clang  10.0.0svn
ExprEngineCXX.cpp
Go to the documentation of this file.
1 //===- ExprEngineCXX.cpp - ExprEngine support for C++ -----------*- C++ -*-===//
2 //
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6 //
7 //===----------------------------------------------------------------------===//
8 //
9 // This file defines the C++ expression evaluation engine.
10 //
11 //===----------------------------------------------------------------------===//
12 
15 #include "clang/AST/DeclCXX.h"
16 #include "clang/AST/StmtCXX.h"
17 #include "clang/AST/ParentMap.h"
22 
23 using namespace clang;
24 using namespace ento;
25 
27  ExplodedNode *Pred,
28  ExplodedNodeSet &Dst) {
29  StmtNodeBuilder Bldr(Pred, Dst, *currBldrCtx);
30  const Expr *tempExpr = ME->GetTemporaryExpr()->IgnoreParens();
31  ProgramStateRef state = Pred->getState();
32  const LocationContext *LCtx = Pred->getLocationContext();
33 
34  state = createTemporaryRegionIfNeeded(state, LCtx, tempExpr, ME);
35  Bldr.generateNode(ME, Pred, state);
36 }
37 
38 // FIXME: This is the sort of code that should eventually live in a Core
39 // checker rather than as a special case in ExprEngine.
40 void ExprEngine::performTrivialCopy(NodeBuilder &Bldr, ExplodedNode *Pred,
41  const CallEvent &Call) {
42  SVal ThisVal;
43  bool AlwaysReturnsLValue;
44  const CXXRecordDecl *ThisRD = nullptr;
45  if (const CXXConstructorCall *Ctor = dyn_cast<CXXConstructorCall>(&Call)) {
46  assert(Ctor->getDecl()->isTrivial());
47  assert(Ctor->getDecl()->isCopyOrMoveConstructor());
48  ThisVal = Ctor->getCXXThisVal();
49  ThisRD = Ctor->getDecl()->getParent();
50  AlwaysReturnsLValue = false;
51  } else {
52  assert(cast<CXXMethodDecl>(Call.getDecl())->isTrivial());
53  assert(cast<CXXMethodDecl>(Call.getDecl())->getOverloadedOperator() ==
54  OO_Equal);
55  ThisVal = cast<CXXInstanceCall>(Call).getCXXThisVal();
56  ThisRD = cast<CXXMethodDecl>(Call.getDecl())->getParent();
57  AlwaysReturnsLValue = true;
58  }
59 
60  assert(ThisRD);
61  if (ThisRD->isEmpty()) {
62  // Do nothing for empty classes. Otherwise it'd retrieve an UnknownVal
63  // and bind it and RegionStore would think that the actual value
64  // in this region at this offset is unknown.
65  return;
66  }
67 
68  const LocationContext *LCtx = Pred->getLocationContext();
69 
70  ExplodedNodeSet Dst;
71  Bldr.takeNodes(Pred);
72 
73  SVal V = Call.getArgSVal(0);
74 
75  // If the value being copied is not unknown, load from its location to get
76  // an aggregate rvalue.
77  if (Optional<Loc> L = V.getAs<Loc>())
78  V = Pred->getState()->getSVal(*L);
79  else
80  assert(V.isUnknownOrUndef());
81 
82  const Expr *CallExpr = Call.getOriginExpr();
83  evalBind(Dst, CallExpr, Pred, ThisVal, V, true);
84 
85  PostStmt PS(CallExpr, LCtx);
86  for (ExplodedNodeSet::iterator I = Dst.begin(), E = Dst.end();
87  I != E; ++I) {
88  ProgramStateRef State = (*I)->getState();
89  if (AlwaysReturnsLValue)
90  State = State->BindExpr(CallExpr, LCtx, ThisVal);
91  else
92  State = bindReturnValue(Call, LCtx, State);
93  Bldr.generateNode(PS, State, *I);
94  }
95 }
96 
97 
98 SVal ExprEngine::makeZeroElementRegion(ProgramStateRef State, SVal LValue,
99  QualType &Ty, bool &IsArray) {
100  SValBuilder &SVB = State->getStateManager().getSValBuilder();
101  ASTContext &Ctx = SVB.getContext();
102 
103  while (const ArrayType *AT = Ctx.getAsArrayType(Ty)) {
104  Ty = AT->getElementType();
105  LValue = State->getLValue(Ty, SVB.makeZeroArrayIndex(), LValue);
106  IsArray = true;
107  }
108 
109  return LValue;
110 }
111 
112 std::pair<ProgramStateRef, SVal> ExprEngine::prepareForObjectConstruction(
113  const Expr *E, ProgramStateRef State, const LocationContext *LCtx,
114  const ConstructionContext *CC, EvalCallOptions &CallOpts) {
115  SValBuilder &SVB = getSValBuilder();
116  MemRegionManager &MRMgr = SVB.getRegionManager();
117  ASTContext &ACtx = SVB.getContext();
118 
119  // See if we're constructing an existing region by looking at the
120  // current construction context.
121  if (CC) {
122  switch (CC->getKind()) {
125  const auto *DSCC = cast<VariableConstructionContext>(CC);
126  const auto *DS = DSCC->getDeclStmt();
127  const auto *Var = cast<VarDecl>(DS->getSingleDecl());
128  SVal LValue = State->getLValue(Var, LCtx);
129  QualType Ty = Var->getType();
130  LValue =
131  makeZeroElementRegion(State, LValue, Ty, CallOpts.IsArrayCtorOrDtor);
132  State =
133  addObjectUnderConstruction(State, DSCC->getDeclStmt(), LCtx, LValue);
134  return std::make_pair(State, LValue);
135  }
138  const auto *ICC = cast<ConstructorInitializerConstructionContext>(CC);
139  const auto *Init = ICC->getCXXCtorInitializer();
140  assert(Init->isAnyMemberInitializer());
141  const CXXMethodDecl *CurCtor = cast<CXXMethodDecl>(LCtx->getDecl());
142  Loc ThisPtr =
143  SVB.getCXXThis(CurCtor, LCtx->getStackFrame());
144  SVal ThisVal = State->getSVal(ThisPtr);
145 
146  const ValueDecl *Field;
147  SVal FieldVal;
148  if (Init->isIndirectMemberInitializer()) {
149  Field = Init->getIndirectMember();
150  FieldVal = State->getLValue(Init->getIndirectMember(), ThisVal);
151  } else {
152  Field = Init->getMember();
153  FieldVal = State->getLValue(Init->getMember(), ThisVal);
154  }
155 
156  QualType Ty = Field->getType();
157  FieldVal = makeZeroElementRegion(State, FieldVal, Ty,
158  CallOpts.IsArrayCtorOrDtor);
159  State = addObjectUnderConstruction(State, Init, LCtx, FieldVal);
160  return std::make_pair(State, FieldVal);
161  }
163  if (AMgr.getAnalyzerOptions().MayInlineCXXAllocator) {
164  const auto *NECC = cast<NewAllocatedObjectConstructionContext>(CC);
165  const auto *NE = NECC->getCXXNewExpr();
166  SVal V = *getObjectUnderConstruction(State, NE, LCtx);
167  if (const SubRegion *MR =
168  dyn_cast_or_null<SubRegion>(V.getAsRegion())) {
169  if (NE->isArray()) {
170  // TODO: In fact, we need to call the constructor for every
171  // allocated element, not just the first one!
172  CallOpts.IsArrayCtorOrDtor = true;
173  return std::make_pair(
174  State, loc::MemRegionVal(getStoreManager().GetElementZeroRegion(
175  MR, NE->getType()->getPointeeType())));
176  }
177  return std::make_pair(State, V);
178  }
179  // TODO: Detect when the allocator returns a null pointer.
180  // Constructor shall not be called in this case.
181  }
182  break;
183  }
186  // The temporary is to be managed by the parent stack frame.
187  // So build it in the parent stack frame if we're not in the
188  // top frame of the analysis.
189  const StackFrameContext *SFC = LCtx->getStackFrame();
190  if (const LocationContext *CallerLCtx = SFC->getParent()) {
191  auto RTC = (*SFC->getCallSiteBlock())[SFC->getIndex()]
192  .getAs<CFGCXXRecordTypedCall>();
193  if (!RTC) {
194  // We were unable to find the correct construction context for the
195  // call in the parent stack frame. This is equivalent to not being
196  // able to find construction context at all.
197  break;
198  }
199  if (isa<BlockInvocationContext>(CallerLCtx)) {
200  // Unwrap block invocation contexts. They're mostly part of
201  // the current stack frame.
202  CallerLCtx = CallerLCtx->getParent();
203  assert(!isa<BlockInvocationContext>(CallerLCtx));
204  }
205  return prepareForObjectConstruction(
206  cast<Expr>(SFC->getCallSite()), State, CallerLCtx,
207  RTC->getConstructionContext(), CallOpts);
208  } else {
209  // We are on the top frame of the analysis. We do not know where is the
210  // object returned to. Conjure a symbolic region for the return value.
211  // TODO: We probably need a new MemRegion kind to represent the storage
212  // of that SymbolicRegion, so that we cound produce a fancy symbol
213  // instead of an anonymous conjured symbol.
214  // TODO: Do we need to track the region to avoid having it dead
215  // too early? It does die too early, at least in C++17, but because
216  // putting anything into a SymbolicRegion causes an immediate escape,
217  // it doesn't cause any leak false positives.
218  const auto *RCC = cast<ReturnedValueConstructionContext>(CC);
219  // Make sure that this doesn't coincide with any other symbol
220  // conjured for the returned expression.
221  static const int TopLevelSymRegionTag = 0;
222  const Expr *RetE = RCC->getReturnStmt()->getRetValue();
223  assert(RetE && "Void returns should not have a construction context");
224  QualType ReturnTy = RetE->getType();
225  QualType RegionTy = ACtx.getPointerType(ReturnTy);
226  SVal V = SVB.conjureSymbolVal(&TopLevelSymRegionTag, RetE, SFC,
227  RegionTy, currBldrCtx->blockCount());
228  return std::make_pair(State, V);
229  }
230  llvm_unreachable("Unhandled return value construction context!");
231  }
233  assert(AMgr.getAnalyzerOptions().ShouldElideConstructors);
234  const auto *TCC = cast<ElidedTemporaryObjectConstructionContext>(CC);
235  const CXXBindTemporaryExpr *BTE = TCC->getCXXBindTemporaryExpr();
236  const MaterializeTemporaryExpr *MTE = TCC->getMaterializedTemporaryExpr();
237  const CXXConstructExpr *CE = TCC->getConstructorAfterElision();
238 
239  // Support pre-C++17 copy elision. We'll have the elidable copy
240  // constructor in the AST and in the CFG, but we'll skip it
241  // and construct directly into the final object. This call
242  // also sets the CallOpts flags for us.
243  SVal V;
244  // If the elided copy/move constructor is not supported, there's still
245  // benefit in trying to model the non-elided constructor.
246  // Stash our state before trying to elide, as it'll get overwritten.
247  ProgramStateRef PreElideState = State;
248  EvalCallOptions PreElideCallOpts = CallOpts;
249 
250  std::tie(State, V) = prepareForObjectConstruction(
251  CE, State, LCtx, TCC->getConstructionContextAfterElision(), CallOpts);
252 
253  // FIXME: This definition of "copy elision has not failed" is unreliable.
254  // It doesn't indicate that the constructor will actually be inlined
255  // later; it is still up to evalCall() to decide.
257  // Remember that we've elided the constructor.
258  State = addObjectUnderConstruction(State, CE, LCtx, V);
259 
260  // Remember that we've elided the destructor.
261  if (BTE)
262  State = elideDestructor(State, BTE, LCtx);
263 
264  // Instead of materialization, shamelessly return
265  // the final object destination.
266  if (MTE)
267  State = addObjectUnderConstruction(State, MTE, LCtx, V);
268 
269  return std::make_pair(State, V);
270  } else {
271  // Copy elision failed. Revert the changes and proceed as if we have
272  // a simple temporary.
273  State = PreElideState;
274  CallOpts = PreElideCallOpts;
275  }
276  LLVM_FALLTHROUGH;
277  }
279  const auto *TCC = cast<TemporaryObjectConstructionContext>(CC);
280  const CXXBindTemporaryExpr *BTE = TCC->getCXXBindTemporaryExpr();
281  const MaterializeTemporaryExpr *MTE = TCC->getMaterializedTemporaryExpr();
282  SVal V = UnknownVal();
283 
284  if (MTE) {
285  if (const ValueDecl *VD = MTE->getExtendingDecl()) {
286  assert(MTE->getStorageDuration() != SD_FullExpression);
287  if (!VD->getType()->isReferenceType()) {
288  // We're lifetime-extended by a surrounding aggregate.
289  // Automatic destructors aren't quite working in this case
290  // on the CFG side. We should warn the caller about that.
291  // FIXME: Is there a better way to retrieve this information from
292  // the MaterializeTemporaryExpr?
294  }
295  }
296 
297  if (MTE->getStorageDuration() == SD_Static ||
298  MTE->getStorageDuration() == SD_Thread)
300  }
301 
302  if (V.isUnknown())
303  V = loc::MemRegionVal(MRMgr.getCXXTempObjectRegion(E, LCtx));
304 
305  if (BTE)
306  State = addObjectUnderConstruction(State, BTE, LCtx, V);
307 
308  if (MTE)
309  State = addObjectUnderConstruction(State, MTE, LCtx, V);
310 
311  CallOpts.IsTemporaryCtorOrDtor = true;
312  return std::make_pair(State, V);
313  }
315  // Arguments are technically temporaries.
316  CallOpts.IsTemporaryCtorOrDtor = true;
317 
318  const auto *ACC = cast<ArgumentConstructionContext>(CC);
319  const Expr *E = ACC->getCallLikeExpr();
320  unsigned Idx = ACC->getIndex();
321  const CXXBindTemporaryExpr *BTE = ACC->getCXXBindTemporaryExpr();
322 
324  SVal V = UnknownVal();
325  auto getArgLoc = [&](CallEventRef<> Caller) -> Optional<SVal> {
326  const LocationContext *FutureSFC =
327  Caller->getCalleeStackFrame(currBldrCtx->blockCount());
328  // Return early if we are unable to reliably foresee
329  // the future stack frame.
330  if (!FutureSFC)
331  return None;
332 
333  // This should be equivalent to Caller->getDecl() for now, but
334  // FutureSFC->getDecl() is likely to support better stuff (like
335  // virtual functions) earlier.
336  const Decl *CalleeD = FutureSFC->getDecl();
337 
338  // FIXME: Support for variadic arguments is not implemented here yet.
339  if (CallEvent::isVariadic(CalleeD))
340  return None;
341 
342  // Operator arguments do not correspond to operator parameters
343  // because this-argument is implemented as a normal argument in
344  // operator call expressions but not in operator declarations.
345  const VarRegion *VR = Caller->getParameterLocation(
346  *Caller->getAdjustedParameterIndex(Idx), currBldrCtx->blockCount());
347  if (!VR)
348  return None;
349 
350  return loc::MemRegionVal(VR);
351  };
352 
353  if (const auto *CE = dyn_cast<CallExpr>(E)) {
354  CallEventRef<> Caller = CEMgr.getSimpleCall(CE, State, LCtx);
355  if (auto OptV = getArgLoc(Caller))
356  V = *OptV;
357  else
358  break;
359  State = addObjectUnderConstruction(State, {CE, Idx}, LCtx, V);
360  } else if (const auto *CCE = dyn_cast<CXXConstructExpr>(E)) {
361  // Don't bother figuring out the target region for the future
362  // constructor because we won't need it.
363  CallEventRef<> Caller =
364  CEMgr.getCXXConstructorCall(CCE, /*Target=*/nullptr, State, LCtx);
365  if (auto OptV = getArgLoc(Caller))
366  V = *OptV;
367  else
368  break;
369  State = addObjectUnderConstruction(State, {CCE, Idx}, LCtx, V);
370  } else if (const auto *ME = dyn_cast<ObjCMessageExpr>(E)) {
371  CallEventRef<> Caller = CEMgr.getObjCMethodCall(ME, State, LCtx);
372  if (auto OptV = getArgLoc(Caller))
373  V = *OptV;
374  else
375  break;
376  State = addObjectUnderConstruction(State, {ME, Idx}, LCtx, V);
377  }
378 
379  assert(!V.isUnknown());
380 
381  if (BTE)
382  State = addObjectUnderConstruction(State, BTE, LCtx, V);
383 
384  return std::make_pair(State, V);
385  }
386  }
387  }
388  // If we couldn't find an existing region to construct into, assume we're
389  // constructing a temporary. Notify the caller of our failure.
391  return std::make_pair(
392  State, loc::MemRegionVal(MRMgr.getCXXTempObjectRegion(E, LCtx)));
393 }
394 
396  ExplodedNode *Pred,
397  ExplodedNodeSet &destNodes) {
398  const LocationContext *LCtx = Pred->getLocationContext();
399  ProgramStateRef State = Pred->getState();
400 
401  SVal Target = UnknownVal();
402 
403  if (Optional<SVal> ElidedTarget =
404  getObjectUnderConstruction(State, CE, LCtx)) {
405  // We've previously modeled an elidable constructor by pretending that it in
406  // fact constructs into the correct target. This constructor can therefore
407  // be skipped.
408  Target = *ElidedTarget;
409  StmtNodeBuilder Bldr(Pred, destNodes, *currBldrCtx);
410  State = finishObjectConstruction(State, CE, LCtx);
411  if (auto L = Target.getAs<Loc>())
412  State = State->BindExpr(CE, LCtx, State->getSVal(*L, CE->getType()));
413  Bldr.generateNode(CE, Pred, State);
414  return;
415  }
416 
417  // FIXME: Handle arrays, which run the same constructor for every element.
418  // For now, we just run the first constructor (which should still invalidate
419  // the entire array).
420 
421  EvalCallOptions CallOpts;
423  assert(C || getCurrentCFGElement().getAs<CFGStmt>());
424  const ConstructionContext *CC = C ? C->getConstructionContext() : nullptr;
425 
426  switch (CE->getConstructionKind()) {
428  std::tie(State, Target) =
429  prepareForObjectConstruction(CE, State, LCtx, CC, CallOpts);
430  break;
431  }
433  // Make sure we are not calling virtual base class initializers twice.
434  // Only the most-derived object should initialize virtual base classes.
435  const auto *OuterCtor = dyn_cast_or_null<CXXConstructExpr>(
436  LCtx->getStackFrame()->getCallSite());
437  assert(
438  (!OuterCtor ||
439  OuterCtor->getConstructionKind() == CXXConstructExpr::CK_Complete ||
440  OuterCtor->getConstructionKind() == CXXConstructExpr::CK_Delegating) &&
441  ("This virtual base should have already been initialized by "
442  "the most derived class!"));
443  (void)OuterCtor;
444  LLVM_FALLTHROUGH;
445  }
447  // In C++17, classes with non-virtual bases may be aggregates, so they would
448  // be initialized as aggregates without a constructor call, so we may have
449  // a base class constructed directly into an initializer list without
450  // having the derived-class constructor call on the previous stack frame.
451  // Initializer lists may be nested into more initializer lists that
452  // correspond to surrounding aggregate initializations.
453  // FIXME: For now this code essentially bails out. We need to find the
454  // correct target region and set it.
455  // FIXME: Instead of relying on the ParentMap, we should have the
456  // trigger-statement (InitListExpr in this case) passed down from CFG or
457  // otherwise always available during construction.
458  if (dyn_cast_or_null<InitListExpr>(LCtx->getParentMap().getParent(CE))) {
460  Target = loc::MemRegionVal(MRMgr.getCXXTempObjectRegion(CE, LCtx));
462  break;
463  }
464  LLVM_FALLTHROUGH;
466  const CXXMethodDecl *CurCtor = cast<CXXMethodDecl>(LCtx->getDecl());
467  Loc ThisPtr = getSValBuilder().getCXXThis(CurCtor,
468  LCtx->getStackFrame());
469  SVal ThisVal = State->getSVal(ThisPtr);
470 
472  Target = ThisVal;
473  } else {
474  // Cast to the base type.
475  bool IsVirtual =
477  SVal BaseVal = getStoreManager().evalDerivedToBase(ThisVal, CE->getType(),
478  IsVirtual);
479  Target = BaseVal;
480  }
481  break;
482  }
483  }
484 
485  if (State != Pred->getState()) {
486  static SimpleProgramPointTag T("ExprEngine",
487  "Prepare for object construction");
488  ExplodedNodeSet DstPrepare;
489  StmtNodeBuilder BldrPrepare(Pred, DstPrepare, *currBldrCtx);
490  BldrPrepare.generateNode(CE, Pred, State, &T, ProgramPoint::PreStmtKind);
491  assert(DstPrepare.size() <= 1);
492  if (DstPrepare.size() == 0)
493  return;
494  Pred = *BldrPrepare.begin();
495  }
496 
499  CEMgr.getCXXConstructorCall(CE, Target.getAsRegion(), State, LCtx);
500 
501  ExplodedNodeSet DstPreVisit;
502  getCheckerManager().runCheckersForPreStmt(DstPreVisit, Pred, CE, *this);
503 
504  // FIXME: Is it possible and/or useful to do this before PreStmt?
505  ExplodedNodeSet PreInitialized;
506  {
507  StmtNodeBuilder Bldr(DstPreVisit, PreInitialized, *currBldrCtx);
508  for (ExplodedNodeSet::iterator I = DstPreVisit.begin(),
509  E = DstPreVisit.end();
510  I != E; ++I) {
511  ProgramStateRef State = (*I)->getState();
512  if (CE->requiresZeroInitialization()) {
513  // FIXME: Once we properly handle constructors in new-expressions, we'll
514  // need to invalidate the region before setting a default value, to make
515  // sure there aren't any lingering bindings around. This probably needs
516  // to happen regardless of whether or not the object is zero-initialized
517  // to handle random fields of a placement-initialized object picking up
518  // old bindings. We might only want to do it when we need to, though.
519  // FIXME: This isn't actually correct for arrays -- we need to zero-
520  // initialize the entire array, not just the first element -- but our
521  // handling of arrays everywhere else is weak as well, so this shouldn't
522  // actually make things worse. Placement new makes this tricky as well,
523  // since it's then possible to be initializing one part of a multi-
524  // dimensional array.
525  State = State->bindDefaultZero(Target, LCtx);
526  }
527 
528  Bldr.generateNode(CE, *I, State, /*tag=*/nullptr,
530  }
531  }
532 
533  ExplodedNodeSet DstPreCall;
534  getCheckerManager().runCheckersForPreCall(DstPreCall, PreInitialized,
535  *Call, *this);
536 
537  ExplodedNodeSet DstEvaluated;
538  StmtNodeBuilder Bldr(DstPreCall, DstEvaluated, *currBldrCtx);
539 
540  if (CE->getConstructor()->isTrivial() &&
542  !CallOpts.IsArrayCtorOrDtor) {
543  // FIXME: Handle other kinds of trivial constructors as well.
544  for (ExplodedNodeSet::iterator I = DstPreCall.begin(), E = DstPreCall.end();
545  I != E; ++I)
546  performTrivialCopy(Bldr, *I, *Call);
547 
548  } else {
549  for (ExplodedNodeSet::iterator I = DstPreCall.begin(), E = DstPreCall.end();
550  I != E; ++I)
551  defaultEvalCall(Bldr, *I, *Call, CallOpts);
552  }
553 
554  // If the CFG was constructed without elements for temporary destructors
555  // and the just-called constructor created a temporary object then
556  // stop exploration if the temporary object has a noreturn constructor.
557  // This can lose coverage because the destructor, if it were present
558  // in the CFG, would be called at the end of the full expression or
559  // later (for life-time extended temporaries) -- but avoids infeasible
560  // paths when no-return temporary destructors are used for assertions.
561  const AnalysisDeclContext *ADC = LCtx->getAnalysisDeclContext();
563  const MemRegion *Target = Call->getCXXThisVal().getAsRegion();
564  if (Target && isa<CXXTempObjectRegion>(Target) &&
565  Call->getDecl()->getParent()->isAnyDestructorNoReturn()) {
566 
567  // If we've inlined the constructor, then DstEvaluated would be empty.
568  // In this case we still want a sink, which could be implemented
569  // in processCallExit. But we don't have that implemented at the moment,
570  // so if you hit this assertion, see if you can avoid inlining
571  // the respective constructor when analyzer-config cfg-temporary-dtors
572  // is set to false.
573  // Otherwise there's nothing wrong with inlining such constructor.
574  assert(!DstEvaluated.empty() &&
575  "We should not have inlined this constructor!");
576 
577  for (ExplodedNode *N : DstEvaluated) {
578  Bldr.generateSink(CE, N, N->getState());
579  }
580 
581  // There is no need to run the PostCall and PostStmt checker
582  // callbacks because we just generated sinks on all nodes in th
583  // frontier.
584  return;
585  }
586  }
587 
588  ExplodedNodeSet DstPostArgumentCleanup;
589  for (auto I : DstEvaluated)
590  finishArgumentConstruction(DstPostArgumentCleanup, I, *Call);
591 
592  // If there were other constructors called for object-type arguments
593  // of this constructor, clean them up.
594  ExplodedNodeSet DstPostCall;
596  DstPostArgumentCleanup,
597  *Call, *this);
598  getCheckerManager().runCheckersForPostStmt(destNodes, DstPostCall, CE, *this);
599 }
600 
602  const MemRegion *Dest,
603  const Stmt *S,
604  bool IsBaseDtor,
605  ExplodedNode *Pred,
606  ExplodedNodeSet &Dst,
607  EvalCallOptions &CallOpts) {
608  assert(S && "A destructor without a trigger!");
609  const LocationContext *LCtx = Pred->getLocationContext();
610  ProgramStateRef State = Pred->getState();
611 
612  const CXXRecordDecl *RecordDecl = ObjectType->getAsCXXRecordDecl();
613  assert(RecordDecl && "Only CXXRecordDecls should have destructors");
614  const CXXDestructorDecl *DtorDecl = RecordDecl->getDestructor();
615  // FIXME: There should always be a Decl, otherwise the destructor call
616  // shouldn't have been added to the CFG in the first place.
617  if (!DtorDecl) {
618  // Skip the invalid destructor. We cannot simply return because
619  // it would interrupt the analysis instead.
620  static SimpleProgramPointTag T("ExprEngine", "SkipInvalidDestructor");
621  // FIXME: PostImplicitCall with a null decl may crash elsewhere anyway.
622  PostImplicitCall PP(/*Decl=*/nullptr, S->getEndLoc(), LCtx, &T);
623  NodeBuilder Bldr(Pred, Dst, *currBldrCtx);
624  Bldr.generateNode(PP, Pred->getState(), Pred);
625  return;
626  }
627 
628  if (!Dest) {
629  // We're trying to destroy something that is not a region. This may happen
630  // for a variety of reasons (unknown target region, concrete integer instead
631  // of target region, etc.). The current code makes an attempt to recover.
632  // FIXME: We probably don't really need to recover when we're dealing
633  // with concrete integers specifically.
635  if (const Expr *E = dyn_cast_or_null<Expr>(S)) {
636  Dest = MRMgr.getCXXTempObjectRegion(E, Pred->getLocationContext());
637  } else {
638  static SimpleProgramPointTag T("ExprEngine", "SkipInvalidDestructor");
639  NodeBuilder Bldr(Pred, Dst, *currBldrCtx);
640  Bldr.generateSink(Pred->getLocation().withTag(&T),
641  Pred->getState(), Pred);
642  return;
643  }
644  }
645 
648  CEMgr.getCXXDestructorCall(DtorDecl, S, Dest, IsBaseDtor, State, LCtx);
649 
650  PrettyStackTraceLoc CrashInfo(getContext().getSourceManager(),
651  Call->getSourceRange().getBegin(),
652  "Error evaluating destructor");
653 
654  ExplodedNodeSet DstPreCall;
655  getCheckerManager().runCheckersForPreCall(DstPreCall, Pred,
656  *Call, *this);
657 
658  ExplodedNodeSet DstInvalidated;
659  StmtNodeBuilder Bldr(DstPreCall, DstInvalidated, *currBldrCtx);
660  for (ExplodedNodeSet::iterator I = DstPreCall.begin(), E = DstPreCall.end();
661  I != E; ++I)
662  defaultEvalCall(Bldr, *I, *Call, CallOpts);
663 
664  getCheckerManager().runCheckersForPostCall(Dst, DstInvalidated,
665  *Call, *this);
666 }
667 
669  ExplodedNode *Pred,
670  ExplodedNodeSet &Dst) {
671  ProgramStateRef State = Pred->getState();
672  const LocationContext *LCtx = Pred->getLocationContext();
673  PrettyStackTraceLoc CrashInfo(getContext().getSourceManager(),
674  CNE->getBeginLoc(),
675  "Error evaluating New Allocator Call");
678  CEMgr.getCXXAllocatorCall(CNE, State, LCtx);
679 
680  ExplodedNodeSet DstPreCall;
681  getCheckerManager().runCheckersForPreCall(DstPreCall, Pred,
682  *Call, *this);
683 
684  ExplodedNodeSet DstPostCall;
685  StmtNodeBuilder CallBldr(DstPreCall, DstPostCall, *currBldrCtx);
686  for (auto I : DstPreCall) {
687  // FIXME: Provide evalCall for checkers?
688  defaultEvalCall(CallBldr, I, *Call);
689  }
690  // If the call is inlined, DstPostCall will be empty and we bail out now.
691 
692  // Store return value of operator new() for future use, until the actual
693  // CXXNewExpr gets processed.
694  ExplodedNodeSet DstPostValue;
695  StmtNodeBuilder ValueBldr(DstPostCall, DstPostValue, *currBldrCtx);
696  for (auto I : DstPostCall) {
697  // FIXME: Because CNE serves as the "call site" for the allocator (due to
698  // lack of a better expression in the AST), the conjured return value symbol
699  // is going to be of the same type (C++ object pointer type). Technically
700  // this is not correct because the operator new's prototype always says that
701  // it returns a 'void *'. So we should change the type of the symbol,
702  // and then evaluate the cast over the symbolic pointer from 'void *' to
703  // the object pointer type. But without changing the symbol's type it
704  // is breaking too much to evaluate the no-op symbolic cast over it, so we
705  // skip it for now.
706  ProgramStateRef State = I->getState();
707  SVal RetVal = State->getSVal(CNE, LCtx);
708 
709  // If this allocation function is not declared as non-throwing, failures
710  // /must/ be signalled by exceptions, and thus the return value will never
711  // be NULL. -fno-exceptions does not influence this semantics.
712  // FIXME: GCC has a -fcheck-new option, which forces it to consider the case
713  // where new can return NULL. If we end up supporting that option, we can
714  // consider adding a check for it here.
715  // C++11 [basic.stc.dynamic.allocation]p3.
716  if (const FunctionDecl *FD = CNE->getOperatorNew()) {
717  QualType Ty = FD->getType();
718  if (const auto *ProtoType = Ty->getAs<FunctionProtoType>())
719  if (!ProtoType->isNothrow())
720  State = State->assume(RetVal.castAs<DefinedOrUnknownSVal>(), true);
721  }
722 
723  ValueBldr.generateNode(
724  CNE, I, addObjectUnderConstruction(State, CNE, LCtx, RetVal));
725  }
726 
727  ExplodedNodeSet DstPostPostCallCallback;
728  getCheckerManager().runCheckersForPostCall(DstPostPostCallCallback,
729  DstPostValue, *Call, *this);
730  for (auto I : DstPostPostCallCallback) {
732  CNE, *getObjectUnderConstruction(I->getState(), CNE, LCtx), Dst, I,
733  *this);
734  }
735 }
736 
738  ExplodedNodeSet &Dst) {
739  // FIXME: Much of this should eventually migrate to CXXAllocatorCall.
740  // Also, we need to decide how allocators actually work -- they're not
741  // really part of the CXXNewExpr because they happen BEFORE the
742  // CXXConstructExpr subexpression. See PR12014 for some discussion.
743 
744  unsigned blockCount = currBldrCtx->blockCount();
745  const LocationContext *LCtx = Pred->getLocationContext();
746  SVal symVal = UnknownVal();
747  FunctionDecl *FD = CNE->getOperatorNew();
748 
749  bool IsStandardGlobalOpNewFunction =
751 
752  ProgramStateRef State = Pred->getState();
753 
754  // Retrieve the stored operator new() return value.
755  if (AMgr.getAnalyzerOptions().MayInlineCXXAllocator) {
756  symVal = *getObjectUnderConstruction(State, CNE, LCtx);
757  State = finishObjectConstruction(State, CNE, LCtx);
758  }
759 
760  // We assume all standard global 'operator new' functions allocate memory in
761  // heap. We realize this is an approximation that might not correctly model
762  // a custom global allocator.
763  if (symVal.isUnknown()) {
764  if (IsStandardGlobalOpNewFunction)
765  symVal = svalBuilder.getConjuredHeapSymbolVal(CNE, LCtx, blockCount);
766  else
767  symVal = svalBuilder.conjureSymbolVal(nullptr, CNE, LCtx, CNE->getType(),
768  blockCount);
769  }
770 
773  CEMgr.getCXXAllocatorCall(CNE, State, LCtx);
774 
775  if (!AMgr.getAnalyzerOptions().MayInlineCXXAllocator) {
776  // Invalidate placement args.
777  // FIXME: Once we figure out how we want allocators to work,
778  // we should be using the usual pre-/(default-)eval-/post-call checkers
779  // here.
780  State = Call->invalidateRegions(blockCount);
781  if (!State)
782  return;
783 
784  // If this allocation function is not declared as non-throwing, failures
785  // /must/ be signalled by exceptions, and thus the return value will never
786  // be NULL. -fno-exceptions does not influence this semantics.
787  // FIXME: GCC has a -fcheck-new option, which forces it to consider the case
788  // where new can return NULL. If we end up supporting that option, we can
789  // consider adding a check for it here.
790  // C++11 [basic.stc.dynamic.allocation]p3.
791  if (FD) {
792  QualType Ty = FD->getType();
793  if (const auto *ProtoType = Ty->getAs<FunctionProtoType>())
794  if (!ProtoType->isNothrow())
795  if (auto dSymVal = symVal.getAs<DefinedOrUnknownSVal>())
796  State = State->assume(*dSymVal, true);
797  }
798  }
799 
800  StmtNodeBuilder Bldr(Pred, Dst, *currBldrCtx);
801 
802  SVal Result = symVal;
803 
804  if (CNE->isArray()) {
805  // FIXME: allocating an array requires simulating the constructors.
806  // For now, just return a symbolicated region.
807  if (const auto *NewReg = cast_or_null<SubRegion>(symVal.getAsRegion())) {
808  QualType ObjTy = CNE->getType()->getPointeeType();
809  const ElementRegion *EleReg =
810  getStoreManager().GetElementZeroRegion(NewReg, ObjTy);
811  Result = loc::MemRegionVal(EleReg);
812  }
813  State = State->BindExpr(CNE, Pred->getLocationContext(), Result);
814  Bldr.generateNode(CNE, Pred, State);
815  return;
816  }
817 
818  // FIXME: Once we have proper support for CXXConstructExprs inside
819  // CXXNewExpr, we need to make sure that the constructed object is not
820  // immediately invalidated here. (The placement call should happen before
821  // the constructor call anyway.)
822  if (FD && FD->isReservedGlobalPlacementOperator()) {
823  // Non-array placement new should always return the placement location.
824  SVal PlacementLoc = State->getSVal(CNE->getPlacementArg(0), LCtx);
825  Result = svalBuilder.evalCast(PlacementLoc, CNE->getType(),
826  CNE->getPlacementArg(0)->getType());
827  }
828 
829  // Bind the address of the object, then check to see if we cached out.
830  State = State->BindExpr(CNE, LCtx, Result);
831  ExplodedNode *NewN = Bldr.generateNode(CNE, Pred, State);
832  if (!NewN)
833  return;
834 
835  // If the type is not a record, we won't have a CXXConstructExpr as an
836  // initializer. Copy the value over.
837  if (const Expr *Init = CNE->getInitializer()) {
838  if (!isa<CXXConstructExpr>(Init)) {
839  assert(Bldr.getResults().size() == 1);
840  Bldr.takeNodes(NewN);
841  evalBind(Dst, CNE, NewN, Result, State->getSVal(Init, LCtx),
842  /*FirstInit=*/IsStandardGlobalOpNewFunction);
843  }
844  }
845 }
846 
848  ExplodedNode *Pred, ExplodedNodeSet &Dst) {
849  StmtNodeBuilder Bldr(Pred, Dst, *currBldrCtx);
850  ProgramStateRef state = Pred->getState();
851  Bldr.generateNode(CDE, Pred, state);
852 }
853 
855  ExplodedNode *Pred,
856  ExplodedNodeSet &Dst) {
857  const VarDecl *VD = CS->getExceptionDecl();
858  if (!VD) {
859  Dst.Add(Pred);
860  return;
861  }
862 
863  const LocationContext *LCtx = Pred->getLocationContext();
864  SVal V = svalBuilder.conjureSymbolVal(CS, LCtx, VD->getType(),
865  currBldrCtx->blockCount());
866  ProgramStateRef state = Pred->getState();
867  state = state->bindLoc(state->getLValue(VD, LCtx), V, LCtx);
868 
869  StmtNodeBuilder Bldr(Pred, Dst, *currBldrCtx);
870  Bldr.generateNode(CS, Pred, state);
871 }
872 
874  ExplodedNodeSet &Dst) {
875  StmtNodeBuilder Bldr(Pred, Dst, *currBldrCtx);
876 
877  // Get the this object region from StoreManager.
878  const LocationContext *LCtx = Pred->getLocationContext();
879  const MemRegion *R =
880  svalBuilder.getRegionManager().getCXXThisRegion(
881  getContext().getCanonicalType(TE->getType()),
882  LCtx);
883 
884  ProgramStateRef state = Pred->getState();
885  SVal V = state->getSVal(loc::MemRegionVal(R));
886  Bldr.generateNode(TE, Pred, state->BindExpr(TE, LCtx, V));
887 }
888 
890  ExplodedNodeSet &Dst) {
891  const LocationContext *LocCtxt = Pred->getLocationContext();
892 
893  // Get the region of the lambda itself.
894  const MemRegion *R = svalBuilder.getRegionManager().getCXXTempObjectRegion(
895  LE, LocCtxt);
896  SVal V = loc::MemRegionVal(R);
897 
898  ProgramStateRef State = Pred->getState();
899 
900  // If we created a new MemRegion for the lambda, we should explicitly bind
901  // the captures.
904  e = LE->capture_init_end();
905  i != e; ++i, ++CurField) {
906  FieldDecl *FieldForCapture = *CurField;
907  SVal FieldLoc = State->getLValue(FieldForCapture, V);
908 
909  SVal InitVal;
910  if (!FieldForCapture->hasCapturedVLAType()) {
911  Expr *InitExpr = *i;
912  assert(InitExpr && "Capture missing initialization expression");
913  InitVal = State->getSVal(InitExpr, LocCtxt);
914  } else {
915  // The field stores the length of a captured variable-length array.
916  // These captures don't have initialization expressions; instead we
917  // get the length from the VLAType size expression.
918  Expr *SizeExpr = FieldForCapture->getCapturedVLAType()->getSizeExpr();
919  InitVal = State->getSVal(SizeExpr, LocCtxt);
920  }
921 
922  State = State->bindLoc(FieldLoc, InitVal, LocCtxt);
923  }
924 
925  // Decay the Loc into an RValue, because there might be a
926  // MaterializeTemporaryExpr node above this one which expects the bound value
927  // to be an RValue.
928  SVal LambdaRVal = State->getSVal(R);
929 
930  ExplodedNodeSet Tmp;
931  StmtNodeBuilder Bldr(Pred, Tmp, *currBldrCtx);
932  // FIXME: is this the right program point kind?
933  Bldr.generateNode(LE, Pred,
934  State->BindExpr(LE, LocCtxt, LambdaRVal),
936 
937  // FIXME: Move all post/pre visits to ::Visit().
938  getCheckerManager().runCheckersForPostStmt(Dst, Tmp, LE, *this);
939 }
bool hasCapturedVLAType() const
Determine whether this member captures the variable length array type.
Definition: Decl.h:2816
Represents a function declaration or definition.
Definition: Decl.h:1784
bool isReservedGlobalPlacementOperator() const
Determines whether this operator new or delete is one of the reserved global placement operators: voi...
Definition: Decl.cpp:2913
SVal evalDerivedToBase(SVal Derived, const CastExpr *Cast)
Evaluates a chain of derived-to-base casts through the path specified in Cast.
Definition: Store.cpp:248
A (possibly-)qualified type.
Definition: Type.h:643
MemRegion - The root abstract class for all memory regions.
Definition: MemRegion.h:94
Static storage duration.
Definition: Specifiers.h:310
bool IsTemporaryCtorOrDtor
This call is a constructor or a destructor of a temporary value.
Definition: ExprEngine.h:106
unsigned blockCount() const
Returns the number of times the current basic block has been visited on the exploded graph path...
Definition: CoreEngine.h:220
Stmt - This represents one statement.
Definition: Stmt.h:66
This builder class is useful for generating nodes that resulted from visiting a statement.
Definition: CoreEngine.h:378
QualType getPointeeType() const
If this is a pointer, ObjC object pointer, or block pointer, this returns the respective pointee...
Definition: Type.cpp:557
Decl - This represents one declaration (or definition), e.g.
Definition: DeclBase.h:88
Defines the PrettyStackTraceEntry class, which is used to make crashes give more contextual informati...
FunctionDecl * getOperatorNew() const
Definition: ExprCXX.h:2218
Manages the lifetime of CallEvent objects.
Definition: CallEvent.h:1148
ProgramPoint withTag(const ProgramPointTag *tag) const
Create a new ProgramPoint object that is the same as the original except for using the specified tag ...
Definition: ProgramPoint.h:132
bool requiresZeroInitialization() const
Whether this construction first requires zero-initialization before the initializer is called...
Definition: ExprCXX.h:1533
CallEventRef< CXXDestructorCall > getCXXDestructorCall(const CXXDestructorDecl *DD, const Stmt *Trigger, const MemRegion *Target, bool IsBase, ProgramStateRef State, const LocationContext *LCtx)
Definition: CallEvent.h:1229
Stmt * getParent(Stmt *) const
Definition: ParentMap.cpp:134
Hints for figuring out of a call should be inlined during evalCall().
Definition: ExprEngine.h:96
Represents an array type, per C99 6.7.5.2 - Array Declarators.
Definition: Type.h:2860
Represents a call to a C++ constructor.
Definition: ExprCXX.h:1422
bool IsArrayCtorOrDtor
This call is a constructor or a destructor for a single element within an array, a part of array cons...
Definition: ExprEngine.h:103
CallEventRef getSimpleCall(const CallExpr *E, ProgramStateRef State, const LocationContext *LCtx)
Definition: CallEvent.cpp:1359
const ProgramStateRef & getState() const
SVal evalCast(SVal val, QualType castTy, QualType originalType)
Represents a prvalue temporary that is written into memory so that a reference can bind to it...
Definition: ExprCXX.h:4419
const Expr * getOriginExpr() const
Returns the expression whose value will be the result of this call.
Definition: CallEvent.h:222
void takeNodes(const ExplodedNodeSet &S)
Definition: CoreEngine.h:329
Represents a variable declaration or definition.
Definition: Decl.h:827
const T * getAs() const
Member-template getAs<specific type>&#39;.
Definition: Type.h:6858
loc::MemRegionVal getCXXThis(const CXXMethodDecl *D, const StackFrameContext *SFC)
Return a memory region for the &#39;this&#39; object reference.
static Optional< SVal > getObjectUnderConstruction(ProgramStateRef State, const ConstructionContextItem &Item, const LocationContext *LC)
By looking at a certain item that may be potentially part of an object&#39;s ConstructionContext, retrieve such object&#39;s location.
Definition: ExprEngine.cpp:474
const ElementRegion * GetElementZeroRegion(const SubRegion *R, QualType T)
Definition: Store.cpp:67
void VisitCXXThisExpr(const CXXThisExpr *TE, ExplodedNode *Pred, ExplodedNodeSet &Dst)
CXXRecordDecl * getLambdaClass() const
Retrieve the class that corresponds to the lambda.
Definition: ExprCXX.cpp:1282
Represents a function call that returns a C++ object by value.
Definition: CFG.h:184
Represents a struct/union/class.
Definition: Decl.h:3662
bool isEmpty() const
Determine whether this is an empty class in the sense of (C++11 [meta.unary.prop]).
Definition: DeclCXX.h:1100
Expr * GetTemporaryExpr() const
Retrieve the temporary-generating subexpression whose value will be materialized into a glvalue...
Definition: ExprCXX.h:4457
MemRegionManager & getRegionManager()
Definition: SValBuilder.h:174
Holds long-lived AST nodes (such as types and decls) that can be referred to throughout the semantic ...
Definition: ASTContext.h:160
LineState State
Represents a member of a struct/union/class.
Definition: Decl.h:2643
AnalysisDeclContext contains the context data for the function or method under analysis.
i32 captured_struct **param SharedsTy A type which contains references the shared variables *param Shareds Context with the list of shared variables from the p *TaskFunction *param Data Additional data for task generation like final * state
bool isReplaceableGlobalAllocationFunction(bool *IsAligned=nullptr) const
Determines whether this function is one of the replaceable global allocation functions: void *operato...
Definition: Decl.cpp:2936
ExplodedNode * generateSink(const Stmt *S, ExplodedNode *Pred, ProgramStateRef St, const ProgramPointTag *tag=nullptr, ProgramPoint::Kind K=ProgramPoint::PostStmtKind)
Definition: CoreEngine.h:417
void runCheckersForPreCall(ExplodedNodeSet &Dst, const ExplodedNodeSet &Src, const CallEvent &Call, ExprEngine &Eng)
Run checkers for pre-visiting obj-c messages.
CFGElement getCurrentCFGElement()
Return the CFG element corresponding to the worklist element that is currently being processed by Exp...
Definition: ExprEngine.h:659
capture_init_iterator capture_init_begin()
Retrieve the first initialization argument for this lambda expression (which initializes the first ca...
Definition: ExprCXX.h:1963
Expr * getInitializer()
The initializer of this new-expression.
Definition: ExprCXX.h:2275
const LocationContext * getLocationContext() const
const LocationContext * getParent() const
bool isUnknown() const
Definition: SVals.h:136
If a crash happens while one of these objects are live, the message is printed out along with the spe...
Expr * getSizeExpr() const
Definition: Type.h:3029
field_iterator field_begin() const
Definition: Decl.cpp:4343
Represents binding an expression to a temporary.
Definition: ExprCXX.h:1373
A C++ lambda expression, which produces a function object (of unspecified type) that can be invoked l...
Definition: ExprCXX.h:1818
void runCheckersForPostCall(ExplodedNodeSet &Dst, const ExplodedNodeSet &Src, const CallEvent &Call, ExprEngine &Eng, bool wasInlined=false)
Run checkers for post-visiting obj-c messages.
CXXDestructorDecl * getDestructor() const
Returns the destructor decl for this class.
Definition: DeclCXX.cpp:1765
static bool isVariadic(const Decl *D)
Returns true if the given decl is known to be variadic.
Definition: CallEvent.cpp:491
Represents the this expression in C++.
Definition: ExprCXX.h:1097
const CFGBlock * getCallSiteBlock() const
void evalBind(ExplodedNodeSet &Dst, const Stmt *StoreE, ExplodedNode *Pred, SVal location, SVal Val, bool atDeclInit=false, const ProgramPoint *PP=nullptr)
evalBind - Handle the semantics of binding a value to a specific location.
CheckerManager & getCheckerManager() const
Definition: ExprEngine.h:190
const ValueDecl * getExtendingDecl() const
Get the declaration which triggered the lifetime-extension of this temporary, if any.
Definition: ExprCXX.h:4479
ProgramStateRef bindReturnValue(const CallEvent &Call, const LocationContext *LCtx, ProgramStateRef State)
Create a new state in which the call return value is binded to the call origin expression.
CXXRecordDecl * getAsCXXRecordDecl() const
Retrieves the CXXRecordDecl that this type refers to, either because the type is a RecordType or beca...
Definition: Type.cpp:1692
Represents a prototype with parameter type info, e.g.
Definition: Type.h:3725
const Stmt * getCallSite() const
CXXConstructorDecl * getConstructor() const
Get the constructor that this expression will (ultimately) call.
Definition: ExprCXX.h:1494
void VisitCXXCatchStmt(const CXXCatchStmt *CS, ExplodedNode *Pred, ExplodedNodeSet &Dst)
void runCheckersForPostStmt(ExplodedNodeSet &Dst, const ExplodedNodeSet &Src, const Stmt *S, ExprEngine &Eng, bool wasInlined=false)
Run checkers for post-visiting Stmts.
ExplodedNode * generateSink(const ProgramPoint &PP, ProgramStateRef State, ExplodedNode *Pred)
Generates a sink in the ExplodedGraph.
Definition: CoreEngine.h:300
Represent the declaration of a variable (in which case it is an lvalue) a function (in which case it ...
Definition: Decl.h:644
This represents one expression.
Definition: Expr.h:108
bool isCopyOrMoveConstructor(unsigned &TypeQuals) const
Determine whether this is a copy or move constructor.
Definition: DeclCXX.cpp:2518
void VisitCXXNewExpr(const CXXNewExpr *CNE, ExplodedNode *Pred, ExplodedNodeSet &Dst)
void VisitCXXNewAllocatorCall(const CXXNewExpr *CNE, ExplodedNode *Pred, ExplodedNodeSet &Dst)
#define V(N, I)
Definition: ASTContext.h:2921
Represents a C++ destructor within a class.
Definition: DeclCXX.h:2629
AnalyzerOptions & getAnalyzerOptions() override
VarDecl * getExceptionDecl() const
Definition: StmtCXX.h:49
This is the simplest builder which generates nodes in the ExplodedGraph.
Definition: CoreEngine.h:236
Represents C++ constructor call.
Definition: CFG.h:156
void Add(ExplodedNode *N)
const ExplodedNodeSet & getResults()
Definition: CoreEngine.h:306
QualType getType() const
Definition: Expr.h:137
virtual const Decl * getDecl() const
Returns the declaration of the function or method that will be called.
Definition: CallEvent.h:202
ASTContext & getContext() const
getContext - Return the ASTContext associated with this analysis.
Definition: ExprEngine.h:182
DeclContext * getParent()
getParent - Returns the containing DeclContext.
Definition: DeclBase.h:1779
StorageDuration getStorageDuration() const
Retrieve the storage duration for the materialized temporary.
Definition: ExprCXX.h:4460
bool isTrivial() const
Whether this function is "trivial" in some specialized C++ senses.
Definition: Decl.h:2076
CallEventRef< ObjCMethodCall > getObjCMethodCall(const ObjCMessageExpr *E, ProgramStateRef State, const LocationContext *LCtx)
Definition: CallEvent.h:1217
Optional< T > getAs() const
Convert to the specified SVal type, returning None if this SVal is not of the desired type...
Definition: SVals.h:111
SourceLocation getEndLoc() const LLVM_READONLY
Definition: Stmt.cpp:287
Thread storage duration.
Definition: Specifiers.h:309
void runCheckersForNewAllocator(const CXXNewExpr *NE, SVal Target, ExplodedNodeSet &Dst, ExplodedNode *Pred, ExprEngine &Eng, bool wasInlined=false)
Run checkers between C++ operator new and constructor calls.
CallEventRef< CXXAllocatorCall > getCXXAllocatorCall(const CXXNewExpr *E, ProgramStateRef State, const LocationContext *LCtx)
Definition: CallEvent.h:1236
DefinedOrUnknownSVal conjureSymbolVal(const void *symbolTag, const Expr *expr, const LocationContext *LCtx, unsigned count)
Create a new symbol with a unique &#39;name&#39;.
const MemRegion * getAsRegion() const
Definition: SVals.cpp:151
Represents a new-expression for memory allocation and constructor calls, e.g: "new CXXNewExpr(foo)"...
Definition: ExprCXX.h:2100
SourceLocation getBeginLoc() const
Definition: ExprCXX.h:2339
const VariableArrayType * getCapturedVLAType() const
Get the captured variable length array type.
Definition: Decl.h:2821
CallEventManager & getCallEventManager()
Definition: ProgramState.h:530
const CXXTempObjectRegion * getCXXTempObjectRegion(Expr const *Ex, LocationContext const *LC)
Definition: MemRegion.cpp:1044
Represents a static or instance method of a struct/union/class.
Definition: DeclCXX.h:1905
ASTContext & getContext()
Definition: SValBuilder.h:155
void VisitCXXDeleteExpr(const CXXDeleteExpr *CDE, ExplodedNode *Pred, ExplodedNodeSet &Dst)
bool IsCtorOrDtorWithImproperlyModeledTargetRegion
This call is a constructor or a destructor for which we do not currently compute the this-region corr...
Definition: ExprEngine.h:99
ProgramPoint getLocation() const
getLocation - Returns the edge associated with the given node.
SVal - This represents a symbolic expression, which can be either an L-value or an R-value...
Definition: SVals.h:75
const ArrayType * getAsArrayType(QualType T) const
Type Query functions.
bool isArray() const
Definition: ExprCXX.h:2223
void runCheckersForPreStmt(ExplodedNodeSet &Dst, const ExplodedNodeSet &Src, const Stmt *S, ExprEngine &Eng)
Run checkers for pre-visiting Stmts.
DefinedOrUnknownSVal getConjuredHeapSymbolVal(const Expr *E, const LocationContext *LCtx, unsigned Count)
Conjure a symbol representing heap allocated memory region.
const CXXThisRegion * getCXXThisRegion(QualType thisPointerTy, const LocationContext *LC)
getCXXThisRegion - Retrieve the [artificial] region associated with the parameter &#39;this&#39;...
Definition: MemRegion.cpp:1100
Optional< T > getAs() const
Convert to the specified CFGElement type, returning None if this CFGElement is not of the desired typ...
Definition: CFG.h:109
Dataflow Directional Tag Classes.
CFG::BuildOptions & getCFGBuildOptions()
Return the build options used to construct the CFG.
SValBuilder & getSValBuilder()
Definition: ExprEngine.h:194
Represents a delete expression for memory deallocation and destructor calls, e.g. ...
Definition: ExprCXX.h:2359
StoreManager & getStoreManager()
Definition: ExprEngine.h:386
Represents a program point just after an implicit call event.
Definition: ProgramPoint.h:600
bool NE(InterpState &S, CodePtr OpPC)
Definition: Interp.h:226
void VisitLambdaExpr(const LambdaExpr *LE, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitLambdaExpr - Transfer function logic for LambdaExprs.
Represents an abstract call to a function or method along a particular path.
Definition: CallEvent.h:138
Expr * getPlacementArg(unsigned I)
Definition: ExprCXX.h:2245
ProgramStateManager & getStateManager() override
Definition: ExprEngine.h:384
specific_decl_iterator - Iterates over a subrange of declarations stored in a DeclContext, providing only those that are of type SpecificDecl (or a class derived from it).
Definition: DeclBase.h:2048
const Decl * getDecl() const
const CXXTempObjectRegion * getCXXStaticTempObjectRegion(const Expr *Ex)
Create a CXXTempObjectRegion for temporaries which are lifetime-extended by static references...
Definition: MemRegion.cpp:967
void VisitCXXDestructor(QualType ObjectType, const MemRegion *Dest, const Stmt *S, bool IsBaseDtor, ExplodedNode *Pred, ExplodedNodeSet &Dst, EvalCallOptions &Options)
void defaultEvalCall(NodeBuilder &B, ExplodedNode *Pred, const CallEvent &Call, const EvalCallOptions &CallOpts={})
Default implementation of call evaluation.
T castAs() const
Convert to the specified SVal type, asserting that this SVal is of the desired type.
Definition: SVals.h:103
SubRegion - A region that subsets another larger region.
Definition: MemRegion.h:436
void VisitCXXConstructExpr(const CXXConstructExpr *E, ExplodedNode *Pred, ExplodedNodeSet &Dst)
const StackFrameContext * getStackFrame() const
CallEventRef< CXXConstructorCall > getCXXConstructorCall(const CXXConstructExpr *E, const MemRegion *Target, ProgramStateRef State, const LocationContext *LCtx)
Definition: CallEvent.h:1223
ExplodedNode * generateNode(const ProgramPoint &PP, ProgramStateRef State, ExplodedNode *Pred)
Generates a node in the ExplodedGraph.
Definition: CoreEngine.h:289
Defines the C++ Decl subclasses, other than those for templates (found in DeclTemplate.h) and friends (in DeclFriend.h).
ConstructionContext&#39;s subclasses describe different ways of constructing an object in C++...
static bool isTrivial(ASTContext &Ctx, const Expr *E)
Checks if the expression is constant or does not have non-trivial function calls. ...
Represents a C++ struct/union/class.
Definition: DeclCXX.h:255
bool IsTemporaryLifetimeExtendedViaAggregate
This call is a constructor for a temporary that is lifetime-extended by binding it to a reference-typ...
Definition: ExprEngine.h:111
CXXCatchStmt - This represents a C++ catch block.
Definition: StmtCXX.h:28
bool LE(InterpState &S, CodePtr OpPC)
Definition: Interp.h:240
const ParentMap & getParentMap() const
QualType getPointerType(QualType T) const
Return the uniqued reference to the type for a pointer to the specified type.
Full-expression storage duration (for temporaries).
Definition: Specifiers.h:307
CallExpr - Represents a function call (C99 6.5.2.2, C++ [expr.call]).
Definition: Expr.h:2521
ExplodedNode * generateNode(const Stmt *S, ExplodedNode *Pred, ProgramStateRef St, const ProgramPointTag *tag=nullptr, ProgramPoint::Kind K=ProgramPoint::PostStmtKind)
Definition: CoreEngine.h:407
iterator begin()
Iterators through the results frontier.
Definition: CoreEngine.h:315
ElementRegion is used to represent both array elements and casts.
Definition: MemRegion.h:1083
capture_init_iterator capture_init_end()
Retrieve the iterator pointing one past the last initialization argument for this lambda expression...
Definition: ExprCXX.h:1975
Expr *const * const_capture_init_iterator
Const iterator that walks over the capture initialization arguments.
Definition: ExprCXX.h:1949
virtual SVal getArgSVal(unsigned Index) const
Returns the value of a given argument at the time of the call.
Definition: CallEvent.cpp:415
QualType getType() const
Definition: Decl.h:655
AnalysisDeclContext * getAnalysisDeclContext() const
void CreateCXXTemporaryObject(const MaterializeTemporaryExpr *ME, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Create a C++ temporary object for an rvalue.
Represents a call to a C++ constructor.
Definition: CallEvent.h:817
bool isUnknownOrUndef() const
Definition: SVals.h:144
Expr * IgnoreParens() LLVM_READONLY
Skip past any parentheses which might surround this expression until reaching a fixed point...
Definition: Expr.cpp:2962
ConstructionKind getConstructionKind() const
Determine whether this constructor is actually constructing a base class (rather than a complete obje...
Definition: ExprCXX.h:1542