ExprEngineCXX.cpp revision a8d937e4bdd39cdf503f77454e9dc4c9c730a9f7 
1//===- ExprEngineCXX.cpp - ExprEngine support for C++ -----------*- C++ -*-===//
2//
3//                     The LLVM Compiler Infrastructure
4//
5// This file is distributed under the University of Illinois Open Source
6// License. See LICENSE.TXT for details.
7//
8//===----------------------------------------------------------------------===//
9//
10//  This file defines the C++ expression evaluation engine.
11//
12//===----------------------------------------------------------------------===//
13
14#include "clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h"
15#include "clang/AST/DeclCXX.h"
16#include "clang/AST/StmtCXX.h"
17#include "clang/Basic/PrettyStackTrace.h"
18#include "clang/StaticAnalyzer/Core/CheckerManager.h"
19#include "clang/StaticAnalyzer/Core/PathSensitive/AnalysisManager.h"
20#include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
21
22using namespace clang;
23using namespace ento;
24
25void ExprEngine::CreateCXXTemporaryObject(const MaterializeTemporaryExpr *ME,
26                                          ExplodedNode *Pred,
27                                          ExplodedNodeSet &Dst) {
28  StmtNodeBuilder Bldr(Pred, Dst, *currBldrCtx);
29  const Expr *tempExpr = ME->GetTemporaryExpr()->IgnoreParens();
30  ProgramStateRef state = Pred->getState();
31  const LocationContext *LCtx = Pred->getLocationContext();
32
33  SVal V = state->getSVal(tempExpr, LCtx);
34
35  // If the value is already a CXXTempObjectRegion, it is fine as it is.
36  // Otherwise, create a new CXXTempObjectRegion, and copy the value into it.
37  // This is an optimization for when an rvalue is constructed and then
38  // immediately materialized.
39  const MemRegion *MR = V.getAsRegion();
40  if (const CXXTempObjectRegion *TR =
41        dyn_cast_or_null<CXXTempObjectRegion>(MR)) {
42    if (getContext().hasSameUnqualifiedType(TR->getValueType(), ME->getType()))
43      state = state->BindExpr(ME, LCtx, V);
44  }
45
46  if (state == Pred->getState())
47    state = createTemporaryRegionIfNeeded(state, LCtx, tempExpr, ME);
48  Bldr.generateNode(ME, Pred, state);
49}
50
51// FIXME: This is the sort of code that should eventually live in a Core
52// checker rather than as a special case in ExprEngine.
53void ExprEngine::performTrivialCopy(NodeBuilder &Bldr, ExplodedNode *Pred,
54                                    const CallEvent &Call) {
55  SVal ThisVal;
56  bool AlwaysReturnsLValue;
57  if (const CXXConstructorCall *Ctor = dyn_cast<CXXConstructorCall>(&Call)) {
58    assert(Ctor->getDecl()->isTrivial());
59    assert(Ctor->getDecl()->isCopyOrMoveConstructor());
60    ThisVal = Ctor->getCXXThisVal();
61    AlwaysReturnsLValue = false;
62  } else {
63    assert(cast<CXXMethodDecl>(Call.getDecl())->isTrivial());
64    assert(cast<CXXMethodDecl>(Call.getDecl())->getOverloadedOperator() ==
65           OO_Equal);
66    ThisVal = cast<CXXInstanceCall>(Call).getCXXThisVal();
67    AlwaysReturnsLValue = true;
68  }
69
70  const LocationContext *LCtx = Pred->getLocationContext();
71
72  ExplodedNodeSet Dst;
73  Bldr.takeNodes(Pred);
74
75  SVal V = Call.getArgSVal(0);
76
77  // If the value being copied is not unknown, load from its location to get
78  // an aggregate rvalue.
79  if (Optional<Loc> L = V.getAs<Loc>())
80    V = Pred->getState()->getSVal(*L);
81  else
82    assert(V.isUnknown());
83
84  const Expr *CallExpr = Call.getOriginExpr();
85  evalBind(Dst, CallExpr, Pred, ThisVal, V, true);
86
87  PostStmt PS(CallExpr, LCtx);
88  for (ExplodedNodeSet::iterator I = Dst.begin(), E = Dst.end();
89       I != E; ++I) {
90    ProgramStateRef State = (*I)->getState();
91    if (AlwaysReturnsLValue)
92      State = State->BindExpr(CallExpr, LCtx, ThisVal);
93    else
94      State = bindReturnValue(Call, LCtx, State);
95    Bldr.generateNode(PS, State, *I);
96  }
97}
98
99void ExprEngine::VisitCXXConstructExpr(const CXXConstructExpr *CE,
100                                       ExplodedNode *Pred,
101                                       ExplodedNodeSet &destNodes) {
102  const LocationContext *LCtx = Pred->getLocationContext();
103  ProgramStateRef State = Pred->getState();
104
105  const MemRegion *Target = 0;
106  bool IsArray = false;
107
108  switch (CE->getConstructionKind()) {
109  case CXXConstructExpr::CK_Complete: {
110    // See if we're constructing an existing region by looking at the next
111    // element in the CFG.
112    const CFGBlock *B = currBldrCtx->getBlock();
113    if (currStmtIdx + 1 < B->size()) {
114      CFGElement Next = (*B)[currStmtIdx+1];
115
116      // Is this a constructor for a local variable?
117      if (Optional<CFGStmt> StmtElem = Next.getAs<CFGStmt>()) {
118        if (const DeclStmt *DS = dyn_cast<DeclStmt>(StmtElem->getStmt())) {
119          if (const VarDecl *Var = dyn_cast<VarDecl>(DS->getSingleDecl())) {
120            if (Var->getInit()->IgnoreImplicit() == CE) {
121              QualType Ty = Var->getType();
122              if (const ArrayType *AT = getContext().getAsArrayType(Ty)) {
123                // FIXME: Handle arrays, which run the same constructor for
124                // every element. This workaround will just run the first
125                // constructor (which should still invalidate the entire array).
126                SVal Base = State->getLValue(Var, LCtx);
127                Target = State->getLValue(AT->getElementType(),
128                                          getSValBuilder().makeZeroArrayIndex(),
129                                          Base).getAsRegion();
130                IsArray = true;
131              } else {
132                Target = State->getLValue(Var, LCtx).getAsRegion();
133              }
134            }
135          }
136        }
137      }
138
139      // Is this a constructor for a member?
140      if (Optional<CFGInitializer> InitElem = Next.getAs<CFGInitializer>()) {
141        const CXXCtorInitializer *Init = InitElem->getInitializer();
142        assert(Init->isAnyMemberInitializer());
143
144        const CXXMethodDecl *CurCtor = cast<CXXMethodDecl>(LCtx->getDecl());
145        Loc ThisPtr = getSValBuilder().getCXXThis(CurCtor,
146                                                  LCtx->getCurrentStackFrame());
147        SVal ThisVal = State->getSVal(ThisPtr);
148
149        if (Init->isIndirectMemberInitializer()) {
150          SVal Field = State->getLValue(Init->getIndirectMember(), ThisVal);
151          Target = Field.getAsRegion();
152        } else {
153          SVal Field = State->getLValue(Init->getMember(), ThisVal);
154          Target = Field.getAsRegion();
155        }
156      }
157
158      // FIXME: This will eventually need to handle new-expressions as well.
159    }
160
161    // If we couldn't find an existing region to construct into, assume we're
162    // constructing a temporary.
163    if (!Target) {
164      MemRegionManager &MRMgr = getSValBuilder().getRegionManager();
165      Target = MRMgr.getCXXTempObjectRegion(CE, LCtx);
166    }
167
168    break;
169  }
170  case CXXConstructExpr::CK_NonVirtualBase:
171  case CXXConstructExpr::CK_VirtualBase:
172  case CXXConstructExpr::CK_Delegating: {
173    const CXXMethodDecl *CurCtor = cast<CXXMethodDecl>(LCtx->getDecl());
174    Loc ThisPtr = getSValBuilder().getCXXThis(CurCtor,
175                                              LCtx->getCurrentStackFrame());
176    SVal ThisVal = State->getSVal(ThisPtr);
177
178    if (CE->getConstructionKind() == CXXConstructExpr::CK_Delegating) {
179      Target = ThisVal.getAsRegion();
180    } else {
181      // Cast to the base type.
182      bool IsVirtual =
183        (CE->getConstructionKind() == CXXConstructExpr::CK_VirtualBase);
184      SVal BaseVal = getStoreManager().evalDerivedToBase(ThisVal, CE->getType(),
185                                                         IsVirtual);
186      Target = BaseVal.getAsRegion();
187    }
188    break;
189  }
190  }
191
192  CallEventManager &CEMgr = getStateManager().getCallEventManager();
193  CallEventRef<CXXConstructorCall> Call =
194    CEMgr.getCXXConstructorCall(CE, Target, State, LCtx);
195
196  ExplodedNodeSet DstPreVisit;
197  getCheckerManager().runCheckersForPreStmt(DstPreVisit, Pred, CE, *this);
198  ExplodedNodeSet DstPreCall;
199  getCheckerManager().runCheckersForPreCall(DstPreCall, DstPreVisit,
200                                            *Call, *this);
201
202  ExplodedNodeSet DstEvaluated;
203  StmtNodeBuilder Bldr(DstPreCall, DstEvaluated, *currBldrCtx);
204
205  if (CE->getConstructor()->isTrivial() &&
206      CE->getConstructor()->isCopyOrMoveConstructor() &&
207      !IsArray) {
208    // FIXME: Handle other kinds of trivial constructors as well.
209    for (ExplodedNodeSet::iterator I = DstPreCall.begin(), E = DstPreCall.end();
210         I != E; ++I)
211      performTrivialCopy(Bldr, *I, *Call);
212
213  } else {
214    for (ExplodedNodeSet::iterator I = DstPreCall.begin(), E = DstPreCall.end();
215         I != E; ++I)
216      defaultEvalCall(Bldr, *I, *Call);
217  }
218
219  ExplodedNodeSet DstPostCall;
220  getCheckerManager().runCheckersForPostCall(DstPostCall, DstEvaluated,
221                                             *Call, *this);
222  getCheckerManager().runCheckersForPostStmt(destNodes, DstPostCall, CE, *this);
223}
224
225void ExprEngine::VisitCXXDestructor(QualType ObjectType,
226                                    const MemRegion *Dest,
227                                    const Stmt *S,
228                                    bool IsBaseDtor,
229                                    ExplodedNode *Pred,
230                                    ExplodedNodeSet &Dst) {
231  const LocationContext *LCtx = Pred->getLocationContext();
232  ProgramStateRef State = Pred->getState();
233
234  // FIXME: We need to run the same destructor on every element of the array.
235  // This workaround will just run the first destructor (which will still
236  // invalidate the entire array).
237  // This is a loop because of multidimensional arrays.
238  while (const ArrayType *AT = getContext().getAsArrayType(ObjectType)) {
239    ObjectType = AT->getElementType();
240    Dest = State->getLValue(ObjectType, getSValBuilder().makeZeroArrayIndex(),
241                            loc::MemRegionVal(Dest)).getAsRegion();
242  }
243
244  const CXXRecordDecl *RecordDecl = ObjectType->getAsCXXRecordDecl();
245  assert(RecordDecl && "Only CXXRecordDecls should have destructors");
246  const CXXDestructorDecl *DtorDecl = RecordDecl->getDestructor();
247
248  CallEventManager &CEMgr = getStateManager().getCallEventManager();
249  CallEventRef<CXXDestructorCall> Call =
250    CEMgr.getCXXDestructorCall(DtorDecl, S, Dest, IsBaseDtor, State, LCtx);
251
252  PrettyStackTraceLoc CrashInfo(getContext().getSourceManager(),
253                                Call->getSourceRange().getBegin(),
254                                "Error evaluating destructor");
255
256  ExplodedNodeSet DstPreCall;
257  getCheckerManager().runCheckersForPreCall(DstPreCall, Pred,
258                                            *Call, *this);
259
260  ExplodedNodeSet DstInvalidated;
261  StmtNodeBuilder Bldr(DstPreCall, DstInvalidated, *currBldrCtx);
262  for (ExplodedNodeSet::iterator I = DstPreCall.begin(), E = DstPreCall.end();
263       I != E; ++I)
264    defaultEvalCall(Bldr, *I, *Call);
265
266  ExplodedNodeSet DstPostCall;
267  getCheckerManager().runCheckersForPostCall(Dst, DstInvalidated,
268                                             *Call, *this);
269}
270
271void ExprEngine::VisitCXXNewExpr(const CXXNewExpr *CNE, ExplodedNode *Pred,
272                                   ExplodedNodeSet &Dst) {
273  // FIXME: Much of this should eventually migrate to CXXAllocatorCall.
274  // Also, we need to decide how allocators actually work -- they're not
275  // really part of the CXXNewExpr because they happen BEFORE the
276  // CXXConstructExpr subexpression. See PR12014 for some discussion.
277  StmtNodeBuilder Bldr(Pred, Dst, *currBldrCtx);
278
279  unsigned blockCount = currBldrCtx->blockCount();
280  const LocationContext *LCtx = Pred->getLocationContext();
281  DefinedOrUnknownSVal symVal = svalBuilder.conjureSymbolVal(0, CNE, LCtx,
282                                                             CNE->getType(),
283                                                             blockCount);
284  ProgramStateRef State = Pred->getState();
285
286  CallEventManager &CEMgr = getStateManager().getCallEventManager();
287  CallEventRef<CXXAllocatorCall> Call =
288    CEMgr.getCXXAllocatorCall(CNE, State, LCtx);
289
290  // Invalidate placement args.
291  // FIXME: Once we figure out how we want allocators to work,
292  // we should be using the usual pre-/(default-)eval-/post-call checks here.
293  State = Call->invalidateRegions(blockCount);
294
295  // If we're compiling with exceptions enabled, and this allocation function
296  // is not declared as non-throwing, failures /must/ be signalled by
297  // exceptions, and thus the return value will never be NULL.
298  // C++11 [basic.stc.dynamic.allocation]p3.
299  FunctionDecl *FD = CNE->getOperatorNew();
300  if (FD && getContext().getLangOpts().CXXExceptions) {
301    QualType Ty = FD->getType();
302    if (const FunctionProtoType *ProtoType = Ty->getAs<FunctionProtoType>())
303      if (!ProtoType->isNothrow(getContext()))
304        State = State->assume(symVal, true);
305  }
306
307  if (CNE->isArray()) {
308    // FIXME: allocating an array requires simulating the constructors.
309    // For now, just return a symbolicated region.
310    const MemRegion *NewReg = symVal.castAs<loc::MemRegionVal>().getRegion();
311    QualType ObjTy = CNE->getType()->getAs<PointerType>()->getPointeeType();
312    const ElementRegion *EleReg =
313      getStoreManager().GetElementZeroRegion(NewReg, ObjTy);
314    State = State->BindExpr(CNE, Pred->getLocationContext(),
315                            loc::MemRegionVal(EleReg));
316    Bldr.generateNode(CNE, Pred, State);
317    return;
318  }
319
320  // FIXME: Once we have proper support for CXXConstructExprs inside
321  // CXXNewExpr, we need to make sure that the constructed object is not
322  // immediately invalidated here. (The placement call should happen before
323  // the constructor call anyway.)
324  if (FD && FD->isReservedGlobalPlacementOperator()) {
325    // Non-array placement new should always return the placement location.
326    SVal PlacementLoc = State->getSVal(CNE->getPlacementArg(0), LCtx);
327    SVal Result = svalBuilder.evalCast(PlacementLoc, CNE->getType(),
328                                       CNE->getPlacementArg(0)->getType());
329    State = State->BindExpr(CNE, LCtx, Result);
330  } else {
331    State = State->BindExpr(CNE, LCtx, symVal);
332  }
333
334  // If the type is not a record, we won't have a CXXConstructExpr as an
335  // initializer. Copy the value over.
336  if (const Expr *Init = CNE->getInitializer()) {
337    if (!isa<CXXConstructExpr>(Init)) {
338      QualType ObjTy = CNE->getType()->getAs<PointerType>()->getPointeeType();
339      (void)ObjTy;
340      assert(!ObjTy->isRecordType());
341      SVal Location = State->getSVal(CNE, LCtx);
342      if (Optional<Loc> LV = Location.getAs<Loc>())
343        State = State->bindLoc(*LV, State->getSVal(Init, LCtx));
344    }
345  }
346
347  Bldr.generateNode(CNE, Pred, State);
348}
349
350void ExprEngine::VisitCXXDeleteExpr(const CXXDeleteExpr *CDE,
351                                    ExplodedNode *Pred, ExplodedNodeSet &Dst) {
352  StmtNodeBuilder Bldr(Pred, Dst, *currBldrCtx);
353  ProgramStateRef state = Pred->getState();
354  Bldr.generateNode(CDE, Pred, state);
355}
356
357void ExprEngine::VisitCXXCatchStmt(const CXXCatchStmt *CS,
358                                   ExplodedNode *Pred,
359                                   ExplodedNodeSet &Dst) {
360  const VarDecl *VD = CS->getExceptionDecl();
361  if (!VD) {
362    Dst.Add(Pred);
363    return;
364  }
365
366  const LocationContext *LCtx = Pred->getLocationContext();
367  SVal V = svalBuilder.conjureSymbolVal(CS, LCtx, VD->getType(),
368                                        currBldrCtx->blockCount());
369  ProgramStateRef state = Pred->getState();
370  state = state->bindLoc(state->getLValue(VD, LCtx), V);
371
372  StmtNodeBuilder Bldr(Pred, Dst, *currBldrCtx);
373  Bldr.generateNode(CS, Pred, state);
374}
375
376void ExprEngine::VisitCXXThisExpr(const CXXThisExpr *TE, ExplodedNode *Pred,
377                                    ExplodedNodeSet &Dst) {
378  StmtNodeBuilder Bldr(Pred, Dst, *currBldrCtx);
379
380  // Get the this object region from StoreManager.
381  const LocationContext *LCtx = Pred->getLocationContext();
382  const MemRegion *R =
383    svalBuilder.getRegionManager().getCXXThisRegion(
384                                  getContext().getCanonicalType(TE->getType()),
385                                                    LCtx);
386
387  ProgramStateRef state = Pred->getState();
388  SVal V = state->getSVal(loc::MemRegionVal(R));
389  Bldr.generateNode(TE, Pred, state->BindExpr(TE, LCtx, V));
390}
391