clang  12.0.0git
ExprEngineC.cpp
Go to the documentation of this file.
1 //=-- ExprEngineC.cpp - ExprEngine support for C expressions ----*- C++ -*-===//
2 //
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6 //
7 //===----------------------------------------------------------------------===//
8 //
9 // This file defines ExprEngine's support for C expressions.
10 //
11 //===----------------------------------------------------------------------===//
12 
13 #include "clang/AST/ExprCXX.h"
14 #include "clang/AST/DeclCXX.h"
17 
18 using namespace clang;
19 using namespace ento;
20 using llvm::APSInt;
21 
22 /// Optionally conjure and return a symbol for offset when processing
23 /// an expression \p Expression.
24 /// If \p Other is a location, conjure a symbol for \p Symbol
25 /// (offset) if it is unknown so that memory arithmetic always
26 /// results in an ElementRegion.
27 /// \p Count The number of times the current basic block was visited.
29  SVal Symbol, SVal Other, Expr* Expression, SValBuilder &svalBuilder,
30  unsigned Count, const LocationContext *LCtx) {
31  QualType Ty = Expression->getType();
32  if (Other.getAs<Loc>() &&
34  Symbol.isUnknown()) {
35  return svalBuilder.conjureSymbolVal(Expression, LCtx, Ty, Count);
36  }
37  return Symbol;
38 }
39 
41  ExplodedNode *Pred,
42  ExplodedNodeSet &Dst) {
43 
44  Expr *LHS = B->getLHS()->IgnoreParens();
45  Expr *RHS = B->getRHS()->IgnoreParens();
46 
47  // FIXME: Prechecks eventually go in ::Visit().
48  ExplodedNodeSet CheckedSet;
49  ExplodedNodeSet Tmp2;
50  getCheckerManager().runCheckersForPreStmt(CheckedSet, Pred, B, *this);
51 
52  // With both the LHS and RHS evaluated, process the operation itself.
53  for (ExplodedNodeSet::iterator it=CheckedSet.begin(), ei=CheckedSet.end();
54  it != ei; ++it) {
55 
56  ProgramStateRef state = (*it)->getState();
57  const LocationContext *LCtx = (*it)->getLocationContext();
58  SVal LeftV = state->getSVal(LHS, LCtx);
59  SVal RightV = state->getSVal(RHS, LCtx);
60 
62 
63  if (Op == BO_Assign) {
64  // EXPERIMENTAL: "Conjured" symbols.
65  // FIXME: Handle structs.
66  if (RightV.isUnknown()) {
67  unsigned Count = currBldrCtx->blockCount();
68  RightV = svalBuilder.conjureSymbolVal(nullptr, B->getRHS(), LCtx,
69  Count);
70  }
71  // Simulate the effects of a "store": bind the value of the RHS
72  // to the L-Value represented by the LHS.
73  SVal ExprVal = B->isGLValue() ? LeftV : RightV;
74  evalStore(Tmp2, B, LHS, *it, state->BindExpr(B, LCtx, ExprVal),
75  LeftV, RightV);
76  continue;
77  }
78 
79  if (!B->isAssignmentOp()) {
80  StmtNodeBuilder Bldr(*it, Tmp2, *currBldrCtx);
81 
82  if (B->isAdditiveOp()) {
83  // TODO: This can be removed after we enable history tracking with
84  // SymSymExpr.
85  unsigned Count = currBldrCtx->blockCount();
87  RightV, LeftV, RHS, svalBuilder, Count, LCtx);
89  LeftV, RightV, LHS, svalBuilder, Count, LCtx);
90  }
91 
92  // Although we don't yet model pointers-to-members, we do need to make
93  // sure that the members of temporaries have a valid 'this' pointer for
94  // other checks.
95  if (B->getOpcode() == BO_PtrMemD)
96  state = createTemporaryRegionIfNeeded(state, LCtx, LHS);
97 
98  // Process non-assignments except commas or short-circuited
99  // logical expressions (LAnd and LOr).
100  SVal Result = evalBinOp(state, Op, LeftV, RightV, B->getType());
101  if (!Result.isUnknown()) {
102  state = state->BindExpr(B, LCtx, Result);
103  } else {
104  // If we cannot evaluate the operation escape the operands.
105  state = escapeValues(state, LeftV, PSK_EscapeOther);
106  state = escapeValues(state, RightV, PSK_EscapeOther);
107  }
108 
109  Bldr.generateNode(B, *it, state);
110  continue;
111  }
112 
113  assert (B->isCompoundAssignmentOp());
114 
115  switch (Op) {
116  default:
117  llvm_unreachable("Invalid opcode for compound assignment.");
118  case BO_MulAssign: Op = BO_Mul; break;
119  case BO_DivAssign: Op = BO_Div; break;
120  case BO_RemAssign: Op = BO_Rem; break;
121  case BO_AddAssign: Op = BO_Add; break;
122  case BO_SubAssign: Op = BO_Sub; break;
123  case BO_ShlAssign: Op = BO_Shl; break;
124  case BO_ShrAssign: Op = BO_Shr; break;
125  case BO_AndAssign: Op = BO_And; break;
126  case BO_XorAssign: Op = BO_Xor; break;
127  case BO_OrAssign: Op = BO_Or; break;
128  }
129 
130  // Perform a load (the LHS). This performs the checks for
131  // null dereferences, and so on.
132  ExplodedNodeSet Tmp;
133  SVal location = LeftV;
134  evalLoad(Tmp, B, LHS, *it, state, location);
135 
136  for (ExplodedNodeSet::iterator I = Tmp.begin(), E = Tmp.end(); I != E;
137  ++I) {
138 
139  state = (*I)->getState();
140  const LocationContext *LCtx = (*I)->getLocationContext();
141  SVal V = state->getSVal(LHS, LCtx);
142 
143  // Get the computation type.
144  QualType CTy =
145  cast<CompoundAssignOperator>(B)->getComputationResultType();
146  CTy = getContext().getCanonicalType(CTy);
147 
148  QualType CLHSTy =
149  cast<CompoundAssignOperator>(B)->getComputationLHSType();
150  CLHSTy = getContext().getCanonicalType(CLHSTy);
151 
153 
154  // Promote LHS.
155  V = svalBuilder.evalCast(V, CLHSTy, LTy);
156 
157  // Compute the result of the operation.
158  SVal Result = svalBuilder.evalCast(evalBinOp(state, Op, V, RightV, CTy),
159  B->getType(), CTy);
160 
161  // EXPERIMENTAL: "Conjured" symbols.
162  // FIXME: Handle structs.
163 
164  SVal LHSVal;
165 
166  if (Result.isUnknown()) {
167  // The symbolic value is actually for the type of the left-hand side
168  // expression, not the computation type, as this is the value the
169  // LValue on the LHS will bind to.
170  LHSVal = svalBuilder.conjureSymbolVal(nullptr, B->getRHS(), LCtx, LTy,
171  currBldrCtx->blockCount());
172  // However, we need to convert the symbol to the computation type.
173  Result = svalBuilder.evalCast(LHSVal, CTy, LTy);
174  }
175  else {
176  // The left-hand side may bind to a different value then the
177  // computation type.
178  LHSVal = svalBuilder.evalCast(Result, LTy, CTy);
179  }
180 
181  // In C++, assignment and compound assignment operators return an
182  // lvalue.
183  if (B->isGLValue())
184  state = state->BindExpr(B, LCtx, location);
185  else
186  state = state->BindExpr(B, LCtx, Result);
187 
188  evalStore(Tmp2, B, LHS, *I, state, location, LHSVal);
189  }
190  }
191 
192  // FIXME: postvisits eventually go in ::Visit()
193  getCheckerManager().runCheckersForPostStmt(Dst, Tmp2, B, *this);
194 }
195 
197  ExplodedNodeSet &Dst) {
198 
200 
201  const BlockDecl *BD = BE->getBlockDecl();
202  // Get the value of the block itself.
203  SVal V = svalBuilder.getBlockPointer(BD, T,
204  Pred->getLocationContext(),
205  currBldrCtx->blockCount());
206 
207  ProgramStateRef State = Pred->getState();
208 
209  // If we created a new MemRegion for the block, we should explicitly bind
210  // the captured variables.
211  if (const BlockDataRegion *BDR =
212  dyn_cast_or_null<BlockDataRegion>(V.getAsRegion())) {
213 
214  BlockDataRegion::referenced_vars_iterator I = BDR->referenced_vars_begin(),
215  E = BDR->referenced_vars_end();
216 
217  auto CI = BD->capture_begin();
218  auto CE = BD->capture_end();
219  for (; I != E; ++I) {
220  const VarRegion *capturedR = I.getCapturedRegion();
221  const TypedValueRegion *originalR = I.getOriginalRegion();
222 
223  // If the capture had a copy expression, use the result of evaluating
224  // that expression, otherwise use the original value.
225  // We rely on the invariant that the block declaration's capture variables
226  // are a prefix of the BlockDataRegion's referenced vars (which may include
227  // referenced globals, etc.) to enable fast lookup of the capture for a
228  // given referenced var.
229  const Expr *copyExpr = nullptr;
230  if (CI != CE) {
231  assert(CI->getVariable() == capturedR->getDecl());
232  copyExpr = CI->getCopyExpr();
233  CI++;
234  }
235 
236  if (capturedR != originalR) {
237  SVal originalV;
238  const LocationContext *LCtx = Pred->getLocationContext();
239  if (copyExpr) {
240  originalV = State->getSVal(copyExpr, LCtx);
241  } else {
242  originalV = State->getSVal(loc::MemRegionVal(originalR));
243  }
244  State = State->bindLoc(loc::MemRegionVal(capturedR), originalV, LCtx);
245  }
246  }
247  }
248 
249  ExplodedNodeSet Tmp;
250  StmtNodeBuilder Bldr(Pred, Tmp, *currBldrCtx);
251  Bldr.generateNode(BE, Pred,
252  State->BindExpr(BE, Pred->getLocationContext(), V),
254 
255  // FIXME: Move all post/pre visits to ::Visit().
256  getCheckerManager().runCheckersForPostStmt(Dst, Tmp, BE, *this);
257 }
258 
260  ProgramStateRef state, const Expr* Ex, const LocationContext* LCtx,
261  QualType T, QualType ExTy, const CastExpr* CastE, StmtNodeBuilder& Bldr,
262  ExplodedNode* Pred) {
263  if (T->isLValueReferenceType()) {
264  assert(!CastE->getType()->isLValueReferenceType());
265  ExTy = getContext().getLValueReferenceType(ExTy);
266  } else if (T->isRValueReferenceType()) {
267  assert(!CastE->getType()->isRValueReferenceType());
268  ExTy = getContext().getRValueReferenceType(ExTy);
269  }
270  // Delegate to SValBuilder to process.
271  SVal OrigV = state->getSVal(Ex, LCtx);
272  SVal V = svalBuilder.evalCast(OrigV, T, ExTy);
273  // Negate the result if we're treating the boolean as a signed i1
274  if (CastE->getCastKind() == CK_BooleanToSignedIntegral)
275  V = evalMinus(V);
276  state = state->BindExpr(CastE, LCtx, V);
277  if (V.isUnknown() && !OrigV.isUnknown()) {
278  state = escapeValues(state, OrigV, PSK_EscapeOther);
279  }
280  Bldr.generateNode(CastE, Pred, state);
281 
282  return state;
283 }
284 
286  ProgramStateRef state, const LocationContext* LCtx, const CastExpr* CastE,
287  StmtNodeBuilder &Bldr, ExplodedNode* Pred) {
288  // Recover some path sensitivity by conjuring a new value.
289  QualType resultType = CastE->getType();
290  if (CastE->isGLValue())
291  resultType = getContext().getPointerType(resultType);
292  SVal result = svalBuilder.conjureSymbolVal(nullptr, CastE, LCtx,
293  resultType,
294  currBldrCtx->blockCount());
295  state = state->BindExpr(CastE, LCtx, result);
296  Bldr.generateNode(CastE, Pred, state);
297 
298  return state;
299 }
300 
301 void ExprEngine::VisitCast(const CastExpr *CastE, const Expr *Ex,
302  ExplodedNode *Pred, ExplodedNodeSet &Dst) {
303 
304  ExplodedNodeSet dstPreStmt;
305  getCheckerManager().runCheckersForPreStmt(dstPreStmt, Pred, CastE, *this);
306 
307  if (CastE->getCastKind() == CK_LValueToRValue) {
308  for (ExplodedNodeSet::iterator I = dstPreStmt.begin(), E = dstPreStmt.end();
309  I!=E; ++I) {
310  ExplodedNode *subExprNode = *I;
311  ProgramStateRef state = subExprNode->getState();
312  const LocationContext *LCtx = subExprNode->getLocationContext();
313  evalLoad(Dst, CastE, CastE, subExprNode, state, state->getSVal(Ex, LCtx));
314  }
315  return;
316  }
317 
318  // All other casts.
319  QualType T = CastE->getType();
320  QualType ExTy = Ex->getType();
321 
322  if (const ExplicitCastExpr *ExCast=dyn_cast_or_null<ExplicitCastExpr>(CastE))
323  T = ExCast->getTypeAsWritten();
324 
325  StmtNodeBuilder Bldr(dstPreStmt, Dst, *currBldrCtx);
326  for (ExplodedNodeSet::iterator I = dstPreStmt.begin(), E = dstPreStmt.end();
327  I != E; ++I) {
328 
329  Pred = *I;
330  ProgramStateRef state = Pred->getState();
331  const LocationContext *LCtx = Pred->getLocationContext();
332 
333  switch (CastE->getCastKind()) {
334  case CK_LValueToRValue:
335  llvm_unreachable("LValueToRValue casts handled earlier.");
336  case CK_ToVoid:
337  continue;
338  // The analyzer doesn't do anything special with these casts,
339  // since it understands retain/release semantics already.
340  case CK_ARCProduceObject:
341  case CK_ARCConsumeObject:
342  case CK_ARCReclaimReturnedObject:
343  case CK_ARCExtendBlockObject: // Fall-through.
344  case CK_CopyAndAutoreleaseBlockObject:
345  // The analyser can ignore atomic casts for now, although some future
346  // checkers may want to make certain that you're not modifying the same
347  // value through atomic and nonatomic pointers.
348  case CK_AtomicToNonAtomic:
349  case CK_NonAtomicToAtomic:
350  // True no-ops.
351  case CK_NoOp:
352  case CK_ConstructorConversion:
353  case CK_UserDefinedConversion:
354  case CK_FunctionToPointerDecay:
355  case CK_BuiltinFnToFnPtr: {
356  // Copy the SVal of Ex to CastE.
357  ProgramStateRef state = Pred->getState();
358  const LocationContext *LCtx = Pred->getLocationContext();
359  SVal V = state->getSVal(Ex, LCtx);
360  state = state->BindExpr(CastE, LCtx, V);
361  Bldr.generateNode(CastE, Pred, state);
362  continue;
363  }
364  case CK_MemberPointerToBoolean:
365  case CK_PointerToBoolean: {
366  SVal V = state->getSVal(Ex, LCtx);
367  auto PTMSV = V.getAs<nonloc::PointerToMember>();
368  if (PTMSV)
369  V = svalBuilder.makeTruthVal(!PTMSV->isNullMemberPointer(), ExTy);
370  if (V.isUndef() || PTMSV) {
371  state = state->BindExpr(CastE, LCtx, V);
372  Bldr.generateNode(CastE, Pred, state);
373  continue;
374  }
375  // Explicitly proceed with default handler for this case cascade.
376  state =
377  handleLValueBitCast(state, Ex, LCtx, T, ExTy, CastE, Bldr, Pred);
378  continue;
379  }
380  case CK_Dependent:
381  case CK_ArrayToPointerDecay:
382  case CK_BitCast:
383  case CK_LValueToRValueBitCast:
384  case CK_AddressSpaceConversion:
385  case CK_BooleanToSignedIntegral:
386  case CK_IntegralToPointer:
387  case CK_PointerToIntegral: {
388  SVal V = state->getSVal(Ex, LCtx);
389  if (V.getAs<nonloc::PointerToMember>()) {
390  state = state->BindExpr(CastE, LCtx, UnknownVal());
391  Bldr.generateNode(CastE, Pred, state);
392  continue;
393  }
394  // Explicitly proceed with default handler for this case cascade.
395  state =
396  handleLValueBitCast(state, Ex, LCtx, T, ExTy, CastE, Bldr, Pred);
397  continue;
398  }
399  case CK_IntegralToBoolean:
400  case CK_IntegralToFloating:
401  case CK_FloatingToIntegral:
402  case CK_FloatingToBoolean:
403  case CK_FloatingCast:
404  case CK_FloatingRealToComplex:
405  case CK_FloatingComplexToReal:
406  case CK_FloatingComplexToBoolean:
407  case CK_FloatingComplexCast:
408  case CK_FloatingComplexToIntegralComplex:
409  case CK_IntegralRealToComplex:
410  case CK_IntegralComplexToReal:
411  case CK_IntegralComplexToBoolean:
412  case CK_IntegralComplexCast:
413  case CK_IntegralComplexToFloatingComplex:
414  case CK_CPointerToObjCPointerCast:
415  case CK_BlockPointerToObjCPointerCast:
416  case CK_AnyPointerToBlockPointerCast:
417  case CK_ObjCObjectLValueCast:
418  case CK_ZeroToOCLOpaqueType:
419  case CK_IntToOCLSampler:
420  case CK_LValueBitCast:
421  case CK_FloatingToFixedPoint:
422  case CK_FixedPointToFloating:
423  case CK_FixedPointCast:
424  case CK_FixedPointToBoolean:
425  case CK_FixedPointToIntegral:
426  case CK_IntegralToFixedPoint: {
427  state =
428  handleLValueBitCast(state, Ex, LCtx, T, ExTy, CastE, Bldr, Pred);
429  continue;
430  }
431  case CK_IntegralCast: {
432  // Delegate to SValBuilder to process.
433  SVal V = state->getSVal(Ex, LCtx);
434  V = svalBuilder.evalIntegralCast(state, V, T, ExTy);
435  state = state->BindExpr(CastE, LCtx, V);
436  Bldr.generateNode(CastE, Pred, state);
437  continue;
438  }
439  case CK_DerivedToBase:
440  case CK_UncheckedDerivedToBase: {
441  // For DerivedToBase cast, delegate to the store manager.
442  SVal val = state->getSVal(Ex, LCtx);
443  val = getStoreManager().evalDerivedToBase(val, CastE);
444  state = state->BindExpr(CastE, LCtx, val);
445  Bldr.generateNode(CastE, Pred, state);
446  continue;
447  }
448  // Handle C++ dyn_cast.
449  case CK_Dynamic: {
450  SVal val = state->getSVal(Ex, LCtx);
451 
452  // Compute the type of the result.
453  QualType resultType = CastE->getType();
454  if (CastE->isGLValue())
455  resultType = getContext().getPointerType(resultType);
456 
457  bool Failed = false;
458 
459  // Check if the value being cast evaluates to 0.
460  if (val.isZeroConstant())
461  Failed = true;
462  // Else, evaluate the cast.
463  else
464  val = getStoreManager().attemptDownCast(val, T, Failed);
465 
466  if (Failed) {
467  if (T->isReferenceType()) {
468  // A bad_cast exception is thrown if input value is a reference.
469  // Currently, we model this, by generating a sink.
470  Bldr.generateSink(CastE, Pred, state);
471  continue;
472  } else {
473  // If the cast fails on a pointer, bind to 0.
474  state = state->BindExpr(CastE, LCtx, svalBuilder.makeNull());
475  }
476  } else {
477  // If we don't know if the cast succeeded, conjure a new symbol.
478  if (val.isUnknown()) {
479  DefinedOrUnknownSVal NewSym =
480  svalBuilder.conjureSymbolVal(nullptr, CastE, LCtx, resultType,
481  currBldrCtx->blockCount());
482  state = state->BindExpr(CastE, LCtx, NewSym);
483  } else
484  // Else, bind to the derived region value.
485  state = state->BindExpr(CastE, LCtx, val);
486  }
487  Bldr.generateNode(CastE, Pred, state);
488  continue;
489  }
490  case CK_BaseToDerived: {
491  SVal val = state->getSVal(Ex, LCtx);
492  QualType resultType = CastE->getType();
493  if (CastE->isGLValue())
494  resultType = getContext().getPointerType(resultType);
495 
496  bool Failed = false;
497 
498  if (!val.isConstant()) {
499  val = getStoreManager().attemptDownCast(val, T, Failed);
500  }
501 
502  // Failed to cast or the result is unknown, fall back to conservative.
503  if (Failed || val.isUnknown()) {
504  val =
505  svalBuilder.conjureSymbolVal(nullptr, CastE, LCtx, resultType,
506  currBldrCtx->blockCount());
507  }
508  state = state->BindExpr(CastE, LCtx, val);
509  Bldr.generateNode(CastE, Pred, state);
510  continue;
511  }
512  case CK_NullToPointer: {
513  SVal V = svalBuilder.makeNull();
514  state = state->BindExpr(CastE, LCtx, V);
515  Bldr.generateNode(CastE, Pred, state);
516  continue;
517  }
518  case CK_NullToMemberPointer: {
519  SVal V = svalBuilder.getMemberPointer(nullptr);
520  state = state->BindExpr(CastE, LCtx, V);
521  Bldr.generateNode(CastE, Pred, state);
522  continue;
523  }
524  case CK_DerivedToBaseMemberPointer:
525  case CK_BaseToDerivedMemberPointer:
526  case CK_ReinterpretMemberPointer: {
527  SVal V = state->getSVal(Ex, LCtx);
528  if (auto PTMSV = V.getAs<nonloc::PointerToMember>()) {
529  SVal CastedPTMSV = svalBuilder.makePointerToMember(
530  getBasicVals().accumCXXBase(
531  llvm::make_range<CastExpr::path_const_iterator>(
532  CastE->path_begin(), CastE->path_end()), *PTMSV));
533  state = state->BindExpr(CastE, LCtx, CastedPTMSV);
534  Bldr.generateNode(CastE, Pred, state);
535  continue;
536  }
537  // Explicitly proceed with default handler for this case cascade.
538  state = handleLVectorSplat(state, LCtx, CastE, Bldr, Pred);
539  continue;
540  }
541  // Various C++ casts that are not handled yet.
542  case CK_ToUnion:
543  case CK_VectorSplat: {
544  state = handleLVectorSplat(state, LCtx, CastE, Bldr, Pred);
545  continue;
546  }
547  }
548  }
549 }
550 
552  ExplodedNode *Pred,
553  ExplodedNodeSet &Dst) {
554  StmtNodeBuilder B(Pred, Dst, *currBldrCtx);
555 
556  ProgramStateRef State = Pred->getState();
557  const LocationContext *LCtx = Pred->getLocationContext();
558 
559  const Expr *Init = CL->getInitializer();
560  SVal V = State->getSVal(CL->getInitializer(), LCtx);
561 
562  if (isa<CXXConstructExpr>(Init) || isa<CXXStdInitializerListExpr>(Init)) {
563  // No work needed. Just pass the value up to this expression.
564  } else {
565  assert(isa<InitListExpr>(Init));
566  Loc CLLoc = State->getLValue(CL, LCtx);
567  State = State->bindLoc(CLLoc, V, LCtx);
568 
569  if (CL->isGLValue())
570  V = CLLoc;
571  }
572 
573  B.generateNode(CL, Pred, State->BindExpr(CL, LCtx, V));
574 }
575 
577  ExplodedNodeSet &Dst) {
578  if (isa<TypedefNameDecl>(*DS->decl_begin())) {
579  // C99 6.7.7 "Any array size expressions associated with variable length
580  // array declarators are evaluated each time the declaration of the typedef
581  // name is reached in the order of execution."
582  // The checkers should know about typedef to be able to handle VLA size
583  // expressions.
584  ExplodedNodeSet DstPre;
585  getCheckerManager().runCheckersForPreStmt(DstPre, Pred, DS, *this);
586  getCheckerManager().runCheckersForPostStmt(Dst, DstPre, DS, *this);
587  return;
588  }
589 
590  // Assumption: The CFG has one DeclStmt per Decl.
591  const VarDecl *VD = dyn_cast_or_null<VarDecl>(*DS->decl_begin());
592 
593  if (!VD) {
594  //TODO:AZ: remove explicit insertion after refactoring is done.
595  Dst.insert(Pred);
596  return;
597  }
598 
599  // FIXME: all pre/post visits should eventually be handled by ::Visit().
600  ExplodedNodeSet dstPreVisit;
601  getCheckerManager().runCheckersForPreStmt(dstPreVisit, Pred, DS, *this);
602 
603  ExplodedNodeSet dstEvaluated;
604  StmtNodeBuilder B(dstPreVisit, dstEvaluated, *currBldrCtx);
605  for (ExplodedNodeSet::iterator I = dstPreVisit.begin(), E = dstPreVisit.end();
606  I!=E; ++I) {
607  ExplodedNode *N = *I;
609  const LocationContext *LC = N->getLocationContext();
610 
611  // Decls without InitExpr are not initialized explicitly.
612  if (const Expr *InitEx = VD->getInit()) {
613 
614  // Note in the state that the initialization has occurred.
615  ExplodedNode *UpdatedN = N;
616  SVal InitVal = state->getSVal(InitEx, LC);
617 
618  assert(DS->isSingleDecl());
619  if (getObjectUnderConstruction(state, DS, LC)) {
620  state = finishObjectConstruction(state, DS, LC);
621  // We constructed the object directly in the variable.
622  // No need to bind anything.
623  B.generateNode(DS, UpdatedN, state);
624  } else {
625  // Recover some path-sensitivity if a scalar value evaluated to
626  // UnknownVal.
627  if (InitVal.isUnknown()) {
628  QualType Ty = InitEx->getType();
629  if (InitEx->isGLValue()) {
630  Ty = getContext().getPointerType(Ty);
631  }
632 
633  InitVal = svalBuilder.conjureSymbolVal(nullptr, InitEx, LC, Ty,
634  currBldrCtx->blockCount());
635  }
636 
637 
638  B.takeNodes(UpdatedN);
639  ExplodedNodeSet Dst2;
640  evalBind(Dst2, DS, UpdatedN, state->getLValue(VD, LC), InitVal, true);
641  B.addNodes(Dst2);
642  }
643  }
644  else {
645  B.generateNode(DS, N, state);
646  }
647  }
648 
649  getCheckerManager().runCheckersForPostStmt(Dst, B.getResults(), DS, *this);
650 }
651 
653  ExplodedNodeSet &Dst) {
654  // This method acts upon CFG elements for logical operators && and ||
655  // and attaches the value (true or false) to them as expressions.
656  // It doesn't produce any state splits.
657  // If we made it that far, we're past the point when we modeled the short
658  // circuit. It means that we should have precise knowledge about whether
659  // we've short-circuited. If we did, we already know the value we need to
660  // bind. If we didn't, the value of the RHS (casted to the boolean type)
661  // is the answer.
662  // Currently this method tries to figure out whether we've short-circuited
663  // by looking at the ExplodedGraph. This method is imperfect because there
664  // could inevitably have been merges that would have resulted in multiple
665  // potential path traversal histories. We bail out when we fail.
666  // Due to this ambiguity, a more reliable solution would have been to
667  // track the short circuit operation history path-sensitively until
668  // we evaluate the respective logical operator.
669  assert(B->getOpcode() == BO_LAnd ||
670  B->getOpcode() == BO_LOr);
671 
672  StmtNodeBuilder Bldr(Pred, Dst, *currBldrCtx);
673  ProgramStateRef state = Pred->getState();
674 
675  if (B->getType()->isVectorType()) {
676  // FIXME: We do not model vector arithmetic yet. When adding support for
677  // that, note that the CFG-based reasoning below does not apply, because
678  // logical operators on vectors are not short-circuit. Currently they are
679  // modeled as short-circuit in Clang CFG but this is incorrect.
680  // Do not set the value for the expression. It'd be UnknownVal by default.
681  Bldr.generateNode(B, Pred, state);
682  return;
683  }
684 
685  ExplodedNode *N = Pred;
686  while (!N->getLocation().getAs<BlockEntrance>()) {
687  ProgramPoint P = N->getLocation();
688  assert(P.getAs<PreStmt>()|| P.getAs<PreStmtPurgeDeadSymbols>());
689  (void) P;
690  if (N->pred_size() != 1) {
691  // We failed to track back where we came from.
692  Bldr.generateNode(B, Pred, state);
693  return;
694  }
695  N = *N->pred_begin();
696  }
697 
698  if (N->pred_size() != 1) {
699  // We failed to track back where we came from.
700  Bldr.generateNode(B, Pred, state);
701  return;
702  }
703 
704  N = *N->pred_begin();
705  BlockEdge BE = N->getLocation().castAs<BlockEdge>();
706  SVal X;
707 
708  // Determine the value of the expression by introspecting how we
709  // got this location in the CFG. This requires looking at the previous
710  // block we were in and what kind of control-flow transfer was involved.
711  const CFGBlock *SrcBlock = BE.getSrc();
712  // The only terminator (if there is one) that makes sense is a logical op.
713  CFGTerminator T = SrcBlock->getTerminator();
714  if (const BinaryOperator *Term = cast_or_null<BinaryOperator>(T.getStmt())) {
715  (void) Term;
716  assert(Term->isLogicalOp());
717  assert(SrcBlock->succ_size() == 2);
718  // Did we take the true or false branch?
719  unsigned constant = (*SrcBlock->succ_begin() == BE.getDst()) ? 1 : 0;
720  X = svalBuilder.makeIntVal(constant, B->getType());
721  }
722  else {
723  // If there is no terminator, by construction the last statement
724  // in SrcBlock is the value of the enclosing expression.
725  // However, we still need to constrain that value to be 0 or 1.
726  assert(!SrcBlock->empty());
727  CFGStmt Elem = SrcBlock->rbegin()->castAs<CFGStmt>();
728  const Expr *RHS = cast<Expr>(Elem.getStmt());
729  SVal RHSVal = N->getState()->getSVal(RHS, Pred->getLocationContext());
730 
731  if (RHSVal.isUndef()) {
732  X = RHSVal;
733  } else {
734  // We evaluate "RHSVal != 0" expression which result in 0 if the value is
735  // known to be false, 1 if the value is known to be true and a new symbol
736  // when the assumption is unknown.
738  X = evalBinOp(N->getState(), BO_NE,
739  svalBuilder.evalCast(RHSVal, B->getType(), RHS->getType()),
740  Zero, B->getType());
741  }
742  }
743  Bldr.generateNode(B, Pred, state->BindExpr(B, Pred->getLocationContext(), X));
744 }
745 
747  ExplodedNode *Pred,
748  ExplodedNodeSet &Dst) {
749  StmtNodeBuilder B(Pred, Dst, *currBldrCtx);
750 
751  ProgramStateRef state = Pred->getState();
752  const LocationContext *LCtx = Pred->getLocationContext();
754  unsigned NumInitElements = IE->getNumInits();
755 
756  if (!IE->isGLValue() && !IE->isTransparent() &&
757  (T->isArrayType() || T->isRecordType() || T->isVectorType() ||
758  T->isAnyComplexType())) {
759  llvm::ImmutableList<SVal> vals = getBasicVals().getEmptySValList();
760 
761  // Handle base case where the initializer has no elements.
762  // e.g: static int* myArray[] = {};
763  if (NumInitElements == 0) {
764  SVal V = svalBuilder.makeCompoundVal(T, vals);
765  B.generateNode(IE, Pred, state->BindExpr(IE, LCtx, V));
766  return;
767  }
768 
770  ei = IE->rend(); it != ei; ++it) {
771  SVal V = state->getSVal(cast<Expr>(*it), LCtx);
772  vals = getBasicVals().prependSVal(V, vals);
773  }
774 
775  B.generateNode(IE, Pred,
776  state->BindExpr(IE, LCtx,
777  svalBuilder.makeCompoundVal(T, vals)));
778  return;
779  }
780 
781  // Handle scalars: int{5} and int{} and GLvalues.
782  // Note, if the InitListExpr is a GLvalue, it means that there is an address
783  // representing it, so it must have a single init element.
784  assert(NumInitElements <= 1);
785 
786  SVal V;
787  if (NumInitElements == 0)
789  else
790  V = state->getSVal(IE->getInit(0), LCtx);
791 
792  B.generateNode(IE, Pred, state->BindExpr(IE, LCtx, V));
793 }
794 
796  const Expr *L,
797  const Expr *R,
798  ExplodedNode *Pred,
799  ExplodedNodeSet &Dst) {
800  assert(L && R);
801 
802  StmtNodeBuilder B(Pred, Dst, *currBldrCtx);
803  ProgramStateRef state = Pred->getState();
804  const LocationContext *LCtx = Pred->getLocationContext();
805  const CFGBlock *SrcBlock = nullptr;
806 
807  // Find the predecessor block.
808  ProgramStateRef SrcState = state;
809  for (const ExplodedNode *N = Pred ; N ; N = *N->pred_begin()) {
810  ProgramPoint PP = N->getLocation();
811  if (PP.getAs<PreStmtPurgeDeadSymbols>() || PP.getAs<BlockEntrance>()) {
812  // If the state N has multiple predecessors P, it means that successors
813  // of P are all equivalent.
814  // In turn, that means that all nodes at P are equivalent in terms
815  // of observable behavior at N, and we can follow any of them.
816  // FIXME: a more robust solution which does not walk up the tree.
817  continue;
818  }
819  SrcBlock = PP.castAs<BlockEdge>().getSrc();
820  SrcState = N->getState();
821  break;
822  }
823 
824  assert(SrcBlock && "missing function entry");
825 
826  // Find the last expression in the predecessor block. That is the
827  // expression that is used for the value of the ternary expression.
828  bool hasValue = false;
829  SVal V;
830 
831  for (CFGElement CE : llvm::reverse(*SrcBlock)) {
832  if (Optional<CFGStmt> CS = CE.getAs<CFGStmt>()) {
833  const Expr *ValEx = cast<Expr>(CS->getStmt());
834  ValEx = ValEx->IgnoreParens();
835 
836  // For GNU extension '?:' operator, the left hand side will be an
837  // OpaqueValueExpr, so get the underlying expression.
838  if (const OpaqueValueExpr *OpaqueEx = dyn_cast<OpaqueValueExpr>(L))
839  L = OpaqueEx->getSourceExpr();
840 
841  // If the last expression in the predecessor block matches true or false
842  // subexpression, get its the value.
843  if (ValEx == L->IgnoreParens() || ValEx == R->IgnoreParens()) {
844  hasValue = true;
845  V = SrcState->getSVal(ValEx, LCtx);
846  }
847  break;
848  }
849  }
850 
851  if (!hasValue)
852  V = svalBuilder.conjureSymbolVal(nullptr, Ex, LCtx,
853  currBldrCtx->blockCount());
854 
855  // Generate a new node with the binding from the appropriate path.
856  B.generateNode(Ex, Pred, state->BindExpr(Ex, LCtx, V, true));
857 }
858 
859 void ExprEngine::
861  ExplodedNode *Pred, ExplodedNodeSet &Dst) {
862  StmtNodeBuilder B(Pred, Dst, *currBldrCtx);
863  Expr::EvalResult Result;
864  if (OOE->EvaluateAsInt(Result, getContext())) {
865  APSInt IV = Result.Val.getInt();
866  assert(IV.getBitWidth() == getContext().getTypeSize(OOE->getType()));
867  assert(OOE->getType()->castAs<BuiltinType>()->isInteger());
868  assert(IV.isSigned() == OOE->getType()->isSignedIntegerType());
869  SVal X = svalBuilder.makeIntVal(IV);
870  B.generateNode(OOE, Pred,
871  Pred->getState()->BindExpr(OOE, Pred->getLocationContext(),
872  X));
873  }
874  // FIXME: Handle the case where __builtin_offsetof is not a constant.
875 }
876 
877 
878 void ExprEngine::
880  ExplodedNode *Pred,
881  ExplodedNodeSet &Dst) {
882  // FIXME: Prechecks eventually go in ::Visit().
883  ExplodedNodeSet CheckedSet;
884  getCheckerManager().runCheckersForPreStmt(CheckedSet, Pred, Ex, *this);
885 
886  ExplodedNodeSet EvalSet;
887  StmtNodeBuilder Bldr(CheckedSet, EvalSet, *currBldrCtx);
888 
889  QualType T = Ex->getTypeOfArgument();
890 
891  for (ExplodedNodeSet::iterator I = CheckedSet.begin(), E = CheckedSet.end();
892  I != E; ++I) {
893  if (Ex->getKind() == UETT_SizeOf) {
894  if (!T->isIncompleteType() && !T->isConstantSizeType()) {
895  assert(T->isVariableArrayType() && "Unknown non-constant-sized type.");
896 
897  // FIXME: Add support for VLA type arguments and VLA expressions.
898  // When that happens, we should probably refactor VLASizeChecker's code.
899  continue;
900  } else if (T->getAs<ObjCObjectType>()) {
901  // Some code tries to take the sizeof an ObjCObjectType, relying that
902  // the compiler has laid out its representation. Just report Unknown
903  // for these.
904  continue;
905  }
906  }
907 
909  CharUnits amt = CharUnits::fromQuantity(Value.getZExtValue());
910 
911  ProgramStateRef state = (*I)->getState();
912  state = state->BindExpr(Ex, (*I)->getLocationContext(),
913  svalBuilder.makeIntVal(amt.getQuantity(),
914  Ex->getType()));
915  Bldr.generateNode(Ex, *I, state);
916  }
917 
918  getCheckerManager().runCheckersForPostStmt(Dst, EvalSet, Ex, *this);
919 }
920 
922  const UnaryOperator *U,
923  StmtNodeBuilder &Bldr) {
924  // FIXME: We can probably just have some magic in Environment::getSVal()
925  // that propagates values, instead of creating a new node here.
926  //
927  // Unary "+" is a no-op, similar to a parentheses. We still have places
928  // where it may be a block-level expression, so we need to
929  // generate an extra node that just propagates the value of the
930  // subexpression.
931  const Expr *Ex = U->getSubExpr()->IgnoreParens();
932  ProgramStateRef state = (*I)->getState();
933  const LocationContext *LCtx = (*I)->getLocationContext();
934  Bldr.generateNode(U, *I, state->BindExpr(U, LCtx,
935  state->getSVal(Ex, LCtx)));
936 }
937 
939  ExplodedNodeSet &Dst) {
940  // FIXME: Prechecks eventually go in ::Visit().
941  ExplodedNodeSet CheckedSet;
942  getCheckerManager().runCheckersForPreStmt(CheckedSet, Pred, U, *this);
943 
944  ExplodedNodeSet EvalSet;
945  StmtNodeBuilder Bldr(CheckedSet, EvalSet, *currBldrCtx);
946 
947  for (ExplodedNodeSet::iterator I = CheckedSet.begin(), E = CheckedSet.end();
948  I != E; ++I) {
949  switch (U->getOpcode()) {
950  default: {
951  Bldr.takeNodes(*I);
952  ExplodedNodeSet Tmp;
954  Bldr.addNodes(Tmp);
955  break;
956  }
957  case UO_Real: {
958  const Expr *Ex = U->getSubExpr()->IgnoreParens();
959 
960  // FIXME: We don't have complex SValues yet.
961  if (Ex->getType()->isAnyComplexType()) {
962  // Just report "Unknown."
963  break;
964  }
965 
966  // For all other types, UO_Real is an identity operation.
967  assert (U->getType() == Ex->getType());
968  ProgramStateRef state = (*I)->getState();
969  const LocationContext *LCtx = (*I)->getLocationContext();
970  Bldr.generateNode(U, *I, state->BindExpr(U, LCtx,
971  state->getSVal(Ex, LCtx)));
972  break;
973  }
974 
975  case UO_Imag: {
976  const Expr *Ex = U->getSubExpr()->IgnoreParens();
977  // FIXME: We don't have complex SValues yet.
978  if (Ex->getType()->isAnyComplexType()) {
979  // Just report "Unknown."
980  break;
981  }
982  // For all other types, UO_Imag returns 0.
983  ProgramStateRef state = (*I)->getState();
984  const LocationContext *LCtx = (*I)->getLocationContext();
985  SVal X = svalBuilder.makeZeroVal(Ex->getType());
986  Bldr.generateNode(U, *I, state->BindExpr(U, LCtx, X));
987  break;
988  }
989 
990  case UO_AddrOf: {
991  // Process pointer-to-member address operation.
992  const Expr *Ex = U->getSubExpr()->IgnoreParens();
993  if (const DeclRefExpr *DRE = dyn_cast<DeclRefExpr>(Ex)) {
994  const ValueDecl *VD = DRE->getDecl();
995 
996  if (isa<CXXMethodDecl>(VD) || isa<FieldDecl>(VD) ||
997  isa<IndirectFieldDecl>(VD)) {
998  ProgramStateRef State = (*I)->getState();
999  const LocationContext *LCtx = (*I)->getLocationContext();
1000  SVal SV = svalBuilder.getMemberPointer(cast<NamedDecl>(VD));
1001  Bldr.generateNode(U, *I, State->BindExpr(U, LCtx, SV));
1002  break;
1003  }
1004  }
1005  // Explicitly proceed with default handler for this case cascade.
1006  handleUOExtension(I, U, Bldr);
1007  break;
1008  }
1009  case UO_Plus:
1010  assert(!U->isGLValue());
1011  LLVM_FALLTHROUGH;
1012  case UO_Deref:
1013  case UO_Extension: {
1014  handleUOExtension(I, U, Bldr);
1015  break;
1016  }
1017 
1018  case UO_LNot:
1019  case UO_Minus:
1020  case UO_Not: {
1021  assert (!U->isGLValue());
1022  const Expr *Ex = U->getSubExpr()->IgnoreParens();
1023  ProgramStateRef state = (*I)->getState();
1024  const LocationContext *LCtx = (*I)->getLocationContext();
1025 
1026  // Get the value of the subexpression.
1027  SVal V = state->getSVal(Ex, LCtx);
1028 
1029  if (V.isUnknownOrUndef()) {
1030  Bldr.generateNode(U, *I, state->BindExpr(U, LCtx, V));
1031  break;
1032  }
1033 
1034  switch (U->getOpcode()) {
1035  default:
1036  llvm_unreachable("Invalid Opcode.");
1037  case UO_Not:
1038  // FIXME: Do we need to handle promotions?
1039  state = state->BindExpr(U, LCtx, evalComplement(V.castAs<NonLoc>()));
1040  break;
1041  case UO_Minus:
1042  // FIXME: Do we need to handle promotions?
1043  state = state->BindExpr(U, LCtx, evalMinus(V.castAs<NonLoc>()));
1044  break;
1045  case UO_LNot:
1046  // C99 6.5.3.3: "The expression !E is equivalent to (0==E)."
1047  //
1048  // Note: technically we do "E == 0", but this is the same in the
1049  // transfer functions as "0 == E".
1050  SVal Result;
1051  if (Optional<Loc> LV = V.getAs<Loc>()) {
1052  Loc X = svalBuilder.makeNullWithType(Ex->getType());
1053  Result = evalBinOp(state, BO_EQ, *LV, X, U->getType());
1054  } else if (Ex->getType()->isFloatingType()) {
1055  // FIXME: handle floating point types.
1056  Result = UnknownVal();
1057  } else {
1058  nonloc::ConcreteInt X(getBasicVals().getValue(0, Ex->getType()));
1059  Result = evalBinOp(state, BO_EQ, V.castAs<NonLoc>(), X,
1060  U->getType());
1061  }
1062 
1063  state = state->BindExpr(U, LCtx, Result);
1064  break;
1065  }
1066  Bldr.generateNode(U, *I, state);
1067  break;
1068  }
1069  }
1070  }
1071 
1072  getCheckerManager().runCheckersForPostStmt(Dst, EvalSet, U, *this);
1073 }
1074 
1076  ExplodedNode *Pred,
1077  ExplodedNodeSet &Dst) {
1078  // Handle ++ and -- (both pre- and post-increment).
1079  assert (U->isIncrementDecrementOp());
1080  const Expr *Ex = U->getSubExpr()->IgnoreParens();
1081 
1082  const LocationContext *LCtx = Pred->getLocationContext();
1083  ProgramStateRef state = Pred->getState();
1084  SVal loc = state->getSVal(Ex, LCtx);
1085 
1086  // Perform a load.
1087  ExplodedNodeSet Tmp;
1088  evalLoad(Tmp, U, Ex, Pred, state, loc);
1089 
1090  ExplodedNodeSet Dst2;
1091  StmtNodeBuilder Bldr(Tmp, Dst2, *currBldrCtx);
1092  for (ExplodedNodeSet::iterator I=Tmp.begin(), E=Tmp.end();I!=E;++I) {
1093 
1094  state = (*I)->getState();
1095  assert(LCtx == (*I)->getLocationContext());
1096  SVal V2_untested = state->getSVal(Ex, LCtx);
1097 
1098  // Propagate unknown and undefined values.
1099  if (V2_untested.isUnknownOrUndef()) {
1100  state = state->BindExpr(U, LCtx, V2_untested);
1101 
1102  // Perform the store, so that the uninitialized value detection happens.
1103  Bldr.takeNodes(*I);
1104  ExplodedNodeSet Dst3;
1105  evalStore(Dst3, U, Ex, *I, state, loc, V2_untested);
1106  Bldr.addNodes(Dst3);
1107 
1108  continue;
1109  }
1110  DefinedSVal V2 = V2_untested.castAs<DefinedSVal>();
1111 
1112  // Handle all other values.
1113  BinaryOperator::Opcode Op = U->isIncrementOp() ? BO_Add : BO_Sub;
1114 
1115  // If the UnaryOperator has non-location type, use its type to create the
1116  // constant value. If the UnaryOperator has location type, create the
1117  // constant with int type and pointer width.
1118  SVal RHS;
1119  SVal Result;
1120 
1121  if (U->getType()->isAnyPointerType())
1122  RHS = svalBuilder.makeArrayIndex(1);
1123  else if (U->getType()->isIntegralOrEnumerationType())
1124  RHS = svalBuilder.makeIntVal(1, U->getType());
1125  else
1126  RHS = UnknownVal();
1127 
1128  // The use of an operand of type bool with the ++ operators is deprecated
1129  // but valid until C++17. And if the operand of the ++ operator is of type
1130  // bool, it is set to true until C++17. Note that for '_Bool', it is also
1131  // set to true when it encounters ++ operator.
1132  if (U->getType()->isBooleanType() && U->isIncrementOp())
1133  Result = svalBuilder.makeTruthVal(true, U->getType());
1134  else
1135  Result = evalBinOp(state, Op, V2, RHS, U->getType());
1136 
1137  // Conjure a new symbol if necessary to recover precision.
1138  if (Result.isUnknown()){
1139  DefinedOrUnknownSVal SymVal =
1140  svalBuilder.conjureSymbolVal(nullptr, U, LCtx,
1141  currBldrCtx->blockCount());
1142  Result = SymVal;
1143 
1144  // If the value is a location, ++/-- should always preserve
1145  // non-nullness. Check if the original value was non-null, and if so
1146  // propagate that constraint.
1147  if (Loc::isLocType(U->getType())) {
1148  DefinedOrUnknownSVal Constraint =
1149  svalBuilder.evalEQ(state, V2,svalBuilder.makeZeroVal(U->getType()));
1150 
1151  if (!state->assume(Constraint, true)) {
1152  // It isn't feasible for the original value to be null.
1153  // Propagate this constraint.
1154  Constraint = svalBuilder.evalEQ(state, SymVal,
1155  svalBuilder.makeZeroVal(U->getType()));
1156 
1157  state = state->assume(Constraint, false);
1158  assert(state);
1159  }
1160  }
1161  }
1162 
1163  // Since the lvalue-to-rvalue conversion is explicit in the AST,
1164  // we bind an l-value if the operator is prefix and an lvalue (in C++).
1165  if (U->isGLValue())
1166  state = state->BindExpr(U, LCtx, loc);
1167  else
1168  state = state->BindExpr(U, LCtx, U->isPostfix() ? V2 : Result);
1169 
1170  // Perform the store.
1171  Bldr.takeNodes(*I);
1172  ExplodedNodeSet Dst3;
1173  evalStore(Dst3, U, Ex, *I, state, loc, Result);
1174  Bldr.addNodes(Dst3);
1175  }
1176  Dst.insert(Dst2);
1177 }
SVal attemptDownCast(SVal Base, QualType DerivedPtrType, bool &Failed)
Attempts to do a down cast.
Definition: Store.cpp:315
const BlockDecl * getBlockDecl() const
Definition: Expr.h:5898
TypedValueRegion - An abstract class representing regions having a typed value.
Definition: MemRegion.h:522
nonloc::ConcreteInt makeIntVal(const IntegerLiteral *integer)
Definition: SValBuilder.h:278
DefinedSVal getBlockPointer(const BlockDecl *block, CanQualType locTy, const LocationContext *locContext, unsigned blockCount)
reverse_iterator rbegin()
Definition: Expr.h:4919
SVal evalDerivedToBase(SVal Derived, const CastExpr *Cast)
Evaluates a chain of derived-to-base casts through the path specified in Cast.
Definition: Store.cpp:249
bool empty() const
Definition: CFG.h:918
A (possibly-)qualified type.
Definition: Type.h:661
bool isArrayType() const
Definition: Type.h:6706
succ_iterator succ_begin()
Definition: CFG.h:955
capture_const_iterator capture_begin() const
Definition: Decl.h:4223
const Expr * getInit(unsigned Init) const
Definition: Expr.h:4758
unsigned blockCount() const
Returns the number of times the current basic block has been visited on the exploded graph path.
Definition: CoreEngine.h:220
This builder class is useful for generating nodes that resulted from visiting a statement.
Definition: CoreEngine.h:378
bool isRecordType() const
Definition: Type.h:6730
const CFGBlock * getSrc() const
Definition: ProgramPoint.h:511
QualType getLValueReferenceType(QualType T, bool SpelledAsLValue=true) const
Return the uniqued reference to the type for an lvalue reference to the specified type.
bool isTransparent() const
Is this a transparent initializer list (that is, an InitListExpr that is purely syntactic,...
Definition: Expr.cpp:2151
Opcode getOpcode() const
Definition: Expr.h:3771
StringRef P
SVal evalBinOp(ProgramStateRef state, BinaryOperator::Opcode op, NonLoc L, NonLoc R, QualType T)
Definition: ExprEngine.h:618
Represents a point after we ran remove dead bindings BEFORE processing the given statement.
Definition: ProgramPoint.h:473
It wraps the AnalysisDeclContext to represent both the call stack with the help of StackFrameContext ...
T castAs() const
Convert to the specified CFGElement type, asserting that this CFGElement is of the desired type.
Definition: CFG.h:98
const ProgramStateRef & getState() const
SVal evalCast(SVal val, QualType castTy, QualType originalType)
Value representing integer constant.
Definition: SVals.h:373
capture_const_iterator capture_end() const
Definition: Decl.h:4224
unsigned succ_size() const
Definition: CFG.h:973
void VisitUnaryOperator(const UnaryOperator *B, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitUnaryOperator - Transfer function logic for unary operators.
void takeNodes(const ExplodedNodeSet &S)
Definition: CoreEngine.h:329
void handleUOExtension(ExplodedNodeSet::iterator I, const UnaryOperator *U, StmtNodeBuilder &Bldr)
Represents a variable declaration or definition.
Definition: Decl.h:834
CompoundLiteralExpr - [C99 6.5.2.5].
Definition: Expr.h:3327
const T * getAs() const
Member-template getAs<specific type>'.
Definition: Type.h:7116
NonLoc makeArrayIndex(uint64_t idx)
Definition: SValBuilder.h:272
static Optional< SVal > getObjectUnderConstruction(ProgramStateRef State, const ConstructionContextItem &Item, const LocationContext *LC)
By looking at a certain item that may be potentially part of an object's ConstructionContext,...
Definition: ExprEngine.cpp:474
void evalStore(ExplodedNodeSet &Dst, const Expr *AssignE, const Expr *StoreE, ExplodedNode *Pred, ProgramStateRef St, SVal TargetLV, SVal Val, const ProgramPointTag *tag=nullptr)
evalStore - Handle the semantics of a store via an assignment.
static bool isAssignmentOp(Opcode Opc)
Definition: Expr.h:3862
Defines the clang::Expr interface and subclasses for C++ expressions.
bool isVariableArrayType() const
Definition: Type.h:6718
InitExprsTy::const_reverse_iterator const_reverse_iterator
Definition: Expr.h:4913
Represents a class type in Objective C.
Definition: Type.h:5783
Value representing pointer-to-member.
Definition: SVals.h:518
LineState State
SVal evalIntegralCast(ProgramStateRef state, SVal val, QualType castTy, QualType originalType)
Loc makeNullWithType(QualType type)
Create NULL pointer, with proper pointer bit-width for given address space.
Definition: SValBuilder.h:345
bool Zero(InterpState &S, CodePtr OpPC)
Definition: Interp.h:812
bool isReferenceType() const
Definition: Type.h:6652
i32 captured_struct **param SharedsTy A type which contains references the shared variables *param Shareds Context with the list of shared variables from the p *TaskFunction *param Data Additional data for task generation like final * state
bool isIntegralOrEnumerationType() const
Determine whether this type is an integral or enumeration type.
Definition: Type.h:7022
llvm::ImmutableList< SVal > prependSVal(SVal X, llvm::ImmutableList< SVal > L)
static bool isLocType(QualType T)
Definition: SVals.h:323
bool isGLValue() const
Definition: Expr.h:275
Describes an C or C++ initializer list.
Definition: Expr.h:4710
void VisitOffsetOfExpr(const OffsetOfExpr *Ex, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitOffsetOfExpr - Transfer function for offsetof.
BinaryOperatorKind
BlockDataRegion - A region that represents a block instance.
Definition: MemRegion.h:663
ExplodedNode * generateSink(const Stmt *S, ExplodedNode *Pred, ProgramStateRef St, const ProgramPointTag *tag=nullptr, ProgramPoint::Kind K=ProgramPoint::PostStmtKind)
Definition: CoreEngine.h:417
CharUnits - This is an opaque type for sizes expressed in character units.
Definition: CharUnits.h:38
path_iterator path_begin()
Definition: Expr.h:3468
const LocationContext * getLocationContext() const
A builtin binary operation expression such as "x + y" or "x <= y".
Definition: Expr.h:3727
bool isUnknown() const
Definition: SVals.h:136
NonLoc makePointerToMember(const DeclaratorDecl *DD)
Definition: SValBuilder.h:260
bool isRValueReferenceType() const
Definition: Type.h:6660
NonLoc makeCompoundVal(QualType type, llvm::ImmutableList< SVal > vals)
Definition: SValBuilder.h:250
CastExpr - Base class for type casts, including both implicit casts (ImplicitCastExpr) and explicit c...
Definition: Expr.h:3397
SVal evalComplement(SVal X)
Definition: ExprEngine.h:597
void VisitDeclStmt(const DeclStmt *DS, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitDeclStmt - Transfer function logic for DeclStmts.
unsigned pred_size() const
bool isConstant() const
Definition: SVals.cpp:200
CheckerManager & getCheckerManager() const
Definition: ExprEngine.h:214
void VisitLogicalExpr(const BinaryOperator *B, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitLogicalExpr - Transfer function logic for '&&', '||'.
UnaryExprOrTypeTraitExpr - expression with either a type or (unevaluated) expression operand.
Definition: Expr.h:2479
Represents a single basic block in a source-level CFG.
Definition: CFG.h:576
void VisitInitListExpr(const InitListExpr *E, ExplodedNode *Pred, ExplodedNodeSet &Dst)
QuantityType getQuantity() const
getQuantity - Get the raw integer representation of this quantity.
Definition: CharUnits.h:179
llvm::APSInt EvaluateKnownConstInt(const ASTContext &Ctx, SmallVectorImpl< PartialDiagnosticAt > *Diag=nullptr) const
EvaluateKnownConstInt - Call EvaluateAsRValue and return the folded integer.
void runCheckersForPostStmt(ExplodedNodeSet &Dst, const ExplodedNodeSet &Src, const Stmt *S, ExprEngine &Eng, bool wasInlined=false)
Run checkers for post-visiting Stmts.
DefinedOrUnknownSVal makeZeroVal(QualType type)
Construct an SVal representing '0' for the specified type.
Definition: SValBuilder.cpp:52
Represents a block literal declaration, which is like an unnamed FunctionDecl.
Definition: Decl.h:4094
Represent the declaration of a variable (in which case it is an lvalue) a function (in which case it ...
Definition: Decl.h:634
This represents one expression.
Definition: Expr.h:109
static SVal conjureOffsetSymbolOnLocation(SVal Symbol, SVal Other, Expr *Expression, SValBuilder &svalBuilder, unsigned Count, const LocationContext *LCtx)
Optionally conjure and return a symbol for offset when processing an expression Expression.
Definition: ExprEngineC.cpp:28
const T * castAs() const
Member-template castAs<specific type>.
Definition: Type.h:7181
void VisitCast(const CastExpr *CastE, const Expr *Ex, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitCast - Transfer function logic for all casts (implicit and explicit).
#define V(N, I)
Definition: ASTContext.h:2983
BlockExpr - Adaptor class for mixing a BlockDecl with expressions.
Definition: Expr.h:5886
unsigned getNumInits() const
Definition: Expr.h:4740
const ExplodedNodeSet & getResults()
Definition: CoreEngine.h:306
bool isAnyComplexType() const
Definition: Type.h:6738
static CharUnits fromQuantity(QuantityType Quantity)
fromQuantity - Construct a CharUnits quantity from a raw integer type.
Definition: CharUnits.h:63
static SVal getValue(SVal val, SValBuilder &svalBuilder)
bool isSignedIntegerType() const
Return true if this is an integer type that is signed, according to C99 6.2.5p4 [char,...
Definition: Type.cpp:2003
const CFGBlock * getDst() const
Definition: ProgramPoint.h:515
QualType getType() const
Definition: Expr.h:141
QualType getTypeOfArgument() const
Gets the argument type, or the type of the argument expression, whichever is appropriate.
Definition: Expr.h:2547
The reason for pointer escape is unknown.
ASTContext & getContext() const
getContext - Return the ASTContext associated with this analysis.
Definition: ExprEngine.h:206
UnaryOperator - This represents the unary-expression's (except sizeof and alignof),...
Definition: Expr.h:2093
DefinedSVal getMemberPointer(const NamedDecl *ND)
void evalLoad(ExplodedNodeSet &Dst, const Expr *NodeEx, const Expr *BoundExpr, ExplodedNode *Pred, ProgramStateRef St, SVal location, const ProgramPointTag *tag=nullptr, QualType LoadTy=QualType())
Simulate a read of the result of Ex.
reverse_iterator rbegin()
Definition: CFG.h:880
OpaqueValueExpr - An expression referring to an opaque object of a fixed type and value class.
Definition: Expr.h:1125
void VisitGuardedExpr(const Expr *Ex, const Expr *L, const Expr *R, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitGuardedExpr - Transfer function logic for ?, __builtin_choose.
DefinedOrUnknownSVal conjureSymbolVal(const void *symbolTag, const Expr *expr, const LocationContext *LCtx, unsigned count)
Create a new symbol with a unique 'name'.
llvm::APSInt APSInt
T castAs() const
Convert to the specified ProgramPoint type, asserting that this ProgramPoint is of the desired type.
Definition: ProgramPoint.h:140
CastKind getCastKind() const
Definition: Expr.h:3442
DeclStmt - Adaptor class for mixing declarations with statements and expressions.
Definition: Stmt.h:1291
void VisitCompoundLiteralExpr(const CompoundLiteralExpr *CL, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitCompoundLiteralExpr - Transfer function logic for compound literals.
ProgramStateRef handleLVectorSplat(ProgramStateRef state, const LocationContext *LCtx, const CastExpr *CastE, StmtNodeBuilder &Bldr, ExplodedNode *Pred)
ProgramPoint getLocation() const
getLocation - Returns the edge associated with the given node.
SVal - This represents a symbolic expression, which can be either an L-value or an R-value.
Definition: SVals.h:75
UnaryExprOrTypeTrait getKind() const
Definition: Expr.h:2510
decl_iterator decl_begin()
Definition: Stmt.h:1345
void VisitUnaryExprOrTypeTraitExpr(const UnaryExprOrTypeTraitExpr *Ex, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitUnaryExprOrTypeTraitExpr - Transfer function for sizeof.
BasicValueFactory & getBasicVals()
Definition: ExprEngine.h:424
void runCheckersForPreStmt(ExplodedNodeSet &Dst, const ExplodedNodeSet &Src, const Stmt *S, ExprEngine &Eng)
Run checkers for pre-visiting Stmts.
bool isVectorType() const
Definition: Type.h:6742
void insert(const ExplodedNodeSet &S)
const Expr * getInitializer() const
Definition: Expr.h:3350
Expr * getLHS() const
Definition: Expr.h:3776
Dataflow Directional Tag Classes.
void VisitIncrementDecrementOperator(const UnaryOperator *U, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Handle ++ and – (both pre- and post-increment).
SValBuilder & getSValBuilder()
Definition: ExprEngine.h:218
EvalResult is a struct with detailed info about an evaluated expression.
Definition: Expr.h:608
void addNodes(const ExplodedNodeSet &S)
Definition: CoreEngine.h:335
StoreManager & getStoreManager()
Definition: ExprEngine.h:417
bool isZeroConstant() const
Definition: SVals.cpp:212
const Expr * getInit() const
Definition: Decl.h:1243
SVal evalEQ(ProgramStateRef state, SVal lhs, SVal rhs)
ExplicitCastExpr - An explicit cast written in the source code.
Definition: Expr.h:3619
bool isSingleDecl() const
isSingleDecl - This method returns true if this DeclStmt refers to a single Decl.
Definition: Stmt.h:1304
Stmt * getStmt()
Definition: CFG.h:535
path_iterator path_end()
Definition: Expr.h:3469
const VarDecl * getDecl() const override=0
ProgramStateRef handleLValueBitCast(ProgramStateRef state, const Expr *Ex, const LocationContext *LCtx, QualType T, QualType ExTy, const CastExpr *CastE, StmtNodeBuilder &Bldr, ExplodedNode *Pred)
T castAs() const
Convert to the specified SVal type, asserting that this SVal is of the desired type.
Definition: SVals.h:103
bool isConstantSizeType() const
Return true if this is not a variable sized type, according to the rules of C99 6....
Definition: Type.cpp:2196
SVal evalMinus(SVal X)
Definition: ExprEngine.h:593
static bool isAdditiveOp(Opcode Opc)
Definition: Expr.h:3812
uint64_t getTypeSize(QualType T) const
Return the size of the specified (complete) type T, in bits.
Definition: ASTContext.h:2121
bool isIncompleteType(NamedDecl **Def=nullptr) const
Types are partitioned into 3 broad categories (C99 6.2.5p1): object types, function types,...
Definition: Type.cpp:2206
CanQualType getCanonicalType(QualType T) const
Return the canonical (structural) type corresponding to the specified potentially non-canonical type ...
Definition: ASTContext.h:2338
bool isLValueReferenceType() const
Definition: Type.h:6656
reverse_iterator rend()
Definition: Expr.h:4921
X
Add a minimal nested name specifier fixit hint to allow lookup of a tag name from an outer enclosing ...
Definition: SemaDecl.cpp:15282
void VisitBlockExpr(const BlockExpr *BE, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitBlockExpr - Transfer function logic for BlockExprs.
Defines the C++ Decl subclasses, other than those for templates (found in DeclTemplate....
bool EvaluateAsInt(EvalResult &Result, const ASTContext &Ctx, SideEffectsKind AllowSideEffects=SE_NoSideEffects, bool InConstantContext=false) const
EvaluateAsInt - Return true if this is a constant which we can fold and convert to an integer,...
static bool isCompoundAssignmentOp(Opcode Opc)
Definition: Expr.h:3867
QualType getRValueReferenceType(QualType T) const
Return the uniqued reference to the type for an rvalue reference to the specified type.
pred_iterator pred_begin()
Represents a top-level expression in a basic block.
Definition: CFG.h:55
QualType getPointerType(QualType T) const
Return the uniqued reference to the type for a pointer to the specified type.
This class is used for builtin types like 'int'.
Definition: Type.h:2479
Represents CFGBlock terminator statement.
Definition: CFG.h:503
ExplodedNode * generateNode(const Stmt *S, ExplodedNode *Pred, ProgramStateRef St, const ProgramPointTag *tag=nullptr, ProgramPoint::Kind K=ProgramPoint::PostStmtKind)
Definition: CoreEngine.h:407
A reference to a declared variable, function, enum, etc.
Definition: Expr.h:1213
Expr * getRHS() const
Definition: Expr.h:3778
nonloc::ConcreteInt makeTruthVal(bool b, QualType type)
Definition: SValBuilder.h:334
Optional< T > getAs() const
Convert to the specified ProgramPoint type, returning None if this ProgramPoint is not of the desired...
Definition: ProgramPoint.h:151
OffsetOfExpr - [C99 7.17] - This represents an expression of the form offsetof(record-type,...
Definition: Expr.h:2374
void VisitBinaryOperator(const BinaryOperator *B, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitBinaryOperator - Transfer function logic for binary operators.
Definition: ExprEngineC.cpp:40
CFGTerminator getTerminator() const
Definition: CFG.h:1048
llvm::ImmutableList< SVal > getEmptySValList()
Expr * IgnoreParens() LLVM_READONLY
Skip past any parentheses which might surround this expression until reaching a fixed point.
Definition: Expr.cpp:2760