ExprEngineCXX.cpp revision 563ea2335d7d0df44bbfe8941f64523e8af1fc14
1//===- ExprEngineCXX.cpp - ExprEngine support for C++ -----------*- C++ -*-===// 2// 3// The LLVM Compiler Infrastructure 4// 5// This file is distributed under the University of Illinois Open Source 6// License. See LICENSE.TXT for details. 7// 8//===----------------------------------------------------------------------===// 9// 10// This file defines the C++ expression evaluation engine. 11// 12//===----------------------------------------------------------------------===// 13 14#include "clang/StaticAnalyzer/Core/CheckerManager.h" 15#include "clang/StaticAnalyzer/Core/PathSensitive/AnalysisManager.h" 16#include "clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h" 17#include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h" 18#include "clang/AST/DeclCXX.h" 19#include "clang/AST/StmtCXX.h" 20#include "clang/Basic/PrettyStackTrace.h" 21 22using namespace clang; 23using namespace ento; 24 25void ExprEngine::CreateCXXTemporaryObject(const MaterializeTemporaryExpr *ME, 26 ExplodedNode *Pred, 27 ExplodedNodeSet &Dst) { 28 StmtNodeBuilder Bldr(Pred, Dst, *currentBuilderContext); 29 const Expr *tempExpr = ME->GetTemporaryExpr()->IgnoreParens(); 30 ProgramStateRef state = Pred->getState(); 31 const LocationContext *LCtx = Pred->getLocationContext(); 32 33 // Bind the temporary object to the value of the expression. Then bind 34 // the expression to the location of the object. 35 SVal V = state->getSVal(tempExpr, Pred->getLocationContext()); 36 37 const MemRegion *R = 38 svalBuilder.getRegionManager().getCXXTempObjectRegion(ME, LCtx); 39 40 state = state->bindLoc(loc::MemRegionVal(R), V); 41 Bldr.generateNode(ME, Pred, state->BindExpr(ME, LCtx, loc::MemRegionVal(R))); 42} 43 44void ExprEngine::VisitCXXConstructExpr(const CXXConstructExpr *CE, 45 ExplodedNode *Pred, 46 ExplodedNodeSet &destNodes) { 47 const LocationContext *LCtx = Pred->getLocationContext(); 48 ProgramStateRef State = Pred->getState(); 49 50 const MemRegion *Target = 0; 51 52 switch (CE->getConstructionKind()) { 53 case CXXConstructExpr::CK_Complete: { 54 // See if we're constructing an existing region by looking at the next 55 // element in the CFG. 56 const CFGBlock *B = currentBuilderContext->getBlock(); 57 if (currentStmtIdx + 1 < B->size()) { 58 CFGElement Next = (*B)[currentStmtIdx+1]; 59 60 // Is this a constructor for a local variable? 61 if (const CFGStmt *StmtElem = dyn_cast<CFGStmt>(&Next)) { 62 if (const DeclStmt *DS = dyn_cast<DeclStmt>(StmtElem->getStmt())) { 63 if (const VarDecl *Var = dyn_cast<VarDecl>(DS->getSingleDecl())) { 64 if (Var->getInit()->IgnoreImplicit() == CE) { 65 QualType Ty = Var->getType(); 66 if (const ArrayType *AT = getContext().getAsArrayType(Ty)) { 67 // FIXME: Handle arrays, which run the same constructor for 68 // every element. This workaround will just run the first 69 // constructor (which should still invalidate the entire array). 70 SVal Base = State->getLValue(Var, LCtx); 71 Target = State->getLValue(AT->getElementType(), 72 getSValBuilder().makeZeroArrayIndex(), 73 Base).getAsRegion(); 74 } else { 75 Target = State->getLValue(Var, LCtx).getAsRegion(); 76 } 77 } 78 } 79 } 80 } 81 82 // Is this a constructor for a member? 83 if (const CFGInitializer *InitElem = dyn_cast<CFGInitializer>(&Next)) { 84 const CXXCtorInitializer *Init = InitElem->getInitializer(); 85 assert(Init->isAnyMemberInitializer()); 86 87 const CXXMethodDecl *CurCtor = cast<CXXMethodDecl>(LCtx->getDecl()); 88 Loc ThisPtr = getSValBuilder().getCXXThis(CurCtor, 89 LCtx->getCurrentStackFrame()); 90 SVal ThisVal = State->getSVal(ThisPtr); 91 92 if (Init->isIndirectMemberInitializer()) { 93 SVal Field = State->getLValue(Init->getIndirectMember(), ThisVal); 94 Target = Field.getAsRegion(); 95 } else { 96 SVal Field = State->getLValue(Init->getMember(), ThisVal); 97 Target = Field.getAsRegion(); 98 } 99 } 100 101 // FIXME: This will eventually need to handle new-expressions as well. 102 } 103 104 // If we couldn't find an existing region to construct into, we'll just 105 // generate a symbolic region, which is fine. 106 107 break; 108 } 109 case CXXConstructExpr::CK_NonVirtualBase: 110 case CXXConstructExpr::CK_VirtualBase: 111 case CXXConstructExpr::CK_Delegating: { 112 const CXXMethodDecl *CurCtor = cast<CXXMethodDecl>(LCtx->getDecl()); 113 Loc ThisPtr = getSValBuilder().getCXXThis(CurCtor, 114 LCtx->getCurrentStackFrame()); 115 SVal ThisVal = State->getSVal(ThisPtr); 116 117 if (CE->getConstructionKind() == CXXConstructExpr::CK_Delegating) { 118 Target = ThisVal.getAsRegion(); 119 } else { 120 // Cast to the base type. 121 QualType BaseTy = CE->getType(); 122 SVal BaseVal = getStoreManager().evalDerivedToBase(ThisVal, BaseTy); 123 Target = BaseVal.getAsRegion(); 124 } 125 break; 126 } 127 } 128 129 CallEventManager &CEMgr = getStateManager().getCallEventManager(); 130 CallEventRef<CXXConstructorCall> Call = 131 CEMgr.getCXXConstructorCall(CE, Target, State, LCtx); 132 133 ExplodedNodeSet DstPreVisit; 134 getCheckerManager().runCheckersForPreStmt(DstPreVisit, Pred, CE, *this); 135 ExplodedNodeSet DstPreCall; 136 getCheckerManager().runCheckersForPreCall(DstPreCall, DstPreVisit, 137 *Call, *this); 138 139 ExplodedNodeSet DstInvalidated; 140 StmtNodeBuilder Bldr(DstPreCall, DstInvalidated, *currentBuilderContext); 141 for (ExplodedNodeSet::iterator I = DstPreCall.begin(), E = DstPreCall.end(); 142 I != E; ++I) 143 defaultEvalCall(Bldr, *I, *Call); 144 145 ExplodedNodeSet DstPostCall; 146 getCheckerManager().runCheckersForPostCall(DstPostCall, DstInvalidated, 147 *Call, *this); 148 getCheckerManager().runCheckersForPostStmt(destNodes, DstPostCall, CE, *this); 149} 150 151void ExprEngine::VisitCXXDestructor(QualType ObjectType, 152 const MemRegion *Dest, 153 const Stmt *S, 154 ExplodedNode *Pred, 155 ExplodedNodeSet &Dst) { 156 const LocationContext *LCtx = Pred->getLocationContext(); 157 ProgramStateRef State = Pred->getState(); 158 159 // FIXME: We need to run the same destructor on every element of the array. 160 // This workaround will just run the first destructor (which will still 161 // invalidate the entire array). 162 if (const ArrayType *AT = getContext().getAsArrayType(ObjectType)) { 163 ObjectType = AT->getElementType(); 164 Dest = State->getLValue(ObjectType, getSValBuilder().makeZeroArrayIndex(), 165 loc::MemRegionVal(Dest)).getAsRegion(); 166 } 167 168 const CXXRecordDecl *RecordDecl = ObjectType->getAsCXXRecordDecl(); 169 assert(RecordDecl && "Only CXXRecordDecls should have destructors"); 170 const CXXDestructorDecl *DtorDecl = RecordDecl->getDestructor(); 171 172 CallEventManager &CEMgr = getStateManager().getCallEventManager(); 173 CallEventRef<CXXDestructorCall> Call = 174 CEMgr.getCXXDestructorCall(DtorDecl, S, Dest, State, LCtx); 175 176 PrettyStackTraceLoc CrashInfo(getContext().getSourceManager(), 177 Call->getSourceRange().getBegin(), 178 "Error evaluating destructor"); 179 180 ExplodedNodeSet DstPreCall; 181 getCheckerManager().runCheckersForPreCall(DstPreCall, Pred, 182 *Call, *this); 183 184 ExplodedNodeSet DstInvalidated; 185 StmtNodeBuilder Bldr(DstPreCall, DstInvalidated, *currentBuilderContext); 186 for (ExplodedNodeSet::iterator I = DstPreCall.begin(), E = DstPreCall.end(); 187 I != E; ++I) 188 defaultEvalCall(Bldr, *I, *Call); 189 190 ExplodedNodeSet DstPostCall; 191 getCheckerManager().runCheckersForPostCall(Dst, DstInvalidated, 192 *Call, *this); 193} 194 195void ExprEngine::VisitCXXNewExpr(const CXXNewExpr *CNE, ExplodedNode *Pred, 196 ExplodedNodeSet &Dst) { 197 // FIXME: Much of this should eventually migrate to CXXAllocatorCall. 198 // Also, we need to decide how allocators actually work -- they're not 199 // really part of the CXXNewExpr because they happen BEFORE the 200 // CXXConstructExpr subexpression. See PR12014 for some discussion. 201 StmtNodeBuilder Bldr(Pred, Dst, *currentBuilderContext); 202 203 unsigned blockCount = currentBuilderContext->getCurrentBlockCount(); 204 const LocationContext *LCtx = Pred->getLocationContext(); 205 DefinedOrUnknownSVal symVal = 206 svalBuilder.getConjuredSymbolVal(0, CNE, LCtx, CNE->getType(), blockCount); 207 ProgramStateRef State = Pred->getState(); 208 209 CallEventManager &CEMgr = getStateManager().getCallEventManager(); 210 CallEventRef<CXXAllocatorCall> Call = 211 CEMgr.getCXXAllocatorCall(CNE, State, LCtx); 212 213 // Invalidate placement args. 214 // FIXME: Once we figure out how we want allocators to work, 215 // we should be using the usual pre-/(default-)eval-/post-call checks here. 216 State = Call->invalidateRegions(blockCount); 217 218 if (CNE->isArray()) { 219 // FIXME: allocating an array requires simulating the constructors. 220 // For now, just return a symbolicated region. 221 const MemRegion *NewReg = cast<loc::MemRegionVal>(symVal).getRegion(); 222 QualType ObjTy = CNE->getType()->getAs<PointerType>()->getPointeeType(); 223 const ElementRegion *EleReg = 224 getStoreManager().GetElementZeroRegion(NewReg, ObjTy); 225 State = State->BindExpr(CNE, Pred->getLocationContext(), 226 loc::MemRegionVal(EleReg)); 227 Bldr.generateNode(CNE, Pred, State); 228 return; 229 } 230 231 // FIXME: Once we have proper support for CXXConstructExprs inside 232 // CXXNewExpr, we need to make sure that the constructed object is not 233 // immediately invalidated here. (The placement call should happen before 234 // the constructor call anyway.) 235 FunctionDecl *FD = CNE->getOperatorNew(); 236 if (FD && FD->isReservedGlobalPlacementOperator()) { 237 // Non-array placement new should always return the placement location. 238 SVal PlacementLoc = State->getSVal(CNE->getPlacementArg(0), LCtx); 239 State = State->BindExpr(CNE, LCtx, PlacementLoc); 240 } else { 241 State = State->BindExpr(CNE, LCtx, symVal); 242 } 243 244 // If the type is not a record, we won't have a CXXConstructExpr as an 245 // initializer. Copy the value over. 246 if (const Expr *Init = CNE->getInitializer()) { 247 if (!isa<CXXConstructExpr>(Init)) { 248 QualType ObjTy = CNE->getType()->getAs<PointerType>()->getPointeeType(); 249 (void)ObjTy; 250 assert(!ObjTy->isRecordType()); 251 SVal Location = State->getSVal(CNE, LCtx); 252 if (isa<Loc>(Location)) 253 State = State->bindLoc(cast<Loc>(Location), State->getSVal(Init, LCtx)); 254 } 255 } 256 257 Bldr.generateNode(CNE, Pred, State); 258} 259 260void ExprEngine::VisitCXXDeleteExpr(const CXXDeleteExpr *CDE, 261 ExplodedNode *Pred, ExplodedNodeSet &Dst) { 262 StmtNodeBuilder Bldr(Pred, Dst, *currentBuilderContext); 263 ProgramStateRef state = Pred->getState(); 264 Bldr.generateNode(CDE, Pred, state); 265} 266 267void ExprEngine::VisitCXXCatchStmt(const CXXCatchStmt *CS, 268 ExplodedNode *Pred, 269 ExplodedNodeSet &Dst) { 270 const VarDecl *VD = CS->getExceptionDecl(); 271 if (!VD) { 272 Dst.Add(Pred); 273 return; 274 } 275 276 const LocationContext *LCtx = Pred->getLocationContext(); 277 SVal V = svalBuilder.getConjuredSymbolVal(CS, LCtx, VD->getType(), 278 currentBuilderContext->getCurrentBlockCount()); 279 ProgramStateRef state = Pred->getState(); 280 state = state->bindLoc(state->getLValue(VD, LCtx), V); 281 282 StmtNodeBuilder Bldr(Pred, Dst, *currentBuilderContext); 283 Bldr.generateNode(CS, Pred, state); 284} 285 286void ExprEngine::VisitCXXThisExpr(const CXXThisExpr *TE, ExplodedNode *Pred, 287 ExplodedNodeSet &Dst) { 288 StmtNodeBuilder Bldr(Pred, Dst, *currentBuilderContext); 289 290 // Get the this object region from StoreManager. 291 const LocationContext *LCtx = Pred->getLocationContext(); 292 const MemRegion *R = 293 svalBuilder.getRegionManager().getCXXThisRegion( 294 getContext().getCanonicalType(TE->getType()), 295 LCtx); 296 297 ProgramStateRef state = Pred->getState(); 298 SVal V = state->getSVal(loc::MemRegionVal(R)); 299 Bldr.generateNode(TE, Pred, state->BindExpr(TE, LCtx, V)); 300} 301