clang  6.0.0svn
ExprEngineCXX.cpp
Go to the documentation of this file.
1 //===- ExprEngineCXX.cpp - ExprEngine support for C++ -----------*- C++ -*-===//
2 //
3 // The LLVM Compiler Infrastructure
4 //
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
7 //
8 //===----------------------------------------------------------------------===//
9 //
10 // This file defines the C++ expression evaluation engine.
11 //
12 //===----------------------------------------------------------------------===//
13 
15 #include "clang/AST/DeclCXX.h"
16 #include "clang/AST/StmtCXX.h"
21 
22 using namespace clang;
23 using namespace ento;
24 
26  ExplodedNode *Pred,
27  ExplodedNodeSet &Dst) {
28  StmtNodeBuilder Bldr(Pred, Dst, *currBldrCtx);
29  const Expr *tempExpr = ME->GetTemporaryExpr()->IgnoreParens();
30  ProgramStateRef state = Pred->getState();
31  const LocationContext *LCtx = Pred->getLocationContext();
32 
33  state = createTemporaryRegionIfNeeded(state, LCtx, tempExpr, ME);
34  Bldr.generateNode(ME, Pred, state);
35 }
36 
37 // FIXME: This is the sort of code that should eventually live in a Core
38 // checker rather than as a special case in ExprEngine.
39 void ExprEngine::performTrivialCopy(NodeBuilder &Bldr, ExplodedNode *Pred,
40  const CallEvent &Call) {
41  SVal ThisVal;
42  bool AlwaysReturnsLValue;
43  if (const CXXConstructorCall *Ctor = dyn_cast<CXXConstructorCall>(&Call)) {
44  assert(Ctor->getDecl()->isTrivial());
45  assert(Ctor->getDecl()->isCopyOrMoveConstructor());
46  ThisVal = Ctor->getCXXThisVal();
47  AlwaysReturnsLValue = false;
48  } else {
49  assert(cast<CXXMethodDecl>(Call.getDecl())->isTrivial());
50  assert(cast<CXXMethodDecl>(Call.getDecl())->getOverloadedOperator() ==
51  OO_Equal);
52  ThisVal = cast<CXXInstanceCall>(Call).getCXXThisVal();
53  AlwaysReturnsLValue = true;
54  }
55 
56  const LocationContext *LCtx = Pred->getLocationContext();
57 
58  ExplodedNodeSet Dst;
59  Bldr.takeNodes(Pred);
60 
61  SVal V = Call.getArgSVal(0);
62 
63  // If the value being copied is not unknown, load from its location to get
64  // an aggregate rvalue.
65  if (Optional<Loc> L = V.getAs<Loc>())
66  V = Pred->getState()->getSVal(*L);
67  else
68  assert(V.isUnknownOrUndef());
69 
70  const Expr *CallExpr = Call.getOriginExpr();
71  evalBind(Dst, CallExpr, Pred, ThisVal, V, true);
72 
73  PostStmt PS(CallExpr, LCtx);
74  for (ExplodedNodeSet::iterator I = Dst.begin(), E = Dst.end();
75  I != E; ++I) {
76  ProgramStateRef State = (*I)->getState();
77  if (AlwaysReturnsLValue)
78  State = State->BindExpr(CallExpr, LCtx, ThisVal);
79  else
80  State = bindReturnValue(Call, LCtx, State);
81  Bldr.generateNode(PS, State, *I);
82  }
83 }
84 
85 
86 /// Returns a region representing the first element of a (possibly
87 /// multi-dimensional) array.
88 ///
89 /// On return, \p Ty will be set to the base type of the array.
90 ///
91 /// If the type is not an array type at all, the original value is returned.
93  QualType &Ty) {
94  SValBuilder &SVB = State->getStateManager().getSValBuilder();
95  ASTContext &Ctx = SVB.getContext();
96 
97  while (const ArrayType *AT = Ctx.getAsArrayType(Ty)) {
98  Ty = AT->getElementType();
99  LValue = State->getLValue(Ty, SVB.makeZeroArrayIndex(), LValue);
100  }
101 
102  return LValue;
103 }
104 
105 
106 const MemRegion *
107 ExprEngine::getRegionForConstructedObject(const CXXConstructExpr *CE,
108  ExplodedNode *Pred) {
109  const LocationContext *LCtx = Pred->getLocationContext();
110  ProgramStateRef State = Pred->getState();
111 
112  // See if we're constructing an existing region by looking at the next
113  // element in the CFG.
114 
115  if (auto Elem = findElementDirectlyInitializedByCurrentConstructor()) {
116  if (Optional<CFGStmt> StmtElem = Elem->getAs<CFGStmt>()) {
117  auto *DS = cast<DeclStmt>(StmtElem->getStmt());
118  if (const auto *Var = dyn_cast<VarDecl>(DS->getSingleDecl())) {
119  if (Var->getInit() && Var->getInit()->IgnoreImplicit() == CE) {
120  SVal LValue = State->getLValue(Var, LCtx);
121  QualType Ty = Var->getType();
122  LValue = makeZeroElementRegion(State, LValue, Ty);
123  return LValue.getAsRegion();
124  }
125  }
126  } else if (Optional<CFGInitializer> InitElem = Elem->getAs<CFGInitializer>()) {
127  const CXXCtorInitializer *Init = InitElem->getInitializer();
128  assert(Init->isAnyMemberInitializer());
129  const CXXMethodDecl *CurCtor = cast<CXXMethodDecl>(LCtx->getDecl());
130  Loc ThisPtr =
131  getSValBuilder().getCXXThis(CurCtor, LCtx->getCurrentStackFrame());
132  SVal ThisVal = State->getSVal(ThisPtr);
133 
134  const ValueDecl *Field;
135  SVal FieldVal;
136  if (Init->isIndirectMemberInitializer()) {
137  Field = Init->getIndirectMember();
138  FieldVal = State->getLValue(Init->getIndirectMember(), ThisVal);
139  } else {
140  Field = Init->getMember();
141  FieldVal = State->getLValue(Init->getMember(), ThisVal);
142  }
143 
144  QualType Ty = Field->getType();
145  FieldVal = makeZeroElementRegion(State, FieldVal, Ty);
146  return FieldVal.getAsRegion();
147  }
148 
149  // FIXME: This will eventually need to handle new-expressions as well.
150  // Don't forget to update the pre-constructor initialization code in
151  // ExprEngine::VisitCXXConstructExpr.
152  }
153  // If we couldn't find an existing region to construct into, assume we're
154  // constructing a temporary.
156  return MRMgr.getCXXTempObjectRegion(CE, LCtx);
157 }
158 
159 /// Returns true if the initializer for \Elem can be a direct
160 /// constructor.
162  // DeclStmts and CXXCtorInitializers for fields can be directly constructed.
163 
164  if (Optional<CFGStmt> StmtElem = Elem.getAs<CFGStmt>()) {
165  if (isa<DeclStmt>(StmtElem->getStmt())) {
166  return true;
167  }
168  }
169 
170  if (Elem.getKind() == CFGElement::Initializer) {
171  return true;
172  }
173 
174  return false;
175 }
176 
178 ExprEngine::findElementDirectlyInitializedByCurrentConstructor() {
179  const NodeBuilderContext &CurrBldrCtx = getBuilderContext();
180  // See if we're constructing an existing region by looking at the next
181  // element in the CFG.
182  const CFGBlock *B = CurrBldrCtx.getBlock();
183  assert(isa<CXXConstructExpr>(((*B)[currStmtIdx]).castAs<CFGStmt>().getStmt()));
184  unsigned int NextStmtIdx = currStmtIdx + 1;
185  if (NextStmtIdx >= B->size())
186  return None;
187 
188  CFGElement Next = (*B)[NextStmtIdx];
189 
190  // Is this a destructor? If so, we might be in the middle of an assignment
191  // to a local or member: look ahead one more element to see what we find.
192  while (Next.getAs<CFGImplicitDtor>() && NextStmtIdx + 1 < B->size()) {
193  ++NextStmtIdx;
194  Next = (*B)[NextStmtIdx];
195  }
196 
197  if (canHaveDirectConstructor(Next))
198  return Next;
199 
200  return None;
201 }
202 
203 const CXXConstructExpr *
204 ExprEngine::findDirectConstructorForCurrentCFGElement() {
205  // Go backward in the CFG to see if the previous element (ignoring
206  // destructors) was a CXXConstructExpr. If so, that constructor
207  // was constructed directly into an existing region.
208  // This process is essentially the inverse of that performed in
209  // findElementDirectlyInitializedByCurrentConstructor().
210  if (currStmtIdx == 0)
211  return nullptr;
212 
213  const CFGBlock *B = getBuilderContext().getBlock();
214  assert(canHaveDirectConstructor((*B)[currStmtIdx]));
215 
216  unsigned int PreviousStmtIdx = currStmtIdx - 1;
217  CFGElement Previous = (*B)[PreviousStmtIdx];
218 
219  while (Previous.getAs<CFGImplicitDtor>() && PreviousStmtIdx > 0) {
220  --PreviousStmtIdx;
221  Previous = (*B)[PreviousStmtIdx];
222  }
223 
224  if (Optional<CFGStmt> PrevStmtElem = Previous.getAs<CFGStmt>()) {
225  if (auto *CtorExpr = dyn_cast<CXXConstructExpr>(PrevStmtElem->getStmt())) {
226  return CtorExpr;
227  }
228  }
229 
230  return nullptr;
231 }
232 
234  ExplodedNode *Pred,
235  ExplodedNodeSet &destNodes) {
236  const LocationContext *LCtx = Pred->getLocationContext();
237  ProgramStateRef State = Pred->getState();
238 
239  const MemRegion *Target = nullptr;
240 
241  // FIXME: Handle arrays, which run the same constructor for every element.
242  // For now, we just run the first constructor (which should still invalidate
243  // the entire array).
244 
245  switch (CE->getConstructionKind()) {
247  Target = getRegionForConstructedObject(CE, Pred);
248  break;
249  }
251  // Make sure we are not calling virtual base class initializers twice.
252  // Only the most-derived object should initialize virtual base classes.
253  if (const Stmt *Outer = LCtx->getCurrentStackFrame()->getCallSite()) {
254  const CXXConstructExpr *OuterCtor = dyn_cast<CXXConstructExpr>(Outer);
255  if (OuterCtor) {
256  switch (OuterCtor->getConstructionKind()) {
259  // Bail out!
260  destNodes.Add(Pred);
261  return;
264  break;
265  }
266  }
267  }
268  // FALLTHROUGH
271  const CXXMethodDecl *CurCtor = cast<CXXMethodDecl>(LCtx->getDecl());
272  Loc ThisPtr = getSValBuilder().getCXXThis(CurCtor,
273  LCtx->getCurrentStackFrame());
274  SVal ThisVal = State->getSVal(ThisPtr);
275 
277  Target = ThisVal.getAsRegion();
278  } else {
279  // Cast to the base type.
280  bool IsVirtual =
282  SVal BaseVal = getStoreManager().evalDerivedToBase(ThisVal, CE->getType(),
283  IsVirtual);
284  Target = BaseVal.getAsRegion();
285  }
286  break;
287  }
288  }
289 
292  CEMgr.getCXXConstructorCall(CE, Target, State, LCtx);
293 
294  ExplodedNodeSet DstPreVisit;
295  getCheckerManager().runCheckersForPreStmt(DstPreVisit, Pred, CE, *this);
296 
297  ExplodedNodeSet PreInitialized;
298  {
299  StmtNodeBuilder Bldr(DstPreVisit, PreInitialized, *currBldrCtx);
300  if (CE->requiresZeroInitialization()) {
301  // Type of the zero doesn't matter.
302  SVal ZeroVal = svalBuilder.makeZeroVal(getContext().CharTy);
303 
304  for (ExplodedNodeSet::iterator I = DstPreVisit.begin(),
305  E = DstPreVisit.end();
306  I != E; ++I) {
307  ProgramStateRef State = (*I)->getState();
308  // FIXME: Once we properly handle constructors in new-expressions, we'll
309  // need to invalidate the region before setting a default value, to make
310  // sure there aren't any lingering bindings around. This probably needs
311  // to happen regardless of whether or not the object is zero-initialized
312  // to handle random fields of a placement-initialized object picking up
313  // old bindings. We might only want to do it when we need to, though.
314  // FIXME: This isn't actually correct for arrays -- we need to zero-
315  // initialize the entire array, not just the first element -- but our
316  // handling of arrays everywhere else is weak as well, so this shouldn't
317  // actually make things worse. Placement new makes this tricky as well,
318  // since it's then possible to be initializing one part of a multi-
319  // dimensional array.
320  State = State->bindDefault(loc::MemRegionVal(Target), ZeroVal, LCtx);
321  Bldr.generateNode(CE, *I, State, /*tag=*/nullptr,
323  }
324  }
325  }
326 
327  ExplodedNodeSet DstPreCall;
328  getCheckerManager().runCheckersForPreCall(DstPreCall, PreInitialized,
329  *Call, *this);
330 
331  ExplodedNodeSet DstEvaluated;
332  StmtNodeBuilder Bldr(DstPreCall, DstEvaluated, *currBldrCtx);
333 
334  bool IsArray = isa<ElementRegion>(Target);
335  if (CE->getConstructor()->isTrivial() &&
337  !IsArray) {
338  // FIXME: Handle other kinds of trivial constructors as well.
339  for (ExplodedNodeSet::iterator I = DstPreCall.begin(), E = DstPreCall.end();
340  I != E; ++I)
341  performTrivialCopy(Bldr, *I, *Call);
342 
343  } else {
344  for (ExplodedNodeSet::iterator I = DstPreCall.begin(), E = DstPreCall.end();
345  I != E; ++I)
346  defaultEvalCall(Bldr, *I, *Call);
347  }
348 
349  // If the CFG was contructed without elements for temporary destructors
350  // and the just-called constructor created a temporary object then
351  // stop exploration if the temporary object has a noreturn constructor.
352  // This can lose coverage because the destructor, if it were present
353  // in the CFG, would be called at the end of the full expression or
354  // later (for life-time extended temporaries) -- but avoids infeasible
355  // paths when no-return temporary destructors are used for assertions.
356  const AnalysisDeclContext *ADC = LCtx->getAnalysisDeclContext();
358  const MemRegion *Target = Call->getCXXThisVal().getAsRegion();
359  if (Target && isa<CXXTempObjectRegion>(Target) &&
360  Call->getDecl()->getParent()->isAnyDestructorNoReturn()) {
361 
362  for (ExplodedNode *N : DstEvaluated) {
363  Bldr.generateSink(CE, N, N->getState());
364  }
365 
366  // There is no need to run the PostCall and PostStmtchecker
367  // callbacks because we just generated sinks on all nodes in th
368  // frontier.
369  return;
370  }
371  }
372 
373  ExplodedNodeSet DstPostCall;
374  getCheckerManager().runCheckersForPostCall(DstPostCall, DstEvaluated,
375  *Call, *this);
376  getCheckerManager().runCheckersForPostStmt(destNodes, DstPostCall, CE, *this);
377 }
378 
380  const MemRegion *Dest,
381  const Stmt *S,
382  bool IsBaseDtor,
383  ExplodedNode *Pred,
384  ExplodedNodeSet &Dst) {
385  const LocationContext *LCtx = Pred->getLocationContext();
386  ProgramStateRef State = Pred->getState();
387 
388  // FIXME: We need to run the same destructor on every element of the array.
389  // This workaround will just run the first destructor (which will still
390  // invalidate the entire array).
391  SVal DestVal = UnknownVal();
392  if (Dest)
393  DestVal = loc::MemRegionVal(Dest);
394  DestVal = makeZeroElementRegion(State, DestVal, ObjectType);
395  Dest = DestVal.getAsRegion();
396 
397  const CXXRecordDecl *RecordDecl = ObjectType->getAsCXXRecordDecl();
398  assert(RecordDecl && "Only CXXRecordDecls should have destructors");
399  const CXXDestructorDecl *DtorDecl = RecordDecl->getDestructor();
400 
403  CEMgr.getCXXDestructorCall(DtorDecl, S, Dest, IsBaseDtor, State, LCtx);
404 
405  PrettyStackTraceLoc CrashInfo(getContext().getSourceManager(),
406  Call->getSourceRange().getBegin(),
407  "Error evaluating destructor");
408 
409  ExplodedNodeSet DstPreCall;
410  getCheckerManager().runCheckersForPreCall(DstPreCall, Pred,
411  *Call, *this);
412 
413  ExplodedNodeSet DstInvalidated;
414  StmtNodeBuilder Bldr(DstPreCall, DstInvalidated, *currBldrCtx);
415  for (ExplodedNodeSet::iterator I = DstPreCall.begin(), E = DstPreCall.end();
416  I != E; ++I)
417  defaultEvalCall(Bldr, *I, *Call);
418 
419  ExplodedNodeSet DstPostCall;
420  getCheckerManager().runCheckersForPostCall(Dst, DstInvalidated,
421  *Call, *this);
422 }
423 
425  ExplodedNode *Pred,
426  ExplodedNodeSet &Dst) {
427  ProgramStateRef State = Pred->getState();
428  const LocationContext *LCtx = Pred->getLocationContext();
429  PrettyStackTraceLoc CrashInfo(getContext().getSourceManager(),
430  CNE->getStartLoc(),
431  "Error evaluating New Allocator Call");
434  CEMgr.getCXXAllocatorCall(CNE, State, LCtx);
435 
436  ExplodedNodeSet DstPreCall;
437  getCheckerManager().runCheckersForPreCall(DstPreCall, Pred,
438  *Call, *this);
439 
440  ExplodedNodeSet DstInvalidated;
441  StmtNodeBuilder Bldr(DstPreCall, DstInvalidated, *currBldrCtx);
442  for (ExplodedNodeSet::iterator I = DstPreCall.begin(), E = DstPreCall.end();
443  I != E; ++I)
444  defaultEvalCall(Bldr, *I, *Call);
445  getCheckerManager().runCheckersForPostCall(Dst, DstInvalidated,
446  *Call, *this);
447 }
448 
449 
451  ExplodedNodeSet &Dst) {
452  // FIXME: Much of this should eventually migrate to CXXAllocatorCall.
453  // Also, we need to decide how allocators actually work -- they're not
454  // really part of the CXXNewExpr because they happen BEFORE the
455  // CXXConstructExpr subexpression. See PR12014 for some discussion.
456 
457  unsigned blockCount = currBldrCtx->blockCount();
458  const LocationContext *LCtx = Pred->getLocationContext();
459  DefinedOrUnknownSVal symVal = UnknownVal();
460  FunctionDecl *FD = CNE->getOperatorNew();
461 
462  bool IsStandardGlobalOpNewFunction = false;
463  if (FD && !isa<CXXMethodDecl>(FD) && !FD->isVariadic()) {
464  if (FD->getNumParams() == 2) {
465  QualType T = FD->getParamDecl(1)->getType();
466  if (const IdentifierInfo *II = T.getBaseTypeIdentifier())
467  // NoThrow placement new behaves as a standard new.
468  IsStandardGlobalOpNewFunction = II->getName().equals("nothrow_t");
469  }
470  else
471  // Placement forms are considered non-standard.
472  IsStandardGlobalOpNewFunction = (FD->getNumParams() == 1);
473  }
474 
475  // We assume all standard global 'operator new' functions allocate memory in
476  // heap. We realize this is an approximation that might not correctly model
477  // a custom global allocator.
478  if (IsStandardGlobalOpNewFunction)
479  symVal = svalBuilder.getConjuredHeapSymbolVal(CNE, LCtx, blockCount);
480  else
481  symVal = svalBuilder.conjureSymbolVal(nullptr, CNE, LCtx, CNE->getType(),
482  blockCount);
483 
484  ProgramStateRef State = Pred->getState();
487  CEMgr.getCXXAllocatorCall(CNE, State, LCtx);
488 
489  // Invalidate placement args.
490  // FIXME: Once we figure out how we want allocators to work,
491  // we should be using the usual pre-/(default-)eval-/post-call checks here.
492  State = Call->invalidateRegions(blockCount);
493  if (!State)
494  return;
495 
496  // If this allocation function is not declared as non-throwing, failures
497  // /must/ be signalled by exceptions, and thus the return value will never be
498  // NULL. -fno-exceptions does not influence this semantics.
499  // FIXME: GCC has a -fcheck-new option, which forces it to consider the case
500  // where new can return NULL. If we end up supporting that option, we can
501  // consider adding a check for it here.
502  // C++11 [basic.stc.dynamic.allocation]p3.
503  if (FD) {
504  QualType Ty = FD->getType();
505  if (const FunctionProtoType *ProtoType = Ty->getAs<FunctionProtoType>())
506  if (!ProtoType->isNothrow(getContext()))
507  State = State->assume(symVal, true);
508  }
509 
510  StmtNodeBuilder Bldr(Pred, Dst, *currBldrCtx);
511 
512  if (CNE->isArray()) {
513  // FIXME: allocating an array requires simulating the constructors.
514  // For now, just return a symbolicated region.
515  const SubRegion *NewReg =
516  symVal.castAs<loc::MemRegionVal>().getRegionAs<SubRegion>();
517  QualType ObjTy = CNE->getType()->getAs<PointerType>()->getPointeeType();
518  const ElementRegion *EleReg =
519  getStoreManager().GetElementZeroRegion(NewReg, ObjTy);
520  State = State->BindExpr(CNE, Pred->getLocationContext(),
521  loc::MemRegionVal(EleReg));
522  Bldr.generateNode(CNE, Pred, State);
523  return;
524  }
525 
526  // FIXME: Once we have proper support for CXXConstructExprs inside
527  // CXXNewExpr, we need to make sure that the constructed object is not
528  // immediately invalidated here. (The placement call should happen before
529  // the constructor call anyway.)
530  SVal Result = symVal;
531  if (FD && FD->isReservedGlobalPlacementOperator()) {
532  // Non-array placement new should always return the placement location.
533  SVal PlacementLoc = State->getSVal(CNE->getPlacementArg(0), LCtx);
534  Result = svalBuilder.evalCast(PlacementLoc, CNE->getType(),
535  CNE->getPlacementArg(0)->getType());
536  }
537 
538  // Bind the address of the object, then check to see if we cached out.
539  State = State->BindExpr(CNE, LCtx, Result);
540  ExplodedNode *NewN = Bldr.generateNode(CNE, Pred, State);
541  if (!NewN)
542  return;
543 
544  // If the type is not a record, we won't have a CXXConstructExpr as an
545  // initializer. Copy the value over.
546  if (const Expr *Init = CNE->getInitializer()) {
547  if (!isa<CXXConstructExpr>(Init)) {
548  assert(Bldr.getResults().size() == 1);
549  Bldr.takeNodes(NewN);
550  evalBind(Dst, CNE, NewN, Result, State->getSVal(Init, LCtx),
551  /*FirstInit=*/IsStandardGlobalOpNewFunction);
552  }
553  }
554 }
555 
557  ExplodedNode *Pred, ExplodedNodeSet &Dst) {
558  StmtNodeBuilder Bldr(Pred, Dst, *currBldrCtx);
559  ProgramStateRef state = Pred->getState();
560  Bldr.generateNode(CDE, Pred, state);
561 }
562 
564  ExplodedNode *Pred,
565  ExplodedNodeSet &Dst) {
566  const VarDecl *VD = CS->getExceptionDecl();
567  if (!VD) {
568  Dst.Add(Pred);
569  return;
570  }
571 
572  const LocationContext *LCtx = Pred->getLocationContext();
573  SVal V = svalBuilder.conjureSymbolVal(CS, LCtx, VD->getType(),
574  currBldrCtx->blockCount());
575  ProgramStateRef state = Pred->getState();
576  state = state->bindLoc(state->getLValue(VD, LCtx), V, LCtx);
577 
578  StmtNodeBuilder Bldr(Pred, Dst, *currBldrCtx);
579  Bldr.generateNode(CS, Pred, state);
580 }
581 
583  ExplodedNodeSet &Dst) {
584  StmtNodeBuilder Bldr(Pred, Dst, *currBldrCtx);
585 
586  // Get the this object region from StoreManager.
587  const LocationContext *LCtx = Pred->getLocationContext();
588  const MemRegion *R =
589  svalBuilder.getRegionManager().getCXXThisRegion(
590  getContext().getCanonicalType(TE->getType()),
591  LCtx);
592 
593  ProgramStateRef state = Pred->getState();
594  SVal V = state->getSVal(loc::MemRegionVal(R));
595  Bldr.generateNode(TE, Pred, state->BindExpr(TE, LCtx, V));
596 }
597 
599  ExplodedNodeSet &Dst) {
600  const LocationContext *LocCtxt = Pred->getLocationContext();
601 
602  // Get the region of the lambda itself.
603  const MemRegion *R = svalBuilder.getRegionManager().getCXXTempObjectRegion(
604  LE, LocCtxt);
605  SVal V = loc::MemRegionVal(R);
606 
607  ProgramStateRef State = Pred->getState();
608 
609  // If we created a new MemRegion for the lambda, we should explicitly bind
610  // the captures.
613  e = LE->capture_init_end();
614  i != e; ++i, ++CurField) {
615  FieldDecl *FieldForCapture = *CurField;
616  SVal FieldLoc = State->getLValue(FieldForCapture, V);
617 
618  SVal InitVal;
619  if (!FieldForCapture->hasCapturedVLAType()) {
620  Expr *InitExpr = *i;
621  assert(InitExpr && "Capture missing initialization expression");
622  InitVal = State->getSVal(InitExpr, LocCtxt);
623  } else {
624  // The field stores the length of a captured variable-length array.
625  // These captures don't have initialization expressions; instead we
626  // get the length from the VLAType size expression.
627  Expr *SizeExpr = FieldForCapture->getCapturedVLAType()->getSizeExpr();
628  InitVal = State->getSVal(SizeExpr, LocCtxt);
629  }
630 
631  State = State->bindLoc(FieldLoc, InitVal, LocCtxt);
632  }
633 
634  // Decay the Loc into an RValue, because there might be a
635  // MaterializeTemporaryExpr node above this one which expects the bound value
636  // to be an RValue.
637  SVal LambdaRVal = State->getSVal(R);
638 
639  ExplodedNodeSet Tmp;
640  StmtNodeBuilder Bldr(Pred, Tmp, *currBldrCtx);
641  // FIXME: is this the right program point kind?
642  Bldr.generateNode(LE, Pred,
643  State->BindExpr(LE, LocCtxt, LambdaRVal),
645 
646  // FIXME: Move all post/pre visits to ::Visit().
647  getCheckerManager().runCheckersForPostStmt(Dst, Tmp, LE, *this);
648 }
bool hasCapturedVLAType() const
Determine whether this member captures the variable length array type.
Definition: Decl.h:2626
FunctionDecl - An instance of this class is created to represent a function declaration or definition...
Definition: Decl.h:1698
bool isReservedGlobalPlacementOperator() const
Determines whether this operator new or delete is one of the reserved global placement operators: voi...
Definition: Decl.cpp:2676
SVal evalDerivedToBase(SVal Derived, const CastExpr *Cast)
Evaluates a chain of derived-to-base casts through the path specified in Cast.
Definition: Store.cpp:237
PointerType - C99 6.7.5.1 - Pointer Declarators.
Definition: Type.h:2285
A (possibly-)qualified type.
Definition: Type.h:653
MemRegion - The root abstract class for all memory regions.
Definition: MemRegion.h:79
unsigned blockCount() const
Returns the number of times the current basic block has been visited on the exploded graph path...
Definition: CoreEngine.h:195
Stmt - This represents one statement.
Definition: Stmt.h:66
This builder class is useful for generating nodes that resulted from visiting a statement.
Definition: CoreEngine.h:349
Defines the PrettyStackTraceEntry class, which is used to make crashes give more contextual informati...
FunctionDecl * getOperatorNew() const
Definition: ExprCXX.h:1942
Manages the lifetime of CallEvent objects.
Definition: CallEvent.h:982
bool requiresZeroInitialization() const
Whether this construction first requires zero-initialization before the initializer is called...
Definition: ExprCXX.h:1329
CallEventRef< CXXDestructorCall > getCXXDestructorCall(const CXXDestructorDecl *DD, const Stmt *Trigger, const MemRegion *Target, bool IsBase, ProgramStateRef State, const LocationContext *LCtx)
Definition: CallEvent.h:1057
Represents an array type, per C99 6.7.5.2 - Array Declarators.
Definition: Type.h:2560
Represents a call to a C++ constructor.
Definition: ExprCXX.h:1239
const ProgramStateRef & getState() const
SVal evalCast(SVal val, QualType castTy, QualType originalType)
Represents a prvalue temporary that is written into memory so that a reference can bind to it...
Definition: ExprCXX.h:4035
const Expr * getOriginExpr() const
Returns the expression whose value will be the result of this call.
Definition: CallEvent.h:225
bool isIndirectMemberInitializer() const
Definition: DeclCXX.h:2250
void takeNodes(const ExplodedNodeSet &S)
Definition: CoreEngine.h:302
VarDecl - An instance of this class is created to represent a variable declaration or definition...
Definition: Decl.h:807
const T * getAs() const
Member-template getAs<specific type>&#39;.
Definition: Type.h:6307
loc::MemRegionVal getCXXThis(const CXXMethodDecl *D, const StackFrameContext *SFC)
Return a memory region for the &#39;this&#39; object reference.
const NodeBuilderContext & getBuilderContext()
Definition: ExprEngine.h:135
const ElementRegion * GetElementZeroRegion(const SubRegion *R, QualType T)
Definition: Store.cpp:56
void VisitCXXThisExpr(const CXXThisExpr *TE, ExplodedNode *Pred, ExplodedNodeSet &Dst)
CXXRecordDecl * getLambdaClass() const
Retrieve the class that corresponds to the lambda.
Definition: ExprCXX.cpp:999
RecordDecl - Represents a struct/union/class.
Definition: Decl.h:3482
One of these records is kept for each identifier that is lexed.
Expr * GetTemporaryExpr() const
Retrieve the temporary-generating subexpression whose value will be materialized into a glvalue...
Definition: ExprCXX.h:4076
MemRegionManager & getRegionManager()
Definition: SValBuilder.h:150
Holds long-lived AST nodes (such as types and decls) that can be referred to throughout the semantic ...
Definition: ASTContext.h:149
LineState State
FieldDecl - An instance of this class is created by Sema::ActOnField to represent a member of a struc...
Definition: Decl.h:2461
AnalysisDeclContext contains the context data for the function or method under analysis.
void VisitCXXDestructor(QualType ObjectType, const MemRegion *Dest, const Stmt *S, bool IsBaseDtor, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Expr * getPlacementArg(unsigned i)
Definition: ExprCXX.h:1962
i32 captured_struct **param SharedsTy A type which contains references the shared variables *param Shareds Context with the list of shared variables from the p *TaskFunction *param Data Additional data for task generation like final * state
ExplodedNode * generateSink(const Stmt *S, ExplodedNode *Pred, ProgramStateRef St, const ProgramPointTag *tag=nullptr, ProgramPoint::Kind K=ProgramPoint::PostStmtKind)
Definition: CoreEngine.h:389
void runCheckersForPreCall(ExplodedNodeSet &Dst, const ExplodedNodeSet &Src, const CallEvent &Call, ExprEngine &Eng)
Run checkers for pre-visiting obj-c messages.
capture_init_iterator capture_init_begin()
Retrieve the first initialization argument for this lambda expression (which initializes the first ca...
Definition: ExprCXX.h:1725
Expr * getInitializer()
The initializer of this new-expression.
Definition: ExprCXX.h:1987
const StackFrameContext * getCurrentStackFrame() const
const LocationContext * getLocationContext() const
const Stmt * getStmt() const
If a crash happens while one of these objects are live, the message is printed out along with the spe...
Expr * getSizeExpr() const
Definition: Type.h:2739
field_iterator field_begin() const
Definition: Decl.cpp:3937
unsigned size() const
Definition: CFG.h:586
bool isAnyMemberInitializer() const
Definition: DeclCXX.h:2246
A C++ lambda expression, which produces a function object (of unspecified type) that can be invoked l...
Definition: ExprCXX.h:1580
void runCheckersForPostCall(ExplodedNodeSet &Dst, const ExplodedNodeSet &Src, const CallEvent &Call, ExprEngine &Eng, bool wasInlined=false)
Run checkers for post-visiting obj-c messages.
CXXDestructorDecl * getDestructor() const
Returns the destructor decl for this class.
Definition: DeclCXX.cpp:1458
FieldDecl * getMember() const
If this is a member initializer, returns the declaration of the non-static data member being initiali...
Definition: DeclCXX.h:2305
Represents the this expression in C++.
Definition: ExprCXX.h:945
void evalBind(ExplodedNodeSet &Dst, const Stmt *StoreE, ExplodedNode *Pred, SVal location, SVal Val, bool atDeclInit=false, const ProgramPoint *PP=nullptr)
evalBind - Handle the semantics of binding a value to a specific location.
CheckerManager & getCheckerManager() const
Definition: ExprEngine.h:127
ProgramStateRef bindReturnValue(const CallEvent &Call, const LocationContext *LCtx, ProgramStateRef State)
Create a new state in which the call return value is binded to the call origin expression.
CXXRecordDecl * getAsCXXRecordDecl() const
Retrieves the CXXRecordDecl that this type refers to, either because the type is a RecordType or beca...
Definition: Type.cpp:1590
Represents a prototype with parameter type info, e.g.
Definition: Type.h:3270
const Stmt * getCallSite() const
CXXConstructorDecl * getConstructor() const
Get the constructor that this expression will (ultimately) call.
Definition: ExprCXX.h:1302
void VisitCXXCatchStmt(const CXXCatchStmt *CS, ExplodedNode *Pred, ExplodedNodeSet &Dst)
CFGBlock - Represents a single basic block in a source-level CFG.
Definition: CFG.h:422
void runCheckersForPostStmt(ExplodedNodeSet &Dst, const ExplodedNodeSet &Src, const Stmt *S, ExprEngine &Eng, bool wasInlined=false)
Run checkers for post-visiting Stmts.
DefinedOrUnknownSVal makeZeroVal(QualType type)
Construct an SVal representing &#39;0&#39; for the specified type.
Definition: SValBuilder.cpp:32
ValueDecl - Represent the declaration of a variable (in which case it is an lvalue) a function (in wh...
Definition: Decl.h:628
Expr - This represents one expression.
Definition: Expr.h:106
bool isCopyOrMoveConstructor(unsigned &TypeQuals) const
Determine whether this is a copy or move constructor.
Definition: DeclCXX.cpp:2109
bool isVariadic() const
Whether this function is variadic.
Definition: Decl.cpp:2570
void VisitCXXNewExpr(const CXXNewExpr *CNE, ExplodedNode *Pred, ExplodedNodeSet &Dst)
const FunctionProtoType * T
StateNode * Previous
void VisitCXXNewAllocatorCall(const CXXNewExpr *CNE, ExplodedNode *Pred, ExplodedNodeSet &Dst)
const IdentifierInfo * getBaseTypeIdentifier() const
Retrieves a pointer to the name of the base type.
Definition: Type.cpp:70
Represents a C++ destructor within a class.
Definition: DeclCXX.h:2620
VarDecl * getExceptionDecl() const
Definition: StmtCXX.h:50
This is the simplest builder which generates nodes in the ExplodedGraph.
Definition: CoreEngine.h:211
void Add(ExplodedNode *N)
const ExplodedNodeSet & getResults()
Definition: CoreEngine.h:281
QualType getType() const
Definition: Expr.h:128
virtual const Decl * getDecl() const
Returns the declaration of the function or method that will be called.
Definition: CallEvent.h:205
ASTContext & getContext() const
getContext - Return the ASTContext associated with this analysis.
Definition: ExprEngine.h:123
bool isTrivial() const
Whether this function is "trivial" in some specialized C++ senses.
Definition: Decl.h:2004
Optional< T > getAs() const
Convert to the specified SVal type, returning None if this SVal is not of the desired type...
Definition: SVals.h:100
Kind getKind() const
Definition: CFG.h:110
CallEventRef< CXXAllocatorCall > getCXXAllocatorCall(const CXXNewExpr *E, ProgramStateRef State, const LocationContext *LCtx)
Definition: CallEvent.h:1064
DefinedOrUnknownSVal conjureSymbolVal(const void *symbolTag, const Expr *expr, const LocationContext *LCtx, unsigned count)
Create a new symbol with a unique &#39;name&#39;.
const MemRegion * getAsRegion() const
Definition: SVals.cpp:140
Represents a new-expression for memory allocation and constructor calls, e.g: "new CXXNewExpr(foo)"...
Definition: ExprCXX.h:1842
const VariableArrayType * getCapturedVLAType() const
Get the captured variable length array type.
Definition: Decl.h:2631
CallEventManager & getCallEventManager()
Definition: ProgramState.h:531
static SVal makeZeroElementRegion(ProgramStateRef State, SVal LValue, QualType &Ty)
Returns a region representing the first element of a (possibly multi-dimensional) array...
const CXXTempObjectRegion * getCXXTempObjectRegion(Expr const *Ex, LocationContext const *LC)
Definition: MemRegion.cpp:980
Represents a static or instance method of a struct/union/class.
Definition: DeclCXX.h:1964
ASTContext & getContext()
Definition: SValBuilder.h:131
void VisitCXXDeleteExpr(const CXXDeleteExpr *CDE, ExplodedNode *Pred, ExplodedNodeSet &Dst)
const ParmVarDecl * getParamDecl(unsigned i) const
Definition: Decl.h:2187
SVal - This represents a symbolic expression, which can be either an L-value or an R-value...
Definition: SVals.h:63
const ArrayType * getAsArrayType(QualType T) const
Type Query functions.
bool isArray() const
Definition: ExprCXX.h:1947
void runCheckersForPreStmt(ExplodedNodeSet &Dst, const ExplodedNodeSet &Src, const Stmt *S, ExprEngine &Eng)
Run checkers for pre-visiting Stmts.
DefinedOrUnknownSVal getConjuredHeapSymbolVal(const Expr *E, const LocationContext *LCtx, unsigned Count)
Conjure a symbol representing heap allocated memory region.
const CXXThisRegion * getCXXThisRegion(QualType thisPointerTy, const LocationContext *LC)
getCXXThisRegion - Retrieve the [artificial] region associated with the parameter &#39;this&#39;...
Definition: MemRegion.cpp:1032
Optional< T > getAs() const
Convert to the specified CFGElement type, returning None if this CFGElement is not of the desired typ...
Definition: CFG.h:101
Dataflow Directional Tag Classes.
CFG::BuildOptions & getCFGBuildOptions()
Return the build options used to construct the CFG.
SValBuilder & getSValBuilder()
Definition: ExprEngine.h:131
Represents a delete expression for memory deallocation and destructor calls, e.g. ...
Definition: ExprCXX.h:2071
StoreManager & getStoreManager()
Definition: ExprEngine.h:307
void VisitLambdaExpr(const LambdaExpr *LE, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitLambdaExpr - Transfer function logic for LambdaExprs.
Represents an abstract call to a function or method along a particular path.
Definition: CallEvent.h:140
ProgramStateManager & getStateManager() override
Definition: ExprEngine.h:305
specific_decl_iterator - Iterates over a subrange of declarations stored in a DeclContext, providing only those that are of type SpecificDecl (or a class derived from it).
Definition: DeclBase.h:1596
const Decl * getDecl() const
T castAs() const
Convert to the specified SVal type, asserting that this SVal is of the desired type.
Definition: SVals.h:92
SubRegion - A region that subsets another larger region.
Definition: MemRegion.h:419
Represents a C++ base or member initializer.
Definition: DeclCXX.h:2172
void VisitCXXConstructExpr(const CXXConstructExpr *E, ExplodedNode *Pred, ExplodedNodeSet &Dst)
IndirectFieldDecl * getIndirectMember() const
Definition: DeclCXX.h:2319
CallEventRef< CXXConstructorCall > getCXXConstructorCall(const CXXConstructExpr *E, const MemRegion *Target, ProgramStateRef State, const LocationContext *LCtx)
Definition: CallEvent.h:1051
void defaultEvalCall(NodeBuilder &B, ExplodedNode *Pred, const CallEvent &Call)
Default implementation of call evaluation.
ExplodedNode * generateNode(const ProgramPoint &PP, ProgramStateRef State, ExplodedNode *Pred)
Generates a node in the ExplodedGraph.
Definition: CoreEngine.h:264
Defines the C++ Decl subclasses, other than those for templates (found in DeclTemplate.h) and friends (in DeclFriend.h).
Represents a C++ struct/union/class.
Definition: DeclCXX.h:299
CFGImplicitDtor - Represents C++ object destructor implicitly generated by compiler on various occasi...
Definition: CFG.h:228
CXXCatchStmt - This represents a C++ catch block.
Definition: StmtCXX.h:29
CFGElement - Represents a top-level expression in a basic block.
Definition: CFG.h:54
CallExpr - Represents a function call (C99 6.5.2.2, C++ [expr.call]).
Definition: Expr.h:2209
ExplodedNode * generateNode(const Stmt *S, ExplodedNode *Pred, ProgramStateRef St, const ProgramPointTag *tag=nullptr, ProgramPoint::Kind K=ProgramPoint::PostStmtKind)
Definition: CoreEngine.h:379
ElementRegin is used to represent both array elements and casts.
Definition: MemRegion.h:1066
capture_init_iterator capture_init_end()
Retrieve the iterator pointing one past the last initialization argument for this lambda expression...
Definition: ExprCXX.h:1737
Expr *const * const_capture_init_iterator
Const iterator that walks over the capture initialization arguments.
Definition: ExprCXX.h:1711
CFGInitializer - Represents C++ base or member initializer from constructor&#39;s initialization list...
Definition: CFG.h:138
SourceLocation getStartLoc() const
Definition: ExprCXX.h:2047
virtual SVal getArgSVal(unsigned Index) const
Returns the value of a given argument at the time of the call.
Definition: CallEvent.cpp:228
QualType getType() const
Definition: Decl.h:639
AnalysisDeclContext * getAnalysisDeclContext() const
void CreateCXXTemporaryObject(const MaterializeTemporaryExpr *ME, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Create a C++ temporary object for an rvalue.
unsigned getNumParams() const
getNumParams - Return the number of parameters this function must have based on its FunctionType...
Definition: Decl.cpp:2906
Represents a call to a C++ constructor.
Definition: CallEvent.h:765
const CFGBlock * getBlock() const
Return the CFGBlock associated with this builder.
Definition: CoreEngine.h:191
bool isUnknownOrUndef() const
Definition: SVals.h:133
Expr * IgnoreParens() LLVM_READONLY
IgnoreParens - Ignore parentheses.
Definition: Expr.cpp:2432
ConstructionKind getConstructionKind() const
Determine whether this constructor is actually constructing a base class (rather than a complete obje...
Definition: ExprCXX.h:1336
static bool canHaveDirectConstructor(CFGElement Elem)
Returns true if the initializer for can be a direct constructor.