ExprEngineC.cpp

Go to the documentation of this file.

//=-- ExprEngineC.cpp - ExprEngine support for C expressions ----*- C++ -*-===//
//
// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
// See https://llvm.org/LICENSE.txt for license information.
// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
//
//===----------------------------------------------------------------------===//
//
//  This file defines ExprEngine's support for C expressions.
//
//===----------------------------------------------------------------------===//
 
#include "clang/AST/DeclCXX.h"
#include "clang/AST/ExprCXX.h"
#include "clang/StaticAnalyzer/Core/CheckerManager.h"
#include "clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h"
#include <optional>
 
using namespace clang;
using namespace ento;
using llvm::APSInt;
 
void ExprEngine::VisitBinaryOperator(const BinaryOperator* B,
                                     ExplodedNode *Pred,
                                     ExplodedNodeSet &Dst) {
  const StackFrame *SF = Pred->getStackFrame();
 
  Expr *LHS = B->getLHS()->IgnoreParens();
  Expr *RHS = B->getRHS()->IgnoreParens();
 
  // FIXME: Prechecks eventually go in ::Visit().
  ExplodedNodeSet CheckedSet;
  ExplodedNodeSet Tmp2;
  getCheckerManager().runCheckersForPreStmt(CheckedSet, Pred, B, *this);
 
  // With both the LHS and RHS evaluated, process the operation itself.
  for (ExplodedNode *N : CheckedSet) {
    ProgramStateRef State = N->getState();
    SVal LeftV = State->getSVal(LHS, SF);
    SVal RightV = State->getSVal(RHS, SF);
 
    BinaryOperator::Opcode Op = B->getOpcode();
 
    if (Op == BO_Assign) {
      if (RightV.isUnknown()) {
        unsigned Count = getNumVisitedCurrent();
        RightV = svalBuilder.conjureSymbolVal(nullptr, getCFGElementRef(), SF,
                                              Count);
      }
      // Simulate the effects of a "store":  bind the value of the RHS
      // to the L-Value represented by the LHS.
      SVal ExprVal = B->isGLValue() ? LeftV : RightV;
      evalStore(Tmp2, B, LHS, N, State->BindExpr(B, SF, ExprVal), LeftV,
                RightV);
      continue;
    }
 
    if (!B->isAssignmentOp()) {
      if (B->isAdditiveOp()) {
        // Ensure that if `p` is a pointer and `i` is an integer with Unknown
        // value, then `p+i`, `i+p` and `p-i` are evaluated to element regions
        // (with a symbolic offset) instead of Unknown.
        auto ConjureIfNeeded = [this, SF](SVal &V, SVal Other, QualType VTy) {
          if (isa<Loc>(Other) && VTy->isIntegralOrEnumerationType() &&
              V.isUnknown()) {
            V = svalBuilder.conjureSymbolVal(getCFGElementRef(), SF, VTy,
                                             getNumVisitedCurrent());
          }
        };
        ConjureIfNeeded(RightV, LeftV, RHS->getType());
        ConjureIfNeeded(LeftV, RightV, LHS->getType());
      }
 
      // Although we don't yet model pointers-to-members, we do need to make
      // sure that the members of temporaries have a valid 'this' pointer for
      // other checks.
      if (B->getOpcode() == BO_PtrMemD)
        State = createTemporaryRegionIfNeeded(State, SF, LHS);
 
      // Process non-assignments except commas or short-circuited
      // logical expressions (LAnd and LOr).
      SVal Result = evalBinOp(State, Op, LeftV, RightV, B->getType());
      if (!Result.isUnknown()) {
        State = State->BindExpr(B, SF, Result);
      } else {
        // If we cannot evaluate the operation escape the operands.
        State = escapeValues(State, LeftV, PSK_EscapeOther);
        State = escapeValues(State, RightV, PSK_EscapeOther);
      }
 
      Tmp2.insert(Engine.makePostStmtNode(B, State, N));
      continue;
    }
 
    assert (B->isCompoundAssignmentOp());
 
    switch (Op) {
      default:
        llvm_unreachable("Invalid opcode for compound assignment.");
      case BO_MulAssign: Op = BO_Mul; break;
      case BO_DivAssign: Op = BO_Div; break;
      case BO_RemAssign: Op = BO_Rem; break;
      case BO_AddAssign: Op = BO_Add; break;
      case BO_SubAssign: Op = BO_Sub; break;
      case BO_ShlAssign: Op = BO_Shl; break;
      case BO_ShrAssign: Op = BO_Shr; break;
      case BO_AndAssign: Op = BO_And; break;
      case BO_XorAssign: Op = BO_Xor; break;
      case BO_OrAssign:  Op = BO_Or;  break;
    }
 
    // Perform a load (the LHS).  This performs the checks for
    // null dereferences, and so on.
    ExplodedNodeSet Tmp;
    evalLoad(Tmp, B, LHS, N, State, LeftV);
 
    for (ExplodedNode *N : Tmp) {
      State = N->getState();
      SVal V = State->getSVal(LHS, SF);
 
      // Determine the relevant types.
      const ASTContext &ACtx = getContext();
      const auto *CAOpB = cast<CompoundAssignOperator>(B);
      QualType CTy = ACtx.getCanonicalType(CAOpB->getComputationResultType());
      QualType CLHSTy = ACtx.getCanonicalType(CAOpB->getComputationLHSType());
      QualType LTy = ACtx.getCanonicalType(LHS->getType());
 
      // Promote LHS.
      V = svalBuilder.evalCast(V, CLHSTy, LTy);
 
      // Compute the result of the operation.
      SVal Result = svalBuilder.evalCast(evalBinOp(State, Op, V, RightV, CTy),
                                         B->getType(), CTy);
 
      SVal StoredInLeftV;
 
      if (Result.isUnknown()) {
        // The symbolic value is actually for the type of the left-hand side
        // expression, not the computation type, as this is the value the
        // LValue on the LHS will bind to.
        StoredInLeftV = svalBuilder.conjureSymbolVal(
            /*symbolTag=*/nullptr, getCFGElementRef(), SF, LTy,
            getNumVisitedCurrent());
        // However, we need to convert the symbol to the computation type.
        Result = svalBuilder.evalCast(StoredInLeftV, CTy, LTy);
      } else {
        // The left-hand side may bind to a different value then the
        // computation type.
        StoredInLeftV = svalBuilder.evalCast(Result, LTy, CTy);
      }
 
      // In C++, assignment and compound assignment operators return an
      // lvalue.
      if (B->isGLValue())
        State = State->BindExpr(B, SF, LeftV);
      else
        State = State->BindExpr(B, SF, Result);
 
      evalStore(Tmp2, B, LHS, N, State, LeftV, StoredInLeftV);
    }
  }
 
  // FIXME: postvisits eventually go in ::Visit()
  getCheckerManager().runCheckersForPostStmt(Dst, Tmp2, B, *this);
}
 
void ExprEngine::VisitBlockExpr(const BlockExpr *BE, ExplodedNode *Pred,
                                ExplodedNodeSet &Dst) {
 
  CanQualType T = getContext().getCanonicalType(BE->getType());
 
  const BlockDecl *BD = BE->getBlockDecl();
  // Get the value of the block itself.
  SVal V = svalBuilder.getBlockPointer(BD, T, Pred->getStackFrame(),
                                       getNumVisitedCurrent());
 
  ProgramStateRef State = Pred->getState();
 
  // If we created a new MemRegion for the block, we should explicitly bind
  // the captured variables.
  if (const BlockDataRegion *BDR =
      dyn_cast_or_null<BlockDataRegion>(V.getAsRegion())) {
 
    auto ReferencedVars = BDR->referenced_vars();
    auto CI = BD->capture_begin();
    auto CE = BD->capture_end();
    for (auto Var : ReferencedVars) {
      const VarRegion *capturedR = Var.getCapturedRegion();
      const TypedValueRegion *originalR = Var.getOriginalRegion();
 
      // If the capture had a copy expression, use the result of evaluating
      // that expression, otherwise use the original value.
      // We rely on the invariant that the block declaration's capture variables
      // are a prefix of the BlockDataRegion's referenced vars (which may include
      // referenced globals, etc.) to enable fast lookup of the capture for a
      // given referenced var.
      const Expr *copyExpr = nullptr;
      if (CI != CE) {
        assert(CI->getVariable() == capturedR->getDecl());
        copyExpr = CI->getCopyExpr();
        CI++;
      }
 
      if (capturedR != originalR) {
        SVal originalV;
        const StackFrame *SF = Pred->getStackFrame();
        if (copyExpr) {
          originalV = State->getSVal(copyExpr, SF);
        } else {
          originalV = State->getSVal(loc::MemRegionVal(originalR));
        }
        State = State->bindLoc(loc::MemRegionVal(capturedR), originalV, SF);
      }
    }
  }
 
  Dst.insert(Engine.makeNodeWithBinding(Pred, BE, V, State,
                                        ProgramPoint::PostLValueKind));
}
 
void ExprEngine::handleLValueBitCast(ProgramStateRef state, const Expr *Ex,
                                     const StackFrame *SF, QualType T,
                                     QualType ExTy, const CastExpr *CastE,
                                     ExplodedNodeSet &Dst, ExplodedNode *Pred) {
  if (T->isLValueReferenceType()) {
    assert(!CastE->getType()->isLValueReferenceType());
    ExTy = getContext().getLValueReferenceType(ExTy);
  } else if (T->isRValueReferenceType()) {
    assert(!CastE->getType()->isRValueReferenceType());
    ExTy = getContext().getRValueReferenceType(ExTy);
  }
  // Delegate to SValBuilder to process.
  SVal OrigV = state->getSVal(Ex, SF);
  SVal SimplifiedOrigV = svalBuilder.simplifySVal(state, OrigV);
  SVal V = svalBuilder.evalCast(SimplifiedOrigV, T, ExTy);
  // Negate the result if we're treating the boolean as a signed i1
  if (CastE->getCastKind() == CK_BooleanToSignedIntegral && V.isValid())
    V = svalBuilder.evalMinus(V.castAs<NonLoc>());
 
  state = state->BindExpr(CastE, SF, V);
  if (V.isUnknown() && !OrigV.isUnknown()) {
    state = escapeValues(state, OrigV, PSK_EscapeOther);
  }
  Dst.insert(Engine.makePostStmtNode(CastE, state, Pred));
}
 
void ExprEngine::VisitCastExpr(const CastExpr *CastE, ExplodedNode *Pred,
                               ExplodedNodeSet &Dst) {
  const Expr *Ex = CastE->getSubExpr();
  ProgramStateRef State = Pred->getState();
  const StackFrame *SF = Pred->getStackFrame();
 
  if (CastE->getCastKind() == CK_LValueToRValue) {
    evalLoad(Dst, CastE, CastE, Pred, State, State->getSVal(Ex, SF));
    return;
  }
  if (CastE->getCastKind() == CK_LValueToRValueBitCast) {
    // Handle `__builtin_bit_cast`:
    ExplodedNodeSet DstEvalLoc;
 
    // Simulate the lvalue-to-rvalue conversion on `Ex`:
    evalLocation(DstEvalLoc, CastE, Ex, Pred, State, State->getSVal(Ex, SF),
                 true);
    // Simulate the operation that actually casts the original value to a new
    // value of the destination type :
 
    for (ExplodedNode *Node : DstEvalLoc) {
      ProgramStateRef State = Node->getState();
      const StackFrame *SF = Node->getStackFrame();
      // Although `Ex` is an lvalue, it could have `Loc::ConcreteInt` kind
      // (e.g., `(int *)123456`).  In such cases, there is no MemRegion
      // available and we can't get the value to be casted.
      SVal CastedV = UnknownVal();
 
      if (const MemRegion *MR = State->getSVal(Ex, SF).getAsRegion()) {
        SVal OrigV = State->getSVal(MR);
        CastedV = svalBuilder.evalCast(svalBuilder.simplifySVal(State, OrigV),
                                       CastE->getType(), Ex->getType());
      }
      Dst.insert(Engine.makeNodeWithBinding(Node, CastE, CastedV));
    }
    return;
  }
 
  // All other casts.
  QualType T = CastE->getType();
  QualType ExTy = Ex->getType();
 
  if (const ExplicitCastExpr *ExCast=dyn_cast_or_null<ExplicitCastExpr>(CastE))
    T = ExCast->getTypeAsWritten();
 
  switch (CastE->getCastKind()) {
  case CK_LValueToRValue:
  case CK_LValueToRValueBitCast:
    llvm_unreachable("LValueToRValue casts handled earlier.");
  case CK_ToVoid:
    Dst.insert(Pred);
    return;
    // The analyzer doesn't do anything special with these casts,
    // since it understands retain/release semantics already.
  case CK_ARCProduceObject:
  case CK_ARCConsumeObject:
  case CK_ARCReclaimReturnedObject:
  case CK_ARCExtendBlockObject: // Fall-through.
  case CK_CopyAndAutoreleaseBlockObject:
    // The analyser can ignore atomic casts for now, although some future
    // checkers may want to make certain that you're not modifying the same
    // value through atomic and nonatomic pointers.
  case CK_AtomicToNonAtomic:
  case CK_NonAtomicToAtomic:
    // True no-ops.
  case CK_NoOp:
  case CK_ConstructorConversion:
  case CK_UserDefinedConversion:
  case CK_FunctionToPointerDecay:
  case CK_BuiltinFnToFnPtr:
  case CK_HLSLArrayRValue: {
    // Copy the SVal of Ex to CastE.
    SVal V = State->getSVal(Ex, SF);
    Dst.insert(Engine.makeNodeWithBinding(Pred, CastE, V));
    return;
  }
  case CK_MemberPointerToBoolean:
  case CK_PointerToBoolean: {
    SVal V = State->getSVal(Ex, SF);
    auto PTMSV = V.getAs<nonloc::PointerToMember>();
    if (PTMSV)
      V = svalBuilder.makeTruthVal(!PTMSV->isNullMemberPointer(), ExTy);
    if (V.isUndef() || PTMSV) {
      Dst.insert(Engine.makeNodeWithBinding(Pred, CastE, V));
      return;
    }
    handleLValueBitCast(State, Ex, SF, T, ExTy, CastE, Dst, Pred);
    return;
  }
  case CK_Dependent:
  case CK_ArrayToPointerDecay:
  case CK_BitCast:
  case CK_AddressSpaceConversion:
  case CK_BooleanToSignedIntegral:
  case CK_IntegralToPointer:
  case CK_PointerToIntegral: {
    SVal V = State->getSVal(Ex, SF);
    if (isa<nonloc::PointerToMember>(V)) {
      Dst.insert(Engine.makeNodeWithBinding(Pred, CastE, UnknownVal()));
      return;
    }
    handleLValueBitCast(State, Ex, SF, T, ExTy, CastE, Dst, Pred);
    return;
  }
  case CK_IntegralToBoolean:
  case CK_IntegralToFloating:
  case CK_FloatingToIntegral:
  case CK_FloatingToBoolean:
  case CK_FloatingCast:
  case CK_FloatingRealToComplex:
  case CK_FloatingComplexToReal:
  case CK_FloatingComplexToBoolean:
  case CK_FloatingComplexCast:
  case CK_FloatingComplexToIntegralComplex:
  case CK_IntegralRealToComplex:
  case CK_IntegralComplexToReal:
  case CK_IntegralComplexToBoolean:
  case CK_IntegralComplexCast:
  case CK_IntegralComplexToFloatingComplex:
  case CK_CPointerToObjCPointerCast:
  case CK_BlockPointerToObjCPointerCast:
  case CK_AnyPointerToBlockPointerCast:
  case CK_ObjCObjectLValueCast:
  case CK_ZeroToOCLOpaqueType:
  case CK_IntToOCLSampler:
  case CK_LValueBitCast:
  case CK_FloatingToFixedPoint:
  case CK_FixedPointToFloating:
  case CK_FixedPointCast:
  case CK_FixedPointToBoolean:
  case CK_FixedPointToIntegral:
  case CK_IntegralToFixedPoint: {
    handleLValueBitCast(State, Ex, SF, T, ExTy, CastE, Dst, Pred);
    return;
  }
  case CK_IntegralCast: {
    // Delegate to SValBuilder to process.
    SVal V = State->getSVal(Ex, SF);
    if (AMgr.options.analyzerSymbolicIntegerCasts())
      V = svalBuilder.evalCast(V, T, ExTy);
    else
      V = svalBuilder.evalIntegralCast(State, V, T, ExTy);
    Dst.insert(Engine.makeNodeWithBinding(Pred, CastE, V));
    return;
  }
  case CK_DerivedToBase:
  case CK_UncheckedDerivedToBase: {
    // For DerivedToBase cast, delegate to the store manager.
    SVal val = State->getSVal(Ex, SF);
    val = getStoreManager().evalDerivedToBase(val, CastE);
    Dst.insert(Engine.makeNodeWithBinding(Pred, CastE, val));
    return;
  }
  // Handle C++ dyn_cast.
  case CK_Dynamic: {
    SVal val = State->getSVal(Ex, SF);
 
    // Compute the type of the result.
    QualType resultType = CastE->getType();
    if (CastE->isGLValue())
      resultType = getContext().getPointerType(resultType);
 
    bool Failed = true;
 
    // Check if the value being cast does not evaluates to 0.
    if (!val.isZeroConstant())
      if (std::optional<SVal> V =
              StateMgr.getStoreManager().evalBaseToDerived(val, T)) {
        val = *V;
        Failed = false;
      }
 
    if (Failed) {
      if (T->isReferenceType()) {
        // A bad_cast exception is thrown if input value is a reference.
        // Currently, we model this, by generating a sink.
        Engine.makePostStmtNode(CastE, State, Pred, /*MarkAsSink=*/true);
        return;
      } else {
        // If the cast fails on a pointer, bind to 0.
        State = State->BindExpr(CastE, SF,
                                svalBuilder.makeNullWithType(resultType));
      }
    } else {
      // If we don't know if the cast succeeded, conjure a new symbol.
      if (val.isUnknown()) {
        DefinedOrUnknownSVal NewSym = svalBuilder.conjureSymbolVal(
            /*symbolTag=*/nullptr, getCFGElementRef(), SF, resultType,
            getNumVisitedCurrent());
        State = State->BindExpr(CastE, SF, NewSym);
      } else
        // Else, bind to the derived region value.
        State = State->BindExpr(CastE, SF, val);
    }
    Dst.insert(Engine.makePostStmtNode(CastE, State, Pred));
    return;
  }
  case CK_BaseToDerived: {
    SVal val = State->getSVal(Ex, SF);
    QualType resultType = CastE->getType();
    if (CastE->isGLValue())
      resultType = getContext().getPointerType(resultType);
 
    if (!val.isConstant()) {
      std::optional<SVal> V = getStoreManager().evalBaseToDerived(val, T);
      val = V ? *V : UnknownVal();
    }
 
    // Failed to cast or the result is unknown, fall back to conservative.
    if (val.isUnknown()) {
      val = svalBuilder.conjureSymbolVal(
          /*symbolTag=*/nullptr, getCFGElementRef(), SF, resultType,
          getNumVisitedCurrent());
    }
    Dst.insert(Engine.makeNodeWithBinding(Pred, CastE, val));
    return;
  }
  case CK_NullToPointer: {
    SVal V = svalBuilder.makeNullWithType(CastE->getType());
    Dst.insert(Engine.makeNodeWithBinding(Pred, CastE, V));
    return;
  }
  case CK_NullToMemberPointer: {
    SVal V = svalBuilder.getMemberPointer(nullptr);
    Dst.insert(Engine.makeNodeWithBinding(Pred, CastE, V));
    return;
  }
  case CK_DerivedToBaseMemberPointer:
  case CK_BaseToDerivedMemberPointer:
  case CK_ReinterpretMemberPointer: {
    SVal V = State->getSVal(Ex, SF);
    if (auto PTMSV = V.getAs<nonloc::PointerToMember>()) {
      SVal CastedPTMSV =
          svalBuilder.makePointerToMember(getBasicVals().accumCXXBase(
              CastE->path(), *PTMSV, CastE->getCastKind()));
      Dst.insert(Engine.makeNodeWithBinding(Pred, CastE, CastedPTMSV));
      return;
    }
    // Explicitly proceed with default handler for this case cascade.
  }
    [[fallthrough]];
  // Various C++ casts that are not handled yet.
  case CK_ToUnion:
  case CK_MatrixCast:
  case CK_VectorSplat:
  case CK_HLSLElementwiseCast:
  case CK_HLSLAggregateSplatCast:
  case CK_HLSLMatrixTruncation:
  case CK_HLSLVectorTruncation: {
    QualType resultType = CastE->getType();
    if (CastE->isGLValue())
      resultType = getContext().getPointerType(resultType);
    SVal result = svalBuilder.conjureSymbolVal(
        /*symbolTag=*/nullptr, getCFGElementRef(), SF, resultType,
        getNumVisitedCurrent());
    Dst.insert(Engine.makeNodeWithBinding(Pred, CastE, result));
    return;
  }
  }
}
 
void ExprEngine::VisitCompoundLiteralExpr(const CompoundLiteralExpr *CL,
                                          ExplodedNode *Pred,
                                          ExplodedNodeSet &Dst) {
  ProgramStateRef State = Pred->getState();
  const StackFrame *SF = Pred->getStackFrame();
 
  const Expr *Init = CL->getInitializer();
  SVal V = State->getSVal(CL->getInitializer(), SF);
 
  if (isa<CXXConstructExpr, CXXStdInitializerListExpr>(Init)) {
    // No work needed. Just pass the value up to this expression.
  } else {
    assert(isa<InitListExpr>(Init));
    Loc CLLoc = State->getLValue(CL, SF);
    State = State->bindLoc(CLLoc, V, SF);
 
    if (CL->isGLValue())
      V = CLLoc;
  }
 
  Dst.insert(Engine.makeNodeWithBinding(Pred, CL, V, State));
}
 
void ExprEngine::VisitDeclStmt(const DeclStmt *DS, ExplodedNode *Pred,
                               ExplodedNodeSet &Dst) {
  if (isa<TypedefNameDecl>(*DS->decl_begin())) {
    // C99 6.7.7 "Any array size expressions associated with variable length
    // array declarators are evaluated each time the declaration of the typedef
    // name is reached in the order of execution."
    // The checkers should know about typedef to be able to handle VLA size
    // expressions.
    ExplodedNodeSet DstPre;
    getCheckerManager().runCheckersForPreStmt(DstPre, Pred, DS, *this);
    getCheckerManager().runCheckersForPostStmt(Dst, DstPre, DS, *this);
    return;
  }
 
  // Assumption: The CFG has one DeclStmt per Decl.
  const VarDecl *VD = dyn_cast_or_null<VarDecl>(*DS->decl_begin());
 
  if (!VD) {
    //TODO:AZ: remove explicit insertion after refactoring is done.
    Dst.insert(Pred);
    return;
  }
 
  // Self-assignment initialization in variable declaration,
  // i.e., `int x = x;`,
  // is a C idiom to suppress warnings of unused variables.
  // This filter will not match variables of C++ record types, but will match
  // C++ references. Allow references continuing here to make the undefined
  // value checker report self-assignments of C++ references.
  if (const Expr *EI = VD->getInit()) {
    // Ignore InitListExpr if exists.
    if (const auto *IL = dyn_cast<InitListExpr>(EI);
        IL && IL->getNumInits() == 1)
      EI = IL->getInit(0);
 
    // Ignore parentheses and implict casts.
    if (const auto *DR = dyn_cast<DeclRefExpr>(EI->IgnoreParenImpCasts())) {
      if (VD == DR->getDecl() && !VD->getType()->isReferenceType()) {
        Dst.insert(Pred);
        return;
      }
    }
  }
 
  // FIXME: all pre/post visits should eventually be handled by ::Visit().
  ExplodedNodeSet dstPreVisit;
  getCheckerManager().runCheckersForPreStmt(dstPreVisit, Pred, DS, *this);
 
  ExplodedNodeSet dstEvaluated;
  for (ExplodedNodeSet::iterator I = dstPreVisit.begin(), E = dstPreVisit.end();
       I!=E; ++I) {
    ExplodedNode *N = *I;
    ProgramStateRef state = N->getState();
    const StackFrame *SF = N->getStackFrame();
 
    // Decls without InitExpr are not initialized explicitly.
    if (const Expr *InitEx = VD->getInit()) {
 
      // Note in the state that the initialization has occurred.
      ExplodedNode *UpdatedN = N;
      SVal InitVal = state->getSVal(InitEx, SF);
 
      assert(DS->isSingleDecl());
      if (getObjectUnderConstruction(state, DS, SF)) {
        state = finishObjectConstruction(state, DS, SF);
        // We constructed the object directly in the variable.
        // No need to bind anything.
        dstEvaluated.insert(Engine.makePostStmtNode(DS, state, UpdatedN));
      } else {
        // Recover some path-sensitivity if a scalar value evaluated to
        // UnknownVal.
        if (InitVal.isUnknown()) {
          QualType Ty = InitEx->getType();
          if (InitEx->isGLValue()) {
            Ty = getContext().getPointerType(Ty);
          }
 
          InitVal = svalBuilder.conjureSymbolVal(
              /*symbolTag=*/nullptr, getCFGElementRef(), SF, Ty,
              getNumVisitedCurrent());
        }
 
        evalBind(dstEvaluated, DS, UpdatedN, state->getLValue(VD, SF), InitVal,
                 true);
      }
    }
    else {
      dstEvaluated.insert(Engine.makePostStmtNode(DS, state, N));
    }
  }
 
  getCheckerManager().runCheckersForPostStmt(Dst, dstEvaluated, DS, *this);
}
 
void ExprEngine::VisitLogicalExpr(const BinaryOperator* B, ExplodedNode *Pred,
                                  ExplodedNodeSet &Dst) {
  // This method acts upon CFG elements for logical operators && and ||
  // and attaches the value (true or false) to them as expressions.
  // It doesn't produce any state splits.
  // If we made it that far, we're past the point when we modeled the short
  // circuit. It means that we should have precise knowledge about whether
  // we've short-circuited. If we did, we already know the value we need to
  // bind. If we didn't, the value of the RHS (casted to the boolean type)
  // is the answer.
  // Currently this method tries to figure out whether we've short-circuited
  // by looking at the ExplodedGraph. This method is imperfect because there
  // could inevitably have been merges that would have resulted in multiple
  // potential path traversal histories. We bail out when we fail.
  // Due to this ambiguity, a more reliable solution would have been to
  // track the short circuit operation history path-sensitively until
  // we evaluate the respective logical operator.
  assert(B->getOpcode() == BO_LAnd ||
         B->getOpcode() == BO_LOr);
 
  ProgramStateRef state = Pred->getState();
 
  if (B->getType()->isVectorType()) {
    // FIXME: We do not model vector arithmetic yet. When adding support for
    // that, note that the CFG-based reasoning below does not apply, because
    // logical operators on vectors are not short-circuit. Currently they are
    // modeled as short-circuit in Clang CFG but this is incorrect.
    // Do not set the value for the expression. It'd be UnknownVal by default.
    Dst.insert(Engine.makePostStmtNode(B, state, Pred));
    return;
  }
 
  ExplodedNode *N = Pred;
  while (!N->getLocation().getAs<BlockEdge>()) {
    ProgramPoint P = N->getLocation();
    assert(P.getAs<PreStmt>() || P.getAs<PreStmtPurgeDeadSymbols>() ||
           P.getAs<BlockEntrance>());
    (void) P;
    if (N->pred_size() != 1) {
      // We failed to track back where we came from.
      Dst.insert(Engine.makePostStmtNode(B, state, Pred));
      return;
    }
    N = *N->pred_begin();
  }
 
  if (N->pred_size() != 1) {
    // We failed to track back where we came from.
    Dst.insert(Engine.makePostStmtNode(B, state, Pred));
    return;
  }
 
  BlockEdge BE = N->getLocation().castAs<BlockEdge>();
  SVal X;
 
  // Determine the value of the expression by introspecting how we
  // got this location in the CFG.  This requires looking at the previous
  // block we were in and what kind of control-flow transfer was involved.
  const CFGBlock *SrcBlock = BE.getSrc();
  // The only terminator (if there is one) that makes sense is a logical op.
  CFGTerminator T = SrcBlock->getTerminator();
  if (const BinaryOperator *Term = cast_or_null<BinaryOperator>(T.getStmt())) {
    (void) Term;
    assert(Term->isLogicalOp());
    assert(SrcBlock->succ_size() == 2);
    // Did we take the true or false branch?
    unsigned constant = (*SrcBlock->succ_begin() == BE.getDst()) ? 1 : 0;
    X = svalBuilder.makeIntVal(constant, B->getType());
  }
  else {
    // If there is no terminator, by construction the last statement
    // in SrcBlock is the value of the enclosing expression.
    // However, we still need to constrain that value to be 0 or 1.
    assert(!SrcBlock->empty());
    CFGStmt Elem = SrcBlock->rbegin()->castAs<CFGStmt>();
    const Expr *RHS = cast<Expr>(Elem.getStmt());
    SVal RHSVal = N->getState()->getSVal(RHS, Pred->getStackFrame());
 
    if (RHSVal.isUndef()) {
      X = RHSVal;
    } else {
      // We evaluate "RHSVal != 0" expression which result in 0 if the value is
      // known to be false, 1 if the value is known to be true and a new symbol
      // when the assumption is unknown.
      X = evalBinOp(N->getState(), BO_NE, RHSVal,
                    svalBuilder.makeZeroVal(RHS->getType()), B->getType());
    }
  }
  Dst.insert(Engine.makeNodeWithBinding(Pred, B, X));
}
 
void ExprEngine::VisitGuardedExpr(const Expr *Ex,
                                  const Expr *L,
                                  const Expr *R,
                                  ExplodedNode *Pred,
                                  ExplodedNodeSet &Dst) {
  assert(L && R);
 
  ProgramStateRef state = Pred->getState();
  const StackFrame *SF = Pred->getStackFrame();
  const CFGBlock *SrcBlock = nullptr;
 
  // Find the predecessor block.
  ProgramStateRef SrcState = state;
  for (const ExplodedNode *N = Pred ; N ; N = *N->pred_begin()) {
    auto Edge = N->getLocationAs<BlockEdge>();
    if (!Edge.has_value()) {
      // If the state N has multiple predecessors P, it means that successors
      // of P are all equivalent.
      // In turn, that means that all nodes at P are equivalent in terms
      // of observable behavior at N, and we can follow any of them.
      // FIXME: a more robust solution which does not walk up the tree.
      continue;
    }
    SrcBlock = Edge->getSrc();
    SrcState = N->getState();
    break;
  }
 
  assert(SrcBlock && "missing function entry");
 
  // Find the last expression in the predecessor block.  That is the
  // expression that is used for the value of the ternary expression.
  bool hasValue = false;
  SVal V;
 
  for (CFGElement CE : llvm::reverse(*SrcBlock)) {
    if (std::optional<CFGStmt> CS = CE.getAs<CFGStmt>()) {
      const Expr *ValEx = cast<Expr>(CS->getStmt());
      ValEx = ValEx->IgnoreParens();
 
      // For GNU extension '?:' operator, the left hand side will be an
      // OpaqueValueExpr, so get the underlying expression.
      if (const OpaqueValueExpr *OpaqueEx = dyn_cast<OpaqueValueExpr>(L))
        L = OpaqueEx->getSourceExpr();
 
      // If the last expression in the predecessor block matches true or false
      // subexpression, get its the value.
      if (ValEx == L->IgnoreParens() || ValEx == R->IgnoreParens()) {
        hasValue = true;
        V = SrcState->getSVal(ValEx, SF);
      }
      break;
    }
  }
 
  if (!hasValue)
    V = svalBuilder.conjureSymbolVal(nullptr, getCFGElementRef(), SF,
                                     getNumVisitedCurrent());
 
  // Generate a new node with the binding from the appropriate path.
  Dst.insert(Engine.makeNodeWithBinding(Pred, Ex, V));
}
 
void ExprEngine::VisitOffsetOfExpr(const OffsetOfExpr *OOE, ExplodedNode *Pred,
                                   ExplodedNodeSet &Dst) {
  Expr::EvalResult Result;
  if (OOE->EvaluateAsInt(Result, getContext())) {
    APSInt IV = Result.Val.getInt();
    assert(IV.getBitWidth() == getContext().getTypeSize(OOE->getType()));
    assert(OOE->getType()->castAs<BuiltinType>()->isInteger());
    assert(IV.isSigned() == OOE->getType()->isSignedIntegerType());
    SVal X = svalBuilder.makeIntVal(IV);
    Dst.insert(Engine.makeNodeWithBinding(Pred, OOE, X));
  } else {
    // FIXME: Handle the case where __builtin_offsetof is not a constant.
    Dst.insert(Pred);
  }
}
 
void ExprEngine::VisitUnaryExprOrTypeTraitExpr(
    const UnaryExprOrTypeTraitExpr *Ex, ExplodedNode *Pred,
    ExplodedNodeSet &Dst) {
  QualType T = Ex->getTypeOfArgument();
 
  if (Ex->getKind() == UETT_SizeOf || Ex->getKind() == UETT_DataSizeOf ||
      Ex->getKind() == UETT_CountOf) {
    if (!T->isIncompleteType() && !T->isConstantSizeType()) {
      assert(T->isVariableArrayType() && "Unknown non-constant-sized type.");
 
      // FIXME: Add support for VLA type arguments and VLA expressions.
      // When that happens, we should probably refactor VLASizeChecker's code.
      Dst.insert(Pred);
      return;
    } else if (T->getAs<ObjCObjectType>()) {
      // Some code tries to take the sizeof an ObjCObjectType, relying that
      // the compiler has laid out its representation.  Just report Unknown
      // for these.
      Dst.insert(Pred);
      return;
    }
  }
 
  APSInt Value = Ex->EvaluateKnownConstInt(getContext());
  CharUnits amt = CharUnits::fromQuantity(Value.getZExtValue());
 
  SVal V = svalBuilder.makeIntVal(amt.getQuantity(), Ex->getType());
  Dst.insert(Engine.makeNodeWithBinding(Pred, Ex, V));
}
 
void ExprEngine::VisitStmtExpr(const StmtExpr *SE, ExplodedNode *Pred,
                               ExplodedNodeSet &Dst) {
  if (SE->getSubStmt()->body_empty()) {
    // Empty statement expression.
    assert(SE->getType() == getContext().VoidTy &&
           "Empty statement expression must have void type.");
  } else if (const auto *LastExpr =
                 dyn_cast<Expr>(*SE->getSubStmt()->body_rbegin())) {
    SVal Val = Pred->getState()->getSVal(LastExpr, Pred->getStackFrame());
    Pred = Engine.makeNodeWithBinding(Pred, SE, Val);
  }
  Dst.insert(Pred);
}
 
void ExprEngine::VisitUnaryOperator(const UnaryOperator* U, ExplodedNode *Pred,
                                    ExplodedNodeSet &Dst) {
  // FIXME: Prechecks eventually go in ::Visit().
  ExplodedNodeSet CheckedSet;
  getCheckerManager().runCheckersForPreStmt(CheckedSet, Pred, U, *this);
 
  ExplodedNodeSet EvalSet;
 
  // Lambda for handling the case when the operand is returned unchanged.
  auto MakeNodeForIdentityOp = [U, &Engine = Engine](ExplodedNode *N) {
    const Expr *Ex = U->getSubExpr()->IgnoreParens();
    SVal SV = N->getState()->getSVal(Ex, N->getStackFrame());
    return Engine.makeNodeWithBinding(N, U, SV);
  };
 
  for (ExplodedNode *N : CheckedSet) {
    switch (U->getOpcode()) {
    default: {
      ExplodedNodeSet Tmp;
      VisitIncrementDecrementOperator(U, N, Tmp);
      EvalSet.insert(Tmp);
      break;
    }
    case UO_Real: {
      const Expr *Ex = U->getSubExpr()->IgnoreParens();
 
      // FIXME: We don't have complex SValues yet.
      if (Ex->getType()->isAnyComplexType()) {
        // Just report "Unknown."
        EvalSet.insert(N);
        break;
      }
 
      // For all other types, UO_Real is an identity operation.
      assert (U->getType() == Ex->getType());
      EvalSet.insert(MakeNodeForIdentityOp(N));
      break;
    }
 
    case UO_Imag: {
      const Expr *Ex = U->getSubExpr()->IgnoreParens();
      // FIXME: We don't have complex SValues yet.
      if (Ex->getType()->isAnyComplexType()) {
        // Just report "Unknown."
        EvalSet.insert(N);
        break;
      }
      // For all other types, UO_Imag returns 0.
      SVal X = svalBuilder.makeZeroVal(Ex->getType());
      EvalSet.insert(Engine.makeNodeWithBinding(N, U, X));
      break;
    }
 
    case UO_AddrOf: {
      // Process pointer-to-member address operation.
      const Expr *Ex = U->getSubExpr()->IgnoreParens();
      if (const DeclRefExpr *DRE = dyn_cast<DeclRefExpr>(Ex)) {
        const ValueDecl *VD = DRE->getDecl();
 
        if (isa<CXXMethodDecl, FieldDecl, IndirectFieldDecl>(VD)) {
          SVal SV = svalBuilder.getMemberPointer(cast<NamedDecl>(VD));
          EvalSet.insert(Engine.makeNodeWithBinding(N, U, SV));
          break;
        }
      }
      // Explicitly proceed with default handler for this case cascade.
      EvalSet.insert(MakeNodeForIdentityOp(N));
      break;
    }
    case UO_Plus:
      assert(!U->isGLValue());
      [[fallthrough]];
    case UO_Deref:
    case UO_Extension: {
      EvalSet.insert(MakeNodeForIdentityOp(N));
      break;
    }
 
    case UO_LNot:
    case UO_Minus:
    case UO_Not: {
      assert (!U->isGLValue());
      const Expr *Ex = U->getSubExpr()->IgnoreParens();
      ProgramStateRef state = N->getState();
      const StackFrame *SF = N->getStackFrame();
 
      // Get the value of the subexpression.
      SVal V = state->getSVal(Ex, SF);
 
      if (V.isUnknownOrUndef()) {
        EvalSet.insert(Engine.makeNodeWithBinding(N, U, V));
        break;
      }
 
      switch (U->getOpcode()) {
        default:
          llvm_unreachable("Invalid Opcode.");
        case UO_Not:
          // FIXME: Do we need to handle promotions?
          state = state->BindExpr(
              U, SF, svalBuilder.evalComplement(V.castAs<NonLoc>()));
          break;
        case UO_Minus:
          // FIXME: Do we need to handle promotions?
          state =
              state->BindExpr(U, SF, svalBuilder.evalMinus(V.castAs<NonLoc>()));
          break;
        case UO_LNot:
          // C99 6.5.3.3: "The expression !E is equivalent to (0==E)."
          //
          //  Note: technically we do "E == 0", but this is the same in the
          //    transfer functions as "0 == E".
          SVal Result;
          if (std::optional<Loc> LV = V.getAs<Loc>()) {
          Loc X = svalBuilder.makeNullWithType(Ex->getType());
          Result = evalBinOp(state, BO_EQ, *LV, X, U->getType());
          } else if (Ex->getType()->isFloatingType()) {
          // FIXME: handle floating point types.
          Result = UnknownVal();
          } else {
          nonloc::ConcreteInt X(getBasicVals().getValue(0, Ex->getType()));
          Result = evalBinOp(state, BO_EQ, V.castAs<NonLoc>(), X, U->getType());
          }
 
          state = state->BindExpr(U, SF, Result);
          break;
      }
      EvalSet.insert(Engine.makePostStmtNode(U, state, N));
      break;
    }
    }
  }
 
  getCheckerManager().runCheckersForPostStmt(Dst, EvalSet, U, *this);
}
 
void ExprEngine::VisitPseudoObjectExpr(const PseudoObjectExpr *PE,
                                       ExplodedNode *Pred,
                                       ExplodedNodeSet &Dst) {
  SVal V = UnknownVal();
  if (const Expr *Result = PE->getResultExpr())
    V = Pred->getState()->getSVal(Result, Pred->getStackFrame());
  Dst.insert(Engine.makeNodeWithBinding(Pred, PE, V));
}
 
void ExprEngine::VisitObjCIndirectCopyRestoreExpr(
    const ObjCIndirectCopyRestoreExpr *OIE, ExplodedNode *Pred,
    ExplodedNodeSet &Dst) {
  // ObjCIndirectCopyRestoreExpr implies passing a temporary for
  // correctness of lifetime management.  Due to limited analysis
  // of ARC, this is implemented as direct arg passing.
  const Expr *E = OIE->getSubExpr();
  SVal V = Pred->getState()->getSVal(E, Pred->getStackFrame());
  Dst.insert(Engine.makeNodeWithBinding(Pred, OIE, V));
}
 
void ExprEngine::VisitIncrementDecrementOperator(const UnaryOperator* U,
                                                 ExplodedNode *Pred,
                                                 ExplodedNodeSet &Dst) {
  // Handle ++ and -- (both pre- and post-increment).
  assert (U->isIncrementDecrementOp());
  const Expr *Ex = U->getSubExpr()->IgnoreParens();
 
  const StackFrame *SF = Pred->getStackFrame();
  ProgramStateRef state = Pred->getState();
  SVal loc = state->getSVal(Ex, SF);
 
  // Perform a load.
  ExplodedNodeSet Tmp;
  evalLoad(Tmp, U, Ex, Pred, state, loc);
 
  ExplodedNodeSet Dst2;
  for (ExplodedNode *N : Tmp) {
    state = N->getState();
    assert(SF == N->getStackFrame());
    SVal V2_untested = state->getSVal(Ex, SF);
 
    // Propagate unknown and undefined values.
    if (V2_untested.isUnknownOrUndef()) {
      state = state->BindExpr(U, SF, V2_untested);
 
      // Perform the store, so that the uninitialized value detection happens.
      evalStore(Dst2, U, Ex, N, state, loc, V2_untested);
      continue;
    }
    DefinedSVal V2 = V2_untested.castAs<DefinedSVal>();
 
    // Handle all other values.
    BinaryOperator::Opcode Op = U->isIncrementOp() ? BO_Add : BO_Sub;
 
    // If the UnaryOperator has non-location type, use its type to create the
    // constant value. If the UnaryOperator has location type, create the
    // constant with int type and pointer width.
    SVal RHS;
    SVal Result;
 
    if (U->getType()->isAnyPointerType())
      RHS = svalBuilder.makeArrayIndex(1);
    else if (U->getType()->isIntegralOrEnumerationType())
      RHS = svalBuilder.makeIntVal(1, U->getType());
    else
      RHS = UnknownVal();
 
    // The use of an operand of type bool with the ++ operators is deprecated
    // but valid until C++17. And if the operand of the ++ operator is of type
    // bool, it is set to true until C++17. Note that for '_Bool', it is also
    // set to true when it encounters ++ operator.
    if (U->getType()->isBooleanType() && U->isIncrementOp())
      Result = svalBuilder.makeTruthVal(true, U->getType());
    else
      Result = evalBinOp(state, Op, V2, RHS, U->getType());
 
    // Conjure a new symbol if necessary to recover precision.
    if (Result.isUnknown()){
      DefinedOrUnknownSVal SymVal = svalBuilder.conjureSymbolVal(
          /*symbolTag=*/nullptr, getCFGElementRef(), SF,
          getNumVisitedCurrent());
      Result = SymVal;
 
      // If the value is a location, ++/-- should always preserve
      // non-nullness.  Check if the original value was non-null, and if so
      // propagate that constraint.
      if (Loc::isLocType(U->getType())) {
        DefinedOrUnknownSVal Constraint =
        svalBuilder.evalEQ(state, V2,svalBuilder.makeZeroVal(U->getType()));
 
        if (!state->assume(Constraint, true)) {
          // It isn't feasible for the original value to be null.
          // Propagate this constraint.
          Constraint = svalBuilder.evalEQ(state, SymVal,
                                       svalBuilder.makeZeroVal(U->getType()));
 
          state = state->assume(Constraint, false);
          assert(state);
        }
      }
    }
 
    // Since the lvalue-to-rvalue conversion is explicit in the AST,
    // we bind an l-value if the operator is prefix and an lvalue (in C++).
    if (U->isGLValue())
      state = state->BindExpr(U, SF, loc);
    else
      state = state->BindExpr(U, SF, U->isPostfix() ? V2 : Result);
 
    // Perform the store.
    evalStore(Dst2, U, Ex, N, state, loc, Result);
  }
  Dst.insert(Dst2);
}