Ted Kremenek | 5f76431 | 2011-08-20 05:59:58 +0000 | [diff] [blame] | 1 | //===- ExprEngineCXX.cpp - ExprEngine support for C++ -----------*- C++ -*-===// |
Zhongxing Xu | cb7464a | 2010-04-19 12:51:02 +0000 | [diff] [blame] | 2 | // |
| 3 | // The LLVM Compiler Infrastructure |
| 4 | // |
| 5 | // This file is distributed under the University of Illinois Open Source |
| 6 | // License. See LICENSE.TXT for details. |
| 7 | // |
| 8 | //===----------------------------------------------------------------------===// |
| 9 | // |
| 10 | // This file defines the C++ expression evaluation engine. |
| 11 | // |
| 12 | //===----------------------------------------------------------------------===// |
| 13 | |
Ted Kremenek | 9b66371 | 2011-02-10 01:03:03 +0000 | [diff] [blame] | 14 | #include "clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h" |
Zhongxing Xu | cb7464a | 2010-04-19 12:51:02 +0000 | [diff] [blame] | 15 | #include "clang/AST/DeclCXX.h" |
Ted Kremenek | 337e4db | 2012-03-10 01:34:17 +0000 | [diff] [blame] | 16 | #include "clang/AST/StmtCXX.h" |
Jordan Rose | 563ea23 | 2012-08-03 23:31:15 +0000 | [diff] [blame] | 17 | #include "clang/Basic/PrettyStackTrace.h" |
Chandler Carruth | 55fc873 | 2012-12-04 09:13:33 +0000 | [diff] [blame] | 18 | #include "clang/StaticAnalyzer/Core/CheckerManager.h" |
| 19 | #include "clang/StaticAnalyzer/Core/PathSensitive/AnalysisManager.h" |
| 20 | #include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h" |
Zhongxing Xu | cb7464a | 2010-04-19 12:51:02 +0000 | [diff] [blame] | 21 | |
| 22 | using namespace clang; |
Ted Kremenek | 9ef6537 | 2010-12-23 07:20:52 +0000 | [diff] [blame] | 23 | using namespace ento; |
Zhongxing Xu | cb7464a | 2010-04-19 12:51:02 +0000 | [diff] [blame] | 24 | |
Ted Kremenek | eea72a9 | 2011-07-28 23:07:36 +0000 | [diff] [blame] | 25 | void ExprEngine::CreateCXXTemporaryObject(const MaterializeTemporaryExpr *ME, |
| 26 | ExplodedNode *Pred, |
| 27 | ExplodedNodeSet &Dst) { |
Ted Kremenek | 66c486f | 2012-08-22 06:26:15 +0000 | [diff] [blame] | 28 | StmtNodeBuilder Bldr(Pred, Dst, *currBldrCtx); |
Ted Kremenek | 6a835dd | 2011-10-02 00:54:48 +0000 | [diff] [blame] | 29 | const Expr *tempExpr = ME->GetTemporaryExpr()->IgnoreParens(); |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 30 | ProgramStateRef state = Pred->getState(); |
Ted Kremenek | 5eca482 | 2012-01-06 22:09:28 +0000 | [diff] [blame] | 31 | const LocationContext *LCtx = Pred->getLocationContext(); |
Zhongxing Xu | cb7464a | 2010-04-19 12:51:02 +0000 | [diff] [blame] | 32 | |
Ted Kremenek | 6a835dd | 2011-10-02 00:54:48 +0000 | [diff] [blame] | 33 | // Bind the temporary object to the value of the expression. Then bind |
| 34 | // the expression to the location of the object. |
Jordan Rose | c210cb7 | 2012-08-27 17:50:07 +0000 | [diff] [blame] | 35 | SVal V = state->getSVal(tempExpr, LCtx); |
Zhongxing Xu | cb7464a | 2010-04-19 12:51:02 +0000 | [diff] [blame] | 36 | |
Jordan Rose | 6ebea89 | 2012-09-05 17:11:26 +0000 | [diff] [blame] | 37 | // If the value is already a CXXTempObjectRegion, it is fine as it is. |
| 38 | // Otherwise, create a new CXXTempObjectRegion, and copy the value into it. |
| 39 | const MemRegion *MR = V.getAsRegion(); |
| 40 | if (!MR || !isa<CXXTempObjectRegion>(MR)) { |
Jordan Rose | c210cb7 | 2012-08-27 17:50:07 +0000 | [diff] [blame] | 41 | const MemRegion *R = |
| 42 | svalBuilder.getRegionManager().getCXXTempObjectRegion(ME, LCtx); |
Zhongxing Xu | cb7464a | 2010-04-19 12:51:02 +0000 | [diff] [blame] | 43 | |
Jordan Rose | c210cb7 | 2012-08-27 17:50:07 +0000 | [diff] [blame] | 44 | SVal L = loc::MemRegionVal(R); |
| 45 | state = state->bindLoc(L, V); |
| 46 | V = L; |
| 47 | } |
| 48 | |
| 49 | Bldr.generateNode(ME, Pred, state->BindExpr(ME, LCtx, V)); |
Zhongxing Xu | cb7464a | 2010-04-19 12:51:02 +0000 | [diff] [blame] | 50 | } |
| 51 | |
Jordan Rose | 362a31c | 2012-07-02 19:28:12 +0000 | [diff] [blame] | 52 | void ExprEngine::VisitCXXConstructExpr(const CXXConstructExpr *CE, |
Ted Kremenek | 5fe9872 | 2011-04-08 22:42:35 +0000 | [diff] [blame] | 53 | ExplodedNode *Pred, |
| 54 | ExplodedNodeSet &destNodes) { |
Jordan Rose | 888c90a | 2012-07-26 20:04:13 +0000 | [diff] [blame] | 55 | const LocationContext *LCtx = Pred->getLocationContext(); |
Jordan Rose | 075f6fb | 2012-07-26 20:04:16 +0000 | [diff] [blame] | 56 | ProgramStateRef State = Pred->getState(); |
| 57 | |
Jordan Rose | 888c90a | 2012-07-26 20:04:13 +0000 | [diff] [blame] | 58 | const MemRegion *Target = 0; |
| 59 | |
| 60 | switch (CE->getConstructionKind()) { |
| 61 | case CXXConstructExpr::CK_Complete: { |
Jordan Rose | 075f6fb | 2012-07-26 20:04:16 +0000 | [diff] [blame] | 62 | // See if we're constructing an existing region by looking at the next |
| 63 | // element in the CFG. |
Ted Kremenek | 66c486f | 2012-08-22 06:26:15 +0000 | [diff] [blame] | 64 | const CFGBlock *B = currBldrCtx->getBlock(); |
| 65 | if (currStmtIdx + 1 < B->size()) { |
| 66 | CFGElement Next = (*B)[currStmtIdx+1]; |
Jordan Rose | 075f6fb | 2012-07-26 20:04:16 +0000 | [diff] [blame] | 67 | |
| 68 | // Is this a constructor for a local variable? |
Jordan Rose | e460c46 | 2012-07-26 20:04:25 +0000 | [diff] [blame] | 69 | if (const CFGStmt *StmtElem = dyn_cast<CFGStmt>(&Next)) { |
| 70 | if (const DeclStmt *DS = dyn_cast<DeclStmt>(StmtElem->getStmt())) { |
| 71 | if (const VarDecl *Var = dyn_cast<VarDecl>(DS->getSingleDecl())) { |
| 72 | if (Var->getInit()->IgnoreImplicit() == CE) { |
| 73 | QualType Ty = Var->getType(); |
| 74 | if (const ArrayType *AT = getContext().getAsArrayType(Ty)) { |
| 75 | // FIXME: Handle arrays, which run the same constructor for |
| 76 | // every element. This workaround will just run the first |
| 77 | // constructor (which should still invalidate the entire array). |
| 78 | SVal Base = State->getLValue(Var, LCtx); |
| 79 | Target = State->getLValue(AT->getElementType(), |
| 80 | getSValBuilder().makeZeroArrayIndex(), |
| 81 | Base).getAsRegion(); |
| 82 | } else { |
| 83 | Target = State->getLValue(Var, LCtx).getAsRegion(); |
| 84 | } |
| 85 | } |
| 86 | } |
| 87 | } |
| 88 | } |
| 89 | |
Jordan Rose | 3a0a9e3 | 2012-07-26 20:04:21 +0000 | [diff] [blame] | 90 | // Is this a constructor for a member? |
| 91 | if (const CFGInitializer *InitElem = dyn_cast<CFGInitializer>(&Next)) { |
| 92 | const CXXCtorInitializer *Init = InitElem->getInitializer(); |
| 93 | assert(Init->isAnyMemberInitializer()); |
| 94 | |
| 95 | const CXXMethodDecl *CurCtor = cast<CXXMethodDecl>(LCtx->getDecl()); |
| 96 | Loc ThisPtr = getSValBuilder().getCXXThis(CurCtor, |
| 97 | LCtx->getCurrentStackFrame()); |
| 98 | SVal ThisVal = State->getSVal(ThisPtr); |
| 99 | |
| 100 | if (Init->isIndirectMemberInitializer()) { |
| 101 | SVal Field = State->getLValue(Init->getIndirectMember(), ThisVal); |
Jordan Rose | e460c46 | 2012-07-26 20:04:25 +0000 | [diff] [blame] | 102 | Target = Field.getAsRegion(); |
Jordan Rose | 3a0a9e3 | 2012-07-26 20:04:21 +0000 | [diff] [blame] | 103 | } else { |
| 104 | SVal Field = State->getLValue(Init->getMember(), ThisVal); |
Jordan Rose | e460c46 | 2012-07-26 20:04:25 +0000 | [diff] [blame] | 105 | Target = Field.getAsRegion(); |
Jordan Rose | 3a0a9e3 | 2012-07-26 20:04:21 +0000 | [diff] [blame] | 106 | } |
| 107 | } |
| 108 | |
Jordan Rose | 075f6fb | 2012-07-26 20:04:16 +0000 | [diff] [blame] | 109 | // FIXME: This will eventually need to handle new-expressions as well. |
| 110 | } |
| 111 | |
Jordan Rose | c210cb7 | 2012-08-27 17:50:07 +0000 | [diff] [blame] | 112 | // If we couldn't find an existing region to construct into, assume we're |
| 113 | // constructing a temporary. |
| 114 | if (!Target) { |
| 115 | MemRegionManager &MRMgr = getSValBuilder().getRegionManager(); |
| 116 | Target = MRMgr.getCXXTempObjectRegion(CE, LCtx); |
| 117 | } |
Jordan Rose | 075f6fb | 2012-07-26 20:04:16 +0000 | [diff] [blame] | 118 | |
Jordan Rose | 888c90a | 2012-07-26 20:04:13 +0000 | [diff] [blame] | 119 | break; |
| 120 | } |
| 121 | case CXXConstructExpr::CK_NonVirtualBase: |
| 122 | case CXXConstructExpr::CK_VirtualBase: |
| 123 | case CXXConstructExpr::CK_Delegating: { |
| 124 | const CXXMethodDecl *CurCtor = cast<CXXMethodDecl>(LCtx->getDecl()); |
| 125 | Loc ThisPtr = getSValBuilder().getCXXThis(CurCtor, |
| 126 | LCtx->getCurrentStackFrame()); |
Jordan Rose | 075f6fb | 2012-07-26 20:04:16 +0000 | [diff] [blame] | 127 | SVal ThisVal = State->getSVal(ThisPtr); |
Jordan Rose | 888c90a | 2012-07-26 20:04:13 +0000 | [diff] [blame] | 128 | |
| 129 | if (CE->getConstructionKind() == CXXConstructExpr::CK_Delegating) { |
| 130 | Target = ThisVal.getAsRegion(); |
| 131 | } else { |
| 132 | // Cast to the base type. |
| 133 | QualType BaseTy = CE->getType(); |
| 134 | SVal BaseVal = getStoreManager().evalDerivedToBase(ThisVal, BaseTy); |
Jordan Rose | e460c46 | 2012-07-26 20:04:25 +0000 | [diff] [blame] | 135 | Target = BaseVal.getAsRegion(); |
Jordan Rose | 888c90a | 2012-07-26 20:04:13 +0000 | [diff] [blame] | 136 | } |
| 137 | break; |
| 138 | } |
| 139 | } |
| 140 | |
Jordan Rose | d563d3f | 2012-07-30 20:22:09 +0000 | [diff] [blame] | 141 | CallEventManager &CEMgr = getStateManager().getCallEventManager(); |
| 142 | CallEventRef<CXXConstructorCall> Call = |
| 143 | CEMgr.getCXXConstructorCall(CE, Target, State, LCtx); |
Zhongxing Xu | cb7464a | 2010-04-19 12:51:02 +0000 | [diff] [blame] | 144 | |
Jordan Rose | 362a31c | 2012-07-02 19:28:12 +0000 | [diff] [blame] | 145 | ExplodedNodeSet DstPreVisit; |
| 146 | getCheckerManager().runCheckersForPreStmt(DstPreVisit, Pred, CE, *this); |
Jordan Rose | 96479da | 2012-07-02 19:28:16 +0000 | [diff] [blame] | 147 | ExplodedNodeSet DstPreCall; |
| 148 | getCheckerManager().runCheckersForPreCall(DstPreCall, DstPreVisit, |
Jordan Rose | d563d3f | 2012-07-30 20:22:09 +0000 | [diff] [blame] | 149 | *Call, *this); |
Ted Kremenek | 5fe9872 | 2011-04-08 22:42:35 +0000 | [diff] [blame] | 150 | |
Jordan Rose | 33e83b6 | 2013-01-31 18:04:03 +0000 | [diff] [blame^] | 151 | ExplodedNodeSet DstInvalidated; |
| 152 | StmtNodeBuilder Bldr(DstPreCall, DstInvalidated, *currBldrCtx); |
| 153 | for (ExplodedNodeSet::iterator I = DstPreCall.begin(), E = DstPreCall.end(); |
| 154 | I != E; ++I) |
| 155 | defaultEvalCall(Bldr, *I, *Call); |
Ted Kremenek | 5fe9872 | 2011-04-08 22:42:35 +0000 | [diff] [blame] | 156 | |
Jordan Rose | 96479da | 2012-07-02 19:28:16 +0000 | [diff] [blame] | 157 | ExplodedNodeSet DstPostCall; |
Jordan Rose | 33e83b6 | 2013-01-31 18:04:03 +0000 | [diff] [blame^] | 158 | getCheckerManager().runCheckersForPostCall(DstPostCall, DstInvalidated, |
Jordan Rose | d563d3f | 2012-07-30 20:22:09 +0000 | [diff] [blame] | 159 | *Call, *this); |
Jordan Rose | 96479da | 2012-07-02 19:28:16 +0000 | [diff] [blame] | 160 | getCheckerManager().runCheckersForPostStmt(destNodes, DstPostCall, CE, *this); |
Zhongxing Xu | cb7464a | 2010-04-19 12:51:02 +0000 | [diff] [blame] | 161 | } |
| 162 | |
Jordan Rose | 888c90a | 2012-07-26 20:04:13 +0000 | [diff] [blame] | 163 | void ExprEngine::VisitCXXDestructor(QualType ObjectType, |
| 164 | const MemRegion *Dest, |
| 165 | const Stmt *S, |
Jordan Rose | 200fa2e | 2012-09-06 20:37:08 +0000 | [diff] [blame] | 166 | bool IsBaseDtor, |
Jordan Rose | 888c90a | 2012-07-26 20:04:13 +0000 | [diff] [blame] | 167 | ExplodedNode *Pred, |
| 168 | ExplodedNodeSet &Dst) { |
Jordan Rose | d563d3f | 2012-07-30 20:22:09 +0000 | [diff] [blame] | 169 | const LocationContext *LCtx = Pred->getLocationContext(); |
| 170 | ProgramStateRef State = Pred->getState(); |
| 171 | |
Jordan Rose | e460c46 | 2012-07-26 20:04:25 +0000 | [diff] [blame] | 172 | // FIXME: We need to run the same destructor on every element of the array. |
| 173 | // This workaround will just run the first destructor (which will still |
| 174 | // invalidate the entire array). |
Jordan Rose | 4f69eb4 | 2012-12-12 19:13:44 +0000 | [diff] [blame] | 175 | // This is a loop because of multidimensional arrays. |
| 176 | while (const ArrayType *AT = getContext().getAsArrayType(ObjectType)) { |
Jordan Rose | e460c46 | 2012-07-26 20:04:25 +0000 | [diff] [blame] | 177 | ObjectType = AT->getElementType(); |
Jordan Rose | d563d3f | 2012-07-30 20:22:09 +0000 | [diff] [blame] | 178 | Dest = State->getLValue(ObjectType, getSValBuilder().makeZeroArrayIndex(), |
| 179 | loc::MemRegionVal(Dest)).getAsRegion(); |
Jordan Rose | e460c46 | 2012-07-26 20:04:25 +0000 | [diff] [blame] | 180 | } |
| 181 | |
Jordan Rose | 888c90a | 2012-07-26 20:04:13 +0000 | [diff] [blame] | 182 | const CXXRecordDecl *RecordDecl = ObjectType->getAsCXXRecordDecl(); |
| 183 | assert(RecordDecl && "Only CXXRecordDecls should have destructors"); |
| 184 | const CXXDestructorDecl *DtorDecl = RecordDecl->getDestructor(); |
| 185 | |
Jordan Rose | d563d3f | 2012-07-30 20:22:09 +0000 | [diff] [blame] | 186 | CallEventManager &CEMgr = getStateManager().getCallEventManager(); |
| 187 | CallEventRef<CXXDestructorCall> Call = |
Jordan Rose | 200fa2e | 2012-09-06 20:37:08 +0000 | [diff] [blame] | 188 | CEMgr.getCXXDestructorCall(DtorDecl, S, Dest, IsBaseDtor, State, LCtx); |
Ted Kremenek | b1b5daf | 2011-10-23 02:31:52 +0000 | [diff] [blame] | 189 | |
Jordan Rose | 563ea23 | 2012-08-03 23:31:15 +0000 | [diff] [blame] | 190 | PrettyStackTraceLoc CrashInfo(getContext().getSourceManager(), |
| 191 | Call->getSourceRange().getBegin(), |
| 192 | "Error evaluating destructor"); |
| 193 | |
Jordan Rose | 8d276d3 | 2012-07-10 22:07:47 +0000 | [diff] [blame] | 194 | ExplodedNodeSet DstPreCall; |
| 195 | getCheckerManager().runCheckersForPreCall(DstPreCall, Pred, |
Jordan Rose | d563d3f | 2012-07-30 20:22:09 +0000 | [diff] [blame] | 196 | *Call, *this); |
Zhongxing Xu | b13453b | 2010-11-20 06:53:12 +0000 | [diff] [blame] | 197 | |
Jordan Rose | 8d276d3 | 2012-07-10 22:07:47 +0000 | [diff] [blame] | 198 | ExplodedNodeSet DstInvalidated; |
Ted Kremenek | 66c486f | 2012-08-22 06:26:15 +0000 | [diff] [blame] | 199 | StmtNodeBuilder Bldr(DstPreCall, DstInvalidated, *currBldrCtx); |
Jordan Rose | 8d276d3 | 2012-07-10 22:07:47 +0000 | [diff] [blame] | 200 | for (ExplodedNodeSet::iterator I = DstPreCall.begin(), E = DstPreCall.end(); |
| 201 | I != E; ++I) |
Jordan Rose | d563d3f | 2012-07-30 20:22:09 +0000 | [diff] [blame] | 202 | defaultEvalCall(Bldr, *I, *Call); |
Jordan Rose | 8d276d3 | 2012-07-10 22:07:47 +0000 | [diff] [blame] | 203 | |
| 204 | ExplodedNodeSet DstPostCall; |
| 205 | getCheckerManager().runCheckersForPostCall(Dst, DstInvalidated, |
Jordan Rose | d563d3f | 2012-07-30 20:22:09 +0000 | [diff] [blame] | 206 | *Call, *this); |
Zhongxing Xu | b13453b | 2010-11-20 06:53:12 +0000 | [diff] [blame] | 207 | } |
| 208 | |
Argyrios Kyrtzidis | d2592a3 | 2010-12-22 18:53:44 +0000 | [diff] [blame] | 209 | void ExprEngine::VisitCXXNewExpr(const CXXNewExpr *CNE, ExplodedNode *Pred, |
Zhongxing Xu | cb7464a | 2010-04-19 12:51:02 +0000 | [diff] [blame] | 210 | ExplodedNodeSet &Dst) { |
Jordan Rose | 70cbf3c | 2012-07-02 22:21:47 +0000 | [diff] [blame] | 211 | // FIXME: Much of this should eventually migrate to CXXAllocatorCall. |
| 212 | // Also, we need to decide how allocators actually work -- they're not |
| 213 | // really part of the CXXNewExpr because they happen BEFORE the |
| 214 | // CXXConstructExpr subexpression. See PR12014 for some discussion. |
Ted Kremenek | 66c486f | 2012-08-22 06:26:15 +0000 | [diff] [blame] | 215 | StmtNodeBuilder Bldr(Pred, Dst, *currBldrCtx); |
Ted Kremenek | 41c5f49 | 2011-03-31 04:04:48 +0000 | [diff] [blame] | 216 | |
Ted Kremenek | 66c486f | 2012-08-22 06:26:15 +0000 | [diff] [blame] | 217 | unsigned blockCount = currBldrCtx->blockCount(); |
Ted Kremenek | 3133f79 | 2012-02-17 23:13:45 +0000 | [diff] [blame] | 218 | const LocationContext *LCtx = Pred->getLocationContext(); |
Ted Kremenek | 3b1df8b | 2012-08-22 06:26:06 +0000 | [diff] [blame] | 219 | DefinedOrUnknownSVal symVal = svalBuilder.conjureSymbolVal(0, CNE, LCtx, |
| 220 | CNE->getType(), |
| 221 | blockCount); |
Jordan Rose | e38c1c2 | 2012-06-20 01:32:01 +0000 | [diff] [blame] | 222 | ProgramStateRef State = Pred->getState(); |
Ted Kremenek | 41c5f49 | 2011-03-31 04:04:48 +0000 | [diff] [blame] | 223 | |
Jordan Rose | d563d3f | 2012-07-30 20:22:09 +0000 | [diff] [blame] | 224 | CallEventManager &CEMgr = getStateManager().getCallEventManager(); |
| 225 | CallEventRef<CXXAllocatorCall> Call = |
| 226 | CEMgr.getCXXAllocatorCall(CNE, State, LCtx); |
| 227 | |
Jordan Rose | 70cbf3c | 2012-07-02 22:21:47 +0000 | [diff] [blame] | 228 | // Invalidate placement args. |
Jordan Rose | d563d3f | 2012-07-30 20:22:09 +0000 | [diff] [blame] | 229 | // FIXME: Once we figure out how we want allocators to work, |
| 230 | // we should be using the usual pre-/(default-)eval-/post-call checks here. |
| 231 | State = Call->invalidateRegions(blockCount); |
Jordan Rose | 70cbf3c | 2012-07-02 22:21:47 +0000 | [diff] [blame] | 232 | |
Jordan Rose | b59b580 | 2012-10-20 02:32:51 +0000 | [diff] [blame] | 233 | // If we're compiling with exceptions enabled, and this allocation function |
| 234 | // is not declared as non-throwing, failures /must/ be signalled by |
| 235 | // exceptions, and thus the return value will never be NULL. |
| 236 | // C++11 [basic.stc.dynamic.allocation]p3. |
| 237 | FunctionDecl *FD = CNE->getOperatorNew(); |
| 238 | if (FD && getContext().getLangOpts().CXXExceptions) { |
| 239 | QualType Ty = FD->getType(); |
| 240 | if (const FunctionProtoType *ProtoType = Ty->getAs<FunctionProtoType>()) |
| 241 | if (!ProtoType->isNothrow(getContext())) |
| 242 | State = State->assume(symVal, true); |
| 243 | } |
| 244 | |
Ted Kremenek | 41c5f49 | 2011-03-31 04:04:48 +0000 | [diff] [blame] | 245 | if (CNE->isArray()) { |
| 246 | // FIXME: allocating an array requires simulating the constructors. |
| 247 | // For now, just return a symbolicated region. |
Jordan Rose | 70cbf3c | 2012-07-02 22:21:47 +0000 | [diff] [blame] | 248 | const MemRegion *NewReg = cast<loc::MemRegionVal>(symVal).getRegion(); |
| 249 | QualType ObjTy = CNE->getType()->getAs<PointerType>()->getPointeeType(); |
| 250 | const ElementRegion *EleReg = |
| 251 | getStoreManager().GetElementZeroRegion(NewReg, ObjTy); |
Jordan Rose | e38c1c2 | 2012-06-20 01:32:01 +0000 | [diff] [blame] | 252 | State = State->BindExpr(CNE, Pred->getLocationContext(), |
Ted Kremenek | 5eca482 | 2012-01-06 22:09:28 +0000 | [diff] [blame] | 253 | loc::MemRegionVal(EleReg)); |
Jordan Rose | e38c1c2 | 2012-06-20 01:32:01 +0000 | [diff] [blame] | 254 | Bldr.generateNode(CNE, Pred, State); |
Ted Kremenek | 41c5f49 | 2011-03-31 04:04:48 +0000 | [diff] [blame] | 255 | return; |
| 256 | } |
Zhongxing Xu | cb7464a | 2010-04-19 12:51:02 +0000 | [diff] [blame] | 257 | |
Jordan Rose | 70cbf3c | 2012-07-02 22:21:47 +0000 | [diff] [blame] | 258 | // FIXME: Once we have proper support for CXXConstructExprs inside |
| 259 | // CXXNewExpr, we need to make sure that the constructed object is not |
| 260 | // immediately invalidated here. (The placement call should happen before |
| 261 | // the constructor call anyway.) |
Jordan Rose | e38c1c2 | 2012-06-20 01:32:01 +0000 | [diff] [blame] | 262 | if (FD && FD->isReservedGlobalPlacementOperator()) { |
| 263 | // Non-array placement new should always return the placement location. |
| 264 | SVal PlacementLoc = State->getSVal(CNE->getPlacementArg(0), LCtx); |
Jordan Rose | 9874f59 | 2012-09-08 01:24:38 +0000 | [diff] [blame] | 265 | SVal Result = svalBuilder.evalCast(PlacementLoc, CNE->getType(), |
| 266 | CNE->getPlacementArg(0)->getType()); |
| 267 | State = State->BindExpr(CNE, LCtx, Result); |
Jordan Rose | 70cbf3c | 2012-07-02 22:21:47 +0000 | [diff] [blame] | 268 | } else { |
| 269 | State = State->BindExpr(CNE, LCtx, symVal); |
Jordan Rose | e38c1c2 | 2012-06-20 01:32:01 +0000 | [diff] [blame] | 270 | } |
| 271 | |
Jordan Rose | 89e5aaf | 2012-07-16 23:38:09 +0000 | [diff] [blame] | 272 | // If the type is not a record, we won't have a CXXConstructExpr as an |
| 273 | // initializer. Copy the value over. |
| 274 | if (const Expr *Init = CNE->getInitializer()) { |
| 275 | if (!isa<CXXConstructExpr>(Init)) { |
| 276 | QualType ObjTy = CNE->getType()->getAs<PointerType>()->getPointeeType(); |
| 277 | (void)ObjTy; |
| 278 | assert(!ObjTy->isRecordType()); |
| 279 | SVal Location = State->getSVal(CNE, LCtx); |
| 280 | if (isa<Loc>(Location)) |
| 281 | State = State->bindLoc(cast<Loc>(Location), State->getSVal(Init, LCtx)); |
| 282 | } |
| 283 | } |
| 284 | |
Jordan Rose | e38c1c2 | 2012-06-20 01:32:01 +0000 | [diff] [blame] | 285 | Bldr.generateNode(CNE, Pred, State); |
Zhongxing Xu | cb7464a | 2010-04-19 12:51:02 +0000 | [diff] [blame] | 286 | } |
| 287 | |
Argyrios Kyrtzidis | d2592a3 | 2010-12-22 18:53:44 +0000 | [diff] [blame] | 288 | void ExprEngine::VisitCXXDeleteExpr(const CXXDeleteExpr *CDE, |
Anna Zaks | ebae6d0 | 2011-10-24 18:26:19 +0000 | [diff] [blame] | 289 | ExplodedNode *Pred, ExplodedNodeSet &Dst) { |
Ted Kremenek | 66c486f | 2012-08-22 06:26:15 +0000 | [diff] [blame] | 290 | StmtNodeBuilder Bldr(Pred, Dst, *currBldrCtx); |
Erik Verbruggen | 4fafeb6 | 2012-02-29 08:42:57 +0000 | [diff] [blame] | 291 | ProgramStateRef state = Pred->getState(); |
| 292 | Bldr.generateNode(CDE, Pred, state); |
Zhongxing Xu | 6b85138 | 2010-04-21 02:17:31 +0000 | [diff] [blame] | 293 | } |
Zhongxing Xu | cb7464a | 2010-04-19 12:51:02 +0000 | [diff] [blame] | 294 | |
Ted Kremenek | 337e4db | 2012-03-10 01:34:17 +0000 | [diff] [blame] | 295 | void ExprEngine::VisitCXXCatchStmt(const CXXCatchStmt *CS, |
| 296 | ExplodedNode *Pred, |
| 297 | ExplodedNodeSet &Dst) { |
| 298 | const VarDecl *VD = CS->getExceptionDecl(); |
Ted Kremenek | ce612f5 | 2012-03-16 05:58:15 +0000 | [diff] [blame] | 299 | if (!VD) { |
| 300 | Dst.Add(Pred); |
| 301 | return; |
| 302 | } |
| 303 | |
Ted Kremenek | 337e4db | 2012-03-10 01:34:17 +0000 | [diff] [blame] | 304 | const LocationContext *LCtx = Pred->getLocationContext(); |
Ted Kremenek | 3b1df8b | 2012-08-22 06:26:06 +0000 | [diff] [blame] | 305 | SVal V = svalBuilder.conjureSymbolVal(CS, LCtx, VD->getType(), |
Ted Kremenek | 66c486f | 2012-08-22 06:26:15 +0000 | [diff] [blame] | 306 | currBldrCtx->blockCount()); |
Ted Kremenek | 337e4db | 2012-03-10 01:34:17 +0000 | [diff] [blame] | 307 | ProgramStateRef state = Pred->getState(); |
| 308 | state = state->bindLoc(state->getLValue(VD, LCtx), V); |
| 309 | |
Ted Kremenek | 66c486f | 2012-08-22 06:26:15 +0000 | [diff] [blame] | 310 | StmtNodeBuilder Bldr(Pred, Dst, *currBldrCtx); |
Ted Kremenek | 337e4db | 2012-03-10 01:34:17 +0000 | [diff] [blame] | 311 | Bldr.generateNode(CS, Pred, state); |
| 312 | } |
| 313 | |
Argyrios Kyrtzidis | d2592a3 | 2010-12-22 18:53:44 +0000 | [diff] [blame] | 314 | void ExprEngine::VisitCXXThisExpr(const CXXThisExpr *TE, ExplodedNode *Pred, |
Zhongxing Xu | 6b85138 | 2010-04-21 02:17:31 +0000 | [diff] [blame] | 315 | ExplodedNodeSet &Dst) { |
Ted Kremenek | 66c486f | 2012-08-22 06:26:15 +0000 | [diff] [blame] | 316 | StmtNodeBuilder Bldr(Pred, Dst, *currBldrCtx); |
Anna Zaks | ebae6d0 | 2011-10-24 18:26:19 +0000 | [diff] [blame] | 317 | |
Zhongxing Xu | cb7464a | 2010-04-19 12:51:02 +0000 | [diff] [blame] | 318 | // Get the this object region from StoreManager. |
Ted Kremenek | 5eca482 | 2012-01-06 22:09:28 +0000 | [diff] [blame] | 319 | const LocationContext *LCtx = Pred->getLocationContext(); |
Zhongxing Xu | cb7464a | 2010-04-19 12:51:02 +0000 | [diff] [blame] | 320 | const MemRegion *R = |
Ted Kremenek | c8413fd | 2010-12-02 07:49:45 +0000 | [diff] [blame] | 321 | svalBuilder.getRegionManager().getCXXThisRegion( |
Zhongxing Xu | cb7464a | 2010-04-19 12:51:02 +0000 | [diff] [blame] | 322 | getContext().getCanonicalType(TE->getType()), |
Ted Kremenek | 5eca482 | 2012-01-06 22:09:28 +0000 | [diff] [blame] | 323 | LCtx); |
Zhongxing Xu | cb7464a | 2010-04-19 12:51:02 +0000 | [diff] [blame] | 324 | |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 325 | ProgramStateRef state = Pred->getState(); |
Zhongxing Xu | cb7464a | 2010-04-19 12:51:02 +0000 | [diff] [blame] | 326 | SVal V = state->getSVal(loc::MemRegionVal(R)); |
Ted Kremenek | 5eca482 | 2012-01-06 22:09:28 +0000 | [diff] [blame] | 327 | Bldr.generateNode(TE, Pred, state->BindExpr(TE, LCtx, V)); |
Zhongxing Xu | cb7464a | 2010-04-19 12:51:02 +0000 | [diff] [blame] | 328 | } |