ExprEngineCXX.cpp revision c210cb7a358d14cdd93b58562f33ff5ed2d895c1 
1//===- ExprEngineCXX.cpp - ExprEngine support for C++ -----------*- C++ -*-===//
2//
3//                     The LLVM Compiler Infrastructure
4//
5// This file is distributed under the University of Illinois Open Source
6// License. See LICENSE.TXT for details.
7//
8//===----------------------------------------------------------------------===//
9//
10//  This file defines the C++ expression evaluation engine.
11//
12//===----------------------------------------------------------------------===//
13
14#include "clang/StaticAnalyzer/Core/CheckerManager.h"
15#include "clang/StaticAnalyzer/Core/PathSensitive/AnalysisManager.h"
16#include "clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h"
17#include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
18#include "clang/AST/DeclCXX.h"
19#include "clang/AST/StmtCXX.h"
20#include "clang/Basic/PrettyStackTrace.h"
21
22using namespace clang;
23using namespace ento;
24
25void ExprEngine::CreateCXXTemporaryObject(const MaterializeTemporaryExpr *ME,
26                                          ExplodedNode *Pred,
27                                          ExplodedNodeSet &Dst) {
28  StmtNodeBuilder Bldr(Pred, Dst, *currBldrCtx);
29  const Expr *tempExpr = ME->GetTemporaryExpr()->IgnoreParens();
30  ProgramStateRef state = Pred->getState();
31  const LocationContext *LCtx = Pred->getLocationContext();
32
33  // Bind the temporary object to the value of the expression. Then bind
34  // the expression to the location of the object.
35  SVal V = state->getSVal(tempExpr, LCtx);
36
37  // If the object is a record, the constructor will have already created
38  // a temporary object region. If it is not, we need to copy the value over.
39  if (!ME->getType()->isRecordType()) {
40    const MemRegion *R =
41      svalBuilder.getRegionManager().getCXXTempObjectRegion(ME, LCtx);
42
43    SVal L = loc::MemRegionVal(R);
44    state = state->bindLoc(L, V);
45    V = L;
46  }
47
48  Bldr.generateNode(ME, Pred, state->BindExpr(ME, LCtx, V));
49}
50
51void ExprEngine::VisitCXXConstructExpr(const CXXConstructExpr *CE,
52                                       ExplodedNode *Pred,
53                                       ExplodedNodeSet &destNodes) {
54  const LocationContext *LCtx = Pred->getLocationContext();
55  ProgramStateRef State = Pred->getState();
56
57  const MemRegion *Target = 0;
58
59  switch (CE->getConstructionKind()) {
60  case CXXConstructExpr::CK_Complete: {
61    // See if we're constructing an existing region by looking at the next
62    // element in the CFG.
63    const CFGBlock *B = currBldrCtx->getBlock();
64    if (currStmtIdx + 1 < B->size()) {
65      CFGElement Next = (*B)[currStmtIdx+1];
66
67      // Is this a constructor for a local variable?
68      if (const CFGStmt *StmtElem = dyn_cast<CFGStmt>(&Next)) {
69        if (const DeclStmt *DS = dyn_cast<DeclStmt>(StmtElem->getStmt())) {
70          if (const VarDecl *Var = dyn_cast<VarDecl>(DS->getSingleDecl())) {
71            if (Var->getInit()->IgnoreImplicit() == CE) {
72              QualType Ty = Var->getType();
73              if (const ArrayType *AT = getContext().getAsArrayType(Ty)) {
74                // FIXME: Handle arrays, which run the same constructor for
75                // every element. This workaround will just run the first
76                // constructor (which should still invalidate the entire array).
77                SVal Base = State->getLValue(Var, LCtx);
78                Target = State->getLValue(AT->getElementType(),
79                                          getSValBuilder().makeZeroArrayIndex(),
80                                          Base).getAsRegion();
81              } else {
82                Target = State->getLValue(Var, LCtx).getAsRegion();
83              }
84            }
85          }
86        }
87      }
88
89      // Is this a constructor for a member?
90      if (const CFGInitializer *InitElem = dyn_cast<CFGInitializer>(&Next)) {
91        const CXXCtorInitializer *Init = InitElem->getInitializer();
92        assert(Init->isAnyMemberInitializer());
93
94        const CXXMethodDecl *CurCtor = cast<CXXMethodDecl>(LCtx->getDecl());
95        Loc ThisPtr = getSValBuilder().getCXXThis(CurCtor,
96                                                  LCtx->getCurrentStackFrame());
97        SVal ThisVal = State->getSVal(ThisPtr);
98
99        if (Init->isIndirectMemberInitializer()) {
100          SVal Field = State->getLValue(Init->getIndirectMember(), ThisVal);
101          Target = Field.getAsRegion();
102        } else {
103          SVal Field = State->getLValue(Init->getMember(), ThisVal);
104          Target = Field.getAsRegion();
105        }
106      }
107
108      // FIXME: This will eventually need to handle new-expressions as well.
109    }
110
111    // If we couldn't find an existing region to construct into, assume we're
112    // constructing a temporary.
113    if (!Target) {
114      MemRegionManager &MRMgr = getSValBuilder().getRegionManager();
115      Target = MRMgr.getCXXTempObjectRegion(CE, LCtx);
116    }
117
118    break;
119  }
120  case CXXConstructExpr::CK_NonVirtualBase:
121  case CXXConstructExpr::CK_VirtualBase:
122  case CXXConstructExpr::CK_Delegating: {
123    const CXXMethodDecl *CurCtor = cast<CXXMethodDecl>(LCtx->getDecl());
124    Loc ThisPtr = getSValBuilder().getCXXThis(CurCtor,
125                                              LCtx->getCurrentStackFrame());
126    SVal ThisVal = State->getSVal(ThisPtr);
127
128    if (CE->getConstructionKind() == CXXConstructExpr::CK_Delegating) {
129      Target = ThisVal.getAsRegion();
130    } else {
131      // Cast to the base type.
132      QualType BaseTy = CE->getType();
133      SVal BaseVal = getStoreManager().evalDerivedToBase(ThisVal, BaseTy);
134      Target = BaseVal.getAsRegion();
135    }
136    break;
137  }
138  }
139
140  CallEventManager &CEMgr = getStateManager().getCallEventManager();
141  CallEventRef<CXXConstructorCall> Call =
142    CEMgr.getCXXConstructorCall(CE, Target, State, LCtx);
143
144  ExplodedNodeSet DstPreVisit;
145  getCheckerManager().runCheckersForPreStmt(DstPreVisit, Pred, CE, *this);
146  ExplodedNodeSet DstPreCall;
147  getCheckerManager().runCheckersForPreCall(DstPreCall, DstPreVisit,
148                                            *Call, *this);
149
150  ExplodedNodeSet DstInvalidated;
151  StmtNodeBuilder Bldr(DstPreCall, DstInvalidated, *currBldrCtx);
152  for (ExplodedNodeSet::iterator I = DstPreCall.begin(), E = DstPreCall.end();
153       I != E; ++I)
154    defaultEvalCall(Bldr, *I, *Call);
155
156  ExplodedNodeSet DstPostCall;
157  getCheckerManager().runCheckersForPostCall(DstPostCall, DstInvalidated,
158                                             *Call, *this);
159  getCheckerManager().runCheckersForPostStmt(destNodes, DstPostCall, CE, *this);
160}
161
162void ExprEngine::VisitCXXDestructor(QualType ObjectType,
163                                    const MemRegion *Dest,
164                                    const Stmt *S,
165                                    ExplodedNode *Pred,
166                                    ExplodedNodeSet &Dst) {
167  const LocationContext *LCtx = Pred->getLocationContext();
168  ProgramStateRef State = Pred->getState();
169
170  // FIXME: We need to run the same destructor on every element of the array.
171  // This workaround will just run the first destructor (which will still
172  // invalidate the entire array).
173  if (const ArrayType *AT = getContext().getAsArrayType(ObjectType)) {
174    ObjectType = AT->getElementType();
175    Dest = State->getLValue(ObjectType, getSValBuilder().makeZeroArrayIndex(),
176                            loc::MemRegionVal(Dest)).getAsRegion();
177  }
178
179  const CXXRecordDecl *RecordDecl = ObjectType->getAsCXXRecordDecl();
180  assert(RecordDecl && "Only CXXRecordDecls should have destructors");
181  const CXXDestructorDecl *DtorDecl = RecordDecl->getDestructor();
182
183  CallEventManager &CEMgr = getStateManager().getCallEventManager();
184  CallEventRef<CXXDestructorCall> Call =
185    CEMgr.getCXXDestructorCall(DtorDecl, S, Dest, State, LCtx);
186
187  PrettyStackTraceLoc CrashInfo(getContext().getSourceManager(),
188                                Call->getSourceRange().getBegin(),
189                                "Error evaluating destructor");
190
191  ExplodedNodeSet DstPreCall;
192  getCheckerManager().runCheckersForPreCall(DstPreCall, Pred,
193                                            *Call, *this);
194
195  ExplodedNodeSet DstInvalidated;
196  StmtNodeBuilder Bldr(DstPreCall, DstInvalidated, *currBldrCtx);
197  for (ExplodedNodeSet::iterator I = DstPreCall.begin(), E = DstPreCall.end();
198       I != E; ++I)
199    defaultEvalCall(Bldr, *I, *Call);
200
201  ExplodedNodeSet DstPostCall;
202  getCheckerManager().runCheckersForPostCall(Dst, DstInvalidated,
203                                             *Call, *this);
204}
205
206void ExprEngine::VisitCXXNewExpr(const CXXNewExpr *CNE, ExplodedNode *Pred,
207                                   ExplodedNodeSet &Dst) {
208  // FIXME: Much of this should eventually migrate to CXXAllocatorCall.
209  // Also, we need to decide how allocators actually work -- they're not
210  // really part of the CXXNewExpr because they happen BEFORE the
211  // CXXConstructExpr subexpression. See PR12014 for some discussion.
212  StmtNodeBuilder Bldr(Pred, Dst, *currBldrCtx);
213
214  unsigned blockCount = currBldrCtx->blockCount();
215  const LocationContext *LCtx = Pred->getLocationContext();
216  DefinedOrUnknownSVal symVal = svalBuilder.conjureSymbolVal(0, CNE, LCtx,
217                                                             CNE->getType(),
218                                                             blockCount);
219  ProgramStateRef State = Pred->getState();
220
221  CallEventManager &CEMgr = getStateManager().getCallEventManager();
222  CallEventRef<CXXAllocatorCall> Call =
223    CEMgr.getCXXAllocatorCall(CNE, State, LCtx);
224
225  // Invalidate placement args.
226  // FIXME: Once we figure out how we want allocators to work,
227  // we should be using the usual pre-/(default-)eval-/post-call checks here.
228  State = Call->invalidateRegions(blockCount);
229
230  if (CNE->isArray()) {
231    // FIXME: allocating an array requires simulating the constructors.
232    // For now, just return a symbolicated region.
233    const MemRegion *NewReg = cast<loc::MemRegionVal>(symVal).getRegion();
234    QualType ObjTy = CNE->getType()->getAs<PointerType>()->getPointeeType();
235    const ElementRegion *EleReg =
236      getStoreManager().GetElementZeroRegion(NewReg, ObjTy);
237    State = State->BindExpr(CNE, Pred->getLocationContext(),
238                            loc::MemRegionVal(EleReg));
239    Bldr.generateNode(CNE, Pred, State);
240    return;
241  }
242
243  // FIXME: Once we have proper support for CXXConstructExprs inside
244  // CXXNewExpr, we need to make sure that the constructed object is not
245  // immediately invalidated here. (The placement call should happen before
246  // the constructor call anyway.)
247  FunctionDecl *FD = CNE->getOperatorNew();
248  if (FD && FD->isReservedGlobalPlacementOperator()) {
249    // Non-array placement new should always return the placement location.
250    SVal PlacementLoc = State->getSVal(CNE->getPlacementArg(0), LCtx);
251    State = State->BindExpr(CNE, LCtx, PlacementLoc);
252  } else {
253    State = State->BindExpr(CNE, LCtx, symVal);
254  }
255
256  // If the type is not a record, we won't have a CXXConstructExpr as an
257  // initializer. Copy the value over.
258  if (const Expr *Init = CNE->getInitializer()) {
259    if (!isa<CXXConstructExpr>(Init)) {
260      QualType ObjTy = CNE->getType()->getAs<PointerType>()->getPointeeType();
261      (void)ObjTy;
262      assert(!ObjTy->isRecordType());
263      SVal Location = State->getSVal(CNE, LCtx);
264      if (isa<Loc>(Location))
265        State = State->bindLoc(cast<Loc>(Location), State->getSVal(Init, LCtx));
266    }
267  }
268
269  Bldr.generateNode(CNE, Pred, State);
270}
271
272void ExprEngine::VisitCXXDeleteExpr(const CXXDeleteExpr *CDE,
273                                    ExplodedNode *Pred, ExplodedNodeSet &Dst) {
274  StmtNodeBuilder Bldr(Pred, Dst, *currBldrCtx);
275  ProgramStateRef state = Pred->getState();
276  Bldr.generateNode(CDE, Pred, state);
277}
278
279void ExprEngine::VisitCXXCatchStmt(const CXXCatchStmt *CS,
280                                   ExplodedNode *Pred,
281                                   ExplodedNodeSet &Dst) {
282  const VarDecl *VD = CS->getExceptionDecl();
283  if (!VD) {
284    Dst.Add(Pred);
285    return;
286  }
287
288  const LocationContext *LCtx = Pred->getLocationContext();
289  SVal V = svalBuilder.conjureSymbolVal(CS, LCtx, VD->getType(),
290                                        currBldrCtx->blockCount());
291  ProgramStateRef state = Pred->getState();
292  state = state->bindLoc(state->getLValue(VD, LCtx), V);
293
294  StmtNodeBuilder Bldr(Pred, Dst, *currBldrCtx);
295  Bldr.generateNode(CS, Pred, state);
296}
297
298void ExprEngine::VisitCXXThisExpr(const CXXThisExpr *TE, ExplodedNode *Pred,
299                                    ExplodedNodeSet &Dst) {
300  StmtNodeBuilder Bldr(Pred, Dst, *currBldrCtx);
301
302  // Get the this object region from StoreManager.
303  const LocationContext *LCtx = Pred->getLocationContext();
304  const MemRegion *R =
305    svalBuilder.getRegionManager().getCXXThisRegion(
306                                  getContext().getCanonicalType(TE->getType()),
307                                                    LCtx);
308
309  ProgramStateRef state = Pred->getState();
310  SVal V = state->getSVal(loc::MemRegionVal(R));
311  Bldr.generateNode(TE, Pred, state->BindExpr(TE, LCtx, V));
312}
313