ExprEngineCXX.cpp revision 2a3fe34b4a2a1b6ceab8838b896435378ae0e692
1//===- ExprEngineCXX.cpp - ExprEngine support for C++ -----------*- C++ -*-===// 2// 3// The LLVM Compiler Infrastructure 4// 5// This file is distributed under the University of Illinois Open Source 6// License. See LICENSE.TXT for details. 7// 8//===----------------------------------------------------------------------===// 9// 10// This file defines the C++ expression evaluation engine. 11// 12//===----------------------------------------------------------------------===// 13 14#include "clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h" 15#include "clang/AST/DeclCXX.h" 16#include "clang/AST/StmtCXX.h" 17#include "clang/Basic/PrettyStackTrace.h" 18#include "clang/StaticAnalyzer/Core/CheckerManager.h" 19#include "clang/StaticAnalyzer/Core/PathSensitive/AnalysisManager.h" 20#include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h" 21 22using namespace clang; 23using namespace ento; 24 25void ExprEngine::CreateCXXTemporaryObject(const MaterializeTemporaryExpr *ME, 26 ExplodedNode *Pred, 27 ExplodedNodeSet &Dst) { 28 StmtNodeBuilder Bldr(Pred, Dst, *currBldrCtx); 29 const Expr *tempExpr = ME->GetTemporaryExpr()->IgnoreParens(); 30 ProgramStateRef state = Pred->getState(); 31 const LocationContext *LCtx = Pred->getLocationContext(); 32 33 // Bind the temporary object to the value of the expression. Then bind 34 // the expression to the location of the object. 35 SVal V = state->getSVal(tempExpr, LCtx); 36 37 // If the value is already a CXXTempObjectRegion, it is fine as it is. 38 // Otherwise, create a new CXXTempObjectRegion, and copy the value into it. 39 const MemRegion *MR = V.getAsRegion(); 40 if (!MR || !isa<CXXTempObjectRegion>(MR)) { 41 const MemRegion *R = 42 svalBuilder.getRegionManager().getCXXTempObjectRegion(ME, LCtx); 43 44 SVal L = loc::MemRegionVal(R); 45 state = state->bindLoc(L, V); 46 V = L; 47 } 48 49 Bldr.generateNode(ME, Pred, state->BindExpr(ME, LCtx, V)); 50} 51 52void ExprEngine::VisitCXXConstructExpr(const CXXConstructExpr *CE, 53 ExplodedNode *Pred, 54 ExplodedNodeSet &destNodes) { 55 const LocationContext *LCtx = Pred->getLocationContext(); 56 ProgramStateRef State = Pred->getState(); 57 58 const MemRegion *Target = 0; 59 60 switch (CE->getConstructionKind()) { 61 case CXXConstructExpr::CK_Complete: { 62 // See if we're constructing an existing region by looking at the next 63 // element in the CFG. 64 const CFGBlock *B = currBldrCtx->getBlock(); 65 if (currStmtIdx + 1 < B->size()) { 66 CFGElement Next = (*B)[currStmtIdx+1]; 67 68 // Is this a constructor for a local variable? 69 if (const CFGStmt *StmtElem = dyn_cast<CFGStmt>(&Next)) { 70 if (const DeclStmt *DS = dyn_cast<DeclStmt>(StmtElem->getStmt())) { 71 if (const VarDecl *Var = dyn_cast<VarDecl>(DS->getSingleDecl())) { 72 if (Var->getInit()->IgnoreImplicit() == CE) { 73 QualType Ty = Var->getType(); 74 if (const ArrayType *AT = getContext().getAsArrayType(Ty)) { 75 // FIXME: Handle arrays, which run the same constructor for 76 // every element. This workaround will just run the first 77 // constructor (which should still invalidate the entire array). 78 SVal Base = State->getLValue(Var, LCtx); 79 Target = State->getLValue(AT->getElementType(), 80 getSValBuilder().makeZeroArrayIndex(), 81 Base).getAsRegion(); 82 } else { 83 Target = State->getLValue(Var, LCtx).getAsRegion(); 84 } 85 } 86 } 87 } 88 } 89 90 // Is this a constructor for a member? 91 if (const CFGInitializer *InitElem = dyn_cast<CFGInitializer>(&Next)) { 92 const CXXCtorInitializer *Init = InitElem->getInitializer(); 93 assert(Init->isAnyMemberInitializer()); 94 95 const CXXMethodDecl *CurCtor = cast<CXXMethodDecl>(LCtx->getDecl()); 96 Loc ThisPtr = getSValBuilder().getCXXThis(CurCtor, 97 LCtx->getCurrentStackFrame()); 98 SVal ThisVal = State->getSVal(ThisPtr); 99 100 if (Init->isIndirectMemberInitializer()) { 101 SVal Field = State->getLValue(Init->getIndirectMember(), ThisVal); 102 Target = Field.getAsRegion(); 103 } else { 104 SVal Field = State->getLValue(Init->getMember(), ThisVal); 105 Target = Field.getAsRegion(); 106 } 107 } 108 109 // FIXME: This will eventually need to handle new-expressions as well. 110 } 111 112 // If we couldn't find an existing region to construct into, assume we're 113 // constructing a temporary. 114 if (!Target) { 115 MemRegionManager &MRMgr = getSValBuilder().getRegionManager(); 116 Target = MRMgr.getCXXTempObjectRegion(CE, LCtx); 117 } 118 119 break; 120 } 121 case CXXConstructExpr::CK_NonVirtualBase: 122 case CXXConstructExpr::CK_VirtualBase: 123 case CXXConstructExpr::CK_Delegating: { 124 const CXXMethodDecl *CurCtor = cast<CXXMethodDecl>(LCtx->getDecl()); 125 Loc ThisPtr = getSValBuilder().getCXXThis(CurCtor, 126 LCtx->getCurrentStackFrame()); 127 SVal ThisVal = State->getSVal(ThisPtr); 128 129 if (CE->getConstructionKind() == CXXConstructExpr::CK_Delegating) { 130 Target = ThisVal.getAsRegion(); 131 } else { 132 // Cast to the base type. 133 QualType BaseTy = CE->getType(); 134 SVal BaseVal = getStoreManager().evalDerivedToBase(ThisVal, BaseTy); 135 Target = BaseVal.getAsRegion(); 136 } 137 break; 138 } 139 } 140 141 CallEventManager &CEMgr = getStateManager().getCallEventManager(); 142 CallEventRef<CXXConstructorCall> Call = 143 CEMgr.getCXXConstructorCall(CE, Target, State, LCtx); 144 145 ExplodedNodeSet DstPreVisit; 146 getCheckerManager().runCheckersForPreStmt(DstPreVisit, Pred, CE, *this); 147 ExplodedNodeSet DstPreCall; 148 getCheckerManager().runCheckersForPreCall(DstPreCall, DstPreVisit, 149 *Call, *this); 150 151 ExplodedNodeSet DstInvalidated; 152 StmtNodeBuilder Bldr(DstPreCall, DstInvalidated, *currBldrCtx); 153 for (ExplodedNodeSet::iterator I = DstPreCall.begin(), E = DstPreCall.end(); 154 I != E; ++I) 155 defaultEvalCall(Bldr, *I, *Call); 156 157 ExplodedNodeSet DstPostCall; 158 getCheckerManager().runCheckersForPostCall(DstPostCall, DstInvalidated, 159 *Call, *this); 160 getCheckerManager().runCheckersForPostStmt(destNodes, DstPostCall, CE, *this); 161} 162 163void ExprEngine::VisitCXXDestructor(QualType ObjectType, 164 const MemRegion *Dest, 165 const Stmt *S, 166 bool IsBaseDtor, 167 ExplodedNode *Pred, 168 ExplodedNodeSet &Dst) { 169 const LocationContext *LCtx = Pred->getLocationContext(); 170 ProgramStateRef State = Pred->getState(); 171 172 // FIXME: We need to run the same destructor on every element of the array. 173 // This workaround will just run the first destructor (which will still 174 // invalidate the entire array). 175 // This is a loop because of multidimensional arrays. 176 while (const ArrayType *AT = getContext().getAsArrayType(ObjectType)) { 177 ObjectType = AT->getElementType(); 178 Dest = State->getLValue(ObjectType, getSValBuilder().makeZeroArrayIndex(), 179 loc::MemRegionVal(Dest)).getAsRegion(); 180 } 181 182 const CXXRecordDecl *RecordDecl = ObjectType->getAsCXXRecordDecl(); 183 assert(RecordDecl && "Only CXXRecordDecls should have destructors"); 184 const CXXDestructorDecl *DtorDecl = RecordDecl->getDestructor(); 185 186 CallEventManager &CEMgr = getStateManager().getCallEventManager(); 187 CallEventRef<CXXDestructorCall> Call = 188 CEMgr.getCXXDestructorCall(DtorDecl, S, Dest, IsBaseDtor, State, LCtx); 189 190 PrettyStackTraceLoc CrashInfo(getContext().getSourceManager(), 191 Call->getSourceRange().getBegin(), 192 "Error evaluating destructor"); 193 194 ExplodedNodeSet DstPreCall; 195 getCheckerManager().runCheckersForPreCall(DstPreCall, Pred, 196 *Call, *this); 197 198 ExplodedNodeSet DstInvalidated; 199 StmtNodeBuilder Bldr(DstPreCall, DstInvalidated, *currBldrCtx); 200 for (ExplodedNodeSet::iterator I = DstPreCall.begin(), E = DstPreCall.end(); 201 I != E; ++I) 202 defaultEvalCall(Bldr, *I, *Call); 203 204 ExplodedNodeSet DstPostCall; 205 getCheckerManager().runCheckersForPostCall(Dst, DstInvalidated, 206 *Call, *this); 207} 208 209void ExprEngine::VisitCXXNewExpr(const CXXNewExpr *CNE, ExplodedNode *Pred, 210 ExplodedNodeSet &Dst) { 211 // FIXME: Much of this should eventually migrate to CXXAllocatorCall. 212 // Also, we need to decide how allocators actually work -- they're not 213 // really part of the CXXNewExpr because they happen BEFORE the 214 // CXXConstructExpr subexpression. See PR12014 for some discussion. 215 StmtNodeBuilder Bldr(Pred, Dst, *currBldrCtx); 216 217 unsigned blockCount = currBldrCtx->blockCount(); 218 const LocationContext *LCtx = Pred->getLocationContext(); 219 DefinedOrUnknownSVal symVal = svalBuilder.conjureSymbolVal(0, CNE, LCtx, 220 CNE->getType(), 221 blockCount); 222 ProgramStateRef State = Pred->getState(); 223 224 CallEventManager &CEMgr = getStateManager().getCallEventManager(); 225 CallEventRef<CXXAllocatorCall> Call = 226 CEMgr.getCXXAllocatorCall(CNE, State, LCtx); 227 228 // Invalidate placement args. 229 // FIXME: Once we figure out how we want allocators to work, 230 // we should be using the usual pre-/(default-)eval-/post-call checks here. 231 State = Call->invalidateRegions(blockCount); 232 233 // If we're compiling with exceptions enabled, and this allocation function 234 // is not declared as non-throwing, failures /must/ be signalled by 235 // exceptions, and thus the return value will never be NULL. 236 // C++11 [basic.stc.dynamic.allocation]p3. 237 FunctionDecl *FD = CNE->getOperatorNew(); 238 if (FD && getContext().getLangOpts().CXXExceptions) { 239 QualType Ty = FD->getType(); 240 if (const FunctionProtoType *ProtoType = Ty->getAs<FunctionProtoType>()) 241 if (!ProtoType->isNothrow(getContext())) 242 State = State->assume(symVal, true); 243 } 244 245 if (CNE->isArray()) { 246 // FIXME: allocating an array requires simulating the constructors. 247 // For now, just return a symbolicated region. 248 const MemRegion *NewReg = cast<loc::MemRegionVal>(symVal).getRegion(); 249 QualType ObjTy = CNE->getType()->getAs<PointerType>()->getPointeeType(); 250 const ElementRegion *EleReg = 251 getStoreManager().GetElementZeroRegion(NewReg, ObjTy); 252 State = State->BindExpr(CNE, Pred->getLocationContext(), 253 loc::MemRegionVal(EleReg)); 254 Bldr.generateNode(CNE, Pred, State); 255 return; 256 } 257 258 // FIXME: Once we have proper support for CXXConstructExprs inside 259 // CXXNewExpr, we need to make sure that the constructed object is not 260 // immediately invalidated here. (The placement call should happen before 261 // the constructor call anyway.) 262 if (FD && FD->isReservedGlobalPlacementOperator()) { 263 // Non-array placement new should always return the placement location. 264 SVal PlacementLoc = State->getSVal(CNE->getPlacementArg(0), LCtx); 265 SVal Result = svalBuilder.evalCast(PlacementLoc, CNE->getType(), 266 CNE->getPlacementArg(0)->getType()); 267 State = State->BindExpr(CNE, LCtx, Result); 268 } else { 269 State = State->BindExpr(CNE, LCtx, symVal); 270 } 271 272 // If the type is not a record, we won't have a CXXConstructExpr as an 273 // initializer. Copy the value over. 274 if (const Expr *Init = CNE->getInitializer()) { 275 if (!isa<CXXConstructExpr>(Init)) { 276 QualType ObjTy = CNE->getType()->getAs<PointerType>()->getPointeeType(); 277 (void)ObjTy; 278 assert(!ObjTy->isRecordType()); 279 SVal Location = State->getSVal(CNE, LCtx); 280 if (isa<Loc>(Location)) 281 State = State->bindLoc(cast<Loc>(Location), State->getSVal(Init, LCtx)); 282 } 283 } 284 285 Bldr.generateNode(CNE, Pred, State); 286} 287 288void ExprEngine::VisitCXXDeleteExpr(const CXXDeleteExpr *CDE, 289 ExplodedNode *Pred, ExplodedNodeSet &Dst) { 290 StmtNodeBuilder Bldr(Pred, Dst, *currBldrCtx); 291 ProgramStateRef state = Pred->getState(); 292 Bldr.generateNode(CDE, Pred, state); 293} 294 295void ExprEngine::VisitCXXCatchStmt(const CXXCatchStmt *CS, 296 ExplodedNode *Pred, 297 ExplodedNodeSet &Dst) { 298 const VarDecl *VD = CS->getExceptionDecl(); 299 if (!VD) { 300 Dst.Add(Pred); 301 return; 302 } 303 304 const LocationContext *LCtx = Pred->getLocationContext(); 305 SVal V = svalBuilder.conjureSymbolVal(CS, LCtx, VD->getType(), 306 currBldrCtx->blockCount()); 307 ProgramStateRef state = Pred->getState(); 308 state = state->bindLoc(state->getLValue(VD, LCtx), V); 309 310 StmtNodeBuilder Bldr(Pred, Dst, *currBldrCtx); 311 Bldr.generateNode(CS, Pred, state); 312} 313 314void ExprEngine::VisitCXXThisExpr(const CXXThisExpr *TE, ExplodedNode *Pred, 315 ExplodedNodeSet &Dst) { 316 StmtNodeBuilder Bldr(Pred, Dst, *currBldrCtx); 317 318 // Get the this object region from StoreManager. 319 const LocationContext *LCtx = Pred->getLocationContext(); 320 const MemRegion *R = 321 svalBuilder.getRegionManager().getCXXThisRegion( 322 getContext().getCanonicalType(TE->getType()), 323 LCtx); 324 325 ProgramStateRef state = Pred->getState(); 326 SVal V = state->getSVal(loc::MemRegionVal(R)); 327 Bldr.generateNode(TE, Pred, state->BindExpr(TE, LCtx, V)); 328} 329