Ted Kremenek | 77349cb | 2008-02-14 22:13:12 +0000 | [diff] [blame] | 1 | //=-- GRExprEngine.cpp - Path-Sensitive Expression-Level Dataflow ---*- C++ -*-= |
Ted Kremenek | 6492485 | 2008-01-31 02:35:41 +0000 | [diff] [blame] | 2 | // |
Ted Kremenek | 4af8431 | 2008-01-31 06:49:09 +0000 | [diff] [blame] | 3 | // The LLVM Compiler Infrastructure |
Ted Kremenek | d27f816 | 2008-01-15 23:55:06 +0000 | [diff] [blame] | 4 | // |
| 5 | // This file is distributed under the University of Illinois Open Source |
| 6 | // License. See LICENSE.TXT for details. |
| 7 | // |
| 8 | //===----------------------------------------------------------------------===// |
| 9 | // |
Ted Kremenek | 77349cb | 2008-02-14 22:13:12 +0000 | [diff] [blame] | 10 | // This file defines a meta-engine for path-sensitive dataflow analysis that |
| 11 | // is built on GREngine, but provides the boilerplate to execute transfer |
| 12 | // functions and build the ExplodedGraph at the expression level. |
Ted Kremenek | d27f816 | 2008-01-15 23:55:06 +0000 | [diff] [blame] | 13 | // |
| 14 | //===----------------------------------------------------------------------===// |
Zhongxing Xu | 668399b | 2009-11-24 08:24:26 +0000 | [diff] [blame] | 15 | #include "GRExprEngineInternalChecks.h" |
Benjamin Kramer | 5e2d2c2 | 2010-03-27 21:19:47 +0000 | [diff] [blame] | 16 | #include "clang/Checker/BugReporter/BugType.h" |
| 17 | #include "clang/Checker/PathSensitive/AnalysisManager.h" |
Ted Kremenek | 1309f9a | 2010-01-25 04:41:41 +0000 | [diff] [blame] | 18 | #include "clang/Checker/PathSensitive/GRExprEngine.h" |
| 19 | #include "clang/Checker/PathSensitive/GRExprEngineBuilders.h" |
| 20 | #include "clang/Checker/PathSensitive/Checker.h" |
Ken Dyck | 199c3d6 | 2010-01-11 17:06:35 +0000 | [diff] [blame] | 21 | #include "clang/AST/CharUnits.h" |
Chris Lattner | 16f0049 | 2009-04-26 01:32:48 +0000 | [diff] [blame] | 22 | #include "clang/AST/ParentMap.h" |
| 23 | #include "clang/AST/StmtObjC.h" |
Zhongxing Xu | c506357 | 2010-03-16 13:14:16 +0000 | [diff] [blame] | 24 | #include "clang/AST/DeclCXX.h" |
Chris Lattner | 1b63e4f | 2009-06-14 01:54:56 +0000 | [diff] [blame] | 25 | #include "clang/Basic/Builtins.h" |
Chris Lattner | 16f0049 | 2009-04-26 01:32:48 +0000 | [diff] [blame] | 26 | #include "clang/Basic/SourceManager.h" |
Ted Kremenek | e97ca06 | 2008-03-07 20:57:30 +0000 | [diff] [blame] | 27 | #include "clang/Basic/SourceManager.h" |
Ted Kremenek | 0bed8a1 | 2009-03-11 02:41:36 +0000 | [diff] [blame] | 28 | #include "clang/Basic/PrettyStackTrace.h" |
Ted Kremenek | a95d375 | 2008-09-13 05:16:45 +0000 | [diff] [blame] | 29 | #include "llvm/Support/raw_ostream.h" |
Benjamin Kramer | 6cb7c1a | 2009-08-23 12:08:50 +0000 | [diff] [blame] | 30 | #include "llvm/ADT/ImmutableList.h" |
Ted Kremenek | 4323a57 | 2008-07-10 22:03:41 +0000 | [diff] [blame] | 31 | |
Ted Kremenek | 0f5f059 | 2008-02-27 06:07:00 +0000 | [diff] [blame] | 32 | #ifndef NDEBUG |
| 33 | #include "llvm/Support/GraphWriter.h" |
Ted Kremenek | 0f5f059 | 2008-02-27 06:07:00 +0000 | [diff] [blame] | 34 | #endif |
| 35 | |
Ted Kremenek | b387a3f | 2008-02-14 22:16:04 +0000 | [diff] [blame] | 36 | using namespace clang; |
| 37 | using llvm::dyn_cast; |
Ted Kremenek | 852274d | 2009-12-16 03:18:58 +0000 | [diff] [blame] | 38 | using llvm::dyn_cast_or_null; |
Ted Kremenek | b387a3f | 2008-02-14 22:16:04 +0000 | [diff] [blame] | 39 | using llvm::cast; |
| 40 | using llvm::APSInt; |
Ted Kremenek | ab2b8c5 | 2008-01-23 19:59:44 +0000 | [diff] [blame] | 41 | |
Zhongxing Xu | 6190ec2 | 2010-02-26 15:43:34 +0000 | [diff] [blame] | 42 | namespace { |
| 43 | // Trait class for recording returned expression in the state. |
| 44 | struct ReturnExpr { |
| 45 | static int TagInt; |
| 46 | typedef const Stmt *data_type; |
| 47 | }; |
| 48 | int ReturnExpr::TagInt; |
| 49 | } |
| 50 | |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 51 | //===----------------------------------------------------------------------===// |
Ted Kremenek | 32c4995 | 2009-11-25 21:51:20 +0000 | [diff] [blame] | 52 | // Utility functions. |
| 53 | //===----------------------------------------------------------------------===// |
| 54 | |
| 55 | static inline Selector GetNullarySelector(const char* name, ASTContext& Ctx) { |
| 56 | IdentifierInfo* II = &Ctx.Idents.get(name); |
| 57 | return Ctx.Selectors.getSelector(0, &II); |
| 58 | } |
| 59 | |
| 60 | //===----------------------------------------------------------------------===// |
Ted Kremenek | 5a5d98b | 2009-07-22 21:43:51 +0000 | [diff] [blame] | 61 | // Checker worklist routines. |
| 62 | //===----------------------------------------------------------------------===// |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 63 | |
Zhongxing Xu | 03509ae | 2010-07-20 06:22:24 +0000 | [diff] [blame] | 64 | void GRExprEngine::CheckerVisit(const Stmt *S, ExplodedNodeSet &Dst, |
Jordy Rose | 72905cf | 2010-08-04 07:10:57 +0000 | [diff] [blame] | 65 | ExplodedNodeSet &Src, CallbackKind Kind) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 66 | |
Ted Kremenek | 9e9595b | 2010-06-25 20:59:31 +0000 | [diff] [blame] | 67 | // Determine if we already have a cached 'CheckersOrdered' vector |
Jordy Rose | 72905cf | 2010-08-04 07:10:57 +0000 | [diff] [blame] | 68 | // specifically tailored for the provided <CallbackKind, Stmt kind>. This |
Ted Kremenek | 9e9595b | 2010-06-25 20:59:31 +0000 | [diff] [blame] | 69 | // can reduce the number of checkers actually called. |
| 70 | CheckersOrdered *CO = &Checkers; |
| 71 | llvm::OwningPtr<CheckersOrdered> NewCO; |
Jordy Rose | 72905cf | 2010-08-04 07:10:57 +0000 | [diff] [blame] | 72 | |
| 73 | // The cache key is made up of the and the callback kind (pre- or post-visit) |
| 74 | // and the statement kind. |
| 75 | CallbackTag K = GetCallbackTag(Kind, S->getStmtClass()); |
Ted Kremenek | 9e9595b | 2010-06-25 20:59:31 +0000 | [diff] [blame] | 76 | |
| 77 | CheckersOrdered *& CO_Ref = COCache[K]; |
| 78 | |
| 79 | if (!CO_Ref) { |
| 80 | // If we have no previously cached CheckersOrdered vector for this |
| 81 | // statement kind, then create one. |
| 82 | NewCO.reset(new CheckersOrdered); |
| 83 | } |
| 84 | else { |
| 85 | // Use the already cached set. |
| 86 | CO = CO_Ref; |
| 87 | } |
| 88 | |
| 89 | if (CO->empty()) { |
| 90 | // If there are no checkers, return early without doing any |
| 91 | // more work. |
Ted Kremenek | 17f4da8 | 2009-12-09 02:45:41 +0000 | [diff] [blame] | 92 | Dst.insert(Src); |
Zhongxing Xu | a46e4d9 | 2009-12-02 05:49:12 +0000 | [diff] [blame] | 93 | return; |
Ted Kremenek | 5a5d98b | 2009-07-22 21:43:51 +0000 | [diff] [blame] | 94 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 95 | |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 96 | ExplodedNodeSet Tmp; |
| 97 | ExplodedNodeSet *PrevSet = &Src; |
Ted Kremenek | 9e9595b | 2010-06-25 20:59:31 +0000 | [diff] [blame] | 98 | unsigned checkersEvaluated = 0; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 99 | |
Zhongxing Xu | 68df730 | 2010-08-06 04:20:59 +0000 | [diff] [blame] | 100 | for (CheckersOrdered::iterator I=CO->begin(), E=CO->end(); I!=E; ++I) { |
| 101 | // If all nodes are sunk, bail out early. |
| 102 | if (PrevSet->empty()) |
| 103 | break; |
Ted Kremenek | 17f4da8 | 2009-12-09 02:45:41 +0000 | [diff] [blame] | 104 | ExplodedNodeSet *CurrSet = 0; |
| 105 | if (I+1 == E) |
| 106 | CurrSet = &Dst; |
| 107 | else { |
| 108 | CurrSet = (PrevSet == &Tmp) ? &Src : &Tmp; |
| 109 | CurrSet->clear(); |
Ted Kremenek | b9bbd59 | 2010-02-15 23:02:46 +0000 | [diff] [blame] | 110 | } |
Zhongxing Xu | ec9227f | 2009-10-29 02:09:30 +0000 | [diff] [blame] | 111 | void *tag = I->first; |
| 112 | Checker *checker = I->second; |
Ted Kremenek | 9e9595b | 2010-06-25 20:59:31 +0000 | [diff] [blame] | 113 | bool respondsToCallback = true; |
Ted Kremenek | b9bbd59 | 2010-02-15 23:02:46 +0000 | [diff] [blame] | 114 | |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 115 | for (ExplodedNodeSet::iterator NI = PrevSet->begin(), NE = PrevSet->end(); |
Ted Kremenek | 9e9595b | 2010-06-25 20:59:31 +0000 | [diff] [blame] | 116 | NI != NE; ++NI) { |
| 117 | |
Jordy Rose | 72905cf | 2010-08-04 07:10:57 +0000 | [diff] [blame] | 118 | checker->GR_Visit(*CurrSet, *Builder, *this, S, *NI, tag, |
| 119 | Kind == PreVisitStmtCallback, respondsToCallback); |
Ted Kremenek | 9e9595b | 2010-06-25 20:59:31 +0000 | [diff] [blame] | 120 | |
| 121 | } |
| 122 | |
Ted Kremenek | 5a5d98b | 2009-07-22 21:43:51 +0000 | [diff] [blame] | 123 | PrevSet = CurrSet; |
Ted Kremenek | 9e9595b | 2010-06-25 20:59:31 +0000 | [diff] [blame] | 124 | |
| 125 | if (NewCO.get()) { |
| 126 | ++checkersEvaluated; |
| 127 | if (respondsToCallback) |
| 128 | NewCO->push_back(*I); |
| 129 | } |
Ted Kremenek | 5a5d98b | 2009-07-22 21:43:51 +0000 | [diff] [blame] | 130 | } |
Ted Kremenek | 9e9595b | 2010-06-25 20:59:31 +0000 | [diff] [blame] | 131 | |
| 132 | // If we built NewCO, check if we called all the checkers. This is important |
| 133 | // so that we know that we accurately determined the entire set of checkers |
Ted Kremenek | 9b44eaf | 2010-08-05 15:03:30 +0000 | [diff] [blame] | 134 | // that responds to this callback. Note that 'checkersEvaluated' might |
| 135 | // not be the same as Checkers.size() if one of the Checkers generates |
| 136 | // a sink node. |
| 137 | if (NewCO.get() && checkersEvaluated == Checkers.size()) |
Ted Kremenek | 9e9595b | 2010-06-25 20:59:31 +0000 | [diff] [blame] | 138 | CO_Ref = NewCO.take(); |
Ted Kremenek | 5a5d98b | 2009-07-22 21:43:51 +0000 | [diff] [blame] | 139 | |
| 140 | // Don't autotransition. The CheckerContext objects should do this |
| 141 | // automatically. |
Zhongxing Xu | a46e4d9 | 2009-12-02 05:49:12 +0000 | [diff] [blame] | 142 | } |
| 143 | |
Ted Kremenek | b9bbd59 | 2010-02-15 23:02:46 +0000 | [diff] [blame] | 144 | void GRExprEngine::CheckerEvalNilReceiver(const ObjCMessageExpr *ME, |
Zhongxing Xu | a46e4d9 | 2009-12-02 05:49:12 +0000 | [diff] [blame] | 145 | ExplodedNodeSet &Dst, |
| 146 | const GRState *state, |
| 147 | ExplodedNode *Pred) { |
Ted Kremenek | 9c14953 | 2010-12-01 21:57:22 +0000 | [diff] [blame] | 148 | bool evaluated = false; |
Zhongxing Xu | 78c98fa | 2009-12-09 12:16:07 +0000 | [diff] [blame] | 149 | ExplodedNodeSet DstTmp; |
| 150 | |
Zhongxing Xu | a46e4d9 | 2009-12-02 05:49:12 +0000 | [diff] [blame] | 151 | for (CheckersOrdered::iterator I=Checkers.begin(),E=Checkers.end();I!=E;++I) { |
| 152 | void *tag = I->first; |
| 153 | Checker *checker = I->second; |
| 154 | |
Ted Kremenek | 9c14953 | 2010-12-01 21:57:22 +0000 | [diff] [blame] | 155 | if (checker->GR_evalNilReceiver(DstTmp, *Builder, *this, ME, Pred, state, |
Zhongxing Xu | 78c98fa | 2009-12-09 12:16:07 +0000 | [diff] [blame] | 156 | tag)) { |
Ted Kremenek | 9c14953 | 2010-12-01 21:57:22 +0000 | [diff] [blame] | 157 | evaluated = true; |
Zhongxing Xu | a46e4d9 | 2009-12-02 05:49:12 +0000 | [diff] [blame] | 158 | break; |
Zhongxing Xu | 78c98fa | 2009-12-09 12:16:07 +0000 | [diff] [blame] | 159 | } else |
| 160 | // The checker didn't evaluate the expr. Restore the Dst. |
| 161 | DstTmp.clear(); |
Zhongxing Xu | a46e4d9 | 2009-12-02 05:49:12 +0000 | [diff] [blame] | 162 | } |
Zhongxing Xu | 78c98fa | 2009-12-09 12:16:07 +0000 | [diff] [blame] | 163 | |
Ted Kremenek | 9c14953 | 2010-12-01 21:57:22 +0000 | [diff] [blame] | 164 | if (evaluated) |
Zhongxing Xu | 78c98fa | 2009-12-09 12:16:07 +0000 | [diff] [blame] | 165 | Dst.insert(DstTmp); |
| 166 | else |
| 167 | Dst.insert(Pred); |
Ted Kremenek | 5a5d98b | 2009-07-22 21:43:51 +0000 | [diff] [blame] | 168 | } |
| 169 | |
Zhongxing Xu | 935ef90 | 2009-12-07 09:17:35 +0000 | [diff] [blame] | 170 | // CheckerEvalCall returns true if one of the checkers processed the node. |
| 171 | // This may return void when all call evaluation logic goes to some checker |
| 172 | // in the future. |
Ted Kremenek | b9bbd59 | 2010-02-15 23:02:46 +0000 | [diff] [blame] | 173 | bool GRExprEngine::CheckerEvalCall(const CallExpr *CE, |
| 174 | ExplodedNodeSet &Dst, |
Zhongxing Xu | 935ef90 | 2009-12-07 09:17:35 +0000 | [diff] [blame] | 175 | ExplodedNode *Pred) { |
Ted Kremenek | 9c14953 | 2010-12-01 21:57:22 +0000 | [diff] [blame] | 176 | bool evaluated = false; |
Zhongxing Xu | 78c98fa | 2009-12-09 12:16:07 +0000 | [diff] [blame] | 177 | ExplodedNodeSet DstTmp; |
Zhongxing Xu | 935ef90 | 2009-12-07 09:17:35 +0000 | [diff] [blame] | 178 | |
| 179 | for (CheckersOrdered::iterator I=Checkers.begin(),E=Checkers.end();I!=E;++I) { |
| 180 | void *tag = I->first; |
| 181 | Checker *checker = I->second; |
| 182 | |
Ted Kremenek | 9c14953 | 2010-12-01 21:57:22 +0000 | [diff] [blame] | 183 | if (checker->GR_evalCallExpr(DstTmp, *Builder, *this, CE, Pred, tag)) { |
| 184 | evaluated = true; |
Zhongxing Xu | 935ef90 | 2009-12-07 09:17:35 +0000 | [diff] [blame] | 185 | break; |
Zhongxing Xu | 78c98fa | 2009-12-09 12:16:07 +0000 | [diff] [blame] | 186 | } else |
| 187 | // The checker didn't evaluate the expr. Restore the DstTmp set. |
| 188 | DstTmp.clear(); |
Zhongxing Xu | 935ef90 | 2009-12-07 09:17:35 +0000 | [diff] [blame] | 189 | } |
| 190 | |
Ted Kremenek | 9c14953 | 2010-12-01 21:57:22 +0000 | [diff] [blame] | 191 | if (evaluated) |
Zhongxing Xu | 78c98fa | 2009-12-09 12:16:07 +0000 | [diff] [blame] | 192 | Dst.insert(DstTmp); |
| 193 | else |
| 194 | Dst.insert(Pred); |
| 195 | |
Ted Kremenek | 9c14953 | 2010-12-01 21:57:22 +0000 | [diff] [blame] | 196 | return evaluated; |
Zhongxing Xu | 935ef90 | 2009-12-07 09:17:35 +0000 | [diff] [blame] | 197 | } |
| 198 | |
Ted Kremenek | b9bbd59 | 2010-02-15 23:02:46 +0000 | [diff] [blame] | 199 | // FIXME: This is largely copy-paste from CheckerVisit(). Need to |
Ted Kremenek | b107c4b | 2009-11-04 04:24:16 +0000 | [diff] [blame] | 200 | // unify. |
Ted Kremenek | 79d7304 | 2010-09-02 00:56:20 +0000 | [diff] [blame] | 201 | void GRExprEngine::CheckerVisitBind(const Stmt *StoreE, ExplodedNodeSet &Dst, |
| 202 | ExplodedNodeSet &Src, SVal location, |
| 203 | SVal val, bool isPrevisit) { |
Ted Kremenek | b9bbd59 | 2010-02-15 23:02:46 +0000 | [diff] [blame] | 204 | |
Ted Kremenek | b107c4b | 2009-11-04 04:24:16 +0000 | [diff] [blame] | 205 | if (Checkers.empty()) { |
Ted Kremenek | 17f4da8 | 2009-12-09 02:45:41 +0000 | [diff] [blame] | 206 | Dst.insert(Src); |
Ted Kremenek | b107c4b | 2009-11-04 04:24:16 +0000 | [diff] [blame] | 207 | return; |
| 208 | } |
Ted Kremenek | b9bbd59 | 2010-02-15 23:02:46 +0000 | [diff] [blame] | 209 | |
Ted Kremenek | b107c4b | 2009-11-04 04:24:16 +0000 | [diff] [blame] | 210 | ExplodedNodeSet Tmp; |
| 211 | ExplodedNodeSet *PrevSet = &Src; |
Ted Kremenek | b9bbd59 | 2010-02-15 23:02:46 +0000 | [diff] [blame] | 212 | |
Ted Kremenek | b107c4b | 2009-11-04 04:24:16 +0000 | [diff] [blame] | 213 | for (CheckersOrdered::iterator I=Checkers.begin(),E=Checkers.end(); I!=E; ++I) |
| 214 | { |
Ted Kremenek | 17f4da8 | 2009-12-09 02:45:41 +0000 | [diff] [blame] | 215 | ExplodedNodeSet *CurrSet = 0; |
| 216 | if (I+1 == E) |
| 217 | CurrSet = &Dst; |
| 218 | else { |
| 219 | CurrSet = (PrevSet == &Tmp) ? &Src : &Tmp; |
| 220 | CurrSet->clear(); |
| 221 | } |
Ted Kremenek | 5328751 | 2009-12-18 20:13:39 +0000 | [diff] [blame] | 222 | |
Ted Kremenek | b107c4b | 2009-11-04 04:24:16 +0000 | [diff] [blame] | 223 | void *tag = I->first; |
| 224 | Checker *checker = I->second; |
Ted Kremenek | b9bbd59 | 2010-02-15 23:02:46 +0000 | [diff] [blame] | 225 | |
Ted Kremenek | b107c4b | 2009-11-04 04:24:16 +0000 | [diff] [blame] | 226 | for (ExplodedNodeSet::iterator NI = PrevSet->begin(), NE = PrevSet->end(); |
| 227 | NI != NE; ++NI) |
Ted Kremenek | 79d7304 | 2010-09-02 00:56:20 +0000 | [diff] [blame] | 228 | checker->GR_VisitBind(*CurrSet, *Builder, *this, StoreE, |
Ted Kremenek | 50ecd15 | 2009-11-05 00:42:23 +0000 | [diff] [blame] | 229 | *NI, tag, location, val, isPrevisit); |
Ted Kremenek | b9bbd59 | 2010-02-15 23:02:46 +0000 | [diff] [blame] | 230 | |
Ted Kremenek | b107c4b | 2009-11-04 04:24:16 +0000 | [diff] [blame] | 231 | // Update which NodeSet is the current one. |
| 232 | PrevSet = CurrSet; |
| 233 | } |
Ted Kremenek | b9bbd59 | 2010-02-15 23:02:46 +0000 | [diff] [blame] | 234 | |
Ted Kremenek | b107c4b | 2009-11-04 04:24:16 +0000 | [diff] [blame] | 235 | // Don't autotransition. The CheckerContext objects should do this |
| 236 | // automatically. |
| 237 | } |
Ted Kremenek | 5a5d98b | 2009-07-22 21:43:51 +0000 | [diff] [blame] | 238 | //===----------------------------------------------------------------------===// |
Ted Kremenek | bdb435d | 2008-07-11 18:37:32 +0000 | [diff] [blame] | 239 | // Engine construction and deletion. |
| 240 | //===----------------------------------------------------------------------===// |
| 241 | |
Ted Kremenek | 32c4995 | 2009-11-25 21:51:20 +0000 | [diff] [blame] | 242 | static void RegisterInternalChecks(GRExprEngine &Eng) { |
| 243 | // Register internal "built-in" BugTypes with the BugReporter. These BugTypes |
| 244 | // are different than what probably many checks will do since they don't |
| 245 | // create BugReports on-the-fly but instead wait until GRExprEngine finishes |
| 246 | // analyzing a function. Generation of BugReport objects is done via a call |
| 247 | // to 'FlushReports' from BugReporter. |
| 248 | // The following checks do not need to have their associated BugTypes |
| 249 | // explicitly registered with the BugReporter. If they issue any BugReports, |
| 250 | // their associated BugType will get registered with the BugReporter |
| 251 | // automatically. Note that the check itself is owned by the GRExprEngine |
Ted Kremenek | b9bbd59 | 2010-02-15 23:02:46 +0000 | [diff] [blame] | 252 | // object. |
Ted Kremenek | 40c37e1 | 2010-02-04 00:47:48 +0000 | [diff] [blame] | 253 | RegisterAdjustedReturnValueChecker(Eng); |
Zhongxing Xu | 5126c60 | 2010-06-16 05:45:09 +0000 | [diff] [blame] | 254 | // CallAndMessageChecker should be registered before AttrNonNullChecker, |
| 255 | // where we assume arguments are not undefined. |
Ted Kremenek | 32c4995 | 2009-11-25 21:51:20 +0000 | [diff] [blame] | 256 | RegisterCallAndMessageChecker(Eng); |
Zhongxing Xu | 5126c60 | 2010-06-16 05:45:09 +0000 | [diff] [blame] | 257 | RegisterAttrNonNullChecker(Eng); |
Ted Kremenek | 32c4995 | 2009-11-25 21:51:20 +0000 | [diff] [blame] | 258 | RegisterDereferenceChecker(Eng); |
| 259 | RegisterVLASizeChecker(Eng); |
| 260 | RegisterDivZeroChecker(Eng); |
Ted Kremenek | 32c4995 | 2009-11-25 21:51:20 +0000 | [diff] [blame] | 261 | RegisterReturnUndefChecker(Eng); |
| 262 | RegisterUndefinedArraySubscriptChecker(Eng); |
| 263 | RegisterUndefinedAssignmentChecker(Eng); |
| 264 | RegisterUndefBranchChecker(Eng); |
Ted Kremenek | 94fd0b8 | 2010-02-16 08:33:59 +0000 | [diff] [blame] | 265 | RegisterUndefCapturedBlockVarChecker(Eng); |
Ted Kremenek | 32c4995 | 2009-11-25 21:51:20 +0000 | [diff] [blame] | 266 | RegisterUndefResultChecker(Eng); |
Zhongxing Xu | 9b14683 | 2010-06-09 06:08:24 +0000 | [diff] [blame] | 267 | RegisterStackAddrLeakChecker(Eng); |
Ted Kremenek | 4f6aa77 | 2010-09-10 03:05:40 +0000 | [diff] [blame] | 268 | RegisterObjCAtSyncChecker(Eng); |
Zhongxing Xu | 935ef90 | 2009-12-07 09:17:35 +0000 | [diff] [blame] | 269 | |
| 270 | // This is not a checker yet. |
| 271 | RegisterNoReturnFunctionChecker(Eng); |
Zhongxing Xu | 7c9624b | 2009-12-08 09:07:59 +0000 | [diff] [blame] | 272 | RegisterBuiltinFunctionChecker(Eng); |
Zhongxing Xu | 1ec4e97 | 2009-12-09 12:23:28 +0000 | [diff] [blame] | 273 | RegisterOSAtomicChecker(Eng); |
Ted Kremenek | 381d1bf | 2010-02-25 00:20:35 +0000 | [diff] [blame] | 274 | RegisterUnixAPIChecker(Eng); |
Ted Kremenek | df61b58 | 2010-02-25 05:44:09 +0000 | [diff] [blame] | 275 | RegisterMacOSXAPIChecker(Eng); |
Ted Kremenek | e448ab4 | 2008-05-01 18:33:28 +0000 | [diff] [blame] | 276 | } |
| 277 | |
Ted Kremenek | 32a5808 | 2010-01-05 00:15:18 +0000 | [diff] [blame] | 278 | GRExprEngine::GRExprEngine(AnalysisManager &mgr, GRTransferFuncs *tf) |
Zhongxing Xu | 25e695b | 2009-08-15 03:17:38 +0000 | [diff] [blame] | 279 | : AMgr(mgr), |
Zhongxing Xu | c77a551 | 2010-07-01 07:10:59 +0000 | [diff] [blame] | 280 | CoreEngine(*this), |
Ted Kremenek | 50a6d0c | 2008-04-09 21:41:14 +0000 | [diff] [blame] | 281 | G(CoreEngine.getGraph()), |
Ted Kremenek | 50a6d0c | 2008-04-09 21:41:14 +0000 | [diff] [blame] | 282 | Builder(NULL), |
Zhongxing Xu | c77a551 | 2010-07-01 07:10:59 +0000 | [diff] [blame] | 283 | StateMgr(getContext(), mgr.getStoreManagerCreator(), |
Ted Kremenek | 32a5808 | 2010-01-05 00:15:18 +0000 | [diff] [blame] | 284 | mgr.getConstraintManagerCreator(), G.getAllocator(), |
| 285 | *this), |
Ted Kremenek | 50a6d0c | 2008-04-09 21:41:14 +0000 | [diff] [blame] | 286 | SymMgr(StateMgr.getSymbolManager()), |
Ted Kremenek | c8413fd | 2010-12-02 07:49:45 +0000 | [diff] [blame] | 287 | svalBuilder(StateMgr.getSValBuilder()), |
Ted Kremenek | 0a3ed31 | 2010-12-17 04:44:39 +0000 | [diff] [blame] | 288 | EntryNode(NULL), currentStmt(NULL), |
Zhongxing Xu | a5a4166 | 2008-12-22 08:30:52 +0000 | [diff] [blame] | 289 | NSExceptionII(NULL), NSExceptionInstanceRaiseSelectors(NULL), |
Zhongxing Xu | c77a551 | 2010-07-01 07:10:59 +0000 | [diff] [blame] | 290 | RaiseSel(GetNullarySelector("raise", getContext())), |
Ted Kremenek | 32a5808 | 2010-01-05 00:15:18 +0000 | [diff] [blame] | 291 | BR(mgr, *this), TF(tf) { |
Ted Kremenek | c80135b | 2009-11-25 21:45:48 +0000 | [diff] [blame] | 292 | // Register internal checks. |
Ted Kremenek | 32c4995 | 2009-11-25 21:51:20 +0000 | [diff] [blame] | 293 | RegisterInternalChecks(*this); |
Ted Kremenek | b9bbd59 | 2010-02-15 23:02:46 +0000 | [diff] [blame] | 294 | |
Ted Kremenek | 32a5808 | 2010-01-05 00:15:18 +0000 | [diff] [blame] | 295 | // FIXME: Eventually remove the TF object entirely. |
| 296 | TF->RegisterChecks(*this); |
| 297 | TF->RegisterPrinters(getStateManager().Printers); |
Ted Kremenek | c80135b | 2009-11-25 21:45:48 +0000 | [diff] [blame] | 298 | } |
Ted Kremenek | 50a6d0c | 2008-04-09 21:41:14 +0000 | [diff] [blame] | 299 | |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 300 | GRExprEngine::~GRExprEngine() { |
Ted Kremenek | cf118d4 | 2009-02-04 23:49:09 +0000 | [diff] [blame] | 301 | BR.FlushReports(); |
Ted Kremenek | e448ab4 | 2008-05-01 18:33:28 +0000 | [diff] [blame] | 302 | delete [] NSExceptionInstanceRaiseSelectors; |
Ted Kremenek | 9e9595b | 2010-06-25 20:59:31 +0000 | [diff] [blame] | 303 | |
| 304 | // Delete the set of checkers. |
Ted Kremenek | 094bef5 | 2009-10-30 17:47:32 +0000 | [diff] [blame] | 305 | for (CheckersOrdered::iterator I=Checkers.begin(), E=Checkers.end(); I!=E;++I) |
Zhongxing Xu | ec9227f | 2009-10-29 02:09:30 +0000 | [diff] [blame] | 306 | delete I->second; |
Ted Kremenek | 9e9595b | 2010-06-25 20:59:31 +0000 | [diff] [blame] | 307 | |
| 308 | for (CheckersOrderedCache::iterator I=COCache.begin(), E=COCache.end(); |
| 309 | I!=E;++I) |
| 310 | delete I->second; |
Ted Kremenek | 50a6d0c | 2008-04-09 21:41:14 +0000 | [diff] [blame] | 311 | } |
| 312 | |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 313 | //===----------------------------------------------------------------------===// |
| 314 | // Utility methods. |
| 315 | //===----------------------------------------------------------------------===// |
| 316 | |
Zhongxing Xu | 17fd863 | 2009-08-17 06:19:58 +0000 | [diff] [blame] | 317 | const GRState* GRExprEngine::getInitialState(const LocationContext *InitLoc) { |
| 318 | const GRState *state = StateMgr.getInitialState(InitLoc); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 319 | |
Ted Kremenek | cfcd7fd | 2009-09-09 20:36:12 +0000 | [diff] [blame] | 320 | // Preconditions. |
| 321 | |
Ted Kremenek | 52e5602 | 2009-04-10 00:59:50 +0000 | [diff] [blame] | 322 | // FIXME: It would be nice if we had a more general mechanism to add |
| 323 | // such preconditions. Some day. |
Ted Kremenek | 5974ec5 | 2009-12-17 19:17:27 +0000 | [diff] [blame] | 324 | do { |
Ted Kremenek | b9bbd59 | 2010-02-15 23:02:46 +0000 | [diff] [blame] | 325 | const Decl *D = InitLoc->getDecl(); |
Ted Kremenek | 5974ec5 | 2009-12-17 19:17:27 +0000 | [diff] [blame] | 326 | if (const FunctionDecl *FD = dyn_cast<FunctionDecl>(D)) { |
| 327 | // Precondition: the first argument of 'main' is an integer guaranteed |
| 328 | // to be > 0. |
| 329 | const IdentifierInfo *II = FD->getIdentifier(); |
| 330 | if (!II || !(II->getName() == "main" && FD->getNumParams() > 0)) |
| 331 | break; |
Ted Kremenek | a591bc0 | 2009-06-18 22:57:13 +0000 | [diff] [blame] | 332 | |
Ted Kremenek | 5974ec5 | 2009-12-17 19:17:27 +0000 | [diff] [blame] | 333 | const ParmVarDecl *PD = FD->getParamDecl(0); |
| 334 | QualType T = PD->getType(); |
| 335 | if (!T->isIntegerType()) |
| 336 | break; |
Ted Kremenek | b9bbd59 | 2010-02-15 23:02:46 +0000 | [diff] [blame] | 337 | |
Ted Kremenek | 5974ec5 | 2009-12-17 19:17:27 +0000 | [diff] [blame] | 338 | const MemRegion *R = state->getRegion(PD, InitLoc); |
| 339 | if (!R) |
| 340 | break; |
Ted Kremenek | b9bbd59 | 2010-02-15 23:02:46 +0000 | [diff] [blame] | 341 | |
Ted Kremenek | 1397663 | 2010-02-08 16:18:51 +0000 | [diff] [blame] | 342 | SVal V = state->getSVal(loc::MemRegionVal(R)); |
Ted Kremenek | 9c14953 | 2010-12-01 21:57:22 +0000 | [diff] [blame] | 343 | SVal Constraint_untested = evalBinOp(state, BO_GT, V, |
Ted Kremenek | c8413fd | 2010-12-02 07:49:45 +0000 | [diff] [blame] | 344 | svalBuilder.makeZeroVal(T), |
Ted Kremenek | 5974ec5 | 2009-12-17 19:17:27 +0000 | [diff] [blame] | 345 | getContext().IntTy); |
| 346 | |
| 347 | DefinedOrUnknownSVal *Constraint = |
| 348 | dyn_cast<DefinedOrUnknownSVal>(&Constraint_untested); |
Ted Kremenek | b9bbd59 | 2010-02-15 23:02:46 +0000 | [diff] [blame] | 349 | |
Ted Kremenek | 5974ec5 | 2009-12-17 19:17:27 +0000 | [diff] [blame] | 350 | if (!Constraint) |
| 351 | break; |
Ted Kremenek | b9bbd59 | 2010-02-15 23:02:46 +0000 | [diff] [blame] | 352 | |
Ted Kremenek | 28f47b9 | 2010-12-01 22:16:56 +0000 | [diff] [blame] | 353 | if (const GRState *newState = state->assume(*Constraint, true)) |
Ted Kremenek | 5974ec5 | 2009-12-17 19:17:27 +0000 | [diff] [blame] | 354 | state = newState; |
Ted Kremenek | b9bbd59 | 2010-02-15 23:02:46 +0000 | [diff] [blame] | 355 | |
Ted Kremenek | 5974ec5 | 2009-12-17 19:17:27 +0000 | [diff] [blame] | 356 | break; |
| 357 | } |
| 358 | |
Ted Kremenek | b9bbd59 | 2010-02-15 23:02:46 +0000 | [diff] [blame] | 359 | if (const ObjCMethodDecl *MD = dyn_cast<ObjCMethodDecl>(D)) { |
Ted Kremenek | 5974ec5 | 2009-12-17 19:17:27 +0000 | [diff] [blame] | 360 | // Precondition: 'self' is always non-null upon entry to an Objective-C |
| 361 | // method. |
| 362 | const ImplicitParamDecl *SelfD = MD->getSelfDecl(); |
| 363 | const MemRegion *R = state->getRegion(SelfD, InitLoc); |
Ted Kremenek | 1397663 | 2010-02-08 16:18:51 +0000 | [diff] [blame] | 364 | SVal V = state->getSVal(loc::MemRegionVal(R)); |
Ted Kremenek | b9bbd59 | 2010-02-15 23:02:46 +0000 | [diff] [blame] | 365 | |
Ted Kremenek | 5974ec5 | 2009-12-17 19:17:27 +0000 | [diff] [blame] | 366 | if (const Loc *LV = dyn_cast<Loc>(&V)) { |
| 367 | // Assume that the pointer value in 'self' is non-null. |
Ted Kremenek | 28f47b9 | 2010-12-01 22:16:56 +0000 | [diff] [blame] | 368 | state = state->assume(*LV, true); |
Ted Kremenek | 5974ec5 | 2009-12-17 19:17:27 +0000 | [diff] [blame] | 369 | assert(state && "'self' cannot be null"); |
Ted Kremenek | 5f75f92 | 2009-12-17 01:20:43 +0000 | [diff] [blame] | 370 | } |
Ted Kremenek | 52e5602 | 2009-04-10 00:59:50 +0000 | [diff] [blame] | 371 | } |
Ted Kremenek | 5974ec5 | 2009-12-17 19:17:27 +0000 | [diff] [blame] | 372 | } while (0); |
Ted Kremenek | b9bbd59 | 2010-02-15 23:02:46 +0000 | [diff] [blame] | 373 | |
Ted Kremenek | 52e5602 | 2009-04-10 00:59:50 +0000 | [diff] [blame] | 374 | return state; |
Ted Kremenek | e070a1d | 2008-02-04 21:59:01 +0000 | [diff] [blame] | 375 | } |
| 376 | |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 377 | //===----------------------------------------------------------------------===// |
| 378 | // Top-level transfer function logic (Dispatcher). |
| 379 | //===----------------------------------------------------------------------===// |
| 380 | |
Ted Kremenek | 9c14953 | 2010-12-01 21:57:22 +0000 | [diff] [blame] | 381 | /// evalAssume - Called by ConstraintManager. Used to call checker-specific |
Ted Kremenek | 32a5808 | 2010-01-05 00:15:18 +0000 | [diff] [blame] | 382 | /// logic for handling assumptions on symbolic values. |
| 383 | const GRState *GRExprEngine::ProcessAssume(const GRState *state, SVal cond, |
Ted Kremenek | b9bbd59 | 2010-02-15 23:02:46 +0000 | [diff] [blame] | 384 | bool assumption) { |
Jordy Rose | 72905cf | 2010-08-04 07:10:57 +0000 | [diff] [blame] | 385 | // Determine if we already have a cached 'CheckersOrdered' vector |
| 386 | // specifically tailored for processing assumptions. This |
| 387 | // can reduce the number of checkers actually called. |
| 388 | CheckersOrdered *CO = &Checkers; |
| 389 | llvm::OwningPtr<CheckersOrdered> NewCO; |
Ted Kremenek | 32a5808 | 2010-01-05 00:15:18 +0000 | [diff] [blame] | 390 | |
Jordy Rose | 72905cf | 2010-08-04 07:10:57 +0000 | [diff] [blame] | 391 | CallbackTag K = GetCallbackTag(ProcessAssumeCallback); |
| 392 | CheckersOrdered *& CO_Ref = COCache[K]; |
Ted Kremenek | b9bbd59 | 2010-02-15 23:02:46 +0000 | [diff] [blame] | 393 | |
Jordy Rose | 72905cf | 2010-08-04 07:10:57 +0000 | [diff] [blame] | 394 | if (!CO_Ref) { |
| 395 | // If we have no previously cached CheckersOrdered vector for this |
| 396 | // statement kind, then create one. |
| 397 | NewCO.reset(new CheckersOrdered); |
| 398 | } |
| 399 | else { |
| 400 | // Use the already cached set. |
| 401 | CO = CO_Ref; |
Ted Kremenek | 32a5808 | 2010-01-05 00:15:18 +0000 | [diff] [blame] | 402 | } |
Ted Kremenek | b9bbd59 | 2010-02-15 23:02:46 +0000 | [diff] [blame] | 403 | |
Jordy Rose | 72905cf | 2010-08-04 07:10:57 +0000 | [diff] [blame] | 404 | if (!CO->empty()) { |
| 405 | // Let the checkers have a crack at the assume before the transfer functions |
| 406 | // get their turn. |
Jordy Rose | a205061 | 2010-08-12 04:05:07 +0000 | [diff] [blame] | 407 | for (CheckersOrdered::iterator I = CO->begin(), E = CO->end(); I!=E; ++I) { |
Jordy Rose | 72905cf | 2010-08-04 07:10:57 +0000 | [diff] [blame] | 408 | |
| 409 | // If any checker declares the state infeasible (or if it starts that |
| 410 | // way), bail out. |
| 411 | if (!state) |
| 412 | return NULL; |
| 413 | |
| 414 | Checker *C = I->second; |
| 415 | bool respondsToCallback = true; |
| 416 | |
Ted Kremenek | 9c14953 | 2010-12-01 21:57:22 +0000 | [diff] [blame] | 417 | state = C->evalAssume(state, cond, assumption, &respondsToCallback); |
Jordy Rose | 72905cf | 2010-08-04 07:10:57 +0000 | [diff] [blame] | 418 | |
Ted Kremenek | 28f47b9 | 2010-12-01 22:16:56 +0000 | [diff] [blame] | 419 | // Check if we're building the cache of checkers that care about |
| 420 | // assumptions. |
Jordy Rose | 72905cf | 2010-08-04 07:10:57 +0000 | [diff] [blame] | 421 | if (NewCO.get() && respondsToCallback) |
| 422 | NewCO->push_back(*I); |
| 423 | } |
| 424 | |
| 425 | // If we got through all the checkers, and we built a list of those that |
Ted Kremenek | 28f47b9 | 2010-12-01 22:16:56 +0000 | [diff] [blame] | 426 | // care about assumptions, save it. |
Jordy Rose | 72905cf | 2010-08-04 07:10:57 +0000 | [diff] [blame] | 427 | if (NewCO.get()) |
| 428 | CO_Ref = NewCO.take(); |
| 429 | } |
| 430 | |
| 431 | // If the state is infeasible at this point, bail out. |
Ted Kremenek | 32a5808 | 2010-01-05 00:15:18 +0000 | [diff] [blame] | 432 | if (!state) |
| 433 | return NULL; |
Ted Kremenek | b9bbd59 | 2010-02-15 23:02:46 +0000 | [diff] [blame] | 434 | |
Ted Kremenek | 9c14953 | 2010-12-01 21:57:22 +0000 | [diff] [blame] | 435 | return TF->evalAssume(state, cond, assumption); |
Ted Kremenek | 32a5808 | 2010-01-05 00:15:18 +0000 | [diff] [blame] | 436 | } |
| 437 | |
Jordy Rose | c2b7dfa | 2010-08-14 20:44:32 +0000 | [diff] [blame] | 438 | bool GRExprEngine::WantsRegionChangeUpdate(const GRState* state) { |
| 439 | CallbackTag K = GetCallbackTag(EvalRegionChangesCallback); |
| 440 | CheckersOrdered *CO = COCache[K]; |
| 441 | |
| 442 | if (!CO) |
| 443 | CO = &Checkers; |
| 444 | |
| 445 | for (CheckersOrdered::iterator I = CO->begin(), E = CO->end(); I != E; ++I) { |
| 446 | Checker *C = I->second; |
| 447 | if (C->WantsRegionChangeUpdate(state)) |
| 448 | return true; |
| 449 | } |
| 450 | |
| 451 | return false; |
| 452 | } |
| 453 | |
| 454 | const GRState * |
| 455 | GRExprEngine::ProcessRegionChanges(const GRState *state, |
| 456 | const MemRegion * const *Begin, |
| 457 | const MemRegion * const *End) { |
| 458 | // FIXME: Most of this method is copy-pasted from ProcessAssume. |
| 459 | |
| 460 | // Determine if we already have a cached 'CheckersOrdered' vector |
| 461 | // specifically tailored for processing region changes. This |
| 462 | // can reduce the number of checkers actually called. |
| 463 | CheckersOrdered *CO = &Checkers; |
| 464 | llvm::OwningPtr<CheckersOrdered> NewCO; |
| 465 | |
| 466 | CallbackTag K = GetCallbackTag(EvalRegionChangesCallback); |
| 467 | CheckersOrdered *& CO_Ref = COCache[K]; |
| 468 | |
| 469 | if (!CO_Ref) { |
| 470 | // If we have no previously cached CheckersOrdered vector for this |
| 471 | // callback, then create one. |
| 472 | NewCO.reset(new CheckersOrdered); |
| 473 | } |
| 474 | else { |
| 475 | // Use the already cached set. |
| 476 | CO = CO_Ref; |
| 477 | } |
| 478 | |
| 479 | // If there are no checkers, just return the state as is. |
| 480 | if (CO->empty()) |
| 481 | return state; |
| 482 | |
| 483 | for (CheckersOrdered::iterator I = CO->begin(), E = CO->end(); I != E; ++I) { |
| 484 | // If any checker declares the state infeasible (or if it starts that way), |
| 485 | // bail out. |
| 486 | if (!state) |
| 487 | return NULL; |
| 488 | |
| 489 | Checker *C = I->second; |
| 490 | bool respondsToCallback = true; |
| 491 | |
| 492 | state = C->EvalRegionChanges(state, Begin, End, &respondsToCallback); |
| 493 | |
| 494 | // See if we're building a cache of checkers that care about region changes. |
| 495 | if (NewCO.get() && respondsToCallback) |
| 496 | NewCO->push_back(*I); |
| 497 | } |
| 498 | |
| 499 | // If we got through all the checkers, and we built a list of those that |
| 500 | // care about region changes, save it. |
| 501 | if (NewCO.get()) |
| 502 | CO_Ref = NewCO.take(); |
| 503 | |
| 504 | return state; |
| 505 | } |
| 506 | |
Ted Kremenek | ccc263b | 2010-06-23 22:08:00 +0000 | [diff] [blame] | 507 | void GRExprEngine::ProcessEndWorklist(bool hasWorkRemaining) { |
| 508 | for (CheckersOrdered::iterator I = Checkers.begin(), E = Checkers.end(); |
| 509 | I != E; ++I) { |
Tom Care | bc42c53 | 2010-08-03 01:55:07 +0000 | [diff] [blame] | 510 | I->second->VisitEndAnalysis(G, BR, *this); |
Ted Kremenek | ccc263b | 2010-06-23 22:08:00 +0000 | [diff] [blame] | 511 | } |
| 512 | } |
| 513 | |
Zhongxing Xu | 9c6cd67 | 2010-11-15 08:48:43 +0000 | [diff] [blame] | 514 | void GRExprEngine::ProcessElement(const CFGElement E, |
| 515 | GRStmtNodeBuilder& builder) { |
| 516 | switch (E.getKind()) { |
| 517 | case CFGElement::Statement: |
Zhongxing Xu | 9c6cd67 | 2010-11-15 08:48:43 +0000 | [diff] [blame] | 518 | ProcessStmt(E.getAs<CFGStmt>(), builder); |
| 519 | break; |
| 520 | case CFGElement::Initializer: |
| 521 | ProcessInitializer(E.getAs<CFGInitializer>(), builder); |
| 522 | break; |
| 523 | case CFGElement::ImplicitDtor: |
| 524 | ProcessImplicitDtor(E.getAs<CFGImplicitDtor>(), builder); |
| 525 | break; |
| 526 | default: |
| 527 | // Suppress compiler warning. |
| 528 | llvm_unreachable("Unexpected CFGElement kind."); |
| 529 | } |
| 530 | } |
| 531 | |
| 532 | void GRExprEngine::ProcessStmt(const CFGStmt S, GRStmtNodeBuilder& builder) { |
Ted Kremenek | 0a3ed31 | 2010-12-17 04:44:39 +0000 | [diff] [blame] | 533 | currentStmt = S.getStmt(); |
Ted Kremenek | 0bed8a1 | 2009-03-11 02:41:36 +0000 | [diff] [blame] | 534 | PrettyStackTraceLoc CrashInfo(getContext().getSourceManager(), |
Ted Kremenek | 0a3ed31 | 2010-12-17 04:44:39 +0000 | [diff] [blame] | 535 | currentStmt->getLocStart(), |
Ted Kremenek | 0bed8a1 | 2009-03-11 02:41:36 +0000 | [diff] [blame] | 536 | "Error evaluating statement"); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 537 | |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 538 | Builder = &builder; |
Zhongxing Xu | 25108a5 | 2010-02-26 02:38:09 +0000 | [diff] [blame] | 539 | EntryNode = builder.getBasePredecessor(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 540 | |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 541 | // Create the cleaned state. |
Jordy Rose | bd533aa | 2010-08-14 20:18:45 +0000 | [diff] [blame] | 542 | const LocationContext *LC = EntryNode->getLocationContext(); |
Ted Kremenek | 0a3ed31 | 2010-12-17 04:44:39 +0000 | [diff] [blame] | 543 | SymbolReaper SymReaper(LC, currentStmt, SymMgr); |
Zhongxing Xu | c179a7f | 2010-03-05 04:45:36 +0000 | [diff] [blame] | 544 | |
Jordy Rose | bd533aa | 2010-08-14 20:18:45 +0000 | [diff] [blame] | 545 | if (AMgr.shouldPurgeDead()) { |
| 546 | const GRState *St = EntryNode->getState(); |
Zhongxing Xu | c179a7f | 2010-03-05 04:45:36 +0000 | [diff] [blame] | 547 | |
Jordy Rose | bd533aa | 2010-08-14 20:18:45 +0000 | [diff] [blame] | 548 | for (CheckersOrdered::iterator I = Checkers.begin(), E = Checkers.end(); |
| 549 | I != E; ++I) { |
| 550 | Checker *checker = I->second; |
| 551 | checker->MarkLiveSymbols(St, SymReaper); |
| 552 | } |
| 553 | |
| 554 | const StackFrameContext *SFC = LC->getCurrentStackFrame(); |
| 555 | CleanedState = StateMgr.RemoveDeadBindings(St, SFC, SymReaper); |
| 556 | } else { |
| 557 | CleanedState = EntryNode->getState(); |
| 558 | } |
Ted Kremenek | 241677a | 2009-01-21 22:26:05 +0000 | [diff] [blame] | 559 | |
Ted Kremenek | 77d7ef8 | 2008-04-24 18:31:42 +0000 | [diff] [blame] | 560 | // Process any special transfer function for dead symbols. |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 561 | ExplodedNodeSet Tmp; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 562 | |
Ted Kremenek | 241677a | 2009-01-21 22:26:05 +0000 | [diff] [blame] | 563 | if (!SymReaper.hasDeadSymbols()) |
Ted Kremenek | 846d4e9 | 2008-04-24 23:35:58 +0000 | [diff] [blame] | 564 | Tmp.Add(EntryNode); |
Ted Kremenek | 77d7ef8 | 2008-04-24 18:31:42 +0000 | [diff] [blame] | 565 | else { |
| 566 | SaveAndRestore<bool> OldSink(Builder->BuildSinks); |
Ted Kremenek | 846d4e9 | 2008-04-24 23:35:58 +0000 | [diff] [blame] | 567 | SaveOr OldHasGen(Builder->HasGeneratedNode); |
| 568 | |
Ted Kremenek | 331b0ac | 2008-06-18 05:34:07 +0000 | [diff] [blame] | 569 | SaveAndRestore<bool> OldPurgeDeadSymbols(Builder->PurgingDeadSymbols); |
| 570 | Builder->PurgingDeadSymbols = true; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 571 | |
Zhongxing Xu | 9400613 | 2009-11-13 06:53:04 +0000 | [diff] [blame] | 572 | // FIXME: This should soon be removed. |
| 573 | ExplodedNodeSet Tmp2; |
Ted Kremenek | 9c14953 | 2010-12-01 21:57:22 +0000 | [diff] [blame] | 574 | getTF().evalDeadSymbols(Tmp2, *this, *Builder, EntryNode, |
Ted Kremenek | 241677a | 2009-01-21 22:26:05 +0000 | [diff] [blame] | 575 | CleanedState, SymReaper); |
Ted Kremenek | 846d4e9 | 2008-04-24 23:35:58 +0000 | [diff] [blame] | 576 | |
Zhongxing Xu | 9400613 | 2009-11-13 06:53:04 +0000 | [diff] [blame] | 577 | if (Checkers.empty()) |
Zhongxing Xu | 7fbb1ba | 2009-12-14 02:13:39 +0000 | [diff] [blame] | 578 | Tmp.insert(Tmp2); |
Zhongxing Xu | 9400613 | 2009-11-13 06:53:04 +0000 | [diff] [blame] | 579 | else { |
| 580 | ExplodedNodeSet Tmp3; |
| 581 | ExplodedNodeSet *SrcSet = &Tmp2; |
| 582 | for (CheckersOrdered::iterator I = Checkers.begin(), E = Checkers.end(); |
| 583 | I != E; ++I) { |
Ted Kremenek | 17f4da8 | 2009-12-09 02:45:41 +0000 | [diff] [blame] | 584 | ExplodedNodeSet *DstSet = 0; |
| 585 | if (I+1 == E) |
| 586 | DstSet = &Tmp; |
| 587 | else { |
| 588 | DstSet = (SrcSet == &Tmp2) ? &Tmp3 : &Tmp2; |
| 589 | DstSet->clear(); |
| 590 | } |
| 591 | |
Zhongxing Xu | 9400613 | 2009-11-13 06:53:04 +0000 | [diff] [blame] | 592 | void *tag = I->first; |
| 593 | Checker *checker = I->second; |
| 594 | for (ExplodedNodeSet::iterator NI = SrcSet->begin(), NE = SrcSet->end(); |
| 595 | NI != NE; ++NI) |
Ted Kremenek | 0a3ed31 | 2010-12-17 04:44:39 +0000 | [diff] [blame] | 596 | checker->GR_evalDeadSymbols(*DstSet, *Builder, *this, currentStmt, |
Ted Kremenek | 852274d | 2009-12-16 03:18:58 +0000 | [diff] [blame] | 597 | *NI, SymReaper, tag); |
Zhongxing Xu | 9400613 | 2009-11-13 06:53:04 +0000 | [diff] [blame] | 598 | SrcSet = DstSet; |
| 599 | } |
| 600 | } |
| 601 | |
Ted Kremenek | 846d4e9 | 2008-04-24 23:35:58 +0000 | [diff] [blame] | 602 | if (!Builder->BuildSinks && !Builder->HasGeneratedNode) |
| 603 | Tmp.Add(EntryNode); |
Ted Kremenek | 77d7ef8 | 2008-04-24 18:31:42 +0000 | [diff] [blame] | 604 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 605 | |
Ted Kremenek | 846d4e9 | 2008-04-24 23:35:58 +0000 | [diff] [blame] | 606 | bool HasAutoGenerated = false; |
| 607 | |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 608 | for (ExplodedNodeSet::iterator I=Tmp.begin(), E=Tmp.end(); I!=E; ++I) { |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 609 | ExplodedNodeSet Dst; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 610 | |
| 611 | // Set the cleaned state. |
Ted Kremenek | 846d4e9 | 2008-04-24 23:35:58 +0000 | [diff] [blame] | 612 | Builder->SetCleanedState(*I == EntryNode ? CleanedState : GetState(*I)); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 613 | |
| 614 | // Visit the statement. |
Ted Kremenek | 0a3ed31 | 2010-12-17 04:44:39 +0000 | [diff] [blame] | 615 | Visit(currentStmt, *I, Dst); |
Ted Kremenek | 846d4e9 | 2008-04-24 23:35:58 +0000 | [diff] [blame] | 616 | |
| 617 | // Do we need to auto-generate a node? We only need to do this to generate |
| 618 | // a node with a "cleaned" state; GRCoreEngine will actually handle |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 619 | // auto-transitions for other cases. |
Ted Kremenek | 846d4e9 | 2008-04-24 23:35:58 +0000 | [diff] [blame] | 620 | if (Dst.size() == 1 && *Dst.begin() == EntryNode |
| 621 | && !Builder->HasGeneratedNode && !HasAutoGenerated) { |
| 622 | HasAutoGenerated = true; |
Ted Kremenek | 0a3ed31 | 2010-12-17 04:44:39 +0000 | [diff] [blame] | 623 | builder.generateNode(currentStmt, GetState(EntryNode), *I); |
Ted Kremenek | 846d4e9 | 2008-04-24 23:35:58 +0000 | [diff] [blame] | 624 | } |
Ted Kremenek | 77d7ef8 | 2008-04-24 18:31:42 +0000 | [diff] [blame] | 625 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 626 | |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 627 | // NULL out these variables to cleanup. |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 628 | CleanedState = NULL; |
Ted Kremenek | 846d4e9 | 2008-04-24 23:35:58 +0000 | [diff] [blame] | 629 | EntryNode = NULL; |
Ted Kremenek | df7533b | 2008-07-17 21:27:31 +0000 | [diff] [blame] | 630 | |
Ted Kremenek | 0a3ed31 | 2010-12-17 04:44:39 +0000 | [diff] [blame] | 631 | currentStmt = 0; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 632 | |
Ted Kremenek | 846d4e9 | 2008-04-24 23:35:58 +0000 | [diff] [blame] | 633 | Builder = NULL; |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 634 | } |
| 635 | |
Zhongxing Xu | 9dc84c9 | 2010-11-16 07:52:17 +0000 | [diff] [blame] | 636 | void GRExprEngine::ProcessInitializer(const CFGInitializer Init, |
Zhongxing Xu | 9c6cd67 | 2010-11-15 08:48:43 +0000 | [diff] [blame] | 637 | GRStmtNodeBuilder &builder) { |
Ted Kremenek | 0a3ed31 | 2010-12-17 04:44:39 +0000 | [diff] [blame] | 638 | // We don't set EntryNode and currentStmt. And we don't clean up state. |
Zhongxing Xu | 9dc84c9 | 2010-11-16 07:52:17 +0000 | [diff] [blame] | 639 | const CXXBaseOrMemberInitializer *BMI = Init.getInitializer(); |
| 640 | |
| 641 | ExplodedNode *Pred = builder.getBasePredecessor(); |
| 642 | const LocationContext *LC = Pred->getLocationContext(); |
| 643 | |
Francois Pichet | 00eb3f9 | 2010-12-04 09:14:42 +0000 | [diff] [blame] | 644 | if (BMI->isAnyMemberInitializer()) { |
Zhongxing Xu | 9dc84c9 | 2010-11-16 07:52:17 +0000 | [diff] [blame] | 645 | ExplodedNodeSet Dst; |
| 646 | |
| 647 | // Evaluate the initializer. |
| 648 | Visit(BMI->getInit(), Pred, Dst); |
| 649 | |
| 650 | for (ExplodedNodeSet::iterator I = Dst.begin(), E = Dst.end(); I != E; ++I){ |
| 651 | ExplodedNode *Pred = *I; |
| 652 | const GRState *state = Pred->getState(); |
| 653 | |
Francois Pichet | 00eb3f9 | 2010-12-04 09:14:42 +0000 | [diff] [blame] | 654 | const FieldDecl *FD = BMI->getAnyMember(); |
Zhongxing Xu | 9dc84c9 | 2010-11-16 07:52:17 +0000 | [diff] [blame] | 655 | const RecordDecl *RD = FD->getParent(); |
| 656 | const CXXThisRegion *ThisR = getCXXThisRegion(cast<CXXRecordDecl>(RD), |
| 657 | cast<StackFrameContext>(LC)); |
| 658 | |
| 659 | SVal ThisV = state->getSVal(ThisR); |
| 660 | SVal FieldLoc = state->getLValue(FD, ThisV); |
| 661 | SVal InitVal = state->getSVal(BMI->getInit()); |
| 662 | state = state->bindLoc(FieldLoc, InitVal); |
| 663 | |
| 664 | // Use a custom node building process. |
| 665 | PostInitializer PP(BMI, LC); |
| 666 | // Builder automatically add the generated node to the deferred set, |
| 667 | // which are processed in the builder's dtor. |
| 668 | builder.generateNode(PP, state, Pred); |
| 669 | } |
| 670 | } |
Zhongxing Xu | 9c6cd67 | 2010-11-15 08:48:43 +0000 | [diff] [blame] | 671 | } |
| 672 | |
| 673 | void GRExprEngine::ProcessImplicitDtor(const CFGImplicitDtor D, |
| 674 | GRStmtNodeBuilder &builder) { |
Zhongxing Xu | b13453b | 2010-11-20 06:53:12 +0000 | [diff] [blame] | 675 | Builder = &builder; |
| 676 | |
Zhongxing Xu | 4ffcb99 | 2010-11-17 09:16:19 +0000 | [diff] [blame] | 677 | switch (D.getDtorKind()) { |
| 678 | case CFGElement::AutomaticObjectDtor: |
| 679 | ProcessAutomaticObjDtor(cast<CFGAutomaticObjDtor>(D), builder); |
| 680 | break; |
| 681 | case CFGElement::BaseDtor: |
| 682 | ProcessBaseDtor(cast<CFGBaseDtor>(D), builder); |
| 683 | break; |
| 684 | case CFGElement::MemberDtor: |
| 685 | ProcessMemberDtor(cast<CFGMemberDtor>(D), builder); |
| 686 | break; |
| 687 | case CFGElement::TemporaryDtor: |
| 688 | ProcessTemporaryDtor(cast<CFGTemporaryDtor>(D), builder); |
| 689 | break; |
| 690 | default: |
| 691 | llvm_unreachable("Unexpected dtor kind."); |
| 692 | } |
| 693 | } |
| 694 | |
Zhongxing Xu | 2210490 | 2010-11-25 06:35:14 +0000 | [diff] [blame] | 695 | void GRExprEngine::ProcessAutomaticObjDtor(const CFGAutomaticObjDtor dtor, |
Zhongxing Xu | 4ffcb99 | 2010-11-17 09:16:19 +0000 | [diff] [blame] | 696 | GRStmtNodeBuilder &builder) { |
Zhongxing Xu | 2210490 | 2010-11-25 06:35:14 +0000 | [diff] [blame] | 697 | ExplodedNode *pred = builder.getBasePredecessor(); |
| 698 | const GRState *state = pred->getState(); |
| 699 | const VarDecl *varDecl = dtor.getVarDecl(); |
Zhongxing Xu | b13453b | 2010-11-20 06:53:12 +0000 | [diff] [blame] | 700 | |
Zhongxing Xu | 2210490 | 2010-11-25 06:35:14 +0000 | [diff] [blame] | 701 | QualType varType = varDecl->getType(); |
Zhongxing Xu | b13453b | 2010-11-20 06:53:12 +0000 | [diff] [blame] | 702 | |
Zhongxing Xu | 2210490 | 2010-11-25 06:35:14 +0000 | [diff] [blame] | 703 | if (const ReferenceType *refType = varType->getAs<ReferenceType>()) |
| 704 | varType = refType->getPointeeType(); |
| 705 | |
| 706 | const CXXRecordDecl *recordDecl = varType->getAsCXXRecordDecl(); |
| 707 | assert(recordDecl && "get CXXRecordDecl fail"); |
| 708 | const CXXDestructorDecl *dtorDecl = recordDecl->getDestructor(); |
| 709 | |
| 710 | Loc dest = state->getLValue(varDecl, pred->getLocationContext()); |
| 711 | |
| 712 | ExplodedNodeSet dstSet; |
| 713 | VisitCXXDestructor(dtorDecl, cast<loc::MemRegionVal>(dest).getRegion(), |
| 714 | dtor.getTriggerStmt(), pred, dstSet); |
Zhongxing Xu | 4ffcb99 | 2010-11-17 09:16:19 +0000 | [diff] [blame] | 715 | } |
| 716 | |
| 717 | void GRExprEngine::ProcessBaseDtor(const CFGBaseDtor D, |
| 718 | GRStmtNodeBuilder &builder) { |
| 719 | } |
| 720 | |
| 721 | void GRExprEngine::ProcessMemberDtor(const CFGMemberDtor D, |
| 722 | GRStmtNodeBuilder &builder) { |
| 723 | } |
| 724 | |
| 725 | void GRExprEngine::ProcessTemporaryDtor(const CFGTemporaryDtor D, |
| 726 | GRStmtNodeBuilder &builder) { |
Zhongxing Xu | 9c6cd67 | 2010-11-15 08:48:43 +0000 | [diff] [blame] | 727 | } |
| 728 | |
Zhongxing Xu | 03509ae | 2010-07-20 06:22:24 +0000 | [diff] [blame] | 729 | void GRExprEngine::Visit(const Stmt* S, ExplodedNode* Pred, |
| 730 | ExplodedNodeSet& Dst) { |
Ted Kremenek | 0bed8a1 | 2009-03-11 02:41:36 +0000 | [diff] [blame] | 731 | PrettyStackTraceLoc CrashInfo(getContext().getSourceManager(), |
| 732 | S->getLocStart(), |
| 733 | "Error evaluating statement"); |
| 734 | |
John McCall | f6a1648 | 2010-12-04 03:47:34 +0000 | [diff] [blame] | 735 | // Expressions to ignore. |
| 736 | if (const Expr *Ex = dyn_cast<Expr>(S)) |
Ted Kremenek | 892697d | 2010-12-16 07:46:53 +0000 | [diff] [blame] | 737 | S = Ex->IgnoreParens(); |
John McCall | f6a1648 | 2010-12-04 03:47:34 +0000 | [diff] [blame] | 738 | |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 739 | // FIXME: add metadata to the CFG so that we can disable |
| 740 | // this check when we KNOW that there is no block-level subexpression. |
| 741 | // The motivation is that this check requires a hashtable lookup. |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 742 | |
Ted Kremenek | 0a3ed31 | 2010-12-17 04:44:39 +0000 | [diff] [blame] | 743 | if (S != currentStmt && Pred->getLocationContext()->getCFG()->isBlkExpr(S)) { |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 744 | Dst.Add(Pred); |
| 745 | return; |
| 746 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 747 | |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 748 | switch (S->getStmtClass()) { |
Ted Kremenek | c768a0c | 2009-12-15 01:38:04 +0000 | [diff] [blame] | 749 | // C++ stuff we don't support yet. |
Ted Kremenek | c768a0c | 2009-12-15 01:38:04 +0000 | [diff] [blame] | 750 | case Stmt::CXXBindTemporaryExprClass: |
Ted Kremenek | c768a0c | 2009-12-15 01:38:04 +0000 | [diff] [blame] | 751 | case Stmt::CXXCatchStmtClass: |
Ted Kremenek | 1b49d76 | 2010-04-15 17:33:31 +0000 | [diff] [blame] | 752 | case Stmt::CXXDefaultArgExprClass: |
Ted Kremenek | 1b49d76 | 2010-04-15 17:33:31 +0000 | [diff] [blame] | 753 | case Stmt::CXXDependentScopeMemberExprClass: |
John McCall | 4765fa0 | 2010-12-06 08:20:24 +0000 | [diff] [blame] | 754 | case Stmt::ExprWithCleanupsClass: |
Ted Kremenek | 1b49d76 | 2010-04-15 17:33:31 +0000 | [diff] [blame] | 755 | case Stmt::CXXNullPtrLiteralExprClass: |
| 756 | case Stmt::CXXPseudoDestructorExprClass: |
| 757 | case Stmt::CXXTemporaryObjectExprClass: |
| 758 | case Stmt::CXXThrowExprClass: |
| 759 | case Stmt::CXXTryStmtClass: |
| 760 | case Stmt::CXXTypeidExprClass: |
Francois Pichet | 9be8840 | 2010-09-08 23:47:05 +0000 | [diff] [blame] | 761 | case Stmt::CXXUuidofExprClass: |
Ted Kremenek | 1b49d76 | 2010-04-15 17:33:31 +0000 | [diff] [blame] | 762 | case Stmt::CXXUnresolvedConstructExprClass: |
Douglas Gregor | ed8abf1 | 2010-07-08 06:14:04 +0000 | [diff] [blame] | 763 | case Stmt::CXXScalarValueInitExprClass: |
Ted Kremenek | 1b49d76 | 2010-04-15 17:33:31 +0000 | [diff] [blame] | 764 | case Stmt::DependentScopeDeclRefExprClass: |
| 765 | case Stmt::UnaryTypeTraitExprClass: |
Francois Pichet | 6ad6f28 | 2010-12-07 00:08:36 +0000 | [diff] [blame] | 766 | case Stmt::BinaryTypeTraitExprClass: |
Ted Kremenek | 1b49d76 | 2010-04-15 17:33:31 +0000 | [diff] [blame] | 767 | case Stmt::UnresolvedLookupExprClass: |
| 768 | case Stmt::UnresolvedMemberExprClass: |
Sebastian Redl | 6b219d0 | 2010-09-10 20:55:54 +0000 | [diff] [blame] | 769 | case Stmt::CXXNoexceptExprClass: |
Ted Kremenek | 1b49d76 | 2010-04-15 17:33:31 +0000 | [diff] [blame] | 770 | { |
Ted Kremenek | c768a0c | 2009-12-15 01:38:04 +0000 | [diff] [blame] | 771 | SaveAndRestore<bool> OldSink(Builder->BuildSinks); |
| 772 | Builder->BuildSinks = true; |
| 773 | MakeNode(Dst, S, Pred, GetState(Pred)); |
| 774 | break; |
| 775 | } |
John McCall | f6a1648 | 2010-12-04 03:47:34 +0000 | [diff] [blame] | 776 | |
| 777 | case Stmt::ParenExprClass: |
| 778 | llvm_unreachable("ParenExprs already handled."); |
Ted Kremenek | 1b49d76 | 2010-04-15 17:33:31 +0000 | [diff] [blame] | 779 | // Cases that should never be evaluated simply because they shouldn't |
| 780 | // appear in the CFG. |
| 781 | case Stmt::BreakStmtClass: |
| 782 | case Stmt::CaseStmtClass: |
| 783 | case Stmt::CompoundStmtClass: |
| 784 | case Stmt::ContinueStmtClass: |
| 785 | case Stmt::DefaultStmtClass: |
| 786 | case Stmt::DoStmtClass: |
| 787 | case Stmt::GotoStmtClass: |
| 788 | case Stmt::IndirectGotoStmtClass: |
| 789 | case Stmt::LabelStmtClass: |
| 790 | case Stmt::NoStmtClass: |
| 791 | case Stmt::NullStmtClass: |
| 792 | case Stmt::SwitchCaseClass: |
John McCall | 7cd7d1a | 2010-11-15 23:31:06 +0000 | [diff] [blame] | 793 | case Stmt::OpaqueValueExprClass: |
Ted Kremenek | 1b49d76 | 2010-04-15 17:33:31 +0000 | [diff] [blame] | 794 | llvm_unreachable("Stmt should not be in analyzer evaluation loop"); |
| 795 | break; |
| 796 | |
Ted Kremenek | 8ad9cbc | 2010-06-22 19:05:10 +0000 | [diff] [blame] | 797 | case Stmt::GNUNullExprClass: { |
Ted Kremenek | c8413fd | 2010-12-02 07:49:45 +0000 | [diff] [blame] | 798 | MakeNode(Dst, S, Pred, GetState(Pred)->BindExpr(S, svalBuilder.makeNull())); |
Ted Kremenek | 8ad9cbc | 2010-06-22 19:05:10 +0000 | [diff] [blame] | 799 | break; |
| 800 | } |
| 801 | |
Ted Kremenek | 4beaa9f | 2010-09-10 03:05:33 +0000 | [diff] [blame] | 802 | case Stmt::ObjCAtSynchronizedStmtClass: |
| 803 | VisitObjCAtSynchronizedStmt(cast<ObjCAtSynchronizedStmt>(S), Pred, Dst); |
| 804 | break; |
| 805 | |
Ted Kremenek | 1b49d76 | 2010-04-15 17:33:31 +0000 | [diff] [blame] | 806 | // Cases not handled yet; but will handle some day. |
| 807 | case Stmt::DesignatedInitExprClass: |
| 808 | case Stmt::ExtVectorElementExprClass: |
Ted Kremenek | 1b49d76 | 2010-04-15 17:33:31 +0000 | [diff] [blame] | 809 | case Stmt::ImaginaryLiteralClass: |
| 810 | case Stmt::ImplicitValueInitExprClass: |
| 811 | case Stmt::ObjCAtCatchStmtClass: |
| 812 | case Stmt::ObjCAtFinallyStmtClass: |
Ted Kremenek | 1b49d76 | 2010-04-15 17:33:31 +0000 | [diff] [blame] | 813 | case Stmt::ObjCAtTryStmtClass: |
| 814 | case Stmt::ObjCEncodeExprClass: |
Ted Kremenek | 1b49d76 | 2010-04-15 17:33:31 +0000 | [diff] [blame] | 815 | case Stmt::ObjCIsaExprClass: |
| 816 | case Stmt::ObjCPropertyRefExprClass: |
| 817 | case Stmt::ObjCProtocolExprClass: |
| 818 | case Stmt::ObjCSelectorExprClass: |
| 819 | case Stmt::ObjCStringLiteralClass: |
Ted Kremenek | 1b49d76 | 2010-04-15 17:33:31 +0000 | [diff] [blame] | 820 | case Stmt::ParenListExprClass: |
| 821 | case Stmt::PredefinedExprClass: |
| 822 | case Stmt::ShuffleVectorExprClass: |
Ted Kremenek | 1b49d76 | 2010-04-15 17:33:31 +0000 | [diff] [blame] | 823 | case Stmt::VAArgExprClass: |
| 824 | // Fall through. |
| 825 | |
| 826 | // Cases we intentionally don't evaluate, since they don't need |
| 827 | // to be explicitly evaluated. |
Zhongxing Xu | bc9ad74 | 2010-04-13 13:15:19 +0000 | [diff] [blame] | 828 | case Stmt::AddrLabelExprClass: |
| 829 | case Stmt::IntegerLiteralClass: |
| 830 | case Stmt::CharacterLiteralClass: |
Zhongxing Xu | 477323d | 2010-04-14 06:29:29 +0000 | [diff] [blame] | 831 | case Stmt::CXXBoolLiteralExprClass: |
Zhongxing Xu | bc9ad74 | 2010-04-13 13:15:19 +0000 | [diff] [blame] | 832 | case Stmt::FloatingLiteralClass: |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 833 | Dst.Add(Pred); // No-op. Simply propagate the current state unchanged. |
| 834 | break; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 835 | |
Ted Kremenek | 540cbe2 | 2008-04-22 04:56:29 +0000 | [diff] [blame] | 836 | case Stmt::ArraySubscriptExprClass: |
Ted Kremenek | 892697d | 2010-12-16 07:46:53 +0000 | [diff] [blame] | 837 | VisitLvalArraySubscriptExpr(cast<ArraySubscriptExpr>(S), Pred, Dst); |
Ted Kremenek | 540cbe2 | 2008-04-22 04:56:29 +0000 | [diff] [blame] | 838 | break; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 839 | |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 840 | case Stmt::AsmStmtClass: |
| 841 | VisitAsmStmt(cast<AsmStmt>(S), Pred, Dst); |
| 842 | break; |
Ted Kremenek | b9bbd59 | 2010-02-15 23:02:46 +0000 | [diff] [blame] | 843 | |
Ted Kremenek | 892697d | 2010-12-16 07:46:53 +0000 | [diff] [blame] | 844 | case Stmt::BlockDeclRefExprClass: { |
| 845 | const BlockDeclRefExpr *BE = cast<BlockDeclRefExpr>(S); |
| 846 | VisitCommonDeclRefExpr(BE, BE->getDecl(), Pred, Dst); |
Ted Kremenek | 67d1287 | 2009-12-07 22:05:27 +0000 | [diff] [blame] | 847 | break; |
Ted Kremenek | 892697d | 2010-12-16 07:46:53 +0000 | [diff] [blame] | 848 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 849 | |
Ted Kremenek | c95ad9f | 2009-11-25 01:33:13 +0000 | [diff] [blame] | 850 | case Stmt::BlockExprClass: |
| 851 | VisitBlockExpr(cast<BlockExpr>(S), Pred, Dst); |
| 852 | break; |
| 853 | |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 854 | case Stmt::BinaryOperatorClass: { |
Zhongxing Xu | 03509ae | 2010-07-20 06:22:24 +0000 | [diff] [blame] | 855 | const BinaryOperator* B = cast<BinaryOperator>(S); |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 856 | if (B->isLogicalOp()) { |
| 857 | VisitLogicalExpr(B, Pred, Dst); |
| 858 | break; |
| 859 | } |
John McCall | 2de56d1 | 2010-08-25 11:45:40 +0000 | [diff] [blame] | 860 | else if (B->getOpcode() == BO_Comma) { |
Ted Kremenek | a8538d9 | 2009-02-13 01:45:31 +0000 | [diff] [blame] | 861 | const GRState* state = GetState(Pred); |
Ted Kremenek | 1397663 | 2010-02-08 16:18:51 +0000 | [diff] [blame] | 862 | MakeNode(Dst, B, Pred, state->BindExpr(B, state->getSVal(B->getRHS()))); |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 863 | break; |
| 864 | } |
Ted Kremenek | 06fb99f | 2008-11-14 19:47:18 +0000 | [diff] [blame] | 865 | |
Ted Kremenek | b9bbd59 | 2010-02-15 23:02:46 +0000 | [diff] [blame] | 866 | if (AMgr.shouldEagerlyAssume() && |
Zhongxing Xu | bb14121 | 2009-12-16 11:27:52 +0000 | [diff] [blame] | 867 | (B->isRelationalOp() || B->isEqualityOp())) { |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 868 | ExplodedNodeSet Tmp; |
Ted Kremenek | 892697d | 2010-12-16 07:46:53 +0000 | [diff] [blame] | 869 | VisitBinaryOperator(cast<BinaryOperator>(S), Pred, Tmp); |
Ted Kremenek | 9c14953 | 2010-12-01 21:57:22 +0000 | [diff] [blame] | 870 | evalEagerlyAssume(Dst, Tmp, cast<Expr>(S)); |
Ted Kremenek | 48af2a9 | 2009-02-25 22:32:02 +0000 | [diff] [blame] | 871 | } |
| 872 | else |
Ted Kremenek | 892697d | 2010-12-16 07:46:53 +0000 | [diff] [blame] | 873 | VisitBinaryOperator(cast<BinaryOperator>(S), Pred, Dst); |
Ted Kremenek | 48af2a9 | 2009-02-25 22:32:02 +0000 | [diff] [blame] | 874 | |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 875 | break; |
| 876 | } |
Ted Kremenek | 06fb99f | 2008-11-14 19:47:18 +0000 | [diff] [blame] | 877 | |
Marcin Swiderski | 6a02b60 | 2010-11-18 06:29:23 +0000 | [diff] [blame] | 878 | case Stmt::CallExprClass: { |
Zhongxing Xu | 03509ae | 2010-07-20 06:22:24 +0000 | [diff] [blame] | 879 | const CallExpr* C = cast<CallExpr>(S); |
Ted Kremenek | 892697d | 2010-12-16 07:46:53 +0000 | [diff] [blame] | 880 | VisitCall(C, Pred, C->arg_begin(), C->arg_end(), Dst); |
Ted Kremenek | 06fb99f | 2008-11-14 19:47:18 +0000 | [diff] [blame] | 881 | break; |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 882 | } |
Ted Kremenek | 06fb99f | 2008-11-14 19:47:18 +0000 | [diff] [blame] | 883 | |
Zhongxing Xu | 7ce351d | 2010-11-01 09:09:44 +0000 | [diff] [blame] | 884 | case Stmt::CXXConstructExprClass: { |
| 885 | const CXXConstructExpr *C = cast<CXXConstructExpr>(S); |
| 886 | // For block-level CXXConstructExpr, we don't have a destination region. |
| 887 | // Let VisitCXXConstructExpr() create one. |
Ted Kremenek | 892697d | 2010-12-16 07:46:53 +0000 | [diff] [blame] | 888 | VisitCXXConstructExpr(C, 0, Pred, Dst); |
Zhongxing Xu | 7ce351d | 2010-11-01 09:09:44 +0000 | [diff] [blame] | 889 | break; |
| 890 | } |
| 891 | |
Zhongxing Xu | 950db87 | 2010-04-01 07:58:50 +0000 | [diff] [blame] | 892 | case Stmt::CXXMemberCallExprClass: { |
Zhongxing Xu | 03509ae | 2010-07-20 06:22:24 +0000 | [diff] [blame] | 893 | const CXXMemberCallExpr *MCE = cast<CXXMemberCallExpr>(S); |
Zhongxing Xu | 950db87 | 2010-04-01 07:58:50 +0000 | [diff] [blame] | 894 | VisitCXXMemberCallExpr(MCE, Pred, Dst); |
| 895 | break; |
| 896 | } |
| 897 | |
Marcin Swiderski | 6a02b60 | 2010-11-18 06:29:23 +0000 | [diff] [blame] | 898 | case Stmt::CXXOperatorCallExprClass: { |
| 899 | const CXXOperatorCallExpr *C = cast<CXXOperatorCallExpr>(S); |
| 900 | VisitCXXOperatorCallExpr(C, Pred, Dst); |
| 901 | break; |
| 902 | } |
| 903 | |
Zhongxing Xu | 856c6bc | 2010-04-19 11:47:28 +0000 | [diff] [blame] | 904 | case Stmt::CXXNewExprClass: { |
Zhongxing Xu | 03509ae | 2010-07-20 06:22:24 +0000 | [diff] [blame] | 905 | const CXXNewExpr *NE = cast<CXXNewExpr>(S); |
Zhongxing Xu | 856c6bc | 2010-04-19 11:47:28 +0000 | [diff] [blame] | 906 | VisitCXXNewExpr(NE, Pred, Dst); |
| 907 | break; |
| 908 | } |
| 909 | |
Zhongxing Xu | 6b85138 | 2010-04-21 02:17:31 +0000 | [diff] [blame] | 910 | case Stmt::CXXDeleteExprClass: { |
Zhongxing Xu | 03509ae | 2010-07-20 06:22:24 +0000 | [diff] [blame] | 911 | const CXXDeleteExpr *CDE = cast<CXXDeleteExpr>(S); |
Zhongxing Xu | 6b85138 | 2010-04-21 02:17:31 +0000 | [diff] [blame] | 912 | VisitCXXDeleteExpr(CDE, Pred, Dst); |
| 913 | break; |
| 914 | } |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 915 | // FIXME: ChooseExpr is really a constant. We need to fix |
| 916 | // the CFG do not model them as explicit control-flow. |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 917 | |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 918 | case Stmt::ChooseExprClass: { // __builtin_choose_expr |
Zhongxing Xu | 03509ae | 2010-07-20 06:22:24 +0000 | [diff] [blame] | 919 | const ChooseExpr* C = cast<ChooseExpr>(S); |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 920 | VisitGuardedExpr(C, C->getLHS(), C->getRHS(), Pred, Dst); |
| 921 | break; |
| 922 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 923 | |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 924 | case Stmt::CompoundAssignOperatorClass: |
Ted Kremenek | 892697d | 2010-12-16 07:46:53 +0000 | [diff] [blame] | 925 | VisitBinaryOperator(cast<BinaryOperator>(S), Pred, Dst); |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 926 | break; |
Zhongxing Xu | f22679e | 2008-11-07 10:38:33 +0000 | [diff] [blame] | 927 | |
| 928 | case Stmt::CompoundLiteralExprClass: |
Ted Kremenek | 892697d | 2010-12-16 07:46:53 +0000 | [diff] [blame] | 929 | VisitCompoundLiteralExpr(cast<CompoundLiteralExpr>(S), Pred, Dst); |
Zhongxing Xu | f22679e | 2008-11-07 10:38:33 +0000 | [diff] [blame] | 930 | break; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 931 | |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 932 | case Stmt::ConditionalOperatorClass: { // '?' operator |
Zhongxing Xu | 03509ae | 2010-07-20 06:22:24 +0000 | [diff] [blame] | 933 | const ConditionalOperator* C = cast<ConditionalOperator>(S); |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 934 | VisitGuardedExpr(C, C->getLHS(), C->getRHS(), Pred, Dst); |
| 935 | break; |
| 936 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 937 | |
Zhongxing Xu | bb14121 | 2009-12-16 11:27:52 +0000 | [diff] [blame] | 938 | case Stmt::CXXThisExprClass: |
| 939 | VisitCXXThisExpr(cast<CXXThisExpr>(S), Pred, Dst); |
| 940 | break; |
| 941 | |
Ted Kremenek | 892697d | 2010-12-16 07:46:53 +0000 | [diff] [blame] | 942 | case Stmt::DeclRefExprClass: { |
| 943 | const DeclRefExpr *DE = cast<DeclRefExpr>(S); |
| 944 | VisitCommonDeclRefExpr(DE, DE->getDecl(), Pred, Dst); |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 945 | break; |
Ted Kremenek | 892697d | 2010-12-16 07:46:53 +0000 | [diff] [blame] | 946 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 947 | |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 948 | case Stmt::DeclStmtClass: |
| 949 | VisitDeclStmt(cast<DeclStmt>(S), Pred, Dst); |
| 950 | break; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 951 | |
Ted Kremenek | 919f066 | 2009-12-24 01:49:25 +0000 | [diff] [blame] | 952 | case Stmt::ForStmtClass: |
| 953 | // This case isn't for branch processing, but for handling the |
| 954 | // initialization of a condition variable. |
| 955 | VisitCondInit(cast<ForStmt>(S)->getConditionVariable(), S, Pred, Dst); |
Ted Kremenek | b9bbd59 | 2010-02-15 23:02:46 +0000 | [diff] [blame] | 956 | break; |
Ted Kremenek | 919f066 | 2009-12-24 01:49:25 +0000 | [diff] [blame] | 957 | |
Argyrios Kyrtzidis | 0835a3c | 2008-08-18 23:01:59 +0000 | [diff] [blame] | 958 | case Stmt::ImplicitCastExprClass: |
Zhongxing Xu | 0d9d736 | 2010-04-13 12:38:32 +0000 | [diff] [blame] | 959 | case Stmt::CStyleCastExprClass: |
| 960 | case Stmt::CXXStaticCastExprClass: |
| 961 | case Stmt::CXXDynamicCastExprClass: |
| 962 | case Stmt::CXXReinterpretCastExprClass: |
| 963 | case Stmt::CXXConstCastExprClass: |
| 964 | case Stmt::CXXFunctionalCastExprClass: { |
Zhongxing Xu | 03509ae | 2010-07-20 06:22:24 +0000 | [diff] [blame] | 965 | const CastExpr* C = cast<CastExpr>(S); |
Ted Kremenek | 892697d | 2010-12-16 07:46:53 +0000 | [diff] [blame] | 966 | VisitCast(C, C->getSubExpr(), Pred, Dst); |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 967 | break; |
| 968 | } |
Ted Kremenek | b9bbd59 | 2010-02-15 23:02:46 +0000 | [diff] [blame] | 969 | |
Ted Kremenek | 61dfbec | 2009-12-23 04:49:01 +0000 | [diff] [blame] | 970 | case Stmt::IfStmtClass: |
| 971 | // This case isn't for branch processing, but for handling the |
| 972 | // initialization of a condition variable. |
Ted Kremenek | fcfb503 | 2009-12-24 00:40:03 +0000 | [diff] [blame] | 973 | VisitCondInit(cast<IfStmt>(S)->getConditionVariable(), S, Pred, Dst); |
Ted Kremenek | 61dfbec | 2009-12-23 04:49:01 +0000 | [diff] [blame] | 974 | break; |
Zhongxing Xu | c4f8706 | 2008-10-30 05:02:23 +0000 | [diff] [blame] | 975 | |
| 976 | case Stmt::InitListExprClass: |
| 977 | VisitInitListExpr(cast<InitListExpr>(S), Pred, Dst); |
| 978 | break; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 979 | |
Ted Kremenek | 97ed4f6 | 2008-10-17 00:03:18 +0000 | [diff] [blame] | 980 | case Stmt::MemberExprClass: |
Ted Kremenek | 892697d | 2010-12-16 07:46:53 +0000 | [diff] [blame] | 981 | VisitMemberExpr(cast<MemberExpr>(S), Pred, Dst); |
Ted Kremenek | 469ecbd | 2008-04-21 23:43:38 +0000 | [diff] [blame] | 982 | break; |
Ted Kremenek | 97ed4f6 | 2008-10-17 00:03:18 +0000 | [diff] [blame] | 983 | case Stmt::ObjCIvarRefExprClass: |
Ted Kremenek | 892697d | 2010-12-16 07:46:53 +0000 | [diff] [blame] | 984 | VisitLvalObjCIvarRefExpr(cast<ObjCIvarRefExpr>(S), Pred, Dst); |
Ted Kremenek | 97ed4f6 | 2008-10-17 00:03:18 +0000 | [diff] [blame] | 985 | break; |
Ted Kremenek | af33741 | 2008-11-12 19:24:17 +0000 | [diff] [blame] | 986 | |
| 987 | case Stmt::ObjCForCollectionStmtClass: |
| 988 | VisitObjCForCollectionStmt(cast<ObjCForCollectionStmt>(S), Pred, Dst); |
| 989 | break; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 990 | |
Ted Kremenek | 38ac4f5 | 2009-12-22 22:13:46 +0000 | [diff] [blame] | 991 | case Stmt::ObjCMessageExprClass: |
Ted Kremenek | 892697d | 2010-12-16 07:46:53 +0000 | [diff] [blame] | 992 | VisitObjCMessageExpr(cast<ObjCMessageExpr>(S), Pred, Dst); |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 993 | break; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 994 | |
Ted Kremenek | bbfd07a | 2008-12-09 20:18:58 +0000 | [diff] [blame] | 995 | case Stmt::ObjCAtThrowStmtClass: { |
| 996 | // FIXME: This is not complete. We basically treat @throw as |
| 997 | // an abort. |
| 998 | SaveAndRestore<bool> OldSink(Builder->BuildSinks); |
| 999 | Builder->BuildSinks = true; |
| 1000 | MakeNode(Dst, S, Pred, GetState(Pred)); |
| 1001 | break; |
| 1002 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1003 | |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 1004 | case Stmt::ReturnStmtClass: |
| 1005 | VisitReturnStmt(cast<ReturnStmt>(S), Pred, Dst); |
| 1006 | break; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1007 | |
Douglas Gregor | 8ecdb65 | 2010-04-28 22:16:22 +0000 | [diff] [blame] | 1008 | case Stmt::OffsetOfExprClass: |
| 1009 | VisitOffsetOfExpr(cast<OffsetOfExpr>(S), Pred, Dst); |
| 1010 | break; |
| 1011 | |
Sebastian Redl | 0518999 | 2008-11-11 17:56:53 +0000 | [diff] [blame] | 1012 | case Stmt::SizeOfAlignOfExprClass: |
| 1013 | VisitSizeOfAlignOfExpr(cast<SizeOfAlignOfExpr>(S), Pred, Dst); |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 1014 | break; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1015 | |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 1016 | case Stmt::StmtExprClass: { |
Zhongxing Xu | 03509ae | 2010-07-20 06:22:24 +0000 | [diff] [blame] | 1017 | const StmtExpr* SE = cast<StmtExpr>(S); |
Ted Kremenek | a3d1eb8 | 2009-02-14 05:55:08 +0000 | [diff] [blame] | 1018 | |
| 1019 | if (SE->getSubStmt()->body_empty()) { |
| 1020 | // Empty statement expression. |
| 1021 | assert(SE->getType() == getContext().VoidTy |
| 1022 | && "Empty statement expression must have void type."); |
| 1023 | Dst.Add(Pred); |
| 1024 | break; |
| 1025 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1026 | |
Ted Kremenek | a3d1eb8 | 2009-02-14 05:55:08 +0000 | [diff] [blame] | 1027 | if (Expr* LastExpr = dyn_cast<Expr>(*SE->getSubStmt()->body_rbegin())) { |
| 1028 | const GRState* state = GetState(Pred); |
Ted Kremenek | 1397663 | 2010-02-08 16:18:51 +0000 | [diff] [blame] | 1029 | MakeNode(Dst, SE, Pred, state->BindExpr(SE, state->getSVal(LastExpr))); |
Ted Kremenek | a3d1eb8 | 2009-02-14 05:55:08 +0000 | [diff] [blame] | 1030 | } |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 1031 | else |
| 1032 | Dst.Add(Pred); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1033 | |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 1034 | break; |
| 1035 | } |
Zhongxing Xu | 6987c7b | 2008-11-30 05:49:49 +0000 | [diff] [blame] | 1036 | |
Ted Kremenek | 892697d | 2010-12-16 07:46:53 +0000 | [diff] [blame] | 1037 | case Stmt::StringLiteralClass: { |
| 1038 | const GRState* state = GetState(Pred); |
| 1039 | SVal V = state->getLValue(cast<StringLiteral>(S)); |
| 1040 | MakeNode(Dst, S, Pred, state->BindExpr(S, V)); |
| 1041 | return; |
| 1042 | } |
Ted Kremenek | b9bbd59 | 2010-02-15 23:02:46 +0000 | [diff] [blame] | 1043 | |
Ted Kremenek | fcfb503 | 2009-12-24 00:40:03 +0000 | [diff] [blame] | 1044 | case Stmt::SwitchStmtClass: |
| 1045 | // This case isn't for branch processing, but for handling the |
| 1046 | // initialization of a condition variable. |
| 1047 | VisitCondInit(cast<SwitchStmt>(S)->getConditionVariable(), S, Pred, Dst); |
| 1048 | break; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1049 | |
Ted Kremenek | 7237459 | 2009-03-18 23:49:26 +0000 | [diff] [blame] | 1050 | case Stmt::UnaryOperatorClass: { |
Zhongxing Xu | 03509ae | 2010-07-20 06:22:24 +0000 | [diff] [blame] | 1051 | const UnaryOperator *U = cast<UnaryOperator>(S); |
John McCall | 2de56d1 | 2010-08-25 11:45:40 +0000 | [diff] [blame] | 1052 | if (AMgr.shouldEagerlyAssume()&&(U->getOpcode() == UO_LNot)) { |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 1053 | ExplodedNodeSet Tmp; |
Ted Kremenek | 892697d | 2010-12-16 07:46:53 +0000 | [diff] [blame] | 1054 | VisitUnaryOperator(U, Pred, Tmp); |
Ted Kremenek | 9c14953 | 2010-12-01 21:57:22 +0000 | [diff] [blame] | 1055 | evalEagerlyAssume(Dst, Tmp, U); |
Ted Kremenek | 7237459 | 2009-03-18 23:49:26 +0000 | [diff] [blame] | 1056 | } |
| 1057 | else |
Ted Kremenek | 892697d | 2010-12-16 07:46:53 +0000 | [diff] [blame] | 1058 | VisitUnaryOperator(U, Pred, Dst); |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 1059 | break; |
Ted Kremenek | 7237459 | 2009-03-18 23:49:26 +0000 | [diff] [blame] | 1060 | } |
Ted Kremenek | b9bbd59 | 2010-02-15 23:02:46 +0000 | [diff] [blame] | 1061 | |
Ted Kremenek | 4c508a1 | 2009-12-24 00:54:56 +0000 | [diff] [blame] | 1062 | case Stmt::WhileStmtClass: |
| 1063 | // This case isn't for branch processing, but for handling the |
| 1064 | // initialization of a condition variable. |
| 1065 | VisitCondInit(cast<WhileStmt>(S)->getConditionVariable(), S, Pred, Dst); |
Ted Kremenek | b9bbd59 | 2010-02-15 23:02:46 +0000 | [diff] [blame] | 1066 | break; |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 1067 | } |
| 1068 | } |
| 1069 | |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 1070 | //===----------------------------------------------------------------------===// |
| 1071 | // Block entrance. (Update counters). |
| 1072 | //===----------------------------------------------------------------------===// |
| 1073 | |
Zhongxing Xu | 03509ae | 2010-07-20 06:22:24 +0000 | [diff] [blame] | 1074 | bool GRExprEngine::ProcessBlockEntrance(const CFGBlock* B, |
| 1075 | const ExplodedNode *Pred, |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 1076 | GRBlockCounter BC) { |
Zhongxing Xu | d9e0c0f | 2010-03-23 05:05:02 +0000 | [diff] [blame] | 1077 | return BC.getNumVisited(Pred->getLocationContext()->getCurrentStackFrame(), |
Tom Care | 68625cf | 2010-09-14 21:35:27 +0000 | [diff] [blame] | 1078 | B->getBlockID()) < AMgr.getMaxVisit(); |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 1079 | } |
| 1080 | |
| 1081 | //===----------------------------------------------------------------------===// |
Ted Kremenek | 1670e40 | 2009-04-11 00:11:10 +0000 | [diff] [blame] | 1082 | // Generic node creation. |
| 1083 | //===----------------------------------------------------------------------===// |
| 1084 | |
Zhongxing Xu | 3992a50 | 2010-07-20 02:41:28 +0000 | [diff] [blame] | 1085 | ExplodedNode* GRExprEngine::MakeNode(ExplodedNodeSet& Dst, const Stmt* S, |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 1086 | ExplodedNode* Pred, const GRState* St, |
| 1087 | ProgramPoint::Kind K, const void *tag) { |
Ted Kremenek | 1670e40 | 2009-04-11 00:11:10 +0000 | [diff] [blame] | 1088 | assert (Builder && "GRStmtNodeBuilder not present."); |
| 1089 | SaveAndRestore<const void*> OldTag(Builder->Tag); |
| 1090 | Builder->Tag = tag; |
| 1091 | return Builder->MakeNode(Dst, S, Pred, St, K); |
| 1092 | } |
| 1093 | |
| 1094 | //===----------------------------------------------------------------------===// |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 1095 | // Branch processing. |
| 1096 | //===----------------------------------------------------------------------===// |
| 1097 | |
Ted Kremenek | a8538d9 | 2009-02-13 01:45:31 +0000 | [diff] [blame] | 1098 | const GRState* GRExprEngine::MarkBranch(const GRState* state, |
Zhongxing Xu | 03509ae | 2010-07-20 06:22:24 +0000 | [diff] [blame] | 1099 | const Stmt* Terminator, |
| 1100 | bool branchTaken) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1101 | |
Ted Kremenek | 05a2378 | 2008-02-26 19:05:15 +0000 | [diff] [blame] | 1102 | switch (Terminator->getStmtClass()) { |
| 1103 | default: |
Ted Kremenek | a8538d9 | 2009-02-13 01:45:31 +0000 | [diff] [blame] | 1104 | return state; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1105 | |
Ted Kremenek | 05a2378 | 2008-02-26 19:05:15 +0000 | [diff] [blame] | 1106 | case Stmt::BinaryOperatorClass: { // '&&' and '||' |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1107 | |
Zhongxing Xu | 03509ae | 2010-07-20 06:22:24 +0000 | [diff] [blame] | 1108 | const BinaryOperator* B = cast<BinaryOperator>(Terminator); |
Ted Kremenek | 05a2378 | 2008-02-26 19:05:15 +0000 | [diff] [blame] | 1109 | BinaryOperator::Opcode Op = B->getOpcode(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1110 | |
John McCall | 2de56d1 | 2010-08-25 11:45:40 +0000 | [diff] [blame] | 1111 | assert (Op == BO_LAnd || Op == BO_LOr); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1112 | |
Ted Kremenek | 05a2378 | 2008-02-26 19:05:15 +0000 | [diff] [blame] | 1113 | // For &&, if we take the true branch, then the value of the whole |
| 1114 | // expression is that of the RHS expression. |
| 1115 | // |
| 1116 | // For ||, if we take the false branch, then the value of the whole |
| 1117 | // expression is that of the RHS expression. |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1118 | |
John McCall | 2de56d1 | 2010-08-25 11:45:40 +0000 | [diff] [blame] | 1119 | const Expr* Ex = (Op == BO_LAnd && branchTaken) || |
| 1120 | (Op == BO_LOr && !branchTaken) |
Zhongxing Xu | 03509ae | 2010-07-20 06:22:24 +0000 | [diff] [blame] | 1121 | ? B->getRHS() : B->getLHS(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1122 | |
Ted Kremenek | 8e02934 | 2009-08-27 22:17:37 +0000 | [diff] [blame] | 1123 | return state->BindExpr(B, UndefinedVal(Ex)); |
Ted Kremenek | 05a2378 | 2008-02-26 19:05:15 +0000 | [diff] [blame] | 1124 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1125 | |
Ted Kremenek | 05a2378 | 2008-02-26 19:05:15 +0000 | [diff] [blame] | 1126 | case Stmt::ConditionalOperatorClass: { // ?: |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1127 | |
Zhongxing Xu | 03509ae | 2010-07-20 06:22:24 +0000 | [diff] [blame] | 1128 | const ConditionalOperator* C = cast<ConditionalOperator>(Terminator); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1129 | |
Ted Kremenek | 05a2378 | 2008-02-26 19:05:15 +0000 | [diff] [blame] | 1130 | // For ?, if branchTaken == true then the value is either the LHS or |
| 1131 | // the condition itself. (GNU extension). |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1132 | |
Zhongxing Xu | 03509ae | 2010-07-20 06:22:24 +0000 | [diff] [blame] | 1133 | const Expr* Ex; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1134 | |
Ted Kremenek | 05a2378 | 2008-02-26 19:05:15 +0000 | [diff] [blame] | 1135 | if (branchTaken) |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1136 | Ex = C->getLHS() ? C->getLHS() : C->getCond(); |
Ted Kremenek | 05a2378 | 2008-02-26 19:05:15 +0000 | [diff] [blame] | 1137 | else |
| 1138 | Ex = C->getRHS(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1139 | |
Ted Kremenek | 8e02934 | 2009-08-27 22:17:37 +0000 | [diff] [blame] | 1140 | return state->BindExpr(C, UndefinedVal(Ex)); |
Ted Kremenek | 05a2378 | 2008-02-26 19:05:15 +0000 | [diff] [blame] | 1141 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1142 | |
Ted Kremenek | 05a2378 | 2008-02-26 19:05:15 +0000 | [diff] [blame] | 1143 | case Stmt::ChooseExprClass: { // ?: |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1144 | |
Zhongxing Xu | 03509ae | 2010-07-20 06:22:24 +0000 | [diff] [blame] | 1145 | const ChooseExpr* C = cast<ChooseExpr>(Terminator); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1146 | |
Zhongxing Xu | 03509ae | 2010-07-20 06:22:24 +0000 | [diff] [blame] | 1147 | const Expr* Ex = branchTaken ? C->getLHS() : C->getRHS(); |
Ted Kremenek | 8e02934 | 2009-08-27 22:17:37 +0000 | [diff] [blame] | 1148 | return state->BindExpr(C, UndefinedVal(Ex)); |
Ted Kremenek | 05a2378 | 2008-02-26 19:05:15 +0000 | [diff] [blame] | 1149 | } |
| 1150 | } |
| 1151 | } |
| 1152 | |
Ted Kremenek | 6ae8a36 | 2009-03-13 16:32:54 +0000 | [diff] [blame] | 1153 | /// RecoverCastedSymbol - A helper function for ProcessBranch that is used |
| 1154 | /// to try to recover some path-sensitivity for casts of symbolic |
| 1155 | /// integers that promote their values (which are currently not tracked well). |
| 1156 | /// This function returns the SVal bound to Condition->IgnoreCasts if all the |
| 1157 | // cast(s) did was sign-extend the original value. |
| 1158 | static SVal RecoverCastedSymbol(GRStateManager& StateMgr, const GRState* state, |
Zhongxing Xu | 03509ae | 2010-07-20 06:22:24 +0000 | [diff] [blame] | 1159 | const Stmt* Condition, ASTContext& Ctx) { |
Ted Kremenek | 6ae8a36 | 2009-03-13 16:32:54 +0000 | [diff] [blame] | 1160 | |
Zhongxing Xu | 03509ae | 2010-07-20 06:22:24 +0000 | [diff] [blame] | 1161 | const Expr *Ex = dyn_cast<Expr>(Condition); |
Ted Kremenek | 6ae8a36 | 2009-03-13 16:32:54 +0000 | [diff] [blame] | 1162 | if (!Ex) |
| 1163 | return UnknownVal(); |
| 1164 | |
| 1165 | uint64_t bits = 0; |
| 1166 | bool bitsInit = false; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1167 | |
Zhongxing Xu | 03509ae | 2010-07-20 06:22:24 +0000 | [diff] [blame] | 1168 | while (const CastExpr *CE = dyn_cast<CastExpr>(Ex)) { |
Ted Kremenek | 6ae8a36 | 2009-03-13 16:32:54 +0000 | [diff] [blame] | 1169 | QualType T = CE->getType(); |
| 1170 | |
| 1171 | if (!T->isIntegerType()) |
| 1172 | return UnknownVal(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1173 | |
Ted Kremenek | 6ae8a36 | 2009-03-13 16:32:54 +0000 | [diff] [blame] | 1174 | uint64_t newBits = Ctx.getTypeSize(T); |
| 1175 | if (!bitsInit || newBits < bits) { |
| 1176 | bitsInit = true; |
| 1177 | bits = newBits; |
| 1178 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1179 | |
Ted Kremenek | 6ae8a36 | 2009-03-13 16:32:54 +0000 | [diff] [blame] | 1180 | Ex = CE->getSubExpr(); |
| 1181 | } |
| 1182 | |
| 1183 | // We reached a non-cast. Is it a symbolic value? |
| 1184 | QualType T = Ex->getType(); |
| 1185 | |
| 1186 | if (!bitsInit || !T->isIntegerType() || Ctx.getTypeSize(T) > bits) |
| 1187 | return UnknownVal(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1188 | |
Ted Kremenek | 1397663 | 2010-02-08 16:18:51 +0000 | [diff] [blame] | 1189 | return state->getSVal(Ex); |
Ted Kremenek | 6ae8a36 | 2009-03-13 16:32:54 +0000 | [diff] [blame] | 1190 | } |
| 1191 | |
Zhongxing Xu | 03509ae | 2010-07-20 06:22:24 +0000 | [diff] [blame] | 1192 | void GRExprEngine::ProcessBranch(const Stmt* Condition, const Stmt* Term, |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 1193 | GRBranchNodeBuilder& builder) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1194 | |
Ted Kremenek | b233183 | 2008-02-15 22:29:00 +0000 | [diff] [blame] | 1195 | // Check for NULL conditions; e.g. "for(;;)" |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1196 | if (!Condition) { |
Ted Kremenek | b233183 | 2008-02-15 22:29:00 +0000 | [diff] [blame] | 1197 | builder.markInfeasible(false); |
Ted Kremenek | b233183 | 2008-02-15 22:29:00 +0000 | [diff] [blame] | 1198 | return; |
| 1199 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1200 | |
Ted Kremenek | 21028dd | 2009-03-11 03:54:24 +0000 | [diff] [blame] | 1201 | PrettyStackTraceLoc CrashInfo(getContext().getSourceManager(), |
| 1202 | Condition->getLocStart(), |
| 1203 | "Error evaluating branch"); |
Ted Kremenek | 0fb0bc4 | 2009-08-27 01:39:13 +0000 | [diff] [blame] | 1204 | |
Zhongxing Xu | 0835e4c | 2009-11-23 03:20:54 +0000 | [diff] [blame] | 1205 | for (CheckersOrdered::iterator I=Checkers.begin(),E=Checkers.end();I!=E;++I) { |
| 1206 | void *tag = I->first; |
| 1207 | Checker *checker = I->second; |
| 1208 | checker->VisitBranchCondition(builder, *this, Condition, tag); |
| 1209 | } |
| 1210 | |
| 1211 | // If the branch condition is undefined, return; |
| 1212 | if (!builder.isFeasible(true) && !builder.isFeasible(false)) |
| 1213 | return; |
| 1214 | |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1215 | const GRState* PrevState = builder.getState(); |
Ted Kremenek | 1397663 | 2010-02-08 16:18:51 +0000 | [diff] [blame] | 1216 | SVal X = PrevState->getSVal(Condition); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1217 | |
Zhongxing Xu | 0835e4c | 2009-11-23 03:20:54 +0000 | [diff] [blame] | 1218 | if (X.isUnknown()) { |
| 1219 | // Give it a chance to recover from unknown. |
| 1220 | if (const Expr *Ex = dyn_cast<Expr>(Condition)) { |
| 1221 | if (Ex->getType()->isIntegerType()) { |
| 1222 | // Try to recover some path-sensitivity. Right now casts of symbolic |
| 1223 | // integers that promote their values are currently not tracked well. |
| 1224 | // If 'Condition' is such an expression, try and recover the |
| 1225 | // underlying value and use that instead. |
| 1226 | SVal recovered = RecoverCastedSymbol(getStateManager(), |
| 1227 | builder.getState(), Condition, |
| 1228 | getContext()); |
Ted Kremenek | b9bbd59 | 2010-02-15 23:02:46 +0000 | [diff] [blame] | 1229 | |
Zhongxing Xu | 0835e4c | 2009-11-23 03:20:54 +0000 | [diff] [blame] | 1230 | if (!recovered.isUnknown()) { |
| 1231 | X = recovered; |
| 1232 | } |
Ted Kremenek | 6ae8a36 | 2009-03-13 16:32:54 +0000 | [diff] [blame] | 1233 | } |
Zhongxing Xu | 0835e4c | 2009-11-23 03:20:54 +0000 | [diff] [blame] | 1234 | } |
| 1235 | // If the condition is still unknown, give up. |
| 1236 | if (X.isUnknown()) { |
| 1237 | builder.generateNode(MarkBranch(PrevState, Term, true), true); |
| 1238 | builder.generateNode(MarkBranch(PrevState, Term, false), false); |
Ted Kremenek | b38911f | 2008-01-30 23:03:39 +0000 | [diff] [blame] | 1239 | return; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1240 | } |
Ted Kremenek | b38911f | 2008-01-30 23:03:39 +0000 | [diff] [blame] | 1241 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1242 | |
Zhongxing Xu | 0835e4c | 2009-11-23 03:20:54 +0000 | [diff] [blame] | 1243 | DefinedSVal V = cast<DefinedSVal>(X); |
| 1244 | |
Ted Kremenek | 6a6719a | 2008-02-29 20:27:50 +0000 | [diff] [blame] | 1245 | // Process the true branch. |
Ted Kremenek | 5200354 | 2009-07-20 18:44:36 +0000 | [diff] [blame] | 1246 | if (builder.isFeasible(true)) { |
Ted Kremenek | 28f47b9 | 2010-12-01 22:16:56 +0000 | [diff] [blame] | 1247 | if (const GRState *state = PrevState->assume(V, true)) |
Ted Kremenek | 5200354 | 2009-07-20 18:44:36 +0000 | [diff] [blame] | 1248 | builder.generateNode(MarkBranch(state, Term, true), true); |
| 1249 | else |
| 1250 | builder.markInfeasible(true); |
| 1251 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1252 | |
| 1253 | // Process the false branch. |
Ted Kremenek | 5200354 | 2009-07-20 18:44:36 +0000 | [diff] [blame] | 1254 | if (builder.isFeasible(false)) { |
Ted Kremenek | 28f47b9 | 2010-12-01 22:16:56 +0000 | [diff] [blame] | 1255 | if (const GRState *state = PrevState->assume(V, false)) |
Ted Kremenek | 5200354 | 2009-07-20 18:44:36 +0000 | [diff] [blame] | 1256 | builder.generateNode(MarkBranch(state, Term, false), false); |
| 1257 | else |
| 1258 | builder.markInfeasible(false); |
| 1259 | } |
Ted Kremenek | 71c29bd | 2008-01-29 23:32:35 +0000 | [diff] [blame] | 1260 | } |
| 1261 | |
Ted Kremenek | 4d4dd85 | 2008-02-13 17:41:41 +0000 | [diff] [blame] | 1262 | /// ProcessIndirectGoto - Called by GRCoreEngine. Used to generate successor |
Ted Kremenek | 754607e | 2008-02-13 00:24:44 +0000 | [diff] [blame] | 1263 | /// nodes by processing the 'effects' of a computed goto jump. |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 1264 | void GRExprEngine::ProcessIndirectGoto(GRIndirectGotoNodeBuilder& builder) { |
Ted Kremenek | 754607e | 2008-02-13 00:24:44 +0000 | [diff] [blame] | 1265 | |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1266 | const GRState *state = builder.getState(); |
Ted Kremenek | 1397663 | 2010-02-08 16:18:51 +0000 | [diff] [blame] | 1267 | SVal V = state->getSVal(builder.getTarget()); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1268 | |
Ted Kremenek | 754607e | 2008-02-13 00:24:44 +0000 | [diff] [blame] | 1269 | // Three possibilities: |
| 1270 | // |
| 1271 | // (1) We know the computed label. |
Ted Kremenek | 4a4e524 | 2008-02-28 09:25:22 +0000 | [diff] [blame] | 1272 | // (2) The label is NULL (or some other constant), or Undefined. |
Ted Kremenek | 754607e | 2008-02-13 00:24:44 +0000 | [diff] [blame] | 1273 | // (3) We have no clue about the label. Dispatch to all targets. |
| 1274 | // |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1275 | |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 1276 | typedef GRIndirectGotoNodeBuilder::iterator iterator; |
Ted Kremenek | 754607e | 2008-02-13 00:24:44 +0000 | [diff] [blame] | 1277 | |
Zhongxing Xu | 1c96b24 | 2008-10-17 05:57:07 +0000 | [diff] [blame] | 1278 | if (isa<loc::GotoLabel>(V)) { |
Zhongxing Xu | 03509ae | 2010-07-20 06:22:24 +0000 | [diff] [blame] | 1279 | const LabelStmt* L = cast<loc::GotoLabel>(V).getLabel(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1280 | |
Ted Kremenek | 754607e | 2008-02-13 00:24:44 +0000 | [diff] [blame] | 1281 | for (iterator I=builder.begin(), E=builder.end(); I != E; ++I) { |
Ted Kremenek | 24f1a96 | 2008-02-13 17:27:37 +0000 | [diff] [blame] | 1282 | if (I.getLabel() == L) { |
Ted Kremenek | a8538d9 | 2009-02-13 01:45:31 +0000 | [diff] [blame] | 1283 | builder.generateNode(I, state); |
Ted Kremenek | 754607e | 2008-02-13 00:24:44 +0000 | [diff] [blame] | 1284 | return; |
| 1285 | } |
| 1286 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1287 | |
Ted Kremenek | 754607e | 2008-02-13 00:24:44 +0000 | [diff] [blame] | 1288 | assert (false && "No block with label."); |
| 1289 | return; |
| 1290 | } |
| 1291 | |
Zhongxing Xu | 1c96b24 | 2008-10-17 05:57:07 +0000 | [diff] [blame] | 1292 | if (isa<loc::ConcreteInt>(V) || isa<UndefinedVal>(V)) { |
Ted Kremenek | 754607e | 2008-02-13 00:24:44 +0000 | [diff] [blame] | 1293 | // Dispatch to the first target and mark it as a sink. |
Zhongxing Xu | 2055eff | 2009-11-24 07:06:39 +0000 | [diff] [blame] | 1294 | //ExplodedNode* N = builder.generateNode(builder.begin(), state, true); |
| 1295 | // FIXME: add checker visit. |
| 1296 | // UndefBranches.insert(N); |
Ted Kremenek | 754607e | 2008-02-13 00:24:44 +0000 | [diff] [blame] | 1297 | return; |
| 1298 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1299 | |
Ted Kremenek | 754607e | 2008-02-13 00:24:44 +0000 | [diff] [blame] | 1300 | // This is really a catch-all. We don't support symbolics yet. |
Ted Kremenek | b3cfd58 | 2009-04-23 17:49:43 +0000 | [diff] [blame] | 1301 | // FIXME: Implement dispatch for symbolic pointers. |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1302 | |
Ted Kremenek | 754607e | 2008-02-13 00:24:44 +0000 | [diff] [blame] | 1303 | for (iterator I=builder.begin(), E=builder.end(); I != E; ++I) |
Ted Kremenek | a8538d9 | 2009-02-13 01:45:31 +0000 | [diff] [blame] | 1304 | builder.generateNode(I, state); |
Ted Kremenek | 754607e | 2008-02-13 00:24:44 +0000 | [diff] [blame] | 1305 | } |
Ted Kremenek | f233d48 | 2008-02-05 00:26:40 +0000 | [diff] [blame] | 1306 | |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 1307 | |
Zhongxing Xu | 03509ae | 2010-07-20 06:22:24 +0000 | [diff] [blame] | 1308 | void GRExprEngine::VisitGuardedExpr(const Expr* Ex, const Expr* L, |
| 1309 | const Expr* R, |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 1310 | ExplodedNode* Pred, ExplodedNodeSet& Dst) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1311 | |
Ted Kremenek | 0a3ed31 | 2010-12-17 04:44:39 +0000 | [diff] [blame] | 1312 | assert(Ex == currentStmt && |
Zhongxing Xu | bb14121 | 2009-12-16 11:27:52 +0000 | [diff] [blame] | 1313 | Pred->getLocationContext()->getCFG()->isBlkExpr(Ex)); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1314 | |
Ted Kremenek | a8538d9 | 2009-02-13 01:45:31 +0000 | [diff] [blame] | 1315 | const GRState* state = GetState(Pred); |
Ted Kremenek | 1397663 | 2010-02-08 16:18:51 +0000 | [diff] [blame] | 1316 | SVal X = state->getSVal(Ex); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1317 | |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 1318 | assert (X.isUndef()); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1319 | |
Zhongxing Xu | 03509ae | 2010-07-20 06:22:24 +0000 | [diff] [blame] | 1320 | const Expr *SE = (Expr*) cast<UndefinedVal>(X).getData(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1321 | assert(SE); |
Ted Kremenek | 1397663 | 2010-02-08 16:18:51 +0000 | [diff] [blame] | 1322 | X = state->getSVal(SE); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1323 | |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 1324 | // Make sure that we invalidate the previous binding. |
Ted Kremenek | 8e02934 | 2009-08-27 22:17:37 +0000 | [diff] [blame] | 1325 | MakeNode(Dst, Ex, Pred, state->BindExpr(Ex, X, true)); |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 1326 | } |
| 1327 | |
Ted Kremenek | 73099bf | 2009-11-14 01:05:20 +0000 | [diff] [blame] | 1328 | /// ProcessEndPath - Called by GRCoreEngine. Used to generate end-of-path |
| 1329 | /// nodes when the control reaches the end of a function. |
| 1330 | void GRExprEngine::ProcessEndPath(GREndPathNodeBuilder& builder) { |
Ted Kremenek | 9c14953 | 2010-12-01 21:57:22 +0000 | [diff] [blame] | 1331 | getTF().evalEndPath(*this, builder); |
Ted Kremenek | 73099bf | 2009-11-14 01:05:20 +0000 | [diff] [blame] | 1332 | StateMgr.EndPath(builder.getState()); |
Zhongxing Xu | 243fde9 | 2009-11-17 07:54:15 +0000 | [diff] [blame] | 1333 | for (CheckersOrdered::iterator I=Checkers.begin(),E=Checkers.end(); I!=E;++I){ |
| 1334 | void *tag = I->first; |
| 1335 | Checker *checker = I->second; |
Ted Kremenek | 9c14953 | 2010-12-01 21:57:22 +0000 | [diff] [blame] | 1336 | checker->evalEndPath(builder, tag, *this); |
Zhongxing Xu | 243fde9 | 2009-11-17 07:54:15 +0000 | [diff] [blame] | 1337 | } |
Ted Kremenek | 73099bf | 2009-11-14 01:05:20 +0000 | [diff] [blame] | 1338 | } |
| 1339 | |
Ted Kremenek | daeb9a7 | 2008-02-13 23:08:21 +0000 | [diff] [blame] | 1340 | /// ProcessSwitch - Called by GRCoreEngine. Used to generate successor |
| 1341 | /// nodes by processing the 'effects' of a switch statement. |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1342 | void GRExprEngine::ProcessSwitch(GRSwitchNodeBuilder& builder) { |
| 1343 | typedef GRSwitchNodeBuilder::iterator iterator; |
| 1344 | const GRState* state = builder.getState(); |
Zhongxing Xu | 03509ae | 2010-07-20 06:22:24 +0000 | [diff] [blame] | 1345 | const Expr* CondE = builder.getCondition(); |
Ted Kremenek | 1397663 | 2010-02-08 16:18:51 +0000 | [diff] [blame] | 1346 | SVal CondV_untested = state->getSVal(CondE); |
Ted Kremenek | daeb9a7 | 2008-02-13 23:08:21 +0000 | [diff] [blame] | 1347 | |
Ted Kremenek | 5b9bd21 | 2009-09-11 22:07:28 +0000 | [diff] [blame] | 1348 | if (CondV_untested.isUndef()) { |
Zhongxing Xu | 2055eff | 2009-11-24 07:06:39 +0000 | [diff] [blame] | 1349 | //ExplodedNode* N = builder.generateDefaultCaseNode(state, true); |
Ted Kremenek | b9bbd59 | 2010-02-15 23:02:46 +0000 | [diff] [blame] | 1350 | // FIXME: add checker |
Zhongxing Xu | 2055eff | 2009-11-24 07:06:39 +0000 | [diff] [blame] | 1351 | //UndefBranches.insert(N); |
| 1352 | |
Ted Kremenek | daeb9a7 | 2008-02-13 23:08:21 +0000 | [diff] [blame] | 1353 | return; |
| 1354 | } |
Ted Kremenek | 5b9bd21 | 2009-09-11 22:07:28 +0000 | [diff] [blame] | 1355 | DefinedOrUnknownSVal CondV = cast<DefinedOrUnknownSVal>(CondV_untested); |
Ted Kremenek | 692416c | 2008-02-18 22:57:02 +0000 | [diff] [blame] | 1356 | |
Ted Kremenek | 5b9bd21 | 2009-09-11 22:07:28 +0000 | [diff] [blame] | 1357 | const GRState *DefaultSt = state; |
Ted Kremenek | 34feff6 | 2010-08-26 22:19:33 +0000 | [diff] [blame] | 1358 | |
| 1359 | iterator I = builder.begin(), EI = builder.end(); |
| 1360 | bool defaultIsFeasible = I == EI; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1361 | |
Ted Kremenek | 34feff6 | 2010-08-26 22:19:33 +0000 | [diff] [blame] | 1362 | for ( ; I != EI; ++I) { |
Ted Kremenek | 4127117 | 2010-08-26 22:04:01 +0000 | [diff] [blame] | 1363 | const CaseStmt* Case = I.getCase(); |
Ted Kremenek | 72afb37 | 2009-01-17 01:54:16 +0000 | [diff] [blame] | 1364 | |
| 1365 | // Evaluate the LHS of the case value. |
| 1366 | Expr::EvalResult V1; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1367 | bool b = Case->getLHS()->Evaluate(V1, getContext()); |
| 1368 | |
Ted Kremenek | 72afb37 | 2009-01-17 01:54:16 +0000 | [diff] [blame] | 1369 | // Sanity checks. These go away in Release builds. |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1370 | assert(b && V1.Val.isInt() && !V1.HasSideEffects |
Ted Kremenek | 72afb37 | 2009-01-17 01:54:16 +0000 | [diff] [blame] | 1371 | && "Case condition must evaluate to an integer constant."); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1372 | b = b; // silence unused variable warning |
| 1373 | assert(V1.Val.getInt().getBitWidth() == |
Ted Kremenek | 72afb37 | 2009-01-17 01:54:16 +0000 | [diff] [blame] | 1374 | getContext().getTypeSize(CondE->getType())); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1375 | |
Ted Kremenek | daeb9a7 | 2008-02-13 23:08:21 +0000 | [diff] [blame] | 1376 | // Get the RHS of the case, if it exists. |
Ted Kremenek | 72afb37 | 2009-01-17 01:54:16 +0000 | [diff] [blame] | 1377 | Expr::EvalResult V2; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1378 | |
Zhongxing Xu | 03509ae | 2010-07-20 06:22:24 +0000 | [diff] [blame] | 1379 | if (const Expr* E = Case->getRHS()) { |
Ted Kremenek | 72afb37 | 2009-01-17 01:54:16 +0000 | [diff] [blame] | 1380 | b = E->Evaluate(V2, getContext()); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1381 | assert(b && V2.Val.isInt() && !V2.HasSideEffects |
Ted Kremenek | 72afb37 | 2009-01-17 01:54:16 +0000 | [diff] [blame] | 1382 | && "Case condition must evaluate to an integer constant."); |
| 1383 | b = b; // silence unused variable warning |
Ted Kremenek | daeb9a7 | 2008-02-13 23:08:21 +0000 | [diff] [blame] | 1384 | } |
Ted Kremenek | 14a1140 | 2008-03-17 22:17:56 +0000 | [diff] [blame] | 1385 | else |
| 1386 | V2 = V1; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1387 | |
Ted Kremenek | daeb9a7 | 2008-02-13 23:08:21 +0000 | [diff] [blame] | 1388 | // FIXME: Eventually we should replace the logic below with a range |
| 1389 | // comparison, rather than concretize the values within the range. |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 1390 | // This should be easy once we have "ranges" for NonLVals. |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1391 | |
Ted Kremenek | 14a1140 | 2008-03-17 22:17:56 +0000 | [diff] [blame] | 1392 | do { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1393 | nonloc::ConcreteInt CaseVal(getBasicVals().getValue(V1.Val.getInt())); |
Ted Kremenek | 9c14953 | 2010-12-01 21:57:22 +0000 | [diff] [blame] | 1394 | DefinedOrUnknownSVal Res = svalBuilder.evalEQ(DefaultSt ? DefaultSt : state, |
Ted Kremenek | 48569f9 | 2010-01-08 18:54:04 +0000 | [diff] [blame] | 1395 | CondV, CaseVal); |
Ted Kremenek | b9bbd59 | 2010-02-15 23:02:46 +0000 | [diff] [blame] | 1396 | |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1397 | // Now "assume" that the case matches. |
Ted Kremenek | 28f47b9 | 2010-12-01 22:16:56 +0000 | [diff] [blame] | 1398 | if (const GRState* stateNew = state->assume(Res, true)) { |
Ted Kremenek | a591bc0 | 2009-06-18 22:57:13 +0000 | [diff] [blame] | 1399 | builder.generateCaseStmtNode(I, stateNew); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1400 | |
Ted Kremenek | daeb9a7 | 2008-02-13 23:08:21 +0000 | [diff] [blame] | 1401 | // If CondV evaluates to a constant, then we know that this |
| 1402 | // is the *only* case that we can take, so stop evaluating the |
| 1403 | // others. |
Zhongxing Xu | 1c96b24 | 2008-10-17 05:57:07 +0000 | [diff] [blame] | 1404 | if (isa<nonloc::ConcreteInt>(CondV)) |
Ted Kremenek | daeb9a7 | 2008-02-13 23:08:21 +0000 | [diff] [blame] | 1405 | return; |
| 1406 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1407 | |
Ted Kremenek | daeb9a7 | 2008-02-13 23:08:21 +0000 | [diff] [blame] | 1408 | // Now "assume" that the case doesn't match. Add this state |
| 1409 | // to the default state (if it is feasible). |
Ted Kremenek | 48569f9 | 2010-01-08 18:54:04 +0000 | [diff] [blame] | 1410 | if (DefaultSt) { |
Ted Kremenek | 28f47b9 | 2010-12-01 22:16:56 +0000 | [diff] [blame] | 1411 | if (const GRState *stateNew = DefaultSt->assume(Res, false)) { |
Ted Kremenek | 48569f9 | 2010-01-08 18:54:04 +0000 | [diff] [blame] | 1412 | defaultIsFeasible = true; |
| 1413 | DefaultSt = stateNew; |
| 1414 | } |
| 1415 | else { |
| 1416 | defaultIsFeasible = false; |
| 1417 | DefaultSt = NULL; |
| 1418 | } |
Ted Kremenek | 5014ab1 | 2008-04-23 05:03:18 +0000 | [diff] [blame] | 1419 | } |
Ted Kremenek | b9bbd59 | 2010-02-15 23:02:46 +0000 | [diff] [blame] | 1420 | |
Ted Kremenek | 14a1140 | 2008-03-17 22:17:56 +0000 | [diff] [blame] | 1421 | // Concretize the next value in the range. |
Ted Kremenek | 72afb37 | 2009-01-17 01:54:16 +0000 | [diff] [blame] | 1422 | if (V1.Val.getInt() == V2.Val.getInt()) |
Ted Kremenek | 14a1140 | 2008-03-17 22:17:56 +0000 | [diff] [blame] | 1423 | break; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1424 | |
Ted Kremenek | 72afb37 | 2009-01-17 01:54:16 +0000 | [diff] [blame] | 1425 | ++V1.Val.getInt(); |
| 1426 | assert (V1.Val.getInt() <= V2.Val.getInt()); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1427 | |
Ted Kremenek | 14a1140 | 2008-03-17 22:17:56 +0000 | [diff] [blame] | 1428 | } while (true); |
Ted Kremenek | daeb9a7 | 2008-02-13 23:08:21 +0000 | [diff] [blame] | 1429 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1430 | |
Ted Kremenek | 4d3175c | 2010-09-09 00:40:40 +0000 | [diff] [blame] | 1431 | if (!defaultIsFeasible) |
| 1432 | return; |
| 1433 | |
| 1434 | // If we have switch(enum value), the default branch is not |
| 1435 | // feasible if all of the enum constants not covered by 'case:' statements |
| 1436 | // are not feasible values for the switch condition. |
| 1437 | // |
| 1438 | // Note that this isn't as accurate as it could be. Even if there isn't |
| 1439 | // a case for a particular enum value as long as that enum value isn't |
| 1440 | // feasible then it shouldn't be considered for making 'default:' reachable. |
| 1441 | const SwitchStmt *SS = builder.getSwitch(); |
| 1442 | const Expr *CondExpr = SS->getCond()->IgnoreParenImpCasts(); |
| 1443 | if (CondExpr->getType()->getAs<EnumType>()) { |
| 1444 | if (SS->isAllEnumCasesCovered()) |
| 1445 | return; |
| 1446 | } |
| 1447 | |
| 1448 | builder.generateDefaultCaseNode(DefaultSt); |
Ted Kremenek | daeb9a7 | 2008-02-13 23:08:21 +0000 | [diff] [blame] | 1449 | } |
| 1450 | |
Douglas Gregor | 102acd5 | 2010-02-25 19:01:53 +0000 | [diff] [blame] | 1451 | void GRExprEngine::ProcessCallEnter(GRCallEnterNodeBuilder &B) { |
Zhongxing Xu | 19b78d9 | 2010-11-24 08:53:20 +0000 | [diff] [blame] | 1452 | const GRState *state = B.getState()->EnterStackFrame(B.getCalleeContext()); |
Ted Kremenek | d048c6e | 2010-12-20 21:19:09 +0000 | [diff] [blame] | 1453 | B.generateNode(state); |
Douglas Gregor | 102acd5 | 2010-02-25 19:01:53 +0000 | [diff] [blame] | 1454 | } |
| 1455 | |
| 1456 | void GRExprEngine::ProcessCallExit(GRCallExitNodeBuilder &B) { |
| 1457 | const GRState *state = B.getState(); |
| 1458 | const ExplodedNode *Pred = B.getPredecessor(); |
Zhongxing Xu | 19b78d9 | 2010-11-24 08:53:20 +0000 | [diff] [blame] | 1459 | const StackFrameContext *calleeCtx = |
Douglas Gregor | 102acd5 | 2010-02-25 19:01:53 +0000 | [diff] [blame] | 1460 | cast<StackFrameContext>(Pred->getLocationContext()); |
Zhongxing Xu | 19b78d9 | 2010-11-24 08:53:20 +0000 | [diff] [blame] | 1461 | const Stmt *CE = calleeCtx->getCallSite(); |
Douglas Gregor | 102acd5 | 2010-02-25 19:01:53 +0000 | [diff] [blame] | 1462 | |
Zhongxing Xu | 6190ec2 | 2010-02-26 15:43:34 +0000 | [diff] [blame] | 1463 | // If the callee returns an expression, bind its value to CallExpr. |
| 1464 | const Stmt *ReturnedExpr = state->get<ReturnExpr>(); |
| 1465 | if (ReturnedExpr) { |
| 1466 | SVal RetVal = state->getSVal(ReturnedExpr); |
| 1467 | state = state->BindExpr(CE, RetVal); |
Zhongxing Xu | bd2b208 | 2010-03-23 08:09:29 +0000 | [diff] [blame] | 1468 | // Clear the return expr GDM. |
Zhongxing Xu | 0541d10 | 2010-03-25 01:39:39 +0000 | [diff] [blame] | 1469 | state = state->remove<ReturnExpr>(); |
Zhongxing Xu | 6190ec2 | 2010-02-26 15:43:34 +0000 | [diff] [blame] | 1470 | } |
| 1471 | |
Zhongxing Xu | 8e18c1b | 2010-03-23 09:13:17 +0000 | [diff] [blame] | 1472 | // Bind the constructed object value to CXXConstructExpr. |
| 1473 | if (const CXXConstructExpr *CCE = dyn_cast<CXXConstructExpr>(CE)) { |
Zhongxing Xu | 9dc84c9 | 2010-11-16 07:52:17 +0000 | [diff] [blame] | 1474 | const CXXThisRegion *ThisR = |
Zhongxing Xu | 19b78d9 | 2010-11-24 08:53:20 +0000 | [diff] [blame] | 1475 | getCXXThisRegion(CCE->getConstructor()->getParent(), calleeCtx); |
Zhongxing Xu | d706434 | 2010-11-24 13:08:51 +0000 | [diff] [blame] | 1476 | |
Zhongxing Xu | 8e18c1b | 2010-03-23 09:13:17 +0000 | [diff] [blame] | 1477 | SVal ThisV = state->getSVal(ThisR); |
Zhongxing Xu | 05e5391 | 2010-12-22 07:20:27 +0000 | [diff] [blame] | 1478 | // Always bind the region to the CXXConstructExpr. |
| 1479 | state = state->BindExpr(CCE, ThisV); |
Zhongxing Xu | 8e18c1b | 2010-03-23 09:13:17 +0000 | [diff] [blame] | 1480 | } |
| 1481 | |
Ted Kremenek | d048c6e | 2010-12-20 21:19:09 +0000 | [diff] [blame] | 1482 | B.generateNode(state); |
Douglas Gregor | 102acd5 | 2010-02-25 19:01:53 +0000 | [diff] [blame] | 1483 | } |
| 1484 | |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 1485 | //===----------------------------------------------------------------------===// |
| 1486 | // Transfer functions: logical operations ('&&', '||'). |
| 1487 | //===----------------------------------------------------------------------===// |
Ted Kremenek | daeb9a7 | 2008-02-13 23:08:21 +0000 | [diff] [blame] | 1488 | |
Zhongxing Xu | 03509ae | 2010-07-20 06:22:24 +0000 | [diff] [blame] | 1489 | void GRExprEngine::VisitLogicalExpr(const BinaryOperator* B, ExplodedNode* Pred, |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 1490 | ExplodedNodeSet& Dst) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1491 | |
John McCall | 2de56d1 | 2010-08-25 11:45:40 +0000 | [diff] [blame] | 1492 | assert(B->getOpcode() == BO_LAnd || |
| 1493 | B->getOpcode() == BO_LOr); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1494 | |
Ted Kremenek | 0a3ed31 | 2010-12-17 04:44:39 +0000 | [diff] [blame] | 1495 | assert(B==currentStmt && Pred->getLocationContext()->getCFG()->isBlkExpr(B)); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1496 | |
Ted Kremenek | a8538d9 | 2009-02-13 01:45:31 +0000 | [diff] [blame] | 1497 | const GRState* state = GetState(Pred); |
Ted Kremenek | 1397663 | 2010-02-08 16:18:51 +0000 | [diff] [blame] | 1498 | SVal X = state->getSVal(B); |
Ted Kremenek | 3ff1259 | 2009-06-19 17:10:32 +0000 | [diff] [blame] | 1499 | assert(X.isUndef()); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1500 | |
Ted Kremenek | 5b9bd21 | 2009-09-11 22:07:28 +0000 | [diff] [blame] | 1501 | const Expr *Ex = (const Expr*) cast<UndefinedVal>(X).getData(); |
Ted Kremenek | 3ff1259 | 2009-06-19 17:10:32 +0000 | [diff] [blame] | 1502 | assert(Ex); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1503 | |
Ted Kremenek | 05a2378 | 2008-02-26 19:05:15 +0000 | [diff] [blame] | 1504 | if (Ex == B->getRHS()) { |
Ted Kremenek | 1397663 | 2010-02-08 16:18:51 +0000 | [diff] [blame] | 1505 | X = state->getSVal(Ex); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1506 | |
Ted Kremenek | 4a4e524 | 2008-02-28 09:25:22 +0000 | [diff] [blame] | 1507 | // Handle undefined values. |
Ted Kremenek | 4a4e524 | 2008-02-28 09:25:22 +0000 | [diff] [blame] | 1508 | if (X.isUndef()) { |
Ted Kremenek | 8e02934 | 2009-08-27 22:17:37 +0000 | [diff] [blame] | 1509 | MakeNode(Dst, B, Pred, state->BindExpr(B, X)); |
Ted Kremenek | 58b3321 | 2008-02-26 19:40:44 +0000 | [diff] [blame] | 1510 | return; |
| 1511 | } |
Ted Kremenek | b9bbd59 | 2010-02-15 23:02:46 +0000 | [diff] [blame] | 1512 | |
Ted Kremenek | 5b9bd21 | 2009-09-11 22:07:28 +0000 | [diff] [blame] | 1513 | DefinedOrUnknownSVal XD = cast<DefinedOrUnknownSVal>(X); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1514 | |
Ted Kremenek | 05a2378 | 2008-02-26 19:05:15 +0000 | [diff] [blame] | 1515 | // We took the RHS. Because the value of the '&&' or '||' expression must |
| 1516 | // evaluate to 0 or 1, we must assume the value of the RHS evaluates to 0 |
| 1517 | // or 1. Alternatively, we could take a lazy approach, and calculate this |
| 1518 | // value later when necessary. We don't have the machinery in place for |
| 1519 | // this right now, and since most logical expressions are used for branches, |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1520 | // the payoff is not likely to be large. Instead, we do eager evaluation. |
Ted Kremenek | 28f47b9 | 2010-12-01 22:16:56 +0000 | [diff] [blame] | 1521 | if (const GRState *newState = state->assume(XD, true)) |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1522 | MakeNode(Dst, B, Pred, |
Ted Kremenek | c8413fd | 2010-12-02 07:49:45 +0000 | [diff] [blame] | 1523 | newState->BindExpr(B, svalBuilder.makeIntVal(1U, B->getType()))); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1524 | |
Ted Kremenek | 28f47b9 | 2010-12-01 22:16:56 +0000 | [diff] [blame] | 1525 | if (const GRState *newState = state->assume(XD, false)) |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1526 | MakeNode(Dst, B, Pred, |
Ted Kremenek | c8413fd | 2010-12-02 07:49:45 +0000 | [diff] [blame] | 1527 | newState->BindExpr(B, svalBuilder.makeIntVal(0U, B->getType()))); |
Ted Kremenek | f233d48 | 2008-02-05 00:26:40 +0000 | [diff] [blame] | 1528 | } |
| 1529 | else { |
Ted Kremenek | 05a2378 | 2008-02-26 19:05:15 +0000 | [diff] [blame] | 1530 | // We took the LHS expression. Depending on whether we are '&&' or |
| 1531 | // '||' we know what the value of the expression is via properties of |
| 1532 | // the short-circuiting. |
Ted Kremenek | c8413fd | 2010-12-02 07:49:45 +0000 | [diff] [blame] | 1533 | X = svalBuilder.makeIntVal(B->getOpcode() == BO_LAnd ? 0U : 1U, |
Zhongxing Xu | d91ee27 | 2009-06-23 09:02:15 +0000 | [diff] [blame] | 1534 | B->getType()); |
Ted Kremenek | 8e02934 | 2009-08-27 22:17:37 +0000 | [diff] [blame] | 1535 | MakeNode(Dst, B, Pred, state->BindExpr(B, X)); |
Ted Kremenek | f233d48 | 2008-02-05 00:26:40 +0000 | [diff] [blame] | 1536 | } |
Ted Kremenek | f233d48 | 2008-02-05 00:26:40 +0000 | [diff] [blame] | 1537 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1538 | |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 1539 | //===----------------------------------------------------------------------===// |
Ted Kremenek | ec96a2d | 2008-04-16 18:39:06 +0000 | [diff] [blame] | 1540 | // Transfer functions: Loads and stores. |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 1541 | //===----------------------------------------------------------------------===// |
Ted Kremenek | d27f816 | 2008-01-15 23:55:06 +0000 | [diff] [blame] | 1542 | |
Zhongxing Xu | 03509ae | 2010-07-20 06:22:24 +0000 | [diff] [blame] | 1543 | void GRExprEngine::VisitBlockExpr(const BlockExpr *BE, ExplodedNode *Pred, |
Ted Kremenek | c95ad9f | 2009-11-25 01:33:13 +0000 | [diff] [blame] | 1544 | ExplodedNodeSet &Dst) { |
Ted Kremenek | b9bbd59 | 2010-02-15 23:02:46 +0000 | [diff] [blame] | 1545 | |
Ted Kremenek | 6607861 | 2009-11-25 22:23:25 +0000 | [diff] [blame] | 1546 | ExplodedNodeSet Tmp; |
Ted Kremenek | b9bbd59 | 2010-02-15 23:02:46 +0000 | [diff] [blame] | 1547 | |
Ted Kremenek | c95ad9f | 2009-11-25 01:33:13 +0000 | [diff] [blame] | 1548 | CanQualType T = getContext().getCanonicalType(BE->getType()); |
Ted Kremenek | c8413fd | 2010-12-02 07:49:45 +0000 | [diff] [blame] | 1549 | SVal V = svalBuilder.getBlockPointer(BE->getBlockDecl(), T, |
Ted Kremenek | 0a8112a | 2009-11-25 23:53:07 +0000 | [diff] [blame] | 1550 | Pred->getLocationContext()); |
| 1551 | |
Ted Kremenek | 6607861 | 2009-11-25 22:23:25 +0000 | [diff] [blame] | 1552 | MakeNode(Tmp, BE, Pred, GetState(Pred)->BindExpr(BE, V), |
Ted Kremenek | c95ad9f | 2009-11-25 01:33:13 +0000 | [diff] [blame] | 1553 | ProgramPoint::PostLValueKind); |
Ted Kremenek | b9bbd59 | 2010-02-15 23:02:46 +0000 | [diff] [blame] | 1554 | |
Ted Kremenek | 6607861 | 2009-11-25 22:23:25 +0000 | [diff] [blame] | 1555 | // Post-visit the BlockExpr. |
Jordy Rose | 72905cf | 2010-08-04 07:10:57 +0000 | [diff] [blame] | 1556 | CheckerVisit(BE, Dst, Tmp, PostVisitStmtCallback); |
Ted Kremenek | c95ad9f | 2009-11-25 01:33:13 +0000 | [diff] [blame] | 1557 | } |
| 1558 | |
Zhongxing Xu | 03509ae | 2010-07-20 06:22:24 +0000 | [diff] [blame] | 1559 | void GRExprEngine::VisitCommonDeclRefExpr(const Expr *Ex, const NamedDecl *D, |
Ted Kremenek | 67d1287 | 2009-12-07 22:05:27 +0000 | [diff] [blame] | 1560 | ExplodedNode *Pred, |
Ted Kremenek | 892697d | 2010-12-16 07:46:53 +0000 | [diff] [blame] | 1561 | ExplodedNodeSet &Dst) { |
Ted Kremenek | 5b9bd21 | 2009-09-11 22:07:28 +0000 | [diff] [blame] | 1562 | const GRState *state = GetState(Pred); |
Zhongxing Xu | 6d69b5d | 2008-10-16 06:09:51 +0000 | [diff] [blame] | 1563 | |
| 1564 | if (const VarDecl* VD = dyn_cast<VarDecl>(D)) { |
Ted Kremenek | 892697d | 2010-12-16 07:46:53 +0000 | [diff] [blame] | 1565 | assert(Ex->isLValue()); |
Ted Kremenek | d17da2b | 2009-08-21 22:28:32 +0000 | [diff] [blame] | 1566 | SVal V = state->getLValue(VD, Pred->getLocationContext()); |
Zhongxing Xu | a758173 | 2008-10-17 02:20:14 +0000 | [diff] [blame] | 1567 | |
Ted Kremenek | 892697d | 2010-12-16 07:46:53 +0000 | [diff] [blame] | 1568 | // For references, the 'lvalue' is the pointer address stored in the |
| 1569 | // reference region. |
| 1570 | if (VD->getType()->isReferenceType()) { |
| 1571 | if (const MemRegion *R = V.getAsRegion()) |
| 1572 | V = state->getSVal(R); |
| 1573 | else |
| 1574 | V = UnknownVal(); |
Ted Kremenek | 852274d | 2009-12-16 03:18:58 +0000 | [diff] [blame] | 1575 | } |
Zhongxing Xu | 6d69b5d | 2008-10-16 06:09:51 +0000 | [diff] [blame] | 1576 | |
Ted Kremenek | 892697d | 2010-12-16 07:46:53 +0000 | [diff] [blame] | 1577 | MakeNode(Dst, Ex, Pred, state->BindExpr(Ex, V), |
| 1578 | ProgramPoint::PostLValueKind); |
Ted Kremenek | 852274d | 2009-12-16 03:18:58 +0000 | [diff] [blame] | 1579 | return; |
Ted Kremenek | 892697d | 2010-12-16 07:46:53 +0000 | [diff] [blame] | 1580 | } |
| 1581 | if (const EnumConstantDecl* ED = dyn_cast<EnumConstantDecl>(D)) { |
| 1582 | assert(!Ex->isLValue()); |
Ted Kremenek | c8413fd | 2010-12-02 07:49:45 +0000 | [diff] [blame] | 1583 | SVal V = svalBuilder.makeIntVal(ED->getInitVal()); |
Ted Kremenek | 8e02934 | 2009-08-27 22:17:37 +0000 | [diff] [blame] | 1584 | MakeNode(Dst, Ex, Pred, state->BindExpr(Ex, V)); |
Zhongxing Xu | 6d69b5d | 2008-10-16 06:09:51 +0000 | [diff] [blame] | 1585 | return; |
Ted Kremenek | 892697d | 2010-12-16 07:46:53 +0000 | [diff] [blame] | 1586 | } |
| 1587 | if (const FunctionDecl* FD = dyn_cast<FunctionDecl>(D)) { |
Ted Kremenek | c8413fd | 2010-12-02 07:49:45 +0000 | [diff] [blame] | 1588 | SVal V = svalBuilder.getFunctionPointer(FD); |
Ted Kremenek | 8e02934 | 2009-08-27 22:17:37 +0000 | [diff] [blame] | 1589 | MakeNode(Dst, Ex, Pred, state->BindExpr(Ex, V), |
Ted Kremenek | 7090d54 | 2009-05-07 18:27:16 +0000 | [diff] [blame] | 1590 | ProgramPoint::PostLValueKind); |
Zhongxing Xu | 6d69b5d | 2008-10-16 06:09:51 +0000 | [diff] [blame] | 1591 | return; |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 1592 | } |
Zhongxing Xu | 6d69b5d | 2008-10-16 06:09:51 +0000 | [diff] [blame] | 1593 | assert (false && |
| 1594 | "ValueDecl support for this ValueDecl not implemented."); |
Ted Kremenek | 3271f8d | 2008-02-07 04:16:04 +0000 | [diff] [blame] | 1595 | } |
| 1596 | |
Ted Kremenek | 540cbe2 | 2008-04-22 04:56:29 +0000 | [diff] [blame] | 1597 | /// VisitArraySubscriptExpr - Transfer function for array accesses |
Ted Kremenek | 892697d | 2010-12-16 07:46:53 +0000 | [diff] [blame] | 1598 | void GRExprEngine::VisitLvalArraySubscriptExpr(const ArraySubscriptExpr* A, |
| 1599 | ExplodedNode* Pred, |
| 1600 | ExplodedNodeSet& Dst){ |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1601 | |
Zhongxing Xu | 03509ae | 2010-07-20 06:22:24 +0000 | [diff] [blame] | 1602 | const Expr* Base = A->getBase()->IgnoreParens(); |
| 1603 | const Expr* Idx = A->getIdx()->IgnoreParens(); |
Ted Kremenek | 892697d | 2010-12-16 07:46:53 +0000 | [diff] [blame] | 1604 | |
| 1605 | // Evaluate the base. |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 1606 | ExplodedNodeSet Tmp; |
Ted Kremenek | 892697d | 2010-12-16 07:46:53 +0000 | [diff] [blame] | 1607 | Visit(Base, Pred, Tmp); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1608 | |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 1609 | for (ExplodedNodeSet::iterator I1=Tmp.begin(), E1=Tmp.end(); I1!=E1; ++I1) { |
| 1610 | ExplodedNodeSet Tmp2; |
Ted Kremenek | d9bc33e | 2008-10-17 00:51:01 +0000 | [diff] [blame] | 1611 | Visit(Idx, *I1, Tmp2); // Evaluate the index. |
Zhongxing Xu | d694485 | 2009-11-11 13:42:54 +0000 | [diff] [blame] | 1612 | ExplodedNodeSet Tmp3; |
Jordy Rose | 72905cf | 2010-08-04 07:10:57 +0000 | [diff] [blame] | 1613 | CheckerVisit(A, Tmp3, Tmp2, PreVisitStmtCallback); |
Zhongxing Xu | d694485 | 2009-11-11 13:42:54 +0000 | [diff] [blame] | 1614 | |
| 1615 | for (ExplodedNodeSet::iterator I2=Tmp3.begin(),E2=Tmp3.end();I2!=E2; ++I2) { |
Ted Kremenek | a8538d9 | 2009-02-13 01:45:31 +0000 | [diff] [blame] | 1616 | const GRState* state = GetState(*I2); |
Ted Kremenek | 1397663 | 2010-02-08 16:18:51 +0000 | [diff] [blame] | 1617 | SVal V = state->getLValue(A->getType(), state->getSVal(Idx), |
| 1618 | state->getSVal(Base)); |
Ted Kremenek | 892697d | 2010-12-16 07:46:53 +0000 | [diff] [blame] | 1619 | assert(A->isLValue()); |
| 1620 | MakeNode(Dst, A, *I2, state->BindExpr(A, V), ProgramPoint::PostLValueKind); |
Ted Kremenek | 4d0348b | 2008-04-29 23:24:44 +0000 | [diff] [blame] | 1621 | } |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 1622 | } |
Ted Kremenek | 540cbe2 | 2008-04-22 04:56:29 +0000 | [diff] [blame] | 1623 | } |
| 1624 | |
Ted Kremenek | 469ecbd | 2008-04-21 23:43:38 +0000 | [diff] [blame] | 1625 | /// VisitMemberExpr - Transfer function for member expressions. |
Zhongxing Xu | 03509ae | 2010-07-20 06:22:24 +0000 | [diff] [blame] | 1626 | void GRExprEngine::VisitMemberExpr(const MemberExpr* M, ExplodedNode* Pred, |
Ted Kremenek | 892697d | 2010-12-16 07:46:53 +0000 | [diff] [blame] | 1627 | ExplodedNodeSet& Dst) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1628 | |
Ted Kremenek | 892697d | 2010-12-16 07:46:53 +0000 | [diff] [blame] | 1629 | Expr *baseExpr = M->getBase()->IgnoreParens(); |
| 1630 | ExplodedNodeSet dstBase; |
| 1631 | Visit(baseExpr, Pred, dstBase); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1632 | |
Ted Kremenek | 892697d | 2010-12-16 07:46:53 +0000 | [diff] [blame] | 1633 | FieldDecl *field = dyn_cast<FieldDecl>(M->getMemberDecl()); |
| 1634 | if (!field) // FIXME: skipping member expressions for non-fields |
Douglas Gregor | 86f1940 | 2008-12-20 23:49:58 +0000 | [diff] [blame] | 1635 | return; |
| 1636 | |
Ted Kremenek | 892697d | 2010-12-16 07:46:53 +0000 | [diff] [blame] | 1637 | for (ExplodedNodeSet::iterator I = dstBase.begin(), E = dstBase.end(); |
| 1638 | I != E; ++I) { |
Ted Kremenek | a8538d9 | 2009-02-13 01:45:31 +0000 | [diff] [blame] | 1639 | const GRState* state = GetState(*I); |
Ted Kremenek | 892697d | 2010-12-16 07:46:53 +0000 | [diff] [blame] | 1640 | SVal baseExprVal = state->getSVal(baseExpr); |
| 1641 | if (isa<nonloc::LazyCompoundVal>(baseExprVal) || |
| 1642 | isa<nonloc::CompoundVal>(baseExprVal)) { |
| 1643 | MakeNode(Dst, M, *I, state->BindExpr(M, UnknownVal())); |
| 1644 | continue; |
| 1645 | } |
| 1646 | |
Ted Kremenek | d9bc33e | 2008-10-17 00:51:01 +0000 | [diff] [blame] | 1647 | // FIXME: Should we insert some assumption logic in here to determine |
| 1648 | // if "Base" is a valid piece of memory? Before we put this assumption |
Douglas Gregor | 86f1940 | 2008-12-20 23:49:58 +0000 | [diff] [blame] | 1649 | // later when using FieldOffset lvals (which we no longer have). |
Ted Kremenek | d9bc33e | 2008-10-17 00:51:01 +0000 | [diff] [blame] | 1650 | |
Ted Kremenek | 892697d | 2010-12-16 07:46:53 +0000 | [diff] [blame] | 1651 | // For all other cases, compute an lvalue. |
| 1652 | SVal L = state->getLValue(field, baseExprVal); |
| 1653 | if (M->isLValue()) |
Zhongxing Xu | 662174ca | 2009-10-30 07:19:39 +0000 | [diff] [blame] | 1654 | MakeNode(Dst, M, *I, state->BindExpr(M, L), ProgramPoint::PostLValueKind); |
| 1655 | else |
Ted Kremenek | 9c14953 | 2010-12-01 21:57:22 +0000 | [diff] [blame] | 1656 | evalLoad(Dst, M, *I, state, L); |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 1657 | } |
Ted Kremenek | 469ecbd | 2008-04-21 23:43:38 +0000 | [diff] [blame] | 1658 | } |
| 1659 | |
Ted Kremenek | 9c14953 | 2010-12-01 21:57:22 +0000 | [diff] [blame] | 1660 | /// evalBind - Handle the semantics of binding a value to a specific location. |
| 1661 | /// This method is used by evalStore and (soon) VisitDeclStmt, and others. |
| 1662 | void GRExprEngine::evalBind(ExplodedNodeSet& Dst, const Stmt* StoreE, |
Ted Kremenek | 79d7304 | 2010-09-02 00:56:20 +0000 | [diff] [blame] | 1663 | ExplodedNode* Pred, const GRState* state, |
| 1664 | SVal location, SVal Val, bool atDeclInit) { |
Ted Kremenek | b9bbd59 | 2010-02-15 23:02:46 +0000 | [diff] [blame] | 1665 | |
| 1666 | |
Ted Kremenek | b107c4b | 2009-11-04 04:24:16 +0000 | [diff] [blame] | 1667 | // Do a previsit of the bind. |
| 1668 | ExplodedNodeSet CheckedSet, Src; |
| 1669 | Src.Add(Pred); |
Ted Kremenek | 79d7304 | 2010-09-02 00:56:20 +0000 | [diff] [blame] | 1670 | CheckerVisitBind(StoreE, CheckedSet, Src, location, Val, true); |
Ted Kremenek | b9bbd59 | 2010-02-15 23:02:46 +0000 | [diff] [blame] | 1671 | |
Ted Kremenek | b107c4b | 2009-11-04 04:24:16 +0000 | [diff] [blame] | 1672 | for (ExplodedNodeSet::iterator I = CheckedSet.begin(), E = CheckedSet.end(); |
| 1673 | I!=E; ++I) { |
Ted Kremenek | b9bbd59 | 2010-02-15 23:02:46 +0000 | [diff] [blame] | 1674 | |
Ted Kremenek | b107c4b | 2009-11-04 04:24:16 +0000 | [diff] [blame] | 1675 | if (Pred != *I) |
| 1676 | state = GetState(*I); |
Ted Kremenek | b9bbd59 | 2010-02-15 23:02:46 +0000 | [diff] [blame] | 1677 | |
Ted Kremenek | b107c4b | 2009-11-04 04:24:16 +0000 | [diff] [blame] | 1678 | const GRState* newState = 0; |
Ted Kremenek | a8538d9 | 2009-02-13 01:45:31 +0000 | [diff] [blame] | 1679 | |
Ted Kremenek | b107c4b | 2009-11-04 04:24:16 +0000 | [diff] [blame] | 1680 | if (atDeclInit) { |
| 1681 | const VarRegion *VR = |
| 1682 | cast<VarRegion>(cast<loc::MemRegionVal>(location).getRegion()); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1683 | |
Ted Kremenek | b107c4b | 2009-11-04 04:24:16 +0000 | [diff] [blame] | 1684 | newState = state->bindDecl(VR, Val); |
Ted Kremenek | f6f56d4 | 2009-11-04 00:09:15 +0000 | [diff] [blame] | 1685 | } |
| 1686 | else { |
Ted Kremenek | b107c4b | 2009-11-04 04:24:16 +0000 | [diff] [blame] | 1687 | if (location.isUnknown()) { |
| 1688 | // We know that the new state will be the same as the old state since |
| 1689 | // the location of the binding is "unknown". Consequently, there |
| 1690 | // is no reason to just create a new node. |
| 1691 | newState = state; |
| 1692 | } |
| 1693 | else { |
| 1694 | // We are binding to a value other than 'unknown'. Perform the binding |
| 1695 | // using the StoreManager. |
| 1696 | newState = state->bindLoc(cast<Loc>(location), Val); |
| 1697 | } |
Ted Kremenek | f6f56d4 | 2009-11-04 00:09:15 +0000 | [diff] [blame] | 1698 | } |
Ted Kremenek | b107c4b | 2009-11-04 04:24:16 +0000 | [diff] [blame] | 1699 | |
| 1700 | // The next thing to do is check if the GRTransferFuncs object wants to |
| 1701 | // update the state based on the new binding. If the GRTransferFunc object |
| 1702 | // doesn't do anything, just auto-propagate the current state. |
Ted Kremenek | 79d7304 | 2010-09-02 00:56:20 +0000 | [diff] [blame] | 1703 | |
| 1704 | // NOTE: We use 'AssignE' for the location of the PostStore if 'AssignE' |
| 1705 | // is non-NULL. Checkers typically care about |
| 1706 | |
Ted Kremenek | 50ecd15 | 2009-11-05 00:42:23 +0000 | [diff] [blame] | 1707 | GRStmtNodeBuilderRef BuilderRef(Dst, *Builder, *this, *I, newState, StoreE, |
Ted Kremenek | 96ebad6 | 2010-09-09 07:13:00 +0000 | [diff] [blame] | 1708 | true); |
Ted Kremenek | b107c4b | 2009-11-04 04:24:16 +0000 | [diff] [blame] | 1709 | |
Ted Kremenek | 9c14953 | 2010-12-01 21:57:22 +0000 | [diff] [blame] | 1710 | getTF().evalBind(BuilderRef, location, Val); |
Ted Kremenek | 41573eb | 2009-02-14 01:43:44 +0000 | [diff] [blame] | 1711 | } |
Ted Kremenek | a8538d9 | 2009-02-13 01:45:31 +0000 | [diff] [blame] | 1712 | } |
| 1713 | |
Ted Kremenek | 9c14953 | 2010-12-01 21:57:22 +0000 | [diff] [blame] | 1714 | /// evalStore - Handle the semantics of a store via an assignment. |
Ted Kremenek | a8538d9 | 2009-02-13 01:45:31 +0000 | [diff] [blame] | 1715 | /// @param Dst The node set to store generated state nodes |
Zhongxing Xu | e8a4d7d | 2010-09-02 01:56:39 +0000 | [diff] [blame] | 1716 | /// @param AssignE The assignment expression if the store happens in an |
| 1717 | /// assignment. |
| 1718 | /// @param LocatioinE The location expression that is stored to. |
Ted Kremenek | a8538d9 | 2009-02-13 01:45:31 +0000 | [diff] [blame] | 1719 | /// @param state The current simulation state |
| 1720 | /// @param location The location to store the value |
| 1721 | /// @param Val The value to be stored |
Ted Kremenek | 9c14953 | 2010-12-01 21:57:22 +0000 | [diff] [blame] | 1722 | void GRExprEngine::evalStore(ExplodedNodeSet& Dst, const Expr *AssignE, |
Ted Kremenek | 79d7304 | 2010-09-02 00:56:20 +0000 | [diff] [blame] | 1723 | const Expr* LocationE, |
Ted Kremenek | 50ecd15 | 2009-11-05 00:42:23 +0000 | [diff] [blame] | 1724 | ExplodedNode* Pred, |
Ted Kremenek | 1670e40 | 2009-04-11 00:11:10 +0000 | [diff] [blame] | 1725 | const GRState* state, SVal location, SVal Val, |
| 1726 | const void *tag) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1727 | |
Ted Kremenek | 50ecd15 | 2009-11-05 00:42:23 +0000 | [diff] [blame] | 1728 | assert(Builder && "GRStmtNodeBuilder must be defined."); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1729 | |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 1730 | // Evaluate the location (checks for bad dereferences). |
Ted Kremenek | b4b817d | 2009-11-11 03:26:34 +0000 | [diff] [blame] | 1731 | ExplodedNodeSet Tmp; |
Ted Kremenek | 9c14953 | 2010-12-01 21:57:22 +0000 | [diff] [blame] | 1732 | evalLocation(Tmp, LocationE, Pred, state, location, tag, false); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1733 | |
Ted Kremenek | b4b817d | 2009-11-11 03:26:34 +0000 | [diff] [blame] | 1734 | if (Tmp.empty()) |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 1735 | return; |
Ted Kremenek | b053396 | 2008-04-18 20:35:30 +0000 | [diff] [blame] | 1736 | |
Ted Kremenek | b4b817d | 2009-11-11 03:26:34 +0000 | [diff] [blame] | 1737 | assert(!location.isUndef()); |
Ted Kremenek | a8538d9 | 2009-02-13 01:45:31 +0000 | [diff] [blame] | 1738 | |
Ted Kremenek | b4b817d | 2009-11-11 03:26:34 +0000 | [diff] [blame] | 1739 | SaveAndRestore<ProgramPoint::Kind> OldSPointKind(Builder->PointKind, |
| 1740 | ProgramPoint::PostStoreKind); |
| 1741 | SaveAndRestore<const void*> OldTag(Builder->Tag, tag); |
Ted Kremenek | b9bbd59 | 2010-02-15 23:02:46 +0000 | [diff] [blame] | 1742 | |
Ted Kremenek | 79d7304 | 2010-09-02 00:56:20 +0000 | [diff] [blame] | 1743 | // Proceed with the store. We use AssignE as the anchor for the PostStore |
| 1744 | // ProgramPoint if it is non-NULL, and LocationE otherwise. |
| 1745 | const Expr *StoreE = AssignE ? AssignE : LocationE; |
| 1746 | |
Ted Kremenek | b4b817d | 2009-11-11 03:26:34 +0000 | [diff] [blame] | 1747 | for (ExplodedNodeSet::iterator NI=Tmp.begin(), NE=Tmp.end(); NI!=NE; ++NI) |
Ted Kremenek | 9c14953 | 2010-12-01 21:57:22 +0000 | [diff] [blame] | 1748 | evalBind(Dst, StoreE, *NI, GetState(*NI), location, Val); |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 1749 | } |
| 1750 | |
Ted Kremenek | 9c14953 | 2010-12-01 21:57:22 +0000 | [diff] [blame] | 1751 | void GRExprEngine::evalLoad(ExplodedNodeSet& Dst, const Expr *Ex, |
Zhongxing Xu | 3992a50 | 2010-07-20 02:41:28 +0000 | [diff] [blame] | 1752 | ExplodedNode* Pred, |
Ted Kremenek | 1670e40 | 2009-04-11 00:11:10 +0000 | [diff] [blame] | 1753 | const GRState* state, SVal location, |
Zhongxing Xu | 652be34 | 2009-11-16 04:49:44 +0000 | [diff] [blame] | 1754 | const void *tag, QualType LoadTy) { |
Zhanyong Wan | cca8ab1 | 2010-11-24 01:47:11 +0000 | [diff] [blame] | 1755 | assert(!isa<NonLoc>(location) && "location cannot be a NonLoc."); |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 1756 | |
Ted Kremenek | 852274d | 2009-12-16 03:18:58 +0000 | [diff] [blame] | 1757 | // Are we loading from a region? This actually results in two loads; one |
| 1758 | // to fetch the address of the referenced value and one to fetch the |
| 1759 | // referenced value. |
Ted Kremenek | b9bbd59 | 2010-02-15 23:02:46 +0000 | [diff] [blame] | 1760 | if (const TypedRegion *TR = |
Ted Kremenek | 852274d | 2009-12-16 03:18:58 +0000 | [diff] [blame] | 1761 | dyn_cast_or_null<TypedRegion>(location.getAsRegion())) { |
Ted Kremenek | b9bbd59 | 2010-02-15 23:02:46 +0000 | [diff] [blame] | 1762 | |
Zhongxing Xu | 018220c | 2010-08-11 06:10:55 +0000 | [diff] [blame] | 1763 | QualType ValTy = TR->getValueType(); |
Ted Kremenek | 852274d | 2009-12-16 03:18:58 +0000 | [diff] [blame] | 1764 | if (const ReferenceType *RT = ValTy->getAs<ReferenceType>()) { |
Ted Kremenek | b9bbd59 | 2010-02-15 23:02:46 +0000 | [diff] [blame] | 1765 | static int loadReferenceTag = 0; |
Ted Kremenek | 852274d | 2009-12-16 03:18:58 +0000 | [diff] [blame] | 1766 | ExplodedNodeSet Tmp; |
Ted Kremenek | 9c14953 | 2010-12-01 21:57:22 +0000 | [diff] [blame] | 1767 | evalLoadCommon(Tmp, Ex, Pred, state, location, &loadReferenceTag, |
Ted Kremenek | 852274d | 2009-12-16 03:18:58 +0000 | [diff] [blame] | 1768 | getContext().getPointerType(RT->getPointeeType())); |
| 1769 | |
| 1770 | // Perform the load from the referenced value. |
| 1771 | for (ExplodedNodeSet::iterator I=Tmp.begin(), E=Tmp.end() ; I!=E; ++I) { |
| 1772 | state = GetState(*I); |
Ted Kremenek | 1397663 | 2010-02-08 16:18:51 +0000 | [diff] [blame] | 1773 | location = state->getSVal(Ex); |
Ted Kremenek | 9c14953 | 2010-12-01 21:57:22 +0000 | [diff] [blame] | 1774 | evalLoadCommon(Dst, Ex, *I, state, location, tag, LoadTy); |
Ted Kremenek | b9bbd59 | 2010-02-15 23:02:46 +0000 | [diff] [blame] | 1775 | } |
Ted Kremenek | 852274d | 2009-12-16 03:18:58 +0000 | [diff] [blame] | 1776 | return; |
| 1777 | } |
| 1778 | } |
Ted Kremenek | b9bbd59 | 2010-02-15 23:02:46 +0000 | [diff] [blame] | 1779 | |
Ted Kremenek | 9c14953 | 2010-12-01 21:57:22 +0000 | [diff] [blame] | 1780 | evalLoadCommon(Dst, Ex, Pred, state, location, tag, LoadTy); |
Ted Kremenek | 852274d | 2009-12-16 03:18:58 +0000 | [diff] [blame] | 1781 | } |
| 1782 | |
Ted Kremenek | 9c14953 | 2010-12-01 21:57:22 +0000 | [diff] [blame] | 1783 | void GRExprEngine::evalLoadCommon(ExplodedNodeSet& Dst, const Expr *Ex, |
Ted Kremenek | 852274d | 2009-12-16 03:18:58 +0000 | [diff] [blame] | 1784 | ExplodedNode* Pred, |
| 1785 | const GRState* state, SVal location, |
| 1786 | const void *tag, QualType LoadTy) { |
Ted Kremenek | b9bbd59 | 2010-02-15 23:02:46 +0000 | [diff] [blame] | 1787 | |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1788 | // Evaluate the location (checks for bad dereferences). |
Ted Kremenek | b4b817d | 2009-11-11 03:26:34 +0000 | [diff] [blame] | 1789 | ExplodedNodeSet Tmp; |
Ted Kremenek | 9c14953 | 2010-12-01 21:57:22 +0000 | [diff] [blame] | 1790 | evalLocation(Tmp, Ex, Pred, state, location, tag, true); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1791 | |
Ted Kremenek | b4b817d | 2009-11-11 03:26:34 +0000 | [diff] [blame] | 1792 | if (Tmp.empty()) |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 1793 | return; |
Ted Kremenek | b9bbd59 | 2010-02-15 23:02:46 +0000 | [diff] [blame] | 1794 | |
Ted Kremenek | b4b817d | 2009-11-11 03:26:34 +0000 | [diff] [blame] | 1795 | assert(!location.isUndef()); |
Ted Kremenek | b9bbd59 | 2010-02-15 23:02:46 +0000 | [diff] [blame] | 1796 | |
Ted Kremenek | b4b817d | 2009-11-11 03:26:34 +0000 | [diff] [blame] | 1797 | SaveAndRestore<ProgramPoint::Kind> OldSPointKind(Builder->PointKind); |
| 1798 | SaveAndRestore<const void*> OldTag(Builder->Tag); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1799 | |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 1800 | // Proceed with the load. |
Ted Kremenek | b4b817d | 2009-11-11 03:26:34 +0000 | [diff] [blame] | 1801 | for (ExplodedNodeSet::iterator NI=Tmp.begin(), NE=Tmp.end(); NI!=NE; ++NI) { |
| 1802 | state = GetState(*NI); |
Ted Kremenek | 96ebad6 | 2010-09-09 07:13:00 +0000 | [diff] [blame] | 1803 | |
Ted Kremenek | b4b817d | 2009-11-11 03:26:34 +0000 | [diff] [blame] | 1804 | if (location.isUnknown()) { |
| 1805 | // This is important. We must nuke the old binding. |
| 1806 | MakeNode(Dst, Ex, *NI, state->BindExpr(Ex, UnknownVal()), |
| 1807 | ProgramPoint::PostLoadKind, tag); |
| 1808 | } |
| 1809 | else { |
Ted Kremenek | 96ebad6 | 2010-09-09 07:13:00 +0000 | [diff] [blame] | 1810 | if (LoadTy.isNull()) |
| 1811 | LoadTy = Ex->getType(); |
| 1812 | SVal V = state->getSVal(cast<Loc>(location), LoadTy); |
| 1813 | MakeNode(Dst, Ex, *NI, state->bindExprAndLocation(Ex, location, V), |
| 1814 | ProgramPoint::PostLoadKind, tag); |
Ted Kremenek | b4b817d | 2009-11-11 03:26:34 +0000 | [diff] [blame] | 1815 | } |
Zhongxing Xu | d5b499d | 2008-11-28 08:34:30 +0000 | [diff] [blame] | 1816 | } |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 1817 | } |
| 1818 | |
Ted Kremenek | 9c14953 | 2010-12-01 21:57:22 +0000 | [diff] [blame] | 1819 | void GRExprEngine::evalLocation(ExplodedNodeSet &Dst, const Stmt *S, |
Ted Kremenek | b4b817d | 2009-11-11 03:26:34 +0000 | [diff] [blame] | 1820 | ExplodedNode* Pred, |
| 1821 | const GRState* state, SVal location, |
| 1822 | const void *tag, bool isLoad) { |
Zhongxing Xu | 00b1ad2 | 2009-11-20 03:50:46 +0000 | [diff] [blame] | 1823 | // Early checks for performance reason. |
| 1824 | if (location.isUnknown() || Checkers.empty()) { |
Ted Kremenek | b4b817d | 2009-11-11 03:26:34 +0000 | [diff] [blame] | 1825 | Dst.Add(Pred); |
| 1826 | return; |
Ted Kremenek | 0296c22 | 2009-11-02 23:19:29 +0000 | [diff] [blame] | 1827 | } |
Ted Kremenek | b9bbd59 | 2010-02-15 23:02:46 +0000 | [diff] [blame] | 1828 | |
Ted Kremenek | b4b817d | 2009-11-11 03:26:34 +0000 | [diff] [blame] | 1829 | ExplodedNodeSet Src, Tmp; |
| 1830 | Src.Add(Pred); |
| 1831 | ExplodedNodeSet *PrevSet = &Src; |
Ted Kremenek | b9bbd59 | 2010-02-15 23:02:46 +0000 | [diff] [blame] | 1832 | |
Ted Kremenek | b4b817d | 2009-11-11 03:26:34 +0000 | [diff] [blame] | 1833 | for (CheckersOrdered::iterator I=Checkers.begin(),E=Checkers.end(); I!=E; ++I) |
| 1834 | { |
Ted Kremenek | 17f4da8 | 2009-12-09 02:45:41 +0000 | [diff] [blame] | 1835 | ExplodedNodeSet *CurrSet = 0; |
| 1836 | if (I+1 == E) |
| 1837 | CurrSet = &Dst; |
| 1838 | else { |
| 1839 | CurrSet = (PrevSet == &Tmp) ? &Src : &Tmp; |
| 1840 | CurrSet->clear(); |
| 1841 | } |
Ted Kremenek | b9bbd59 | 2010-02-15 23:02:46 +0000 | [diff] [blame] | 1842 | |
Ted Kremenek | b4b817d | 2009-11-11 03:26:34 +0000 | [diff] [blame] | 1843 | void *tag = I->first; |
| 1844 | Checker *checker = I->second; |
Ted Kremenek | b9bbd59 | 2010-02-15 23:02:46 +0000 | [diff] [blame] | 1845 | |
Ted Kremenek | b4b817d | 2009-11-11 03:26:34 +0000 | [diff] [blame] | 1846 | for (ExplodedNodeSet::iterator NI = PrevSet->begin(), NE = PrevSet->end(); |
Ted Kremenek | 19d67b5 | 2009-11-23 22:22:01 +0000 | [diff] [blame] | 1847 | NI != NE; ++NI) { |
| 1848 | // Use the 'state' argument only when the predecessor node is the |
| 1849 | // same as Pred. This allows us to catch updates to the state. |
Ted Kremenek | 342e907 | 2010-12-20 21:22:47 +0000 | [diff] [blame] | 1850 | checker->GR_visitLocation(*CurrSet, *Builder, *this, S, *NI, |
Ted Kremenek | 19d67b5 | 2009-11-23 22:22:01 +0000 | [diff] [blame] | 1851 | *NI == Pred ? state : GetState(*NI), |
Ted Kremenek | b4b817d | 2009-11-11 03:26:34 +0000 | [diff] [blame] | 1852 | location, tag, isLoad); |
Ted Kremenek | 19d67b5 | 2009-11-23 22:22:01 +0000 | [diff] [blame] | 1853 | } |
Ted Kremenek | b9bbd59 | 2010-02-15 23:02:46 +0000 | [diff] [blame] | 1854 | |
Ted Kremenek | b4b817d | 2009-11-11 03:26:34 +0000 | [diff] [blame] | 1855 | // Update which NodeSet is the current one. |
| 1856 | PrevSet = CurrSet; |
| 1857 | } |
Ted Kremenek | ec96a2d | 2008-04-16 18:39:06 +0000 | [diff] [blame] | 1858 | } |
| 1859 | |
Zhongxing Xu | 1c625f2 | 2010-05-06 03:38:27 +0000 | [diff] [blame] | 1860 | bool GRExprEngine::InlineCall(ExplodedNodeSet &Dst, const CallExpr *CE, |
| 1861 | ExplodedNode *Pred) { |
| 1862 | const GRState *state = GetState(Pred); |
| 1863 | const Expr *Callee = CE->getCallee(); |
| 1864 | SVal L = state->getSVal(Callee); |
| 1865 | |
| 1866 | const FunctionDecl *FD = L.getAsFunctionDecl(); |
| 1867 | if (!FD) |
| 1868 | return false; |
| 1869 | |
Zhongxing Xu | c6238d2 | 2010-07-19 01:31:21 +0000 | [diff] [blame] | 1870 | // Check if the function definition is in the same translation unit. |
| 1871 | if (FD->hasBody(FD)) { |
Zhongxing Xu | 19b78d9 | 2010-11-24 08:53:20 +0000 | [diff] [blame] | 1872 | const StackFrameContext *stackFrame = |
| 1873 | AMgr.getStackFrame(AMgr.getAnalysisContext(FD), |
| 1874 | Pred->getLocationContext(), |
Ted Kremenek | 892697d | 2010-12-16 07:46:53 +0000 | [diff] [blame] | 1875 | CE, Builder->getBlock(), Builder->getIndex()); |
Zhongxing Xu | c6238d2 | 2010-07-19 01:31:21 +0000 | [diff] [blame] | 1876 | // Now we have the definition of the callee, create a CallEnter node. |
Zhongxing Xu | 19b78d9 | 2010-11-24 08:53:20 +0000 | [diff] [blame] | 1877 | CallEnter Loc(CE, stackFrame, Pred->getLocationContext()); |
Zhongxing Xu | 1c625f2 | 2010-05-06 03:38:27 +0000 | [diff] [blame] | 1878 | |
Zhongxing Xu | c6238d2 | 2010-07-19 01:31:21 +0000 | [diff] [blame] | 1879 | ExplodedNode *N = Builder->generateNode(Loc, state, Pred); |
Zhongxing Xu | 1c625f2 | 2010-05-06 03:38:27 +0000 | [diff] [blame] | 1880 | Dst.Add(N); |
Zhongxing Xu | c6238d2 | 2010-07-19 01:31:21 +0000 | [diff] [blame] | 1881 | return true; |
| 1882 | } |
| 1883 | |
| 1884 | // Check if we can find the function definition in other translation units. |
| 1885 | if (AMgr.hasIndexer()) { |
Zhongxing Xu | 19b78d9 | 2010-11-24 08:53:20 +0000 | [diff] [blame] | 1886 | AnalysisContext *C = AMgr.getAnalysisContextInAnotherTU(FD); |
Zhongxing Xu | c6238d2 | 2010-07-19 01:31:21 +0000 | [diff] [blame] | 1887 | if (C == 0) |
| 1888 | return false; |
Zhongxing Xu | 19b78d9 | 2010-11-24 08:53:20 +0000 | [diff] [blame] | 1889 | const StackFrameContext *stackFrame = |
| 1890 | AMgr.getStackFrame(C, Pred->getLocationContext(), |
Ted Kremenek | 892697d | 2010-12-16 07:46:53 +0000 | [diff] [blame] | 1891 | CE, Builder->getBlock(), Builder->getIndex()); |
Zhongxing Xu | 19b78d9 | 2010-11-24 08:53:20 +0000 | [diff] [blame] | 1892 | CallEnter Loc(CE, stackFrame, Pred->getLocationContext()); |
Zhongxing Xu | c6238d2 | 2010-07-19 01:31:21 +0000 | [diff] [blame] | 1893 | ExplodedNode *N = Builder->generateNode(Loc, state, Pred); |
| 1894 | Dst.Add(N); |
| 1895 | return true; |
| 1896 | } |
| 1897 | |
| 1898 | return false; |
Zhongxing Xu | 1c625f2 | 2010-05-06 03:38:27 +0000 | [diff] [blame] | 1899 | } |
| 1900 | |
Zhongxing Xu | 03509ae | 2010-07-20 06:22:24 +0000 | [diff] [blame] | 1901 | void GRExprEngine::VisitCall(const CallExpr* CE, ExplodedNode* Pred, |
| 1902 | CallExpr::const_arg_iterator AI, |
| 1903 | CallExpr::const_arg_iterator AE, |
Ted Kremenek | 892697d | 2010-12-16 07:46:53 +0000 | [diff] [blame] | 1904 | ExplodedNodeSet& Dst) { |
Ted Kremenek | 3cead90 | 2009-12-17 20:06:29 +0000 | [diff] [blame] | 1905 | |
Douglas Gregor | 9d293df | 2008-10-28 00:22:11 +0000 | [diff] [blame] | 1906 | // Determine the type of function we're calling (if available). |
Douglas Gregor | 72564e7 | 2009-02-26 23:50:07 +0000 | [diff] [blame] | 1907 | const FunctionProtoType *Proto = NULL; |
Douglas Gregor | 9d293df | 2008-10-28 00:22:11 +0000 | [diff] [blame] | 1908 | QualType FnType = CE->getCallee()->IgnoreParens()->getType(); |
Ted Kremenek | 6217b80 | 2009-07-29 21:53:49 +0000 | [diff] [blame] | 1909 | if (const PointerType *FnTypePtr = FnType->getAs<PointerType>()) |
John McCall | 183700f | 2009-09-21 23:43:11 +0000 | [diff] [blame] | 1910 | Proto = FnTypePtr->getPointeeType()->getAs<FunctionProtoType>(); |
Douglas Gregor | 9d293df | 2008-10-28 00:22:11 +0000 | [diff] [blame] | 1911 | |
Ted Kremenek | c69c438 | 2010-09-23 05:14:51 +0000 | [diff] [blame] | 1912 | // Evaluate the arguments. |
Ted Kremenek | 3cead90 | 2009-12-17 20:06:29 +0000 | [diff] [blame] | 1913 | ExplodedNodeSet ArgsEvaluated; |
Ted Kremenek | 9c14953 | 2010-12-01 21:57:22 +0000 | [diff] [blame] | 1914 | evalArguments(CE->arg_begin(), CE->arg_end(), Proto, Pred, ArgsEvaluated); |
Ted Kremenek | de43424 | 2008-02-19 01:44:53 +0000 | [diff] [blame] | 1915 | |
Ted Kremenek | 7f14e6f | 2009-12-17 20:10:17 +0000 | [diff] [blame] | 1916 | // Now process the call itself. |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 1917 | ExplodedNodeSet DstTmp; |
Zhongxing Xu | 03509ae | 2010-07-20 06:22:24 +0000 | [diff] [blame] | 1918 | const Expr* Callee = CE->getCallee()->IgnoreParens(); |
Ted Kremenek | b9bbd59 | 2010-02-15 23:02:46 +0000 | [diff] [blame] | 1919 | |
Ted Kremenek | 3cead90 | 2009-12-17 20:06:29 +0000 | [diff] [blame] | 1920 | for (ExplodedNodeSet::iterator NI=ArgsEvaluated.begin(), |
Ted Kremenek | 7f14e6f | 2009-12-17 20:10:17 +0000 | [diff] [blame] | 1921 | NE=ArgsEvaluated.end(); NI != NE; ++NI) { |
| 1922 | // Evaluate the callee. |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 1923 | ExplodedNodeSet DstTmp2; |
Ted Kremenek | b9bbd59 | 2010-02-15 23:02:46 +0000 | [diff] [blame] | 1924 | Visit(Callee, *NI, DstTmp2); |
Ted Kremenek | 5a5d98b | 2009-07-22 21:43:51 +0000 | [diff] [blame] | 1925 | // Perform the previsit of the CallExpr, storing the results in DstTmp. |
Jordy Rose | 72905cf | 2010-08-04 07:10:57 +0000 | [diff] [blame] | 1926 | CheckerVisit(CE, DstTmp, DstTmp2, PreVisitStmtCallback); |
Ted Kremenek | 5a5d98b | 2009-07-22 21:43:51 +0000 | [diff] [blame] | 1927 | } |
Ted Kremenek | b9bbd59 | 2010-02-15 23:02:46 +0000 | [diff] [blame] | 1928 | |
Ted Kremenek | 3cead90 | 2009-12-17 20:06:29 +0000 | [diff] [blame] | 1929 | // Finally, evaluate the function call. We try each of the checkers |
| 1930 | // to see if the can evaluate the function call. |
Ted Kremenek | 17f4da8 | 2009-12-09 02:45:41 +0000 | [diff] [blame] | 1931 | ExplodedNodeSet DstTmp3; |
Ted Kremenek | 5328751 | 2009-12-18 20:13:39 +0000 | [diff] [blame] | 1932 | |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1933 | for (ExplodedNodeSet::iterator DI = DstTmp.begin(), DE = DstTmp.end(); |
Zhongxing Xu | 248072a | 2009-09-05 05:00:57 +0000 | [diff] [blame] | 1934 | DI != DE; ++DI) { |
Ted Kremenek | b9bbd59 | 2010-02-15 23:02:46 +0000 | [diff] [blame] | 1935 | |
Ted Kremenek | a8538d9 | 2009-02-13 01:45:31 +0000 | [diff] [blame] | 1936 | const GRState* state = GetState(*DI); |
Ted Kremenek | 1397663 | 2010-02-08 16:18:51 +0000 | [diff] [blame] | 1937 | SVal L = state->getSVal(Callee); |
Ted Kremenek | b9bbd59 | 2010-02-15 23:02:46 +0000 | [diff] [blame] | 1938 | |
Ted Kremenek | a1354a5 | 2008-03-03 16:47:31 +0000 | [diff] [blame] | 1939 | // FIXME: Add support for symbolic function calls (calls involving |
| 1940 | // function pointer values that are symbolic). |
Ted Kremenek | 4bf38da | 2008-03-05 21:15:02 +0000 | [diff] [blame] | 1941 | SaveAndRestore<bool> OldSink(Builder->BuildSinks); |
Ted Kremenek | 17f4da8 | 2009-12-09 02:45:41 +0000 | [diff] [blame] | 1942 | ExplodedNodeSet DstChecker; |
Ted Kremenek | b9bbd59 | 2010-02-15 23:02:46 +0000 | [diff] [blame] | 1943 | |
Zhongxing Xu | 935ef90 | 2009-12-07 09:17:35 +0000 | [diff] [blame] | 1944 | // If the callee is processed by a checker, skip the rest logic. |
| 1945 | if (CheckerEvalCall(CE, DstChecker, *DI)) |
Zhongxing Xu | 9f68ea2 | 2009-12-09 05:48:53 +0000 | [diff] [blame] | 1946 | DstTmp3.insert(DstChecker); |
Zhongxing Xu | 1c625f2 | 2010-05-06 03:38:27 +0000 | [diff] [blame] | 1947 | else if (AMgr.shouldInlineCall() && InlineCall(Dst, CE, *DI)) { |
| 1948 | // Callee is inlined. We shouldn't do post call checking. |
| 1949 | return; |
| 1950 | } |
Zhongxing Xu | 935ef90 | 2009-12-07 09:17:35 +0000 | [diff] [blame] | 1951 | else { |
Ted Kremenek | 17f4da8 | 2009-12-09 02:45:41 +0000 | [diff] [blame] | 1952 | for (ExplodedNodeSet::iterator DI_Checker = DstChecker.begin(), |
Ted Kremenek | 3cead90 | 2009-12-17 20:06:29 +0000 | [diff] [blame] | 1953 | DE_Checker = DstChecker.end(); |
| 1954 | DI_Checker != DE_Checker; ++DI_Checker) { |
Ted Kremenek | b9bbd59 | 2010-02-15 23:02:46 +0000 | [diff] [blame] | 1955 | |
Ted Kremenek | 3cead90 | 2009-12-17 20:06:29 +0000 | [diff] [blame] | 1956 | // Dispatch to the plug-in transfer function. |
Ted Kremenek | 9c14953 | 2010-12-01 21:57:22 +0000 | [diff] [blame] | 1957 | unsigned oldSize = DstTmp3.size(); |
Ted Kremenek | 17f4da8 | 2009-12-09 02:45:41 +0000 | [diff] [blame] | 1958 | SaveOr OldHasGen(Builder->HasGeneratedNode); |
| 1959 | Pred = *DI_Checker; |
Ted Kremenek | b9bbd59 | 2010-02-15 23:02:46 +0000 | [diff] [blame] | 1960 | |
Ted Kremenek | 17f4da8 | 2009-12-09 02:45:41 +0000 | [diff] [blame] | 1961 | // Dispatch to transfer function logic to handle the call itself. |
| 1962 | // FIXME: Allow us to chain together transfer functions. |
Ted Kremenek | b9bbd59 | 2010-02-15 23:02:46 +0000 | [diff] [blame] | 1963 | assert(Builder && "GRStmtNodeBuilder must be defined."); |
Ted Kremenek | 9c14953 | 2010-12-01 21:57:22 +0000 | [diff] [blame] | 1964 | getTF().evalCall(DstTmp3, *this, *Builder, CE, L, Pred); |
Ted Kremenek | b9bbd59 | 2010-02-15 23:02:46 +0000 | [diff] [blame] | 1965 | |
Ted Kremenek | 17f4da8 | 2009-12-09 02:45:41 +0000 | [diff] [blame] | 1966 | // Handle the case where no nodes where generated. Auto-generate that |
| 1967 | // contains the updated state if we aren't generating sinks. |
Ted Kremenek | 9c14953 | 2010-12-01 21:57:22 +0000 | [diff] [blame] | 1968 | if (!Builder->BuildSinks && DstTmp3.size() == oldSize && |
Ted Kremenek | 17f4da8 | 2009-12-09 02:45:41 +0000 | [diff] [blame] | 1969 | !Builder->HasGeneratedNode) |
| 1970 | MakeNode(DstTmp3, CE, Pred, state); |
| 1971 | } |
Zhongxing Xu | 935ef90 | 2009-12-07 09:17:35 +0000 | [diff] [blame] | 1972 | } |
Ted Kremenek | de43424 | 2008-02-19 01:44:53 +0000 | [diff] [blame] | 1973 | } |
Ted Kremenek | b9bbd59 | 2010-02-15 23:02:46 +0000 | [diff] [blame] | 1974 | |
Ted Kremenek | 3cead90 | 2009-12-17 20:06:29 +0000 | [diff] [blame] | 1975 | // Finally, perform the post-condition check of the CallExpr and store |
| 1976 | // the created nodes in 'Dst'. |
Ted Kremenek | 892697d | 2010-12-16 07:46:53 +0000 | [diff] [blame] | 1977 | CheckerVisit(CE, Dst, DstTmp3, PostVisitStmtCallback); |
Ted Kremenek | de43424 | 2008-02-19 01:44:53 +0000 | [diff] [blame] | 1978 | } |
| 1979 | |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 1980 | //===----------------------------------------------------------------------===// |
Ted Kremenek | 97ed4f6 | 2008-10-17 00:03:18 +0000 | [diff] [blame] | 1981 | // Transfer function: Objective-C ivar references. |
| 1982 | //===----------------------------------------------------------------------===// |
| 1983 | |
Ted Kremenek | f5cae63 | 2009-02-28 20:50:43 +0000 | [diff] [blame] | 1984 | static std::pair<const void*,const void*> EagerlyAssumeTag |
Douglas Gregor | a5fdd9c | 2010-05-11 06:18:17 +0000 | [diff] [blame] | 1985 | = std::pair<const void*,const void*>(&EagerlyAssumeTag,static_cast<void*>(0)); |
Ted Kremenek | f5cae63 | 2009-02-28 20:50:43 +0000 | [diff] [blame] | 1986 | |
Ted Kremenek | 9c14953 | 2010-12-01 21:57:22 +0000 | [diff] [blame] | 1987 | void GRExprEngine::evalEagerlyAssume(ExplodedNodeSet &Dst, ExplodedNodeSet &Src, |
Zhongxing Xu | 03509ae | 2010-07-20 06:22:24 +0000 | [diff] [blame] | 1988 | const Expr *Ex) { |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 1989 | for (ExplodedNodeSet::iterator I=Src.begin(), E=Src.end(); I!=E; ++I) { |
| 1990 | ExplodedNode *Pred = *I; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1991 | |
Ted Kremenek | b293902 | 2009-02-25 23:32:10 +0000 | [diff] [blame] | 1992 | // Test if the previous node was as the same expression. This can happen |
| 1993 | // when the expression fails to evaluate to anything meaningful and |
| 1994 | // (as an optimization) we don't generate a node. |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1995 | ProgramPoint P = Pred->getLocation(); |
Ted Kremenek | b293902 | 2009-02-25 23:32:10 +0000 | [diff] [blame] | 1996 | if (!isa<PostStmt>(P) || cast<PostStmt>(P).getStmt() != Ex) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1997 | Dst.Add(Pred); |
Ted Kremenek | b293902 | 2009-02-25 23:32:10 +0000 | [diff] [blame] | 1998 | continue; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1999 | } |
Ted Kremenek | b293902 | 2009-02-25 23:32:10 +0000 | [diff] [blame] | 2000 | |
Zhongxing Xu | 59fea60 | 2010-04-20 04:53:09 +0000 | [diff] [blame] | 2001 | const GRState* state = GetState(Pred); |
Ted Kremenek | 1397663 | 2010-02-08 16:18:51 +0000 | [diff] [blame] | 2002 | SVal V = state->getSVal(Ex); |
Ted Kremenek | 5b9bd21 | 2009-09-11 22:07:28 +0000 | [diff] [blame] | 2003 | if (nonloc::SymExprVal *SEV = dyn_cast<nonloc::SymExprVal>(&V)) { |
Ted Kremenek | 48af2a9 | 2009-02-25 22:32:02 +0000 | [diff] [blame] | 2004 | // First assume that the condition is true. |
Ted Kremenek | 28f47b9 | 2010-12-01 22:16:56 +0000 | [diff] [blame] | 2005 | if (const GRState *stateTrue = state->assume(*SEV, true)) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2006 | stateTrue = stateTrue->BindExpr(Ex, |
Ted Kremenek | c8413fd | 2010-12-02 07:49:45 +0000 | [diff] [blame] | 2007 | svalBuilder.makeIntVal(1U, Ex->getType())); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2008 | Dst.Add(Builder->generateNode(PostStmtCustom(Ex, |
Zhongxing Xu | 25e695b | 2009-08-15 03:17:38 +0000 | [diff] [blame] | 2009 | &EagerlyAssumeTag, Pred->getLocationContext()), |
Ted Kremenek | 48af2a9 | 2009-02-25 22:32:02 +0000 | [diff] [blame] | 2010 | stateTrue, Pred)); |
| 2011 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2012 | |
Ted Kremenek | 48af2a9 | 2009-02-25 22:32:02 +0000 | [diff] [blame] | 2013 | // Next, assume that the condition is false. |
Ted Kremenek | 28f47b9 | 2010-12-01 22:16:56 +0000 | [diff] [blame] | 2014 | if (const GRState *stateFalse = state->assume(*SEV, false)) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2015 | stateFalse = stateFalse->BindExpr(Ex, |
Ted Kremenek | c8413fd | 2010-12-02 07:49:45 +0000 | [diff] [blame] | 2016 | svalBuilder.makeIntVal(0U, Ex->getType())); |
Zhongxing Xu | 25e695b | 2009-08-15 03:17:38 +0000 | [diff] [blame] | 2017 | Dst.Add(Builder->generateNode(PostStmtCustom(Ex, &EagerlyAssumeTag, |
| 2018 | Pred->getLocationContext()), |
Ted Kremenek | 48af2a9 | 2009-02-25 22:32:02 +0000 | [diff] [blame] | 2019 | stateFalse, Pred)); |
| 2020 | } |
| 2021 | } |
| 2022 | else |
| 2023 | Dst.Add(Pred); |
| 2024 | } |
| 2025 | } |
| 2026 | |
| 2027 | //===----------------------------------------------------------------------===// |
Ted Kremenek | 4beaa9f | 2010-09-10 03:05:33 +0000 | [diff] [blame] | 2028 | // Transfer function: Objective-C @synchronized. |
| 2029 | //===----------------------------------------------------------------------===// |
| 2030 | |
| 2031 | void GRExprEngine::VisitObjCAtSynchronizedStmt(const ObjCAtSynchronizedStmt *S, |
| 2032 | ExplodedNode *Pred, |
| 2033 | ExplodedNodeSet &Dst) { |
| 2034 | |
| 2035 | // The mutex expression is a CFGElement, so we don't need to explicitly |
| 2036 | // visit it since it will already be processed. |
| 2037 | |
| 2038 | // Pre-visit the ObjCAtSynchronizedStmt. |
| 2039 | ExplodedNodeSet Tmp; |
| 2040 | Tmp.Add(Pred); |
| 2041 | CheckerVisit(S, Dst, Tmp, PreVisitStmtCallback); |
| 2042 | } |
| 2043 | |
| 2044 | //===----------------------------------------------------------------------===// |
Ted Kremenek | 48af2a9 | 2009-02-25 22:32:02 +0000 | [diff] [blame] | 2045 | // Transfer function: Objective-C ivar references. |
| 2046 | //===----------------------------------------------------------------------===// |
| 2047 | |
Ted Kremenek | 892697d | 2010-12-16 07:46:53 +0000 | [diff] [blame] | 2048 | void GRExprEngine::VisitLvalObjCIvarRefExpr(const ObjCIvarRefExpr* Ex, |
| 2049 | ExplodedNode* Pred, |
| 2050 | ExplodedNodeSet& Dst) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2051 | |
Ted Kremenek | 892697d | 2010-12-16 07:46:53 +0000 | [diff] [blame] | 2052 | // Visit the base expression, which is needed for computing the lvalue |
| 2053 | // of the ivar. |
| 2054 | ExplodedNodeSet dstBase; |
| 2055 | const Expr *baseExpr = Ex->getBase(); |
| 2056 | Visit(baseExpr, Pred, dstBase); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2057 | |
Ted Kremenek | 892697d | 2010-12-16 07:46:53 +0000 | [diff] [blame] | 2058 | // Using the base, compute the lvalue of the instance variable. |
| 2059 | for (ExplodedNodeSet::iterator I = dstBase.begin(), E = dstBase.end(); |
| 2060 | I!=E; ++I) { |
| 2061 | ExplodedNode *nodeBase = *I; |
| 2062 | const GRState *state = GetState(nodeBase); |
| 2063 | SVal baseVal = state->getSVal(baseExpr); |
| 2064 | SVal location = state->getLValue(Ex->getDecl(), baseVal); |
| 2065 | MakeNode(Dst, Ex, *I, state->BindExpr(Ex, location)); |
Ted Kremenek | 97ed4f6 | 2008-10-17 00:03:18 +0000 | [diff] [blame] | 2066 | } |
| 2067 | } |
| 2068 | |
| 2069 | //===----------------------------------------------------------------------===// |
Ted Kremenek | af33741 | 2008-11-12 19:24:17 +0000 | [diff] [blame] | 2070 | // Transfer function: Objective-C fast enumeration 'for' statements. |
| 2071 | //===----------------------------------------------------------------------===// |
| 2072 | |
Zhongxing Xu | 03509ae | 2010-07-20 06:22:24 +0000 | [diff] [blame] | 2073 | void GRExprEngine::VisitObjCForCollectionStmt(const ObjCForCollectionStmt* S, |
Zhongxing Xu | b317f8f | 2009-09-10 05:44:00 +0000 | [diff] [blame] | 2074 | ExplodedNode* Pred, ExplodedNodeSet& Dst) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2075 | |
Ted Kremenek | af33741 | 2008-11-12 19:24:17 +0000 | [diff] [blame] | 2076 | // ObjCForCollectionStmts are processed in two places. This method |
| 2077 | // handles the case where an ObjCForCollectionStmt* occurs as one of the |
| 2078 | // statements within a basic block. This transfer function does two things: |
| 2079 | // |
| 2080 | // (1) binds the next container value to 'element'. This creates a new |
| 2081 | // node in the ExplodedGraph. |
| 2082 | // |
| 2083 | // (2) binds the value 0/1 to the ObjCForCollectionStmt* itself, indicating |
| 2084 | // whether or not the container has any more elements. This value |
| 2085 | // will be tested in ProcessBranch. We need to explicitly bind |
| 2086 | // this value because a container can contain nil elements. |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2087 | // |
Ted Kremenek | af33741 | 2008-11-12 19:24:17 +0000 | [diff] [blame] | 2088 | // FIXME: Eventually this logic should actually do dispatches to |
| 2089 | // 'countByEnumeratingWithState:objects:count:' (NSFastEnumeration). |
| 2090 | // This will require simulating a temporary NSFastEnumerationState, either |
| 2091 | // through an SVal or through the use of MemRegions. This value can |
| 2092 | // be affixed to the ObjCForCollectionStmt* instead of 0/1; when the loop |
| 2093 | // terminates we reclaim the temporary (it goes out of scope) and we |
| 2094 | // we can test if the SVal is 0 or if the MemRegion is null (depending |
| 2095 | // on what approach we take). |
| 2096 | // |
| 2097 | // For now: simulate (1) by assigning either a symbol or nil if the |
| 2098 | // container is empty. Thus this transfer function will by default |
| 2099 | // result in state splitting. |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2100 | |
Zhongxing Xu | 03509ae | 2010-07-20 06:22:24 +0000 | [diff] [blame] | 2101 | const Stmt* elem = S->getElement(); |
Ted Kremenek | 06fb99f | 2008-11-14 19:47:18 +0000 | [diff] [blame] | 2102 | SVal ElementV; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2103 | |
Zhongxing Xu | 03509ae | 2010-07-20 06:22:24 +0000 | [diff] [blame] | 2104 | if (const DeclStmt* DS = dyn_cast<DeclStmt>(elem)) { |
| 2105 | const VarDecl* ElemD = cast<VarDecl>(DS->getSingleDecl()); |
Ted Kremenek | af33741 | 2008-11-12 19:24:17 +0000 | [diff] [blame] | 2106 | assert (ElemD->getInit() == 0); |
Ted Kremenek | d17da2b | 2009-08-21 22:28:32 +0000 | [diff] [blame] | 2107 | ElementV = GetState(Pred)->getLValue(ElemD, Pred->getLocationContext()); |
Ted Kremenek | 06fb99f | 2008-11-14 19:47:18 +0000 | [diff] [blame] | 2108 | VisitObjCForCollectionStmtAux(S, Pred, Dst, ElementV); |
| 2109 | return; |
Ted Kremenek | af33741 | 2008-11-12 19:24:17 +0000 | [diff] [blame] | 2110 | } |
Ted Kremenek | 06fb99f | 2008-11-14 19:47:18 +0000 | [diff] [blame] | 2111 | |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 2112 | ExplodedNodeSet Tmp; |
Ted Kremenek | 892697d | 2010-12-16 07:46:53 +0000 | [diff] [blame] | 2113 | Visit(cast<Expr>(elem), Pred, Tmp); |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 2114 | for (ExplodedNodeSet::iterator I = Tmp.begin(), E = Tmp.end(); I!=E; ++I) { |
Ted Kremenek | 06fb99f | 2008-11-14 19:47:18 +0000 | [diff] [blame] | 2115 | const GRState* state = GetState(*I); |
Ted Kremenek | 1397663 | 2010-02-08 16:18:51 +0000 | [diff] [blame] | 2116 | VisitObjCForCollectionStmtAux(S, *I, Dst, state->getSVal(elem)); |
Ted Kremenek | 06fb99f | 2008-11-14 19:47:18 +0000 | [diff] [blame] | 2117 | } |
| 2118 | } |
| 2119 | |
Zhongxing Xu | 03509ae | 2010-07-20 06:22:24 +0000 | [diff] [blame] | 2120 | void GRExprEngine::VisitObjCForCollectionStmtAux(const ObjCForCollectionStmt* S, |
Zhongxing Xu | b317f8f | 2009-09-10 05:44:00 +0000 | [diff] [blame] | 2121 | ExplodedNode* Pred, ExplodedNodeSet& Dst, |
Ted Kremenek | 06fb99f | 2008-11-14 19:47:18 +0000 | [diff] [blame] | 2122 | SVal ElementV) { |
Ted Kremenek | 06fb99f | 2008-11-14 19:47:18 +0000 | [diff] [blame] | 2123 | |
Ted Kremenek | b4b817d | 2009-11-11 03:26:34 +0000 | [diff] [blame] | 2124 | // Check if the location we are writing back to is a null pointer. |
Zhongxing Xu | 03509ae | 2010-07-20 06:22:24 +0000 | [diff] [blame] | 2125 | const Stmt* elem = S->getElement(); |
Ted Kremenek | b4b817d | 2009-11-11 03:26:34 +0000 | [diff] [blame] | 2126 | ExplodedNodeSet Tmp; |
Ted Kremenek | 9c14953 | 2010-12-01 21:57:22 +0000 | [diff] [blame] | 2127 | evalLocation(Tmp, elem, Pred, GetState(Pred), ElementV, NULL, false); |
Ted Kremenek | b9bbd59 | 2010-02-15 23:02:46 +0000 | [diff] [blame] | 2128 | |
Ted Kremenek | b4b817d | 2009-11-11 03:26:34 +0000 | [diff] [blame] | 2129 | if (Tmp.empty()) |
Ted Kremenek | 06fb99f | 2008-11-14 19:47:18 +0000 | [diff] [blame] | 2130 | return; |
Ted Kremenek | b9bbd59 | 2010-02-15 23:02:46 +0000 | [diff] [blame] | 2131 | |
Ted Kremenek | b4b817d | 2009-11-11 03:26:34 +0000 | [diff] [blame] | 2132 | for (ExplodedNodeSet::iterator NI=Tmp.begin(), NE=Tmp.end(); NI!=NE; ++NI) { |
| 2133 | Pred = *NI; |
| 2134 | const GRState *state = GetState(Pred); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2135 | |
Ted Kremenek | b4b817d | 2009-11-11 03:26:34 +0000 | [diff] [blame] | 2136 | // Handle the case where the container still has elements. |
Ted Kremenek | c8413fd | 2010-12-02 07:49:45 +0000 | [diff] [blame] | 2137 | SVal TrueV = svalBuilder.makeTruthVal(1); |
Ted Kremenek | b4b817d | 2009-11-11 03:26:34 +0000 | [diff] [blame] | 2138 | const GRState *hasElems = state->BindExpr(S, TrueV); |
Ted Kremenek | 06fb99f | 2008-11-14 19:47:18 +0000 | [diff] [blame] | 2139 | |
Ted Kremenek | b4b817d | 2009-11-11 03:26:34 +0000 | [diff] [blame] | 2140 | // Handle the case where the container has no elements. |
Ted Kremenek | c8413fd | 2010-12-02 07:49:45 +0000 | [diff] [blame] | 2141 | SVal FalseV = svalBuilder.makeTruthVal(0); |
Ted Kremenek | b4b817d | 2009-11-11 03:26:34 +0000 | [diff] [blame] | 2142 | const GRState *noElems = state->BindExpr(S, FalseV); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2143 | |
Ted Kremenek | b4b817d | 2009-11-11 03:26:34 +0000 | [diff] [blame] | 2144 | if (loc::MemRegionVal* MV = dyn_cast<loc::MemRegionVal>(&ElementV)) |
| 2145 | if (const TypedRegion* R = dyn_cast<TypedRegion>(MV->getRegion())) { |
| 2146 | // FIXME: The proper thing to do is to really iterate over the |
| 2147 | // container. We will do this with dispatch logic to the store. |
| 2148 | // For now, just 'conjure' up a symbolic value. |
Zhongxing Xu | 018220c | 2010-08-11 06:10:55 +0000 | [diff] [blame] | 2149 | QualType T = R->getValueType(); |
Ted Kremenek | b4b817d | 2009-11-11 03:26:34 +0000 | [diff] [blame] | 2150 | assert(Loc::IsLocType(T)); |
| 2151 | unsigned Count = Builder->getCurrentBlockCount(); |
| 2152 | SymbolRef Sym = SymMgr.getConjuredSymbol(elem, T, Count); |
Ted Kremenek | c8413fd | 2010-12-02 07:49:45 +0000 | [diff] [blame] | 2153 | SVal V = svalBuilder.makeLoc(Sym); |
Ted Kremenek | b4b817d | 2009-11-11 03:26:34 +0000 | [diff] [blame] | 2154 | hasElems = hasElems->bindLoc(ElementV, V); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2155 | |
Ted Kremenek | b4b817d | 2009-11-11 03:26:34 +0000 | [diff] [blame] | 2156 | // Bind the location to 'nil' on the false branch. |
Ted Kremenek | c8413fd | 2010-12-02 07:49:45 +0000 | [diff] [blame] | 2157 | SVal nilV = svalBuilder.makeIntVal(0, T); |
Ted Kremenek | b4b817d | 2009-11-11 03:26:34 +0000 | [diff] [blame] | 2158 | noElems = noElems->bindLoc(ElementV, nilV); |
| 2159 | } |
Ted Kremenek | 116ed0a | 2008-11-12 21:12:46 +0000 | [diff] [blame] | 2160 | |
Ted Kremenek | b4b817d | 2009-11-11 03:26:34 +0000 | [diff] [blame] | 2161 | // Create the new nodes. |
| 2162 | MakeNode(Dst, S, Pred, hasElems); |
| 2163 | MakeNode(Dst, S, Pred, noElems); |
| 2164 | } |
Ted Kremenek | af33741 | 2008-11-12 19:24:17 +0000 | [diff] [blame] | 2165 | } |
| 2166 | |
| 2167 | //===----------------------------------------------------------------------===// |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 2168 | // Transfer function: Objective-C message expressions. |
| 2169 | //===----------------------------------------------------------------------===// |
| 2170 | |
Ted Kremenek | b9bbd59 | 2010-02-15 23:02:46 +0000 | [diff] [blame] | 2171 | namespace { |
| 2172 | class ObjCMsgWLItem { |
| 2173 | public: |
Zhongxing Xu | 03509ae | 2010-07-20 06:22:24 +0000 | [diff] [blame] | 2174 | ObjCMessageExpr::const_arg_iterator I; |
Ted Kremenek | b9bbd59 | 2010-02-15 23:02:46 +0000 | [diff] [blame] | 2175 | ExplodedNode *N; |
| 2176 | |
Zhongxing Xu | 03509ae | 2010-07-20 06:22:24 +0000 | [diff] [blame] | 2177 | ObjCMsgWLItem(const ObjCMessageExpr::const_arg_iterator &i, ExplodedNode *n) |
Ted Kremenek | b9bbd59 | 2010-02-15 23:02:46 +0000 | [diff] [blame] | 2178 | : I(i), N(n) {} |
| 2179 | }; |
| 2180 | } // end anonymous namespace |
| 2181 | |
Zhongxing Xu | 03509ae | 2010-07-20 06:22:24 +0000 | [diff] [blame] | 2182 | void GRExprEngine::VisitObjCMessageExpr(const ObjCMessageExpr* ME, |
| 2183 | ExplodedNode* Pred, |
Ted Kremenek | 892697d | 2010-12-16 07:46:53 +0000 | [diff] [blame] | 2184 | ExplodedNodeSet& Dst){ |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2185 | |
Ted Kremenek | b9bbd59 | 2010-02-15 23:02:46 +0000 | [diff] [blame] | 2186 | // Create a worklist to process both the arguments. |
| 2187 | llvm::SmallVector<ObjCMsgWLItem, 20> WL; |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 2188 | |
Ted Kremenek | b9bbd59 | 2010-02-15 23:02:46 +0000 | [diff] [blame] | 2189 | // But first evaluate the receiver (if any). |
Zhongxing Xu | 03509ae | 2010-07-20 06:22:24 +0000 | [diff] [blame] | 2190 | ObjCMessageExpr::const_arg_iterator AI = ME->arg_begin(), AE = ME->arg_end(); |
| 2191 | if (const Expr *Receiver = ME->getInstanceReceiver()) { |
Ted Kremenek | b9bbd59 | 2010-02-15 23:02:46 +0000 | [diff] [blame] | 2192 | ExplodedNodeSet Tmp; |
| 2193 | Visit(Receiver, Pred, Tmp); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2194 | |
Ted Kremenek | b9bbd59 | 2010-02-15 23:02:46 +0000 | [diff] [blame] | 2195 | if (Tmp.empty()) |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 2196 | return; |
Ted Kremenek | b9bbd59 | 2010-02-15 23:02:46 +0000 | [diff] [blame] | 2197 | |
| 2198 | for (ExplodedNodeSet::iterator I=Tmp.begin(), E=Tmp.end(); I!=E; ++I) |
| 2199 | WL.push_back(ObjCMsgWLItem(AI, *I)); |
| 2200 | } |
| 2201 | else |
| 2202 | WL.push_back(ObjCMsgWLItem(AI, Pred)); |
| 2203 | |
| 2204 | // Evaluate the arguments. |
| 2205 | ExplodedNodeSet ArgsEvaluated; |
| 2206 | while (!WL.empty()) { |
| 2207 | ObjCMsgWLItem Item = WL.back(); |
| 2208 | WL.pop_back(); |
| 2209 | |
| 2210 | if (Item.I == AE) { |
| 2211 | ArgsEvaluated.insert(Item.N); |
| 2212 | continue; |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 2213 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2214 | |
Ted Kremenek | b9bbd59 | 2010-02-15 23:02:46 +0000 | [diff] [blame] | 2215 | // Evaluate the subexpression. |
| 2216 | ExplodedNodeSet Tmp; |
| 2217 | |
| 2218 | // FIXME: [Objective-C++] handle arguments that are references |
| 2219 | Visit(*Item.I, Item.N, Tmp); |
| 2220 | |
| 2221 | // Enqueue evaluating the next argument on the worklist. |
| 2222 | ++(Item.I); |
| 2223 | for (ExplodedNodeSet::iterator NI=Tmp.begin(), NE=Tmp.end(); NI!=NE; ++NI) |
| 2224 | WL.push_back(ObjCMsgWLItem(Item.I, *NI)); |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 2225 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2226 | |
Ted Kremenek | b9bbd59 | 2010-02-15 23:02:46 +0000 | [diff] [blame] | 2227 | // Now that the arguments are processed, handle the previsits checks. |
| 2228 | ExplodedNodeSet DstPrevisit; |
Jordy Rose | 72905cf | 2010-08-04 07:10:57 +0000 | [diff] [blame] | 2229 | CheckerVisit(ME, DstPrevisit, ArgsEvaluated, PreVisitStmtCallback); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2230 | |
Ted Kremenek | b9bbd59 | 2010-02-15 23:02:46 +0000 | [diff] [blame] | 2231 | // Proceed with evaluate the message expression. |
Ted Kremenek | 9c14953 | 2010-12-01 21:57:22 +0000 | [diff] [blame] | 2232 | ExplodedNodeSet dstEval; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2233 | |
Ted Kremenek | b9bbd59 | 2010-02-15 23:02:46 +0000 | [diff] [blame] | 2234 | for (ExplodedNodeSet::iterator DI = DstPrevisit.begin(), |
| 2235 | DE = DstPrevisit.end(); DI != DE; ++DI) { |
Ted Kremenek | 38ac4f5 | 2009-12-22 22:13:46 +0000 | [diff] [blame] | 2236 | |
Ted Kremenek | c79d7d4 | 2009-11-21 01:25:37 +0000 | [diff] [blame] | 2237 | Pred = *DI; |
Ted Kremenek | c79d7d4 | 2009-11-21 01:25:37 +0000 | [diff] [blame] | 2238 | bool RaisesException = false; |
Ted Kremenek | 9c14953 | 2010-12-01 21:57:22 +0000 | [diff] [blame] | 2239 | unsigned oldSize = dstEval.size(); |
Ted Kremenek | 38ac4f5 | 2009-12-22 22:13:46 +0000 | [diff] [blame] | 2240 | SaveAndRestore<bool> OldSink(Builder->BuildSinks); |
Ted Kremenek | b9bbd59 | 2010-02-15 23:02:46 +0000 | [diff] [blame] | 2241 | SaveOr OldHasGen(Builder->HasGeneratedNode); |
Ted Kremenek | c79d7d4 | 2009-11-21 01:25:37 +0000 | [diff] [blame] | 2242 | |
Douglas Gregor | 04badcf | 2010-04-21 00:45:42 +0000 | [diff] [blame] | 2243 | if (const Expr *Receiver = ME->getInstanceReceiver()) { |
Zhongxing Xu | 59fea60 | 2010-04-20 04:53:09 +0000 | [diff] [blame] | 2244 | const GRState *state = GetState(Pred); |
Zhongxing Xu | a46e4d9 | 2009-12-02 05:49:12 +0000 | [diff] [blame] | 2245 | |
| 2246 | // Bifurcate the state into nil and non-nil ones. |
Ted Kremenek | b9bbd59 | 2010-02-15 23:02:46 +0000 | [diff] [blame] | 2247 | DefinedOrUnknownSVal receiverVal = |
Ted Kremenek | 1397663 | 2010-02-08 16:18:51 +0000 | [diff] [blame] | 2248 | cast<DefinedOrUnknownSVal>(state->getSVal(Receiver)); |
Zhongxing Xu | a46e4d9 | 2009-12-02 05:49:12 +0000 | [diff] [blame] | 2249 | |
| 2250 | const GRState *notNilState, *nilState; |
Ted Kremenek | 28f47b9 | 2010-12-01 22:16:56 +0000 | [diff] [blame] | 2251 | llvm::tie(notNilState, nilState) = state->assume(receiverVal); |
Zhongxing Xu | a46e4d9 | 2009-12-02 05:49:12 +0000 | [diff] [blame] | 2252 | |
Ted Kremenek | b9bbd59 | 2010-02-15 23:02:46 +0000 | [diff] [blame] | 2253 | // There are three cases: can be nil or non-nil, must be nil, must be |
Zhongxing Xu | a46e4d9 | 2009-12-02 05:49:12 +0000 | [diff] [blame] | 2254 | // non-nil. We handle must be nil, and merge the rest two into non-nil. |
| 2255 | if (nilState && !notNilState) { |
Ted Kremenek | 9c14953 | 2010-12-01 21:57:22 +0000 | [diff] [blame] | 2256 | CheckerEvalNilReceiver(ME, dstEval, nilState, Pred); |
Ted Kremenek | 38ac4f5 | 2009-12-22 22:13:46 +0000 | [diff] [blame] | 2257 | continue; |
Zhongxing Xu | a46e4d9 | 2009-12-02 05:49:12 +0000 | [diff] [blame] | 2258 | } |
| 2259 | |
Ted Kremenek | c79d7d4 | 2009-11-21 01:25:37 +0000 | [diff] [blame] | 2260 | // Check if the "raise" message was sent. |
Ted Kremenek | b9bbd59 | 2010-02-15 23:02:46 +0000 | [diff] [blame] | 2261 | assert(notNilState); |
Ted Kremenek | c79d7d4 | 2009-11-21 01:25:37 +0000 | [diff] [blame] | 2262 | if (ME->getSelector() == RaiseSel) |
| 2263 | RaisesException = true; |
Zhongxing Xu | a46e4d9 | 2009-12-02 05:49:12 +0000 | [diff] [blame] | 2264 | |
| 2265 | // Check if we raise an exception. For now treat these as sinks. |
| 2266 | // Eventually we will want to handle exceptions properly. |
Zhongxing Xu | a46e4d9 | 2009-12-02 05:49:12 +0000 | [diff] [blame] | 2267 | if (RaisesException) |
| 2268 | Builder->BuildSinks = true; |
| 2269 | |
| 2270 | // Dispatch to plug-in transfer function. |
Ted Kremenek | 9c14953 | 2010-12-01 21:57:22 +0000 | [diff] [blame] | 2271 | evalObjCMessageExpr(dstEval, ME, Pred, notNilState); |
Ted Kremenek | c79d7d4 | 2009-11-21 01:25:37 +0000 | [diff] [blame] | 2272 | } |
Douglas Gregor | 04badcf | 2010-04-21 00:45:42 +0000 | [diff] [blame] | 2273 | else if (ObjCInterfaceDecl *Iface = ME->getReceiverInterface()) { |
| 2274 | IdentifierInfo* ClsName = Iface->getIdentifier(); |
Ted Kremenek | c79d7d4 | 2009-11-21 01:25:37 +0000 | [diff] [blame] | 2275 | Selector S = ME->getSelector(); |
| 2276 | |
| 2277 | // Check for special instance methods. |
Ted Kremenek | c79d7d4 | 2009-11-21 01:25:37 +0000 | [diff] [blame] | 2278 | if (!NSExceptionII) { |
| 2279 | ASTContext& Ctx = getContext(); |
Ted Kremenek | c79d7d4 | 2009-11-21 01:25:37 +0000 | [diff] [blame] | 2280 | NSExceptionII = &Ctx.Idents.get("NSException"); |
| 2281 | } |
| 2282 | |
| 2283 | if (ClsName == NSExceptionII) { |
Ted Kremenek | c79d7d4 | 2009-11-21 01:25:37 +0000 | [diff] [blame] | 2284 | enum { NUM_RAISE_SELECTORS = 2 }; |
| 2285 | |
| 2286 | // Lazily create a cache of the selectors. |
Ted Kremenek | c79d7d4 | 2009-11-21 01:25:37 +0000 | [diff] [blame] | 2287 | if (!NSExceptionInstanceRaiseSelectors) { |
Ted Kremenek | c79d7d4 | 2009-11-21 01:25:37 +0000 | [diff] [blame] | 2288 | ASTContext& Ctx = getContext(); |
Ted Kremenek | b9bbd59 | 2010-02-15 23:02:46 +0000 | [diff] [blame] | 2289 | NSExceptionInstanceRaiseSelectors = |
| 2290 | new Selector[NUM_RAISE_SELECTORS]; |
Ted Kremenek | c79d7d4 | 2009-11-21 01:25:37 +0000 | [diff] [blame] | 2291 | llvm::SmallVector<IdentifierInfo*, NUM_RAISE_SELECTORS> II; |
| 2292 | unsigned idx = 0; |
| 2293 | |
| 2294 | // raise:format: |
| 2295 | II.push_back(&Ctx.Idents.get("raise")); |
| 2296 | II.push_back(&Ctx.Idents.get("format")); |
| 2297 | NSExceptionInstanceRaiseSelectors[idx++] = |
| 2298 | Ctx.Selectors.getSelector(II.size(), &II[0]); |
| 2299 | |
| 2300 | // raise:format::arguments: |
| 2301 | II.push_back(&Ctx.Idents.get("arguments")); |
| 2302 | NSExceptionInstanceRaiseSelectors[idx++] = |
| 2303 | Ctx.Selectors.getSelector(II.size(), &II[0]); |
| 2304 | } |
| 2305 | |
| 2306 | for (unsigned i = 0; i < NUM_RAISE_SELECTORS; ++i) |
| 2307 | if (S == NSExceptionInstanceRaiseSelectors[i]) { |
Ted Kremenek | 38ac4f5 | 2009-12-22 22:13:46 +0000 | [diff] [blame] | 2308 | RaisesException = true; |
| 2309 | break; |
Ted Kremenek | c79d7d4 | 2009-11-21 01:25:37 +0000 | [diff] [blame] | 2310 | } |
| 2311 | } |
Zhongxing Xu | a46e4d9 | 2009-12-02 05:49:12 +0000 | [diff] [blame] | 2312 | |
| 2313 | // Check if we raise an exception. For now treat these as sinks. |
| 2314 | // Eventually we will want to handle exceptions properly. |
Zhongxing Xu | a46e4d9 | 2009-12-02 05:49:12 +0000 | [diff] [blame] | 2315 | if (RaisesException) |
| 2316 | Builder->BuildSinks = true; |
| 2317 | |
| 2318 | // Dispatch to plug-in transfer function. |
Ted Kremenek | 9c14953 | 2010-12-01 21:57:22 +0000 | [diff] [blame] | 2319 | evalObjCMessageExpr(dstEval, ME, Pred, Builder->GetState(Pred)); |
Ted Kremenek | c79d7d4 | 2009-11-21 01:25:37 +0000 | [diff] [blame] | 2320 | } |
Ted Kremenek | b9bbd59 | 2010-02-15 23:02:46 +0000 | [diff] [blame] | 2321 | |
Ted Kremenek | 38ac4f5 | 2009-12-22 22:13:46 +0000 | [diff] [blame] | 2322 | // Handle the case where no nodes where generated. Auto-generate that |
| 2323 | // contains the updated state if we aren't generating sinks. |
Ted Kremenek | 9c14953 | 2010-12-01 21:57:22 +0000 | [diff] [blame] | 2324 | if (!Builder->BuildSinks && dstEval.size() == oldSize && |
Ted Kremenek | 38ac4f5 | 2009-12-22 22:13:46 +0000 | [diff] [blame] | 2325 | !Builder->HasGeneratedNode) |
Ted Kremenek | 9c14953 | 2010-12-01 21:57:22 +0000 | [diff] [blame] | 2326 | MakeNode(dstEval, ME, Pred, GetState(Pred)); |
Ted Kremenek | c79d7d4 | 2009-11-21 01:25:37 +0000 | [diff] [blame] | 2327 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2328 | |
Ted Kremenek | 38ac4f5 | 2009-12-22 22:13:46 +0000 | [diff] [blame] | 2329 | // Finally, perform the post-condition check of the ObjCMessageExpr and store |
| 2330 | // the created nodes in 'Dst'. |
Ted Kremenek | 892697d | 2010-12-16 07:46:53 +0000 | [diff] [blame] | 2331 | CheckerVisit(ME, Dst, dstEval, PostVisitStmtCallback); |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 2332 | } |
| 2333 | |
| 2334 | //===----------------------------------------------------------------------===// |
| 2335 | // Transfer functions: Miscellaneous statements. |
| 2336 | //===----------------------------------------------------------------------===// |
| 2337 | |
Zhongxing Xu | 03509ae | 2010-07-20 06:22:24 +0000 | [diff] [blame] | 2338 | void GRExprEngine::VisitCast(const CastExpr *CastE, const Expr *Ex, |
Ted Kremenek | 892697d | 2010-12-16 07:46:53 +0000 | [diff] [blame] | 2339 | ExplodedNode *Pred, ExplodedNodeSet &Dst) { |
| 2340 | |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 2341 | ExplodedNodeSet S1; |
Ted Kremenek | 892697d | 2010-12-16 07:46:53 +0000 | [diff] [blame] | 2342 | Visit(Ex, Pred, S1); |
| 2343 | ExplodedNodeSet S2; |
| 2344 | CheckerVisit(CastE, S2, S1, PreVisitStmtCallback); |
| 2345 | |
| 2346 | if (CastE->getCastKind() == CK_LValueToRValue) { |
| 2347 | for (ExplodedNodeSet::iterator I = S2.begin(), E = S2.end(); I!=E; ++I) { |
| 2348 | ExplodedNode *subExprNode = *I; |
| 2349 | const GRState *state = GetState(subExprNode); |
| 2350 | evalLoad(Dst, CastE, subExprNode, state, state->getSVal(Ex)); |
| 2351 | } |
| 2352 | return; |
| 2353 | } |
| 2354 | |
| 2355 | // All other casts. |
Ted Kremenek | 5d3003a | 2008-02-19 18:52:54 +0000 | [diff] [blame] | 2356 | QualType T = CastE->getType(); |
Zhongxing Xu | 933c3e1 | 2008-10-21 06:54:23 +0000 | [diff] [blame] | 2357 | QualType ExTy = Ex->getType(); |
Zhongxing Xu | ed340f7 | 2008-10-22 08:02:16 +0000 | [diff] [blame] | 2358 | |
Zhongxing Xu | d3118bd | 2008-10-31 07:26:14 +0000 | [diff] [blame] | 2359 | if (const ExplicitCastExpr *ExCast=dyn_cast_or_null<ExplicitCastExpr>(CastE)) |
Douglas Gregor | 49badde | 2008-10-27 19:41:14 +0000 | [diff] [blame] | 2360 | T = ExCast->getTypeAsWritten(); |
Ted Kremenek | 892697d | 2010-12-16 07:46:53 +0000 | [diff] [blame] | 2361 | |
| 2362 | #if 0 |
Ted Kremenek | 949bdb4 | 2009-12-23 00:26:16 +0000 | [diff] [blame] | 2363 | // If we are evaluating the cast in an lvalue context, we implicitly want |
| 2364 | // the cast to evaluate to a location. |
| 2365 | if (asLValue) { |
| 2366 | ASTContext &Ctx = getContext(); |
| 2367 | T = Ctx.getPointerType(Ctx.getCanonicalType(T)); |
Ted Kremenek | 077a40d | 2009-12-23 01:19:20 +0000 | [diff] [blame] | 2368 | ExTy = Ctx.getPointerType(Ctx.getCanonicalType(ExTy)); |
Ted Kremenek | 949bdb4 | 2009-12-23 00:26:16 +0000 | [diff] [blame] | 2369 | } |
Ted Kremenek | 892697d | 2010-12-16 07:46:53 +0000 | [diff] [blame] | 2370 | #endif |
Ted Kremenek | 32c3fa4 | 2009-07-21 21:03:30 +0000 | [diff] [blame] | 2371 | |
Zhongxing Xu | b79b117 | 2010-01-22 04:30:00 +0000 | [diff] [blame] | 2372 | switch (CastE->getCastKind()) { |
John McCall | 2de56d1 | 2010-08-25 11:45:40 +0000 | [diff] [blame] | 2373 | case CK_ToVoid: |
Zhongxing Xu | b79b117 | 2010-01-22 04:30:00 +0000 | [diff] [blame] | 2374 | for (ExplodedNodeSet::iterator I = S2.begin(), E = S2.end(); I != E; ++I) |
| 2375 | Dst.Add(*I); |
| 2376 | return; |
| 2377 | |
John McCall | 0ae287a | 2010-12-01 04:43:34 +0000 | [diff] [blame] | 2378 | case CK_LValueToRValue: |
John McCall | 2de56d1 | 2010-08-25 11:45:40 +0000 | [diff] [blame] | 2379 | case CK_NoOp: |
| 2380 | case CK_FunctionToPointerDecay: |
Zhongxing Xu | b79b117 | 2010-01-22 04:30:00 +0000 | [diff] [blame] | 2381 | for (ExplodedNodeSet::iterator I = S2.begin(), E = S2.end(); I != E; ++I) { |
| 2382 | // Copy the SVal of Ex to CastE. |
| 2383 | ExplodedNode *N = *I; |
| 2384 | const GRState *state = GetState(N); |
Ted Kremenek | 1397663 | 2010-02-08 16:18:51 +0000 | [diff] [blame] | 2385 | SVal V = state->getSVal(Ex); |
Zhongxing Xu | b79b117 | 2010-01-22 04:30:00 +0000 | [diff] [blame] | 2386 | state = state->BindExpr(CastE, V); |
| 2387 | MakeNode(Dst, CastE, N, state); |
| 2388 | } |
| 2389 | return; |
| 2390 | |
John McCall | f6a1648 | 2010-12-04 03:47:34 +0000 | [diff] [blame] | 2391 | case CK_GetObjCProperty: |
John McCall | daa8e4e | 2010-11-15 09:13:47 +0000 | [diff] [blame] | 2392 | case CK_Dependent: |
John McCall | 2de56d1 | 2010-08-25 11:45:40 +0000 | [diff] [blame] | 2393 | case CK_ArrayToPointerDecay: |
| 2394 | case CK_BitCast: |
| 2395 | case CK_LValueBitCast: |
| 2396 | case CK_IntegralCast: |
John McCall | 404cd16 | 2010-11-13 01:35:44 +0000 | [diff] [blame] | 2397 | case CK_NullToPointer: |
John McCall | 2de56d1 | 2010-08-25 11:45:40 +0000 | [diff] [blame] | 2398 | case CK_IntegralToPointer: |
| 2399 | case CK_PointerToIntegral: |
John McCall | daa8e4e | 2010-11-15 09:13:47 +0000 | [diff] [blame] | 2400 | case CK_PointerToBoolean: |
| 2401 | case CK_IntegralToBoolean: |
John McCall | 2de56d1 | 2010-08-25 11:45:40 +0000 | [diff] [blame] | 2402 | case CK_IntegralToFloating: |
| 2403 | case CK_FloatingToIntegral: |
John McCall | daa8e4e | 2010-11-15 09:13:47 +0000 | [diff] [blame] | 2404 | case CK_FloatingToBoolean: |
John McCall | 2de56d1 | 2010-08-25 11:45:40 +0000 | [diff] [blame] | 2405 | case CK_FloatingCast: |
John McCall | 2bb5d00 | 2010-11-13 09:02:35 +0000 | [diff] [blame] | 2406 | case CK_FloatingRealToComplex: |
John McCall | f3ea8cf | 2010-11-14 08:17:51 +0000 | [diff] [blame] | 2407 | case CK_FloatingComplexToReal: |
| 2408 | case CK_FloatingComplexToBoolean: |
John McCall | 2bb5d00 | 2010-11-13 09:02:35 +0000 | [diff] [blame] | 2409 | case CK_FloatingComplexCast: |
John McCall | f3ea8cf | 2010-11-14 08:17:51 +0000 | [diff] [blame] | 2410 | case CK_FloatingComplexToIntegralComplex: |
John McCall | 2bb5d00 | 2010-11-13 09:02:35 +0000 | [diff] [blame] | 2411 | case CK_IntegralRealToComplex: |
John McCall | f3ea8cf | 2010-11-14 08:17:51 +0000 | [diff] [blame] | 2412 | case CK_IntegralComplexToReal: |
| 2413 | case CK_IntegralComplexToBoolean: |
John McCall | 2bb5d00 | 2010-11-13 09:02:35 +0000 | [diff] [blame] | 2414 | case CK_IntegralComplexCast: |
John McCall | f3ea8cf | 2010-11-14 08:17:51 +0000 | [diff] [blame] | 2415 | case CK_IntegralComplexToFloatingComplex: |
John McCall | 2de56d1 | 2010-08-25 11:45:40 +0000 | [diff] [blame] | 2416 | case CK_AnyPointerToObjCPointerCast: |
| 2417 | case CK_AnyPointerToBlockPointerCast: |
Zhongxing Xu | 4fd5681 | 2010-11-26 08:21:53 +0000 | [diff] [blame] | 2418 | |
John McCall | 2de56d1 | 2010-08-25 11:45:40 +0000 | [diff] [blame] | 2419 | case CK_ObjCObjectLValueCast: { |
Ted Kremenek | 846eabd | 2010-12-01 21:28:31 +0000 | [diff] [blame] | 2420 | // Delegate to SValBuilder to process. |
Zhongxing Xu | b79b117 | 2010-01-22 04:30:00 +0000 | [diff] [blame] | 2421 | for (ExplodedNodeSet::iterator I = S2.begin(), E = S2.end(); I != E; ++I) { |
| 2422 | ExplodedNode* N = *I; |
| 2423 | const GRState* state = GetState(N); |
Ted Kremenek | 1397663 | 2010-02-08 16:18:51 +0000 | [diff] [blame] | 2424 | SVal V = state->getSVal(Ex); |
Ted Kremenek | 9c14953 | 2010-12-01 21:57:22 +0000 | [diff] [blame] | 2425 | V = svalBuilder.evalCast(V, T, ExTy); |
Zhongxing Xu | 814e6b9 | 2010-02-04 04:56:43 +0000 | [diff] [blame] | 2426 | state = state->BindExpr(CastE, V); |
Zhongxing Xu | b79b117 | 2010-01-22 04:30:00 +0000 | [diff] [blame] | 2427 | MakeNode(Dst, CastE, N, state); |
| 2428 | } |
| 2429 | return; |
Ted Kremenek | 8ad9cbc | 2010-06-22 19:05:10 +0000 | [diff] [blame] | 2430 | } |
Zhongxing Xu | 4fd5681 | 2010-11-26 08:21:53 +0000 | [diff] [blame] | 2431 | |
| 2432 | case CK_DerivedToBase: |
| 2433 | case CK_UncheckedDerivedToBase: |
| 2434 | // For DerivedToBase cast, delegate to the store manager. |
| 2435 | for (ExplodedNodeSet::iterator I = S2.begin(), E = S2.end(); I != E; ++I) { |
| 2436 | ExplodedNode *node = *I; |
| 2437 | const GRState *state = GetState(node); |
| 2438 | SVal val = state->getSVal(Ex); |
| 2439 | val = getStoreManager().evalDerivedToBase(val, T); |
| 2440 | state = state->BindExpr(CastE, val); |
| 2441 | MakeNode(Dst, CastE, node, state); |
| 2442 | } |
| 2443 | return; |
| 2444 | |
Ted Kremenek | 8ad9cbc | 2010-06-22 19:05:10 +0000 | [diff] [blame] | 2445 | // Various C++ casts that are not handled yet. |
John McCall | 2de56d1 | 2010-08-25 11:45:40 +0000 | [diff] [blame] | 2446 | case CK_Dynamic: |
| 2447 | case CK_ToUnion: |
| 2448 | case CK_BaseToDerived: |
| 2449 | case CK_NullToMemberPointer: |
| 2450 | case CK_BaseToDerivedMemberPointer: |
| 2451 | case CK_DerivedToBaseMemberPointer: |
| 2452 | case CK_UserDefinedConversion: |
| 2453 | case CK_ConstructorConversion: |
| 2454 | case CK_VectorSplat: |
| 2455 | case CK_MemberPointerToBoolean: { |
Ted Kremenek | 8ad9cbc | 2010-06-22 19:05:10 +0000 | [diff] [blame] | 2456 | SaveAndRestore<bool> OldSink(Builder->BuildSinks); |
| 2457 | Builder->BuildSinks = true; |
| 2458 | MakeNode(Dst, CastE, Pred, GetState(Pred)); |
| 2459 | return; |
| 2460 | } |
Ted Kremenek | 874d63f | 2008-01-24 02:02:54 +0000 | [diff] [blame] | 2461 | } |
Ted Kremenek | 9de04c4 | 2008-01-24 20:55:43 +0000 | [diff] [blame] | 2462 | } |
| 2463 | |
Zhongxing Xu | 03509ae | 2010-07-20 06:22:24 +0000 | [diff] [blame] | 2464 | void GRExprEngine::VisitCompoundLiteralExpr(const CompoundLiteralExpr* CL, |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2465 | ExplodedNode* Pred, |
Ted Kremenek | 892697d | 2010-12-16 07:46:53 +0000 | [diff] [blame] | 2466 | ExplodedNodeSet& Dst) { |
Zhongxing Xu | 03509ae | 2010-07-20 06:22:24 +0000 | [diff] [blame] | 2467 | const InitListExpr* ILE |
| 2468 | = cast<InitListExpr>(CL->getInitializer()->IgnoreParens()); |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 2469 | ExplodedNodeSet Tmp; |
Ted Kremenek | 4f09027 | 2008-10-27 21:54:31 +0000 | [diff] [blame] | 2470 | Visit(ILE, Pred, Tmp); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2471 | |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 2472 | for (ExplodedNodeSet::iterator I = Tmp.begin(), EI = Tmp.end(); I!=EI; ++I) { |
Ted Kremenek | a8538d9 | 2009-02-13 01:45:31 +0000 | [diff] [blame] | 2473 | const GRState* state = GetState(*I); |
Ted Kremenek | 1397663 | 2010-02-08 16:18:51 +0000 | [diff] [blame] | 2474 | SVal ILV = state->getSVal(ILE); |
Ted Kremenek | 67d1287 | 2009-12-07 22:05:27 +0000 | [diff] [blame] | 2475 | const LocationContext *LC = (*I)->getLocationContext(); |
| 2476 | state = state->bindCompoundLiteral(CL, LC, ILV); |
Ted Kremenek | 4f09027 | 2008-10-27 21:54:31 +0000 | [diff] [blame] | 2477 | |
Ted Kremenek | 892697d | 2010-12-16 07:46:53 +0000 | [diff] [blame] | 2478 | if (CL->isLValue()) { |
Ted Kremenek | 67d1287 | 2009-12-07 22:05:27 +0000 | [diff] [blame] | 2479 | MakeNode(Dst, CL, *I, state->BindExpr(CL, state->getLValue(CL, LC))); |
| 2480 | } |
Zhongxing Xu | f22679e | 2008-11-07 10:38:33 +0000 | [diff] [blame] | 2481 | else |
Ted Kremenek | 8e02934 | 2009-08-27 22:17:37 +0000 | [diff] [blame] | 2482 | MakeNode(Dst, CL, *I, state->BindExpr(CL, ILV)); |
Ted Kremenek | 4f09027 | 2008-10-27 21:54:31 +0000 | [diff] [blame] | 2483 | } |
| 2484 | } |
| 2485 | |
Zhongxing Xu | 03509ae | 2010-07-20 06:22:24 +0000 | [diff] [blame] | 2486 | void GRExprEngine::VisitDeclStmt(const DeclStmt *DS, ExplodedNode *Pred, |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2487 | ExplodedNodeSet& Dst) { |
Ted Kremenek | 5b7dcce | 2008-04-22 22:25:27 +0000 | [diff] [blame] | 2488 | |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2489 | // The CFG has one DeclStmt per Decl. |
Zhongxing Xu | 03509ae | 2010-07-20 06:22:24 +0000 | [diff] [blame] | 2490 | const Decl* D = *DS->decl_begin(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2491 | |
Ted Kremenek | e6c62e3 | 2008-08-28 18:34:26 +0000 | [diff] [blame] | 2492 | if (!D || !isa<VarDecl>(D)) |
Ted Kremenek | 5b7dcce | 2008-04-22 22:25:27 +0000 | [diff] [blame] | 2493 | return; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2494 | |
| 2495 | const VarDecl* VD = dyn_cast<VarDecl>(D); |
Zhongxing Xu | 1f19124 | 2010-07-23 02:54:53 +0000 | [diff] [blame] | 2496 | const Expr* InitEx = VD->getInit(); |
Ted Kremenek | 5b7dcce | 2008-04-22 22:25:27 +0000 | [diff] [blame] | 2497 | |
| 2498 | // FIXME: static variables may have an initializer, but the second |
| 2499 | // time a function is called those values may not be current. |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 2500 | ExplodedNodeSet Tmp; |
Ted Kremenek | 5b7dcce | 2008-04-22 22:25:27 +0000 | [diff] [blame] | 2501 | |
Zhongxing Xu | f45fbad | 2010-12-19 02:26:37 +0000 | [diff] [blame] | 2502 | if (InitEx) { |
| 2503 | if (VD->getType()->isReferenceType() && !InitEx->isLValue()) { |
Zhongxing Xu | 05e5391 | 2010-12-22 07:20:27 +0000 | [diff] [blame] | 2504 | // If the initializer is C++ record type, it should already has a |
| 2505 | // temp object. |
| 2506 | if (!InitEx->getType()->isRecordType()) |
| 2507 | CreateCXXTemporaryObject(InitEx, Pred, Tmp); |
| 2508 | else |
| 2509 | Tmp.Add(Pred); |
Zhongxing Xu | f45fbad | 2010-12-19 02:26:37 +0000 | [diff] [blame] | 2510 | } else |
| 2511 | Visit(InitEx, Pred, Tmp); |
| 2512 | } else |
Ted Kremenek | e6c62e3 | 2008-08-28 18:34:26 +0000 | [diff] [blame] | 2513 | Tmp.Add(Pred); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2514 | |
Ted Kremenek | ae16233 | 2009-11-07 03:56:57 +0000 | [diff] [blame] | 2515 | ExplodedNodeSet Tmp2; |
Jordy Rose | 72905cf | 2010-08-04 07:10:57 +0000 | [diff] [blame] | 2516 | CheckerVisit(DS, Tmp2, Tmp, PreVisitStmtCallback); |
Ted Kremenek | b9bbd59 | 2010-02-15 23:02:46 +0000 | [diff] [blame] | 2517 | |
Ted Kremenek | ae16233 | 2009-11-07 03:56:57 +0000 | [diff] [blame] | 2518 | for (ExplodedNodeSet::iterator I=Tmp2.begin(), E=Tmp2.end(); I!=E; ++I) { |
Zhongxing Xu | 5206f0b | 2009-11-03 12:13:38 +0000 | [diff] [blame] | 2519 | ExplodedNode *N = *I; |
Ted Kremenek | ae16233 | 2009-11-07 03:56:57 +0000 | [diff] [blame] | 2520 | const GRState *state = GetState(N); |
Zhongxing Xu | 5206f0b | 2009-11-03 12:13:38 +0000 | [diff] [blame] | 2521 | |
Zhongxing Xu | 4193eca | 2008-12-20 06:32:12 +0000 | [diff] [blame] | 2522 | // Decls without InitExpr are not initialized explicitly. |
Zhongxing Xu | 5206f0b | 2009-11-03 12:13:38 +0000 | [diff] [blame] | 2523 | const LocationContext *LC = N->getLocationContext(); |
Ted Kremenek | d17da2b | 2009-08-21 22:28:32 +0000 | [diff] [blame] | 2524 | |
Ted Kremenek | af33741 | 2008-11-12 19:24:17 +0000 | [diff] [blame] | 2525 | if (InitEx) { |
Ted Kremenek | 1397663 | 2010-02-08 16:18:51 +0000 | [diff] [blame] | 2526 | SVal InitVal = state->getSVal(InitEx); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2527 | |
Zhongxing Xu | 05e5391 | 2010-12-22 07:20:27 +0000 | [diff] [blame] | 2528 | // We bound the temp obj region to the CXXConstructExpr. Now recover |
| 2529 | // the lazy compound value when the variable is not a reference. |
| 2530 | if (AMgr.getLangOptions().CPlusPlus && VD->getType()->isRecordType() && |
| 2531 | !VD->getType()->isReferenceType() && isa<loc::MemRegionVal>(InitVal)){ |
| 2532 | InitVal = state->getSVal(cast<loc::MemRegionVal>(InitVal).getRegion()); |
| 2533 | assert(isa<nonloc::LazyCompoundVal>(InitVal)); |
| 2534 | } |
| 2535 | |
Ted Kremenek | af33741 | 2008-11-12 19:24:17 +0000 | [diff] [blame] | 2536 | // Recover some path-sensitivity if a scalar value evaluated to |
| 2537 | // UnknownVal. |
Ted Kremenek | a804a68 | 2010-03-02 21:43:52 +0000 | [diff] [blame] | 2538 | if ((InitVal.isUnknown() || |
| 2539 | !getConstraintManager().canReasonAbout(InitVal)) && |
| 2540 | !VD->getType()->isReferenceType()) { |
Ted Kremenek | c8413fd | 2010-12-02 07:49:45 +0000 | [diff] [blame] | 2541 | InitVal = svalBuilder.getConjuredSymbolVal(NULL, InitEx, |
Zhongxing Xu | 5206f0b | 2009-11-03 12:13:38 +0000 | [diff] [blame] | 2542 | Builder->getCurrentBlockCount()); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2543 | } |
Ted Kremenek | b9bbd59 | 2010-02-15 23:02:46 +0000 | [diff] [blame] | 2544 | |
Ted Kremenek | 9c14953 | 2010-12-01 21:57:22 +0000 | [diff] [blame] | 2545 | evalBind(Dst, DS, *I, state, |
Ted Kremenek | b9bbd59 | 2010-02-15 23:02:46 +0000 | [diff] [blame] | 2546 | loc::MemRegionVal(state->getRegion(VD, LC)), InitVal, true); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2547 | } |
Ted Kremenek | 5b8d901 | 2009-02-14 01:54:57 +0000 | [diff] [blame] | 2548 | else { |
Ted Kremenek | f6f56d4 | 2009-11-04 00:09:15 +0000 | [diff] [blame] | 2549 | state = state->bindDeclWithNoInit(state->getRegion(VD, LC)); |
Ted Kremenek | 5b8d901 | 2009-02-14 01:54:57 +0000 | [diff] [blame] | 2550 | MakeNode(Dst, DS, *I, state); |
Ted Kremenek | efd5994 | 2008-12-08 22:47:34 +0000 | [diff] [blame] | 2551 | } |
Ted Kremenek | 5b7dcce | 2008-04-22 22:25:27 +0000 | [diff] [blame] | 2552 | } |
Ted Kremenek | 9de04c4 | 2008-01-24 20:55:43 +0000 | [diff] [blame] | 2553 | } |
Ted Kremenek | 874d63f | 2008-01-24 02:02:54 +0000 | [diff] [blame] | 2554 | |
Zhongxing Xu | 03509ae | 2010-07-20 06:22:24 +0000 | [diff] [blame] | 2555 | void GRExprEngine::VisitCondInit(const VarDecl *VD, const Stmt *S, |
Ted Kremenek | fcfb503 | 2009-12-24 00:40:03 +0000 | [diff] [blame] | 2556 | ExplodedNode *Pred, ExplodedNodeSet& Dst) { |
Ted Kremenek | b9bbd59 | 2010-02-15 23:02:46 +0000 | [diff] [blame] | 2557 | |
Zhongxing Xu | 03509ae | 2010-07-20 06:22:24 +0000 | [diff] [blame] | 2558 | const Expr* InitEx = VD->getInit(); |
Ted Kremenek | 61dfbec | 2009-12-23 04:49:01 +0000 | [diff] [blame] | 2559 | ExplodedNodeSet Tmp; |
| 2560 | Visit(InitEx, Pred, Tmp); |
| 2561 | |
| 2562 | for (ExplodedNodeSet::iterator I=Tmp.begin(), E=Tmp.end(); I!=E; ++I) { |
| 2563 | ExplodedNode *N = *I; |
| 2564 | const GRState *state = GetState(N); |
Ted Kremenek | b9bbd59 | 2010-02-15 23:02:46 +0000 | [diff] [blame] | 2565 | |
Ted Kremenek | 61dfbec | 2009-12-23 04:49:01 +0000 | [diff] [blame] | 2566 | const LocationContext *LC = N->getLocationContext(); |
Ted Kremenek | 1397663 | 2010-02-08 16:18:51 +0000 | [diff] [blame] | 2567 | SVal InitVal = state->getSVal(InitEx); |
Ted Kremenek | b9bbd59 | 2010-02-15 23:02:46 +0000 | [diff] [blame] | 2568 | |
Ted Kremenek | 61dfbec | 2009-12-23 04:49:01 +0000 | [diff] [blame] | 2569 | // Recover some path-sensitivity if a scalar value evaluated to |
| 2570 | // UnknownVal. |
| 2571 | if (InitVal.isUnknown() || |
| 2572 | !getConstraintManager().canReasonAbout(InitVal)) { |
Ted Kremenek | c8413fd | 2010-12-02 07:49:45 +0000 | [diff] [blame] | 2573 | InitVal = svalBuilder.getConjuredSymbolVal(NULL, InitEx, |
Ted Kremenek | 61dfbec | 2009-12-23 04:49:01 +0000 | [diff] [blame] | 2574 | Builder->getCurrentBlockCount()); |
| 2575 | } |
Ted Kremenek | b9bbd59 | 2010-02-15 23:02:46 +0000 | [diff] [blame] | 2576 | |
Ted Kremenek | 9c14953 | 2010-12-01 21:57:22 +0000 | [diff] [blame] | 2577 | evalBind(Dst, S, N, state, |
Ted Kremenek | 61dfbec | 2009-12-23 04:49:01 +0000 | [diff] [blame] | 2578 | loc::MemRegionVal(state->getRegion(VD, LC)), InitVal, true); |
| 2579 | } |
| 2580 | } |
| 2581 | |
Ted Kremenek | f75b186 | 2008-10-30 17:47:32 +0000 | [diff] [blame] | 2582 | namespace { |
| 2583 | // This class is used by VisitInitListExpr as an item in a worklist |
| 2584 | // for processing the values contained in an InitListExpr. |
Kovarththanan Rajaratnam | ba5fb5a | 2009-11-28 06:07:30 +0000 | [diff] [blame] | 2585 | class InitListWLItem { |
Ted Kremenek | f75b186 | 2008-10-30 17:47:32 +0000 | [diff] [blame] | 2586 | public: |
| 2587 | llvm::ImmutableList<SVal> Vals; |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 2588 | ExplodedNode* N; |
Zhongxing Xu | 03509ae | 2010-07-20 06:22:24 +0000 | [diff] [blame] | 2589 | InitListExpr::const_reverse_iterator Itr; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2590 | |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 2591 | InitListWLItem(ExplodedNode* n, llvm::ImmutableList<SVal> vals, |
Zhongxing Xu | 03509ae | 2010-07-20 06:22:24 +0000 | [diff] [blame] | 2592 | InitListExpr::const_reverse_iterator itr) |
Ted Kremenek | f75b186 | 2008-10-30 17:47:32 +0000 | [diff] [blame] | 2593 | : Vals(vals), N(n), Itr(itr) {} |
| 2594 | }; |
| 2595 | } |
| 2596 | |
| 2597 | |
Zhongxing Xu | 03509ae | 2010-07-20 06:22:24 +0000 | [diff] [blame] | 2598 | void GRExprEngine::VisitInitListExpr(const InitListExpr* E, ExplodedNode* Pred, |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 2599 | ExplodedNodeSet& Dst) { |
Ted Kremenek | a49e367 | 2008-10-30 23:14:36 +0000 | [diff] [blame] | 2600 | |
Zhongxing Xu | c4f8706 | 2008-10-30 05:02:23 +0000 | [diff] [blame] | 2601 | const GRState* state = GetState(Pred); |
Ted Kremenek | 76dba7b | 2008-11-13 05:05:34 +0000 | [diff] [blame] | 2602 | QualType T = getContext().getCanonicalType(E->getType()); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2603 | unsigned NumInitElements = E->getNumInits(); |
Zhongxing Xu | c4f8706 | 2008-10-30 05:02:23 +0000 | [diff] [blame] | 2604 | |
Douglas Gregor | fb87b89 | 2010-04-26 21:31:17 +0000 | [diff] [blame] | 2605 | if (T->isArrayType() || T->isRecordType() || T->isVectorType()) { |
Ted Kremenek | a49e367 | 2008-10-30 23:14:36 +0000 | [diff] [blame] | 2606 | llvm::ImmutableList<SVal> StartVals = getBasicVals().getEmptySValList(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2607 | |
Ted Kremenek | a49e367 | 2008-10-30 23:14:36 +0000 | [diff] [blame] | 2608 | // Handle base case where the initializer has no elements. |
| 2609 | // e.g: static int* myArray[] = {}; |
| 2610 | if (NumInitElements == 0) { |
Ted Kremenek | c8413fd | 2010-12-02 07:49:45 +0000 | [diff] [blame] | 2611 | SVal V = svalBuilder.makeCompoundVal(T, StartVals); |
Ted Kremenek | 8e02934 | 2009-08-27 22:17:37 +0000 | [diff] [blame] | 2612 | MakeNode(Dst, E, Pred, state->BindExpr(E, V)); |
Ted Kremenek | a49e367 | 2008-10-30 23:14:36 +0000 | [diff] [blame] | 2613 | return; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2614 | } |
| 2615 | |
Ted Kremenek | a49e367 | 2008-10-30 23:14:36 +0000 | [diff] [blame] | 2616 | // Create a worklist to process the initializers. |
| 2617 | llvm::SmallVector<InitListWLItem, 10> WorkList; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2618 | WorkList.reserve(NumInitElements); |
| 2619 | WorkList.push_back(InitListWLItem(Pred, StartVals, E->rbegin())); |
Zhongxing Xu | 03509ae | 2010-07-20 06:22:24 +0000 | [diff] [blame] | 2620 | InitListExpr::const_reverse_iterator ItrEnd = E->rend(); |
Ted Kremenek | cf54959 | 2009-09-22 21:19:14 +0000 | [diff] [blame] | 2621 | assert(!(E->rbegin() == E->rend())); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2622 | |
Ted Kremenek | a49e367 | 2008-10-30 23:14:36 +0000 | [diff] [blame] | 2623 | // Process the worklist until it is empty. |
Ted Kremenek | f75b186 | 2008-10-30 17:47:32 +0000 | [diff] [blame] | 2624 | while (!WorkList.empty()) { |
| 2625 | InitListWLItem X = WorkList.back(); |
| 2626 | WorkList.pop_back(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2627 | |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 2628 | ExplodedNodeSet Tmp; |
Ted Kremenek | f75b186 | 2008-10-30 17:47:32 +0000 | [diff] [blame] | 2629 | Visit(*X.Itr, X.N, Tmp); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2630 | |
Zhongxing Xu | 03509ae | 2010-07-20 06:22:24 +0000 | [diff] [blame] | 2631 | InitListExpr::const_reverse_iterator NewItr = X.Itr + 1; |
Zhongxing Xu | c4f8706 | 2008-10-30 05:02:23 +0000 | [diff] [blame] | 2632 | |
Zhongxing Xu | bb14121 | 2009-12-16 11:27:52 +0000 | [diff] [blame] | 2633 | for (ExplodedNodeSet::iterator NI=Tmp.begin(),NE=Tmp.end();NI!=NE;++NI) { |
Ted Kremenek | f75b186 | 2008-10-30 17:47:32 +0000 | [diff] [blame] | 2634 | // Get the last initializer value. |
| 2635 | state = GetState(*NI); |
Ted Kremenek | 1397663 | 2010-02-08 16:18:51 +0000 | [diff] [blame] | 2636 | SVal InitV = state->getSVal(cast<Expr>(*X.Itr)); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2637 | |
Ted Kremenek | f75b186 | 2008-10-30 17:47:32 +0000 | [diff] [blame] | 2638 | // Construct the new list of values by prepending the new value to |
| 2639 | // the already constructed list. |
| 2640 | llvm::ImmutableList<SVal> NewVals = |
| 2641 | getBasicVals().consVals(InitV, X.Vals); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2642 | |
Ted Kremenek | f75b186 | 2008-10-30 17:47:32 +0000 | [diff] [blame] | 2643 | if (NewItr == ItrEnd) { |
Zhongxing Xu | a189dca | 2008-10-31 03:01:26 +0000 | [diff] [blame] | 2644 | // Now we have a list holding all init values. Make CompoundValData. |
Ted Kremenek | c8413fd | 2010-12-02 07:49:45 +0000 | [diff] [blame] | 2645 | SVal V = svalBuilder.makeCompoundVal(T, NewVals); |
Zhongxing Xu | c4f8706 | 2008-10-30 05:02:23 +0000 | [diff] [blame] | 2646 | |
Ted Kremenek | f75b186 | 2008-10-30 17:47:32 +0000 | [diff] [blame] | 2647 | // Make final state and node. |
Ted Kremenek | 8e02934 | 2009-08-27 22:17:37 +0000 | [diff] [blame] | 2648 | MakeNode(Dst, E, *NI, state->BindExpr(E, V)); |
Ted Kremenek | f75b186 | 2008-10-30 17:47:32 +0000 | [diff] [blame] | 2649 | } |
| 2650 | else { |
| 2651 | // Still some initializer values to go. Push them onto the worklist. |
| 2652 | WorkList.push_back(InitListWLItem(*NI, NewVals, NewItr)); |
| 2653 | } |
| 2654 | } |
Zhongxing Xu | c4f8706 | 2008-10-30 05:02:23 +0000 | [diff] [blame] | 2655 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2656 | |
Ted Kremenek | 8790307 | 2008-10-30 18:34:31 +0000 | [diff] [blame] | 2657 | return; |
Zhongxing Xu | c4f8706 | 2008-10-30 05:02:23 +0000 | [diff] [blame] | 2658 | } |
| 2659 | |
Zhongxing Xu | c4f8706 | 2008-10-30 05:02:23 +0000 | [diff] [blame] | 2660 | if (Loc::IsLocType(T) || T->isIntegerType()) { |
| 2661 | assert (E->getNumInits() == 1); |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 2662 | ExplodedNodeSet Tmp; |
Zhongxing Xu | 03509ae | 2010-07-20 06:22:24 +0000 | [diff] [blame] | 2663 | const Expr* Init = E->getInit(0); |
Zhongxing Xu | c4f8706 | 2008-10-30 05:02:23 +0000 | [diff] [blame] | 2664 | Visit(Init, Pred, Tmp); |
Zhongxing Xu | bb14121 | 2009-12-16 11:27:52 +0000 | [diff] [blame] | 2665 | for (ExplodedNodeSet::iterator I=Tmp.begin(), EI=Tmp.end(); I != EI; ++I) { |
Zhongxing Xu | c4f8706 | 2008-10-30 05:02:23 +0000 | [diff] [blame] | 2666 | state = GetState(*I); |
Ted Kremenek | 1397663 | 2010-02-08 16:18:51 +0000 | [diff] [blame] | 2667 | MakeNode(Dst, E, *I, state->BindExpr(E, state->getSVal(Init))); |
Zhongxing Xu | c4f8706 | 2008-10-30 05:02:23 +0000 | [diff] [blame] | 2668 | } |
| 2669 | return; |
| 2670 | } |
| 2671 | |
Zhongxing Xu | c4f8706 | 2008-10-30 05:02:23 +0000 | [diff] [blame] | 2672 | assert(0 && "unprocessed InitListExpr type"); |
| 2673 | } |
Ted Kremenek | f233d48 | 2008-02-05 00:26:40 +0000 | [diff] [blame] | 2674 | |
Sebastian Redl | 0518999 | 2008-11-11 17:56:53 +0000 | [diff] [blame] | 2675 | /// VisitSizeOfAlignOfExpr - Transfer function for sizeof(type). |
Zhongxing Xu | 03509ae | 2010-07-20 06:22:24 +0000 | [diff] [blame] | 2676 | void GRExprEngine::VisitSizeOfAlignOfExpr(const SizeOfAlignOfExpr* Ex, |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 2677 | ExplodedNode* Pred, |
| 2678 | ExplodedNodeSet& Dst) { |
Sebastian Redl | 0518999 | 2008-11-11 17:56:53 +0000 | [diff] [blame] | 2679 | QualType T = Ex->getTypeOfArgument(); |
Ken Dyck | 199c3d6 | 2010-01-11 17:06:35 +0000 | [diff] [blame] | 2680 | CharUnits amt; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2681 | |
Ted Kremenek | 87e8034 | 2008-03-15 03:13:20 +0000 | [diff] [blame] | 2682 | if (Ex->isSizeOf()) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2683 | if (T == getContext().VoidTy) { |
Ted Kremenek | 55f7bcb | 2008-12-15 18:51:00 +0000 | [diff] [blame] | 2684 | // sizeof(void) == 1 byte. |
Ken Dyck | 199c3d6 | 2010-01-11 17:06:35 +0000 | [diff] [blame] | 2685 | amt = CharUnits::One(); |
Ted Kremenek | 55f7bcb | 2008-12-15 18:51:00 +0000 | [diff] [blame] | 2686 | } |
Jordy Rose | b7e3aab | 2010-07-05 04:42:43 +0000 | [diff] [blame] | 2687 | else if (!T->isConstantSizeType()) { |
| 2688 | assert(T->isVariableArrayType() && "Unknown non-constant-sized type."); |
| 2689 | |
| 2690 | // FIXME: Add support for VLA type arguments, not just VLA expressions. |
| 2691 | // When that happens, we should probably refactor VLASizeChecker's code. |
| 2692 | if (Ex->isArgumentType()) { |
| 2693 | Dst.Add(Pred); |
| 2694 | return; |
| 2695 | } |
| 2696 | |
| 2697 | // Get the size by getting the extent of the sub-expression. |
| 2698 | // First, visit the sub-expression to find its region. |
Zhongxing Xu | 03509ae | 2010-07-20 06:22:24 +0000 | [diff] [blame] | 2699 | const Expr *Arg = Ex->getArgumentExpr(); |
Jordy Rose | b7e3aab | 2010-07-05 04:42:43 +0000 | [diff] [blame] | 2700 | ExplodedNodeSet Tmp; |
Ted Kremenek | 892697d | 2010-12-16 07:46:53 +0000 | [diff] [blame] | 2701 | Visit(Arg, Pred, Tmp); |
Jordy Rose | b7e3aab | 2010-07-05 04:42:43 +0000 | [diff] [blame] | 2702 | |
| 2703 | for (ExplodedNodeSet::iterator I=Tmp.begin(), E=Tmp.end(); I!=E; ++I) { |
| 2704 | const GRState* state = GetState(*I); |
| 2705 | const MemRegion *MR = state->getSVal(Arg).getAsRegion(); |
| 2706 | |
| 2707 | // If the subexpression can't be resolved to a region, we don't know |
| 2708 | // anything about its size. Just leave the state as is and continue. |
| 2709 | if (!MR) { |
| 2710 | Dst.Add(*I); |
| 2711 | continue; |
| 2712 | } |
| 2713 | |
| 2714 | // The result is the extent of the VLA. |
Ted Kremenek | c8413fd | 2010-12-02 07:49:45 +0000 | [diff] [blame] | 2715 | SVal Extent = cast<SubRegion>(MR)->getExtent(svalBuilder); |
Jordy Rose | b7e3aab | 2010-07-05 04:42:43 +0000 | [diff] [blame] | 2716 | MakeNode(Dst, Ex, *I, state->BindExpr(Ex, Extent)); |
| 2717 | } |
| 2718 | |
Ted Kremenek | 87e8034 | 2008-03-15 03:13:20 +0000 | [diff] [blame] | 2719 | return; |
Ted Kremenek | 55f7bcb | 2008-12-15 18:51:00 +0000 | [diff] [blame] | 2720 | } |
John McCall | c12c5bb | 2010-05-15 11:32:37 +0000 | [diff] [blame] | 2721 | else if (T->getAs<ObjCObjectType>()) { |
| 2722 | // Some code tries to take the sizeof an ObjCObjectType, relying that |
Ted Kremenek | 55f7bcb | 2008-12-15 18:51:00 +0000 | [diff] [blame] | 2723 | // the compiler has laid out its representation. Just report Unknown |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2724 | // for these. |
Ted Kremenek | 61e8e1b | 2010-02-02 02:01:51 +0000 | [diff] [blame] | 2725 | Dst.Add(Pred); |
Ted Kremenek | f342d18 | 2008-04-30 21:31:12 +0000 | [diff] [blame] | 2726 | return; |
Ted Kremenek | 55f7bcb | 2008-12-15 18:51:00 +0000 | [diff] [blame] | 2727 | } |
| 2728 | else { |
| 2729 | // All other cases. |
Ken Dyck | 199c3d6 | 2010-01-11 17:06:35 +0000 | [diff] [blame] | 2730 | amt = getContext().getTypeSizeInChars(T); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2731 | } |
Ted Kremenek | 87e8034 | 2008-03-15 03:13:20 +0000 | [diff] [blame] | 2732 | } |
| 2733 | else // Get alignment of the type. |
Ken Dyck | da8e585 | 2010-01-27 12:54:25 +0000 | [diff] [blame] | 2734 | amt = getContext().getTypeAlignInChars(T); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2735 | |
Ted Kremenek | 0e561a3 | 2008-03-21 21:30:14 +0000 | [diff] [blame] | 2736 | MakeNode(Dst, Ex, Pred, |
Ted Kremenek | b9bbd59 | 2010-02-15 23:02:46 +0000 | [diff] [blame] | 2737 | GetState(Pred)->BindExpr(Ex, |
Ted Kremenek | c8413fd | 2010-12-02 07:49:45 +0000 | [diff] [blame] | 2738 | svalBuilder.makeIntVal(amt.getQuantity(), Ex->getType()))); |
Ted Kremenek | d9435bf | 2008-02-12 19:49:57 +0000 | [diff] [blame] | 2739 | } |
| 2740 | |
Zhongxing Xu | 03509ae | 2010-07-20 06:22:24 +0000 | [diff] [blame] | 2741 | void GRExprEngine::VisitOffsetOfExpr(const OffsetOfExpr* OOE, |
| 2742 | ExplodedNode* Pred, ExplodedNodeSet& Dst) { |
Douglas Gregor | 8ecdb65 | 2010-04-28 22:16:22 +0000 | [diff] [blame] | 2743 | Expr::EvalResult Res; |
| 2744 | if (OOE->Evaluate(Res, getContext()) && Res.Val.isInt()) { |
| 2745 | const APSInt &IV = Res.Val.getInt(); |
| 2746 | assert(IV.getBitWidth() == getContext().getTypeSize(OOE->getType())); |
| 2747 | assert(OOE->getType()->isIntegerType()); |
| 2748 | assert(IV.isSigned() == OOE->getType()->isSignedIntegerType()); |
Ted Kremenek | c8413fd | 2010-12-02 07:49:45 +0000 | [diff] [blame] | 2749 | SVal X = svalBuilder.makeIntVal(IV); |
Douglas Gregor | 8ecdb65 | 2010-04-28 22:16:22 +0000 | [diff] [blame] | 2750 | MakeNode(Dst, OOE, Pred, GetState(Pred)->BindExpr(OOE, X)); |
| 2751 | return; |
| 2752 | } |
| 2753 | // FIXME: Handle the case where __builtin_offsetof is not a constant. |
| 2754 | Dst.Add(Pred); |
| 2755 | } |
Ted Kremenek | d8e9f0d | 2008-02-20 04:02:35 +0000 | [diff] [blame] | 2756 | |
Zhongxing Xu | 03509ae | 2010-07-20 06:22:24 +0000 | [diff] [blame] | 2757 | void GRExprEngine::VisitUnaryOperator(const UnaryOperator* U, |
| 2758 | ExplodedNode* Pred, |
Ted Kremenek | 892697d | 2010-12-16 07:46:53 +0000 | [diff] [blame] | 2759 | ExplodedNodeSet& Dst) { |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 2760 | |
Ted Kremenek | d8e9f0d | 2008-02-20 04:02:35 +0000 | [diff] [blame] | 2761 | switch (U->getOpcode()) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2762 | |
Ted Kremenek | d8e9f0d | 2008-02-20 04:02:35 +0000 | [diff] [blame] | 2763 | default: |
Ted Kremenek | d8e9f0d | 2008-02-20 04:02:35 +0000 | [diff] [blame] | 2764 | break; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2765 | |
John McCall | 2de56d1 | 2010-08-25 11:45:40 +0000 | [diff] [blame] | 2766 | case UO_Real: { |
Zhongxing Xu | 03509ae | 2010-07-20 06:22:24 +0000 | [diff] [blame] | 2767 | const Expr* Ex = U->getSubExpr()->IgnoreParens(); |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 2768 | ExplodedNodeSet Tmp; |
Ted Kremenek | b8e26e6 | 2008-06-19 17:55:38 +0000 | [diff] [blame] | 2769 | Visit(Ex, Pred, Tmp); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2770 | |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 2771 | for (ExplodedNodeSet::iterator I=Tmp.begin(), E=Tmp.end(); I!=E; ++I) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2772 | |
Zhongxing Xu | 1c96b24 | 2008-10-17 05:57:07 +0000 | [diff] [blame] | 2773 | // FIXME: We don't have complex SValues yet. |
Ted Kremenek | b8e26e6 | 2008-06-19 17:55:38 +0000 | [diff] [blame] | 2774 | if (Ex->getType()->isAnyComplexType()) { |
| 2775 | // Just report "Unknown." |
| 2776 | Dst.Add(*I); |
| 2777 | continue; |
| 2778 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2779 | |
John McCall | 2de56d1 | 2010-08-25 11:45:40 +0000 | [diff] [blame] | 2780 | // For all other types, UO_Real is an identity operation. |
Ted Kremenek | b8e26e6 | 2008-06-19 17:55:38 +0000 | [diff] [blame] | 2781 | assert (U->getType() == Ex->getType()); |
Ted Kremenek | a8538d9 | 2009-02-13 01:45:31 +0000 | [diff] [blame] | 2782 | const GRState* state = GetState(*I); |
Ted Kremenek | 1397663 | 2010-02-08 16:18:51 +0000 | [diff] [blame] | 2783 | MakeNode(Dst, U, *I, state->BindExpr(U, state->getSVal(Ex))); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2784 | } |
| 2785 | |
Ted Kremenek | b8e26e6 | 2008-06-19 17:55:38 +0000 | [diff] [blame] | 2786 | return; |
| 2787 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2788 | |
John McCall | 2de56d1 | 2010-08-25 11:45:40 +0000 | [diff] [blame] | 2789 | case UO_Imag: { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2790 | |
Zhongxing Xu | 03509ae | 2010-07-20 06:22:24 +0000 | [diff] [blame] | 2791 | const Expr* Ex = U->getSubExpr()->IgnoreParens(); |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 2792 | ExplodedNodeSet Tmp; |
Ted Kremenek | b8e26e6 | 2008-06-19 17:55:38 +0000 | [diff] [blame] | 2793 | Visit(Ex, Pred, Tmp); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2794 | |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 2795 | for (ExplodedNodeSet::iterator I=Tmp.begin(), E=Tmp.end(); I!=E; ++I) { |
Zhongxing Xu | 1c96b24 | 2008-10-17 05:57:07 +0000 | [diff] [blame] | 2796 | // FIXME: We don't have complex SValues yet. |
Ted Kremenek | b8e26e6 | 2008-06-19 17:55:38 +0000 | [diff] [blame] | 2797 | if (Ex->getType()->isAnyComplexType()) { |
| 2798 | // Just report "Unknown." |
| 2799 | Dst.Add(*I); |
| 2800 | continue; |
| 2801 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2802 | |
John McCall | 2de56d1 | 2010-08-25 11:45:40 +0000 | [diff] [blame] | 2803 | // For all other types, UO_Imag returns 0. |
Ted Kremenek | a8538d9 | 2009-02-13 01:45:31 +0000 | [diff] [blame] | 2804 | const GRState* state = GetState(*I); |
Ted Kremenek | c8413fd | 2010-12-02 07:49:45 +0000 | [diff] [blame] | 2805 | SVal X = svalBuilder.makeZeroVal(Ex->getType()); |
Ted Kremenek | 8e02934 | 2009-08-27 22:17:37 +0000 | [diff] [blame] | 2806 | MakeNode(Dst, U, *I, state->BindExpr(U, X)); |
Ted Kremenek | b8e26e6 | 2008-06-19 17:55:38 +0000 | [diff] [blame] | 2807 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2808 | |
Ted Kremenek | b8e26e6 | 2008-06-19 17:55:38 +0000 | [diff] [blame] | 2809 | return; |
| 2810 | } |
Douglas Gregor | 8ecdb65 | 2010-04-28 22:16:22 +0000 | [diff] [blame] | 2811 | |
Ted Kremenek | 892697d | 2010-12-16 07:46:53 +0000 | [diff] [blame] | 2812 | case UO_Plus: |
| 2813 | assert(!U->isLValue()); |
| 2814 | // FALL-THROUGH. |
| 2815 | case UO_Deref: |
Zhongxing Xu | 9c2bac0 | 2010-12-18 05:16:43 +0000 | [diff] [blame] | 2816 | case UO_AddrOf: |
John McCall | 2de56d1 | 2010-08-25 11:45:40 +0000 | [diff] [blame] | 2817 | case UO_Extension: { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2818 | |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 2819 | // Unary "+" is a no-op, similar to a parentheses. We still have places |
| 2820 | // where it may be a block-level expression, so we need to |
| 2821 | // generate an extra node that just propagates the value of the |
| 2822 | // subexpression. |
| 2823 | |
Zhongxing Xu | 03509ae | 2010-07-20 06:22:24 +0000 | [diff] [blame] | 2824 | const Expr* Ex = U->getSubExpr()->IgnoreParens(); |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 2825 | ExplodedNodeSet Tmp; |
Ted Kremenek | 892697d | 2010-12-16 07:46:53 +0000 | [diff] [blame] | 2826 | Visit(Ex, Pred, Tmp); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2827 | |
| 2828 | for (ExplodedNodeSet::iterator I=Tmp.begin(), E=Tmp.end(); I!=E; ++I) { |
Ted Kremenek | a8538d9 | 2009-02-13 01:45:31 +0000 | [diff] [blame] | 2829 | const GRState* state = GetState(*I); |
Ted Kremenek | 1397663 | 2010-02-08 16:18:51 +0000 | [diff] [blame] | 2830 | MakeNode(Dst, U, *I, state->BindExpr(U, state->getSVal(Ex))); |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 2831 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2832 | |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 2833 | return; |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 2834 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2835 | |
John McCall | 2de56d1 | 2010-08-25 11:45:40 +0000 | [diff] [blame] | 2836 | case UO_LNot: |
| 2837 | case UO_Minus: |
| 2838 | case UO_Not: { |
Ted Kremenek | 892697d | 2010-12-16 07:46:53 +0000 | [diff] [blame] | 2839 | assert (!U->isLValue()); |
Zhongxing Xu | 03509ae | 2010-07-20 06:22:24 +0000 | [diff] [blame] | 2840 | const Expr* Ex = U->getSubExpr()->IgnoreParens(); |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 2841 | ExplodedNodeSet Tmp; |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 2842 | Visit(Ex, Pred, Tmp); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2843 | |
| 2844 | for (ExplodedNodeSet::iterator I=Tmp.begin(), E=Tmp.end(); I!=E; ++I) { |
Ted Kremenek | a8538d9 | 2009-02-13 01:45:31 +0000 | [diff] [blame] | 2845 | const GRState* state = GetState(*I); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2846 | |
Ted Kremenek | 855cd90 | 2008-09-30 05:32:44 +0000 | [diff] [blame] | 2847 | // Get the value of the subexpression. |
Ted Kremenek | 1397663 | 2010-02-08 16:18:51 +0000 | [diff] [blame] | 2848 | SVal V = state->getSVal(Ex); |
Ted Kremenek | 855cd90 | 2008-09-30 05:32:44 +0000 | [diff] [blame] | 2849 | |
Ted Kremenek | e04a5cb | 2008-11-15 00:20:05 +0000 | [diff] [blame] | 2850 | if (V.isUnknownOrUndef()) { |
Ted Kremenek | 8e02934 | 2009-08-27 22:17:37 +0000 | [diff] [blame] | 2851 | MakeNode(Dst, U, *I, state->BindExpr(U, V)); |
Ted Kremenek | e04a5cb | 2008-11-15 00:20:05 +0000 | [diff] [blame] | 2852 | continue; |
| 2853 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2854 | |
Ted Kremenek | 60595da | 2008-11-15 04:01:56 +0000 | [diff] [blame] | 2855 | // QualType DstT = getContext().getCanonicalType(U->getType()); |
| 2856 | // QualType SrcT = getContext().getCanonicalType(Ex->getType()); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2857 | // |
Ted Kremenek | 60595da | 2008-11-15 04:01:56 +0000 | [diff] [blame] | 2858 | // if (DstT != SrcT) // Perform promotions. |
Ted Kremenek | 9c14953 | 2010-12-01 21:57:22 +0000 | [diff] [blame] | 2859 | // V = evalCast(V, DstT); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2860 | // |
Ted Kremenek | 60595da | 2008-11-15 04:01:56 +0000 | [diff] [blame] | 2861 | // if (V.isUnknownOrUndef()) { |
| 2862 | // MakeNode(Dst, U, *I, BindExpr(St, U, V)); |
| 2863 | // continue; |
| 2864 | // } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2865 | |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 2866 | switch (U->getOpcode()) { |
| 2867 | default: |
| 2868 | assert(false && "Invalid Opcode."); |
| 2869 | break; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2870 | |
John McCall | 2de56d1 | 2010-08-25 11:45:40 +0000 | [diff] [blame] | 2871 | case UO_Not: |
Ted Kremenek | 60a6e0c | 2008-10-01 00:21:14 +0000 | [diff] [blame] | 2872 | // FIXME: Do we need to handle promotions? |
Ted Kremenek | 9c14953 | 2010-12-01 21:57:22 +0000 | [diff] [blame] | 2873 | state = state->BindExpr(U, evalComplement(cast<NonLoc>(V))); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2874 | break; |
| 2875 | |
John McCall | 2de56d1 | 2010-08-25 11:45:40 +0000 | [diff] [blame] | 2876 | case UO_Minus: |
Ted Kremenek | 60a6e0c | 2008-10-01 00:21:14 +0000 | [diff] [blame] | 2877 | // FIXME: Do we need to handle promotions? |
Ted Kremenek | 9c14953 | 2010-12-01 21:57:22 +0000 | [diff] [blame] | 2878 | state = state->BindExpr(U, evalMinus(cast<NonLoc>(V))); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2879 | break; |
| 2880 | |
John McCall | 2de56d1 | 2010-08-25 11:45:40 +0000 | [diff] [blame] | 2881 | case UO_LNot: |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2882 | |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 2883 | // C99 6.5.3.3: "The expression !E is equivalent to (0==E)." |
| 2884 | // |
| 2885 | // Note: technically we do "E == 0", but this is the same in the |
| 2886 | // transfer functions as "0 == E". |
Ted Kremenek | 6c07bdb | 2009-06-26 00:05:51 +0000 | [diff] [blame] | 2887 | SVal Result; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2888 | |
Zhongxing Xu | 1c96b24 | 2008-10-17 05:57:07 +0000 | [diff] [blame] | 2889 | if (isa<Loc>(V)) { |
Ted Kremenek | c8413fd | 2010-12-02 07:49:45 +0000 | [diff] [blame] | 2890 | Loc X = svalBuilder.makeNull(); |
Ted Kremenek | 9c14953 | 2010-12-01 21:57:22 +0000 | [diff] [blame] | 2891 | Result = evalBinOp(state, BO_EQ, cast<Loc>(V), X, |
Ted Kremenek | 6c07bdb | 2009-06-26 00:05:51 +0000 | [diff] [blame] | 2892 | U->getType()); |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 2893 | } |
| 2894 | else { |
Ted Kremenek | 60595da | 2008-11-15 04:01:56 +0000 | [diff] [blame] | 2895 | nonloc::ConcreteInt X(getBasicVals().getValue(0, Ex->getType())); |
Ted Kremenek | 9c14953 | 2010-12-01 21:57:22 +0000 | [diff] [blame] | 2896 | Result = evalBinOp(state, BO_EQ, cast<NonLoc>(V), X, |
Ted Kremenek | 6c07bdb | 2009-06-26 00:05:51 +0000 | [diff] [blame] | 2897 | U->getType()); |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 2898 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2899 | |
Ted Kremenek | 8e02934 | 2009-08-27 22:17:37 +0000 | [diff] [blame] | 2900 | state = state->BindExpr(U, Result); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2901 | |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 2902 | break; |
| 2903 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2904 | |
Ted Kremenek | a8538d9 | 2009-02-13 01:45:31 +0000 | [diff] [blame] | 2905 | MakeNode(Dst, U, *I, state); |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 2906 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2907 | |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 2908 | return; |
| 2909 | } |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 2910 | } |
| 2911 | |
| 2912 | // Handle ++ and -- (both pre- and post-increment). |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 2913 | assert (U->isIncrementDecrementOp()); |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 2914 | ExplodedNodeSet Tmp; |
Zhongxing Xu | 03509ae | 2010-07-20 06:22:24 +0000 | [diff] [blame] | 2915 | const Expr* Ex = U->getSubExpr()->IgnoreParens(); |
Ted Kremenek | 892697d | 2010-12-16 07:46:53 +0000 | [diff] [blame] | 2916 | Visit(Ex, Pred, Tmp); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2917 | |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 2918 | for (ExplodedNodeSet::iterator I = Tmp.begin(), E = Tmp.end(); I!=E; ++I) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2919 | |
Ted Kremenek | a8538d9 | 2009-02-13 01:45:31 +0000 | [diff] [blame] | 2920 | const GRState* state = GetState(*I); |
Zhongxing Xu | 250704b | 2010-12-22 08:38:13 +0000 | [diff] [blame] | 2921 | SVal loc = state->getSVal(Ex); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2922 | |
| 2923 | // Perform a load. |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 2924 | ExplodedNodeSet Tmp2; |
Zhongxing Xu | 250704b | 2010-12-22 08:38:13 +0000 | [diff] [blame] | 2925 | evalLoad(Tmp2, Ex, *I, state, loc); |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 2926 | |
Zhongxing Xu | bb14121 | 2009-12-16 11:27:52 +0000 | [diff] [blame] | 2927 | for (ExplodedNodeSet::iterator I2=Tmp2.begin(), E2=Tmp2.end();I2!=E2;++I2) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2928 | |
Ted Kremenek | a8538d9 | 2009-02-13 01:45:31 +0000 | [diff] [blame] | 2929 | state = GetState(*I2); |
Ted Kremenek | 1397663 | 2010-02-08 16:18:51 +0000 | [diff] [blame] | 2930 | SVal V2_untested = state->getSVal(Ex); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2931 | |
| 2932 | // Propagate unknown and undefined values. |
Ted Kremenek | 5b9bd21 | 2009-09-11 22:07:28 +0000 | [diff] [blame] | 2933 | if (V2_untested.isUnknownOrUndef()) { |
| 2934 | MakeNode(Dst, U, *I2, state->BindExpr(U, V2_untested)); |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 2935 | continue; |
Ted Kremenek | b9bbd59 | 2010-02-15 23:02:46 +0000 | [diff] [blame] | 2936 | } |
Ted Kremenek | 5b9bd21 | 2009-09-11 22:07:28 +0000 | [diff] [blame] | 2937 | DefinedSVal V2 = cast<DefinedSVal>(V2_untested); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2938 | |
| 2939 | // Handle all other values. |
John McCall | 2de56d1 | 2010-08-25 11:45:40 +0000 | [diff] [blame] | 2940 | BinaryOperator::Opcode Op = U->isIncrementOp() ? BO_Add |
| 2941 | : BO_Sub; |
Ted Kremenek | 21028dd | 2009-03-11 03:54:24 +0000 | [diff] [blame] | 2942 | |
Zhongxing Xu | a52ad4e | 2009-08-05 02:51:59 +0000 | [diff] [blame] | 2943 | // If the UnaryOperator has non-location type, use its type to create the |
| 2944 | // constant value. If the UnaryOperator has location type, create the |
| 2945 | // constant with int type and pointer width. |
| 2946 | SVal RHS; |
| 2947 | |
| 2948 | if (U->getType()->isAnyPointerType()) |
Ted Kremenek | c8413fd | 2010-12-02 07:49:45 +0000 | [diff] [blame] | 2949 | RHS = svalBuilder.makeIntValWithPtrWidth(1, false); |
Zhongxing Xu | a52ad4e | 2009-08-05 02:51:59 +0000 | [diff] [blame] | 2950 | else |
Ted Kremenek | c8413fd | 2010-12-02 07:49:45 +0000 | [diff] [blame] | 2951 | RHS = svalBuilder.makeIntVal(1, U->getType()); |
Zhongxing Xu | a52ad4e | 2009-08-05 02:51:59 +0000 | [diff] [blame] | 2952 | |
Ted Kremenek | 9c14953 | 2010-12-01 21:57:22 +0000 | [diff] [blame] | 2953 | SVal Result = evalBinOp(state, Op, V2, RHS, U->getType()); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2954 | |
Ted Kremenek | bb9b271 | 2009-03-20 20:10:45 +0000 | [diff] [blame] | 2955 | // Conjure a new symbol if necessary to recover precision. |
Ted Kremenek | af48fdd | 2009-04-21 22:38:05 +0000 | [diff] [blame] | 2956 | if (Result.isUnknown() || !getConstraintManager().canReasonAbout(Result)){ |
Ted Kremenek | 5b9bd21 | 2009-09-11 22:07:28 +0000 | [diff] [blame] | 2957 | DefinedOrUnknownSVal SymVal = |
Ted Kremenek | c8413fd | 2010-12-02 07:49:45 +0000 | [diff] [blame] | 2958 | svalBuilder.getConjuredSymbolVal(NULL, Ex, |
Ted Kremenek | 8780679 | 2009-09-27 20:45:21 +0000 | [diff] [blame] | 2959 | Builder->getCurrentBlockCount()); |
Ted Kremenek | 5b9bd21 | 2009-09-11 22:07:28 +0000 | [diff] [blame] | 2960 | Result = SymVal; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2961 | |
Ted Kremenek | af48fdd | 2009-04-21 22:38:05 +0000 | [diff] [blame] | 2962 | // If the value is a location, ++/-- should always preserve |
Ted Kremenek | 6c07bdb | 2009-06-26 00:05:51 +0000 | [diff] [blame] | 2963 | // non-nullness. Check if the original value was non-null, and if so |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2964 | // propagate that constraint. |
Ted Kremenek | af48fdd | 2009-04-21 22:38:05 +0000 | [diff] [blame] | 2965 | if (Loc::IsLocType(U->getType())) { |
Ted Kremenek | 5b9bd21 | 2009-09-11 22:07:28 +0000 | [diff] [blame] | 2966 | DefinedOrUnknownSVal Constraint = |
Zhongxing Xu | 250704b | 2010-12-22 08:38:13 +0000 | [diff] [blame] | 2967 | svalBuilder.evalEQ(state, V2,svalBuilder.makeZeroVal(U->getType())); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2968 | |
Ted Kremenek | 28f47b9 | 2010-12-01 22:16:56 +0000 | [diff] [blame] | 2969 | if (!state->assume(Constraint, true)) { |
Ted Kremenek | af48fdd | 2009-04-21 22:38:05 +0000 | [diff] [blame] | 2970 | // It isn't feasible for the original value to be null. |
| 2971 | // Propagate this constraint. |
Ted Kremenek | 9c14953 | 2010-12-01 21:57:22 +0000 | [diff] [blame] | 2972 | Constraint = svalBuilder.evalEQ(state, SymVal, |
Ted Kremenek | c8413fd | 2010-12-02 07:49:45 +0000 | [diff] [blame] | 2973 | svalBuilder.makeZeroVal(U->getType())); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2974 | |
Ted Kremenek | 5b9bd21 | 2009-09-11 22:07:28 +0000 | [diff] [blame] | 2975 | |
Ted Kremenek | 28f47b9 | 2010-12-01 22:16:56 +0000 | [diff] [blame] | 2976 | state = state->assume(Constraint, false); |
Ted Kremenek | a591bc0 | 2009-06-18 22:57:13 +0000 | [diff] [blame] | 2977 | assert(state); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2978 | } |
| 2979 | } |
Ted Kremenek | af48fdd | 2009-04-21 22:38:05 +0000 | [diff] [blame] | 2980 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2981 | |
Zhongxing Xu | 250704b | 2010-12-22 08:38:13 +0000 | [diff] [blame] | 2982 | // Since the lvalue-to-rvalue conversion is explicit in the AST, |
| 2983 | // we bind an l-value if the operator is prefix and an lvalue (in C++). |
| 2984 | if (U->isPrefix() && U->isLValue()) |
| 2985 | state = state->BindExpr(U, loc); |
| 2986 | else |
| 2987 | state = state->BindExpr(U, V2); |
Ted Kremenek | cf78b6a | 2008-02-06 22:50:25 +0000 | [diff] [blame] | 2988 | |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2989 | // Perform the store. |
Zhongxing Xu | 250704b | 2010-12-22 08:38:13 +0000 | [diff] [blame] | 2990 | evalStore(Dst, NULL, U, *I2, state, loc, Result); |
Ted Kremenek | 5b6dc2d | 2008-02-07 01:08:27 +0000 | [diff] [blame] | 2991 | } |
Ted Kremenek | 469ecbd | 2008-04-21 23:43:38 +0000 | [diff] [blame] | 2992 | } |
Ted Kremenek | 5b6dc2d | 2008-02-07 01:08:27 +0000 | [diff] [blame] | 2993 | } |
| 2994 | |
Zhongxing Xu | 03509ae | 2010-07-20 06:22:24 +0000 | [diff] [blame] | 2995 | void GRExprEngine::VisitAsmStmt(const AsmStmt* A, ExplodedNode* Pred, |
Zhongxing Xu | bb14121 | 2009-12-16 11:27:52 +0000 | [diff] [blame] | 2996 | ExplodedNodeSet& Dst) { |
Ted Kremenek | ef44bfb | 2008-03-17 21:11:24 +0000 | [diff] [blame] | 2997 | VisitAsmStmtHelperOutputs(A, A->begin_outputs(), A->end_outputs(), Pred, Dst); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2998 | } |
Ted Kremenek | ef44bfb | 2008-03-17 21:11:24 +0000 | [diff] [blame] | 2999 | |
Zhongxing Xu | 03509ae | 2010-07-20 06:22:24 +0000 | [diff] [blame] | 3000 | void GRExprEngine::VisitAsmStmtHelperOutputs(const AsmStmt* A, |
| 3001 | AsmStmt::const_outputs_iterator I, |
| 3002 | AsmStmt::const_outputs_iterator E, |
Zhongxing Xu | bb14121 | 2009-12-16 11:27:52 +0000 | [diff] [blame] | 3003 | ExplodedNode* Pred, ExplodedNodeSet& Dst) { |
Ted Kremenek | ef44bfb | 2008-03-17 21:11:24 +0000 | [diff] [blame] | 3004 | if (I == E) { |
| 3005 | VisitAsmStmtHelperInputs(A, A->begin_inputs(), A->end_inputs(), Pred, Dst); |
| 3006 | return; |
| 3007 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3008 | |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 3009 | ExplodedNodeSet Tmp; |
Ted Kremenek | 892697d | 2010-12-16 07:46:53 +0000 | [diff] [blame] | 3010 | Visit(*I, Pred, Tmp); |
Ted Kremenek | ef44bfb | 2008-03-17 21:11:24 +0000 | [diff] [blame] | 3011 | ++I; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3012 | |
Zhongxing Xu | bb14121 | 2009-12-16 11:27:52 +0000 | [diff] [blame] | 3013 | for (ExplodedNodeSet::iterator NI = Tmp.begin(), NE = Tmp.end();NI != NE;++NI) |
Ted Kremenek | ef44bfb | 2008-03-17 21:11:24 +0000 | [diff] [blame] | 3014 | VisitAsmStmtHelperOutputs(A, I, E, *NI, Dst); |
| 3015 | } |
| 3016 | |
Zhongxing Xu | 03509ae | 2010-07-20 06:22:24 +0000 | [diff] [blame] | 3017 | void GRExprEngine::VisitAsmStmtHelperInputs(const AsmStmt* A, |
| 3018 | AsmStmt::const_inputs_iterator I, |
| 3019 | AsmStmt::const_inputs_iterator E, |
Ted Kremenek | b9bbd59 | 2010-02-15 23:02:46 +0000 | [diff] [blame] | 3020 | ExplodedNode* Pred, |
Zhongxing Xu | bb14121 | 2009-12-16 11:27:52 +0000 | [diff] [blame] | 3021 | ExplodedNodeSet& Dst) { |
Ted Kremenek | ef44bfb | 2008-03-17 21:11:24 +0000 | [diff] [blame] | 3022 | if (I == E) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3023 | |
Ted Kremenek | ef44bfb | 2008-03-17 21:11:24 +0000 | [diff] [blame] | 3024 | // We have processed both the inputs and the outputs. All of the outputs |
Zhongxing Xu | 1c96b24 | 2008-10-17 05:57:07 +0000 | [diff] [blame] | 3025 | // should evaluate to Locs. Nuke all of their values. |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3026 | |
Ted Kremenek | ef44bfb | 2008-03-17 21:11:24 +0000 | [diff] [blame] | 3027 | // FIXME: Some day in the future it would be nice to allow a "plug-in" |
| 3028 | // which interprets the inline asm and stores proper results in the |
| 3029 | // outputs. |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3030 | |
Ted Kremenek | a8538d9 | 2009-02-13 01:45:31 +0000 | [diff] [blame] | 3031 | const GRState* state = GetState(Pred); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3032 | |
Zhongxing Xu | 03509ae | 2010-07-20 06:22:24 +0000 | [diff] [blame] | 3033 | for (AsmStmt::const_outputs_iterator OI = A->begin_outputs(), |
Ted Kremenek | ef44bfb | 2008-03-17 21:11:24 +0000 | [diff] [blame] | 3034 | OE = A->end_outputs(); OI != OE; ++OI) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3035 | |
Ted Kremenek | 1397663 | 2010-02-08 16:18:51 +0000 | [diff] [blame] | 3036 | SVal X = state->getSVal(*OI); |
Zhongxing Xu | 1c96b24 | 2008-10-17 05:57:07 +0000 | [diff] [blame] | 3037 | assert (!isa<NonLoc>(X)); // Should be an Lval, or unknown, undef. |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3038 | |
Zhongxing Xu | 1c96b24 | 2008-10-17 05:57:07 +0000 | [diff] [blame] | 3039 | if (isa<Loc>(X)) |
Ted Kremenek | 3ff1259 | 2009-06-19 17:10:32 +0000 | [diff] [blame] | 3040 | state = state->bindLoc(cast<Loc>(X), UnknownVal()); |
Ted Kremenek | ef44bfb | 2008-03-17 21:11:24 +0000 | [diff] [blame] | 3041 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3042 | |
Ted Kremenek | a8538d9 | 2009-02-13 01:45:31 +0000 | [diff] [blame] | 3043 | MakeNode(Dst, A, Pred, state); |
Ted Kremenek | ef44bfb | 2008-03-17 21:11:24 +0000 | [diff] [blame] | 3044 | return; |
| 3045 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3046 | |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 3047 | ExplodedNodeSet Tmp; |
Ted Kremenek | ef44bfb | 2008-03-17 21:11:24 +0000 | [diff] [blame] | 3048 | Visit(*I, Pred, Tmp); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3049 | |
Ted Kremenek | ef44bfb | 2008-03-17 21:11:24 +0000 | [diff] [blame] | 3050 | ++I; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3051 | |
Ted Kremenek | e1ccccf | 2009-09-03 03:02:58 +0000 | [diff] [blame] | 3052 | for (ExplodedNodeSet::iterator NI = Tmp.begin(), NE = Tmp.end(); NI!=NE; ++NI) |
Ted Kremenek | ef44bfb | 2008-03-17 21:11:24 +0000 | [diff] [blame] | 3053 | VisitAsmStmtHelperInputs(A, I, E, *NI, Dst); |
| 3054 | } |
| 3055 | |
Zhongxing Xu | 03509ae | 2010-07-20 06:22:24 +0000 | [diff] [blame] | 3056 | void GRExprEngine::VisitReturnStmt(const ReturnStmt *RS, ExplodedNode *Pred, |
Ted Kremenek | 1053d24 | 2009-11-06 02:24:13 +0000 | [diff] [blame] | 3057 | ExplodedNodeSet &Dst) { |
Ted Kremenek | 1053d24 | 2009-11-06 02:24:13 +0000 | [diff] [blame] | 3058 | ExplodedNodeSet Src; |
Zhongxing Xu | 03509ae | 2010-07-20 06:22:24 +0000 | [diff] [blame] | 3059 | if (const Expr *RetE = RS->getRetValue()) { |
Zhongxing Xu | bd2b208 | 2010-03-23 08:09:29 +0000 | [diff] [blame] | 3060 | // Record the returned expression in the state. It will be used in |
| 3061 | // ProcessCallExit to bind the return value to the call expr. |
Zhongxing Xu | 6190ec2 | 2010-02-26 15:43:34 +0000 | [diff] [blame] | 3062 | { |
Ted Kremenek | a804a68 | 2010-03-02 21:43:52 +0000 | [diff] [blame] | 3063 | static int Tag = 0; |
| 3064 | SaveAndRestore<const void *> OldTag(Builder->Tag, &Tag); |
Zhongxing Xu | 6190ec2 | 2010-02-26 15:43:34 +0000 | [diff] [blame] | 3065 | const GRState *state = GetState(Pred); |
| 3066 | state = state->set<ReturnExpr>(RetE); |
| 3067 | Pred = Builder->generateNode(RetE, state, Pred); |
| 3068 | } |
| 3069 | // We may get a NULL Pred because we generated a cached node. |
| 3070 | if (Pred) |
| 3071 | Visit(RetE, Pred, Src); |
Ted Kremenek | 02737ed | 2008-03-31 15:02:58 +0000 | [diff] [blame] | 3072 | } |
Ted Kremenek | 1053d24 | 2009-11-06 02:24:13 +0000 | [diff] [blame] | 3073 | else { |
| 3074 | Src.Add(Pred); |
| 3075 | } |
Ted Kremenek | b9bbd59 | 2010-02-15 23:02:46 +0000 | [diff] [blame] | 3076 | |
Ted Kremenek | 1053d24 | 2009-11-06 02:24:13 +0000 | [diff] [blame] | 3077 | ExplodedNodeSet CheckedSet; |
Jordy Rose | 72905cf | 2010-08-04 07:10:57 +0000 | [diff] [blame] | 3078 | CheckerVisit(RS, CheckedSet, Src, PreVisitStmtCallback); |
Ted Kremenek | b9bbd59 | 2010-02-15 23:02:46 +0000 | [diff] [blame] | 3079 | |
Ted Kremenek | 1053d24 | 2009-11-06 02:24:13 +0000 | [diff] [blame] | 3080 | for (ExplodedNodeSet::iterator I = CheckedSet.begin(), E = CheckedSet.end(); |
| 3081 | I != E; ++I) { |
Ted Kremenek | 6b31e8e | 2008-04-16 23:05:51 +0000 | [diff] [blame] | 3082 | |
Ted Kremenek | 1053d24 | 2009-11-06 02:24:13 +0000 | [diff] [blame] | 3083 | assert(Builder && "GRStmtNodeBuilder must be defined."); |
Ted Kremenek | b9bbd59 | 2010-02-15 23:02:46 +0000 | [diff] [blame] | 3084 | |
Ted Kremenek | 1053d24 | 2009-11-06 02:24:13 +0000 | [diff] [blame] | 3085 | Pred = *I; |
| 3086 | unsigned size = Dst.size(); |
Ted Kremenek | b9bbd59 | 2010-02-15 23:02:46 +0000 | [diff] [blame] | 3087 | |
Ted Kremenek | 1053d24 | 2009-11-06 02:24:13 +0000 | [diff] [blame] | 3088 | SaveAndRestore<bool> OldSink(Builder->BuildSinks); |
| 3089 | SaveOr OldHasGen(Builder->HasGeneratedNode); |
Ted Kremenek | b9bbd59 | 2010-02-15 23:02:46 +0000 | [diff] [blame] | 3090 | |
Ted Kremenek | 9c14953 | 2010-12-01 21:57:22 +0000 | [diff] [blame] | 3091 | getTF().evalReturn(Dst, *this, *Builder, RS, Pred); |
Ted Kremenek | b9bbd59 | 2010-02-15 23:02:46 +0000 | [diff] [blame] | 3092 | |
| 3093 | // Handle the case where no nodes where generated. |
| 3094 | if (!Builder->BuildSinks && Dst.size() == size && |
Ted Kremenek | 1053d24 | 2009-11-06 02:24:13 +0000 | [diff] [blame] | 3095 | !Builder->HasGeneratedNode) |
| 3096 | MakeNode(Dst, RS, Pred, GetState(Pred)); |
Ted Kremenek | 5917d78 | 2008-11-21 00:27:44 +0000 | [diff] [blame] | 3097 | } |
Ted Kremenek | 02737ed | 2008-03-31 15:02:58 +0000 | [diff] [blame] | 3098 | } |
Ted Kremenek | 55deb97 | 2008-03-25 00:34:37 +0000 | [diff] [blame] | 3099 | |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 3100 | //===----------------------------------------------------------------------===// |
| 3101 | // Transfer functions: Binary operators. |
| 3102 | //===----------------------------------------------------------------------===// |
| 3103 | |
Zhongxing Xu | 03509ae | 2010-07-20 06:22:24 +0000 | [diff] [blame] | 3104 | void GRExprEngine::VisitBinaryOperator(const BinaryOperator* B, |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 3105 | ExplodedNode* Pred, |
Ted Kremenek | 892697d | 2010-12-16 07:46:53 +0000 | [diff] [blame] | 3106 | ExplodedNodeSet& Dst) { |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 3107 | ExplodedNodeSet Tmp1; |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 3108 | Expr* LHS = B->getLHS()->IgnoreParens(); |
| 3109 | Expr* RHS = B->getRHS()->IgnoreParens(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3110 | |
Ted Kremenek | 892697d | 2010-12-16 07:46:53 +0000 | [diff] [blame] | 3111 | Visit(LHS, Pred, Tmp1); |
Zhongxing Xu | 668399b | 2009-11-24 08:24:26 +0000 | [diff] [blame] | 3112 | ExplodedNodeSet Tmp3; |
| 3113 | |
Ted Kremenek | e1ccccf | 2009-09-03 03:02:58 +0000 | [diff] [blame] | 3114 | for (ExplodedNodeSet::iterator I1=Tmp1.begin(), E1=Tmp1.end(); I1!=E1; ++I1) { |
Zhongxing Xu | 59fea60 | 2010-04-20 04:53:09 +0000 | [diff] [blame] | 3115 | SVal LeftV = GetState(*I1)->getSVal(LHS); |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 3116 | ExplodedNodeSet Tmp2; |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 3117 | Visit(RHS, *I1, Tmp2); |
Zhongxing Xu | 6403b57 | 2009-09-02 13:26:26 +0000 | [diff] [blame] | 3118 | |
| 3119 | ExplodedNodeSet CheckedSet; |
Jordy Rose | 72905cf | 2010-08-04 07:10:57 +0000 | [diff] [blame] | 3120 | CheckerVisit(B, CheckedSet, Tmp2, PreVisitStmtCallback); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3121 | |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 3122 | // With both the LHS and RHS evaluated, process the operation itself. |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3123 | |
| 3124 | for (ExplodedNodeSet::iterator I2=CheckedSet.begin(), E2=CheckedSet.end(); |
Zhongxing Xu | 6403b57 | 2009-09-02 13:26:26 +0000 | [diff] [blame] | 3125 | I2 != E2; ++I2) { |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 3126 | |
Ted Kremenek | 5b9bd21 | 2009-09-11 22:07:28 +0000 | [diff] [blame] | 3127 | const GRState *state = GetState(*I2); |
Ted Kremenek | 1397663 | 2010-02-08 16:18:51 +0000 | [diff] [blame] | 3128 | SVal RightV = state->getSVal(RHS); |
Ted Kremenek | 5b9bd21 | 2009-09-11 22:07:28 +0000 | [diff] [blame] | 3129 | |
Ted Kremenek | cf78b6a | 2008-02-06 22:50:25 +0000 | [diff] [blame] | 3130 | BinaryOperator::Opcode Op = B->getOpcode(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3131 | |
John McCall | 2de56d1 | 2010-08-25 11:45:40 +0000 | [diff] [blame] | 3132 | if (Op == BO_Assign) { |
Zhongxing Xu | 73af2d5 | 2009-10-21 11:42:22 +0000 | [diff] [blame] | 3133 | // EXPERIMENTAL: "Conjured" symbols. |
| 3134 | // FIXME: Handle structs. |
| 3135 | QualType T = RHS->getType(); |
Ted Kremenek | b9bbd59 | 2010-02-15 23:02:46 +0000 | [diff] [blame] | 3136 | |
Ted Kremenek | 0e82a93 | 2010-07-29 00:28:33 +0000 | [diff] [blame] | 3137 | if (RightV.isUnknown() ||!getConstraintManager().canReasonAbout(RightV)) |
| 3138 | { |
Zhongxing Xu | 73af2d5 | 2009-10-21 11:42:22 +0000 | [diff] [blame] | 3139 | unsigned Count = Builder->getCurrentBlockCount(); |
Ted Kremenek | c8413fd | 2010-12-02 07:49:45 +0000 | [diff] [blame] | 3140 | RightV = svalBuilder.getConjuredSymbolVal(NULL, B->getRHS(), Count); |
Zhongxing Xu | 73af2d5 | 2009-10-21 11:42:22 +0000 | [diff] [blame] | 3141 | } |
Zhongxing Xu | 662174ca | 2009-10-30 07:19:39 +0000 | [diff] [blame] | 3142 | |
Ted Kremenek | 892697d | 2010-12-16 07:46:53 +0000 | [diff] [blame] | 3143 | SVal ExprVal = B->isLValue() ? LeftV : RightV; |
Zhongxing Xu | 662174ca | 2009-10-30 07:19:39 +0000 | [diff] [blame] | 3144 | |
Zhongxing Xu | 73af2d5 | 2009-10-21 11:42:22 +0000 | [diff] [blame] | 3145 | // Simulate the effects of a "store": bind the value of the RHS |
| 3146 | // to the L-Value represented by the LHS. |
Ted Kremenek | 9c14953 | 2010-12-01 21:57:22 +0000 | [diff] [blame] | 3147 | evalStore(Tmp3, B, LHS, *I2, state->BindExpr(B, ExprVal), LeftV,RightV); |
Zhongxing Xu | 73af2d5 | 2009-10-21 11:42:22 +0000 | [diff] [blame] | 3148 | continue; |
| 3149 | } |
Ted Kremenek | b9bbd59 | 2010-02-15 23:02:46 +0000 | [diff] [blame] | 3150 | |
Zhongxing Xu | 73af2d5 | 2009-10-21 11:42:22 +0000 | [diff] [blame] | 3151 | if (!B->isAssignmentOp()) { |
| 3152 | // Process non-assignments except commas or short-circuited |
| 3153 | // logical expressions (LAnd and LOr). |
Ted Kremenek | 9c14953 | 2010-12-01 21:57:22 +0000 | [diff] [blame] | 3154 | SVal Result = evalBinOp(state, Op, LeftV, RightV, B->getType()); |
Ted Kremenek | b9bbd59 | 2010-02-15 23:02:46 +0000 | [diff] [blame] | 3155 | |
Zhongxing Xu | 73af2d5 | 2009-10-21 11:42:22 +0000 | [diff] [blame] | 3156 | if (Result.isUnknown()) { |
Ted Kremenek | 96ebad6 | 2010-09-09 07:13:00 +0000 | [diff] [blame] | 3157 | MakeNode(Tmp3, B, *I2, state); |
Ted Kremenek | e38718e | 2008-04-16 18:21:25 +0000 | [diff] [blame] | 3158 | continue; |
Ted Kremenek | ab2b8c5 | 2008-01-23 19:59:44 +0000 | [diff] [blame] | 3159 | } |
Ted Kremenek | b9bbd59 | 2010-02-15 23:02:46 +0000 | [diff] [blame] | 3160 | |
Zhongxing Xu | 73af2d5 | 2009-10-21 11:42:22 +0000 | [diff] [blame] | 3161 | state = state->BindExpr(B, Result); |
Ted Kremenek | b9bbd59 | 2010-02-15 23:02:46 +0000 | [diff] [blame] | 3162 | |
Zhongxing Xu | 668399b | 2009-11-24 08:24:26 +0000 | [diff] [blame] | 3163 | MakeNode(Tmp3, B, *I2, state); |
Zhongxing Xu | 73af2d5 | 2009-10-21 11:42:22 +0000 | [diff] [blame] | 3164 | continue; |
Ted Kremenek | ab2b8c5 | 2008-01-23 19:59:44 +0000 | [diff] [blame] | 3165 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3166 | |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 3167 | assert (B->isCompoundAssignmentOp()); |
| 3168 | |
Ted Kremenek | cad2996 | 2009-02-07 00:52:24 +0000 | [diff] [blame] | 3169 | switch (Op) { |
| 3170 | default: |
| 3171 | assert(0 && "Invalid opcode for compound assignment."); |
John McCall | 2de56d1 | 2010-08-25 11:45:40 +0000 | [diff] [blame] | 3172 | case BO_MulAssign: Op = BO_Mul; break; |
| 3173 | case BO_DivAssign: Op = BO_Div; break; |
| 3174 | case BO_RemAssign: Op = BO_Rem; break; |
| 3175 | case BO_AddAssign: Op = BO_Add; break; |
| 3176 | case BO_SubAssign: Op = BO_Sub; break; |
| 3177 | case BO_ShlAssign: Op = BO_Shl; break; |
| 3178 | case BO_ShrAssign: Op = BO_Shr; break; |
| 3179 | case BO_AndAssign: Op = BO_And; break; |
| 3180 | case BO_XorAssign: Op = BO_Xor; break; |
| 3181 | case BO_OrAssign: Op = BO_Or; break; |
Ted Kremenek | 934e3e9 | 2008-10-27 23:02:39 +0000 | [diff] [blame] | 3182 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3183 | |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 3184 | // Perform a load (the LHS). This performs the checks for |
| 3185 | // null dereferences, and so on. |
Zhongxing Xu | c39b2bd | 2010-01-19 09:25:53 +0000 | [diff] [blame] | 3186 | ExplodedNodeSet Tmp4; |
Ted Kremenek | 1397663 | 2010-02-08 16:18:51 +0000 | [diff] [blame] | 3187 | SVal location = state->getSVal(LHS); |
Ted Kremenek | 9c14953 | 2010-12-01 21:57:22 +0000 | [diff] [blame] | 3188 | evalLoad(Tmp4, LHS, *I2, state, location); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3189 | |
Zhongxing Xu | c39b2bd | 2010-01-19 09:25:53 +0000 | [diff] [blame] | 3190 | for (ExplodedNodeSet::iterator I4=Tmp4.begin(), E4=Tmp4.end(); I4!=E4; |
| 3191 | ++I4) { |
| 3192 | state = GetState(*I4); |
Ted Kremenek | 1397663 | 2010-02-08 16:18:51 +0000 | [diff] [blame] | 3193 | SVal V = state->getSVal(LHS); |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 3194 | |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 3195 | // Get the computation type. |
Ted Kremenek | 32c3fa4 | 2009-07-21 21:03:30 +0000 | [diff] [blame] | 3196 | QualType CTy = |
| 3197 | cast<CompoundAssignOperator>(B)->getComputationResultType(); |
Ted Kremenek | 60595da | 2008-11-15 04:01:56 +0000 | [diff] [blame] | 3198 | CTy = getContext().getCanonicalType(CTy); |
Eli Friedman | ab3a852 | 2009-03-28 01:22:36 +0000 | [diff] [blame] | 3199 | |
Ted Kremenek | 32c3fa4 | 2009-07-21 21:03:30 +0000 | [diff] [blame] | 3200 | QualType CLHSTy = |
| 3201 | cast<CompoundAssignOperator>(B)->getComputationLHSType(); |
| 3202 | CLHSTy = getContext().getCanonicalType(CLHSTy); |
Eli Friedman | ab3a852 | 2009-03-28 01:22:36 +0000 | [diff] [blame] | 3203 | |
Ted Kremenek | 60595da | 2008-11-15 04:01:56 +0000 | [diff] [blame] | 3204 | QualType LTy = getContext().getCanonicalType(LHS->getType()); |
| 3205 | QualType RTy = getContext().getCanonicalType(RHS->getType()); |
Eli Friedman | ab3a852 | 2009-03-28 01:22:36 +0000 | [diff] [blame] | 3206 | |
| 3207 | // Promote LHS. |
Ted Kremenek | 9c14953 | 2010-12-01 21:57:22 +0000 | [diff] [blame] | 3208 | V = svalBuilder.evalCast(V, CLHSTy, LTy); |
Eli Friedman | ab3a852 | 2009-03-28 01:22:36 +0000 | [diff] [blame] | 3209 | |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3210 | // Compute the result of the operation. |
Ted Kremenek | 9c14953 | 2010-12-01 21:57:22 +0000 | [diff] [blame] | 3211 | SVal Result = svalBuilder.evalCast(evalBinOp(state, Op, V, RightV, CTy), |
Zhongxing Xu | 814e6b9 | 2010-02-04 04:56:43 +0000 | [diff] [blame] | 3212 | B->getType(), CTy); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3213 | |
Ted Kremenek | 9ff267d | 2008-10-20 23:13:25 +0000 | [diff] [blame] | 3214 | // EXPERIMENTAL: "Conjured" symbols. |
| 3215 | // FIXME: Handle structs. |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3216 | |
Ted Kremenek | 60595da | 2008-11-15 04:01:56 +0000 | [diff] [blame] | 3217 | SVal LHSVal; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3218 | |
Ted Kremenek | 0e82a93 | 2010-07-29 00:28:33 +0000 | [diff] [blame] | 3219 | if (Result.isUnknown() || |
| 3220 | !getConstraintManager().canReasonAbout(Result)) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3221 | |
Ted Kremenek | 9ff267d | 2008-10-20 23:13:25 +0000 | [diff] [blame] | 3222 | unsigned Count = Builder->getCurrentBlockCount(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3223 | |
Ted Kremenek | 60595da | 2008-11-15 04:01:56 +0000 | [diff] [blame] | 3224 | // The symbolic value is actually for the type of the left-hand side |
| 3225 | // expression, not the computation type, as this is the value the |
| 3226 | // LValue on the LHS will bind to. |
Ted Kremenek | c8413fd | 2010-12-02 07:49:45 +0000 | [diff] [blame] | 3227 | LHSVal = svalBuilder.getConjuredSymbolVal(NULL, B->getRHS(), LTy, Count); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3228 | |
Zhongxing Xu | 1c0c233 | 2008-11-23 05:52:28 +0000 | [diff] [blame] | 3229 | // However, we need to convert the symbol to the computation type. |
Ted Kremenek | 9c14953 | 2010-12-01 21:57:22 +0000 | [diff] [blame] | 3230 | Result = svalBuilder.evalCast(LHSVal, CTy, LTy); |
Ted Kremenek | 9ff267d | 2008-10-20 23:13:25 +0000 | [diff] [blame] | 3231 | } |
Ted Kremenek | 60595da | 2008-11-15 04:01:56 +0000 | [diff] [blame] | 3232 | else { |
| 3233 | // The left-hand side may bind to a different value then the |
| 3234 | // computation type. |
Ted Kremenek | 9c14953 | 2010-12-01 21:57:22 +0000 | [diff] [blame] | 3235 | LHSVal = svalBuilder.evalCast(Result, LTy, CTy); |
Ted Kremenek | 60595da | 2008-11-15 04:01:56 +0000 | [diff] [blame] | 3236 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3237 | |
Ted Kremenek | 9c14953 | 2010-12-01 21:57:22 +0000 | [diff] [blame] | 3238 | evalStore(Tmp3, B, LHS, *I4, state->BindExpr(B, Result), |
Zhongxing Xu | 5032ffe | 2009-08-25 06:51:30 +0000 | [diff] [blame] | 3239 | location, LHSVal); |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 3240 | } |
Ted Kremenek | cb448ca | 2008-01-16 00:53:15 +0000 | [diff] [blame] | 3241 | } |
Ted Kremenek | d27f816 | 2008-01-15 23:55:06 +0000 | [diff] [blame] | 3242 | } |
Zhongxing Xu | 668399b | 2009-11-24 08:24:26 +0000 | [diff] [blame] | 3243 | |
Jordy Rose | 72905cf | 2010-08-04 07:10:57 +0000 | [diff] [blame] | 3244 | CheckerVisit(B, Dst, Tmp3, PostVisitStmtCallback); |
Ted Kremenek | d27f816 | 2008-01-15 23:55:06 +0000 | [diff] [blame] | 3245 | } |
Ted Kremenek | ee98546 | 2008-01-16 18:18:48 +0000 | [diff] [blame] | 3246 | |
| 3247 | //===----------------------------------------------------------------------===// |
Ted Kremenek | 094bef5 | 2009-10-30 17:47:32 +0000 | [diff] [blame] | 3248 | // Checker registration/lookup. |
| 3249 | //===----------------------------------------------------------------------===// |
| 3250 | |
| 3251 | Checker *GRExprEngine::lookupChecker(void *tag) const { |
Jeffrey Yasskin | 3958b50 | 2009-11-10 01:17:45 +0000 | [diff] [blame] | 3252 | CheckerMap::const_iterator I = CheckerM.find(tag); |
Ted Kremenek | 094bef5 | 2009-10-30 17:47:32 +0000 | [diff] [blame] | 3253 | return (I == CheckerM.end()) ? NULL : Checkers[I->second].second; |
| 3254 | } |
| 3255 | |
| 3256 | //===----------------------------------------------------------------------===// |
Ted Kremenek | e01c987 | 2008-02-14 22:36:46 +0000 | [diff] [blame] | 3257 | // Visualization. |
Ted Kremenek | ee98546 | 2008-01-16 18:18:48 +0000 | [diff] [blame] | 3258 | //===----------------------------------------------------------------------===// |
| 3259 | |
Ted Kremenek | aa66a32 | 2008-01-16 21:46:15 +0000 | [diff] [blame] | 3260 | #ifndef NDEBUG |
Ted Kremenek | 4d4dd85 | 2008-02-13 17:41:41 +0000 | [diff] [blame] | 3261 | static GRExprEngine* GraphPrintCheckerState; |
Ted Kremenek | e97ca06 | 2008-03-07 20:57:30 +0000 | [diff] [blame] | 3262 | static SourceManager* GraphPrintSourceManager; |
Ted Kremenek | 3b4f670 | 2008-01-30 23:24:39 +0000 | [diff] [blame] | 3263 | |
Ted Kremenek | aa66a32 | 2008-01-16 21:46:15 +0000 | [diff] [blame] | 3264 | namespace llvm { |
| 3265 | template<> |
Douglas Gregor | 47491f8 | 2009-11-30 16:08:24 +0000 | [diff] [blame] | 3266 | struct DOTGraphTraits<ExplodedNode*> : |
Ted Kremenek | aa66a32 | 2008-01-16 21:46:15 +0000 | [diff] [blame] | 3267 | public DefaultDOTGraphTraits { |
Tobias Grosser | 006b0eb | 2009-11-30 14:16:05 +0000 | [diff] [blame] | 3268 | |
| 3269 | DOTGraphTraits (bool isSimple=false) : DefaultDOTGraphTraits(isSimple) {} |
| 3270 | |
Zhongxing Xu | ec9227f | 2009-10-29 02:09:30 +0000 | [diff] [blame] | 3271 | // FIXME: Since we do not cache error nodes in GRExprEngine now, this does not |
| 3272 | // work. |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 3273 | static std::string getNodeAttributes(const ExplodedNode* N, void*) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3274 | |
Ted Kremenek | 10f51e8 | 2009-11-11 20:16:36 +0000 | [diff] [blame] | 3275 | #if 0 |
| 3276 | // FIXME: Replace with a general scheme to tell if the node is |
| 3277 | // an error node. |
Ted Kremenek | a3fadfc | 2008-02-14 22:54:53 +0000 | [diff] [blame] | 3278 | if (GraphPrintCheckerState->isImplicitNullDeref(N) || |
Ted Kremenek | 9dca062 | 2008-02-19 00:22:37 +0000 | [diff] [blame] | 3279 | GraphPrintCheckerState->isExplicitNullDeref(N) || |
Ted Kremenek | 4a4e524 | 2008-02-28 09:25:22 +0000 | [diff] [blame] | 3280 | GraphPrintCheckerState->isUndefDeref(N) || |
| 3281 | GraphPrintCheckerState->isUndefStore(N) || |
| 3282 | GraphPrintCheckerState->isUndefControlFlow(N) || |
Ted Kremenek | 5e03fcb | 2008-02-29 23:14:48 +0000 | [diff] [blame] | 3283 | GraphPrintCheckerState->isUndefResult(N) || |
Ted Kremenek | 2ded35a | 2008-02-29 23:53:11 +0000 | [diff] [blame] | 3284 | GraphPrintCheckerState->isBadCall(N) || |
| 3285 | GraphPrintCheckerState->isUndefArg(N)) |
Ted Kremenek | a3fadfc | 2008-02-14 22:54:53 +0000 | [diff] [blame] | 3286 | return "color=\"red\",style=\"filled\""; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3287 | |
Ted Kremenek | 8cc13ea | 2008-02-28 20:32:03 +0000 | [diff] [blame] | 3288 | if (GraphPrintCheckerState->isNoReturnCall(N)) |
| 3289 | return "color=\"blue\",style=\"filled\""; |
Zhongxing Xu | 2055eff | 2009-11-24 07:06:39 +0000 | [diff] [blame] | 3290 | #endif |
Ted Kremenek | a3fadfc | 2008-02-14 22:54:53 +0000 | [diff] [blame] | 3291 | return ""; |
| 3292 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3293 | |
Tobias Grosser | 006b0eb | 2009-11-30 14:16:05 +0000 | [diff] [blame] | 3294 | static std::string getNodeLabel(const ExplodedNode* N, void*){ |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3295 | |
Ted Kremenek | 53ba0b6 | 2009-06-24 23:06:47 +0000 | [diff] [blame] | 3296 | std::string sbuf; |
| 3297 | llvm::raw_string_ostream Out(sbuf); |
Ted Kremenek | 803c9ed | 2008-01-23 22:30:44 +0000 | [diff] [blame] | 3298 | |
| 3299 | // Program Location. |
Ted Kremenek | aa66a32 | 2008-01-16 21:46:15 +0000 | [diff] [blame] | 3300 | ProgramPoint Loc = N->getLocation(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3301 | |
Ted Kremenek | aa66a32 | 2008-01-16 21:46:15 +0000 | [diff] [blame] | 3302 | switch (Loc.getKind()) { |
| 3303 | case ProgramPoint::BlockEntranceKind: |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3304 | Out << "Block Entrance: B" |
Ted Kremenek | aa66a32 | 2008-01-16 21:46:15 +0000 | [diff] [blame] | 3305 | << cast<BlockEntrance>(Loc).getBlock()->getBlockID(); |
| 3306 | break; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3307 | |
Ted Kremenek | aa66a32 | 2008-01-16 21:46:15 +0000 | [diff] [blame] | 3308 | case ProgramPoint::BlockExitKind: |
| 3309 | assert (false); |
| 3310 | break; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3311 | |
Douglas Gregor | 102acd5 | 2010-02-25 19:01:53 +0000 | [diff] [blame] | 3312 | case ProgramPoint::CallEnterKind: |
| 3313 | Out << "CallEnter"; |
| 3314 | break; |
| 3315 | |
| 3316 | case ProgramPoint::CallExitKind: |
| 3317 | Out << "CallExit"; |
| 3318 | break; |
| 3319 | |
Ted Kremenek | aa66a32 | 2008-01-16 21:46:15 +0000 | [diff] [blame] | 3320 | default: { |
Ted Kremenek | 5f85e17 | 2009-07-22 22:35:28 +0000 | [diff] [blame] | 3321 | if (StmtPoint *L = dyn_cast<StmtPoint>(&Loc)) { |
| 3322 | const Stmt* S = L->getStmt(); |
Ted Kremenek | 8c35475 | 2008-12-16 22:02:27 +0000 | [diff] [blame] | 3323 | SourceLocation SLoc = S->getLocStart(); |
| 3324 | |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3325 | Out << S->getStmtClassName() << ' ' << (void*) S << ' '; |
Chris Lattner | e4f2142 | 2009-06-30 01:26:17 +0000 | [diff] [blame] | 3326 | LangOptions LO; // FIXME. |
| 3327 | S->printPretty(Out, 0, PrintingPolicy(LO)); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3328 | |
| 3329 | if (SLoc.isFileID()) { |
Ted Kremenek | 8c35475 | 2008-12-16 22:02:27 +0000 | [diff] [blame] | 3330 | Out << "\\lline=" |
Chris Lattner | 7da5aea | 2009-02-04 00:55:58 +0000 | [diff] [blame] | 3331 | << GraphPrintSourceManager->getInstantiationLineNumber(SLoc) |
| 3332 | << " col=" |
| 3333 | << GraphPrintSourceManager->getInstantiationColumnNumber(SLoc) |
| 3334 | << "\\l"; |
Ted Kremenek | 8c35475 | 2008-12-16 22:02:27 +0000 | [diff] [blame] | 3335 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3336 | |
Ted Kremenek | 5f85e17 | 2009-07-22 22:35:28 +0000 | [diff] [blame] | 3337 | if (isa<PreStmt>(Loc)) |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3338 | Out << "\\lPreStmt\\l;"; |
Ted Kremenek | 5f85e17 | 2009-07-22 22:35:28 +0000 | [diff] [blame] | 3339 | else if (isa<PostLoad>(Loc)) |
Ted Kremenek | 7090d54 | 2009-05-07 18:27:16 +0000 | [diff] [blame] | 3340 | Out << "\\lPostLoad\\l;"; |
| 3341 | else if (isa<PostStore>(Loc)) |
| 3342 | Out << "\\lPostStore\\l"; |
| 3343 | else if (isa<PostLValue>(Loc)) |
| 3344 | Out << "\\lPostLValue\\l"; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3345 | |
Ted Kremenek | 10f51e8 | 2009-11-11 20:16:36 +0000 | [diff] [blame] | 3346 | #if 0 |
| 3347 | // FIXME: Replace with a general scheme to determine |
| 3348 | // the name of the check. |
Ted Kremenek | 8c35475 | 2008-12-16 22:02:27 +0000 | [diff] [blame] | 3349 | if (GraphPrintCheckerState->isImplicitNullDeref(N)) |
| 3350 | Out << "\\|Implicit-Null Dereference.\\l"; |
| 3351 | else if (GraphPrintCheckerState->isExplicitNullDeref(N)) |
| 3352 | Out << "\\|Explicit-Null Dereference.\\l"; |
| 3353 | else if (GraphPrintCheckerState->isUndefDeref(N)) |
| 3354 | Out << "\\|Dereference of undefialied value.\\l"; |
| 3355 | else if (GraphPrintCheckerState->isUndefStore(N)) |
| 3356 | Out << "\\|Store to Undefined Loc."; |
Ted Kremenek | 8c35475 | 2008-12-16 22:02:27 +0000 | [diff] [blame] | 3357 | else if (GraphPrintCheckerState->isUndefResult(N)) |
| 3358 | Out << "\\|Result of operation is undefined."; |
| 3359 | else if (GraphPrintCheckerState->isNoReturnCall(N)) |
| 3360 | Out << "\\|Call to function marked \"noreturn\"."; |
| 3361 | else if (GraphPrintCheckerState->isBadCall(N)) |
| 3362 | Out << "\\|Call to NULL/Undefined."; |
| 3363 | else if (GraphPrintCheckerState->isUndefArg(N)) |
| 3364 | Out << "\\|Argument in call is undefined"; |
Ted Kremenek | 10f51e8 | 2009-11-11 20:16:36 +0000 | [diff] [blame] | 3365 | #endif |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3366 | |
Ted Kremenek | 8c35475 | 2008-12-16 22:02:27 +0000 | [diff] [blame] | 3367 | break; |
| 3368 | } |
| 3369 | |
Ted Kremenek | aa66a32 | 2008-01-16 21:46:15 +0000 | [diff] [blame] | 3370 | const BlockEdge& E = cast<BlockEdge>(Loc); |
| 3371 | Out << "Edge: (B" << E.getSrc()->getBlockID() << ", B" |
| 3372 | << E.getDst()->getBlockID() << ')'; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3373 | |
Zhongxing Xu | 03509ae | 2010-07-20 06:22:24 +0000 | [diff] [blame] | 3374 | if (const Stmt* T = E.getSrc()->getTerminator()) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3375 | |
Ted Kremenek | e97ca06 | 2008-03-07 20:57:30 +0000 | [diff] [blame] | 3376 | SourceLocation SLoc = T->getLocStart(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3377 | |
Ted Kremenek | b38911f | 2008-01-30 23:03:39 +0000 | [diff] [blame] | 3378 | Out << "\\|Terminator: "; |
Chris Lattner | e4f2142 | 2009-06-30 01:26:17 +0000 | [diff] [blame] | 3379 | LangOptions LO; // FIXME. |
| 3380 | E.getSrc()->printTerminator(Out, LO); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3381 | |
Ted Kremenek | 9b5551d | 2008-03-09 03:30:59 +0000 | [diff] [blame] | 3382 | if (SLoc.isFileID()) { |
| 3383 | Out << "\\lline=" |
Chris Lattner | 7da5aea | 2009-02-04 00:55:58 +0000 | [diff] [blame] | 3384 | << GraphPrintSourceManager->getInstantiationLineNumber(SLoc) |
| 3385 | << " col=" |
| 3386 | << GraphPrintSourceManager->getInstantiationColumnNumber(SLoc); |
Ted Kremenek | 9b5551d | 2008-03-09 03:30:59 +0000 | [diff] [blame] | 3387 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3388 | |
Ted Kremenek | daeb9a7 | 2008-02-13 23:08:21 +0000 | [diff] [blame] | 3389 | if (isa<SwitchStmt>(T)) { |
Zhongxing Xu | 03509ae | 2010-07-20 06:22:24 +0000 | [diff] [blame] | 3390 | const Stmt* Label = E.getDst()->getLabel(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3391 | |
| 3392 | if (Label) { |
Zhongxing Xu | 03509ae | 2010-07-20 06:22:24 +0000 | [diff] [blame] | 3393 | if (const CaseStmt* C = dyn_cast<CaseStmt>(Label)) { |
Ted Kremenek | daeb9a7 | 2008-02-13 23:08:21 +0000 | [diff] [blame] | 3394 | Out << "\\lcase "; |
Chris Lattner | e4f2142 | 2009-06-30 01:26:17 +0000 | [diff] [blame] | 3395 | LangOptions LO; // FIXME. |
| 3396 | C->getLHS()->printPretty(Out, 0, PrintingPolicy(LO)); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3397 | |
Zhongxing Xu | 03509ae | 2010-07-20 06:22:24 +0000 | [diff] [blame] | 3398 | if (const Stmt* RHS = C->getRHS()) { |
Ted Kremenek | daeb9a7 | 2008-02-13 23:08:21 +0000 | [diff] [blame] | 3399 | Out << " .. "; |
Chris Lattner | e4f2142 | 2009-06-30 01:26:17 +0000 | [diff] [blame] | 3400 | RHS->printPretty(Out, 0, PrintingPolicy(LO)); |
Ted Kremenek | daeb9a7 | 2008-02-13 23:08:21 +0000 | [diff] [blame] | 3401 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3402 | |
Ted Kremenek | daeb9a7 | 2008-02-13 23:08:21 +0000 | [diff] [blame] | 3403 | Out << ":"; |
| 3404 | } |
| 3405 | else { |
| 3406 | assert (isa<DefaultStmt>(Label)); |
| 3407 | Out << "\\ldefault:"; |
| 3408 | } |
| 3409 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3410 | else |
Ted Kremenek | daeb9a7 | 2008-02-13 23:08:21 +0000 | [diff] [blame] | 3411 | Out << "\\l(implicit) default:"; |
| 3412 | } |
| 3413 | else if (isa<IndirectGotoStmt>(T)) { |
Ted Kremenek | b38911f | 2008-01-30 23:03:39 +0000 | [diff] [blame] | 3414 | // FIXME |
| 3415 | } |
| 3416 | else { |
| 3417 | Out << "\\lCondition: "; |
| 3418 | if (*E.getSrc()->succ_begin() == E.getDst()) |
| 3419 | Out << "true"; |
| 3420 | else |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3421 | Out << "false"; |
Ted Kremenek | b38911f | 2008-01-30 23:03:39 +0000 | [diff] [blame] | 3422 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3423 | |
Ted Kremenek | b38911f | 2008-01-30 23:03:39 +0000 | [diff] [blame] | 3424 | Out << "\\l"; |
| 3425 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3426 | |
Ted Kremenek | 10f51e8 | 2009-11-11 20:16:36 +0000 | [diff] [blame] | 3427 | #if 0 |
| 3428 | // FIXME: Replace with a general scheme to determine |
| 3429 | // the name of the check. |
Ted Kremenek | 4a4e524 | 2008-02-28 09:25:22 +0000 | [diff] [blame] | 3430 | if (GraphPrintCheckerState->isUndefControlFlow(N)) { |
| 3431 | Out << "\\|Control-flow based on\\lUndefined value.\\l"; |
Ted Kremenek | 3b4f670 | 2008-01-30 23:24:39 +0000 | [diff] [blame] | 3432 | } |
Ted Kremenek | 10f51e8 | 2009-11-11 20:16:36 +0000 | [diff] [blame] | 3433 | #endif |
Ted Kremenek | aa66a32 | 2008-01-16 21:46:15 +0000 | [diff] [blame] | 3434 | } |
| 3435 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3436 | |
Ted Kremenek | b65be70 | 2009-06-18 01:23:53 +0000 | [diff] [blame] | 3437 | const GRState *state = N->getState(); |
Ted Kremenek | 8673a68 | 2010-12-03 06:52:26 +0000 | [diff] [blame] | 3438 | Out << "\\|StateID: " << (void*) state |
| 3439 | << " NodeID: " << (void*) N << "\\|"; |
Zhongxing Xu | c179a7f | 2010-03-05 04:45:36 +0000 | [diff] [blame] | 3440 | state->printDOT(Out, *N->getLocationContext()->getCFG()); |
Ted Kremenek | 803c9ed | 2008-01-23 22:30:44 +0000 | [diff] [blame] | 3441 | Out << "\\l"; |
Ted Kremenek | aa66a32 | 2008-01-16 21:46:15 +0000 | [diff] [blame] | 3442 | return Out.str(); |
| 3443 | } |
| 3444 | }; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3445 | } // end llvm namespace |
Ted Kremenek | aa66a32 | 2008-01-16 21:46:15 +0000 | [diff] [blame] | 3446 | #endif |
| 3447 | |
Ted Kremenek | ffe0f43 | 2008-03-07 22:58:01 +0000 | [diff] [blame] | 3448 | #ifndef NDEBUG |
Ted Kremenek | 7ec07fd | 2008-03-12 17:18:20 +0000 | [diff] [blame] | 3449 | template <typename ITERATOR> |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 3450 | ExplodedNode* GetGraphNode(ITERATOR I) { return *I; } |
Ted Kremenek | 7ec07fd | 2008-03-12 17:18:20 +0000 | [diff] [blame] | 3451 | |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 3452 | template <> ExplodedNode* |
| 3453 | GetGraphNode<llvm::DenseMap<ExplodedNode*, Expr*>::iterator> |
| 3454 | (llvm::DenseMap<ExplodedNode*, Expr*>::iterator I) { |
Ted Kremenek | 7ec07fd | 2008-03-12 17:18:20 +0000 | [diff] [blame] | 3455 | return I->first; |
| 3456 | } |
Ted Kremenek | ffe0f43 | 2008-03-07 22:58:01 +0000 | [diff] [blame] | 3457 | #endif |
| 3458 | |
| 3459 | void GRExprEngine::ViewGraph(bool trim) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3460 | #ifndef NDEBUG |
Ted Kremenek | ffe0f43 | 2008-03-07 22:58:01 +0000 | [diff] [blame] | 3461 | if (trim) { |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 3462 | std::vector<ExplodedNode*> Src; |
Ted Kremenek | 940abcc | 2009-03-11 01:41:22 +0000 | [diff] [blame] | 3463 | |
| 3464 | // Flush any outstanding reports to make sure we cover all the nodes. |
| 3465 | // This does not cause them to get displayed. |
| 3466 | for (BugReporter::iterator I=BR.begin(), E=BR.end(); I!=E; ++I) |
| 3467 | const_cast<BugType*>(*I)->FlushReports(BR); |
| 3468 | |
| 3469 | // Iterate through the reports and get their nodes. |
| 3470 | for (BugReporter::iterator I=BR.begin(), E=BR.end(); I!=E; ++I) { |
Ted Kremenek | e1ccccf | 2009-09-03 03:02:58 +0000 | [diff] [blame] | 3471 | for (BugType::const_iterator I2=(*I)->begin(), E2=(*I)->end(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3472 | I2!=E2; ++I2) { |
Ted Kremenek | 940abcc | 2009-03-11 01:41:22 +0000 | [diff] [blame] | 3473 | const BugReportEquivClass& EQ = *I2; |
| 3474 | const BugReport &R = **EQ.begin(); |
Tom Care | 212f6d3 | 2010-09-16 03:50:38 +0000 | [diff] [blame] | 3475 | ExplodedNode *N = const_cast<ExplodedNode*>(R.getErrorNode()); |
Ted Kremenek | 940abcc | 2009-03-11 01:41:22 +0000 | [diff] [blame] | 3476 | if (N) Src.push_back(N); |
| 3477 | } |
| 3478 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3479 | |
Ted Kremenek | 7ec07fd | 2008-03-12 17:18:20 +0000 | [diff] [blame] | 3480 | ViewGraph(&Src[0], &Src[0]+Src.size()); |
Ted Kremenek | ffe0f43 | 2008-03-07 22:58:01 +0000 | [diff] [blame] | 3481 | } |
Ted Kremenek | 493d7a2 | 2008-03-11 18:25:33 +0000 | [diff] [blame] | 3482 | else { |
| 3483 | GraphPrintCheckerState = this; |
| 3484 | GraphPrintSourceManager = &getContext().getSourceManager(); |
Ted Kremenek | ae6814e | 2008-08-13 21:24:49 +0000 | [diff] [blame] | 3485 | |
Ted Kremenek | ffe0f43 | 2008-03-07 22:58:01 +0000 | [diff] [blame] | 3486 | llvm::ViewGraph(*G.roots_begin(), "GRExprEngine"); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3487 | |
Ted Kremenek | 493d7a2 | 2008-03-11 18:25:33 +0000 | [diff] [blame] | 3488 | GraphPrintCheckerState = NULL; |
| 3489 | GraphPrintSourceManager = NULL; |
| 3490 | } |
| 3491 | #endif |
| 3492 | } |
| 3493 | |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 3494 | void GRExprEngine::ViewGraph(ExplodedNode** Beg, ExplodedNode** End) { |
Ted Kremenek | 493d7a2 | 2008-03-11 18:25:33 +0000 | [diff] [blame] | 3495 | #ifndef NDEBUG |
| 3496 | GraphPrintCheckerState = this; |
| 3497 | GraphPrintSourceManager = &getContext().getSourceManager(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3498 | |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 3499 | std::auto_ptr<ExplodedGraph> TrimmedG(G.Trim(Beg, End).first); |
Ted Kremenek | 493d7a2 | 2008-03-11 18:25:33 +0000 | [diff] [blame] | 3500 | |
Ted Kremenek | cf118d4 | 2009-02-04 23:49:09 +0000 | [diff] [blame] | 3501 | if (!TrimmedG.get()) |
Benjamin Kramer | 6cb7c1a | 2009-08-23 12:08:50 +0000 | [diff] [blame] | 3502 | llvm::errs() << "warning: Trimmed ExplodedGraph is empty.\n"; |
Ted Kremenek | cf118d4 | 2009-02-04 23:49:09 +0000 | [diff] [blame] | 3503 | else |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3504 | llvm::ViewGraph(*TrimmedG->roots_begin(), "TrimmedGRExprEngine"); |
| 3505 | |
Ted Kremenek | 3b4f670 | 2008-01-30 23:24:39 +0000 | [diff] [blame] | 3506 | GraphPrintCheckerState = NULL; |
Ted Kremenek | e97ca06 | 2008-03-07 20:57:30 +0000 | [diff] [blame] | 3507 | GraphPrintSourceManager = NULL; |
Ted Kremenek | e01c987 | 2008-02-14 22:36:46 +0000 | [diff] [blame] | 3508 | #endif |
Ted Kremenek | ee98546 | 2008-01-16 18:18:48 +0000 | [diff] [blame] | 3509 | } |