExprClass: 7080d9d736c49b51691ced96759ec99399824e2a602Zhongxing Xu case Stmt::CXXStaticCastExprClass: 7090d9d736c49b51691ced96759ec99399824e2a602Zhongxing Xu case Stmt::CXXDynamicCastExprClass: 7100d9d736c49b51691ced96759ec99399824e2a602Zhongxing Xu case Stmt::CXXReinterpretCastExprClass: 7110d9d736c49b51691ced96759ec99399824e2a602Zhongxing Xu case Stmt::CXXConstCastExprClass: 712f85e193739c953358c865005855253af4f68a497John McCall case Stmt::CXXFunctionalCastExprClass: 713f85e193739c953358c865005855253af4f68a497John McCall case Stmt::ObjCBridgedCastExprClass: { 7149c378f705405d37f49795d5e915989de774fe11fTed Kremenek const CastExpr *C = cast<CastExpr>(S); 715f85e193739c953358c865005855253af4f68a497John McCall // Handle the previsit checks. 716f85e193739c953358c865005855253af4f68a497John McCall ExplodedNodeSet dstPrevisit; 717f85e193739c953358c865005855253af4f68a497John McCall getCheckerManager().runCheckersForPreStmt(dstPrevisit, Pred, C, *this); 718f85e193739c953358c865005855253af4f68a497John McCall 719f85e193739c953358c865005855253af4f68a497John McCall // Handle the expression itself. 720f85e193739c953358c865005855253af4f68a497John McCall ExplodedNodeSet dstExpr; 721f85e193739c953358c865005855253af4f68a497John McCall for (ExplodedNodeSet::iterator i = dstPrevisit.begin(), 722f85e193739c953358c865005855253af4f68a497John McCall e = dstPrevisit.end(); i != e ; ++i) { 723f85e193739c953358c865005855253af4f68a497John McCall VisitCast(C, C->getSubExpr(), *i, dstExpr); 724f85e193739c953358c865005855253af4f68a497John McCall } 725f85e193739c953358c865005855253af4f68a497John McCall 726f85e193739c953358c865005855253af4f68a497John McCall // Handle the postvisit checks. 727f85e193739c953358c865005855253af4f68a497John McCall getCheckerManager().runCheckersForPostStmt(Dst, dstExpr, C, *this); 728e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek break; 729e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek } 730b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 73103e80030515c800d1ab44125b9052dfffd1bd04cDouglas Gregor case Expr::MaterializeTemporaryExprClass: { 73203e80030515c800d1ab44125b9052dfffd1bd04cDouglas Gregor const MaterializeTemporaryExpr *Materialize 73303e80030515c800d1ab44125b9052dfffd1bd04cDouglas Gregor = cast<MaterializeTemporaryExpr>(S); 73403e80030515c800d1ab44125b9052dfffd1bd04cDouglas Gregor if (!Materialize->getType()->isRecordType()) 735eea72a925f294225391ecec876a342771c09b635Ted Kremenek CreateCXXTemporaryObject(Materialize, Pred, Dst); 73603e80030515c800d1ab44125b9052dfffd1bd04cDouglas Gregor else 73703e80030515c800d1ab44125b9052dfffd1bd04cDouglas Gregor Visit(Materialize->GetTemporaryExpr(), Pred, Dst); 73803e80030515c800d1ab44125b9052dfffd1bd04cDouglas Gregor break; 73903e80030515c800d1ab44125b9052dfffd1bd04cDouglas Gregor } 74003e80030515c800d1ab44125b9052dfffd1bd04cDouglas Gregor 741c4f8706b6539e06a5de153bd72850bb2e0a71456Zhongxing Xu case Stmt::InitListExprClass: 742c4f8706b6539e06a5de153bd72850bb2e0a71456Zhongxing Xu VisitInitListExpr(cast<InitListExpr>(S), Pred, Dst); 743c4f8706b6539e06a5de153bd72850bb2e0a71456Zhongxing Xu break; 7441eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 74597ed4f68f5dba3e21e7a490ef0f9ffd3bfead7f8Ted Kremenek case Stmt::MemberExprClass: 746892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek VisitMemberExpr(cast<MemberExpr>(S), Pred, Dst); 747469ecbded3616416ef938ed94a67f86149faf226Ted Kremenek break; 74897ed4f68f5dba3e21e7a490ef0f9ffd3bfead7f8Ted Kremenek case Stmt::ObjCIvarRefExprClass: 749892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek VisitLvalObjCIvarRefExpr(cast<ObjCIvarRefExpr>(S), Pred, Dst); 75097ed4f68f5dba3e21e7a490ef0f9ffd3bfead7f8Ted Kremenek break; 751af3374187c47acea45706eab6744be6b1c66a856Ted Kremenek 752af3374187c47acea45706eab6744be6b1c66a856Ted Kremenek case Stmt::ObjCForCollectionStmtClass: 753af3374187c47acea45706eab6744be6b1c66a856Ted Kremenek VisitObjCForCollectionStmt(cast<ObjCForCollectionStmt>(S), Pred, Dst); 754af3374187c47acea45706eab6744be6b1c66a856Ted Kremenek break; 7551eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 75638ac4f504bf8ed514520b5a82be538bdb0860687Ted Kremenek case Stmt::ObjCMessageExprClass: 7574410a935e8d8ee3c903b858bbf74ca24fce629b5Ted Kremenek VisitObjCMessage(cast<ObjCMessageExpr>(S), Pred, Dst); 758e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek break; 7591eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 760bbfd07a0c94f659beaf74316029ef73769cefb81Ted Kremenek case Stmt::ObjCAtThrowStmtClass: { 761bbfd07a0c94f659beaf74316029ef73769cefb81Ted Kremenek // FIXME: This is not complete. We basically treat @throw as 762bbfd07a0c94f659beaf74316029ef73769cefb81Ted Kremenek // an abort. 763bbfd07a0c94f659beaf74316029ef73769cefb81Ted Kremenek SaveAndRestore<bool> OldSink(Builder->BuildSinks); 764bbfd07a0c94f659beaf74316029ef73769cefb81Ted Kremenek Builder->BuildSinks = true; 765db5e8cd095d1ffdd18f5620ad2348b5f386bebe3Anna Zaks MakeNode(Dst, S, Pred, Pred->getState()); 766bbfd07a0c94f659beaf74316029ef73769cefb81Ted Kremenek break; 767bbfd07a0c94f659beaf74316029ef73769cefb81Ted Kremenek } 7681eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 7691b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek case Stmt::ReturnStmtClass: 7701b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek VisitReturnStmt(cast<ReturnStmt>(S), Pred, Dst); 7711b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek break; 7721eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 7738ecdb65716cd7914ffb2eeee993fa9039fcd31e8Douglas Gregor case Stmt::OffsetOfExprClass: 7748ecdb65716cd7914ffb2eeee993fa9039fcd31e8Douglas Gregor VisitOffsetOfExpr(cast<OffsetOfExpr>(S), Pred, Dst); 7758ecdb65716cd7914ffb2eeee993fa9039fcd31e8Douglas Gregor break; 7768ecdb65716cd7914ffb2eeee993fa9039fcd31e8Douglas Gregor 777f4e3cfbe8abd124be6341ef5d714819b4fbd9082Peter Collingbourne case Stmt::UnaryExprOrTypeTraitExprClass: 778f4e3cfbe8abd124be6341ef5d714819b4fbd9082Peter Collingbourne VisitUnaryExprOrTypeTraitExpr(cast<UnaryExprOrTypeTraitExpr>(S), 779f4e3cfbe8abd124be6341ef5d714819b4fbd9082Peter Collingbourne Pred, Dst); 780e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek break; 7811eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 782e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek case Stmt::StmtExprClass: { 7839c378f705405d37f49795d5e915989de774fe11fTed Kremenek const StmtExpr *SE = cast<StmtExpr>(S); 784a3d1eb85853eae7b719f679b40923826b5e4b7dfTed Kremenek 785a3d1eb85853eae7b719f679b40923826b5e4b7dfTed Kremenek if (SE->getSubStmt()->body_empty()) { 786a3d1eb85853eae7b719f679b40923826b5e4b7dfTed Kremenek // Empty statement expression. 787a3d1eb85853eae7b719f679b40923826b5e4b7dfTed Kremenek assert(SE->getType() == getContext().VoidTy 788a3d1eb85853eae7b719f679b40923826b5e4b7dfTed Kremenek && "Empty statement expression must have void type."); 789a3d1eb85853eae7b719f679b40923826b5e4b7dfTed Kremenek Dst.Add(Pred); 790a3d1eb85853eae7b719f679b40923826b5e4b7dfTed Kremenek break; 791a3d1eb85853eae7b719f679b40923826b5e4b7dfTed Kremenek } 7921eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 7939c378f705405d37f49795d5e915989de774fe11fTed Kremenek if (Expr *LastExpr = dyn_cast<Expr>(*SE->getSubStmt()->body_rbegin())) { 79418c66fdc3c4008d335885695fe36fb5353c5f672Ted Kremenek const ProgramState *state = Pred->getState(); 7951397663af9dbcc24dbf0e11de43931b3dc08fdbbTed Kremenek MakeNode(Dst, SE, Pred, state->BindExpr(SE, state->getSVal(LastExpr))); 796a3d1eb85853eae7b719f679b40923826b5e4b7dfTed Kremenek } 797e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek else 798e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek Dst.Add(Pred); 7991eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 800e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek break; 801e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek } 8026987c7b74146b9658b1925c5981f8b0cd0672b55Zhongxing Xu 803892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek case Stmt::StringLiteralClass: { 80418c66fdc3c4008d335885695fe36fb5353c5f672Ted Kremenek const ProgramState *state = Pred->getState(); 805892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek SVal V = state->getLValue(cast<StringLiteral>(S)); 806892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek MakeNode(Dst, S, Pred, state->BindExpr(S, V)); 807892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek return; 808892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek } 809b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 81072374594c5d9ade02451bc85cf9dfa5b0ea106e7Ted Kremenek case Stmt::UnaryOperatorClass: { 81103509aea098772644bf4662dc1c88634818ceeccZhongxing Xu const UnaryOperator *U = cast<UnaryOperator>(S); 8122de56d1d0c3a504ad1529de2677628bdfbb95cd4John McCall if (AMgr.shouldEagerlyAssume()&&(U->getOpcode() == UO_LNot)) { 813031ccc0555a82afc2e8afe29e19dd57ff204e2deZhongxing Xu ExplodedNodeSet Tmp; 814892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek VisitUnaryOperator(U, Pred, Tmp); 8159c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek evalEagerlyAssume(Dst, Tmp, U); 81672374594c5d9ade02451bc85cf9dfa5b0ea106e7Ted Kremenek } 81772374594c5d9ade02451bc85cf9dfa5b0ea106e7Ted Kremenek else 818892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek VisitUnaryOperator(U, Pred, Dst); 8191b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek break; 82072374594c5d9ade02451bc85cf9dfa5b0ea106e7Ted Kremenek } 8211b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek } 8221b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek} 8231b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek 824e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek//===----------------------------------------------------------------------===// 825e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek// Block entrance. (Update counters). 826e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek//===----------------------------------------------------------------------===// 827e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek 82827c54e57c4a012dcdf2b40cf985b70d0b9caa69eTed Kremenekvoid ExprEngine::processCFGBlockEntrance(ExplodedNodeSet &dstNodes, 82927c54e57c4a012dcdf2b40cf985b70d0b9caa69eTed Kremenek GenericNodeBuilder<BlockEntrance> &nodeBuilder){ 83027c54e57c4a012dcdf2b40cf985b70d0b9caa69eTed Kremenek 83127c54e57c4a012dcdf2b40cf985b70d0b9caa69eTed Kremenek // FIXME: Refactor this into a checker. 83227c54e57c4a012dcdf2b40cf985b70d0b9caa69eTed Kremenek const CFGBlock *block = nodeBuilder.getProgramPoint().getBlock(); 83327c54e57c4a012dcdf2b40cf985b70d0b9caa69eTed Kremenek ExplodedNode *pred = nodeBuilder.getPredecessor(); 83427c54e57c4a012dcdf2b40cf985b70d0b9caa69eTed Kremenek 83527c54e57c4a012dcdf2b40cf985b70d0b9caa69eTed Kremenek if (nodeBuilder.getBlockCounter().getNumVisited( 83627c54e57c4a012dcdf2b40cf985b70d0b9caa69eTed Kremenek pred->getLocationContext()->getCurrentStackFrame(), 83727c54e57c4a012dcdf2b40cf985b70d0b9caa69eTed Kremenek block->getBlockID()) >= AMgr.getMaxVisit()) { 838ca804539d908d3a0e8c72a0df5f1f571d29490bbTed Kremenek static SimpleProgramPointTag tag("ExprEngine : Block count exceeded"); 839b6a2b08a6b3fbce1a6a4b69d4185165de970696cTed Kremenek nodeBuilder.generateNode(pred->getState(), pred, &tag, true); 84027c54e57c4a012dcdf2b40cf985b70d0b9caa69eTed Kremenek } 841e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek} 842e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek 843e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek//===----------------------------------------------------------------------===// 8441670e403c48f3af4fceff3f6773a0e1cfc6c4eb3Ted Kremenek// Generic node creation. 8451670e403c48f3af4fceff3f6773a0e1cfc6c4eb3Ted Kremenek//===----------------------------------------------------------------------===// 8461670e403c48f3af4fceff3f6773a0e1cfc6c4eb3Ted Kremenek 8479c378f705405d37f49795d5e915989de774fe11fTed KremenekExplodedNode *ExprEngine::MakeNode(ExplodedNodeSet &Dst, const Stmt *S, 84818c66fdc3c4008d335885695fe36fb5353c5f672Ted Kremenek ExplodedNode *Pred, const ProgramState *St, 849ca804539d908d3a0e8c72a0df5f1f571d29490bbTed Kremenek ProgramPoint::Kind K, 850ca804539d908d3a0e8c72a0df5f1f571d29490bbTed Kremenek const ProgramPointTag *tag) { 851d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidis assert (Builder && "StmtNodeBuilder not present."); 852ca804539d908d3a0e8c72a0df5f1f571d29490bbTed Kremenek SaveAndRestore<const ProgramPointTag*> OldTag(Builder->Tag); 8531670e403c48f3af4fceff3f6773a0e1cfc6c4eb3Ted Kremenek Builder->Tag = tag; 8541670e403c48f3af4fceff3f6773a0e1cfc6c4eb3Ted Kremenek return Builder->MakeNode(Dst, S, Pred, St, K); 8551670e403c48f3af4fceff3f6773a0e1cfc6c4eb3Ted Kremenek} 8561670e403c48f3af4fceff3f6773a0e1cfc6c4eb3Ted Kremenek 8571670e403c48f3af4fceff3f6773a0e1cfc6c4eb3Ted Kremenek//===----------------------------------------------------------------------===// 858e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek// Branch processing. 859e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek//===----------------------------------------------------------------------===// 860e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek 86118c66fdc3c4008d335885695fe36fb5353c5f672Ted Kremenekconst ProgramState *ExprEngine::MarkBranch(const ProgramState *state, 8629c378f705405d37f49795d5e915989de774fe11fTed Kremenek const Stmt *Terminator, 86303509aea098772644bf4662dc1c88634818ceeccZhongxing Xu bool branchTaken) { 8641eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 86505a2378c708688c8ef498a5cea40ed7f5db15fa5Ted Kremenek switch (Terminator->getStmtClass()) { 86605a2378c708688c8ef498a5cea40ed7f5db15fa5Ted Kremenek default: 867a8538d902fce9cfec20f39b34492268b51643819Ted Kremenek return state; 8681eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 86905a2378c708688c8ef498a5cea40ed7f5db15fa5Ted Kremenek case Stmt::BinaryOperatorClass: { // '&&' and '||' 8701eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 87103509aea098772644bf4662dc1c88634818ceeccZhongxing Xu const BinaryOperator* B = cast<BinaryOperator>(Terminator); 87205a2378c708688c8ef498a5cea40ed7f5db15fa5Ted Kremenek BinaryOperator::Opcode Op = B->getOpcode(); 8731eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 8742de56d1d0c3a504ad1529de2677628bdfbb95cd4John McCall assert (Op == BO_LAnd || Op == BO_LOr); 8751eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 87605a2378c708688c8ef498a5cea40ed7f5db15fa5Ted Kremenek // For &&, if we take the true branch, then the value of the whole 87705a2378c708688c8ef498a5cea40ed7f5db15fa5Ted Kremenek // expression is that of the RHS expression. 87805a2378c708688c8ef498a5cea40ed7f5db15fa5Ted Kremenek // 87905a2378c708688c8ef498a5cea40ed7f5db15fa5Ted Kremenek // For ||, if we take the false branch, then the value of the whole 88005a2378c708688c8ef498a5cea40ed7f5db15fa5Ted Kremenek // expression is that of the RHS expression. 8811eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 8829c378f705405d37f49795d5e915989de774fe11fTed Kremenek const Expr *Ex = (Op == BO_LAnd && branchTaken) || 8832de56d1d0c3a504ad1529de2677628bdfbb95cd4John McCall (Op == BO_LOr && !branchTaken) 88403509aea098772644bf4662dc1c88634818ceeccZhongxing Xu ? B->getRHS() : B->getLHS(); 8851eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 8868e0293406f9d62a293be6be3b1fb89d359f5ea40Ted Kremenek return state->BindExpr(B, UndefinedVal(Ex)); 88705a2378c708688c8ef498a5cea40ed7f5db15fa5Ted Kremenek } 8881eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 88956ca35d396d8692c384c785f9aeebcf22563fe1eJohn McCall case Stmt::BinaryConditionalOperatorClass: 89005a2378c708688c8ef498a5cea40ed7f5db15fa5Ted Kremenek case Stmt::ConditionalOperatorClass: { // ?: 89156ca35d396d8692c384c785f9aeebcf22563fe1eJohn McCall const AbstractConditionalOperator* C 89256ca35d396d8692c384c785f9aeebcf22563fe1eJohn McCall = cast<AbstractConditionalOperator>(Terminator); 8931eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 89405a2378c708688c8ef498a5cea40ed7f5db15fa5Ted Kremenek // For ?, if branchTaken == true then the value is either the LHS or 89505a2378c708688c8ef498a5cea40ed7f5db15fa5Ted Kremenek // the condition itself. (GNU extension). 8961eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 8979c378f705405d37f49795d5e915989de774fe11fTed Kremenek const Expr *Ex; 8981eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 89905a2378c708688c8ef498a5cea40ed7f5db15fa5Ted Kremenek if (branchTaken) 90056ca35d396d8692c384c785f9aeebcf22563fe1eJohn McCall Ex = C->getTrueExpr(); 90105a2378c708688c8ef498a5cea40ed7f5db15fa5Ted Kremenek else 90256ca35d396d8692c384c785f9aeebcf22563fe1eJohn McCall Ex = C->getFalseExpr(); 9031eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 9048e0293406f9d62a293be6be3b1fb89d359f5ea40Ted Kremenek return state->BindExpr(C, UndefinedVal(Ex)); 90505a2378c708688c8ef498a5cea40ed7f5db15fa5Ted Kremenek } 9061eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 90705a2378c708688c8ef498a5cea40ed7f5db15fa5Ted Kremenek case Stmt::ChooseExprClass: { // ?: 9081eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 9099c378f705405d37f49795d5e915989de774fe11fTed Kremenek const ChooseExpr *C = cast<ChooseExpr>(Terminator); 9101eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 9119c378f705405d37f49795d5e915989de774fe11fTed Kremenek const Expr *Ex = branchTaken ? C->getLHS() : C->getRHS(); 9128e0293406f9d62a293be6be3b1fb89d359f5ea40Ted Kremenek return state->BindExpr(C, UndefinedVal(Ex)); 91305a2378c708688c8ef498a5cea40ed7f5db15fa5Ted Kremenek } 91405a2378c708688c8ef498a5cea40ed7f5db15fa5Ted Kremenek } 91505a2378c708688c8ef498a5cea40ed7f5db15fa5Ted Kremenek} 91605a2378c708688c8ef498a5cea40ed7f5db15fa5Ted Kremenek 9176ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek/// RecoverCastedSymbol - A helper function for ProcessBranch that is used 9186ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek/// to try to recover some path-sensitivity for casts of symbolic 9196ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek/// integers that promote their values (which are currently not tracked well). 9206ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek/// This function returns the SVal bound to Condition->IgnoreCasts if all the 9216ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek// cast(s) did was sign-extend the original value. 92218c66fdc3c4008d335885695fe36fb5353c5f672Ted Kremenekstatic SVal RecoverCastedSymbol(ProgramStateManager& StateMgr, const ProgramState *state, 9239c378f705405d37f49795d5e915989de774fe11fTed Kremenek const Stmt *Condition, ASTContext &Ctx) { 9246ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek 92503509aea098772644bf4662dc1c88634818ceeccZhongxing Xu const Expr *Ex = dyn_cast<Expr>(Condition); 9266ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek if (!Ex) 9276ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek return UnknownVal(); 9286ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek 9296ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek uint64_t bits = 0; 9306ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek bool bitsInit = false; 9311eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 93203509aea098772644bf4662dc1c88634818ceeccZhongxing Xu while (const CastExpr *CE = dyn_cast<CastExpr>(Ex)) { 9336ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek QualType T = CE->getType(); 9346ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek 9356ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek if (!T->isIntegerType()) 9366ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek return UnknownVal(); 9371eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 9386ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek uint64_t newBits = Ctx.getTypeSize(T); 9396ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek if (!bitsInit || newBits < bits) { 9406ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek bitsInit = true; 9416ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek bits = newBits; 9426ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek } 9431eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 9446ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek Ex = CE->getSubExpr(); 9456ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek } 9466ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek 9476ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek // We reached a non-cast. Is it a symbolic value? 9486ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek QualType T = Ex->getType(); 9496ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek 9506ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek if (!bitsInit || !T->isIntegerType() || Ctx.getTypeSize(T) > bits) 9516ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek return UnknownVal(); 9521eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 9531397663af9dbcc24dbf0e11de43931b3dc08fdbbTed Kremenek return state->getSVal(Ex); 9546ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek} 9556ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek 9569c378f705405d37f49795d5e915989de774fe11fTed Kremenekvoid ExprEngine::processBranch(const Stmt *Condition, const Stmt *Term, 957d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidis BranchNodeBuilder& builder) { 9581eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 959b2331834a0515c80862ee51325c758a053829f15Ted Kremenek // Check for NULL conditions; e.g. "for(;;)" 9601eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump if (!Condition) { 961b2331834a0515c80862ee51325c758a053829f15Ted Kremenek builder.markInfeasible(false); 962b2331834a0515c80862ee51325c758a053829f15Ted Kremenek return; 963b2331834a0515c80862ee51325c758a053829f15Ted Kremenek } 9641eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 96521028dd8850c64a414f7a82dfddcc291351203d6Ted Kremenek PrettyStackTraceLoc CrashInfo(getContext().getSourceManager(), 96621028dd8850c64a414f7a82dfddcc291351203d6Ted Kremenek Condition->getLocStart(), 96721028dd8850c64a414f7a82dfddcc291351203d6Ted Kremenek "Error evaluating branch"); 9680fb0bc4067d6c9d7c0e655300ef309b05d3adfc9Ted Kremenek 969cc05d511b26ac6dc80fcbcc78ac305d2755aa0b9Argyrios Kyrtzidis getCheckerManager().runCheckersForBranchCondition(Condition, builder, *this); 970cc05d511b26ac6dc80fcbcc78ac305d2755aa0b9Argyrios Kyrtzidis 9710835e4cccfef3ea5346962722b79484f6b3ca602Zhongxing Xu // If the branch condition is undefined, return; 9720835e4cccfef3ea5346962722b79484f6b3ca602Zhongxing Xu if (!builder.isFeasible(true) && !builder.isFeasible(false)) 9730835e4cccfef3ea5346962722b79484f6b3ca602Zhongxing Xu return; 9741eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 97518c66fdc3c4008d335885695fe36fb5353c5f672Ted Kremenek const ProgramState *PrevState = builder.getState(); 9761397663af9dbcc24dbf0e11de43931b3dc08fdbbTed Kremenek SVal X = PrevState->getSVal(Condition); 977b38911f16b4943548db6a3695fc6ae23070b25d2Ted Kremenek 97873c498a08f4968b6987d1453c7b77929dcc6d5f7Argyrios Kyrtzidis if (X.isUnknownOrUndef()) { 9790835e4cccfef3ea5346962722b79484f6b3ca602Zhongxing Xu // Give it a chance to recover from unknown. 9800835e4cccfef3ea5346962722b79484f6b3ca602Zhongxing Xu if (const Expr *Ex = dyn_cast<Expr>(Condition)) { 9810835e4cccfef3ea5346962722b79484f6b3ca602Zhongxing Xu if (Ex->getType()->isIntegerType()) { 9820835e4cccfef3ea5346962722b79484f6b3ca602Zhongxing Xu // Try to recover some path-sensitivity. Right now casts of symbolic 9830835e4cccfef3ea5346962722b79484f6b3ca602Zhongxing Xu // integers that promote their values are currently not tracked well. 9840835e4cccfef3ea5346962722b79484f6b3ca602Zhongxing Xu // If 'Condition' is such an expression, try and recover the 9850835e4cccfef3ea5346962722b79484f6b3ca602Zhongxing Xu // underlying value and use that instead. 9860835e4cccfef3ea5346962722b79484f6b3ca602Zhongxing Xu SVal recovered = RecoverCastedSymbol(getStateManager(), 9870835e4cccfef3ea5346962722b79484f6b3ca602Zhongxing Xu builder.getState(), Condition, 9880835e4cccfef3ea5346962722b79484f6b3ca602Zhongxing Xu getContext()); 989b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 9900835e4cccfef3ea5346962722b79484f6b3ca602Zhongxing Xu if (!recovered.isUnknown()) { 9910835e4cccfef3ea5346962722b79484f6b3ca602Zhongxing Xu X = recovered; 9920835e4cccfef3ea5346962722b79484f6b3ca602Zhongxing Xu } 993b38911f16b4943548db6a3695fc6ae23070b25d2Ted Kremenek } 9940835e4cccfef3ea5346962722b79484f6b3ca602Zhongxing Xu } 9950835e4cccfef3ea5346962722b79484f6b3ca602Zhongxing Xu // If the condition is still unknown, give up. 99673c498a08f4968b6987d1453c7b77929dcc6d5f7Argyrios Kyrtzidis if (X.isUnknownOrUndef()) { 9970835e4cccfef3ea5346962722b79484f6b3ca602Zhongxing Xu builder.generateNode(MarkBranch(PrevState, Term, true), true); 9980835e4cccfef3ea5346962722b79484f6b3ca602Zhongxing Xu builder.generateNode(MarkBranch(PrevState, Term, false), false); 999b38911f16b4943548db6a3695fc6ae23070b25d2Ted Kremenek return; 10001eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump } 1001b38911f16b4943548db6a3695fc6ae23070b25d2Ted Kremenek } 10021eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 10030835e4cccfef3ea5346962722b79484f6b3ca602Zhongxing Xu DefinedSVal V = cast<DefinedSVal>(X); 10040835e4cccfef3ea5346962722b79484f6b3ca602Zhongxing Xu 10056a6719a3a11087b48d9f1a4eb08b3bd43cb05a65Ted Kremenek // Process the true branch. 1006520035439d7133064325c4df6378c5a8f2f05539Ted Kremenek if (builder.isFeasible(true)) { 100718c66fdc3c4008d335885695fe36fb5353c5f672Ted Kremenek if (const ProgramState *state = PrevState->assume(V, true)) 1008520035439d7133064325c4df6378c5a8f2f05539Ted Kremenek builder.generateNode(MarkBranch(state, Term, true), true); 1009520035439d7133064325c4df6378c5a8f2f05539Ted Kremenek else 1010520035439d7133064325c4df6378c5a8f2f05539Ted Kremenek builder.markInfeasible(true); 1011520035439d7133064325c4df6378c5a8f2f05539Ted Kremenek } 10121eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 10131eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump // Process the false branch. 1014520035439d7133064325c4df6378c5a8f2f05539Ted Kremenek if (builder.isFeasible(false)) { 101518c66fdc3c4008d335885695fe36fb5353c5f672Ted Kremenek if (const ProgramState *state = PrevState->assume(V, false)) 1016520035439d7133064325c4df6378c5a8f2f05539Ted Kremenek builder.generateNode(MarkBranch(state, Term, false), false); 1017520035439d7133064325c4df6378c5a8f2f05539Ted Kremenek else 1018520035439d7133064325c4df6378c5a8f2f05539Ted Kremenek builder.markInfeasible(false); 1019520035439d7133064325c4df6378c5a8f2f05539Ted Kremenek } 1020f233d48cfc513b045e2c2cfca5c175220fbd0a82Ted Kremenek} 1021f233d48cfc513b045e2c2cfca5c175220fbd0a82Ted Kremenek 1022e36de1fe51c39d9161915dd3dbef880954af6476Ted Kremenek/// processIndirectGoto - Called by CoreEngine. Used to generate successor 1023754607e7cff2d902d9af8b771409449fb2f8d2bfTed Kremenek/// nodes by processing the 'effects' of a computed goto jump. 1024ad8dcf4a9df0e24051dc31bf9e6f3cd138a34298Chris Lattnervoid ExprEngine::processIndirectGoto(IndirectGotoNodeBuilder &builder) { 1025754607e7cff2d902d9af8b771409449fb2f8d2bfTed Kremenek 102618c66fdc3c4008d335885695fe36fb5353c5f672Ted Kremenek const ProgramState *state = builder.getState(); 10271397663af9dbcc24dbf0e11de43931b3dc08fdbbTed Kremenek SVal V = state->getSVal(builder.getTarget()); 10281eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1029754607e7cff2d902d9af8b771409449fb2f8d2bfTed Kremenek // Three possibilities: 1030754607e7cff2d902d9af8b771409449fb2f8d2bfTed Kremenek // 1031754607e7cff2d902d9af8b771409449fb2f8d2bfTed Kremenek // (1) We know the computed label. 10324a4e524afef40d6f3ddb25d0e407c814e4ca56a8Ted Kremenek // (2) The label is NULL (or some other constant), or Undefined. 1033754607e7cff2d902d9af8b771409449fb2f8d2bfTed Kremenek // (3) We have no clue about the label. Dispatch to all targets. 1034754607e7cff2d902d9af8b771409449fb2f8d2bfTed Kremenek // 10351eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1036d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidis typedef IndirectGotoNodeBuilder::iterator iterator; 1037754607e7cff2d902d9af8b771409449fb2f8d2bfTed Kremenek 10381c96b24285d05c0eac455ae96d7c9ff43d42bc96Zhongxing Xu if (isa<loc::GotoLabel>(V)) { 1039ad8dcf4a9df0e24051dc31bf9e6f3cd138a34298Chris Lattner const LabelDecl *L = cast<loc::GotoLabel>(V).getLabel(); 10401eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1041ad8dcf4a9df0e24051dc31bf9e6f3cd138a34298Chris Lattner for (iterator I = builder.begin(), E = builder.end(); I != E; ++I) { 104224f1a967741ff9f8025ee23be12ba6feacc31f77Ted Kremenek if (I.getLabel() == L) { 1043a8538d902fce9cfec20f39b34492268b51643819Ted Kremenek builder.generateNode(I, state); 1044754607e7cff2d902d9af8b771409449fb2f8d2bfTed Kremenek return; 1045754607e7cff2d902d9af8b771409449fb2f8d2bfTed Kremenek } 1046754607e7cff2d902d9af8b771409449fb2f8d2bfTed Kremenek } 10471eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1048ad8dcf4a9df0e24051dc31bf9e6f3cd138a34298Chris Lattner assert(false && "No block with label."); 1049754607e7cff2d902d9af8b771409449fb2f8d2bfTed Kremenek return; 1050754607e7cff2d902d9af8b771409449fb2f8d2bfTed Kremenek } 1051754607e7cff2d902d9af8b771409449fb2f8d2bfTed Kremenek 10521c96b24285d05c0eac455ae96d7c9ff43d42bc96Zhongxing Xu if (isa<loc::ConcreteInt>(V) || isa<UndefinedVal>(V)) { 1053754607e7cff2d902d9af8b771409449fb2f8d2bfTed Kremenek // Dispatch to the first target and mark it as a sink. 10542055effed54d614b51e3501a174c9b1fe92e4de4Zhongxing Xu //ExplodedNode* N = builder.generateNode(builder.begin(), state, true); 10552055effed54d614b51e3501a174c9b1fe92e4de4Zhongxing Xu // FIXME: add checker visit. 10562055effed54d614b51e3501a174c9b1fe92e4de4Zhongxing Xu // UndefBranches.insert(N); 1057754607e7cff2d902d9af8b771409449fb2f8d2bfTed Kremenek return; 1058754607e7cff2d902d9af8b771409449fb2f8d2bfTed Kremenek } 10591eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1060754607e7cff2d902d9af8b771409449fb2f8d2bfTed Kremenek // This is really a catch-all. We don't support symbolics yet. 1061b3cfd58c9b13325d994e5f9b5065e6a22d91911dTed Kremenek // FIXME: Implement dispatch for symbolic pointers. 10621eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1063754607e7cff2d902d9af8b771409449fb2f8d2bfTed Kremenek for (iterator I=builder.begin(), E=builder.end(); I != E; ++I) 1064a8538d902fce9cfec20f39b34492268b51643819Ted Kremenek builder.generateNode(I, state); 1065754607e7cff2d902d9af8b771409449fb2f8d2bfTed Kremenek} 1066f233d48cfc513b045e2c2cfca5c175220fbd0a82Ted Kremenek 1067e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek 10689c378f705405d37f49795d5e915989de774fe11fTed Kremenekvoid ExprEngine::VisitGuardedExpr(const Expr *Ex, const Expr *L, 10699c378f705405d37f49795d5e915989de774fe11fTed Kremenek const Expr *R, 10709c378f705405d37f49795d5e915989de774fe11fTed Kremenek ExplodedNode *Pred, ExplodedNodeSet &Dst) { 10711eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 10720a3ed3143b00f237decb1288c1ff574ae09eba4eTed Kremenek assert(Ex == currentStmt && 1073bb141217871e93767aa3f2de1b9946fa6d37066aZhongxing Xu Pred->getLocationContext()->getCFG()->isBlkExpr(Ex)); 10741eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 107518c66fdc3c4008d335885695fe36fb5353c5f672Ted Kremenek const ProgramState *state = Pred->getState(); 10761397663af9dbcc24dbf0e11de43931b3dc08fdbbTed Kremenek SVal X = state->getSVal(Ex); 10771eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1078e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek assert (X.isUndef()); 10791eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 108003509aea098772644bf4662dc1c88634818ceeccZhongxing Xu const Expr *SE = (Expr*) cast<UndefinedVal>(X).getData(); 10811eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump assert(SE); 10821397663af9dbcc24dbf0e11de43931b3dc08fdbbTed Kremenek X = state->getSVal(SE); 10831eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1084e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek // Make sure that we invalidate the previous binding. 10858e0293406f9d62a293be6be3b1fb89d359f5ea40Ted Kremenek MakeNode(Dst, Ex, Pred, state->BindExpr(Ex, X, true)); 1086e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek} 1087e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek 1088d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidis/// ProcessEndPath - Called by CoreEngine. Used to generate end-of-path 108973099bfea9f5d4ec05265170bbefec3d76fb6b5eTed Kremenek/// nodes when the control reaches the end of a function. 1090e36de1fe51c39d9161915dd3dbef880954af6476Ted Kremenekvoid ExprEngine::processEndOfFunction(EndOfFunctionNodeBuilder& builder) { 10919c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek getTF().evalEndPath(*this, builder); 109273099bfea9f5d4ec05265170bbefec3d76fb6b5eTed Kremenek StateMgr.EndPath(builder.getState()); 1093af5800a1e287990bb547e052f257adeeae5ab476Argyrios Kyrtzidis getCheckerManager().runCheckersForEndPath(builder, *this); 109473099bfea9f5d4ec05265170bbefec3d76fb6b5eTed Kremenek} 109573099bfea9f5d4ec05265170bbefec3d76fb6b5eTed Kremenek 1096d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidis/// ProcessSwitch - Called by CoreEngine. Used to generate successor 1097daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek/// nodes by processing the 'effects' of a switch statement. 1098e36de1fe51c39d9161915dd3dbef880954af6476Ted Kremenekvoid ExprEngine::processSwitch(SwitchNodeBuilder& builder) { 1099d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidis typedef SwitchNodeBuilder::iterator iterator; 110018c66fdc3c4008d335885695fe36fb5353c5f672Ted Kremenek const ProgramState *state = builder.getState(); 11019c378f705405d37f49795d5e915989de774fe11fTed Kremenek const Expr *CondE = builder.getCondition(); 11021397663af9dbcc24dbf0e11de43931b3dc08fdbbTed Kremenek SVal CondV_untested = state->getSVal(CondE); 1103daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek 11045b9bd2137ebef350af803c634e3fdf5d74678100Ted Kremenek if (CondV_untested.isUndef()) { 11052055effed54d614b51e3501a174c9b1fe92e4de4Zhongxing Xu //ExplodedNode* N = builder.generateDefaultCaseNode(state, true); 1106b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek // FIXME: add checker 11072055effed54d614b51e3501a174c9b1fe92e4de4Zhongxing Xu //UndefBranches.insert(N); 11082055effed54d614b51e3501a174c9b1fe92e4de4Zhongxing Xu 1109daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek return; 1110daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek } 11115b9bd2137ebef350af803c634e3fdf5d74678100Ted Kremenek DefinedOrUnknownSVal CondV = cast<DefinedOrUnknownSVal>(CondV_untested); 1112692416c214a3b234236dedcf875735a9cc29e90bTed Kremenek 111318c66fdc3c4008d335885695fe36fb5353c5f672Ted Kremenek const ProgramState *DefaultSt = state; 111434feff654c6304e0a59ceb1376989d28dbc956ffTed Kremenek 111534feff654c6304e0a59ceb1376989d28dbc956ffTed Kremenek iterator I = builder.begin(), EI = builder.end(); 111634feff654c6304e0a59ceb1376989d28dbc956ffTed Kremenek bool defaultIsFeasible = I == EI; 11171eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 111834feff654c6304e0a59ceb1376989d28dbc956ffTed Kremenek for ( ; I != EI; ++I) { 1119e71f3d587844110d836c82250830b27b1651afdbTed Kremenek // Successor may be pruned out during CFG construction. 1120e71f3d587844110d836c82250830b27b1651afdbTed Kremenek if (!I.getBlock()) 1121e71f3d587844110d836c82250830b27b1651afdbTed Kremenek continue; 1122e71f3d587844110d836c82250830b27b1651afdbTed Kremenek 11239c378f705405d37f49795d5e915989de774fe11fTed Kremenek const CaseStmt *Case = I.getCase(); 112472afb3739da0da02158242ae41a50cfe0bea78b4Ted Kremenek 112572afb3739da0da02158242ae41a50cfe0bea78b4Ted Kremenek // Evaluate the LHS of the case value. 112672afb3739da0da02158242ae41a50cfe0bea78b4Ted Kremenek Expr::EvalResult V1; 11271eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump bool b = Case->getLHS()->Evaluate(V1, getContext()); 11281eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 112972afb3739da0da02158242ae41a50cfe0bea78b4Ted Kremenek // Sanity checks. These go away in Release builds. 11301eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump assert(b && V1.Val.isInt() && !V1.HasSideEffects 113172afb3739da0da02158242ae41a50cfe0bea78b4Ted Kremenek && "Case condition must evaluate to an integer constant."); 1132c6ed729f669044f5072a49d79041f455d971ece3Jeffrey Yasskin (void)b; // silence unused variable warning 11331eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump assert(V1.Val.getInt().getBitWidth() == 113472afb3739da0da02158242ae41a50cfe0bea78b4Ted Kremenek getContext().getTypeSize(CondE->getType())); 11351eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1136daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek // Get the RHS of the case, if it exists. 113772afb3739da0da02158242ae41a50cfe0bea78b4Ted Kremenek Expr::EvalResult V2; 11381eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 11399c378f705405d37f49795d5e915989de774fe11fTed Kremenek if (const Expr *E = Case->getRHS()) { 114072afb3739da0da02158242ae41a50cfe0bea78b4Ted Kremenek b = E->Evaluate(V2, getContext()); 11411eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump assert(b && V2.Val.isInt() && !V2.HasSideEffects 114272afb3739da0da02158242ae41a50cfe0bea78b4Ted Kremenek && "Case condition must evaluate to an integer constant."); 1143c6ed729f669044f5072a49d79041f455d971ece3Jeffrey Yasskin (void)b; // silence unused variable warning 1144daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek } 114514a1140c9f4e20b12a54db8745b74699b9872cd2Ted Kremenek else 114614a1140c9f4e20b12a54db8745b74699b9872cd2Ted Kremenek V2 = V1; 11471eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1148daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek // FIXME: Eventually we should replace the logic below with a range 1149daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek // comparison, rather than concretize the values within the range. 1150aa1c4e5a6b87b62d991c55a0d4522bcd778068d7Ted Kremenek // This should be easy once we have "ranges" for NonLVals. 11511eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 115214a1140c9f4e20b12a54db8745b74699b9872cd2Ted Kremenek do { 11531eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump nonloc::ConcreteInt CaseVal(getBasicVals().getValue(V1.Val.getInt())); 11549c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek DefinedOrUnknownSVal Res = svalBuilder.evalEQ(DefaultSt ? DefaultSt : state, 115548569f9562740ac1f4b175cb17ce3d49035402c4Ted Kremenek CondV, CaseVal); 1156b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 11571eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump // Now "assume" that the case matches. 115818c66fdc3c4008d335885695fe36fb5353c5f672Ted Kremenek if (const ProgramState *stateNew = state->assume(Res, true)) { 1159a591bc04d21fa62ebffcb2c7814d738ca8f5e2f9Ted Kremenek builder.generateCaseStmtNode(I, stateNew); 11601eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1161daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek // If CondV evaluates to a constant, then we know that this 1162daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek // is the *only* case that we can take, so stop evaluating the 1163daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek // others. 11641c96b24285d05c0eac455ae96d7c9ff43d42bc96Zhongxing Xu if (isa<nonloc::ConcreteInt>(CondV)) 1165daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek return; 1166daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek } 11671eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1168daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek // Now "assume" that the case doesn't match. Add this state 1169daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek // to the default state (if it is feasible). 117048569f9562740ac1f4b175cb17ce3d49035402c4Ted Kremenek if (DefaultSt) { 117118c66fdc3c4008d335885695fe36fb5353c5f672Ted Kremenek if (const ProgramState *stateNew = DefaultSt->assume(Res, false)) { 117248569f9562740ac1f4b175cb17ce3d49035402c4Ted Kremenek defaultIsFeasible = true; 117348569f9562740ac1f4b175cb17ce3d49035402c4Ted Kremenek DefaultSt = stateNew; 117448569f9562740ac1f4b175cb17ce3d49035402c4Ted Kremenek } 117548569f9562740ac1f4b175cb17ce3d49035402c4Ted Kremenek else { 117648569f9562740ac1f4b175cb17ce3d49035402c4Ted Kremenek defaultIsFeasible = false; 117748569f9562740ac1f4b175cb17ce3d49035402c4Ted Kremenek DefaultSt = NULL; 117848569f9562740ac1f4b175cb17ce3d49035402c4Ted Kremenek } 11795014ab113eb211b8320ae30b173d7020352663c6Ted Kremenek } 1180b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 118114a1140c9f4e20b12a54db8745b74699b9872cd2Ted Kremenek // Concretize the next value in the range. 118272afb3739da0da02158242ae41a50cfe0bea78b4Ted Kremenek if (V1.Val.getInt() == V2.Val.getInt()) 118314a1140c9f4e20b12a54db8745b74699b9872cd2Ted Kremenek break; 11841eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 118572afb3739da0da02158242ae41a50cfe0bea78b4Ted Kremenek ++V1.Val.getInt(); 118672afb3739da0da02158242ae41a50cfe0bea78b4Ted Kremenek assert (V1.Val.getInt() <= V2.Val.getInt()); 11871eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 118814a1140c9f4e20b12a54db8745b74699b9872cd2Ted Kremenek } while (true); 1189daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek } 11901eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 11914d3175c1e5a44251ea97b0c81e80f060629d9c08Ted Kremenek if (!defaultIsFeasible) 11924d3175c1e5a44251ea97b0c81e80f060629d9c08Ted Kremenek return; 11934d3175c1e5a44251ea97b0c81e80f060629d9c08Ted Kremenek 11944d3175c1e5a44251ea97b0c81e80f060629d9c08Ted Kremenek // If we have switch(enum value), the default branch is not 11954d3175c1e5a44251ea97b0c81e80f060629d9c08Ted Kremenek // feasible if all of the enum constants not covered by 'case:' statements 11964d3175c1e5a44251ea97b0c81e80f060629d9c08Ted Kremenek // are not feasible values for the switch condition. 11974d3175c1e5a44251ea97b0c81e80f060629d9c08Ted Kremenek // 11984d3175c1e5a44251ea97b0c81e80f060629d9c08Ted Kremenek // Note that this isn't as accurate as it could be. Even if there isn't 11994d3175c1e5a44251ea97b0c81e80f060629d9c08Ted Kremenek // a case for a particular enum value as long as that enum value isn't 12004d3175c1e5a44251ea97b0c81e80f060629d9c08Ted Kremenek // feasible then it shouldn't be considered for making 'default:' reachable. 12014d3175c1e5a44251ea97b0c81e80f060629d9c08Ted Kremenek const SwitchStmt *SS = builder.getSwitch(); 12024d3175c1e5a44251ea97b0c81e80f060629d9c08Ted Kremenek const Expr *CondExpr = SS->getCond()->IgnoreParenImpCasts(); 12034d3175c1e5a44251ea97b0c81e80f060629d9c08Ted Kremenek if (CondExpr->getType()->getAs<EnumType>()) { 12044d3175c1e5a44251ea97b0c81e80f060629d9c08Ted Kremenek if (SS->isAllEnumCasesCovered()) 12054d3175c1e5a44251ea97b0c81e80f060629d9c08Ted Kremenek return; 12064d3175c1e5a44251ea97b0c81e80f060629d9c08Ted Kremenek } 12074d3175c1e5a44251ea97b0c81e80f060629d9c08Ted Kremenek 12084d3175c1e5a44251ea97b0c81e80f060629d9c08Ted Kremenek builder.generateDefaultCaseNode(DefaultSt); 1209daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek} 1210daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek 1211e36de1fe51c39d9161915dd3dbef880954af6476Ted Kremenekvoid ExprEngine::processCallEnter(CallEnterNodeBuilder &B) { 121218c66fdc3c4008d335885695fe36fb5353c5f672Ted Kremenek const ProgramState *state = B.getState()->enterStackFrame(B.getCalleeContext()); 1213d048c6ef5b6cfaa0cecb8cc1d4bdace32ed21d07Ted Kremenek B.generateNode(state); 1214102acd5369bbb17c0d6ab868af376671acff7a93Douglas Gregor} 1215102acd5369bbb17c0d6ab868af376671acff7a93Douglas Gregor 1216e36de1fe51c39d9161915dd3dbef880954af6476Ted Kremenekvoid ExprEngine::processCallExit(CallExitNodeBuilder &B) { 121718c66fdc3c4008d335885695fe36fb5353c5f672Ted Kremenek const ProgramState *state = B.getState(); 1218102acd5369bbb17c0d6ab868af376671acff7a93Douglas Gregor const ExplodedNode *Pred = B.getPredecessor(); 121919b78d9e3dbbc27bbcbdd8c3017a00fe88849ecdZhongxing Xu const StackFrameContext *calleeCtx = 1220102acd5369bbb17c0d6ab868af376671acff7a93Douglas Gregor cast<StackFrameContext>(Pred->getLocationContext()); 122119b78d9e3dbbc27bbcbdd8c3017a00fe88849ecdZhongxing Xu const Stmt *CE = calleeCtx->getCallSite(); 1222102acd5369bbb17c0d6ab868af376671acff7a93Douglas Gregor 12236190ec29f0895185bbec95a932429b8832917fecZhongxing Xu // If the callee returns an expression, bind its value to CallExpr. 12246190ec29f0895185bbec95a932429b8832917fecZhongxing Xu const Stmt *ReturnedExpr = state->get<ReturnExpr>(); 12256190ec29f0895185bbec95a932429b8832917fecZhongxing Xu if (ReturnedExpr) { 12266190ec29f0895185bbec95a932429b8832917fecZhongxing Xu SVal RetVal = state->getSVal(ReturnedExpr); 12276190ec29f0895185bbec95a932429b8832917fecZhongxing Xu state = state->BindExpr(CE, RetVal); 1228bd2b2084e58577f17308f910770a5563a344251aZhongxing Xu // Clear the return expr GDM. 12290541d106eae48f4238097df03a72028a610e0dceZhongxing Xu state = state->remove<ReturnExpr>(); 12306190ec29f0895185bbec95a932429b8832917fecZhongxing Xu } 12316190ec29f0895185bbec95a932429b8832917fecZhongxing Xu 12328e18c1b840882d26039503629d7e4ad4822f3bdaZhongxing Xu // Bind the constructed object value to CXXConstructExpr. 12338e18c1b840882d26039503629d7e4ad4822f3bdaZhongxing Xu if (const CXXConstructExpr *CCE = dyn_cast<CXXConstructExpr>(CE)) { 12349dc84c9455df2a77195147d0210c915dc1775a88Zhongxing Xu const CXXThisRegion *ThisR = 123519b78d9e3dbbc27bbcbdd8c3017a00fe88849ecdZhongxing Xu getCXXThisRegion(CCE->getConstructor()->getParent(), calleeCtx); 1236d706434b0231c76fd9acf30060646a7aa8f69aefZhongxing Xu 12378e18c1b840882d26039503629d7e4ad4822f3bdaZhongxing Xu SVal ThisV = state->getSVal(ThisR); 123805e539175d9bac678fca8e77665e88b685729850Zhongxing Xu // Always bind the region to the CXXConstructExpr. 123905e539175d9bac678fca8e77665e88b685729850Zhongxing Xu state = state->BindExpr(CCE, ThisV); 12408e18c1b840882d26039503629d7e4ad4822f3bdaZhongxing Xu } 12418e18c1b840882d26039503629d7e4ad4822f3bdaZhongxing Xu 1242d048c6ef5b6cfaa0cecb8cc1d4bdace32ed21d07Ted Kremenek B.generateNode(state); 1243102acd5369bbb17c0d6ab868af376671acff7a93Douglas Gregor} 1244102acd5369bbb17c0d6ab868af376671acff7a93Douglas Gregor 1245e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek//===----------------------------------------------------------------------===// 1246e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek// Transfer functions: logical operations ('&&', '||'). 1247e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek//===----------------------------------------------------------------------===// 1248daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek 12499c378f705405d37f49795d5e915989de774fe11fTed Kremenekvoid ExprEngine::VisitLogicalExpr(const BinaryOperator* B, ExplodedNode *Pred, 12509c378f705405d37f49795d5e915989de774fe11fTed Kremenek ExplodedNodeSet &Dst) { 12511eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 12522de56d1d0c3a504ad1529de2677628bdfbb95cd4John McCall assert(B->getOpcode() == BO_LAnd || 12532de56d1d0c3a504ad1529de2677628bdfbb95cd4John McCall B->getOpcode() == BO_LOr); 12541eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 12550a3ed3143b00f237decb1288c1ff574ae09eba4eTed Kremenek assert(B==currentStmt && Pred->getLocationContext()->getCFG()->isBlkExpr(B)); 12561eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 125718c66fdc3c4008d335885695fe36fb5353c5f672Ted Kremenek const ProgramState *state = Pred->getState(); 12581397663af9dbcc24dbf0e11de43931b3dc08fdbbTed Kremenek SVal X = state->getSVal(B); 12593ff12591494a3cb3d3a24427975df58714ac3b2fTed Kremenek assert(X.isUndef()); 12601eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 12615b9bd2137ebef350af803c634e3fdf5d74678100Ted Kremenek const Expr *Ex = (const Expr*) cast<UndefinedVal>(X).getData(); 12623ff12591494a3cb3d3a24427975df58714ac3b2fTed Kremenek assert(Ex); 12631eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 126405a2378c708688c8ef498a5cea40ed7f5db15fa5Ted Kremenek if (Ex == B->getRHS()) { 12651397663af9dbcc24dbf0e11de43931b3dc08fdbbTed Kremenek X = state->getSVal(Ex); 12661eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 12674a4e524afef40d6f3ddb25d0e407c814e4ca56a8Ted Kremenek // Handle undefined values. 12684a4e524afef40d6f3ddb25d0e407c814e4ca56a8Ted Kremenek if (X.isUndef()) { 12698e0293406f9d62a293be6be3b1fb89d359f5ea40Ted Kremenek MakeNode(Dst, B, Pred, state->BindExpr(B, X)); 127058b3321009b3f750fb4587b12c2024bb77e6ebf0Ted Kremenek return; 127158b3321009b3f750fb4587b12c2024bb77e6ebf0Ted Kremenek } 1272b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 12735b9bd2137ebef350af803c634e3fdf5d74678100Ted Kremenek DefinedOrUnknownSVal XD = cast<DefinedOrUnknownSVal>(X); 12741eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 127505a2378c708688c8ef498a5cea40ed7f5db15fa5Ted Kremenek // We took the RHS. Because the value of the '&&' or '||' expression must 127605a2378c708688c8ef498a5cea40ed7f5db15fa5Ted Kremenek // evaluate to 0 or 1, we must assume the value of the RHS evaluates to 0 127705a2378c708688c8ef498a5cea40ed7f5db15fa5Ted Kremenek // or 1. Alternatively, we could take a lazy approach, and calculate this 127805a2378c708688c8ef498a5cea40ed7f5db15fa5Ted Kremenek // value later when necessary. We don't have the machinery in place for 127905a2378c708688c8ef498a5cea40ed7f5db15fa5Ted Kremenek // this right now, and since most logical expressions are used for branches, 12801eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump // the payoff is not likely to be large. Instead, we do eager evaluation. 128118c66fdc3c4008d335885695fe36fb5353c5f672Ted Kremenek if (const ProgramState *newState = state->assume(XD, true)) 12821eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump MakeNode(Dst, B, Pred, 1283c8413fd03f73084a5c93028f8b4db619fc388087Ted Kremenek newState->BindExpr(B, svalBuilder.makeIntVal(1U, B->getType()))); 12841eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 128518c66fdc3c4008d335885695fe36fb5353c5f672Ted Kremenek if (const ProgramState *newState = state->assume(XD, false)) 12861eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump MakeNode(Dst, B, Pred, 1287c8413fd03f73084a5c93028f8b4db619fc388087Ted Kremenek newState->BindExpr(B, svalBuilder.makeIntVal(0U, B->getType()))); 1288f233d48cfc513b045e2c2cfca5c175220fbd0a82Ted Kremenek } 1289f233d48cfc513b045e2c2cfca5c175220fbd0a82Ted Kremenek else { 129005a2378c708688c8ef498a5cea40ed7f5db15fa5Ted Kremenek // We took the LHS expression. Depending on whether we are '&&' or 129105a2378c708688c8ef498a5cea40ed7f5db15fa5Ted Kremenek // '||' we know what the value of the expression is via properties of 129205a2378c708688c8ef498a5cea40ed7f5db15fa5Ted Kremenek // the short-circuiting. 1293c8413fd03f73084a5c93028f8b4db619fc388087Ted Kremenek X = svalBuilder.makeIntVal(B->getOpcode() == BO_LAnd ? 0U : 1U, 1294d91ee27950ef5c321db1ac2aa5becb75ffe7cb14Zhongxing Xu B->getType()); 12958e0293406f9d62a293be6be3b1fb89d359f5ea40Ted Kremenek MakeNode(Dst, B, Pred, state->BindExpr(B, X)); 129605a2378c708688c8ef498a5cea40ed7f5db15fa5Ted Kremenek } 129771c29bdc931bc49644c581ec7d698f0dbf01a0aaTed Kremenek} 12981eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1299e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek//===----------------------------------------------------------------------===// 1300ec96a2d52d16e150baaf629cd35e3fabff5d8915Ted Kremenek// Transfer functions: Loads and stores. 1301e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek//===----------------------------------------------------------------------===// 1302d27f8169f4b68337a489547a41ac45bf7a5d1ddfTed Kremenek 1303d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidisvoid ExprEngine::VisitBlockExpr(const BlockExpr *BE, ExplodedNode *Pred, 1304c95ad9ff6e574aecdd759542d5578bc65d586d93Ted Kremenek ExplodedNodeSet &Dst) { 1305b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 130666078610be5e4319de02efa283b07887c73c2e27Ted Kremenek ExplodedNodeSet Tmp; 1307b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 1308c95ad9ff6e574aecdd759542d5578bc65d586d93Ted Kremenek CanQualType T = getContext().getCanonicalType(BE->getType()); 1309c8413fd03f73084a5c93028f8b4db619fc388087Ted Kremenek SVal V = svalBuilder.getBlockPointer(BE->getBlockDecl(), T, 13100a8112a78d00b5140c5b7f16c3b34c2c0c13c1a0Ted Kremenek Pred->getLocationContext()); 13110a8112a78d00b5140c5b7f16c3b34c2c0c13c1a0Ted Kremenek 1312db5e8cd095d1ffdd18f5620ad2348b5f386bebe3Anna Zaks MakeNode(Tmp, BE, Pred, Pred->getState()->BindExpr(BE, V), 1313c95ad9ff6e574aecdd759542d5578bc65d586d93Ted Kremenek ProgramPoint::PostLValueKind); 1314b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 131566078610be5e4319de02efa283b07887c73c2e27Ted Kremenek // Post-visit the BlockExpr. 1316eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis getCheckerManager().runCheckersForPostStmt(Dst, Tmp, BE, *this); 1317c95ad9ff6e574aecdd759542d5578bc65d586d93Ted Kremenek} 1318c95ad9ff6e574aecdd759542d5578bc65d586d93Ted Kremenek 1319d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidisvoid ExprEngine::VisitCommonDeclRefExpr(const Expr *Ex, const NamedDecl *D, 1320d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidis ExplodedNode *Pred, 1321d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidis ExplodedNodeSet &Dst) { 132218c66fdc3c4008d335885695fe36fb5353c5f672Ted Kremenek const ProgramState *state = Pred->getState(); 13236d69b5d82281992e981caa9bc038e3f6cac6594aZhongxing Xu 13249c378f705405d37f49795d5e915989de774fe11fTed Kremenek if (const VarDecl *VD = dyn_cast<VarDecl>(D)) { 1325892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek assert(Ex->isLValue()); 1326d17da2b99f323fa91b01e1dd119cc32e0ee8197dTed Kremenek SVal V = state->getLValue(VD, Pred->getLocationContext()); 1327a7581731b1453b51b26154d2409d42a5b6395079Zhongxing Xu 1328892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek // For references, the 'lvalue' is the pointer address stored in the 1329892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek // reference region. 1330892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek if (VD->getType()->isReferenceType()) { 1331892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek if (const MemRegion *R = V.getAsRegion()) 1332892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek V = state->getSVal(R); 1333892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek else 1334892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek V = UnknownVal(); 1335852274d4257134906995cb252fb3dfd2d71deae8Ted Kremenek } 13366d69b5d82281992e981caa9bc038e3f6cac6594aZhongxing Xu 1337892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek MakeNode(Dst, Ex, Pred, state->BindExpr(Ex, V), 1338892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek ProgramPoint::PostLValueKind); 1339852274d4257134906995cb252fb3dfd2d71deae8Ted Kremenek return; 1340892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek } 13419c378f705405d37f49795d5e915989de774fe11fTed Kremenek if (const EnumConstantDecl *ED = dyn_cast<EnumConstantDecl>(D)) { 1342892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek assert(!Ex->isLValue()); 1343c8413fd03f73084a5c93028f8b4db619fc388087Ted Kremenek SVal V = svalBuilder.makeIntVal(ED->getInitVal()); 13448e0293406f9d62a293be6be3b1fb89d359f5ea40Ted Kremenek MakeNode(Dst, Ex, Pred, state->BindExpr(Ex, V)); 13456d69b5d82281992e981caa9bc038e3f6cac6594aZhongxing Xu return; 1346892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek } 13479c378f705405d37f49795d5e915989de774fe11fTed Kremenek if (const FunctionDecl *FD = dyn_cast<FunctionDecl>(D)) { 1348c8413fd03f73084a5c93028f8b4db619fc388087Ted Kremenek SVal V = svalBuilder.getFunctionPointer(FD); 13498e0293406f9d62a293be6be3b1fb89d359f5ea40Ted Kremenek MakeNode(Dst, Ex, Pred, state->BindExpr(Ex, V), 13507090d5465de7ca620da16211cf886edf1edc1f1fTed Kremenek ProgramPoint::PostLValueKind); 13516d69b5d82281992e981caa9bc038e3f6cac6594aZhongxing Xu return; 13521b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek } 13536d69b5d82281992e981caa9bc038e3f6cac6594aZhongxing Xu assert (false && 13546d69b5d82281992e981caa9bc038e3f6cac6594aZhongxing Xu "ValueDecl support for this ValueDecl not implemented."); 13553271f8d315712885ac87747369bb1d9f4b1ea81fTed Kremenek} 13563271f8d315712885ac87747369bb1d9f4b1ea81fTed Kremenek 1357540cbe2b60294fe7b926c26b4f1840f544fe3011Ted Kremenek/// VisitArraySubscriptExpr - Transfer function for array accesses 13589c378f705405d37f49795d5e915989de774fe11fTed Kremenekvoid ExprEngine::VisitLvalArraySubscriptExpr(const ArraySubscriptExpr *A, 13599c378f705405d37f49795d5e915989de774fe11fTed Kremenek ExplodedNode *Pred, 13609c378f705405d37f49795d5e915989de774fe11fTed Kremenek ExplodedNodeSet &Dst){ 13611eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 13629c378f705405d37f49795d5e915989de774fe11fTed Kremenek const Expr *Base = A->getBase()->IgnoreParens(); 13639c378f705405d37f49795d5e915989de774fe11fTed Kremenek const Expr *Idx = A->getIdx()->IgnoreParens(); 1364892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek 13651eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 13668f3407ef22bc7efe6ca4169381e09d0d657ec192Ted Kremenek ExplodedNodeSet checkerPreStmt; 13678f3407ef22bc7efe6ca4169381e09d0d657ec192Ted Kremenek getCheckerManager().runCheckersForPreStmt(checkerPreStmt, Pred, A, *this); 13688f3407ef22bc7efe6ca4169381e09d0d657ec192Ted Kremenek 13698f3407ef22bc7efe6ca4169381e09d0d657ec192Ted Kremenek for (ExplodedNodeSet::iterator it = checkerPreStmt.begin(), 13708f3407ef22bc7efe6ca4169381e09d0d657ec192Ted Kremenek ei = checkerPreStmt.end(); it != ei; ++it) { 137118c66fdc3c4008d335885695fe36fb5353c5f672Ted Kremenek const ProgramState *state = (*it)->getState(); 13728f3407ef22bc7efe6ca4169381e09d0d657ec192Ted Kremenek SVal V = state->getLValue(A->getType(), state->getSVal(Idx), 13738f3407ef22bc7efe6ca4169381e09d0d657ec192Ted Kremenek state->getSVal(Base)); 13748f3407ef22bc7efe6ca4169381e09d0d657ec192Ted Kremenek assert(A->isLValue()); 13758f3407ef22bc7efe6ca4169381e09d0d657ec192Ted Kremenek MakeNode(Dst, A, *it, state->BindExpr(A, V), ProgramPoint::PostLValueKind); 13761b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek } 1377540cbe2b60294fe7b926c26b4f1840f544fe3011Ted Kremenek} 1378540cbe2b60294fe7b926c26b4f1840f544fe3011Ted Kremenek 1379469ecbded3616416ef938ed94a67f86149faf226Ted Kremenek/// VisitMemberExpr - Transfer function for member expressions. 13809c378f705405d37f49795d5e915989de774fe11fTed Kremenekvoid ExprEngine::VisitMemberExpr(const MemberExpr *M, ExplodedNode *Pred, 13819c378f705405d37f49795d5e915989de774fe11fTed Kremenek ExplodedNodeSet &Dst) { 13821eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 13835bd04952d4ae7ca894f583583208f0cec4735a90Ted Kremenek Decl *member = M->getMemberDecl(); 13845bd04952d4ae7ca894f583583208f0cec4735a90Ted Kremenek if (VarDecl *VD = dyn_cast<VarDecl>(member)) { 13855bd04952d4ae7ca894f583583208f0cec4735a90Ted Kremenek assert(M->isLValue()); 13865bd04952d4ae7ca894f583583208f0cec4735a90Ted Kremenek VisitCommonDeclRefExpr(M, VD, Pred, Dst); 13875bd04952d4ae7ca894f583583208f0cec4735a90Ted Kremenek return; 13885bd04952d4ae7ca894f583583208f0cec4735a90Ted Kremenek } 13895bd04952d4ae7ca894f583583208f0cec4735a90Ted Kremenek 13905bd04952d4ae7ca894f583583208f0cec4735a90Ted Kremenek FieldDecl *field = dyn_cast<FieldDecl>(member); 1391892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek if (!field) // FIXME: skipping member expressions for non-fields 139286f194083504938df72135b5b66bf0c5cafd9498Douglas Gregor return; 139386f194083504938df72135b5b66bf0c5cafd9498Douglas Gregor 1394e3939d7446959afb6b650fe08e952d0f64ab6794Ted Kremenek Expr *baseExpr = M->getBase()->IgnoreParens(); 139518c66fdc3c4008d335885695fe36fb5353c5f672Ted Kremenek const ProgramState *state = Pred->getState(); 1396e3939d7446959afb6b650fe08e952d0f64ab6794Ted Kremenek SVal baseExprVal = state->getSVal(baseExpr); 1397e3939d7446959afb6b650fe08e952d0f64ab6794Ted Kremenek if (isa<nonloc::LazyCompoundVal>(baseExprVal) || 1398e3939d7446959afb6b650fe08e952d0f64ab6794Ted Kremenek isa<nonloc::CompoundVal>(baseExprVal) || 1399e3939d7446959afb6b650fe08e952d0f64ab6794Ted Kremenek // FIXME: This can originate by conjuring a symbol for an unknown 1400e3939d7446959afb6b650fe08e952d0f64ab6794Ted Kremenek // temporary struct object, see test/Analysis/fields.c: 1401e3939d7446959afb6b650fe08e952d0f64ab6794Ted Kremenek // (p = getit()).x 1402e3939d7446959afb6b650fe08e952d0f64ab6794Ted Kremenek isa<nonloc::SymbolVal>(baseExprVal)) { 1403e3939d7446959afb6b650fe08e952d0f64ab6794Ted Kremenek MakeNode(Dst, M, Pred, state->BindExpr(M, UnknownVal())); 1404e3939d7446959afb6b650fe08e952d0f64ab6794Ted Kremenek return; 1405e3939d7446959afb6b650fe08e952d0f64ab6794Ted Kremenek } 1406892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek 1407e3939d7446959afb6b650fe08e952d0f64ab6794Ted Kremenek // FIXME: Should we insert some assumption logic in here to determine 1408e3939d7446959afb6b650fe08e952d0f64ab6794Ted Kremenek // if "Base" is a valid piece of memory? Before we put this assumption 1409e3939d7446959afb6b650fe08e952d0f64ab6794Ted Kremenek // later when using FieldOffset lvals (which we no longer have). 1410d9bc33efa195114d6f2a365c26e5b8dba4e1cc38Ted Kremenek 1411e3939d7446959afb6b650fe08e952d0f64ab6794Ted Kremenek // For all other cases, compute an lvalue. 1412e3939d7446959afb6b650fe08e952d0f64ab6794Ted Kremenek SVal L = state->getLValue(field, baseExprVal); 1413e3939d7446959afb6b650fe08e952d0f64ab6794Ted Kremenek if (M->isLValue()) 1414e3939d7446959afb6b650fe08e952d0f64ab6794Ted Kremenek MakeNode(Dst, M, Pred, state->BindExpr(M, L), ProgramPoint::PostLValueKind); 1415e3939d7446959afb6b650fe08e952d0f64ab6794Ted Kremenek else 1416e3939d7446959afb6b650fe08e952d0f64ab6794Ted Kremenek evalLoad(Dst, M, Pred, state, L); 1417469ecbded3616416ef938ed94a67f86149faf226Ted Kremenek} 1418469ecbded3616416ef938ed94a67f86149faf226Ted Kremenek 14199c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek/// evalBind - Handle the semantics of binding a value to a specific location. 14209c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek/// This method is used by evalStore and (soon) VisitDeclStmt, and others. 14219c378f705405d37f49795d5e915989de774fe11fTed Kremenekvoid ExprEngine::evalBind(ExplodedNodeSet &Dst, const Stmt *StoreE, 142218c66fdc3c4008d335885695fe36fb5353c5f672Ted Kremenek ExplodedNode *Pred, const ProgramState *state, 142379d73044b7d0adfbd18ee34285395e1d5135f662Ted Kremenek SVal location, SVal Val, bool atDeclInit) { 1424b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 1425b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 1426b107c4b7efb907d75620cd3c17f82fe27dc5b745Ted Kremenek // Do a previsit of the bind. 1427b107c4b7efb907d75620cd3c17f82fe27dc5b745Ted Kremenek ExplodedNodeSet CheckedSet, Src; 1428b107c4b7efb907d75620cd3c17f82fe27dc5b745Ted Kremenek Src.Add(Pred); 1429eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis getCheckerManager().runCheckersForBind(CheckedSet, Src, location, Val, StoreE, 1430eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis *this); 1431b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 1432b107c4b7efb907d75620cd3c17f82fe27dc5b745Ted Kremenek for (ExplodedNodeSet::iterator I = CheckedSet.begin(), E = CheckedSet.end(); 1433b107c4b7efb907d75620cd3c17f82fe27dc5b745Ted Kremenek I!=E; ++I) { 1434b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 1435b107c4b7efb907d75620cd3c17f82fe27dc5b745Ted Kremenek if (Pred != *I) 1436db5e8cd095d1ffdd18f5620ad2348b5f386bebe3Anna Zaks state = (*I)->getState(); 1437b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 143818c66fdc3c4008d335885695fe36fb5353c5f672Ted Kremenek const ProgramState *newState = 0; 1439a8538d902fce9cfec20f39b34492268b51643819Ted Kremenek 1440b107c4b7efb907d75620cd3c17f82fe27dc5b745Ted Kremenek if (atDeclInit) { 1441b107c4b7efb907d75620cd3c17f82fe27dc5b745Ted Kremenek const VarRegion *VR = 1442b107c4b7efb907d75620cd3c17f82fe27dc5b745Ted Kremenek cast<VarRegion>(cast<loc::MemRegionVal>(location).getRegion()); 1443f6f56d4fc8ebce17e7b83eb2c35f57a055c22283Ted Kremenek 1444b107c4b7efb907d75620cd3c17f82fe27dc5b745Ted Kremenek newState = state->bindDecl(VR, Val); 1445f6f56d4fc8ebce17e7b83eb2c35f57a055c22283Ted Kremenek } 1446f6f56d4fc8ebce17e7b83eb2c35f57a055c22283Ted Kremenek else { 1447b107c4b7efb907d75620cd3c17f82fe27dc5b745Ted Kremenek if (location.isUnknown()) { 1448b107c4b7efb907d75620cd3c17f82fe27dc5b745Ted Kremenek // We know that the new state will be the same as the old state since 1449b107c4b7efb907d75620cd3c17f82fe27dc5b745Ted Kremenek // the location of the binding is "unknown". Consequently, there 1450b107c4b7efb907d75620cd3c17f82fe27dc5b745Ted Kremenek // is no reason to just create a new node. 1451b107c4b7efb907d75620cd3c17f82fe27dc5b745Ted Kremenek newState = state; 1452b107c4b7efb907d75620cd3c17f82fe27dc5b745Ted Kremenek } 1453b107c4b7efb907d75620cd3c17f82fe27dc5b745Ted Kremenek else { 1454b107c4b7efb907d75620cd3c17f82fe27dc5b745Ted Kremenek // We are binding to a value other than 'unknown'. Perform the binding 1455b107c4b7efb907d75620cd3c17f82fe27dc5b745Ted Kremenek // using the StoreManager. 1456b107c4b7efb907d75620cd3c17f82fe27dc5b745Ted Kremenek newState = state->bindLoc(cast<Loc>(location), Val); 1457b107c4b7efb907d75620cd3c17f82fe27dc5b745Ted Kremenek } 1458f6f56d4fc8ebce17e7b83eb2c35f57a055c22283Ted Kremenek } 1459a8538d902fce9cfec20f39b34492268b51643819Ted Kremenek 1460d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidis // The next thing to do is check if the TransferFuncs object wants to 1461b107c4b7efb907d75620cd3c17f82fe27dc5b745Ted Kremenek // update the state based on the new binding. If the GRTransferFunc object 1462b107c4b7efb907d75620cd3c17f82fe27dc5b745Ted Kremenek // doesn't do anything, just auto-propagate the current state. 146379d73044b7d0adfbd18ee34285395e1d5135f662Ted Kremenek 146479d73044b7d0adfbd18ee34285395e1d5135f662Ted Kremenek // NOTE: We use 'AssignE' for the location of the PostStore if 'AssignE' 146579d73044b7d0adfbd18ee34285395e1d5135f662Ted Kremenek // is non-NULL. Checkers typically care about 146679d73044b7d0adfbd18ee34285395e1d5135f662Ted Kremenek 1467d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidis StmtNodeBuilderRef BuilderRef(Dst, *Builder, *this, *I, newState, StoreE, 146896ebad66c451d79c9f57b1edb31efaeeb23b9a01Ted Kremenek true); 14691eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 14709c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek getTF().evalBind(BuilderRef, location, Val); 1471b107c4b7efb907d75620cd3c17f82fe27dc5b745Ted Kremenek } 1472a8538d902fce9cfec20f39b34492268b51643819Ted Kremenek} 1473a8538d902fce9cfec20f39b34492268b51643819Ted Kremenek 14749c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek/// evalStore - Handle the semantics of a store via an assignment. 1475a8538d902fce9cfec20f39b34492268b51643819Ted Kremenek/// @param Dst The node set to store generated state nodes 1476e8a4d7d0064b357a30fe7ee4f2ddc02f9ffc0357Zhongxing Xu/// @param AssignE The assignment expression if the store happens in an 1477e8a4d7d0064b357a30fe7ee4f2ddc02f9ffc0357Zhongxing Xu/// assignment. 1478e8a4d7d0064b357a30fe7ee4f2ddc02f9ffc0357Zhongxing Xu/// @param LocatioinE The location expression that is stored to. 1479a8538d902fce9cfec20f39b34492268b51643819Ted Kremenek/// @param state The current simulation state 1480a8538d902fce9cfec20f39b34492268b51643819Ted Kremenek/// @param location The location to store the value 1481a8538d902fce9cfec20f39b34492268b51643819Ted Kremenek/// @param Val The value to be stored 14829c378f705405d37f49795d5e915989de774fe11fTed Kremenekvoid ExprEngine::evalStore(ExplodedNodeSet &Dst, const Expr *AssignE, 14839c378f705405d37f49795d5e915989de774fe11fTed Kremenek const Expr *LocationE, 14849c378f705405d37f49795d5e915989de774fe11fTed Kremenek ExplodedNode *Pred, 148518c66fdc3c4008d335885695fe36fb5353c5f672Ted Kremenek const ProgramState *state, SVal location, SVal Val, 1486ca804539d908d3a0e8c72a0df5f1f571d29490bbTed Kremenek const ProgramPointTag *tag) { 14871eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1488d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidis assert(Builder && "StmtNodeBuilder must be defined."); 14891eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 149014429b918bd2f4cb52abc75546a7fe37142054caArgyrios Kyrtzidis // Proceed with the store. We use AssignE as the anchor for the PostStore 149114429b918bd2f4cb52abc75546a7fe37142054caArgyrios Kyrtzidis // ProgramPoint if it is non-NULL, and LocationE otherwise. 149214429b918bd2f4cb52abc75546a7fe37142054caArgyrios Kyrtzidis const Expr *StoreE = AssignE ? AssignE : LocationE; 149314429b918bd2f4cb52abc75546a7fe37142054caArgyrios Kyrtzidis 149414429b918bd2f4cb52abc75546a7fe37142054caArgyrios Kyrtzidis if (isa<loc::ObjCPropRef>(location)) { 149514429b918bd2f4cb52abc75546a7fe37142054caArgyrios Kyrtzidis loc::ObjCPropRef prop = cast<loc::ObjCPropRef>(location); 149614429b918bd2f4cb52abc75546a7fe37142054caArgyrios Kyrtzidis return VisitObjCMessage(ObjCPropertySetter(prop.getPropRefExpr(), 14974410a935e8d8ee3c903b858bbf74ca24fce629b5Ted Kremenek StoreE, Val), Pred, Dst); 149814429b918bd2f4cb52abc75546a7fe37142054caArgyrios Kyrtzidis } 149914429b918bd2f4cb52abc75546a7fe37142054caArgyrios Kyrtzidis 15001b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek // Evaluate the location (checks for bad dereferences). 1501b4b817d704287836b52b34369009e682f208aa2bTed Kremenek ExplodedNodeSet Tmp; 15029c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek evalLocation(Tmp, LocationE, Pred, state, location, tag, false); 15031eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1504b4b817d704287836b52b34369009e682f208aa2bTed Kremenek if (Tmp.empty()) 15051b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek return; 1506b0533965f1b4db020692e3b23ca7b3bc15bf5897Ted Kremenek 150773c498a08f4968b6987d1453c7b77929dcc6d5f7Argyrios Kyrtzidis if (location.isUndef()) 150873c498a08f4968b6987d1453c7b77929dcc6d5f7Argyrios Kyrtzidis return; 1509a8538d902fce9cfec20f39b34492268b51643819Ted Kremenek 1510b4b817d704287836b52b34369009e682f208aa2bTed Kremenek SaveAndRestore<ProgramPoint::Kind> OldSPointKind(Builder->PointKind, 1511b4b817d704287836b52b34369009e682f208aa2bTed Kremenek ProgramPoint::PostStoreKind); 1512b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 1513b4b817d704287836b52b34369009e682f208aa2bTed Kremenek for (ExplodedNodeSet::iterator NI=Tmp.begin(), NE=Tmp.end(); NI!=NE; ++NI) 1514db5e8cd095d1ffdd18f5620ad2348b5f386bebe3Anna Zaks evalBind(Dst, StoreE, *NI, (*NI)->getState(), location, Val); 15151b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek} 15161b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek 15179c378f705405d37f49795d5e915989de774fe11fTed Kremenekvoid ExprEngine::evalLoad(ExplodedNodeSet &Dst, const Expr *Ex, 15189c378f705405d37f49795d5e915989de774fe11fTed Kremenek ExplodedNode *Pred, 151918c66fdc3c4008d335885695fe36fb5353c5f672Ted Kremenek const ProgramState *state, SVal location, 1520ca804539d908d3a0e8c72a0df5f1f571d29490bbTed Kremenek const ProgramPointTag *tag, QualType LoadTy) { 1521cca8ab155e8c20b98ba2d90eb2b1c228895e06fdZhanyong Wan assert(!isa<NonLoc>(location) && "location cannot be a NonLoc."); 15221b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek 152314429b918bd2f4cb52abc75546a7fe37142054caArgyrios Kyrtzidis if (isa<loc::ObjCPropRef>(location)) { 152414429b918bd2f4cb52abc75546a7fe37142054caArgyrios Kyrtzidis loc::ObjCPropRef prop = cast<loc::ObjCPropRef>(location); 152514429b918bd2f4cb52abc75546a7fe37142054caArgyrios Kyrtzidis return VisitObjCMessage(ObjCPropertyGetter(prop.getPropRefExpr(), Ex), 15264410a935e8d8ee3c903b858bbf74ca24fce629b5Ted Kremenek Pred, Dst); 152714429b918bd2f4cb52abc75546a7fe37142054caArgyrios Kyrtzidis } 152814429b918bd2f4cb52abc75546a7fe37142054caArgyrios Kyrtzidis 1529852274d4257134906995cb252fb3dfd2d71deae8Ted Kremenek // Are we loading from a region? This actually results in two loads; one 1530852274d4257134906995cb252fb3dfd2d71deae8Ted Kremenek // to fetch the address of the referenced value and one to fetch the 1531852274d4257134906995cb252fb3dfd2d71deae8Ted Kremenek // referenced value. 15329697934650354bed2e509d8e7e44f21a1fb00f76Ted Kremenek if (const TypedValueRegion *TR = 15339697934650354bed2e509d8e7e44f21a1fb00f76Ted Kremenek dyn_cast_or_null<TypedValueRegion>(location.getAsRegion())) { 1534b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 1535018220c343c103b7dfaa117a7a474c7a7fd6d068Zhongxing Xu QualType ValTy = TR->getValueType(); 1536852274d4257134906995cb252fb3dfd2d71deae8Ted Kremenek if (const ReferenceType *RT = ValTy->getAs<ReferenceType>()) { 1537ca804539d908d3a0e8c72a0df5f1f571d29490bbTed Kremenek static SimpleProgramPointTag 1538ca804539d908d3a0e8c72a0df5f1f571d29490bbTed Kremenek loadReferenceTag("ExprEngine : Load Reference"); 1539852274d4257134906995cb252fb3dfd2d71deae8Ted Kremenek ExplodedNodeSet Tmp; 15409c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek evalLoadCommon(Tmp, Ex, Pred, state, location, &loadReferenceTag, 1541852274d4257134906995cb252fb3dfd2d71deae8Ted Kremenek getContext().getPointerType(RT->getPointeeType())); 1542852274d4257134906995cb252fb3dfd2d71deae8Ted Kremenek 1543852274d4257134906995cb252fb3dfd2d71deae8Ted Kremenek // Perform the load from the referenced value. 1544852274d4257134906995cb252fb3dfd2d71deae8Ted Kremenek for (ExplodedNodeSet::iterator I=Tmp.begin(), E=Tmp.end() ; I!=E; ++I) { 1545db5e8cd095d1ffdd18f5620ad2348b5f386bebe3Anna Zaks state = (*I)->getState(); 15461397663af9dbcc24dbf0e11de43931b3dc08fdbbTed Kremenek location = state->getSVal(Ex); 15479c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek evalLoadCommon(Dst, Ex, *I, state, location, tag, LoadTy); 1548b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek } 1549852274d4257134906995cb252fb3dfd2d71deae8Ted Kremenek return; 1550852274d4257134906995cb252fb3dfd2d71deae8Ted Kremenek } 1551852274d4257134906995cb252fb3dfd2d71deae8Ted Kremenek } 1552b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 15539c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek evalLoadCommon(Dst, Ex, Pred, state, location, tag, LoadTy); 1554852274d4257134906995cb252fb3dfd2d71deae8Ted Kremenek} 1555852274d4257134906995cb252fb3dfd2d71deae8Ted Kremenek 15569c378f705405d37f49795d5e915989de774fe11fTed Kremenekvoid ExprEngine::evalLoadCommon(ExplodedNodeSet &Dst, const Expr *Ex, 15579c378f705405d37f49795d5e915989de774fe11fTed Kremenek ExplodedNode *Pred, 155818c66fdc3c4008d335885695fe36fb5353c5f672Ted Kremenek const ProgramState *state, SVal location, 1559ca804539d908d3a0e8c72a0df5f1f571d29490bbTed Kremenek const ProgramPointTag *tag, QualType LoadTy) { 1560b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 15611eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump // Evaluate the location (checks for bad dereferences). 1562b4b817d704287836b52b34369009e682f208aa2bTed Kremenek ExplodedNodeSet Tmp; 15639c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek evalLocation(Tmp, Ex, Pred, state, location, tag, true); 15641eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1565b4b817d704287836b52b34369009e682f208aa2bTed Kremenek if (Tmp.empty()) 15661b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek return; 1567b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 156873c498a08f4968b6987d1453c7b77929dcc6d5f7Argyrios Kyrtzidis if (location.isUndef()) 156973c498a08f4968b6987d1453c7b77929dcc6d5f7Argyrios Kyrtzidis return; 1570b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 1571b4b817d704287836b52b34369009e682f208aa2bTed Kremenek SaveAndRestore<ProgramPoint::Kind> OldSPointKind(Builder->PointKind); 15721eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 15731b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek // Proceed with the load. 1574b4b817d704287836b52b34369009e682f208aa2bTed Kremenek for (ExplodedNodeSet::iterator NI=Tmp.begin(), NE=Tmp.end(); NI!=NE; ++NI) { 1575db5e8cd095d1ffdd18f5620ad2348b5f386bebe3Anna Zaks state = (*NI)->getState(); 157696ebad66c451d79c9f57b1edb31efaeeb23b9a01Ted Kremenek 1577b4b817d704287836b52b34369009e682f208aa2bTed Kremenek if (location.isUnknown()) { 1578b4b817d704287836b52b34369009e682f208aa2bTed Kremenek // This is important. We must nuke the old binding. 1579b4b817d704287836b52b34369009e682f208aa2bTed Kremenek MakeNode(Dst, Ex, *NI, state->BindExpr(Ex, UnknownVal()), 1580b4b817d704287836b52b34369009e682f208aa2bTed Kremenek ProgramPoint::PostLoadKind, tag); 1581b4b817d704287836b52b34369009e682f208aa2bTed Kremenek } 1582b4b817d704287836b52b34369009e682f208aa2bTed Kremenek else { 158396ebad66c451d79c9f57b1edb31efaeeb23b9a01Ted Kremenek if (LoadTy.isNull()) 158496ebad66c451d79c9f57b1edb31efaeeb23b9a01Ted Kremenek LoadTy = Ex->getType(); 158596ebad66c451d79c9f57b1edb31efaeeb23b9a01Ted Kremenek SVal V = state->getSVal(cast<Loc>(location), LoadTy); 158696ebad66c451d79c9f57b1edb31efaeeb23b9a01Ted Kremenek MakeNode(Dst, Ex, *NI, state->bindExprAndLocation(Ex, location, V), 158796ebad66c451d79c9f57b1edb31efaeeb23b9a01Ted Kremenek ProgramPoint::PostLoadKind, tag); 1588b4b817d704287836b52b34369009e682f208aa2bTed Kremenek } 1589d5b499d43c3526fae7f9ebb6e2d50e79d3496cedZhongxing Xu } 15901b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek} 15911b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek 1592d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidisvoid ExprEngine::evalLocation(ExplodedNodeSet &Dst, const Stmt *S, 15939c378f705405d37f49795d5e915989de774fe11fTed Kremenek ExplodedNode *Pred, 159418c66fdc3c4008d335885695fe36fb5353c5f672Ted Kremenek const ProgramState *state, SVal location, 1595ca804539d908d3a0e8c72a0df5f1f571d29490bbTed Kremenek const ProgramPointTag *tag, bool isLoad) { 159600b1ad2d56f3e39f95c3f61bf511a531ab6a4fa5Zhongxing Xu // Early checks for performance reason. 1597769ce3e93ad35bd9ac28e4d8b8f035ae4fd9a5b5Argyrios Kyrtzidis if (location.isUnknown()) { 1598b4b817d704287836b52b34369009e682f208aa2bTed Kremenek Dst.Add(Pred); 1599b4b817d704287836b52b34369009e682f208aa2bTed Kremenek return; 1600b4b817d704287836b52b34369009e682f208aa2bTed Kremenek } 1601b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 16029c0d6891b3ec4b0d20b8a295946c0dc5426d147cArgyrios Kyrtzidis ExplodedNodeSet Src; 16030e89061a399bae32f0eca5b85658ad66a58c504dAnna Zaks if (Pred->getState() == state) { 1604eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis Src.Add(Pred); 1605eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis } else { 1606eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis // Associate this new state with an ExplodedNode. 1607eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis // FIXME: If I pass null tag, the graph is incorrect, e.g for 1608eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis // int *p; 1609eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis // p = 0; 1610eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis // *p = 0xDEADBEEF; 1611eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis // "p = 0" is not noted as "Null pointer value stored to 'p'" but 1612eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis // instead "int *p" is noted as 1613eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis // "Variable 'p' initialized to a null pointer value" 1614ca804539d908d3a0e8c72a0df5f1f571d29490bbTed Kremenek 1615ca804539d908d3a0e8c72a0df5f1f571d29490bbTed Kremenek // FIXME: why is 'tag' not used instead of etag? 1616ca804539d908d3a0e8c72a0df5f1f571d29490bbTed Kremenek static SimpleProgramPointTag etag("ExprEngine: Location"); 1617ca804539d908d3a0e8c72a0df5f1f571d29490bbTed Kremenek 1618ca804539d908d3a0e8c72a0df5f1f571d29490bbTed Kremenek ExplodedNode *N = Builder->generateNode(S, state, Pred, &etag); 1619eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis Src.Add(N ? N : Pred); 16200296c22557b3735e2ffeff690eb46fb0e9152bccTed Kremenek } 1621eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis getCheckerManager().runCheckersForLocation(Dst, Src, location, isLoad, S, 1622eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis *this); 1623ec96a2d52d16e150baaf629cd35e3fabff5d8915Ted Kremenek} 1624ec96a2d52d16e150baaf629cd35e3fabff5d8915Ted Kremenek 1625d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidisbool ExprEngine::InlineCall(ExplodedNodeSet &Dst, const CallExpr *CE, 16261c625f25055331bf76ab5479a8060d2b0f61e8b8Zhongxing Xu ExplodedNode *Pred) { 1627b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek return false; 1628b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek 1629b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek // Inlining isn't correct right now because we: 1630b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek // (a) don't generate CallExit nodes. 1631b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek // (b) we need a way to postpone doing post-visits of CallExprs until 1632b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek // the CallExit. This means we need CallExits for the non-inline 1633b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek // cases as well. 1634b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek 1635b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek#if 0 163618c66fdc3c4008d335885695fe36fb5353c5f672Ted Kremenek const ProgramState *state = Pred->getState(); 16371c625f25055331bf76ab5479a8060d2b0f61e8b8Zhongxing Xu const Expr *Callee = CE->getCallee(); 16381c625f25055331bf76ab5479a8060d2b0f61e8b8Zhongxing Xu SVal L = state->getSVal(Callee); 16391c625f25055331bf76ab5479a8060d2b0f61e8b8Zhongxing Xu 16401c625f25055331bf76ab5479a8060d2b0f61e8b8Zhongxing Xu const FunctionDecl *FD = L.getAsFunctionDecl(); 16411c625f25055331bf76ab5479a8060d2b0f61e8b8Zhongxing Xu if (!FD) 16421c625f25055331bf76ab5479a8060d2b0f61e8b8Zhongxing Xu return false; 16431c625f25055331bf76ab5479a8060d2b0f61e8b8Zhongxing Xu 1644b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek // Specially handle CXXMethods. 1645b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek const CXXMethodDecl *methodDecl = 0; 1646b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek 1647b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek switch (CE->getStmtClass()) { 1648b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek default: break; 1649b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek case Stmt::CXXOperatorCallExprClass: { 1650b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek const CXXOperatorCallExpr *opCall = cast<CXXOperatorCallExpr>(CE); 1651b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek methodDecl = 16525f9e272e632e951b1efe824cd16acb4d96077930Chris Lattner dyn_cast_or_null<CXXMethodDecl>(opCall->getCalleeDecl()); 1653b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek break; 1654b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek } 1655b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek case Stmt::CXXMemberCallExprClass: { 1656b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek const CXXMemberCallExpr *memberCall = cast<CXXMemberCallExpr>(CE); 1657b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek const MemberExpr *memberExpr = 1658b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek cast<MemberExpr>(memberCall->getCallee()->IgnoreParens()); 1659b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek methodDecl = cast<CXXMethodDecl>(memberExpr->getMemberDecl()); 1660b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek break; 1661b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek } 1662b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek } 1663b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek 1664b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek 1665b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek 1666b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek 1667c6238d2786cfd961b94580b3d3675a1b3ff0721cZhongxing Xu // Check if the function definition is in the same translation unit. 1668c6238d2786cfd961b94580b3d3675a1b3ff0721cZhongxing Xu if (FD->hasBody(FD)) { 166919b78d9e3dbbc27bbcbdd8c3017a00fe88849ecdZhongxing Xu const StackFrameContext *stackFrame = 167019b78d9e3dbbc27bbcbdd8c3017a00fe88849ecdZhongxing Xu AMgr.getStackFrame(AMgr.getAnalysisContext(FD), 167119b78d9e3dbbc27bbcbdd8c3017a00fe88849ecdZhongxing Xu Pred->getLocationContext(), 1672892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek CE, Builder->getBlock(), Builder->getIndex()); 1673c6238d2786cfd961b94580b3d3675a1b3ff0721cZhongxing Xu // Now we have the definition of the callee, create a CallEnter node. 167419b78d9e3dbbc27bbcbdd8c3017a00fe88849ecdZhongxing Xu CallEnter Loc(CE, stackFrame, Pred->getLocationContext()); 1675c6238d2786cfd961b94580b3d3675a1b3ff0721cZhongxing Xu 1676c6238d2786cfd961b94580b3d3675a1b3ff0721cZhongxing Xu ExplodedNode *N = Builder->generateNode(Loc, state, Pred); 1677c6238d2786cfd961b94580b3d3675a1b3ff0721cZhongxing Xu Dst.Add(N); 1678c6238d2786cfd961b94580b3d3675a1b3ff0721cZhongxing Xu return true; 1679c6238d2786cfd961b94580b3d3675a1b3ff0721cZhongxing Xu } 16801c625f25055331bf76ab5479a8060d2b0f61e8b8Zhongxing Xu 1681c6238d2786cfd961b94580b3d3675a1b3ff0721cZhongxing Xu // Check if we can find the function definition in other translation units. 1682c6238d2786cfd961b94580b3d3675a1b3ff0721cZhongxing Xu if (AMgr.hasIndexer()) { 168319b78d9e3dbbc27bbcbdd8c3017a00fe88849ecdZhongxing Xu AnalysisContext *C = AMgr.getAnalysisContextInAnotherTU(FD); 1684c6238d2786cfd961b94580b3d3675a1b3ff0721cZhongxing Xu if (C == 0) 1685c6238d2786cfd961b94580b3d3675a1b3ff0721cZhongxing Xu return false; 168619b78d9e3dbbc27bbcbdd8c3017a00fe88849ecdZhongxing Xu const StackFrameContext *stackFrame = 168719b78d9e3dbbc27bbcbdd8c3017a00fe88849ecdZhongxing Xu AMgr.getStackFrame(C, Pred->getLocationContext(), 1688892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek CE, Builder->getBlock(), Builder->getIndex()); 168919b78d9e3dbbc27bbcbdd8c3017a00fe88849ecdZhongxing Xu CallEnter Loc(CE, stackFrame, Pred->getLocationContext()); 1690c6238d2786cfd961b94580b3d3675a1b3ff0721cZhongxing Xu ExplodedNode *N = Builder->generateNode(Loc, state, Pred); 16911c625f25055331bf76ab5479a8060d2b0f61e8b8Zhongxing Xu Dst.Add(N); 1692c6238d2786cfd961b94580b3d3675a1b3ff0721cZhongxing Xu return true; 1693c6238d2786cfd961b94580b3d3675a1b3ff0721cZhongxing Xu } 1694b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek 1695b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek // Generate the CallExit node. 1696c6238d2786cfd961b94580b3d3675a1b3ff0721cZhongxing Xu 1697c6238d2786cfd961b94580b3d3675a1b3ff0721cZhongxing Xu return false; 1698b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek#endif 16991c625f25055331bf76ab5479a8060d2b0f61e8b8Zhongxing Xu} 17001c625f25055331bf76ab5479a8060d2b0f61e8b8Zhongxing Xu 17019c378f705405d37f49795d5e915989de774fe11fTed Kremenekvoid ExprEngine::VisitCallExpr(const CallExpr *CE, ExplodedNode *Pred, 17029c378f705405d37f49795d5e915989de774fe11fTed Kremenek ExplodedNodeSet &dst) { 1703b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek // Perform the previsit of the CallExpr. 1704b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek ExplodedNodeSet dstPreVisit; 1705962fddcd97d20012ea2e68a8c4e1833c53b6d937Ted Kremenek getCheckerManager().runCheckersForPreStmt(dstPreVisit, Pred, CE, *this); 1706b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek 1707b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek // Now evaluate the call itself. 1708eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis class DefaultEval : public GraphExpander { 1709eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis ExprEngine &Eng; 1710eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis const CallExpr *CE; 1711eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis public: 1712eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis 1713eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis DefaultEval(ExprEngine &eng, const CallExpr *ce) 1714b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek : Eng(eng), CE(ce) {} 1715eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis virtual void expandGraph(ExplodedNodeSet &Dst, ExplodedNode *Pred) { 1716b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek // Should we inline the call? 1717eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis if (Eng.getAnalysisManager().shouldInlineCall() && 1718eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis Eng.InlineCall(Dst, CE, Pred)) { 1719b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek return; 172017f4da8f150f6b9dfb571cebd6299b06948e5385Ted Kremenek } 1721b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek 1722b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek StmtNodeBuilder &Builder = Eng.getBuilder(); 1723b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek assert(&Builder && "StmtNodeBuilder must be defined."); 1724b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek 1725b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek // Dispatch to the plug-in transfer function. 1726b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek unsigned oldSize = Dst.size(); 1727b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek SaveOr OldHasGen(Builder.hasGeneratedNode); 1728b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek 1729b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek // Dispatch to transfer function logic to handle the call itself. 17309c378f705405d37f49795d5e915989de774fe11fTed Kremenek const Expr *Callee = CE->getCallee()->IgnoreParens(); 173118c66fdc3c4008d335885695fe36fb5353c5f672Ted Kremenek const ProgramState *state = Pred->getState(); 1732b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek SVal L = state->getSVal(Callee); 1733b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek Eng.getTF().evalCall(Dst, Eng, Builder, CE, L, Pred); 1734b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek 1735b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek // Handle the case where no nodes where generated. Auto-generate that 1736b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek // contains the updated state if we aren't generating sinks. 1737b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek if (!Builder.BuildSinks && Dst.size() == oldSize && 1738b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek !Builder.hasGeneratedNode) 1739b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek Eng.MakeNode(Dst, CE, Pred, state); 1740935ef90f4b065c7c865ee5b2a99c5f9b1a115d72Zhongxing Xu } 1741eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis }; 1742eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis 1743eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis // Finally, evaluate the function call. We try each of the checkers 1744eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis // to see if the can evaluate the function call. 1745b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek ExplodedNodeSet dstCallEvaluated; 1746eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis DefaultEval defEval(*this, CE); 1747b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek getCheckerManager().runCheckersForEvalCall(dstCallEvaluated, 1748b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek dstPreVisit, 1749b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek CE, *this, &defEval); 1750b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 17513cead901aab394fe8e84953235959ece8002854fTed Kremenek // Finally, perform the post-condition check of the CallExpr and store 17523cead901aab394fe8e84953235959ece8002854fTed Kremenek // the created nodes in 'Dst'. 1753b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek getCheckerManager().runCheckersForPostStmt(dst, dstCallEvaluated, CE, 1754b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek *this); 1755e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek} 1756e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek 1757e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek//===----------------------------------------------------------------------===// 175814429b918bd2f4cb52abc75546a7fe37142054caArgyrios Kyrtzidis// Transfer function: Objective-C dot-syntax to access a property. 175914429b918bd2f4cb52abc75546a7fe37142054caArgyrios Kyrtzidis//===----------------------------------------------------------------------===// 176014429b918bd2f4cb52abc75546a7fe37142054caArgyrios Kyrtzidis 176114429b918bd2f4cb52abc75546a7fe37142054caArgyrios Kyrtzidisvoid ExprEngine::VisitObjCPropertyRefExpr(const ObjCPropertyRefExpr *Ex, 176214429b918bd2f4cb52abc75546a7fe37142054caArgyrios Kyrtzidis ExplodedNode *Pred, 176314429b918bd2f4cb52abc75546a7fe37142054caArgyrios Kyrtzidis ExplodedNodeSet &Dst) { 1764db5e8cd095d1ffdd18f5620ad2348b5f386bebe3Anna Zaks MakeNode(Dst, Ex, Pred, Pred->getState()->BindExpr(Ex, loc::ObjCPropRef(Ex))); 176514429b918bd2f4cb52abc75546a7fe37142054caArgyrios Kyrtzidis} 176614429b918bd2f4cb52abc75546a7fe37142054caArgyrios Kyrtzidis 176714429b918bd2f4cb52abc75546a7fe37142054caArgyrios Kyrtzidis//===----------------------------------------------------------------------===// 176897ed4f68f5dba3e21e7a490ef0f9ffd3bfead7f8Ted Kremenek// Transfer function: Objective-C ivar references. 176997ed4f68f5dba3e21e7a490ef0f9ffd3bfead7f8Ted Kremenek//===----------------------------------------------------------------------===// 177048af2a9c1ed3259512f2d1431720add1fbe8fb5fTed Kremenek 17716c7511db998817e64f2e124013e7d7c9a430c580Ted Kremenekstd::pair<const ProgramPointTag *, const ProgramPointTag*> 17726c7511db998817e64f2e124013e7d7c9a430c580Ted KremenekExprEngine::getEagerlyAssumeTags() { 17736c7511db998817e64f2e124013e7d7c9a430c580Ted Kremenek static SimpleProgramPointTag 17746c7511db998817e64f2e124013e7d7c9a430c580Ted Kremenek EagerlyAssumeTrue("ExprEngine : Eagerly Assume True"), 17756c7511db998817e64f2e124013e7d7c9a430c580Ted Kremenek EagerlyAssumeFalse("ExprEngine : Eagerly Assume False"); 17766c7511db998817e64f2e124013e7d7c9a430c580Ted Kremenek return std::make_pair(&EagerlyAssumeTrue, &EagerlyAssumeFalse); 17776c7511db998817e64f2e124013e7d7c9a430c580Ted Kremenek} 17786c7511db998817e64f2e124013e7d7c9a430c580Ted Kremenek 1779d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidisvoid ExprEngine::evalEagerlyAssume(ExplodedNodeSet &Dst, ExplodedNodeSet &Src, 178003509aea098772644bf4662dc1c88634818ceeccZhongxing Xu const Expr *Ex) { 178186b39f20d5091ca3fdcbeb4a22766aaffdf6ac35Ted Kremenek 178286b39f20d5091ca3fdcbeb4a22766aaffdf6ac35Ted Kremenek 1783031ccc0555a82afc2e8afe29e19dd57ff204e2deZhongxing Xu for (ExplodedNodeSet::iterator I=Src.begin(), E=Src.end(); I!=E; ++I) { 1784031ccc0555a82afc2e8afe29e19dd57ff204e2deZhongxing Xu ExplodedNode *Pred = *I; 17851eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1786b293902c5cfa18365ffb0e00763849c9808a2ad1Ted Kremenek // Test if the previous node was as the same expression. This can happen 1787b293902c5cfa18365ffb0e00763849c9808a2ad1Ted Kremenek // when the expression fails to evaluate to anything meaningful and 1788b293902c5cfa18365ffb0e00763849c9808a2ad1Ted Kremenek // (as an optimization) we don't generate a node. 17891eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump ProgramPoint P = Pred->getLocation(); 1790b293902c5cfa18365ffb0e00763849c9808a2ad1Ted Kremenek if (!isa<PostStmt>(P) || cast<PostStmt>(P).getStmt() != Ex) { 17911eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump Dst.Add(Pred); 1792b293902c5cfa18365ffb0e00763849c9808a2ad1Ted Kremenek continue; 17931eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump } 1794b293902c5cfa18365ffb0e00763849c9808a2ad1Ted Kremenek 179518c66fdc3c4008d335885695fe36fb5353c5f672Ted Kremenek const ProgramState *state = Pred->getState(); 17961397663af9dbcc24dbf0e11de43931b3dc08fdbbTed Kremenek SVal V = state->getSVal(Ex); 17975b9bd2137ebef350af803c634e3fdf5d74678100Ted Kremenek if (nonloc::SymExprVal *SEV = dyn_cast<nonloc::SymExprVal>(&V)) { 17986c7511db998817e64f2e124013e7d7c9a430c580Ted Kremenek const std::pair<const ProgramPointTag *, const ProgramPointTag*> &tags = 17996c7511db998817e64f2e124013e7d7c9a430c580Ted Kremenek getEagerlyAssumeTags(); 18006c7511db998817e64f2e124013e7d7c9a430c580Ted Kremenek 180148af2a9c1ed3259512f2d1431720add1fbe8fb5fTed Kremenek // First assume that the condition is true. 18026c7511db998817e64f2e124013e7d7c9a430c580Ted Kremenek if (const ProgramState *StateTrue = state->assume(*SEV, true)) { 180386b39f20d5091ca3fdcbeb4a22766aaffdf6ac35Ted Kremenek SVal Val = svalBuilder.makeIntVal(1U, Ex->getType()); 18046c7511db998817e64f2e124013e7d7c9a430c580Ted Kremenek StateTrue = StateTrue->BindExpr(Ex, Val); 18056c7511db998817e64f2e124013e7d7c9a430c580Ted Kremenek Dst.Add(Builder->generateNode(Ex, StateTrue, Pred, tags.first)); 180648af2a9c1ed3259512f2d1431720add1fbe8fb5fTed Kremenek } 18071eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 180848af2a9c1ed3259512f2d1431720add1fbe8fb5fTed Kremenek // Next, assume that the condition is false. 18096c7511db998817e64f2e124013e7d7c9a430c580Ted Kremenek if (const ProgramState *StateFalse = state->assume(*SEV, false)) { 181086b39f20d5091ca3fdcbeb4a22766aaffdf6ac35Ted Kremenek SVal Val = svalBuilder.makeIntVal(0U, Ex->getType()); 18116c7511db998817e64f2e124013e7d7c9a430c580Ted Kremenek StateFalse = StateFalse->BindExpr(Ex, Val); 18126c7511db998817e64f2e124013e7d7c9a430c580Ted Kremenek Dst.Add(Builder->generateNode(Ex, StateFalse, Pred, tags.second)); 181348af2a9c1ed3259512f2d1431720add1fbe8fb5fTed Kremenek } 181448af2a9c1ed3259512f2d1431720add1fbe8fb5fTed Kremenek } 181548af2a9c1ed3259512f2d1431720add1fbe8fb5fTed Kremenek else 181648af2a9c1ed3259512f2d1431720add1fbe8fb5fTed Kremenek Dst.Add(Pred); 181748af2a9c1ed3259512f2d1431720add1fbe8fb5fTed Kremenek } 181848af2a9c1ed3259512f2d1431720add1fbe8fb5fTed Kremenek} 181948af2a9c1ed3259512f2d1431720add1fbe8fb5fTed Kremenek 182048af2a9c1ed3259512f2d1431720add1fbe8fb5fTed Kremenek//===----------------------------------------------------------------------===// 18214beaa9f51b2da57c64740cef2bd1c2fdb0c325d5Ted Kremenek// Transfer function: Objective-C @synchronized. 18224beaa9f51b2da57c64740cef2bd1c2fdb0c325d5Ted Kremenek//===----------------------------------------------------------------------===// 18234beaa9f51b2da57c64740cef2bd1c2fdb0c325d5Ted Kremenek 1824d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidisvoid ExprEngine::VisitObjCAtSynchronizedStmt(const ObjCAtSynchronizedStmt *S, 1825994b8d374adb56c3897a43e4e97118b4111ecfc7Ted Kremenek ExplodedNode *Pred, 1826994b8d374adb56c3897a43e4e97118b4111ecfc7Ted Kremenek ExplodedNodeSet &Dst) { 1827994b8d374adb56c3897a43e4e97118b4111ecfc7Ted Kremenek getCheckerManager().runCheckersForPreStmt(Dst, Pred, S, *this); 18284beaa9f51b2da57c64740cef2bd1c2fdb0c325d5Ted Kremenek} 18294beaa9f51b2da57c64740cef2bd1c2fdb0c325d5Ted Kremenek 18304beaa9f51b2da57c64740cef2bd1c2fdb0c325d5Ted Kremenek//===----------------------------------------------------------------------===// 183148af2a9c1ed3259512f2d1431720add1fbe8fb5fTed Kremenek// Transfer function: Objective-C ivar references. 183248af2a9c1ed3259512f2d1431720add1fbe8fb5fTed Kremenek//===----------------------------------------------------------------------===// 183397ed4f68f5dba3e21e7a490ef0f9ffd3bfead7f8Ted Kremenek 18349c378f705405d37f49795d5e915989de774fe11fTed Kremenekvoid ExprEngine::VisitLvalObjCIvarRefExpr(const ObjCIvarRefExpr *Ex, 18359c378f705405d37f49795d5e915989de774fe11fTed Kremenek ExplodedNode *Pred, 18369c378f705405d37f49795d5e915989de774fe11fTed Kremenek ExplodedNodeSet &Dst) { 18371eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 183818c66fdc3c4008d335885695fe36fb5353c5f672Ted Kremenek const ProgramState *state = Pred->getState(); 1839871f686b477b0ff225a7f53bb3350a54f35269baTed Kremenek SVal baseVal = state->getSVal(Ex->getBase()); 1840871f686b477b0ff225a7f53bb3350a54f35269baTed Kremenek SVal location = state->getLValue(Ex->getDecl(), baseVal); 18411eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 18426547884b9c20096594bdc652669df82c322c5eb6Argyrios Kyrtzidis ExplodedNodeSet dstIvar; 1843871f686b477b0ff225a7f53bb3350a54f35269baTed Kremenek MakeNode(dstIvar, Ex, Pred, state->BindExpr(Ex, location)); 18446547884b9c20096594bdc652669df82c322c5eb6Argyrios Kyrtzidis 18456547884b9c20096594bdc652669df82c322c5eb6Argyrios Kyrtzidis // Perform the post-condition check of the ObjCIvarRefExpr and store 18466547884b9c20096594bdc652669df82c322c5eb6Argyrios Kyrtzidis // the created nodes in 'Dst'. 1847eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis getCheckerManager().runCheckersForPostStmt(Dst, dstIvar, Ex, *this); 184897ed4f68f5dba3e21e7a490ef0f9ffd3bfead7f8Ted Kremenek} 184997ed4f68f5dba3e21e7a490ef0f9ffd3bfead7f8Ted Kremenek 185097ed4f68f5dba3e21e7a490ef0f9ffd3bfead7f8Ted Kremenek//===----------------------------------------------------------------------===// 1851af3374187c47acea45706eab6744be6b1c66a856Ted Kremenek// Transfer function: Objective-C fast enumeration 'for' statements. 1852af3374187c47acea45706eab6744be6b1c66a856Ted Kremenek//===----------------------------------------------------------------------===// 1853af3374187c47acea45706eab6744be6b1c66a856Ted Kremenek 18549c378f705405d37f49795d5e915989de774fe11fTed Kremenekvoid ExprEngine::VisitObjCForCollectionStmt(const ObjCForCollectionStmt *S, 18559c378f705405d37f49795d5e915989de774fe11fTed Kremenek ExplodedNode *Pred, ExplodedNodeSet &Dst) { 18561eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1857af3374187c47acea45706eab6744be6b1c66a856Ted Kremenek // ObjCForCollectionStmts are processed in two places. This method 1858af3374187c47acea45706eab6744be6b1c66a856Ted Kremenek // handles the case where an ObjCForCollectionStmt* occurs as one of the 1859af3374187c47acea45706eab6744be6b1c66a856Ted Kremenek // statements within a basic block. This transfer function does two things: 1860af3374187c47acea45706eab6744be6b1c66a856Ted Kremenek // 1861af3374187c47acea45706eab6744be6b1c66a856Ted Kremenek // (1) binds the next container value to 'element'. This creates a new 1862af3374187c47acea45706eab6744be6b1c66a856Ted Kremenek // node in the ExplodedGraph. 1863af3374187c47acea45706eab6744be6b1c66a856Ted Kremenek // 1864af3374187c47acea45706eab6744be6b1c66a856Ted Kremenek // (2) binds the value 0/1 to the ObjCForCollectionStmt* itself, indicating 1865af3374187c47acea45706eab6744be6b1c66a856Ted Kremenek // whether or not the container has any more elements. This value 1866af3374187c47acea45706eab6744be6b1c66a856Ted Kremenek // will be tested in ProcessBranch. We need to explicitly bind 1867af3374187c47acea45706eab6744be6b1c66a856Ted Kremenek // this value because a container can contain nil elements. 18681eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump // 1869af3374187c47acea45706eab6744be6b1c66a856Ted Kremenek // FIXME: Eventually this logic should actually do dispatches to 1870af3374187c47acea45706eab6744be6b1c66a856Ted Kremenek // 'countByEnumeratingWithState:objects:count:' (NSFastEnumeration). 1871af3374187c47acea45706eab6744be6b1c66a856Ted Kremenek // This will require simulating a temporary NSFastEnumerationState, either 1872af3374187c47acea45706eab6744be6b1c66a856Ted Kremenek // through an SVal or through the use of MemRegions. This value can 1873af3374187c47acea45706eab6744be6b1c66a856Ted Kremenek // be affixed to the ObjCForCollectionStmt* instead of 0/1; when the loop 1874af3374187c47acea45706eab6744be6b1c66a856Ted Kremenek // terminates we reclaim the temporary (it goes out of scope) and we 1875af3374187c47acea45706eab6744be6b1c66a856Ted Kremenek // we can test if the SVal is 0 or if the MemRegion is null (depending 1876af3374187c47acea45706eab6744be6b1c66a856Ted Kremenek // on what approach we take). 1877af3374187c47acea45706eab6744be6b1c66a856Ted Kremenek // 1878af3374187c47acea45706eab6744be6b1c66a856Ted Kremenek // For now: simulate (1) by assigning either a symbol or nil if the 1879af3374187c47acea45706eab6744be6b1c66a856Ted Kremenek // container is empty. Thus this transfer function will by default 1880af3374187c47acea45706eab6744be6b1c66a856Ted Kremenek // result in state splitting. 18811eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 18829c378f705405d37f49795d5e915989de774fe11fTed Kremenek const Stmt *elem = S->getElement(); 188318c66fdc3c4008d335885695fe36fb5353c5f672Ted Kremenek const ProgramState *state = Pred->getState(); 188470a34da7a767bda69958d8f659de9f87b03de747Ted Kremenek SVal elementV; 18851eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 18869c378f705405d37f49795d5e915989de774fe11fTed Kremenek if (const DeclStmt *DS = dyn_cast<DeclStmt>(elem)) { 18879c378f705405d37f49795d5e915989de774fe11fTed Kremenek const VarDecl *elemD = cast<VarDecl>(DS->getSingleDecl()); 188870a34da7a767bda69958d8f659de9f87b03de747Ted Kremenek assert(elemD->getInit() == 0); 188970a34da7a767bda69958d8f659de9f87b03de747Ted Kremenek elementV = state->getLValue(elemD, Pred->getLocationContext()); 1890af3374187c47acea45706eab6744be6b1c66a856Ted Kremenek } 189170a34da7a767bda69958d8f659de9f87b03de747Ted Kremenek else { 189270a34da7a767bda69958d8f659de9f87b03de747Ted Kremenek elementV = state->getSVal(elem); 189306fb99fb403bff1651429923f666a2ebe2b1522fTed Kremenek } 189470a34da7a767bda69958d8f659de9f87b03de747Ted Kremenek 189570a34da7a767bda69958d8f659de9f87b03de747Ted Kremenek ExplodedNodeSet dstLocation; 189670a34da7a767bda69958d8f659de9f87b03de747Ted Kremenek evalLocation(dstLocation, elem, Pred, state, elementV, NULL, false); 1897b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 189870a34da7a767bda69958d8f659de9f87b03de747Ted Kremenek if (dstLocation.empty()) 189906fb99fb403bff1651429923f666a2ebe2b1522fTed Kremenek return; 190070a34da7a767bda69958d8f659de9f87b03de747Ted Kremenek 190170a34da7a767bda69958d8f659de9f87b03de747Ted Kremenek for (ExplodedNodeSet::iterator NI = dstLocation.begin(), 190270a34da7a767bda69958d8f659de9f87b03de747Ted Kremenek NE = dstLocation.end(); NI!=NE; ++NI) { 1903b4b817d704287836b52b34369009e682f208aa2bTed Kremenek Pred = *NI; 190418c66fdc3c4008d335885695fe36fb5353c5f672Ted Kremenek const ProgramState *state = Pred->getState(); 190570a34da7a767bda69958d8f659de9f87b03de747Ted Kremenek 1906b4b817d704287836b52b34369009e682f208aa2bTed Kremenek // Handle the case where the container still has elements. 1907c8413fd03f73084a5c93028f8b4db619fc388087Ted Kremenek SVal TrueV = svalBuilder.makeTruthVal(1); 190818c66fdc3c4008d335885695fe36fb5353c5f672Ted Kremenek const ProgramState *hasElems = state->BindExpr(S, TrueV); 190970a34da7a767bda69958d8f659de9f87b03de747Ted Kremenek 1910b4b817d704287836b52b34369009e682f208aa2bTed Kremenek // Handle the case where the container has no elements. 1911c8413fd03f73084a5c93028f8b4db619fc388087Ted Kremenek SVal FalseV = svalBuilder.makeTruthVal(0); 191218c66fdc3c4008d335885695fe36fb5353c5f672Ted Kremenek const ProgramState *noElems = state->BindExpr(S, FalseV); 191370a34da7a767bda69958d8f659de9f87b03de747Ted Kremenek 191470a34da7a767bda69958d8f659de9f87b03de747Ted Kremenek if (loc::MemRegionVal *MV = dyn_cast<loc::MemRegionVal>(&elementV)) 19159697934650354bed2e509d8e7e44f21a1fb00f76Ted Kremenek if (const TypedValueRegion *R = 19169697934650354bed2e509d8e7e44f21a1fb00f76Ted Kremenek dyn_cast<TypedValueRegion>(MV->getRegion())) { 1917b4b817d704287836b52b34369009e682f208aa2bTed Kremenek // FIXME: The proper thing to do is to really iterate over the 1918b4b817d704287836b52b34369009e682f208aa2bTed Kremenek // container. We will do this with dispatch logic to the store. 1919b4b817d704287836b52b34369009e682f208aa2bTed Kremenek // For now, just 'conjure' up a symbolic value. 1920018220c343c103b7dfaa117a7a474c7a7fd6d068Zhongxing Xu QualType T = R->getValueType(); 19217dfc9420babe83e236a47e752f8723bd06070d9dZhanyong Wan assert(Loc::isLocType(T)); 1922b4b817d704287836b52b34369009e682f208aa2bTed Kremenek unsigned Count = Builder->getCurrentBlockCount(); 1923b4b817d704287836b52b34369009e682f208aa2bTed Kremenek SymbolRef Sym = SymMgr.getConjuredSymbol(elem, T, Count); 1924c8413fd03f73084a5c93028f8b4db619fc388087Ted Kremenek SVal V = svalBuilder.makeLoc(Sym); 192570a34da7a767bda69958d8f659de9f87b03de747Ted Kremenek hasElems = hasElems->bindLoc(elementV, V); 192670a34da7a767bda69958d8f659de9f87b03de747Ted Kremenek 1927b4b817d704287836b52b34369009e682f208aa2bTed Kremenek // Bind the location to 'nil' on the false branch. 1928c8413fd03f73084a5c93028f8b4db619fc388087Ted Kremenek SVal nilV = svalBuilder.makeIntVal(0, T); 192970a34da7a767bda69958d8f659de9f87b03de747Ted Kremenek noElems = noElems->bindLoc(elementV, nilV); 1930b4b817d704287836b52b34369009e682f208aa2bTed Kremenek } 193170a34da7a767bda69958d8f659de9f87b03de747Ted Kremenek 1932b4b817d704287836b52b34369009e682f208aa2bTed Kremenek // Create the new nodes. 1933b4b817d704287836b52b34369009e682f208aa2bTed Kremenek MakeNode(Dst, S, Pred, hasElems); 1934b4b817d704287836b52b34369009e682f208aa2bTed Kremenek MakeNode(Dst, S, Pred, noElems); 1935b4b817d704287836b52b34369009e682f208aa2bTed Kremenek } 1936af3374187c47acea45706eab6744be6b1c66a856Ted Kremenek} 1937af3374187c47acea45706eab6744be6b1c66a856Ted Kremenek 1938af3374187c47acea45706eab6744be6b1c66a856Ted Kremenek//===----------------------------------------------------------------------===// 1939e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek// Transfer function: Objective-C message expressions. 1940e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek//===----------------------------------------------------------------------===// 1941e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek 19425286e2ddfd8332520de4c076e49991d6fe557adbArgyrios Kyrtzidisvoid ExprEngine::VisitObjCMessage(const ObjCMessage &msg, 19439c378f705405d37f49795d5e915989de774fe11fTed Kremenek ExplodedNode *Pred, ExplodedNodeSet &Dst) { 19445286e2ddfd8332520de4c076e49991d6fe557adbArgyrios Kyrtzidis 19455286e2ddfd8332520de4c076e49991d6fe557adbArgyrios Kyrtzidis // Handle the previsits checks. 19464410a935e8d8ee3c903b858bbf74ca24fce629b5Ted Kremenek ExplodedNodeSet dstPrevisit; 19474410a935e8d8ee3c903b858bbf74ca24fce629b5Ted Kremenek getCheckerManager().runCheckersForPreObjCMessage(dstPrevisit, Pred, 19484410a935e8d8ee3c903b858bbf74ca24fce629b5Ted Kremenek msg, *this); 19491eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1950b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek // Proceed with evaluate the message expression. 19519c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek ExplodedNodeSet dstEval; 19521eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 19534410a935e8d8ee3c903b858bbf74ca24fce629b5Ted Kremenek for (ExplodedNodeSet::iterator DI = dstPrevisit.begin(), 19544410a935e8d8ee3c903b858bbf74ca24fce629b5Ted Kremenek DE = dstPrevisit.end(); DI != DE; ++DI) { 195538ac4f504bf8ed514520b5a82be538bdb0860687Ted Kremenek 19565286e2ddfd8332520de4c076e49991d6fe557adbArgyrios Kyrtzidis ExplodedNode *Pred = *DI; 1957c79d7d49c5ec42e8bb6ac34350ebb5bc24ca663dTed Kremenek bool RaisesException = false; 19589c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek unsigned oldSize = dstEval.size(); 195938ac4f504bf8ed514520b5a82be538bdb0860687Ted Kremenek SaveAndRestore<bool> OldSink(Builder->BuildSinks); 1960b4857264b8d3d861f688cdaa174aab30e0729a73Ted Kremenek SaveOr OldHasGen(Builder->hasGeneratedNode); 19611eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 19625286e2ddfd8332520de4c076e49991d6fe557adbArgyrios Kyrtzidis if (const Expr *Receiver = msg.getInstanceReceiver()) { 196318c66fdc3c4008d335885695fe36fb5353c5f672Ted Kremenek const ProgramState *state = Pred->getState(); 19642b3ca9c420e90f131642d7e7d47af6387dad7e1dArgyrios Kyrtzidis SVal recVal = state->getSVal(Receiver); 19652b3ca9c420e90f131642d7e7d47af6387dad7e1dArgyrios Kyrtzidis if (!recVal.isUndef()) { 19662b3ca9c420e90f131642d7e7d47af6387dad7e1dArgyrios Kyrtzidis // Bifurcate the state into nil and non-nil ones. 19672b3ca9c420e90f131642d7e7d47af6387dad7e1dArgyrios Kyrtzidis DefinedOrUnknownSVal receiverVal = cast<DefinedOrUnknownSVal>(recVal); 19682b3ca9c420e90f131642d7e7d47af6387dad7e1dArgyrios Kyrtzidis 196918c66fdc3c4008d335885695fe36fb5353c5f672Ted Kremenek const ProgramState *notNilState, *nilState; 19702b3ca9c420e90f131642d7e7d47af6387dad7e1dArgyrios Kyrtzidis llvm::tie(notNilState, nilState) = state->assume(receiverVal); 19712b3ca9c420e90f131642d7e7d47af6387dad7e1dArgyrios Kyrtzidis 19722b3ca9c420e90f131642d7e7d47af6387dad7e1dArgyrios Kyrtzidis // There are three cases: can be nil or non-nil, must be nil, must be 1973eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis // non-nil. We ignore must be nil, and merge the rest two into non-nil. 19742b3ca9c420e90f131642d7e7d47af6387dad7e1dArgyrios Kyrtzidis if (nilState && !notNilState) { 1975eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis dstEval.insert(Pred); 19762b3ca9c420e90f131642d7e7d47af6387dad7e1dArgyrios Kyrtzidis continue; 19772b3ca9c420e90f131642d7e7d47af6387dad7e1dArgyrios Kyrtzidis } 19782b3ca9c420e90f131642d7e7d47af6387dad7e1dArgyrios Kyrtzidis 19792b3ca9c420e90f131642d7e7d47af6387dad7e1dArgyrios Kyrtzidis // Check if the "raise" message was sent. 19802b3ca9c420e90f131642d7e7d47af6387dad7e1dArgyrios Kyrtzidis assert(notNilState); 19812b3ca9c420e90f131642d7e7d47af6387dad7e1dArgyrios Kyrtzidis if (msg.getSelector() == RaiseSel) 19822b3ca9c420e90f131642d7e7d47af6387dad7e1dArgyrios Kyrtzidis RaisesException = true; 19832b3ca9c420e90f131642d7e7d47af6387dad7e1dArgyrios Kyrtzidis 19842b3ca9c420e90f131642d7e7d47af6387dad7e1dArgyrios Kyrtzidis // Check if we raise an exception. For now treat these as sinks. 19852b3ca9c420e90f131642d7e7d47af6387dad7e1dArgyrios Kyrtzidis // Eventually we will want to handle exceptions properly. 19862b3ca9c420e90f131642d7e7d47af6387dad7e1dArgyrios Kyrtzidis if (RaisesException) 19872b3ca9c420e90f131642d7e7d47af6387dad7e1dArgyrios Kyrtzidis Builder->BuildSinks = true; 19882b3ca9c420e90f131642d7e7d47af6387dad7e1dArgyrios Kyrtzidis 19892b3ca9c420e90f131642d7e7d47af6387dad7e1dArgyrios Kyrtzidis // Dispatch to plug-in transfer function. 19902b3ca9c420e90f131642d7e7d47af6387dad7e1dArgyrios Kyrtzidis evalObjCMessage(dstEval, msg, Pred, notNilState); 1991a46e4d91d8f3eb341f2387768db66dcfe8dd0afaZhongxing Xu } 199221fe8370f660a30e3a0493c74728dcb369b9c58bTed Kremenek } 19935286e2ddfd8332520de4c076e49991d6fe557adbArgyrios Kyrtzidis else if (const ObjCInterfaceDecl *Iface = msg.getReceiverInterface()) { 199404badcf84c8d504d8491c7c7e29b58f52cb16640Douglas Gregor IdentifierInfo* ClsName = Iface->getIdentifier(); 19955286e2ddfd8332520de4c076e49991d6fe557adbArgyrios Kyrtzidis Selector S = msg.getSelector(); 19961eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1997c79d7d49c5ec42e8bb6ac34350ebb5bc24ca663dTed Kremenek // Check for special instance methods. 1998c79d7d49c5ec42e8bb6ac34350ebb5bc24ca663dTed Kremenek if (!NSExceptionII) { 19999c378f705405d37f49795d5e915989de774fe11fTed Kremenek ASTContext &Ctx = getContext(); 2000c79d7d49c5ec42e8bb6ac34350ebb5bc24ca663dTed Kremenek NSExceptionII = &Ctx.Idents.get("NSException"); 2001c79d7d49c5ec42e8bb6ac34350ebb5bc24ca663dTed Kremenek } 20021eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 2003c79d7d49c5ec42e8bb6ac34350ebb5bc24ca663dTed Kremenek if (ClsName == NSExceptionII) { 2004c79d7d49c5ec42e8bb6ac34350ebb5bc24ca663dTed Kremenek enum { NUM_RAISE_SELECTORS = 2 }; 20051eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 2006c79d7d49c5ec42e8bb6ac34350ebb5bc24ca663dTed Kremenek // Lazily create a cache of the selectors. 2007c79d7d49c5ec42e8bb6ac34350ebb5bc24ca663dTed Kremenek if (!NSExceptionInstanceRaiseSelectors) { 20089c378f705405d37f49795d5e915989de774fe11fTed Kremenek ASTContext &Ctx = getContext(); 2009b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek NSExceptionInstanceRaiseSelectors = 2010b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek new Selector[NUM_RAISE_SELECTORS]; 20115f9e272e632e951b1efe824cd16acb4d96077930Chris Lattner SmallVector<IdentifierInfo*, NUM_RAISE_SELECTORS> II; 2012c79d7d49c5ec42e8bb6ac34350ebb5bc24ca663dTed Kremenek unsigned idx = 0; 20131eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 2014c79d7d49c5ec42e8bb6ac34350ebb5bc24ca663dTed Kremenek // raise:format: 2015c79d7d49c5ec42e8bb6ac34350ebb5bc24ca663dTed Kremenek II.push_back(&Ctx.Idents.get("raise")); 2016c79d7d49c5ec42e8bb6ac34350ebb5bc24ca663dTed Kremenek II.push_back(&Ctx.Idents.get("format")); 2017c79d7d49c5ec42e8bb6ac34350ebb5bc24ca663dTed Kremenek NSExceptionInstanceRaiseSelectors[idx++] = 2018c79d7d49c5ec42e8bb6ac34350ebb5bc24ca663dTed Kremenek Ctx.Selectors.getSelector(II.size(), &II[0]); 20191eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 2020c79d7d49c5ec42e8bb6ac34350ebb5bc24ca663dTed Kremenek // raise:format::arguments: 2021c79d7d49c5ec42e8bb6ac34350ebb5bc24ca663dTed Kremenek II.push_back(&Ctx.Idents.get("arguments")); 2022c79d7d49c5ec42e8bb6ac34350ebb5bc24ca663dTed Kremenek NSExceptionInstanceRaiseSelectors[idx++] = 2023c79d7d49c5ec42e8bb6ac34350ebb5bc24ca663dTed Kremenek Ctx.Selectors.getSelector(II.size(), &II[0]); 2024c79d7d49c5ec42e8bb6ac34350ebb5bc24ca663dTed Kremenek } 20251eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 2026c79d7d49c5ec42e8bb6ac34350ebb5bc24ca663dTed Kremenek for (unsigned i = 0; i < NUM_RAISE_SELECTORS; ++i) 2027c79d7d49c5ec42e8bb6ac34350ebb5bc24ca663dTed Kremenek if (S == NSExceptionInstanceRaiseSelectors[i]) { 202838ac4f504bf8ed514520b5a82be538bdb0860687Ted Kremenek RaisesException = true; 202938ac4f504bf8ed514520b5a82be538bdb0860687Ted Kremenek break; 2030c79d7d49c5ec42e8bb6ac34350ebb5bc24ca663dTed Kremenek } 2031e448ab4f9dd162802f5d7cfea60f7830cc61c654Ted Kremenek } 20321eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 2033a46e4d91d8f3eb341f2387768db66dcfe8dd0afaZhongxing Xu // Check if we raise an exception. For now treat these as sinks. 2034a46e4d91d8f3eb341f2387768db66dcfe8dd0afaZhongxing Xu // Eventually we will want to handle exceptions properly. 2035a46e4d91d8f3eb341f2387768db66dcfe8dd0afaZhongxing Xu if (RaisesException) 2036a46e4d91d8f3eb341f2387768db66dcfe8dd0afaZhongxing Xu Builder->BuildSinks = true; 20371eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 2038a46e4d91d8f3eb341f2387768db66dcfe8dd0afaZhongxing Xu // Dispatch to plug-in transfer function. 20390e89061a399bae32f0eca5b85658ad66a58c504dAnna Zaks evalObjCMessage(dstEval, msg, Pred, Pred->getState()); 2040a46e4d91d8f3eb341f2387768db66dcfe8dd0afaZhongxing Xu } 2041b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 204238ac4f504bf8ed514520b5a82be538bdb0860687Ted Kremenek // Handle the case where no nodes where generated. Auto-generate that 204338ac4f504bf8ed514520b5a82be538bdb0860687Ted Kremenek // contains the updated state if we aren't generating sinks. 20449c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek if (!Builder->BuildSinks && dstEval.size() == oldSize && 2045b4857264b8d3d861f688cdaa174aab30e0729a73Ted Kremenek !Builder->hasGeneratedNode) 2046db5e8cd095d1ffdd18f5620ad2348b5f386bebe3Anna Zaks MakeNode(dstEval, msg.getOriginExpr(), Pred, Pred->getState()); 2047c79d7d49c5ec42e8bb6ac34350ebb5bc24ca663dTed Kremenek } 20481eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 204938ac4f504bf8ed514520b5a82be538bdb0860687Ted Kremenek // Finally, perform the post-condition check of the ObjCMessageExpr and store 205038ac4f504bf8ed514520b5a82be538bdb0860687Ted Kremenek // the created nodes in 'Dst'. 2051eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis getCheckerManager().runCheckersForPostObjCMessage(Dst, dstEval, msg, *this); 2052de43424560f1a744de6214dab6bbee28ad8437f5Ted Kremenek} 2053de43424560f1a744de6214dab6bbee28ad8437f5Ted Kremenek 2054e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek//===----------------------------------------------------------------------===// 2055e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek// Transfer functions: Miscellaneous statements. 2056e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek//===----------------------------------------------------------------------===// 2057e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek 2058d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidisvoid ExprEngine::VisitCast(const CastExpr *CastE, const Expr *Ex, 2059d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidis ExplodedNode *Pred, ExplodedNodeSet &Dst) { 2060892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek 20614e906e889d51e1026964c0224e814ded39e9522fTed Kremenek ExplodedNodeSet dstPreStmt; 20624e906e889d51e1026964c0224e814ded39e9522fTed Kremenek getCheckerManager().runCheckersForPreStmt(dstPreStmt, Pred, CastE, *this); 2063892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek 206414429b918bd2f4cb52abc75546a7fe37142054caArgyrios Kyrtzidis if (CastE->getCastKind() == CK_LValueToRValue || 206514429b918bd2f4cb52abc75546a7fe37142054caArgyrios Kyrtzidis CastE->getCastKind() == CK_GetObjCProperty) { 20664e906e889d51e1026964c0224e814ded39e9522fTed Kremenek for (ExplodedNodeSet::iterator I = dstPreStmt.begin(), E = dstPreStmt.end(); 20674e906e889d51e1026964c0224e814ded39e9522fTed Kremenek I!=E; ++I) { 2068892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek ExplodedNode *subExprNode = *I; 206918c66fdc3c4008d335885695fe36fb5353c5f672Ted Kremenek const ProgramState *state = subExprNode->getState(); 2070892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek evalLoad(Dst, CastE, subExprNode, state, state->getSVal(Ex)); 2071892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek } 2072892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek return; 2073892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek } 2074892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek 2075892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek // All other casts. 20765d3003a9d10cc6da4ef716c350bf53c187774c93Ted Kremenek QualType T = CastE->getType(); 2077933c3e1dca3bb88bf113290ef0ade8f5262a89c0Zhongxing Xu QualType ExTy = Ex->getType(); 2078ed340f7d26b3a8fedeb2aebeb5b23429e79d18e0Zhongxing Xu 2079d3118bd7daed36417c8e8bdb0390495a4c829d86Zhongxing Xu if (const ExplicitCastExpr *ExCast=dyn_cast_or_null<ExplicitCastExpr>(CastE)) 208049badde06e066d058d6c7fcf4e628a72999b65a9Douglas Gregor T = ExCast->getTypeAsWritten(); 2081b79b117d3b76da58b14ef835ccfcf2e988b7345fZhongxing Xu 20824e906e889d51e1026964c0224e814ded39e9522fTed Kremenek for (ExplodedNodeSet::iterator I = dstPreStmt.begin(), E = dstPreStmt.end(); 20834e906e889d51e1026964c0224e814ded39e9522fTed Kremenek I != E; ++I) { 20844e906e889d51e1026964c0224e814ded39e9522fTed Kremenek 208594ae8fd470471134114599ccfc2301da05719212Ted Kremenek Pred = *I; 20864fd56816e0925c04f2c92e75399f5c9018d5d6fbZhongxing Xu 208794ae8fd470471134114599ccfc2301da05719212Ted Kremenek switch (CastE->getCastKind()) { 2088f85e193739c953358c865005855253af4f68a497John McCall case CK_LValueToRValue: 2089f85e193739c953358c865005855253af4f68a497John McCall assert(false && "LValueToRValue casts handled earlier."); 2090f85e193739c953358c865005855253af4f68a497John McCall case CK_GetObjCProperty: 2091f85e193739c953358c865005855253af4f68a497John McCall assert(false && "GetObjCProperty casts handled earlier."); 209294ae8fd470471134114599ccfc2301da05719212Ted Kremenek case CK_ToVoid: 209394ae8fd470471134114599ccfc2301da05719212Ted Kremenek Dst.Add(Pred); 209494ae8fd470471134114599ccfc2301da05719212Ted Kremenek continue; 2095f85e193739c953358c865005855253af4f68a497John McCall // The analyzer doesn't do anything special with these casts, 2096f85e193739c953358c865005855253af4f68a497John McCall // since it understands retain/release semantics already. 2097f85e193739c953358c865005855253af4f68a497John McCall case CK_ObjCProduceObject: 20987e5e5f4cc36fe50f46ad76dca7a266434c94f475John McCall case CK_ObjCConsumeObject: 20997e5e5f4cc36fe50f46ad76dca7a266434c94f475John McCall case CK_ObjCReclaimReturnedObject: // Fall-through. 2100f85e193739c953358c865005855253af4f68a497John McCall // True no-ops. 210194ae8fd470471134114599ccfc2301da05719212Ted Kremenek case CK_NoOp: 210294ae8fd470471134114599ccfc2301da05719212Ted Kremenek case CK_FunctionToPointerDecay: { 210394ae8fd470471134114599ccfc2301da05719212Ted Kremenek // Copy the SVal of Ex to CastE. 210418c66fdc3c4008d335885695fe36fb5353c5f672Ted Kremenek const ProgramState *state = Pred->getState(); 210594ae8fd470471134114599ccfc2301da05719212Ted Kremenek SVal V = state->getSVal(Ex); 210694ae8fd470471134114599ccfc2301da05719212Ted Kremenek state = state->BindExpr(CastE, V); 210794ae8fd470471134114599ccfc2301da05719212Ted Kremenek MakeNode(Dst, CastE, Pred, state); 210894ae8fd470471134114599ccfc2301da05719212Ted Kremenek continue; 210994ae8fd470471134114599ccfc2301da05719212Ted Kremenek } 211094ae8fd470471134114599ccfc2301da05719212Ted Kremenek case CK_Dependent: 211194ae8fd470471134114599ccfc2301da05719212Ted Kremenek case CK_ArrayToPointerDecay: 211294ae8fd470471134114599ccfc2301da05719212Ted Kremenek case CK_BitCast: 211394ae8fd470471134114599ccfc2301da05719212Ted Kremenek case CK_LValueBitCast: 211494ae8fd470471134114599ccfc2301da05719212Ted Kremenek case CK_IntegralCast: 211594ae8fd470471134114599ccfc2301da05719212Ted Kremenek case CK_NullToPointer: 211694ae8fd470471134114599ccfc2301da05719212Ted Kremenek case CK_IntegralToPointer: 211794ae8fd470471134114599ccfc2301da05719212Ted Kremenek case CK_PointerToIntegral: 211894ae8fd470471134114599ccfc2301da05719212Ted Kremenek case CK_PointerToBoolean: 211994ae8fd470471134114599ccfc2301da05719212Ted Kremenek case CK_IntegralToBoolean: 212094ae8fd470471134114599ccfc2301da05719212Ted Kremenek case CK_IntegralToFloating: 212194ae8fd470471134114599ccfc2301da05719212Ted Kremenek case CK_FloatingToIntegral: 212294ae8fd470471134114599ccfc2301da05719212Ted Kremenek case CK_FloatingToBoolean: 212394ae8fd470471134114599ccfc2301da05719212Ted Kremenek case CK_FloatingCast: 212494ae8fd470471134114599ccfc2301da05719212Ted Kremenek case CK_FloatingRealToComplex: 212594ae8fd470471134114599ccfc2301da05719212Ted Kremenek case CK_FloatingComplexToReal: 212694ae8fd470471134114599ccfc2301da05719212Ted Kremenek case CK_FloatingComplexToBoolean: 212794ae8fd470471134114599ccfc2301da05719212Ted Kremenek case CK_FloatingComplexCast: 212894ae8fd470471134114599ccfc2301da05719212Ted Kremenek case CK_FloatingComplexToIntegralComplex: 212994ae8fd470471134114599ccfc2301da05719212Ted Kremenek case CK_IntegralRealToComplex: 213094ae8fd470471134114599ccfc2301da05719212Ted Kremenek case CK_IntegralComplexToReal: 213194ae8fd470471134114599ccfc2301da05719212Ted Kremenek case CK_IntegralComplexToBoolean: 213294ae8fd470471134114599ccfc2301da05719212Ted Kremenek case CK_IntegralComplexCast: 213394ae8fd470471134114599ccfc2301da05719212Ted Kremenek case CK_IntegralComplexToFloatingComplex: 213494ae8fd470471134114599ccfc2301da05719212Ted Kremenek case CK_AnyPointerToObjCPointerCast: 213594ae8fd470471134114599ccfc2301da05719212Ted Kremenek case CK_AnyPointerToBlockPointerCast: 213694ae8fd470471134114599ccfc2301da05719212Ted Kremenek case CK_ObjCObjectLValueCast: { 213794ae8fd470471134114599ccfc2301da05719212Ted Kremenek // Delegate to SValBuilder to process. 213818c66fdc3c4008d335885695fe36fb5353c5f672Ted Kremenek const ProgramState *state = Pred->getState(); 213994ae8fd470471134114599ccfc2301da05719212Ted Kremenek SVal V = state->getSVal(Ex); 214094ae8fd470471134114599ccfc2301da05719212Ted Kremenek V = svalBuilder.evalCast(V, T, ExTy); 214194ae8fd470471134114599ccfc2301da05719212Ted Kremenek state = state->BindExpr(CastE, V); 214294ae8fd470471134114599ccfc2301da05719212Ted Kremenek MakeNode(Dst, CastE, Pred, state); 214394ae8fd470471134114599ccfc2301da05719212Ted Kremenek continue; 214494ae8fd470471134114599ccfc2301da05719212Ted Kremenek } 214594ae8fd470471134114599ccfc2301da05719212Ted Kremenek case CK_DerivedToBase: 214694ae8fd470471134114599ccfc2301da05719212Ted Kremenek case CK_UncheckedDerivedToBase: { 214794ae8fd470471134114599ccfc2301da05719212Ted Kremenek // For DerivedToBase cast, delegate to the store manager. 214818c66fdc3c4008d335885695fe36fb5353c5f672Ted Kremenek const ProgramState *state = Pred->getState(); 214994ae8fd470471134114599ccfc2301da05719212Ted Kremenek SVal val = state->getSVal(Ex); 215094ae8fd470471134114599ccfc2301da05719212Ted Kremenek val = getStoreManager().evalDerivedToBase(val, T); 215194ae8fd470471134114599ccfc2301da05719212Ted Kremenek state = state->BindExpr(CastE, val); 215294ae8fd470471134114599ccfc2301da05719212Ted Kremenek MakeNode(Dst, CastE, Pred, state); 215394ae8fd470471134114599ccfc2301da05719212Ted Kremenek continue; 215494ae8fd470471134114599ccfc2301da05719212Ted Kremenek } 215594ae8fd470471134114599ccfc2301da05719212Ted Kremenek // Various C++ casts that are not handled yet. 21561de4d4e8cb2e9c88809fea8092bc6e835a5473d2John McCall case CK_Dynamic: 215794ae8fd470471134114599ccfc2301da05719212Ted Kremenek case CK_ToUnion: 215894ae8fd470471134114599ccfc2301da05719212Ted Kremenek case CK_BaseToDerived: 215994ae8fd470471134114599ccfc2301da05719212Ted Kremenek case CK_NullToMemberPointer: 216094ae8fd470471134114599ccfc2301da05719212Ted Kremenek case CK_BaseToDerivedMemberPointer: 216194ae8fd470471134114599ccfc2301da05719212Ted Kremenek case CK_DerivedToBaseMemberPointer: 216294ae8fd470471134114599ccfc2301da05719212Ted Kremenek case CK_UserDefinedConversion: 216394ae8fd470471134114599ccfc2301da05719212Ted Kremenek case CK_ConstructorConversion: 216494ae8fd470471134114599ccfc2301da05719212Ted Kremenek case CK_VectorSplat: 216594ae8fd470471134114599ccfc2301da05719212Ted Kremenek case CK_MemberPointerToBoolean: { 216694ae8fd470471134114599ccfc2301da05719212Ted Kremenek // Recover some path-sensitivty by conjuring a new value. 216794ae8fd470471134114599ccfc2301da05719212Ted Kremenek QualType resultType = CastE->getType(); 216894ae8fd470471134114599ccfc2301da05719212Ted Kremenek if (CastE->isLValue()) 216994ae8fd470471134114599ccfc2301da05719212Ted Kremenek resultType = getContext().getPointerType(resultType); 217094ae8fd470471134114599ccfc2301da05719212Ted Kremenek 217194ae8fd470471134114599ccfc2301da05719212Ted Kremenek SVal result = 217294ae8fd470471134114599ccfc2301da05719212Ted Kremenek svalBuilder.getConjuredSymbolVal(NULL, CastE, resultType, 217394ae8fd470471134114599ccfc2301da05719212Ted Kremenek Builder->getCurrentBlockCount()); 217494ae8fd470471134114599ccfc2301da05719212Ted Kremenek 217518c66fdc3c4008d335885695fe36fb5353c5f672Ted Kremenek const ProgramState *state = Pred->getState()->BindExpr(CastE, result); 217694ae8fd470471134114599ccfc2301da05719212Ted Kremenek MakeNode(Dst, CastE, Pred, state); 217794ae8fd470471134114599ccfc2301da05719212Ted Kremenek continue; 217894ae8fd470471134114599ccfc2301da05719212Ted Kremenek } 21794fd56816e0925c04f2c92e75399f5c9018d5d6fbZhongxing Xu } 2180874d63fc63387365a21775a14c01963b10fde689Ted Kremenek } 21819de04c4415bd31c0c0e888e9ad5673f6c972e12eTed Kremenek} 21829de04c4415bd31c0c0e888e9ad5673f6c972e12eTed Kremenek 21839c378f705405d37f49795d5e915989de774fe11fTed Kremenekvoid ExprEngine::VisitCompoundLiteralExpr(const CompoundLiteralExpr *CL, 21849c378f705405d37f49795d5e915989de774fe11fTed Kremenek ExplodedNode *Pred, 21859c378f705405d37f49795d5e915989de774fe11fTed Kremenek ExplodedNodeSet &Dst) { 21869c378f705405d37f49795d5e915989de774fe11fTed Kremenek const InitListExpr *ILE 218703509aea098772644bf4662dc1c88634818ceeccZhongxing Xu = cast<InitListExpr>(CL->getInitializer()->IgnoreParens()); 218871f20db43bfcb6e7a377982e20615f5f62789cc2Ted Kremenek 218918c66fdc3c4008d335885695fe36fb5353c5f672Ted Kremenek const ProgramState *state = Pred->getState(); 219071f20db43bfcb6e7a377982e20615f5f62789cc2Ted Kremenek SVal ILV = state->getSVal(ILE); 21911eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 219271f20db43bfcb6e7a377982e20615f5f62789cc2Ted Kremenek const LocationContext *LC = Pred->getLocationContext(); 219371f20db43bfcb6e7a377982e20615f5f62789cc2Ted Kremenek state = state->bindCompoundLiteral(CL, LC, ILV); 21944f09027385466f1f4c382c80ca77157e2aef97d9Ted Kremenek 219571f20db43bfcb6e7a377982e20615f5f62789cc2Ted Kremenek if (CL->isLValue()) { 219671f20db43bfcb6e7a377982e20615f5f62789cc2Ted Kremenek MakeNode(Dst, CL, Pred, state->BindExpr(CL, state->getLValue(CL, LC))); 21974f09027385466f1f4c382c80ca77157e2aef97d9Ted Kremenek } 219871f20db43bfcb6e7a377982e20615f5f62789cc2Ted Kremenek else 219971f20db43bfcb6e7a377982e20615f5f62789cc2Ted Kremenek MakeNode(Dst, CL, Pred, state->BindExpr(CL, ILV)); 22004f09027385466f1f4c382c80ca77157e2aef97d9Ted Kremenek} 22014f09027385466f1f4c382c80ca77157e2aef97d9Ted Kremenek 2202d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidisvoid ExprEngine::VisitDeclStmt(const DeclStmt *DS, ExplodedNode *Pred, 22039c378f705405d37f49795d5e915989de774fe11fTed Kremenek ExplodedNodeSet &Dst) { 22045b7dcce86c79370f16fd89ecebd454a3b4eec73cTed Kremenek 22056075f01f557ea9f0f59a8040a666e78df9bbb3dfTed Kremenek // FIXME: static variables may have an initializer, but the second 22066075f01f557ea9f0f59a8040a666e78df9bbb3dfTed Kremenek // time a function is called those values may not be current. 22076075f01f557ea9f0f59a8040a666e78df9bbb3dfTed Kremenek // This may need to be reflected in the CFG. 22086075f01f557ea9f0f59a8040a666e78df9bbb3dfTed Kremenek 22096075f01f557ea9f0f59a8040a666e78df9bbb3dfTed Kremenek // Assumption: The CFG has one DeclStmt per Decl. 22109c378f705405d37f49795d5e915989de774fe11fTed Kremenek const Decl *D = *DS->decl_begin(); 22111eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 2212e6c62e3d43728b0a4477fffd543723dd2170af1aTed Kremenek if (!D || !isa<VarDecl>(D)) 22135b7dcce86c79370f16fd89ecebd454a3b4eec73cTed Kremenek return; 22141eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 22155b7dcce86c79370f16fd89ecebd454a3b4eec73cTed Kremenek 22166075f01f557ea9f0f59a8040a666e78df9bbb3dfTed Kremenek ExplodedNodeSet dstPreVisit; 22176075f01f557ea9f0f59a8040a666e78df9bbb3dfTed Kremenek getCheckerManager().runCheckersForPreStmt(dstPreVisit, Pred, DS, *this); 22181eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 22196075f01f557ea9f0f59a8040a666e78df9bbb3dfTed Kremenek const VarDecl *VD = dyn_cast<VarDecl>(D); 2220b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 22216075f01f557ea9f0f59a8040a666e78df9bbb3dfTed Kremenek for (ExplodedNodeSet::iterator I = dstPreVisit.begin(), E = dstPreVisit.end(); 22226075f01f557ea9f0f59a8040a666e78df9bbb3dfTed Kremenek I!=E; ++I) 22236075f01f557ea9f0f59a8040a666e78df9bbb3dfTed Kremenek { 22245206f0b913d1a11744c9436c83b24f8daa21152cZhongxing Xu ExplodedNode *N = *I; 222518c66fdc3c4008d335885695fe36fb5353c5f672Ted Kremenek const ProgramState *state = N->getState(); 22261eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 22275b8d9019e317e3e0abc4ad1d89066908413339aaTed Kremenek // Decls without InitExpr are not initialized explicitly. 22285206f0b913d1a11744c9436c83b24f8daa21152cZhongxing Xu const LocationContext *LC = N->getLocationContext(); 2229d17da2b99f323fa91b01e1dd119cc32e0ee8197dTed Kremenek 22306075f01f557ea9f0f59a8040a666e78df9bbb3dfTed Kremenek if (const Expr *InitEx = VD->getInit()) { 22311397663af9dbcc24dbf0e11de43931b3dc08fdbbTed Kremenek SVal InitVal = state->getSVal(InitEx); 22321eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 223305e539175d9bac678fca8e77665e88b685729850Zhongxing Xu // We bound the temp obj region to the CXXConstructExpr. Now recover 223405e539175d9bac678fca8e77665e88b685729850Zhongxing Xu // the lazy compound value when the variable is not a reference. 223505e539175d9bac678fca8e77665e88b685729850Zhongxing Xu if (AMgr.getLangOptions().CPlusPlus && VD->getType()->isRecordType() && 223605e539175d9bac678fca8e77665e88b685729850Zhongxing Xu !VD->getType()->isReferenceType() && isa<loc::MemRegionVal>(InitVal)){ 223705e539175d9bac678fca8e77665e88b685729850Zhongxing Xu InitVal = state->getSVal(cast<loc::MemRegionVal>(InitVal).getRegion()); 223805e539175d9bac678fca8e77665e88b685729850Zhongxing Xu assert(isa<nonloc::LazyCompoundVal>(InitVal)); 223905e539175d9bac678fca8e77665e88b685729850Zhongxing Xu } 224005e539175d9bac678fca8e77665e88b685729850Zhongxing Xu 22415b8d9019e317e3e0abc4ad1d89066908413339aaTed Kremenek // Recover some path-sensitivity if a scalar value evaluated to 22425b8d9019e317e3e0abc4ad1d89066908413339aaTed Kremenek // UnknownVal. 2243a804a68f5a1ad739eb17ff2fd942d12abbc30b08Ted Kremenek if ((InitVal.isUnknown() || 2244a804a68f5a1ad739eb17ff2fd942d12abbc30b08Ted Kremenek !getConstraintManager().canReasonAbout(InitVal)) && 2245a804a68f5a1ad739eb17ff2fd942d12abbc30b08Ted Kremenek !VD->getType()->isReferenceType()) { 2246c8413fd03f73084a5c93028f8b4db619fc388087Ted Kremenek InitVal = svalBuilder.getConjuredSymbolVal(NULL, InitEx, 22475206f0b913d1a11744c9436c83b24f8daa21152cZhongxing Xu Builder->getCurrentBlockCount()); 22481eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump } 2249b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 22506075f01f557ea9f0f59a8040a666e78df9bbb3dfTed Kremenek evalBind(Dst, DS, N, state, 2251b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek loc::MemRegionVal(state->getRegion(VD, LC)), InitVal, true); 22521eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump } 22535b8d9019e317e3e0abc4ad1d89066908413339aaTed Kremenek else { 22546075f01f557ea9f0f59a8040a666e78df9bbb3dfTed Kremenek MakeNode(Dst, DS, N, state->bindDeclWithNoInit(state->getRegion(VD, LC))); 22555b8d9019e317e3e0abc4ad1d89066908413339aaTed Kremenek } 22565b7dcce86c79370f16fd89ecebd454a3b4eec73cTed Kremenek } 22575b7dcce86c79370f16fd89ecebd454a3b4eec73cTed Kremenek} 2258f233d48cfc513b045e2c2cfca5c175220fbd0a82Ted Kremenek 2259ff8e758c30b86628a6cdaa6f1b089fefbbdba40cTed Kremenekvoid ExprEngine::VisitInitListExpr(const InitListExpr *IE, ExplodedNode *Pred, 22609c378f705405d37f49795d5e915989de774fe11fTed Kremenek ExplodedNodeSet &Dst) { 2261c4f8706b6539e06a5de153bd72850bb2e0a71456Zhongxing Xu 226218c66fdc3c4008d335885695fe36fb5353c5f672Ted Kremenek const ProgramState *state = Pred->getState(); 2263ff8e758c30b86628a6cdaa6f1b089fefbbdba40cTed Kremenek QualType T = getContext().getCanonicalType(IE->getType()); 2264ff8e758c30b86628a6cdaa6f1b089fefbbdba40cTed Kremenek unsigned NumInitElements = IE->getNumInits(); 2265c4f8706b6539e06a5de153bd72850bb2e0a71456Zhongxing Xu 2266fb87b89fc9eb103e19fb8e4b925c23f0bd091b99Douglas Gregor if (T->isArrayType() || T->isRecordType() || T->isVectorType()) { 2267ff8e758c30b86628a6cdaa6f1b089fefbbdba40cTed Kremenek llvm::ImmutableList<SVal> vals = getBasicVals().getEmptySValList(); 22681eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 2269a49e3674e44104e34342d2c35ece7cb4f9bd96cbTed Kremenek // Handle base case where the initializer has no elements. 2270a49e3674e44104e34342d2c35ece7cb4f9bd96cbTed Kremenek // e.g: static int* myArray[] = {}; 2271a49e3674e44104e34342d2c35ece7cb4f9bd96cbTed Kremenek if (NumInitElements == 0) { 2272ff8e758c30b86628a6cdaa6f1b089fefbbdba40cTed Kremenek SVal V = svalBuilder.makeCompoundVal(T, vals); 2273ff8e758c30b86628a6cdaa6f1b089fefbbdba40cTed Kremenek MakeNode(Dst, IE, Pred, state->BindExpr(IE, V)); 2274a49e3674e44104e34342d2c35ece7cb4f9bd96cbTed Kremenek return; 22751eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump } 22761eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 2277ff8e758c30b86628a6cdaa6f1b089fefbbdba40cTed Kremenek for (InitListExpr::const_reverse_iterator it = IE->rbegin(), 2278ff8e758c30b86628a6cdaa6f1b089fefbbdba40cTed Kremenek ei = IE->rend(); it != ei; ++it) { 2279ff8e758c30b86628a6cdaa6f1b089fefbbdba40cTed Kremenek vals = getBasicVals().consVals(state->getSVal(cast<Expr>(*it)), vals); 2280f75b186893b3461610668dbb627d6f95abead973Ted Kremenek } 22811eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 2282ff8e758c30b86628a6cdaa6f1b089fefbbdba40cTed Kremenek MakeNode(Dst, IE, Pred, 2283ff8e758c30b86628a6cdaa6f1b089fefbbdba40cTed Kremenek state->BindExpr(IE, svalBuilder.makeCompoundVal(T, vals))); 22848790307d116eef2c23d665ca75d1e44db232117cTed Kremenek return; 2285c4f8706b6539e06a5de153bd72850bb2e0a71456Zhongxing Xu } 2286c4f8706b6539e06a5de153bd72850bb2e0a71456Zhongxing Xu 22877dfc9420babe83e236a47e752f8723bd06070d9dZhanyong Wan if (Loc::isLocType(T) || T->isIntegerType()) { 2288ff8e758c30b86628a6cdaa6f1b089fefbbdba40cTed Kremenek assert(IE->getNumInits() == 1); 2289ff8e758c30b86628a6cdaa6f1b089fefbbdba40cTed Kremenek const Expr *initEx = IE->getInit(0); 2290ff8e758c30b86628a6cdaa6f1b089fefbbdba40cTed Kremenek MakeNode(Dst, IE, Pred, state->BindExpr(IE, state->getSVal(initEx))); 2291c4f8706b6539e06a5de153bd72850bb2e0a71456Zhongxing Xu return; 2292c4f8706b6539e06a5de153bd72850bb2e0a71456Zhongxing Xu } 2293c4f8706b6539e06a5de153bd72850bb2e0a71456Zhongxing Xu 2294ff8e758c30b86628a6cdaa6f1b089fefbbdba40cTed Kremenek llvm_unreachable("unprocessed InitListExpr type"); 2295c4f8706b6539e06a5de153bd72850bb2e0a71456Zhongxing Xu} 2296f233d48cfc513b045e2c2cfca5c175220fbd0a82Ted Kremenek 2297f4e3cfbe8abd124be6341ef5d714819b4fbd9082Peter Collingbourne/// VisitUnaryExprOrTypeTraitExpr - Transfer function for sizeof(type). 2298f4e3cfbe8abd124be6341ef5d714819b4fbd9082Peter Collingbournevoid ExprEngine::VisitUnaryExprOrTypeTraitExpr( 22999c378f705405d37f49795d5e915989de774fe11fTed Kremenek const UnaryExprOrTypeTraitExpr *Ex, 23009c378f705405d37f49795d5e915989de774fe11fTed Kremenek ExplodedNode *Pred, 23019c378f705405d37f49795d5e915989de774fe11fTed Kremenek ExplodedNodeSet &Dst) { 23020518999d3adcc289997bd974dce90cc97f5c1c44Sebastian Redl QualType T = Ex->getTypeOfArgument(); 23031eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 2304f4e3cfbe8abd124be6341ef5d714819b4fbd9082Peter Collingbourne if (Ex->getKind() == UETT_SizeOf) { 2305f4e3cfbe8abd124be6341ef5d714819b4fbd9082Peter Collingbourne if (!T->isIncompleteType() && !T->isConstantSizeType()) { 2306b7e3aabf8f0fe4210d6a0aaec8a2b5770cab9186Jordy Rose assert(T->isVariableArrayType() && "Unknown non-constant-sized type."); 2307b7e3aabf8f0fe4210d6a0aaec8a2b5770cab9186Jordy Rose 2308b7e3aabf8f0fe4210d6a0aaec8a2b5770cab9186Jordy Rose // FIXME: Add support for VLA type arguments, not just VLA expressions. 2309b7e3aabf8f0fe4210d6a0aaec8a2b5770cab9186Jordy Rose // When that happens, we should probably refactor VLASizeChecker's code. 2310b7e3aabf8f0fe4210d6a0aaec8a2b5770cab9186Jordy Rose if (Ex->isArgumentType()) { 2311b7e3aabf8f0fe4210d6a0aaec8a2b5770cab9186Jordy Rose Dst.Add(Pred); 2312b7e3aabf8f0fe4210d6a0aaec8a2b5770cab9186Jordy Rose return; 2313b7e3aabf8f0fe4210d6a0aaec8a2b5770cab9186Jordy Rose } 2314b7e3aabf8f0fe4210d6a0aaec8a2b5770cab9186Jordy Rose 2315b7e3aabf8f0fe4210d6a0aaec8a2b5770cab9186Jordy Rose // Get the size by getting the extent of the sub-expression. 2316b7e3aabf8f0fe4210d6a0aaec8a2b5770cab9186Jordy Rose // First, visit the sub-expression to find its region. 231703509aea098772644bf4662dc1c88634818ceeccZhongxing Xu const Expr *Arg = Ex->getArgumentExpr(); 231818c66fdc3c4008d335885695fe36fb5353c5f672Ted Kremenek const ProgramState *state = Pred->getState(); 2319f91a5b008d1a63630ae483247204c2651e512fa1Ted Kremenek const MemRegion *MR = state->getSVal(Arg).getAsRegion(); 2320b7e3aabf8f0fe4210d6a0aaec8a2b5770cab9186Jordy Rose 2321f91a5b008d1a63630ae483247204c2651e512fa1Ted Kremenek // If the subexpression can't be resolved to a region, we don't know 2322f91a5b008d1a63630ae483247204c2651e512fa1Ted Kremenek // anything about its size. Just leave the state as is and continue. 2323f91a5b008d1a63630ae483247204c2651e512fa1Ted Kremenek if (!MR) { 2324f91a5b008d1a63630ae483247204c2651e512fa1Ted Kremenek Dst.Add(Pred); 2325f91a5b008d1a63630ae483247204c2651e512fa1Ted Kremenek return; 2326b7e3aabf8f0fe4210d6a0aaec8a2b5770cab9186Jordy Rose } 2327b7e3aabf8f0fe4210d6a0aaec8a2b5770cab9186Jordy Rose 2328f91a5b008d1a63630ae483247204c2651e512fa1Ted Kremenek // The result is the extent of the VLA. 2329f91a5b008d1a63630ae483247204c2651e512fa1Ted Kremenek SVal Extent = cast<SubRegion>(MR)->getExtent(svalBuilder); 2330f91a5b008d1a63630ae483247204c2651e512fa1Ted Kremenek MakeNode(Dst, Ex, Pred, state->BindExpr(Ex, Extent)); 2331f91a5b008d1a63630ae483247204c2651e512fa1Ted Kremenek 233287e8034faf994b1e13143e6e0b5062a38d979d21Ted Kremenek return; 233355f7bcbda37964d3c0e8928d0e50a6e1692b7dceTed Kremenek } 2334c12c5bba6ceb6acd4e51e7a0fc03257da9cfd44eJohn McCall else if (T->getAs<ObjCObjectType>()) { 2335c12c5bba6ceb6acd4e51e7a0fc03257da9cfd44eJohn McCall // Some code tries to take the sizeof an ObjCObjectType, relying that 233655f7bcbda37964d3c0e8928d0e50a6e1692b7dceTed Kremenek // the compiler has laid out its representation. Just report Unknown 23371eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump // for these. 233861e8e1b84292e882553a47edec830a79606c78f4Ted Kremenek Dst.Add(Pred); 2339f342d1887c9b2ef24d029c0546d536e2277b9976Ted Kremenek return; 234055f7bcbda37964d3c0e8928d0e50a6e1692b7dceTed Kremenek } 234187e8034faf994b1e13143e6e0b5062a38d979d21Ted Kremenek } 2342f4e3cfbe8abd124be6341ef5d714819b4fbd9082Peter Collingbourne 2343f4e3cfbe8abd124be6341ef5d714819b4fbd9082Peter Collingbourne Expr::EvalResult Result; 2344f4e3cfbe8abd124be6341ef5d714819b4fbd9082Peter Collingbourne Ex->Evaluate(Result, getContext()); 2345f4e3cfbe8abd124be6341ef5d714819b4fbd9082Peter Collingbourne CharUnits amt = CharUnits::fromQuantity(Result.Val.getInt().getZExtValue()); 23461eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 23470e561a3e6755c4f248a8bb05d49071ddf4f2ef7bTed Kremenek MakeNode(Dst, Ex, Pred, 2348db5e8cd095d1ffdd18f5620ad2348b5f386bebe3Anna Zaks Pred->getState()->BindExpr(Ex, 2349c8413fd03f73084a5c93028f8b4db619fc388087Ted Kremenek svalBuilder.makeIntVal(amt.getQuantity(), Ex->getType()))); 2350469ecbded3616416ef938ed94a67f86149faf226Ted Kremenek} 2351469ecbded3616416ef938ed94a67f86149faf226Ted Kremenek 23529c378f705405d37f49795d5e915989de774fe11fTed Kremenekvoid ExprEngine::VisitOffsetOfExpr(const OffsetOfExpr *OOE, 23539c378f705405d37f49795d5e915989de774fe11fTed Kremenek ExplodedNode *Pred, ExplodedNodeSet &Dst) { 23548ecdb65716cd7914ffb2eeee993fa9039fcd31e8Douglas Gregor Expr::EvalResult Res; 23558ecdb65716cd7914ffb2eeee993fa9039fcd31e8Douglas Gregor if (OOE->Evaluate(Res, getContext()) && Res.Val.isInt()) { 23568ecdb65716cd7914ffb2eeee993fa9039fcd31e8Douglas Gregor const APSInt &IV = Res.Val.getInt(); 23578ecdb65716cd7914ffb2eeee993fa9039fcd31e8Douglas Gregor assert(IV.getBitWidth() == getContext().getTypeSize(OOE->getType())); 23588ecdb65716cd7914ffb2eeee993fa9039fcd31e8Douglas Gregor assert(OOE->getType()->isIntegerType()); 2359575a1c9dc8dc5b4977194993e289f9eda7295c39Douglas Gregor assert(IV.isSigned() == OOE->getType()->isSignedIntegerOrEnumerationType()); 2360c8413fd03f73084a5c93028f8b4db619fc388087Ted Kremenek SVal X = svalBuilder.makeIntVal(IV); 2361db5e8cd095d1ffdd18f5620ad2348b5f386bebe3Anna Zaks MakeNode(Dst, OOE, Pred, Pred->getState()->BindExpr(OOE, X)); 23628ecdb65716cd7914ffb2eeee993fa9039fcd31e8Douglas Gregor return; 23638ecdb65716cd7914ffb2eeee993fa9039fcd31e8Douglas Gregor } 23648ecdb65716cd7914ffb2eeee993fa9039fcd31e8Douglas Gregor // FIXME: Handle the case where __builtin_offsetof is not a constant. 23658ecdb65716cd7914ffb2eeee993fa9039fcd31e8Douglas Gregor Dst.Add(Pred); 23668ecdb65716cd7914ffb2eeee993fa9039fcd31e8Douglas Gregor} 2367d8e9f0dc737133d4e8342f39389064620f5a7f8fTed Kremenek 2368d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidisvoid ExprEngine::VisitUnaryOperator(const UnaryOperator* U, 23699c378f705405d37f49795d5e915989de774fe11fTed Kremenek ExplodedNode *Pred, 23709c378f705405d37f49795d5e915989de774fe11fTed Kremenek ExplodedNodeSet &Dst) { 23711b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek 2372d8e9f0dc737133d4e8342f39389064620f5a7f8fTed Kremenek switch (U->getOpcode()) { 23731eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 2374d8e9f0dc737133d4e8342f39389064620f5a7f8fTed Kremenek default: 2375d8e9f0dc737133d4e8342f39389064620f5a7f8fTed Kremenek break; 23761eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 23772de56d1d0c3a504ad1529de2677628bdfbb95cd4John McCall case UO_Real: { 23789c378f705405d37f49795d5e915989de774fe11fTed Kremenek const Expr *Ex = U->getSubExpr()->IgnoreParens(); 2379031ccc0555a82afc2e8afe29e19dd57ff204e2deZhongxing Xu ExplodedNodeSet Tmp; 2380b8e26e63d9dcc09351d75677721c6c9ff7045b54Ted Kremenek Visit(Ex, Pred, Tmp); 23811eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 2382031ccc0555a82afc2e8afe29e19dd57ff204e2deZhongxing Xu for (ExplodedNodeSet::iterator I=Tmp.begin(), E=Tmp.end(); I!=E; ++I) { 23831eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 23841c96b24285d05c0eac455ae96d7c9ff43d42bc96Zhongxing Xu // FIXME: We don't have complex SValues yet. 2385b8e26e63d9dcc09351d75677721c6c9ff7045b54Ted Kremenek if (Ex->getType()->isAnyComplexType()) { 2386b8e26e63d9dcc09351d75677721c6c9ff7045b54Ted Kremenek // Just report "Unknown." 2387b8e26e63d9dcc09351d75677721c6c9ff7045b54Ted Kremenek Dst.Add(*I); 2388b8e26e63d9dcc09351d75677721c6c9ff7045b54Ted Kremenek continue; 2389b8e26e63d9dcc09351d75677721c6c9ff7045b54Ted Kremenek } 23901eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 23912de56d1d0c3a504ad1529de2677628bdfbb95cd4John McCall // For all other types, UO_Real is an identity operation. 2392b8e26e63d9dcc09351d75677721c6c9ff7045b54Ted Kremenek assert (U->getType() == Ex->getType()); 239318c66fdc3c4008d335885695fe36fb5353c5f672Ted Kremenek const ProgramState *state = (*I)->getState(); 23941397663af9dbcc24dbf0e11de43931b3dc08fdbbTed Kremenek MakeNode(Dst, U, *I, state->BindExpr(U, state->getSVal(Ex))); 23951eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump } 23961eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 2397b8e26e63d9dcc09351d75677721c6c9ff7045b54Ted Kremenek return; 2398b8e26e63d9dcc09351d75677721c6c9ff7045b54Ted Kremenek } 23991eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 24002de56d1d0c3a504ad1529de2677628bdfbb95cd4John McCall case UO_Imag: { 24011eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 24029c378f705405d37f49795d5e915989de774fe11fTed Kremenek const Expr *Ex = U->getSubExpr()->IgnoreParens(); 2403031ccc0555a82afc2e8afe29e19dd57ff204e2deZhongxing Xu ExplodedNodeSet Tmp; 2404b8e26e63d9dcc09351d75677721c6c9ff7045b54Ted Kremenek Visit(Ex, Pred, Tmp); 24051eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 2406031ccc0555a82afc2e8afe29e19dd57ff204e2deZhongxing Xu for (ExplodedNodeSet::iterator I=Tmp.begin(), E=Tmp.end(); I!=E; ++I) { 24071c96b24285d05c0eac455ae96d7c9ff43d42bc96Zhongxing Xu // FIXME: We don't have complex SValues yet. 2408b8e26e63d9dcc09351d75677721c6c9ff7045b54Ted Kremenek if (Ex->getType()->isAnyComplexType()) { 2409b8e26e63d9dcc09351d75677721c6c9ff7045b54Ted Kremenek // Just report "Unknown." 2410b8e26e63d9dcc09351d75677721c6c9ff7045b54Ted Kremenek Dst.Add(*I); 2411b8e26e63d9dcc09351d75677721c6c9ff7045b54Ted Kremenek continue; 2412b8e26e63d9dcc09351d75677721c6c9ff7045b54Ted Kremenek } 24131eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 24142de56d1d0c3a504ad1529de2677628bdfbb95cd4John McCall // For all other types, UO_Imag returns 0. 241518c66fdc3c4008d335885695fe36fb5353c5f672Ted Kremenek const ProgramState *state = (*I)->getState(); 2416c8413fd03f73084a5c93028f8b4db619fc388087Ted Kremenek SVal X = svalBuilder.makeZeroVal(Ex->getType()); 24178e0293406f9d62a293be6be3b1fb89d359f5ea40Ted Kremenek MakeNode(Dst, U, *I, state->BindExpr(U, X)); 2418b8e26e63d9dcc09351d75677721c6c9ff7045b54Ted Kremenek } 24191eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 2420b8e26e63d9dcc09351d75677721c6c9ff7045b54Ted Kremenek return; 2421b8e26e63d9dcc09351d75677721c6c9ff7045b54Ted Kremenek } 24228ecdb65716cd7914ffb2eeee993fa9039fcd31e8Douglas Gregor 2423892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek case UO_Plus: 2424892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek assert(!U->isLValue()); 2425892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek // FALL-THROUGH. 2426892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek case UO_Deref: 24279c2bac02c1d1204bcf2c5a025ab901d09bc7ae26Zhongxing Xu case UO_AddrOf: 24282de56d1d0c3a504ad1529de2677628bdfbb95cd4John McCall case UO_Extension: { 24291eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 24301b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek // Unary "+" is a no-op, similar to a parentheses. We still have places 24311b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek // where it may be a block-level expression, so we need to 24321b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek // generate an extra node that just propagates the value of the 24331b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek // subexpression. 24341b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek 24359c378f705405d37f49795d5e915989de774fe11fTed Kremenek const Expr *Ex = U->getSubExpr()->IgnoreParens(); 2436031ccc0555a82afc2e8afe29e19dd57ff204e2deZhongxing Xu ExplodedNodeSet Tmp; 2437892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek Visit(Ex, Pred, Tmp); 24381eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 24391eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump for (ExplodedNodeSet::iterator I=Tmp.begin(), E=Tmp.end(); I!=E; ++I) { 244018c66fdc3c4008d335885695fe36fb5353c5f672Ted Kremenek const ProgramState *state = (*I)->getState(); 24411397663af9dbcc24dbf0e11de43931b3dc08fdbbTed Kremenek MakeNode(Dst, U, *I, state->BindExpr(U, state->getSVal(Ex))); 24421b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek } 24431eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 24441b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek return; 24451b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek } 24461eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 24472de56d1d0c3a504ad1529de2677628bdfbb95cd4John McCall case UO_LNot: 24482de56d1d0c3a504ad1529de2677628bdfbb95cd4John McCall case UO_Minus: 24492de56d1d0c3a504ad1529de2677628bdfbb95cd4John McCall case UO_Not: { 2450892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek assert (!U->isLValue()); 24519c378f705405d37f49795d5e915989de774fe11fTed Kremenek const Expr *Ex = U->getSubExpr()->IgnoreParens(); 2452031ccc0555a82afc2e8afe29e19dd57ff204e2deZhongxing Xu ExplodedNodeSet Tmp; 24531b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek Visit(Ex, Pred, Tmp); 24541eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 24551eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump for (ExplodedNodeSet::iterator I=Tmp.begin(), E=Tmp.end(); I!=E; ++I) { 245618c66fdc3c4008d335885695fe36fb5353c5f672Ted Kremenek const ProgramState *state = (*I)->getState(); 24571eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 2458855cd903beadc056ea300464b46c6c46b91d290fTed Kremenek // Get the value of the subexpression. 24591397663af9dbcc24dbf0e11de43931b3dc08fdbbTed Kremenek SVal V = state->getSVal(Ex); 2460855cd903beadc056ea300464b46c6c46b91d290fTed Kremenek 2461e04a5cb9afb5faa205c0bfa93103d6df691e05b2Ted Kremenek if (V.isUnknownOrUndef()) { 24628e0293406f9d62a293be6be3b1fb89d359f5ea40Ted Kremenek MakeNode(Dst, U, *I, state->BindExpr(U, V)); 2463e04a5cb9afb5faa205c0bfa93103d6df691e05b2Ted Kremenek continue; 2464e04a5cb9afb5faa205c0bfa93103d6df691e05b2Ted Kremenek } 24651eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 246660595dab8bd9800f6b0b724fa4d859ada78c264fTed Kremenek// QualType DstT = getContext().getCanonicalType(U->getType()); 246760595dab8bd9800f6b0b724fa4d859ada78c264fTed Kremenek// QualType SrcT = getContext().getCanonicalType(Ex->getType()); 24681eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump// 246960595dab8bd9800f6b0b724fa4d859ada78c264fTed Kremenek// if (DstT != SrcT) // Perform promotions. 24709c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek// V = evalCast(V, DstT); 24711eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump// 247260595dab8bd9800f6b0b724fa4d859ada78c264fTed Kremenek// if (V.isUnknownOrUndef()) { 247360595dab8bd9800f6b0b724fa4d859ada78c264fTed Kremenek// MakeNode(Dst, U, *I, BindExpr(St, U, V)); 247460595dab8bd9800f6b0b724fa4d859ada78c264fTed Kremenek// continue; 247560595dab8bd9800f6b0b724fa4d859ada78c264fTed Kremenek// } 24761eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 24771b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek switch (U->getOpcode()) { 24781b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek default: 24791b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek assert(false && "Invalid Opcode."); 24801b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek break; 24811eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 24822de56d1d0c3a504ad1529de2677628bdfbb95cd4John McCall case UO_Not: 248360a6e0ce72a24d6247602625c631fc3dc7bfd8d4Ted Kremenek // FIXME: Do we need to handle promotions? 24849c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek state = state->BindExpr(U, evalComplement(cast<NonLoc>(V))); 24851eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump break; 24861eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 24872de56d1d0c3a504ad1529de2677628bdfbb95cd4John McCall case UO_Minus: 248860a6e0ce72a24d6247602625c631fc3dc7bfd8d4Ted Kremenek // FIXME: Do we need to handle promotions? 24899c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek state = state->BindExpr(U, evalMinus(cast<NonLoc>(V))); 24901eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump break; 24911eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 24922de56d1d0c3a504ad1529de2677628bdfbb95cd4John McCall case UO_LNot: 24931eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 24941b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek // C99 6.5.3.3: "The expression !E is equivalent to (0==E)." 24951b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek // 24961b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek // Note: technically we do "E == 0", but this is the same in the 24971b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek // transfer functions as "0 == E". 24986c07bdba93b095b66e2c8c82dd5ed458fa8285eaTed Kremenek SVal Result; 24991eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 25001c96b24285d05c0eac455ae96d7c9ff43d42bc96Zhongxing Xu if (isa<Loc>(V)) { 2501c8413fd03f73084a5c93028f8b4db619fc388087Ted Kremenek Loc X = svalBuilder.makeNull(); 25029c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek Result = evalBinOp(state, BO_EQ, cast<Loc>(V), X, 25036c07bdba93b095b66e2c8c82dd5ed458fa8285eaTed Kremenek U->getType()); 25041b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek } 25051b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek else { 250660595dab8bd9800f6b0b724fa4d859ada78c264fTed Kremenek nonloc::ConcreteInt X(getBasicVals().getValue(0, Ex->getType())); 25079c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek Result = evalBinOp(state, BO_EQ, cast<NonLoc>(V), X, 25086c07bdba93b095b66e2c8c82dd5ed458fa8285eaTed Kremenek U->getType()); 25091b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek } 25101eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 25118e0293406f9d62a293be6be3b1fb89d359f5ea40Ted Kremenek state = state->BindExpr(U, Result); 25121eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 25131b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek break; 25141b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek } 25151eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 2516a8538d902fce9cfec20f39b34492268b51643819Ted Kremenek MakeNode(Dst, U, *I, state); 25171b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek } 25181eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 25191b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek return; 25201b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek } 25217b8009a3e3a1479203d315b74712552a4ce3e200Ted Kremenek } 25222ad886836c3a9111f24144a8fe5da3d72958a01cTed Kremenek 25231b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek // Handle ++ and -- (both pre- and post-increment). 25241b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek assert (U->isIncrementDecrementOp()); 2525031ccc0555a82afc2e8afe29e19dd57ff204e2deZhongxing Xu ExplodedNodeSet Tmp; 25269c378f705405d37f49795d5e915989de774fe11fTed Kremenek const Expr *Ex = U->getSubExpr()->IgnoreParens(); 2527892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek Visit(Ex, Pred, Tmp); 25281eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 2529031ccc0555a82afc2e8afe29e19dd57ff204e2deZhongxing Xu for (ExplodedNodeSet::iterator I = Tmp.begin(), E = Tmp.end(); I!=E; ++I) { 25301eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 253118c66fdc3c4008d335885695fe36fb5353c5f672Ted Kremenek const ProgramState *state = (*I)->getState(); 2532250704bc525361e8612ea01f245a41a1193c13f0Zhongxing Xu SVal loc = state->getSVal(Ex); 25331eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 25341eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump // Perform a load. 2535031ccc0555a82afc2e8afe29e19dd57ff204e2deZhongxing Xu ExplodedNodeSet Tmp2; 2536250704bc525361e8612ea01f245a41a1193c13f0Zhongxing Xu evalLoad(Tmp2, Ex, *I, state, loc); 2537540cbe2b60294fe7b926c26b4f1840f544fe3011Ted Kremenek 2538bb141217871e93767aa3f2de1b9946fa6d37066aZhongxing Xu for (ExplodedNodeSet::iterator I2=Tmp2.begin(), E2=Tmp2.end();I2!=E2;++I2) { 25391eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 2540db5e8cd095d1ffdd18f5620ad2348b5f386bebe3Anna Zaks state = (*I2)->getState(); 25411397663af9dbcc24dbf0e11de43931b3dc08fdbbTed Kremenek SVal V2_untested = state->getSVal(Ex); 25421eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 25431eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump // Propagate unknown and undefined values. 25445b9bd2137ebef350af803c634e3fdf5d74678100Ted Kremenek if (V2_untested.isUnknownOrUndef()) { 25455b9bd2137ebef350af803c634e3fdf5d74678100Ted Kremenek MakeNode(Dst, U, *I2, state->BindExpr(U, V2_untested)); 25461b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek continue; 2547b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek } 25485b9bd2137ebef350af803c634e3fdf5d74678100Ted Kremenek DefinedSVal V2 = cast<DefinedSVal>(V2_untested); 25491eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 25501eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump // Handle all other values. 25512de56d1d0c3a504ad1529de2677628bdfbb95cd4John McCall BinaryOperator::Opcode Op = U->isIncrementOp() ? BO_Add 25522de56d1d0c3a504ad1529de2677628bdfbb95cd4John McCall : BO_Sub; 255321028dd8850c64a414f7a82dfddcc291351203d6Ted Kremenek 2554a52ad4e1f423bed2e9e0dcb12661268091d20a54Zhongxing Xu // If the UnaryOperator has non-location type, use its type to create the 2555a52ad4e1f423bed2e9e0dcb12661268091d20a54Zhongxing Xu // constant value. If the UnaryOperator has location type, create the 2556a52ad4e1f423bed2e9e0dcb12661268091d20a54Zhongxing Xu // constant with int type and pointer width. 2557a52ad4e1f423bed2e9e0dcb12661268091d20a54Zhongxing Xu SVal RHS; 2558a52ad4e1f423bed2e9e0dcb12661268091d20a54Zhongxing Xu 2559a52ad4e1f423bed2e9e0dcb12661268091d20a54Zhongxing Xu if (U->getType()->isAnyPointerType()) 2560a6b0b96e5376cd9cf182a3e240e0537feed43cdeTed Kremenek RHS = svalBuilder.makeArrayIndex(1); 2561a52ad4e1f423bed2e9e0dcb12661268091d20a54Zhongxing Xu else 2562c8413fd03f73084a5c93028f8b4db619fc388087Ted Kremenek RHS = svalBuilder.makeIntVal(1, U->getType()); 2563a52ad4e1f423bed2e9e0dcb12661268091d20a54Zhongxing Xu 25649c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek SVal Result = evalBinOp(state, Op, V2, RHS, U->getType()); 25651eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 2566bb9b2711ded08d39f9c9aa08b06ac5e288f32c62Ted Kremenek // Conjure a new symbol if necessary to recover precision. 2567af48fdd35633f53c74e982ba7922ca7b2051c1f5Ted Kremenek if (Result.isUnknown() || !getConstraintManager().canReasonAbout(Result)){ 25685b9bd2137ebef350af803c634e3fdf5d74678100Ted Kremenek DefinedOrUnknownSVal SymVal = 2569c8413fd03f73084a5c93028f8b4db619fc388087Ted Kremenek svalBuilder.getConjuredSymbolVal(NULL, Ex, 25708780679b02bea5ab6360f3f8ebf3b221aaeda93fTed Kremenek Builder->getCurrentBlockCount()); 25715b9bd2137ebef350af803c634e3fdf5d74678100Ted Kremenek Result = SymVal; 25721eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 2573af48fdd35633f53c74e982ba7922ca7b2051c1f5Ted Kremenek // If the value is a location, ++/-- should always preserve 25746c07bdba93b095b66e2c8c82dd5ed458fa8285eaTed Kremenek // non-nullness. Check if the original value was non-null, and if so 25751eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump // propagate that constraint. 25767dfc9420babe83e236a47e752f8723bd06070d9dZhanyong Wan if (Loc::isLocType(U->getType())) { 25775b9bd2137ebef350af803c634e3fdf5d74678100Ted Kremenek DefinedOrUnknownSVal Constraint = 2578250704bc525361e8612ea01f245a41a1193c13f0Zhongxing Xu svalBuilder.evalEQ(state, V2,svalBuilder.makeZeroVal(U->getType())); 25791eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 258028f47b92e760ccf641ac91cb0fe1c12d9ca89795Ted Kremenek if (!state->assume(Constraint, true)) { 2581af48fdd35633f53c74e982ba7922ca7b2051c1f5Ted Kremenek // It isn't feasible for the original value to be null. 2582af48fdd35633f53c74e982ba7922ca7b2051c1f5Ted Kremenek // Propagate this constraint. 25839c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek Constraint = svalBuilder.evalEQ(state, SymVal, 2584c8413fd03f73084a5c93028f8b4db619fc388087Ted Kremenek svalBuilder.makeZeroVal(U->getType())); 25855b9bd2137ebef350af803c634e3fdf5d74678100Ted Kremenek 25861eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 258728f47b92e760ccf641ac91cb0fe1c12d9ca89795Ted Kremenek state = state->assume(Constraint, false); 2588a591bc04d21fa62ebffcb2c7814d738ca8f5e2f9Ted Kremenek assert(state); 25891eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump } 25901eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump } 2591af48fdd35633f53c74e982ba7922ca7b2051c1f5Ted Kremenek } 25921eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 2593250704bc525361e8612ea01f245a41a1193c13f0Zhongxing Xu // Since the lvalue-to-rvalue conversion is explicit in the AST, 2594250704bc525361e8612ea01f245a41a1193c13f0Zhongxing Xu // we bind an l-value if the operator is prefix and an lvalue (in C++). 2595b08624414a923e0df93dd7630fee51b0ff3cb7b1Zhongxing Xu if (U->isLValue()) 2596250704bc525361e8612ea01f245a41a1193c13f0Zhongxing Xu state = state->BindExpr(U, loc); 2597250704bc525361e8612ea01f245a41a1193c13f0Zhongxing Xu else 2598ce30688b8aa0effd70a7a69a4d1e3d6a2a86efcdTed Kremenek state = state->BindExpr(U, U->isPostfix() ? V2 : Result); 25991b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek 26001eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump // Perform the store. 2601250704bc525361e8612ea01f245a41a1193c13f0Zhongxing Xu evalStore(Dst, NULL, U, *I2, state, loc, Result); 26025b6dc2d72bf1bcf2b61fe5dbcd57bfa4aee76b29Ted Kremenek } 2603469ecbded3616416ef938ed94a67f86149faf226Ted Kremenek } 26045b6dc2d72bf1bcf2b61fe5dbcd57bfa4aee76b29Ted Kremenek} 26055b6dc2d72bf1bcf2b61fe5dbcd57bfa4aee76b29Ted Kremenek 26069c378f705405d37f49795d5e915989de774fe11fTed Kremenekvoid ExprEngine::VisitAsmStmt(const AsmStmt *A, ExplodedNode *Pred, 26079c378f705405d37f49795d5e915989de774fe11fTed Kremenek ExplodedNodeSet &Dst) { 2608ef44bfb9d0f15ba0391f8346c9f01355fb450a09Ted Kremenek VisitAsmStmtHelperOutputs(A, A->begin_outputs(), A->end_outputs(), Pred, Dst); 26091eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump} 2610ef44bfb9d0f15ba0391f8346c9f01355fb450a09Ted Kremenek 26119c378f705405d37f49795d5e915989de774fe11fTed Kremenekvoid ExprEngine::VisitAsmStmtHelperOutputs(const AsmStmt *A, 261203509aea098772644bf4662dc1c88634818ceeccZhongxing Xu AsmStmt::const_outputs_iterator I, 261303509aea098772644bf4662dc1c88634818ceeccZhongxing Xu AsmStmt::const_outputs_iterator E, 26149c378f705405d37f49795d5e915989de774fe11fTed Kremenek ExplodedNode *Pred, ExplodedNodeSet &Dst) { 2615ef44bfb9d0f15ba0391f8346c9f01355fb450a09Ted Kremenek if (I == E) { 2616ef44bfb9d0f15ba0391f8346c9f01355fb450a09Ted Kremenek VisitAsmStmtHelperInputs(A, A->begin_inputs(), A->end_inputs(), Pred, Dst); 2617ef44bfb9d0f15ba0391f8346c9f01355fb450a09Ted Kremenek return; 2618ef44bfb9d0f15ba0391f8346c9f01355fb450a09Ted Kremenek } 26191eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 2620031ccc0555a82afc2e8afe29e19dd57ff204e2deZhongxing Xu ExplodedNodeSet Tmp; 2621892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek Visit(*I, Pred, Tmp); 2622ef44bfb9d0f15ba0391f8346c9f01355fb450a09Ted Kremenek ++I; 26231eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 2624bb141217871e93767aa3f2de1b9946fa6d37066aZhongxing Xu for (ExplodedNodeSet::iterator NI = Tmp.begin(), NE = Tmp.end();NI != NE;++NI) 2625ef44bfb9d0f15ba0391f8346c9f01355fb450a09Ted Kremenek VisitAsmStmtHelperOutputs(A, I, E, *NI, Dst); 2626ef44bfb9d0f15ba0391f8346c9f01355fb450a09Ted Kremenek} 2627ef44bfb9d0f15ba0391f8346c9f01355fb450a09Ted Kremenek 26289c378f705405d37f49795d5e915989de774fe11fTed Kremenekvoid ExprEngine::VisitAsmStmtHelperInputs(const AsmStmt *A, 262903509aea098772644bf4662dc1c88634818ceeccZhongxing Xu AsmStmt::const_inputs_iterator I, 263003509aea098772644bf4662dc1c88634818ceeccZhongxing Xu AsmStmt::const_inputs_iterator E, 26319c378f705405d37f49795d5e915989de774fe11fTed Kremenek ExplodedNode *Pred, 26329c378f705405d37f49795d5e915989de774fe11fTed Kremenek ExplodedNodeSet &Dst) { 2633ef44bfb9d0f15ba0391f8346c9f01355fb450a09Ted Kremenek if (I == E) { 26341eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 2635ef44bfb9d0f15ba0391f8346c9f01355fb450a09Ted Kremenek // We have processed both the inputs and the outputs. All of the outputs 26361c96b24285d05c0eac455ae96d7c9ff43d42bc96Zhongxing Xu // should evaluate to Locs. Nuke all of their values. 26371eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 2638ef44bfb9d0f15ba0391f8346c9f01355fb450a09Ted Kremenek // FIXME: Some day in the future it would be nice to allow a "plug-in" 2639ef44bfb9d0f15ba0391f8346c9f01355fb450a09Ted Kremenek // which interprets the inline asm and stores proper results in the 2640ef44bfb9d0f15ba0391f8346c9f01355fb450a09Ted Kremenek // outputs. 26411eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 264218c66fdc3c4008d335885695fe36fb5353c5f672Ted Kremenek const ProgramState *state = Pred->getState(); 26431eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 264403509aea098772644bf4662dc1c88634818ceeccZhongxing Xu for (AsmStmt::const_outputs_iterator OI = A->begin_outputs(), 2645ef44bfb9d0f15ba0391f8346c9f01355fb450a09Ted Kremenek OE = A->end_outputs(); OI != OE; ++OI) { 26461eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 26471397663af9dbcc24dbf0e11de43931b3dc08fdbbTed Kremenek SVal X = state->getSVal(*OI); 26481c96b24285d05c0eac455ae96d7c9ff43d42bc96Zhongxing Xu assert (!isa<NonLoc>(X)); // Should be an Lval, or unknown, undef. 26491eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 26501c96b24285d05c0eac455ae96d7c9ff43d42bc96Zhongxing Xu if (isa<Loc>(X)) 26513ff12591494a3cb3d3a24427975df58714ac3b2fTed Kremenek state = state->bindLoc(cast<Loc>(X), UnknownVal()); 2652ef44bfb9d0f15ba0391f8346c9f01355fb450a09Ted Kremenek } 26531eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 2654a8538d902fce9cfec20f39b34492268b51643819Ted Kremenek MakeNode(Dst, A, Pred, state); 2655ef44bfb9d0f15ba0391f8346c9f01355fb450a09Ted Kremenek return; 2656ef44bfb9d0f15ba0391f8346c9f01355fb450a09Ted Kremenek } 26571eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 2658031ccc0555a82afc2e8afe29e19dd57ff204e2deZhongxing Xu ExplodedNodeSet Tmp; 2659ef44bfb9d0f15ba0391f8346c9f01355fb450a09Ted Kremenek Visit(*I, Pred, Tmp); 26601eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 2661ef44bfb9d0f15ba0391f8346c9f01355fb450a09Ted Kremenek ++I; 26621eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 2663e1ccccff777f6bad6b25e9c6a762f98fd8003181Ted Kremenek for (ExplodedNodeSet::iterator NI = Tmp.begin(), NE = Tmp.end(); NI!=NE; ++NI) 2664ef44bfb9d0f15ba0391f8346c9f01355fb450a09Ted Kremenek VisitAsmStmtHelperInputs(A, I, E, *NI, Dst); 2665ef44bfb9d0f15ba0391f8346c9f01355fb450a09Ted Kremenek} 2666ef44bfb9d0f15ba0391f8346c9f01355fb450a09Ted Kremenek 2667d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidisvoid ExprEngine::VisitReturnStmt(const ReturnStmt *RS, ExplodedNode *Pred, 26681053d246f451c399468248625d1146e3d845e21eTed Kremenek ExplodedNodeSet &Dst) { 26691053d246f451c399468248625d1146e3d845e21eTed Kremenek ExplodedNodeSet Src; 267003509aea098772644bf4662dc1c88634818ceeccZhongxing Xu if (const Expr *RetE = RS->getRetValue()) { 2671bd2b2084e58577f17308f910770a5563a344251aZhongxing Xu // Record the returned expression in the state. It will be used in 2672e36de1fe51c39d9161915dd3dbef880954af6476Ted Kremenek // processCallExit to bind the return value to the call expr. 26736190ec29f0895185bbec95a932429b8832917fecZhongxing Xu { 2674ca804539d908d3a0e8c72a0df5f1f571d29490bbTed Kremenek static SimpleProgramPointTag tag("ExprEngine: ReturnStmt"); 267518c66fdc3c4008d335885695fe36fb5353c5f672Ted Kremenek const ProgramState *state = Pred->getState(); 26766190ec29f0895185bbec95a932429b8832917fecZhongxing Xu state = state->set<ReturnExpr>(RetE); 2677b4857264b8d3d861f688cdaa174aab30e0729a73Ted Kremenek Pred = Builder->generateNode(RetE, state, Pred, &tag); 26786190ec29f0895185bbec95a932429b8832917fecZhongxing Xu } 26796190ec29f0895185bbec95a932429b8832917fecZhongxing Xu // We may get a NULL Pred because we generated a cached node. 26806190ec29f0895185bbec95a932429b8832917fecZhongxing Xu if (Pred) 26816190ec29f0895185bbec95a932429b8832917fecZhongxing Xu Visit(RetE, Pred, Src); 268202737ed29d7fff2206f7c7ee958cdf0665e35542Ted Kremenek } 26831053d246f451c399468248625d1146e3d845e21eTed Kremenek else { 26841053d246f451c399468248625d1146e3d845e21eTed Kremenek Src.Add(Pred); 26851053d246f451c399468248625d1146e3d845e21eTed Kremenek } 2686b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 26871053d246f451c399468248625d1146e3d845e21eTed Kremenek ExplodedNodeSet CheckedSet; 2688eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis getCheckerManager().runCheckersForPreStmt(CheckedSet, Src, RS, *this); 2689b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 26901053d246f451c399468248625d1146e3d845e21eTed Kremenek for (ExplodedNodeSet::iterator I = CheckedSet.begin(), E = CheckedSet.end(); 26911053d246f451c399468248625d1146e3d845e21eTed Kremenek I != E; ++I) { 26926b31e8ed11721505645860f40486e091ecd23dd0Ted Kremenek 2693d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidis assert(Builder && "StmtNodeBuilder must be defined."); 2694b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 26951053d246f451c399468248625d1146e3d845e21eTed Kremenek Pred = *I; 26961053d246f451c399468248625d1146e3d845e21eTed Kremenek unsigned size = Dst.size(); 2697b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 26981053d246f451c399468248625d1146e3d845e21eTed Kremenek SaveAndRestore<bool> OldSink(Builder->BuildSinks); 2699b4857264b8d3d861f688cdaa174aab30e0729a73Ted Kremenek SaveOr OldHasGen(Builder->hasGeneratedNode); 2700b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 27019c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek getTF().evalReturn(Dst, *this, *Builder, RS, Pred); 2702b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 2703b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek // Handle the case where no nodes where generated. 2704b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek if (!Builder->BuildSinks && Dst.size() == size && 2705b4857264b8d3d861f688cdaa174aab30e0729a73Ted Kremenek !Builder->hasGeneratedNode) 2706db5e8cd095d1ffdd18f5620ad2348b5f386bebe3Anna Zaks MakeNode(Dst, RS, Pred, Pred->getState()); 27075917d7894e8274b9625275dd4dd86c5d0040a242Ted Kremenek } 270802737ed29d7fff2206f7c7ee958cdf0665e35542Ted Kremenek} 270955deb97341819080d6d127d29e25b9502e4f2e3cTed Kremenek 2710e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek//===----------------------------------------------------------------------===// 2711e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek// Transfer functions: Binary operators. 2712e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek//===----------------------------------------------------------------------===// 2713e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek 2714d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidisvoid ExprEngine::VisitBinaryOperator(const BinaryOperator* B, 27159c378f705405d37f49795d5e915989de774fe11fTed Kremenek ExplodedNode *Pred, 27169c378f705405d37f49795d5e915989de774fe11fTed Kremenek ExplodedNodeSet &Dst) { 2717031ccc0555a82afc2e8afe29e19dd57ff204e2deZhongxing Xu ExplodedNodeSet Tmp1; 27189c378f705405d37f49795d5e915989de774fe11fTed Kremenek Expr *LHS = B->getLHS()->IgnoreParens(); 27199c378f705405d37f49795d5e915989de774fe11fTed Kremenek Expr *RHS = B->getRHS()->IgnoreParens(); 27201eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 2721892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek Visit(LHS, Pred, Tmp1); 2722668399b23cf18124c8c8c41a14a7712212f6fa45Zhongxing Xu ExplodedNodeSet Tmp3; 2723668399b23cf18124c8c8c41a14a7712212f6fa45Zhongxing Xu 2724e1ccccff777f6bad6b25e9c6a762f98fd8003181Ted Kremenek for (ExplodedNodeSet::iterator I1=Tmp1.begin(), E1=Tmp1.end(); I1!=E1; ++I1) { 2725db5e8cd095d1ffdd18f5620ad2348b5f386bebe3Anna Zaks SVal LeftV = (*I1)->getState()->getSVal(LHS); 2726031ccc0555a82afc2e8afe29e19dd57ff204e2deZhongxing Xu ExplodedNodeSet Tmp2; 27271b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek Visit(RHS, *I1, Tmp2); 27286403b57eda05a22273d920ad0bd2991d11eaa7b8Zhongxing Xu 27296403b57eda05a22273d920ad0bd2991d11eaa7b8Zhongxing Xu ExplodedNodeSet CheckedSet; 2730eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis getCheckerManager().runCheckersForPreStmt(CheckedSet, Tmp2, B, *this); 27311eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 27321b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek // With both the LHS and RHS evaluated, process the operation itself. 27331eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 27341eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump for (ExplodedNodeSet::iterator I2=CheckedSet.begin(), E2=CheckedSet.end(); 27356403b57eda05a22273d920ad0bd2991d11eaa7b8Zhongxing Xu I2 != E2; ++I2) { 2736cf78b6a771bb4537d5ee8fa44e718e842c2f70c7Ted Kremenek 273718c66fdc3c4008d335885695fe36fb5353c5f672Ted Kremenek const ProgramState *state = (*I2)->getState(); 27381397663af9dbcc24dbf0e11de43931b3dc08fdbbTed Kremenek SVal RightV = state->getSVal(RHS); 27391eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 27405b9bd2137ebef350af803c634e3fdf5d74678100Ted Kremenek BinaryOperator::Opcode Op = B->getOpcode(); 27411eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 27422de56d1d0c3a504ad1529de2677628bdfbb95cd4John McCall if (Op == BO_Assign) { 274373af2d5c92420e9cd8b6a9fefcdc2c744aedda1fZhongxing Xu // EXPERIMENTAL: "Conjured" symbols. 274473af2d5c92420e9cd8b6a9fefcdc2c744aedda1fZhongxing Xu // FIXME: Handle structs. 27450e82a936389ead8f22077d5b021cab4ab7bd9899Ted Kremenek if (RightV.isUnknown() ||!getConstraintManager().canReasonAbout(RightV)) 27460e82a936389ead8f22077d5b021cab4ab7bd9899Ted Kremenek { 274773af2d5c92420e9cd8b6a9fefcdc2c744aedda1fZhongxing Xu unsigned Count = Builder->getCurrentBlockCount(); 2748c8413fd03f73084a5c93028f8b4db619fc388087Ted Kremenek RightV = svalBuilder.getConjuredSymbolVal(NULL, B->getRHS(), Count); 2749ab2b8c54bca82866876f91e756788916d3fa20c3Ted Kremenek } 2750662174ca204cb520f634bdcb34a3708f45389d14Zhongxing Xu 2751892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek SVal ExprVal = B->isLValue() ? LeftV : RightV; 2752662174ca204cb520f634bdcb34a3708f45389d14Zhongxing Xu 275373af2d5c92420e9cd8b6a9fefcdc2c744aedda1fZhongxing Xu // Simulate the effects of a "store": bind the value of the RHS 275473af2d5c92420e9cd8b6a9fefcdc2c744aedda1fZhongxing Xu // to the L-Value represented by the LHS. 27559c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek evalStore(Tmp3, B, LHS, *I2, state->BindExpr(B, ExprVal), LeftV,RightV); 275673af2d5c92420e9cd8b6a9fefcdc2c744aedda1fZhongxing Xu continue; 275773af2d5c92420e9cd8b6a9fefcdc2c744aedda1fZhongxing Xu } 2758b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 275973af2d5c92420e9cd8b6a9fefcdc2c744aedda1fZhongxing Xu if (!B->isAssignmentOp()) { 276073af2d5c92420e9cd8b6a9fefcdc2c744aedda1fZhongxing Xu // Process non-assignments except commas or short-circuited 276173af2d5c92420e9cd8b6a9fefcdc2c744aedda1fZhongxing Xu // logical expressions (LAnd and LOr). 27629c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek SVal Result = evalBinOp(state, Op, LeftV, RightV, B->getType()); 2763b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 276473af2d5c92420e9cd8b6a9fefcdc2c744aedda1fZhongxing Xu if (Result.isUnknown()) { 276596ebad66c451d79c9f57b1edb31efaeeb23b9a01Ted Kremenek MakeNode(Tmp3, B, *I2, state); 276673af2d5c92420e9cd8b6a9fefcdc2c744aedda1fZhongxing Xu continue; 276773af2d5c92420e9cd8b6a9fefcdc2c744aedda1fZhongxing Xu } 2768b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 276973af2d5c92420e9cd8b6a9fefcdc2c744aedda1fZhongxing Xu state = state->BindExpr(B, Result); 2770b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 2771668399b23cf18124c8c8c41a14a7712212f6fa45Zhongxing Xu MakeNode(Tmp3, B, *I2, state); 277273af2d5c92420e9cd8b6a9fefcdc2c744aedda1fZhongxing Xu continue; 27731b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek } 27741eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 27751b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek assert (B->isCompoundAssignmentOp()); 27761b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek 2777cad2996edf303978932c621ab02729dc11debb81Ted Kremenek switch (Op) { 2778cad2996edf303978932c621ab02729dc11debb81Ted Kremenek default: 2779cad2996edf303978932c621ab02729dc11debb81Ted Kremenek assert(0 && "Invalid opcode for compound assignment."); 27802de56d1d0c3a504ad1529de2677628bdfbb95cd4John McCall case BO_MulAssign: Op = BO_Mul; break; 27812de56d1d0c3a504ad1529de2677628bdfbb95cd4John McCall case BO_DivAssign: Op = BO_Div; break; 27822de56d1d0c3a504ad1529de2677628bdfbb95cd4John McCall case BO_RemAssign: Op = BO_Rem; break; 27832de56d1d0c3a504ad1529de2677628bdfbb95cd4John McCall case BO_AddAssign: Op = BO_Add; break; 27842de56d1d0c3a504ad1529de2677628bdfbb95cd4John McCall case BO_SubAssign: Op = BO_Sub; break; 27852de56d1d0c3a504ad1529de2677628bdfbb95cd4John McCall case BO_ShlAssign: Op = BO_Shl; break; 27862de56d1d0c3a504ad1529de2677628bdfbb95cd4John McCall case BO_ShrAssign: Op = BO_Shr; break; 27872de56d1d0c3a504ad1529de2677628bdfbb95cd4John McCall case BO_AndAssign: Op = BO_And; break; 27882de56d1d0c3a504ad1529de2677628bdfbb95cd4John McCall case BO_XorAssign: Op = BO_Xor; break; 27892de56d1d0c3a504ad1529de2677628bdfbb95cd4John McCall case BO_OrAssign: Op = BO_Or; break; 2790934e3e93eface34e73257a4a80cc6752edd588ceTed Kremenek } 27911eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 27921b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek // Perform a load (the LHS). This performs the checks for 27931b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek // null dereferences, and so on. 2794c39b2bdd4cef51021fe90de91c9fb6d1a15f4d0aZhongxing Xu ExplodedNodeSet Tmp4; 27951397663af9dbcc24dbf0e11de43931b3dc08fdbbTed Kremenek SVal location = state->getSVal(LHS); 27969c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek evalLoad(Tmp4, LHS, *I2, state, location); 27971eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 2798c39b2bdd4cef51021fe90de91c9fb6d1a15f4d0aZhongxing Xu for (ExplodedNodeSet::iterator I4=Tmp4.begin(), E4=Tmp4.end(); I4!=E4; 2799c39b2bdd4cef51021fe90de91c9fb6d1a15f4d0aZhongxing Xu ++I4) { 2800db5e8cd095d1ffdd18f5620ad2348b5f386bebe3Anna Zaks state = (*I4)->getState(); 28011397663af9dbcc24dbf0e11de43931b3dc08fdbbTed Kremenek SVal V = state->getSVal(LHS); 28021b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek 28031b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek // Get the computation type. 280432c3fa4195762ba93f0b7114ab36c0941bc34432Ted Kremenek QualType CTy = 280532c3fa4195762ba93f0b7114ab36c0941bc34432Ted Kremenek cast<CompoundAssignOperator>(B)->getComputationResultType(); 280660595dab8bd9800f6b0b724fa4d859ada78c264fTed Kremenek CTy = getContext().getCanonicalType(CTy); 2807ab3a852ae713189444dcbf75e70accf1e8c2b7f2Eli Friedman 280832c3fa4195762ba93f0b7114ab36c0941bc34432Ted Kremenek QualType CLHSTy = 280932c3fa4195762ba93f0b7114ab36c0941bc34432Ted Kremenek cast<CompoundAssignOperator>(B)->getComputationLHSType(); 281032c3fa4195762ba93f0b7114ab36c0941bc34432Ted Kremenek CLHSTy = getContext().getCanonicalType(CLHSTy); 2811ab3a852ae713189444dcbf75e70accf1e8c2b7f2Eli Friedman 281260595dab8bd9800f6b0b724fa4d859ada78c264fTed Kremenek QualType LTy = getContext().getCanonicalType(LHS->getType()); 2813ab3a852ae713189444dcbf75e70accf1e8c2b7f2Eli Friedman 2814ab3a852ae713189444dcbf75e70accf1e8c2b7f2Eli Friedman // Promote LHS. 28159c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek V = svalBuilder.evalCast(V, CLHSTy, LTy); 2816ab3a852ae713189444dcbf75e70accf1e8c2b7f2Eli Friedman 28171eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump // Compute the result of the operation. 28189c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek SVal Result = svalBuilder.evalCast(evalBinOp(state, Op, V, RightV, CTy), 2819814e6b915450456eb2a1ba15d82fc7f8ae3bc8a6Zhongxing Xu B->getType(), CTy); 28201eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 28219ff267d0d6b8249a017fca0b56a0c5a6bcb7ef8aTed Kremenek // EXPERIMENTAL: "Conjured" symbols. 28229ff267d0d6b8249a017fca0b56a0c5a6bcb7ef8aTed Kremenek // FIXME: Handle structs. 28231eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 282460595dab8bd9800f6b0b724fa4d859ada78c264fTed Kremenek SVal LHSVal; 28251eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 28260e82a936389ead8f22077d5b021cab4ab7bd9899Ted Kremenek if (Result.isUnknown() || 28270e82a936389ead8f22077d5b021cab4ab7bd9899Ted Kremenek !getConstraintManager().canReasonAbout(Result)) { 28281eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 28299ff267d0d6b8249a017fca0b56a0c5a6bcb7ef8aTed Kremenek unsigned Count = Builder->getCurrentBlockCount(); 28301eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 283160595dab8bd9800f6b0b724fa4d859ada78c264fTed Kremenek // The symbolic value is actually for the type of the left-hand side 283260595dab8bd9800f6b0b724fa4d859ada78c264fTed Kremenek // expression, not the computation type, as this is the value the 283360595dab8bd9800f6b0b724fa4d859ada78c264fTed Kremenek // LValue on the LHS will bind to. 2834c8413fd03f73084a5c93028f8b4db619fc388087Ted Kremenek LHSVal = svalBuilder.getConjuredSymbolVal(NULL, B->getRHS(), LTy, Count); 28351eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 28361c0c23325312df5d40fe788ffcb48484f190e9a3Zhongxing Xu // However, we need to convert the symbol to the computation type. 28379c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek Result = svalBuilder.evalCast(LHSVal, CTy, LTy); 28389ff267d0d6b8249a017fca0b56a0c5a6bcb7ef8aTed Kremenek } 283960595dab8bd9800f6b0b724fa4d859ada78c264fTed Kremenek else { 284060595dab8bd9800f6b0b724fa4d859ada78c264fTed Kremenek // The left-hand side may bind to a different value then the 284160595dab8bd9800f6b0b724fa4d859ada78c264fTed Kremenek // computation type. 28429c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek LHSVal = svalBuilder.evalCast(Result, LTy, CTy); 284360595dab8bd9800f6b0b724fa4d859ada78c264fTed Kremenek } 28441eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 2845f9d3cbbe07afa05c2414c7120d7141409e5a3663Zhongxing Xu // In C++, assignment and compound assignment operators return an 2846f9d3cbbe07afa05c2414c7120d7141409e5a3663Zhongxing Xu // lvalue. 2847f9d3cbbe07afa05c2414c7120d7141409e5a3663Zhongxing Xu if (B->isLValue()) 2848f9d3cbbe07afa05c2414c7120d7141409e5a3663Zhongxing Xu state = state->BindExpr(B, location); 2849f9d3cbbe07afa05c2414c7120d7141409e5a3663Zhongxing Xu else 2850f9d3cbbe07afa05c2414c7120d7141409e5a3663Zhongxing Xu state = state->BindExpr(B, Result); 2851f9d3cbbe07afa05c2414c7120d7141409e5a3663Zhongxing Xu 2852f9d3cbbe07afa05c2414c7120d7141409e5a3663Zhongxing Xu evalStore(Tmp3, B, LHS, *I4, state, location, LHSVal); 2853ab2b8c54bca82866876f91e756788916d3fa20c3Ted Kremenek } 2854cb448ca8b372710d48a232fddcec615164eee574Ted Kremenek } 2855d27f8169f4b68337a489547a41ac45bf7a5d1ddfTed Kremenek } 2856668399b23cf18124c8c8c41a14a7712212f6fa45Zhongxing Xu 2857eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis getCheckerManager().runCheckersForPostStmt(Dst, Tmp3, B, *this); 2858094bef56a7900f13bb777f9a352704104b1458e7Ted Kremenek} 2859094bef56a7900f13bb777f9a352704104b1458e7Ted Kremenek 2860094bef56a7900f13bb777f9a352704104b1458e7Ted Kremenek//===----------------------------------------------------------------------===// 2861e01c98767dfd7153c3c84637c36659e3bbe16ff7Ted Kremenek// Visualization. 2862ee98546b0d5f3439c4a590b0d7d1545af794a0ecTed Kremenek//===----------------------------------------------------------------------===// 2863ee98546b0d5f3439c4a590b0d7d1545af794a0ecTed Kremenek 2864aa66a32ba177338763cd0cf9df8310dfa2e24ff7Ted Kremenek#ifndef NDEBUG 2865d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidisstatic ExprEngine* GraphPrintCheckerState; 2866e97ca065c91ff9ca2a2a42eb443eaa553c40441cTed Kremenekstatic SourceManager* GraphPrintSourceManager; 28673b4f6702860208692f6ef28401e68de4e3ff9af9Ted Kremenek 2868aa66a32ba177338763cd0cf9df8310dfa2e24ff7Ted Kremeneknamespace llvm { 2869aa66a32ba177338763cd0cf9df8310dfa2e24ff7Ted Kremenektemplate<> 287047491f8b7adf9d42a404d44c073e8a5308fa6cfcDouglas Gregorstruct DOTGraphTraits<ExplodedNode*> : 2871aa66a32ba177338763cd0cf9df8310dfa2e24ff7Ted Kremenek public DefaultDOTGraphTraits { 2872006b0eb3e11162d8c06372db813ac9f71a7a16e8Tobias Grosser 2873006b0eb3e11162d8c06372db813ac9f71a7a16e8Tobias Grosser DOTGraphTraits (bool isSimple=false) : DefaultDOTGraphTraits(isSimple) {} 2874006b0eb3e11162d8c06372db813ac9f71a7a16e8Tobias Grosser 2875d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidis // FIXME: Since we do not cache error nodes in ExprEngine now, this does not 2876ec9227fea66c3439991fc84b0d33b0a8b4b8875eZhongxing Xu // work. 28779c378f705405d37f49795d5e915989de774fe11fTed Kremenek static std::string getNodeAttributes(const ExplodedNode *N, void*) { 28781eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 287910f51e8785e43d5a22acc2d2a638307c582949c2Ted Kremenek#if 0 288010f51e8785e43d5a22acc2d2a638307c582949c2Ted Kremenek // FIXME: Replace with a general scheme to tell if the node is 288110f51e8785e43d5a22acc2d2a638307c582949c2Ted Kremenek // an error node. 2882a3fadfcce5911742801a302cac82d4fe54d5c682Ted Kremenek if (GraphPrintCheckerState->isImplicitNullDeref(N) || 28839dca062461a6244cf0f733346657fa3eee853f9bTed Kremenek GraphPrintCheckerState->isExplicitNullDeref(N) || 28844a4e524afef40d6f3ddb25d0e407c814e4ca56a8Ted Kremenek GraphPrintCheckerState->isUndefDeref(N) || 28854a4e524afef40d6f3ddb25d0e407c814e4ca56a8Ted Kremenek GraphPrintCheckerState->isUndefStore(N) || 28864a4e524afef40d6f3ddb25d0e407c814e4ca56a8Ted Kremenek GraphPrintCheckerState->isUndefControlFlow(N) || 28875e03fcb5420c33207433dd6f800588e256dd9bdbTed Kremenek GraphPrintCheckerState->isUndefResult(N) || 28882ded35a576e3899553ea0ccfcbf5cbdb3d8cf664Ted Kremenek GraphPrintCheckerState->isBadCall(N) || 28892ded35a576e3899553ea0ccfcbf5cbdb3d8cf664Ted Kremenek GraphPrintCheckerState->isUndefArg(N)) 2890a3fadfcce5911742801a302cac82d4fe54d5c682Ted Kremenek return "color=\"red\",style=\"filled\""; 28911eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 28928cc13ea74fea1c04042a2f4087665bc5182e8408Ted Kremenek if (GraphPrintCheckerState->isNoReturnCall(N)) 28938cc13ea74fea1c04042a2f4087665bc5182e8408Ted Kremenek return "color=\"blue\",style=\"filled\""; 28942055effed54d614b51e3501a174c9b1fe92e4de4Zhongxing Xu#endif 2895a3fadfcce5911742801a302cac82d4fe54d5c682Ted Kremenek return ""; 2896a3fadfcce5911742801a302cac82d4fe54d5c682Ted Kremenek } 28971eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 28989c378f705405d37f49795d5e915989de774fe11fTed Kremenek static std::string getNodeLabel(const ExplodedNode *N, void*){ 28991eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 290053ba0b636194dbeaa65a6f85316c9397a0c5298bTed Kremenek std::string sbuf; 290153ba0b636194dbeaa65a6f85316c9397a0c5298bTed Kremenek llvm::raw_string_ostream Out(sbuf); 2902803c9edd06e8f936821525d36b1d8cc131e37d44Ted Kremenek 2903803c9edd06e8f936821525d36b1d8cc131e37d44Ted Kremenek // Program Location. 2904aa66a32ba177338763cd0cf9df8310dfa2e24ff7Ted Kremenek ProgramPoint Loc = N->getLocation(); 29051eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 2906aa66a32ba177338763cd0cf9df8310dfa2e24ff7Ted Kremenek switch (Loc.getKind()) { 2907aa66a32ba177338763cd0cf9df8310dfa2e24ff7Ted Kremenek case ProgramPoint::BlockEntranceKind: 29081eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump Out << "Block Entrance: B" 2909aa66a32ba177338763cd0cf9df8310dfa2e24ff7Ted Kremenek << cast<BlockEntrance>(Loc).getBlock()->getBlockID(); 2910aa66a32ba177338763cd0cf9df8310dfa2e24ff7Ted Kremenek break; 29111eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 2912aa66a32ba177338763cd0cf9df8310dfa2e24ff7Ted Kremenek case ProgramPoint::BlockExitKind: 2913aa66a32ba177338763cd0cf9df8310dfa2e24ff7Ted Kremenek assert (false); 2914aa66a32ba177338763cd0cf9df8310dfa2e24ff7Ted Kremenek break; 29151eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 2916102acd5369bbb17c0d6ab868af376671acff7a93Douglas Gregor case ProgramPoint::CallEnterKind: 2917102acd5369bbb17c0d6ab868af376671acff7a93Douglas Gregor Out << "CallEnter"; 2918102acd5369bbb17c0d6ab868af376671acff7a93Douglas Gregor break; 2919102acd5369bbb17c0d6ab868af376671acff7a93Douglas Gregor 2920102acd5369bbb17c0d6ab868af376671acff7a93Douglas Gregor case ProgramPoint::CallExitKind: 2921102acd5369bbb17c0d6ab868af376671acff7a93Douglas Gregor Out << "CallExit"; 2922102acd5369bbb17c0d6ab868af376671acff7a93Douglas Gregor break; 2923102acd5369bbb17c0d6ab868af376671acff7a93Douglas Gregor 2924aa66a32ba177338763cd0cf9df8310dfa2e24ff7Ted Kremenek default: { 29255f85e17df3f5b0a8021443f2b590daecfb2cbd17Ted Kremenek if (StmtPoint *L = dyn_cast<StmtPoint>(&Loc)) { 29269c378f705405d37f49795d5e915989de774fe11fTed Kremenek const Stmt *S = L->getStmt(); 29278c354758c2d39db87c77c723d81e34b4d967f762Ted Kremenek SourceLocation SLoc = S->getLocStart(); 29288c354758c2d39db87c77c723d81e34b4d967f762Ted Kremenek 29291eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump Out << S->getStmtClassName() << ' ' << (void*) S << ' '; 2930e4f2142d00fa5fdb580c4e2413da91882d955381Chris Lattner LangOptions LO; // FIXME. 2931e4f2142d00fa5fdb580c4e2413da91882d955381Chris Lattner S->printPretty(Out, 0, PrintingPolicy(LO)); 29321eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 29331eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump if (SLoc.isFileID()) { 29348c354758c2d39db87c77c723d81e34b4d967f762Ted Kremenek Out << "\\lline=" 2935642116259e8df6286063a17361c20e95b5017a0aChandler Carruth << GraphPrintSourceManager->getExpansionLineNumber(SLoc) 29367da5aea7669e6db3e593162b8a123aef06a04d07Chris Lattner << " col=" 2937a77c031cb66f75d22672070052cc6e0205289ff8Chandler Carruth << GraphPrintSourceManager->getExpansionColumnNumber(SLoc) 29387da5aea7669e6db3e593162b8a123aef06a04d07Chris Lattner << "\\l"; 29398c354758c2d39db87c77c723d81e34b4d967f762Ted Kremenek } 29401eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 29415f85e17df3f5b0a8021443f2b590daecfb2cbd17Ted Kremenek if (isa<PreStmt>(Loc)) 29421eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump Out << "\\lPreStmt\\l;"; 29435f85e17df3f5b0a8021443f2b590daecfb2cbd17Ted Kremenek else if (isa<PostLoad>(Loc)) 29447090d5465de7ca620da16211cf886edf1edc1f1fTed Kremenek Out << "\\lPostLoad\\l;"; 29457090d5465de7ca620da16211cf886edf1edc1f1fTed Kremenek else if (isa<PostStore>(Loc)) 29467090d5465de7ca620da16211cf886edf1edc1f1fTed Kremenek Out << "\\lPostStore\\l"; 29477090d5465de7ca620da16211cf886edf1edc1f1fTed Kremenek else if (isa<PostLValue>(Loc)) 29487090d5465de7ca620da16211cf886edf1edc1f1fTed Kremenek Out << "\\lPostLValue\\l"; 29491eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 295010f51e8785e43d5a22acc2d2a638307c582949c2Ted Kremenek#if 0 295110f51e8785e43d5a22acc2d2a638307c582949c2Ted Kremenek // FIXME: Replace with a general scheme to determine 295210f51e8785e43d5a22acc2d2a638307c582949c2Ted Kremenek // the name of the check. 29538c354758c2d39db87c77c723d81e34b4d967f762Ted Kremenek if (GraphPrintCheckerState->isImplicitNullDeref(N)) 29548c354758c2d39db87c77c723d81e34b4d967f762Ted Kremenek Out << "\\|Implicit-Null Dereference.\\l"; 29558c354758c2d39db87c77c723d81e34b4d967f762Ted Kremenek else if (GraphPrintCheckerState->isExplicitNullDeref(N)) 29568c354758c2d39db87c77c723d81e34b4d967f762Ted Kremenek Out << "\\|Explicit-Null Dereference.\\l"; 29578c354758c2d39db87c77c723d81e34b4d967f762Ted Kremenek else if (GraphPrintCheckerState->isUndefDeref(N)) 29588c354758c2d39db87c77c723d81e34b4d967f762Ted Kremenek Out << "\\|Dereference of undefialied value.\\l"; 29598c354758c2d39db87c77c723d81e34b4d967f762Ted Kremenek else if (GraphPrintCheckerState->isUndefStore(N)) 29608c354758c2d39db87c77c723d81e34b4d967f762Ted Kremenek Out << "\\|Store to Undefined Loc."; 29618c354758c2d39db87c77c723d81e34b4d967f762Ted Kremenek else if (GraphPrintCheckerState->isUndefResult(N)) 29628c354758c2d39db87c77c723d81e34b4d967f762Ted Kremenek Out << "\\|Result of operation is undefined."; 29638c354758c2d39db87c77c723d81e34b4d967f762Ted Kremenek else if (GraphPrintCheckerState->isNoReturnCall(N)) 29648c354758c2d39db87c77c723d81e34b4d967f762Ted Kremenek Out << "\\|Call to function marked \"noreturn\"."; 29658c354758c2d39db87c77c723d81e34b4d967f762Ted Kremenek else if (GraphPrintCheckerState->isBadCall(N)) 29668c354758c2d39db87c77c723d81e34b4d967f762Ted Kremenek Out << "\\|Call to NULL/Undefined."; 29678c354758c2d39db87c77c723d81e34b4d967f762Ted Kremenek else if (GraphPrintCheckerState->isUndefArg(N)) 29688c354758c2d39db87c77c723d81e34b4d967f762Ted Kremenek Out << "\\|Argument in call is undefined"; 296910f51e8785e43d5a22acc2d2a638307c582949c2Ted Kremenek#endif 29701eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 29718c354758c2d39db87c77c723d81e34b4d967f762Ted Kremenek break; 29728c354758c2d39db87c77c723d81e34b4d967f762Ted Kremenek } 29738c354758c2d39db87c77c723d81e34b4d967f762Ted Kremenek 29749c378f705405d37f49795d5e915989de774fe11fTed Kremenek const BlockEdge &E = cast<BlockEdge>(Loc); 2975aa66a32ba177338763cd0cf9df8310dfa2e24ff7Ted Kremenek Out << "Edge: (B" << E.getSrc()->getBlockID() << ", B" 2976aa66a32ba177338763cd0cf9df8310dfa2e24ff7Ted Kremenek << E.getDst()->getBlockID() << ')'; 29771eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 29789c378f705405d37f49795d5e915989de774fe11fTed Kremenek if (const Stmt *T = E.getSrc()->getTerminator()) { 29791eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 2980e97ca065c91ff9ca2a2a42eb443eaa553c40441cTed Kremenek SourceLocation SLoc = T->getLocStart(); 29811eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 2982b38911f16b4943548db6a3695fc6ae23070b25d2Ted Kremenek Out << "\\|Terminator: "; 2983e4f2142d00fa5fdb580c4e2413da91882d955381Chris Lattner LangOptions LO; // FIXME. 2984e4f2142d00fa5fdb580c4e2413da91882d955381Chris Lattner E.getSrc()->printTerminator(Out, LO); 29851eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 29869b5551d7f0209cec8b9c555cf70e893940674e5cTed Kremenek if (SLoc.isFileID()) { 29879b5551d7f0209cec8b9c555cf70e893940674e5cTed Kremenek Out << "\\lline=" 2988642116259e8df6286063a17361c20e95b5017a0aChandler Carruth << GraphPrintSourceManager->getExpansionLineNumber(SLoc) 29897da5aea7669e6db3e593162b8a123aef06a04d07Chris Lattner << " col=" 2990a77c031cb66f75d22672070052cc6e0205289ff8Chandler Carruth << GraphPrintSourceManager->getExpansionColumnNumber(SLoc); 29919b5551d7f0209cec8b9c555cf70e893940674e5cTed Kremenek } 29921eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 2993daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek if (isa<SwitchStmt>(T)) { 29949c378f705405d37f49795d5e915989de774fe11fTed Kremenek const Stmt *Label = E.getDst()->getLabel(); 29951eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 29961eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump if (Label) { 29979c378f705405d37f49795d5e915989de774fe11fTed Kremenek if (const CaseStmt *C = dyn_cast<CaseStmt>(Label)) { 2998daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek Out << "\\lcase "; 2999e4f2142d00fa5fdb580c4e2413da91882d955381Chris Lattner LangOptions LO; // FIXME. 3000e4f2142d00fa5fdb580c4e2413da91882d955381Chris Lattner C->getLHS()->printPretty(Out, 0, PrintingPolicy(LO)); 30011eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 30029c378f705405d37f49795d5e915989de774fe11fTed Kremenek if (const Stmt *RHS = C->getRHS()) { 3003daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek Out << " .. "; 3004e4f2142d00fa5fdb580c4e2413da91882d955381Chris Lattner RHS->printPretty(Out, 0, PrintingPolicy(LO)); 3005daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek } 30061eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 3007daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek Out << ":"; 3008daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek } 3009daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek else { 3010daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek assert (isa<DefaultStmt>(Label)); 3011daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek Out << "\\ldefault:"; 3012daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek } 3013daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek } 30141eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump else 3015daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek Out << "\\l(implicit) default:"; 3016daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek } 3017daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek else if (isa<IndirectGotoStmt>(T)) { 3018b38911f16b4943548db6a3695fc6ae23070b25d2Ted Kremenek // FIXME 3019b38911f16b4943548db6a3695fc6ae23070b25d2Ted Kremenek } 3020b38911f16b4943548db6a3695fc6ae23070b25d2Ted Kremenek else { 3021b38911f16b4943548db6a3695fc6ae23070b25d2Ted Kremenek Out << "\\lCondition: "; 3022b38911f16b4943548db6a3695fc6ae23070b25d2Ted Kremenek if (*E.getSrc()->succ_begin() == E.getDst()) 3023b38911f16b4943548db6a3695fc6ae23070b25d2Ted Kremenek Out << "true"; 3024b38911f16b4943548db6a3695fc6ae23070b25d2Ted Kremenek else 30251eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump Out << "false"; 3026b38911f16b4943548db6a3695fc6ae23070b25d2Ted Kremenek } 30271eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 3028b38911f16b4943548db6a3695fc6ae23070b25d2Ted Kremenek Out << "\\l"; 3029b38911f16b4943548db6a3695fc6ae23070b25d2Ted Kremenek } 30301eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 303110f51e8785e43d5a22acc2d2a638307c582949c2Ted Kremenek#if 0 303210f51e8785e43d5a22acc2d2a638307c582949c2Ted Kremenek // FIXME: Replace with a general scheme to determine 303310f51e8785e43d5a22acc2d2a638307c582949c2Ted Kremenek // the name of the check. 30344a4e524afef40d6f3ddb25d0e407c814e4ca56a8Ted Kremenek if (GraphPrintCheckerState->isUndefControlFlow(N)) { 30354a4e524afef40d6f3ddb25d0e407c814e4ca56a8Ted Kremenek Out << "\\|Control-flow based on\\lUndefined value.\\l"; 30363b4f6702860208692f6ef28401e68de4e3ff9af9Ted Kremenek } 303710f51e8785e43d5a22acc2d2a638307c582949c2Ted Kremenek#endif 3038aa66a32ba177338763cd0cf9df8310dfa2e24ff7Ted Kremenek } 3039aa66a32ba177338763cd0cf9df8310dfa2e24ff7Ted Kremenek } 30401eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 304118c66fdc3c4008d335885695fe36fb5353c5f672Ted Kremenek const ProgramState *state = N->getState(); 30428673a68a8ab55a2bd03f92d636a50e6b0bfad2daTed Kremenek Out << "\\|StateID: " << (void*) state 30438673a68a8ab55a2bd03f92d636a50e6b0bfad2daTed Kremenek << " NodeID: " << (void*) N << "\\|"; 3044c179a7fbb294fe3ff6cf5479f6239a10f39628c7Zhongxing Xu state->printDOT(Out, *N->getLocationContext()->getCFG()); 3045ca804539d908d3a0e8c72a0df5f1f571d29490bbTed Kremenek 3046ca804539d908d3a0e8c72a0df5f1f571d29490bbTed Kremenek Out << "\\l"; 3047ca804539d908d3a0e8c72a0df5f1f571d29490bbTed Kremenek 3048ca804539d908d3a0e8c72a0df5f1f571d29490bbTed Kremenek if (const ProgramPointTag *tag = Loc.getTag()) { 3049ca804539d908d3a0e8c72a0df5f1f571d29490bbTed Kremenek Out << "\\|Tag: " << tag->getTagDescription(); 3050ca804539d908d3a0e8c72a0df5f1f571d29490bbTed Kremenek Out << "\\l"; 3051ca804539d908d3a0e8c72a0df5f1f571d29490bbTed Kremenek } 3052aa66a32ba177338763cd0cf9df8310dfa2e24ff7Ted Kremenek return Out.str(); 3053aa66a32ba177338763cd0cf9df8310dfa2e24ff7Ted Kremenek } 3054aa66a32ba177338763cd0cf9df8310dfa2e24ff7Ted Kremenek}; 30551eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump} // end llvm namespace 3056aa66a32ba177338763cd0cf9df8310dfa2e24ff7Ted Kremenek#endif 3057aa66a32ba177338763cd0cf9df8310dfa2e24ff7Ted Kremenek 3058ffe0f43806d4823271c2406c1fccc2373115c36aTed Kremenek#ifndef NDEBUG 30597ec07fd91f6eae8bd619ebb8512805222ca41c92Ted Kremenektemplate <typename ITERATOR> 30609c378f705405d37f49795d5e915989de774fe11fTed KremenekExplodedNode *GetGraphNode(ITERATOR I) { return *I; } 30617ec07fd91f6eae8bd619ebb8512805222ca41c92Ted Kremenek 3062031ccc0555a82afc2e8afe29e19dd57ff204e2deZhongxing Xutemplate <> ExplodedNode* 3063031ccc0555a82afc2e8afe29e19dd57ff204e2deZhongxing XuGetGraphNode<llvm::DenseMap<ExplodedNode*, Expr*>::iterator> 3064031ccc0555a82afc2e8afe29e19dd57ff204e2deZhongxing Xu (llvm::DenseMap<ExplodedNode*, Expr*>::iterator I) { 30657ec07fd91f6eae8bd619ebb8512805222ca41c92Ted Kremenek return I->first; 30667ec07fd91f6eae8bd619ebb8512805222ca41c92Ted Kremenek} 3067ffe0f43806d4823271c2406c1fccc2373115c36aTed Kremenek#endif 3068ffe0f43806d4823271c2406c1fccc2373115c36aTed Kremenek 3069d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidisvoid ExprEngine::ViewGraph(bool trim) { 30701eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump#ifndef NDEBUG 3071ffe0f43806d4823271c2406c1fccc2373115c36aTed Kremenek if (trim) { 3072031ccc0555a82afc2e8afe29e19dd57ff204e2deZhongxing Xu std::vector<ExplodedNode*> Src; 3073940abcc574580e454689be801f38a3d4d41ab01fTed Kremenek 3074940abcc574580e454689be801f38a3d4d41ab01fTed Kremenek // Flush any outstanding reports to make sure we cover all the nodes. 3075940abcc574580e454689be801f38a3d4d41ab01fTed Kremenek // This does not cause them to get displayed. 3076940abcc574580e454689be801f38a3d4d41ab01fTed Kremenek for (BugReporter::iterator I=BR.begin(), E=BR.end(); I!=E; ++I) 3077940abcc574580e454689be801f38a3d4d41ab01fTed Kremenek const_cast<BugType*>(*I)->FlushReports(BR); 3078940abcc574580e454689be801f38a3d4d41ab01fTed Kremenek 3079940abcc574580e454689be801f38a3d4d41ab01fTed Kremenek // Iterate through the reports and get their nodes. 3080404fc3ad6bd844bf8ce70cbf9974ab297704a122Argyrios Kyrtzidis for (BugReporter::EQClasses_iterator 3081404fc3ad6bd844bf8ce70cbf9974ab297704a122Argyrios Kyrtzidis EI = BR.EQClasses_begin(), EE = BR.EQClasses_end(); EI != EE; ++EI) { 3082404fc3ad6bd844bf8ce70cbf9974ab297704a122Argyrios Kyrtzidis BugReportEquivClass& EQ = *EI; 3083404fc3ad6bd844bf8ce70cbf9974ab297704a122Argyrios Kyrtzidis const BugReport &R = **EQ.begin(); 3084404fc3ad6bd844bf8ce70cbf9974ab297704a122Argyrios Kyrtzidis ExplodedNode *N = const_cast<ExplodedNode*>(R.getErrorNode()); 3085404fc3ad6bd844bf8ce70cbf9974ab297704a122Argyrios Kyrtzidis if (N) Src.push_back(N); 3086940abcc574580e454689be801f38a3d4d41ab01fTed Kremenek } 30871eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 30887ec07fd91f6eae8bd619ebb8512805222ca41c92Ted Kremenek ViewGraph(&Src[0], &Src[0]+Src.size()); 3089ffe0f43806d4823271c2406c1fccc2373115c36aTed Kremenek } 3090493d7a26d5ea319770ba904b43f2740d43b820cbTed Kremenek else { 3091493d7a26d5ea319770ba904b43f2740d43b820cbTed Kremenek GraphPrintCheckerState = this; 3092493d7a26d5ea319770ba904b43f2740d43b820cbTed Kremenek GraphPrintSourceManager = &getContext().getSourceManager(); 3093ae6814efb6c41bd0c0f6413d25097105284d5be7Ted Kremenek 3094d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidis llvm::ViewGraph(*G.roots_begin(), "ExprEngine"); 30951eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 3096493d7a26d5ea319770ba904b43f2740d43b820cbTed Kremenek GraphPrintCheckerState = NULL; 3097493d7a26d5ea319770ba904b43f2740d43b820cbTed Kremenek GraphPrintSourceManager = NULL; 3098493d7a26d5ea319770ba904b43f2740d43b820cbTed Kremenek } 3099493d7a26d5ea319770ba904b43f2740d43b820cbTed Kremenek#endif 3100493d7a26d5ea319770ba904b43f2740d43b820cbTed Kremenek} 3101493d7a26d5ea319770ba904b43f2740d43b820cbTed Kremenek 3102d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidisvoid ExprEngine::ViewGraph(ExplodedNode** Beg, ExplodedNode** End) { 3103493d7a26d5ea319770ba904b43f2740d43b820cbTed Kremenek#ifndef NDEBUG 3104493d7a26d5ea319770ba904b43f2740d43b820cbTed Kremenek GraphPrintCheckerState = this; 3105493d7a26d5ea319770ba904b43f2740d43b820cbTed Kremenek GraphPrintSourceManager = &getContext().getSourceManager(); 31061eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 3107031ccc0555a82afc2e8afe29e19dd57ff204e2deZhongxing Xu std::auto_ptr<ExplodedGraph> TrimmedG(G.Trim(Beg, End).first); 3108493d7a26d5ea319770ba904b43f2740d43b820cbTed Kremenek 3109cf118d41f7930a18dce97416ef7834a62642f587Ted Kremenek if (!TrimmedG.get()) 31106cb7c1a43b0c8f739d1f54b7fdae5ede86033496Benjamin Kramer llvm::errs() << "warning: Trimmed ExplodedGraph is empty.\n"; 3111cf118d41f7930a18dce97416ef7834a62642f587Ted Kremenek else 3112d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidis llvm::ViewGraph(*TrimmedG->roots_begin(), "TrimmedExprEngine"); 31131eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 31143b4f6702860208692f6ef28401e68de4e3ff9af9Ted Kremenek GraphPrintCheckerState = NULL; 3115e97ca065c91ff9ca2a2a42eb443eaa553c40441cTed Kremenek GraphPrintSourceManager = NULL; 3116e01c98767dfd7153c3c84637c36659e3bbe16ff7Ted Kremenek#endif 3117ee98546b0d5f3439c4a590b0d7d1545af794a0ecTed Kremenek} 3118