Store.cpp revision 9b663716449b618ba0390b1dbebc54fa8e971124
1c62abc1012feb0b15eff091b02c176649766a347Ted Kremenek//== Store.cpp - Interface for maps from Locations to Values ----*- C++ -*--==// 2c62abc1012feb0b15eff091b02c176649766a347Ted Kremenek// 3c62abc1012feb0b15eff091b02c176649766a347Ted Kremenek// The LLVM Compiler Infrastructure 4c62abc1012feb0b15eff091b02c176649766a347Ted Kremenek// 5c62abc1012feb0b15eff091b02c176649766a347Ted Kremenek// This file is distributed under the University of Illinois Open Source 6c62abc1012feb0b15eff091b02c176649766a347Ted Kremenek// License. See LICENSE.TXT for details. 7c62abc1012feb0b15eff091b02c176649766a347Ted Kremenek// 8c62abc1012feb0b15eff091b02c176649766a347Ted Kremenek//===----------------------------------------------------------------------===// 9c62abc1012feb0b15eff091b02c176649766a347Ted Kremenek// 10c62abc1012feb0b15eff091b02c176649766a347Ted Kremenek// This file defined the types Store and StoreManager. 11c62abc1012feb0b15eff091b02c176649766a347Ted Kremenek// 12c62abc1012feb0b15eff091b02c176649766a347Ted Kremenek//===----------------------------------------------------------------------===// 13c62abc1012feb0b15eff091b02c176649766a347Ted Kremenek 149b663716449b618ba0390b1dbebc54fa8e971124Ted Kremenek#include "clang/StaticAnalyzer/Core/PathSensitive/Store.h" 159b663716449b618ba0390b1dbebc54fa8e971124Ted Kremenek#include "clang/StaticAnalyzer/Core/PathSensitive/GRState.h" 16199c3d6cd16aebbb9c7f0d42af9d922c9628bf70Ken Dyck#include "clang/AST/CharUnits.h" 17c62abc1012feb0b15eff091b02c176649766a347Ted Kremenek 18c62abc1012feb0b15eff091b02c176649766a347Ted Kremenekusing namespace clang; 199ef6537a894c33003359b1f9b9676e9178e028b7Ted Kremenekusing namespace ento; 20c62abc1012feb0b15eff091b02c176649766a347Ted Kremenek 21f7a0cf426eddae76e1a71dd2295631a2cf0560afTed KremenekStoreManager::StoreManager(GRStateManager &stateMgr) 22c8413fd03f73084a5c93028f8b4db619fc388087Ted Kremenek : svalBuilder(stateMgr.getSValBuilder()), StateMgr(stateMgr), 23c8413fd03f73084a5c93028f8b4db619fc388087Ted Kremenek MRMgr(svalBuilder.getRegionManager()), Ctx(stateMgr.getContext()) {} 24c62abc1012feb0b15eff091b02c176649766a347Ted Kremenek 252ccf047adf877f5e821210b1ce1a2c8289acadc0Ted KremenekStore StoreManager::enterStackFrame(const GRState *state, 26ff59efd65bb1f2f8d005079597f814a3c8381f95Jordy Rose const StackFrameContext *frame) { 27ff59efd65bb1f2f8d005079597f814a3c8381f95Jordy Rose return state->getStore(); 28ff59efd65bb1f2f8d005079597f814a3c8381f95Jordy Rose} 29ff59efd65bb1f2f8d005079597f814a3c8381f95Jordy Rose 3009270cc1b9cdd4c50012cb7984df8745e05833e5Zhongxing Xuconst MemRegion *StoreManager::MakeElementRegion(const MemRegion *Base, 31652be346f74feba027bcbdeb6a3e3f4755a0e62cZhongxing Xu QualType EleTy, uint64_t index) { 32c8413fd03f73084a5c93028f8b4db619fc388087Ted Kremenek NonLoc idx = svalBuilder.makeArrayIndex(index); 33c8413fd03f73084a5c93028f8b4db619fc388087Ted Kremenek return MRMgr.getElementRegion(EleTy, idx, Base, svalBuilder.getContext()); 34411af40d038947b6d2a8ad9549c85c1c4c52d15aTed Kremenek} 35411af40d038947b6d2a8ad9549c85c1c4c52d15aTed Kremenek 3619e1f0ba5cec738ce6cebe3fe0e1edc782206494Ted Kremenek// FIXME: Merge with the implementation of the same method in MemRegion.cpp 37169077dde4d91270a7495793f1e00b22aa0bc7caTed Kremenekstatic bool IsCompleteType(ASTContext &Ctx, QualType Ty) { 386217b80b7a1379b74cced1c076338262c3c980b3Ted Kremenek if (const RecordType *RT = Ty->getAs<RecordType>()) { 39169077dde4d91270a7495793f1e00b22aa0bc7caTed Kremenek const RecordDecl *D = RT->getDecl(); 40952b017601f9c82b51119c3a1600f1312a833db9Douglas Gregor if (!D->getDefinition()) 41169077dde4d91270a7495793f1e00b22aa0bc7caTed Kremenek return false; 42169077dde4d91270a7495793f1e00b22aa0bc7caTed Kremenek } 431eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 44169077dde4d91270a7495793f1e00b22aa0bc7caTed Kremenek return true; 45169077dde4d91270a7495793f1e00b22aa0bc7caTed Kremenek} 46169077dde4d91270a7495793f1e00b22aa0bc7caTed Kremenek 47856c6bcaea56e05255e9f3997ddd56b5c18a14f0Zhongxing Xuconst ElementRegion *StoreManager::GetElementZeroRegion(const MemRegion *R, 48856c6bcaea56e05255e9f3997ddd56b5c18a14f0Zhongxing Xu QualType T) { 49c8413fd03f73084a5c93028f8b4db619fc388087Ted Kremenek NonLoc idx = svalBuilder.makeZeroArrayIndex(); 50856c6bcaea56e05255e9f3997ddd56b5c18a14f0Zhongxing Xu assert(!T.isNull()); 51856c6bcaea56e05255e9f3997ddd56b5c18a14f0Zhongxing Xu return MRMgr.getElementRegion(T, idx, R, Ctx); 52856c6bcaea56e05255e9f3997ddd56b5c18a14f0Zhongxing Xu} 53856c6bcaea56e05255e9f3997ddd56b5c18a14f0Zhongxing Xu 5409270cc1b9cdd4c50012cb7984df8745e05833e5Zhongxing Xuconst MemRegion *StoreManager::CastRegion(const MemRegion *R, QualType CastToTy) { 551eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 5648ce7deb86ffb1e028ac9a8e7cddffc32843c26cTed Kremenek ASTContext& Ctx = StateMgr.getContext(); 571eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 58b9a44250c502cf9f9a2c18ccd50f06158dd7357bTed Kremenek // Handle casts to Objective-C objects. 5919e1f0ba5cec738ce6cebe3fe0e1edc782206494Ted Kremenek if (CastToTy->isObjCObjectPointerType()) 60479529e679957fbb92b56e116e3c86734429331eZhongxing Xu return R->StripCasts(); 6119e1f0ba5cec738ce6cebe3fe0e1edc782206494Ted Kremenek 6263b9cfe8f2aaec53710b59e565bb8d5afb558b40Ted Kremenek if (CastToTy->isBlockPointerType()) { 63abd46e13cfd48f2c9bf26d9759edb4366aaa6d5bTed Kremenek // FIXME: We may need different solutions, depending on the symbol 6463b9cfe8f2aaec53710b59e565bb8d5afb558b40Ted Kremenek // involved. Blocks can be casted to/from 'id', as they can be treated 65abd46e13cfd48f2c9bf26d9759edb4366aaa6d5bTed Kremenek // as Objective-C objects. This could possibly be handled by enhancing 661eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump // our reasoning of downcasts of symbolic objects. 67abd46e13cfd48f2c9bf26d9759edb4366aaa6d5bTed Kremenek if (isa<CodeTextRegion>(R) || isa<SymbolicRegion>(R)) 6809270cc1b9cdd4c50012cb7984df8745e05833e5Zhongxing Xu return R; 6963b9cfe8f2aaec53710b59e565bb8d5afb558b40Ted Kremenek 7063b9cfe8f2aaec53710b59e565bb8d5afb558b40Ted Kremenek // We don't know what to make of it. Return a NULL region, which 7163b9cfe8f2aaec53710b59e565bb8d5afb558b40Ted Kremenek // will be interpretted as UnknownVal. 7209270cc1b9cdd4c50012cb7984df8745e05833e5Zhongxing Xu return NULL; 7363b9cfe8f2aaec53710b59e565bb8d5afb558b40Ted Kremenek } 74411af40d038947b6d2a8ad9549c85c1c4c52d15aTed Kremenek 7548ce7deb86ffb1e028ac9a8e7cddffc32843c26cTed Kremenek // Now assume we are casting from pointer to pointer. Other cases should 7648ce7deb86ffb1e028ac9a8e7cddffc32843c26cTed Kremenek // already be handled. 776217b80b7a1379b74cced1c076338262c3c980b3Ted Kremenek QualType PointeeTy = CastToTy->getAs<PointerType>()->getPointeeType(); 789a108eb88f93c524dfa5fb2c3fea3896b1eb6525Ted Kremenek QualType CanonPointeeTy = Ctx.getCanonicalType(PointeeTy); 799a108eb88f93c524dfa5fb2c3fea3896b1eb6525Ted Kremenek 809a108eb88f93c524dfa5fb2c3fea3896b1eb6525Ted Kremenek // Handle casts to void*. We just pass the region through. 81a4923eb7c4b04d360cb2747641a5e92818edf804Douglas Gregor if (CanonPointeeTy.getLocalUnqualifiedType() == Ctx.VoidTy) 8209270cc1b9cdd4c50012cb7984df8745e05833e5Zhongxing Xu return R; 831eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 849a108eb88f93c524dfa5fb2c3fea3896b1eb6525Ted Kremenek // Handle casts from compatible types. 8519e1f0ba5cec738ce6cebe3fe0e1edc782206494Ted Kremenek if (R->isBoundable()) 8619e1f0ba5cec738ce6cebe3fe0e1edc782206494Ted Kremenek if (const TypedRegion *TR = dyn_cast<TypedRegion>(R)) { 87018220c343c103b7dfaa117a7a474c7a7fd6d068Zhongxing Xu QualType ObjTy = Ctx.getCanonicalType(TR->getValueType()); 889a108eb88f93c524dfa5fb2c3fea3896b1eb6525Ted Kremenek if (CanonPointeeTy == ObjTy) 8909270cc1b9cdd4c50012cb7984df8745e05833e5Zhongxing Xu return R; 9019e1f0ba5cec738ce6cebe3fe0e1edc782206494Ted Kremenek } 9119e1f0ba5cec738ce6cebe3fe0e1edc782206494Ted Kremenek 9248ce7deb86ffb1e028ac9a8e7cddffc32843c26cTed Kremenek // Process region cast according to the kind of the region being cast. 93fc8f57c31d8336db0ccb2ce8eb9ebf52228a47c1Ted Kremenek switch (R->getKind()) { 94de0d26310191215a6d1d189dc419f87af18ce6beTed Kremenek case MemRegion::CXXThisRegionKind: 9567d1287035767f4f6c8ca0c2bb755990012a44caTed Kremenek case MemRegion::GenericMemSpaceRegionKind: 9667d1287035767f4f6c8ca0c2bb755990012a44caTed Kremenek case MemRegion::StackLocalsSpaceRegionKind: 9767d1287035767f4f6c8ca0c2bb755990012a44caTed Kremenek case MemRegion::StackArgumentsSpaceRegionKind: 9867d1287035767f4f6c8ca0c2bb755990012a44caTed Kremenek case MemRegion::HeapSpaceRegionKind: 992b87ae45e129b941d0a4d221c9d4842385a119bdTed Kremenek case MemRegion::UnknownSpaceRegionKind: 100dcee3ce97fc76f20ce8f5a7451071e3dec537073Ted Kremenek case MemRegion::NonStaticGlobalSpaceRegionKind: 101dcee3ce97fc76f20ce8f5a7451071e3dec537073Ted Kremenek case MemRegion::StaticGlobalSpaceRegionKind: { 102fc8f57c31d8336db0ccb2ce8eb9ebf52228a47c1Ted Kremenek assert(0 && "Invalid region cast"); 103fc8f57c31d8336db0ccb2ce8eb9ebf52228a47c1Ted Kremenek break; 1041eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump } 1051e4a32acfad6a9f4cf555fdbc5c6c44c558b9fcbTed Kremenek 106eb1c7a04509f5d25c09005a6d46bd8bbb3ca88cbTed Kremenek case MemRegion::FunctionTextRegionKind: 107bf0fe6c5b7bd7bc67b6b3ef0acb22bf4811f2a1bTed Kremenek case MemRegion::BlockTextRegionKind: 1081e4a32acfad6a9f4cf555fdbc5c6c44c558b9fcbTed Kremenek case MemRegion::BlockDataRegionKind: 109fc8f57c31d8336db0ccb2ce8eb9ebf52228a47c1Ted Kremenek case MemRegion::StringRegionKind: 110fc8f57c31d8336db0ccb2ce8eb9ebf52228a47c1Ted Kremenek // FIXME: Need to handle arbitrary downcasts. 11119e1f0ba5cec738ce6cebe3fe0e1edc782206494Ted Kremenek case MemRegion::SymbolicRegionKind: 11219e1f0ba5cec738ce6cebe3fe0e1edc782206494Ted Kremenek case MemRegion::AllocaRegionKind: 113fc8f57c31d8336db0ccb2ce8eb9ebf52228a47c1Ted Kremenek case MemRegion::CompoundLiteralRegionKind: 114fc8f57c31d8336db0ccb2ce8eb9ebf52228a47c1Ted Kremenek case MemRegion::FieldRegionKind: 115fc8f57c31d8336db0ccb2ce8eb9ebf52228a47c1Ted Kremenek case MemRegion::ObjCIvarRegionKind: 1161eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump case MemRegion::VarRegionKind: 11702fe28c8a6da29d4ad88d0900c133dcf22d24a75Zhongxing Xu case MemRegion::CXXTempObjectRegionKind: 11802fe28c8a6da29d4ad88d0900c133dcf22d24a75Zhongxing Xu case MemRegion::CXXBaseObjectRegionKind: 11909270cc1b9cdd4c50012cb7984df8745e05833e5Zhongxing Xu return MakeElementRegion(R, PointeeTy); 1201eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 12119e1f0ba5cec738ce6cebe3fe0e1edc782206494Ted Kremenek case MemRegion::ElementRegionKind: { 12219e1f0ba5cec738ce6cebe3fe0e1edc782206494Ted Kremenek // If we are casting from an ElementRegion to another type, the 12319e1f0ba5cec738ce6cebe3fe0e1edc782206494Ted Kremenek // algorithm is as follows: 12419e1f0ba5cec738ce6cebe3fe0e1edc782206494Ted Kremenek // 12519e1f0ba5cec738ce6cebe3fe0e1edc782206494Ted Kremenek // (1) Compute the "raw offset" of the ElementRegion from the 12619e1f0ba5cec738ce6cebe3fe0e1edc782206494Ted Kremenek // base region. This is done by calling 'getAsRawOffset()'. 12719e1f0ba5cec738ce6cebe3fe0e1edc782206494Ted Kremenek // 1281eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump // (2a) If we get a 'RegionRawOffset' after calling 12919e1f0ba5cec738ce6cebe3fe0e1edc782206494Ted Kremenek // 'getAsRawOffset()', determine if the absolute offset 1301eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump // can be exactly divided into chunks of the size of the 1311eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump // casted-pointee type. If so, create a new ElementRegion with 13219e1f0ba5cec738ce6cebe3fe0e1edc782206494Ted Kremenek // the pointee-cast type as the new ElementType and the index 13319e1f0ba5cec738ce6cebe3fe0e1edc782206494Ted Kremenek // being the offset divded by the chunk size. If not, create 13419e1f0ba5cec738ce6cebe3fe0e1edc782206494Ted Kremenek // a new ElementRegion at offset 0 off the raw offset region. 13519e1f0ba5cec738ce6cebe3fe0e1edc782206494Ted Kremenek // 13619e1f0ba5cec738ce6cebe3fe0e1edc782206494Ted Kremenek // (2b) If we don't a get a 'RegionRawOffset' after calling 13719e1f0ba5cec738ce6cebe3fe0e1edc782206494Ted Kremenek // 'getAsRawOffset()', it means that we are at offset 0. 1381eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump // 13919e1f0ba5cec738ce6cebe3fe0e1edc782206494Ted Kremenek // FIXME: Handle symbolic raw offsets. 1401eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 14119e1f0ba5cec738ce6cebe3fe0e1edc782206494Ted Kremenek const ElementRegion *elementR = cast<ElementRegion>(R); 1427caf9b369cba6edaf6eac25121cbc65ee938f14dZhongxing Xu const RegionRawOffset &rawOff = elementR->getAsArrayOffset(); 14319e1f0ba5cec738ce6cebe3fe0e1edc782206494Ted Kremenek const MemRegion *baseR = rawOff.getRegion(); 1441eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 14519e1f0ba5cec738ce6cebe3fe0e1edc782206494Ted Kremenek // If we cannot compute a raw offset, throw up our hands and return 14619e1f0ba5cec738ce6cebe3fe0e1edc782206494Ted Kremenek // a NULL MemRegion*. 14719e1f0ba5cec738ce6cebe3fe0e1edc782206494Ted Kremenek if (!baseR) 14809270cc1b9cdd4c50012cb7984df8745e05833e5Zhongxing Xu return NULL; 1491eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 1509ff2b13aee0f89d23ef4820218f9b88bb5e5c1c1Ken Dyck CharUnits off = rawOff.getOffset(); 1511eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 152199c3d6cd16aebbb9c7f0d42af9d922c9628bf70Ken Dyck if (off.isZero()) { 15319e1f0ba5cec738ce6cebe3fe0e1edc782206494Ted Kremenek // Edge case: we are at 0 bytes off the beginning of baseR. We 15419e1f0ba5cec738ce6cebe3fe0e1edc782206494Ted Kremenek // check to see if type we are casting to is the same as the base 1551eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump // region. If so, just return the base region. 15619e1f0ba5cec738ce6cebe3fe0e1edc782206494Ted Kremenek if (const TypedRegion *TR = dyn_cast<TypedRegion>(baseR)) { 157018220c343c103b7dfaa117a7a474c7a7fd6d068Zhongxing Xu QualType ObjTy = Ctx.getCanonicalType(TR->getValueType()); 15819e1f0ba5cec738ce6cebe3fe0e1edc782206494Ted Kremenek QualType CanonPointeeTy = Ctx.getCanonicalType(PointeeTy); 15919e1f0ba5cec738ce6cebe3fe0e1edc782206494Ted Kremenek if (CanonPointeeTy == ObjTy) 16009270cc1b9cdd4c50012cb7984df8745e05833e5Zhongxing Xu return baseR; 16119e1f0ba5cec738ce6cebe3fe0e1edc782206494Ted Kremenek } 1621eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 16319e1f0ba5cec738ce6cebe3fe0e1edc782206494Ted Kremenek // Otherwise, create a new ElementRegion at offset 0. 16409270cc1b9cdd4c50012cb7984df8745e05833e5Zhongxing Xu return MakeElementRegion(baseR, PointeeTy); 165169077dde4d91270a7495793f1e00b22aa0bc7caTed Kremenek } 1661eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 16719e1f0ba5cec738ce6cebe3fe0e1edc782206494Ted Kremenek // We have a non-zero offset from the base region. We want to determine 16819e1f0ba5cec738ce6cebe3fe0e1edc782206494Ted Kremenek // if the offset can be evenly divided by sizeof(PointeeTy). If so, 16919e1f0ba5cec738ce6cebe3fe0e1edc782206494Ted Kremenek // we create an ElementRegion whose index is that value. Otherwise, we 17019e1f0ba5cec738ce6cebe3fe0e1edc782206494Ted Kremenek // create two ElementRegions, one that reflects a raw offset and the other 17119e1f0ba5cec738ce6cebe3fe0e1edc782206494Ted Kremenek // that reflects the cast. 1721eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 17319e1f0ba5cec738ce6cebe3fe0e1edc782206494Ted Kremenek // Compute the index for the new ElementRegion. 17419e1f0ba5cec738ce6cebe3fe0e1edc782206494Ted Kremenek int64_t newIndex = 0; 17519e1f0ba5cec738ce6cebe3fe0e1edc782206494Ted Kremenek const MemRegion *newSuperR = 0; 176169077dde4d91270a7495793f1e00b22aa0bc7caTed Kremenek 17719e1f0ba5cec738ce6cebe3fe0e1edc782206494Ted Kremenek // We can only compute sizeof(PointeeTy) if it is a complete type. 17819e1f0ba5cec738ce6cebe3fe0e1edc782206494Ted Kremenek if (IsCompleteType(Ctx, PointeeTy)) { 17919e1f0ba5cec738ce6cebe3fe0e1edc782206494Ted Kremenek // Compute the size in **bytes**. 180199c3d6cd16aebbb9c7f0d42af9d922c9628bf70Ken Dyck CharUnits pointeeTySize = Ctx.getTypeSizeInChars(PointeeTy); 181974d97b251aaf5a735af83367cd3a930f3eb4333Ted Kremenek if (!pointeeTySize.isZero()) { 182974d97b251aaf5a735af83367cd3a930f3eb4333Ted Kremenek // Is the offset a multiple of the size? If so, we can layer the 183974d97b251aaf5a735af83367cd3a930f3eb4333Ted Kremenek // ElementRegion (with elementType == PointeeTy) directly on top of 184974d97b251aaf5a735af83367cd3a930f3eb4333Ted Kremenek // the base region. 185974d97b251aaf5a735af83367cd3a930f3eb4333Ted Kremenek if (off % pointeeTySize == 0) { 186974d97b251aaf5a735af83367cd3a930f3eb4333Ted Kremenek newIndex = off / pointeeTySize; 187974d97b251aaf5a735af83367cd3a930f3eb4333Ted Kremenek newSuperR = baseR; 188974d97b251aaf5a735af83367cd3a930f3eb4333Ted Kremenek } 18919e1f0ba5cec738ce6cebe3fe0e1edc782206494Ted Kremenek } 19019e1f0ba5cec738ce6cebe3fe0e1edc782206494Ted Kremenek } 1911eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 19219e1f0ba5cec738ce6cebe3fe0e1edc782206494Ted Kremenek if (!newSuperR) { 19319e1f0ba5cec738ce6cebe3fe0e1edc782206494Ted Kremenek // Create an intermediate ElementRegion to represent the raw byte. 19419e1f0ba5cec738ce6cebe3fe0e1edc782206494Ted Kremenek // This will be the super region of the final ElementRegion. 195199c3d6cd16aebbb9c7f0d42af9d922c9628bf70Ken Dyck newSuperR = MakeElementRegion(baseR, Ctx.CharTy, off.getQuantity()); 19619e1f0ba5cec738ce6cebe3fe0e1edc782206494Ted Kremenek } 1971eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 19809270cc1b9cdd4c50012cb7984df8745e05833e5Zhongxing Xu return MakeElementRegion(newSuperR, PointeeTy, newIndex); 19948ce7deb86ffb1e028ac9a8e7cddffc32843c26cTed Kremenek } 20048ce7deb86ffb1e028ac9a8e7cddffc32843c26cTed Kremenek } 2011eb4433ac451dc16f4133a88af2d002ac26c58efMike Stump 20209270cc1b9cdd4c50012cb7984df8745e05833e5Zhongxing Xu assert(0 && "unreachable"); 20309270cc1b9cdd4c50012cb7984df8745e05833e5Zhongxing Xu return 0; 20448ce7deb86ffb1e028ac9a8e7cddffc32843c26cTed Kremenek} 2051894dce96476dbe58c0e60d47f8987cbeb3d3869Ted Kremenek 2061894dce96476dbe58c0e60d47f8987cbeb3d3869Ted Kremenek 2071894dce96476dbe58c0e60d47f8987cbeb3d3869Ted Kremenek/// CastRetrievedVal - Used by subclasses of StoreManager to implement 2081894dce96476dbe58c0e60d47f8987cbeb3d3869Ted Kremenek/// implicit casts that arise from loads from regions that are reinterpreted 2091894dce96476dbe58c0e60d47f8987cbeb3d3869Ted Kremenek/// as another region. 210c50e6df965ff264952d8d5805d151f89c89af302Ted KremenekSVal StoreManager::CastRetrievedVal(SVal V, const TypedRegion *R, 211c50e6df965ff264952d8d5805d151f89c89af302Ted Kremenek QualType castTy, bool performTestOnly) { 212852274d4257134906995cb252fb3dfd2d71deae8Ted Kremenek 2131894dce96476dbe58c0e60d47f8987cbeb3d3869Ted Kremenek if (castTy.isNull()) 214652be346f74feba027bcbdeb6a3e3f4755a0e62cZhongxing Xu return V; 215852274d4257134906995cb252fb3dfd2d71deae8Ted Kremenek 216c8413fd03f73084a5c93028f8b4db619fc388087Ted Kremenek ASTContext &Ctx = svalBuilder.getContext(); 2172f4a6b25a7409f6f05e8a5e6864de21a337c8958Zhongxing Xu 218c50e6df965ff264952d8d5805d151f89c89af302Ted Kremenek if (performTestOnly) { 219c50e6df965ff264952d8d5805d151f89c89af302Ted Kremenek // Automatically translate references to pointers. 220018220c343c103b7dfaa117a7a474c7a7fd6d068Zhongxing Xu QualType T = R->getValueType(); 221c50e6df965ff264952d8d5805d151f89c89af302Ted Kremenek if (const ReferenceType *RT = T->getAs<ReferenceType>()) 222c50e6df965ff264952d8d5805d151f89c89af302Ted Kremenek T = Ctx.getPointerType(RT->getPointeeType()); 223c50e6df965ff264952d8d5805d151f89c89af302Ted Kremenek 224c8413fd03f73084a5c93028f8b4db619fc388087Ted Kremenek assert(svalBuilder.getContext().hasSameUnqualifiedType(castTy, T)); 225c50e6df965ff264952d8d5805d151f89c89af302Ted Kremenek return V; 226c50e6df965ff264952d8d5805d151f89c89af302Ted Kremenek } 227c50e6df965ff264952d8d5805d151f89c89af302Ted Kremenek 228c50e6df965ff264952d8d5805d151f89c89af302Ted Kremenek if (const Loc *L = dyn_cast<Loc>(&V)) 229c8413fd03f73084a5c93028f8b4db619fc388087Ted Kremenek return svalBuilder.evalCastL(*L, castTy); 230c50e6df965ff264952d8d5805d151f89c89af302Ted Kremenek else if (const NonLoc *NL = dyn_cast<NonLoc>(&V)) 231c8413fd03f73084a5c93028f8b4db619fc388087Ted Kremenek return svalBuilder.evalCastNL(*NL, castTy); 232c50e6df965ff264952d8d5805d151f89c89af302Ted Kremenek 233652be346f74feba027bcbdeb6a3e3f4755a0e62cZhongxing Xu return V; 2341894dce96476dbe58c0e60d47f8987cbeb3d3869Ted Kremenek} 2351894dce96476dbe58c0e60d47f8987cbeb3d3869Ted Kremenek 236c1511e04998e685c9e030323e248363b9633267dZhongxing XuSVal StoreManager::getLValueFieldOrIvar(const Decl* D, SVal Base) { 237c1511e04998e685c9e030323e248363b9633267dZhongxing Xu if (Base.isUnknownOrUndef()) 238c1511e04998e685c9e030323e248363b9633267dZhongxing Xu return Base; 239c1511e04998e685c9e030323e248363b9633267dZhongxing Xu 240c1511e04998e685c9e030323e248363b9633267dZhongxing Xu Loc BaseL = cast<Loc>(Base); 241c1511e04998e685c9e030323e248363b9633267dZhongxing Xu const MemRegion* BaseR = 0; 242c1511e04998e685c9e030323e248363b9633267dZhongxing Xu 243c1511e04998e685c9e030323e248363b9633267dZhongxing Xu switch (BaseL.getSubKind()) { 244c1511e04998e685c9e030323e248363b9633267dZhongxing Xu case loc::MemRegionKind: 245c1511e04998e685c9e030323e248363b9633267dZhongxing Xu BaseR = cast<loc::MemRegionVal>(BaseL).getRegion(); 246c1511e04998e685c9e030323e248363b9633267dZhongxing Xu break; 247c1511e04998e685c9e030323e248363b9633267dZhongxing Xu 248c1511e04998e685c9e030323e248363b9633267dZhongxing Xu case loc::GotoLabelKind: 249c1511e04998e685c9e030323e248363b9633267dZhongxing Xu // These are anormal cases. Flag an undefined value. 250c1511e04998e685c9e030323e248363b9633267dZhongxing Xu return UndefinedVal(); 251c1511e04998e685c9e030323e248363b9633267dZhongxing Xu 252c1511e04998e685c9e030323e248363b9633267dZhongxing Xu case loc::ConcreteIntKind: 253c1511e04998e685c9e030323e248363b9633267dZhongxing Xu // While these seem funny, this can happen through casts. 254c1511e04998e685c9e030323e248363b9633267dZhongxing Xu // FIXME: What we should return is the field offset. For example, 255c1511e04998e685c9e030323e248363b9633267dZhongxing Xu // add the field offset to the integer value. That way funny things 256c1511e04998e685c9e030323e248363b9633267dZhongxing Xu // like this work properly: &(((struct foo *) 0xa)->f) 257c1511e04998e685c9e030323e248363b9633267dZhongxing Xu return Base; 258c1511e04998e685c9e030323e248363b9633267dZhongxing Xu 259c1511e04998e685c9e030323e248363b9633267dZhongxing Xu default: 260c1511e04998e685c9e030323e248363b9633267dZhongxing Xu assert(0 && "Unhandled Base."); 261c1511e04998e685c9e030323e248363b9633267dZhongxing Xu return Base; 262c1511e04998e685c9e030323e248363b9633267dZhongxing Xu } 263c1511e04998e685c9e030323e248363b9633267dZhongxing Xu 264c1511e04998e685c9e030323e248363b9633267dZhongxing Xu // NOTE: We must have this check first because ObjCIvarDecl is a subclass 265c1511e04998e685c9e030323e248363b9633267dZhongxing Xu // of FieldDecl. 266c1511e04998e685c9e030323e248363b9633267dZhongxing Xu if (const ObjCIvarDecl *ID = dyn_cast<ObjCIvarDecl>(D)) 267c1511e04998e685c9e030323e248363b9633267dZhongxing Xu return loc::MemRegionVal(MRMgr.getObjCIvarRegion(ID, BaseR)); 268c1511e04998e685c9e030323e248363b9633267dZhongxing Xu 269c1511e04998e685c9e030323e248363b9633267dZhongxing Xu return loc::MemRegionVal(MRMgr.getFieldRegion(cast<FieldDecl>(D), BaseR)); 270c1511e04998e685c9e030323e248363b9633267dZhongxing Xu} 27152535688b1339e0b3898ac0d670052482851a3abZhongxing Xu 27202282acd7a42d06a3178e3102d34a585bd82dd9fTed KremenekSVal StoreManager::getLValueElement(QualType elementType, NonLoc Offset, 27352535688b1339e0b3898ac0d670052482851a3abZhongxing Xu SVal Base) { 27452535688b1339e0b3898ac0d670052482851a3abZhongxing Xu 27552535688b1339e0b3898ac0d670052482851a3abZhongxing Xu // If the base is an unknown or undefined value, just return it back. 27652535688b1339e0b3898ac0d670052482851a3abZhongxing Xu // FIXME: For absolute pointer addresses, we just return that value back as 27752535688b1339e0b3898ac0d670052482851a3abZhongxing Xu // well, although in reality we should return the offset added to that 27852535688b1339e0b3898ac0d670052482851a3abZhongxing Xu // value. 27952535688b1339e0b3898ac0d670052482851a3abZhongxing Xu if (Base.isUnknownOrUndef() || isa<loc::ConcreteInt>(Base)) 28052535688b1339e0b3898ac0d670052482851a3abZhongxing Xu return Base; 28152535688b1339e0b3898ac0d670052482851a3abZhongxing Xu 28252535688b1339e0b3898ac0d670052482851a3abZhongxing Xu const MemRegion* BaseRegion = cast<loc::MemRegionVal>(Base).getRegion(); 28352535688b1339e0b3898ac0d670052482851a3abZhongxing Xu 28452535688b1339e0b3898ac0d670052482851a3abZhongxing Xu // Pointer of any type can be cast and used as array base. 28552535688b1339e0b3898ac0d670052482851a3abZhongxing Xu const ElementRegion *ElemR = dyn_cast<ElementRegion>(BaseRegion); 28652535688b1339e0b3898ac0d670052482851a3abZhongxing Xu 28752535688b1339e0b3898ac0d670052482851a3abZhongxing Xu // Convert the offset to the appropriate size and signedness. 288c8413fd03f73084a5c93028f8b4db619fc388087Ted Kremenek Offset = cast<NonLoc>(svalBuilder.convertToArrayIndex(Offset)); 28952535688b1339e0b3898ac0d670052482851a3abZhongxing Xu 29052535688b1339e0b3898ac0d670052482851a3abZhongxing Xu if (!ElemR) { 29152535688b1339e0b3898ac0d670052482851a3abZhongxing Xu // 29252535688b1339e0b3898ac0d670052482851a3abZhongxing Xu // If the base region is not an ElementRegion, create one. 29352535688b1339e0b3898ac0d670052482851a3abZhongxing Xu // This can happen in the following example: 29452535688b1339e0b3898ac0d670052482851a3abZhongxing Xu // 29552535688b1339e0b3898ac0d670052482851a3abZhongxing Xu // char *p = __builtin_alloc(10); 29652535688b1339e0b3898ac0d670052482851a3abZhongxing Xu // p[1] = 8; 29752535688b1339e0b3898ac0d670052482851a3abZhongxing Xu // 29852535688b1339e0b3898ac0d670052482851a3abZhongxing Xu // Observe that 'p' binds to an AllocaRegion. 29952535688b1339e0b3898ac0d670052482851a3abZhongxing Xu // 30052535688b1339e0b3898ac0d670052482851a3abZhongxing Xu return loc::MemRegionVal(MRMgr.getElementRegion(elementType, Offset, 30152535688b1339e0b3898ac0d670052482851a3abZhongxing Xu BaseRegion, Ctx)); 30252535688b1339e0b3898ac0d670052482851a3abZhongxing Xu } 30352535688b1339e0b3898ac0d670052482851a3abZhongxing Xu 30452535688b1339e0b3898ac0d670052482851a3abZhongxing Xu SVal BaseIdx = ElemR->getIndex(); 30552535688b1339e0b3898ac0d670052482851a3abZhongxing Xu 30652535688b1339e0b3898ac0d670052482851a3abZhongxing Xu if (!isa<nonloc::ConcreteInt>(BaseIdx)) 30752535688b1339e0b3898ac0d670052482851a3abZhongxing Xu return UnknownVal(); 30852535688b1339e0b3898ac0d670052482851a3abZhongxing Xu 30952535688b1339e0b3898ac0d670052482851a3abZhongxing Xu const llvm::APSInt& BaseIdxI = cast<nonloc::ConcreteInt>(BaseIdx).getValue(); 310e701117b21356d3c60133315b5bdd50232ec6ccaJordy Rose 311e701117b21356d3c60133315b5bdd50232ec6ccaJordy Rose // Only allow non-integer offsets if the base region has no offset itself. 312e701117b21356d3c60133315b5bdd50232ec6ccaJordy Rose // FIXME: This is a somewhat arbitrary restriction. We should be using 313846eabd187be4bfe992e8bca131166b734d86e0dTed Kremenek // SValBuilder here to add the two offsets without checking their types. 314e701117b21356d3c60133315b5bdd50232ec6ccaJordy Rose if (!isa<nonloc::ConcreteInt>(Offset)) { 315e701117b21356d3c60133315b5bdd50232ec6ccaJordy Rose if (isa<ElementRegion>(BaseRegion->StripCasts())) 316e701117b21356d3c60133315b5bdd50232ec6ccaJordy Rose return UnknownVal(); 317e701117b21356d3c60133315b5bdd50232ec6ccaJordy Rose 318e701117b21356d3c60133315b5bdd50232ec6ccaJordy Rose return loc::MemRegionVal(MRMgr.getElementRegion(elementType, Offset, 319e701117b21356d3c60133315b5bdd50232ec6ccaJordy Rose ElemR->getSuperRegion(), 320e701117b21356d3c60133315b5bdd50232ec6ccaJordy Rose Ctx)); 321e701117b21356d3c60133315b5bdd50232ec6ccaJordy Rose } 322e701117b21356d3c60133315b5bdd50232ec6ccaJordy Rose 32352535688b1339e0b3898ac0d670052482851a3abZhongxing Xu const llvm::APSInt& OffI = cast<nonloc::ConcreteInt>(Offset).getValue(); 32452535688b1339e0b3898ac0d670052482851a3abZhongxing Xu assert(BaseIdxI.isSigned()); 32552535688b1339e0b3898ac0d670052482851a3abZhongxing Xu 32652535688b1339e0b3898ac0d670052482851a3abZhongxing Xu // Compute the new index. 327c8413fd03f73084a5c93028f8b4db619fc388087Ted Kremenek nonloc::ConcreteInt NewIdx(svalBuilder.getBasicValueFactory().getValue(BaseIdxI + 32802282acd7a42d06a3178e3102d34a585bd82dd9fTed Kremenek OffI)); 32952535688b1339e0b3898ac0d670052482851a3abZhongxing Xu 33052535688b1339e0b3898ac0d670052482851a3abZhongxing Xu // Construct the new ElementRegion. 33152535688b1339e0b3898ac0d670052482851a3abZhongxing Xu const MemRegion *ArrayR = ElemR->getSuperRegion(); 33252535688b1339e0b3898ac0d670052482851a3abZhongxing Xu return loc::MemRegionVal(MRMgr.getElementRegion(elementType, NewIdx, ArrayR, 33352535688b1339e0b3898ac0d670052482851a3abZhongxing Xu Ctx)); 33452535688b1339e0b3898ac0d670052482851a3abZhongxing Xu} 335