ExprEngine.cpp revision 651f13cea278ec967336033dd032faef0e9fc2ec
1d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidis//=-- ExprEngine.cpp - Path-Sensitive Expression-Level Dataflow ---*- C++ -*-= 264924859b6b09d1cfb62fecf5954ec6c27cb58feTed Kremenek// 34af84313df0d2710fd57af89132e680294225cadTed Kremenek// The LLVM Compiler Infrastructure 4d27f8169f4b68337a489547a41ac45bf7a5d1ddfTed Kremenek// 5d27f8169f4b68337a489547a41ac45bf7a5d1ddfTed Kremenek// This file is distributed under the University of Illinois Open Source 6d27f8169f4b68337a489547a41ac45bf7a5d1ddfTed Kremenek// License. See LICENSE.TXT for details. 7d27f8169f4b68337a489547a41ac45bf7a5d1ddfTed Kremenek// 8d27f8169f4b68337a489547a41ac45bf7a5d1ddfTed Kremenek//===----------------------------------------------------------------------===// 9d27f8169f4b68337a489547a41ac45bf7a5d1ddfTed Kremenek// 1077349cb20bfd7069d081f84c91975bfa8ef60a32Ted Kremenek// This file defines a meta-engine for path-sensitive dataflow analysis that 1177349cb20bfd7069d081f84c91975bfa8ef60a32Ted Kremenek// is built on GREngine, but provides the boilerplate to execute transfer 1277349cb20bfd7069d081f84c91975bfa8ef60a32Ted Kremenek// functions and build the ExplodedGraph at the expression level. 13d27f8169f4b68337a489547a41ac45bf7a5d1ddfTed Kremenek// 14d27f8169f4b68337a489547a41ac45bf7a5d1ddfTed Kremenek//===----------------------------------------------------------------------===// 15a7af5ea88a6c5bdf87497cca6c20831e8c546751Argyrios Kyrtzidis 16c2994283aa7538b7420c8e398cde7afa328d7042Anna Zaks#define DEBUG_TYPE "ExprEngine" 17c2994283aa7538b7420c8e398cde7afa328d7042Anna Zaks 189b663716449b618ba0390b1dbebc54fa8e971124Ted Kremenek#include "clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h" 19ac7cc2d37e82181e73fcc265c1d0a619d18b7605Jordan Rose#include "PrettyStackTraceLocationContext.h" 20199c3d6cd16aebbb9c7f0d42af9d922c9628bf70Ken Dyck#include "clang/AST/CharUnits.h" 2116f0049415ec596504891259e2a83e19871c0d52Chris Lattner#include "clang/AST/ParentMap.h" 22337e4dbc6859589b8878146a88bebf754e916702Ted Kremenek#include "clang/AST/StmtCXX.h" 2355fc873017f10f6f566b182b70f6fc22aefa3464Chandler Carruth#include "clang/AST/StmtObjC.h" 241b63e4f732dbc73d90abf886b4d21f8e3a165f6dChris Lattner#include "clang/Basic/Builtins.h" 250bed8a12f2878d3cd94fb8bdba55b593d92dd11aTed Kremenek#include "clang/Basic/PrettyStackTrace.h" 2655fc873017f10f6f566b182b70f6fc22aefa3464Chandler Carruth#include "clang/Basic/SourceManager.h" 2755fc873017f10f6f566b182b70f6fc22aefa3464Chandler Carruth#include "clang/StaticAnalyzer/Core/BugReporter/BugType.h" 2855fc873017f10f6f566b182b70f6fc22aefa3464Chandler Carruth#include "clang/StaticAnalyzer/Core/CheckerManager.h" 2955fc873017f10f6f566b182b70f6fc22aefa3464Chandler Carruth#include "clang/StaticAnalyzer/Core/PathSensitive/AnalysisManager.h" 3055fc873017f10f6f566b182b70f6fc22aefa3464Chandler Carruth#include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h" 316cb7c1a43b0c8f739d1f54b7fdae5ede86033496Benjamin Kramer#include "llvm/ADT/ImmutableList.h" 32c2994283aa7538b7420c8e398cde7afa328d7042Anna Zaks#include "llvm/ADT/Statistic.h" 3355fc873017f10f6f566b182b70f6fc22aefa3464Chandler Carruth#include "llvm/Support/raw_ostream.h" 344323a57627e796dcfdfdb7d47672dc09ed308edaTed Kremenek 350f5f0595d6a038843a7051c5a65fca7bce2915a0Ted Kremenek#ifndef NDEBUG 360f5f0595d6a038843a7051c5a65fca7bce2915a0Ted Kremenek#include "llvm/Support/GraphWriter.h" 370f5f0595d6a038843a7051c5a65fca7bce2915a0Ted Kremenek#endif 380f5f0595d6a038843a7051c5a65fca7bce2915a0Ted Kremenek 39b387a3f23e423d62c053be86294b703da1d1a222Ted Kremenekusing namespace clang; 409ef6537a894c33003359b1f9b9676e9178e028b7Ted Kremenekusing namespace ento; 41b387a3f23e423d62c053be86294b703da1d1a222Ted Kremenekusing llvm::APSInt; 42ab2b8c54bca82866876f91e756788916d3fa20c3Ted Kremenek 43c2994283aa7538b7420c8e398cde7afa328d7042Anna ZaksSTATISTIC(NumRemoveDeadBindings, 44c2994283aa7538b7420c8e398cde7afa328d7042Anna Zaks "The # of times RemoveDeadBindings is called"); 45749bbe6f5f23676244f12a0d41511c8e73516febAnna ZaksSTATISTIC(NumMaxBlockCountReached, 46749bbe6f5f23676244f12a0d41511c8e73516febAnna Zaks "The # of aborted paths due to reaching the maximum block count in " 47749bbe6f5f23676244f12a0d41511c8e73516febAnna Zaks "a top level function"); 48749bbe6f5f23676244f12a0d41511c8e73516febAnna ZaksSTATISTIC(NumMaxBlockCountReachedInInlined, 49749bbe6f5f23676244f12a0d41511c8e73516febAnna Zaks "The # of aborted paths due to reaching the maximum block count in " 50749bbe6f5f23676244f12a0d41511c8e73516febAnna Zaks "an inlined function"); 515903a373db3d27794c90b25687e0dd6adb0e497dAnna ZaksSTATISTIC(NumTimesRetriedWithoutInlining, 525903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks "The # of times we re-evaluated a call without inlining"); 535903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks 54e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek//===----------------------------------------------------------------------===// 55bdb435ddaafd5069becd543d638112f68825b89dTed Kremenek// Engine construction and deletion. 56bdb435ddaafd5069becd543d638112f68825b89dTed Kremenek//===----------------------------------------------------------------------===// 57bdb435ddaafd5069becd543d638112f68825b89dTed Kremenek 58651f13cea278ec967336033dd032faef0e9fc2ecStephen Hinesstatic const char* TagProviderName = "ExprEngine"; 59651f13cea278ec967336033dd032faef0e9fc2ecStephen Hines 603fd5f370a28552976c52e76c3035d79012d78ddaAnna ZaksExprEngine::ExprEngine(AnalysisManager &mgr, bool gcEnabled, 61fbcb3f11fc90e9f00e6074e9b118b8dc11ca604cAnna Zaks SetOfConstDecls *VisitedCalleesIn, 6275f31c4862643ab09479c979fabf754e7ffe1460Anna Zaks FunctionSummariesTy *FS, 6375f31c4862643ab09479c979fabf754e7ffe1460Anna Zaks InliningModes HowToInlineIn) 6425e695b2d574d919cc1bbddf3a2efe073d449b1cZhongxing Xu : AMgr(mgr), 651d26f48dc2eea1c07431ca1519d7034a21b9bcffTed Kremenek AnalysisDeclContexts(mgr.getAnalysisDeclContextManager()), 66fbcb3f11fc90e9f00e6074e9b118b8dc11ca604cAnna Zaks Engine(*this, FS), 67d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidis G(Engine.getGraph()), 68c77a55126fcad66fb086f8e100a494caa2496a2dZhongxing Xu StateMgr(getContext(), mgr.getStoreManagerCreator(), 6932a58084a4c53e6938dd81bfce224db25a5976d1Ted Kremenek mgr.getConstraintManagerCreator(), G.getAllocator(), 70ca5d78d0bc3010164f2f9682967d64d7e305a167Jordan Rose this), 7150a6d0ce344c02782e0207574005c3b2aaa5077cTed Kremenek SymMgr(StateMgr.getSymbolManager()), 72c8413fd03f73084a5c93028f8b4db619fc388087Ted Kremenek svalBuilder(StateMgr.getSValBuilder()), 739428723d6730f4fd257e15b78d24991ae95bbd84Jordan Rose currStmtIdx(0), currBldrCtx(0), 744ef19205b6912316296db74a9073ad6fa60e4ccaTed Kremenek ObjCNoRet(mgr.getASTContext()), 75fbcb3f11fc90e9f00e6074e9b118b8dc11ca604cAnna Zaks ObjCGCEnabled(gcEnabled), BR(mgr, *this), 7675f31c4862643ab09479c979fabf754e7ffe1460Anna Zaks VisitedCallees(VisitedCalleesIn), 7775f31c4862643ab09479c979fabf754e7ffe1460Anna Zaks HowToInline(HowToInlineIn) 78255d4d4226b24036ceb11228fbb74286e58620f7Ted Kremenek{ 794d9e497a2b1eab3b1214848216050c64fc3acfd6Jordan Rose unsigned TrimInterval = mgr.options.getGraphTrimInterval(); 804d9e497a2b1eab3b1214848216050c64fc3acfd6Jordan Rose if (TrimInterval != 0) { 814d9e497a2b1eab3b1214848216050c64fc3acfd6Jordan Rose // Enable eager node reclaimation when constructing the ExplodedGraph. 824d9e497a2b1eab3b1214848216050c64fc3acfd6Jordan Rose G.enableNodeReclamation(TrimInterval); 834d9e497a2b1eab3b1214848216050c64fc3acfd6Jordan Rose } 84c80135ba857da48173578b9c528fce6777e18168Ted Kremenek} 8550a6d0ce344c02782e0207574005c3b2aaa5077cTed Kremenek 86d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios KyrtzidisExprEngine::~ExprEngine() { 87cf118d41f7930a18dce97416ef7834a62642f587Ted Kremenek BR.FlushReports(); 8850a6d0ce344c02782e0207574005c3b2aaa5077cTed Kremenek} 8950a6d0ce344c02782e0207574005c3b2aaa5077cTed Kremenek 90e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek//===----------------------------------------------------------------------===// 91e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek// Utility methods. 92e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek//===----------------------------------------------------------------------===// 93e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek 948bef8238181a30e52dea380789a7e2d760eac532Ted KremenekProgramStateRef ExprEngine::getInitialState(const LocationContext *InitLoc) { 958bef8238181a30e52dea380789a7e2d760eac532Ted Kremenek ProgramStateRef state = StateMgr.getInitialState(InitLoc); 96a078ecf3484d62b01d9f8c01e0fecffd65c583e1Ted Kremenek const Decl *D = InitLoc->getDecl(); 971eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 98cfcd7fd0de701c5ce05e96de1ed2d0bf8c7035d9Ted Kremenek // Preconditions. 9952e5602056e4cade24cbcca57767e94e1d430b03Ted Kremenek // FIXME: It would be nice if we had a more general mechanism to add 10052e5602056e4cade24cbcca57767e94e1d430b03Ted Kremenek // such preconditions. Some day. 1015974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek do { 102a078ecf3484d62b01d9f8c01e0fecffd65c583e1Ted Kremenek 1035974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek if (const FunctionDecl *FD = dyn_cast<FunctionDecl>(D)) { 1045974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek // Precondition: the first argument of 'main' is an integer guaranteed 1055974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek // to be > 0. 1065974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek const IdentifierInfo *II = FD->getIdentifier(); 1075974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek if (!II || !(II->getName() == "main" && FD->getNumParams() > 0)) 1085974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek break; 1095974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek 1105974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek const ParmVarDecl *PD = FD->getParamDecl(0); 1115974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek QualType T = PD->getType(); 112a5796f87229b4aeebca71fa6ee1790ae7a5a0382Jordan Rose const BuiltinType *BT = dyn_cast<BuiltinType>(T); 113a5796f87229b4aeebca71fa6ee1790ae7a5a0382Jordan Rose if (!BT || !BT->isInteger()) 1145974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek break; 115b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 1165974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek const MemRegion *R = state->getRegion(PD, InitLoc); 1175974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek if (!R) 1185974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek break; 119b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 1201397663af9dbcc24dbf0e11de43931b3dc08fdbbTed Kremenek SVal V = state->getSVal(loc::MemRegionVal(R)); 1219c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek SVal Constraint_untested = evalBinOp(state, BO_GT, V, 122c8413fd03f73084a5c93028f8b4db619fc388087Ted Kremenek svalBuilder.makeZeroVal(T), 123651f13cea278ec967336033dd032faef0e9fc2ecStephen Hines svalBuilder.getConditionType()); 1245974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek 125dc84cd5efdd3430efb22546b4ac656aa0540b210David Blaikie Optional<DefinedOrUnknownSVal> Constraint = 126dc84cd5efdd3430efb22546b4ac656aa0540b210David Blaikie Constraint_untested.getAs<DefinedOrUnknownSVal>(); 127b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 1285974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek if (!Constraint) 1295974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek break; 130b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 1318bef8238181a30e52dea380789a7e2d760eac532Ted Kremenek if (ProgramStateRef newState = state->assume(*Constraint, true)) 1325974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek state = newState; 13352e5602056e4cade24cbcca57767e94e1d430b03Ted Kremenek } 134a078ecf3484d62b01d9f8c01e0fecffd65c583e1Ted Kremenek break; 135a078ecf3484d62b01d9f8c01e0fecffd65c583e1Ted Kremenek } 136a078ecf3484d62b01d9f8c01e0fecffd65c583e1Ted Kremenek while (0); 137a078ecf3484d62b01d9f8c01e0fecffd65c583e1Ted Kremenek 138a078ecf3484d62b01d9f8c01e0fecffd65c583e1Ted Kremenek if (const ObjCMethodDecl *MD = dyn_cast<ObjCMethodDecl>(D)) { 139a078ecf3484d62b01d9f8c01e0fecffd65c583e1Ted Kremenek // Precondition: 'self' is always non-null upon entry to an Objective-C 140a078ecf3484d62b01d9f8c01e0fecffd65c583e1Ted Kremenek // method. 141a078ecf3484d62b01d9f8c01e0fecffd65c583e1Ted Kremenek const ImplicitParamDecl *SelfD = MD->getSelfDecl(); 142a078ecf3484d62b01d9f8c01e0fecffd65c583e1Ted Kremenek const MemRegion *R = state->getRegion(SelfD, InitLoc); 143a078ecf3484d62b01d9f8c01e0fecffd65c583e1Ted Kremenek SVal V = state->getSVal(loc::MemRegionVal(R)); 144a078ecf3484d62b01d9f8c01e0fecffd65c583e1Ted Kremenek 145dc84cd5efdd3430efb22546b4ac656aa0540b210David Blaikie if (Optional<Loc> LV = V.getAs<Loc>()) { 146a078ecf3484d62b01d9f8c01e0fecffd65c583e1Ted Kremenek // Assume that the pointer value in 'self' is non-null. 147a078ecf3484d62b01d9f8c01e0fecffd65c583e1Ted Kremenek state = state->assume(*LV, true); 148a078ecf3484d62b01d9f8c01e0fecffd65c583e1Ted Kremenek assert(state && "'self' cannot be null"); 149a078ecf3484d62b01d9f8c01e0fecffd65c583e1Ted Kremenek } 150a078ecf3484d62b01d9f8c01e0fecffd65c583e1Ted Kremenek } 1515974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek 152a078ecf3484d62b01d9f8c01e0fecffd65c583e1Ted Kremenek if (const CXXMethodDecl *MD = dyn_cast<CXXMethodDecl>(D)) { 153a078ecf3484d62b01d9f8c01e0fecffd65c583e1Ted Kremenek if (!MD->isStatic()) { 154a078ecf3484d62b01d9f8c01e0fecffd65c583e1Ted Kremenek // Precondition: 'this' is always non-null upon entry to the 155a078ecf3484d62b01d9f8c01e0fecffd65c583e1Ted Kremenek // top-level function. This is our starting assumption for 156a078ecf3484d62b01d9f8c01e0fecffd65c583e1Ted Kremenek // analyzing an "open" program. 157a078ecf3484d62b01d9f8c01e0fecffd65c583e1Ted Kremenek const StackFrameContext *SFC = InitLoc->getCurrentStackFrame(); 158a078ecf3484d62b01d9f8c01e0fecffd65c583e1Ted Kremenek if (SFC->getParent() == 0) { 15910f77ad7fc5e5cf3f37a9b14ff5843468b8b84d2Ted Kremenek loc::MemRegionVal L = svalBuilder.getCXXThis(MD, SFC); 160a078ecf3484d62b01d9f8c01e0fecffd65c583e1Ted Kremenek SVal V = state->getSVal(L); 161dc84cd5efdd3430efb22546b4ac656aa0540b210David Blaikie if (Optional<Loc> LV = V.getAs<Loc>()) { 162a078ecf3484d62b01d9f8c01e0fecffd65c583e1Ted Kremenek state = state->assume(*LV, true); 163a078ecf3484d62b01d9f8c01e0fecffd65c583e1Ted Kremenek assert(state && "'this' cannot be null"); 164a078ecf3484d62b01d9f8c01e0fecffd65c583e1Ted Kremenek } 1655974ec518289a719fdd18122060bbcfe49d439e3Ted Kremenek } 166cfcd7fd0de701c5ce05e96de1ed2d0bf8c7035d9Ted Kremenek } 167a078ecf3484d62b01d9f8c01e0fecffd65c583e1Ted Kremenek } 168a078ecf3484d62b01d9f8c01e0fecffd65c583e1Ted Kremenek 16952e5602056e4cade24cbcca57767e94e1d430b03Ted Kremenek return state; 170e070a1df66aab6d4168fb28f7559fdf996df3567Ted Kremenek} 171e070a1df66aab6d4168fb28f7559fdf996df3567Ted Kremenek 1725e5440ba9c135f523f72e7e7c5da59d390d697c5Jordan RoseProgramStateRef 1735e5440ba9c135f523f72e7e7c5da59d390d697c5Jordan RoseExprEngine::createTemporaryRegionIfNeeded(ProgramStateRef State, 1745e5440ba9c135f523f72e7e7c5da59d390d697c5Jordan Rose const LocationContext *LC, 1755e5440ba9c135f523f72e7e7c5da59d390d697c5Jordan Rose const Expr *Ex, 1765e5440ba9c135f523f72e7e7c5da59d390d697c5Jordan Rose const Expr *Result) { 17787193dac8f2c6c8f7ee1aa9eeb64622ec75c881bJordan Rose SVal V = State->getSVal(Ex, LC); 17808291a937a149dbd036fd6ac8ab061eb8034343dJordan Rose if (!Result) { 17908291a937a149dbd036fd6ac8ab061eb8034343dJordan Rose // If we don't have an explicit result expression, we're in "if needed" 18008291a937a149dbd036fd6ac8ab061eb8034343dJordan Rose // mode. Only create a region if the current value is a NonLoc. 18108291a937a149dbd036fd6ac8ab061eb8034343dJordan Rose if (!V.getAs<NonLoc>()) 18208291a937a149dbd036fd6ac8ab061eb8034343dJordan Rose return State; 18308291a937a149dbd036fd6ac8ab061eb8034343dJordan Rose Result = Ex; 18408291a937a149dbd036fd6ac8ab061eb8034343dJordan Rose } else { 18508291a937a149dbd036fd6ac8ab061eb8034343dJordan Rose // We need to create a region no matter what. For sanity, make sure we don't 18608291a937a149dbd036fd6ac8ab061eb8034343dJordan Rose // try to stuff a Loc into a non-pointer temporary region. 18728117be48de465bc2862a8f4aaab09338be5090bJordan Rose assert(!V.getAs<Loc>() || Loc::isLocType(Result->getType()) || 18828117be48de465bc2862a8f4aaab09338be5090bJordan Rose Result->getType()->isMemberPointerType()); 18908291a937a149dbd036fd6ac8ab061eb8034343dJordan Rose } 1905e5440ba9c135f523f72e7e7c5da59d390d697c5Jordan Rose 1915e5440ba9c135f523f72e7e7c5da59d390d697c5Jordan Rose ProgramStateManager &StateMgr = State->getStateManager(); 1925e5440ba9c135f523f72e7e7c5da59d390d697c5Jordan Rose MemRegionManager &MRMgr = StateMgr.getRegionManager(); 1935e5440ba9c135f523f72e7e7c5da59d390d697c5Jordan Rose StoreManager &StoreMgr = StateMgr.getStoreManager(); 1945e5440ba9c135f523f72e7e7c5da59d390d697c5Jordan Rose 1955e5440ba9c135f523f72e7e7c5da59d390d697c5Jordan Rose // We need to be careful about treating a derived type's value as 19608291a937a149dbd036fd6ac8ab061eb8034343dJordan Rose // bindings for a base type. Unless we're creating a temporary pointer region, 19708291a937a149dbd036fd6ac8ab061eb8034343dJordan Rose // start by stripping and recording base casts. 1985e5440ba9c135f523f72e7e7c5da59d390d697c5Jordan Rose SmallVector<const CastExpr *, 4> Casts; 1995e5440ba9c135f523f72e7e7c5da59d390d697c5Jordan Rose const Expr *Inner = Ex->IgnoreParens(); 20008291a937a149dbd036fd6ac8ab061eb8034343dJordan Rose if (!Loc::isLocType(Result->getType())) { 201eafb5c694cc5d165149fcb9453bc9355fb0d44a5Jordan Rose while (const CastExpr *CE = dyn_cast<CastExpr>(Inner)) { 202eafb5c694cc5d165149fcb9453bc9355fb0d44a5Jordan Rose if (CE->getCastKind() == CK_DerivedToBase || 203eafb5c694cc5d165149fcb9453bc9355fb0d44a5Jordan Rose CE->getCastKind() == CK_UncheckedDerivedToBase) 204eafb5c694cc5d165149fcb9453bc9355fb0d44a5Jordan Rose Casts.push_back(CE); 205eafb5c694cc5d165149fcb9453bc9355fb0d44a5Jordan Rose else if (CE->getCastKind() != CK_NoOp) 206eafb5c694cc5d165149fcb9453bc9355fb0d44a5Jordan Rose break; 2075e5440ba9c135f523f72e7e7c5da59d390d697c5Jordan Rose 208eafb5c694cc5d165149fcb9453bc9355fb0d44a5Jordan Rose Inner = CE->getSubExpr()->IgnoreParens(); 209eafb5c694cc5d165149fcb9453bc9355fb0d44a5Jordan Rose } 2105e5440ba9c135f523f72e7e7c5da59d390d697c5Jordan Rose } 211f1e67d75fc922ff905de9faa6326bb1a96685ec1Jordan Rose 2125e5440ba9c135f523f72e7e7c5da59d390d697c5Jordan Rose // Create a temporary object region for the inner expression (which may have 21308291a937a149dbd036fd6ac8ab061eb8034343dJordan Rose // a more derived type) and bind the value into it. 21476b5dd48c9dbf2ed3e5830060ea55b81b7d1cca0Pavel Labath const TypedValueRegion *TR = NULL; 21576b5dd48c9dbf2ed3e5830060ea55b81b7d1cca0Pavel Labath if (const MaterializeTemporaryExpr *MT = 21676b5dd48c9dbf2ed3e5830060ea55b81b7d1cca0Pavel Labath dyn_cast<MaterializeTemporaryExpr>(Result)) { 21776b5dd48c9dbf2ed3e5830060ea55b81b7d1cca0Pavel Labath StorageDuration SD = MT->getStorageDuration(); 21876b5dd48c9dbf2ed3e5830060ea55b81b7d1cca0Pavel Labath // If this object is bound to a reference with static storage duration, we 21976b5dd48c9dbf2ed3e5830060ea55b81b7d1cca0Pavel Labath // put it in a different region to prevent "address leakage" warnings. 22076b5dd48c9dbf2ed3e5830060ea55b81b7d1cca0Pavel Labath if (SD == SD_Static || SD == SD_Thread) 22176b5dd48c9dbf2ed3e5830060ea55b81b7d1cca0Pavel Labath TR = MRMgr.getCXXStaticTempObjectRegion(Inner); 22276b5dd48c9dbf2ed3e5830060ea55b81b7d1cca0Pavel Labath } 22376b5dd48c9dbf2ed3e5830060ea55b81b7d1cca0Pavel Labath if (!TR) 22476b5dd48c9dbf2ed3e5830060ea55b81b7d1cca0Pavel Labath TR = MRMgr.getCXXTempObjectRegion(Inner, LC); 22576b5dd48c9dbf2ed3e5830060ea55b81b7d1cca0Pavel Labath 22608291a937a149dbd036fd6ac8ab061eb8034343dJordan Rose SVal Reg = loc::MemRegionVal(TR); 22708291a937a149dbd036fd6ac8ab061eb8034343dJordan Rose 22808291a937a149dbd036fd6ac8ab061eb8034343dJordan Rose if (V.isUnknown()) 22908291a937a149dbd036fd6ac8ab061eb8034343dJordan Rose V = getSValBuilder().conjureSymbolVal(Result, LC, TR->getValueType(), 23008291a937a149dbd036fd6ac8ab061eb8034343dJordan Rose currBldrCtx->blockCount()); 2315e5440ba9c135f523f72e7e7c5da59d390d697c5Jordan Rose State = State->bindLoc(Reg, V); 2329f1d541ef1aca8f953e5bb4e7177969f0a2062d5Jordan Rose 2335e5440ba9c135f523f72e7e7c5da59d390d697c5Jordan Rose // Re-apply the casts (from innermost to outermost) for type sanity. 2345e5440ba9c135f523f72e7e7c5da59d390d697c5Jordan Rose for (SmallVectorImpl<const CastExpr *>::reverse_iterator I = Casts.rbegin(), 2355e5440ba9c135f523f72e7e7c5da59d390d697c5Jordan Rose E = Casts.rend(); 2365e5440ba9c135f523f72e7e7c5da59d390d697c5Jordan Rose I != E; ++I) { 2375e5440ba9c135f523f72e7e7c5da59d390d697c5Jordan Rose Reg = StoreMgr.evalDerivedToBase(Reg, *I); 238f1e67d75fc922ff905de9faa6326bb1a96685ec1Jordan Rose } 239f1e67d75fc922ff905de9faa6326bb1a96685ec1Jordan Rose 24008291a937a149dbd036fd6ac8ab061eb8034343dJordan Rose State = State->BindExpr(Result, LC, Reg); 241f1e67d75fc922ff905de9faa6326bb1a96685ec1Jordan Rose return State; 242f1e67d75fc922ff905de9faa6326bb1a96685ec1Jordan Rose} 243f1e67d75fc922ff905de9faa6326bb1a96685ec1Jordan Rose 244e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek//===----------------------------------------------------------------------===// 245e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek// Top-level transfer function logic (Dispatcher). 246e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek//===----------------------------------------------------------------------===// 247e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek 2489c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek/// evalAssume - Called by ConstraintManager. Used to call checker-specific 24932a58084a4c53e6938dd81bfce224db25a5976d1Ted Kremenek/// logic for handling assumptions on symbolic values. 2508bef8238181a30e52dea380789a7e2d760eac532Ted KremenekProgramStateRef ExprEngine::processAssume(ProgramStateRef state, 251fe27971d54d26997149d6b84057f04ff398d1d5dJordy Rose SVal cond, bool assumption) { 252fe27971d54d26997149d6b84057f04ff398d1d5dJordy Rose return getCheckerManager().runCheckersForEvalAssume(state, cond, assumption); 25332a58084a4c53e6938dd81bfce224db25a5976d1Ted Kremenek} 25432a58084a4c53e6938dd81bfce224db25a5976d1Ted Kremenek 2558bef8238181a30e52dea380789a7e2d760eac532Ted Kremenekbool ExprEngine::wantsRegionChangeUpdate(ProgramStateRef state) { 256183ff98f425d470c2a0276880aaf43496c9dad14Argyrios Kyrtzidis return getCheckerManager().wantsRegionChangeUpdate(state); 257c2b7dfaad674587cfd220ff447b3710d252130c3Jordy Rose} 258c2b7dfaad674587cfd220ff447b3710d252130c3Jordy Rose 2598bef8238181a30e52dea380789a7e2d760eac532Ted KremenekProgramStateRef 2608bef8238181a30e52dea380789a7e2d760eac532Ted KremenekExprEngine::processRegionChanges(ProgramStateRef state, 261bf53dfac8195835028bd6347433f7dbebcc29fc1Anna Zaks const InvalidatedSymbols *invalidated, 262537716ad8dd10f984b6cfe6985afade1185c5e3cJordy Rose ArrayRef<const MemRegion *> Explicits, 26366c40400e7d6272b0cd675ada18dd62c1f0362c7Anna Zaks ArrayRef<const MemRegion *> Regions, 264740d490593e0de8732a697c9f77b90ddd463863bJordan Rose const CallEvent *Call) { 26535bdbf40624beba3fc00cb72ab444659939c1a6bTed Kremenek return getCheckerManager().runCheckersForRegionChanges(state, invalidated, 26666c40400e7d6272b0cd675ada18dd62c1f0362c7Anna Zaks Explicits, Regions, Call); 267c2b7dfaad674587cfd220ff447b3710d252130c3Jordy Rose} 268c2b7dfaad674587cfd220ff447b3710d252130c3Jordy Rose 2698bef8238181a30e52dea380789a7e2d760eac532Ted Kremenekvoid ExprEngine::printState(raw_ostream &Out, ProgramStateRef State, 270dbd658e139b3e0bf084f75feaea8d844af9e319fJordy Rose const char *NL, const char *Sep) { 271dbd658e139b3e0bf084f75feaea8d844af9e319fJordy Rose getCheckerManager().runCheckersForPrintState(Out, State, NL, Sep); 272dbd658e139b3e0bf084f75feaea8d844af9e319fJordy Rose} 273dbd658e139b3e0bf084f75feaea8d844af9e319fJordy Rose 274e36de1fe51c39d9161915dd3dbef880954af6476Ted Kremenekvoid ExprEngine::processEndWorklist(bool hasWorkRemaining) { 27530726c6baee1417307236e854f1474fdb3cedb98Argyrios Kyrtzidis getCheckerManager().runCheckersForEndAnalysis(G, BR, *this); 276ccc263b44c62ce3a02f797a3ddb3d6017cf0e5e4Ted Kremenek} 277ccc263b44c62ce3a02f797a3ddb3d6017cf0e5e4Ted Kremenek 278ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaksvoid ExprEngine::processCFGElement(const CFGElement E, ExplodedNode *Pred, 279ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks unsigned StmtIdx, NodeBuilderContext *Ctx) { 280ac7cc2d37e82181e73fcc265c1d0a619d18b7605Jordan Rose PrettyStackTraceLocationContext CrashInfo(Pred->getLocationContext()); 28166c486f275531df6362b3511fc3af6563561801bTed Kremenek currStmtIdx = StmtIdx; 28266c486f275531df6362b3511fc3af6563561801bTed Kremenek currBldrCtx = Ctx; 283ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks 2849c6cd67ea416bace666d614c84d5531124287653Zhongxing Xu switch (E.getKind()) { 2853c0349e87cdbd7316d06d2411d86ee1086e717a5Ted Kremenek case CFGElement::Statement: 286fdf6a279c9a75c778eba382d9a156697092982a1David Blaikie ProcessStmt(const_cast<Stmt*>(E.castAs<CFGStmt>().getStmt()), Pred); 2873c0349e87cdbd7316d06d2411d86ee1086e717a5Ted Kremenek return; 2883c0349e87cdbd7316d06d2411d86ee1086e717a5Ted Kremenek case CFGElement::Initializer: 289fdf6a279c9a75c778eba382d9a156697092982a1David Blaikie ProcessInitializer(E.castAs<CFGInitializer>().getInitializer(), Pred); 2903c0349e87cdbd7316d06d2411d86ee1086e717a5Ted Kremenek return; 291651f13cea278ec967336033dd032faef0e9fc2ecStephen Hines case CFGElement::NewAllocator: 292651f13cea278ec967336033dd032faef0e9fc2ecStephen Hines ProcessNewAllocator(E.castAs<CFGNewAllocator>().getAllocatorExpr(), 293651f13cea278ec967336033dd032faef0e9fc2ecStephen Hines Pred); 294651f13cea278ec967336033dd032faef0e9fc2ecStephen Hines return; 2953c0349e87cdbd7316d06d2411d86ee1086e717a5Ted Kremenek case CFGElement::AutomaticObjectDtor: 29636d558d85653315edb389677e995ec9ccdbfbf3dJordan Rose case CFGElement::DeleteDtor: 2973c0349e87cdbd7316d06d2411d86ee1086e717a5Ted Kremenek case CFGElement::BaseDtor: 2983c0349e87cdbd7316d06d2411d86ee1086e717a5Ted Kremenek case CFGElement::MemberDtor: 2993c0349e87cdbd7316d06d2411d86ee1086e717a5Ted Kremenek case CFGElement::TemporaryDtor: 300fdf6a279c9a75c778eba382d9a156697092982a1David Blaikie ProcessImplicitDtor(E.castAs<CFGImplicitDtor>(), Pred); 3013c0349e87cdbd7316d06d2411d86ee1086e717a5Ted Kremenek return; 3029c6cd67ea416bace666d614c84d5531124287653Zhongxing Xu } 3039c6cd67ea416bace666d614c84d5531124287653Zhongxing Xu} 3049c6cd67ea416bace666d614c84d5531124287653Zhongxing Xu 305ce117a7d289f57f792e5cc3294280cfe070433deTed Kremenekstatic bool shouldRemoveDeadBindings(AnalysisManager &AMgr, 306ce117a7d289f57f792e5cc3294280cfe070433deTed Kremenek const CFGStmt S, 307ce117a7d289f57f792e5cc3294280cfe070433deTed Kremenek const ExplodedNode *Pred, 308ce117a7d289f57f792e5cc3294280cfe070433deTed Kremenek const LocationContext *LC) { 309ce117a7d289f57f792e5cc3294280cfe070433deTed Kremenek 310ce117a7d289f57f792e5cc3294280cfe070433deTed Kremenek // Are we never purging state values? 311255d4d4226b24036ceb11228fbb74286e58620f7Ted Kremenek if (AMgr.options.AnalysisPurgeOpt == PurgeNone) 312ce117a7d289f57f792e5cc3294280cfe070433deTed Kremenek return false; 313ce117a7d289f57f792e5cc3294280cfe070433deTed Kremenek 314ce117a7d289f57f792e5cc3294280cfe070433deTed Kremenek // Is this the beginning of a basic block? 3157a95de68c093991047ed8d339479ccad51b88663David Blaikie if (Pred->getLocation().getAs<BlockEntrance>()) 316ce117a7d289f57f792e5cc3294280cfe070433deTed Kremenek return true; 317ce117a7d289f57f792e5cc3294280cfe070433deTed Kremenek 318ce117a7d289f57f792e5cc3294280cfe070433deTed Kremenek // Is this on a non-expression? 319ce117a7d289f57f792e5cc3294280cfe070433deTed Kremenek if (!isa<Expr>(S.getStmt())) 320ce117a7d289f57f792e5cc3294280cfe070433deTed Kremenek return true; 321ff80afcfb2b00ccffcb6cb10528bec565fc59eddAnna Zaks 322ff80afcfb2b00ccffcb6cb10528bec565fc59eddAnna Zaks // Run before processing a call. 3236062334cc388bce69fb3978c4ecb26c6485a5c2bJordan Rose if (CallEvent::isCallStmt(S.getStmt())) 324ff80afcfb2b00ccffcb6cb10528bec565fc59eddAnna Zaks return true; 325ff80afcfb2b00ccffcb6cb10528bec565fc59eddAnna Zaks 326ce117a7d289f57f792e5cc3294280cfe070433deTed Kremenek // Is this an expression that is consumed by another expression? If so, 327ce117a7d289f57f792e5cc3294280cfe070433deTed Kremenek // postpone cleaning out the state. 328ce117a7d289f57f792e5cc3294280cfe070433deTed Kremenek ParentMap &PM = LC->getAnalysisDeclContext()->getParentMap(); 329ce117a7d289f57f792e5cc3294280cfe070433deTed Kremenek return !PM.isConsumedExpr(cast<Expr>(S.getStmt())); 330ce117a7d289f57f792e5cc3294280cfe070433deTed Kremenek} 331ce117a7d289f57f792e5cc3294280cfe070433deTed Kremenek 3320b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaksvoid ExprEngine::removeDead(ExplodedNode *Pred, ExplodedNodeSet &Out, 3330b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks const Stmt *ReferenceStmt, 33484c484545c5906ba55143e212b4a5275ab55889fJordan Rose const LocationContext *LC, 3350b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks const Stmt *DiagnosticStmt, 3360b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks ProgramPoint::Kind K) { 3370b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks assert((K == ProgramPoint::PreStmtPurgeDeadSymbolsKind || 33884c484545c5906ba55143e212b4a5275ab55889fJordan Rose ReferenceStmt == 0 || isa<ReturnStmt>(ReferenceStmt)) 3398501b7a1c4c4a9ba0ea6cb8e500e601ef3759debAnna Zaks && "PostStmt is not generally supported by the SymbolReaper yet"); 34084c484545c5906ba55143e212b4a5275ab55889fJordan Rose assert(LC && "Must pass the current (or expiring) LocationContext"); 34184c484545c5906ba55143e212b4a5275ab55889fJordan Rose 34284c484545c5906ba55143e212b4a5275ab55889fJordan Rose if (!DiagnosticStmt) { 34384c484545c5906ba55143e212b4a5275ab55889fJordan Rose DiagnosticStmt = ReferenceStmt; 34484c484545c5906ba55143e212b4a5275ab55889fJordan Rose assert(DiagnosticStmt && "Required for clearing a LocationContext"); 34584c484545c5906ba55143e212b4a5275ab55889fJordan Rose } 34684c484545c5906ba55143e212b4a5275ab55889fJordan Rose 3470b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks NumRemoveDeadBindings++; 3489428723d6730f4fd257e15b78d24991ae95bbd84Jordan Rose ProgramStateRef CleanedState = Pred->getState(); 34984c484545c5906ba55143e212b4a5275ab55889fJordan Rose 35084c484545c5906ba55143e212b4a5275ab55889fJordan Rose // LC is the location context being destroyed, but SymbolReaper wants a 35184c484545c5906ba55143e212b4a5275ab55889fJordan Rose // location context that is still live. (If this is the top-level stack 35284c484545c5906ba55143e212b4a5275ab55889fJordan Rose // frame, this will be null.) 35384c484545c5906ba55143e212b4a5275ab55889fJordan Rose if (!ReferenceStmt) { 35484c484545c5906ba55143e212b4a5275ab55889fJordan Rose assert(K == ProgramPoint::PostStmtPurgeDeadSymbolsKind && 35584c484545c5906ba55143e212b4a5275ab55889fJordan Rose "Use PostStmtPurgeDeadSymbolsKind for clearing a LocationContext"); 35684c484545c5906ba55143e212b4a5275ab55889fJordan Rose LC = LC->getParent(); 35784c484545c5906ba55143e212b4a5275ab55889fJordan Rose } 35884c484545c5906ba55143e212b4a5275ab55889fJordan Rose 35984c484545c5906ba55143e212b4a5275ab55889fJordan Rose const StackFrameContext *SFC = LC ? LC->getCurrentStackFrame() : 0; 36084c484545c5906ba55143e212b4a5275ab55889fJordan Rose SymbolReaper SymReaper(SFC, ReferenceStmt, SymMgr, getStoreManager()); 3610b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks 3620b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks getCheckerManager().runCheckersForLiveSymbols(CleanedState, SymReaper); 3630b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks 3640b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks // Create a state in which dead bindings are removed from the environment 3650b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks // and the store. TODO: The function should just return new env and store, 3660b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks // not a new state. 3670b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks CleanedState = StateMgr.removeDeadBindings(CleanedState, SFC, SymReaper); 368241677a13cc46647a8f5098b3e3239bd9480dca2Ted Kremenek 36977d7ef8d8a80ccb2ab3d25c80810571e3ab14ee4Ted Kremenek // Process any special transfer function for dead symbols. 370f185cc1ac77a84139c603eee3473b88dcb839c68Anna Zaks // A tag to track convenience transitions, which can be removed at cleanup. 371651f13cea278ec967336033dd032faef0e9fc2ecStephen Hines static SimpleProgramPointTag cleanupTag(TagProviderName, "Clean Node"); 3726bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks if (!SymReaper.hasDeadSymbols()) { 3736bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks // Generate a CleanedNode that has the environment and store cleaned 3746bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks // up. Since no symbols are dead, we can optimize and not clean out 3756bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks // the constraint manager. 37666c486f275531df6362b3511fc3af6563561801bTed Kremenek StmtNodeBuilder Bldr(Pred, Out, *currBldrCtx); 377fa06f0464a04bb7fce1fcfb3780d151bb029e00cJordan Rose Bldr.generateNode(DiagnosticStmt, Pred, CleanedState, &cleanupTag, K); 3781eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 3796bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks } else { 3806bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks // Call checkers with the non-cleaned state so that they could query the 3816bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks // values of the soon to be dead symbols. 382fe27971d54d26997149d6b84057f04ff398d1d5dJordy Rose ExplodedNodeSet CheckedSet; 3830b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks getCheckerManager().runCheckersForDeadSymbols(CheckedSet, Pred, SymReaper, 3840b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks DiagnosticStmt, *this, K); 385183ff98f425d470c2a0276880aaf43496c9dad14Argyrios Kyrtzidis 386fe27971d54d26997149d6b84057f04ff398d1d5dJordy Rose // For each node in CheckedSet, generate CleanedNodes that have the 387fe27971d54d26997149d6b84057f04ff398d1d5dJordy Rose // environment, the store, and the constraints cleaned up but have the 388fe27971d54d26997149d6b84057f04ff398d1d5dJordy Rose // user-supplied states as the predecessors. 38966c486f275531df6362b3511fc3af6563561801bTed Kremenek StmtNodeBuilder Bldr(CheckedSet, Out, *currBldrCtx); 390fe27971d54d26997149d6b84057f04ff398d1d5dJordy Rose for (ExplodedNodeSet::const_iterator 391fe27971d54d26997149d6b84057f04ff398d1d5dJordy Rose I = CheckedSet.begin(), E = CheckedSet.end(); I != E; ++I) { 3928bef8238181a30e52dea380789a7e2d760eac532Ted Kremenek ProgramStateRef CheckerState = (*I)->getState(); 3936bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks 3946bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks // The constraint manager has not been cleaned up yet, so clean up now. 3956bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks CheckerState = getConstraintManager().removeDeadBindings(CheckerState, 3966bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks SymReaper); 3976bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks 3980b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks assert(StateMgr.haveEqualEnvironments(CheckerState, Pred->getState()) && 3996bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks "Checkers are not allowed to modify the Environment as a part of " 4006bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks "checkDeadSymbols processing."); 4010b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks assert(StateMgr.haveEqualStores(CheckerState, Pred->getState()) && 4026bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks "Checkers are not allowed to modify the Store as a part of " 4036bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks "checkDeadSymbols processing."); 4046bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks 4056bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks // Create a state based on CleanedState with CheckerState GDM and 4066bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks // generate a transition to that state. 4078bef8238181a30e52dea380789a7e2d760eac532Ted Kremenek ProgramStateRef CleanedCheckerSt = 4086bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks StateMgr.getPersistentStateWithGDM(CleanedState, CheckerState); 409fa06f0464a04bb7fce1fcfb3780d151bb029e00cJordan Rose Bldr.generateNode(DiagnosticStmt, *I, CleanedCheckerSt, &cleanupTag, K); 4106bd528b9d703fdea51053719d9c53504a61a6bd7Anna Zaks } 41177d7ef8d8a80ccb2ab3d25c80810571e3ab14ee4Ted Kremenek } 4120b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks} 4130b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks 4140b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaksvoid ExprEngine::ProcessStmt(const CFGStmt S, 4150b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks ExplodedNode *Pred) { 4160b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks // Reclaim any unnecessary nodes in the ExplodedGraph. 4170b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks G.reclaimRecentlyAllocatedNodes(); 4180b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks 4199428723d6730f4fd257e15b78d24991ae95bbd84Jordan Rose const Stmt *currStmt = S.getStmt(); 4200b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks PrettyStackTraceLoc CrashInfo(getContext().getSourceManager(), 42166c486f275531df6362b3511fc3af6563561801bTed Kremenek currStmt->getLocStart(), 4220b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks "Error evaluating statement"); 4231eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 4240b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks // Remove dead bindings and symbols. 4250b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks ExplodedNodeSet CleanedStates; 4269428723d6730f4fd257e15b78d24991ae95bbd84Jordan Rose if (shouldRemoveDeadBindings(AMgr, S, Pred, Pred->getLocationContext())){ 4279428723d6730f4fd257e15b78d24991ae95bbd84Jordan Rose removeDead(Pred, CleanedStates, currStmt, Pred->getLocationContext()); 4280b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks } else 4299428723d6730f4fd257e15b78d24991ae95bbd84Jordan Rose CleanedStates.Add(Pred); 4300b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks 4310b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks // Visit the statement. 432dd7ddf2b2296f95e7591ca3f9791f0eb9a15ee42Anna Zaks ExplodedNodeSet Dst; 4330b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks for (ExplodedNodeSet::iterator I = CleanedStates.begin(), 4340b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks E = CleanedStates.end(); I != E; ++I) { 435dd7ddf2b2296f95e7591ca3f9791f0eb9a15ee42Anna Zaks ExplodedNodeSet DstI; 4361eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump // Visit the statement. 43766c486f275531df6362b3511fc3af6563561801bTed Kremenek Visit(currStmt, *I, DstI); 438dd7ddf2b2296f95e7591ca3f9791f0eb9a15ee42Anna Zaks Dst.insert(DstI); 439ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks } 440ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks 441dd7ddf2b2296f95e7591ca3f9791f0eb9a15ee42Anna Zaks // Enqueue the new nodes onto the work list. 44266c486f275531df6362b3511fc3af6563561801bTed Kremenek Engine.enqueue(Dst, currBldrCtx->getBlock(), currStmtIdx); 443e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek} 444e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek 445d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidisvoid ExprEngine::ProcessInitializer(const CFGInitializer Init, 446056c4b46335a3bd2612414735d5749ee159c0165Anna Zaks ExplodedNode *Pred) { 447cbb67480094b3bcb5b715acd827cbad55e2a204cSean Hunt const CXXCtorInitializer *BMI = Init.getInitializer(); 448563ea2335d7d0df44bbfe8941f64523e8af1fc14Jordan Rose 449563ea2335d7d0df44bbfe8941f64523e8af1fc14Jordan Rose PrettyStackTraceLoc CrashInfo(getContext().getSourceManager(), 450563ea2335d7d0df44bbfe8941f64523e8af1fc14Jordan Rose BMI->getSourceLocation(), 451563ea2335d7d0df44bbfe8941f64523e8af1fc14Jordan Rose "Error evaluating initializer"); 452563ea2335d7d0df44bbfe8941f64523e8af1fc14Jordan Rose 4539428723d6730f4fd257e15b78d24991ae95bbd84Jordan Rose // We don't clean up dead bindings here. 454056c4b46335a3bd2612414735d5749ee159c0165Anna Zaks const StackFrameContext *stackFrame = 455056c4b46335a3bd2612414735d5749ee159c0165Anna Zaks cast<StackFrameContext>(Pred->getLocationContext()); 456056c4b46335a3bd2612414735d5749ee159c0165Anna Zaks const CXXConstructorDecl *decl = 457056c4b46335a3bd2612414735d5749ee159c0165Anna Zaks cast<CXXConstructorDecl>(stackFrame->getDecl()); 4583682f1ea9c7fddc7dcbc590891158ba40f7fca16Jordan Rose 4593682f1ea9c7fddc7dcbc590891158ba40f7fca16Jordan Rose ProgramStateRef State = Pred->getState(); 4603a0a9e3e8bbaa45f3ca22b1e20b3beaac0f5861eJordan Rose SVal thisVal = State->getSVal(svalBuilder.getCXXThis(decl, stackFrame)); 4619dc84c9455df2a77195147d0210c915dc1775a88Zhongxing Xu 4623682f1ea9c7fddc7dcbc590891158ba40f7fca16Jordan Rose ExplodedNodeSet Tmp(Pred); 463610f79cbab4d752349b5c81a94682a6a82b102e7Anna Zaks SVal FieldLoc; 4643682f1ea9c7fddc7dcbc590891158ba40f7fca16Jordan Rose 4653a0a9e3e8bbaa45f3ca22b1e20b3beaac0f5861eJordan Rose // Evaluate the initializer, if necessary 46600eb3f9c5b33e3d99aee1f8b75dd9c9678fdd66bFrancois Pichet if (BMI->isAnyMemberInitializer()) { 4673a0a9e3e8bbaa45f3ca22b1e20b3beaac0f5861eJordan Rose // Constructors build the object directly in the field, 4683a0a9e3e8bbaa45f3ca22b1e20b3beaac0f5861eJordan Rose // but non-objects must be copied in from the initializer. 46907c52d2813a6b5e4025276d3687bd25f75fd51b9Jordan Rose const Expr *Init = BMI->getInit()->IgnoreImplicit(); 4703682f1ea9c7fddc7dcbc590891158ba40f7fca16Jordan Rose if (!isa<CXXConstructExpr>(Init)) { 471ecee1651c100342366a9417c85c6e50399039930Jordan Rose const ValueDecl *Field; 472ecee1651c100342366a9417c85c6e50399039930Jordan Rose if (BMI->isIndirectMemberInitializer()) { 473ecee1651c100342366a9417c85c6e50399039930Jordan Rose Field = BMI->getIndirectMember(); 4743a0a9e3e8bbaa45f3ca22b1e20b3beaac0f5861eJordan Rose FieldLoc = State->getLValue(BMI->getIndirectMember(), thisVal); 475ecee1651c100342366a9417c85c6e50399039930Jordan Rose } else { 476ecee1651c100342366a9417c85c6e50399039930Jordan Rose Field = BMI->getMember(); 4773a0a9e3e8bbaa45f3ca22b1e20b3beaac0f5861eJordan Rose FieldLoc = State->getLValue(BMI->getMember(), thisVal); 478ecee1651c100342366a9417c85c6e50399039930Jordan Rose } 4793a0a9e3e8bbaa45f3ca22b1e20b3beaac0f5861eJordan Rose 480ecee1651c100342366a9417c85c6e50399039930Jordan Rose SVal InitVal; 481ecee1651c100342366a9417c85c6e50399039930Jordan Rose if (BMI->getNumArrayIndices() > 0) { 482ecee1651c100342366a9417c85c6e50399039930Jordan Rose // Handle arrays of trivial type. We can represent this with a 483ecee1651c100342366a9417c85c6e50399039930Jordan Rose // primitive load/copy from the base array region. 484ecee1651c100342366a9417c85c6e50399039930Jordan Rose const ArraySubscriptExpr *ASE; 485ecee1651c100342366a9417c85c6e50399039930Jordan Rose while ((ASE = dyn_cast<ArraySubscriptExpr>(Init))) 486ecee1651c100342366a9417c85c6e50399039930Jordan Rose Init = ASE->getBase()->IgnoreImplicit(); 487ecee1651c100342366a9417c85c6e50399039930Jordan Rose 488ecee1651c100342366a9417c85c6e50399039930Jordan Rose SVal LValue = State->getSVal(Init, stackFrame); 489ecee1651c100342366a9417c85c6e50399039930Jordan Rose if (Optional<Loc> LValueLoc = LValue.getAs<Loc>()) 490ecee1651c100342366a9417c85c6e50399039930Jordan Rose InitVal = State->getSVal(*LValueLoc); 491ecee1651c100342366a9417c85c6e50399039930Jordan Rose 492ecee1651c100342366a9417c85c6e50399039930Jordan Rose // If we fail to get the value for some reason, use a symbolic value. 493ecee1651c100342366a9417c85c6e50399039930Jordan Rose if (InitVal.isUnknownOrUndef()) { 494ecee1651c100342366a9417c85c6e50399039930Jordan Rose SValBuilder &SVB = getSValBuilder(); 495ecee1651c100342366a9417c85c6e50399039930Jordan Rose InitVal = SVB.conjureSymbolVal(BMI->getInit(), stackFrame, 496ecee1651c100342366a9417c85c6e50399039930Jordan Rose Field->getType(), 497ecee1651c100342366a9417c85c6e50399039930Jordan Rose currBldrCtx->blockCount()); 498ecee1651c100342366a9417c85c6e50399039930Jordan Rose } 499ecee1651c100342366a9417c85c6e50399039930Jordan Rose } else { 500ecee1651c100342366a9417c85c6e50399039930Jordan Rose InitVal = State->getSVal(BMI->getInit(), stackFrame); 501ecee1651c100342366a9417c85c6e50399039930Jordan Rose } 5023682f1ea9c7fddc7dcbc590891158ba40f7fca16Jordan Rose 503ecee1651c100342366a9417c85c6e50399039930Jordan Rose assert(Tmp.size() == 1 && "have not generated any new nodes yet"); 504ecee1651c100342366a9417c85c6e50399039930Jordan Rose assert(*Tmp.begin() == Pred && "have not generated any new nodes yet"); 5053682f1ea9c7fddc7dcbc590891158ba40f7fca16Jordan Rose Tmp.clear(); 506610f79cbab4d752349b5c81a94682a6a82b102e7Anna Zaks 507610f79cbab4d752349b5c81a94682a6a82b102e7Anna Zaks PostInitializer PP(BMI, FieldLoc.getAsRegion(), stackFrame); 5083682f1ea9c7fddc7dcbc590891158ba40f7fca16Jordan Rose evalBind(Tmp, Init, Pred, FieldLoc, InitVal, /*isInit=*/true, &PP); 5093a0a9e3e8bbaa45f3ca22b1e20b3beaac0f5861eJordan Rose } 510056c4b46335a3bd2612414735d5749ee159c0165Anna Zaks } else { 511563ea2335d7d0df44bbfe8941f64523e8af1fc14Jordan Rose assert(BMI->isBaseInitializer() || BMI->isDelegatingInitializer()); 512888c90ac0ef6baf7d47e86cf5cc4715707d223b1Jordan Rose // We already did all the work when visiting the CXXConstructExpr. 513056c4b46335a3bd2612414735d5749ee159c0165Anna Zaks } 514dd7ddf2b2296f95e7591ca3f9791f0eb9a15ee42Anna Zaks 5153682f1ea9c7fddc7dcbc590891158ba40f7fca16Jordan Rose // Construct PostInitializer nodes whether the state changed or not, 5163a0a9e3e8bbaa45f3ca22b1e20b3beaac0f5861eJordan Rose // so that the diagnostics don't get confused. 517610f79cbab4d752349b5c81a94682a6a82b102e7Anna Zaks PostInitializer PP(BMI, FieldLoc.getAsRegion(), stackFrame); 5183682f1ea9c7fddc7dcbc590891158ba40f7fca16Jordan Rose ExplodedNodeSet Dst; 5193682f1ea9c7fddc7dcbc590891158ba40f7fca16Jordan Rose NodeBuilder Bldr(Tmp, Dst, *currBldrCtx); 5203682f1ea9c7fddc7dcbc590891158ba40f7fca16Jordan Rose for (ExplodedNodeSet::iterator I = Tmp.begin(), E = Tmp.end(); I != E; ++I) { 5213682f1ea9c7fddc7dcbc590891158ba40f7fca16Jordan Rose ExplodedNode *N = *I; 5223682f1ea9c7fddc7dcbc590891158ba40f7fca16Jordan Rose Bldr.generateNode(PP, N->getState(), N); 5233682f1ea9c7fddc7dcbc590891158ba40f7fca16Jordan Rose } 5243a0a9e3e8bbaa45f3ca22b1e20b3beaac0f5861eJordan Rose 525dd7ddf2b2296f95e7591ca3f9791f0eb9a15ee42Anna Zaks // Enqueue the new nodes onto the work list. 52666c486f275531df6362b3511fc3af6563561801bTed Kremenek Engine.enqueue(Dst, currBldrCtx->getBlock(), currStmtIdx); 5279c6cd67ea416bace666d614c84d5531124287653Zhongxing Xu} 5289c6cd67ea416bace666d614c84d5531124287653Zhongxing Xu 529d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidisvoid ExprEngine::ProcessImplicitDtor(const CFGImplicitDtor D, 530ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks ExplodedNode *Pred) { 531ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks ExplodedNodeSet Dst; 5323c0349e87cdbd7316d06d2411d86ee1086e717a5Ted Kremenek switch (D.getKind()) { 5334ffcb9974c6b7142c4a1483abfcb1f88b6371c45Zhongxing Xu case CFGElement::AutomaticObjectDtor: 534fdf6a279c9a75c778eba382d9a156697092982a1David Blaikie ProcessAutomaticObjDtor(D.castAs<CFGAutomaticObjDtor>(), Pred, Dst); 5354ffcb9974c6b7142c4a1483abfcb1f88b6371c45Zhongxing Xu break; 5364ffcb9974c6b7142c4a1483abfcb1f88b6371c45Zhongxing Xu case CFGElement::BaseDtor: 537fdf6a279c9a75c778eba382d9a156697092982a1David Blaikie ProcessBaseDtor(D.castAs<CFGBaseDtor>(), Pred, Dst); 5384ffcb9974c6b7142c4a1483abfcb1f88b6371c45Zhongxing Xu break; 5394ffcb9974c6b7142c4a1483abfcb1f88b6371c45Zhongxing Xu case CFGElement::MemberDtor: 540fdf6a279c9a75c778eba382d9a156697092982a1David Blaikie ProcessMemberDtor(D.castAs<CFGMemberDtor>(), Pred, Dst); 5414ffcb9974c6b7142c4a1483abfcb1f88b6371c45Zhongxing Xu break; 5424ffcb9974c6b7142c4a1483abfcb1f88b6371c45Zhongxing Xu case CFGElement::TemporaryDtor: 543fdf6a279c9a75c778eba382d9a156697092982a1David Blaikie ProcessTemporaryDtor(D.castAs<CFGTemporaryDtor>(), Pred, Dst); 5444ffcb9974c6b7142c4a1483abfcb1f88b6371c45Zhongxing Xu break; 54536d558d85653315edb389677e995ec9ccdbfbf3dJordan Rose case CFGElement::DeleteDtor: 54636d558d85653315edb389677e995ec9ccdbfbf3dJordan Rose ProcessDeleteDtor(D.castAs<CFGDeleteDtor>(), Pred, Dst); 54736d558d85653315edb389677e995ec9ccdbfbf3dJordan Rose break; 5484ffcb9974c6b7142c4a1483abfcb1f88b6371c45Zhongxing Xu default: 5494ffcb9974c6b7142c4a1483abfcb1f88b6371c45Zhongxing Xu llvm_unreachable("Unexpected dtor kind."); 5504ffcb9974c6b7142c4a1483abfcb1f88b6371c45Zhongxing Xu } 551ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks 552dd7ddf2b2296f95e7591ca3f9791f0eb9a15ee42Anna Zaks // Enqueue the new nodes onto the work list. 55366c486f275531df6362b3511fc3af6563561801bTed Kremenek Engine.enqueue(Dst, currBldrCtx->getBlock(), currStmtIdx); 5544ffcb9974c6b7142c4a1483abfcb1f88b6371c45Zhongxing Xu} 5554ffcb9974c6b7142c4a1483abfcb1f88b6371c45Zhongxing Xu 556651f13cea278ec967336033dd032faef0e9fc2ecStephen Hinesvoid ExprEngine::ProcessNewAllocator(const CXXNewExpr *NE, 557651f13cea278ec967336033dd032faef0e9fc2ecStephen Hines ExplodedNode *Pred) { 558651f13cea278ec967336033dd032faef0e9fc2ecStephen Hines ExplodedNodeSet Dst; 559651f13cea278ec967336033dd032faef0e9fc2ecStephen Hines AnalysisManager &AMgr = getAnalysisManager(); 560651f13cea278ec967336033dd032faef0e9fc2ecStephen Hines AnalyzerOptions &Opts = AMgr.options; 561651f13cea278ec967336033dd032faef0e9fc2ecStephen Hines // TODO: We're not evaluating allocators for all cases just yet as 562651f13cea278ec967336033dd032faef0e9fc2ecStephen Hines // we're not handling the return value correctly, which causes false 563651f13cea278ec967336033dd032faef0e9fc2ecStephen Hines // positives when the alpha.cplusplus.NewDeleteLeaks check is on. 564651f13cea278ec967336033dd032faef0e9fc2ecStephen Hines if (Opts.mayInlineCXXAllocator()) 565651f13cea278ec967336033dd032faef0e9fc2ecStephen Hines VisitCXXNewAllocatorCall(NE, Pred, Dst); 566651f13cea278ec967336033dd032faef0e9fc2ecStephen Hines else { 567651f13cea278ec967336033dd032faef0e9fc2ecStephen Hines NodeBuilder Bldr(Pred, Dst, *currBldrCtx); 568651f13cea278ec967336033dd032faef0e9fc2ecStephen Hines const LocationContext *LCtx = Pred->getLocationContext(); 569651f13cea278ec967336033dd032faef0e9fc2ecStephen Hines PostImplicitCall PP(NE->getOperatorNew(), NE->getLocStart(), LCtx); 570651f13cea278ec967336033dd032faef0e9fc2ecStephen Hines Bldr.generateNode(PP, Pred->getState(), Pred); 571651f13cea278ec967336033dd032faef0e9fc2ecStephen Hines } 572651f13cea278ec967336033dd032faef0e9fc2ecStephen Hines Engine.enqueue(Dst, currBldrCtx->getBlock(), currStmtIdx); 573651f13cea278ec967336033dd032faef0e9fc2ecStephen Hines} 574651f13cea278ec967336033dd032faef0e9fc2ecStephen Hines 575056c4b46335a3bd2612414735d5749ee159c0165Anna Zaksvoid ExprEngine::ProcessAutomaticObjDtor(const CFGAutomaticObjDtor Dtor, 576056c4b46335a3bd2612414735d5749ee159c0165Anna Zaks ExplodedNode *Pred, 577056c4b46335a3bd2612414735d5749ee159c0165Anna Zaks ExplodedNodeSet &Dst) { 578056c4b46335a3bd2612414735d5749ee159c0165Anna Zaks const VarDecl *varDecl = Dtor.getVarDecl(); 5792210490e6d099b7a5b4f68f44a136e4dcf3cdea2Zhongxing Xu QualType varType = varDecl->getType(); 5802210490e6d099b7a5b4f68f44a136e4dcf3cdea2Zhongxing Xu 58108291a937a149dbd036fd6ac8ab061eb8034343dJordan Rose ProgramStateRef state = Pred->getState(); 58208291a937a149dbd036fd6ac8ab061eb8034343dJordan Rose SVal dest = state->getLValue(varDecl, Pred->getLocationContext()); 58308291a937a149dbd036fd6ac8ab061eb8034343dJordan Rose const MemRegion *Region = dest.castAs<loc::MemRegionVal>().getRegion(); 5842210490e6d099b7a5b4f68f44a136e4dcf3cdea2Zhongxing Xu 58508291a937a149dbd036fd6ac8ab061eb8034343dJordan Rose if (const ReferenceType *refType = varType->getAs<ReferenceType>()) { 58608291a937a149dbd036fd6ac8ab061eb8034343dJordan Rose varType = refType->getPointeeType(); 58708291a937a149dbd036fd6ac8ab061eb8034343dJordan Rose Region = state->getSVal(Region).getAsRegion(); 58808291a937a149dbd036fd6ac8ab061eb8034343dJordan Rose } 589b13453bd8a91f331d0910ca95ad52aa41b52f648Zhongxing Xu 59008291a937a149dbd036fd6ac8ab061eb8034343dJordan Rose VisitCXXDestructor(varType, Region, Dtor.getTriggerStmt(), /*IsBase=*/ false, 59108291a937a149dbd036fd6ac8ab061eb8034343dJordan Rose Pred, Dst); 5924ffcb9974c6b7142c4a1483abfcb1f88b6371c45Zhongxing Xu} 5934ffcb9974c6b7142c4a1483abfcb1f88b6371c45Zhongxing Xu 59436d558d85653315edb389677e995ec9ccdbfbf3dJordan Rosevoid ExprEngine::ProcessDeleteDtor(const CFGDeleteDtor Dtor, 59536d558d85653315edb389677e995ec9ccdbfbf3dJordan Rose ExplodedNode *Pred, 59636d558d85653315edb389677e995ec9ccdbfbf3dJordan Rose ExplodedNodeSet &Dst) { 59781557223ba8d7ef8b0468a6e1dc8fc79f2de46f2Jordan Rose ProgramStateRef State = Pred->getState(); 59881557223ba8d7ef8b0468a6e1dc8fc79f2de46f2Jordan Rose const LocationContext *LCtx = Pred->getLocationContext(); 59981557223ba8d7ef8b0468a6e1dc8fc79f2de46f2Jordan Rose const CXXDeleteExpr *DE = Dtor.getDeleteExpr(); 60081557223ba8d7ef8b0468a6e1dc8fc79f2de46f2Jordan Rose const Stmt *Arg = DE->getArgument(); 60181557223ba8d7ef8b0468a6e1dc8fc79f2de46f2Jordan Rose SVal ArgVal = State->getSVal(Arg, LCtx); 60281557223ba8d7ef8b0468a6e1dc8fc79f2de46f2Jordan Rose 60381557223ba8d7ef8b0468a6e1dc8fc79f2de46f2Jordan Rose // If the argument to delete is known to be a null value, 60481557223ba8d7ef8b0468a6e1dc8fc79f2de46f2Jordan Rose // don't run destructor. 60581557223ba8d7ef8b0468a6e1dc8fc79f2de46f2Jordan Rose if (State->isNull(ArgVal).isConstrainedTrue()) { 60681557223ba8d7ef8b0468a6e1dc8fc79f2de46f2Jordan Rose QualType DTy = DE->getDestroyedType(); 60781557223ba8d7ef8b0468a6e1dc8fc79f2de46f2Jordan Rose QualType BTy = getContext().getBaseElementType(DTy); 60881557223ba8d7ef8b0468a6e1dc8fc79f2de46f2Jordan Rose const CXXRecordDecl *RD = BTy->getAsCXXRecordDecl(); 60981557223ba8d7ef8b0468a6e1dc8fc79f2de46f2Jordan Rose const CXXDestructorDecl *Dtor = RD->getDestructor(); 61081557223ba8d7ef8b0468a6e1dc8fc79f2de46f2Jordan Rose 61181557223ba8d7ef8b0468a6e1dc8fc79f2de46f2Jordan Rose PostImplicitCall PP(Dtor, DE->getLocStart(), LCtx); 61281557223ba8d7ef8b0468a6e1dc8fc79f2de46f2Jordan Rose NodeBuilder Bldr(Pred, Dst, *currBldrCtx); 61381557223ba8d7ef8b0468a6e1dc8fc79f2de46f2Jordan Rose Bldr.generateNode(PP, Pred->getState(), Pred); 61481557223ba8d7ef8b0468a6e1dc8fc79f2de46f2Jordan Rose return; 61581557223ba8d7ef8b0468a6e1dc8fc79f2de46f2Jordan Rose } 61681557223ba8d7ef8b0468a6e1dc8fc79f2de46f2Jordan Rose 61781557223ba8d7ef8b0468a6e1dc8fc79f2de46f2Jordan Rose VisitCXXDestructor(DE->getDestroyedType(), 61881557223ba8d7ef8b0468a6e1dc8fc79f2de46f2Jordan Rose ArgVal.getAsRegion(), 61981557223ba8d7ef8b0468a6e1dc8fc79f2de46f2Jordan Rose DE, /*IsBase=*/ false, 62081557223ba8d7ef8b0468a6e1dc8fc79f2de46f2Jordan Rose Pred, Dst); 62136d558d85653315edb389677e995ec9ccdbfbf3dJordan Rose} 62236d558d85653315edb389677e995ec9ccdbfbf3dJordan Rose 623d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidisvoid ExprEngine::ProcessBaseDtor(const CFGBaseDtor D, 624888c90ac0ef6baf7d47e86cf5cc4715707d223b1Jordan Rose ExplodedNode *Pred, ExplodedNodeSet &Dst) { 625888c90ac0ef6baf7d47e86cf5cc4715707d223b1Jordan Rose const LocationContext *LCtx = Pred->getLocationContext(); 626888c90ac0ef6baf7d47e86cf5cc4715707d223b1Jordan Rose 627888c90ac0ef6baf7d47e86cf5cc4715707d223b1Jordan Rose const CXXDestructorDecl *CurDtor = cast<CXXDestructorDecl>(LCtx->getDecl()); 628888c90ac0ef6baf7d47e86cf5cc4715707d223b1Jordan Rose Loc ThisPtr = getSValBuilder().getCXXThis(CurDtor, 629888c90ac0ef6baf7d47e86cf5cc4715707d223b1Jordan Rose LCtx->getCurrentStackFrame()); 630888c90ac0ef6baf7d47e86cf5cc4715707d223b1Jordan Rose SVal ThisVal = Pred->getState()->getSVal(ThisPtr); 631888c90ac0ef6baf7d47e86cf5cc4715707d223b1Jordan Rose 632888c90ac0ef6baf7d47e86cf5cc4715707d223b1Jordan Rose // Create the base object region. 6334411b423e91da0a2c879b70c0222aeba35f72044Jordan Rose const CXXBaseSpecifier *Base = D.getBaseSpecifier(); 6344411b423e91da0a2c879b70c0222aeba35f72044Jordan Rose QualType BaseTy = Base->getType(); 6354411b423e91da0a2c879b70c0222aeba35f72044Jordan Rose SVal BaseVal = getStoreManager().evalDerivedToBase(ThisVal, BaseTy, 6364411b423e91da0a2c879b70c0222aeba35f72044Jordan Rose Base->isVirtual()); 637888c90ac0ef6baf7d47e86cf5cc4715707d223b1Jordan Rose 6385251abea41b446c26e3239c8dd6c7edea6fc335dDavid Blaikie VisitCXXDestructor(BaseTy, BaseVal.castAs<loc::MemRegionVal>().getRegion(), 6395251abea41b446c26e3239c8dd6c7edea6fc335dDavid Blaikie CurDtor->getBody(), /*IsBase=*/ true, Pred, Dst); 640888c90ac0ef6baf7d47e86cf5cc4715707d223b1Jordan Rose} 6414ffcb9974c6b7142c4a1483abfcb1f88b6371c45Zhongxing Xu 642d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidisvoid ExprEngine::ProcessMemberDtor(const CFGMemberDtor D, 6433a0a9e3e8bbaa45f3ca22b1e20b3beaac0f5861eJordan Rose ExplodedNode *Pred, ExplodedNodeSet &Dst) { 6443a0a9e3e8bbaa45f3ca22b1e20b3beaac0f5861eJordan Rose const FieldDecl *Member = D.getFieldDecl(); 6453a0a9e3e8bbaa45f3ca22b1e20b3beaac0f5861eJordan Rose ProgramStateRef State = Pred->getState(); 6463a0a9e3e8bbaa45f3ca22b1e20b3beaac0f5861eJordan Rose const LocationContext *LCtx = Pred->getLocationContext(); 6473a0a9e3e8bbaa45f3ca22b1e20b3beaac0f5861eJordan Rose 6483a0a9e3e8bbaa45f3ca22b1e20b3beaac0f5861eJordan Rose const CXXDestructorDecl *CurDtor = cast<CXXDestructorDecl>(LCtx->getDecl()); 6493a0a9e3e8bbaa45f3ca22b1e20b3beaac0f5861eJordan Rose Loc ThisVal = getSValBuilder().getCXXThis(CurDtor, 6503a0a9e3e8bbaa45f3ca22b1e20b3beaac0f5861eJordan Rose LCtx->getCurrentStackFrame()); 6515251abea41b446c26e3239c8dd6c7edea6fc335dDavid Blaikie SVal FieldVal = 6525251abea41b446c26e3239c8dd6c7edea6fc335dDavid Blaikie State->getLValue(Member, State->getSVal(ThisVal).castAs<Loc>()); 6533a0a9e3e8bbaa45f3ca22b1e20b3beaac0f5861eJordan Rose 6543a0a9e3e8bbaa45f3ca22b1e20b3beaac0f5861eJordan Rose VisitCXXDestructor(Member->getType(), 6555251abea41b446c26e3239c8dd6c7edea6fc335dDavid Blaikie FieldVal.castAs<loc::MemRegionVal>().getRegion(), 656200fa2e70d52ae6d620e81cd45536071fdde70c0Jordan Rose CurDtor->getBody(), /*IsBase=*/false, Pred, Dst); 6573a0a9e3e8bbaa45f3ca22b1e20b3beaac0f5861eJordan Rose} 6584ffcb9974c6b7142c4a1483abfcb1f88b6371c45Zhongxing Xu 659d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidisvoid ExprEngine::ProcessTemporaryDtor(const CFGTemporaryDtor D, 660056c4b46335a3bd2612414735d5749ee159c0165Anna Zaks ExplodedNode *Pred, 66195ab9e306f4deefeabd89ea61987f4a8d67e0890Pavel Labath ExplodedNodeSet &Dst) { 66295ab9e306f4deefeabd89ea61987f4a8d67e0890Pavel Labath 66395ab9e306f4deefeabd89ea61987f4a8d67e0890Pavel Labath QualType varType = D.getBindTemporaryExpr()->getSubExpr()->getType(); 66495ab9e306f4deefeabd89ea61987f4a8d67e0890Pavel Labath 66595ab9e306f4deefeabd89ea61987f4a8d67e0890Pavel Labath // FIXME: Inlining of temporary destructors is not supported yet anyway, so we 66695ab9e306f4deefeabd89ea61987f4a8d67e0890Pavel Labath // just put a NULL region for now. This will need to be changed later. 66795ab9e306f4deefeabd89ea61987f4a8d67e0890Pavel Labath VisitCXXDestructor(varType, NULL, D.getBindTemporaryExpr(), 66895ab9e306f4deefeabd89ea61987f4a8d67e0890Pavel Labath /*IsBase=*/ false, Pred, Dst); 66995ab9e306f4deefeabd89ea61987f4a8d67e0890Pavel Labath} 6709c6cd67ea416bace666d614c84d5531124287653Zhongxing Xu 67148b6247804eacc262cc5508e0fbb74ed819fbb6eJordan Rosevoid ExprEngine::Visit(const Stmt *S, ExplodedNode *Pred, 6726889679d72859960e0fc8d1080487f63c4df1e0aAnna Zaks ExplodedNodeSet &DstTop) { 6730bed8a12f2878d3cd94fb8bdba55b593d92dd11aTed Kremenek PrettyStackTraceLoc CrashInfo(getContext().getSourceManager(), 6740bed8a12f2878d3cd94fb8bdba55b593d92dd11aTed Kremenek S->getLocStart(), 6750bed8a12f2878d3cd94fb8bdba55b593d92dd11aTed Kremenek "Error evaluating statement"); 6766889679d72859960e0fc8d1080487f63c4df1e0aAnna Zaks ExplodedNodeSet Dst; 67766c486f275531df6362b3511fc3af6563561801bTed Kremenek StmtNodeBuilder Bldr(Pred, DstTop, *currBldrCtx); 6780bed8a12f2878d3cd94fb8bdba55b593d92dd11aTed Kremenek 679e9cd031c77a92015571425b6445e8867816997cdJordan Rose assert(!isa<Expr>(S) || S == cast<Expr>(S)->IgnoreParens()); 6801eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 681e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek switch (S->getStmtClass()) { 682f85e193739c953358c865005855253af4f68a497John McCall // C++ and ARC stuff we don't support yet. 683f85e193739c953358c865005855253af4f68a497John McCall case Expr::ObjCIndirectCopyRestoreExprClass: 6841b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::CXXDependentScopeMemberExprClass: 6851b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::CXXTryStmtClass: 6861b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::CXXTypeidExprClass: 6879be88403e965cc49af76c9d33d818781d44b333eFrancois Pichet case Stmt::CXXUuidofExprClass: 68876da55d3a49e1805f51b1ced7c5da5bcd7f759d8John McCall case Stmt::MSPropertyRefExprClass: 689c768a0c46e6c064c3281d663777ee95aea8652eeTed Kremenek case Stmt::CXXUnresolvedConstructExprClass: 6901b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::DependentScopeDeclRefExprClass: 6914ca8ac2e61c37ddadf37024af86f3e1019af8532Douglas Gregor case Stmt::TypeTraitExprClass: 69221ff2e516b0e0bc8c1dbf965cb3d44bac3c64330John Wiegley case Stmt::ArrayTypeTraitExprClass: 693552622067dc45013d240f73952fece703f5e63bdJohn Wiegley case Stmt::ExpressionTraitExprClass: 6941b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::UnresolvedLookupExprClass: 695c768a0c46e6c064c3281d663777ee95aea8652eeTed Kremenek case Stmt::UnresolvedMemberExprClass: 6966b219d082434394c1ac401390ec1d1967727815aSebastian Redl case Stmt::CXXNoexceptExprClass: 697be230c36e32142cbdcdbe9c97511d097beeecbabDouglas Gregor case Stmt::PackExpansionExprClass: 698c7793c73ba8a343de3f2552d984851985a46f159Douglas Gregor case Stmt::SubstNonTypeTemplateParmPackExprClass: 6999a4db032ecd991626d236a502e770126db32bd31Richard Smith case Stmt::FunctionParmPackExprClass: 70028bbe4b8acc338476fe0825769b41fb32b423c72John Wiegley case Stmt::SEHTryStmtClass: 70128bbe4b8acc338476fe0825769b41fb32b423c72John Wiegley case Stmt::SEHExceptStmtClass: 70201d08018b7cf5ce1601707cfd7a84d22015fc04eDouglas Gregor case Stmt::LambdaExprClass: 703ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks case Stmt::SEHFinallyStmtClass: { 704fa06f0464a04bb7fce1fcfb3780d151bb029e00cJordan Rose const ExplodedNode *node = Bldr.generateSink(S, Pred, Pred->getState()); 70566c486f275531df6362b3511fc3af6563561801bTed Kremenek Engine.addAbortedBlock(node, currBldrCtx->getBlock()); 706c768a0c46e6c064c3281d663777ee95aea8652eeTed Kremenek break; 707c768a0c46e6c064c3281d663777ee95aea8652eeTed Kremenek } 7085fe98728dca1f3a7a378ce1a21984a0f8a0c0b8bTed Kremenek 709f6a1648197562e0b133440d612d9af297d0a86ccJohn McCall case Stmt::ParenExprClass: 710f6a1648197562e0b133440d612d9af297d0a86ccJohn McCall llvm_unreachable("ParenExprs already handled."); 711f111d935722ed488144600cea5ed03a6b5069e8fPeter Collingbourne case Stmt::GenericSelectionExprClass: 712f111d935722ed488144600cea5ed03a6b5069e8fPeter Collingbourne llvm_unreachable("GenericSelectionExprs already handled."); 7131b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek // Cases that should never be evaluated simply because they shouldn't 7141b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek // appear in the CFG. 7151b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::BreakStmtClass: 7161b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::CaseStmtClass: 7171b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::CompoundStmtClass: 7181b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::ContinueStmtClass: 71946eaf7789a1059a7b42b7dbd183150c72df5738fTed Kremenek case Stmt::CXXForRangeStmtClass: 7201b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::DefaultStmtClass: 7211b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::DoStmtClass: 722d40066b0fb883839a9100e5455e33190b9b8abacTed Kremenek case Stmt::ForStmtClass: 7231b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::GotoStmtClass: 724d40066b0fb883839a9100e5455e33190b9b8abacTed Kremenek case Stmt::IfStmtClass: 7251b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::IndirectGotoStmtClass: 7261b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::LabelStmtClass: 7271b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::NoStmtClass: 7281b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::NullStmtClass: 729d40066b0fb883839a9100e5455e33190b9b8abacTed Kremenek case Stmt::SwitchStmtClass: 730d40066b0fb883839a9100e5455e33190b9b8abacTed Kremenek case Stmt::WhileStmtClass: 731ba0513de93d2fab6db5ab30b6927209fcc883078Douglas Gregor case Expr::MSDependentExistsStmtClass: 732051303ce09291dfbed537fa33b0d8a4d92c82b75Tareq A. Siraj case Stmt::CapturedStmtClass: 7334fa7eab771ab8212e1058bd1a91061ff120c8fbbAlexey Bataev case Stmt::OMPParallelDirectiveClass: 734651f13cea278ec967336033dd032faef0e9fc2ecStephen Hines case Stmt::OMPSimdDirectiveClass: 7351b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek llvm_unreachable("Stmt should not be in analyzer evaluation loop"); 7361b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek 7374ccc4cc5d4e7c5c436d5f45065d3639cfc7c6e48Jordan Rose case Stmt::ObjCSubscriptRefExprClass: 7384ccc4cc5d4e7c5c436d5f45065d3639cfc7c6e48Jordan Rose case Stmt::ObjCPropertyRefExprClass: 7394ccc4cc5d4e7c5c436d5f45065d3639cfc7c6e48Jordan Rose llvm_unreachable("These are handled by PseudoObjectExpr"); 7404ccc4cc5d4e7c5c436d5f45065d3639cfc7c6e48Jordan Rose 7418ad9cbc518a603176462f1fa1efe389023590082Ted Kremenek case Stmt::GNUNullExprClass: { 7428f08426e6f54ed20b959018f24dbea106a00b4adJordy Rose // GNU __null is a pointer-width integer, not an actual pointer. 7438bef8238181a30e52dea380789a7e2d760eac532Ted Kremenek ProgramStateRef state = Pred->getState(); 7445eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek state = state->BindExpr(S, Pred->getLocationContext(), 7455eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek svalBuilder.makeIntValWithPtrWidth(0, false)); 746ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.generateNode(S, Pred, state); 7478ad9cbc518a603176462f1fa1efe389023590082Ted Kremenek break; 7488ad9cbc518a603176462f1fa1efe389023590082Ted Kremenek } 7498ad9cbc518a603176462f1fa1efe389023590082Ted Kremenek 7504beaa9f51b2da57c64740cef2bd1c2fdb0c325d5Ted Kremenek case Stmt::ObjCAtSynchronizedStmtClass: 751ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.takeNodes(Pred); 7524beaa9f51b2da57c64740cef2bd1c2fdb0c325d5Ted Kremenek VisitObjCAtSynchronizedStmt(cast<ObjCAtSynchronizedStmt>(S), Pred, Dst); 753ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.addNodes(Dst); 7544beaa9f51b2da57c64740cef2bd1c2fdb0c325d5Ted Kremenek break; 7554beaa9f51b2da57c64740cef2bd1c2fdb0c325d5Ted Kremenek 756ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks case Stmt::ExprWithCleanupsClass: 757e711d7e7875920fee4180a26bfc67d67f0f71a2cErik Verbruggen // Handled due to fully linearised CFG. 758f85e193739c953358c865005855253af4f68a497John McCall break; 759f85e193739c953358c865005855253af4f68a497John McCall 7601b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek // Cases not handled yet; but will handle some day. 7611b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::DesignatedInitExprClass: 7621b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::ExtVectorElementExprClass: 7631b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::ImaginaryLiteralClass: 7641b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::ObjCAtCatchStmtClass: 7651b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::ObjCAtFinallyStmtClass: 7661b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::ObjCAtTryStmtClass: 767f85e193739c953358c865005855253af4f68a497John McCall case Stmt::ObjCAutoreleasePoolStmtClass: 7681b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::ObjCEncodeExprClass: 7691b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::ObjCIsaExprClass: 7701b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::ObjCProtocolExprClass: 7711b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::ObjCSelectorExprClass: 7721b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::ParenListExprClass: 7731b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::PredefinedExprClass: 7741b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::ShuffleVectorExprClass: 775414a1bdbdaf250e0488589f12865c8961831b65dHal Finkel case Stmt::ConvertVectorExprClass: 7761b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek case Stmt::VAArgExprClass: 777e08ce650a2b02410eddd1f60a4aa6b3d4be71e73Peter Collingbourne case Stmt::CUDAKernelCallExprClass: 77856ca35d396d8692c384c785f9aeebcf22563fe1eJohn McCall case Stmt::OpaqueValueExprClass: 77961eee0ca33b29e102f11bab77c8b74cc00e2392bTanya Lattner case Stmt::AsTypeExprClass: 780276b061970939293f1abaf694bd3ef05b2cbda79Eli Friedman case Stmt::AtomicExprClass: 781337e4dbc6859589b8878146a88bebf754e916702Ted Kremenek // Fall through. 7821b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek 7831b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek // Cases we intentionally don't evaluate, since they don't need 7841b49d762e9658b6b6d1b677dca005324a7b1126dTed Kremenek // to be explicitly evaluated. 785bc9ad74a13e83303a3a5251f8bacbbca17341c17Zhongxing Xu case Stmt::AddrLabelExprClass: 786ed2e2de580f840385f25a188ed48d2a14948af76Pavel Labath case Stmt::AttributedStmtClass: 787bc9ad74a13e83303a3a5251f8bacbbca17341c17Zhongxing Xu case Stmt::IntegerLiteralClass: 788bc9ad74a13e83303a3a5251f8bacbbca17341c17Zhongxing Xu case Stmt::CharacterLiteralClass: 789c319c585c0d5899cba0dca2272e6e4909c8b9f16Ted Kremenek case Stmt::ImplicitValueInitExprClass: 790c319c585c0d5899cba0dca2272e6e4909c8b9f16Ted Kremenek case Stmt::CXXScalarValueInitExprClass: 791477323d58a0de352c6a61e08b5a83127c4adc904Zhongxing Xu case Stmt::CXXBoolLiteralExprClass: 7921a45a5ff5d495cb6cd9a3d4d06317af79c0f634dTed Kremenek case Stmt::ObjCBoolLiteralExprClass: 793bc9ad74a13e83303a3a5251f8bacbbca17341c17Zhongxing Xu case Stmt::FloatingLiteralClass: 794f901a7de97f46ba2b1ff153f9fb83d00dc37cfcfDouglas Gregor case Stmt::SizeOfPackExprClass: 795e739a29c62c67eaec0af5c4d5c75f9e8f11228bdTed Kremenek case Stmt::StringLiteralClass: 796e739a29c62c67eaec0af5c4d5c75f9e8f11228bdTed Kremenek case Stmt::ObjCStringLiteralClass: 797cc2c4b293d8590346f26b7ecc16d299226b8794fTed Kremenek case Stmt::CXXBindTemporaryExprClass: 798fee16225a103ee1459af4f3ecb89fa2804e81ac3Jordan Rose case Stmt::CXXPseudoDestructorExprClass: 79969a0e5021c5c49a34aa25cd89b1e613a52097e65Jordan Rose case Stmt::SubstNonTypeTemplateParmExprClass: 800bdd4c848349d4091d66b052efa453e6d69a77e36Ted Kremenek case Stmt::CXXNullPtrLiteralExprClass: { 801bdd4c848349d4091d66b052efa453e6d69a77e36Ted Kremenek Bldr.takeNodes(Pred); 802bdd4c848349d4091d66b052efa453e6d69a77e36Ted Kremenek ExplodedNodeSet preVisit; 803bdd4c848349d4091d66b052efa453e6d69a77e36Ted Kremenek getCheckerManager().runCheckersForPreStmt(preVisit, Pred, S, *this); 804bdd4c848349d4091d66b052efa453e6d69a77e36Ted Kremenek getCheckerManager().runCheckersForPostStmt(Dst, preVisit, S, *this); 805bdd4c848349d4091d66b052efa453e6d69a77e36Ted Kremenek Bldr.addNodes(Dst); 806e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek break; 807bdd4c848349d4091d66b052efa453e6d69a77e36Ted Kremenek } 8081eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 809bccda13aa3fc2a4c674a8c0a7003a7e6b1ff17b0Jordan Rose case Stmt::CXXDefaultArgExprClass: 810bccda13aa3fc2a4c674a8c0a7003a7e6b1ff17b0Jordan Rose case Stmt::CXXDefaultInitExprClass: { 81138f68ef19cb51d5876e9025b5fceb44b33ec9ed7Jordan Rose Bldr.takeNodes(Pred); 81238f68ef19cb51d5876e9025b5fceb44b33ec9ed7Jordan Rose ExplodedNodeSet PreVisit; 81338f68ef19cb51d5876e9025b5fceb44b33ec9ed7Jordan Rose getCheckerManager().runCheckersForPreStmt(PreVisit, Pred, S, *this); 81438f68ef19cb51d5876e9025b5fceb44b33ec9ed7Jordan Rose 81538f68ef19cb51d5876e9025b5fceb44b33ec9ed7Jordan Rose ExplodedNodeSet Tmp; 81638f68ef19cb51d5876e9025b5fceb44b33ec9ed7Jordan Rose StmtNodeBuilder Bldr2(PreVisit, Tmp, *currBldrCtx); 81738f68ef19cb51d5876e9025b5fceb44b33ec9ed7Jordan Rose 818bccda13aa3fc2a4c674a8c0a7003a7e6b1ff17b0Jordan Rose const Expr *ArgE; 819bccda13aa3fc2a4c674a8c0a7003a7e6b1ff17b0Jordan Rose if (const CXXDefaultArgExpr *DefE = dyn_cast<CXXDefaultArgExpr>(S)) 820bccda13aa3fc2a4c674a8c0a7003a7e6b1ff17b0Jordan Rose ArgE = DefE->getExpr(); 821bccda13aa3fc2a4c674a8c0a7003a7e6b1ff17b0Jordan Rose else if (const CXXDefaultInitExpr *DefE = dyn_cast<CXXDefaultInitExpr>(S)) 822bccda13aa3fc2a4c674a8c0a7003a7e6b1ff17b0Jordan Rose ArgE = DefE->getExpr(); 823bccda13aa3fc2a4c674a8c0a7003a7e6b1ff17b0Jordan Rose else 824bccda13aa3fc2a4c674a8c0a7003a7e6b1ff17b0Jordan Rose llvm_unreachable("unknown constant wrapper kind"); 82538f68ef19cb51d5876e9025b5fceb44b33ec9ed7Jordan Rose 8264b75085f5669efc6407c662b5686361624c3ff2fJordan Rose bool IsTemporary = false; 8274b75085f5669efc6407c662b5686361624c3ff2fJordan Rose if (const MaterializeTemporaryExpr *MTE = 8284b75085f5669efc6407c662b5686361624c3ff2fJordan Rose dyn_cast<MaterializeTemporaryExpr>(ArgE)) { 8294b75085f5669efc6407c662b5686361624c3ff2fJordan Rose ArgE = MTE->GetTemporaryExpr(); 8304b75085f5669efc6407c662b5686361624c3ff2fJordan Rose IsTemporary = true; 8314b75085f5669efc6407c662b5686361624c3ff2fJordan Rose } 8324b75085f5669efc6407c662b5686361624c3ff2fJordan Rose 833e2b1246a24e8babf2f58c93713fba16b8edb8e2dJordan Rose Optional<SVal> ConstantVal = svalBuilder.getConstantVal(ArgE); 834e2b1246a24e8babf2f58c93713fba16b8edb8e2dJordan Rose if (!ConstantVal) 835e2b1246a24e8babf2f58c93713fba16b8edb8e2dJordan Rose ConstantVal = UnknownVal(); 83638f68ef19cb51d5876e9025b5fceb44b33ec9ed7Jordan Rose 837bccda13aa3fc2a4c674a8c0a7003a7e6b1ff17b0Jordan Rose const LocationContext *LCtx = Pred->getLocationContext(); 83838f68ef19cb51d5876e9025b5fceb44b33ec9ed7Jordan Rose for (ExplodedNodeSet::iterator I = PreVisit.begin(), E = PreVisit.end(); 83938f68ef19cb51d5876e9025b5fceb44b33ec9ed7Jordan Rose I != E; ++I) { 84038f68ef19cb51d5876e9025b5fceb44b33ec9ed7Jordan Rose ProgramStateRef State = (*I)->getState(); 841bccda13aa3fc2a4c674a8c0a7003a7e6b1ff17b0Jordan Rose State = State->BindExpr(S, LCtx, *ConstantVal); 8424b75085f5669efc6407c662b5686361624c3ff2fJordan Rose if (IsTemporary) 843bccda13aa3fc2a4c674a8c0a7003a7e6b1ff17b0Jordan Rose State = createTemporaryRegionIfNeeded(State, LCtx, 844bccda13aa3fc2a4c674a8c0a7003a7e6b1ff17b0Jordan Rose cast<Expr>(S), 845bccda13aa3fc2a4c674a8c0a7003a7e6b1ff17b0Jordan Rose cast<Expr>(S)); 84638f68ef19cb51d5876e9025b5fceb44b33ec9ed7Jordan Rose Bldr2.generateNode(S, *I, State); 84738f68ef19cb51d5876e9025b5fceb44b33ec9ed7Jordan Rose } 84838f68ef19cb51d5876e9025b5fceb44b33ec9ed7Jordan Rose 84938f68ef19cb51d5876e9025b5fceb44b33ec9ed7Jordan Rose getCheckerManager().runCheckersForPostStmt(Dst, Tmp, S, *this); 85038f68ef19cb51d5876e9025b5fceb44b33ec9ed7Jordan Rose Bldr.addNodes(Dst); 85138f68ef19cb51d5876e9025b5fceb44b33ec9ed7Jordan Rose break; 85238f68ef19cb51d5876e9025b5fceb44b33ec9ed7Jordan Rose } 85338f68ef19cb51d5876e9025b5fceb44b33ec9ed7Jordan Rose 854be2e1b11e3350e3a6e632c71beaab83aae3824d2Jordan Rose // Cases we evaluate as opaque expressions, conjuring a symbol. 855be2e1b11e3350e3a6e632c71beaab83aae3824d2Jordan Rose case Stmt::CXXStdInitializerListExprClass: 8561a45a5ff5d495cb6cd9a3d4d06317af79c0f634dTed Kremenek case Expr::ObjCArrayLiteralClass: 85770fdbc366da85880aae5baebd3351e993ca05603Jordy Rose case Expr::ObjCDictionaryLiteralClass: 85870fdbc366da85880aae5baebd3351e993ca05603Jordy Rose case Expr::ObjCBoxedExprClass: { 8591a45a5ff5d495cb6cd9a3d4d06317af79c0f634dTed Kremenek Bldr.takeNodes(Pred); 8601a45a5ff5d495cb6cd9a3d4d06317af79c0f634dTed Kremenek 8611a45a5ff5d495cb6cd9a3d4d06317af79c0f634dTed Kremenek ExplodedNodeSet preVisit; 8621a45a5ff5d495cb6cd9a3d4d06317af79c0f634dTed Kremenek getCheckerManager().runCheckersForPreStmt(preVisit, Pred, S, *this); 8631a45a5ff5d495cb6cd9a3d4d06317af79c0f634dTed Kremenek 8641a45a5ff5d495cb6cd9a3d4d06317af79c0f634dTed Kremenek ExplodedNodeSet Tmp; 86566c486f275531df6362b3511fc3af6563561801bTed Kremenek StmtNodeBuilder Bldr2(preVisit, Tmp, *currBldrCtx); 8661a45a5ff5d495cb6cd9a3d4d06317af79c0f634dTed Kremenek 86770fdbc366da85880aae5baebd3351e993ca05603Jordy Rose const Expr *Ex = cast<Expr>(S); 86870fdbc366da85880aae5baebd3351e993ca05603Jordy Rose QualType resultType = Ex->getType(); 86970fdbc366da85880aae5baebd3351e993ca05603Jordy Rose 8701a45a5ff5d495cb6cd9a3d4d06317af79c0f634dTed Kremenek for (ExplodedNodeSet::iterator it = preVisit.begin(), et = preVisit.end(); 8711a45a5ff5d495cb6cd9a3d4d06317af79c0f634dTed Kremenek it != et; ++it) { 8721a45a5ff5d495cb6cd9a3d4d06317af79c0f634dTed Kremenek ExplodedNode *N = *it; 8731a45a5ff5d495cb6cd9a3d4d06317af79c0f634dTed Kremenek const LocationContext *LCtx = N->getLocationContext(); 8743b1df8bb941a18c4a7256d7cfcbccb9de7e39995Ted Kremenek SVal result = svalBuilder.conjureSymbolVal(0, Ex, LCtx, resultType, 87566c486f275531df6362b3511fc3af6563561801bTed Kremenek currBldrCtx->blockCount()); 8761a45a5ff5d495cb6cd9a3d4d06317af79c0f634dTed Kremenek ProgramStateRef state = N->getState()->BindExpr(Ex, LCtx, result); 8771a45a5ff5d495cb6cd9a3d4d06317af79c0f634dTed Kremenek Bldr2.generateNode(S, N, state); 8781a45a5ff5d495cb6cd9a3d4d06317af79c0f634dTed Kremenek } 8791a45a5ff5d495cb6cd9a3d4d06317af79c0f634dTed Kremenek 8801a45a5ff5d495cb6cd9a3d4d06317af79c0f634dTed Kremenek getCheckerManager().runCheckersForPostStmt(Dst, Tmp, S, *this); 8811a45a5ff5d495cb6cd9a3d4d06317af79c0f634dTed Kremenek Bldr.addNodes(Dst); 8821a45a5ff5d495cb6cd9a3d4d06317af79c0f634dTed Kremenek break; 8831a45a5ff5d495cb6cd9a3d4d06317af79c0f634dTed Kremenek } 8841a45a5ff5d495cb6cd9a3d4d06317af79c0f634dTed Kremenek 885540cbe2b60294fe7b926c26b4f1840f544fe3011Ted Kremenek case Stmt::ArraySubscriptExprClass: 886ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.takeNodes(Pred); 887892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek VisitLvalArraySubscriptExpr(cast<ArraySubscriptExpr>(S), Pred, Dst); 888ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.addNodes(Dst); 889540cbe2b60294fe7b926c26b4f1840f544fe3011Ted Kremenek break; 8901eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 891df5faf5e7ae6823d0af0b801c4ac26d47f2cee97Chad Rosier case Stmt::GCCAsmStmtClass: 892ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.takeNodes(Pred); 893df5faf5e7ae6823d0af0b801c4ac26d47f2cee97Chad Rosier VisitGCCAsmStmt(cast<GCCAsmStmt>(S), Pred, Dst); 894ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.addNodes(Dst); 895e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek break; 896b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 8978cd64b4c5553fa6284d248336cb7c82dc960a394Chad Rosier case Stmt::MSAsmStmtClass: 8988cd64b4c5553fa6284d248336cb7c82dc960a394Chad Rosier Bldr.takeNodes(Pred); 8998cd64b4c5553fa6284d248336cb7c82dc960a394Chad Rosier VisitMSAsmStmt(cast<MSAsmStmt>(S), Pred, Dst); 9008cd64b4c5553fa6284d248336cb7c82dc960a394Chad Rosier Bldr.addNodes(Dst); 9018cd64b4c5553fa6284d248336cb7c82dc960a394Chad Rosier break; 9028cd64b4c5553fa6284d248336cb7c82dc960a394Chad Rosier 903c95ad9ff6e574aecdd759542d5578bc65d586d93Ted Kremenek case Stmt::BlockExprClass: 904ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.takeNodes(Pred); 905c95ad9ff6e574aecdd759542d5578bc65d586d93Ted Kremenek VisitBlockExpr(cast<BlockExpr>(S), Pred, Dst); 906ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.addNodes(Dst); 907c95ad9ff6e574aecdd759542d5578bc65d586d93Ted Kremenek break; 908c95ad9ff6e574aecdd759542d5578bc65d586d93Ted Kremenek 909e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek case Stmt::BinaryOperatorClass: { 91003509aea098772644bf4662dc1c88634818ceeccZhongxing Xu const BinaryOperator* B = cast<BinaryOperator>(S); 911e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek if (B->isLogicalOp()) { 912ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.takeNodes(Pred); 913e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek VisitLogicalExpr(B, Pred, Dst); 914ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.addNodes(Dst); 915e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek break; 916e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek } 9172de56d1d0c3a504ad1529de2677628bdfbb95cd4John McCall else if (B->getOpcode() == BO_Comma) { 9188bef8238181a30e52dea380789a7e2d760eac532Ted Kremenek ProgramStateRef state = Pred->getState(); 919ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.generateNode(B, Pred, 9205eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek state->BindExpr(B, Pred->getLocationContext(), 9215eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek state->getSVal(B->getRHS(), 9225eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek Pred->getLocationContext()))); 923e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek break; 924e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek } 92506fb99fb403bff1651429923f666a2ebe2b1522fTed Kremenek 926ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.takeNodes(Pred); 927ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks 9280caa2d47b84337e942b3f6652adfafe4ae506cfeTed Kremenek if (AMgr.options.eagerlyAssumeBinOpBifurcation && 929bb141217871e93767aa3f2de1b9946fa6d37066aZhongxing Xu (B->isRelationalOp() || B->isEqualityOp())) { 930031ccc0555a82afc2e8afe29e19dd57ff204e2deZhongxing Xu ExplodedNodeSet Tmp; 931892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek VisitBinaryOperator(cast<BinaryOperator>(S), Pred, Tmp); 9320caa2d47b84337e942b3f6652adfafe4ae506cfeTed Kremenek evalEagerlyAssumeBinOpBifurcation(Dst, Tmp, cast<Expr>(S)); 93348af2a9c1ed3259512f2d1431720add1fbe8fb5fTed Kremenek } 93448af2a9c1ed3259512f2d1431720add1fbe8fb5fTed Kremenek else 935892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek VisitBinaryOperator(cast<BinaryOperator>(S), Pred, Dst); 93648af2a9c1ed3259512f2d1431720add1fbe8fb5fTed Kremenek 937ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.addNodes(Dst); 938e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek break; 939e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek } 94006fb99fb403bff1651429923f666a2ebe2b1522fTed Kremenek 941f1e67d75fc922ff905de9faa6326bb1a96685ec1Jordan Rose case Stmt::CXXOperatorCallExprClass: { 942f1e67d75fc922ff905de9faa6326bb1a96685ec1Jordan Rose const CXXOperatorCallExpr *OCE = cast<CXXOperatorCallExpr>(S); 943f1e67d75fc922ff905de9faa6326bb1a96685ec1Jordan Rose 944f1e67d75fc922ff905de9faa6326bb1a96685ec1Jordan Rose // For instance method operators, make sure the 'this' argument has a 945f1e67d75fc922ff905de9faa6326bb1a96685ec1Jordan Rose // valid region. 946f1e67d75fc922ff905de9faa6326bb1a96685ec1Jordan Rose const Decl *Callee = OCE->getCalleeDecl(); 947f1e67d75fc922ff905de9faa6326bb1a96685ec1Jordan Rose if (const CXXMethodDecl *MD = dyn_cast_or_null<CXXMethodDecl>(Callee)) { 948f1e67d75fc922ff905de9faa6326bb1a96685ec1Jordan Rose if (MD->isInstance()) { 949f1e67d75fc922ff905de9faa6326bb1a96685ec1Jordan Rose ProgramStateRef State = Pred->getState(); 950f1e67d75fc922ff905de9faa6326bb1a96685ec1Jordan Rose const LocationContext *LCtx = Pred->getLocationContext(); 951f1e67d75fc922ff905de9faa6326bb1a96685ec1Jordan Rose ProgramStateRef NewState = 952f1e67d75fc922ff905de9faa6326bb1a96685ec1Jordan Rose createTemporaryRegionIfNeeded(State, LCtx, OCE->getArg(0)); 953476f41c4750421a7ead5014e75a0e790ff682754Jordan Rose if (NewState != State) { 954f1e67d75fc922ff905de9faa6326bb1a96685ec1Jordan Rose Pred = Bldr.generateNode(OCE, Pred, NewState, /*Tag=*/0, 955f1e67d75fc922ff905de9faa6326bb1a96685ec1Jordan Rose ProgramPoint::PreStmtKind); 956476f41c4750421a7ead5014e75a0e790ff682754Jordan Rose // Did we cache out? 957476f41c4750421a7ead5014e75a0e790ff682754Jordan Rose if (!Pred) 958476f41c4750421a7ead5014e75a0e790ff682754Jordan Rose break; 959476f41c4750421a7ead5014e75a0e790ff682754Jordan Rose } 960f1e67d75fc922ff905de9faa6326bb1a96685ec1Jordan Rose } 961f1e67d75fc922ff905de9faa6326bb1a96685ec1Jordan Rose } 962f1e67d75fc922ff905de9faa6326bb1a96685ec1Jordan Rose // FALLTHROUGH 963f1e67d75fc922ff905de9faa6326bb1a96685ec1Jordan Rose } 964b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek case Stmt::CallExprClass: 9659fcce65e7e1307b5b8da9be13e4092d6bb94dc1dRichard Smith case Stmt::CXXMemberCallExprClass: 9669fcce65e7e1307b5b8da9be13e4092d6bb94dc1dRichard Smith case Stmt::UserDefinedLiteralClass: { 967ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.takeNodes(Pred); 968b277159055933e610bbc80262b600d3ad7e0595cTed Kremenek VisitCallExpr(cast<CallExpr>(S), Pred, Dst); 969ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.addNodes(Dst); 97006fb99fb403bff1651429923f666a2ebe2b1522fTed Kremenek break; 971e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek } 972337e4dbc6859589b8878146a88bebf754e916702Ted Kremenek 973337e4dbc6859589b8878146a88bebf754e916702Ted Kremenek case Stmt::CXXCatchStmtClass: { 974337e4dbc6859589b8878146a88bebf754e916702Ted Kremenek Bldr.takeNodes(Pred); 975337e4dbc6859589b8878146a88bebf754e916702Ted Kremenek VisitCXXCatchStmt(cast<CXXCatchStmt>(S), Pred, Dst); 976337e4dbc6859589b8878146a88bebf754e916702Ted Kremenek Bldr.addNodes(Dst); 977337e4dbc6859589b8878146a88bebf754e916702Ted Kremenek break; 978337e4dbc6859589b8878146a88bebf754e916702Ted Kremenek } 97906fb99fb403bff1651429923f666a2ebe2b1522fTed Kremenek 980744f1cd66bb6747ea71fbf1172698e7bf35ec88dTed Kremenek case Stmt::CXXTemporaryObjectExprClass: 981888c90ac0ef6baf7d47e86cf5cc4715707d223b1Jordan Rose case Stmt::CXXConstructExprClass: { 982ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.takeNodes(Pred); 983888c90ac0ef6baf7d47e86cf5cc4715707d223b1Jordan Rose VisitCXXConstructExpr(cast<CXXConstructExpr>(S), Pred, Dst); 984ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.addNodes(Dst); 9857ce351db56fbce162a3b650518ce05b5c61ebf36Zhongxing Xu break; 9867ce351db56fbce162a3b650518ce05b5c61ebf36Zhongxing Xu } 9877ce351db56fbce162a3b650518ce05b5c61ebf36Zhongxing Xu 988d74324371465a152387ac45e737ab7d23e543552Anton Yartsev case Stmt::CXXNewExprClass: { 989d74324371465a152387ac45e737ab7d23e543552Anton Yartsev Bldr.takeNodes(Pred); 990d74324371465a152387ac45e737ab7d23e543552Anton Yartsev ExplodedNodeSet PostVisit; 991d74324371465a152387ac45e737ab7d23e543552Anton Yartsev VisitCXXNewExpr(cast<CXXNewExpr>(S), Pred, PostVisit); 992d74324371465a152387ac45e737ab7d23e543552Anton Yartsev getCheckerManager().runCheckersForPostStmt(Dst, PostVisit, S, *this); 993d74324371465a152387ac45e737ab7d23e543552Anton Yartsev Bldr.addNodes(Dst); 994d74324371465a152387ac45e737ab7d23e543552Anton Yartsev break; 995d74324371465a152387ac45e737ab7d23e543552Anton Yartsev } 996d74324371465a152387ac45e737ab7d23e543552Anton Yartsev 997d74324371465a152387ac45e737ab7d23e543552Anton Yartsev case Stmt::CXXDeleteExprClass: { 998d74324371465a152387ac45e737ab7d23e543552Anton Yartsev Bldr.takeNodes(Pred); 999d74324371465a152387ac45e737ab7d23e543552Anton Yartsev ExplodedNodeSet PreVisit; 1000d74324371465a152387ac45e737ab7d23e543552Anton Yartsev const CXXDeleteExpr *CDE = cast<CXXDeleteExpr>(S); 1001d74324371465a152387ac45e737ab7d23e543552Anton Yartsev getCheckerManager().runCheckersForPreStmt(PreVisit, Pred, S, *this); 1002d74324371465a152387ac45e737ab7d23e543552Anton Yartsev 1003d74324371465a152387ac45e737ab7d23e543552Anton Yartsev for (ExplodedNodeSet::iterator i = PreVisit.begin(), 1004d74324371465a152387ac45e737ab7d23e543552Anton Yartsev e = PreVisit.end(); i != e ; ++i) 1005d74324371465a152387ac45e737ab7d23e543552Anton Yartsev VisitCXXDeleteExpr(CDE, *i, Dst); 1006d74324371465a152387ac45e737ab7d23e543552Anton Yartsev 1007d74324371465a152387ac45e737ab7d23e543552Anton Yartsev Bldr.addNodes(Dst); 1008d74324371465a152387ac45e737ab7d23e543552Anton Yartsev break; 1009d74324371465a152387ac45e737ab7d23e543552Anton Yartsev } 1010e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek // FIXME: ChooseExpr is really a constant. We need to fix 1011e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek // the CFG do not model them as explicit control-flow. 10121eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1013e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek case Stmt::ChooseExprClass: { // __builtin_choose_expr 1014ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.takeNodes(Pred); 10159c378f705405d37f49795d5e915989de774fe11fTed Kremenek const ChooseExpr *C = cast<ChooseExpr>(S); 1016e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek VisitGuardedExpr(C, C->getLHS(), C->getRHS(), Pred, Dst); 1017ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.addNodes(Dst); 1018e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek break; 1019e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek } 10201eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1021e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek case Stmt::CompoundAssignOperatorClass: 1022ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.takeNodes(Pred); 1023892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek VisitBinaryOperator(cast<BinaryOperator>(S), Pred, Dst); 1024ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.addNodes(Dst); 1025e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek break; 1026f22679e3e5d5f5754931952e58112b4c863a4137Zhongxing Xu 1027f22679e3e5d5f5754931952e58112b4c863a4137Zhongxing Xu case Stmt::CompoundLiteralExprClass: 1028ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.takeNodes(Pred); 1029892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek VisitCompoundLiteralExpr(cast<CompoundLiteralExpr>(S), Pred, Dst); 1030ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.addNodes(Dst); 1031f22679e3e5d5f5754931952e58112b4c863a4137Zhongxing Xu break; 10321eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 103356ca35d396d8692c384c785f9aeebcf22563fe1eJohn McCall case Stmt::BinaryConditionalOperatorClass: 1034e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek case Stmt::ConditionalOperatorClass: { // '?' operator 1035ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.takeNodes(Pred); 103656ca35d396d8692c384c785f9aeebcf22563fe1eJohn McCall const AbstractConditionalOperator *C 103756ca35d396d8692c384c785f9aeebcf22563fe1eJohn McCall = cast<AbstractConditionalOperator>(S); 103856ca35d396d8692c384c785f9aeebcf22563fe1eJohn McCall VisitGuardedExpr(C, C->getTrueExpr(), C->getFalseExpr(), Pred, Dst); 1039ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.addNodes(Dst); 1040e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek break; 1041e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek } 10421eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1043bb141217871e93767aa3f2de1b9946fa6d37066aZhongxing Xu case Stmt::CXXThisExprClass: 1044ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.takeNodes(Pred); 1045bb141217871e93767aa3f2de1b9946fa6d37066aZhongxing Xu VisitCXXThisExpr(cast<CXXThisExpr>(S), Pred, Dst); 1046ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.addNodes(Dst); 1047bb141217871e93767aa3f2de1b9946fa6d37066aZhongxing Xu break; 1048bb141217871e93767aa3f2de1b9946fa6d37066aZhongxing Xu 1049892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek case Stmt::DeclRefExprClass: { 1050ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.takeNodes(Pred); 1051892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek const DeclRefExpr *DE = cast<DeclRefExpr>(S); 1052892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek VisitCommonDeclRefExpr(DE, DE->getDecl(), Pred, Dst); 1053ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.addNodes(Dst); 1054e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek break; 1055892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek } 10561eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1057e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek case Stmt::DeclStmtClass: 1058ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.takeNodes(Pred); 1059e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek VisitDeclStmt(cast<DeclStmt>(S), Pred, Dst); 1060ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.addNodes(Dst); 1061e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek break; 10621eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 10630835a3cdeefe714b4959d31127ea155e56393125Argyrios Kyrtzidis case Stmt::ImplicitCastExprClass: 10640d9d736c49b51691ced96759ec99399824e2a602Zhongxing Xu case Stmt::CStyleCastExprClass: 10650d9d736c49b51691ced96759ec99399824e2a602Zhongxing Xu case Stmt::CXXStaticCastExprClass: 10660d9d736c49b51691ced96759ec99399824e2a602Zhongxing Xu case Stmt::CXXDynamicCastExprClass: 10670d9d736c49b51691ced96759ec99399824e2a602Zhongxing Xu case Stmt::CXXReinterpretCastExprClass: 10680d9d736c49b51691ced96759ec99399824e2a602Zhongxing Xu case Stmt::CXXConstCastExprClass: 1069f85e193739c953358c865005855253af4f68a497John McCall case Stmt::CXXFunctionalCastExprClass: 1070f85e193739c953358c865005855253af4f68a497John McCall case Stmt::ObjCBridgedCastExprClass: { 1071ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.takeNodes(Pred); 10729c378f705405d37f49795d5e915989de774fe11fTed Kremenek const CastExpr *C = cast<CastExpr>(S); 1073f85e193739c953358c865005855253af4f68a497John McCall // Handle the previsit checks. 1074f85e193739c953358c865005855253af4f68a497John McCall ExplodedNodeSet dstPrevisit; 1075f85e193739c953358c865005855253af4f68a497John McCall getCheckerManager().runCheckersForPreStmt(dstPrevisit, Pred, C, *this); 1076f85e193739c953358c865005855253af4f68a497John McCall 1077f85e193739c953358c865005855253af4f68a497John McCall // Handle the expression itself. 1078f85e193739c953358c865005855253af4f68a497John McCall ExplodedNodeSet dstExpr; 1079f85e193739c953358c865005855253af4f68a497John McCall for (ExplodedNodeSet::iterator i = dstPrevisit.begin(), 1080f85e193739c953358c865005855253af4f68a497John McCall e = dstPrevisit.end(); i != e ; ++i) { 1081f85e193739c953358c865005855253af4f68a497John McCall VisitCast(C, C->getSubExpr(), *i, dstExpr); 1082f85e193739c953358c865005855253af4f68a497John McCall } 1083f85e193739c953358c865005855253af4f68a497John McCall 1084f85e193739c953358c865005855253af4f68a497John McCall // Handle the postvisit checks. 1085f85e193739c953358c865005855253af4f68a497John McCall getCheckerManager().runCheckersForPostStmt(Dst, dstExpr, C, *this); 1086ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.addNodes(Dst); 1087e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek break; 1088e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek } 1089b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 109003e80030515c800d1ab44125b9052dfffd1bd04cDouglas Gregor case Expr::MaterializeTemporaryExprClass: { 1091ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.takeNodes(Pred); 1092c210cb7a358d14cdd93b58562f33ff5ed2d895c1Jordan Rose const MaterializeTemporaryExpr *MTE = cast<MaterializeTemporaryExpr>(S); 1093c210cb7a358d14cdd93b58562f33ff5ed2d895c1Jordan Rose CreateCXXTemporaryObject(MTE, Pred, Dst); 1094ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.addNodes(Dst); 109503e80030515c800d1ab44125b9052dfffd1bd04cDouglas Gregor break; 109603e80030515c800d1ab44125b9052dfffd1bd04cDouglas Gregor } 109703e80030515c800d1ab44125b9052dfffd1bd04cDouglas Gregor 1098c4f8706b6539e06a5de153bd72850bb2e0a71456Zhongxing Xu case Stmt::InitListExprClass: 1099ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.takeNodes(Pred); 1100c4f8706b6539e06a5de153bd72850bb2e0a71456Zhongxing Xu VisitInitListExpr(cast<InitListExpr>(S), Pred, Dst); 1101ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.addNodes(Dst); 1102c4f8706b6539e06a5de153bd72850bb2e0a71456Zhongxing Xu break; 11031eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 110497ed4f68f5dba3e21e7a490ef0f9ffd3bfead7f8Ted Kremenek case Stmt::MemberExprClass: 1105ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.takeNodes(Pred); 1106892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek VisitMemberExpr(cast<MemberExpr>(S), Pred, Dst); 1107ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.addNodes(Dst); 1108469ecbded3616416ef938ed94a67f86149faf226Ted Kremenek break; 1109ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks 111097ed4f68f5dba3e21e7a490ef0f9ffd3bfead7f8Ted Kremenek case Stmt::ObjCIvarRefExprClass: 1111ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.takeNodes(Pred); 1112892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek VisitLvalObjCIvarRefExpr(cast<ObjCIvarRefExpr>(S), Pred, Dst); 1113ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.addNodes(Dst); 111497ed4f68f5dba3e21e7a490ef0f9ffd3bfead7f8Ted Kremenek break; 1115af3374187c47acea45706eab6744be6b1c66a856Ted Kremenek 1116af3374187c47acea45706eab6744be6b1c66a856Ted Kremenek case Stmt::ObjCForCollectionStmtClass: 1117ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.takeNodes(Pred); 1118af3374187c47acea45706eab6744be6b1c66a856Ted Kremenek VisitObjCForCollectionStmt(cast<ObjCForCollectionStmt>(S), Pred, Dst); 1119ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.addNodes(Dst); 1120af3374187c47acea45706eab6744be6b1c66a856Ted Kremenek break; 11211eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1122d563d3fb73879df7147b8a5302c3bf0e1402ba18Jordan Rose case Stmt::ObjCMessageExprClass: 1123ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.takeNodes(Pred); 1124d563d3fb73879df7147b8a5302c3bf0e1402ba18Jordan Rose VisitObjCMessage(cast<ObjCMessageExpr>(S), Pred, Dst); 1125ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.addNodes(Dst); 1126e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek break; 11271eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1128c32a453e40b2c8878fed10512fb2f570b7aba576Jordan Rose case Stmt::ObjCAtThrowStmtClass: 1129c32a453e40b2c8878fed10512fb2f570b7aba576Jordan Rose case Stmt::CXXThrowExprClass: 1130bbfd07a0c94f659beaf74316029ef73769cefb81Ted Kremenek // FIXME: This is not complete. We basically treat @throw as 1131bbfd07a0c94f659beaf74316029ef73769cefb81Ted Kremenek // an abort. 1132fa06f0464a04bb7fce1fcfb3780d151bb029e00cJordan Rose Bldr.generateSink(S, Pred, Pred->getState()); 1133bbfd07a0c94f659beaf74316029ef73769cefb81Ted Kremenek break; 11341eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 11351b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek case Stmt::ReturnStmtClass: 1136ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.takeNodes(Pred); 11371b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek VisitReturnStmt(cast<ReturnStmt>(S), Pred, Dst); 1138ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.addNodes(Dst); 11391b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek break; 11401eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 11418ecdb65716cd7914ffb2eeee993fa9039fcd31e8Douglas Gregor case Stmt::OffsetOfExprClass: 1142ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.takeNodes(Pred); 11438ecdb65716cd7914ffb2eeee993fa9039fcd31e8Douglas Gregor VisitOffsetOfExpr(cast<OffsetOfExpr>(S), Pred, Dst); 1144ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.addNodes(Dst); 11458ecdb65716cd7914ffb2eeee993fa9039fcd31e8Douglas Gregor break; 11468ecdb65716cd7914ffb2eeee993fa9039fcd31e8Douglas Gregor 1147f4e3cfbe8abd124be6341ef5d714819b4fbd9082Peter Collingbourne case Stmt::UnaryExprOrTypeTraitExprClass: 1148ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.takeNodes(Pred); 1149f4e3cfbe8abd124be6341ef5d714819b4fbd9082Peter Collingbourne VisitUnaryExprOrTypeTraitExpr(cast<UnaryExprOrTypeTraitExpr>(S), 1150f4e3cfbe8abd124be6341ef5d714819b4fbd9082Peter Collingbourne Pred, Dst); 1151ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.addNodes(Dst); 1152e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek break; 11531eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1154e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek case Stmt::StmtExprClass: { 11559c378f705405d37f49795d5e915989de774fe11fTed Kremenek const StmtExpr *SE = cast<StmtExpr>(S); 1156a3d1eb85853eae7b719f679b40923826b5e4b7dfTed Kremenek 1157a3d1eb85853eae7b719f679b40923826b5e4b7dfTed Kremenek if (SE->getSubStmt()->body_empty()) { 1158a3d1eb85853eae7b719f679b40923826b5e4b7dfTed Kremenek // Empty statement expression. 1159a3d1eb85853eae7b719f679b40923826b5e4b7dfTed Kremenek assert(SE->getType() == getContext().VoidTy 1160a3d1eb85853eae7b719f679b40923826b5e4b7dfTed Kremenek && "Empty statement expression must have void type."); 1161a3d1eb85853eae7b719f679b40923826b5e4b7dfTed Kremenek break; 1162a3d1eb85853eae7b719f679b40923826b5e4b7dfTed Kremenek } 11631eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 11649c378f705405d37f49795d5e915989de774fe11fTed Kremenek if (Expr *LastExpr = dyn_cast<Expr>(*SE->getSubStmt()->body_rbegin())) { 11658bef8238181a30e52dea380789a7e2d760eac532Ted Kremenek ProgramStateRef state = Pred->getState(); 1166ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.generateNode(SE, Pred, 11675eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek state->BindExpr(SE, Pred->getLocationContext(), 11685eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek state->getSVal(LastExpr, 11695eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek Pred->getLocationContext()))); 1170a3d1eb85853eae7b719f679b40923826b5e4b7dfTed Kremenek } 1171e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek break; 1172e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek } 11736987c7b74146b9658b1925c5981f8b0cd0672b55Zhongxing Xu 117472374594c5d9ade02451bc85cf9dfa5b0ea106e7Ted Kremenek case Stmt::UnaryOperatorClass: { 1175ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.takeNodes(Pred); 117603509aea098772644bf4662dc1c88634818ceeccZhongxing Xu const UnaryOperator *U = cast<UnaryOperator>(S); 11770caa2d47b84337e942b3f6652adfafe4ae506cfeTed Kremenek if (AMgr.options.eagerlyAssumeBinOpBifurcation && (U->getOpcode() == UO_LNot)) { 1178031ccc0555a82afc2e8afe29e19dd57ff204e2deZhongxing Xu ExplodedNodeSet Tmp; 1179892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek VisitUnaryOperator(U, Pred, Tmp); 11800caa2d47b84337e942b3f6652adfafe4ae506cfeTed Kremenek evalEagerlyAssumeBinOpBifurcation(Dst, Tmp, U); 118172374594c5d9ade02451bc85cf9dfa5b0ea106e7Ted Kremenek } 118272374594c5d9ade02451bc85cf9dfa5b0ea106e7Ted Kremenek else 1183892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek VisitUnaryOperator(U, Pred, Dst); 1184ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks Bldr.addNodes(Dst); 11851b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek break; 118672374594c5d9ade02451bc85cf9dfa5b0ea106e7Ted Kremenek } 11874b9c2d235fb9449e249d74f48ecfec601650de93John McCall 11884b9c2d235fb9449e249d74f48ecfec601650de93John McCall case Stmt::PseudoObjectExprClass: { 11894b9c2d235fb9449e249d74f48ecfec601650de93John McCall Bldr.takeNodes(Pred); 11908bef8238181a30e52dea380789a7e2d760eac532Ted Kremenek ProgramStateRef state = Pred->getState(); 11914b9c2d235fb9449e249d74f48ecfec601650de93John McCall const PseudoObjectExpr *PE = cast<PseudoObjectExpr>(S); 11924b9c2d235fb9449e249d74f48ecfec601650de93John McCall if (const Expr *Result = PE->getResultExpr()) { 11935eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek SVal V = state->getSVal(Result, Pred->getLocationContext()); 11945eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek Bldr.generateNode(S, Pred, 11955eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek state->BindExpr(S, Pred->getLocationContext(), V)); 11964b9c2d235fb9449e249d74f48ecfec601650de93John McCall } 11974b9c2d235fb9449e249d74f48ecfec601650de93John McCall else 11985eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek Bldr.generateNode(S, Pred, 11995eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek state->BindExpr(S, Pred->getLocationContext(), 12005eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek UnknownVal())); 12014b9c2d235fb9449e249d74f48ecfec601650de93John McCall 12024b9c2d235fb9449e249d74f48ecfec601650de93John McCall Bldr.addNodes(Dst); 12034b9c2d235fb9449e249d74f48ecfec601650de93John McCall break; 12044b9c2d235fb9449e249d74f48ecfec601650de93John McCall } 12051b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek } 12061b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek} 12071b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek 12085903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaksbool ExprEngine::replayWithoutInlining(ExplodedNode *N, 12095903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks const LocationContext *CalleeLC) { 12105903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks const StackFrameContext *CalleeSF = CalleeLC->getCurrentStackFrame(); 12115903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks const StackFrameContext *CallerSF = CalleeSF->getParent()->getCurrentStackFrame(); 12125903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks assert(CalleeSF && CallerSF); 12135903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks ExplodedNode *BeforeProcessingCall = 0; 121428038f33aa2db4833881fea757a1f0daf85ac02bJordan Rose const Stmt *CE = CalleeSF->getCallSite(); 12155903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks 12165903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks // Find the first node before we started processing the call expression. 12175903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks while (N) { 12185903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks ProgramPoint L = N->getLocation(); 12195903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks BeforeProcessingCall = N; 12205903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks N = N->pred_empty() ? NULL : *(N->pred_begin()); 12215903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks 12225903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks // Skip the nodes corresponding to the inlined code. 12235903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks if (L.getLocationContext()->getCurrentStackFrame() != CallerSF) 12245903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks continue; 12255903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks // We reached the caller. Find the node right before we started 122628038f33aa2db4833881fea757a1f0daf85ac02bJordan Rose // processing the call. 12270b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks if (L.isPurgeKind()) 12285903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks continue; 12297a95de68c093991047ed8d339479ccad51b88663David Blaikie if (L.getAs<PreImplicitCall>()) 123028038f33aa2db4833881fea757a1f0daf85ac02bJordan Rose continue; 12317a95de68c093991047ed8d339479ccad51b88663David Blaikie if (L.getAs<CallEnter>()) 1232852aa0d2c5d2d1faf2d77b5aa3c0848068a342c5Jordan Rose continue; 12337a95de68c093991047ed8d339479ccad51b88663David Blaikie if (Optional<StmtPoint> SP = L.getAs<StmtPoint>()) 123428038f33aa2db4833881fea757a1f0daf85ac02bJordan Rose if (SP->getStmt() == CE) 12355903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks continue; 12365903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks break; 12375903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks } 12385903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks 1239253955ca25c7e7049963b5db613c0cd15d66e4f8Anna Zaks if (!BeforeProcessingCall) 12405903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks return false; 12415903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks 12425903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks // TODO: Clean up the unneeded nodes. 12435903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks 12445903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks // Build an Epsilon node from which we will restart the analyzes. 124528038f33aa2db4833881fea757a1f0daf85ac02bJordan Rose // Note that CE is permitted to be NULL! 12465903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks ProgramPoint NewNodeLoc = 12475903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks EpsilonPoint(BeforeProcessingCall->getLocationContext(), CE); 12485903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks // Add the special flag to GDM to signal retrying with no inlining. 12495903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks // Note, changing the state ensures that we are not going to cache out. 12505903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks ProgramStateRef NewNodeState = BeforeProcessingCall->getState(); 125116303fcc569ea149dc2de38ff9e367d2d4831ceeDavid Greene NewNodeState = 125216303fcc569ea149dc2de38ff9e367d2d4831ceeDavid Greene NewNodeState->set<ReplayWithoutInlining>(const_cast<Stmt *>(CE)); 12535903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks 12545903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks // Make the new node a successor of BeforeProcessingCall. 12555903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks bool IsNew = false; 12565903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks ExplodedNode *NewNode = G.getNode(NewNodeLoc, NewNodeState, false, &IsNew); 1257253955ca25c7e7049963b5db613c0cd15d66e4f8Anna Zaks // We cached out at this point. Caching out is common due to us backtracking 1258253955ca25c7e7049963b5db613c0cd15d66e4f8Anna Zaks // from the inlined function, which might spawn several paths. 1259253955ca25c7e7049963b5db613c0cd15d66e4f8Anna Zaks if (!IsNew) 1260253955ca25c7e7049963b5db613c0cd15d66e4f8Anna Zaks return true; 1261253955ca25c7e7049963b5db613c0cd15d66e4f8Anna Zaks 12625903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks NewNode->addPredecessor(BeforeProcessingCall, G); 12635903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks 12645903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks // Add the new node to the work list. 12655903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks Engine.enqueueStmtNode(NewNode, CalleeSF->getCallSiteBlock(), 12665903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks CalleeSF->getIndex()); 12675903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks NumTimesRetriedWithoutInlining++; 12685903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks return true; 12695903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks} 12705903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks 1271c03a39e16762627b421247b12a2658be630a3300Anna Zaks/// Block entrance. (Update counters). 1272253955ca25c7e7049963b5db613c0cd15d66e4f8Anna Zaksvoid ExprEngine::processCFGBlockEntrance(const BlockEdge &L, 1273b355be838a22a511d078504b2277f70aea52ca85Anna Zaks NodeBuilderWithSinks &nodeBuilder, 1274b355be838a22a511d078504b2277f70aea52ca85Anna Zaks ExplodedNode *Pred) { 1275ac7cc2d37e82181e73fcc265c1d0a619d18b7605Jordan Rose PrettyStackTraceLocationContext CrashInfo(Pred->getLocationContext()); 1276ac7cc2d37e82181e73fcc265c1d0a619d18b7605Jordan Rose 127727c54e57c4a012dcdf2b40cf985b70d0b9caa69eTed Kremenek // FIXME: Refactor this into a checker. 12782fa9d72d4d23ccdcd4137946e5ebafac7a04f04cTed Kremenek if (nodeBuilder.getContext().blockCount() >= AMgr.options.maxBlockVisitOnPath) { 1279651f13cea278ec967336033dd032faef0e9fc2ecStephen Hines static SimpleProgramPointTag tag(TagProviderName, "Block count exceeded"); 1280253955ca25c7e7049963b5db613c0cd15d66e4f8Anna Zaks const ExplodedNode *Sink = 1281b355be838a22a511d078504b2277f70aea52ca85Anna Zaks nodeBuilder.generateSink(Pred->getState(), Pred, &tag); 1282749bbe6f5f23676244f12a0d41511c8e73516febAnna Zaks 1283749bbe6f5f23676244f12a0d41511c8e73516febAnna Zaks // Check if we stopped at the top level function or not. 1284749bbe6f5f23676244f12a0d41511c8e73516febAnna Zaks // Root node should have the location context of the top most function. 1285b355be838a22a511d078504b2277f70aea52ca85Anna Zaks const LocationContext *CalleeLC = Pred->getLocation().getLocationContext(); 12863bbd8cd831788c506f2980293eb3c7e1b3ca2501Anna Zaks const LocationContext *CalleeSF = CalleeLC->getCurrentStackFrame(); 12875903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks const LocationContext *RootLC = 12885903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks (*G.roots_begin())->getLocation().getLocationContext(); 12893bbd8cd831788c506f2980293eb3c7e1b3ca2501Anna Zaks if (RootLC->getCurrentStackFrame() != CalleeSF) { 1290e62f048960645b79363408fdead53fec2a063c52Anna Zaks Engine.FunctionSummaries->markReachedMaxBlockCount(CalleeSF->getDecl()); 12913bbd8cd831788c506f2980293eb3c7e1b3ca2501Anna Zaks 12925903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks // Re-run the call evaluation without inlining it, by storing the 12935903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks // no-inlining policy in the state and enqueuing the new work item on 12945903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks // the list. Replay should almost never fail. Use the stats to catch it 12955903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks // if it does. 1296255d4d4226b24036ceb11228fbb74286e58620f7Ted Kremenek if ((!AMgr.options.NoRetryExhausted && 1297b355be838a22a511d078504b2277f70aea52ca85Anna Zaks replayWithoutInlining(Pred, CalleeLC))) 1298253955ca25c7e7049963b5db613c0cd15d66e4f8Anna Zaks return; 1299253955ca25c7e7049963b5db613c0cd15d66e4f8Anna Zaks NumMaxBlockCountReachedInInlined++; 13005903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks } else 1301749bbe6f5f23676244f12a0d41511c8e73516febAnna Zaks NumMaxBlockCountReached++; 1302253955ca25c7e7049963b5db613c0cd15d66e4f8Anna Zaks 1303253955ca25c7e7049963b5db613c0cd15d66e4f8Anna Zaks // Make sink nodes as exhausted(for stats) only if retry failed. 1304253955ca25c7e7049963b5db613c0cd15d66e4f8Anna Zaks Engine.blocksExhausted.push_back(std::make_pair(L, Sink)); 130527c54e57c4a012dcdf2b40cf985b70d0b9caa69eTed Kremenek } 1306e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek} 1307e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek 1308e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek//===----------------------------------------------------------------------===// 1309e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek// Branch processing. 1310e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek//===----------------------------------------------------------------------===// 1311e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek 13126ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek/// RecoverCastedSymbol - A helper function for ProcessBranch that is used 13136ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek/// to try to recover some path-sensitivity for casts of symbolic 13146ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek/// integers that promote their values (which are currently not tracked well). 13156ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek/// This function returns the SVal bound to Condition->IgnoreCasts if all the 13166ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek// cast(s) did was sign-extend the original value. 1317294fd0a62b95f512637910bf85c7efa6c2354b50Ted Kremenekstatic SVal RecoverCastedSymbol(ProgramStateManager& StateMgr, 13188bef8238181a30e52dea380789a7e2d760eac532Ted Kremenek ProgramStateRef state, 1319294fd0a62b95f512637910bf85c7efa6c2354b50Ted Kremenek const Stmt *Condition, 13205eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek const LocationContext *LCtx, 1321294fd0a62b95f512637910bf85c7efa6c2354b50Ted Kremenek ASTContext &Ctx) { 13226ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek 132303509aea098772644bf4662dc1c88634818ceeccZhongxing Xu const Expr *Ex = dyn_cast<Expr>(Condition); 13246ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek if (!Ex) 13256ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek return UnknownVal(); 13266ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek 13276ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek uint64_t bits = 0; 13286ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek bool bitsInit = false; 13291eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 133003509aea098772644bf4662dc1c88634818ceeccZhongxing Xu while (const CastExpr *CE = dyn_cast<CastExpr>(Ex)) { 13316ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek QualType T = CE->getType(); 13326ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek 1333a5796f87229b4aeebca71fa6ee1790ae7a5a0382Jordan Rose if (!T->isIntegralOrEnumerationType()) 13346ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek return UnknownVal(); 13351eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 13366ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek uint64_t newBits = Ctx.getTypeSize(T); 13376ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek if (!bitsInit || newBits < bits) { 13386ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek bitsInit = true; 13396ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek bits = newBits; 13406ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek } 13411eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 13426ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek Ex = CE->getSubExpr(); 13436ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek } 13446ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek 13456ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek // We reached a non-cast. Is it a symbolic value? 13466ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek QualType T = Ex->getType(); 13476ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek 1348a5796f87229b4aeebca71fa6ee1790ae7a5a0382Jordan Rose if (!bitsInit || !T->isIntegralOrEnumerationType() || 1349a5796f87229b4aeebca71fa6ee1790ae7a5a0382Jordan Rose Ctx.getTypeSize(T) > bits) 13506ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek return UnknownVal(); 13511eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 13525eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek return state->getSVal(Ex, LCtx); 13536ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek} 13546ae8a3600656c478d27f25639bed765f4fe71732Ted Kremenek 13553f635c08b2d0b2d5bafb38da09589cb238407faaTed Kremenekstatic const Stmt *ResolveCondition(const Stmt *Condition, 13563f635c08b2d0b2d5bafb38da09589cb238407faaTed Kremenek const CFGBlock *B) { 13573f635c08b2d0b2d5bafb38da09589cb238407faaTed Kremenek if (const Expr *Ex = dyn_cast<Expr>(Condition)) 13583f635c08b2d0b2d5bafb38da09589cb238407faaTed Kremenek Condition = Ex->IgnoreParens(); 13593f635c08b2d0b2d5bafb38da09589cb238407faaTed Kremenek 13603f635c08b2d0b2d5bafb38da09589cb238407faaTed Kremenek const BinaryOperator *BO = dyn_cast<BinaryOperator>(Condition); 13613f635c08b2d0b2d5bafb38da09589cb238407faaTed Kremenek if (!BO || !BO->isLogicalOp()) 13623f635c08b2d0b2d5bafb38da09589cb238407faaTed Kremenek return Condition; 13633f635c08b2d0b2d5bafb38da09589cb238407faaTed Kremenek 13643f635c08b2d0b2d5bafb38da09589cb238407faaTed Kremenek // For logical operations, we still have the case where some branches 13653f635c08b2d0b2d5bafb38da09589cb238407faaTed Kremenek // use the traditional "merge" approach and others sink the branch 13663f635c08b2d0b2d5bafb38da09589cb238407faaTed Kremenek // directly into the basic blocks representing the logical operation. 13673f635c08b2d0b2d5bafb38da09589cb238407faaTed Kremenek // We need to distinguish between those two cases here. 13683f635c08b2d0b2d5bafb38da09589cb238407faaTed Kremenek 13693f635c08b2d0b2d5bafb38da09589cb238407faaTed Kremenek // The invariants are still shifting, but it is possible that the 13703f635c08b2d0b2d5bafb38da09589cb238407faaTed Kremenek // last element in a CFGBlock is not a CFGStmt. Look for the last 13713f635c08b2d0b2d5bafb38da09589cb238407faaTed Kremenek // CFGStmt as the value of the condition. 13723f635c08b2d0b2d5bafb38da09589cb238407faaTed Kremenek CFGBlock::const_reverse_iterator I = B->rbegin(), E = B->rend(); 13733f635c08b2d0b2d5bafb38da09589cb238407faaTed Kremenek for (; I != E; ++I) { 13743f635c08b2d0b2d5bafb38da09589cb238407faaTed Kremenek CFGElement Elem = *I; 1375b07805485c603be3d8011f72611465324c9e664bDavid Blaikie Optional<CFGStmt> CS = Elem.getAs<CFGStmt>(); 13763f635c08b2d0b2d5bafb38da09589cb238407faaTed Kremenek if (!CS) 13773f635c08b2d0b2d5bafb38da09589cb238407faaTed Kremenek continue; 1378b07805485c603be3d8011f72611465324c9e664bDavid Blaikie if (CS->getStmt() != Condition) 13793f635c08b2d0b2d5bafb38da09589cb238407faaTed Kremenek break; 13803f635c08b2d0b2d5bafb38da09589cb238407faaTed Kremenek return Condition; 13813f635c08b2d0b2d5bafb38da09589cb238407faaTed Kremenek } 13823f635c08b2d0b2d5bafb38da09589cb238407faaTed Kremenek 13833f635c08b2d0b2d5bafb38da09589cb238407faaTed Kremenek assert(I != E); 13843f635c08b2d0b2d5bafb38da09589cb238407faaTed Kremenek 13853f635c08b2d0b2d5bafb38da09589cb238407faaTed Kremenek while (Condition) { 13863f635c08b2d0b2d5bafb38da09589cb238407faaTed Kremenek BO = dyn_cast<BinaryOperator>(Condition); 13873f635c08b2d0b2d5bafb38da09589cb238407faaTed Kremenek if (!BO || !BO->isLogicalOp()) 13883f635c08b2d0b2d5bafb38da09589cb238407faaTed Kremenek return Condition; 13893f635c08b2d0b2d5bafb38da09589cb238407faaTed Kremenek Condition = BO->getRHS()->IgnoreParens(); 13903f635c08b2d0b2d5bafb38da09589cb238407faaTed Kremenek } 13913f635c08b2d0b2d5bafb38da09589cb238407faaTed Kremenek llvm_unreachable("could not resolve condition"); 13923f635c08b2d0b2d5bafb38da09589cb238407faaTed Kremenek} 13933f635c08b2d0b2d5bafb38da09589cb238407faaTed Kremenek 13949c378f705405d37f49795d5e915989de774fe11fTed Kremenekvoid ExprEngine::processBranch(const Stmt *Condition, const Stmt *Term, 1395a19f4af7a94835ce4693bfe12d6270754e79eb56Anna Zaks NodeBuilderContext& BldCtx, 1396ad62deeb70e97da6bd514dd390ea1ce6af6ad81dAnna Zaks ExplodedNode *Pred, 13971aae01a8308d2f8e31adab3f4d7ac35543aac680Anna Zaks ExplodedNodeSet &Dst, 1398a19f4af7a94835ce4693bfe12d6270754e79eb56Anna Zaks const CFGBlock *DstT, 1399a19f4af7a94835ce4693bfe12d6270754e79eb56Anna Zaks const CFGBlock *DstF) { 140095ab9e306f4deefeabd89ea61987f4a8d67e0890Pavel Labath const LocationContext *LCtx = Pred->getLocationContext(); 140195ab9e306f4deefeabd89ea61987f4a8d67e0890Pavel Labath PrettyStackTraceLocationContext StackCrashInfo(LCtx); 140266c486f275531df6362b3511fc3af6563561801bTed Kremenek currBldrCtx = &BldCtx; 1403f236b6503a4dbc44c1fccb8756bd57c9d0efdf05Anna Zaks 1404b2331834a0515c80862ee51325c758a053829f15Ted Kremenek // Check for NULL conditions; e.g. "for(;;)" 14051eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump if (!Condition) { 14061aae01a8308d2f8e31adab3f4d7ac35543aac680Anna Zaks BranchNodeBuilder NullCondBldr(Pred, Dst, BldCtx, DstT, DstF); 1407a19f4af7a94835ce4693bfe12d6270754e79eb56Anna Zaks NullCondBldr.markInfeasible(false); 14084e82d3cf6fd4c907265e3fa3aac0a835c35dc759Anna Zaks NullCondBldr.generateNode(Pred->getState(), true, Pred); 1409b2331834a0515c80862ee51325c758a053829f15Ted Kremenek return; 1410b2331834a0515c80862ee51325c758a053829f15Ted Kremenek } 14111eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 14123f635c08b2d0b2d5bafb38da09589cb238407faaTed Kremenek 14133f635c08b2d0b2d5bafb38da09589cb238407faaTed Kremenek if (const Expr *Ex = dyn_cast<Expr>(Condition)) 14143f635c08b2d0b2d5bafb38da09589cb238407faaTed Kremenek Condition = Ex->IgnoreParens(); 141595ab9e306f4deefeabd89ea61987f4a8d67e0890Pavel Labath 1416dd9e9cec6f863afa15dd91b34fbf15c66c678c02Bill Wendling Condition = ResolveCondition(Condition, BldCtx.getBlock()); 141721028dd8850c64a414f7a82dfddcc291351203d6Ted Kremenek PrettyStackTraceLoc CrashInfo(getContext().getSourceManager(), 141821028dd8850c64a414f7a82dfddcc291351203d6Ted Kremenek Condition->getLocStart(), 141921028dd8850c64a414f7a82dfddcc291351203d6Ted Kremenek "Error evaluating branch"); 14200fb0bc4067d6c9d7c0e655300ef309b05d3adfc9Ted Kremenek 1421f236b6503a4dbc44c1fccb8756bd57c9d0efdf05Anna Zaks ExplodedNodeSet CheckersOutSet; 1422f236b6503a4dbc44c1fccb8756bd57c9d0efdf05Anna Zaks getCheckerManager().runCheckersForBranchCondition(Condition, CheckersOutSet, 14234e82d3cf6fd4c907265e3fa3aac0a835c35dc759Anna Zaks Pred, *this); 14248ff5c41f2bde7ebbe568b4c15e59f14b8befae66Anna Zaks // We generated only sinks. 1425f236b6503a4dbc44c1fccb8756bd57c9d0efdf05Anna Zaks if (CheckersOutSet.empty()) 14268ff5c41f2bde7ebbe568b4c15e59f14b8befae66Anna Zaks return; 14271eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1428f236b6503a4dbc44c1fccb8756bd57c9d0efdf05Anna Zaks BranchNodeBuilder builder(CheckersOutSet, Dst, BldCtx, DstT, DstF); 1429f236b6503a4dbc44c1fccb8756bd57c9d0efdf05Anna Zaks for (NodeBuilder::iterator I = CheckersOutSet.begin(), 1430f236b6503a4dbc44c1fccb8756bd57c9d0efdf05Anna Zaks E = CheckersOutSet.end(); E != I; ++I) { 1431cd656cab3fa3dd4b0c974c6ae1c0e60880b18c22Anna Zaks ExplodedNode *PredI = *I; 1432cd656cab3fa3dd4b0c974c6ae1c0e60880b18c22Anna Zaks 1433cd656cab3fa3dd4b0c974c6ae1c0e60880b18c22Anna Zaks if (PredI->isSink()) 1434cd656cab3fa3dd4b0c974c6ae1c0e60880b18c22Anna Zaks continue; 1435cd656cab3fa3dd4b0c974c6ae1c0e60880b18c22Anna Zaks 143612b3e3199c530b72f3cc44dd24a1e20ed6086292Anna Zaks ProgramStateRef PrevState = PredI->getState(); 143712b3e3199c530b72f3cc44dd24a1e20ed6086292Anna Zaks SVal X = PrevState->getSVal(Condition, PredI->getLocationContext()); 1438cd656cab3fa3dd4b0c974c6ae1c0e60880b18c22Anna Zaks 1439cd656cab3fa3dd4b0c974c6ae1c0e60880b18c22Anna Zaks if (X.isUnknownOrUndef()) { 1440cd656cab3fa3dd4b0c974c6ae1c0e60880b18c22Anna Zaks // Give it a chance to recover from unknown. 1441cd656cab3fa3dd4b0c974c6ae1c0e60880b18c22Anna Zaks if (const Expr *Ex = dyn_cast<Expr>(Condition)) { 1442a5796f87229b4aeebca71fa6ee1790ae7a5a0382Jordan Rose if (Ex->getType()->isIntegralOrEnumerationType()) { 1443cd656cab3fa3dd4b0c974c6ae1c0e60880b18c22Anna Zaks // Try to recover some path-sensitivity. Right now casts of symbolic 1444cd656cab3fa3dd4b0c974c6ae1c0e60880b18c22Anna Zaks // integers that promote their values are currently not tracked well. 1445cd656cab3fa3dd4b0c974c6ae1c0e60880b18c22Anna Zaks // If 'Condition' is such an expression, try and recover the 1446cd656cab3fa3dd4b0c974c6ae1c0e60880b18c22Anna Zaks // underlying value and use that instead. 1447cd656cab3fa3dd4b0c974c6ae1c0e60880b18c22Anna Zaks SVal recovered = RecoverCastedSymbol(getStateManager(), 1448cd656cab3fa3dd4b0c974c6ae1c0e60880b18c22Anna Zaks PrevState, Condition, 144912b3e3199c530b72f3cc44dd24a1e20ed6086292Anna Zaks PredI->getLocationContext(), 1450cd656cab3fa3dd4b0c974c6ae1c0e60880b18c22Anna Zaks getContext()); 1451cd656cab3fa3dd4b0c974c6ae1c0e60880b18c22Anna Zaks 1452cd656cab3fa3dd4b0c974c6ae1c0e60880b18c22Anna Zaks if (!recovered.isUnknown()) { 1453cd656cab3fa3dd4b0c974c6ae1c0e60880b18c22Anna Zaks X = recovered; 1454cd656cab3fa3dd4b0c974c6ae1c0e60880b18c22Anna Zaks } 14550835e4cccfef3ea5346962722b79484f6b3ca602Zhongxing Xu } 1456b38911f16b4943548db6a3695fc6ae23070b25d2Ted Kremenek } 14570835e4cccfef3ea5346962722b79484f6b3ca602Zhongxing Xu } 14585eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek 14590835e4cccfef3ea5346962722b79484f6b3ca602Zhongxing Xu // If the condition is still unknown, give up. 146073c498a08f4968b6987d1453c7b77929dcc6d5f7Argyrios Kyrtzidis if (X.isUnknownOrUndef()) { 1461dd9e9cec6f863afa15dd91b34fbf15c66c678c02Bill Wendling builder.generateNode(PrevState, true, PredI); 1462dd9e9cec6f863afa15dd91b34fbf15c66c678c02Bill Wendling builder.generateNode(PrevState, false, PredI); 1463cd656cab3fa3dd4b0c974c6ae1c0e60880b18c22Anna Zaks continue; 14641eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump } 14651eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 14665251abea41b446c26e3239c8dd6c7edea6fc335dDavid Blaikie DefinedSVal V = X.castAs<DefinedSVal>(); 1467dd9e9cec6f863afa15dd91b34fbf15c66c678c02Bill Wendling 1468dd9e9cec6f863afa15dd91b34fbf15c66c678c02Bill Wendling ProgramStateRef StTrue, StFalse; 1469651f13cea278ec967336033dd032faef0e9fc2ecStephen Hines std::tie(StTrue, StFalse) = PrevState->assume(V); 14706960d08b4ddf389d7c81504df7f16dc645120482Jordan Rose 1471cd656cab3fa3dd4b0c974c6ae1c0e60880b18c22Anna Zaks // Process the true branch. 1472cd656cab3fa3dd4b0c974c6ae1c0e60880b18c22Anna Zaks if (builder.isFeasible(true)) { 1473dd9e9cec6f863afa15dd91b34fbf15c66c678c02Bill Wendling if (StTrue) 14746960d08b4ddf389d7c81504df7f16dc645120482Jordan Rose builder.generateNode(StTrue, true, PredI); 1475dd9e9cec6f863afa15dd91b34fbf15c66c678c02Bill Wendling else 1476cd656cab3fa3dd4b0c974c6ae1c0e60880b18c22Anna Zaks builder.markInfeasible(true); 1477cd656cab3fa3dd4b0c974c6ae1c0e60880b18c22Anna Zaks } 14781eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1479cd656cab3fa3dd4b0c974c6ae1c0e60880b18c22Anna Zaks // Process the false branch. 1480cd656cab3fa3dd4b0c974c6ae1c0e60880b18c22Anna Zaks if (builder.isFeasible(false)) { 1481dd9e9cec6f863afa15dd91b34fbf15c66c678c02Bill Wendling if (StFalse) 14826960d08b4ddf389d7c81504df7f16dc645120482Jordan Rose builder.generateNode(StFalse, false, PredI); 1483dd9e9cec6f863afa15dd91b34fbf15c66c678c02Bill Wendling else 1484cd656cab3fa3dd4b0c974c6ae1c0e60880b18c22Anna Zaks builder.markInfeasible(false); 1485cd656cab3fa3dd4b0c974c6ae1c0e60880b18c22Anna Zaks } 1486cd656cab3fa3dd4b0c974c6ae1c0e60880b18c22Anna Zaks } 148766c486f275531df6362b3511fc3af6563561801bTed Kremenek currBldrCtx = 0; 1488f233d48cfc513b045e2c2cfca5c175220fbd0a82Ted Kremenek} 1489f233d48cfc513b045e2c2cfca5c175220fbd0a82Ted Kremenek 14900f5c5c60e9806d13f0907cd99d7204ffab0e08f7Ted Kremenek/// The GDM component containing the set of global variables which have been 14910f5c5c60e9806d13f0907cd99d7204ffab0e08f7Ted Kremenek/// previously initialized with explicit initializers. 14920f5c5c60e9806d13f0907cd99d7204ffab0e08f7Ted KremenekREGISTER_TRAIT_WITH_PROGRAMSTATE(InitializedGlobalsSet, 14930f5c5c60e9806d13f0907cd99d7204ffab0e08f7Ted Kremenek llvm::ImmutableSet<const VarDecl *>) 14940f5c5c60e9806d13f0907cd99d7204ffab0e08f7Ted Kremenek 14950f5c5c60e9806d13f0907cd99d7204ffab0e08f7Ted Kremenekvoid ExprEngine::processStaticInitializer(const DeclStmt *DS, 14960f5c5c60e9806d13f0907cd99d7204ffab0e08f7Ted Kremenek NodeBuilderContext &BuilderCtx, 14970f5c5c60e9806d13f0907cd99d7204ffab0e08f7Ted Kremenek ExplodedNode *Pred, 14980f5c5c60e9806d13f0907cd99d7204ffab0e08f7Ted Kremenek clang::ento::ExplodedNodeSet &Dst, 14990f5c5c60e9806d13f0907cd99d7204ffab0e08f7Ted Kremenek const CFGBlock *DstT, 15000f5c5c60e9806d13f0907cd99d7204ffab0e08f7Ted Kremenek const CFGBlock *DstF) { 1501ac7cc2d37e82181e73fcc265c1d0a619d18b7605Jordan Rose PrettyStackTraceLocationContext CrashInfo(Pred->getLocationContext()); 15020f5c5c60e9806d13f0907cd99d7204ffab0e08f7Ted Kremenek currBldrCtx = &BuilderCtx; 15030f5c5c60e9806d13f0907cd99d7204ffab0e08f7Ted Kremenek 15040f5c5c60e9806d13f0907cd99d7204ffab0e08f7Ted Kremenek const VarDecl *VD = cast<VarDecl>(DS->getSingleDecl()); 15050f5c5c60e9806d13f0907cd99d7204ffab0e08f7Ted Kremenek ProgramStateRef state = Pred->getState(); 15060f5c5c60e9806d13f0907cd99d7204ffab0e08f7Ted Kremenek bool initHasRun = state->contains<InitializedGlobalsSet>(VD); 15070f5c5c60e9806d13f0907cd99d7204ffab0e08f7Ted Kremenek BranchNodeBuilder builder(Pred, Dst, BuilderCtx, DstT, DstF); 15080f5c5c60e9806d13f0907cd99d7204ffab0e08f7Ted Kremenek 15090f5c5c60e9806d13f0907cd99d7204ffab0e08f7Ted Kremenek if (!initHasRun) { 15100f5c5c60e9806d13f0907cd99d7204ffab0e08f7Ted Kremenek state = state->add<InitializedGlobalsSet>(VD); 15110f5c5c60e9806d13f0907cd99d7204ffab0e08f7Ted Kremenek } 15120f5c5c60e9806d13f0907cd99d7204ffab0e08f7Ted Kremenek 15130f5c5c60e9806d13f0907cd99d7204ffab0e08f7Ted Kremenek builder.generateNode(state, initHasRun, Pred); 15140f5c5c60e9806d13f0907cd99d7204ffab0e08f7Ted Kremenek builder.markInfeasible(!initHasRun); 15150f5c5c60e9806d13f0907cd99d7204ffab0e08f7Ted Kremenek 15160f5c5c60e9806d13f0907cd99d7204ffab0e08f7Ted Kremenek currBldrCtx = 0; 15170f5c5c60e9806d13f0907cd99d7204ffab0e08f7Ted Kremenek} 15180f5c5c60e9806d13f0907cd99d7204ffab0e08f7Ted Kremenek 1519e36de1fe51c39d9161915dd3dbef880954af6476Ted Kremenek/// processIndirectGoto - Called by CoreEngine. Used to generate successor 1520754607e7cff2d902d9af8b771409449fb2f8d2bfTed Kremenek/// nodes by processing the 'effects' of a computed goto jump. 1521ad8dcf4a9df0e24051dc31bf9e6f3cd138a34298Chris Lattnervoid ExprEngine::processIndirectGoto(IndirectGotoNodeBuilder &builder) { 1522754607e7cff2d902d9af8b771409449fb2f8d2bfTed Kremenek 15238bef8238181a30e52dea380789a7e2d760eac532Ted Kremenek ProgramStateRef state = builder.getState(); 15245eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek SVal V = state->getSVal(builder.getTarget(), builder.getLocationContext()); 15251eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1526754607e7cff2d902d9af8b771409449fb2f8d2bfTed Kremenek // Three possibilities: 1527754607e7cff2d902d9af8b771409449fb2f8d2bfTed Kremenek // 1528754607e7cff2d902d9af8b771409449fb2f8d2bfTed Kremenek // (1) We know the computed label. 15294a4e524afef40d6f3ddb25d0e407c814e4ca56a8Ted Kremenek // (2) The label is NULL (or some other constant), or Undefined. 1530754607e7cff2d902d9af8b771409449fb2f8d2bfTed Kremenek // (3) We have no clue about the label. Dispatch to all targets. 1531754607e7cff2d902d9af8b771409449fb2f8d2bfTed Kremenek // 15321eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1533d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidis typedef IndirectGotoNodeBuilder::iterator iterator; 1534754607e7cff2d902d9af8b771409449fb2f8d2bfTed Kremenek 1535dc84cd5efdd3430efb22546b4ac656aa0540b210David Blaikie if (Optional<loc::GotoLabel> LV = V.getAs<loc::GotoLabel>()) { 15365251abea41b446c26e3239c8dd6c7edea6fc335dDavid Blaikie const LabelDecl *L = LV->getLabel(); 15371eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1538ad8dcf4a9df0e24051dc31bf9e6f3cd138a34298Chris Lattner for (iterator I = builder.begin(), E = builder.end(); I != E; ++I) { 153924f1a967741ff9f8025ee23be12ba6feacc31f77Ted Kremenek if (I.getLabel() == L) { 1540a8538d902fce9cfec20f39b34492268b51643819Ted Kremenek builder.generateNode(I, state); 1541754607e7cff2d902d9af8b771409449fb2f8d2bfTed Kremenek return; 1542754607e7cff2d902d9af8b771409449fb2f8d2bfTed Kremenek } 1543754607e7cff2d902d9af8b771409449fb2f8d2bfTed Kremenek } 15441eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1545b219cfc4d75f0a03630b7c4509ef791b7e97b2c8David Blaikie llvm_unreachable("No block with label."); 1546754607e7cff2d902d9af8b771409449fb2f8d2bfTed Kremenek } 1547754607e7cff2d902d9af8b771409449fb2f8d2bfTed Kremenek 15485251abea41b446c26e3239c8dd6c7edea6fc335dDavid Blaikie if (V.getAs<loc::ConcreteInt>() || V.getAs<UndefinedVal>()) { 1549754607e7cff2d902d9af8b771409449fb2f8d2bfTed Kremenek // Dispatch to the first target and mark it as a sink. 15502055effed54d614b51e3501a174c9b1fe92e4de4Zhongxing Xu //ExplodedNode* N = builder.generateNode(builder.begin(), state, true); 15512055effed54d614b51e3501a174c9b1fe92e4de4Zhongxing Xu // FIXME: add checker visit. 15522055effed54d614b51e3501a174c9b1fe92e4de4Zhongxing Xu // UndefBranches.insert(N); 1553754607e7cff2d902d9af8b771409449fb2f8d2bfTed Kremenek return; 1554754607e7cff2d902d9af8b771409449fb2f8d2bfTed Kremenek } 15551eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1556754607e7cff2d902d9af8b771409449fb2f8d2bfTed Kremenek // This is really a catch-all. We don't support symbolics yet. 1557b3cfd58c9b13325d994e5f9b5065e6a22d91911dTed Kremenek // FIXME: Implement dispatch for symbolic pointers. 15581eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1559754607e7cff2d902d9af8b771409449fb2f8d2bfTed Kremenek for (iterator I=builder.begin(), E=builder.end(); I != E; ++I) 1560a8538d902fce9cfec20f39b34492268b51643819Ted Kremenek builder.generateNode(I, state); 1561754607e7cff2d902d9af8b771409449fb2f8d2bfTed Kremenek} 1562f233d48cfc513b045e2c2cfca5c175220fbd0a82Ted Kremenek 1563d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidis/// ProcessEndPath - Called by CoreEngine. Used to generate end-of-path 156473099bfea9f5d4ec05265170bbefec3d76fb6b5eTed Kremenek/// nodes when the control reaches the end of a function. 1565b355be838a22a511d078504b2277f70aea52ca85Anna Zaksvoid ExprEngine::processEndOfFunction(NodeBuilderContext& BC, 1566b355be838a22a511d078504b2277f70aea52ca85Anna Zaks ExplodedNode *Pred) { 1567ac7cc2d37e82181e73fcc265c1d0a619d18b7605Jordan Rose PrettyStackTraceLocationContext CrashInfo(Pred->getLocationContext()); 1568b355be838a22a511d078504b2277f70aea52ca85Anna Zaks StateMgr.EndPath(Pred->getState()); 15698501b7a1c4c4a9ba0ea6cb8e500e601ef3759debAnna Zaks 1570af498a28797c075c48d7e943df5f5a8e78ed8eb0Anna Zaks ExplodedNodeSet Dst; 15718501b7a1c4c4a9ba0ea6cb8e500e601ef3759debAnna Zaks if (Pred->getLocationContext()->inTopFrame()) { 15728501b7a1c4c4a9ba0ea6cb8e500e601ef3759debAnna Zaks // Remove dead symbols. 15738501b7a1c4c4a9ba0ea6cb8e500e601ef3759debAnna Zaks ExplodedNodeSet AfterRemovedDead; 15748501b7a1c4c4a9ba0ea6cb8e500e601ef3759debAnna Zaks removeDeadOnEndOfFunction(BC, Pred, AfterRemovedDead); 15758501b7a1c4c4a9ba0ea6cb8e500e601ef3759debAnna Zaks 15768501b7a1c4c4a9ba0ea6cb8e500e601ef3759debAnna Zaks // Notify checkers. 15778501b7a1c4c4a9ba0ea6cb8e500e601ef3759debAnna Zaks for (ExplodedNodeSet::iterator I = AfterRemovedDead.begin(), 15788501b7a1c4c4a9ba0ea6cb8e500e601ef3759debAnna Zaks E = AfterRemovedDead.end(); I != E; ++I) { 1579344c77aac25e5d960aced3f45fbaa09853383f6dAnna Zaks getCheckerManager().runCheckersForEndFunction(BC, Dst, *I, *this); 15808501b7a1c4c4a9ba0ea6cb8e500e601ef3759debAnna Zaks } 15818501b7a1c4c4a9ba0ea6cb8e500e601ef3759debAnna Zaks } else { 1582344c77aac25e5d960aced3f45fbaa09853383f6dAnna Zaks getCheckerManager().runCheckersForEndFunction(BC, Dst, Pred, *this); 15838501b7a1c4c4a9ba0ea6cb8e500e601ef3759debAnna Zaks } 15848501b7a1c4c4a9ba0ea6cb8e500e601ef3759debAnna Zaks 15854d2ae4a70336dc2aa11389b34946be152bb454c9Anna Zaks Engine.enqueueEndOfFunction(Dst); 158673099bfea9f5d4ec05265170bbefec3d76fb6b5eTed Kremenek} 158773099bfea9f5d4ec05265170bbefec3d76fb6b5eTed Kremenek 1588d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidis/// ProcessSwitch - Called by CoreEngine. Used to generate successor 1589daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek/// nodes by processing the 'effects' of a switch statement. 1590e36de1fe51c39d9161915dd3dbef880954af6476Ted Kremenekvoid ExprEngine::processSwitch(SwitchNodeBuilder& builder) { 1591d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidis typedef SwitchNodeBuilder::iterator iterator; 15928bef8238181a30e52dea380789a7e2d760eac532Ted Kremenek ProgramStateRef state = builder.getState(); 15939c378f705405d37f49795d5e915989de774fe11fTed Kremenek const Expr *CondE = builder.getCondition(); 15945eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek SVal CondV_untested = state->getSVal(CondE, builder.getLocationContext()); 1595daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek 15965b9bd2137ebef350af803c634e3fdf5d74678100Ted Kremenek if (CondV_untested.isUndef()) { 15972055effed54d614b51e3501a174c9b1fe92e4de4Zhongxing Xu //ExplodedNode* N = builder.generateDefaultCaseNode(state, true); 1598b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek // FIXME: add checker 15992055effed54d614b51e3501a174c9b1fe92e4de4Zhongxing Xu //UndefBranches.insert(N); 16002055effed54d614b51e3501a174c9b1fe92e4de4Zhongxing Xu 1601daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek return; 1602daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek } 16035251abea41b446c26e3239c8dd6c7edea6fc335dDavid Blaikie DefinedOrUnknownSVal CondV = CondV_untested.castAs<DefinedOrUnknownSVal>(); 1604692416c214a3b234236dedcf875735a9cc29e90bTed Kremenek 16058bef8238181a30e52dea380789a7e2d760eac532Ted Kremenek ProgramStateRef DefaultSt = state; 160634feff654c6304e0a59ceb1376989d28dbc956ffTed Kremenek 160734feff654c6304e0a59ceb1376989d28dbc956ffTed Kremenek iterator I = builder.begin(), EI = builder.end(); 160834feff654c6304e0a59ceb1376989d28dbc956ffTed Kremenek bool defaultIsFeasible = I == EI; 16091eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 161034feff654c6304e0a59ceb1376989d28dbc956ffTed Kremenek for ( ; I != EI; ++I) { 1611e71f3d587844110d836c82250830b27b1651afdbTed Kremenek // Successor may be pruned out during CFG construction. 1612e71f3d587844110d836c82250830b27b1651afdbTed Kremenek if (!I.getBlock()) 1613e71f3d587844110d836c82250830b27b1651afdbTed Kremenek continue; 1614e71f3d587844110d836c82250830b27b1651afdbTed Kremenek 16159c378f705405d37f49795d5e915989de774fe11fTed Kremenek const CaseStmt *Case = I.getCase(); 161672afb3739da0da02158242ae41a50cfe0bea78b4Ted Kremenek 161772afb3739da0da02158242ae41a50cfe0bea78b4Ted Kremenek // Evaluate the LHS of the case value. 161885df96c1f04867e26ba069aa0cc6a4cd6a01292eRichard Smith llvm::APSInt V1 = Case->getLHS()->EvaluateKnownConstInt(getContext()); 161985df96c1f04867e26ba069aa0cc6a4cd6a01292eRichard Smith assert(V1.getBitWidth() == getContext().getTypeSize(CondE->getType())); 16201eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1621daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek // Get the RHS of the case, if it exists. 162285df96c1f04867e26ba069aa0cc6a4cd6a01292eRichard Smith llvm::APSInt V2; 162385df96c1f04867e26ba069aa0cc6a4cd6a01292eRichard Smith if (const Expr *E = Case->getRHS()) 162485df96c1f04867e26ba069aa0cc6a4cd6a01292eRichard Smith V2 = E->EvaluateKnownConstInt(getContext()); 162514a1140c9f4e20b12a54db8745b74699b9872cd2Ted Kremenek else 162614a1140c9f4e20b12a54db8745b74699b9872cd2Ted Kremenek V2 = V1; 16271eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1628daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek // FIXME: Eventually we should replace the logic below with a range 1629daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek // comparison, rather than concretize the values within the range. 1630aa1c4e5a6b87b62d991c55a0d4522bcd778068d7Ted Kremenek // This should be easy once we have "ranges" for NonLVals. 16311eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 163214a1140c9f4e20b12a54db8745b74699b9872cd2Ted Kremenek do { 163385df96c1f04867e26ba069aa0cc6a4cd6a01292eRichard Smith nonloc::ConcreteInt CaseVal(getBasicVals().getValue(V1)); 16349c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek DefinedOrUnknownSVal Res = svalBuilder.evalEQ(DefaultSt ? DefaultSt : state, 163548569f9562740ac1f4b175cb17ce3d49035402c4Ted Kremenek CondV, CaseVal); 1636b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 16371eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump // Now "assume" that the case matches. 16388bef8238181a30e52dea380789a7e2d760eac532Ted Kremenek if (ProgramStateRef stateNew = state->assume(Res, true)) { 1639a591bc04d21fa62ebffcb2c7814d738ca8f5e2f9Ted Kremenek builder.generateCaseStmtNode(I, stateNew); 16401eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1641daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek // If CondV evaluates to a constant, then we know that this 1642daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek // is the *only* case that we can take, so stop evaluating the 1643daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek // others. 16445251abea41b446c26e3239c8dd6c7edea6fc335dDavid Blaikie if (CondV.getAs<nonloc::ConcreteInt>()) 1645daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek return; 1646daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek } 16471eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1648daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek // Now "assume" that the case doesn't match. Add this state 1649daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek // to the default state (if it is feasible). 165048569f9562740ac1f4b175cb17ce3d49035402c4Ted Kremenek if (DefaultSt) { 16518bef8238181a30e52dea380789a7e2d760eac532Ted Kremenek if (ProgramStateRef stateNew = DefaultSt->assume(Res, false)) { 165248569f9562740ac1f4b175cb17ce3d49035402c4Ted Kremenek defaultIsFeasible = true; 165348569f9562740ac1f4b175cb17ce3d49035402c4Ted Kremenek DefaultSt = stateNew; 165448569f9562740ac1f4b175cb17ce3d49035402c4Ted Kremenek } 165548569f9562740ac1f4b175cb17ce3d49035402c4Ted Kremenek else { 165648569f9562740ac1f4b175cb17ce3d49035402c4Ted Kremenek defaultIsFeasible = false; 165748569f9562740ac1f4b175cb17ce3d49035402c4Ted Kremenek DefaultSt = NULL; 165848569f9562740ac1f4b175cb17ce3d49035402c4Ted Kremenek } 16595014ab113eb211b8320ae30b173d7020352663c6Ted Kremenek } 1660b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 166114a1140c9f4e20b12a54db8745b74699b9872cd2Ted Kremenek // Concretize the next value in the range. 166285df96c1f04867e26ba069aa0cc6a4cd6a01292eRichard Smith if (V1 == V2) 166314a1140c9f4e20b12a54db8745b74699b9872cd2Ted Kremenek break; 16641eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 166585df96c1f04867e26ba069aa0cc6a4cd6a01292eRichard Smith ++V1; 166685df96c1f04867e26ba069aa0cc6a4cd6a01292eRichard Smith assert (V1 <= V2); 16671eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 166814a1140c9f4e20b12a54db8745b74699b9872cd2Ted Kremenek } while (true); 1669daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek } 16701eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 16714d3175c1e5a44251ea97b0c81e80f060629d9c08Ted Kremenek if (!defaultIsFeasible) 16724d3175c1e5a44251ea97b0c81e80f060629d9c08Ted Kremenek return; 16734d3175c1e5a44251ea97b0c81e80f060629d9c08Ted Kremenek 16744d3175c1e5a44251ea97b0c81e80f060629d9c08Ted Kremenek // If we have switch(enum value), the default branch is not 16754d3175c1e5a44251ea97b0c81e80f060629d9c08Ted Kremenek // feasible if all of the enum constants not covered by 'case:' statements 16764d3175c1e5a44251ea97b0c81e80f060629d9c08Ted Kremenek // are not feasible values for the switch condition. 16774d3175c1e5a44251ea97b0c81e80f060629d9c08Ted Kremenek // 16784d3175c1e5a44251ea97b0c81e80f060629d9c08Ted Kremenek // Note that this isn't as accurate as it could be. Even if there isn't 16794d3175c1e5a44251ea97b0c81e80f060629d9c08Ted Kremenek // a case for a particular enum value as long as that enum value isn't 16804d3175c1e5a44251ea97b0c81e80f060629d9c08Ted Kremenek // feasible then it shouldn't be considered for making 'default:' reachable. 16814d3175c1e5a44251ea97b0c81e80f060629d9c08Ted Kremenek const SwitchStmt *SS = builder.getSwitch(); 16824d3175c1e5a44251ea97b0c81e80f060629d9c08Ted Kremenek const Expr *CondExpr = SS->getCond()->IgnoreParenImpCasts(); 16834d3175c1e5a44251ea97b0c81e80f060629d9c08Ted Kremenek if (CondExpr->getType()->getAs<EnumType>()) { 16844d3175c1e5a44251ea97b0c81e80f060629d9c08Ted Kremenek if (SS->isAllEnumCasesCovered()) 16854d3175c1e5a44251ea97b0c81e80f060629d9c08Ted Kremenek return; 16864d3175c1e5a44251ea97b0c81e80f060629d9c08Ted Kremenek } 16874d3175c1e5a44251ea97b0c81e80f060629d9c08Ted Kremenek 16884d3175c1e5a44251ea97b0c81e80f060629d9c08Ted Kremenek builder.generateDefaultCaseNode(DefaultSt); 1689daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek} 1690daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek 1691e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek//===----------------------------------------------------------------------===// 1692ec96a2d52d16e150baaf629cd35e3fabff5d8915Ted Kremenek// Transfer functions: Loads and stores. 1693e695e1cd7d8a579455e8969be36cbaf10a316a64Ted Kremenek//===----------------------------------------------------------------------===// 1694d27f8169f4b68337a489547a41ac45bf7a5d1ddfTed Kremenek 1695d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidisvoid ExprEngine::VisitCommonDeclRefExpr(const Expr *Ex, const NamedDecl *D, 1696d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidis ExplodedNode *Pred, 1697d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidis ExplodedNodeSet &Dst) { 169866c486f275531df6362b3511fc3af6563561801bTed Kremenek StmtNodeBuilder Bldr(Pred, Dst, *currBldrCtx); 1699ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks 17008bef8238181a30e52dea380789a7e2d760eac532Ted Kremenek ProgramStateRef state = Pred->getState(); 17015eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek const LocationContext *LCtx = Pred->getLocationContext(); 17026d69b5d82281992e981caa9bc038e3f6cac6594aZhongxing Xu 17039c378f705405d37f49795d5e915989de774fe11fTed Kremenek if (const VarDecl *VD = dyn_cast<VarDecl>(D)) { 17041acb394679b6e644044a0f6c358229759009b1a6Jordan Rose // C permits "extern void v", and if you cast the address to a valid type, 17051acb394679b6e644044a0f6c358229759009b1a6Jordan Rose // you can even do things with it. We simply pretend 17061acb394679b6e644044a0f6c358229759009b1a6Jordan Rose assert(Ex->isGLValue() || VD->getType()->isVoidType()); 1707d17da2b99f323fa91b01e1dd119cc32e0ee8197dTed Kremenek SVal V = state->getLValue(VD, Pred->getLocationContext()); 1708a7581731b1453b51b26154d2409d42a5b6395079Zhongxing Xu 1709892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek // For references, the 'lvalue' is the pointer address stored in the 1710892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek // reference region. 1711892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek if (VD->getType()->isReferenceType()) { 1712892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek if (const MemRegion *R = V.getAsRegion()) 1713892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek V = state->getSVal(R); 1714892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek else 1715892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek V = UnknownVal(); 1716852274d4257134906995cb252fb3dfd2d71deae8Ted Kremenek } 17176d69b5d82281992e981caa9bc038e3f6cac6594aZhongxing Xu 1718fa06f0464a04bb7fce1fcfb3780d151bb029e00cJordan Rose Bldr.generateNode(Ex, Pred, state->BindExpr(Ex, LCtx, V), 0, 1719ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks ProgramPoint::PostLValueKind); 1720852274d4257134906995cb252fb3dfd2d71deae8Ted Kremenek return; 1721892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek } 17229c378f705405d37f49795d5e915989de774fe11fTed Kremenek if (const EnumConstantDecl *ED = dyn_cast<EnumConstantDecl>(D)) { 1723591b5f53c0e11d87401b4804bb1be1a53f95c619Anna Zaks assert(!Ex->isGLValue()); 1724c8413fd03f73084a5c93028f8b4db619fc388087Ted Kremenek SVal V = svalBuilder.makeIntVal(ED->getInitVal()); 17255eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek Bldr.generateNode(Ex, Pred, state->BindExpr(Ex, LCtx, V)); 17266d69b5d82281992e981caa9bc038e3f6cac6594aZhongxing Xu return; 1727892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek } 17289c378f705405d37f49795d5e915989de774fe11fTed Kremenek if (const FunctionDecl *FD = dyn_cast<FunctionDecl>(D)) { 1729c8413fd03f73084a5c93028f8b4db619fc388087Ted Kremenek SVal V = svalBuilder.getFunctionPointer(FD); 1730fa06f0464a04bb7fce1fcfb3780d151bb029e00cJordan Rose Bldr.generateNode(Ex, Pred, state->BindExpr(Ex, LCtx, V), 0, 1731ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks ProgramPoint::PostLValueKind); 17326d69b5d82281992e981caa9bc038e3f6cac6594aZhongxing Xu return; 17331b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek } 17345aac0b6ae95f137b1783f3e6227241fb457b8f8bTed Kremenek if (isa<FieldDecl>(D)) { 1735fa06f0464a04bb7fce1fcfb3780d151bb029e00cJordan Rose // FIXME: Compute lvalue of field pointers-to-member. 17360156439a3d718ea0ef5922c38d189a60829c8a86Jordan Rose // Right now we just use a non-null void pointer, so that it gives proper 17370156439a3d718ea0ef5922c38d189a60829c8a86Jordan Rose // results in boolean contexts. 17380156439a3d718ea0ef5922c38d189a60829c8a86Jordan Rose SVal V = svalBuilder.conjureSymbolVal(Ex, LCtx, getContext().VoidPtrTy, 17390156439a3d718ea0ef5922c38d189a60829c8a86Jordan Rose currBldrCtx->blockCount()); 17405251abea41b446c26e3239c8dd6c7edea6fc335dDavid Blaikie state = state->assume(V.castAs<DefinedOrUnknownSVal>(), true); 17410156439a3d718ea0ef5922c38d189a60829c8a86Jordan Rose Bldr.generateNode(Ex, Pred, state->BindExpr(Ex, LCtx, V), 0, 1742fa06f0464a04bb7fce1fcfb3780d151bb029e00cJordan Rose ProgramPoint::PostLValueKind); 17435aac0b6ae95f137b1783f3e6227241fb457b8f8bTed Kremenek return; 17445aac0b6ae95f137b1783f3e6227241fb457b8f8bTed Kremenek } 17455aac0b6ae95f137b1783f3e6227241fb457b8f8bTed Kremenek 1746fa06f0464a04bb7fce1fcfb3780d151bb029e00cJordan Rose llvm_unreachable("Support for this Decl not implemented."); 17473271f8d315712885ac87747369bb1d9f4b1ea81fTed Kremenek} 17483271f8d315712885ac87747369bb1d9f4b1ea81fTed Kremenek 1749540cbe2b60294fe7b926c26b4f1840f544fe3011Ted Kremenek/// VisitArraySubscriptExpr - Transfer function for array accesses 17509c378f705405d37f49795d5e915989de774fe11fTed Kremenekvoid ExprEngine::VisitLvalArraySubscriptExpr(const ArraySubscriptExpr *A, 17519c378f705405d37f49795d5e915989de774fe11fTed Kremenek ExplodedNode *Pred, 17529c378f705405d37f49795d5e915989de774fe11fTed Kremenek ExplodedNodeSet &Dst){ 17531eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 17549c378f705405d37f49795d5e915989de774fe11fTed Kremenek const Expr *Base = A->getBase()->IgnoreParens(); 17559c378f705405d37f49795d5e915989de774fe11fTed Kremenek const Expr *Idx = A->getIdx()->IgnoreParens(); 1756892697dd2287caf7c29aaaa82909b0e90b8b63feTed Kremenek 17571eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 17588f3407ef22bc7efe6ca4169381e09d0d657ec192Ted Kremenek ExplodedNodeSet checkerPreStmt; 17598f3407ef22bc7efe6ca4169381e09d0d657ec192Ted Kremenek getCheckerManager().runCheckersForPreStmt(checkerPreStmt, Pred, A, *this); 17608f3407ef22bc7efe6ca4169381e09d0d657ec192Ted Kremenek 176166c486f275531df6362b3511fc3af6563561801bTed Kremenek StmtNodeBuilder Bldr(checkerPreStmt, Dst, *currBldrCtx); 1762ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks 17638f3407ef22bc7efe6ca4169381e09d0d657ec192Ted Kremenek for (ExplodedNodeSet::iterator it = checkerPreStmt.begin(), 17648f3407ef22bc7efe6ca4169381e09d0d657ec192Ted Kremenek ei = checkerPreStmt.end(); it != ei; ++it) { 17655eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek const LocationContext *LCtx = (*it)->getLocationContext(); 17668bef8238181a30e52dea380789a7e2d760eac532Ted Kremenek ProgramStateRef state = (*it)->getState(); 17675eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek SVal V = state->getLValue(A->getType(), 17685eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek state->getSVal(Idx, LCtx), 17695eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek state->getSVal(Base, LCtx)); 1770591b5f53c0e11d87401b4804bb1be1a53f95c619Anna Zaks assert(A->isGLValue()); 1771fa06f0464a04bb7fce1fcfb3780d151bb029e00cJordan Rose Bldr.generateNode(A, *it, state->BindExpr(A, LCtx, V), 0, 1772fa06f0464a04bb7fce1fcfb3780d151bb029e00cJordan Rose ProgramPoint::PostLValueKind); 17731b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek } 1774540cbe2b60294fe7b926c26b4f1840f544fe3011Ted Kremenek} 1775540cbe2b60294fe7b926c26b4f1840f544fe3011Ted Kremenek 1776469ecbded3616416ef938ed94a67f86149faf226Ted Kremenek/// VisitMemberExpr - Transfer function for member expressions. 17779c378f705405d37f49795d5e915989de774fe11fTed Kremenekvoid ExprEngine::VisitMemberExpr(const MemberExpr *M, ExplodedNode *Pred, 1778651f13cea278ec967336033dd032faef0e9fc2ecStephen Hines ExplodedNodeSet &Dst) { 17791eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1780651f13cea278ec967336033dd032faef0e9fc2ecStephen Hines // FIXME: Prechecks eventually go in ::Visit(). 1781651f13cea278ec967336033dd032faef0e9fc2ecStephen Hines ExplodedNodeSet CheckedSet; 1782651f13cea278ec967336033dd032faef0e9fc2ecStephen Hines getCheckerManager().runCheckersForPreStmt(CheckedSet, Pred, M, *this); 1783651f13cea278ec967336033dd032faef0e9fc2ecStephen Hines 1784651f13cea278ec967336033dd032faef0e9fc2ecStephen Hines ExplodedNodeSet EvalSet; 1785603513d2294c437b37bcf47f326b686e31bd9e84Jordan Rose ValueDecl *Member = M->getMemberDecl(); 178610f77ad7fc5e5cf3f37a9b14ff5843468b8b84d2Ted Kremenek 1787603513d2294c437b37bcf47f326b686e31bd9e84Jordan Rose // Handle static member variables and enum constants accessed via 1788603513d2294c437b37bcf47f326b686e31bd9e84Jordan Rose // member syntax. 1789603513d2294c437b37bcf47f326b686e31bd9e84Jordan Rose if (isa<VarDecl>(Member) || isa<EnumConstantDecl>(Member)) { 1790651f13cea278ec967336033dd032faef0e9fc2ecStephen Hines ExplodedNodeSet Dst; 1791651f13cea278ec967336033dd032faef0e9fc2ecStephen Hines for (ExplodedNodeSet::iterator I = CheckedSet.begin(), E = CheckedSet.end(); 1792651f13cea278ec967336033dd032faef0e9fc2ecStephen Hines I != E; ++I) { 1793651f13cea278ec967336033dd032faef0e9fc2ecStephen Hines VisitCommonDeclRefExpr(M, Member, Pred, EvalSet); 1794651f13cea278ec967336033dd032faef0e9fc2ecStephen Hines } 1795651f13cea278ec967336033dd032faef0e9fc2ecStephen Hines } else { 1796651f13cea278ec967336033dd032faef0e9fc2ecStephen Hines StmtNodeBuilder Bldr(CheckedSet, EvalSet, *currBldrCtx); 1797651f13cea278ec967336033dd032faef0e9fc2ecStephen Hines ExplodedNodeSet Tmp; 1798f1e67d75fc922ff905de9faa6326bb1a96685ec1Jordan Rose 1799651f13cea278ec967336033dd032faef0e9fc2ecStephen Hines for (ExplodedNodeSet::iterator I = CheckedSet.begin(), E = CheckedSet.end(); 1800651f13cea278ec967336033dd032faef0e9fc2ecStephen Hines I != E; ++I) { 1801651f13cea278ec967336033dd032faef0e9fc2ecStephen Hines ProgramStateRef state = (*I)->getState(); 1802651f13cea278ec967336033dd032faef0e9fc2ecStephen Hines const LocationContext *LCtx = (*I)->getLocationContext(); 1803651f13cea278ec967336033dd032faef0e9fc2ecStephen Hines Expr *BaseExpr = M->getBase(); 180410f77ad7fc5e5cf3f37a9b14ff5843468b8b84d2Ted Kremenek 1805651f13cea278ec967336033dd032faef0e9fc2ecStephen Hines // Handle C++ method calls. 1806651f13cea278ec967336033dd032faef0e9fc2ecStephen Hines if (const CXXMethodDecl *MD = dyn_cast<CXXMethodDecl>(Member)) { 1807651f13cea278ec967336033dd032faef0e9fc2ecStephen Hines if (MD->isInstance()) 1808651f13cea278ec967336033dd032faef0e9fc2ecStephen Hines state = createTemporaryRegionIfNeeded(state, LCtx, BaseExpr); 180920aa40342bd74895128860c081aa84cd85bfa68dJordan Rose 1810651f13cea278ec967336033dd032faef0e9fc2ecStephen Hines SVal MDVal = svalBuilder.getFunctionPointer(MD); 1811651f13cea278ec967336033dd032faef0e9fc2ecStephen Hines state = state->BindExpr(M, LCtx, MDVal); 181220aa40342bd74895128860c081aa84cd85bfa68dJordan Rose 1813651f13cea278ec967336033dd032faef0e9fc2ecStephen Hines Bldr.generateNode(M, *I, state); 1814651f13cea278ec967336033dd032faef0e9fc2ecStephen Hines continue; 181573b417f363a67439b30b3167ef8d9fb32e37191bAnna Zaks } 181673b417f363a67439b30b3167ef8d9fb32e37191bAnna Zaks 1817651f13cea278ec967336033dd032faef0e9fc2ecStephen Hines // Handle regular struct fields / member variables. 1818651f13cea278ec967336033dd032faef0e9fc2ecStephen Hines state = createTemporaryRegionIfNeeded(state, LCtx, BaseExpr); 1819651f13cea278ec967336033dd032faef0e9fc2ecStephen Hines SVal baseExprVal = state->getSVal(BaseExpr, LCtx); 1820651f13cea278ec967336033dd032faef0e9fc2ecStephen Hines 1821651f13cea278ec967336033dd032faef0e9fc2ecStephen Hines FieldDecl *field = cast<FieldDecl>(Member); 1822651f13cea278ec967336033dd032faef0e9fc2ecStephen Hines SVal L = state->getLValue(field, baseExprVal); 1823651f13cea278ec967336033dd032faef0e9fc2ecStephen Hines 1824651f13cea278ec967336033dd032faef0e9fc2ecStephen Hines if (M->isGLValue() || M->getType()->isArrayType()) { 1825651f13cea278ec967336033dd032faef0e9fc2ecStephen Hines // We special-case rvalues of array type because the analyzer cannot 1826651f13cea278ec967336033dd032faef0e9fc2ecStephen Hines // reason about them, since we expect all regions to be wrapped in Locs. 1827651f13cea278ec967336033dd032faef0e9fc2ecStephen Hines // We instead treat these as lvalues and assume that they will decay to 1828651f13cea278ec967336033dd032faef0e9fc2ecStephen Hines // pointers as soon as they are used. 1829651f13cea278ec967336033dd032faef0e9fc2ecStephen Hines if (!M->isGLValue()) { 1830651f13cea278ec967336033dd032faef0e9fc2ecStephen Hines assert(M->getType()->isArrayType()); 1831651f13cea278ec967336033dd032faef0e9fc2ecStephen Hines const ImplicitCastExpr *PE = 1832651f13cea278ec967336033dd032faef0e9fc2ecStephen Hines dyn_cast<ImplicitCastExpr>((*I)->getParentMap().getParent(M)); 1833651f13cea278ec967336033dd032faef0e9fc2ecStephen Hines if (!PE || PE->getCastKind() != CK_ArrayToPointerDecay) { 1834651f13cea278ec967336033dd032faef0e9fc2ecStephen Hines llvm_unreachable("should always be wrapped in ArrayToPointerDecay"); 1835651f13cea278ec967336033dd032faef0e9fc2ecStephen Hines } 1836651f13cea278ec967336033dd032faef0e9fc2ecStephen Hines } 18376b4be2ef4ce49717ff972434975ce3c34c9a1c4cJordan Rose 1838651f13cea278ec967336033dd032faef0e9fc2ecStephen Hines if (field->getType()->isReferenceType()) { 1839651f13cea278ec967336033dd032faef0e9fc2ecStephen Hines if (const MemRegion *R = L.getAsRegion()) 1840651f13cea278ec967336033dd032faef0e9fc2ecStephen Hines L = state->getSVal(R); 1841651f13cea278ec967336033dd032faef0e9fc2ecStephen Hines else 1842651f13cea278ec967336033dd032faef0e9fc2ecStephen Hines L = UnknownVal(); 1843651f13cea278ec967336033dd032faef0e9fc2ecStephen Hines } 1844651f13cea278ec967336033dd032faef0e9fc2ecStephen Hines 1845651f13cea278ec967336033dd032faef0e9fc2ecStephen Hines Bldr.generateNode(M, *I, state->BindExpr(M, LCtx, L), 0, 1846651f13cea278ec967336033dd032faef0e9fc2ecStephen Hines ProgramPoint::PostLValueKind); 1847651f13cea278ec967336033dd032faef0e9fc2ecStephen Hines } else { 1848651f13cea278ec967336033dd032faef0e9fc2ecStephen Hines Bldr.takeNodes(*I); 1849651f13cea278ec967336033dd032faef0e9fc2ecStephen Hines evalLoad(Tmp, M, M, *I, state, L); 1850651f13cea278ec967336033dd032faef0e9fc2ecStephen Hines Bldr.addNodes(Tmp); 1851651f13cea278ec967336033dd032faef0e9fc2ecStephen Hines } 1852651f13cea278ec967336033dd032faef0e9fc2ecStephen Hines } 1853ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks } 1854651f13cea278ec967336033dd032faef0e9fc2ecStephen Hines 1855651f13cea278ec967336033dd032faef0e9fc2ecStephen Hines getCheckerManager().runCheckersForPostStmt(Dst, EvalSet, M, *this); 1856469ecbded3616416ef938ed94a67f86149faf226Ted Kremenek} 1857469ecbded3616416ef938ed94a67f86149faf226Ted Kremenek 1858bf53dfac8195835028bd6347433f7dbebcc29fc1Anna Zaksnamespace { 1859bf53dfac8195835028bd6347433f7dbebcc29fc1Anna Zaksclass CollectReachableSymbolsCallback : public SymbolVisitor { 1860bf53dfac8195835028bd6347433f7dbebcc29fc1Anna Zaks InvalidatedSymbols Symbols; 1861bf53dfac8195835028bd6347433f7dbebcc29fc1Anna Zakspublic: 1862bf53dfac8195835028bd6347433f7dbebcc29fc1Anna Zaks CollectReachableSymbolsCallback(ProgramStateRef State) {} 1863bf53dfac8195835028bd6347433f7dbebcc29fc1Anna Zaks const InvalidatedSymbols &getSymbols() const { return Symbols; } 1864bf53dfac8195835028bd6347433f7dbebcc29fc1Anna Zaks 1865651f13cea278ec967336033dd032faef0e9fc2ecStephen Hines bool VisitSymbol(SymbolRef Sym) override { 1866bf53dfac8195835028bd6347433f7dbebcc29fc1Anna Zaks Symbols.insert(Sym); 1867bf53dfac8195835028bd6347433f7dbebcc29fc1Anna Zaks return true; 1868bf53dfac8195835028bd6347433f7dbebcc29fc1Anna Zaks } 1869bf53dfac8195835028bd6347433f7dbebcc29fc1Anna Zaks}; 1870bf53dfac8195835028bd6347433f7dbebcc29fc1Anna Zaks} // end anonymous namespace 1871bf53dfac8195835028bd6347433f7dbebcc29fc1Anna Zaks 18721655bcd052a67a3050fc55df8ecce57342352e68Anna Zaks// A value escapes in three possible cases: 18731655bcd052a67a3050fc55df8ecce57342352e68Anna Zaks// (1) We are binding to something that is not a memory region. 18741655bcd052a67a3050fc55df8ecce57342352e68Anna Zaks// (2) We are binding to a MemrRegion that does not have stack storage. 18751655bcd052a67a3050fc55df8ecce57342352e68Anna Zaks// (3) We are binding to a MemRegion with stack storage that the store 18761655bcd052a67a3050fc55df8ecce57342352e68Anna Zaks// does not understand. 1877bf53dfac8195835028bd6347433f7dbebcc29fc1Anna ZaksProgramStateRef ExprEngine::processPointerEscapedOnBind(ProgramStateRef State, 18781655bcd052a67a3050fc55df8ecce57342352e68Anna Zaks SVal Loc, SVal Val) { 1879bf53dfac8195835028bd6347433f7dbebcc29fc1Anna Zaks // Are we storing to something that causes the value to "escape"? 1880bf53dfac8195835028bd6347433f7dbebcc29fc1Anna Zaks bool escapes = true; 1881bf53dfac8195835028bd6347433f7dbebcc29fc1Anna Zaks 1882bf53dfac8195835028bd6347433f7dbebcc29fc1Anna Zaks // TODO: Move to StoreManager. 1883dc84cd5efdd3430efb22546b4ac656aa0540b210David Blaikie if (Optional<loc::MemRegionVal> regionLoc = Loc.getAs<loc::MemRegionVal>()) { 1884bf53dfac8195835028bd6347433f7dbebcc29fc1Anna Zaks escapes = !regionLoc->getRegion()->hasStackStorage(); 1885bf53dfac8195835028bd6347433f7dbebcc29fc1Anna Zaks 1886bf53dfac8195835028bd6347433f7dbebcc29fc1Anna Zaks if (!escapes) { 1887bf53dfac8195835028bd6347433f7dbebcc29fc1Anna Zaks // To test (3), generate a new state with the binding added. If it is 1888bf53dfac8195835028bd6347433f7dbebcc29fc1Anna Zaks // the same state, then it escapes (since the store cannot represent 1889bf53dfac8195835028bd6347433f7dbebcc29fc1Anna Zaks // the binding). 1890bf53dfac8195835028bd6347433f7dbebcc29fc1Anna Zaks // Do this only if we know that the store is not supposed to generate the 1891bf53dfac8195835028bd6347433f7dbebcc29fc1Anna Zaks // same state. 1892bf53dfac8195835028bd6347433f7dbebcc29fc1Anna Zaks SVal StoredVal = State->getSVal(regionLoc->getRegion()); 1893bf53dfac8195835028bd6347433f7dbebcc29fc1Anna Zaks if (StoredVal != Val) 1894bf53dfac8195835028bd6347433f7dbebcc29fc1Anna Zaks escapes = (State == (State->bindLoc(*regionLoc, Val))); 1895bf53dfac8195835028bd6347433f7dbebcc29fc1Anna Zaks } 1896bf53dfac8195835028bd6347433f7dbebcc29fc1Anna Zaks } 1897bf53dfac8195835028bd6347433f7dbebcc29fc1Anna Zaks 1898bf53dfac8195835028bd6347433f7dbebcc29fc1Anna Zaks // If our store can represent the binding and we aren't storing to something 1899bf53dfac8195835028bd6347433f7dbebcc29fc1Anna Zaks // that doesn't have local storage then just return and have the simulation 1900bf53dfac8195835028bd6347433f7dbebcc29fc1Anna Zaks // state continue as is. 1901bf53dfac8195835028bd6347433f7dbebcc29fc1Anna Zaks if (!escapes) 1902bf53dfac8195835028bd6347433f7dbebcc29fc1Anna Zaks return State; 1903bf53dfac8195835028bd6347433f7dbebcc29fc1Anna Zaks 1904bf53dfac8195835028bd6347433f7dbebcc29fc1Anna Zaks // Otherwise, find all symbols referenced by 'val' that we are tracking 1905bf53dfac8195835028bd6347433f7dbebcc29fc1Anna Zaks // and stop tracking them. 1906bf53dfac8195835028bd6347433f7dbebcc29fc1Anna Zaks CollectReachableSymbolsCallback Scanner = 1907bf53dfac8195835028bd6347433f7dbebcc29fc1Anna Zaks State->scanReachableSymbols<CollectReachableSymbolsCallback>(Val); 1908bf53dfac8195835028bd6347433f7dbebcc29fc1Anna Zaks const InvalidatedSymbols &EscapedSymbols = Scanner.getSymbols(); 1909bf53dfac8195835028bd6347433f7dbebcc29fc1Anna Zaks State = getCheckerManager().runCheckersForPointerEscape(State, 1910bf53dfac8195835028bd6347433f7dbebcc29fc1Anna Zaks EscapedSymbols, 1911233e26acc0ff2a1098f4c813f69286fce840a422Anna Zaks /*CallEvent*/ 0, 1912da8d37ce42d2db4e1e76ee6f7f38f10f6b0ef0f8Anton Yartsev PSK_EscapeOnBind, 1913da8d37ce42d2db4e1e76ee6f7f38f10f6b0ef0f8Anton Yartsev 0); 1914bf53dfac8195835028bd6347433f7dbebcc29fc1Anna Zaks 1915bf53dfac8195835028bd6347433f7dbebcc29fc1Anna Zaks return State; 1916bf53dfac8195835028bd6347433f7dbebcc29fc1Anna Zaks} 1917bf53dfac8195835028bd6347433f7dbebcc29fc1Anna Zaks 1918bf53dfac8195835028bd6347433f7dbebcc29fc1Anna ZaksProgramStateRef 191941988f331a74a72cf243a2a68ffb56418e9a174eAnna ZaksExprEngine::notifyCheckersOfPointerEscape(ProgramStateRef State, 1920bf53dfac8195835028bd6347433f7dbebcc29fc1Anna Zaks const InvalidatedSymbols *Invalidated, 1921bf53dfac8195835028bd6347433f7dbebcc29fc1Anna Zaks ArrayRef<const MemRegion *> ExplicitRegions, 1922bf53dfac8195835028bd6347433f7dbebcc29fc1Anna Zaks ArrayRef<const MemRegion *> Regions, 192341988f331a74a72cf243a2a68ffb56418e9a174eAnna Zaks const CallEvent *Call, 1924da8d37ce42d2db4e1e76ee6f7f38f10f6b0ef0f8Anton Yartsev RegionAndSymbolInvalidationTraits &ITraits) { 1925bf53dfac8195835028bd6347433f7dbebcc29fc1Anna Zaks 1926bf53dfac8195835028bd6347433f7dbebcc29fc1Anna Zaks if (!Invalidated || Invalidated->empty()) 1927bf53dfac8195835028bd6347433f7dbebcc29fc1Anna Zaks return State; 1928bf53dfac8195835028bd6347433f7dbebcc29fc1Anna Zaks 1929bf53dfac8195835028bd6347433f7dbebcc29fc1Anna Zaks if (!Call) 1930bf53dfac8195835028bd6347433f7dbebcc29fc1Anna Zaks return getCheckerManager().runCheckersForPointerEscape(State, 1931233e26acc0ff2a1098f4c813f69286fce840a422Anna Zaks *Invalidated, 1932233e26acc0ff2a1098f4c813f69286fce840a422Anna Zaks 0, 1933044fe23e79fff3841cc4c315f8c97e1cdccdd8ddAnton Yartsev PSK_EscapeOther, 1934da8d37ce42d2db4e1e76ee6f7f38f10f6b0ef0f8Anton Yartsev &ITraits); 193541988f331a74a72cf243a2a68ffb56418e9a174eAnna Zaks 1936bf53dfac8195835028bd6347433f7dbebcc29fc1Anna Zaks // If the symbols were invalidated by a call, we want to find out which ones 1937bf53dfac8195835028bd6347433f7dbebcc29fc1Anna Zaks // were invalidated directly due to being arguments to the call. 1938bf53dfac8195835028bd6347433f7dbebcc29fc1Anna Zaks InvalidatedSymbols SymbolsDirectlyInvalidated; 1939bf53dfac8195835028bd6347433f7dbebcc29fc1Anna Zaks for (ArrayRef<const MemRegion *>::iterator I = ExplicitRegions.begin(), 1940bf53dfac8195835028bd6347433f7dbebcc29fc1Anna Zaks E = ExplicitRegions.end(); I != E; ++I) { 1941bf53dfac8195835028bd6347433f7dbebcc29fc1Anna Zaks if (const SymbolicRegion *R = (*I)->StripCasts()->getAs<SymbolicRegion>()) 1942bf53dfac8195835028bd6347433f7dbebcc29fc1Anna Zaks SymbolsDirectlyInvalidated.insert(R->getSymbol()); 1943bf53dfac8195835028bd6347433f7dbebcc29fc1Anna Zaks } 1944bf53dfac8195835028bd6347433f7dbebcc29fc1Anna Zaks 1945bf53dfac8195835028bd6347433f7dbebcc29fc1Anna Zaks InvalidatedSymbols SymbolsIndirectlyInvalidated; 1946bf53dfac8195835028bd6347433f7dbebcc29fc1Anna Zaks for (InvalidatedSymbols::const_iterator I=Invalidated->begin(), 1947bf53dfac8195835028bd6347433f7dbebcc29fc1Anna Zaks E = Invalidated->end(); I!=E; ++I) { 1948bf53dfac8195835028bd6347433f7dbebcc29fc1Anna Zaks SymbolRef sym = *I; 1949bf53dfac8195835028bd6347433f7dbebcc29fc1Anna Zaks if (SymbolsDirectlyInvalidated.count(sym)) 1950bf53dfac8195835028bd6347433f7dbebcc29fc1Anna Zaks continue; 1951bf53dfac8195835028bd6347433f7dbebcc29fc1Anna Zaks SymbolsIndirectlyInvalidated.insert(sym); 1952bf53dfac8195835028bd6347433f7dbebcc29fc1Anna Zaks } 1953bf53dfac8195835028bd6347433f7dbebcc29fc1Anna Zaks 1954bf53dfac8195835028bd6347433f7dbebcc29fc1Anna Zaks if (!SymbolsDirectlyInvalidated.empty()) 1955bf53dfac8195835028bd6347433f7dbebcc29fc1Anna Zaks State = getCheckerManager().runCheckersForPointerEscape(State, 1956da8d37ce42d2db4e1e76ee6f7f38f10f6b0ef0f8Anton Yartsev SymbolsDirectlyInvalidated, Call, PSK_DirectEscapeOnCall, &ITraits); 1957bf53dfac8195835028bd6347433f7dbebcc29fc1Anna Zaks 1958bf53dfac8195835028bd6347433f7dbebcc29fc1Anna Zaks // Notify about the symbols that get indirectly invalidated by the call. 1959bf53dfac8195835028bd6347433f7dbebcc29fc1Anna Zaks if (!SymbolsIndirectlyInvalidated.empty()) 1960bf53dfac8195835028bd6347433f7dbebcc29fc1Anna Zaks State = getCheckerManager().runCheckersForPointerEscape(State, 1961da8d37ce42d2db4e1e76ee6f7f38f10f6b0ef0f8Anton Yartsev SymbolsIndirectlyInvalidated, Call, PSK_IndirectEscapeOnCall, &ITraits); 1962bf53dfac8195835028bd6347433f7dbebcc29fc1Anna Zaks 1963bf53dfac8195835028bd6347433f7dbebcc29fc1Anna Zaks return State; 1964bf53dfac8195835028bd6347433f7dbebcc29fc1Anna Zaks} 1965bf53dfac8195835028bd6347433f7dbebcc29fc1Anna Zaks 19669c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek/// evalBind - Handle the semantics of binding a value to a specific location. 19679c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek/// This method is used by evalStore and (soon) VisitDeclStmt, and others. 19689c378f705405d37f49795d5e915989de774fe11fTed Kremenekvoid ExprEngine::evalBind(ExplodedNodeSet &Dst, const Stmt *StoreE, 196993bd5ca766c4d7906878f4ffe76ce1b2080e540bJordy Rose ExplodedNode *Pred, 197032a549a64922af0903bdb777613ae7ae4490b70fTed Kremenek SVal location, SVal Val, 19713682f1ea9c7fddc7dcbc590891158ba40f7fca16Jordan Rose bool atDeclInit, const ProgramPoint *PP) { 19723682f1ea9c7fddc7dcbc590891158ba40f7fca16Jordan Rose 19733682f1ea9c7fddc7dcbc590891158ba40f7fca16Jordan Rose const LocationContext *LC = Pred->getLocationContext(); 19743682f1ea9c7fddc7dcbc590891158ba40f7fca16Jordan Rose PostStmt PS(StoreE, LC); 19753682f1ea9c7fddc7dcbc590891158ba40f7fca16Jordan Rose if (!PP) 19763682f1ea9c7fddc7dcbc590891158ba40f7fca16Jordan Rose PP = &PS; 1977b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 1978b107c4b7efb907d75620cd3c17f82fe27dc5b745Ted Kremenek // Do a previsit of the bind. 1979fe27971d54d26997149d6b84057f04ff398d1d5dJordy Rose ExplodedNodeSet CheckedSet; 1980fe27971d54d26997149d6b84057f04ff398d1d5dJordy Rose getCheckerManager().runCheckersForBind(CheckedSet, Pred, location, Val, 19813682f1ea9c7fddc7dcbc590891158ba40f7fca16Jordan Rose StoreE, *this, *PP); 1982b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 1983bf53dfac8195835028bd6347433f7dbebcc29fc1Anna Zaks 1984bf53dfac8195835028bd6347433f7dbebcc29fc1Anna Zaks StmtNodeBuilder Bldr(CheckedSet, Dst, *currBldrCtx); 1985bf53dfac8195835028bd6347433f7dbebcc29fc1Anna Zaks 198632a549a64922af0903bdb777613ae7ae4490b70fTed Kremenek // If the location is not a 'Loc', it will already be handled by 198732a549a64922af0903bdb777613ae7ae4490b70fTed Kremenek // the checkers. There is nothing left to do. 19885251abea41b446c26e3239c8dd6c7edea6fc335dDavid Blaikie if (!location.getAs<Loc>()) { 1989bf53dfac8195835028bd6347433f7dbebcc29fc1Anna Zaks const ProgramPoint L = PostStore(StoreE, LC, /*Loc*/0, /*tag*/0); 1990bf53dfac8195835028bd6347433f7dbebcc29fc1Anna Zaks ProgramStateRef state = Pred->getState(); 1991bf53dfac8195835028bd6347433f7dbebcc29fc1Anna Zaks state = processPointerEscapedOnBind(state, location, Val); 1992bf53dfac8195835028bd6347433f7dbebcc29fc1Anna Zaks Bldr.generateNode(L, state, Pred); 199332a549a64922af0903bdb777613ae7ae4490b70fTed Kremenek return; 199432a549a64922af0903bdb777613ae7ae4490b70fTed Kremenek } 199532a549a64922af0903bdb777613ae7ae4490b70fTed Kremenek 19966b6152ba96c164a292cc0b8d8b1d4cecbec27a60Anna Zaks 1997b107c4b7efb907d75620cd3c17f82fe27dc5b745Ted Kremenek for (ExplodedNodeSet::iterator I = CheckedSet.begin(), E = CheckedSet.end(); 1998b107c4b7efb907d75620cd3c17f82fe27dc5b745Ted Kremenek I!=E; ++I) { 19993d7c44e01d568e5d5c0fac9c6ccb3f080157ba19Anna Zaks ExplodedNode *PredI = *I; 20003d7c44e01d568e5d5c0fac9c6ccb3f080157ba19Anna Zaks ProgramStateRef state = PredI->getState(); 200132a549a64922af0903bdb777613ae7ae4490b70fTed Kremenek 2002bf53dfac8195835028bd6347433f7dbebcc29fc1Anna Zaks state = processPointerEscapedOnBind(state, location, Val); 2003bf53dfac8195835028bd6347433f7dbebcc29fc1Anna Zaks 200432a549a64922af0903bdb777613ae7ae4490b70fTed Kremenek // When binding the value, pass on the hint that this is a initialization. 200532a549a64922af0903bdb777613ae7ae4490b70fTed Kremenek // For initializations, we do not need to inform clients of region 200632a549a64922af0903bdb777613ae7ae4490b70fTed Kremenek // changes. 20075251abea41b446c26e3239c8dd6c7edea6fc335dDavid Blaikie state = state->bindLoc(location.castAs<Loc>(), 200832a549a64922af0903bdb777613ae7ae4490b70fTed Kremenek Val, /* notifyChanges = */ !atDeclInit); 2009bf53dfac8195835028bd6347433f7dbebcc29fc1Anna Zaks 20103d7c44e01d568e5d5c0fac9c6ccb3f080157ba19Anna Zaks const MemRegion *LocReg = 0; 2011dc84cd5efdd3430efb22546b4ac656aa0540b210David Blaikie if (Optional<loc::MemRegionVal> LocRegVal = 20125251abea41b446c26e3239c8dd6c7edea6fc335dDavid Blaikie location.getAs<loc::MemRegionVal>()) { 20133d7c44e01d568e5d5c0fac9c6ccb3f080157ba19Anna Zaks LocReg = LocRegVal->getRegion(); 201432a549a64922af0903bdb777613ae7ae4490b70fTed Kremenek } 20153682f1ea9c7fddc7dcbc590891158ba40f7fca16Jordan Rose 20163d7c44e01d568e5d5c0fac9c6ccb3f080157ba19Anna Zaks const ProgramPoint L = PostStore(StoreE, LC, LocReg, 0); 2017fa06f0464a04bb7fce1fcfb3780d151bb029e00cJordan Rose Bldr.generateNode(L, state, PredI); 2018b107c4b7efb907d75620cd3c17f82fe27dc5b745Ted Kremenek } 2019a8538d902fce9cfec20f39b34492268b51643819Ted Kremenek} 2020a8538d902fce9cfec20f39b34492268b51643819Ted Kremenek 20219c14953d0c84f7cf5adfb4cd3c0f05a9b1723c1cTed Kremenek/// evalStore - Handle the semantics of a store via an assignment. 2022a8538d902fce9cfec20f39b34492268b51643819Ted Kremenek/// @param Dst The node set to store generated state nodes 20232e6f5b823912ae76211427cb8684c9eaa6e53a1fJames Dennett/// @param AssignE The assignment expression if the store happens in an 2024e8a4d7d0064b357a30fe7ee4f2ddc02f9ffc0357Zhongxing Xu/// assignment. 20252e6f5b823912ae76211427cb8684c9eaa6e53a1fJames Dennett/// @param LocationE The location expression that is stored to. 2026a8538d902fce9cfec20f39b34492268b51643819Ted Kremenek/// @param state The current simulation state 2027a8538d902fce9cfec20f39b34492268b51643819Ted Kremenek/// @param location The location to store the value 2028a8538d902fce9cfec20f39b34492268b51643819Ted Kremenek/// @param Val The value to be stored 20299c378f705405d37f49795d5e915989de774fe11fTed Kremenekvoid ExprEngine::evalStore(ExplodedNodeSet &Dst, const Expr *AssignE, 20309c378f705405d37f49795d5e915989de774fe11fTed Kremenek const Expr *LocationE, 20319c378f705405d37f49795d5e915989de774fe11fTed Kremenek ExplodedNode *Pred, 20328bef8238181a30e52dea380789a7e2d760eac532Ted Kremenek ProgramStateRef state, SVal location, SVal Val, 2033ca804539d908d3a0e8c72a0df5f1f571d29490bbTed Kremenek const ProgramPointTag *tag) { 203414429b918bd2f4cb52abc75546a7fe37142054caArgyrios Kyrtzidis // Proceed with the store. We use AssignE as the anchor for the PostStore 203514429b918bd2f4cb52abc75546a7fe37142054caArgyrios Kyrtzidis // ProgramPoint if it is non-NULL, and LocationE otherwise. 203614429b918bd2f4cb52abc75546a7fe37142054caArgyrios Kyrtzidis const Expr *StoreE = AssignE ? AssignE : LocationE; 203714429b918bd2f4cb52abc75546a7fe37142054caArgyrios Kyrtzidis 20381b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek // Evaluate the location (checks for bad dereferences). 2039b4b817d704287836b52b34369009e682f208aa2bTed Kremenek ExplodedNodeSet Tmp; 2040bd613137499b1d4c3b63dccd0aa21f6add243f4fTed Kremenek evalLocation(Tmp, AssignE, LocationE, Pred, state, location, tag, false); 20411eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 2042b4b817d704287836b52b34369009e682f208aa2bTed Kremenek if (Tmp.empty()) 20431b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek return; 2044b0533965f1b4db020692e3b23ca7b3bc15bf5897Ted Kremenek 204573c498a08f4968b6987d1453c7b77929dcc6d5f7Argyrios Kyrtzidis if (location.isUndef()) 204673c498a08f4968b6987d1453c7b77929dcc6d5f7Argyrios Kyrtzidis return; 2047a8538d902fce9cfec20f39b34492268b51643819Ted Kremenek 2048b4b817d704287836b52b34369009e682f208aa2bTed Kremenek for (ExplodedNodeSet::iterator NI=Tmp.begin(), NE=Tmp.end(); NI!=NE; ++NI) 20493d7c44e01d568e5d5c0fac9c6ccb3f080157ba19Anna Zaks evalBind(Dst, StoreE, *NI, location, Val, false); 20501b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek} 20511b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek 2052bd613137499b1d4c3b63dccd0aa21f6add243f4fTed Kremenekvoid ExprEngine::evalLoad(ExplodedNodeSet &Dst, 2053bd613137499b1d4c3b63dccd0aa21f6add243f4fTed Kremenek const Expr *NodeEx, 2054bd613137499b1d4c3b63dccd0aa21f6add243f4fTed Kremenek const Expr *BoundEx, 2055bd613137499b1d4c3b63dccd0aa21f6add243f4fTed Kremenek ExplodedNode *Pred, 2056bd613137499b1d4c3b63dccd0aa21f6add243f4fTed Kremenek ProgramStateRef state, 2057bd613137499b1d4c3b63dccd0aa21f6add243f4fTed Kremenek SVal location, 2058bd613137499b1d4c3b63dccd0aa21f6add243f4fTed Kremenek const ProgramPointTag *tag, 2059bd613137499b1d4c3b63dccd0aa21f6add243f4fTed Kremenek QualType LoadTy) 2060bd613137499b1d4c3b63dccd0aa21f6add243f4fTed Kremenek{ 20615251abea41b446c26e3239c8dd6c7edea6fc335dDavid Blaikie assert(!location.getAs<NonLoc>() && "location cannot be a NonLoc."); 206214429b918bd2f4cb52abc75546a7fe37142054caArgyrios Kyrtzidis 20635b8c69494881b7d35bc6244b4a19be0cc2eab368Jordan Rose // Are we loading from a region? This actually results in two loads; one 2064852274d4257134906995cb252fb3dfd2d71deae8Ted Kremenek // to fetch the address of the referenced value and one to fetch the 2065852274d4257134906995cb252fb3dfd2d71deae8Ted Kremenek // referenced value. 20669697934650354bed2e509d8e7e44f21a1fb00f76Ted Kremenek if (const TypedValueRegion *TR = 20679697934650354bed2e509d8e7e44f21a1fb00f76Ted Kremenek dyn_cast_or_null<TypedValueRegion>(location.getAsRegion())) { 2068b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 2069018220c343c103b7dfaa117a7a474c7a7fd6d068Zhongxing Xu QualType ValTy = TR->getValueType(); 2070852274d4257134906995cb252fb3dfd2d71deae8Ted Kremenek if (const ReferenceType *RT = ValTy->getAs<ReferenceType>()) { 2071ca804539d908d3a0e8c72a0df5f1f571d29490bbTed Kremenek static SimpleProgramPointTag 2072651f13cea278ec967336033dd032faef0e9fc2ecStephen Hines loadReferenceTag(TagProviderName, "Load Reference"); 2073852274d4257134906995cb252fb3dfd2d71deae8Ted Kremenek ExplodedNodeSet Tmp; 2074bd613137499b1d4c3b63dccd0aa21f6add243f4fTed Kremenek evalLoadCommon(Tmp, NodeEx, BoundEx, Pred, state, 2075bd613137499b1d4c3b63dccd0aa21f6add243f4fTed Kremenek location, &loadReferenceTag, 2076852274d4257134906995cb252fb3dfd2d71deae8Ted Kremenek getContext().getPointerType(RT->getPointeeType())); 2077852274d4257134906995cb252fb3dfd2d71deae8Ted Kremenek 2078852274d4257134906995cb252fb3dfd2d71deae8Ted Kremenek // Perform the load from the referenced value. 2079852274d4257134906995cb252fb3dfd2d71deae8Ted Kremenek for (ExplodedNodeSet::iterator I=Tmp.begin(), E=Tmp.end() ; I!=E; ++I) { 2080db5e8cd095d1ffdd18f5620ad2348b5f386bebe3Anna Zaks state = (*I)->getState(); 2081bd613137499b1d4c3b63dccd0aa21f6add243f4fTed Kremenek location = state->getSVal(BoundEx, (*I)->getLocationContext()); 2082bd613137499b1d4c3b63dccd0aa21f6add243f4fTed Kremenek evalLoadCommon(Dst, NodeEx, BoundEx, *I, state, location, tag, LoadTy); 2083b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek } 2084852274d4257134906995cb252fb3dfd2d71deae8Ted Kremenek return; 2085852274d4257134906995cb252fb3dfd2d71deae8Ted Kremenek } 2086852274d4257134906995cb252fb3dfd2d71deae8Ted Kremenek } 2087b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 2088bd613137499b1d4c3b63dccd0aa21f6add243f4fTed Kremenek evalLoadCommon(Dst, NodeEx, BoundEx, Pred, state, location, tag, LoadTy); 2089852274d4257134906995cb252fb3dfd2d71deae8Ted Kremenek} 2090852274d4257134906995cb252fb3dfd2d71deae8Ted Kremenek 2091bd613137499b1d4c3b63dccd0aa21f6add243f4fTed Kremenekvoid ExprEngine::evalLoadCommon(ExplodedNodeSet &Dst, 2092bd613137499b1d4c3b63dccd0aa21f6add243f4fTed Kremenek const Expr *NodeEx, 2093bd613137499b1d4c3b63dccd0aa21f6add243f4fTed Kremenek const Expr *BoundEx, 2094bd613137499b1d4c3b63dccd0aa21f6add243f4fTed Kremenek ExplodedNode *Pred, 2095bd613137499b1d4c3b63dccd0aa21f6add243f4fTed Kremenek ProgramStateRef state, 2096bd613137499b1d4c3b63dccd0aa21f6add243f4fTed Kremenek SVal location, 2097bd613137499b1d4c3b63dccd0aa21f6add243f4fTed Kremenek const ProgramPointTag *tag, 2098bd613137499b1d4c3b63dccd0aa21f6add243f4fTed Kremenek QualType LoadTy) { 2099bd613137499b1d4c3b63dccd0aa21f6add243f4fTed Kremenek assert(NodeEx); 2100bd613137499b1d4c3b63dccd0aa21f6add243f4fTed Kremenek assert(BoundEx); 21011eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump // Evaluate the location (checks for bad dereferences). 2102b4b817d704287836b52b34369009e682f208aa2bTed Kremenek ExplodedNodeSet Tmp; 2103bd613137499b1d4c3b63dccd0aa21f6add243f4fTed Kremenek evalLocation(Tmp, NodeEx, BoundEx, Pred, state, location, tag, true); 2104b4b817d704287836b52b34369009e682f208aa2bTed Kremenek if (Tmp.empty()) 21051b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek return; 2106b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 210766c486f275531df6362b3511fc3af6563561801bTed Kremenek StmtNodeBuilder Bldr(Tmp, Dst, *currBldrCtx); 210873c498a08f4968b6987d1453c7b77929dcc6d5f7Argyrios Kyrtzidis if (location.isUndef()) 210973c498a08f4968b6987d1453c7b77929dcc6d5f7Argyrios Kyrtzidis return; 2110b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 21111b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek // Proceed with the load. 2112b4b817d704287836b52b34369009e682f208aa2bTed Kremenek for (ExplodedNodeSet::iterator NI=Tmp.begin(), NE=Tmp.end(); NI!=NE; ++NI) { 2113db5e8cd095d1ffdd18f5620ad2348b5f386bebe3Anna Zaks state = (*NI)->getState(); 21145eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek const LocationContext *LCtx = (*NI)->getLocationContext(); 211596ebad66c451d79c9f57b1edb31efaeeb23b9a01Ted Kremenek 21167affe151f5689b2d3547b8947c4099532c78a021Jordan Rose SVal V = UnknownVal(); 21177affe151f5689b2d3547b8947c4099532c78a021Jordan Rose if (location.isValid()) { 211896ebad66c451d79c9f57b1edb31efaeeb23b9a01Ted Kremenek if (LoadTy.isNull()) 2119bd613137499b1d4c3b63dccd0aa21f6add243f4fTed Kremenek LoadTy = BoundEx->getType(); 21205251abea41b446c26e3239c8dd6c7edea6fc335dDavid Blaikie V = state->getSVal(location.castAs<Loc>(), LoadTy); 2121b4b817d704287836b52b34369009e682f208aa2bTed Kremenek } 21227affe151f5689b2d3547b8947c4099532c78a021Jordan Rose 21237affe151f5689b2d3547b8947c4099532c78a021Jordan Rose Bldr.generateNode(NodeEx, *NI, state->BindExpr(BoundEx, LCtx, V), tag, 21247affe151f5689b2d3547b8947c4099532c78a021Jordan Rose ProgramPoint::PostLoadKind); 2125d5b499d43c3526fae7f9ebb6e2d50e79d3496cedZhongxing Xu } 21261b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek} 21271b8bd4d71c2098126041b4de4267175a82f0103cTed Kremenek 2128bd613137499b1d4c3b63dccd0aa21f6add243f4fTed Kremenekvoid ExprEngine::evalLocation(ExplodedNodeSet &Dst, 2129bd613137499b1d4c3b63dccd0aa21f6add243f4fTed Kremenek const Stmt *NodeEx, 2130bd613137499b1d4c3b63dccd0aa21f6add243f4fTed Kremenek const Stmt *BoundEx, 2131bd613137499b1d4c3b63dccd0aa21f6add243f4fTed Kremenek ExplodedNode *Pred, 2132bd613137499b1d4c3b63dccd0aa21f6add243f4fTed Kremenek ProgramStateRef state, 2133bd613137499b1d4c3b63dccd0aa21f6add243f4fTed Kremenek SVal location, 2134bd613137499b1d4c3b63dccd0aa21f6add243f4fTed Kremenek const ProgramPointTag *tag, 2135bd613137499b1d4c3b63dccd0aa21f6add243f4fTed Kremenek bool isLoad) { 213666c486f275531df6362b3511fc3af6563561801bTed Kremenek StmtNodeBuilder BldrTop(Pred, Dst, *currBldrCtx); 213700b1ad2d56f3e39f95c3f61bf511a531ab6a4fa5Zhongxing Xu // Early checks for performance reason. 2138769ce3e93ad35bd9ac28e4d8b8f035ae4fd9a5b5Argyrios Kyrtzidis if (location.isUnknown()) { 2139b4b817d704287836b52b34369009e682f208aa2bTed Kremenek return; 2140b4b817d704287836b52b34369009e682f208aa2bTed Kremenek } 2141b9bbd592c7ea72ada8d982e40a729beb9b53371eTed Kremenek 21429c0d6891b3ec4b0d20b8a295946c0dc5426d147cArgyrios Kyrtzidis ExplodedNodeSet Src; 2143ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks BldrTop.takeNodes(Pred); 214466c486f275531df6362b3511fc3af6563561801bTed Kremenek StmtNodeBuilder Bldr(Pred, Src, *currBldrCtx); 2145ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks if (Pred->getState() != state) { 2146eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis // Associate this new state with an ExplodedNode. 2147eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis // FIXME: If I pass null tag, the graph is incorrect, e.g for 2148eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis // int *p; 2149eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis // p = 0; 2150eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis // *p = 0xDEADBEEF; 2151eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis // "p = 0" is not noted as "Null pointer value stored to 'p'" but 2152eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis // instead "int *p" is noted as 2153eb48bd1dd4168ab206a330bf523659170291a6a0Argyrios Kyrtzidis // "Variable 'p' initialized to a null pointer value" 2154ca804539d908d3a0e8c72a0df5f1f571d29490bbTed Kremenek 2155651f13cea278ec967336033dd032faef0e9fc2ecStephen Hines static SimpleProgramPointTag tag(TagProviderName, "Location"); 2156fa06f0464a04bb7fce1fcfb3780d151bb029e00cJordan Rose Bldr.generateNode(NodeEx, Pred, state, &tag); 21570296c22557b3735e2ffeff690eb46fb0e9152bccTed Kremenek } 2158ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks ExplodedNodeSet Tmp; 2159bd613137499b1d4c3b63dccd0aa21f6add243f4fTed Kremenek getCheckerManager().runCheckersForLocation(Tmp, Src, location, isLoad, 2160bd613137499b1d4c3b63dccd0aa21f6add243f4fTed Kremenek NodeEx, BoundEx, *this); 2161ebae6d0209e1ec3d5ea14f9e63bd0d740218ed14Anna Zaks BldrTop.addNodes(Tmp); 2162ec96a2d52d16e150baaf629cd35e3fabff5d8915Ted Kremenek} 2163ec96a2d52d16e150baaf629cd35e3fabff5d8915Ted Kremenek 21646c7511db998817e64f2e124013e7d7c9a430c580Ted Kremenekstd::pair<const ProgramPointTag *, const ProgramPointTag*> 21650caa2d47b84337e942b3f6652adfafe4ae506cfeTed KremenekExprEngine::geteagerlyAssumeBinOpBifurcationTags() { 21666c7511db998817e64f2e124013e7d7c9a430c580Ted Kremenek static SimpleProgramPointTag 2167651f13cea278ec967336033dd032faef0e9fc2ecStephen Hines eagerlyAssumeBinOpBifurcationTrue(TagProviderName, 2168651f13cea278ec967336033dd032faef0e9fc2ecStephen Hines "Eagerly Assume True"), 2169651f13cea278ec967336033dd032faef0e9fc2ecStephen Hines eagerlyAssumeBinOpBifurcationFalse(TagProviderName, 2170651f13cea278ec967336033dd032faef0e9fc2ecStephen Hines "Eagerly Assume False"); 21710caa2d47b84337e942b3f6652adfafe4ae506cfeTed Kremenek return std::make_pair(&eagerlyAssumeBinOpBifurcationTrue, 21720caa2d47b84337e942b3f6652adfafe4ae506cfeTed Kremenek &eagerlyAssumeBinOpBifurcationFalse); 21736c7511db998817e64f2e124013e7d7c9a430c580Ted Kremenek} 21746c7511db998817e64f2e124013e7d7c9a430c580Ted Kremenek 21750caa2d47b84337e942b3f6652adfafe4ae506cfeTed Kremenekvoid ExprEngine::evalEagerlyAssumeBinOpBifurcation(ExplodedNodeSet &Dst, 21760caa2d47b84337e942b3f6652adfafe4ae506cfeTed Kremenek ExplodedNodeSet &Src, 21770caa2d47b84337e942b3f6652adfafe4ae506cfeTed Kremenek const Expr *Ex) { 217866c486f275531df6362b3511fc3af6563561801bTed Kremenek StmtNodeBuilder Bldr(Src, Dst, *currBldrCtx); 217986b39f20d5091ca3fdcbeb4a22766aaffdf6ac35Ted Kremenek 2180031ccc0555a82afc2e8afe29e19dd57ff204e2deZhongxing Xu for (ExplodedNodeSet::iterator I=Src.begin(), E=Src.end(); I!=E; ++I) { 2181031ccc0555a82afc2e8afe29e19dd57ff204e2deZhongxing Xu ExplodedNode *Pred = *I; 2182b293902c5cfa18365ffb0e00763849c9808a2ad1Ted Kremenek // Test if the previous node was as the same expression. This can happen 2183b293902c5cfa18365ffb0e00763849c9808a2ad1Ted Kremenek // when the expression fails to evaluate to anything meaningful and 2184b293902c5cfa18365ffb0e00763849c9808a2ad1Ted Kremenek // (as an optimization) we don't generate a node. 21851eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump ProgramPoint P = Pred->getLocation(); 21867a95de68c093991047ed8d339479ccad51b88663David Blaikie if (!P.getAs<PostStmt>() || P.castAs<PostStmt>().getStmt() != Ex) { 2187b293902c5cfa18365ffb0e00763849c9808a2ad1Ted Kremenek continue; 21881eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump } 2189b293902c5cfa18365ffb0e00763849c9808a2ad1Ted Kremenek 21908bef8238181a30e52dea380789a7e2d760eac532Ted Kremenek ProgramStateRef state = Pred->getState(); 21915eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek SVal V = state->getSVal(Ex, Pred->getLocationContext()); 2192dc84cd5efdd3430efb22546b4ac656aa0540b210David Blaikie Optional<nonloc::SymbolVal> SEV = V.getAs<nonloc::SymbolVal>(); 21935344baa704f42b22d9df25c24ffbbf6b4716603bAnna Zaks if (SEV && SEV->isExpression()) { 21946c7511db998817e64f2e124013e7d7c9a430c580Ted Kremenek const std::pair<const ProgramPointTag *, const ProgramPointTag*> &tags = 21950caa2d47b84337e942b3f6652adfafe4ae506cfeTed Kremenek geteagerlyAssumeBinOpBifurcationTags(); 21966c7511db998817e64f2e124013e7d7c9a430c580Ted Kremenek 21976960d08b4ddf389d7c81504df7f16dc645120482Jordan Rose ProgramStateRef StateTrue, StateFalse; 2198651f13cea278ec967336033dd032faef0e9fc2ecStephen Hines std::tie(StateTrue, StateFalse) = state->assume(*SEV); 21996960d08b4ddf389d7c81504df7f16dc645120482Jordan Rose 220048af2a9c1ed3259512f2d1431720add1fbe8fb5fTed Kremenek // First assume that the condition is true. 22016960d08b4ddf389d7c81504df7f16dc645120482Jordan Rose if (StateTrue) { 220286b39f20d5091ca3fdcbeb4a22766aaffdf6ac35Ted Kremenek SVal Val = svalBuilder.makeIntVal(1U, Ex->getType()); 22035eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek StateTrue = StateTrue->BindExpr(Ex, Pred->getLocationContext(), Val); 2204fa06f0464a04bb7fce1fcfb3780d151bb029e00cJordan Rose Bldr.generateNode(Ex, Pred, StateTrue, tags.first); 220548af2a9c1ed3259512f2d1431720add1fbe8fb5fTed Kremenek } 22061eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 220748af2a9c1ed3259512f2d1431720add1fbe8fb5fTed Kremenek // Next, assume that the condition is false. 22086960d08b4ddf389d7c81504df7f16dc645120482Jordan Rose if (StateFalse) { 220986b39f20d5091ca3fdcbeb4a22766aaffdf6ac35Ted Kremenek SVal Val = svalBuilder.makeIntVal(0U, Ex->getType()); 22105eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek StateFalse = StateFalse->BindExpr(Ex, Pred->getLocationContext(), Val); 2211fa06f0464a04bb7fce1fcfb3780d151bb029e00cJordan Rose Bldr.generateNode(Ex, Pred, StateFalse, tags.second); 221248af2a9c1ed3259512f2d1431720add1fbe8fb5fTed Kremenek } 221348af2a9c1ed3259512f2d1431720add1fbe8fb5fTed Kremenek } 221448af2a9c1ed3259512f2d1431720add1fbe8fb5fTed Kremenek } 221548af2a9c1ed3259512f2d1431720add1fbe8fb5fTed Kremenek} 221648af2a9c1ed3259512f2d1431720add1fbe8fb5fTed Kremenek 2217df5faf5e7ae6823d0af0b801c4ac26d47f2cee97Chad Rosiervoid ExprEngine::VisitGCCAsmStmt(const GCCAsmStmt *A, ExplodedNode *Pred, 2218df5faf5e7ae6823d0af0b801c4ac26d47f2cee97Chad Rosier ExplodedNodeSet &Dst) { 221966c486f275531df6362b3511fc3af6563561801bTed Kremenek StmtNodeBuilder Bldr(Pred, Dst, *currBldrCtx); 2220a81d3d434e6581ff354eaf5b2a3c25c75771a792Erik Verbruggen // We have processed both the inputs and the outputs. All of the outputs 2221a81d3d434e6581ff354eaf5b2a3c25c75771a792Erik Verbruggen // should evaluate to Locs. Nuke all of their values. 22221eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 2223a81d3d434e6581ff354eaf5b2a3c25c75771a792Erik Verbruggen // FIXME: Some day in the future it would be nice to allow a "plug-in" 2224a81d3d434e6581ff354eaf5b2a3c25c75771a792Erik Verbruggen // which interprets the inline asm and stores proper results in the 2225a81d3d434e6581ff354eaf5b2a3c25c75771a792Erik Verbruggen // outputs. 22261eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 2227a81d3d434e6581ff354eaf5b2a3c25c75771a792Erik Verbruggen ProgramStateRef state = Pred->getState(); 22281eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 2229df5faf5e7ae6823d0af0b801c4ac26d47f2cee97Chad Rosier for (GCCAsmStmt::const_outputs_iterator OI = A->begin_outputs(), 2230a81d3d434e6581ff354eaf5b2a3c25c75771a792Erik Verbruggen OE = A->end_outputs(); OI != OE; ++OI) { 2231a81d3d434e6581ff354eaf5b2a3c25c75771a792Erik Verbruggen SVal X = state->getSVal(*OI, Pred->getLocationContext()); 22325251abea41b446c26e3239c8dd6c7edea6fc335dDavid Blaikie assert (!X.getAs<NonLoc>()); // Should be an Lval, or unknown, undef. 22331eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 2234dc84cd5efdd3430efb22546b4ac656aa0540b210David Blaikie if (Optional<Loc> LV = X.getAs<Loc>()) 22355251abea41b446c26e3239c8dd6c7edea6fc335dDavid Blaikie state = state->bindLoc(*LV, UnknownVal()); 2236ef44bfb9d0f15ba0391f8346c9f01355fb450a09Ted Kremenek } 22371eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 2238a81d3d434e6581ff354eaf5b2a3c25c75771a792Erik Verbruggen Bldr.generateNode(A, Pred, state); 2239ef44bfb9d0f15ba0391f8346c9f01355fb450a09Ted Kremenek} 2240ef44bfb9d0f15ba0391f8346c9f01355fb450a09Ted Kremenek 22418cd64b4c5553fa6284d248336cb7c82dc960a394Chad Rosiervoid ExprEngine::VisitMSAsmStmt(const MSAsmStmt *A, ExplodedNode *Pred, 22428cd64b4c5553fa6284d248336cb7c82dc960a394Chad Rosier ExplodedNodeSet &Dst) { 224366c486f275531df6362b3511fc3af6563561801bTed Kremenek StmtNodeBuilder Bldr(Pred, Dst, *currBldrCtx); 22448cd64b4c5553fa6284d248336cb7c82dc960a394Chad Rosier Bldr.generateNode(A, Pred, Pred->getState()); 22458cd64b4c5553fa6284d248336cb7c82dc960a394Chad Rosier} 22468cd64b4c5553fa6284d248336cb7c82dc960a394Chad Rosier 2247094bef56a7900f13bb777f9a352704104b1458e7Ted Kremenek//===----------------------------------------------------------------------===// 2248e01c98767dfd7153c3c84637c36659e3bbe16ff7Ted Kremenek// Visualization. 2249ee98546b0d5f3439c4a590b0d7d1545af794a0ecTed Kremenek//===----------------------------------------------------------------------===// 2250ee98546b0d5f3439c4a590b0d7d1545af794a0ecTed Kremenek 2251aa66a32ba177338763cd0cf9df8310dfa2e24ff7Ted Kremenek#ifndef NDEBUG 2252d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidisstatic ExprEngine* GraphPrintCheckerState; 2253e97ca065c91ff9ca2a2a42eb443eaa553c40441cTed Kremenekstatic SourceManager* GraphPrintSourceManager; 22543b4f6702860208692f6ef28401e68de4e3ff9af9Ted Kremenek 2255aa66a32ba177338763cd0cf9df8310dfa2e24ff7Ted Kremeneknamespace llvm { 2256aa66a32ba177338763cd0cf9df8310dfa2e24ff7Ted Kremenektemplate<> 225747491f8b7adf9d42a404d44c073e8a5308fa6cfcDouglas Gregorstruct DOTGraphTraits<ExplodedNode*> : 2258aa66a32ba177338763cd0cf9df8310dfa2e24ff7Ted Kremenek public DefaultDOTGraphTraits { 2259006b0eb3e11162d8c06372db813ac9f71a7a16e8Tobias Grosser 2260006b0eb3e11162d8c06372db813ac9f71a7a16e8Tobias Grosser DOTGraphTraits (bool isSimple=false) : DefaultDOTGraphTraits(isSimple) {} 2261006b0eb3e11162d8c06372db813ac9f71a7a16e8Tobias Grosser 2262d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidis // FIXME: Since we do not cache error nodes in ExprEngine now, this does not 2263ec9227fea66c3439991fc84b0d33b0a8b4b8875eZhongxing Xu // work. 22649c378f705405d37f49795d5e915989de774fe11fTed Kremenek static std::string getNodeAttributes(const ExplodedNode *N, void*) { 22651eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 226610f51e8785e43d5a22acc2d2a638307c582949c2Ted Kremenek#if 0 226710f51e8785e43d5a22acc2d2a638307c582949c2Ted Kremenek // FIXME: Replace with a general scheme to tell if the node is 226810f51e8785e43d5a22acc2d2a638307c582949c2Ted Kremenek // an error node. 2269a3fadfcce5911742801a302cac82d4fe54d5c682Ted Kremenek if (GraphPrintCheckerState->isImplicitNullDeref(N) || 22709dca062461a6244cf0f733346657fa3eee853f9bTed Kremenek GraphPrintCheckerState->isExplicitNullDeref(N) || 22714a4e524afef40d6f3ddb25d0e407c814e4ca56a8Ted Kremenek GraphPrintCheckerState->isUndefDeref(N) || 22724a4e524afef40d6f3ddb25d0e407c814e4ca56a8Ted Kremenek GraphPrintCheckerState->isUndefStore(N) || 22734a4e524afef40d6f3ddb25d0e407c814e4ca56a8Ted Kremenek GraphPrintCheckerState->isUndefControlFlow(N) || 22745e03fcb5420c33207433dd6f800588e256dd9bdbTed Kremenek GraphPrintCheckerState->isUndefResult(N) || 22752ded35a576e3899553ea0ccfcbf5cbdb3d8cf664Ted Kremenek GraphPrintCheckerState->isBadCall(N) || 22762ded35a576e3899553ea0ccfcbf5cbdb3d8cf664Ted Kremenek GraphPrintCheckerState->isUndefArg(N)) 2277a3fadfcce5911742801a302cac82d4fe54d5c682Ted Kremenek return "color=\"red\",style=\"filled\""; 22781eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 22798cc13ea74fea1c04042a2f4087665bc5182e8408Ted Kremenek if (GraphPrintCheckerState->isNoReturnCall(N)) 22808cc13ea74fea1c04042a2f4087665bc5182e8408Ted Kremenek return "color=\"blue\",style=\"filled\""; 22812055effed54d614b51e3501a174c9b1fe92e4de4Zhongxing Xu#endif 2282a3fadfcce5911742801a302cac82d4fe54d5c682Ted Kremenek return ""; 2283a3fadfcce5911742801a302cac82d4fe54d5c682Ted Kremenek } 22841eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 2285cfa88f893915ceb8ae4ce2f17c46c24a4d67502fDmitri Gribenko static void printLocation(raw_ostream &Out, SourceLocation SLoc) { 228628038f33aa2db4833881fea757a1f0daf85ac02bJordan Rose if (SLoc.isFileID()) { 228728038f33aa2db4833881fea757a1f0daf85ac02bJordan Rose Out << "\\lline=" 228828038f33aa2db4833881fea757a1f0daf85ac02bJordan Rose << GraphPrintSourceManager->getExpansionLineNumber(SLoc) 228928038f33aa2db4833881fea757a1f0daf85ac02bJordan Rose << " col=" 229028038f33aa2db4833881fea757a1f0daf85ac02bJordan Rose << GraphPrintSourceManager->getExpansionColumnNumber(SLoc) 229128038f33aa2db4833881fea757a1f0daf85ac02bJordan Rose << "\\l"; 229228038f33aa2db4833881fea757a1f0daf85ac02bJordan Rose } 229328038f33aa2db4833881fea757a1f0daf85ac02bJordan Rose } 229428038f33aa2db4833881fea757a1f0daf85ac02bJordan Rose 22959c378f705405d37f49795d5e915989de774fe11fTed Kremenek static std::string getNodeLabel(const ExplodedNode *N, void*){ 22961eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 229753ba0b636194dbeaa65a6f85316c9397a0c5298bTed Kremenek std::string sbuf; 229853ba0b636194dbeaa65a6f85316c9397a0c5298bTed Kremenek llvm::raw_string_ostream Out(sbuf); 2299803c9edd06e8f936821525d36b1d8cc131e37d44Ted Kremenek 2300803c9edd06e8f936821525d36b1d8cc131e37d44Ted Kremenek // Program Location. 2301aa66a32ba177338763cd0cf9df8310dfa2e24ff7Ted Kremenek ProgramPoint Loc = N->getLocation(); 23021eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 2303aa66a32ba177338763cd0cf9df8310dfa2e24ff7Ted Kremenek switch (Loc.getKind()) { 23040b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks case ProgramPoint::BlockEntranceKind: { 23051eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump Out << "Block Entrance: B" 23067a95de68c093991047ed8d339479ccad51b88663David Blaikie << Loc.castAs<BlockEntrance>().getBlock()->getBlockID(); 23070b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks if (const NamedDecl *ND = 23080b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks dyn_cast<NamedDecl>(Loc.getLocationContext()->getDecl())) { 23090b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks Out << " ("; 23100b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks ND->printName(Out); 23110b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks Out << ")"; 23120b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks } 2313aa66a32ba177338763cd0cf9df8310dfa2e24ff7Ted Kremenek break; 23140b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks } 23151eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 2316aa66a32ba177338763cd0cf9df8310dfa2e24ff7Ted Kremenek case ProgramPoint::BlockExitKind: 2317aa66a32ba177338763cd0cf9df8310dfa2e24ff7Ted Kremenek assert (false); 2318aa66a32ba177338763cd0cf9df8310dfa2e24ff7Ted Kremenek break; 23191eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 2320102acd5369bbb17c0d6ab868af376671acff7a93Douglas Gregor case ProgramPoint::CallEnterKind: 2321102acd5369bbb17c0d6ab868af376671acff7a93Douglas Gregor Out << "CallEnter"; 2322102acd5369bbb17c0d6ab868af376671acff7a93Douglas Gregor break; 2323102acd5369bbb17c0d6ab868af376671acff7a93Douglas Gregor 23240b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks case ProgramPoint::CallExitBeginKind: 23250b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks Out << "CallExitBegin"; 23260b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks break; 23270b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks 23280b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks case ProgramPoint::CallExitEndKind: 23290b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks Out << "CallExitEnd"; 23300b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks break; 23310b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks 23320b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks case ProgramPoint::PostStmtPurgeDeadSymbolsKind: 23330b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks Out << "PostStmtPurgeDeadSymbols"; 23340b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks break; 23350b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks 23360b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks case ProgramPoint::PreStmtPurgeDeadSymbolsKind: 23370b3ade86a1c60cf0c7b56aa238aff458eb7f5974Anna Zaks Out << "PreStmtPurgeDeadSymbols"; 2338102acd5369bbb17c0d6ab868af376671acff7a93Douglas Gregor break; 2339102acd5369bbb17c0d6ab868af376671acff7a93Douglas Gregor 23405903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks case ProgramPoint::EpsilonKind: 23415903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks Out << "Epsilon Point"; 23425903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks break; 23435903a373db3d27794c90b25687e0dd6adb0e497dAnna Zaks 234428038f33aa2db4833881fea757a1f0daf85ac02bJordan Rose case ProgramPoint::PreImplicitCallKind: { 23457a95de68c093991047ed8d339479ccad51b88663David Blaikie ImplicitCallPoint PC = Loc.castAs<ImplicitCallPoint>(); 234628038f33aa2db4833881fea757a1f0daf85ac02bJordan Rose Out << "PreCall: "; 234728038f33aa2db4833881fea757a1f0daf85ac02bJordan Rose 234828038f33aa2db4833881fea757a1f0daf85ac02bJordan Rose // FIXME: Get proper printing options. 23497a95de68c093991047ed8d339479ccad51b88663David Blaikie PC.getDecl()->print(Out, LangOptions()); 23507a95de68c093991047ed8d339479ccad51b88663David Blaikie printLocation(Out, PC.getLocation()); 235128038f33aa2db4833881fea757a1f0daf85ac02bJordan Rose break; 235228038f33aa2db4833881fea757a1f0daf85ac02bJordan Rose } 235328038f33aa2db4833881fea757a1f0daf85ac02bJordan Rose 235428038f33aa2db4833881fea757a1f0daf85ac02bJordan Rose case ProgramPoint::PostImplicitCallKind: { 23557a95de68c093991047ed8d339479ccad51b88663David Blaikie ImplicitCallPoint PC = Loc.castAs<ImplicitCallPoint>(); 235628038f33aa2db4833881fea757a1f0daf85ac02bJordan Rose Out << "PostCall: "; 235728038f33aa2db4833881fea757a1f0daf85ac02bJordan Rose 235828038f33aa2db4833881fea757a1f0daf85ac02bJordan Rose // FIXME: Get proper printing options. 23597a95de68c093991047ed8d339479ccad51b88663David Blaikie PC.getDecl()->print(Out, LangOptions()); 23607a95de68c093991047ed8d339479ccad51b88663David Blaikie printLocation(Out, PC.getLocation()); 236128038f33aa2db4833881fea757a1f0daf85ac02bJordan Rose break; 236228038f33aa2db4833881fea757a1f0daf85ac02bJordan Rose } 236328038f33aa2db4833881fea757a1f0daf85ac02bJordan Rose 23641aa4f5019164592643bf46b7d61f15b6ef509c8eJordan Rose case ProgramPoint::PostInitializerKind: { 23651aa4f5019164592643bf46b7d61f15b6ef509c8eJordan Rose Out << "PostInitializer: "; 23661aa4f5019164592643bf46b7d61f15b6ef509c8eJordan Rose const CXXCtorInitializer *Init = 23671aa4f5019164592643bf46b7d61f15b6ef509c8eJordan Rose Loc.castAs<PostInitializer>().getInitializer(); 23681aa4f5019164592643bf46b7d61f15b6ef509c8eJordan Rose if (const FieldDecl *FD = Init->getAnyMember()) 23691aa4f5019164592643bf46b7d61f15b6ef509c8eJordan Rose Out << *FD; 23701aa4f5019164592643bf46b7d61f15b6ef509c8eJordan Rose else { 23711aa4f5019164592643bf46b7d61f15b6ef509c8eJordan Rose QualType Ty = Init->getTypeSourceInfo()->getType(); 23721aa4f5019164592643bf46b7d61f15b6ef509c8eJordan Rose Ty = Ty.getLocalUnqualifiedType(); 2373e4f2142d00fa5fdb580c4e2413da91882d955381Chris Lattner LangOptions LO; // FIXME. 23741aa4f5019164592643bf46b7d61f15b6ef509c8eJordan Rose Ty.print(Out, LO); 23758c354758c2d39db87c77c723d81e34b4d967f762Ted Kremenek } 23761aa4f5019164592643bf46b7d61f15b6ef509c8eJordan Rose break; 23771aa4f5019164592643bf46b7d61f15b6ef509c8eJordan Rose } 23788c354758c2d39db87c77c723d81e34b4d967f762Ted Kremenek 23791aa4f5019164592643bf46b7d61f15b6ef509c8eJordan Rose case ProgramPoint::BlockEdgeKind: { 23807a95de68c093991047ed8d339479ccad51b88663David Blaikie const BlockEdge &E = Loc.castAs<BlockEdge>(); 2381aa66a32ba177338763cd0cf9df8310dfa2e24ff7Ted Kremenek Out << "Edge: (B" << E.getSrc()->getBlockID() << ", B" 2382aa66a32ba177338763cd0cf9df8310dfa2e24ff7Ted Kremenek << E.getDst()->getBlockID() << ')'; 23831eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 23849c378f705405d37f49795d5e915989de774fe11fTed Kremenek if (const Stmt *T = E.getSrc()->getTerminator()) { 2385e97ca065c91ff9ca2a2a42eb443eaa553c40441cTed Kremenek SourceLocation SLoc = T->getLocStart(); 23861eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 2387b38911f16b4943548db6a3695fc6ae23070b25d2Ted Kremenek Out << "\\|Terminator: "; 2388e4f2142d00fa5fdb580c4e2413da91882d955381Chris Lattner LangOptions LO; // FIXME. 2389e4f2142d00fa5fdb580c4e2413da91882d955381Chris Lattner E.getSrc()->printTerminator(Out, LO); 23901eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 23919b5551d7f0209cec8b9c555cf70e893940674e5cTed Kremenek if (SLoc.isFileID()) { 23929b5551d7f0209cec8b9c555cf70e893940674e5cTed Kremenek Out << "\\lline=" 2393642116259e8df6286063a17361c20e95b5017a0aChandler Carruth << GraphPrintSourceManager->getExpansionLineNumber(SLoc) 23947da5aea7669e6db3e593162b8a123aef06a04d07Chris Lattner << " col=" 2395a77c031cb66f75d22672070052cc6e0205289ff8Chandler Carruth << GraphPrintSourceManager->getExpansionColumnNumber(SLoc); 23969b5551d7f0209cec8b9c555cf70e893940674e5cTed Kremenek } 23971eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 2398daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek if (isa<SwitchStmt>(T)) { 23999c378f705405d37f49795d5e915989de774fe11fTed Kremenek const Stmt *Label = E.getDst()->getLabel(); 24001eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 24011eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump if (Label) { 24029c378f705405d37f49795d5e915989de774fe11fTed Kremenek if (const CaseStmt *C = dyn_cast<CaseStmt>(Label)) { 2403daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek Out << "\\lcase "; 2404e4f2142d00fa5fdb580c4e2413da91882d955381Chris Lattner LangOptions LO; // FIXME. 2405e4f2142d00fa5fdb580c4e2413da91882d955381Chris Lattner C->getLHS()->printPretty(Out, 0, PrintingPolicy(LO)); 24061eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 24079c378f705405d37f49795d5e915989de774fe11fTed Kremenek if (const Stmt *RHS = C->getRHS()) { 2408daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek Out << " .. "; 2409e4f2142d00fa5fdb580c4e2413da91882d955381Chris Lattner RHS->printPretty(Out, 0, PrintingPolicy(LO)); 2410daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek } 24111eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 2412daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek Out << ":"; 2413daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek } 2414daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek else { 2415daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek assert (isa<DefaultStmt>(Label)); 2416daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek Out << "\\ldefault:"; 2417daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek } 2418daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek } 24191eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump else 2420daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek Out << "\\l(implicit) default:"; 2421daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek } 2422daeb9a7376830d637e02b5bc51faf4750a7bce70Ted Kremenek else if (isa<IndirectGotoStmt>(T)) { 2423b38911f16b4943548db6a3695fc6ae23070b25d2Ted Kremenek // FIXME 2424b38911f16b4943548db6a3695fc6ae23070b25d2Ted Kremenek } 2425b38911f16b4943548db6a3695fc6ae23070b25d2Ted Kremenek else { 2426b38911f16b4943548db6a3695fc6ae23070b25d2Ted Kremenek Out << "\\lCondition: "; 2427b38911f16b4943548db6a3695fc6ae23070b25d2Ted Kremenek if (*E.getSrc()->succ_begin() == E.getDst()) 2428b38911f16b4943548db6a3695fc6ae23070b25d2Ted Kremenek Out << "true"; 2429b38911f16b4943548db6a3695fc6ae23070b25d2Ted Kremenek else 24301eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump Out << "false"; 2431b38911f16b4943548db6a3695fc6ae23070b25d2Ted Kremenek } 24321eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 2433b38911f16b4943548db6a3695fc6ae23070b25d2Ted Kremenek Out << "\\l"; 2434b38911f16b4943548db6a3695fc6ae23070b25d2Ted Kremenek } 24351eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 243610f51e8785e43d5a22acc2d2a638307c582949c2Ted Kremenek#if 0 243710f51e8785e43d5a22acc2d2a638307c582949c2Ted Kremenek // FIXME: Replace with a general scheme to determine 243810f51e8785e43d5a22acc2d2a638307c582949c2Ted Kremenek // the name of the check. 24394a4e524afef40d6f3ddb25d0e407c814e4ca56a8Ted Kremenek if (GraphPrintCheckerState->isUndefControlFlow(N)) { 24404a4e524afef40d6f3ddb25d0e407c814e4ca56a8Ted Kremenek Out << "\\|Control-flow based on\\lUndefined value.\\l"; 24413b4f6702860208692f6ef28401e68de4e3ff9af9Ted Kremenek } 244210f51e8785e43d5a22acc2d2a638307c582949c2Ted Kremenek#endif 24431aa4f5019164592643bf46b7d61f15b6ef509c8eJordan Rose break; 24441aa4f5019164592643bf46b7d61f15b6ef509c8eJordan Rose } 24451aa4f5019164592643bf46b7d61f15b6ef509c8eJordan Rose 24461aa4f5019164592643bf46b7d61f15b6ef509c8eJordan Rose default: { 24471aa4f5019164592643bf46b7d61f15b6ef509c8eJordan Rose const Stmt *S = Loc.castAs<StmtPoint>().getStmt(); 24481aa4f5019164592643bf46b7d61f15b6ef509c8eJordan Rose 24491aa4f5019164592643bf46b7d61f15b6ef509c8eJordan Rose Out << S->getStmtClassName() << ' ' << (const void*) S << ' '; 24501aa4f5019164592643bf46b7d61f15b6ef509c8eJordan Rose LangOptions LO; // FIXME. 24511aa4f5019164592643bf46b7d61f15b6ef509c8eJordan Rose S->printPretty(Out, 0, PrintingPolicy(LO)); 24521aa4f5019164592643bf46b7d61f15b6ef509c8eJordan Rose printLocation(Out, S->getLocStart()); 24531aa4f5019164592643bf46b7d61f15b6ef509c8eJordan Rose 24541aa4f5019164592643bf46b7d61f15b6ef509c8eJordan Rose if (Loc.getAs<PreStmt>()) 24551aa4f5019164592643bf46b7d61f15b6ef509c8eJordan Rose Out << "\\lPreStmt\\l;"; 24561aa4f5019164592643bf46b7d61f15b6ef509c8eJordan Rose else if (Loc.getAs<PostLoad>()) 24571aa4f5019164592643bf46b7d61f15b6ef509c8eJordan Rose Out << "\\lPostLoad\\l;"; 24581aa4f5019164592643bf46b7d61f15b6ef509c8eJordan Rose else if (Loc.getAs<PostStore>()) 24591aa4f5019164592643bf46b7d61f15b6ef509c8eJordan Rose Out << "\\lPostStore\\l"; 24601aa4f5019164592643bf46b7d61f15b6ef509c8eJordan Rose else if (Loc.getAs<PostLValue>()) 24611aa4f5019164592643bf46b7d61f15b6ef509c8eJordan Rose Out << "\\lPostLValue\\l"; 24621aa4f5019164592643bf46b7d61f15b6ef509c8eJordan Rose 24631aa4f5019164592643bf46b7d61f15b6ef509c8eJordan Rose#if 0 24641aa4f5019164592643bf46b7d61f15b6ef509c8eJordan Rose // FIXME: Replace with a general scheme to determine 24651aa4f5019164592643bf46b7d61f15b6ef509c8eJordan Rose // the name of the check. 24661aa4f5019164592643bf46b7d61f15b6ef509c8eJordan Rose if (GraphPrintCheckerState->isImplicitNullDeref(N)) 24671aa4f5019164592643bf46b7d61f15b6ef509c8eJordan Rose Out << "\\|Implicit-Null Dereference.\\l"; 24681aa4f5019164592643bf46b7d61f15b6ef509c8eJordan Rose else if (GraphPrintCheckerState->isExplicitNullDeref(N)) 24691aa4f5019164592643bf46b7d61f15b6ef509c8eJordan Rose Out << "\\|Explicit-Null Dereference.\\l"; 24701aa4f5019164592643bf46b7d61f15b6ef509c8eJordan Rose else if (GraphPrintCheckerState->isUndefDeref(N)) 24711aa4f5019164592643bf46b7d61f15b6ef509c8eJordan Rose Out << "\\|Dereference of undefialied value.\\l"; 24721aa4f5019164592643bf46b7d61f15b6ef509c8eJordan Rose else if (GraphPrintCheckerState->isUndefStore(N)) 24731aa4f5019164592643bf46b7d61f15b6ef509c8eJordan Rose Out << "\\|Store to Undefined Loc."; 24741aa4f5019164592643bf46b7d61f15b6ef509c8eJordan Rose else if (GraphPrintCheckerState->isUndefResult(N)) 24751aa4f5019164592643bf46b7d61f15b6ef509c8eJordan Rose Out << "\\|Result of operation is undefined."; 24761aa4f5019164592643bf46b7d61f15b6ef509c8eJordan Rose else if (GraphPrintCheckerState->isNoReturnCall(N)) 24771aa4f5019164592643bf46b7d61f15b6ef509c8eJordan Rose Out << "\\|Call to function marked \"noreturn\"."; 24781aa4f5019164592643bf46b7d61f15b6ef509c8eJordan Rose else if (GraphPrintCheckerState->isBadCall(N)) 24791aa4f5019164592643bf46b7d61f15b6ef509c8eJordan Rose Out << "\\|Call to NULL/Undefined."; 24801aa4f5019164592643bf46b7d61f15b6ef509c8eJordan Rose else if (GraphPrintCheckerState->isUndefArg(N)) 24811aa4f5019164592643bf46b7d61f15b6ef509c8eJordan Rose Out << "\\|Argument in call is undefined"; 24821aa4f5019164592643bf46b7d61f15b6ef509c8eJordan Rose#endif 24831aa4f5019164592643bf46b7d61f15b6ef509c8eJordan Rose 24841aa4f5019164592643bf46b7d61f15b6ef509c8eJordan Rose break; 2485aa66a32ba177338763cd0cf9df8310dfa2e24ff7Ted Kremenek } 2486aa66a32ba177338763cd0cf9df8310dfa2e24ff7Ted Kremenek } 24871eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 24888bef8238181a30e52dea380789a7e2d760eac532Ted Kremenek ProgramStateRef state = N->getState(); 248931ba6135375433b617a8587ea6cc836a014ebd86Roman Divacky Out << "\\|StateID: " << (const void*) state.getPtr() 249031ba6135375433b617a8587ea6cc836a014ebd86Roman Divacky << " NodeID: " << (const void*) N << "\\|"; 24915eca482fe895ea57bc82410222e6426c09e63284Ted Kremenek state->printDOT(Out); 2492ca804539d908d3a0e8c72a0df5f1f571d29490bbTed Kremenek 2493ca804539d908d3a0e8c72a0df5f1f571d29490bbTed Kremenek Out << "\\l"; 2494ca804539d908d3a0e8c72a0df5f1f571d29490bbTed Kremenek 2495ca804539d908d3a0e8c72a0df5f1f571d29490bbTed Kremenek if (const ProgramPointTag *tag = Loc.getTag()) { 2496ca804539d908d3a0e8c72a0df5f1f571d29490bbTed Kremenek Out << "\\|Tag: " << tag->getTagDescription(); 2497ca804539d908d3a0e8c72a0df5f1f571d29490bbTed Kremenek Out << "\\l"; 2498ca804539d908d3a0e8c72a0df5f1f571d29490bbTed Kremenek } 2499aa66a32ba177338763cd0cf9df8310dfa2e24ff7Ted Kremenek return Out.str(); 2500aa66a32ba177338763cd0cf9df8310dfa2e24ff7Ted Kremenek } 2501aa66a32ba177338763cd0cf9df8310dfa2e24ff7Ted Kremenek}; 25021eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump} // end llvm namespace 2503aa66a32ba177338763cd0cf9df8310dfa2e24ff7Ted Kremenek#endif 2504aa66a32ba177338763cd0cf9df8310dfa2e24ff7Ted Kremenek 2505ffe0f43806d4823271c2406c1fccc2373115c36aTed Kremenek#ifndef NDEBUG 25067ec07fd91f6eae8bd619ebb8512805222ca41c92Ted Kremenektemplate <typename ITERATOR> 25079c378f705405d37f49795d5e915989de774fe11fTed KremenekExplodedNode *GetGraphNode(ITERATOR I) { return *I; } 25087ec07fd91f6eae8bd619ebb8512805222ca41c92Ted Kremenek 2509031ccc0555a82afc2e8afe29e19dd57ff204e2deZhongxing Xutemplate <> ExplodedNode* 2510031ccc0555a82afc2e8afe29e19dd57ff204e2deZhongxing XuGetGraphNode<llvm::DenseMap<ExplodedNode*, Expr*>::iterator> 2511031ccc0555a82afc2e8afe29e19dd57ff204e2deZhongxing Xu (llvm::DenseMap<ExplodedNode*, Expr*>::iterator I) { 25127ec07fd91f6eae8bd619ebb8512805222ca41c92Ted Kremenek return I->first; 25137ec07fd91f6eae8bd619ebb8512805222ca41c92Ted Kremenek} 2514ffe0f43806d4823271c2406c1fccc2373115c36aTed Kremenek#endif 2515ffe0f43806d4823271c2406c1fccc2373115c36aTed Kremenek 2516d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidisvoid ExprEngine::ViewGraph(bool trim) { 25171eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump#ifndef NDEBUG 2518ffe0f43806d4823271c2406c1fccc2373115c36aTed Kremenek if (trim) { 2519c9963132736782d0c9178c744b3e2307cfb98a08Jordan Rose std::vector<const ExplodedNode*> Src; 2520940abcc574580e454689be801f38a3d4d41ab01fTed Kremenek 2521940abcc574580e454689be801f38a3d4d41ab01fTed Kremenek // Flush any outstanding reports to make sure we cover all the nodes. 2522940abcc574580e454689be801f38a3d4d41ab01fTed Kremenek // This does not cause them to get displayed. 2523940abcc574580e454689be801f38a3d4d41ab01fTed Kremenek for (BugReporter::iterator I=BR.begin(), E=BR.end(); I!=E; ++I) 2524940abcc574580e454689be801f38a3d4d41ab01fTed Kremenek const_cast<BugType*>(*I)->FlushReports(BR); 2525940abcc574580e454689be801f38a3d4d41ab01fTed Kremenek 2526940abcc574580e454689be801f38a3d4d41ab01fTed Kremenek // Iterate through the reports and get their nodes. 2527404fc3ad6bd844bf8ce70cbf9974ab297704a122Argyrios Kyrtzidis for (BugReporter::EQClasses_iterator 2528404fc3ad6bd844bf8ce70cbf9974ab297704a122Argyrios Kyrtzidis EI = BR.EQClasses_begin(), EE = BR.EQClasses_end(); EI != EE; ++EI) { 25294a5f724538cbc275370c9504e8169ce92503256cBenjamin Kramer ExplodedNode *N = const_cast<ExplodedNode*>(EI->begin()->getErrorNode()); 2530404fc3ad6bd844bf8ce70cbf9974ab297704a122Argyrios Kyrtzidis if (N) Src.push_back(N); 2531940abcc574580e454689be801f38a3d4d41ab01fTed Kremenek } 25321eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 2533c9963132736782d0c9178c744b3e2307cfb98a08Jordan Rose ViewGraph(Src); 2534ffe0f43806d4823271c2406c1fccc2373115c36aTed Kremenek } 2535493d7a26d5ea319770ba904b43f2740d43b820cbTed Kremenek else { 2536493d7a26d5ea319770ba904b43f2740d43b820cbTed Kremenek GraphPrintCheckerState = this; 2537493d7a26d5ea319770ba904b43f2740d43b820cbTed Kremenek GraphPrintSourceManager = &getContext().getSourceManager(); 2538ae6814efb6c41bd0c0f6413d25097105284d5be7Ted Kremenek 2539d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidis llvm::ViewGraph(*G.roots_begin(), "ExprEngine"); 25401eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 2541493d7a26d5ea319770ba904b43f2740d43b820cbTed Kremenek GraphPrintCheckerState = NULL; 2542493d7a26d5ea319770ba904b43f2740d43b820cbTed Kremenek GraphPrintSourceManager = NULL; 2543493d7a26d5ea319770ba904b43f2740d43b820cbTed Kremenek } 2544493d7a26d5ea319770ba904b43f2740d43b820cbTed Kremenek#endif 2545493d7a26d5ea319770ba904b43f2740d43b820cbTed Kremenek} 2546493d7a26d5ea319770ba904b43f2740d43b820cbTed Kremenek 2547c9963132736782d0c9178c744b3e2307cfb98a08Jordan Rosevoid ExprEngine::ViewGraph(ArrayRef<const ExplodedNode*> Nodes) { 2548493d7a26d5ea319770ba904b43f2740d43b820cbTed Kremenek#ifndef NDEBUG 2549493d7a26d5ea319770ba904b43f2740d43b820cbTed Kremenek GraphPrintCheckerState = this; 2550493d7a26d5ea319770ba904b43f2740d43b820cbTed Kremenek GraphPrintSourceManager = &getContext().getSourceManager(); 25511eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 2552651f13cea278ec967336033dd032faef0e9fc2ecStephen Hines std::unique_ptr<ExplodedGraph> TrimmedG(G.trim(Nodes)); 2553493d7a26d5ea319770ba904b43f2740d43b820cbTed Kremenek 2554cf118d41f7930a18dce97416ef7834a62642f587Ted Kremenek if (!TrimmedG.get()) 25556cb7c1a43b0c8f739d1f54b7fdae5ede86033496Benjamin Kramer llvm::errs() << "warning: Trimmed ExplodedGraph is empty.\n"; 2556cf118d41f7930a18dce97416ef7834a62642f587Ted Kremenek else 2557d2592a34a059e7cbb2b11dc53649ac4912422909Argyrios Kyrtzidis llvm::ViewGraph(*TrimmedG->roots_begin(), "TrimmedExprEngine"); 25581eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 25593b4f6702860208692f6ef28401e68de4e3ff9af9Ted Kremenek GraphPrintCheckerState = NULL; 2560e97ca065c91ff9ca2a2a42eb443eaa553c40441cTed Kremenek GraphPrintSourceManager = NULL; 2561e01c98767dfd7153c3c84637c36659e3bbe16ff7Ted Kremenek#endif 2562ee98546b0d5f3439c4a590b0d7d1545af794a0ecTed Kremenek} 2563