1//== Store.cpp - Interface for maps from Locations to Values ----*- C++ -*--==//
2//
3//                     The LLVM Compiler Infrastructure
4//
5// This file is distributed under the University of Illinois Open Source
6// License. See LICENSE.TXT for details.
7//
8//===----------------------------------------------------------------------===//
9//
10//  This file defined the types Store and StoreManager.
11//
12//===----------------------------------------------------------------------===//
13
14#include "clang/StaticAnalyzer/Core/PathSensitive/Store.h"
15#include "clang/AST/CXXInheritance.h"
16#include "clang/AST/CharUnits.h"
17#include "clang/AST/DeclObjC.h"
18#include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
19#include "clang/StaticAnalyzer/Core/PathSensitive/ProgramState.h"
20
21using namespace clang;
22using namespace ento;
23
24StoreManager::StoreManager(ProgramStateManager &stateMgr)
25  : svalBuilder(stateMgr.getSValBuilder()), StateMgr(stateMgr),
26    MRMgr(svalBuilder.getRegionManager()), Ctx(stateMgr.getContext()) {}
27
28StoreRef StoreManager::enterStackFrame(Store OldStore,
29                                       const CallEvent &Call,
30                                       const StackFrameContext *LCtx) {
31  StoreRef Store = StoreRef(OldStore, *this);
32
33  SmallVector<CallEvent::FrameBindingTy, 16> InitialBindings;
34  Call.getInitialStackFrameContents(LCtx, InitialBindings);
35
36  for (CallEvent::BindingsTy::iterator I = InitialBindings.begin(),
37                                       E = InitialBindings.end();
38       I != E; ++I) {
39    Store = Bind(Store.getStore(), I->first, I->second);
40  }
41
42  return Store;
43}
44
45const MemRegion *StoreManager::MakeElementRegion(const MemRegion *Base,
46                                              QualType EleTy, uint64_t index) {
47  NonLoc idx = svalBuilder.makeArrayIndex(index);
48  return MRMgr.getElementRegion(EleTy, idx, Base, svalBuilder.getContext());
49}
50
51// FIXME: Merge with the implementation of the same method in MemRegion.cpp
52static bool IsCompleteType(ASTContext &Ctx, QualType Ty) {
53  if (const RecordType *RT = Ty->getAs<RecordType>()) {
54    const RecordDecl *D = RT->getDecl();
55    if (!D->getDefinition())
56      return false;
57  }
58
59  return true;
60}
61
62StoreRef StoreManager::BindDefault(Store store, const MemRegion *R, SVal V) {
63  return StoreRef(store, *this);
64}
65
66const ElementRegion *StoreManager::GetElementZeroRegion(const MemRegion *R,
67                                                        QualType T) {
68  NonLoc idx = svalBuilder.makeZeroArrayIndex();
69  assert(!T.isNull());
70  return MRMgr.getElementRegion(T, idx, R, Ctx);
71}
72
73const MemRegion *StoreManager::castRegion(const MemRegion *R, QualType CastToTy) {
74
75  ASTContext &Ctx = StateMgr.getContext();
76
77  // Handle casts to Objective-C objects.
78  if (CastToTy->isObjCObjectPointerType())
79    return R->StripCasts();
80
81  if (CastToTy->isBlockPointerType()) {
82    // FIXME: We may need different solutions, depending on the symbol
83    // involved.  Blocks can be casted to/from 'id', as they can be treated
84    // as Objective-C objects.  This could possibly be handled by enhancing
85    // our reasoning of downcasts of symbolic objects.
86    if (isa<CodeTextRegion>(R) || isa<SymbolicRegion>(R))
87      return R;
88
89    // We don't know what to make of it.  Return a NULL region, which
90    // will be interpretted as UnknownVal.
91    return nullptr;
92  }
93
94  // Now assume we are casting from pointer to pointer. Other cases should
95  // already be handled.
96  QualType PointeeTy = CastToTy->getPointeeType();
97  QualType CanonPointeeTy = Ctx.getCanonicalType(PointeeTy);
98
99  // Handle casts to void*.  We just pass the region through.
100  if (CanonPointeeTy.getLocalUnqualifiedType() == Ctx.VoidTy)
101    return R;
102
103  // Handle casts from compatible types.
104  if (R->isBoundable())
105    if (const TypedValueRegion *TR = dyn_cast<TypedValueRegion>(R)) {
106      QualType ObjTy = Ctx.getCanonicalType(TR->getValueType());
107      if (CanonPointeeTy == ObjTy)
108        return R;
109    }
110
111  // Process region cast according to the kind of the region being cast.
112  switch (R->getKind()) {
113    case MemRegion::CXXThisRegionKind:
114    case MemRegion::GenericMemSpaceRegionKind:
115    case MemRegion::StackLocalsSpaceRegionKind:
116    case MemRegion::StackArgumentsSpaceRegionKind:
117    case MemRegion::HeapSpaceRegionKind:
118    case MemRegion::UnknownSpaceRegionKind:
119    case MemRegion::StaticGlobalSpaceRegionKind:
120    case MemRegion::GlobalInternalSpaceRegionKind:
121    case MemRegion::GlobalSystemSpaceRegionKind:
122    case MemRegion::GlobalImmutableSpaceRegionKind: {
123      llvm_unreachable("Invalid region cast");
124    }
125
126    case MemRegion::FunctionTextRegionKind:
127    case MemRegion::BlockTextRegionKind:
128    case MemRegion::BlockDataRegionKind:
129    case MemRegion::StringRegionKind:
130      // FIXME: Need to handle arbitrary downcasts.
131    case MemRegion::SymbolicRegionKind:
132    case MemRegion::AllocaRegionKind:
133    case MemRegion::CompoundLiteralRegionKind:
134    case MemRegion::FieldRegionKind:
135    case MemRegion::ObjCIvarRegionKind:
136    case MemRegion::ObjCStringRegionKind:
137    case MemRegion::VarRegionKind:
138    case MemRegion::CXXTempObjectRegionKind:
139    case MemRegion::CXXBaseObjectRegionKind:
140      return MakeElementRegion(R, PointeeTy);
141
142    case MemRegion::ElementRegionKind: {
143      // If we are casting from an ElementRegion to another type, the
144      // algorithm is as follows:
145      //
146      // (1) Compute the "raw offset" of the ElementRegion from the
147      //     base region.  This is done by calling 'getAsRawOffset()'.
148      //
149      // (2a) If we get a 'RegionRawOffset' after calling
150      //      'getAsRawOffset()', determine if the absolute offset
151      //      can be exactly divided into chunks of the size of the
152      //      casted-pointee type.  If so, create a new ElementRegion with
153      //      the pointee-cast type as the new ElementType and the index
154      //      being the offset divded by the chunk size.  If not, create
155      //      a new ElementRegion at offset 0 off the raw offset region.
156      //
157      // (2b) If we don't a get a 'RegionRawOffset' after calling
158      //      'getAsRawOffset()', it means that we are at offset 0.
159      //
160      // FIXME: Handle symbolic raw offsets.
161
162      const ElementRegion *elementR = cast<ElementRegion>(R);
163      const RegionRawOffset &rawOff = elementR->getAsArrayOffset();
164      const MemRegion *baseR = rawOff.getRegion();
165
166      // If we cannot compute a raw offset, throw up our hands and return
167      // a NULL MemRegion*.
168      if (!baseR)
169        return nullptr;
170
171      CharUnits off = rawOff.getOffset();
172
173      if (off.isZero()) {
174        // Edge case: we are at 0 bytes off the beginning of baseR.  We
175        // check to see if type we are casting to is the same as the base
176        // region.  If so, just return the base region.
177        if (const TypedValueRegion *TR = dyn_cast<TypedValueRegion>(baseR)) {
178          QualType ObjTy = Ctx.getCanonicalType(TR->getValueType());
179          QualType CanonPointeeTy = Ctx.getCanonicalType(PointeeTy);
180          if (CanonPointeeTy == ObjTy)
181            return baseR;
182        }
183
184        // Otherwise, create a new ElementRegion at offset 0.
185        return MakeElementRegion(baseR, PointeeTy);
186      }
187
188      // We have a non-zero offset from the base region.  We want to determine
189      // if the offset can be evenly divided by sizeof(PointeeTy).  If so,
190      // we create an ElementRegion whose index is that value.  Otherwise, we
191      // create two ElementRegions, one that reflects a raw offset and the other
192      // that reflects the cast.
193
194      // Compute the index for the new ElementRegion.
195      int64_t newIndex = 0;
196      const MemRegion *newSuperR = nullptr;
197
198      // We can only compute sizeof(PointeeTy) if it is a complete type.
199      if (IsCompleteType(Ctx, PointeeTy)) {
200        // Compute the size in **bytes**.
201        CharUnits pointeeTySize = Ctx.getTypeSizeInChars(PointeeTy);
202        if (!pointeeTySize.isZero()) {
203          // Is the offset a multiple of the size?  If so, we can layer the
204          // ElementRegion (with elementType == PointeeTy) directly on top of
205          // the base region.
206          if (off % pointeeTySize == 0) {
207            newIndex = off / pointeeTySize;
208            newSuperR = baseR;
209          }
210        }
211      }
212
213      if (!newSuperR) {
214        // Create an intermediate ElementRegion to represent the raw byte.
215        // This will be the super region of the final ElementRegion.
216        newSuperR = MakeElementRegion(baseR, Ctx.CharTy, off.getQuantity());
217      }
218
219      return MakeElementRegion(newSuperR, PointeeTy, newIndex);
220    }
221  }
222
223  llvm_unreachable("unreachable");
224}
225
226static bool regionMatchesCXXRecordType(SVal V, QualType Ty) {
227  const MemRegion *MR = V.getAsRegion();
228  if (!MR)
229    return true;
230
231  const TypedValueRegion *TVR = dyn_cast<TypedValueRegion>(MR);
232  if (!TVR)
233    return true;
234
235  const CXXRecordDecl *RD = TVR->getValueType()->getAsCXXRecordDecl();
236  if (!RD)
237    return true;
238
239  const CXXRecordDecl *Expected = Ty->getPointeeCXXRecordDecl();
240  if (!Expected)
241    Expected = Ty->getAsCXXRecordDecl();
242
243  return Expected->getCanonicalDecl() == RD->getCanonicalDecl();
244}
245
246SVal StoreManager::evalDerivedToBase(SVal Derived, const CastExpr *Cast) {
247  // Sanity check to avoid doing the wrong thing in the face of
248  // reinterpret_cast.
249  if (!regionMatchesCXXRecordType(Derived, Cast->getSubExpr()->getType()))
250    return UnknownVal();
251
252  // Walk through the cast path to create nested CXXBaseRegions.
253  SVal Result = Derived;
254  for (CastExpr::path_const_iterator I = Cast->path_begin(),
255                                     E = Cast->path_end();
256       I != E; ++I) {
257    Result = evalDerivedToBase(Result, (*I)->getType(), (*I)->isVirtual());
258  }
259  return Result;
260}
261
262SVal StoreManager::evalDerivedToBase(SVal Derived, const CXXBasePath &Path) {
263  // Walk through the path to create nested CXXBaseRegions.
264  SVal Result = Derived;
265  for (CXXBasePath::const_iterator I = Path.begin(), E = Path.end();
266       I != E; ++I) {
267    Result = evalDerivedToBase(Result, I->Base->getType(),
268                               I->Base->isVirtual());
269  }
270  return Result;
271}
272
273SVal StoreManager::evalDerivedToBase(SVal Derived, QualType BaseType,
274                                     bool IsVirtual) {
275  Optional<loc::MemRegionVal> DerivedRegVal =
276      Derived.getAs<loc::MemRegionVal>();
277  if (!DerivedRegVal)
278    return Derived;
279
280  const CXXRecordDecl *BaseDecl = BaseType->getPointeeCXXRecordDecl();
281  if (!BaseDecl)
282    BaseDecl = BaseType->getAsCXXRecordDecl();
283  assert(BaseDecl && "not a C++ object?");
284
285  const MemRegion *BaseReg =
286    MRMgr.getCXXBaseObjectRegion(BaseDecl, DerivedRegVal->getRegion(),
287                                 IsVirtual);
288
289  return loc::MemRegionVal(BaseReg);
290}
291
292/// Returns the static type of the given region, if it represents a C++ class
293/// object.
294///
295/// This handles both fully-typed regions, where the dynamic type is known, and
296/// symbolic regions, where the dynamic type is merely bounded (and even then,
297/// only ostensibly!), but does not take advantage of any dynamic type info.
298static const CXXRecordDecl *getCXXRecordType(const MemRegion *MR) {
299  if (const TypedValueRegion *TVR = dyn_cast<TypedValueRegion>(MR))
300    return TVR->getValueType()->getAsCXXRecordDecl();
301  if (const SymbolicRegion *SR = dyn_cast<SymbolicRegion>(MR))
302    return SR->getSymbol()->getType()->getPointeeCXXRecordDecl();
303  return nullptr;
304}
305
306SVal StoreManager::evalDynamicCast(SVal Base, QualType TargetType,
307                                   bool &Failed) {
308  Failed = false;
309
310  const MemRegion *MR = Base.getAsRegion();
311  if (!MR)
312    return UnknownVal();
313
314  // Assume the derived class is a pointer or a reference to a CXX record.
315  TargetType = TargetType->getPointeeType();
316  assert(!TargetType.isNull());
317  const CXXRecordDecl *TargetClass = TargetType->getAsCXXRecordDecl();
318  if (!TargetClass && !TargetType->isVoidType())
319    return UnknownVal();
320
321  // Drill down the CXXBaseObject chains, which represent upcasts (casts from
322  // derived to base).
323  while (const CXXRecordDecl *MRClass = getCXXRecordType(MR)) {
324    // If found the derived class, the cast succeeds.
325    if (MRClass == TargetClass)
326      return loc::MemRegionVal(MR);
327
328    // We skip over incomplete types. They must be the result of an earlier
329    // reinterpret_cast, as one can only dynamic_cast between types in the same
330    // class hierarchy.
331    if (!TargetType->isVoidType() && MRClass->hasDefinition()) {
332      // Static upcasts are marked as DerivedToBase casts by Sema, so this will
333      // only happen when multiple or virtual inheritance is involved.
334      CXXBasePaths Paths(/*FindAmbiguities=*/false, /*RecordPaths=*/true,
335                         /*DetectVirtual=*/false);
336      if (MRClass->isDerivedFrom(TargetClass, Paths))
337        return evalDerivedToBase(loc::MemRegionVal(MR), Paths.front());
338    }
339
340    if (const CXXBaseObjectRegion *BaseR = dyn_cast<CXXBaseObjectRegion>(MR)) {
341      // Drill down the chain to get the derived classes.
342      MR = BaseR->getSuperRegion();
343      continue;
344    }
345
346    // If this is a cast to void*, return the region.
347    if (TargetType->isVoidType())
348      return loc::MemRegionVal(MR);
349
350    // Strange use of reinterpret_cast can give us paths we don't reason
351    // about well, by putting in ElementRegions where we'd expect
352    // CXXBaseObjectRegions. If it's a valid reinterpret_cast (i.e. if the
353    // derived class has a zero offset from the base class), then it's safe
354    // to strip the cast; if it's invalid, -Wreinterpret-base-class should
355    // catch it. In the interest of performance, the analyzer will silently
356    // do the wrong thing in the invalid case (because offsets for subregions
357    // will be wrong).
358    const MemRegion *Uncasted = MR->StripCasts(/*IncludeBaseCasts=*/false);
359    if (Uncasted == MR) {
360      // We reached the bottom of the hierarchy and did not find the derived
361      // class. We we must be casting the base to derived, so the cast should
362      // fail.
363      break;
364    }
365
366    MR = Uncasted;
367  }
368
369  // We failed if the region we ended up with has perfect type info.
370  Failed = isa<TypedValueRegion>(MR);
371  return UnknownVal();
372}
373
374
375/// CastRetrievedVal - Used by subclasses of StoreManager to implement
376///  implicit casts that arise from loads from regions that are reinterpreted
377///  as another region.
378SVal StoreManager::CastRetrievedVal(SVal V, const TypedValueRegion *R,
379                                    QualType castTy, bool performTestOnly) {
380
381  if (castTy.isNull() || V.isUnknownOrUndef())
382    return V;
383
384  ASTContext &Ctx = svalBuilder.getContext();
385
386  if (performTestOnly) {
387    // Automatically translate references to pointers.
388    QualType T = R->getValueType();
389    if (const ReferenceType *RT = T->getAs<ReferenceType>())
390      T = Ctx.getPointerType(RT->getPointeeType());
391
392    assert(svalBuilder.getContext().hasSameUnqualifiedType(castTy, T));
393    return V;
394  }
395
396  return svalBuilder.dispatchCast(V, castTy);
397}
398
399SVal StoreManager::getLValueFieldOrIvar(const Decl *D, SVal Base) {
400  if (Base.isUnknownOrUndef())
401    return Base;
402
403  Loc BaseL = Base.castAs<Loc>();
404  const MemRegion* BaseR = nullptr;
405
406  switch (BaseL.getSubKind()) {
407  case loc::MemRegionKind:
408    BaseR = BaseL.castAs<loc::MemRegionVal>().getRegion();
409    break;
410
411  case loc::GotoLabelKind:
412    // These are anormal cases. Flag an undefined value.
413    return UndefinedVal();
414
415  case loc::ConcreteIntKind:
416    // While these seem funny, this can happen through casts.
417    // FIXME: What we should return is the field offset.  For example,
418    //  add the field offset to the integer value.  That way funny things
419    //  like this work properly:  &(((struct foo *) 0xa)->f)
420    return Base;
421
422  default:
423    llvm_unreachable("Unhandled Base.");
424  }
425
426  // NOTE: We must have this check first because ObjCIvarDecl is a subclass
427  // of FieldDecl.
428  if (const ObjCIvarDecl *ID = dyn_cast<ObjCIvarDecl>(D))
429    return loc::MemRegionVal(MRMgr.getObjCIvarRegion(ID, BaseR));
430
431  return loc::MemRegionVal(MRMgr.getFieldRegion(cast<FieldDecl>(D), BaseR));
432}
433
434SVal StoreManager::getLValueIvar(const ObjCIvarDecl *decl, SVal base) {
435  return getLValueFieldOrIvar(decl, base);
436}
437
438SVal StoreManager::getLValueElement(QualType elementType, NonLoc Offset,
439                                    SVal Base) {
440
441  // If the base is an unknown or undefined value, just return it back.
442  // FIXME: For absolute pointer addresses, we just return that value back as
443  //  well, although in reality we should return the offset added to that
444  //  value.
445  if (Base.isUnknownOrUndef() || Base.getAs<loc::ConcreteInt>())
446    return Base;
447
448  const MemRegion* BaseRegion = Base.castAs<loc::MemRegionVal>().getRegion();
449
450  // Pointer of any type can be cast and used as array base.
451  const ElementRegion *ElemR = dyn_cast<ElementRegion>(BaseRegion);
452
453  // Convert the offset to the appropriate size and signedness.
454  Offset = svalBuilder.convertToArrayIndex(Offset).castAs<NonLoc>();
455
456  if (!ElemR) {
457    //
458    // If the base region is not an ElementRegion, create one.
459    // This can happen in the following example:
460    //
461    //   char *p = __builtin_alloc(10);
462    //   p[1] = 8;
463    //
464    //  Observe that 'p' binds to an AllocaRegion.
465    //
466    return loc::MemRegionVal(MRMgr.getElementRegion(elementType, Offset,
467                                                    BaseRegion, Ctx));
468  }
469
470  SVal BaseIdx = ElemR->getIndex();
471
472  if (!BaseIdx.getAs<nonloc::ConcreteInt>())
473    return UnknownVal();
474
475  const llvm::APSInt &BaseIdxI =
476      BaseIdx.castAs<nonloc::ConcreteInt>().getValue();
477
478  // Only allow non-integer offsets if the base region has no offset itself.
479  // FIXME: This is a somewhat arbitrary restriction. We should be using
480  // SValBuilder here to add the two offsets without checking their types.
481  if (!Offset.getAs<nonloc::ConcreteInt>()) {
482    if (isa<ElementRegion>(BaseRegion->StripCasts()))
483      return UnknownVal();
484
485    return loc::MemRegionVal(MRMgr.getElementRegion(elementType, Offset,
486                                                    ElemR->getSuperRegion(),
487                                                    Ctx));
488  }
489
490  const llvm::APSInt& OffI = Offset.castAs<nonloc::ConcreteInt>().getValue();
491  assert(BaseIdxI.isSigned());
492
493  // Compute the new index.
494  nonloc::ConcreteInt NewIdx(svalBuilder.getBasicValueFactory().getValue(BaseIdxI +
495                                                                    OffI));
496
497  // Construct the new ElementRegion.
498  const MemRegion *ArrayR = ElemR->getSuperRegion();
499  return loc::MemRegionVal(MRMgr.getElementRegion(elementType, NewIdx, ArrayR,
500                                                  Ctx));
501}
502
503StoreManager::BindingsHandler::~BindingsHandler() {}
504
505bool StoreManager::FindUniqueBinding::HandleBinding(StoreManager& SMgr,
506                                                    Store store,
507                                                    const MemRegion* R,
508                                                    SVal val) {
509  SymbolRef SymV = val.getAsLocSymbol();
510  if (!SymV || SymV != Sym)
511    return true;
512
513  if (Binding) {
514    First = false;
515    return false;
516  }
517  else
518    Binding = R;
519
520  return true;
521}
522