clang  10.0.0svn
ExprEngineC.cpp
Go to the documentation of this file.
1 //=-- ExprEngineC.cpp - ExprEngine support for C expressions ----*- C++ -*-===//
2 //
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6 //
7 //===----------------------------------------------------------------------===//
8 //
9 // This file defines ExprEngine's support for C expressions.
10 //
11 //===----------------------------------------------------------------------===//
12 
13 #include "clang/AST/ExprCXX.h"
14 #include "clang/AST/DeclCXX.h"
17 
18 using namespace clang;
19 using namespace ento;
20 using llvm::APSInt;
21 
22 /// Optionally conjure and return a symbol for offset when processing
23 /// an expression \p Expression.
24 /// If \p Other is a location, conjure a symbol for \p Symbol
25 /// (offset) if it is unknown so that memory arithmetic always
26 /// results in an ElementRegion.
27 /// \p Count The number of times the current basic block was visited.
29  SVal Symbol, SVal Other, Expr* Expression, SValBuilder &svalBuilder,
30  unsigned Count, const LocationContext *LCtx) {
31  QualType Ty = Expression->getType();
32  if (Other.getAs<Loc>() &&
34  Symbol.isUnknown()) {
35  return svalBuilder.conjureSymbolVal(Expression, LCtx, Ty, Count);
36  }
37  return Symbol;
38 }
39 
41  ExplodedNode *Pred,
42  ExplodedNodeSet &Dst) {
43 
44  Expr *LHS = B->getLHS()->IgnoreParens();
45  Expr *RHS = B->getRHS()->IgnoreParens();
46 
47  // FIXME: Prechecks eventually go in ::Visit().
48  ExplodedNodeSet CheckedSet;
49  ExplodedNodeSet Tmp2;
50  getCheckerManager().runCheckersForPreStmt(CheckedSet, Pred, B, *this);
51 
52  // With both the LHS and RHS evaluated, process the operation itself.
53  for (ExplodedNodeSet::iterator it=CheckedSet.begin(), ei=CheckedSet.end();
54  it != ei; ++it) {
55 
56  ProgramStateRef state = (*it)->getState();
57  const LocationContext *LCtx = (*it)->getLocationContext();
58  SVal LeftV = state->getSVal(LHS, LCtx);
59  SVal RightV = state->getSVal(RHS, LCtx);
60 
62 
63  if (Op == BO_Assign) {
64  // EXPERIMENTAL: "Conjured" symbols.
65  // FIXME: Handle structs.
66  if (RightV.isUnknown()) {
67  unsigned Count = currBldrCtx->blockCount();
68  RightV = svalBuilder.conjureSymbolVal(nullptr, B->getRHS(), LCtx,
69  Count);
70  }
71  // Simulate the effects of a "store": bind the value of the RHS
72  // to the L-Value represented by the LHS.
73  SVal ExprVal = B->isGLValue() ? LeftV : RightV;
74  evalStore(Tmp2, B, LHS, *it, state->BindExpr(B, LCtx, ExprVal),
75  LeftV, RightV);
76  continue;
77  }
78 
79  if (!B->isAssignmentOp()) {
80  StmtNodeBuilder Bldr(*it, Tmp2, *currBldrCtx);
81 
82  if (B->isAdditiveOp()) {
83  // TODO: This can be removed after we enable history tracking with
84  // SymSymExpr.
85  unsigned Count = currBldrCtx->blockCount();
87  RightV, LeftV, RHS, svalBuilder, Count, LCtx);
89  LeftV, RightV, LHS, svalBuilder, Count, LCtx);
90  }
91 
92  // Although we don't yet model pointers-to-members, we do need to make
93  // sure that the members of temporaries have a valid 'this' pointer for
94  // other checks.
95  if (B->getOpcode() == BO_PtrMemD)
96  state = createTemporaryRegionIfNeeded(state, LCtx, LHS);
97 
98  // Process non-assignments except commas or short-circuited
99  // logical expressions (LAnd and LOr).
100  SVal Result = evalBinOp(state, Op, LeftV, RightV, B->getType());
101  if (!Result.isUnknown()) {
102  state = state->BindExpr(B, LCtx, Result);
103  } else {
104  // If we cannot evaluate the operation escape the operands.
105  state = escapeValue(state, LeftV, PSK_EscapeOther);
106  state = escapeValue(state, RightV, PSK_EscapeOther);
107  }
108 
109  Bldr.generateNode(B, *it, state);
110  continue;
111  }
112 
113  assert (B->isCompoundAssignmentOp());
114 
115  switch (Op) {
116  default:
117  llvm_unreachable("Invalid opcode for compound assignment.");
118  case BO_MulAssign: Op = BO_Mul; break;
119  case BO_DivAssign: Op = BO_Div; break;
120  case BO_RemAssign: Op = BO_Rem; break;
121  case BO_AddAssign: Op = BO_Add; break;
122  case BO_SubAssign: Op = BO_Sub; break;
123  case BO_ShlAssign: Op = BO_Shl; break;
124  case BO_ShrAssign: Op = BO_Shr; break;
125  case BO_AndAssign: Op = BO_And; break;
126  case BO_XorAssign: Op = BO_Xor; break;
127  case BO_OrAssign: Op = BO_Or; break;
128  }
129 
130  // Perform a load (the LHS). This performs the checks for
131  // null dereferences, and so on.
132  ExplodedNodeSet Tmp;
133  SVal location = LeftV;
134  evalLoad(Tmp, B, LHS, *it, state, location);
135 
136  for (ExplodedNodeSet::iterator I = Tmp.begin(), E = Tmp.end(); I != E;
137  ++I) {
138 
139  state = (*I)->getState();
140  const LocationContext *LCtx = (*I)->getLocationContext();
141  SVal V = state->getSVal(LHS, LCtx);
142 
143  // Get the computation type.
144  QualType CTy =
145  cast<CompoundAssignOperator>(B)->getComputationResultType();
146  CTy = getContext().getCanonicalType(CTy);
147 
148  QualType CLHSTy =
149  cast<CompoundAssignOperator>(B)->getComputationLHSType();
150  CLHSTy = getContext().getCanonicalType(CLHSTy);
151 
153 
154  // Promote LHS.
155  V = svalBuilder.evalCast(V, CLHSTy, LTy);
156 
157  // Compute the result of the operation.
158  SVal Result = svalBuilder.evalCast(evalBinOp(state, Op, V, RightV, CTy),
159  B->getType(), CTy);
160 
161  // EXPERIMENTAL: "Conjured" symbols.
162  // FIXME: Handle structs.
163 
164  SVal LHSVal;
165 
166  if (Result.isUnknown()) {
167  // The symbolic value is actually for the type of the left-hand side
168  // expression, not the computation type, as this is the value the
169  // LValue on the LHS will bind to.
170  LHSVal = svalBuilder.conjureSymbolVal(nullptr, B->getRHS(), LCtx, LTy,
171  currBldrCtx->blockCount());
172  // However, we need to convert the symbol to the computation type.
173  Result = svalBuilder.evalCast(LHSVal, CTy, LTy);
174  }
175  else {
176  // The left-hand side may bind to a different value then the
177  // computation type.
178  LHSVal = svalBuilder.evalCast(Result, LTy, CTy);
179  }
180 
181  // In C++, assignment and compound assignment operators return an
182  // lvalue.
183  if (B->isGLValue())
184  state = state->BindExpr(B, LCtx, location);
185  else
186  state = state->BindExpr(B, LCtx, Result);
187 
188  evalStore(Tmp2, B, LHS, *I, state, location, LHSVal);
189  }
190  }
191 
192  // FIXME: postvisits eventually go in ::Visit()
193  getCheckerManager().runCheckersForPostStmt(Dst, Tmp2, B, *this);
194 }
195 
197  ExplodedNodeSet &Dst) {
198 
200 
201  const BlockDecl *BD = BE->getBlockDecl();
202  // Get the value of the block itself.
203  SVal V = svalBuilder.getBlockPointer(BD, T,
204  Pred->getLocationContext(),
205  currBldrCtx->blockCount());
206 
207  ProgramStateRef State = Pred->getState();
208 
209  // If we created a new MemRegion for the block, we should explicitly bind
210  // the captured variables.
211  if (const BlockDataRegion *BDR =
212  dyn_cast_or_null<BlockDataRegion>(V.getAsRegion())) {
213 
214  BlockDataRegion::referenced_vars_iterator I = BDR->referenced_vars_begin(),
215  E = BDR->referenced_vars_end();
216 
217  auto CI = BD->capture_begin();
218  auto CE = BD->capture_end();
219  for (; I != E; ++I) {
220  const VarRegion *capturedR = I.getCapturedRegion();
221  const VarRegion *originalR = I.getOriginalRegion();
222 
223  // If the capture had a copy expression, use the result of evaluating
224  // that expression, otherwise use the original value.
225  // We rely on the invariant that the block declaration's capture variables
226  // are a prefix of the BlockDataRegion's referenced vars (which may include
227  // referenced globals, etc.) to enable fast lookup of the capture for a
228  // given referenced var.
229  const Expr *copyExpr = nullptr;
230  if (CI != CE) {
231  assert(CI->getVariable() == capturedR->getDecl());
232  copyExpr = CI->getCopyExpr();
233  CI++;
234  }
235 
236  if (capturedR != originalR) {
237  SVal originalV;
238  const LocationContext *LCtx = Pred->getLocationContext();
239  if (copyExpr) {
240  originalV = State->getSVal(copyExpr, LCtx);
241  } else {
242  originalV = State->getSVal(loc::MemRegionVal(originalR));
243  }
244  State = State->bindLoc(loc::MemRegionVal(capturedR), originalV, LCtx);
245  }
246  }
247  }
248 
249  ExplodedNodeSet Tmp;
250  StmtNodeBuilder Bldr(Pred, Tmp, *currBldrCtx);
251  Bldr.generateNode(BE, Pred,
252  State->BindExpr(BE, Pred->getLocationContext(), V),
254 
255  // FIXME: Move all post/pre visits to ::Visit().
256  getCheckerManager().runCheckersForPostStmt(Dst, Tmp, BE, *this);
257 }
258 
260  ProgramStateRef state, const Expr* Ex, const LocationContext* LCtx,
261  QualType T, QualType ExTy, const CastExpr* CastE, StmtNodeBuilder& Bldr,
262  ExplodedNode* Pred) {
263  if (T->isLValueReferenceType()) {
264  assert(!CastE->getType()->isLValueReferenceType());
265  ExTy = getContext().getLValueReferenceType(ExTy);
266  } else if (T->isRValueReferenceType()) {
267  assert(!CastE->getType()->isRValueReferenceType());
268  ExTy = getContext().getRValueReferenceType(ExTy);
269  }
270  // Delegate to SValBuilder to process.
271  SVal OrigV = state->getSVal(Ex, LCtx);
272  SVal V = svalBuilder.evalCast(OrigV, T, ExTy);
273  // Negate the result if we're treating the boolean as a signed i1
274  if (CastE->getCastKind() == CK_BooleanToSignedIntegral)
275  V = evalMinus(V);
276  state = state->BindExpr(CastE, LCtx, V);
277  if (V.isUnknown() && !OrigV.isUnknown()) {
278  state = escapeValue(state, OrigV, PSK_EscapeOther);
279  }
280  Bldr.generateNode(CastE, Pred, state);
281 
282  return state;
283 }
284 
286  ProgramStateRef state, const LocationContext* LCtx, const CastExpr* CastE,
287  StmtNodeBuilder &Bldr, ExplodedNode* Pred) {
288  // Recover some path sensitivity by conjuring a new value.
289  QualType resultType = CastE->getType();
290  if (CastE->isGLValue())
291  resultType = getContext().getPointerType(resultType);
292  SVal result = svalBuilder.conjureSymbolVal(nullptr, CastE, LCtx,
293  resultType,
294  currBldrCtx->blockCount());
295  state = state->BindExpr(CastE, LCtx, result);
296  Bldr.generateNode(CastE, Pred, state);
297 
298  return state;
299 }
300 
301 void ExprEngine::VisitCast(const CastExpr *CastE, const Expr *Ex,
302  ExplodedNode *Pred, ExplodedNodeSet &Dst) {
303 
304  ExplodedNodeSet dstPreStmt;
305  getCheckerManager().runCheckersForPreStmt(dstPreStmt, Pred, CastE, *this);
306 
307  if (CastE->getCastKind() == CK_LValueToRValue) {
308  for (ExplodedNodeSet::iterator I = dstPreStmt.begin(), E = dstPreStmt.end();
309  I!=E; ++I) {
310  ExplodedNode *subExprNode = *I;
311  ProgramStateRef state = subExprNode->getState();
312  const LocationContext *LCtx = subExprNode->getLocationContext();
313  evalLoad(Dst, CastE, CastE, subExprNode, state, state->getSVal(Ex, LCtx));
314  }
315  return;
316  }
317 
318  // All other casts.
319  QualType T = CastE->getType();
320  QualType ExTy = Ex->getType();
321 
322  if (const ExplicitCastExpr *ExCast=dyn_cast_or_null<ExplicitCastExpr>(CastE))
323  T = ExCast->getTypeAsWritten();
324 
325  StmtNodeBuilder Bldr(dstPreStmt, Dst, *currBldrCtx);
326  for (ExplodedNodeSet::iterator I = dstPreStmt.begin(), E = dstPreStmt.end();
327  I != E; ++I) {
328 
329  Pred = *I;
330  ProgramStateRef state = Pred->getState();
331  const LocationContext *LCtx = Pred->getLocationContext();
332 
333  switch (CastE->getCastKind()) {
334  case CK_LValueToRValue:
335  llvm_unreachable("LValueToRValue casts handled earlier.");
336  case CK_ToVoid:
337  continue;
338  // The analyzer doesn't do anything special with these casts,
339  // since it understands retain/release semantics already.
340  case CK_ARCProduceObject:
341  case CK_ARCConsumeObject:
342  case CK_ARCReclaimReturnedObject:
343  case CK_ARCExtendBlockObject: // Fall-through.
344  case CK_CopyAndAutoreleaseBlockObject:
345  // The analyser can ignore atomic casts for now, although some future
346  // checkers may want to make certain that you're not modifying the same
347  // value through atomic and nonatomic pointers.
348  case CK_AtomicToNonAtomic:
349  case CK_NonAtomicToAtomic:
350  // True no-ops.
351  case CK_NoOp:
352  case CK_ConstructorConversion:
353  case CK_UserDefinedConversion:
354  case CK_FunctionToPointerDecay:
355  case CK_BuiltinFnToFnPtr: {
356  // Copy the SVal of Ex to CastE.
357  ProgramStateRef state = Pred->getState();
358  const LocationContext *LCtx = Pred->getLocationContext();
359  SVal V = state->getSVal(Ex, LCtx);
360  state = state->BindExpr(CastE, LCtx, V);
361  Bldr.generateNode(CastE, Pred, state);
362  continue;
363  }
364  case CK_MemberPointerToBoolean:
365  case CK_PointerToBoolean: {
366  SVal V = state->getSVal(Ex, LCtx);
367  auto PTMSV = V.getAs<nonloc::PointerToMember>();
368  if (PTMSV)
369  V = svalBuilder.makeTruthVal(!PTMSV->isNullMemberPointer(), ExTy);
370  if (V.isUndef() || PTMSV) {
371  state = state->BindExpr(CastE, LCtx, V);
372  Bldr.generateNode(CastE, Pred, state);
373  continue;
374  }
375  // Explicitly proceed with default handler for this case cascade.
376  state =
377  handleLValueBitCast(state, Ex, LCtx, T, ExTy, CastE, Bldr, Pred);
378  continue;
379  }
380  case CK_Dependent:
381  case CK_ArrayToPointerDecay:
382  case CK_BitCast:
383  case CK_LValueToRValueBitCast:
384  case CK_AddressSpaceConversion:
385  case CK_BooleanToSignedIntegral:
386  case CK_IntegralToPointer:
387  case CK_PointerToIntegral: {
388  SVal V = state->getSVal(Ex, LCtx);
389  if (V.getAs<nonloc::PointerToMember>()) {
390  state = state->BindExpr(CastE, LCtx, UnknownVal());
391  Bldr.generateNode(CastE, Pred, state);
392  continue;
393  }
394  // Explicitly proceed with default handler for this case cascade.
395  state =
396  handleLValueBitCast(state, Ex, LCtx, T, ExTy, CastE, Bldr, Pred);
397  continue;
398  }
399  case CK_IntegralToBoolean:
400  case CK_IntegralToFloating:
401  case CK_FloatingToIntegral:
402  case CK_FloatingToBoolean:
403  case CK_FloatingCast:
404  case CK_FloatingRealToComplex:
405  case CK_FloatingComplexToReal:
406  case CK_FloatingComplexToBoolean:
407  case CK_FloatingComplexCast:
408  case CK_FloatingComplexToIntegralComplex:
409  case CK_IntegralRealToComplex:
410  case CK_IntegralComplexToReal:
411  case CK_IntegralComplexToBoolean:
412  case CK_IntegralComplexCast:
413  case CK_IntegralComplexToFloatingComplex:
414  case CK_CPointerToObjCPointerCast:
415  case CK_BlockPointerToObjCPointerCast:
416  case CK_AnyPointerToBlockPointerCast:
417  case CK_ObjCObjectLValueCast:
418  case CK_ZeroToOCLOpaqueType:
419  case CK_IntToOCLSampler:
420  case CK_LValueBitCast:
421  case CK_FixedPointCast:
422  case CK_FixedPointToBoolean:
423  case CK_FixedPointToIntegral:
424  case CK_IntegralToFixedPoint: {
425  state =
426  handleLValueBitCast(state, Ex, LCtx, T, ExTy, CastE, Bldr, Pred);
427  continue;
428  }
429  case CK_IntegralCast: {
430  // Delegate to SValBuilder to process.
431  SVal V = state->getSVal(Ex, LCtx);
432  V = svalBuilder.evalIntegralCast(state, V, T, ExTy);
433  state = state->BindExpr(CastE, LCtx, V);
434  Bldr.generateNode(CastE, Pred, state);
435  continue;
436  }
437  case CK_DerivedToBase:
438  case CK_UncheckedDerivedToBase: {
439  // For DerivedToBase cast, delegate to the store manager.
440  SVal val = state->getSVal(Ex, LCtx);
441  val = getStoreManager().evalDerivedToBase(val, CastE);
442  state = state->BindExpr(CastE, LCtx, val);
443  Bldr.generateNode(CastE, Pred, state);
444  continue;
445  }
446  // Handle C++ dyn_cast.
447  case CK_Dynamic: {
448  SVal val = state->getSVal(Ex, LCtx);
449 
450  // Compute the type of the result.
451  QualType resultType = CastE->getType();
452  if (CastE->isGLValue())
453  resultType = getContext().getPointerType(resultType);
454 
455  bool Failed = false;
456 
457  // Check if the value being cast evaluates to 0.
458  if (val.isZeroConstant())
459  Failed = true;
460  // Else, evaluate the cast.
461  else
462  val = getStoreManager().attemptDownCast(val, T, Failed);
463 
464  if (Failed) {
465  if (T->isReferenceType()) {
466  // A bad_cast exception is thrown if input value is a reference.
467  // Currently, we model this, by generating a sink.
468  Bldr.generateSink(CastE, Pred, state);
469  continue;
470  } else {
471  // If the cast fails on a pointer, bind to 0.
472  state = state->BindExpr(CastE, LCtx, svalBuilder.makeNull());
473  }
474  } else {
475  // If we don't know if the cast succeeded, conjure a new symbol.
476  if (val.isUnknown()) {
477  DefinedOrUnknownSVal NewSym =
478  svalBuilder.conjureSymbolVal(nullptr, CastE, LCtx, resultType,
479  currBldrCtx->blockCount());
480  state = state->BindExpr(CastE, LCtx, NewSym);
481  } else
482  // Else, bind to the derived region value.
483  state = state->BindExpr(CastE, LCtx, val);
484  }
485  Bldr.generateNode(CastE, Pred, state);
486  continue;
487  }
488  case CK_BaseToDerived: {
489  SVal val = state->getSVal(Ex, LCtx);
490  QualType resultType = CastE->getType();
491  if (CastE->isGLValue())
492  resultType = getContext().getPointerType(resultType);
493 
494  bool Failed = false;
495 
496  if (!val.isConstant()) {
497  val = getStoreManager().attemptDownCast(val, T, Failed);
498  }
499 
500  // Failed to cast or the result is unknown, fall back to conservative.
501  if (Failed || val.isUnknown()) {
502  val =
503  svalBuilder.conjureSymbolVal(nullptr, CastE, LCtx, resultType,
504  currBldrCtx->blockCount());
505  }
506  state = state->BindExpr(CastE, LCtx, val);
507  Bldr.generateNode(CastE, Pred, state);
508  continue;
509  }
510  case CK_NullToPointer: {
511  SVal V = svalBuilder.makeNull();
512  state = state->BindExpr(CastE, LCtx, V);
513  Bldr.generateNode(CastE, Pred, state);
514  continue;
515  }
516  case CK_NullToMemberPointer: {
517  SVal V = svalBuilder.getMemberPointer(nullptr);
518  state = state->BindExpr(CastE, LCtx, V);
519  Bldr.generateNode(CastE, Pred, state);
520  continue;
521  }
522  case CK_DerivedToBaseMemberPointer:
523  case CK_BaseToDerivedMemberPointer:
524  case CK_ReinterpretMemberPointer: {
525  SVal V = state->getSVal(Ex, LCtx);
526  if (auto PTMSV = V.getAs<nonloc::PointerToMember>()) {
527  SVal CastedPTMSV = svalBuilder.makePointerToMember(
528  getBasicVals().accumCXXBase(
529  llvm::make_range<CastExpr::path_const_iterator>(
530  CastE->path_begin(), CastE->path_end()), *PTMSV));
531  state = state->BindExpr(CastE, LCtx, CastedPTMSV);
532  Bldr.generateNode(CastE, Pred, state);
533  continue;
534  }
535  // Explicitly proceed with default handler for this case cascade.
536  state = handleLVectorSplat(state, LCtx, CastE, Bldr, Pred);
537  continue;
538  }
539  // Various C++ casts that are not handled yet.
540  case CK_ToUnion:
541  case CK_VectorSplat: {
542  state = handleLVectorSplat(state, LCtx, CastE, Bldr, Pred);
543  continue;
544  }
545  }
546  }
547 }
548 
550  ExplodedNode *Pred,
551  ExplodedNodeSet &Dst) {
552  StmtNodeBuilder B(Pred, Dst, *currBldrCtx);
553 
554  ProgramStateRef State = Pred->getState();
555  const LocationContext *LCtx = Pred->getLocationContext();
556 
557  const Expr *Init = CL->getInitializer();
558  SVal V = State->getSVal(CL->getInitializer(), LCtx);
559 
560  if (isa<CXXConstructExpr>(Init) || isa<CXXStdInitializerListExpr>(Init)) {
561  // No work needed. Just pass the value up to this expression.
562  } else {
563  assert(isa<InitListExpr>(Init));
564  Loc CLLoc = State->getLValue(CL, LCtx);
565  State = State->bindLoc(CLLoc, V, LCtx);
566 
567  if (CL->isGLValue())
568  V = CLLoc;
569  }
570 
571  B.generateNode(CL, Pred, State->BindExpr(CL, LCtx, V));
572 }
573 
575  ExplodedNodeSet &Dst) {
576  // Assumption: The CFG has one DeclStmt per Decl.
577  const VarDecl *VD = dyn_cast_or_null<VarDecl>(*DS->decl_begin());
578 
579  if (!VD) {
580  //TODO:AZ: remove explicit insertion after refactoring is done.
581  Dst.insert(Pred);
582  return;
583  }
584 
585  // FIXME: all pre/post visits should eventually be handled by ::Visit().
586  ExplodedNodeSet dstPreVisit;
587  getCheckerManager().runCheckersForPreStmt(dstPreVisit, Pred, DS, *this);
588 
589  ExplodedNodeSet dstEvaluated;
590  StmtNodeBuilder B(dstPreVisit, dstEvaluated, *currBldrCtx);
591  for (ExplodedNodeSet::iterator I = dstPreVisit.begin(), E = dstPreVisit.end();
592  I!=E; ++I) {
593  ExplodedNode *N = *I;
595  const LocationContext *LC = N->getLocationContext();
596 
597  // Decls without InitExpr are not initialized explicitly.
598  if (const Expr *InitEx = VD->getInit()) {
599 
600  // Note in the state that the initialization has occurred.
601  ExplodedNode *UpdatedN = N;
602  SVal InitVal = state->getSVal(InitEx, LC);
603 
604  assert(DS->isSingleDecl());
605  if (getObjectUnderConstruction(state, DS, LC)) {
606  state = finishObjectConstruction(state, DS, LC);
607  // We constructed the object directly in the variable.
608  // No need to bind anything.
609  B.generateNode(DS, UpdatedN, state);
610  } else {
611  // Recover some path-sensitivity if a scalar value evaluated to
612  // UnknownVal.
613  if (InitVal.isUnknown()) {
614  QualType Ty = InitEx->getType();
615  if (InitEx->isGLValue()) {
616  Ty = getContext().getPointerType(Ty);
617  }
618 
619  InitVal = svalBuilder.conjureSymbolVal(nullptr, InitEx, LC, Ty,
620  currBldrCtx->blockCount());
621  }
622 
623 
624  B.takeNodes(UpdatedN);
625  ExplodedNodeSet Dst2;
626  evalBind(Dst2, DS, UpdatedN, state->getLValue(VD, LC), InitVal, true);
627  B.addNodes(Dst2);
628  }
629  }
630  else {
631  B.generateNode(DS, N, state);
632  }
633  }
634 
635  getCheckerManager().runCheckersForPostStmt(Dst, B.getResults(), DS, *this);
636 }
637 
639  ExplodedNodeSet &Dst) {
640  // This method acts upon CFG elements for logical operators && and ||
641  // and attaches the value (true or false) to them as expressions.
642  // It doesn't produce any state splits.
643  // If we made it that far, we're past the point when we modeled the short
644  // circuit. It means that we should have precise knowledge about whether
645  // we've short-circuited. If we did, we already know the value we need to
646  // bind. If we didn't, the value of the RHS (casted to the boolean type)
647  // is the answer.
648  // Currently this method tries to figure out whether we've short-circuited
649  // by looking at the ExplodedGraph. This method is imperfect because there
650  // could inevitably have been merges that would have resulted in multiple
651  // potential path traversal histories. We bail out when we fail.
652  // Due to this ambiguity, a more reliable solution would have been to
653  // track the short circuit operation history path-sensitively until
654  // we evaluate the respective logical operator.
655  assert(B->getOpcode() == BO_LAnd ||
656  B->getOpcode() == BO_LOr);
657 
658  StmtNodeBuilder Bldr(Pred, Dst, *currBldrCtx);
659  ProgramStateRef state = Pred->getState();
660 
661  if (B->getType()->isVectorType()) {
662  // FIXME: We do not model vector arithmetic yet. When adding support for
663  // that, note that the CFG-based reasoning below does not apply, because
664  // logical operators on vectors are not short-circuit. Currently they are
665  // modeled as short-circuit in Clang CFG but this is incorrect.
666  // Do not set the value for the expression. It'd be UnknownVal by default.
667  Bldr.generateNode(B, Pred, state);
668  return;
669  }
670 
671  ExplodedNode *N = Pred;
672  while (!N->getLocation().getAs<BlockEntrance>()) {
673  ProgramPoint P = N->getLocation();
674  assert(P.getAs<PreStmt>()|| P.getAs<PreStmtPurgeDeadSymbols>());
675  (void) P;
676  if (N->pred_size() != 1) {
677  // We failed to track back where we came from.
678  Bldr.generateNode(B, Pred, state);
679  return;
680  }
681  N = *N->pred_begin();
682  }
683 
684  if (N->pred_size() != 1) {
685  // We failed to track back where we came from.
686  Bldr.generateNode(B, Pred, state);
687  return;
688  }
689 
690  N = *N->pred_begin();
691  BlockEdge BE = N->getLocation().castAs<BlockEdge>();
692  SVal X;
693 
694  // Determine the value of the expression by introspecting how we
695  // got this location in the CFG. This requires looking at the previous
696  // block we were in and what kind of control-flow transfer was involved.
697  const CFGBlock *SrcBlock = BE.getSrc();
698  // The only terminator (if there is one) that makes sense is a logical op.
699  CFGTerminator T = SrcBlock->getTerminator();
700  if (const BinaryOperator *Term = cast_or_null<BinaryOperator>(T.getStmt())) {
701  (void) Term;
702  assert(Term->isLogicalOp());
703  assert(SrcBlock->succ_size() == 2);
704  // Did we take the true or false branch?
705  unsigned constant = (*SrcBlock->succ_begin() == BE.getDst()) ? 1 : 0;
706  X = svalBuilder.makeIntVal(constant, B->getType());
707  }
708  else {
709  // If there is no terminator, by construction the last statement
710  // in SrcBlock is the value of the enclosing expression.
711  // However, we still need to constrain that value to be 0 or 1.
712  assert(!SrcBlock->empty());
713  CFGStmt Elem = SrcBlock->rbegin()->castAs<CFGStmt>();
714  const Expr *RHS = cast<Expr>(Elem.getStmt());
715  SVal RHSVal = N->getState()->getSVal(RHS, Pred->getLocationContext());
716 
717  if (RHSVal.isUndef()) {
718  X = RHSVal;
719  } else {
720  // We evaluate "RHSVal != 0" expression which result in 0 if the value is
721  // known to be false, 1 if the value is known to be true and a new symbol
722  // when the assumption is unknown.
724  X = evalBinOp(N->getState(), BO_NE,
725  svalBuilder.evalCast(RHSVal, B->getType(), RHS->getType()),
726  Zero, B->getType());
727  }
728  }
729  Bldr.generateNode(B, Pred, state->BindExpr(B, Pred->getLocationContext(), X));
730 }
731 
733  ExplodedNode *Pred,
734  ExplodedNodeSet &Dst) {
735  StmtNodeBuilder B(Pred, Dst, *currBldrCtx);
736 
737  ProgramStateRef state = Pred->getState();
738  const LocationContext *LCtx = Pred->getLocationContext();
740  unsigned NumInitElements = IE->getNumInits();
741 
742  if (!IE->isGLValue() && !IE->isTransparent() &&
743  (T->isArrayType() || T->isRecordType() || T->isVectorType() ||
744  T->isAnyComplexType())) {
745  llvm::ImmutableList<SVal> vals = getBasicVals().getEmptySValList();
746 
747  // Handle base case where the initializer has no elements.
748  // e.g: static int* myArray[] = {};
749  if (NumInitElements == 0) {
750  SVal V = svalBuilder.makeCompoundVal(T, vals);
751  B.generateNode(IE, Pred, state->BindExpr(IE, LCtx, V));
752  return;
753  }
754 
756  ei = IE->rend(); it != ei; ++it) {
757  SVal V = state->getSVal(cast<Expr>(*it), LCtx);
758  vals = getBasicVals().prependSVal(V, vals);
759  }
760 
761  B.generateNode(IE, Pred,
762  state->BindExpr(IE, LCtx,
763  svalBuilder.makeCompoundVal(T, vals)));
764  return;
765  }
766 
767  // Handle scalars: int{5} and int{} and GLvalues.
768  // Note, if the InitListExpr is a GLvalue, it means that there is an address
769  // representing it, so it must have a single init element.
770  assert(NumInitElements <= 1);
771 
772  SVal V;
773  if (NumInitElements == 0)
774  V = getSValBuilder().makeZeroVal(T);
775  else
776  V = state->getSVal(IE->getInit(0), LCtx);
777 
778  B.generateNode(IE, Pred, state->BindExpr(IE, LCtx, V));
779 }
780 
782  const Expr *L,
783  const Expr *R,
784  ExplodedNode *Pred,
785  ExplodedNodeSet &Dst) {
786  assert(L && R);
787 
788  StmtNodeBuilder B(Pred, Dst, *currBldrCtx);
789  ProgramStateRef state = Pred->getState();
790  const LocationContext *LCtx = Pred->getLocationContext();
791  const CFGBlock *SrcBlock = nullptr;
792 
793  // Find the predecessor block.
794  ProgramStateRef SrcState = state;
795  for (const ExplodedNode *N = Pred ; N ; N = *N->pred_begin()) {
796  ProgramPoint PP = N->getLocation();
797  if (PP.getAs<PreStmtPurgeDeadSymbols>() || PP.getAs<BlockEntrance>()) {
798  // If the state N has multiple predecessors P, it means that successors
799  // of P are all equivalent.
800  // In turn, that means that all nodes at P are equivalent in terms
801  // of observable behavior at N, and we can follow any of them.
802  // FIXME: a more robust solution which does not walk up the tree.
803  continue;
804  }
805  SrcBlock = PP.castAs<BlockEdge>().getSrc();
806  SrcState = N->getState();
807  break;
808  }
809 
810  assert(SrcBlock && "missing function entry");
811 
812  // Find the last expression in the predecessor block. That is the
813  // expression that is used for the value of the ternary expression.
814  bool hasValue = false;
815  SVal V;
816 
817  for (CFGElement CE : llvm::reverse(*SrcBlock)) {
818  if (Optional<CFGStmt> CS = CE.getAs<CFGStmt>()) {
819  const Expr *ValEx = cast<Expr>(CS->getStmt());
820  ValEx = ValEx->IgnoreParens();
821 
822  // For GNU extension '?:' operator, the left hand side will be an
823  // OpaqueValueExpr, so get the underlying expression.
824  if (const OpaqueValueExpr *OpaqueEx = dyn_cast<OpaqueValueExpr>(L))
825  L = OpaqueEx->getSourceExpr();
826 
827  // If the last expression in the predecessor block matches true or false
828  // subexpression, get its the value.
829  if (ValEx == L->IgnoreParens() || ValEx == R->IgnoreParens()) {
830  hasValue = true;
831  V = SrcState->getSVal(ValEx, LCtx);
832  }
833  break;
834  }
835  }
836 
837  if (!hasValue)
838  V = svalBuilder.conjureSymbolVal(nullptr, Ex, LCtx,
839  currBldrCtx->blockCount());
840 
841  // Generate a new node with the binding from the appropriate path.
842  B.generateNode(Ex, Pred, state->BindExpr(Ex, LCtx, V, true));
843 }
844 
845 void ExprEngine::
847  ExplodedNode *Pred, ExplodedNodeSet &Dst) {
848  StmtNodeBuilder B(Pred, Dst, *currBldrCtx);
849  Expr::EvalResult Result;
850  if (OOE->EvaluateAsInt(Result, getContext())) {
851  APSInt IV = Result.Val.getInt();
852  assert(IV.getBitWidth() == getContext().getTypeSize(OOE->getType()));
853  assert(OOE->getType()->isBuiltinType());
854  assert(OOE->getType()->getAs<BuiltinType>()->isInteger());
855  assert(IV.isSigned() == OOE->getType()->isSignedIntegerType());
856  SVal X = svalBuilder.makeIntVal(IV);
857  B.generateNode(OOE, Pred,
858  Pred->getState()->BindExpr(OOE, Pred->getLocationContext(),
859  X));
860  }
861  // FIXME: Handle the case where __builtin_offsetof is not a constant.
862 }
863 
864 
865 void ExprEngine::
867  ExplodedNode *Pred,
868  ExplodedNodeSet &Dst) {
869  // FIXME: Prechecks eventually go in ::Visit().
870  ExplodedNodeSet CheckedSet;
871  getCheckerManager().runCheckersForPreStmt(CheckedSet, Pred, Ex, *this);
872 
873  ExplodedNodeSet EvalSet;
874  StmtNodeBuilder Bldr(CheckedSet, EvalSet, *currBldrCtx);
875 
876  QualType T = Ex->getTypeOfArgument();
877 
878  for (ExplodedNodeSet::iterator I = CheckedSet.begin(), E = CheckedSet.end();
879  I != E; ++I) {
880  if (Ex->getKind() == UETT_SizeOf) {
881  if (!T->isIncompleteType() && !T->isConstantSizeType()) {
882  assert(T->isVariableArrayType() && "Unknown non-constant-sized type.");
883 
884  // FIXME: Add support for VLA type arguments and VLA expressions.
885  // When that happens, we should probably refactor VLASizeChecker's code.
886  continue;
887  } else if (T->getAs<ObjCObjectType>()) {
888  // Some code tries to take the sizeof an ObjCObjectType, relying that
889  // the compiler has laid out its representation. Just report Unknown
890  // for these.
891  continue;
892  }
893  }
894 
895  APSInt Value = Ex->EvaluateKnownConstInt(getContext());
896  CharUnits amt = CharUnits::fromQuantity(Value.getZExtValue());
897 
898  ProgramStateRef state = (*I)->getState();
899  state = state->BindExpr(Ex, (*I)->getLocationContext(),
900  svalBuilder.makeIntVal(amt.getQuantity(),
901  Ex->getType()));
902  Bldr.generateNode(Ex, *I, state);
903  }
904 
905  getCheckerManager().runCheckersForPostStmt(Dst, EvalSet, Ex, *this);
906 }
907 
909  const UnaryOperator *U,
910  StmtNodeBuilder &Bldr) {
911  // FIXME: We can probably just have some magic in Environment::getSVal()
912  // that propagates values, instead of creating a new node here.
913  //
914  // Unary "+" is a no-op, similar to a parentheses. We still have places
915  // where it may be a block-level expression, so we need to
916  // generate an extra node that just propagates the value of the
917  // subexpression.
918  const Expr *Ex = U->getSubExpr()->IgnoreParens();
919  ProgramStateRef state = (*I)->getState();
920  const LocationContext *LCtx = (*I)->getLocationContext();
921  Bldr.generateNode(U, *I, state->BindExpr(U, LCtx,
922  state->getSVal(Ex, LCtx)));
923 }
924 
926  ExplodedNodeSet &Dst) {
927  // FIXME: Prechecks eventually go in ::Visit().
928  ExplodedNodeSet CheckedSet;
929  getCheckerManager().runCheckersForPreStmt(CheckedSet, Pred, U, *this);
930 
931  ExplodedNodeSet EvalSet;
932  StmtNodeBuilder Bldr(CheckedSet, EvalSet, *currBldrCtx);
933 
934  for (ExplodedNodeSet::iterator I = CheckedSet.begin(), E = CheckedSet.end();
935  I != E; ++I) {
936  switch (U->getOpcode()) {
937  default: {
938  Bldr.takeNodes(*I);
939  ExplodedNodeSet Tmp;
941  Bldr.addNodes(Tmp);
942  break;
943  }
944  case UO_Real: {
945  const Expr *Ex = U->getSubExpr()->IgnoreParens();
946 
947  // FIXME: We don't have complex SValues yet.
948  if (Ex->getType()->isAnyComplexType()) {
949  // Just report "Unknown."
950  break;
951  }
952 
953  // For all other types, UO_Real is an identity operation.
954  assert (U->getType() == Ex->getType());
955  ProgramStateRef state = (*I)->getState();
956  const LocationContext *LCtx = (*I)->getLocationContext();
957  Bldr.generateNode(U, *I, state->BindExpr(U, LCtx,
958  state->getSVal(Ex, LCtx)));
959  break;
960  }
961 
962  case UO_Imag: {
963  const Expr *Ex = U->getSubExpr()->IgnoreParens();
964  // FIXME: We don't have complex SValues yet.
965  if (Ex->getType()->isAnyComplexType()) {
966  // Just report "Unknown."
967  break;
968  }
969  // For all other types, UO_Imag returns 0.
970  ProgramStateRef state = (*I)->getState();
971  const LocationContext *LCtx = (*I)->getLocationContext();
972  SVal X = svalBuilder.makeZeroVal(Ex->getType());
973  Bldr.generateNode(U, *I, state->BindExpr(U, LCtx, X));
974  break;
975  }
976 
977  case UO_AddrOf: {
978  // Process pointer-to-member address operation.
979  const Expr *Ex = U->getSubExpr()->IgnoreParens();
980  if (const DeclRefExpr *DRE = dyn_cast<DeclRefExpr>(Ex)) {
981  const ValueDecl *VD = DRE->getDecl();
982 
983  if (isa<CXXMethodDecl>(VD) || isa<FieldDecl>(VD)) {
984  ProgramStateRef State = (*I)->getState();
985  const LocationContext *LCtx = (*I)->getLocationContext();
986  SVal SV = svalBuilder.getMemberPointer(cast<DeclaratorDecl>(VD));
987  Bldr.generateNode(U, *I, State->BindExpr(U, LCtx, SV));
988  break;
989  }
990  }
991  // Explicitly proceed with default handler for this case cascade.
992  handleUOExtension(I, U, Bldr);
993  break;
994  }
995  case UO_Plus:
996  assert(!U->isGLValue());
997  LLVM_FALLTHROUGH;
998  case UO_Deref:
999  case UO_Extension: {
1000  handleUOExtension(I, U, Bldr);
1001  break;
1002  }
1003 
1004  case UO_LNot:
1005  case UO_Minus:
1006  case UO_Not: {
1007  assert (!U->isGLValue());
1008  const Expr *Ex = U->getSubExpr()->IgnoreParens();
1009  ProgramStateRef state = (*I)->getState();
1010  const LocationContext *LCtx = (*I)->getLocationContext();
1011 
1012  // Get the value of the subexpression.
1013  SVal V = state->getSVal(Ex, LCtx);
1014 
1015  if (V.isUnknownOrUndef()) {
1016  Bldr.generateNode(U, *I, state->BindExpr(U, LCtx, V));
1017  break;
1018  }
1019 
1020  switch (U->getOpcode()) {
1021  default:
1022  llvm_unreachable("Invalid Opcode.");
1023  case UO_Not:
1024  // FIXME: Do we need to handle promotions?
1025  state = state->BindExpr(U, LCtx, evalComplement(V.castAs<NonLoc>()));
1026  break;
1027  case UO_Minus:
1028  // FIXME: Do we need to handle promotions?
1029  state = state->BindExpr(U, LCtx, evalMinus(V.castAs<NonLoc>()));
1030  break;
1031  case UO_LNot:
1032  // C99 6.5.3.3: "The expression !E is equivalent to (0==E)."
1033  //
1034  // Note: technically we do "E == 0", but this is the same in the
1035  // transfer functions as "0 == E".
1036  SVal Result;
1037  if (Optional<Loc> LV = V.getAs<Loc>()) {
1038  Loc X = svalBuilder.makeNullWithType(Ex->getType());
1039  Result = evalBinOp(state, BO_EQ, *LV, X, U->getType());
1040  } else if (Ex->getType()->isFloatingType()) {
1041  // FIXME: handle floating point types.
1042  Result = UnknownVal();
1043  } else {
1044  nonloc::ConcreteInt X(getBasicVals().getValue(0, Ex->getType()));
1045  Result = evalBinOp(state, BO_EQ, V.castAs<NonLoc>(), X,
1046  U->getType());
1047  }
1048 
1049  state = state->BindExpr(U, LCtx, Result);
1050  break;
1051  }
1052  Bldr.generateNode(U, *I, state);
1053  break;
1054  }
1055  }
1056  }
1057 
1058  getCheckerManager().runCheckersForPostStmt(Dst, EvalSet, U, *this);
1059 }
1060 
1062  ExplodedNode *Pred,
1063  ExplodedNodeSet &Dst) {
1064  // Handle ++ and -- (both pre- and post-increment).
1065  assert (U->isIncrementDecrementOp());
1066  const Expr *Ex = U->getSubExpr()->IgnoreParens();
1067 
1068  const LocationContext *LCtx = Pred->getLocationContext();
1069  ProgramStateRef state = Pred->getState();
1070  SVal loc = state->getSVal(Ex, LCtx);
1071 
1072  // Perform a load.
1073  ExplodedNodeSet Tmp;
1074  evalLoad(Tmp, U, Ex, Pred, state, loc);
1075 
1076  ExplodedNodeSet Dst2;
1077  StmtNodeBuilder Bldr(Tmp, Dst2, *currBldrCtx);
1078  for (ExplodedNodeSet::iterator I=Tmp.begin(), E=Tmp.end();I!=E;++I) {
1079 
1080  state = (*I)->getState();
1081  assert(LCtx == (*I)->getLocationContext());
1082  SVal V2_untested = state->getSVal(Ex, LCtx);
1083 
1084  // Propagate unknown and undefined values.
1085  if (V2_untested.isUnknownOrUndef()) {
1086  state = state->BindExpr(U, LCtx, V2_untested);
1087 
1088  // Perform the store, so that the uninitialized value detection happens.
1089  Bldr.takeNodes(*I);
1090  ExplodedNodeSet Dst3;
1091  evalStore(Dst3, U, Ex, *I, state, loc, V2_untested);
1092  Bldr.addNodes(Dst3);
1093 
1094  continue;
1095  }
1096  DefinedSVal V2 = V2_untested.castAs<DefinedSVal>();
1097 
1098  // Handle all other values.
1099  BinaryOperator::Opcode Op = U->isIncrementOp() ? BO_Add : BO_Sub;
1100 
1101  // If the UnaryOperator has non-location type, use its type to create the
1102  // constant value. If the UnaryOperator has location type, create the
1103  // constant with int type and pointer width.
1104  SVal RHS;
1105  SVal Result;
1106 
1107  if (U->getType()->isAnyPointerType())
1108  RHS = svalBuilder.makeArrayIndex(1);
1109  else if (U->getType()->isIntegralOrEnumerationType())
1110  RHS = svalBuilder.makeIntVal(1, U->getType());
1111  else
1112  RHS = UnknownVal();
1113 
1114  // The use of an operand of type bool with the ++ operators is deprecated
1115  // but valid until C++17. And if the operand of the ++ operator is of type
1116  // bool, it is set to true until C++17. Note that for '_Bool', it is also
1117  // set to true when it encounters ++ operator.
1118  if (U->getType()->isBooleanType() && U->isIncrementOp())
1119  Result = svalBuilder.makeTruthVal(true, U->getType());
1120  else
1121  Result = evalBinOp(state, Op, V2, RHS, U->getType());
1122 
1123  // Conjure a new symbol if necessary to recover precision.
1124  if (Result.isUnknown()){
1125  DefinedOrUnknownSVal SymVal =
1126  svalBuilder.conjureSymbolVal(nullptr, U, LCtx,
1127  currBldrCtx->blockCount());
1128  Result = SymVal;
1129 
1130  // If the value is a location, ++/-- should always preserve
1131  // non-nullness. Check if the original value was non-null, and if so
1132  // propagate that constraint.
1133  if (Loc::isLocType(U->getType())) {
1134  DefinedOrUnknownSVal Constraint =
1135  svalBuilder.evalEQ(state, V2,svalBuilder.makeZeroVal(U->getType()));
1136 
1137  if (!state->assume(Constraint, true)) {
1138  // It isn't feasible for the original value to be null.
1139  // Propagate this constraint.
1140  Constraint = svalBuilder.evalEQ(state, SymVal,
1141  svalBuilder.makeZeroVal(U->getType()));
1142 
1143  state = state->assume(Constraint, false);
1144  assert(state);
1145  }
1146  }
1147  }
1148 
1149  // Since the lvalue-to-rvalue conversion is explicit in the AST,
1150  // we bind an l-value if the operator is prefix and an lvalue (in C++).
1151  if (U->isGLValue())
1152  state = state->BindExpr(U, LCtx, loc);
1153  else
1154  state = state->BindExpr(U, LCtx, U->isPostfix() ? V2 : Result);
1155 
1156  // Perform the store.
1157  Bldr.takeNodes(*I);
1158  ExplodedNodeSet Dst3;
1159  evalStore(Dst3, U, Ex, *I, state, loc, Result);
1160  Bldr.addNodes(Dst3);
1161  }
1162  Dst.insert(Dst2);
1163 }
SVal attemptDownCast(SVal Base, QualType DerivedPtrType, bool &Failed)
Attempts to do a down cast.
Definition: Store.cpp:314
const BlockDecl * getBlockDecl() const
Definition: Expr.h:5554
nonloc::ConcreteInt makeIntVal(const IntegerLiteral *integer)
Definition: SValBuilder.h:278
DefinedSVal getBlockPointer(const BlockDecl *block, CanQualType locTy, const LocationContext *locContext, unsigned blockCount)
reverse_iterator rbegin()
Definition: Expr.h:4575
SVal evalDerivedToBase(SVal Derived, const CastExpr *Cast)
Evaluates a chain of derived-to-base casts through the path specified in Cast.
Definition: Store.cpp:248
bool empty() const
Definition: CFG.h:904
A (possibly-)qualified type.
Definition: Type.h:643
bool isArrayType() const
Definition: Type.h:6410
succ_iterator succ_begin()
Definition: CFG.h:941
capture_const_iterator capture_begin() const
Definition: Decl.h:4020
const Expr * getInit(unsigned Init) const
Definition: Expr.h:4418
unsigned blockCount() const
Returns the number of times the current basic block has been visited on the exploded graph path...
Definition: CoreEngine.h:220
This builder class is useful for generating nodes that resulted from visiting a statement.
Definition: CoreEngine.h:378
bool isRecordType() const
Definition: Type.h:6434
const CFGBlock * getSrc() const
Definition: ProgramPoint.h:511
QualType getLValueReferenceType(QualType T, bool SpelledAsLValue=true) const
Return the uniqued reference to the type for an lvalue reference to the specified type...
bool isTransparent() const
Is this a transparent initializer list (that is, an InitListExpr that is purely syntactic, and whose semantics are that of the sole contained initializer)?
Definition: Expr.cpp:2280
Opcode getOpcode() const
Definition: Expr.h:3439
StringRef P
SVal evalBinOp(ProgramStateRef state, BinaryOperator::Opcode op, NonLoc L, NonLoc R, QualType T)
Definition: ExprEngine.h:584
Represents a point after we ran remove dead bindings BEFORE processing the given statement.
Definition: ProgramPoint.h:473
T castAs() const
Convert to the specified CFGElement type, asserting that this CFGElement is of the desired type...
Definition: CFG.h:98
const ProgramStateRef & getState() const
SVal evalCast(SVal val, QualType castTy, QualType originalType)
Value representing integer constant.
Definition: SVals.h:379
capture_const_iterator capture_end() const
Definition: Decl.h:4021
unsigned succ_size() const
Definition: CFG.h:959
void VisitUnaryOperator(const UnaryOperator *B, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitUnaryOperator - Transfer function logic for unary operators.
void takeNodes(const ExplodedNodeSet &S)
Definition: CoreEngine.h:329
void handleUOExtension(ExplodedNodeSet::iterator I, const UnaryOperator *U, StmtNodeBuilder &Bldr)
Represents a variable declaration or definition.
Definition: Decl.h:812
CompoundLiteralExpr - [C99 6.5.2.5].
Definition: Expr.h:3047
const T * getAs() const
Member-template getAs<specific type>&#39;.
Definition: Type.h:6821
NonLoc makeArrayIndex(uint64_t idx)
Definition: SValBuilder.h:272
static Optional< SVal > getObjectUnderConstruction(ProgramStateRef State, const ConstructionContextItem &Item, const LocationContext *LC)
By looking at a certain item that may be potentially part of an object&#39;s ConstructionContext, retrieve such object&#39;s location.
Definition: ExprEngine.cpp:474
void evalStore(ExplodedNodeSet &Dst, const Expr *AssignE, const Expr *StoreE, ExplodedNode *Pred, ProgramStateRef St, SVal TargetLV, SVal Val, const ProgramPointTag *tag=nullptr)
evalStore - Handle the semantics of a store via an assignment.
static bool isAssignmentOp(Opcode Opc)
Definition: Expr.h:3530
Defines the clang::Expr interface and subclasses for C++ expressions.
bool isVariableArrayType() const
Definition: Type.h:6422
InitExprsTy::const_reverse_iterator const_reverse_iterator
Definition: Expr.h:4569
Represents a class type in Objective C.
Definition: Type.h:5596
Value representing pointer-to-member.
Definition: SVals.h:524
LineState State
SVal evalIntegralCast(ProgramStateRef state, SVal val, QualType castTy, QualType originalType)
Loc makeNullWithType(QualType type)
Create NULL pointer, with proper pointer bit-width for given address space.
Definition: SValBuilder.h:345
static bool isIncrementDecrementOp(Opcode Op)
Definition: Expr.h:2089
bool isReferenceType() const
Definition: Type.h:6366
i32 captured_struct **param SharedsTy A type which contains references the shared variables *param Shareds Context with the list of shared variables from the p *TaskFunction *param Data Additional data for task generation like final * state
bool isIntegralOrEnumerationType() const
Determine whether this type is an integral or enumeration type.
Definition: Type.h:6717
llvm::ImmutableList< SVal > prependSVal(SVal X, llvm::ImmutableList< SVal > L)
static bool isLocType(QualType T)
Definition: SVals.h:329
bool isGLValue() const
Definition: Expr.h:261
Describes an C or C++ initializer list.
Definition: Expr.h:4370
void VisitOffsetOfExpr(const OffsetOfExpr *Ex, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitOffsetOfExpr - Transfer function for offsetof.
BinaryOperatorKind
BlockDataRegion - A region that represents a block instance.
Definition: MemRegion.h:672
ExplodedNode * generateSink(const Stmt *S, ExplodedNode *Pred, ProgramStateRef St, const ProgramPointTag *tag=nullptr, ProgramPoint::Kind K=ProgramPoint::PostStmtKind)
Definition: CoreEngine.h:417
CharUnits - This is an opaque type for sizes expressed in character units.
Definition: CharUnits.h:37
APValue Val
Val - This is the value the expression can be folded to.
Definition: Expr.h:582
path_iterator path_begin()
Definition: Expr.h:3192
const LocationContext * getLocationContext() const
A builtin binary operation expression such as "x + y" or "x <= y".
Definition: Expr.h:3404
bool isUnknown() const
Definition: SVals.h:136
NonLoc makePointerToMember(const DeclaratorDecl *DD)
Definition: SValBuilder.h:260
static bool isPostfix(Opcode Op)
isPostfix - Return true if this is a postfix operation, like x++.
Definition: Expr.h:2063
bool isRValueReferenceType() const
Definition: Type.h:6374
NonLoc makeCompoundVal(QualType type, llvm::ImmutableList< SVal > vals)
Definition: SValBuilder.h:250
CastExpr - Base class for type casts, including both implicit casts (ImplicitCastExpr) and explicit c...
Definition: Expr.h:3120
SVal evalComplement(SVal X)
Definition: ExprEngine.h:563
void VisitDeclStmt(const DeclStmt *DS, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitDeclStmt - Transfer function logic for DeclStmts.
unsigned pred_size() const
bool isConstant() const
Definition: SVals.cpp:222
void evalBind(ExplodedNodeSet &Dst, const Stmt *StoreE, ExplodedNode *Pred, SVal location, SVal Val, bool atDeclInit=false, const ProgramPoint *PP=nullptr)
evalBind - Handle the semantics of binding a value to a specific location.
CheckerManager & getCheckerManager() const
Definition: ExprEngine.h:190
void VisitLogicalExpr(const BinaryOperator *B, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitLogicalExpr - Transfer function logic for &#39;&&&#39;, &#39;||&#39;.
UnaryExprOrTypeTraitExpr - expression with either a type or (unevaluated) expression operand...
Definition: Expr.h:2342
Represents a single basic block in a source-level CFG.
Definition: CFG.h:570
void VisitInitListExpr(const InitListExpr *E, ExplodedNode *Pred, ExplodedNodeSet &Dst)
QuantityType getQuantity() const
getQuantity - Get the raw integer representation of this quantity.
Definition: CharUnits.h:178
llvm::APSInt EvaluateKnownConstInt(const ASTContext &Ctx, SmallVectorImpl< PartialDiagnosticAt > *Diag=nullptr) const
EvaluateKnownConstInt - Call EvaluateAsRValue and return the folded integer.
void runCheckersForPostStmt(ExplodedNodeSet &Dst, const ExplodedNodeSet &Src, const Stmt *S, ExprEngine &Eng, bool wasInlined=false)
Run checkers for post-visiting Stmts.
DefinedOrUnknownSVal makeZeroVal(QualType type)
Construct an SVal representing &#39;0&#39; for the specified type.
Definition: SValBuilder.cpp:52
Represents a block literal declaration, which is like an unnamed FunctionDecl.
Definition: Decl.h:3891
Represent the declaration of a variable (in which case it is an lvalue) a function (in which case it ...
Definition: Decl.h:636
This represents one expression.
Definition: Expr.h:108
static SVal conjureOffsetSymbolOnLocation(SVal Symbol, SVal Other, Expr *Expression, SValBuilder &svalBuilder, unsigned Count, const LocationContext *LCtx)
Optionally conjure and return a symbol for offset when processing an expression Expression.
Definition: ExprEngineC.cpp:28
void VisitCast(const CastExpr *CastE, const Expr *Ex, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitCast - Transfer function logic for all casts (implicit and explicit).
#define V(N, I)
Definition: ASTContext.h:2898
BlockExpr - Adaptor class for mixing a BlockDecl with expressions.
Definition: Expr.h:5540
unsigned getNumInits() const
Definition: Expr.h:4400
const ExplodedNodeSet & getResults()
Definition: CoreEngine.h:306
bool isAnyComplexType() const
Definition: Type.h:6442
static CharUnits fromQuantity(QuantityType Quantity)
fromQuantity - Construct a CharUnits quantity from a raw integer type.
Definition: CharUnits.h:62
static SVal getValue(SVal val, SValBuilder &svalBuilder)
bool isSignedIntegerType() const
Return true if this is an integer type that is signed, according to C99 6.2.5p4 [char, signed char, short, int, long..], or an enum decl which has a signed representation.
Definition: Type.cpp:1875
const CFGBlock * getDst() const
Definition: ProgramPoint.h:515
QualType getType() const
Definition: Expr.h:137
QualType getTypeOfArgument() const
Gets the argument type, or the type of the argument expression, whichever is appropriate.
Definition: Expr.h:2405
The reason for pointer escape is unknown.
ASTContext & getContext() const
getContext - Return the ASTContext associated with this analysis.
Definition: ExprEngine.h:182
UnaryOperator - This represents the unary-expression&#39;s (except sizeof and alignof), the postinc/postdec operators from postfix-expression, and various extensions.
Definition: Expr.h:2016
void evalLoad(ExplodedNodeSet &Dst, const Expr *NodeEx, const Expr *BoundExpr, ExplodedNode *Pred, ProgramStateRef St, SVal location, const ProgramPointTag *tag=nullptr, QualType LoadTy=QualType())
Simulate a read of the result of Ex.
reverse_iterator rbegin()
Definition: CFG.h:866
Optional< T > getAs() const
Convert to the specified SVal type, returning None if this SVal is not of the desired type...
Definition: SVals.h:111
const VarDecl * getDecl() const
Definition: MemRegion.h:949
OpaqueValueExpr - An expression referring to an opaque object of a fixed type and value class...
Definition: Expr.h:1045
bool isBuiltinType() const
Helper methods to distinguish type categories.
Definition: Type.h:6430
void VisitGuardedExpr(const Expr *Ex, const Expr *L, const Expr *R, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitGuardedExpr - Transfer function logic for ?, __builtin_choose.
DefinedOrUnknownSVal conjureSymbolVal(const void *symbolTag, const Expr *expr, const LocationContext *LCtx, unsigned count)
Create a new symbol with a unique &#39;name&#39;.
Expr * getSubExpr() const
Definition: Expr.h:2046
T castAs() const
Convert to the specified ProgramPoint type, asserting that this ProgramPoint is of the desired type...
Definition: ProgramPoint.h:140
CastKind getCastKind() const
Definition: Expr.h:3166
const MemRegion * getAsRegion() const
Definition: SVals.cpp:151
DeclStmt - Adaptor class for mixing declarations with statements and expressions. ...
Definition: Stmt.h:1203
void VisitCompoundLiteralExpr(const CompoundLiteralExpr *CL, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitCompoundLiteralExpr - Transfer function logic for compound literals.
ProgramStateRef handleLVectorSplat(ProgramStateRef state, const LocationContext *LCtx, const CastExpr *CastE, StmtNodeBuilder &Bldr, ExplodedNode *Pred)
ProgramPoint getLocation() const
getLocation - Returns the edge associated with the given node.
SVal - This represents a symbolic expression, which can be either an L-value or an R-value...
Definition: SVals.h:75
UnaryExprOrTypeTrait getKind() const
Definition: Expr.h:2373
decl_iterator decl_begin()
Definition: Stmt.h:1257
void VisitUnaryExprOrTypeTraitExpr(const UnaryExprOrTypeTraitExpr *Ex, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitUnaryExprOrTypeTraitExpr - Transfer function for sizeof.
bool isAnyPointerType() const
Definition: Type.h:6358
BasicValueFactory & getBasicVals()
Definition: ExprEngine.h:393
void runCheckersForPreStmt(ExplodedNodeSet &Dst, const ExplodedNodeSet &Src, const Stmt *S, ExprEngine &Eng)
Run checkers for pre-visiting Stmts.
bool isVectorType() const
Definition: Type.h:6446
void insert(const ExplodedNodeSet &S)
const Expr * getInitializer() const
Definition: Expr.h:3073
Expr * getLHS() const
Definition: Expr.h:3444
Dataflow Directional Tag Classes.
void VisitIncrementDecrementOperator(const UnaryOperator *U, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Handle ++ and – (both pre- and post-increment).
SValBuilder & getSValBuilder()
Definition: ExprEngine.h:194
EvalResult is a struct with detailed info about an evaluated expression.
Definition: Expr.h:580
void addNodes(const ExplodedNodeSet &S)
Definition: CoreEngine.h:335
StoreManager & getStoreManager()
Definition: ExprEngine.h:386
bool isZeroConstant() const
Definition: SVals.cpp:234
const Expr * getInit() const
Definition: Decl.h:1219
bool isBooleanType() const
Definition: Type.h:6730
SVal evalEQ(ProgramStateRef state, SVal lhs, SVal rhs)
ExplicitCastExpr - An explicit cast written in the source code.
Definition: Expr.h:3307
bool isSingleDecl() const
isSingleDecl - This method returns true if this DeclStmt refers to a single Decl. ...
Definition: Stmt.h:1216
Stmt * getStmt()
Definition: CFG.h:529
path_iterator path_end()
Definition: Expr.h:3193
ProgramStateRef handleLValueBitCast(ProgramStateRef state, const Expr *Ex, const LocationContext *LCtx, QualType T, QualType ExTy, const CastExpr *CastE, StmtNodeBuilder &Bldr, ExplodedNode *Pred)
T castAs() const
Convert to the specified SVal type, asserting that this SVal is of the desired type.
Definition: SVals.h:103
bool isConstantSizeType() const
Return true if this is not a variable sized type, according to the rules of C99 6.7.5p3.
Definition: Type.cpp:2052
SVal evalMinus(SVal X)
Definition: ExprEngine.h:559
DefinedSVal getMemberPointer(const DeclaratorDecl *DD)
Opcode getOpcode() const
Definition: Expr.h:2041
static bool isAdditiveOp(Opcode Opc)
Definition: Expr.h:3480
uint64_t getTypeSize(QualType T) const
Return the size of the specified (complete) type T, in bits.
Definition: ASTContext.h:2070
bool isIncompleteType(NamedDecl **Def=nullptr) const
Types are partitioned into 3 broad categories (C99 6.2.5p1): object types, function types...
Definition: Type.cpp:2062
static bool isIncrementOp(Opcode Op)
Definition: Expr.h:2075
CanQualType getCanonicalType(QualType T) const
Return the canonical (structural) type corresponding to the specified potentially non-canonical type ...
Definition: ASTContext.h:2271
bool isLValueReferenceType() const
Definition: Type.h:6370
reverse_iterator rend()
Definition: Expr.h:4577
X
Add a minimal nested name specifier fixit hint to allow lookup of a tag name from an outer enclosing ...
Definition: SemaDecl.cpp:14148
void VisitBlockExpr(const BlockExpr *BE, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitBlockExpr - Transfer function logic for BlockExprs.
Defines the C++ Decl subclasses, other than those for templates (found in DeclTemplate.h) and friends (in DeclFriend.h).
bool EvaluateAsInt(EvalResult &Result, const ASTContext &Ctx, SideEffectsKind AllowSideEffects=SE_NoSideEffects, bool InConstantContext=false) const
EvaluateAsInt - Return true if this is a constant which we can fold and convert to an integer...
static bool isCompoundAssignmentOp(Opcode Opc)
Definition: Expr.h:3535
QualType getRValueReferenceType(QualType T) const
Return the uniqued reference to the type for an rvalue reference to the specified type...
pred_iterator pred_begin()
Represents a top-level expression in a basic block.
Definition: CFG.h:55
QualType getPointerType(QualType T) const
Return the uniqued reference to the type for a pointer to the specified type.
This class is used for builtin types like &#39;int&#39;.
Definition: Type.h:2408
Represents CFGBlock terminator statement.
Definition: CFG.h:497
ExplodedNode * generateNode(const Stmt *S, ExplodedNode *Pred, ProgramStateRef St, const ProgramPointTag *tag=nullptr, ProgramPoint::Kind K=ProgramPoint::PostStmtKind)
Definition: CoreEngine.h:407
bool isUndef() const
Definition: SVals.h:140
A reference to a declared variable, function, enum, etc.
Definition: Expr.h:1141
Expr * getRHS() const
Definition: Expr.h:3446
nonloc::ConcreteInt makeTruthVal(bool b, QualType type)
Definition: SValBuilder.h:334
ProgramStateRef escapeValue(ProgramStateRef State, SVal V, PointerEscapeKind K) const
A simple wrapper when you only need to notify checkers of pointer-escape of a single value...
Optional< T > getAs() const
Convert to the specified ProgramPoint type, returning None if this ProgramPoint is not of the desired...
Definition: ProgramPoint.h:151
OffsetOfExpr - [C99 7.17] - This represents an expression of the form offsetof(record-type, member-designator).
Definition: Expr.h:2237
void VisitBinaryOperator(const BinaryOperator *B, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitBinaryOperator - Transfer function logic for binary operators.
Definition: ExprEngineC.cpp:40
APSInt & getInt()
Definition: APValue.h:336
CFGTerminator getTerminator() const
Definition: CFG.h:1034
bool isUnknownOrUndef() const
Definition: SVals.h:144
llvm::ImmutableList< SVal > getEmptySValList()
Expr * IgnoreParens() LLVM_READONLY
Skip past any parentheses which might surround this expression until reaching a fixed point...
Definition: Expr.cpp:2956