clang 19.0.0git
ExprEngineCXX.cpp
Go to the documentation of this file.
1//===- ExprEngineCXX.cpp - ExprEngine support for C++ -----------*- C++ -*-===//
2//
3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4// See https://llvm.org/LICENSE.txt for license information.
5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6//
7//===----------------------------------------------------------------------===//
8//
9// This file defines the C++ expression evaluation engine.
10//
11//===----------------------------------------------------------------------===//
12
13#include "clang/AST/DeclCXX.h"
14#include "clang/AST/ParentMap.h"
15#include "clang/AST/StmtCXX.h"
23#include "llvm/ADT/STLExtras.h"
24#include "llvm/ADT/Sequence.h"
25#include <optional>
26
27using namespace clang;
28using namespace ento;
29
31 ExplodedNode *Pred,
32 ExplodedNodeSet &Dst) {
33 StmtNodeBuilder Bldr(Pred, Dst, *currBldrCtx);
34 const Expr *tempExpr = ME->getSubExpr()->IgnoreParens();
35 ProgramStateRef state = Pred->getState();
36 const LocationContext *LCtx = Pred->getLocationContext();
37
38 state = createTemporaryRegionIfNeeded(state, LCtx, tempExpr, ME);
39 Bldr.generateNode(ME, Pred, state);
40}
41
42// FIXME: This is the sort of code that should eventually live in a Core
43// checker rather than as a special case in ExprEngine.
44void ExprEngine::performTrivialCopy(NodeBuilder &Bldr, ExplodedNode *Pred,
45 const CallEvent &Call) {
46 SVal ThisVal;
47 bool AlwaysReturnsLValue;
48 const CXXRecordDecl *ThisRD = nullptr;
49 if (const CXXConstructorCall *Ctor = dyn_cast<CXXConstructorCall>(&Call)) {
50 assert(Ctor->getDecl()->isTrivial());
51 assert(Ctor->getDecl()->isCopyOrMoveConstructor());
52 ThisVal = Ctor->getCXXThisVal();
53 ThisRD = Ctor->getDecl()->getParent();
54 AlwaysReturnsLValue = false;
55 } else {
56 assert(cast<CXXMethodDecl>(Call.getDecl())->isTrivial());
57 assert(cast<CXXMethodDecl>(Call.getDecl())->getOverloadedOperator() ==
58 OO_Equal);
59 ThisVal = cast<CXXInstanceCall>(Call).getCXXThisVal();
60 ThisRD = cast<CXXMethodDecl>(Call.getDecl())->getParent();
61 AlwaysReturnsLValue = true;
62 }
63
64 const LocationContext *LCtx = Pred->getLocationContext();
65 const Expr *CallExpr = Call.getOriginExpr();
66
68 Bldr.takeNodes(Pred);
69
70 assert(ThisRD);
71 if (!ThisRD->isEmpty()) {
72 // Load the source value only for non-empty classes.
73 // Otherwise it'd retrieve an UnknownVal
74 // and bind it and RegionStore would think that the actual value
75 // in this region at this offset is unknown.
76 SVal V = Call.getArgSVal(0);
77
78 // If the value being copied is not unknown, load from its location to get
79 // an aggregate rvalue.
80 if (std::optional<Loc> L = V.getAs<Loc>())
81 V = Pred->getState()->getSVal(*L);
82 else
83 assert(V.isUnknownOrUndef());
84 evalBind(Dst, CallExpr, Pred, ThisVal, V, true);
85 } else {
86 Dst.Add(Pred);
87 }
88
89 PostStmt PS(CallExpr, LCtx);
90 for (ExplodedNode *N : Dst) {
91 ProgramStateRef State = N->getState();
92 if (AlwaysReturnsLValue)
93 State = State->BindExpr(CallExpr, LCtx, ThisVal);
94 else
95 State = bindReturnValue(Call, LCtx, State);
96 Bldr.generateNode(PS, State, N);
97 }
98}
99
100SVal ExprEngine::makeElementRegion(ProgramStateRef State, SVal LValue,
101 QualType &Ty, bool &IsArray, unsigned Idx) {
102 SValBuilder &SVB = State->getStateManager().getSValBuilder();
103 ASTContext &Ctx = SVB.getContext();
104
105 if (const ArrayType *AT = Ctx.getAsArrayType(Ty)) {
106 while (AT) {
107 Ty = AT->getElementType();
108 AT = dyn_cast<ArrayType>(AT->getElementType());
109 }
110 LValue = State->getLValue(Ty, SVB.makeArrayIndex(Idx), LValue);
111 IsArray = true;
112 }
113
114 return LValue;
115}
116
117// In case when the prvalue is returned from the function (kind is one of
118// SimpleReturnedValueKind, CXX17ElidedCopyReturnedValueKind), then
119// it's materialization happens in context of the caller.
120// We pass BldrCtx explicitly, as currBldrCtx always refers to callee's context.
122 const Expr *E, ProgramStateRef State, const NodeBuilderContext *BldrCtx,
123 const LocationContext *LCtx, const ConstructionContext *CC,
124 EvalCallOptions &CallOpts, unsigned Idx) {
125
127 MemRegionManager &MRMgr = SVB.getRegionManager();
128 ASTContext &ACtx = SVB.getContext();
129
130 // Compute the target region by exploring the construction context.
131 if (CC) {
132 switch (CC->getKind()) {
135 const auto *DSCC = cast<VariableConstructionContext>(CC);
136 const auto *DS = DSCC->getDeclStmt();
137 const auto *Var = cast<VarDecl>(DS->getSingleDecl());
138 QualType Ty = Var->getType();
139 return makeElementRegion(State, State->getLValue(Var, LCtx), Ty,
140 CallOpts.IsArrayCtorOrDtor, Idx);
141 }
144 const auto *ICC = cast<ConstructorInitializerConstructionContext>(CC);
145 const auto *Init = ICC->getCXXCtorInitializer();
146 const CXXMethodDecl *CurCtor = cast<CXXMethodDecl>(LCtx->getDecl());
147 Loc ThisPtr = SVB.getCXXThis(CurCtor, LCtx->getStackFrame());
148 SVal ThisVal = State->getSVal(ThisPtr);
149 if (Init->isBaseInitializer()) {
150 const auto *ThisReg = cast<SubRegion>(ThisVal.getAsRegion());
151 const CXXRecordDecl *BaseClass =
152 Init->getBaseClass()->getAsCXXRecordDecl();
153 const auto *BaseReg =
154 MRMgr.getCXXBaseObjectRegion(BaseClass, ThisReg,
155 Init->isBaseVirtual());
156 return SVB.makeLoc(BaseReg);
157 }
158 if (Init->isDelegatingInitializer())
159 return ThisVal;
160
161 const ValueDecl *Field;
162 SVal FieldVal;
163 if (Init->isIndirectMemberInitializer()) {
164 Field = Init->getIndirectMember();
165 FieldVal = State->getLValue(Init->getIndirectMember(), ThisVal);
166 } else {
167 Field = Init->getMember();
168 FieldVal = State->getLValue(Init->getMember(), ThisVal);
169 }
170
171 QualType Ty = Field->getType();
172 return makeElementRegion(State, FieldVal, Ty, CallOpts.IsArrayCtorOrDtor,
173 Idx);
174 }
176 if (AMgr.getAnalyzerOptions().MayInlineCXXAllocator) {
177 const auto *NECC = cast<NewAllocatedObjectConstructionContext>(CC);
178 const auto *NE = NECC->getCXXNewExpr();
179 SVal V = *getObjectUnderConstruction(State, NE, LCtx);
180 if (const SubRegion *MR =
181 dyn_cast_or_null<SubRegion>(V.getAsRegion())) {
182 if (NE->isArray()) {
183 CallOpts.IsArrayCtorOrDtor = true;
184
185 auto Ty = NE->getType()->getPointeeType();
186 while (const auto *AT = getContext().getAsArrayType(Ty))
187 Ty = AT->getElementType();
188
189 auto R = MRMgr.getElementRegion(Ty, svalBuilder.makeArrayIndex(Idx),
190 MR, SVB.getContext());
191
192 return loc::MemRegionVal(R);
193 }
194 return V;
195 }
196 // TODO: Detect when the allocator returns a null pointer.
197 // Constructor shall not be called in this case.
198 }
199 break;
200 }
203 // The temporary is to be managed by the parent stack frame.
204 // So build it in the parent stack frame if we're not in the
205 // top frame of the analysis.
206 const StackFrameContext *SFC = LCtx->getStackFrame();
207 if (const LocationContext *CallerLCtx = SFC->getParent()) {
208 auto RTC = (*SFC->getCallSiteBlock())[SFC->getIndex()]
209 .getAs<CFGCXXRecordTypedCall>();
210 if (!RTC) {
211 // We were unable to find the correct construction context for the
212 // call in the parent stack frame. This is equivalent to not being
213 // able to find construction context at all.
214 break;
215 }
216 if (isa<BlockInvocationContext>(CallerLCtx)) {
217 // Unwrap block invocation contexts. They're mostly part of
218 // the current stack frame.
219 CallerLCtx = CallerLCtx->getParent();
220 assert(!isa<BlockInvocationContext>(CallerLCtx));
221 }
222
223 NodeBuilderContext CallerBldrCtx(getCoreEngine(),
224 SFC->getCallSiteBlock(), CallerLCtx);
226 cast<Expr>(SFC->getCallSite()), State, &CallerBldrCtx, CallerLCtx,
227 RTC->getConstructionContext(), CallOpts);
228 } else {
229 // We are on the top frame of the analysis. We do not know where is the
230 // object returned to. Conjure a symbolic region for the return value.
231 // TODO: We probably need a new MemRegion kind to represent the storage
232 // of that SymbolicRegion, so that we could produce a fancy symbol
233 // instead of an anonymous conjured symbol.
234 // TODO: Do we need to track the region to avoid having it dead
235 // too early? It does die too early, at least in C++17, but because
236 // putting anything into a SymbolicRegion causes an immediate escape,
237 // it doesn't cause any leak false positives.
238 const auto *RCC = cast<ReturnedValueConstructionContext>(CC);
239 // Make sure that this doesn't coincide with any other symbol
240 // conjured for the returned expression.
241 static const int TopLevelSymRegionTag = 0;
242 const Expr *RetE = RCC->getReturnStmt()->getRetValue();
243 assert(RetE && "Void returns should not have a construction context");
244 QualType ReturnTy = RetE->getType();
245 QualType RegionTy = ACtx.getPointerType(ReturnTy);
246 return SVB.conjureSymbolVal(&TopLevelSymRegionTag, RetE, SFC, RegionTy,
247 currBldrCtx->blockCount());
248 }
249 llvm_unreachable("Unhandled return value construction context!");
250 }
252 assert(AMgr.getAnalyzerOptions().ShouldElideConstructors);
253 const auto *TCC = cast<ElidedTemporaryObjectConstructionContext>(CC);
254
255 // Support pre-C++17 copy elision. We'll have the elidable copy
256 // constructor in the AST and in the CFG, but we'll skip it
257 // and construct directly into the final object. This call
258 // also sets the CallOpts flags for us.
259 // If the elided copy/move constructor is not supported, there's still
260 // benefit in trying to model the non-elided constructor.
261 // Stash our state before trying to elide, as it'll get overwritten.
262 ProgramStateRef PreElideState = State;
263 EvalCallOptions PreElideCallOpts = CallOpts;
264
266 TCC->getConstructorAfterElision(), State, BldrCtx, LCtx,
267 TCC->getConstructionContextAfterElision(), CallOpts);
268
269 // FIXME: This definition of "copy elision has not failed" is unreliable.
270 // It doesn't indicate that the constructor will actually be inlined
271 // later; this is still up to evalCall() to decide.
273 return V;
274
275 // Copy elision failed. Revert the changes and proceed as if we have
276 // a simple temporary.
277 CallOpts = PreElideCallOpts;
279 [[fallthrough]];
280 }
282 const auto *TCC = cast<TemporaryObjectConstructionContext>(CC);
283 const MaterializeTemporaryExpr *MTE = TCC->getMaterializedTemporaryExpr();
284
285 CallOpts.IsTemporaryCtorOrDtor = true;
286 if (MTE) {
287 if (const ValueDecl *VD = MTE->getExtendingDecl()) {
289 assert(SD != SD_FullExpression);
290 if (!VD->getType()->isReferenceType()) {
291 // We're lifetime-extended by a surrounding aggregate.
292 // Automatic destructors aren't quite working in this case
293 // on the CFG side. We should warn the caller about that.
294 // FIXME: Is there a better way to retrieve this information from
295 // the MaterializeTemporaryExpr?
297 }
298
299 if (SD == SD_Static || SD == SD_Thread)
300 return loc::MemRegionVal(
302
303 return loc::MemRegionVal(
304 MRMgr.getCXXLifetimeExtendedObjectRegion(E, VD, LCtx));
305 }
306 assert(MTE->getStorageDuration() == SD_FullExpression);
307 }
308
309 return loc::MemRegionVal(MRMgr.getCXXTempObjectRegion(E, LCtx));
310 }
312 CallOpts.IsTemporaryCtorOrDtor = true;
313
314 const auto *LCC = cast<LambdaCaptureConstructionContext>(CC);
315
317 MRMgr.getCXXTempObjectRegion(LCC->getInitializer(), LCtx));
318
319 const auto *CE = dyn_cast_or_null<CXXConstructExpr>(E);
320 if (getIndexOfElementToConstruct(State, CE, LCtx)) {
321 CallOpts.IsArrayCtorOrDtor = true;
322 Base = State->getLValue(E->getType(), svalBuilder.makeArrayIndex(Idx),
323 Base);
324 }
325
326 return Base;
327 }
329 // Arguments are technically temporaries.
330 CallOpts.IsTemporaryCtorOrDtor = true;
331
332 const auto *ACC = cast<ArgumentConstructionContext>(CC);
333 const Expr *E = ACC->getCallLikeExpr();
334 unsigned Idx = ACC->getIndex();
335
337 auto getArgLoc = [&](CallEventRef<> Caller) -> std::optional<SVal> {
338 const LocationContext *FutureSFC =
339 Caller->getCalleeStackFrame(BldrCtx->blockCount());
340 // Return early if we are unable to reliably foresee
341 // the future stack frame.
342 if (!FutureSFC)
343 return std::nullopt;
344
345 // This should be equivalent to Caller->getDecl() for now, but
346 // FutureSFC->getDecl() is likely to support better stuff (like
347 // virtual functions) earlier.
348 const Decl *CalleeD = FutureSFC->getDecl();
349
350 // FIXME: Support for variadic arguments is not implemented here yet.
351 if (CallEvent::isVariadic(CalleeD))
352 return std::nullopt;
353
354 // Operator arguments do not correspond to operator parameters
355 // because this-argument is implemented as a normal argument in
356 // operator call expressions but not in operator declarations.
357 const TypedValueRegion *TVR = Caller->getParameterLocation(
358 *Caller->getAdjustedParameterIndex(Idx), BldrCtx->blockCount());
359 if (!TVR)
360 return std::nullopt;
361
362 return loc::MemRegionVal(TVR);
363 };
364
365 if (const auto *CE = dyn_cast<CallExpr>(E)) {
366 CallEventRef<> Caller =
367 CEMgr.getSimpleCall(CE, State, LCtx, getCFGElementRef());
368 if (std::optional<SVal> V = getArgLoc(Caller))
369 return *V;
370 else
371 break;
372 } else if (const auto *CCE = dyn_cast<CXXConstructExpr>(E)) {
373 // Don't bother figuring out the target region for the future
374 // constructor because we won't need it.
376 CCE, /*Target=*/nullptr, State, LCtx, getCFGElementRef());
377 if (std::optional<SVal> V = getArgLoc(Caller))
378 return *V;
379 else
380 break;
381 } else if (const auto *ME = dyn_cast<ObjCMessageExpr>(E)) {
382 CallEventRef<> Caller =
383 CEMgr.getObjCMethodCall(ME, State, LCtx, getCFGElementRef());
384 if (std::optional<SVal> V = getArgLoc(Caller))
385 return *V;
386 else
387 break;
388 }
389 }
390 } // switch (CC->getKind())
391 }
392
393 // If we couldn't find an existing region to construct into, assume we're
394 // constructing a temporary. Notify the caller of our failure.
396 return loc::MemRegionVal(MRMgr.getCXXTempObjectRegion(E, LCtx));
397}
398
400 SVal V, const Expr *E, ProgramStateRef State, const LocationContext *LCtx,
401 const ConstructionContext *CC, const EvalCallOptions &CallOpts) {
403 // Sounds like we failed to find the target region and therefore
404 // copy elision failed. There's nothing we can do about it here.
405 return State;
406 }
407
408 // See if we're constructing an existing region by looking at the
409 // current construction context.
410 assert(CC && "Computed target region without construction context?");
411 switch (CC->getKind()) {
414 const auto *DSCC = cast<VariableConstructionContext>(CC);
415 return addObjectUnderConstruction(State, DSCC->getDeclStmt(), LCtx, V);
416 }
419 const auto *ICC = cast<ConstructorInitializerConstructionContext>(CC);
420 const auto *Init = ICC->getCXXCtorInitializer();
421 // Base and delegating initializers handled above
422 assert(Init->isAnyMemberInitializer() &&
423 "Base and delegating initializers should have been handled by"
424 "computeObjectUnderConstruction()");
425 return addObjectUnderConstruction(State, Init, LCtx, V);
426 }
428 return State;
429 }
432 const StackFrameContext *SFC = LCtx->getStackFrame();
433 const LocationContext *CallerLCtx = SFC->getParent();
434 if (!CallerLCtx) {
435 // No extra work is necessary in top frame.
436 return State;
437 }
438
439 auto RTC = (*SFC->getCallSiteBlock())[SFC->getIndex()]
440 .getAs<CFGCXXRecordTypedCall>();
441 assert(RTC && "Could not have had a target region without it");
442 if (isa<BlockInvocationContext>(CallerLCtx)) {
443 // Unwrap block invocation contexts. They're mostly part of
444 // the current stack frame.
445 CallerLCtx = CallerLCtx->getParent();
446 assert(!isa<BlockInvocationContext>(CallerLCtx));
447 }
448
450 cast<Expr>(SFC->getCallSite()), State, CallerLCtx,
451 RTC->getConstructionContext(), CallOpts);
452 }
454 assert(AMgr.getAnalyzerOptions().ShouldElideConstructors);
456 const auto *TCC = cast<ElidedTemporaryObjectConstructionContext>(CC);
458 V, TCC->getConstructorAfterElision(), State, LCtx,
459 TCC->getConstructionContextAfterElision(), CallOpts);
460
461 // Remember that we've elided the constructor.
462 State = addObjectUnderConstruction(
463 State, TCC->getConstructorAfterElision(), LCtx, V);
464
465 // Remember that we've elided the destructor.
466 if (const auto *BTE = TCC->getCXXBindTemporaryExpr())
467 State = elideDestructor(State, BTE, LCtx);
468
469 // Instead of materialization, shamelessly return
470 // the final object destination.
471 if (const auto *MTE = TCC->getMaterializedTemporaryExpr())
472 State = addObjectUnderConstruction(State, MTE, LCtx, V);
473
474 return State;
475 }
476 // If we decided not to elide the constructor, proceed as if
477 // it's a simple temporary.
478 [[fallthrough]];
479 }
481 const auto *TCC = cast<TemporaryObjectConstructionContext>(CC);
482 if (const auto *BTE = TCC->getCXXBindTemporaryExpr())
483 State = addObjectUnderConstruction(State, BTE, LCtx, V);
484
485 if (const auto *MTE = TCC->getMaterializedTemporaryExpr())
486 State = addObjectUnderConstruction(State, MTE, LCtx, V);
487
488 return State;
489 }
491 const auto *LCC = cast<LambdaCaptureConstructionContext>(CC);
492
493 // If we capture and array, we want to store the super region, not a
494 // sub-region.
495 if (const auto *EL = dyn_cast_or_null<ElementRegion>(V.getAsRegion()))
496 V = loc::MemRegionVal(EL->getSuperRegion());
497
498 return addObjectUnderConstruction(
499 State, {LCC->getLambdaExpr(), LCC->getIndex()}, LCtx, V);
500 }
502 const auto *ACC = cast<ArgumentConstructionContext>(CC);
503 if (const auto *BTE = ACC->getCXXBindTemporaryExpr())
504 State = addObjectUnderConstruction(State, BTE, LCtx, V);
505
506 return addObjectUnderConstruction(
507 State, {ACC->getCallLikeExpr(), ACC->getIndex()}, LCtx, V);
508 }
509 }
510 llvm_unreachable("Unhandled construction context!");
511}
512
513static ProgramStateRef
515 const ArrayInitLoopExpr *AILE,
516 const LocationContext *LCtx, SVal Idx) {
517 // The ctor in this case is guaranteed to be a copy ctor, otherwise we hit a
518 // compile time error.
519 //
520 // -ArrayInitLoopExpr <-- we're here
521 // |-OpaqueValueExpr
522 // | `-DeclRefExpr <-- match this
523 // `-CXXConstructExpr
524 // `-ImplicitCastExpr
525 // `-ArraySubscriptExpr
526 // |-ImplicitCastExpr
527 // | `-OpaqueValueExpr
528 // | `-DeclRefExpr
529 // `-ArrayInitIndexExpr
530 //
531 // The resulting expression might look like the one below in an implicit
532 // copy/move ctor.
533 //
534 // ArrayInitLoopExpr <-- we're here
535 // |-OpaqueValueExpr
536 // | `-MemberExpr <-- match this
537 // | (`-CXXStaticCastExpr) <-- move ctor only
538 // | `-DeclRefExpr
539 // `-CXXConstructExpr
540 // `-ArraySubscriptExpr
541 // |-ImplicitCastExpr
542 // | `-OpaqueValueExpr
543 // | `-MemberExpr
544 // | `-DeclRefExpr
545 // `-ArrayInitIndexExpr
546 //
547 // The resulting expression for a multidimensional array.
548 // ArrayInitLoopExpr <-- we're here
549 // |-OpaqueValueExpr
550 // | `-DeclRefExpr <-- match this
551 // `-ArrayInitLoopExpr
552 // |-OpaqueValueExpr
553 // | `-ArraySubscriptExpr
554 // | |-ImplicitCastExpr
555 // | | `-OpaqueValueExpr
556 // | | `-DeclRefExpr
557 // | `-ArrayInitIndexExpr
558 // `-CXXConstructExpr <-- extract this
559 // ` ...
560
561 const auto *OVESrc = AILE->getCommonExpr()->getSourceExpr();
562
563 // HACK: There is no way we can put the index of the array element into the
564 // CFG unless we unroll the loop, so we manually select and bind the required
565 // parameter to the environment.
566 const auto *CE =
567 cast<CXXConstructExpr>(extractElementInitializerFromNestedAILE(AILE));
568
569 SVal Base = UnknownVal();
570 if (const auto *ME = dyn_cast<MemberExpr>(OVESrc))
571 Base = State->getSVal(ME, LCtx);
572 else if (const auto *DRE = dyn_cast<DeclRefExpr>(OVESrc))
573 Base = State->getLValue(cast<VarDecl>(DRE->getDecl()), LCtx);
574 else
575 llvm_unreachable("ArrayInitLoopExpr contains unexpected source expression");
576
577 SVal NthElem = State->getLValue(CE->getType(), Idx, Base);
578
579 return State->BindExpr(CE->getArg(0), LCtx, NthElem);
580}
581
582void ExprEngine::handleConstructor(const Expr *E,
583 ExplodedNode *Pred,
584 ExplodedNodeSet &destNodes) {
585 const auto *CE = dyn_cast<CXXConstructExpr>(E);
586 const auto *CIE = dyn_cast<CXXInheritedCtorInitExpr>(E);
587 assert(CE || CIE);
588
589 const LocationContext *LCtx = Pred->getLocationContext();
590 ProgramStateRef State = Pred->getState();
591
593
594 if (CE) {
595 if (std::optional<SVal> ElidedTarget =
596 getObjectUnderConstruction(State, CE, LCtx)) {
597 // We've previously modeled an elidable constructor by pretending that
598 // it in fact constructs into the correct target. This constructor can
599 // therefore be skipped.
600 Target = *ElidedTarget;
601 StmtNodeBuilder Bldr(Pred, destNodes, *currBldrCtx);
602 State = finishObjectConstruction(State, CE, LCtx);
603 if (auto L = Target.getAs<Loc>())
604 State = State->BindExpr(CE, LCtx, State->getSVal(*L, CE->getType()));
605 Bldr.generateNode(CE, Pred, State);
606 return;
607 }
608 }
609
610 EvalCallOptions CallOpts;
612 assert(C || getCurrentCFGElement().getAs<CFGStmt>());
613 const ConstructionContext *CC = C ? C->getConstructionContext() : nullptr;
614
615 const CXXConstructionKind CK =
616 CE ? CE->getConstructionKind() : CIE->getConstructionKind();
617 switch (CK) {
619 // Inherited constructors are always base class constructors.
620 assert(CE && !CIE && "A complete constructor is inherited?!");
621
622 // If the ctor is part of an ArrayInitLoopExpr, we want to handle it
623 // differently.
624 auto *AILE = CC ? CC->getArrayInitLoop() : nullptr;
625
626 unsigned Idx = 0;
627 if (CE->getType()->isArrayType() || AILE) {
628
629 auto isZeroSizeArray = [&] {
630 uint64_t Size = 1;
631
632 if (const auto *CAT = dyn_cast<ConstantArrayType>(CE->getType()))
634 else if (AILE)
636
637 return Size == 0;
638 };
639
640 // No element construction will happen in a 0 size array.
641 if (isZeroSizeArray()) {
642 StmtNodeBuilder Bldr(Pred, destNodes, *currBldrCtx);
643 static SimpleProgramPointTag T{"ExprEngine",
644 "Skipping 0 size array construction"};
645 Bldr.generateNode(CE, Pred, State, &T);
646 return;
647 }
648
649 Idx = getIndexOfElementToConstruct(State, CE, LCtx).value_or(0u);
650 State = setIndexOfElementToConstruct(State, CE, LCtx, Idx + 1);
651 }
652
653 if (AILE) {
654 // Only set this once even though we loop through it multiple times.
655 if (!getPendingInitLoop(State, CE, LCtx))
656 State = setPendingInitLoop(
657 State, CE, LCtx,
658 getContext().getArrayInitLoopExprElementCount(AILE));
659
661 State, AILE, LCtx, svalBuilder.makeArrayIndex(Idx));
662 }
663
664 // The target region is found from construction context.
665 std::tie(State, Target) = handleConstructionContext(
666 CE, State, currBldrCtx, LCtx, CC, CallOpts, Idx);
667 break;
668 }
670 // Make sure we are not calling virtual base class initializers twice.
671 // Only the most-derived object should initialize virtual base classes.
672 const auto *OuterCtor = dyn_cast_or_null<CXXConstructExpr>(
673 LCtx->getStackFrame()->getCallSite());
674 assert(
675 (!OuterCtor ||
676 OuterCtor->getConstructionKind() == CXXConstructionKind::Complete ||
677 OuterCtor->getConstructionKind() == CXXConstructionKind::Delegating) &&
678 ("This virtual base should have already been initialized by "
679 "the most derived class!"));
680 (void)OuterCtor;
681 [[fallthrough]];
682 }
684 // In C++17, classes with non-virtual bases may be aggregates, so they would
685 // be initialized as aggregates without a constructor call, so we may have
686 // a base class constructed directly into an initializer list without
687 // having the derived-class constructor call on the previous stack frame.
688 // Initializer lists may be nested into more initializer lists that
689 // correspond to surrounding aggregate initializations.
690 // FIXME: For now this code essentially bails out. We need to find the
691 // correct target region and set it.
692 // FIXME: Instead of relying on the ParentMap, we should have the
693 // trigger-statement (InitListExpr in this case) passed down from CFG or
694 // otherwise always available during construction.
695 if (isa_and_nonnull<InitListExpr>(LCtx->getParentMap().getParent(E))) {
699 break;
700 }
701 [[fallthrough]];
703 const CXXMethodDecl *CurCtor = cast<CXXMethodDecl>(LCtx->getDecl());
704 Loc ThisPtr = getSValBuilder().getCXXThis(CurCtor,
705 LCtx->getStackFrame());
706 SVal ThisVal = State->getSVal(ThisPtr);
707
709 Target = ThisVal;
710 } else {
711 // Cast to the base type.
712 bool IsVirtual = (CK == CXXConstructionKind::VirtualBase);
713 SVal BaseVal =
714 getStoreManager().evalDerivedToBase(ThisVal, E->getType(), IsVirtual);
715 Target = BaseVal;
716 }
717 break;
718 }
719 }
720
721 if (State != Pred->getState()) {
722 static SimpleProgramPointTag T("ExprEngine",
723 "Prepare for object construction");
724 ExplodedNodeSet DstPrepare;
725 StmtNodeBuilder BldrPrepare(Pred, DstPrepare, *currBldrCtx);
726 BldrPrepare.generateNode(E, Pred, State, &T, ProgramPoint::PreStmtKind);
727 assert(DstPrepare.size() <= 1);
728 if (DstPrepare.size() == 0)
729 return;
730 Pred = *BldrPrepare.begin();
731 }
732
733 const MemRegion *TargetRegion = Target.getAsRegion();
737 CIE, TargetRegion, State, LCtx, getCFGElementRef())
739 CE, TargetRegion, State, LCtx, getCFGElementRef());
740
741 ExplodedNodeSet DstPreVisit;
742 getCheckerManager().runCheckersForPreStmt(DstPreVisit, Pred, E, *this);
743
744 ExplodedNodeSet PreInitialized;
745 if (CE) {
746 // FIXME: Is it possible and/or useful to do this before PreStmt?
747 StmtNodeBuilder Bldr(DstPreVisit, PreInitialized, *currBldrCtx);
748 for (ExplodedNode *N : DstPreVisit) {
749 ProgramStateRef State = N->getState();
750 if (CE->requiresZeroInitialization()) {
751 // FIXME: Once we properly handle constructors in new-expressions, we'll
752 // need to invalidate the region before setting a default value, to make
753 // sure there aren't any lingering bindings around. This probably needs
754 // to happen regardless of whether or not the object is zero-initialized
755 // to handle random fields of a placement-initialized object picking up
756 // old bindings. We might only want to do it when we need to, though.
757 // FIXME: This isn't actually correct for arrays -- we need to zero-
758 // initialize the entire array, not just the first element -- but our
759 // handling of arrays everywhere else is weak as well, so this shouldn't
760 // actually make things worse. Placement new makes this tricky as well,
761 // since it's then possible to be initializing one part of a multi-
762 // dimensional array.
763 State = State->bindDefaultZero(Target, LCtx);
764 }
765
766 Bldr.generateNode(CE, N, State, /*tag=*/nullptr,
768 }
769 } else {
770 PreInitialized = DstPreVisit;
771 }
772
773 ExplodedNodeSet DstPreCall;
774 getCheckerManager().runCheckersForPreCall(DstPreCall, PreInitialized,
775 *Call, *this);
776
777 ExplodedNodeSet DstEvaluated;
778
779 if (CE && CE->getConstructor()->isTrivial() &&
780 CE->getConstructor()->isCopyOrMoveConstructor() &&
781 !CallOpts.IsArrayCtorOrDtor) {
782 StmtNodeBuilder Bldr(DstPreCall, DstEvaluated, *currBldrCtx);
783 // FIXME: Handle other kinds of trivial constructors as well.
784 for (ExplodedNode *N : DstPreCall)
785 performTrivialCopy(Bldr, N, *Call);
786
787 } else {
788 for (ExplodedNode *N : DstPreCall)
789 getCheckerManager().runCheckersForEvalCall(DstEvaluated, N, *Call, *this,
790 CallOpts);
791 }
792
793 // If the CFG was constructed without elements for temporary destructors
794 // and the just-called constructor created a temporary object then
795 // stop exploration if the temporary object has a noreturn constructor.
796 // This can lose coverage because the destructor, if it were present
797 // in the CFG, would be called at the end of the full expression or
798 // later (for life-time extended temporaries) -- but avoids infeasible
799 // paths when no-return temporary destructors are used for assertions.
800 ExplodedNodeSet DstEvaluatedPostProcessed;
801 StmtNodeBuilder Bldr(DstEvaluated, DstEvaluatedPostProcessed, *currBldrCtx);
802 const AnalysisDeclContext *ADC = LCtx->getAnalysisDeclContext();
804 if (llvm::isa_and_nonnull<CXXTempObjectRegion,
805 CXXLifetimeExtendedObjectRegion>(TargetRegion) &&
806 cast<CXXConstructorDecl>(Call->getDecl())
807 ->getParent()
808 ->isAnyDestructorNoReturn()) {
809
810 // If we've inlined the constructor, then DstEvaluated would be empty.
811 // In this case we still want a sink, which could be implemented
812 // in processCallExit. But we don't have that implemented at the moment,
813 // so if you hit this assertion, see if you can avoid inlining
814 // the respective constructor when analyzer-config cfg-temporary-dtors
815 // is set to false.
816 // Otherwise there's nothing wrong with inlining such constructor.
817 assert(!DstEvaluated.empty() &&
818 "We should not have inlined this constructor!");
819
820 for (ExplodedNode *N : DstEvaluated) {
821 Bldr.generateSink(E, N, N->getState());
822 }
823
824 // There is no need to run the PostCall and PostStmt checker
825 // callbacks because we just generated sinks on all nodes in th
826 // frontier.
827 return;
828 }
829 }
830
831 ExplodedNodeSet DstPostArgumentCleanup;
832 for (ExplodedNode *I : DstEvaluatedPostProcessed)
833 finishArgumentConstruction(DstPostArgumentCleanup, I, *Call);
834
835 // If there were other constructors called for object-type arguments
836 // of this constructor, clean them up.
837 ExplodedNodeSet DstPostCall;
839 DstPostArgumentCleanup,
840 *Call, *this);
841 getCheckerManager().runCheckersForPostStmt(destNodes, DstPostCall, E, *this);
842}
843
845 ExplodedNode *Pred,
846 ExplodedNodeSet &Dst) {
847 handleConstructor(CE, Pred, Dst);
848}
849
851 const CXXInheritedCtorInitExpr *CE, ExplodedNode *Pred,
852 ExplodedNodeSet &Dst) {
853 handleConstructor(CE, Pred, Dst);
854}
855
857 const MemRegion *Dest,
858 const Stmt *S,
859 bool IsBaseDtor,
860 ExplodedNode *Pred,
861 ExplodedNodeSet &Dst,
862 EvalCallOptions &CallOpts) {
863 assert(S && "A destructor without a trigger!");
864 const LocationContext *LCtx = Pred->getLocationContext();
865 ProgramStateRef State = Pred->getState();
866
867 const CXXRecordDecl *RecordDecl = ObjectType->getAsCXXRecordDecl();
868 assert(RecordDecl && "Only CXXRecordDecls should have destructors");
869 const CXXDestructorDecl *DtorDecl = RecordDecl->getDestructor();
870 // FIXME: There should always be a Decl, otherwise the destructor call
871 // shouldn't have been added to the CFG in the first place.
872 if (!DtorDecl) {
873 // Skip the invalid destructor. We cannot simply return because
874 // it would interrupt the analysis instead.
875 static SimpleProgramPointTag T("ExprEngine", "SkipInvalidDestructor");
876 // FIXME: PostImplicitCall with a null decl may crash elsewhere anyway.
877 PostImplicitCall PP(/*Decl=*/nullptr, S->getEndLoc(), LCtx,
878 getCFGElementRef(), &T);
879 NodeBuilder Bldr(Pred, Dst, *currBldrCtx);
880 Bldr.generateNode(PP, Pred->getState(), Pred);
881 return;
882 }
883
884 if (!Dest) {
885 // We're trying to destroy something that is not a region. This may happen
886 // for a variety of reasons (unknown target region, concrete integer instead
887 // of target region, etc.). The current code makes an attempt to recover.
888 // FIXME: We probably don't really need to recover when we're dealing
889 // with concrete integers specifically.
891 if (const Expr *E = dyn_cast_or_null<Expr>(S)) {
892 Dest = MRMgr.getCXXTempObjectRegion(E, Pred->getLocationContext());
893 } else {
894 static SimpleProgramPointTag T("ExprEngine", "SkipInvalidDestructor");
895 NodeBuilder Bldr(Pred, Dst, *currBldrCtx);
896 Bldr.generateSink(Pred->getLocation().withTag(&T),
897 Pred->getState(), Pred);
898 return;
899 }
900 }
901
904 DtorDecl, S, Dest, IsBaseDtor, State, LCtx, getCFGElementRef());
905
906 PrettyStackTraceLoc CrashInfo(getContext().getSourceManager(),
907 Call->getSourceRange().getBegin(),
908 "Error evaluating destructor");
909
910 ExplodedNodeSet DstPreCall;
911 getCheckerManager().runCheckersForPreCall(DstPreCall, Pred,
912 *Call, *this);
913
914 ExplodedNodeSet DstInvalidated;
915 StmtNodeBuilder Bldr(DstPreCall, DstInvalidated, *currBldrCtx);
916 for (ExplodedNode *N : DstPreCall)
917 defaultEvalCall(Bldr, N, *Call, CallOpts);
918
919 getCheckerManager().runCheckersForPostCall(Dst, DstInvalidated,
920 *Call, *this);
921}
922
924 ExplodedNode *Pred,
925 ExplodedNodeSet &Dst) {
926 ProgramStateRef State = Pred->getState();
927 const LocationContext *LCtx = Pred->getLocationContext();
928 PrettyStackTraceLoc CrashInfo(getContext().getSourceManager(),
929 CNE->getBeginLoc(),
930 "Error evaluating New Allocator Call");
933 CEMgr.getCXXAllocatorCall(CNE, State, LCtx, getCFGElementRef());
934
935 ExplodedNodeSet DstPreCall;
936 getCheckerManager().runCheckersForPreCall(DstPreCall, Pred,
937 *Call, *this);
938
939 ExplodedNodeSet DstPostCall;
940 StmtNodeBuilder CallBldr(DstPreCall, DstPostCall, *currBldrCtx);
941 for (ExplodedNode *I : DstPreCall) {
942 // FIXME: Provide evalCall for checkers?
943 defaultEvalCall(CallBldr, I, *Call);
944 }
945 // If the call is inlined, DstPostCall will be empty and we bail out now.
946
947 // Store return value of operator new() for future use, until the actual
948 // CXXNewExpr gets processed.
949 ExplodedNodeSet DstPostValue;
950 StmtNodeBuilder ValueBldr(DstPostCall, DstPostValue, *currBldrCtx);
951 for (ExplodedNode *I : DstPostCall) {
952 // FIXME: Because CNE serves as the "call site" for the allocator (due to
953 // lack of a better expression in the AST), the conjured return value symbol
954 // is going to be of the same type (C++ object pointer type). Technically
955 // this is not correct because the operator new's prototype always says that
956 // it returns a 'void *'. So we should change the type of the symbol,
957 // and then evaluate the cast over the symbolic pointer from 'void *' to
958 // the object pointer type. But without changing the symbol's type it
959 // is breaking too much to evaluate the no-op symbolic cast over it, so we
960 // skip it for now.
961 ProgramStateRef State = I->getState();
962 SVal RetVal = State->getSVal(CNE, LCtx);
963 // [basic.stc.dynamic.allocation] (on the return value of an allocation
964 // function):
965 // "The order, contiguity, and initial value of storage allocated by
966 // successive calls to an allocation function are unspecified."
967 State = State->bindDefaultInitial(RetVal, UndefinedVal{}, LCtx);
968
969 // If this allocation function is not declared as non-throwing, failures
970 // /must/ be signalled by exceptions, and thus the return value will never
971 // be NULL. -fno-exceptions does not influence this semantics.
972 // FIXME: GCC has a -fcheck-new option, which forces it to consider the case
973 // where new can return NULL. If we end up supporting that option, we can
974 // consider adding a check for it here.
975 // C++11 [basic.stc.dynamic.allocation]p3.
976 if (const FunctionDecl *FD = CNE->getOperatorNew()) {
977 QualType Ty = FD->getType();
978 if (const auto *ProtoType = Ty->getAs<FunctionProtoType>())
979 if (!ProtoType->isNothrow())
980 State = State->assume(RetVal.castAs<DefinedOrUnknownSVal>(), true);
981 }
982
983 ValueBldr.generateNode(
984 CNE, I, addObjectUnderConstruction(State, CNE, LCtx, RetVal));
985 }
986
987 ExplodedNodeSet DstPostPostCallCallback;
988 getCheckerManager().runCheckersForPostCall(DstPostPostCallCallback,
989 DstPostValue, *Call, *this);
990 for (ExplodedNode *I : DstPostPostCallCallback) {
992 }
993}
994
996 ExplodedNodeSet &Dst) {
997 // FIXME: Much of this should eventually migrate to CXXAllocatorCall.
998 // Also, we need to decide how allocators actually work -- they're not
999 // really part of the CXXNewExpr because they happen BEFORE the
1000 // CXXConstructExpr subexpression. See PR12014 for some discussion.
1001
1002 unsigned blockCount = currBldrCtx->blockCount();
1003 const LocationContext *LCtx = Pred->getLocationContext();
1004 SVal symVal = UnknownVal();
1005 FunctionDecl *FD = CNE->getOperatorNew();
1006
1007 bool IsStandardGlobalOpNewFunction =
1009
1010 ProgramStateRef State = Pred->getState();
1011
1012 // Retrieve the stored operator new() return value.
1013 if (AMgr.getAnalyzerOptions().MayInlineCXXAllocator) {
1014 symVal = *getObjectUnderConstruction(State, CNE, LCtx);
1015 State = finishObjectConstruction(State, CNE, LCtx);
1016 }
1017
1018 // We assume all standard global 'operator new' functions allocate memory in
1019 // heap. We realize this is an approximation that might not correctly model
1020 // a custom global allocator.
1021 if (symVal.isUnknown()) {
1022 if (IsStandardGlobalOpNewFunction)
1023 symVal = svalBuilder.getConjuredHeapSymbolVal(CNE, LCtx, blockCount);
1024 else
1025 symVal = svalBuilder.conjureSymbolVal(nullptr, CNE, LCtx, CNE->getType(),
1026 blockCount);
1027 }
1028
1031 CEMgr.getCXXAllocatorCall(CNE, State, LCtx, getCFGElementRef());
1032
1033 if (!AMgr.getAnalyzerOptions().MayInlineCXXAllocator) {
1034 // Invalidate placement args.
1035 // FIXME: Once we figure out how we want allocators to work,
1036 // we should be using the usual pre-/(default-)eval-/post-call checkers
1037 // here.
1038 State = Call->invalidateRegions(blockCount);
1039 if (!State)
1040 return;
1041
1042 // If this allocation function is not declared as non-throwing, failures
1043 // /must/ be signalled by exceptions, and thus the return value will never
1044 // be NULL. -fno-exceptions does not influence this semantics.
1045 // FIXME: GCC has a -fcheck-new option, which forces it to consider the case
1046 // where new can return NULL. If we end up supporting that option, we can
1047 // consider adding a check for it here.
1048 // C++11 [basic.stc.dynamic.allocation]p3.
1049 if (const auto *ProtoType = FD->getType()->getAs<FunctionProtoType>())
1050 if (!ProtoType->isNothrow())
1051 if (auto dSymVal = symVal.getAs<DefinedOrUnknownSVal>())
1052 State = State->assume(*dSymVal, true);
1053 }
1054
1055 StmtNodeBuilder Bldr(Pred, Dst, *currBldrCtx);
1056
1057 SVal Result = symVal;
1058
1059 if (CNE->isArray()) {
1060
1061 if (const auto *NewReg = cast_or_null<SubRegion>(symVal.getAsRegion())) {
1062 // If each element is initialized by their default constructor, the field
1063 // values are properly placed inside the required region, however if an
1064 // initializer list is used, this doesn't happen automatically.
1065 auto *Init = CNE->getInitializer();
1066 bool isInitList = isa_and_nonnull<InitListExpr>(Init);
1067
1068 QualType ObjTy =
1069 isInitList ? Init->getType() : CNE->getType()->getPointeeType();
1070 const ElementRegion *EleReg =
1071 MRMgr.getElementRegion(ObjTy, svalBuilder.makeArrayIndex(0), NewReg,
1072 svalBuilder.getContext());
1073 Result = loc::MemRegionVal(EleReg);
1074
1075 // If the array is list initialized, we bind the initializer list to the
1076 // memory region here, otherwise we would lose it.
1077 if (isInitList) {
1078 Bldr.takeNodes(Pred);
1079 Pred = Bldr.generateNode(CNE, Pred, State);
1080
1081 SVal V = State->getSVal(Init, LCtx);
1082 ExplodedNodeSet evaluated;
1083 evalBind(evaluated, CNE, Pred, Result, V, true);
1084
1085 Bldr.takeNodes(Pred);
1086 Bldr.addNodes(evaluated);
1087
1088 Pred = *evaluated.begin();
1089 State = Pred->getState();
1090 }
1091 }
1092
1093 State = State->BindExpr(CNE, Pred->getLocationContext(), Result);
1094 Bldr.generateNode(CNE, Pred, State);
1095 return;
1096 }
1097
1098 // FIXME: Once we have proper support for CXXConstructExprs inside
1099 // CXXNewExpr, we need to make sure that the constructed object is not
1100 // immediately invalidated here. (The placement call should happen before
1101 // the constructor call anyway.)
1103 // Non-array placement new should always return the placement location.
1104 SVal PlacementLoc = State->getSVal(CNE->getPlacementArg(0), LCtx);
1105 Result = svalBuilder.evalCast(PlacementLoc, CNE->getType(),
1106 CNE->getPlacementArg(0)->getType());
1107 }
1108
1109 // Bind the address of the object, then check to see if we cached out.
1110 State = State->BindExpr(CNE, LCtx, Result);
1111 ExplodedNode *NewN = Bldr.generateNode(CNE, Pred, State);
1112 if (!NewN)
1113 return;
1114
1115 // If the type is not a record, we won't have a CXXConstructExpr as an
1116 // initializer. Copy the value over.
1117 if (const Expr *Init = CNE->getInitializer()) {
1118 if (!isa<CXXConstructExpr>(Init)) {
1119 assert(Bldr.getResults().size() == 1);
1120 Bldr.takeNodes(NewN);
1121 evalBind(Dst, CNE, NewN, Result, State->getSVal(Init, LCtx),
1122 /*FirstInit=*/IsStandardGlobalOpNewFunction);
1123 }
1124 }
1125}
1126
1128 ExplodedNode *Pred, ExplodedNodeSet &Dst) {
1129
1132 CDE, Pred->getState(), Pred->getLocationContext(), getCFGElementRef());
1133
1134 ExplodedNodeSet DstPreCall;
1135 getCheckerManager().runCheckersForPreCall(DstPreCall, Pred, *Call, *this);
1136 ExplodedNodeSet DstPostCall;
1137
1138 if (AMgr.getAnalyzerOptions().MayInlineCXXAllocator) {
1139 StmtNodeBuilder Bldr(DstPreCall, DstPostCall, *currBldrCtx);
1140 for (ExplodedNode *I : DstPreCall) {
1141 defaultEvalCall(Bldr, I, *Call);
1142 }
1143 } else {
1144 DstPostCall = DstPreCall;
1145 }
1146 getCheckerManager().runCheckersForPostCall(Dst, DstPostCall, *Call, *this);
1147}
1148
1150 ExplodedNodeSet &Dst) {
1151 const VarDecl *VD = CS->getExceptionDecl();
1152 if (!VD) {
1153 Dst.Add(Pred);
1154 return;
1155 }
1156
1157 const LocationContext *LCtx = Pred->getLocationContext();
1158 SVal V = svalBuilder.conjureSymbolVal(CS, LCtx, VD->getType(),
1159 currBldrCtx->blockCount());
1160 ProgramStateRef state = Pred->getState();
1161 state = state->bindLoc(state->getLValue(VD, LCtx), V, LCtx);
1162
1163 StmtNodeBuilder Bldr(Pred, Dst, *currBldrCtx);
1164 Bldr.generateNode(CS, Pred, state);
1165}
1166
1168 ExplodedNodeSet &Dst) {
1169 StmtNodeBuilder Bldr(Pred, Dst, *currBldrCtx);
1170
1171 // Get the this object region from StoreManager.
1172 const LocationContext *LCtx = Pred->getLocationContext();
1173 const MemRegion *R =
1174 svalBuilder.getRegionManager().getCXXThisRegion(
1175 getContext().getCanonicalType(TE->getType()),
1176 LCtx);
1177
1178 ProgramStateRef state = Pred->getState();
1179 SVal V = state->getSVal(loc::MemRegionVal(R));
1180 Bldr.generateNode(TE, Pred, state->BindExpr(TE, LCtx, V));
1181}
1182
1184 ExplodedNodeSet &Dst) {
1185 const LocationContext *LocCtxt = Pred->getLocationContext();
1186
1187 // Get the region of the lambda itself.
1188 const MemRegion *R = svalBuilder.getRegionManager().getCXXTempObjectRegion(
1189 LE, LocCtxt);
1191
1192 ProgramStateRef State = Pred->getState();
1193
1194 // If we created a new MemRegion for the lambda, we should explicitly bind
1195 // the captures.
1196 for (auto const [Idx, FieldForCapture, InitExpr] :
1197 llvm::zip(llvm::seq<unsigned>(0, -1), LE->getLambdaClass()->fields(),
1198 LE->capture_inits())) {
1199 SVal FieldLoc = State->getLValue(FieldForCapture, V);
1200
1201 SVal InitVal;
1202 if (!FieldForCapture->hasCapturedVLAType()) {
1203 assert(InitExpr && "Capture missing initialization expression");
1204
1205 // Capturing a 0 length array is a no-op, so we ignore it to get a more
1206 // accurate analysis. If it's not ignored, it would set the default
1207 // binding of the lambda to 'Unknown', which can lead to falsely detecting
1208 // 'Uninitialized' values as 'Unknown' and not reporting a warning.
1209 const auto FTy = FieldForCapture->getType();
1210 if (FTy->isConstantArrayType() &&
1211 getContext().getConstantArrayElementCount(
1212 getContext().getAsConstantArrayType(FTy)) == 0)
1213 continue;
1214
1215 // With C++17 copy elision the InitExpr can be anything, so instead of
1216 // pattern matching all cases, we simple check if the current field is
1217 // under construction or not, regardless what it's InitExpr is.
1218 if (const auto OUC =
1219 getObjectUnderConstruction(State, {LE, Idx}, LocCtxt)) {
1220 InitVal = State->getSVal(OUC->getAsRegion());
1221
1222 State = finishObjectConstruction(State, {LE, Idx}, LocCtxt);
1223 } else
1224 InitVal = State->getSVal(InitExpr, LocCtxt);
1225
1226 } else {
1227
1228 assert(!getObjectUnderConstruction(State, {LE, Idx}, LocCtxt) &&
1229 "VLA capture by value is a compile time error!");
1230
1231 // The field stores the length of a captured variable-length array.
1232 // These captures don't have initialization expressions; instead we
1233 // get the length from the VLAType size expression.
1234 Expr *SizeExpr = FieldForCapture->getCapturedVLAType()->getSizeExpr();
1235 InitVal = State->getSVal(SizeExpr, LocCtxt);
1236 }
1237
1238 State = State->bindLoc(FieldLoc, InitVal, LocCtxt);
1239 }
1240
1241 // Decay the Loc into an RValue, because there might be a
1242 // MaterializeTemporaryExpr node above this one which expects the bound value
1243 // to be an RValue.
1244 SVal LambdaRVal = State->getSVal(R);
1245
1246 ExplodedNodeSet Tmp;
1247 StmtNodeBuilder Bldr(Pred, Tmp, *currBldrCtx);
1248 // FIXME: is this the right program point kind?
1249 Bldr.generateNode(LE, Pred,
1250 State->BindExpr(LE, LocCtxt, LambdaRVal),
1252
1253 // FIXME: Move all post/pre visits to ::Visit().
1254 getCheckerManager().runCheckersForPostStmt(Dst, Tmp, LE, *this);
1255}
#define V(N, I)
Definition: ASTContext.h:3285
Defines the C++ Decl subclasses, other than those for templates (found in DeclTemplate....
static ProgramStateRef bindRequiredArrayElementToEnvironment(ProgramStateRef State, const ArrayInitLoopExpr *AILE, const LocationContext *LCtx, SVal Idx)
llvm::MachO::Target Target
Definition: MachO.h:50
Defines the PrettyStackTraceEntry class, which is used to make crashes give more contextual informati...
Holds long-lived AST nodes (such as types and decls) that can be referred to throughout the semantic ...
Definition: ASTContext.h:182
QualType getPointerType(QualType T) const
Return the uniqued reference to the type for a pointer to the specified type.
const ArrayType * getAsArrayType(QualType T) const
Type Query functions.
uint64_t getConstantArrayElementCount(const ConstantArrayType *CA) const
Return number of constant array elements.
uint64_t getArrayInitLoopExprElementCount(const ArrayInitLoopExpr *AILE) const
Return number of elements initialized in an ArrayInitLoopExpr.
AnalysisDeclContext contains the context data for the function, method or block under analysis.
CFG::BuildOptions & getCFGBuildOptions()
Represents a loop initializing the elements of an array.
Definition: Expr.h:5511
OpaqueValueExpr * getCommonExpr() const
Get the common subexpression shared by all initializations (the source array).
Definition: Expr.h:5526
Represents an array type, per C99 6.7.5.2 - Array Declarators.
Definition: Type.h:3519
Represents a function call that returns a C++ object by value.
Definition: CFG.h:185
Represents C++ constructor call.
Definition: CFG.h:156
std::optional< T > getAs() const
Convert to the specified CFGElement type, returning std::nullopt if this CFGElement is not of the des...
Definition: CFG.h:109
CXXCatchStmt - This represents a C++ catch block.
Definition: StmtCXX.h:28
VarDecl * getExceptionDecl() const
Definition: StmtCXX.h:49
Represents a call to a C++ constructor.
Definition: ExprCXX.h:1542
Represents a delete expression for memory deallocation and destructor calls, e.g.
Definition: ExprCXX.h:2493
Represents a C++ destructor within a class.
Definition: DeclCXX.h:2799
Represents a call to an inherited base class constructor from an inheriting constructor.
Definition: ExprCXX.h:1733
Represents a static or instance method of a struct/union/class.
Definition: DeclCXX.h:2060
Represents a new-expression for memory allocation and constructor calls, e.g: "new CXXNewExpr(foo)".
Definition: ExprCXX.h:2236
bool isArray() const
Definition: ExprCXX.h:2344
Expr * getPlacementArg(unsigned I)
Definition: ExprCXX.h:2383
SourceLocation getBeginLoc() const
Definition: ExprCXX.h:2473
FunctionDecl * getOperatorNew() const
Definition: ExprCXX.h:2339
Expr * getInitializer()
The initializer of this new-expression.
Definition: ExprCXX.h:2409
Represents a C++ struct/union/class.
Definition: DeclCXX.h:258
bool isEmpty() const
Determine whether this is an empty class in the sense of (C++11 [meta.unary.prop]).
Definition: DeclCXX.h:1190
Represents the this expression in C++.
Definition: ExprCXX.h:1148
CallExpr - Represents a function call (C99 6.5.2.2, C++ [expr.call]).
Definition: Expr.h:2820
ConstructionContext's subclasses describe different ways of constructing an object in C++.
virtual const ArrayInitLoopExpr * getArrayInitLoop() const
DeclContext * getParent()
getParent - Returns the containing DeclContext.
Definition: DeclBase.h:2066
Decl - This represents one declaration (or definition), e.g.
Definition: DeclBase.h:86
This represents one expression.
Definition: Expr.h:110
Expr * IgnoreParens() LLVM_READONLY
Skip past any parentheses which might surround this expression until reaching a fixed point.
Definition: Expr.cpp:3055
QualType getType() const
Definition: Expr.h:142
Represents a function declaration or definition.
Definition: Decl.h:1971
bool isReservedGlobalPlacementOperator() const
Determines whether this operator new or delete is one of the reserved global placement operators: voi...
Definition: Decl.cpp:3341
bool isReplaceableGlobalAllocationFunction(std::optional< unsigned > *AlignmentParam=nullptr, bool *IsNothrow=nullptr) const
Determines whether this function is one of the replaceable global allocation functions: void *operato...
Definition: Decl.cpp:3366
Represents a prototype with parameter type info, e.g.
Definition: Type.h:4657
A C++ lambda expression, which produces a function object (of unspecified type) that can be invoked l...
Definition: ExprCXX.h:1950
It wraps the AnalysisDeclContext to represent both the call stack with the help of StackFrameContext ...
const Decl * getDecl() const
const ParentMap & getParentMap() const
LLVM_ATTRIBUTE_RETURNS_NONNULL AnalysisDeclContext * getAnalysisDeclContext() const
const LocationContext * getParent() const
It might return null.
const StackFrameContext * getStackFrame() const
Represents a prvalue temporary that is written into memory so that a reference can bind to it.
Definition: ExprCXX.h:4721
StorageDuration getStorageDuration() const
Retrieve the storage duration for the materialized temporary.
Definition: ExprCXX.h:4746
Expr * getSubExpr() const
Retrieve the temporary-generating subexpression whose value will be materialized into a glvalue.
Definition: ExprCXX.h:4738
ValueDecl * getExtendingDecl()
Get the declaration which triggered the lifetime-extension of this temporary, if any.
Definition: ExprCXX.h:4771
Expr * getSourceExpr() const
The source expression of an opaque value expression is the expression which originally generated the ...
Definition: Expr.h:1218
Stmt * getParent(Stmt *) const
Definition: ParentMap.cpp:136
Represents a program point just after an implicit call event.
Definition: ProgramPoint.h:597
If a crash happens while one of these objects are live, the message is printed out along with the spe...
ProgramPoint withTag(const ProgramPointTag *tag) const
Create a new ProgramPoint object that is the same as the original except for using the specified tag ...
Definition: ProgramPoint.h:129
A (possibly-)qualified type.
Definition: Type.h:940
Represents a struct/union/class.
Definition: Decl.h:4168
It represents a stack frame of the call stack (based on CallEvent).
const Stmt * getCallSite() const
const CFGBlock * getCallSiteBlock() const
Stmt - This represents one statement.
Definition: Stmt.h:84
CXXRecordDecl * getAsCXXRecordDecl() const
Retrieves the CXXRecordDecl that this type refers to, either because the type is a RecordType or beca...
Definition: Type.cpp:1871
QualType getPointeeType() const
If this is a pointer, ObjC object pointer, or block pointer, this returns the respective pointee.
Definition: Type.cpp:695
const T * getAs() const
Member-template getAs<specific type>'.
Definition: Type.h:8131
Represent the declaration of a variable (in which case it is an lvalue) a function (in which case it ...
Definition: Decl.h:706
QualType getType() const
Definition: Decl.h:717
Represents a variable declaration or definition.
Definition: Decl.h:918
AnalyzerOptions & getAnalyzerOptions() override
Represents a call to a C++ constructor.
Definition: CallEvent.h:979
Manages the lifetime of CallEvent objects.
Definition: CallEvent.h:1356
CallEventRef< CXXDestructorCall > getCXXDestructorCall(const CXXDestructorDecl *DD, const Stmt *Trigger, const MemRegion *Target, bool IsBase, ProgramStateRef State, const LocationContext *LCtx, CFGBlock::ConstCFGElementRef ElemRef)
Definition: CallEvent.h:1449
CallEventRef< CXXDeallocatorCall > getCXXDeallocatorCall(const CXXDeleteExpr *E, ProgramStateRef State, const LocationContext *LCtx, CFGBlock::ConstCFGElementRef ElemRef)
Definition: CallEvent.h:1465
CallEventRef getSimpleCall(const CallExpr *E, ProgramStateRef State, const LocationContext *LCtx, CFGBlock::ConstCFGElementRef ElemRef)
Definition: CallEvent.cpp:1403
CallEventRef< ObjCMethodCall > getObjCMethodCall(const ObjCMessageExpr *E, ProgramStateRef State, const LocationContext *LCtx, CFGBlock::ConstCFGElementRef ElemRef)
Definition: CallEvent.h:1427
CallEventRef< CXXAllocatorCall > getCXXAllocatorCall(const CXXNewExpr *E, ProgramStateRef State, const LocationContext *LCtx, CFGBlock::ConstCFGElementRef ElemRef)
Definition: CallEvent.h:1458
CallEventRef< CXXConstructorCall > getCXXConstructorCall(const CXXConstructExpr *E, const MemRegion *Target, ProgramStateRef State, const LocationContext *LCtx, CFGBlock::ConstCFGElementRef ElemRef)
Definition: CallEvent.h:1434
CallEventRef< CXXInheritedConstructorCall > getCXXInheritedConstructorCall(const CXXInheritedCtorInitExpr *E, const MemRegion *Target, ProgramStateRef State, const LocationContext *LCtx, CFGBlock::ConstCFGElementRef ElemRef)
Definition: CallEvent.h:1441
Represents an abstract call to a function or method along a particular path.
Definition: CallEvent.h:153
static bool isVariadic(const Decl *D)
Returns true if the given decl is known to be variadic.
Definition: CallEvent.cpp:380
void runCheckersForPreCall(ExplodedNodeSet &Dst, const ExplodedNodeSet &Src, const CallEvent &Call, ExprEngine &Eng)
Run checkers for pre-visiting obj-c messages.
void runCheckersForEvalCall(ExplodedNodeSet &Dst, const ExplodedNodeSet &Src, const CallEvent &CE, ExprEngine &Eng, const EvalCallOptions &CallOpts)
Run checkers for evaluating a call.
void runCheckersForPostStmt(ExplodedNodeSet &Dst, const ExplodedNodeSet &Src, const Stmt *S, ExprEngine &Eng, bool wasInlined=false)
Run checkers for post-visiting Stmts.
void runCheckersForNewAllocator(const CXXAllocatorCall &Call, ExplodedNodeSet &Dst, ExplodedNode *Pred, ExprEngine &Eng, bool wasInlined=false)
Run checkers between C++ operator new and constructor calls.
void runCheckersForPreStmt(ExplodedNodeSet &Dst, const ExplodedNodeSet &Src, const Stmt *S, ExprEngine &Eng)
Run checkers for pre-visiting Stmts.
void runCheckersForPostCall(ExplodedNodeSet &Dst, const ExplodedNodeSet &Src, const CallEvent &Call, ExprEngine &Eng, bool wasInlined=false)
Run checkers for post-visiting obj-c messages.
ElementRegion is used to represent both array elements and casts.
Definition: MemRegion.h:1194
void Add(ExplodedNode *N)
const ProgramStateRef & getState() const
ProgramPoint getLocation() const
getLocation - Returns the edge associated with the given node.
const LocationContext * getLocationContext() const
ProgramStateManager & getStateManager()
Definition: ExprEngine.h:410
std::pair< ProgramStateRef, SVal > handleConstructionContext(const Expr *E, ProgramStateRef State, const NodeBuilderContext *BldrCtx, const LocationContext *LCtx, const ConstructionContext *CC, EvalCallOptions &CallOpts, unsigned Idx=0)
A convenient wrapper around computeObjectUnderConstruction and updateObjectsUnderConstruction.
Definition: ExprEngine.h:738
void VisitCXXDestructor(QualType ObjectType, const MemRegion *Dest, const Stmt *S, bool IsBaseDtor, ExplodedNode *Pred, ExplodedNodeSet &Dst, EvalCallOptions &Options)
const CoreEngine & getCoreEngine() const
Definition: ExprEngine.h:433
void VisitCXXNewExpr(const CXXNewExpr *CNE, ExplodedNode *Pred, ExplodedNodeSet &Dst)
void VisitLambdaExpr(const LambdaExpr *LE, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitLambdaExpr - Transfer function logic for LambdaExprs.
static std::optional< SVal > getObjectUnderConstruction(ProgramStateRef State, const ConstructionContextItem &Item, const LocationContext *LC)
By looking at a certain item that may be potentially part of an object's ConstructionContext,...
Definition: ExprEngine.cpp:603
CFGElement getCurrentCFGElement()
Return the CFG element corresponding to the worklist element that is currently being processed by Exp...
Definition: ExprEngine.h:687
SVal computeObjectUnderConstruction(const Expr *E, ProgramStateRef State, const NodeBuilderContext *BldrCtx, const LocationContext *LCtx, const ConstructionContext *CC, EvalCallOptions &CallOpts, unsigned Idx=0)
Find location of the object that is being constructed by a given constructor.
static std::optional< unsigned > getIndexOfElementToConstruct(ProgramStateRef State, const CXXConstructExpr *E, const LocationContext *LCtx)
Retreives which element is being constructed in a non-POD type array.
Definition: ExprEngine.cpp:513
ASTContext & getContext() const
getContext - Return the ASTContext associated with this analysis.
Definition: ExprEngine.h:196
StoreManager & getStoreManager()
Definition: ExprEngine.h:412
void VisitCXXNewAllocatorCall(const CXXNewExpr *CNE, ExplodedNode *Pred, ExplodedNodeSet &Dst)
void CreateCXXTemporaryObject(const MaterializeTemporaryExpr *ME, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Create a C++ temporary object for an rvalue.
CFGBlock::ConstCFGElementRef getCFGElementRef() const
Definition: ExprEngine.h:229
CheckerManager & getCheckerManager() const
Definition: ExprEngine.h:204
ProgramStateRef bindReturnValue(const CallEvent &Call, const LocationContext *LCtx, ProgramStateRef State)
Create a new state in which the call return value is binded to the call origin expression.
void VisitCXXThisExpr(const CXXThisExpr *TE, ExplodedNode *Pred, ExplodedNodeSet &Dst)
void VisitCXXDeleteExpr(const CXXDeleteExpr *CDE, ExplodedNode *Pred, ExplodedNodeSet &Dst)
void VisitCXXConstructExpr(const CXXConstructExpr *E, ExplodedNode *Pred, ExplodedNodeSet &Dst)
void VisitCXXInheritedCtorInitExpr(const CXXInheritedCtorInitExpr *E, ExplodedNode *Pred, ExplodedNodeSet &Dst)
void defaultEvalCall(NodeBuilder &B, ExplodedNode *Pred, const CallEvent &Call, const EvalCallOptions &CallOpts={})
Default implementation of call evaluation.
void VisitCXXCatchStmt(const CXXCatchStmt *CS, ExplodedNode *Pred, ExplodedNodeSet &Dst)
SValBuilder & getSValBuilder()
Definition: ExprEngine.h:208
ProgramStateRef updateObjectsUnderConstruction(SVal V, const Expr *E, ProgramStateRef State, const LocationContext *LCtx, const ConstructionContext *CC, const EvalCallOptions &CallOpts)
Update the program state with all the path-sensitive information that's necessary to perform construc...
static std::optional< unsigned > getPendingInitLoop(ProgramStateRef State, const CXXConstructExpr *E, const LocationContext *LCtx)
Retreives the size of the array in the pending ArrayInitLoopExpr.
Definition: ExprEngine.cpp:486
const CXXThisRegion * getCXXThisRegion(QualType thisPointerTy, const LocationContext *LC)
getCXXThisRegion - Retrieve the [artificial] region associated with the parameter 'this'.
Definition: MemRegion.cpp:1289
const ElementRegion * getElementRegion(QualType elementType, NonLoc Idx, const SubRegion *superRegion, ASTContext &Ctx)
getElementRegion - Retrieve the memory region associated with the associated element type,...
Definition: MemRegion.cpp:1159
const CXXLifetimeExtendedObjectRegion * getCXXLifetimeExtendedObjectRegion(Expr const *Ex, ValueDecl const *VD, LocationContext const *LC)
Create a CXXLifetimeExtendedObjectRegion for temporaries which are lifetime-extended by local referen...
Definition: MemRegion.cpp:1224
const CXXTempObjectRegion * getCXXTempObjectRegion(Expr const *Ex, LocationContext const *LC)
Definition: MemRegion.cpp:1216
const CXXBaseObjectRegion * getCXXBaseObjectRegion(const CXXRecordDecl *BaseClass, const SubRegion *Super, bool IsVirtual)
Create a CXXBaseObjectRegion with the given base class for region Super.
Definition: MemRegion.cpp:1263
const CXXLifetimeExtendedObjectRegion * getCXXStaticLifetimeExtendedObjectRegion(const Expr *Ex, ValueDecl const *VD)
Create a CXXLifetimeExtendedObjectRegion for temporaries which are lifetime-extended by static refere...
Definition: MemRegion.cpp:1233
MemRegion - The root abstract class for all memory regions.
Definition: MemRegion.h:96
unsigned blockCount() const
Returns the number of times the current basic block has been visited on the exploded graph path.
Definition: CoreEngine.h:222
This is the simplest builder which generates nodes in the ExplodedGraph.
Definition: CoreEngine.h:238
ExplodedNode * generateNode(const ProgramPoint &PP, ProgramStateRef State, ExplodedNode *Pred)
Generates a node in the ExplodedGraph.
Definition: CoreEngine.h:291
void takeNodes(const ExplodedNodeSet &S)
Definition: CoreEngine.h:333
ExplodedNode * generateSink(const ProgramPoint &PP, ProgramStateRef State, ExplodedNode *Pred)
Generates a sink in the ExplodedGraph.
Definition: CoreEngine.h:304
void addNodes(const ExplodedNodeSet &S)
Definition: CoreEngine.h:339
const ExplodedNodeSet & getResults()
Definition: CoreEngine.h:310
CallEventManager & getCallEventManager()
Definition: ProgramState.h:579
MemRegionManager & getRegionManager()
Definition: SValBuilder.h:167
NonLoc makeArrayIndex(uint64_t idx)
Definition: SValBuilder.h:284
ASTContext & getContext()
Definition: SValBuilder.h:148
loc::MemRegionVal makeLoc(SymbolRef sym)
Definition: SValBuilder.h:377
SVal evalCast(SVal V, QualType CastTy, QualType OriginalTy)
Cast a given SVal to another SVal using given QualType's.
DefinedOrUnknownSVal conjureSymbolVal(const void *symbolTag, const Expr *expr, const LocationContext *LCtx, unsigned count)
Create a new symbol with a unique 'name'.
loc::MemRegionVal getCXXThis(const CXXMethodDecl *D, const StackFrameContext *SFC)
Return a memory region for the 'this' object reference.
DefinedOrUnknownSVal getConjuredHeapSymbolVal(const Expr *E, const LocationContext *LCtx, unsigned Count)
Conjure a symbol representing heap allocated memory region.
SVal - This represents a symbolic expression, which can be either an L-value or an R-value.
Definition: SVals.h:55
std::optional< T > getAs() const
Convert to the specified SVal type, returning std::nullopt if this SVal is not of the desired type.
Definition: SVals.h:86
const MemRegion * getAsRegion() const
Definition: SVals.cpp:120
T castAs() const
Convert to the specified SVal type, asserting that this SVal is of the desired type.
Definition: SVals.h:82
bool isUnknown() const
Definition: SVals.h:102
This builder class is useful for generating nodes that resulted from visiting a statement.
Definition: CoreEngine.h:382
ExplodedNode * generateNode(const Stmt *S, ExplodedNode *Pred, ProgramStateRef St, const ProgramPointTag *tag=nullptr, ProgramPoint::Kind K=ProgramPoint::PostStmtKind)
Definition: CoreEngine.h:411
SVal evalDerivedToBase(SVal Derived, const CastExpr *Cast)
Evaluates a chain of derived-to-base casts through the path specified in Cast.
Definition: Store.cpp:252
SubRegion - A region that subsets another larger region.
Definition: MemRegion.h:441
TypedValueRegion - An abstract class representing regions having a typed value.
Definition: MemRegion.h:530
The JSON file list parser is used to communicate input to InstallAPI.
CXXConstructionKind
Definition: ExprCXX.h:1534
StorageDuration
The storage duration for an object (per C++ [basic.stc]).
Definition: Specifiers.h:324
@ SD_Thread
Thread storage duration.
Definition: Specifiers.h:327
@ SD_Static
Static storage duration.
Definition: Specifiers.h:328
@ SD_FullExpression
Full-expression storage duration (for temporaries).
Definition: Specifiers.h:325
@ Result
The result type of a method or function.
const FunctionProtoType * T
Expr * extractElementInitializerFromNestedAILE(const ArrayInitLoopExpr *AILE)
Definition: CFG.cpp:1360
unsigned long uint64_t
Hints for figuring out of a call should be inlined during evalCall().
Definition: ExprEngine.h:97
bool IsTemporaryLifetimeExtendedViaAggregate
This call is a constructor for a temporary that is lifetime-extended by binding it to a reference-typ...
Definition: ExprEngine.h:112
bool IsTemporaryCtorOrDtor
This call is a constructor or a destructor of a temporary value.
Definition: ExprEngine.h:107
bool IsArrayCtorOrDtor
This call is a constructor or a destructor for a single element within an array, a part of array cons...
Definition: ExprEngine.h:104
bool IsElidableCtorThatHasNotBeenElided
This call is a pre-C++17 elidable constructor that we failed to elide because we failed to compute th...
Definition: ExprEngine.h:119
bool IsCtorOrDtorWithImproperlyModeledTargetRegion
This call is a constructor or a destructor for which we do not currently compute the this-region corr...
Definition: ExprEngine.h:100