ExprEngineCXX.cpp revision 4f69eb4daa3c5ce8b88535fc560f2ee102a580f4 
1//===- ExprEngineCXX.cpp - ExprEngine support for C++ -----------*- C++ -*-===//
2//
3//                     The LLVM Compiler Infrastructure
4//
5// This file is distributed under the University of Illinois Open Source
6// License. See LICENSE.TXT for details.
7//
8//===----------------------------------------------------------------------===//
9//
10//  This file defines the C++ expression evaluation engine.
11//
12//===----------------------------------------------------------------------===//
13
14#include "clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h"
15#include "clang/AST/DeclCXX.h"
16#include "clang/AST/StmtCXX.h"
17#include "clang/Basic/PrettyStackTrace.h"
18#include "clang/StaticAnalyzer/Core/CheckerManager.h"
19#include "clang/StaticAnalyzer/Core/PathSensitive/AnalysisManager.h"
20#include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
21
22using namespace clang;
23using namespace ento;
24
25void ExprEngine::CreateCXXTemporaryObject(const MaterializeTemporaryExpr *ME,
26                                          ExplodedNode *Pred,
27                                          ExplodedNodeSet &Dst) {
28  StmtNodeBuilder Bldr(Pred, Dst, *currBldrCtx);
29  const Expr *tempExpr = ME->GetTemporaryExpr()->IgnoreParens();
30  ProgramStateRef state = Pred->getState();
31  const LocationContext *LCtx = Pred->getLocationContext();
32
33  // Bind the temporary object to the value of the expression. Then bind
34  // the expression to the location of the object.
35  SVal V = state->getSVal(tempExpr, LCtx);
36
37  // If the value is already a CXXTempObjectRegion, it is fine as it is.
38  // Otherwise, create a new CXXTempObjectRegion, and copy the value into it.
39  const MemRegion *MR = V.getAsRegion();
40  if (!MR || !isa<CXXTempObjectRegion>(MR)) {
41    const MemRegion *R =
42      svalBuilder.getRegionManager().getCXXTempObjectRegion(ME, LCtx);
43
44    SVal L = loc::MemRegionVal(R);
45    state = state->bindLoc(L, V);
46    V = L;
47  }
48
49  Bldr.generateNode(ME, Pred, state->BindExpr(ME, LCtx, V));
50}
51
52void ExprEngine::VisitCXXConstructExpr(const CXXConstructExpr *CE,
53                                       ExplodedNode *Pred,
54                                       ExplodedNodeSet &destNodes) {
55  const LocationContext *LCtx = Pred->getLocationContext();
56  ProgramStateRef State = Pred->getState();
57
58  const MemRegion *Target = 0;
59
60  switch (CE->getConstructionKind()) {
61  case CXXConstructExpr::CK_Complete: {
62    // See if we're constructing an existing region by looking at the next
63    // element in the CFG.
64    const CFGBlock *B = currBldrCtx->getBlock();
65    if (currStmtIdx + 1 < B->size()) {
66      CFGElement Next = (*B)[currStmtIdx+1];
67
68      // Is this a constructor for a local variable?
69      if (const CFGStmt *StmtElem = dyn_cast<CFGStmt>(&Next)) {
70        if (const DeclStmt *DS = dyn_cast<DeclStmt>(StmtElem->getStmt())) {
71          if (const VarDecl *Var = dyn_cast<VarDecl>(DS->getSingleDecl())) {
72            if (Var->getInit()->IgnoreImplicit() == CE) {
73              QualType Ty = Var->getType();
74              if (const ArrayType *AT = getContext().getAsArrayType(Ty)) {
75                // FIXME: Handle arrays, which run the same constructor for
76                // every element. This workaround will just run the first
77                // constructor (which should still invalidate the entire array).
78                SVal Base = State->getLValue(Var, LCtx);
79                Target = State->getLValue(AT->getElementType(),
80                                          getSValBuilder().makeZeroArrayIndex(),
81                                          Base).getAsRegion();
82              } else {
83                Target = State->getLValue(Var, LCtx).getAsRegion();
84              }
85            }
86          }
87        }
88      }
89
90      // Is this a constructor for a member?
91      if (const CFGInitializer *InitElem = dyn_cast<CFGInitializer>(&Next)) {
92        const CXXCtorInitializer *Init = InitElem->getInitializer();
93        assert(Init->isAnyMemberInitializer());
94
95        const CXXMethodDecl *CurCtor = cast<CXXMethodDecl>(LCtx->getDecl());
96        Loc ThisPtr = getSValBuilder().getCXXThis(CurCtor,
97                                                  LCtx->getCurrentStackFrame());
98        SVal ThisVal = State->getSVal(ThisPtr);
99
100        if (Init->isIndirectMemberInitializer()) {
101          SVal Field = State->getLValue(Init->getIndirectMember(), ThisVal);
102          Target = Field.getAsRegion();
103        } else {
104          SVal Field = State->getLValue(Init->getMember(), ThisVal);
105          Target = Field.getAsRegion();
106        }
107      }
108
109      // FIXME: This will eventually need to handle new-expressions as well.
110    }
111
112    // If we couldn't find an existing region to construct into, assume we're
113    // constructing a temporary.
114    if (!Target) {
115      MemRegionManager &MRMgr = getSValBuilder().getRegionManager();
116      Target = MRMgr.getCXXTempObjectRegion(CE, LCtx);
117    }
118
119    break;
120  }
121  case CXXConstructExpr::CK_NonVirtualBase:
122  case CXXConstructExpr::CK_VirtualBase:
123  case CXXConstructExpr::CK_Delegating: {
124    const CXXMethodDecl *CurCtor = cast<CXXMethodDecl>(LCtx->getDecl());
125    Loc ThisPtr = getSValBuilder().getCXXThis(CurCtor,
126                                              LCtx->getCurrentStackFrame());
127    SVal ThisVal = State->getSVal(ThisPtr);
128
129    if (CE->getConstructionKind() == CXXConstructExpr::CK_Delegating) {
130      Target = ThisVal.getAsRegion();
131    } else {
132      // Cast to the base type.
133      QualType BaseTy = CE->getType();
134      SVal BaseVal = getStoreManager().evalDerivedToBase(ThisVal, BaseTy);
135      Target = BaseVal.getAsRegion();
136    }
137    break;
138  }
139  }
140
141  CallEventManager &CEMgr = getStateManager().getCallEventManager();
142  CallEventRef<CXXConstructorCall> Call =
143    CEMgr.getCXXConstructorCall(CE, Target, State, LCtx);
144
145  ExplodedNodeSet DstPreVisit;
146  getCheckerManager().runCheckersForPreStmt(DstPreVisit, Pred, CE, *this);
147  ExplodedNodeSet DstPreCall;
148  getCheckerManager().runCheckersForPreCall(DstPreCall, DstPreVisit,
149                                            *Call, *this);
150
151  ExplodedNodeSet DstInvalidated;
152  StmtNodeBuilder Bldr(DstPreCall, DstInvalidated, *currBldrCtx);
153  for (ExplodedNodeSet::iterator I = DstPreCall.begin(), E = DstPreCall.end();
154       I != E; ++I)
155    defaultEvalCall(Bldr, *I, *Call);
156
157  ExplodedNodeSet DstPostCall;
158  getCheckerManager().runCheckersForPostCall(DstPostCall, DstInvalidated,
159                                             *Call, *this);
160  getCheckerManager().runCheckersForPostStmt(destNodes, DstPostCall, CE, *this);
161}
162
163void ExprEngine::VisitCXXDestructor(QualType ObjectType,
164                                    const MemRegion *Dest,
165                                    const Stmt *S,
166                                    bool IsBaseDtor,
167                                    ExplodedNode *Pred,
168                                    ExplodedNodeSet &Dst) {
169  const LocationContext *LCtx = Pred->getLocationContext();
170  ProgramStateRef State = Pred->getState();
171
172  // FIXME: We need to run the same destructor on every element of the array.
173  // This workaround will just run the first destructor (which will still
174  // invalidate the entire array).
175  // This is a loop because of multidimensional arrays.
176  while (const ArrayType *AT = getContext().getAsArrayType(ObjectType)) {
177    ObjectType = AT->getElementType();
178    Dest = State->getLValue(ObjectType, getSValBuilder().makeZeroArrayIndex(),
179                            loc::MemRegionVal(Dest)).getAsRegion();
180  }
181
182  const CXXRecordDecl *RecordDecl = ObjectType->getAsCXXRecordDecl();
183  assert(RecordDecl && "Only CXXRecordDecls should have destructors");
184  const CXXDestructorDecl *DtorDecl = RecordDecl->getDestructor();
185
186  CallEventManager &CEMgr = getStateManager().getCallEventManager();
187  CallEventRef<CXXDestructorCall> Call =
188    CEMgr.getCXXDestructorCall(DtorDecl, S, Dest, IsBaseDtor, State, LCtx);
189
190  PrettyStackTraceLoc CrashInfo(getContext().getSourceManager(),
191                                Call->getSourceRange().getBegin(),
192                                "Error evaluating destructor");
193
194  ExplodedNodeSet DstPreCall;
195  getCheckerManager().runCheckersForPreCall(DstPreCall, Pred,
196                                            *Call, *this);
197
198  ExplodedNodeSet DstInvalidated;
199  StmtNodeBuilder Bldr(DstPreCall, DstInvalidated, *currBldrCtx);
200  for (ExplodedNodeSet::iterator I = DstPreCall.begin(), E = DstPreCall.end();
201       I != E; ++I)
202    defaultEvalCall(Bldr, *I, *Call);
203
204  ExplodedNodeSet DstPostCall;
205  getCheckerManager().runCheckersForPostCall(Dst, DstInvalidated,
206                                             *Call, *this);
207}
208
209void ExprEngine::VisitCXXNewExpr(const CXXNewExpr *CNE, ExplodedNode *Pred,
210                                   ExplodedNodeSet &Dst) {
211  // FIXME: Much of this should eventually migrate to CXXAllocatorCall.
212  // Also, we need to decide how allocators actually work -- they're not
213  // really part of the CXXNewExpr because they happen BEFORE the
214  // CXXConstructExpr subexpression. See PR12014 for some discussion.
215  StmtNodeBuilder Bldr(Pred, Dst, *currBldrCtx);
216
217  unsigned blockCount = currBldrCtx->blockCount();
218  const LocationContext *LCtx = Pred->getLocationContext();
219  DefinedOrUnknownSVal symVal = svalBuilder.conjureSymbolVal(0, CNE, LCtx,
220                                                             CNE->getType(),
221                                                             blockCount);
222  ProgramStateRef State = Pred->getState();
223
224  CallEventManager &CEMgr = getStateManager().getCallEventManager();
225  CallEventRef<CXXAllocatorCall> Call =
226    CEMgr.getCXXAllocatorCall(CNE, State, LCtx);
227
228  // Invalidate placement args.
229  // FIXME: Once we figure out how we want allocators to work,
230  // we should be using the usual pre-/(default-)eval-/post-call checks here.
231  State = Call->invalidateRegions(blockCount);
232
233  // If we're compiling with exceptions enabled, and this allocation function
234  // is not declared as non-throwing, failures /must/ be signalled by
235  // exceptions, and thus the return value will never be NULL.
236  // C++11 [basic.stc.dynamic.allocation]p3.
237  FunctionDecl *FD = CNE->getOperatorNew();
238  if (FD && getContext().getLangOpts().CXXExceptions) {
239    QualType Ty = FD->getType();
240    if (const FunctionProtoType *ProtoType = Ty->getAs<FunctionProtoType>())
241      if (!ProtoType->isNothrow(getContext()))
242        State = State->assume(symVal, true);
243  }
244
245  if (CNE->isArray()) {
246    // FIXME: allocating an array requires simulating the constructors.
247    // For now, just return a symbolicated region.
248    const MemRegion *NewReg = cast<loc::MemRegionVal>(symVal).getRegion();
249    QualType ObjTy = CNE->getType()->getAs<PointerType>()->getPointeeType();
250    const ElementRegion *EleReg =
251      getStoreManager().GetElementZeroRegion(NewReg, ObjTy);
252    State = State->BindExpr(CNE, Pred->getLocationContext(),
253                            loc::MemRegionVal(EleReg));
254    Bldr.generateNode(CNE, Pred, State);
255    return;
256  }
257
258  // FIXME: Once we have proper support for CXXConstructExprs inside
259  // CXXNewExpr, we need to make sure that the constructed object is not
260  // immediately invalidated here. (The placement call should happen before
261  // the constructor call anyway.)
262  if (FD && FD->isReservedGlobalPlacementOperator()) {
263    // Non-array placement new should always return the placement location.
264    SVal PlacementLoc = State->getSVal(CNE->getPlacementArg(0), LCtx);
265    SVal Result = svalBuilder.evalCast(PlacementLoc, CNE->getType(),
266                                       CNE->getPlacementArg(0)->getType());
267    State = State->BindExpr(CNE, LCtx, Result);
268  } else {
269    State = State->BindExpr(CNE, LCtx, symVal);
270  }
271
272  // If the type is not a record, we won't have a CXXConstructExpr as an
273  // initializer. Copy the value over.
274  if (const Expr *Init = CNE->getInitializer()) {
275    if (!isa<CXXConstructExpr>(Init)) {
276      QualType ObjTy = CNE->getType()->getAs<PointerType>()->getPointeeType();
277      (void)ObjTy;
278      assert(!ObjTy->isRecordType());
279      SVal Location = State->getSVal(CNE, LCtx);
280      if (isa<Loc>(Location))
281        State = State->bindLoc(cast<Loc>(Location), State->getSVal(Init, LCtx));
282    }
283  }
284
285  Bldr.generateNode(CNE, Pred, State);
286}
287
288void ExprEngine::VisitCXXDeleteExpr(const CXXDeleteExpr *CDE,
289                                    ExplodedNode *Pred, ExplodedNodeSet &Dst) {
290  StmtNodeBuilder Bldr(Pred, Dst, *currBldrCtx);
291  ProgramStateRef state = Pred->getState();
292  Bldr.generateNode(CDE, Pred, state);
293}
294
295void ExprEngine::VisitCXXCatchStmt(const CXXCatchStmt *CS,
296                                   ExplodedNode *Pred,
297                                   ExplodedNodeSet &Dst) {
298  const VarDecl *VD = CS->getExceptionDecl();
299  if (!VD) {
300    Dst.Add(Pred);
301    return;
302  }
303
304  const LocationContext *LCtx = Pred->getLocationContext();
305  SVal V = svalBuilder.conjureSymbolVal(CS, LCtx, VD->getType(),
306                                        currBldrCtx->blockCount());
307  ProgramStateRef state = Pred->getState();
308  state = state->bindLoc(state->getLValue(VD, LCtx), V);
309
310  StmtNodeBuilder Bldr(Pred, Dst, *currBldrCtx);
311  Bldr.generateNode(CS, Pred, state);
312}
313
314void ExprEngine::VisitCXXThisExpr(const CXXThisExpr *TE, ExplodedNode *Pred,
315                                    ExplodedNodeSet &Dst) {
316  StmtNodeBuilder Bldr(Pred, Dst, *currBldrCtx);
317
318  // Get the this object region from StoreManager.
319  const LocationContext *LCtx = Pred->getLocationContext();
320  const MemRegion *R =
321    svalBuilder.getRegionManager().getCXXThisRegion(
322                                  getContext().getCanonicalType(TE->getType()),
323                                                    LCtx);
324
325  ProgramStateRef state = Pred->getState();
326  SVal V = state->getSVal(loc::MemRegionVal(R));
327  Bldr.generateNode(TE, Pred, state->BindExpr(TE, LCtx, V));
328}
329