Ted Kremenek | 77349cb | 2008-02-14 22:13:12 +0000 | [diff] [blame] | 1 | //=-- GRExprEngine.cpp - Path-Sensitive Expression-Level Dataflow ---*- C++ -*-= |
Ted Kremenek | 6492485 | 2008-01-31 02:35:41 +0000 | [diff] [blame] | 2 | // |
Ted Kremenek | 4af8431 | 2008-01-31 06:49:09 +0000 | [diff] [blame] | 3 | // The LLVM Compiler Infrastructure |
Ted Kremenek | d27f816 | 2008-01-15 23:55:06 +0000 | [diff] [blame] | 4 | // |
| 5 | // This file is distributed under the University of Illinois Open Source |
| 6 | // License. See LICENSE.TXT for details. |
| 7 | // |
| 8 | //===----------------------------------------------------------------------===// |
| 9 | // |
Ted Kremenek | 77349cb | 2008-02-14 22:13:12 +0000 | [diff] [blame] | 10 | // This file defines a meta-engine for path-sensitive dataflow analysis that |
| 11 | // is built on GREngine, but provides the boilerplate to execute transfer |
| 12 | // functions and build the ExplodedGraph at the expression level. |
Ted Kremenek | d27f816 | 2008-01-15 23:55:06 +0000 | [diff] [blame] | 13 | // |
| 14 | //===----------------------------------------------------------------------===// |
| 15 | |
Ted Kremenek | 77349cb | 2008-02-14 22:13:12 +0000 | [diff] [blame] | 16 | #include "clang/Analysis/PathSensitive/GRExprEngine.h" |
Ted Kremenek | 41573eb | 2009-02-14 01:43:44 +0000 | [diff] [blame] | 17 | #include "clang/Analysis/PathSensitive/GRExprEngineBuilders.h" |
Ted Kremenek | 5a5d98b | 2009-07-22 21:43:51 +0000 | [diff] [blame] | 18 | #include "clang/Analysis/PathSensitive/Checker.h" |
Chris Lattner | 16f0049 | 2009-04-26 01:32:48 +0000 | [diff] [blame] | 19 | #include "clang/AST/ParentMap.h" |
| 20 | #include "clang/AST/StmtObjC.h" |
Chris Lattner | 1b63e4f | 2009-06-14 01:54:56 +0000 | [diff] [blame] | 21 | #include "clang/Basic/Builtins.h" |
Chris Lattner | 16f0049 | 2009-04-26 01:32:48 +0000 | [diff] [blame] | 22 | #include "clang/Basic/SourceManager.h" |
Ted Kremenek | e97ca06 | 2008-03-07 20:57:30 +0000 | [diff] [blame] | 23 | #include "clang/Basic/SourceManager.h" |
Ted Kremenek | 0bed8a1 | 2009-03-11 02:41:36 +0000 | [diff] [blame] | 24 | #include "clang/Basic/PrettyStackTrace.h" |
Ted Kremenek | bdb435d | 2008-07-11 18:37:32 +0000 | [diff] [blame] | 25 | #include "llvm/Support/Compiler.h" |
Ted Kremenek | a95d375 | 2008-09-13 05:16:45 +0000 | [diff] [blame] | 26 | #include "llvm/Support/raw_ostream.h" |
Benjamin Kramer | 6cb7c1a | 2009-08-23 12:08:50 +0000 | [diff] [blame] | 27 | #include "llvm/ADT/ImmutableList.h" |
Douglas Gregor | 55d3f7a | 2009-10-29 00:41:01 +0000 | [diff] [blame^] | 28 | #include "llvm/ADT/StringSwitch.h" |
Ted Kremenek | 4323a57 | 2008-07-10 22:03:41 +0000 | [diff] [blame] | 29 | |
Ted Kremenek | 0f5f059 | 2008-02-27 06:07:00 +0000 | [diff] [blame] | 30 | #ifndef NDEBUG |
| 31 | #include "llvm/Support/GraphWriter.h" |
Ted Kremenek | 0f5f059 | 2008-02-27 06:07:00 +0000 | [diff] [blame] | 32 | #endif |
| 33 | |
Ted Kremenek | b387a3f | 2008-02-14 22:16:04 +0000 | [diff] [blame] | 34 | using namespace clang; |
| 35 | using llvm::dyn_cast; |
| 36 | using llvm::cast; |
| 37 | using llvm::APSInt; |
Ted Kremenek | ab2b8c5 | 2008-01-23 19:59:44 +0000 | [diff] [blame] | 38 | |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 39 | //===----------------------------------------------------------------------===// |
Ted Kremenek | 5a5d98b | 2009-07-22 21:43:51 +0000 | [diff] [blame] | 40 | // Batch auditor. DEPRECATED. |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 41 | //===----------------------------------------------------------------------===// |
| 42 | |
Ted Kremenek | bdb435d | 2008-07-11 18:37:32 +0000 | [diff] [blame] | 43 | namespace { |
| 44 | |
| 45 | class VISIBILITY_HIDDEN MappedBatchAuditor : public GRSimpleAPICheck { |
| 46 | typedef llvm::ImmutableList<GRSimpleAPICheck*> Checks; |
| 47 | typedef llvm::DenseMap<void*,Checks> MapTy; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 48 | |
Ted Kremenek | bdb435d | 2008-07-11 18:37:32 +0000 | [diff] [blame] | 49 | MapTy M; |
| 50 | Checks::Factory F; |
Ted Kremenek | 536aa02 | 2009-03-30 17:53:05 +0000 | [diff] [blame] | 51 | Checks AllStmts; |
Ted Kremenek | bdb435d | 2008-07-11 18:37:32 +0000 | [diff] [blame] | 52 | |
| 53 | public: |
Ted Kremenek | 536aa02 | 2009-03-30 17:53:05 +0000 | [diff] [blame] | 54 | MappedBatchAuditor(llvm::BumpPtrAllocator& Alloc) : |
| 55 | F(Alloc), AllStmts(F.GetEmptyList()) {} |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 56 | |
Ted Kremenek | bdb435d | 2008-07-11 18:37:32 +0000 | [diff] [blame] | 57 | virtual ~MappedBatchAuditor() { |
| 58 | llvm::DenseSet<GRSimpleAPICheck*> AlreadyVisited; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 59 | |
Ted Kremenek | bdb435d | 2008-07-11 18:37:32 +0000 | [diff] [blame] | 60 | for (MapTy::iterator MI = M.begin(), ME = M.end(); MI != ME; ++MI) |
| 61 | for (Checks::iterator I=MI->second.begin(), E=MI->second.end(); I!=E;++I){ |
| 62 | |
| 63 | GRSimpleAPICheck* check = *I; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 64 | |
Ted Kremenek | bdb435d | 2008-07-11 18:37:32 +0000 | [diff] [blame] | 65 | if (AlreadyVisited.count(check)) |
| 66 | continue; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 67 | |
Ted Kremenek | bdb435d | 2008-07-11 18:37:32 +0000 | [diff] [blame] | 68 | AlreadyVisited.insert(check); |
| 69 | delete check; |
| 70 | } |
| 71 | } |
| 72 | |
Ted Kremenek | 536aa02 | 2009-03-30 17:53:05 +0000 | [diff] [blame] | 73 | void AddCheck(GRSimpleAPICheck *A, Stmt::StmtClass C) { |
Ted Kremenek | bdb435d | 2008-07-11 18:37:32 +0000 | [diff] [blame] | 74 | assert (A && "Check cannot be null."); |
| 75 | void* key = reinterpret_cast<void*>((uintptr_t) C); |
| 76 | MapTy::iterator I = M.find(key); |
| 77 | M[key] = F.Concat(A, I == M.end() ? F.GetEmptyList() : I->second); |
| 78 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 79 | |
Ted Kremenek | 536aa02 | 2009-03-30 17:53:05 +0000 | [diff] [blame] | 80 | void AddCheck(GRSimpleAPICheck *A) { |
| 81 | assert (A && "Check cannot be null."); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 82 | AllStmts = F.Concat(A, AllStmts); |
Ted Kremenek | 536aa02 | 2009-03-30 17:53:05 +0000 | [diff] [blame] | 83 | } |
Ted Kremenek | cf118d4 | 2009-02-04 23:49:09 +0000 | [diff] [blame] | 84 | |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 85 | virtual bool Audit(ExplodedNode* N, GRStateManager& VMgr) { |
Ted Kremenek | 536aa02 | 2009-03-30 17:53:05 +0000 | [diff] [blame] | 86 | // First handle the auditors that accept all statements. |
| 87 | bool isSink = false; |
| 88 | for (Checks::iterator I = AllStmts.begin(), E = AllStmts.end(); I!=E; ++I) |
| 89 | isSink |= (*I)->Audit(N, VMgr); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 90 | |
Ted Kremenek | 536aa02 | 2009-03-30 17:53:05 +0000 | [diff] [blame] | 91 | // Next handle the auditors that accept only specific statements. |
Ted Kremenek | 5f85e17 | 2009-07-22 22:35:28 +0000 | [diff] [blame] | 92 | const Stmt* S = cast<PostStmt>(N->getLocation()).getStmt(); |
Ted Kremenek | bdb435d | 2008-07-11 18:37:32 +0000 | [diff] [blame] | 93 | void* key = reinterpret_cast<void*>((uintptr_t) S->getStmtClass()); |
| 94 | MapTy::iterator MI = M.find(key); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 95 | if (MI != M.end()) { |
Ted Kremenek | 536aa02 | 2009-03-30 17:53:05 +0000 | [diff] [blame] | 96 | for (Checks::iterator I=MI->second.begin(), E=MI->second.end(); I!=E; ++I) |
| 97 | isSink |= (*I)->Audit(N, VMgr); |
| 98 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 99 | |
| 100 | return isSink; |
Ted Kremenek | bdb435d | 2008-07-11 18:37:32 +0000 | [diff] [blame] | 101 | } |
| 102 | }; |
| 103 | |
| 104 | } // end anonymous namespace |
| 105 | |
| 106 | //===----------------------------------------------------------------------===// |
Ted Kremenek | 5a5d98b | 2009-07-22 21:43:51 +0000 | [diff] [blame] | 107 | // Checker worklist routines. |
| 108 | //===----------------------------------------------------------------------===// |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 109 | |
| 110 | void GRExprEngine::CheckerVisit(Stmt *S, ExplodedNodeSet &Dst, |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 111 | ExplodedNodeSet &Src, bool isPrevisit) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 112 | |
Ted Kremenek | 5a5d98b | 2009-07-22 21:43:51 +0000 | [diff] [blame] | 113 | if (Checkers.empty()) { |
| 114 | Dst = Src; |
| 115 | return; |
| 116 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 117 | |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 118 | ExplodedNodeSet Tmp; |
| 119 | ExplodedNodeSet *PrevSet = &Src; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 120 | |
Ted Kremenek | 5a5d98b | 2009-07-22 21:43:51 +0000 | [diff] [blame] | 121 | for (std::vector<Checker*>::iterator I = Checkers.begin(), E = Checkers.end(); |
| 122 | I != E; ++I) { |
| 123 | |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 124 | ExplodedNodeSet *CurrSet = (I+1 == E) ? &Dst |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 125 | : (PrevSet == &Tmp) ? &Src : &Tmp; |
Ted Kremenek | 5a5d98b | 2009-07-22 21:43:51 +0000 | [diff] [blame] | 126 | CurrSet->clear(); |
| 127 | Checker *checker = *I; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 128 | |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 129 | for (ExplodedNodeSet::iterator NI = PrevSet->begin(), NE = PrevSet->end(); |
Ted Kremenek | 5a5d98b | 2009-07-22 21:43:51 +0000 | [diff] [blame] | 130 | NI != NE; ++NI) |
| 131 | checker->GR_Visit(*CurrSet, *Builder, *this, S, *NI, isPrevisit); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 132 | |
Ted Kremenek | 5a5d98b | 2009-07-22 21:43:51 +0000 | [diff] [blame] | 133 | // Update which NodeSet is the current one. |
| 134 | PrevSet = CurrSet; |
| 135 | } |
| 136 | |
| 137 | // Don't autotransition. The CheckerContext objects should do this |
| 138 | // automatically. |
| 139 | } |
| 140 | |
| 141 | //===----------------------------------------------------------------------===// |
Ted Kremenek | bdb435d | 2008-07-11 18:37:32 +0000 | [diff] [blame] | 142 | // Engine construction and deletion. |
| 143 | //===----------------------------------------------------------------------===// |
| 144 | |
Ted Kremenek | e448ab4 | 2008-05-01 18:33:28 +0000 | [diff] [blame] | 145 | static inline Selector GetNullarySelector(const char* name, ASTContext& Ctx) { |
| 146 | IdentifierInfo* II = &Ctx.Idents.get(name); |
| 147 | return Ctx.Selectors.getSelector(0, &II); |
| 148 | } |
| 149 | |
Ted Kremenek | daa497e | 2008-03-09 18:05:48 +0000 | [diff] [blame] | 150 | |
Zhongxing Xu | 5032ffe | 2009-08-25 06:51:30 +0000 | [diff] [blame] | 151 | GRExprEngine::GRExprEngine(AnalysisManager &mgr) |
Zhongxing Xu | 25e695b | 2009-08-15 03:17:38 +0000 | [diff] [blame] | 152 | : AMgr(mgr), |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 153 | CoreEngine(mgr.getASTContext(), *this), |
Ted Kremenek | 50a6d0c | 2008-04-09 21:41:14 +0000 | [diff] [blame] | 154 | G(CoreEngine.getGraph()), |
Ted Kremenek | 50a6d0c | 2008-04-09 21:41:14 +0000 | [diff] [blame] | 155 | Builder(NULL), |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 156 | StateMgr(G.getContext(), mgr.getStoreManagerCreator(), |
Zhongxing Xu | 5032ffe | 2009-08-25 06:51:30 +0000 | [diff] [blame] | 157 | mgr.getConstraintManagerCreator(), G.getAllocator()), |
Ted Kremenek | 50a6d0c | 2008-04-09 21:41:14 +0000 | [diff] [blame] | 158 | SymMgr(StateMgr.getSymbolManager()), |
Ted Kremenek | 8e5fb28 | 2009-04-09 16:46:55 +0000 | [diff] [blame] | 159 | ValMgr(StateMgr.getValueManager()), |
Ted Kremenek | 06669c8 | 2009-07-16 01:32:00 +0000 | [diff] [blame] | 160 | SVator(ValMgr.getSValuator()), |
Ted Kremenek | e448ab4 | 2008-05-01 18:33:28 +0000 | [diff] [blame] | 161 | CurrentStmt(NULL), |
Zhongxing Xu | a5a4166 | 2008-12-22 08:30:52 +0000 | [diff] [blame] | 162 | NSExceptionII(NULL), NSExceptionInstanceRaiseSelectors(NULL), |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 163 | RaiseSel(GetNullarySelector("raise", G.getContext())), |
Zhongxing Xu | 5032ffe | 2009-08-25 06:51:30 +0000 | [diff] [blame] | 164 | BR(mgr, *this) {} |
Ted Kremenek | 50a6d0c | 2008-04-09 21:41:14 +0000 | [diff] [blame] | 165 | |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 166 | GRExprEngine::~GRExprEngine() { |
Ted Kremenek | cf118d4 | 2009-02-04 23:49:09 +0000 | [diff] [blame] | 167 | BR.FlushReports(); |
Ted Kremenek | e448ab4 | 2008-05-01 18:33:28 +0000 | [diff] [blame] | 168 | delete [] NSExceptionInstanceRaiseSelectors; |
Ted Kremenek | 5a5d98b | 2009-07-22 21:43:51 +0000 | [diff] [blame] | 169 | for (std::vector<Checker*>::iterator I=Checkers.begin(), E=Checkers.end(); |
| 170 | I!=E; ++I) |
| 171 | delete *I; |
Ted Kremenek | 50a6d0c | 2008-04-09 21:41:14 +0000 | [diff] [blame] | 172 | } |
| 173 | |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 174 | //===----------------------------------------------------------------------===// |
| 175 | // Utility methods. |
| 176 | //===----------------------------------------------------------------------===// |
| 177 | |
Ted Kremenek | 186350f | 2008-04-23 20:12:28 +0000 | [diff] [blame] | 178 | |
Ted Kremenek | 50a6d0c | 2008-04-09 21:41:14 +0000 | [diff] [blame] | 179 | void GRExprEngine::setTransferFunctions(GRTransferFuncs* tf) { |
Ted Kremenek | 729a9a2 | 2008-07-17 23:15:45 +0000 | [diff] [blame] | 180 | StateMgr.TF = tf; |
Ted Kremenek | cf118d4 | 2009-02-04 23:49:09 +0000 | [diff] [blame] | 181 | tf->RegisterChecks(getBugReporter()); |
Ted Kremenek | 1c72ef0 | 2008-08-16 00:49:49 +0000 | [diff] [blame] | 182 | tf->RegisterPrinters(getStateManager().Printers); |
Ted Kremenek | 50a6d0c | 2008-04-09 21:41:14 +0000 | [diff] [blame] | 183 | } |
| 184 | |
Ted Kremenek | bdb435d | 2008-07-11 18:37:32 +0000 | [diff] [blame] | 185 | void GRExprEngine::AddCheck(GRSimpleAPICheck* A, Stmt::StmtClass C) { |
| 186 | if (!BatchAuditor) |
| 187 | BatchAuditor.reset(new MappedBatchAuditor(getGraph().getAllocator())); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 188 | |
Ted Kremenek | bdb435d | 2008-07-11 18:37:32 +0000 | [diff] [blame] | 189 | ((MappedBatchAuditor*) BatchAuditor.get())->AddCheck(A, C); |
Ted Kremenek | 50a6d0c | 2008-04-09 21:41:14 +0000 | [diff] [blame] | 190 | } |
| 191 | |
Ted Kremenek | 536aa02 | 2009-03-30 17:53:05 +0000 | [diff] [blame] | 192 | void GRExprEngine::AddCheck(GRSimpleAPICheck *A) { |
| 193 | if (!BatchAuditor) |
| 194 | BatchAuditor.reset(new MappedBatchAuditor(getGraph().getAllocator())); |
| 195 | |
| 196 | ((MappedBatchAuditor*) BatchAuditor.get())->AddCheck(A); |
| 197 | } |
| 198 | |
Zhongxing Xu | 17fd863 | 2009-08-17 06:19:58 +0000 | [diff] [blame] | 199 | const GRState* GRExprEngine::getInitialState(const LocationContext *InitLoc) { |
| 200 | const GRState *state = StateMgr.getInitialState(InitLoc); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 201 | |
Ted Kremenek | cfcd7fd | 2009-09-09 20:36:12 +0000 | [diff] [blame] | 202 | // Preconditions. |
| 203 | |
Ted Kremenek | 52e5602 | 2009-04-10 00:59:50 +0000 | [diff] [blame] | 204 | // FIXME: It would be nice if we had a more general mechanism to add |
| 205 | // such preconditions. Some day. |
Ted Kremenek | cfcd7fd | 2009-09-09 20:36:12 +0000 | [diff] [blame] | 206 | const Decl *D = InitLoc->getDecl(); |
| 207 | |
| 208 | if (const FunctionDecl *FD = dyn_cast<FunctionDecl>(D)) { |
| 209 | // Precondition: the first argument of 'main' is an integer guaranteed |
| 210 | // to be > 0. |
Daniel Dunbar | 01eb9b9 | 2009-10-18 21:17:35 +0000 | [diff] [blame] | 211 | if (FD->getIdentifier()->getName() == "main" && |
Ted Kremenek | 52e5602 | 2009-04-10 00:59:50 +0000 | [diff] [blame] | 212 | FD->getNumParams() > 0) { |
| 213 | const ParmVarDecl *PD = FD->getParamDecl(0); |
| 214 | QualType T = PD->getType(); |
| 215 | if (T->isIntegerType()) |
Ted Kremenek | d17da2b | 2009-08-21 22:28:32 +0000 | [diff] [blame] | 216 | if (const MemRegion *R = state->getRegion(PD, InitLoc)) { |
Ted Kremenek | 3ff1259 | 2009-06-19 17:10:32 +0000 | [diff] [blame] | 217 | SVal V = state->getSVal(loc::MemRegionVal(R)); |
Ted Kremenek | 5b9bd21 | 2009-09-11 22:07:28 +0000 | [diff] [blame] | 218 | SVal Constraint_untested = EvalBinOp(state, BinaryOperator::GT, V, |
| 219 | ValMgr.makeZeroVal(T), |
| 220 | getContext().IntTy); |
Ted Kremenek | a591bc0 | 2009-06-18 22:57:13 +0000 | [diff] [blame] | 221 | |
Ted Kremenek | 5b9bd21 | 2009-09-11 22:07:28 +0000 | [diff] [blame] | 222 | if (DefinedOrUnknownSVal *Constraint = |
| 223 | dyn_cast<DefinedOrUnknownSVal>(&Constraint_untested)) { |
| 224 | if (const GRState *newState = state->Assume(*Constraint, true)) |
| 225 | state = newState; |
| 226 | } |
Ted Kremenek | 52e5602 | 2009-04-10 00:59:50 +0000 | [diff] [blame] | 227 | } |
| 228 | } |
Ted Kremenek | cfcd7fd | 2009-09-09 20:36:12 +0000 | [diff] [blame] | 229 | } |
| 230 | else if (const ObjCMethodDecl *MD = dyn_cast<ObjCMethodDecl>(D)) { |
| 231 | // Precondition: 'self' is always non-null upon entry to an Objective-C |
| 232 | // method. |
| 233 | const ImplicitParamDecl *SelfD = MD->getSelfDecl(); |
| 234 | const MemRegion *R = state->getRegion(SelfD, InitLoc); |
| 235 | SVal V = state->getSVal(loc::MemRegionVal(R)); |
| 236 | |
| 237 | if (const Loc *LV = dyn_cast<Loc>(&V)) { |
| 238 | // Assume that the pointer value in 'self' is non-null. |
Ted Kremenek | 5b9bd21 | 2009-09-11 22:07:28 +0000 | [diff] [blame] | 239 | state = state->Assume(*LV, true); |
Ted Kremenek | cfcd7fd | 2009-09-09 20:36:12 +0000 | [diff] [blame] | 240 | assert(state && "'self' cannot be null"); |
| 241 | } |
| 242 | } |
| 243 | |
Ted Kremenek | 52e5602 | 2009-04-10 00:59:50 +0000 | [diff] [blame] | 244 | return state; |
Ted Kremenek | e070a1d | 2008-02-04 21:59:01 +0000 | [diff] [blame] | 245 | } |
| 246 | |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 247 | //===----------------------------------------------------------------------===// |
| 248 | // Top-level transfer function logic (Dispatcher). |
| 249 | //===----------------------------------------------------------------------===// |
| 250 | |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 251 | void GRExprEngine::ProcessStmt(Stmt* S, GRStmtNodeBuilder& builder) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 252 | |
Ted Kremenek | 0bed8a1 | 2009-03-11 02:41:36 +0000 | [diff] [blame] | 253 | PrettyStackTraceLoc CrashInfo(getContext().getSourceManager(), |
| 254 | S->getLocStart(), |
| 255 | "Error evaluating statement"); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 256 | |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 257 | Builder = &builder; |
Ted Kremenek | 846d4e9 | 2008-04-24 23:35:58 +0000 | [diff] [blame] | 258 | EntryNode = builder.getLastNode(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 259 | |
Ted Kremenek | df7533b | 2008-07-17 21:27:31 +0000 | [diff] [blame] | 260 | // FIXME: Consolidate. |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 261 | CurrentStmt = S; |
Ted Kremenek | df7533b | 2008-07-17 21:27:31 +0000 | [diff] [blame] | 262 | StateMgr.CurrentStmt = S; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 263 | |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 264 | // Set up our simple checks. |
Ted Kremenek | bdb435d | 2008-07-11 18:37:32 +0000 | [diff] [blame] | 265 | if (BatchAuditor) |
| 266 | Builder->setAuditor(BatchAuditor.get()); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 267 | |
| 268 | // Create the cleaned state. |
Zhongxing Xu | b317f8f | 2009-09-10 05:44:00 +0000 | [diff] [blame] | 269 | SymbolReaper SymReaper(Builder->getBasePredecessor()->getLiveVariables(), |
| 270 | SymMgr); |
Zhongxing Xu | c999496 | 2009-08-27 06:55:26 +0000 | [diff] [blame] | 271 | CleanedState = AMgr.shouldPurgeDead() |
| 272 | ? StateMgr.RemoveDeadBindings(EntryNode->getState(), CurrentStmt, SymReaper) |
| 273 | : EntryNode->getState(); |
Ted Kremenek | 241677a | 2009-01-21 22:26:05 +0000 | [diff] [blame] | 274 | |
Ted Kremenek | 77d7ef8 | 2008-04-24 18:31:42 +0000 | [diff] [blame] | 275 | // Process any special transfer function for dead symbols. |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 276 | ExplodedNodeSet Tmp; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 277 | |
Ted Kremenek | 241677a | 2009-01-21 22:26:05 +0000 | [diff] [blame] | 278 | if (!SymReaper.hasDeadSymbols()) |
Ted Kremenek | 846d4e9 | 2008-04-24 23:35:58 +0000 | [diff] [blame] | 279 | Tmp.Add(EntryNode); |
Ted Kremenek | 77d7ef8 | 2008-04-24 18:31:42 +0000 | [diff] [blame] | 280 | else { |
| 281 | SaveAndRestore<bool> OldSink(Builder->BuildSinks); |
Ted Kremenek | 846d4e9 | 2008-04-24 23:35:58 +0000 | [diff] [blame] | 282 | SaveOr OldHasGen(Builder->HasGeneratedNode); |
| 283 | |
Ted Kremenek | 331b0ac | 2008-06-18 05:34:07 +0000 | [diff] [blame] | 284 | SaveAndRestore<bool> OldPurgeDeadSymbols(Builder->PurgingDeadSymbols); |
| 285 | Builder->PurgingDeadSymbols = true; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 286 | |
| 287 | getTF().EvalDeadSymbols(Tmp, *this, *Builder, EntryNode, S, |
Ted Kremenek | 241677a | 2009-01-21 22:26:05 +0000 | [diff] [blame] | 288 | CleanedState, SymReaper); |
Ted Kremenek | 846d4e9 | 2008-04-24 23:35:58 +0000 | [diff] [blame] | 289 | |
| 290 | if (!Builder->BuildSinks && !Builder->HasGeneratedNode) |
| 291 | Tmp.Add(EntryNode); |
Ted Kremenek | 77d7ef8 | 2008-04-24 18:31:42 +0000 | [diff] [blame] | 292 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 293 | |
Ted Kremenek | 846d4e9 | 2008-04-24 23:35:58 +0000 | [diff] [blame] | 294 | bool HasAutoGenerated = false; |
| 295 | |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 296 | for (ExplodedNodeSet::iterator I=Tmp.begin(), E=Tmp.end(); I!=E; ++I) { |
Ted Kremenek | 846d4e9 | 2008-04-24 23:35:58 +0000 | [diff] [blame] | 297 | |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 298 | ExplodedNodeSet Dst; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 299 | |
| 300 | // Set the cleaned state. |
Ted Kremenek | 846d4e9 | 2008-04-24 23:35:58 +0000 | [diff] [blame] | 301 | Builder->SetCleanedState(*I == EntryNode ? CleanedState : GetState(*I)); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 302 | |
| 303 | // Visit the statement. |
Ted Kremenek | 846d4e9 | 2008-04-24 23:35:58 +0000 | [diff] [blame] | 304 | Visit(S, *I, Dst); |
| 305 | |
| 306 | // Do we need to auto-generate a node? We only need to do this to generate |
| 307 | // a node with a "cleaned" state; GRCoreEngine will actually handle |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 308 | // auto-transitions for other cases. |
Ted Kremenek | 846d4e9 | 2008-04-24 23:35:58 +0000 | [diff] [blame] | 309 | if (Dst.size() == 1 && *Dst.begin() == EntryNode |
| 310 | && !Builder->HasGeneratedNode && !HasAutoGenerated) { |
| 311 | HasAutoGenerated = true; |
| 312 | builder.generateNode(S, GetState(EntryNode), *I); |
| 313 | } |
Ted Kremenek | 77d7ef8 | 2008-04-24 18:31:42 +0000 | [diff] [blame] | 314 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 315 | |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 316 | // NULL out these variables to cleanup. |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 317 | CleanedState = NULL; |
Ted Kremenek | 846d4e9 | 2008-04-24 23:35:58 +0000 | [diff] [blame] | 318 | EntryNode = NULL; |
Ted Kremenek | df7533b | 2008-07-17 21:27:31 +0000 | [diff] [blame] | 319 | |
| 320 | // FIXME: Consolidate. |
| 321 | StateMgr.CurrentStmt = 0; |
| 322 | CurrentStmt = 0; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 323 | |
Ted Kremenek | 846d4e9 | 2008-04-24 23:35:58 +0000 | [diff] [blame] | 324 | Builder = NULL; |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 325 | } |
| 326 | |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 327 | void GRExprEngine::Visit(Stmt* S, ExplodedNode* Pred, ExplodedNodeSet& Dst) { |
Ted Kremenek | 0bed8a1 | 2009-03-11 02:41:36 +0000 | [diff] [blame] | 328 | PrettyStackTraceLoc CrashInfo(getContext().getSourceManager(), |
| 329 | S->getLocStart(), |
| 330 | "Error evaluating statement"); |
| 331 | |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 332 | // FIXME: add metadata to the CFG so that we can disable |
| 333 | // this check when we KNOW that there is no block-level subexpression. |
| 334 | // The motivation is that this check requires a hashtable lookup. |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 335 | |
Zhongxing Xu | cc02553 | 2009-08-25 03:33:41 +0000 | [diff] [blame] | 336 | if (S != CurrentStmt && Pred->getLocationContext()->getCFG()->isBlkExpr(S)) { |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 337 | Dst.Add(Pred); |
| 338 | return; |
| 339 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 340 | |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 341 | switch (S->getStmtClass()) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 342 | |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 343 | default: |
| 344 | // Cases we intentionally have "default" handle: |
| 345 | // AddrLabelExpr, IntegerLiteral, CharacterLiteral |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 346 | |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 347 | Dst.Add(Pred); // No-op. Simply propagate the current state unchanged. |
| 348 | break; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 349 | |
Ted Kremenek | 540cbe2 | 2008-04-22 04:56:29 +0000 | [diff] [blame] | 350 | case Stmt::ArraySubscriptExprClass: |
| 351 | VisitArraySubscriptExpr(cast<ArraySubscriptExpr>(S), Pred, Dst, false); |
| 352 | break; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 353 | |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 354 | case Stmt::AsmStmtClass: |
| 355 | VisitAsmStmt(cast<AsmStmt>(S), Pred, Dst); |
| 356 | break; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 357 | |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 358 | case Stmt::BinaryOperatorClass: { |
| 359 | BinaryOperator* B = cast<BinaryOperator>(S); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 360 | |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 361 | if (B->isLogicalOp()) { |
| 362 | VisitLogicalExpr(B, Pred, Dst); |
| 363 | break; |
| 364 | } |
| 365 | else if (B->getOpcode() == BinaryOperator::Comma) { |
Ted Kremenek | a8538d9 | 2009-02-13 01:45:31 +0000 | [diff] [blame] | 366 | const GRState* state = GetState(Pred); |
Ted Kremenek | 8e02934 | 2009-08-27 22:17:37 +0000 | [diff] [blame] | 367 | MakeNode(Dst, B, Pred, state->BindExpr(B, state->getSVal(B->getRHS()))); |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 368 | break; |
| 369 | } |
Ted Kremenek | 06fb99f | 2008-11-14 19:47:18 +0000 | [diff] [blame] | 370 | |
Zhongxing Xu | 5032ffe | 2009-08-25 06:51:30 +0000 | [diff] [blame] | 371 | if (AMgr.shouldEagerlyAssume() && (B->isRelationalOp() || B->isEqualityOp())) { |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 372 | ExplodedNodeSet Tmp; |
Ted Kremenek | 48af2a9 | 2009-02-25 22:32:02 +0000 | [diff] [blame] | 373 | VisitBinaryOperator(cast<BinaryOperator>(S), Pred, Tmp); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 374 | EvalEagerlyAssume(Dst, Tmp, cast<Expr>(S)); |
Ted Kremenek | 48af2a9 | 2009-02-25 22:32:02 +0000 | [diff] [blame] | 375 | } |
| 376 | else |
| 377 | VisitBinaryOperator(cast<BinaryOperator>(S), Pred, Dst); |
| 378 | |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 379 | break; |
| 380 | } |
Ted Kremenek | 06fb99f | 2008-11-14 19:47:18 +0000 | [diff] [blame] | 381 | |
Douglas Gregor | b460980 | 2008-11-14 16:09:21 +0000 | [diff] [blame] | 382 | case Stmt::CallExprClass: |
| 383 | case Stmt::CXXOperatorCallExprClass: { |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 384 | CallExpr* C = cast<CallExpr>(S); |
| 385 | VisitCall(C, Pred, C->arg_begin(), C->arg_end(), Dst); |
Ted Kremenek | 06fb99f | 2008-11-14 19:47:18 +0000 | [diff] [blame] | 386 | break; |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 387 | } |
Ted Kremenek | 06fb99f | 2008-11-14 19:47:18 +0000 | [diff] [blame] | 388 | |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 389 | // FIXME: ChooseExpr is really a constant. We need to fix |
| 390 | // the CFG do not model them as explicit control-flow. |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 391 | |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 392 | case Stmt::ChooseExprClass: { // __builtin_choose_expr |
| 393 | ChooseExpr* C = cast<ChooseExpr>(S); |
| 394 | VisitGuardedExpr(C, C->getLHS(), C->getRHS(), Pred, Dst); |
| 395 | break; |
| 396 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 397 | |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 398 | case Stmt::CompoundAssignOperatorClass: |
| 399 | VisitBinaryOperator(cast<BinaryOperator>(S), Pred, Dst); |
| 400 | break; |
Zhongxing Xu | f22679e | 2008-11-07 10:38:33 +0000 | [diff] [blame] | 401 | |
| 402 | case Stmt::CompoundLiteralExprClass: |
| 403 | VisitCompoundLiteralExpr(cast<CompoundLiteralExpr>(S), Pred, Dst, false); |
| 404 | break; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 405 | |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 406 | case Stmt::ConditionalOperatorClass: { // '?' operator |
| 407 | ConditionalOperator* C = cast<ConditionalOperator>(S); |
| 408 | VisitGuardedExpr(C, C->getLHS(), C->getRHS(), Pred, Dst); |
| 409 | break; |
| 410 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 411 | |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 412 | case Stmt::DeclRefExprClass: |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 413 | VisitDeclRefExpr(cast<DeclRefExpr>(S), Pred, Dst, false); |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 414 | break; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 415 | |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 416 | case Stmt::DeclStmtClass: |
| 417 | VisitDeclStmt(cast<DeclStmt>(S), Pred, Dst); |
| 418 | break; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 419 | |
Argyrios Kyrtzidis | 0835a3c | 2008-08-18 23:01:59 +0000 | [diff] [blame] | 420 | case Stmt::ImplicitCastExprClass: |
Douglas Gregor | 6eec8e8 | 2008-10-28 15:36:24 +0000 | [diff] [blame] | 421 | case Stmt::CStyleCastExprClass: { |
Argyrios Kyrtzidis | 0835a3c | 2008-08-18 23:01:59 +0000 | [diff] [blame] | 422 | CastExpr* C = cast<CastExpr>(S); |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 423 | VisitCast(C, C->getSubExpr(), Pred, Dst); |
| 424 | break; |
| 425 | } |
Zhongxing Xu | c4f8706 | 2008-10-30 05:02:23 +0000 | [diff] [blame] | 426 | |
| 427 | case Stmt::InitListExprClass: |
| 428 | VisitInitListExpr(cast<InitListExpr>(S), Pred, Dst); |
| 429 | break; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 430 | |
Ted Kremenek | 97ed4f6 | 2008-10-17 00:03:18 +0000 | [diff] [blame] | 431 | case Stmt::MemberExprClass: |
Ted Kremenek | 469ecbd | 2008-04-21 23:43:38 +0000 | [diff] [blame] | 432 | VisitMemberExpr(cast<MemberExpr>(S), Pred, Dst, false); |
| 433 | break; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 434 | |
Ted Kremenek | 97ed4f6 | 2008-10-17 00:03:18 +0000 | [diff] [blame] | 435 | case Stmt::ObjCIvarRefExprClass: |
| 436 | VisitObjCIvarRefExpr(cast<ObjCIvarRefExpr>(S), Pred, Dst, false); |
| 437 | break; |
Ted Kremenek | af33741 | 2008-11-12 19:24:17 +0000 | [diff] [blame] | 438 | |
| 439 | case Stmt::ObjCForCollectionStmtClass: |
| 440 | VisitObjCForCollectionStmt(cast<ObjCForCollectionStmt>(S), Pred, Dst); |
| 441 | break; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 442 | |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 443 | case Stmt::ObjCMessageExprClass: { |
| 444 | VisitObjCMessageExpr(cast<ObjCMessageExpr>(S), Pred, Dst); |
| 445 | break; |
| 446 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 447 | |
Ted Kremenek | bbfd07a | 2008-12-09 20:18:58 +0000 | [diff] [blame] | 448 | case Stmt::ObjCAtThrowStmtClass: { |
| 449 | // FIXME: This is not complete. We basically treat @throw as |
| 450 | // an abort. |
| 451 | SaveAndRestore<bool> OldSink(Builder->BuildSinks); |
| 452 | Builder->BuildSinks = true; |
| 453 | MakeNode(Dst, S, Pred, GetState(Pred)); |
| 454 | break; |
| 455 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 456 | |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 457 | case Stmt::ParenExprClass: |
Ted Kremenek | 540cbe2 | 2008-04-22 04:56:29 +0000 | [diff] [blame] | 458 | Visit(cast<ParenExpr>(S)->getSubExpr()->IgnoreParens(), Pred, Dst); |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 459 | break; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 460 | |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 461 | case Stmt::ReturnStmtClass: |
| 462 | VisitReturnStmt(cast<ReturnStmt>(S), Pred, Dst); |
| 463 | break; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 464 | |
Sebastian Redl | 0518999 | 2008-11-11 17:56:53 +0000 | [diff] [blame] | 465 | case Stmt::SizeOfAlignOfExprClass: |
| 466 | VisitSizeOfAlignOfExpr(cast<SizeOfAlignOfExpr>(S), Pred, Dst); |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 467 | break; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 468 | |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 469 | case Stmt::StmtExprClass: { |
| 470 | StmtExpr* SE = cast<StmtExpr>(S); |
Ted Kremenek | a3d1eb8 | 2009-02-14 05:55:08 +0000 | [diff] [blame] | 471 | |
| 472 | if (SE->getSubStmt()->body_empty()) { |
| 473 | // Empty statement expression. |
| 474 | assert(SE->getType() == getContext().VoidTy |
| 475 | && "Empty statement expression must have void type."); |
| 476 | Dst.Add(Pred); |
| 477 | break; |
| 478 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 479 | |
Ted Kremenek | a3d1eb8 | 2009-02-14 05:55:08 +0000 | [diff] [blame] | 480 | if (Expr* LastExpr = dyn_cast<Expr>(*SE->getSubStmt()->body_rbegin())) { |
| 481 | const GRState* state = GetState(Pred); |
Ted Kremenek | 8e02934 | 2009-08-27 22:17:37 +0000 | [diff] [blame] | 482 | MakeNode(Dst, SE, Pred, state->BindExpr(SE, state->getSVal(LastExpr))); |
Ted Kremenek | a3d1eb8 | 2009-02-14 05:55:08 +0000 | [diff] [blame] | 483 | } |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 484 | else |
| 485 | Dst.Add(Pred); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 486 | |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 487 | break; |
| 488 | } |
Zhongxing Xu | 6987c7b | 2008-11-30 05:49:49 +0000 | [diff] [blame] | 489 | |
| 490 | case Stmt::StringLiteralClass: |
| 491 | VisitLValue(cast<StringLiteral>(S), Pred, Dst); |
| 492 | break; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 493 | |
Ted Kremenek | 7237459 | 2009-03-18 23:49:26 +0000 | [diff] [blame] | 494 | case Stmt::UnaryOperatorClass: { |
| 495 | UnaryOperator *U = cast<UnaryOperator>(S); |
Zhongxing Xu | 5032ffe | 2009-08-25 06:51:30 +0000 | [diff] [blame] | 496 | if (AMgr.shouldEagerlyAssume() && (U->getOpcode() == UnaryOperator::LNot)) { |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 497 | ExplodedNodeSet Tmp; |
Ted Kremenek | 7237459 | 2009-03-18 23:49:26 +0000 | [diff] [blame] | 498 | VisitUnaryOperator(U, Pred, Tmp, false); |
| 499 | EvalEagerlyAssume(Dst, Tmp, U); |
| 500 | } |
| 501 | else |
| 502 | VisitUnaryOperator(U, Pred, Dst, false); |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 503 | break; |
Ted Kremenek | 7237459 | 2009-03-18 23:49:26 +0000 | [diff] [blame] | 504 | } |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 505 | } |
| 506 | } |
| 507 | |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 508 | void GRExprEngine::VisitLValue(Expr* Ex, ExplodedNode* Pred, |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 509 | ExplodedNodeSet& Dst) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 510 | |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 511 | Ex = Ex->IgnoreParens(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 512 | |
Zhongxing Xu | cc02553 | 2009-08-25 03:33:41 +0000 | [diff] [blame] | 513 | if (Ex != CurrentStmt && Pred->getLocationContext()->getCFG()->isBlkExpr(Ex)) { |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 514 | Dst.Add(Pred); |
| 515 | return; |
| 516 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 517 | |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 518 | switch (Ex->getStmtClass()) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 519 | |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 520 | case Stmt::ArraySubscriptExprClass: |
| 521 | VisitArraySubscriptExpr(cast<ArraySubscriptExpr>(Ex), Pred, Dst, true); |
| 522 | return; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 523 | |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 524 | case Stmt::DeclRefExprClass: |
| 525 | VisitDeclRefExpr(cast<DeclRefExpr>(Ex), Pred, Dst, true); |
| 526 | return; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 527 | |
Ted Kremenek | 97ed4f6 | 2008-10-17 00:03:18 +0000 | [diff] [blame] | 528 | case Stmt::ObjCIvarRefExprClass: |
| 529 | VisitObjCIvarRefExpr(cast<ObjCIvarRefExpr>(Ex), Pred, Dst, true); |
| 530 | return; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 531 | |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 532 | case Stmt::UnaryOperatorClass: |
| 533 | VisitUnaryOperator(cast<UnaryOperator>(Ex), Pred, Dst, true); |
| 534 | return; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 535 | |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 536 | case Stmt::MemberExprClass: |
| 537 | VisitMemberExpr(cast<MemberExpr>(Ex), Pred, Dst, true); |
| 538 | return; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 539 | |
Ted Kremenek | 4f09027 | 2008-10-27 21:54:31 +0000 | [diff] [blame] | 540 | case Stmt::CompoundLiteralExprClass: |
Zhongxing Xu | f22679e | 2008-11-07 10:38:33 +0000 | [diff] [blame] | 541 | VisitCompoundLiteralExpr(cast<CompoundLiteralExpr>(Ex), Pred, Dst, true); |
Ted Kremenek | 4f09027 | 2008-10-27 21:54:31 +0000 | [diff] [blame] | 542 | return; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 543 | |
Ted Kremenek | b6b81d1 | 2008-10-17 17:24:14 +0000 | [diff] [blame] | 544 | case Stmt::ObjCPropertyRefExprClass: |
Fariborz Jahanian | 09105f5 | 2009-08-20 17:02:02 +0000 | [diff] [blame] | 545 | case Stmt::ObjCImplicitSetterGetterRefExprClass: |
Ted Kremenek | b6b81d1 | 2008-10-17 17:24:14 +0000 | [diff] [blame] | 546 | // FIXME: Property assignments are lvalues, but not really "locations". |
| 547 | // e.g.: self.x = something; |
| 548 | // Here the "self.x" really can translate to a method call (setter) when |
| 549 | // the assignment is made. Moreover, the entire assignment expression |
| 550 | // evaluate to whatever "something" is, not calling the "getter" for |
| 551 | // the property (which would make sense since it can have side effects). |
| 552 | // We'll probably treat this as a location, but not one that we can |
| 553 | // take the address of. Perhaps we need a new SVal class for cases |
| 554 | // like thsis? |
| 555 | // Note that we have a similar problem for bitfields, since they don't |
| 556 | // have "locations" in the sense that we can take their address. |
| 557 | Dst.Add(Pred); |
Ted Kremenek | c7df6d2 | 2008-10-18 04:08:49 +0000 | [diff] [blame] | 558 | return; |
Zhongxing Xu | 143bf82 | 2008-10-25 14:18:57 +0000 | [diff] [blame] | 559 | |
| 560 | case Stmt::StringLiteralClass: { |
Ted Kremenek | a8538d9 | 2009-02-13 01:45:31 +0000 | [diff] [blame] | 561 | const GRState* state = GetState(Pred); |
Ted Kremenek | 3ff1259 | 2009-06-19 17:10:32 +0000 | [diff] [blame] | 562 | SVal V = state->getLValue(cast<StringLiteral>(Ex)); |
Ted Kremenek | 8e02934 | 2009-08-27 22:17:37 +0000 | [diff] [blame] | 563 | MakeNode(Dst, Ex, Pred, state->BindExpr(Ex, V)); |
Zhongxing Xu | 143bf82 | 2008-10-25 14:18:57 +0000 | [diff] [blame] | 564 | return; |
| 565 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 566 | |
Ted Kremenek | f8cd1b2 | 2008-10-18 04:15:35 +0000 | [diff] [blame] | 567 | default: |
| 568 | // Arbitrary subexpressions can return aggregate temporaries that |
| 569 | // can be used in a lvalue context. We need to enhance our support |
| 570 | // of such temporaries in both the environment and the store, so right |
| 571 | // now we just do a regular visit. |
Douglas Gregor | d7eb846 | 2009-01-30 17:31:00 +0000 | [diff] [blame] | 572 | assert ((Ex->getType()->isAggregateType()) && |
Ted Kremenek | 5b2316a | 2008-10-25 20:09:21 +0000 | [diff] [blame] | 573 | "Other kinds of expressions with non-aggregate/union types do" |
| 574 | " not have lvalues."); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 575 | |
Ted Kremenek | f8cd1b2 | 2008-10-18 04:15:35 +0000 | [diff] [blame] | 576 | Visit(Ex, Pred, Dst); |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 577 | } |
| 578 | } |
| 579 | |
| 580 | //===----------------------------------------------------------------------===// |
| 581 | // Block entrance. (Update counters). |
| 582 | //===----------------------------------------------------------------------===// |
| 583 | |
Ted Kremenek | 4adc81e | 2008-08-13 04:27:00 +0000 | [diff] [blame] | 584 | bool GRExprEngine::ProcessBlockEntrance(CFGBlock* B, const GRState*, |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 585 | GRBlockCounter BC) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 586 | |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 587 | return BC.getNumVisited(B->getBlockID()) < 3; |
| 588 | } |
| 589 | |
| 590 | //===----------------------------------------------------------------------===// |
Ted Kremenek | 1670e40 | 2009-04-11 00:11:10 +0000 | [diff] [blame] | 591 | // Generic node creation. |
| 592 | //===----------------------------------------------------------------------===// |
| 593 | |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 594 | ExplodedNode* GRExprEngine::MakeNode(ExplodedNodeSet& Dst, Stmt* S, |
| 595 | ExplodedNode* Pred, const GRState* St, |
| 596 | ProgramPoint::Kind K, const void *tag) { |
Ted Kremenek | 1670e40 | 2009-04-11 00:11:10 +0000 | [diff] [blame] | 597 | assert (Builder && "GRStmtNodeBuilder not present."); |
| 598 | SaveAndRestore<const void*> OldTag(Builder->Tag); |
| 599 | Builder->Tag = tag; |
| 600 | return Builder->MakeNode(Dst, S, Pred, St, K); |
| 601 | } |
| 602 | |
| 603 | //===----------------------------------------------------------------------===// |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 604 | // Branch processing. |
| 605 | //===----------------------------------------------------------------------===// |
| 606 | |
Ted Kremenek | a8538d9 | 2009-02-13 01:45:31 +0000 | [diff] [blame] | 607 | const GRState* GRExprEngine::MarkBranch(const GRState* state, |
Ted Kremenek | 4323a57 | 2008-07-10 22:03:41 +0000 | [diff] [blame] | 608 | Stmt* Terminator, |
| 609 | bool branchTaken) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 610 | |
Ted Kremenek | 05a2378 | 2008-02-26 19:05:15 +0000 | [diff] [blame] | 611 | switch (Terminator->getStmtClass()) { |
| 612 | default: |
Ted Kremenek | a8538d9 | 2009-02-13 01:45:31 +0000 | [diff] [blame] | 613 | return state; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 614 | |
Ted Kremenek | 05a2378 | 2008-02-26 19:05:15 +0000 | [diff] [blame] | 615 | case Stmt::BinaryOperatorClass: { // '&&' and '||' |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 616 | |
Ted Kremenek | 05a2378 | 2008-02-26 19:05:15 +0000 | [diff] [blame] | 617 | BinaryOperator* B = cast<BinaryOperator>(Terminator); |
| 618 | BinaryOperator::Opcode Op = B->getOpcode(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 619 | |
Ted Kremenek | 05a2378 | 2008-02-26 19:05:15 +0000 | [diff] [blame] | 620 | assert (Op == BinaryOperator::LAnd || Op == BinaryOperator::LOr); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 621 | |
Ted Kremenek | 05a2378 | 2008-02-26 19:05:15 +0000 | [diff] [blame] | 622 | // For &&, if we take the true branch, then the value of the whole |
| 623 | // expression is that of the RHS expression. |
| 624 | // |
| 625 | // For ||, if we take the false branch, then the value of the whole |
| 626 | // expression is that of the RHS expression. |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 627 | |
Ted Kremenek | 05a2378 | 2008-02-26 19:05:15 +0000 | [diff] [blame] | 628 | Expr* Ex = (Op == BinaryOperator::LAnd && branchTaken) || |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 629 | (Op == BinaryOperator::LOr && !branchTaken) |
Ted Kremenek | 05a2378 | 2008-02-26 19:05:15 +0000 | [diff] [blame] | 630 | ? B->getRHS() : B->getLHS(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 631 | |
Ted Kremenek | 8e02934 | 2009-08-27 22:17:37 +0000 | [diff] [blame] | 632 | return state->BindExpr(B, UndefinedVal(Ex)); |
Ted Kremenek | 05a2378 | 2008-02-26 19:05:15 +0000 | [diff] [blame] | 633 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 634 | |
Ted Kremenek | 05a2378 | 2008-02-26 19:05:15 +0000 | [diff] [blame] | 635 | case Stmt::ConditionalOperatorClass: { // ?: |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 636 | |
Ted Kremenek | 05a2378 | 2008-02-26 19:05:15 +0000 | [diff] [blame] | 637 | ConditionalOperator* C = cast<ConditionalOperator>(Terminator); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 638 | |
Ted Kremenek | 05a2378 | 2008-02-26 19:05:15 +0000 | [diff] [blame] | 639 | // For ?, if branchTaken == true then the value is either the LHS or |
| 640 | // the condition itself. (GNU extension). |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 641 | |
| 642 | Expr* Ex; |
| 643 | |
Ted Kremenek | 05a2378 | 2008-02-26 19:05:15 +0000 | [diff] [blame] | 644 | if (branchTaken) |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 645 | Ex = C->getLHS() ? C->getLHS() : C->getCond(); |
Ted Kremenek | 05a2378 | 2008-02-26 19:05:15 +0000 | [diff] [blame] | 646 | else |
| 647 | Ex = C->getRHS(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 648 | |
Ted Kremenek | 8e02934 | 2009-08-27 22:17:37 +0000 | [diff] [blame] | 649 | return state->BindExpr(C, UndefinedVal(Ex)); |
Ted Kremenek | 05a2378 | 2008-02-26 19:05:15 +0000 | [diff] [blame] | 650 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 651 | |
Ted Kremenek | 05a2378 | 2008-02-26 19:05:15 +0000 | [diff] [blame] | 652 | case Stmt::ChooseExprClass: { // ?: |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 653 | |
Ted Kremenek | 05a2378 | 2008-02-26 19:05:15 +0000 | [diff] [blame] | 654 | ChooseExpr* C = cast<ChooseExpr>(Terminator); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 655 | |
| 656 | Expr* Ex = branchTaken ? C->getLHS() : C->getRHS(); |
Ted Kremenek | 8e02934 | 2009-08-27 22:17:37 +0000 | [diff] [blame] | 657 | return state->BindExpr(C, UndefinedVal(Ex)); |
Ted Kremenek | 05a2378 | 2008-02-26 19:05:15 +0000 | [diff] [blame] | 658 | } |
| 659 | } |
| 660 | } |
| 661 | |
Ted Kremenek | 6ae8a36 | 2009-03-13 16:32:54 +0000 | [diff] [blame] | 662 | /// RecoverCastedSymbol - A helper function for ProcessBranch that is used |
| 663 | /// to try to recover some path-sensitivity for casts of symbolic |
| 664 | /// integers that promote their values (which are currently not tracked well). |
| 665 | /// This function returns the SVal bound to Condition->IgnoreCasts if all the |
| 666 | // cast(s) did was sign-extend the original value. |
| 667 | static SVal RecoverCastedSymbol(GRStateManager& StateMgr, const GRState* state, |
| 668 | Stmt* Condition, ASTContext& Ctx) { |
| 669 | |
| 670 | Expr *Ex = dyn_cast<Expr>(Condition); |
| 671 | if (!Ex) |
| 672 | return UnknownVal(); |
| 673 | |
| 674 | uint64_t bits = 0; |
| 675 | bool bitsInit = false; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 676 | |
Ted Kremenek | 6ae8a36 | 2009-03-13 16:32:54 +0000 | [diff] [blame] | 677 | while (CastExpr *CE = dyn_cast<CastExpr>(Ex)) { |
| 678 | QualType T = CE->getType(); |
| 679 | |
| 680 | if (!T->isIntegerType()) |
| 681 | return UnknownVal(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 682 | |
Ted Kremenek | 6ae8a36 | 2009-03-13 16:32:54 +0000 | [diff] [blame] | 683 | uint64_t newBits = Ctx.getTypeSize(T); |
| 684 | if (!bitsInit || newBits < bits) { |
| 685 | bitsInit = true; |
| 686 | bits = newBits; |
| 687 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 688 | |
Ted Kremenek | 6ae8a36 | 2009-03-13 16:32:54 +0000 | [diff] [blame] | 689 | Ex = CE->getSubExpr(); |
| 690 | } |
| 691 | |
| 692 | // We reached a non-cast. Is it a symbolic value? |
| 693 | QualType T = Ex->getType(); |
| 694 | |
| 695 | if (!bitsInit || !T->isIntegerType() || Ctx.getTypeSize(T) > bits) |
| 696 | return UnknownVal(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 697 | |
Ted Kremenek | 23ec48c | 2009-06-18 23:58:37 +0000 | [diff] [blame] | 698 | return state->getSVal(Ex); |
Ted Kremenek | 6ae8a36 | 2009-03-13 16:32:54 +0000 | [diff] [blame] | 699 | } |
| 700 | |
Ted Kremenek | af33741 | 2008-11-12 19:24:17 +0000 | [diff] [blame] | 701 | void GRExprEngine::ProcessBranch(Stmt* Condition, Stmt* Term, |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 702 | GRBranchNodeBuilder& builder) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 703 | |
Ted Kremenek | b233183 | 2008-02-15 22:29:00 +0000 | [diff] [blame] | 704 | // Check for NULL conditions; e.g. "for(;;)" |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 705 | if (!Condition) { |
Ted Kremenek | b233183 | 2008-02-15 22:29:00 +0000 | [diff] [blame] | 706 | builder.markInfeasible(false); |
Ted Kremenek | b233183 | 2008-02-15 22:29:00 +0000 | [diff] [blame] | 707 | return; |
| 708 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 709 | |
Ted Kremenek | 21028dd | 2009-03-11 03:54:24 +0000 | [diff] [blame] | 710 | PrettyStackTraceLoc CrashInfo(getContext().getSourceManager(), |
| 711 | Condition->getLocStart(), |
| 712 | "Error evaluating branch"); |
Ted Kremenek | 0fb0bc4 | 2009-08-27 01:39:13 +0000 | [diff] [blame] | 713 | |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 714 | const GRState* PrevState = builder.getState(); |
Ted Kremenek | 5b9bd21 | 2009-09-11 22:07:28 +0000 | [diff] [blame] | 715 | SVal X = PrevState->getSVal(Condition); |
| 716 | DefinedSVal *V = NULL; |
| 717 | |
| 718 | while (true) { |
| 719 | V = dyn_cast<DefinedSVal>(&X); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 720 | |
Ted Kremenek | 5b9bd21 | 2009-09-11 22:07:28 +0000 | [diff] [blame] | 721 | if (!V) { |
| 722 | if (X.isUnknown()) { |
| 723 | if (const Expr *Ex = dyn_cast<Expr>(Condition)) { |
Ted Kremenek | 6ae8a36 | 2009-03-13 16:32:54 +0000 | [diff] [blame] | 724 | if (Ex->getType()->isIntegerType()) { |
Ted Kremenek | 5b9bd21 | 2009-09-11 22:07:28 +0000 | [diff] [blame] | 725 | // Try to recover some path-sensitivity. Right now casts of symbolic |
| 726 | // integers that promote their values are currently not tracked well. |
| 727 | // If 'Condition' is such an expression, try and recover the |
| 728 | // underlying value and use that instead. |
| 729 | SVal recovered = RecoverCastedSymbol(getStateManager(), |
| 730 | builder.getState(), Condition, |
| 731 | getContext()); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 732 | |
Ted Kremenek | 5b9bd21 | 2009-09-11 22:07:28 +0000 | [diff] [blame] | 733 | if (!recovered.isUnknown()) { |
| 734 | X = recovered; |
| 735 | continue; |
| 736 | } |
Ted Kremenek | 6ae8a36 | 2009-03-13 16:32:54 +0000 | [diff] [blame] | 737 | } |
Ted Kremenek | 5b9bd21 | 2009-09-11 22:07:28 +0000 | [diff] [blame] | 738 | } |
| 739 | |
| 740 | builder.generateNode(MarkBranch(PrevState, Term, true), true); |
| 741 | builder.generateNode(MarkBranch(PrevState, Term, false), false); |
| 742 | return; |
Ted Kremenek | 6ae8a36 | 2009-03-13 16:32:54 +0000 | [diff] [blame] | 743 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 744 | |
Ted Kremenek | 5b9bd21 | 2009-09-11 22:07:28 +0000 | [diff] [blame] | 745 | assert(X.isUndef()); |
| 746 | ExplodedNode *N = builder.generateNode(PrevState, true); |
Ted Kremenek | b38911f | 2008-01-30 23:03:39 +0000 | [diff] [blame] | 747 | |
| 748 | if (N) { |
| 749 | N->markAsSink(); |
Ted Kremenek | 4a4e524 | 2008-02-28 09:25:22 +0000 | [diff] [blame] | 750 | UndefBranches.insert(N); |
Ted Kremenek | b38911f | 2008-01-30 23:03:39 +0000 | [diff] [blame] | 751 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 752 | |
Ted Kremenek | b38911f | 2008-01-30 23:03:39 +0000 | [diff] [blame] | 753 | builder.markInfeasible(false); |
| 754 | return; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 755 | } |
Ted Kremenek | 5b9bd21 | 2009-09-11 22:07:28 +0000 | [diff] [blame] | 756 | |
| 757 | break; |
Ted Kremenek | b38911f | 2008-01-30 23:03:39 +0000 | [diff] [blame] | 758 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 759 | |
Ted Kremenek | 6a6719a | 2008-02-29 20:27:50 +0000 | [diff] [blame] | 760 | // Process the true branch. |
Ted Kremenek | 5200354 | 2009-07-20 18:44:36 +0000 | [diff] [blame] | 761 | if (builder.isFeasible(true)) { |
Ted Kremenek | 5b9bd21 | 2009-09-11 22:07:28 +0000 | [diff] [blame] | 762 | if (const GRState *state = PrevState->Assume(*V, true)) |
Ted Kremenek | 5200354 | 2009-07-20 18:44:36 +0000 | [diff] [blame] | 763 | builder.generateNode(MarkBranch(state, Term, true), true); |
| 764 | else |
| 765 | builder.markInfeasible(true); |
| 766 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 767 | |
| 768 | // Process the false branch. |
Ted Kremenek | 5200354 | 2009-07-20 18:44:36 +0000 | [diff] [blame] | 769 | if (builder.isFeasible(false)) { |
Ted Kremenek | 5b9bd21 | 2009-09-11 22:07:28 +0000 | [diff] [blame] | 770 | if (const GRState *state = PrevState->Assume(*V, false)) |
Ted Kremenek | 5200354 | 2009-07-20 18:44:36 +0000 | [diff] [blame] | 771 | builder.generateNode(MarkBranch(state, Term, false), false); |
| 772 | else |
| 773 | builder.markInfeasible(false); |
| 774 | } |
Ted Kremenek | 71c29bd | 2008-01-29 23:32:35 +0000 | [diff] [blame] | 775 | } |
| 776 | |
Ted Kremenek | 4d4dd85 | 2008-02-13 17:41:41 +0000 | [diff] [blame] | 777 | /// ProcessIndirectGoto - Called by GRCoreEngine. Used to generate successor |
Ted Kremenek | 754607e | 2008-02-13 00:24:44 +0000 | [diff] [blame] | 778 | /// nodes by processing the 'effects' of a computed goto jump. |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 779 | void GRExprEngine::ProcessIndirectGoto(GRIndirectGotoNodeBuilder& builder) { |
Ted Kremenek | 754607e | 2008-02-13 00:24:44 +0000 | [diff] [blame] | 780 | |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 781 | const GRState *state = builder.getState(); |
Ted Kremenek | 3ff1259 | 2009-06-19 17:10:32 +0000 | [diff] [blame] | 782 | SVal V = state->getSVal(builder.getTarget()); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 783 | |
Ted Kremenek | 754607e | 2008-02-13 00:24:44 +0000 | [diff] [blame] | 784 | // Three possibilities: |
| 785 | // |
| 786 | // (1) We know the computed label. |
Ted Kremenek | 4a4e524 | 2008-02-28 09:25:22 +0000 | [diff] [blame] | 787 | // (2) The label is NULL (or some other constant), or Undefined. |
Ted Kremenek | 754607e | 2008-02-13 00:24:44 +0000 | [diff] [blame] | 788 | // (3) We have no clue about the label. Dispatch to all targets. |
| 789 | // |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 790 | |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 791 | typedef GRIndirectGotoNodeBuilder::iterator iterator; |
Ted Kremenek | 754607e | 2008-02-13 00:24:44 +0000 | [diff] [blame] | 792 | |
Zhongxing Xu | 1c96b24 | 2008-10-17 05:57:07 +0000 | [diff] [blame] | 793 | if (isa<loc::GotoLabel>(V)) { |
| 794 | LabelStmt* L = cast<loc::GotoLabel>(V).getLabel(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 795 | |
Ted Kremenek | 754607e | 2008-02-13 00:24:44 +0000 | [diff] [blame] | 796 | for (iterator I=builder.begin(), E=builder.end(); I != E; ++I) { |
Ted Kremenek | 24f1a96 | 2008-02-13 17:27:37 +0000 | [diff] [blame] | 797 | if (I.getLabel() == L) { |
Ted Kremenek | a8538d9 | 2009-02-13 01:45:31 +0000 | [diff] [blame] | 798 | builder.generateNode(I, state); |
Ted Kremenek | 754607e | 2008-02-13 00:24:44 +0000 | [diff] [blame] | 799 | return; |
| 800 | } |
| 801 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 802 | |
Ted Kremenek | 754607e | 2008-02-13 00:24:44 +0000 | [diff] [blame] | 803 | assert (false && "No block with label."); |
| 804 | return; |
| 805 | } |
| 806 | |
Zhongxing Xu | 1c96b24 | 2008-10-17 05:57:07 +0000 | [diff] [blame] | 807 | if (isa<loc::ConcreteInt>(V) || isa<UndefinedVal>(V)) { |
Ted Kremenek | 754607e | 2008-02-13 00:24:44 +0000 | [diff] [blame] | 808 | // Dispatch to the first target and mark it as a sink. |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 809 | ExplodedNode* N = builder.generateNode(builder.begin(), state, true); |
Ted Kremenek | 4a4e524 | 2008-02-28 09:25:22 +0000 | [diff] [blame] | 810 | UndefBranches.insert(N); |
Ted Kremenek | 754607e | 2008-02-13 00:24:44 +0000 | [diff] [blame] | 811 | return; |
| 812 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 813 | |
Ted Kremenek | 754607e | 2008-02-13 00:24:44 +0000 | [diff] [blame] | 814 | // This is really a catch-all. We don't support symbolics yet. |
Ted Kremenek | b3cfd58 | 2009-04-23 17:49:43 +0000 | [diff] [blame] | 815 | // FIXME: Implement dispatch for symbolic pointers. |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 816 | |
Ted Kremenek | 754607e | 2008-02-13 00:24:44 +0000 | [diff] [blame] | 817 | for (iterator I=builder.begin(), E=builder.end(); I != E; ++I) |
Ted Kremenek | a8538d9 | 2009-02-13 01:45:31 +0000 | [diff] [blame] | 818 | builder.generateNode(I, state); |
Ted Kremenek | 754607e | 2008-02-13 00:24:44 +0000 | [diff] [blame] | 819 | } |
Ted Kremenek | f233d48 | 2008-02-05 00:26:40 +0000 | [diff] [blame] | 820 | |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 821 | |
| 822 | void GRExprEngine::VisitGuardedExpr(Expr* Ex, Expr* L, Expr* R, |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 823 | ExplodedNode* Pred, ExplodedNodeSet& Dst) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 824 | |
Zhongxing Xu | cc02553 | 2009-08-25 03:33:41 +0000 | [diff] [blame] | 825 | assert (Ex == CurrentStmt && Pred->getLocationContext()->getCFG()->isBlkExpr(Ex)); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 826 | |
Ted Kremenek | a8538d9 | 2009-02-13 01:45:31 +0000 | [diff] [blame] | 827 | const GRState* state = GetState(Pred); |
Ted Kremenek | 0fb0bc4 | 2009-08-27 01:39:13 +0000 | [diff] [blame] | 828 | SVal X = state->getSVal(Ex); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 829 | |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 830 | assert (X.isUndef()); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 831 | |
Ted Kremenek | 3ff1259 | 2009-06-19 17:10:32 +0000 | [diff] [blame] | 832 | Expr *SE = (Expr*) cast<UndefinedVal>(X).getData(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 833 | assert(SE); |
Ted Kremenek | 0fb0bc4 | 2009-08-27 01:39:13 +0000 | [diff] [blame] | 834 | X = state->getSVal(SE); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 835 | |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 836 | // Make sure that we invalidate the previous binding. |
Ted Kremenek | 8e02934 | 2009-08-27 22:17:37 +0000 | [diff] [blame] | 837 | MakeNode(Dst, Ex, Pred, state->BindExpr(Ex, X, true)); |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 838 | } |
| 839 | |
Ted Kremenek | daeb9a7 | 2008-02-13 23:08:21 +0000 | [diff] [blame] | 840 | /// ProcessSwitch - Called by GRCoreEngine. Used to generate successor |
| 841 | /// nodes by processing the 'effects' of a switch statement. |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 842 | void GRExprEngine::ProcessSwitch(GRSwitchNodeBuilder& builder) { |
| 843 | typedef GRSwitchNodeBuilder::iterator iterator; |
| 844 | const GRState* state = builder.getState(); |
Ted Kremenek | 692416c | 2008-02-18 22:57:02 +0000 | [diff] [blame] | 845 | Expr* CondE = builder.getCondition(); |
Ted Kremenek | 5b9bd21 | 2009-09-11 22:07:28 +0000 | [diff] [blame] | 846 | SVal CondV_untested = state->getSVal(CondE); |
Ted Kremenek | daeb9a7 | 2008-02-13 23:08:21 +0000 | [diff] [blame] | 847 | |
Ted Kremenek | 5b9bd21 | 2009-09-11 22:07:28 +0000 | [diff] [blame] | 848 | if (CondV_untested.isUndef()) { |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 849 | ExplodedNode* N = builder.generateDefaultCaseNode(state, true); |
Ted Kremenek | 4a4e524 | 2008-02-28 09:25:22 +0000 | [diff] [blame] | 850 | UndefBranches.insert(N); |
Ted Kremenek | daeb9a7 | 2008-02-13 23:08:21 +0000 | [diff] [blame] | 851 | return; |
| 852 | } |
Ted Kremenek | 5b9bd21 | 2009-09-11 22:07:28 +0000 | [diff] [blame] | 853 | DefinedOrUnknownSVal CondV = cast<DefinedOrUnknownSVal>(CondV_untested); |
Ted Kremenek | 692416c | 2008-02-18 22:57:02 +0000 | [diff] [blame] | 854 | |
Ted Kremenek | 5b9bd21 | 2009-09-11 22:07:28 +0000 | [diff] [blame] | 855 | const GRState *DefaultSt = state; |
Ted Kremenek | a591bc0 | 2009-06-18 22:57:13 +0000 | [diff] [blame] | 856 | bool defaultIsFeasible = false; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 857 | |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 858 | for (iterator I = builder.begin(), EI = builder.end(); I != EI; ++I) { |
Ted Kremenek | daeb9a7 | 2008-02-13 23:08:21 +0000 | [diff] [blame] | 859 | CaseStmt* Case = cast<CaseStmt>(I.getCase()); |
Ted Kremenek | 72afb37 | 2009-01-17 01:54:16 +0000 | [diff] [blame] | 860 | |
| 861 | // Evaluate the LHS of the case value. |
| 862 | Expr::EvalResult V1; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 863 | bool b = Case->getLHS()->Evaluate(V1, getContext()); |
| 864 | |
Ted Kremenek | 72afb37 | 2009-01-17 01:54:16 +0000 | [diff] [blame] | 865 | // Sanity checks. These go away in Release builds. |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 866 | assert(b && V1.Val.isInt() && !V1.HasSideEffects |
Ted Kremenek | 72afb37 | 2009-01-17 01:54:16 +0000 | [diff] [blame] | 867 | && "Case condition must evaluate to an integer constant."); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 868 | b = b; // silence unused variable warning |
| 869 | assert(V1.Val.getInt().getBitWidth() == |
Ted Kremenek | 72afb37 | 2009-01-17 01:54:16 +0000 | [diff] [blame] | 870 | getContext().getTypeSize(CondE->getType())); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 871 | |
Ted Kremenek | daeb9a7 | 2008-02-13 23:08:21 +0000 | [diff] [blame] | 872 | // Get the RHS of the case, if it exists. |
Ted Kremenek | 72afb37 | 2009-01-17 01:54:16 +0000 | [diff] [blame] | 873 | Expr::EvalResult V2; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 874 | |
Ted Kremenek | daeb9a7 | 2008-02-13 23:08:21 +0000 | [diff] [blame] | 875 | if (Expr* E = Case->getRHS()) { |
Ted Kremenek | 72afb37 | 2009-01-17 01:54:16 +0000 | [diff] [blame] | 876 | b = E->Evaluate(V2, getContext()); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 877 | assert(b && V2.Val.isInt() && !V2.HasSideEffects |
Ted Kremenek | 72afb37 | 2009-01-17 01:54:16 +0000 | [diff] [blame] | 878 | && "Case condition must evaluate to an integer constant."); |
| 879 | b = b; // silence unused variable warning |
Ted Kremenek | daeb9a7 | 2008-02-13 23:08:21 +0000 | [diff] [blame] | 880 | } |
Ted Kremenek | 14a1140 | 2008-03-17 22:17:56 +0000 | [diff] [blame] | 881 | else |
| 882 | V2 = V1; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 883 | |
Ted Kremenek | daeb9a7 | 2008-02-13 23:08:21 +0000 | [diff] [blame] | 884 | // FIXME: Eventually we should replace the logic below with a range |
| 885 | // comparison, rather than concretize the values within the range. |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 886 | // This should be easy once we have "ranges" for NonLVals. |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 887 | |
Ted Kremenek | 14a1140 | 2008-03-17 22:17:56 +0000 | [diff] [blame] | 888 | do { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 889 | nonloc::ConcreteInt CaseVal(getBasicVals().getValue(V1.Val.getInt())); |
Ted Kremenek | 5b9bd21 | 2009-09-11 22:07:28 +0000 | [diff] [blame] | 890 | DefinedOrUnknownSVal Res = SVator.EvalEQ(DefaultSt, CondV, CaseVal); |
| 891 | |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 892 | // Now "assume" that the case matches. |
Ted Kremenek | 5b9bd21 | 2009-09-11 22:07:28 +0000 | [diff] [blame] | 893 | if (const GRState* stateNew = state->Assume(Res, true)) { |
Ted Kremenek | a591bc0 | 2009-06-18 22:57:13 +0000 | [diff] [blame] | 894 | builder.generateCaseStmtNode(I, stateNew); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 895 | |
Ted Kremenek | daeb9a7 | 2008-02-13 23:08:21 +0000 | [diff] [blame] | 896 | // If CondV evaluates to a constant, then we know that this |
| 897 | // is the *only* case that we can take, so stop evaluating the |
| 898 | // others. |
Zhongxing Xu | 1c96b24 | 2008-10-17 05:57:07 +0000 | [diff] [blame] | 899 | if (isa<nonloc::ConcreteInt>(CondV)) |
Ted Kremenek | daeb9a7 | 2008-02-13 23:08:21 +0000 | [diff] [blame] | 900 | return; |
| 901 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 902 | |
Ted Kremenek | daeb9a7 | 2008-02-13 23:08:21 +0000 | [diff] [blame] | 903 | // Now "assume" that the case doesn't match. Add this state |
| 904 | // to the default state (if it is feasible). |
Ted Kremenek | 5b9bd21 | 2009-09-11 22:07:28 +0000 | [diff] [blame] | 905 | if (const GRState *stateNew = DefaultSt->Assume(Res, false)) { |
Ted Kremenek | a591bc0 | 2009-06-18 22:57:13 +0000 | [diff] [blame] | 906 | defaultIsFeasible = true; |
| 907 | DefaultSt = stateNew; |
Ted Kremenek | 5014ab1 | 2008-04-23 05:03:18 +0000 | [diff] [blame] | 908 | } |
Ted Kremenek | daeb9a7 | 2008-02-13 23:08:21 +0000 | [diff] [blame] | 909 | |
Ted Kremenek | 14a1140 | 2008-03-17 22:17:56 +0000 | [diff] [blame] | 910 | // Concretize the next value in the range. |
Ted Kremenek | 72afb37 | 2009-01-17 01:54:16 +0000 | [diff] [blame] | 911 | if (V1.Val.getInt() == V2.Val.getInt()) |
Ted Kremenek | 14a1140 | 2008-03-17 22:17:56 +0000 | [diff] [blame] | 912 | break; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 913 | |
Ted Kremenek | 72afb37 | 2009-01-17 01:54:16 +0000 | [diff] [blame] | 914 | ++V1.Val.getInt(); |
| 915 | assert (V1.Val.getInt() <= V2.Val.getInt()); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 916 | |
Ted Kremenek | 14a1140 | 2008-03-17 22:17:56 +0000 | [diff] [blame] | 917 | } while (true); |
Ted Kremenek | daeb9a7 | 2008-02-13 23:08:21 +0000 | [diff] [blame] | 918 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 919 | |
Ted Kremenek | daeb9a7 | 2008-02-13 23:08:21 +0000 | [diff] [blame] | 920 | // If we reach here, than we know that the default branch is |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 921 | // possible. |
Ted Kremenek | a591bc0 | 2009-06-18 22:57:13 +0000 | [diff] [blame] | 922 | if (defaultIsFeasible) builder.generateDefaultCaseNode(DefaultSt); |
Ted Kremenek | daeb9a7 | 2008-02-13 23:08:21 +0000 | [diff] [blame] | 923 | } |
| 924 | |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 925 | //===----------------------------------------------------------------------===// |
| 926 | // Transfer functions: logical operations ('&&', '||'). |
| 927 | //===----------------------------------------------------------------------===// |
Ted Kremenek | daeb9a7 | 2008-02-13 23:08:21 +0000 | [diff] [blame] | 928 | |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 929 | void GRExprEngine::VisitLogicalExpr(BinaryOperator* B, ExplodedNode* Pred, |
| 930 | ExplodedNodeSet& Dst) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 931 | |
Ted Kremenek | 3ff1259 | 2009-06-19 17:10:32 +0000 | [diff] [blame] | 932 | assert(B->getOpcode() == BinaryOperator::LAnd || |
| 933 | B->getOpcode() == BinaryOperator::LOr); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 934 | |
Zhongxing Xu | cc02553 | 2009-08-25 03:33:41 +0000 | [diff] [blame] | 935 | assert(B == CurrentStmt && Pred->getLocationContext()->getCFG()->isBlkExpr(B)); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 936 | |
Ted Kremenek | a8538d9 | 2009-02-13 01:45:31 +0000 | [diff] [blame] | 937 | const GRState* state = GetState(Pred); |
Ted Kremenek | 0fb0bc4 | 2009-08-27 01:39:13 +0000 | [diff] [blame] | 938 | SVal X = state->getSVal(B); |
Ted Kremenek | 3ff1259 | 2009-06-19 17:10:32 +0000 | [diff] [blame] | 939 | assert(X.isUndef()); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 940 | |
Ted Kremenek | 5b9bd21 | 2009-09-11 22:07:28 +0000 | [diff] [blame] | 941 | const Expr *Ex = (const Expr*) cast<UndefinedVal>(X).getData(); |
Ted Kremenek | 3ff1259 | 2009-06-19 17:10:32 +0000 | [diff] [blame] | 942 | assert(Ex); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 943 | |
Ted Kremenek | 05a2378 | 2008-02-26 19:05:15 +0000 | [diff] [blame] | 944 | if (Ex == B->getRHS()) { |
Ted Kremenek | 0fb0bc4 | 2009-08-27 01:39:13 +0000 | [diff] [blame] | 945 | X = state->getSVal(Ex); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 946 | |
Ted Kremenek | 4a4e524 | 2008-02-28 09:25:22 +0000 | [diff] [blame] | 947 | // Handle undefined values. |
Ted Kremenek | 4a4e524 | 2008-02-28 09:25:22 +0000 | [diff] [blame] | 948 | if (X.isUndef()) { |
Ted Kremenek | 8e02934 | 2009-08-27 22:17:37 +0000 | [diff] [blame] | 949 | MakeNode(Dst, B, Pred, state->BindExpr(B, X)); |
Ted Kremenek | 58b3321 | 2008-02-26 19:40:44 +0000 | [diff] [blame] | 950 | return; |
| 951 | } |
Ted Kremenek | 5b9bd21 | 2009-09-11 22:07:28 +0000 | [diff] [blame] | 952 | |
| 953 | DefinedOrUnknownSVal XD = cast<DefinedOrUnknownSVal>(X); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 954 | |
Ted Kremenek | 05a2378 | 2008-02-26 19:05:15 +0000 | [diff] [blame] | 955 | // We took the RHS. Because the value of the '&&' or '||' expression must |
| 956 | // evaluate to 0 or 1, we must assume the value of the RHS evaluates to 0 |
| 957 | // or 1. Alternatively, we could take a lazy approach, and calculate this |
| 958 | // value later when necessary. We don't have the machinery in place for |
| 959 | // this right now, and since most logical expressions are used for branches, |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 960 | // the payoff is not likely to be large. Instead, we do eager evaluation. |
Ted Kremenek | 5b9bd21 | 2009-09-11 22:07:28 +0000 | [diff] [blame] | 961 | if (const GRState *newState = state->Assume(XD, true)) |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 962 | MakeNode(Dst, B, Pred, |
Ted Kremenek | 8e02934 | 2009-08-27 22:17:37 +0000 | [diff] [blame] | 963 | newState->BindExpr(B, ValMgr.makeIntVal(1U, B->getType()))); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 964 | |
Ted Kremenek | 5b9bd21 | 2009-09-11 22:07:28 +0000 | [diff] [blame] | 965 | if (const GRState *newState = state->Assume(XD, false)) |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 966 | MakeNode(Dst, B, Pred, |
Ted Kremenek | 8e02934 | 2009-08-27 22:17:37 +0000 | [diff] [blame] | 967 | newState->BindExpr(B, ValMgr.makeIntVal(0U, B->getType()))); |
Ted Kremenek | f233d48 | 2008-02-05 00:26:40 +0000 | [diff] [blame] | 968 | } |
| 969 | else { |
Ted Kremenek | 05a2378 | 2008-02-26 19:05:15 +0000 | [diff] [blame] | 970 | // We took the LHS expression. Depending on whether we are '&&' or |
| 971 | // '||' we know what the value of the expression is via properties of |
| 972 | // the short-circuiting. |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 973 | X = ValMgr.makeIntVal(B->getOpcode() == BinaryOperator::LAnd ? 0U : 1U, |
Zhongxing Xu | d91ee27 | 2009-06-23 09:02:15 +0000 | [diff] [blame] | 974 | B->getType()); |
Ted Kremenek | 8e02934 | 2009-08-27 22:17:37 +0000 | [diff] [blame] | 975 | MakeNode(Dst, B, Pred, state->BindExpr(B, X)); |
Ted Kremenek | f233d48 | 2008-02-05 00:26:40 +0000 | [diff] [blame] | 976 | } |
Ted Kremenek | f233d48 | 2008-02-05 00:26:40 +0000 | [diff] [blame] | 977 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 978 | |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 979 | //===----------------------------------------------------------------------===// |
Ted Kremenek | ec96a2d | 2008-04-16 18:39:06 +0000 | [diff] [blame] | 980 | // Transfer functions: Loads and stores. |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 981 | //===----------------------------------------------------------------------===// |
Ted Kremenek | d27f816 | 2008-01-15 23:55:06 +0000 | [diff] [blame] | 982 | |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 983 | void GRExprEngine::VisitDeclRefExpr(DeclRefExpr *Ex, ExplodedNode *Pred, |
Ted Kremenek | d17da2b | 2009-08-21 22:28:32 +0000 | [diff] [blame] | 984 | ExplodedNodeSet &Dst, bool asLValue) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 985 | |
Ted Kremenek | 5b9bd21 | 2009-09-11 22:07:28 +0000 | [diff] [blame] | 986 | const GRState *state = GetState(Pred); |
| 987 | const NamedDecl *D = Ex->getDecl(); |
Zhongxing Xu | 6d69b5d | 2008-10-16 06:09:51 +0000 | [diff] [blame] | 988 | |
| 989 | if (const VarDecl* VD = dyn_cast<VarDecl>(D)) { |
| 990 | |
Ted Kremenek | d17da2b | 2009-08-21 22:28:32 +0000 | [diff] [blame] | 991 | SVal V = state->getLValue(VD, Pred->getLocationContext()); |
Zhongxing Xu | a758173 | 2008-10-17 02:20:14 +0000 | [diff] [blame] | 992 | |
Zhongxing Xu | 6d69b5d | 2008-10-16 06:09:51 +0000 | [diff] [blame] | 993 | if (asLValue) |
Ted Kremenek | 8e02934 | 2009-08-27 22:17:37 +0000 | [diff] [blame] | 994 | MakeNode(Dst, Ex, Pred, state->BindExpr(Ex, V), |
Ted Kremenek | 7090d54 | 2009-05-07 18:27:16 +0000 | [diff] [blame] | 995 | ProgramPoint::PostLValueKind); |
Zhongxing Xu | 6d69b5d | 2008-10-16 06:09:51 +0000 | [diff] [blame] | 996 | else |
Ted Kremenek | a8538d9 | 2009-02-13 01:45:31 +0000 | [diff] [blame] | 997 | EvalLoad(Dst, Ex, Pred, state, V); |
Zhongxing Xu | 6d69b5d | 2008-10-16 06:09:51 +0000 | [diff] [blame] | 998 | return; |
| 999 | |
| 1000 | } else if (const EnumConstantDecl* ED = dyn_cast<EnumConstantDecl>(D)) { |
| 1001 | assert(!asLValue && "EnumConstantDecl does not have lvalue."); |
| 1002 | |
Zhongxing Xu | 3038c5a | 2009-06-23 06:13:19 +0000 | [diff] [blame] | 1003 | SVal V = ValMgr.makeIntVal(ED->getInitVal()); |
Ted Kremenek | 8e02934 | 2009-08-27 22:17:37 +0000 | [diff] [blame] | 1004 | MakeNode(Dst, Ex, Pred, state->BindExpr(Ex, V)); |
Zhongxing Xu | 6d69b5d | 2008-10-16 06:09:51 +0000 | [diff] [blame] | 1005 | return; |
| 1006 | |
| 1007 | } else if (const FunctionDecl* FD = dyn_cast<FunctionDecl>(D)) { |
Ted Kremenek | 657406d | 2009-09-23 01:30:01 +0000 | [diff] [blame] | 1008 | // This code is valid regardless of the value of 'isLValue'. |
Zhongxing Xu | 369f447 | 2009-04-20 05:24:46 +0000 | [diff] [blame] | 1009 | SVal V = ValMgr.getFunctionPointer(FD); |
Ted Kremenek | 8e02934 | 2009-08-27 22:17:37 +0000 | [diff] [blame] | 1010 | MakeNode(Dst, Ex, Pred, state->BindExpr(Ex, V), |
Ted Kremenek | 7090d54 | 2009-05-07 18:27:16 +0000 | [diff] [blame] | 1011 | ProgramPoint::PostLValueKind); |
Zhongxing Xu | 6d69b5d | 2008-10-16 06:09:51 +0000 | [diff] [blame] | 1012 | return; |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 1013 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1014 | |
Zhongxing Xu | 6d69b5d | 2008-10-16 06:09:51 +0000 | [diff] [blame] | 1015 | assert (false && |
| 1016 | "ValueDecl support for this ValueDecl not implemented."); |
Ted Kremenek | 3271f8d | 2008-02-07 04:16:04 +0000 | [diff] [blame] | 1017 | } |
| 1018 | |
Ted Kremenek | 540cbe2 | 2008-04-22 04:56:29 +0000 | [diff] [blame] | 1019 | /// VisitArraySubscriptExpr - Transfer function for array accesses |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1020 | void GRExprEngine::VisitArraySubscriptExpr(ArraySubscriptExpr* A, |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 1021 | ExplodedNode* Pred, |
| 1022 | ExplodedNodeSet& Dst, bool asLValue){ |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1023 | |
Ted Kremenek | 540cbe2 | 2008-04-22 04:56:29 +0000 | [diff] [blame] | 1024 | Expr* Base = A->getBase()->IgnoreParens(); |
Ted Kremenek | 4d0348b | 2008-04-29 23:24:44 +0000 | [diff] [blame] | 1025 | Expr* Idx = A->getIdx()->IgnoreParens(); |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 1026 | ExplodedNodeSet Tmp; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1027 | |
Ted Kremenek | 265a305 | 2009-02-24 02:23:11 +0000 | [diff] [blame] | 1028 | if (Base->getType()->isVectorType()) { |
| 1029 | // For vector types get its lvalue. |
| 1030 | // FIXME: This may not be correct. Is the rvalue of a vector its location? |
| 1031 | // In fact, I think this is just a hack. We need to get the right |
| 1032 | // semantics. |
| 1033 | VisitLValue(Base, Pred, Tmp); |
| 1034 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1035 | else |
Ted Kremenek | 265a305 | 2009-02-24 02:23:11 +0000 | [diff] [blame] | 1036 | Visit(Base, Pred, Tmp); // Get Base's rvalue, which should be an LocVal. |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1037 | |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 1038 | for (ExplodedNodeSet::iterator I1=Tmp.begin(), E1=Tmp.end(); I1!=E1; ++I1) { |
| 1039 | ExplodedNodeSet Tmp2; |
Ted Kremenek | d9bc33e | 2008-10-17 00:51:01 +0000 | [diff] [blame] | 1040 | Visit(Idx, *I1, Tmp2); // Evaluate the index. |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1041 | |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 1042 | for (ExplodedNodeSet::iterator I2=Tmp2.begin(),E2=Tmp2.end();I2!=E2; ++I2) { |
Ted Kremenek | a8538d9 | 2009-02-13 01:45:31 +0000 | [diff] [blame] | 1043 | const GRState* state = GetState(*I2); |
Zhongxing Xu | d0f8bb1 | 2009-10-14 03:33:08 +0000 | [diff] [blame] | 1044 | SVal V = state->getLValue(A->getType(), state->getSVal(Idx), |
| 1045 | state->getSVal(Base)); |
Ted Kremenek | 4d0348b | 2008-04-29 23:24:44 +0000 | [diff] [blame] | 1046 | |
Zhongxing Xu | 6d69b5d | 2008-10-16 06:09:51 +0000 | [diff] [blame] | 1047 | if (asLValue) |
Ted Kremenek | 8e02934 | 2009-08-27 22:17:37 +0000 | [diff] [blame] | 1048 | MakeNode(Dst, A, *I2, state->BindExpr(A, V), |
Ted Kremenek | 7090d54 | 2009-05-07 18:27:16 +0000 | [diff] [blame] | 1049 | ProgramPoint::PostLValueKind); |
Ted Kremenek | 4d0348b | 2008-04-29 23:24:44 +0000 | [diff] [blame] | 1050 | else |
Ted Kremenek | a8538d9 | 2009-02-13 01:45:31 +0000 | [diff] [blame] | 1051 | EvalLoad(Dst, A, *I2, state, V); |
Ted Kremenek | 4d0348b | 2008-04-29 23:24:44 +0000 | [diff] [blame] | 1052 | } |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 1053 | } |
Ted Kremenek | 540cbe2 | 2008-04-22 04:56:29 +0000 | [diff] [blame] | 1054 | } |
| 1055 | |
Ted Kremenek | 469ecbd | 2008-04-21 23:43:38 +0000 | [diff] [blame] | 1056 | /// VisitMemberExpr - Transfer function for member expressions. |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 1057 | void GRExprEngine::VisitMemberExpr(MemberExpr* M, ExplodedNode* Pred, |
| 1058 | ExplodedNodeSet& Dst, bool asLValue) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1059 | |
Ted Kremenek | 469ecbd | 2008-04-21 23:43:38 +0000 | [diff] [blame] | 1060 | Expr* Base = M->getBase()->IgnoreParens(); |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 1061 | ExplodedNodeSet Tmp; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1062 | |
| 1063 | if (M->isArrow()) |
Ted Kremenek | 5c456fe | 2008-10-18 03:28:48 +0000 | [diff] [blame] | 1064 | Visit(Base, Pred, Tmp); // p->f = ... or ... = p->f |
| 1065 | else |
| 1066 | VisitLValue(Base, Pred, Tmp); // x.f = ... or ... = x.f |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1067 | |
Douglas Gregor | 86f1940 | 2008-12-20 23:49:58 +0000 | [diff] [blame] | 1068 | FieldDecl *Field = dyn_cast<FieldDecl>(M->getMemberDecl()); |
| 1069 | if (!Field) // FIXME: skipping member expressions for non-fields |
| 1070 | return; |
| 1071 | |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 1072 | for (ExplodedNodeSet::iterator I = Tmp.begin(), E = Tmp.end(); I != E; ++I) { |
Ted Kremenek | a8538d9 | 2009-02-13 01:45:31 +0000 | [diff] [blame] | 1073 | const GRState* state = GetState(*I); |
Ted Kremenek | d9bc33e | 2008-10-17 00:51:01 +0000 | [diff] [blame] | 1074 | // FIXME: Should we insert some assumption logic in here to determine |
| 1075 | // if "Base" is a valid piece of memory? Before we put this assumption |
Douglas Gregor | 86f1940 | 2008-12-20 23:49:58 +0000 | [diff] [blame] | 1076 | // later when using FieldOffset lvals (which we no longer have). |
Zhongxing Xu | d0f8bb1 | 2009-10-14 03:33:08 +0000 | [diff] [blame] | 1077 | SVal L = state->getLValue(Field, state->getSVal(Base)); |
Ted Kremenek | d9bc33e | 2008-10-17 00:51:01 +0000 | [diff] [blame] | 1078 | |
Zhongxing Xu | 6d69b5d | 2008-10-16 06:09:51 +0000 | [diff] [blame] | 1079 | if (asLValue) |
Ted Kremenek | 8e02934 | 2009-08-27 22:17:37 +0000 | [diff] [blame] | 1080 | MakeNode(Dst, M, *I, state->BindExpr(M, L), |
Ted Kremenek | 7090d54 | 2009-05-07 18:27:16 +0000 | [diff] [blame] | 1081 | ProgramPoint::PostLValueKind); |
Zhongxing Xu | 6d69b5d | 2008-10-16 06:09:51 +0000 | [diff] [blame] | 1082 | else |
Ted Kremenek | a8538d9 | 2009-02-13 01:45:31 +0000 | [diff] [blame] | 1083 | EvalLoad(Dst, M, *I, state, L); |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 1084 | } |
Ted Kremenek | 469ecbd | 2008-04-21 23:43:38 +0000 | [diff] [blame] | 1085 | } |
| 1086 | |
Ted Kremenek | a8538d9 | 2009-02-13 01:45:31 +0000 | [diff] [blame] | 1087 | /// EvalBind - Handle the semantics of binding a value to a specific location. |
| 1088 | /// This method is used by EvalStore and (soon) VisitDeclStmt, and others. |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 1089 | void GRExprEngine::EvalBind(ExplodedNodeSet& Dst, Expr* Ex, ExplodedNode* Pred, |
Ted Kremenek | 32c3fa4 | 2009-07-21 21:03:30 +0000 | [diff] [blame] | 1090 | const GRState* state, SVal location, SVal Val) { |
Ted Kremenek | a8538d9 | 2009-02-13 01:45:31 +0000 | [diff] [blame] | 1091 | |
Ted Kremenek | 41573eb | 2009-02-14 01:43:44 +0000 | [diff] [blame] | 1092 | const GRState* newState = 0; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1093 | |
Ted Kremenek | 41573eb | 2009-02-14 01:43:44 +0000 | [diff] [blame] | 1094 | if (location.isUnknown()) { |
| 1095 | // We know that the new state will be the same as the old state since |
| 1096 | // the location of the binding is "unknown". Consequently, there |
| 1097 | // is no reason to just create a new node. |
| 1098 | newState = state; |
| 1099 | } |
| 1100 | else { |
| 1101 | // We are binding to a value other than 'unknown'. Perform the binding |
| 1102 | // using the StoreManager. |
Ted Kremenek | 32c3fa4 | 2009-07-21 21:03:30 +0000 | [diff] [blame] | 1103 | newState = state->bindLoc(cast<Loc>(location), Val); |
Ted Kremenek | 41573eb | 2009-02-14 01:43:44 +0000 | [diff] [blame] | 1104 | } |
Ted Kremenek | a8538d9 | 2009-02-13 01:45:31 +0000 | [diff] [blame] | 1105 | |
Ted Kremenek | 41573eb | 2009-02-14 01:43:44 +0000 | [diff] [blame] | 1106 | // The next thing to do is check if the GRTransferFuncs object wants to |
| 1107 | // update the state based on the new binding. If the GRTransferFunc object |
| 1108 | // doesn't do anything, just auto-propagate the current state. |
| 1109 | GRStmtNodeBuilderRef BuilderRef(Dst, *Builder, *this, Pred, newState, Ex, |
| 1110 | newState != state); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1111 | |
Ted Kremenek | 41573eb | 2009-02-14 01:43:44 +0000 | [diff] [blame] | 1112 | getTF().EvalBind(BuilderRef, location, Val); |
Ted Kremenek | a8538d9 | 2009-02-13 01:45:31 +0000 | [diff] [blame] | 1113 | } |
| 1114 | |
| 1115 | /// EvalStore - Handle the semantics of a store via an assignment. |
| 1116 | /// @param Dst The node set to store generated state nodes |
| 1117 | /// @param Ex The expression representing the location of the store |
| 1118 | /// @param state The current simulation state |
| 1119 | /// @param location The location to store the value |
| 1120 | /// @param Val The value to be stored |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 1121 | void GRExprEngine::EvalStore(ExplodedNodeSet& Dst, Expr* Ex, ExplodedNode* Pred, |
Ted Kremenek | 1670e40 | 2009-04-11 00:11:10 +0000 | [diff] [blame] | 1122 | const GRState* state, SVal location, SVal Val, |
| 1123 | const void *tag) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1124 | |
Ted Kremenek | ec96a2d | 2008-04-16 18:39:06 +0000 | [diff] [blame] | 1125 | assert (Builder && "GRStmtNodeBuilder must be defined."); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1126 | |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 1127 | // Evaluate the location (checks for bad dereferences). |
Ted Kremenek | 1670e40 | 2009-04-11 00:11:10 +0000 | [diff] [blame] | 1128 | Pred = EvalLocation(Ex, Pred, state, location, tag); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1129 | |
Ted Kremenek | 8c35475 | 2008-12-16 22:02:27 +0000 | [diff] [blame] | 1130 | if (!Pred) |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 1131 | return; |
Ted Kremenek | b053396 | 2008-04-18 20:35:30 +0000 | [diff] [blame] | 1132 | |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 1133 | assert (!location.isUndef()); |
Ted Kremenek | a8538d9 | 2009-02-13 01:45:31 +0000 | [diff] [blame] | 1134 | state = GetState(Pred); |
| 1135 | |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1136 | // Proceed with the store. |
Ted Kremenek | a8538d9 | 2009-02-13 01:45:31 +0000 | [diff] [blame] | 1137 | SaveAndRestore<ProgramPoint::Kind> OldSPointKind(Builder->PointKind); |
Ted Kremenek | 1670e40 | 2009-04-11 00:11:10 +0000 | [diff] [blame] | 1138 | SaveAndRestore<const void*> OldTag(Builder->Tag); |
| 1139 | Builder->PointKind = ProgramPoint::PostStoreKind; |
| 1140 | Builder->Tag = tag; |
Ted Kremenek | a8538d9 | 2009-02-13 01:45:31 +0000 | [diff] [blame] | 1141 | EvalBind(Dst, Ex, Pred, state, location, Val); |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 1142 | } |
| 1143 | |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 1144 | void GRExprEngine::EvalLoad(ExplodedNodeSet& Dst, Expr* Ex, ExplodedNode* Pred, |
Ted Kremenek | 1670e40 | 2009-04-11 00:11:10 +0000 | [diff] [blame] | 1145 | const GRState* state, SVal location, |
| 1146 | const void *tag) { |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 1147 | |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1148 | // Evaluate the location (checks for bad dereferences). |
Ted Kremenek | 1670e40 | 2009-04-11 00:11:10 +0000 | [diff] [blame] | 1149 | Pred = EvalLocation(Ex, Pred, state, location, tag); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1150 | |
Ted Kremenek | 8c35475 | 2008-12-16 22:02:27 +0000 | [diff] [blame] | 1151 | if (!Pred) |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 1152 | return; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1153 | |
Ted Kremenek | a8538d9 | 2009-02-13 01:45:31 +0000 | [diff] [blame] | 1154 | state = GetState(Pred); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1155 | |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 1156 | // Proceed with the load. |
Ted Kremenek | 982e674 | 2008-08-28 18:43:46 +0000 | [diff] [blame] | 1157 | ProgramPoint::Kind K = ProgramPoint::PostLoadKind; |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 1158 | |
| 1159 | // FIXME: Currently symbolic analysis "generates" new symbols |
| 1160 | // for the contents of values. We need a better approach. |
| 1161 | |
Ted Kremenek | 8c35475 | 2008-12-16 22:02:27 +0000 | [diff] [blame] | 1162 | if (location.isUnknown()) { |
Ted Kremenek | 436f2b9 | 2008-04-30 04:23:07 +0000 | [diff] [blame] | 1163 | // This is important. We must nuke the old binding. |
Ted Kremenek | 8e02934 | 2009-08-27 22:17:37 +0000 | [diff] [blame] | 1164 | MakeNode(Dst, Ex, Pred, state->BindExpr(Ex, UnknownVal()), |
Zhongxing Xu | 5032ffe | 2009-08-25 06:51:30 +0000 | [diff] [blame] | 1165 | K, tag); |
Ted Kremenek | 436f2b9 | 2008-04-30 04:23:07 +0000 | [diff] [blame] | 1166 | } |
Zhongxing Xu | d5b499d | 2008-11-28 08:34:30 +0000 | [diff] [blame] | 1167 | else { |
Ted Kremenek | 3ff1259 | 2009-06-19 17:10:32 +0000 | [diff] [blame] | 1168 | SVal V = state->getSVal(cast<Loc>(location), Ex->getType()); |
Ted Kremenek | 8e02934 | 2009-08-27 22:17:37 +0000 | [diff] [blame] | 1169 | MakeNode(Dst, Ex, Pred, state->BindExpr(Ex, V), K, tag); |
Zhongxing Xu | d5b499d | 2008-11-28 08:34:30 +0000 | [diff] [blame] | 1170 | } |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 1171 | } |
| 1172 | |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1173 | void GRExprEngine::EvalStore(ExplodedNodeSet& Dst, Expr* Ex, Expr* StoreE, |
| 1174 | ExplodedNode* Pred, const GRState* state, |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 1175 | SVal location, SVal Val, const void *tag) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1176 | |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 1177 | ExplodedNodeSet TmpDst; |
Ted Kremenek | 1670e40 | 2009-04-11 00:11:10 +0000 | [diff] [blame] | 1178 | EvalStore(TmpDst, StoreE, Pred, state, location, Val, tag); |
Ted Kremenek | 82bae3f | 2008-09-20 01:50:34 +0000 | [diff] [blame] | 1179 | |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 1180 | for (ExplodedNodeSet::iterator I=TmpDst.begin(), E=TmpDst.end(); I!=E; ++I) |
Ted Kremenek | 1670e40 | 2009-04-11 00:11:10 +0000 | [diff] [blame] | 1181 | MakeNode(Dst, Ex, *I, (*I)->getState(), ProgramPoint::PostStmtKind, tag); |
Ted Kremenek | 82bae3f | 2008-09-20 01:50:34 +0000 | [diff] [blame] | 1182 | } |
| 1183 | |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 1184 | ExplodedNode* GRExprEngine::EvalLocation(Stmt* Ex, ExplodedNode* Pred, |
| 1185 | const GRState* state, SVal location, |
| 1186 | const void *tag) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1187 | |
Ted Kremenek | 1670e40 | 2009-04-11 00:11:10 +0000 | [diff] [blame] | 1188 | SaveAndRestore<const void*> OldTag(Builder->Tag); |
| 1189 | Builder->Tag = tag; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1190 | |
| 1191 | // Check for loads/stores from/to undefined values. |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 1192 | if (location.isUndef()) { |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 1193 | ExplodedNode* N = |
Ted Kremenek | a8538d9 | 2009-02-13 01:45:31 +0000 | [diff] [blame] | 1194 | Builder->generateNode(Ex, state, Pred, |
Ted Kremenek | 8c35475 | 2008-12-16 22:02:27 +0000 | [diff] [blame] | 1195 | ProgramPoint::PostUndefLocationCheckFailedKind); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1196 | |
Ted Kremenek | 8c35475 | 2008-12-16 22:02:27 +0000 | [diff] [blame] | 1197 | if (N) { |
| 1198 | N->markAsSink(); |
| 1199 | UndefDeref.insert(N); |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 1200 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1201 | |
Ted Kremenek | 8c35475 | 2008-12-16 22:02:27 +0000 | [diff] [blame] | 1202 | return 0; |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 1203 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1204 | |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 1205 | // Check for loads/stores from/to unknown locations. Treat as No-Ops. |
| 1206 | if (location.isUnknown()) |
Ted Kremenek | 8c35475 | 2008-12-16 22:02:27 +0000 | [diff] [blame] | 1207 | return Pred; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1208 | |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 1209 | // During a load, one of two possible situations arise: |
| 1210 | // (1) A crash, because the location (pointer) was NULL. |
| 1211 | // (2) The location (pointer) is not NULL, and the dereference works. |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1212 | // |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 1213 | // We add these assumptions. |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1214 | |
| 1215 | Loc LV = cast<Loc>(location); |
| 1216 | |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 1217 | // "Assume" that the pointer is not NULL. |
Ted Kremenek | 5b9bd21 | 2009-09-11 22:07:28 +0000 | [diff] [blame] | 1218 | const GRState *StNotNull = state->Assume(LV, true); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1219 | |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 1220 | // "Assume" that the pointer is NULL. |
Ted Kremenek | 5b9bd21 | 2009-09-11 22:07:28 +0000 | [diff] [blame] | 1221 | const GRState *StNull = state->Assume(LV, false); |
Zhongxing Xu | a1718c7 | 2009-04-03 07:33:13 +0000 | [diff] [blame] | 1222 | |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1223 | if (StNull) { |
Ted Kremenek | 7360fda | 2008-09-18 23:09:54 +0000 | [diff] [blame] | 1224 | // Use the Generic Data Map to mark in the state what lval was null. |
Zhongxing Xu | 1c96b24 | 2008-10-17 05:57:07 +0000 | [diff] [blame] | 1225 | const SVal* PersistentLV = getBasicVals().getPersistentSVal(LV); |
Ted Kremenek | b65be70 | 2009-06-18 01:23:53 +0000 | [diff] [blame] | 1226 | StNull = StNull->set<GRState::NullDerefTag>(PersistentLV); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1227 | |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 1228 | // We don't use "MakeNode" here because the node will be a sink |
| 1229 | // and we have no intention of processing it later. |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 1230 | ExplodedNode* NullNode = |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1231 | Builder->generateNode(Ex, StNull, Pred, |
Ted Kremenek | 8c35475 | 2008-12-16 22:02:27 +0000 | [diff] [blame] | 1232 | ProgramPoint::PostNullCheckFailedKind); |
Ted Kremenek | 331b0ac | 2008-06-18 05:34:07 +0000 | [diff] [blame] | 1233 | |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1234 | if (NullNode) { |
| 1235 | NullNode->markAsSink(); |
Ted Kremenek | a591bc0 | 2009-06-18 22:57:13 +0000 | [diff] [blame] | 1236 | if (StNotNull) ImplicitNullDeref.insert(NullNode); |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 1237 | else ExplicitNullDeref.insert(NullNode); |
| 1238 | } |
| 1239 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1240 | |
Ted Kremenek | a591bc0 | 2009-06-18 22:57:13 +0000 | [diff] [blame] | 1241 | if (!StNotNull) |
| 1242 | return NULL; |
Zhongxing Xu | 60156f0 | 2008-11-08 03:45:42 +0000 | [diff] [blame] | 1243 | |
Ted Kremenek | 39abcdf | 2009-08-01 05:59:39 +0000 | [diff] [blame] | 1244 | // FIXME: Temporarily disable out-of-bounds checking until we make |
| 1245 | // the logic reflect recent changes to CastRegion and friends. |
| 1246 | #if 0 |
Zhongxing Xu | 60156f0 | 2008-11-08 03:45:42 +0000 | [diff] [blame] | 1247 | // Check for out-of-bound array access. |
Ted Kremenek | 8c35475 | 2008-12-16 22:02:27 +0000 | [diff] [blame] | 1248 | if (isa<loc::MemRegionVal>(LV)) { |
Zhongxing Xu | 60156f0 | 2008-11-08 03:45:42 +0000 | [diff] [blame] | 1249 | const MemRegion* R = cast<loc::MemRegionVal>(LV).getRegion(); |
| 1250 | if (const ElementRegion* ER = dyn_cast<ElementRegion>(R)) { |
| 1251 | // Get the index of the accessed element. |
| 1252 | SVal Idx = ER->getIndex(); |
| 1253 | // Get the extent of the array. |
Zhongxing Xu | 1ed8d4b | 2008-11-24 07:02:06 +0000 | [diff] [blame] | 1254 | SVal NumElements = getStoreManager().getSizeInElements(StNotNull, |
| 1255 | ER->getSuperRegion()); |
Zhongxing Xu | 60156f0 | 2008-11-08 03:45:42 +0000 | [diff] [blame] | 1256 | |
Ted Kremenek | 5b9bd21 | 2009-09-11 22:07:28 +0000 | [diff] [blame] | 1257 | const GRState * StInBound = StNotNull->AssumeInBound(Idx, NumElements, |
Ted Kremenek | a591bc0 | 2009-06-18 22:57:13 +0000 | [diff] [blame] | 1258 | true); |
Ted Kremenek | 5b9bd21 | 2009-09-11 22:07:28 +0000 | [diff] [blame] | 1259 | const GRState* StOutBound = StNotNull->AssumeInBound(Idx, NumElements, |
Ted Kremenek | a591bc0 | 2009-06-18 22:57:13 +0000 | [diff] [blame] | 1260 | false); |
Zhongxing Xu | 60156f0 | 2008-11-08 03:45:42 +0000 | [diff] [blame] | 1261 | |
Ted Kremenek | a591bc0 | 2009-06-18 22:57:13 +0000 | [diff] [blame] | 1262 | if (StOutBound) { |
Ted Kremenek | 8c35475 | 2008-12-16 22:02:27 +0000 | [diff] [blame] | 1263 | // Report warning. Make sink node manually. |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 1264 | ExplodedNode* OOBNode = |
Ted Kremenek | 8c35475 | 2008-12-16 22:02:27 +0000 | [diff] [blame] | 1265 | Builder->generateNode(Ex, StOutBound, Pred, |
| 1266 | ProgramPoint::PostOutOfBoundsCheckFailedKind); |
Zhongxing Xu | 1c0c233 | 2008-11-23 05:52:28 +0000 | [diff] [blame] | 1267 | |
| 1268 | if (OOBNode) { |
| 1269 | OOBNode->markAsSink(); |
| 1270 | |
Ted Kremenek | a591bc0 | 2009-06-18 22:57:13 +0000 | [diff] [blame] | 1271 | if (StInBound) |
Zhongxing Xu | 1c0c233 | 2008-11-23 05:52:28 +0000 | [diff] [blame] | 1272 | ImplicitOOBMemAccesses.insert(OOBNode); |
| 1273 | else |
| 1274 | ExplicitOOBMemAccesses.insert(OOBNode); |
| 1275 | } |
Zhongxing Xu | e8a964b | 2008-11-22 13:21:46 +0000 | [diff] [blame] | 1276 | } |
| 1277 | |
Ted Kremenek | a591bc0 | 2009-06-18 22:57:13 +0000 | [diff] [blame] | 1278 | if (!StInBound) |
| 1279 | return NULL; |
| 1280 | |
Ted Kremenek | 8c35475 | 2008-12-16 22:02:27 +0000 | [diff] [blame] | 1281 | StNotNull = StInBound; |
Zhongxing Xu | 60156f0 | 2008-11-08 03:45:42 +0000 | [diff] [blame] | 1282 | } |
| 1283 | } |
Ted Kremenek | 39abcdf | 2009-08-01 05:59:39 +0000 | [diff] [blame] | 1284 | #endif |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1285 | |
Ted Kremenek | 8c35475 | 2008-12-16 22:02:27 +0000 | [diff] [blame] | 1286 | // Generate a new node indicating the checks succeed. |
| 1287 | return Builder->generateNode(Ex, StNotNull, Pred, |
| 1288 | ProgramPoint::PostLocationChecksSucceedKind); |
Ted Kremenek | ec96a2d | 2008-04-16 18:39:06 +0000 | [diff] [blame] | 1289 | } |
| 1290 | |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 1291 | //===----------------------------------------------------------------------===// |
Ted Kremenek | 1670e40 | 2009-04-11 00:11:10 +0000 | [diff] [blame] | 1292 | // Transfer function: OSAtomics. |
| 1293 | // |
| 1294 | // FIXME: Eventually refactor into a more "plugin" infrastructure. |
| 1295 | //===----------------------------------------------------------------------===// |
| 1296 | |
| 1297 | // Mac OS X: |
| 1298 | // http://developer.apple.com/documentation/Darwin/Reference/Manpages/man3 |
| 1299 | // atomic.3.html |
| 1300 | // |
Zhongxing Xu | c5619d9 | 2009-08-06 01:32:16 +0000 | [diff] [blame] | 1301 | static bool EvalOSAtomicCompareAndSwap(ExplodedNodeSet& Dst, |
Ted Kremenek | 1670e40 | 2009-04-11 00:11:10 +0000 | [diff] [blame] | 1302 | GRExprEngine& Engine, |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 1303 | GRStmtNodeBuilder& Builder, |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1304 | CallExpr* CE, SVal L, |
Zhongxing Xu | c5619d9 | 2009-08-06 01:32:16 +0000 | [diff] [blame] | 1305 | ExplodedNode* Pred) { |
Ted Kremenek | 1670e40 | 2009-04-11 00:11:10 +0000 | [diff] [blame] | 1306 | |
| 1307 | // Not enough arguments to match OSAtomicCompareAndSwap? |
| 1308 | if (CE->getNumArgs() != 3) |
| 1309 | return false; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1310 | |
Ted Kremenek | 1670e40 | 2009-04-11 00:11:10 +0000 | [diff] [blame] | 1311 | ASTContext &C = Engine.getContext(); |
| 1312 | Expr *oldValueExpr = CE->getArg(0); |
| 1313 | QualType oldValueType = C.getCanonicalType(oldValueExpr->getType()); |
| 1314 | |
| 1315 | Expr *newValueExpr = CE->getArg(1); |
| 1316 | QualType newValueType = C.getCanonicalType(newValueExpr->getType()); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1317 | |
Ted Kremenek | 1670e40 | 2009-04-11 00:11:10 +0000 | [diff] [blame] | 1318 | // Do the types of 'oldValue' and 'newValue' match? |
| 1319 | if (oldValueType != newValueType) |
| 1320 | return false; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1321 | |
Ted Kremenek | 1670e40 | 2009-04-11 00:11:10 +0000 | [diff] [blame] | 1322 | Expr *theValueExpr = CE->getArg(2); |
Ted Kremenek | 39abcdf | 2009-08-01 05:59:39 +0000 | [diff] [blame] | 1323 | const PointerType *theValueType = |
| 1324 | theValueExpr->getType()->getAs<PointerType>(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1325 | |
Ted Kremenek | 1670e40 | 2009-04-11 00:11:10 +0000 | [diff] [blame] | 1326 | // theValueType not a pointer? |
| 1327 | if (!theValueType) |
| 1328 | return false; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1329 | |
Ted Kremenek | 1670e40 | 2009-04-11 00:11:10 +0000 | [diff] [blame] | 1330 | QualType theValueTypePointee = |
| 1331 | C.getCanonicalType(theValueType->getPointeeType()).getUnqualifiedType(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1332 | |
Ted Kremenek | 1670e40 | 2009-04-11 00:11:10 +0000 | [diff] [blame] | 1333 | // The pointee must match newValueType and oldValueType. |
| 1334 | if (theValueTypePointee != newValueType) |
| 1335 | return false; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1336 | |
Ted Kremenek | 1670e40 | 2009-04-11 00:11:10 +0000 | [diff] [blame] | 1337 | static unsigned magic_load = 0; |
| 1338 | static unsigned magic_store = 0; |
| 1339 | |
| 1340 | const void *OSAtomicLoadTag = &magic_load; |
| 1341 | const void *OSAtomicStoreTag = &magic_store; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1342 | |
Ted Kremenek | 1670e40 | 2009-04-11 00:11:10 +0000 | [diff] [blame] | 1343 | // Load 'theValue'. |
Ted Kremenek | 1670e40 | 2009-04-11 00:11:10 +0000 | [diff] [blame] | 1344 | const GRState *state = Pred->getState(); |
Zhongxing Xu | c5619d9 | 2009-08-06 01:32:16 +0000 | [diff] [blame] | 1345 | ExplodedNodeSet Tmp; |
Ted Kremenek | 23ec48c | 2009-06-18 23:58:37 +0000 | [diff] [blame] | 1346 | SVal location = state->getSVal(theValueExpr); |
Ted Kremenek | 1670e40 | 2009-04-11 00:11:10 +0000 | [diff] [blame] | 1347 | Engine.EvalLoad(Tmp, theValueExpr, Pred, state, location, OSAtomicLoadTag); |
| 1348 | |
Zhongxing Xu | c5619d9 | 2009-08-06 01:32:16 +0000 | [diff] [blame] | 1349 | for (ExplodedNodeSet::iterator I = Tmp.begin(), E = Tmp.end(); |
Ted Kremenek | 1670e40 | 2009-04-11 00:11:10 +0000 | [diff] [blame] | 1350 | I != E; ++I) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1351 | |
Zhongxing Xu | c5619d9 | 2009-08-06 01:32:16 +0000 | [diff] [blame] | 1352 | ExplodedNode *N = *I; |
Ted Kremenek | 1670e40 | 2009-04-11 00:11:10 +0000 | [diff] [blame] | 1353 | const GRState *stateLoad = N->getState(); |
Ted Kremenek | 5b9bd21 | 2009-09-11 22:07:28 +0000 | [diff] [blame] | 1354 | SVal theValueVal_untested = stateLoad->getSVal(theValueExpr); |
| 1355 | SVal oldValueVal_untested = stateLoad->getSVal(oldValueExpr); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1356 | |
Ted Kremenek | 1ff8339 | 2009-07-20 20:38:59 +0000 | [diff] [blame] | 1357 | // FIXME: Issue an error. |
Ted Kremenek | 5b9bd21 | 2009-09-11 22:07:28 +0000 | [diff] [blame] | 1358 | if (theValueVal_untested.isUndef() || oldValueVal_untested.isUndef()) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1359 | return false; |
Ted Kremenek | 1ff8339 | 2009-07-20 20:38:59 +0000 | [diff] [blame] | 1360 | } |
Ted Kremenek | 5b9bd21 | 2009-09-11 22:07:28 +0000 | [diff] [blame] | 1361 | |
| 1362 | DefinedOrUnknownSVal theValueVal = |
| 1363 | cast<DefinedOrUnknownSVal>(theValueVal_untested); |
| 1364 | DefinedOrUnknownSVal oldValueVal = |
| 1365 | cast<DefinedOrUnknownSVal>(oldValueVal_untested); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1366 | |
Ted Kremenek | ff4264d | 2009-08-25 18:44:25 +0000 | [diff] [blame] | 1367 | SValuator &SVator = Engine.getSValuator(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1368 | |
Ted Kremenek | 1670e40 | 2009-04-11 00:11:10 +0000 | [diff] [blame] | 1369 | // Perform the comparison. |
Ted Kremenek | 5b9bd21 | 2009-09-11 22:07:28 +0000 | [diff] [blame] | 1370 | DefinedOrUnknownSVal Cmp = SVator.EvalEQ(stateLoad, theValueVal, |
| 1371 | oldValueVal); |
Ted Kremenek | a591bc0 | 2009-06-18 22:57:13 +0000 | [diff] [blame] | 1372 | |
Ted Kremenek | 5b9bd21 | 2009-09-11 22:07:28 +0000 | [diff] [blame] | 1373 | const GRState *stateEqual = stateLoad->Assume(Cmp, true); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1374 | |
Ted Kremenek | 1670e40 | 2009-04-11 00:11:10 +0000 | [diff] [blame] | 1375 | // Were they equal? |
Ted Kremenek | a591bc0 | 2009-06-18 22:57:13 +0000 | [diff] [blame] | 1376 | if (stateEqual) { |
Ted Kremenek | 1670e40 | 2009-04-11 00:11:10 +0000 | [diff] [blame] | 1377 | // Perform the store. |
Zhongxing Xu | c5619d9 | 2009-08-06 01:32:16 +0000 | [diff] [blame] | 1378 | ExplodedNodeSet TmpStore; |
Ted Kremenek | 32c3fa4 | 2009-07-21 21:03:30 +0000 | [diff] [blame] | 1379 | SVal val = stateEqual->getSVal(newValueExpr); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1380 | |
Ted Kremenek | 32c3fa4 | 2009-07-21 21:03:30 +0000 | [diff] [blame] | 1381 | // Handle implicit value casts. |
| 1382 | if (const TypedRegion *R = |
| 1383 | dyn_cast_or_null<TypedRegion>(location.getAsRegion())) { |
Ted Kremenek | ff4264d | 2009-08-25 18:44:25 +0000 | [diff] [blame] | 1384 | llvm::tie(state, val) = SVator.EvalCast(val, state, R->getValueType(C), |
| 1385 | newValueExpr->getType()); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1386 | } |
| 1387 | |
| 1388 | Engine.EvalStore(TmpStore, theValueExpr, N, stateEqual, location, |
Ted Kremenek | 32c3fa4 | 2009-07-21 21:03:30 +0000 | [diff] [blame] | 1389 | val, OSAtomicStoreTag); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1390 | |
Ted Kremenek | 1670e40 | 2009-04-11 00:11:10 +0000 | [diff] [blame] | 1391 | // Now bind the result of the comparison. |
Zhongxing Xu | c5619d9 | 2009-08-06 01:32:16 +0000 | [diff] [blame] | 1392 | for (ExplodedNodeSet::iterator I2 = TmpStore.begin(), |
Ted Kremenek | 1670e40 | 2009-04-11 00:11:10 +0000 | [diff] [blame] | 1393 | E2 = TmpStore.end(); I2 != E2; ++I2) { |
Zhongxing Xu | c5619d9 | 2009-08-06 01:32:16 +0000 | [diff] [blame] | 1394 | ExplodedNode *predNew = *I2; |
Ted Kremenek | 1670e40 | 2009-04-11 00:11:10 +0000 | [diff] [blame] | 1395 | const GRState *stateNew = predNew->getState(); |
| 1396 | SVal Res = Engine.getValueManager().makeTruthVal(true, CE->getType()); |
Ted Kremenek | 8e02934 | 2009-08-27 22:17:37 +0000 | [diff] [blame] | 1397 | Engine.MakeNode(Dst, CE, predNew, stateNew->BindExpr(CE, Res)); |
Ted Kremenek | 1670e40 | 2009-04-11 00:11:10 +0000 | [diff] [blame] | 1398 | } |
| 1399 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1400 | |
Ted Kremenek | 1670e40 | 2009-04-11 00:11:10 +0000 | [diff] [blame] | 1401 | // Were they not equal? |
Ted Kremenek | 5b9bd21 | 2009-09-11 22:07:28 +0000 | [diff] [blame] | 1402 | if (const GRState *stateNotEqual = stateLoad->Assume(Cmp, false)) { |
Ted Kremenek | 1670e40 | 2009-04-11 00:11:10 +0000 | [diff] [blame] | 1403 | SVal Res = Engine.getValueManager().makeTruthVal(false, CE->getType()); |
Ted Kremenek | 8e02934 | 2009-08-27 22:17:37 +0000 | [diff] [blame] | 1404 | Engine.MakeNode(Dst, CE, N, stateNotEqual->BindExpr(CE, Res)); |
Ted Kremenek | 1670e40 | 2009-04-11 00:11:10 +0000 | [diff] [blame] | 1405 | } |
| 1406 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1407 | |
Ted Kremenek | 1670e40 | 2009-04-11 00:11:10 +0000 | [diff] [blame] | 1408 | return true; |
| 1409 | } |
| 1410 | |
Zhongxing Xu | c5619d9 | 2009-08-06 01:32:16 +0000 | [diff] [blame] | 1411 | static bool EvalOSAtomic(ExplodedNodeSet& Dst, |
Ted Kremenek | 1670e40 | 2009-04-11 00:11:10 +0000 | [diff] [blame] | 1412 | GRExprEngine& Engine, |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 1413 | GRStmtNodeBuilder& Builder, |
Ted Kremenek | 1670e40 | 2009-04-11 00:11:10 +0000 | [diff] [blame] | 1414 | CallExpr* CE, SVal L, |
Zhongxing Xu | c5619d9 | 2009-08-06 01:32:16 +0000 | [diff] [blame] | 1415 | ExplodedNode* Pred) { |
Zhongxing Xu | 369f447 | 2009-04-20 05:24:46 +0000 | [diff] [blame] | 1416 | const FunctionDecl* FD = L.getAsFunctionDecl(); |
| 1417 | if (!FD) |
Ted Kremenek | 1670e40 | 2009-04-11 00:11:10 +0000 | [diff] [blame] | 1418 | return false; |
Zhongxing Xu | 369f447 | 2009-04-20 05:24:46 +0000 | [diff] [blame] | 1419 | |
Ted Kremenek | 1670e40 | 2009-04-11 00:11:10 +0000 | [diff] [blame] | 1420 | const char *FName = FD->getNameAsCString(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1421 | |
Ted Kremenek | 1670e40 | 2009-04-11 00:11:10 +0000 | [diff] [blame] | 1422 | // Check for compare and swap. |
Ted Kremenek | b3bf76f | 2009-04-11 00:54:13 +0000 | [diff] [blame] | 1423 | if (strncmp(FName, "OSAtomicCompareAndSwap", 22) == 0 || |
| 1424 | strncmp(FName, "objc_atomicCompareAndSwap", 25) == 0) |
Ted Kremenek | 1670e40 | 2009-04-11 00:11:10 +0000 | [diff] [blame] | 1425 | return EvalOSAtomicCompareAndSwap(Dst, Engine, Builder, CE, L, Pred); |
Ted Kremenek | b3bf76f | 2009-04-11 00:54:13 +0000 | [diff] [blame] | 1426 | |
Ted Kremenek | 1670e40 | 2009-04-11 00:11:10 +0000 | [diff] [blame] | 1427 | // FIXME: Other atomics. |
| 1428 | return false; |
| 1429 | } |
| 1430 | |
| 1431 | //===----------------------------------------------------------------------===// |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 1432 | // Transfer function: Function calls. |
| 1433 | //===----------------------------------------------------------------------===// |
Zhongxing Xu | 326d617 | 2009-09-04 02:13:36 +0000 | [diff] [blame] | 1434 | static void MarkNoReturnFunction(const FunctionDecl *FD, CallExpr *CE, |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1435 | const GRState *state, |
Zhongxing Xu | 326d617 | 2009-09-04 02:13:36 +0000 | [diff] [blame] | 1436 | GRStmtNodeBuilder *Builder) { |
Zhongxing Xu | 4e71ddb | 2009-09-04 02:17:35 +0000 | [diff] [blame] | 1437 | if (!FD) |
| 1438 | return; |
| 1439 | |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1440 | if (FD->getAttr<NoReturnAttr>() || |
Zhongxing Xu | 326d617 | 2009-09-04 02:13:36 +0000 | [diff] [blame] | 1441 | FD->getAttr<AnalyzerNoReturnAttr>()) |
| 1442 | Builder->BuildSinks = true; |
| 1443 | else { |
| 1444 | // HACK: Some functions are not marked noreturn, and don't return. |
| 1445 | // Here are a few hardwired ones. If this takes too long, we can |
| 1446 | // potentially cache these results. |
Douglas Gregor | 55d3f7a | 2009-10-29 00:41:01 +0000 | [diff] [blame^] | 1447 | using llvm::StringRef; |
| 1448 | bool BuildSinks |
| 1449 | = llvm::StringSwitch<bool>(StringRef(FD->getIdentifier()->getName())) |
| 1450 | .Case("exit", true) |
| 1451 | .Case("panic", true) |
| 1452 | .Case("error", true) |
| 1453 | .Case("Assert", true) |
| 1454 | // FIXME: This is just a wrapper around throwing an exception. |
| 1455 | // Eventually inter-procedural analysis should handle this easily. |
| 1456 | .Case("ziperr", true) |
| 1457 | .Case("assfail", true) |
| 1458 | .Case("db_error", true) |
| 1459 | .Case("__assert", true) |
| 1460 | .Case("__assert_rtn", true) |
| 1461 | .Case("__assert_fail", true) |
| 1462 | .Case("dtrace_assfail", true) |
| 1463 | .Case("yy_fatal_error", true) |
| 1464 | .Case("_XCAssertionFailureHandler", true) |
| 1465 | .Case("_DTAssertionFailureHandler", true) |
| 1466 | .Case("_TSAssertionFailureHandler", true) |
| 1467 | .Default(false); |
| 1468 | |
| 1469 | if (BuildSinks) |
| 1470 | Builder->BuildSinks = true; |
Zhongxing Xu | 326d617 | 2009-09-04 02:13:36 +0000 | [diff] [blame] | 1471 | } |
| 1472 | } |
Ted Kremenek | 1670e40 | 2009-04-11 00:11:10 +0000 | [diff] [blame] | 1473 | |
Zhongxing Xu | 248072a | 2009-09-05 05:00:57 +0000 | [diff] [blame] | 1474 | bool GRExprEngine::EvalBuiltinFunction(const FunctionDecl *FD, CallExpr *CE, |
| 1475 | ExplodedNode *Pred, |
| 1476 | ExplodedNodeSet &Dst) { |
| 1477 | if (!FD) |
| 1478 | return false; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1479 | |
Douglas Gregor | 7814e6d | 2009-09-12 00:22:50 +0000 | [diff] [blame] | 1480 | unsigned id = FD->getBuiltinID(); |
Zhongxing Xu | 248072a | 2009-09-05 05:00:57 +0000 | [diff] [blame] | 1481 | if (!id) |
| 1482 | return false; |
| 1483 | |
| 1484 | const GRState *state = Pred->getState(); |
| 1485 | |
| 1486 | switch (id) { |
| 1487 | case Builtin::BI__builtin_expect: { |
| 1488 | // For __builtin_expect, just return the value of the subexpression. |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1489 | assert (CE->arg_begin() != CE->arg_end()); |
Zhongxing Xu | 248072a | 2009-09-05 05:00:57 +0000 | [diff] [blame] | 1490 | SVal X = state->getSVal(*(CE->arg_begin())); |
| 1491 | MakeNode(Dst, CE, Pred, state->BindExpr(CE, X)); |
| 1492 | return true; |
| 1493 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1494 | |
Zhongxing Xu | 248072a | 2009-09-05 05:00:57 +0000 | [diff] [blame] | 1495 | case Builtin::BI__builtin_alloca: { |
| 1496 | // FIXME: Refactor into StoreManager itself? |
| 1497 | MemRegionManager& RM = getStateManager().getRegionManager(); |
| 1498 | const MemRegion* R = |
| 1499 | RM.getAllocaRegion(CE, Builder->getCurrentBlockCount()); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1500 | |
Zhongxing Xu | 248072a | 2009-09-05 05:00:57 +0000 | [diff] [blame] | 1501 | // Set the extent of the region in bytes. This enables us to use the |
| 1502 | // SVal of the argument directly. If we save the extent in bits, we |
| 1503 | // cannot represent values like symbol*8. |
| 1504 | SVal Extent = state->getSVal(*(CE->arg_begin())); |
| 1505 | state = getStoreManager().setExtent(state, R, Extent); |
| 1506 | MakeNode(Dst, CE, Pred, state->BindExpr(CE, loc::MemRegionVal(R))); |
| 1507 | return true; |
| 1508 | } |
| 1509 | } |
| 1510 | |
| 1511 | return false; |
| 1512 | } |
| 1513 | |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1514 | void GRExprEngine::EvalCall(ExplodedNodeSet& Dst, CallExpr* CE, SVal L, |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 1515 | ExplodedNode* Pred) { |
Ted Kremenek | 1670e40 | 2009-04-11 00:11:10 +0000 | [diff] [blame] | 1516 | assert (Builder && "GRStmtNodeBuilder must be defined."); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1517 | |
Ted Kremenek | 1670e40 | 2009-04-11 00:11:10 +0000 | [diff] [blame] | 1518 | // FIXME: Allow us to chain together transfer functions. |
| 1519 | if (EvalOSAtomic(Dst, *this, *Builder, CE, L, Pred)) |
| 1520 | return; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1521 | |
Ted Kremenek | 1670e40 | 2009-04-11 00:11:10 +0000 | [diff] [blame] | 1522 | getTF().EvalCall(Dst, *this, *Builder, CE, L, Pred); |
| 1523 | } |
| 1524 | |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 1525 | void GRExprEngine::VisitCall(CallExpr* CE, ExplodedNode* Pred, |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 1526 | CallExpr::arg_iterator AI, |
| 1527 | CallExpr::arg_iterator AE, |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1528 | ExplodedNodeSet& Dst) { |
Douglas Gregor | 9d293df | 2008-10-28 00:22:11 +0000 | [diff] [blame] | 1529 | // Determine the type of function we're calling (if available). |
Douglas Gregor | 72564e7 | 2009-02-26 23:50:07 +0000 | [diff] [blame] | 1530 | const FunctionProtoType *Proto = NULL; |
Douglas Gregor | 9d293df | 2008-10-28 00:22:11 +0000 | [diff] [blame] | 1531 | QualType FnType = CE->getCallee()->IgnoreParens()->getType(); |
Ted Kremenek | 6217b80 | 2009-07-29 21:53:49 +0000 | [diff] [blame] | 1532 | if (const PointerType *FnTypePtr = FnType->getAs<PointerType>()) |
John McCall | 183700f | 2009-09-21 23:43:11 +0000 | [diff] [blame] | 1533 | Proto = FnTypePtr->getPointeeType()->getAs<FunctionProtoType>(); |
Douglas Gregor | 9d293df | 2008-10-28 00:22:11 +0000 | [diff] [blame] | 1534 | |
| 1535 | VisitCallRec(CE, Pred, AI, AE, Dst, Proto, /*ParamIdx=*/0); |
| 1536 | } |
| 1537 | |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 1538 | void GRExprEngine::VisitCallRec(CallExpr* CE, ExplodedNode* Pred, |
Douglas Gregor | 9d293df | 2008-10-28 00:22:11 +0000 | [diff] [blame] | 1539 | CallExpr::arg_iterator AI, |
| 1540 | CallExpr::arg_iterator AE, |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1541 | ExplodedNodeSet& Dst, |
| 1542 | const FunctionProtoType *Proto, |
Douglas Gregor | 9d293df | 2008-10-28 00:22:11 +0000 | [diff] [blame] | 1543 | unsigned ParamIdx) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1544 | |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 1545 | // Process the arguments. |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 1546 | if (AI != AE) { |
Douglas Gregor | 9d293df | 2008-10-28 00:22:11 +0000 | [diff] [blame] | 1547 | // If the call argument is being bound to a reference parameter, |
| 1548 | // visit it as an lvalue, not an rvalue. |
| 1549 | bool VisitAsLvalue = false; |
| 1550 | if (Proto && ParamIdx < Proto->getNumArgs()) |
| 1551 | VisitAsLvalue = Proto->getArgType(ParamIdx)->isReferenceType(); |
| 1552 | |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1553 | ExplodedNodeSet DstTmp; |
Douglas Gregor | 9d293df | 2008-10-28 00:22:11 +0000 | [diff] [blame] | 1554 | if (VisitAsLvalue) |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1555 | VisitLValue(*AI, Pred, DstTmp); |
Douglas Gregor | 9d293df | 2008-10-28 00:22:11 +0000 | [diff] [blame] | 1556 | else |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1557 | Visit(*AI, Pred, DstTmp); |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 1558 | ++AI; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1559 | |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 1560 | for (ExplodedNodeSet::iterator DI=DstTmp.begin(), DE=DstTmp.end(); DI != DE; |
| 1561 | ++DI) |
Douglas Gregor | 9d293df | 2008-10-28 00:22:11 +0000 | [diff] [blame] | 1562 | VisitCallRec(CE, *DI, AI, AE, Dst, Proto, ParamIdx + 1); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1563 | |
Ted Kremenek | de43424 | 2008-02-19 01:44:53 +0000 | [diff] [blame] | 1564 | return; |
| 1565 | } |
| 1566 | |
| 1567 | // If we reach here we have processed all of the arguments. Evaluate |
| 1568 | // the callee expression. |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 1569 | ExplodedNodeSet DstTmp; |
Ted Kremenek | 186350f | 2008-04-23 20:12:28 +0000 | [diff] [blame] | 1570 | Expr* Callee = CE->getCallee()->IgnoreParens(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1571 | |
Ted Kremenek | 5a5d98b | 2009-07-22 21:43:51 +0000 | [diff] [blame] | 1572 | { // Enter new scope to make the lifetime of 'DstTmp2' bounded. |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 1573 | ExplodedNodeSet DstTmp2; |
Ted Kremenek | 5a5d98b | 2009-07-22 21:43:51 +0000 | [diff] [blame] | 1574 | Visit(Callee, Pred, DstTmp2); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1575 | |
Ted Kremenek | 5a5d98b | 2009-07-22 21:43:51 +0000 | [diff] [blame] | 1576 | // Perform the previsit of the CallExpr, storing the results in DstTmp. |
| 1577 | CheckerVisit(CE, DstTmp, DstTmp2, true); |
| 1578 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1579 | |
Ted Kremenek | de43424 | 2008-02-19 01:44:53 +0000 | [diff] [blame] | 1580 | // Finally, evaluate the function call. |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1581 | for (ExplodedNodeSet::iterator DI = DstTmp.begin(), DE = DstTmp.end(); |
Zhongxing Xu | 248072a | 2009-09-05 05:00:57 +0000 | [diff] [blame] | 1582 | DI != DE; ++DI) { |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 1583 | |
Ted Kremenek | a8538d9 | 2009-02-13 01:45:31 +0000 | [diff] [blame] | 1584 | const GRState* state = GetState(*DI); |
Ted Kremenek | 3ff1259 | 2009-06-19 17:10:32 +0000 | [diff] [blame] | 1585 | SVal L = state->getSVal(Callee); |
Ted Kremenek | de43424 | 2008-02-19 01:44:53 +0000 | [diff] [blame] | 1586 | |
Ted Kremenek | a1354a5 | 2008-03-03 16:47:31 +0000 | [diff] [blame] | 1587 | // FIXME: Add support for symbolic function calls (calls involving |
| 1588 | // function pointer values that are symbolic). |
Zhongxing Xu | d99f361 | 2009-09-02 08:10:35 +0000 | [diff] [blame] | 1589 | |
Ted Kremenek | 4bf38da | 2008-03-05 21:15:02 +0000 | [diff] [blame] | 1590 | // Check for the "noreturn" attribute. |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1591 | |
Ted Kremenek | 4bf38da | 2008-03-05 21:15:02 +0000 | [diff] [blame] | 1592 | SaveAndRestore<bool> OldSink(Builder->BuildSinks); |
Zhongxing Xu | 369f447 | 2009-04-20 05:24:46 +0000 | [diff] [blame] | 1593 | const FunctionDecl* FD = L.getAsFunctionDecl(); |
Zhongxing Xu | 4e71ddb | 2009-09-04 02:17:35 +0000 | [diff] [blame] | 1594 | |
| 1595 | MarkNoReturnFunction(FD, CE, state, Builder); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1596 | |
Ted Kremenek | 4bf38da | 2008-03-05 21:15:02 +0000 | [diff] [blame] | 1597 | // Evaluate the call. |
Zhongxing Xu | aeba284 | 2009-09-05 06:46:12 +0000 | [diff] [blame] | 1598 | if (EvalBuiltinFunction(FD, CE, *DI, Dst)) |
Zhongxing Xu | 248072a | 2009-09-05 05:00:57 +0000 | [diff] [blame] | 1599 | continue; |
Ted Kremenek | 186350f | 2008-04-23 20:12:28 +0000 | [diff] [blame] | 1600 | |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1601 | // Dispatch to the plug-in transfer function. |
| 1602 | |
Ted Kremenek | 186350f | 2008-04-23 20:12:28 +0000 | [diff] [blame] | 1603 | unsigned size = Dst.size(); |
| 1604 | SaveOr OldHasGen(Builder->HasGeneratedNode); |
| 1605 | EvalCall(Dst, CE, L, *DI); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1606 | |
Ted Kremenek | 186350f | 2008-04-23 20:12:28 +0000 | [diff] [blame] | 1607 | // Handle the case where no nodes where generated. Auto-generate that |
| 1608 | // contains the updated state if we aren't generating sinks. |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1609 | |
Ted Kremenek | 186350f | 2008-04-23 20:12:28 +0000 | [diff] [blame] | 1610 | if (!Builder->BuildSinks && Dst.size() == size && |
| 1611 | !Builder->HasGeneratedNode) |
Ted Kremenek | a8538d9 | 2009-02-13 01:45:31 +0000 | [diff] [blame] | 1612 | MakeNode(Dst, CE, *DI, state); |
Ted Kremenek | de43424 | 2008-02-19 01:44:53 +0000 | [diff] [blame] | 1613 | } |
| 1614 | } |
| 1615 | |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 1616 | //===----------------------------------------------------------------------===// |
Ted Kremenek | 97ed4f6 | 2008-10-17 00:03:18 +0000 | [diff] [blame] | 1617 | // Transfer function: Objective-C ivar references. |
| 1618 | //===----------------------------------------------------------------------===// |
| 1619 | |
Ted Kremenek | f5cae63 | 2009-02-28 20:50:43 +0000 | [diff] [blame] | 1620 | static std::pair<const void*,const void*> EagerlyAssumeTag |
| 1621 | = std::pair<const void*,const void*>(&EagerlyAssumeTag,0); |
| 1622 | |
Zhongxing Xu | b317f8f | 2009-09-10 05:44:00 +0000 | [diff] [blame] | 1623 | void GRExprEngine::EvalEagerlyAssume(ExplodedNodeSet &Dst, ExplodedNodeSet &Src, |
| 1624 | Expr *Ex) { |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 1625 | for (ExplodedNodeSet::iterator I=Src.begin(), E=Src.end(); I!=E; ++I) { |
| 1626 | ExplodedNode *Pred = *I; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1627 | |
Ted Kremenek | b293902 | 2009-02-25 23:32:10 +0000 | [diff] [blame] | 1628 | // Test if the previous node was as the same expression. This can happen |
| 1629 | // when the expression fails to evaluate to anything meaningful and |
| 1630 | // (as an optimization) we don't generate a node. |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1631 | ProgramPoint P = Pred->getLocation(); |
Ted Kremenek | b293902 | 2009-02-25 23:32:10 +0000 | [diff] [blame] | 1632 | if (!isa<PostStmt>(P) || cast<PostStmt>(P).getStmt() != Ex) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1633 | Dst.Add(Pred); |
Ted Kremenek | b293902 | 2009-02-25 23:32:10 +0000 | [diff] [blame] | 1634 | continue; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1635 | } |
Ted Kremenek | b293902 | 2009-02-25 23:32:10 +0000 | [diff] [blame] | 1636 | |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1637 | const GRState* state = Pred->getState(); |
| 1638 | SVal V = state->getSVal(Ex); |
Ted Kremenek | 5b9bd21 | 2009-09-11 22:07:28 +0000 | [diff] [blame] | 1639 | if (nonloc::SymExprVal *SEV = dyn_cast<nonloc::SymExprVal>(&V)) { |
Ted Kremenek | 48af2a9 | 2009-02-25 22:32:02 +0000 | [diff] [blame] | 1640 | // First assume that the condition is true. |
Ted Kremenek | 5b9bd21 | 2009-09-11 22:07:28 +0000 | [diff] [blame] | 1641 | if (const GRState *stateTrue = state->Assume(*SEV, true)) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1642 | stateTrue = stateTrue->BindExpr(Ex, |
Ted Kremenek | 0fb0bc4 | 2009-08-27 01:39:13 +0000 | [diff] [blame] | 1643 | ValMgr.makeIntVal(1U, Ex->getType())); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1644 | Dst.Add(Builder->generateNode(PostStmtCustom(Ex, |
Zhongxing Xu | 25e695b | 2009-08-15 03:17:38 +0000 | [diff] [blame] | 1645 | &EagerlyAssumeTag, Pred->getLocationContext()), |
Ted Kremenek | 48af2a9 | 2009-02-25 22:32:02 +0000 | [diff] [blame] | 1646 | stateTrue, Pred)); |
| 1647 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1648 | |
Ted Kremenek | 48af2a9 | 2009-02-25 22:32:02 +0000 | [diff] [blame] | 1649 | // Next, assume that the condition is false. |
Ted Kremenek | 5b9bd21 | 2009-09-11 22:07:28 +0000 | [diff] [blame] | 1650 | if (const GRState *stateFalse = state->Assume(*SEV, false)) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1651 | stateFalse = stateFalse->BindExpr(Ex, |
Ted Kremenek | 0fb0bc4 | 2009-08-27 01:39:13 +0000 | [diff] [blame] | 1652 | ValMgr.makeIntVal(0U, Ex->getType())); |
Zhongxing Xu | 25e695b | 2009-08-15 03:17:38 +0000 | [diff] [blame] | 1653 | Dst.Add(Builder->generateNode(PostStmtCustom(Ex, &EagerlyAssumeTag, |
| 1654 | Pred->getLocationContext()), |
Ted Kremenek | 48af2a9 | 2009-02-25 22:32:02 +0000 | [diff] [blame] | 1655 | stateFalse, Pred)); |
| 1656 | } |
| 1657 | } |
| 1658 | else |
| 1659 | Dst.Add(Pred); |
| 1660 | } |
| 1661 | } |
| 1662 | |
| 1663 | //===----------------------------------------------------------------------===// |
| 1664 | // Transfer function: Objective-C ivar references. |
| 1665 | //===----------------------------------------------------------------------===// |
| 1666 | |
Zhongxing Xu | b317f8f | 2009-09-10 05:44:00 +0000 | [diff] [blame] | 1667 | void GRExprEngine::VisitObjCIvarRefExpr(ObjCIvarRefExpr* Ex, ExplodedNode* Pred, |
| 1668 | ExplodedNodeSet& Dst, bool asLValue) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1669 | |
Ted Kremenek | 97ed4f6 | 2008-10-17 00:03:18 +0000 | [diff] [blame] | 1670 | Expr* Base = cast<Expr>(Ex->getBase()); |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 1671 | ExplodedNodeSet Tmp; |
Ted Kremenek | 97ed4f6 | 2008-10-17 00:03:18 +0000 | [diff] [blame] | 1672 | Visit(Base, Pred, Tmp); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1673 | |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 1674 | for (ExplodedNodeSet::iterator I=Tmp.begin(), E=Tmp.end(); I!=E; ++I) { |
Ted Kremenek | a8538d9 | 2009-02-13 01:45:31 +0000 | [diff] [blame] | 1675 | const GRState* state = GetState(*I); |
Ted Kremenek | 3ff1259 | 2009-06-19 17:10:32 +0000 | [diff] [blame] | 1676 | SVal BaseVal = state->getSVal(Base); |
| 1677 | SVal location = state->getLValue(Ex->getDecl(), BaseVal); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1678 | |
Ted Kremenek | 97ed4f6 | 2008-10-17 00:03:18 +0000 | [diff] [blame] | 1679 | if (asLValue) |
Ted Kremenek | 8e02934 | 2009-08-27 22:17:37 +0000 | [diff] [blame] | 1680 | MakeNode(Dst, Ex, *I, state->BindExpr(Ex, location)); |
Ted Kremenek | 97ed4f6 | 2008-10-17 00:03:18 +0000 | [diff] [blame] | 1681 | else |
Ted Kremenek | a8538d9 | 2009-02-13 01:45:31 +0000 | [diff] [blame] | 1682 | EvalLoad(Dst, Ex, *I, state, location); |
Ted Kremenek | 97ed4f6 | 2008-10-17 00:03:18 +0000 | [diff] [blame] | 1683 | } |
| 1684 | } |
| 1685 | |
| 1686 | //===----------------------------------------------------------------------===// |
Ted Kremenek | af33741 | 2008-11-12 19:24:17 +0000 | [diff] [blame] | 1687 | // Transfer function: Objective-C fast enumeration 'for' statements. |
| 1688 | //===----------------------------------------------------------------------===// |
| 1689 | |
| 1690 | void GRExprEngine::VisitObjCForCollectionStmt(ObjCForCollectionStmt* S, |
Zhongxing Xu | b317f8f | 2009-09-10 05:44:00 +0000 | [diff] [blame] | 1691 | ExplodedNode* Pred, ExplodedNodeSet& Dst) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1692 | |
Ted Kremenek | af33741 | 2008-11-12 19:24:17 +0000 | [diff] [blame] | 1693 | // ObjCForCollectionStmts are processed in two places. This method |
| 1694 | // handles the case where an ObjCForCollectionStmt* occurs as one of the |
| 1695 | // statements within a basic block. This transfer function does two things: |
| 1696 | // |
| 1697 | // (1) binds the next container value to 'element'. This creates a new |
| 1698 | // node in the ExplodedGraph. |
| 1699 | // |
| 1700 | // (2) binds the value 0/1 to the ObjCForCollectionStmt* itself, indicating |
| 1701 | // whether or not the container has any more elements. This value |
| 1702 | // will be tested in ProcessBranch. We need to explicitly bind |
| 1703 | // this value because a container can contain nil elements. |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1704 | // |
Ted Kremenek | af33741 | 2008-11-12 19:24:17 +0000 | [diff] [blame] | 1705 | // FIXME: Eventually this logic should actually do dispatches to |
| 1706 | // 'countByEnumeratingWithState:objects:count:' (NSFastEnumeration). |
| 1707 | // This will require simulating a temporary NSFastEnumerationState, either |
| 1708 | // through an SVal or through the use of MemRegions. This value can |
| 1709 | // be affixed to the ObjCForCollectionStmt* instead of 0/1; when the loop |
| 1710 | // terminates we reclaim the temporary (it goes out of scope) and we |
| 1711 | // we can test if the SVal is 0 or if the MemRegion is null (depending |
| 1712 | // on what approach we take). |
| 1713 | // |
| 1714 | // For now: simulate (1) by assigning either a symbol or nil if the |
| 1715 | // container is empty. Thus this transfer function will by default |
| 1716 | // result in state splitting. |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1717 | |
Ted Kremenek | 06fb99f | 2008-11-14 19:47:18 +0000 | [diff] [blame] | 1718 | Stmt* elem = S->getElement(); |
| 1719 | SVal ElementV; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1720 | |
Ted Kremenek | af33741 | 2008-11-12 19:24:17 +0000 | [diff] [blame] | 1721 | if (DeclStmt* DS = dyn_cast<DeclStmt>(elem)) { |
Chris Lattner | 7e24e82 | 2009-03-28 06:33:19 +0000 | [diff] [blame] | 1722 | VarDecl* ElemD = cast<VarDecl>(DS->getSingleDecl()); |
Ted Kremenek | af33741 | 2008-11-12 19:24:17 +0000 | [diff] [blame] | 1723 | assert (ElemD->getInit() == 0); |
Ted Kremenek | d17da2b | 2009-08-21 22:28:32 +0000 | [diff] [blame] | 1724 | ElementV = GetState(Pred)->getLValue(ElemD, Pred->getLocationContext()); |
Ted Kremenek | 06fb99f | 2008-11-14 19:47:18 +0000 | [diff] [blame] | 1725 | VisitObjCForCollectionStmtAux(S, Pred, Dst, ElementV); |
| 1726 | return; |
Ted Kremenek | af33741 | 2008-11-12 19:24:17 +0000 | [diff] [blame] | 1727 | } |
Ted Kremenek | 06fb99f | 2008-11-14 19:47:18 +0000 | [diff] [blame] | 1728 | |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 1729 | ExplodedNodeSet Tmp; |
Ted Kremenek | 06fb99f | 2008-11-14 19:47:18 +0000 | [diff] [blame] | 1730 | VisitLValue(cast<Expr>(elem), Pred, Tmp); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1731 | |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 1732 | for (ExplodedNodeSet::iterator I = Tmp.begin(), E = Tmp.end(); I!=E; ++I) { |
Ted Kremenek | 06fb99f | 2008-11-14 19:47:18 +0000 | [diff] [blame] | 1733 | const GRState* state = GetState(*I); |
Ted Kremenek | 3ff1259 | 2009-06-19 17:10:32 +0000 | [diff] [blame] | 1734 | VisitObjCForCollectionStmtAux(S, *I, Dst, state->getSVal(elem)); |
Ted Kremenek | 06fb99f | 2008-11-14 19:47:18 +0000 | [diff] [blame] | 1735 | } |
| 1736 | } |
| 1737 | |
| 1738 | void GRExprEngine::VisitObjCForCollectionStmtAux(ObjCForCollectionStmt* S, |
Zhongxing Xu | b317f8f | 2009-09-10 05:44:00 +0000 | [diff] [blame] | 1739 | ExplodedNode* Pred, ExplodedNodeSet& Dst, |
Ted Kremenek | 06fb99f | 2008-11-14 19:47:18 +0000 | [diff] [blame] | 1740 | SVal ElementV) { |
Ted Kremenek | 06fb99f | 2008-11-14 19:47:18 +0000 | [diff] [blame] | 1741 | |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1742 | |
| 1743 | |
Ted Kremenek | 06fb99f | 2008-11-14 19:47:18 +0000 | [diff] [blame] | 1744 | // Get the current state. Use 'EvalLocation' to determine if it is a null |
| 1745 | // pointer, etc. |
| 1746 | Stmt* elem = S->getElement(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1747 | |
Ted Kremenek | 8c35475 | 2008-12-16 22:02:27 +0000 | [diff] [blame] | 1748 | Pred = EvalLocation(elem, Pred, GetState(Pred), ElementV); |
| 1749 | if (!Pred) |
Ted Kremenek | 06fb99f | 2008-11-14 19:47:18 +0000 | [diff] [blame] | 1750 | return; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1751 | |
Ted Kremenek | b65be70 | 2009-06-18 01:23:53 +0000 | [diff] [blame] | 1752 | const GRState *state = GetState(Pred); |
Ted Kremenek | 06fb99f | 2008-11-14 19:47:18 +0000 | [diff] [blame] | 1753 | |
Ted Kremenek | af33741 | 2008-11-12 19:24:17 +0000 | [diff] [blame] | 1754 | // Handle the case where the container still has elements. |
Zhongxing Xu | d91ee27 | 2009-06-23 09:02:15 +0000 | [diff] [blame] | 1755 | SVal TrueV = ValMgr.makeTruthVal(1); |
Ted Kremenek | 8e02934 | 2009-08-27 22:17:37 +0000 | [diff] [blame] | 1756 | const GRState *hasElems = state->BindExpr(S, TrueV); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1757 | |
Ted Kremenek | af33741 | 2008-11-12 19:24:17 +0000 | [diff] [blame] | 1758 | // Handle the case where the container has no elements. |
Zhongxing Xu | d91ee27 | 2009-06-23 09:02:15 +0000 | [diff] [blame] | 1759 | SVal FalseV = ValMgr.makeTruthVal(0); |
Ted Kremenek | 8e02934 | 2009-08-27 22:17:37 +0000 | [diff] [blame] | 1760 | const GRState *noElems = state->BindExpr(S, FalseV); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1761 | |
Ted Kremenek | 06fb99f | 2008-11-14 19:47:18 +0000 | [diff] [blame] | 1762 | if (loc::MemRegionVal* MV = dyn_cast<loc::MemRegionVal>(&ElementV)) |
| 1763 | if (const TypedRegion* R = dyn_cast<TypedRegion>(MV->getRegion())) { |
| 1764 | // FIXME: The proper thing to do is to really iterate over the |
| 1765 | // container. We will do this with dispatch logic to the store. |
| 1766 | // For now, just 'conjure' up a symbolic value. |
Zhongxing Xu | a82d8aa | 2009-05-09 03:57:34 +0000 | [diff] [blame] | 1767 | QualType T = R->getValueType(getContext()); |
Ted Kremenek | 06fb99f | 2008-11-14 19:47:18 +0000 | [diff] [blame] | 1768 | assert (Loc::IsLocType(T)); |
| 1769 | unsigned Count = Builder->getCurrentBlockCount(); |
Zhongxing Xu | ea7c5ce | 2009-04-09 06:49:52 +0000 | [diff] [blame] | 1770 | SymbolRef Sym = SymMgr.getConjuredSymbol(elem, T, Count); |
Zhongxing Xu | d91ee27 | 2009-06-23 09:02:15 +0000 | [diff] [blame] | 1771 | SVal V = ValMgr.makeLoc(Sym); |
Ted Kremenek | b65be70 | 2009-06-18 01:23:53 +0000 | [diff] [blame] | 1772 | hasElems = hasElems->bindLoc(ElementV, V); |
Ted Kremenek | 116ed0a | 2008-11-12 21:12:46 +0000 | [diff] [blame] | 1773 | |
Ted Kremenek | 06fb99f | 2008-11-14 19:47:18 +0000 | [diff] [blame] | 1774 | // Bind the location to 'nil' on the false branch. |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1775 | SVal nilV = ValMgr.makeIntVal(0, T); |
| 1776 | noElems = noElems->bindLoc(ElementV, nilV); |
Ted Kremenek | 06fb99f | 2008-11-14 19:47:18 +0000 | [diff] [blame] | 1777 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1778 | |
Ted Kremenek | 116ed0a | 2008-11-12 21:12:46 +0000 | [diff] [blame] | 1779 | // Create the new nodes. |
| 1780 | MakeNode(Dst, S, Pred, hasElems); |
| 1781 | MakeNode(Dst, S, Pred, noElems); |
Ted Kremenek | af33741 | 2008-11-12 19:24:17 +0000 | [diff] [blame] | 1782 | } |
| 1783 | |
| 1784 | //===----------------------------------------------------------------------===// |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 1785 | // Transfer function: Objective-C message expressions. |
| 1786 | //===----------------------------------------------------------------------===// |
| 1787 | |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 1788 | void GRExprEngine::VisitObjCMessageExpr(ObjCMessageExpr* ME, ExplodedNode* Pred, |
| 1789 | ExplodedNodeSet& Dst){ |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1790 | |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 1791 | VisitObjCMessageExprArgHelper(ME, ME->arg_begin(), ME->arg_end(), |
| 1792 | Pred, Dst); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1793 | } |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 1794 | |
| 1795 | void GRExprEngine::VisitObjCMessageExprArgHelper(ObjCMessageExpr* ME, |
Zhongxing Xu | d3118bd | 2008-10-31 07:26:14 +0000 | [diff] [blame] | 1796 | ObjCMessageExpr::arg_iterator AI, |
| 1797 | ObjCMessageExpr::arg_iterator AE, |
Zhongxing Xu | b317f8f | 2009-09-10 05:44:00 +0000 | [diff] [blame] | 1798 | ExplodedNode* Pred, ExplodedNodeSet& Dst) { |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 1799 | if (AI == AE) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1800 | |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 1801 | // Process the receiver. |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1802 | |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 1803 | if (Expr* Receiver = ME->getReceiver()) { |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 1804 | ExplodedNodeSet Tmp; |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 1805 | Visit(Receiver, Pred, Tmp); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1806 | |
Zhongxing Xu | b317f8f | 2009-09-10 05:44:00 +0000 | [diff] [blame] | 1807 | for (ExplodedNodeSet::iterator NI = Tmp.begin(), NE = Tmp.end(); NI != NE; |
| 1808 | ++NI) |
Daniel Dunbar | 3629255 | 2009-07-23 04:41:06 +0000 | [diff] [blame] | 1809 | VisitObjCMessageExprDispatchHelper(ME, *NI, Dst); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1810 | |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 1811 | return; |
| 1812 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1813 | |
Daniel Dunbar | 3629255 | 2009-07-23 04:41:06 +0000 | [diff] [blame] | 1814 | VisitObjCMessageExprDispatchHelper(ME, Pred, Dst); |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 1815 | return; |
| 1816 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1817 | |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 1818 | ExplodedNodeSet Tmp; |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 1819 | Visit(*AI, Pred, Tmp); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1820 | |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 1821 | ++AI; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1822 | |
Zhongxing Xu | b317f8f | 2009-09-10 05:44:00 +0000 | [diff] [blame] | 1823 | for (ExplodedNodeSet::iterator NI = Tmp.begin(), NE = Tmp.end();NI != NE;++NI) |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 1824 | VisitObjCMessageExprArgHelper(ME, AI, AE, *NI, Dst); |
| 1825 | } |
| 1826 | |
| 1827 | void GRExprEngine::VisitObjCMessageExprDispatchHelper(ObjCMessageExpr* ME, |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 1828 | ExplodedNode* Pred, |
| 1829 | ExplodedNodeSet& Dst) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1830 | |
| 1831 | // FIXME: More logic for the processing the method call. |
| 1832 | |
Ted Kremenek | a8538d9 | 2009-02-13 01:45:31 +0000 | [diff] [blame] | 1833 | const GRState* state = GetState(Pred); |
Ted Kremenek | e448ab4 | 2008-05-01 18:33:28 +0000 | [diff] [blame] | 1834 | bool RaisesException = false; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1835 | |
| 1836 | |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 1837 | if (Expr* Receiver = ME->getReceiver()) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1838 | |
Ted Kremenek | 5b9bd21 | 2009-09-11 22:07:28 +0000 | [diff] [blame] | 1839 | SVal L_untested = state->getSVal(Receiver); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1840 | |
| 1841 | // Check for undefined control-flow. |
Ted Kremenek | 5b9bd21 | 2009-09-11 22:07:28 +0000 | [diff] [blame] | 1842 | if (L_untested.isUndef()) { |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 1843 | ExplodedNode* N = Builder->generateNode(ME, state, Pred); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1844 | |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 1845 | if (N) { |
| 1846 | N->markAsSink(); |
| 1847 | UndefReceivers.insert(N); |
| 1848 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1849 | |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 1850 | return; |
| 1851 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1852 | |
| 1853 | // "Assume" that the receiver is not NULL. |
Ted Kremenek | 5b9bd21 | 2009-09-11 22:07:28 +0000 | [diff] [blame] | 1854 | DefinedOrUnknownSVal L = cast<DefinedOrUnknownSVal>(L_untested); |
| 1855 | const GRState *StNotNull = state->Assume(L, true); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1856 | |
| 1857 | // "Assume" that the receiver is NULL. |
Ted Kremenek | 5b9bd21 | 2009-09-11 22:07:28 +0000 | [diff] [blame] | 1858 | const GRState *StNull = state->Assume(L, false); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1859 | |
Ted Kremenek | a591bc0 | 2009-06-18 22:57:13 +0000 | [diff] [blame] | 1860 | if (StNull) { |
Ted Kremenek | fe630b9 | 2009-04-09 05:45:56 +0000 | [diff] [blame] | 1861 | QualType RetTy = ME->getType(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1862 | |
Ted Kremenek | 21fe837 | 2009-02-19 04:06:22 +0000 | [diff] [blame] | 1863 | // Check if the receiver was nil and the return value a struct. |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1864 | if (RetTy->isRecordType()) { |
Zhongxing Xu | b317f8f | 2009-09-10 05:44:00 +0000 | [diff] [blame] | 1865 | if (Pred->getParentMap().isConsumedExpr(ME)) { |
Ted Kremenek | 899b3de | 2009-04-08 03:07:17 +0000 | [diff] [blame] | 1866 | // The [0 ...] expressions will return garbage. Flag either an |
| 1867 | // explicit or implicit error. Because of the structure of this |
| 1868 | // function we currently do not bifurfacte the state graph at |
| 1869 | // this point. |
| 1870 | // FIXME: We should bifurcate and fill the returned struct with |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1871 | // garbage. |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 1872 | if (ExplodedNode* N = Builder->generateNode(ME, StNull, Pred)) { |
Ted Kremenek | 899b3de | 2009-04-08 03:07:17 +0000 | [diff] [blame] | 1873 | N->markAsSink(); |
Ted Kremenek | a591bc0 | 2009-06-18 22:57:13 +0000 | [diff] [blame] | 1874 | if (StNotNull) |
Ted Kremenek | 899b3de | 2009-04-08 03:07:17 +0000 | [diff] [blame] | 1875 | NilReceiverStructRetImplicit.insert(N); |
Ted Kremenek | f8769c8 | 2009-04-09 06:02:06 +0000 | [diff] [blame] | 1876 | else |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1877 | NilReceiverStructRetExplicit.insert(N); |
Ted Kremenek | 899b3de | 2009-04-08 03:07:17 +0000 | [diff] [blame] | 1878 | } |
| 1879 | } |
Ted Kremenek | e8dbf06 | 2009-04-09 00:00:02 +0000 | [diff] [blame] | 1880 | } |
Ted Kremenek | fe630b9 | 2009-04-09 05:45:56 +0000 | [diff] [blame] | 1881 | else { |
Ted Kremenek | e8dbf06 | 2009-04-09 00:00:02 +0000 | [diff] [blame] | 1882 | ASTContext& Ctx = getContext(); |
Ted Kremenek | fe630b9 | 2009-04-09 05:45:56 +0000 | [diff] [blame] | 1883 | if (RetTy != Ctx.VoidTy) { |
Zhongxing Xu | b317f8f | 2009-09-10 05:44:00 +0000 | [diff] [blame] | 1884 | if (Pred->getParentMap().isConsumedExpr(ME)) { |
Ted Kremenek | fe630b9 | 2009-04-09 05:45:56 +0000 | [diff] [blame] | 1885 | // sizeof(void *) |
| 1886 | const uint64_t voidPtrSize = Ctx.getTypeSize(Ctx.VoidPtrTy); |
| 1887 | // sizeof(return type) |
| 1888 | const uint64_t returnTypeSize = Ctx.getTypeSize(ME->getType()); |
Ted Kremenek | e8dbf06 | 2009-04-09 00:00:02 +0000 | [diff] [blame] | 1889 | |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1890 | if (voidPtrSize < returnTypeSize) { |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 1891 | if (ExplodedNode* N = Builder->generateNode(ME, StNull, Pred)) { |
Ted Kremenek | fe630b9 | 2009-04-09 05:45:56 +0000 | [diff] [blame] | 1892 | N->markAsSink(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1893 | if (StNotNull) |
Ted Kremenek | fe630b9 | 2009-04-09 05:45:56 +0000 | [diff] [blame] | 1894 | NilReceiverLargerThanVoidPtrRetImplicit.insert(N); |
Ted Kremenek | f8769c8 | 2009-04-09 06:02:06 +0000 | [diff] [blame] | 1895 | else |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1896 | NilReceiverLargerThanVoidPtrRetExplicit.insert(N); |
Ted Kremenek | fe630b9 | 2009-04-09 05:45:56 +0000 | [diff] [blame] | 1897 | } |
| 1898 | } |
Ted Kremenek | a591bc0 | 2009-06-18 22:57:13 +0000 | [diff] [blame] | 1899 | else if (!StNotNull) { |
Ted Kremenek | fe630b9 | 2009-04-09 05:45:56 +0000 | [diff] [blame] | 1900 | // Handle the safe cases where the return value is 0 if the |
| 1901 | // receiver is nil. |
| 1902 | // |
| 1903 | // FIXME: For now take the conservative approach that we only |
| 1904 | // return null values if we *know* that the receiver is nil. |
| 1905 | // This is because we can have surprises like: |
| 1906 | // |
| 1907 | // ... = [[NSScreens screens] objectAtIndex:0]; |
| 1908 | // |
| 1909 | // What can happen is that [... screens] could return nil, but |
| 1910 | // it most likely isn't nil. We should assume the semantics |
| 1911 | // of this case unless we have *a lot* more knowledge. |
| 1912 | // |
Ted Kremenek | 8e5fb28 | 2009-04-09 16:46:55 +0000 | [diff] [blame] | 1913 | SVal V = ValMgr.makeZeroVal(ME->getType()); |
Ted Kremenek | 8e02934 | 2009-08-27 22:17:37 +0000 | [diff] [blame] | 1914 | MakeNode(Dst, ME, Pred, StNull->BindExpr(ME, V)); |
Ted Kremenek | e644939 | 2009-04-09 04:06:51 +0000 | [diff] [blame] | 1915 | return; |
| 1916 | } |
Ted Kremenek | 899b3de | 2009-04-08 03:07:17 +0000 | [diff] [blame] | 1917 | } |
Ted Kremenek | e8dbf06 | 2009-04-09 00:00:02 +0000 | [diff] [blame] | 1918 | } |
Ted Kremenek | 21fe837 | 2009-02-19 04:06:22 +0000 | [diff] [blame] | 1919 | } |
Ted Kremenek | da9ae60 | 2009-04-08 18:51:08 +0000 | [diff] [blame] | 1920 | // We have handled the cases where the receiver is nil. The remainder |
Ted Kremenek | f8769c8 | 2009-04-09 06:02:06 +0000 | [diff] [blame] | 1921 | // of this method should assume that the receiver is not nil. |
| 1922 | if (!StNotNull) |
| 1923 | return; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1924 | |
Ted Kremenek | da9ae60 | 2009-04-08 18:51:08 +0000 | [diff] [blame] | 1925 | state = StNotNull; |
Ted Kremenek | 21fe837 | 2009-02-19 04:06:22 +0000 | [diff] [blame] | 1926 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1927 | |
Ted Kremenek | e448ab4 | 2008-05-01 18:33:28 +0000 | [diff] [blame] | 1928 | // Check if the "raise" message was sent. |
| 1929 | if (ME->getSelector() == RaiseSel) |
| 1930 | RaisesException = true; |
| 1931 | } |
| 1932 | else { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1933 | |
Ted Kremenek | e448ab4 | 2008-05-01 18:33:28 +0000 | [diff] [blame] | 1934 | IdentifierInfo* ClsName = ME->getClassName(); |
| 1935 | Selector S = ME->getSelector(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1936 | |
Ted Kremenek | e448ab4 | 2008-05-01 18:33:28 +0000 | [diff] [blame] | 1937 | // Check for special instance methods. |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1938 | |
| 1939 | if (!NSExceptionII) { |
Ted Kremenek | e448ab4 | 2008-05-01 18:33:28 +0000 | [diff] [blame] | 1940 | ASTContext& Ctx = getContext(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1941 | |
Ted Kremenek | e448ab4 | 2008-05-01 18:33:28 +0000 | [diff] [blame] | 1942 | NSExceptionII = &Ctx.Idents.get("NSException"); |
| 1943 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1944 | |
Ted Kremenek | e448ab4 | 2008-05-01 18:33:28 +0000 | [diff] [blame] | 1945 | if (ClsName == NSExceptionII) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1946 | |
Ted Kremenek | e448ab4 | 2008-05-01 18:33:28 +0000 | [diff] [blame] | 1947 | enum { NUM_RAISE_SELECTORS = 2 }; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1948 | |
Ted Kremenek | e448ab4 | 2008-05-01 18:33:28 +0000 | [diff] [blame] | 1949 | // Lazily create a cache of the selectors. |
| 1950 | |
| 1951 | if (!NSExceptionInstanceRaiseSelectors) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1952 | |
Ted Kremenek | e448ab4 | 2008-05-01 18:33:28 +0000 | [diff] [blame] | 1953 | ASTContext& Ctx = getContext(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1954 | |
Ted Kremenek | e448ab4 | 2008-05-01 18:33:28 +0000 | [diff] [blame] | 1955 | NSExceptionInstanceRaiseSelectors = new Selector[NUM_RAISE_SELECTORS]; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1956 | |
Ted Kremenek | e448ab4 | 2008-05-01 18:33:28 +0000 | [diff] [blame] | 1957 | llvm::SmallVector<IdentifierInfo*, NUM_RAISE_SELECTORS> II; |
| 1958 | unsigned idx = 0; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1959 | |
| 1960 | // raise:format: |
Ted Kremenek | 6ff6f8b | 2008-05-02 17:12:56 +0000 | [diff] [blame] | 1961 | II.push_back(&Ctx.Idents.get("raise")); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1962 | II.push_back(&Ctx.Idents.get("format")); |
Ted Kremenek | e448ab4 | 2008-05-01 18:33:28 +0000 | [diff] [blame] | 1963 | NSExceptionInstanceRaiseSelectors[idx++] = |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1964 | Ctx.Selectors.getSelector(II.size(), &II[0]); |
| 1965 | |
| 1966 | // raise:format::arguments: |
Ted Kremenek | 6ff6f8b | 2008-05-02 17:12:56 +0000 | [diff] [blame] | 1967 | II.push_back(&Ctx.Idents.get("arguments")); |
Ted Kremenek | e448ab4 | 2008-05-01 18:33:28 +0000 | [diff] [blame] | 1968 | NSExceptionInstanceRaiseSelectors[idx++] = |
| 1969 | Ctx.Selectors.getSelector(II.size(), &II[0]); |
| 1970 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1971 | |
Ted Kremenek | e448ab4 | 2008-05-01 18:33:28 +0000 | [diff] [blame] | 1972 | for (unsigned i = 0; i < NUM_RAISE_SELECTORS; ++i) |
| 1973 | if (S == NSExceptionInstanceRaiseSelectors[i]) { |
| 1974 | RaisesException = true; break; |
| 1975 | } |
| 1976 | } |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 1977 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1978 | |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 1979 | // Check for any arguments that are uninitialized/undefined. |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1980 | |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 1981 | for (ObjCMessageExpr::arg_iterator I = ME->arg_begin(), E = ME->arg_end(); |
| 1982 | I != E; ++I) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1983 | |
Ted Kremenek | 3ff1259 | 2009-06-19 17:10:32 +0000 | [diff] [blame] | 1984 | if (state->getSVal(*I).isUndef()) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1985 | |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 1986 | // Generate an error node for passing an uninitialized/undefined value |
| 1987 | // as an argument to a message expression. This node is a sink. |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 1988 | ExplodedNode* N = Builder->generateNode(ME, state, Pred); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1989 | |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 1990 | if (N) { |
| 1991 | N->markAsSink(); |
| 1992 | MsgExprUndefArgs[N] = *I; |
| 1993 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1994 | |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 1995 | return; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1996 | } |
Ted Kremenek | e448ab4 | 2008-05-01 18:33:28 +0000 | [diff] [blame] | 1997 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1998 | |
Ted Kremenek | e448ab4 | 2008-05-01 18:33:28 +0000 | [diff] [blame] | 1999 | // Check if we raise an exception. For now treat these as sinks. Eventually |
| 2000 | // we will want to handle exceptions properly. |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2001 | |
Ted Kremenek | e448ab4 | 2008-05-01 18:33:28 +0000 | [diff] [blame] | 2002 | SaveAndRestore<bool> OldSink(Builder->BuildSinks); |
| 2003 | |
| 2004 | if (RaisesException) |
| 2005 | Builder->BuildSinks = true; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2006 | |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 2007 | // Dispatch to plug-in transfer function. |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2008 | |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 2009 | unsigned size = Dst.size(); |
Ted Kremenek | 186350f | 2008-04-23 20:12:28 +0000 | [diff] [blame] | 2010 | SaveOr OldHasGen(Builder->HasGeneratedNode); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2011 | |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 2012 | EvalObjCMessageExpr(Dst, ME, Pred); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2013 | |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 2014 | // Handle the case where no nodes where generated. Auto-generate that |
| 2015 | // contains the updated state if we aren't generating sinks. |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2016 | |
Ted Kremenek | b053396 | 2008-04-18 20:35:30 +0000 | [diff] [blame] | 2017 | if (!Builder->BuildSinks && Dst.size() == size && !Builder->HasGeneratedNode) |
Ted Kremenek | a8538d9 | 2009-02-13 01:45:31 +0000 | [diff] [blame] | 2018 | MakeNode(Dst, ME, Pred, state); |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 2019 | } |
| 2020 | |
| 2021 | //===----------------------------------------------------------------------===// |
| 2022 | // Transfer functions: Miscellaneous statements. |
| 2023 | //===----------------------------------------------------------------------===// |
| 2024 | |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 2025 | void GRExprEngine::VisitCast(Expr* CastE, Expr* Ex, ExplodedNode* Pred, ExplodedNodeSet& Dst){ |
| 2026 | ExplodedNodeSet S1; |
Ted Kremenek | 5d3003a | 2008-02-19 18:52:54 +0000 | [diff] [blame] | 2027 | QualType T = CastE->getType(); |
Zhongxing Xu | 933c3e1 | 2008-10-21 06:54:23 +0000 | [diff] [blame] | 2028 | QualType ExTy = Ex->getType(); |
Zhongxing Xu | ed340f7 | 2008-10-22 08:02:16 +0000 | [diff] [blame] | 2029 | |
Zhongxing Xu | d3118bd | 2008-10-31 07:26:14 +0000 | [diff] [blame] | 2030 | if (const ExplicitCastExpr *ExCast=dyn_cast_or_null<ExplicitCastExpr>(CastE)) |
Douglas Gregor | 49badde | 2008-10-27 19:41:14 +0000 | [diff] [blame] | 2031 | T = ExCast->getTypeAsWritten(); |
| 2032 | |
Zhongxing Xu | ed340f7 | 2008-10-22 08:02:16 +0000 | [diff] [blame] | 2033 | if (ExTy->isArrayType() || ExTy->isFunctionType() || T->isReferenceType()) |
Zhongxing Xu | 6d69b5d | 2008-10-16 06:09:51 +0000 | [diff] [blame] | 2034 | VisitLValue(Ex, Pred, S1); |
Ted Kremenek | 65cfb73 | 2008-03-04 22:16:08 +0000 | [diff] [blame] | 2035 | else |
| 2036 | Visit(Ex, Pred, S1); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2037 | |
Ted Kremenek | 0fe33bc | 2008-04-22 21:10:18 +0000 | [diff] [blame] | 2038 | // Check for casting to "void". |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2039 | if (T->isVoidType()) { |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 2040 | for (ExplodedNodeSet::iterator I1 = S1.begin(), E1 = S1.end(); I1 != E1; ++I1) |
Ted Kremenek | 5d3003a | 2008-02-19 18:52:54 +0000 | [diff] [blame] | 2041 | Dst.Add(*I1); |
| 2042 | |
Ted Kremenek | 874d63f | 2008-01-24 02:02:54 +0000 | [diff] [blame] | 2043 | return; |
| 2044 | } |
Ted Kremenek | 32c3fa4 | 2009-07-21 21:03:30 +0000 | [diff] [blame] | 2045 | |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 2046 | for (ExplodedNodeSet::iterator I1 = S1.begin(), E1 = S1.end(); I1 != E1; ++I1) { |
| 2047 | ExplodedNode* N = *I1; |
Ted Kremenek | a8538d9 | 2009-02-13 01:45:31 +0000 | [diff] [blame] | 2048 | const GRState* state = GetState(N); |
Ted Kremenek | 3ff1259 | 2009-06-19 17:10:32 +0000 | [diff] [blame] | 2049 | SVal V = state->getSVal(Ex); |
Ted Kremenek | 32c3fa4 | 2009-07-21 21:03:30 +0000 | [diff] [blame] | 2050 | const SValuator::CastResult &Res = SVator.EvalCast(V, state, T, ExTy); |
Ted Kremenek | 8e02934 | 2009-08-27 22:17:37 +0000 | [diff] [blame] | 2051 | state = Res.getState()->BindExpr(CastE, Res.getSVal()); |
Ted Kremenek | 32c3fa4 | 2009-07-21 21:03:30 +0000 | [diff] [blame] | 2052 | MakeNode(Dst, CastE, N, state); |
Ted Kremenek | 874d63f | 2008-01-24 02:02:54 +0000 | [diff] [blame] | 2053 | } |
Ted Kremenek | 9de04c4 | 2008-01-24 20:55:43 +0000 | [diff] [blame] | 2054 | } |
| 2055 | |
Ted Kremenek | 4f09027 | 2008-10-27 21:54:31 +0000 | [diff] [blame] | 2056 | void GRExprEngine::VisitCompoundLiteralExpr(CompoundLiteralExpr* CL, |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2057 | ExplodedNode* Pred, |
| 2058 | ExplodedNodeSet& Dst, |
Zhongxing Xu | f22679e | 2008-11-07 10:38:33 +0000 | [diff] [blame] | 2059 | bool asLValue) { |
Ted Kremenek | 4f09027 | 2008-10-27 21:54:31 +0000 | [diff] [blame] | 2060 | InitListExpr* ILE = cast<InitListExpr>(CL->getInitializer()->IgnoreParens()); |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 2061 | ExplodedNodeSet Tmp; |
Ted Kremenek | 4f09027 | 2008-10-27 21:54:31 +0000 | [diff] [blame] | 2062 | Visit(ILE, Pred, Tmp); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2063 | |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 2064 | for (ExplodedNodeSet::iterator I = Tmp.begin(), EI = Tmp.end(); I!=EI; ++I) { |
Ted Kremenek | a8538d9 | 2009-02-13 01:45:31 +0000 | [diff] [blame] | 2065 | const GRState* state = GetState(*I); |
Ted Kremenek | 3ff1259 | 2009-06-19 17:10:32 +0000 | [diff] [blame] | 2066 | SVal ILV = state->getSVal(ILE); |
| 2067 | state = state->bindCompoundLiteral(CL, ILV); |
Ted Kremenek | 4f09027 | 2008-10-27 21:54:31 +0000 | [diff] [blame] | 2068 | |
Zhongxing Xu | f22679e | 2008-11-07 10:38:33 +0000 | [diff] [blame] | 2069 | if (asLValue) |
Ted Kremenek | 8e02934 | 2009-08-27 22:17:37 +0000 | [diff] [blame] | 2070 | MakeNode(Dst, CL, *I, state->BindExpr(CL, state->getLValue(CL))); |
Zhongxing Xu | f22679e | 2008-11-07 10:38:33 +0000 | [diff] [blame] | 2071 | else |
Ted Kremenek | 8e02934 | 2009-08-27 22:17:37 +0000 | [diff] [blame] | 2072 | MakeNode(Dst, CL, *I, state->BindExpr(CL, ILV)); |
Ted Kremenek | 4f09027 | 2008-10-27 21:54:31 +0000 | [diff] [blame] | 2073 | } |
| 2074 | } |
| 2075 | |
Ted Kremenek | d17da2b | 2009-08-21 22:28:32 +0000 | [diff] [blame] | 2076 | void GRExprEngine::VisitDeclStmt(DeclStmt *DS, ExplodedNode *Pred, |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2077 | ExplodedNodeSet& Dst) { |
Ted Kremenek | 5b7dcce | 2008-04-22 22:25:27 +0000 | [diff] [blame] | 2078 | |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2079 | // The CFG has one DeclStmt per Decl. |
Douglas Gregor | 4afa39d | 2009-01-20 01:17:11 +0000 | [diff] [blame] | 2080 | Decl* D = *DS->decl_begin(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2081 | |
Ted Kremenek | e6c62e3 | 2008-08-28 18:34:26 +0000 | [diff] [blame] | 2082 | if (!D || !isa<VarDecl>(D)) |
Ted Kremenek | 5b7dcce | 2008-04-22 22:25:27 +0000 | [diff] [blame] | 2083 | return; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2084 | |
| 2085 | const VarDecl* VD = dyn_cast<VarDecl>(D); |
Ted Kremenek | af33741 | 2008-11-12 19:24:17 +0000 | [diff] [blame] | 2086 | Expr* InitEx = const_cast<Expr*>(VD->getInit()); |
Ted Kremenek | 5b7dcce | 2008-04-22 22:25:27 +0000 | [diff] [blame] | 2087 | |
| 2088 | // FIXME: static variables may have an initializer, but the second |
| 2089 | // time a function is called those values may not be current. |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 2090 | ExplodedNodeSet Tmp; |
Ted Kremenek | 5b7dcce | 2008-04-22 22:25:27 +0000 | [diff] [blame] | 2091 | |
Ted Kremenek | af33741 | 2008-11-12 19:24:17 +0000 | [diff] [blame] | 2092 | if (InitEx) |
| 2093 | Visit(InitEx, Pred, Tmp); |
Ted Kremenek | 1152fc0 | 2009-07-17 23:48:26 +0000 | [diff] [blame] | 2094 | else |
Ted Kremenek | e6c62e3 | 2008-08-28 18:34:26 +0000 | [diff] [blame] | 2095 | Tmp.Add(Pred); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2096 | |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 2097 | for (ExplodedNodeSet::iterator I=Tmp.begin(), E=Tmp.end(); I!=E; ++I) { |
Ted Kremenek | a8538d9 | 2009-02-13 01:45:31 +0000 | [diff] [blame] | 2098 | const GRState* state = GetState(*I); |
Ted Kremenek | af33741 | 2008-11-12 19:24:17 +0000 | [diff] [blame] | 2099 | unsigned Count = Builder->getCurrentBlockCount(); |
Zhongxing Xu | 4193eca | 2008-12-20 06:32:12 +0000 | [diff] [blame] | 2100 | |
Ted Kremenek | 5b8d901 | 2009-02-14 01:54:57 +0000 | [diff] [blame] | 2101 | // Check if 'VD' is a VLA and if so check if has a non-zero size. |
| 2102 | QualType T = getContext().getCanonicalType(VD->getType()); |
| 2103 | if (VariableArrayType* VLA = dyn_cast<VariableArrayType>(T)) { |
| 2104 | // FIXME: Handle multi-dimensional VLAs. |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2105 | |
Ted Kremenek | 5b8d901 | 2009-02-14 01:54:57 +0000 | [diff] [blame] | 2106 | Expr* SE = VLA->getSizeExpr(); |
Ted Kremenek | 5b9bd21 | 2009-09-11 22:07:28 +0000 | [diff] [blame] | 2107 | SVal Size_untested = state->getSVal(SE); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2108 | |
Ted Kremenek | 5b9bd21 | 2009-09-11 22:07:28 +0000 | [diff] [blame] | 2109 | if (Size_untested.isUndef()) { |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 2110 | if (ExplodedNode* N = Builder->generateNode(DS, state, Pred)) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2111 | N->markAsSink(); |
Ted Kremenek | 5b8d901 | 2009-02-14 01:54:57 +0000 | [diff] [blame] | 2112 | ExplicitBadSizedVLA.insert(N); |
| 2113 | } |
| 2114 | continue; |
| 2115 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2116 | |
Ted Kremenek | 5b9bd21 | 2009-09-11 22:07:28 +0000 | [diff] [blame] | 2117 | DefinedOrUnknownSVal Size = cast<DefinedOrUnknownSVal>(Size_untested); |
| 2118 | const GRState *zeroState = state->Assume(Size, false); |
| 2119 | state = state->Assume(Size, true); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2120 | |
Ted Kremenek | a591bc0 | 2009-06-18 22:57:13 +0000 | [diff] [blame] | 2121 | if (zeroState) { |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 2122 | if (ExplodedNode* N = Builder->generateNode(DS, zeroState, Pred)) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2123 | N->markAsSink(); |
Ted Kremenek | a591bc0 | 2009-06-18 22:57:13 +0000 | [diff] [blame] | 2124 | if (state) |
| 2125 | ImplicitBadSizedVLA.insert(N); |
| 2126 | else |
| 2127 | ExplicitBadSizedVLA.insert(N); |
Ted Kremenek | 5b8d901 | 2009-02-14 01:54:57 +0000 | [diff] [blame] | 2128 | } |
| 2129 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2130 | |
Ted Kremenek | a591bc0 | 2009-06-18 22:57:13 +0000 | [diff] [blame] | 2131 | if (!state) |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2132 | continue; |
Ted Kremenek | 5b8d901 | 2009-02-14 01:54:57 +0000 | [diff] [blame] | 2133 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2134 | |
Zhongxing Xu | 4193eca | 2008-12-20 06:32:12 +0000 | [diff] [blame] | 2135 | // Decls without InitExpr are not initialized explicitly. |
Ted Kremenek | d17da2b | 2009-08-21 22:28:32 +0000 | [diff] [blame] | 2136 | const LocationContext *LC = (*I)->getLocationContext(); |
| 2137 | |
Ted Kremenek | af33741 | 2008-11-12 19:24:17 +0000 | [diff] [blame] | 2138 | if (InitEx) { |
Ted Kremenek | 3ff1259 | 2009-06-19 17:10:32 +0000 | [diff] [blame] | 2139 | SVal InitVal = state->getSVal(InitEx); |
Ted Kremenek | af33741 | 2008-11-12 19:24:17 +0000 | [diff] [blame] | 2140 | QualType T = VD->getType(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2141 | |
Ted Kremenek | af33741 | 2008-11-12 19:24:17 +0000 | [diff] [blame] | 2142 | // Recover some path-sensitivity if a scalar value evaluated to |
| 2143 | // UnknownVal. |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2144 | if (InitVal.isUnknown() || |
Ted Kremenek | 276c6ac | 2009-03-11 02:24:48 +0000 | [diff] [blame] | 2145 | !getConstraintManager().canReasonAbout(InitVal)) { |
Ted Kremenek | 8780679 | 2009-09-27 20:45:21 +0000 | [diff] [blame] | 2146 | InitVal = ValMgr.getConjuredSymbolVal(NULL, InitEx, Count); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2147 | } |
| 2148 | |
Ted Kremenek | d17da2b | 2009-08-21 22:28:32 +0000 | [diff] [blame] | 2149 | state = state->bindDecl(VD, LC, InitVal); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2150 | |
Ted Kremenek | 5b8d901 | 2009-02-14 01:54:57 +0000 | [diff] [blame] | 2151 | // The next thing to do is check if the GRTransferFuncs object wants to |
| 2152 | // update the state based on the new binding. If the GRTransferFunc |
| 2153 | // object doesn't do anything, just auto-propagate the current state. |
| 2154 | GRStmtNodeBuilderRef BuilderRef(Dst, *Builder, *this, *I, state, DS,true); |
Ted Kremenek | d17da2b | 2009-08-21 22:28:32 +0000 | [diff] [blame] | 2155 | getTF().EvalBind(BuilderRef, loc::MemRegionVal(state->getRegion(VD, LC)), |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2156 | InitVal); |
| 2157 | } |
Ted Kremenek | 5b8d901 | 2009-02-14 01:54:57 +0000 | [diff] [blame] | 2158 | else { |
Ted Kremenek | d17da2b | 2009-08-21 22:28:32 +0000 | [diff] [blame] | 2159 | state = state->bindDeclWithNoInit(VD, LC); |
Ted Kremenek | 5b8d901 | 2009-02-14 01:54:57 +0000 | [diff] [blame] | 2160 | MakeNode(Dst, DS, *I, state); |
Ted Kremenek | efd5994 | 2008-12-08 22:47:34 +0000 | [diff] [blame] | 2161 | } |
Ted Kremenek | 5b7dcce | 2008-04-22 22:25:27 +0000 | [diff] [blame] | 2162 | } |
Ted Kremenek | 9de04c4 | 2008-01-24 20:55:43 +0000 | [diff] [blame] | 2163 | } |
Ted Kremenek | 874d63f | 2008-01-24 02:02:54 +0000 | [diff] [blame] | 2164 | |
Ted Kremenek | f75b186 | 2008-10-30 17:47:32 +0000 | [diff] [blame] | 2165 | namespace { |
| 2166 | // This class is used by VisitInitListExpr as an item in a worklist |
| 2167 | // for processing the values contained in an InitListExpr. |
| 2168 | class VISIBILITY_HIDDEN InitListWLItem { |
| 2169 | public: |
| 2170 | llvm::ImmutableList<SVal> Vals; |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 2171 | ExplodedNode* N; |
Ted Kremenek | f75b186 | 2008-10-30 17:47:32 +0000 | [diff] [blame] | 2172 | InitListExpr::reverse_iterator Itr; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2173 | |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 2174 | InitListWLItem(ExplodedNode* n, llvm::ImmutableList<SVal> vals, |
| 2175 | InitListExpr::reverse_iterator itr) |
Ted Kremenek | f75b186 | 2008-10-30 17:47:32 +0000 | [diff] [blame] | 2176 | : Vals(vals), N(n), Itr(itr) {} |
| 2177 | }; |
| 2178 | } |
| 2179 | |
| 2180 | |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2181 | void GRExprEngine::VisitInitListExpr(InitListExpr* E, ExplodedNode* Pred, |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 2182 | ExplodedNodeSet& Dst) { |
Ted Kremenek | a49e367 | 2008-10-30 23:14:36 +0000 | [diff] [blame] | 2183 | |
Zhongxing Xu | c4f8706 | 2008-10-30 05:02:23 +0000 | [diff] [blame] | 2184 | const GRState* state = GetState(Pred); |
Ted Kremenek | 76dba7b | 2008-11-13 05:05:34 +0000 | [diff] [blame] | 2185 | QualType T = getContext().getCanonicalType(E->getType()); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2186 | unsigned NumInitElements = E->getNumInits(); |
Zhongxing Xu | c4f8706 | 2008-10-30 05:02:23 +0000 | [diff] [blame] | 2187 | |
Ted Kremenek | f3bfa21 | 2009-07-28 20:46:55 +0000 | [diff] [blame] | 2188 | if (T->isArrayType() || T->isStructureType() || |
| 2189 | T->isUnionType() || T->isVectorType()) { |
Ted Kremenek | f75b186 | 2008-10-30 17:47:32 +0000 | [diff] [blame] | 2190 | |
Ted Kremenek | a49e367 | 2008-10-30 23:14:36 +0000 | [diff] [blame] | 2191 | llvm::ImmutableList<SVal> StartVals = getBasicVals().getEmptySValList(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2192 | |
Ted Kremenek | a49e367 | 2008-10-30 23:14:36 +0000 | [diff] [blame] | 2193 | // Handle base case where the initializer has no elements. |
| 2194 | // e.g: static int* myArray[] = {}; |
| 2195 | if (NumInitElements == 0) { |
Zhongxing Xu | d91ee27 | 2009-06-23 09:02:15 +0000 | [diff] [blame] | 2196 | SVal V = ValMgr.makeCompoundVal(T, StartVals); |
Ted Kremenek | 8e02934 | 2009-08-27 22:17:37 +0000 | [diff] [blame] | 2197 | MakeNode(Dst, E, Pred, state->BindExpr(E, V)); |
Ted Kremenek | a49e367 | 2008-10-30 23:14:36 +0000 | [diff] [blame] | 2198 | return; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2199 | } |
| 2200 | |
Ted Kremenek | a49e367 | 2008-10-30 23:14:36 +0000 | [diff] [blame] | 2201 | // Create a worklist to process the initializers. |
| 2202 | llvm::SmallVector<InitListWLItem, 10> WorkList; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2203 | WorkList.reserve(NumInitElements); |
| 2204 | WorkList.push_back(InitListWLItem(Pred, StartVals, E->rbegin())); |
Ted Kremenek | f75b186 | 2008-10-30 17:47:32 +0000 | [diff] [blame] | 2205 | InitListExpr::reverse_iterator ItrEnd = E->rend(); |
Ted Kremenek | cf54959 | 2009-09-22 21:19:14 +0000 | [diff] [blame] | 2206 | assert(!(E->rbegin() == E->rend())); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2207 | |
Ted Kremenek | a49e367 | 2008-10-30 23:14:36 +0000 | [diff] [blame] | 2208 | // Process the worklist until it is empty. |
Ted Kremenek | f75b186 | 2008-10-30 17:47:32 +0000 | [diff] [blame] | 2209 | while (!WorkList.empty()) { |
| 2210 | InitListWLItem X = WorkList.back(); |
| 2211 | WorkList.pop_back(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2212 | |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 2213 | ExplodedNodeSet Tmp; |
Ted Kremenek | f75b186 | 2008-10-30 17:47:32 +0000 | [diff] [blame] | 2214 | Visit(*X.Itr, X.N, Tmp); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2215 | |
Ted Kremenek | f75b186 | 2008-10-30 17:47:32 +0000 | [diff] [blame] | 2216 | InitListExpr::reverse_iterator NewItr = X.Itr + 1; |
Zhongxing Xu | c4f8706 | 2008-10-30 05:02:23 +0000 | [diff] [blame] | 2217 | |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 2218 | for (ExplodedNodeSet::iterator NI=Tmp.begin(), NE=Tmp.end(); NI!=NE; ++NI) { |
Ted Kremenek | f75b186 | 2008-10-30 17:47:32 +0000 | [diff] [blame] | 2219 | // Get the last initializer value. |
| 2220 | state = GetState(*NI); |
Ted Kremenek | 3ff1259 | 2009-06-19 17:10:32 +0000 | [diff] [blame] | 2221 | SVal InitV = state->getSVal(cast<Expr>(*X.Itr)); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2222 | |
Ted Kremenek | f75b186 | 2008-10-30 17:47:32 +0000 | [diff] [blame] | 2223 | // Construct the new list of values by prepending the new value to |
| 2224 | // the already constructed list. |
| 2225 | llvm::ImmutableList<SVal> NewVals = |
| 2226 | getBasicVals().consVals(InitV, X.Vals); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2227 | |
Ted Kremenek | f75b186 | 2008-10-30 17:47:32 +0000 | [diff] [blame] | 2228 | if (NewItr == ItrEnd) { |
Zhongxing Xu | a189dca | 2008-10-31 03:01:26 +0000 | [diff] [blame] | 2229 | // Now we have a list holding all init values. Make CompoundValData. |
Zhongxing Xu | d91ee27 | 2009-06-23 09:02:15 +0000 | [diff] [blame] | 2230 | SVal V = ValMgr.makeCompoundVal(T, NewVals); |
Zhongxing Xu | c4f8706 | 2008-10-30 05:02:23 +0000 | [diff] [blame] | 2231 | |
Ted Kremenek | f75b186 | 2008-10-30 17:47:32 +0000 | [diff] [blame] | 2232 | // Make final state and node. |
Ted Kremenek | 8e02934 | 2009-08-27 22:17:37 +0000 | [diff] [blame] | 2233 | MakeNode(Dst, E, *NI, state->BindExpr(E, V)); |
Ted Kremenek | f75b186 | 2008-10-30 17:47:32 +0000 | [diff] [blame] | 2234 | } |
| 2235 | else { |
| 2236 | // Still some initializer values to go. Push them onto the worklist. |
| 2237 | WorkList.push_back(InitListWLItem(*NI, NewVals, NewItr)); |
| 2238 | } |
| 2239 | } |
Zhongxing Xu | c4f8706 | 2008-10-30 05:02:23 +0000 | [diff] [blame] | 2240 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2241 | |
Ted Kremenek | 8790307 | 2008-10-30 18:34:31 +0000 | [diff] [blame] | 2242 | return; |
Zhongxing Xu | c4f8706 | 2008-10-30 05:02:23 +0000 | [diff] [blame] | 2243 | } |
| 2244 | |
Zhongxing Xu | c4f8706 | 2008-10-30 05:02:23 +0000 | [diff] [blame] | 2245 | if (Loc::IsLocType(T) || T->isIntegerType()) { |
| 2246 | assert (E->getNumInits() == 1); |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 2247 | ExplodedNodeSet Tmp; |
Zhongxing Xu | c4f8706 | 2008-10-30 05:02:23 +0000 | [diff] [blame] | 2248 | Expr* Init = E->getInit(0); |
| 2249 | Visit(Init, Pred, Tmp); |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 2250 | for (ExplodedNodeSet::iterator I = Tmp.begin(), EI = Tmp.end(); I != EI; ++I) { |
Zhongxing Xu | c4f8706 | 2008-10-30 05:02:23 +0000 | [diff] [blame] | 2251 | state = GetState(*I); |
Ted Kremenek | 8e02934 | 2009-08-27 22:17:37 +0000 | [diff] [blame] | 2252 | MakeNode(Dst, E, *I, state->BindExpr(E, state->getSVal(Init))); |
Zhongxing Xu | c4f8706 | 2008-10-30 05:02:23 +0000 | [diff] [blame] | 2253 | } |
| 2254 | return; |
| 2255 | } |
| 2256 | |
Zhongxing Xu | c4f8706 | 2008-10-30 05:02:23 +0000 | [diff] [blame] | 2257 | |
| 2258 | printf("InitListExpr type = %s\n", T.getAsString().c_str()); |
| 2259 | assert(0 && "unprocessed InitListExpr type"); |
| 2260 | } |
Ted Kremenek | f233d48 | 2008-02-05 00:26:40 +0000 | [diff] [blame] | 2261 | |
Sebastian Redl | 0518999 | 2008-11-11 17:56:53 +0000 | [diff] [blame] | 2262 | /// VisitSizeOfAlignOfExpr - Transfer function for sizeof(type). |
| 2263 | void GRExprEngine::VisitSizeOfAlignOfExpr(SizeOfAlignOfExpr* Ex, |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 2264 | ExplodedNode* Pred, |
| 2265 | ExplodedNodeSet& Dst) { |
Sebastian Redl | 0518999 | 2008-11-11 17:56:53 +0000 | [diff] [blame] | 2266 | QualType T = Ex->getTypeOfArgument(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2267 | uint64_t amt; |
| 2268 | |
Ted Kremenek | 87e8034 | 2008-03-15 03:13:20 +0000 | [diff] [blame] | 2269 | if (Ex->isSizeOf()) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2270 | if (T == getContext().VoidTy) { |
Ted Kremenek | 55f7bcb | 2008-12-15 18:51:00 +0000 | [diff] [blame] | 2271 | // sizeof(void) == 1 byte. |
| 2272 | amt = 1; |
| 2273 | } |
| 2274 | else if (!T.getTypePtr()->isConstantSizeType()) { |
| 2275 | // FIXME: Add support for VLAs. |
Ted Kremenek | 87e8034 | 2008-03-15 03:13:20 +0000 | [diff] [blame] | 2276 | return; |
Ted Kremenek | 55f7bcb | 2008-12-15 18:51:00 +0000 | [diff] [blame] | 2277 | } |
| 2278 | else if (T->isObjCInterfaceType()) { |
| 2279 | // Some code tries to take the sizeof an ObjCInterfaceType, relying that |
| 2280 | // the compiler has laid out its representation. Just report Unknown |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2281 | // for these. |
Ted Kremenek | f342d18 | 2008-04-30 21:31:12 +0000 | [diff] [blame] | 2282 | return; |
Ted Kremenek | 55f7bcb | 2008-12-15 18:51:00 +0000 | [diff] [blame] | 2283 | } |
| 2284 | else { |
| 2285 | // All other cases. |
Ted Kremenek | 87e8034 | 2008-03-15 03:13:20 +0000 | [diff] [blame] | 2286 | amt = getContext().getTypeSize(T) / 8; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2287 | } |
Ted Kremenek | 87e8034 | 2008-03-15 03:13:20 +0000 | [diff] [blame] | 2288 | } |
| 2289 | else // Get alignment of the type. |
Ted Kremenek | 897781a | 2008-03-15 03:13:55 +0000 | [diff] [blame] | 2290 | amt = getContext().getTypeAlign(T) / 8; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2291 | |
Ted Kremenek | 0e561a3 | 2008-03-21 21:30:14 +0000 | [diff] [blame] | 2292 | MakeNode(Dst, Ex, Pred, |
Ted Kremenek | 8e02934 | 2009-08-27 22:17:37 +0000 | [diff] [blame] | 2293 | GetState(Pred)->BindExpr(Ex, ValMgr.makeIntVal(amt, Ex->getType()))); |
Ted Kremenek | d9435bf | 2008-02-12 19:49:57 +0000 | [diff] [blame] | 2294 | } |
| 2295 | |
Ted Kremenek | d8e9f0d | 2008-02-20 04:02:35 +0000 | [diff] [blame] | 2296 | |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 2297 | void GRExprEngine::VisitUnaryOperator(UnaryOperator* U, ExplodedNode* Pred, |
| 2298 | ExplodedNodeSet& Dst, bool asLValue) { |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 2299 | |
Ted Kremenek | d8e9f0d | 2008-02-20 04:02:35 +0000 | [diff] [blame] | 2300 | switch (U->getOpcode()) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2301 | |
Ted Kremenek | d8e9f0d | 2008-02-20 04:02:35 +0000 | [diff] [blame] | 2302 | default: |
Ted Kremenek | d8e9f0d | 2008-02-20 04:02:35 +0000 | [diff] [blame] | 2303 | break; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2304 | |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 2305 | case UnaryOperator::Deref: { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2306 | |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 2307 | Expr* Ex = U->getSubExpr()->IgnoreParens(); |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 2308 | ExplodedNodeSet Tmp; |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 2309 | Visit(Ex, Pred, Tmp); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2310 | |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 2311 | for (ExplodedNodeSet::iterator I=Tmp.begin(), E=Tmp.end(); I!=E; ++I) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2312 | |
Ted Kremenek | a8538d9 | 2009-02-13 01:45:31 +0000 | [diff] [blame] | 2313 | const GRState* state = GetState(*I); |
Ted Kremenek | 3ff1259 | 2009-06-19 17:10:32 +0000 | [diff] [blame] | 2314 | SVal location = state->getSVal(Ex); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2315 | |
Zhongxing Xu | 6d69b5d | 2008-10-16 06:09:51 +0000 | [diff] [blame] | 2316 | if (asLValue) |
Ted Kremenek | 8e02934 | 2009-08-27 22:17:37 +0000 | [diff] [blame] | 2317 | MakeNode(Dst, U, *I, state->BindExpr(U, location), |
Ted Kremenek | 7090d54 | 2009-05-07 18:27:16 +0000 | [diff] [blame] | 2318 | ProgramPoint::PostLValueKind); |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 2319 | else |
Ted Kremenek | a8538d9 | 2009-02-13 01:45:31 +0000 | [diff] [blame] | 2320 | EvalLoad(Dst, U, *I, state, location); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2321 | } |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 2322 | |
| 2323 | return; |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 2324 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2325 | |
Ted Kremenek | b8e26e6 | 2008-06-19 17:55:38 +0000 | [diff] [blame] | 2326 | case UnaryOperator::Real: { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2327 | |
Ted Kremenek | b8e26e6 | 2008-06-19 17:55:38 +0000 | [diff] [blame] | 2328 | Expr* Ex = U->getSubExpr()->IgnoreParens(); |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 2329 | ExplodedNodeSet Tmp; |
Ted Kremenek | b8e26e6 | 2008-06-19 17:55:38 +0000 | [diff] [blame] | 2330 | Visit(Ex, Pred, Tmp); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2331 | |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 2332 | for (ExplodedNodeSet::iterator I=Tmp.begin(), E=Tmp.end(); I!=E; ++I) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2333 | |
Zhongxing Xu | 1c96b24 | 2008-10-17 05:57:07 +0000 | [diff] [blame] | 2334 | // FIXME: We don't have complex SValues yet. |
Ted Kremenek | b8e26e6 | 2008-06-19 17:55:38 +0000 | [diff] [blame] | 2335 | if (Ex->getType()->isAnyComplexType()) { |
| 2336 | // Just report "Unknown." |
| 2337 | Dst.Add(*I); |
| 2338 | continue; |
| 2339 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2340 | |
Ted Kremenek | b8e26e6 | 2008-06-19 17:55:38 +0000 | [diff] [blame] | 2341 | // For all other types, UnaryOperator::Real is an identity operation. |
| 2342 | assert (U->getType() == Ex->getType()); |
Ted Kremenek | a8538d9 | 2009-02-13 01:45:31 +0000 | [diff] [blame] | 2343 | const GRState* state = GetState(*I); |
Ted Kremenek | 8e02934 | 2009-08-27 22:17:37 +0000 | [diff] [blame] | 2344 | MakeNode(Dst, U, *I, state->BindExpr(U, state->getSVal(Ex))); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2345 | } |
| 2346 | |
Ted Kremenek | b8e26e6 | 2008-06-19 17:55:38 +0000 | [diff] [blame] | 2347 | return; |
| 2348 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2349 | |
Ted Kremenek | b8e26e6 | 2008-06-19 17:55:38 +0000 | [diff] [blame] | 2350 | case UnaryOperator::Imag: { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2351 | |
Ted Kremenek | b8e26e6 | 2008-06-19 17:55:38 +0000 | [diff] [blame] | 2352 | Expr* Ex = U->getSubExpr()->IgnoreParens(); |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 2353 | ExplodedNodeSet Tmp; |
Ted Kremenek | b8e26e6 | 2008-06-19 17:55:38 +0000 | [diff] [blame] | 2354 | Visit(Ex, Pred, Tmp); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2355 | |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 2356 | for (ExplodedNodeSet::iterator I=Tmp.begin(), E=Tmp.end(); I!=E; ++I) { |
Zhongxing Xu | 1c96b24 | 2008-10-17 05:57:07 +0000 | [diff] [blame] | 2357 | // FIXME: We don't have complex SValues yet. |
Ted Kremenek | b8e26e6 | 2008-06-19 17:55:38 +0000 | [diff] [blame] | 2358 | if (Ex->getType()->isAnyComplexType()) { |
| 2359 | // Just report "Unknown." |
| 2360 | Dst.Add(*I); |
| 2361 | continue; |
| 2362 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2363 | |
Ted Kremenek | b8e26e6 | 2008-06-19 17:55:38 +0000 | [diff] [blame] | 2364 | // For all other types, UnaryOperator::Float returns 0. |
| 2365 | assert (Ex->getType()->isIntegerType()); |
Ted Kremenek | a8538d9 | 2009-02-13 01:45:31 +0000 | [diff] [blame] | 2366 | const GRState* state = GetState(*I); |
Zhongxing Xu | d91ee27 | 2009-06-23 09:02:15 +0000 | [diff] [blame] | 2367 | SVal X = ValMgr.makeZeroVal(Ex->getType()); |
Ted Kremenek | 8e02934 | 2009-08-27 22:17:37 +0000 | [diff] [blame] | 2368 | MakeNode(Dst, U, *I, state->BindExpr(U, X)); |
Ted Kremenek | b8e26e6 | 2008-06-19 17:55:38 +0000 | [diff] [blame] | 2369 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2370 | |
Ted Kremenek | b8e26e6 | 2008-06-19 17:55:38 +0000 | [diff] [blame] | 2371 | return; |
| 2372 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2373 | |
Ted Kremenek | e2b5744 | 2009-09-15 00:40:32 +0000 | [diff] [blame] | 2374 | case UnaryOperator::OffsetOf: { |
Ted Kremenek | aab7efe | 2009-09-15 04:19:09 +0000 | [diff] [blame] | 2375 | Expr::EvalResult Res; |
| 2376 | if (U->Evaluate(Res, getContext()) && Res.Val.isInt()) { |
| 2377 | const APSInt &IV = Res.Val.getInt(); |
| 2378 | assert(IV.getBitWidth() == getContext().getTypeSize(U->getType())); |
| 2379 | assert(U->getType()->isIntegerType()); |
| 2380 | assert(IV.isSigned() == U->getType()->isSignedIntegerType()); |
| 2381 | SVal X = ValMgr.makeIntVal(IV); |
| 2382 | MakeNode(Dst, U, Pred, GetState(Pred)->BindExpr(U, X)); |
| 2383 | return; |
| 2384 | } |
| 2385 | // FIXME: Handle the case where __builtin_offsetof is not a constant. |
| 2386 | Dst.Add(Pred); |
Ted Kremenek | a084bb6 | 2008-04-30 21:45:55 +0000 | [diff] [blame] | 2387 | return; |
Ted Kremenek | e2b5744 | 2009-09-15 00:40:32 +0000 | [diff] [blame] | 2388 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2389 | |
Zhongxing Xu | 6d69b5d | 2008-10-16 06:09:51 +0000 | [diff] [blame] | 2390 | case UnaryOperator::Plus: assert (!asLValue); // FALL-THROUGH. |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 2391 | case UnaryOperator::Extension: { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2392 | |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 2393 | // Unary "+" is a no-op, similar to a parentheses. We still have places |
| 2394 | // where it may be a block-level expression, so we need to |
| 2395 | // generate an extra node that just propagates the value of the |
| 2396 | // subexpression. |
| 2397 | |
| 2398 | Expr* Ex = U->getSubExpr()->IgnoreParens(); |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 2399 | ExplodedNodeSet Tmp; |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 2400 | Visit(Ex, Pred, Tmp); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2401 | |
| 2402 | for (ExplodedNodeSet::iterator I=Tmp.begin(), E=Tmp.end(); I!=E; ++I) { |
Ted Kremenek | a8538d9 | 2009-02-13 01:45:31 +0000 | [diff] [blame] | 2403 | const GRState* state = GetState(*I); |
Ted Kremenek | 8e02934 | 2009-08-27 22:17:37 +0000 | [diff] [blame] | 2404 | MakeNode(Dst, U, *I, state->BindExpr(U, state->getSVal(Ex))); |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 2405 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2406 | |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 2407 | return; |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 2408 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2409 | |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 2410 | case UnaryOperator::AddrOf: { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2411 | |
Zhongxing Xu | 6d69b5d | 2008-10-16 06:09:51 +0000 | [diff] [blame] | 2412 | assert(!asLValue); |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 2413 | Expr* Ex = U->getSubExpr()->IgnoreParens(); |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 2414 | ExplodedNodeSet Tmp; |
Zhongxing Xu | 6d69b5d | 2008-10-16 06:09:51 +0000 | [diff] [blame] | 2415 | VisitLValue(Ex, Pred, Tmp); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2416 | |
| 2417 | for (ExplodedNodeSet::iterator I=Tmp.begin(), E=Tmp.end(); I!=E; ++I) { |
Ted Kremenek | a8538d9 | 2009-02-13 01:45:31 +0000 | [diff] [blame] | 2418 | const GRState* state = GetState(*I); |
Ted Kremenek | 3ff1259 | 2009-06-19 17:10:32 +0000 | [diff] [blame] | 2419 | SVal V = state->getSVal(Ex); |
Ted Kremenek | 8e02934 | 2009-08-27 22:17:37 +0000 | [diff] [blame] | 2420 | state = state->BindExpr(U, V); |
Ted Kremenek | a8538d9 | 2009-02-13 01:45:31 +0000 | [diff] [blame] | 2421 | MakeNode(Dst, U, *I, state); |
Ted Kremenek | 89063af | 2008-02-21 19:15:37 +0000 | [diff] [blame] | 2422 | } |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 2423 | |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2424 | return; |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 2425 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2426 | |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 2427 | case UnaryOperator::LNot: |
| 2428 | case UnaryOperator::Minus: |
| 2429 | case UnaryOperator::Not: { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2430 | |
Zhongxing Xu | 6d69b5d | 2008-10-16 06:09:51 +0000 | [diff] [blame] | 2431 | assert (!asLValue); |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 2432 | Expr* Ex = U->getSubExpr()->IgnoreParens(); |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 2433 | ExplodedNodeSet Tmp; |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 2434 | Visit(Ex, Pred, Tmp); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2435 | |
| 2436 | for (ExplodedNodeSet::iterator I=Tmp.begin(), E=Tmp.end(); I!=E; ++I) { |
Ted Kremenek | a8538d9 | 2009-02-13 01:45:31 +0000 | [diff] [blame] | 2437 | const GRState* state = GetState(*I); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2438 | |
Ted Kremenek | 855cd90 | 2008-09-30 05:32:44 +0000 | [diff] [blame] | 2439 | // Get the value of the subexpression. |
Ted Kremenek | 3ff1259 | 2009-06-19 17:10:32 +0000 | [diff] [blame] | 2440 | SVal V = state->getSVal(Ex); |
Ted Kremenek | 855cd90 | 2008-09-30 05:32:44 +0000 | [diff] [blame] | 2441 | |
Ted Kremenek | e04a5cb | 2008-11-15 00:20:05 +0000 | [diff] [blame] | 2442 | if (V.isUnknownOrUndef()) { |
Ted Kremenek | 8e02934 | 2009-08-27 22:17:37 +0000 | [diff] [blame] | 2443 | MakeNode(Dst, U, *I, state->BindExpr(U, V)); |
Ted Kremenek | e04a5cb | 2008-11-15 00:20:05 +0000 | [diff] [blame] | 2444 | continue; |
| 2445 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2446 | |
Ted Kremenek | 60595da | 2008-11-15 04:01:56 +0000 | [diff] [blame] | 2447 | // QualType DstT = getContext().getCanonicalType(U->getType()); |
| 2448 | // QualType SrcT = getContext().getCanonicalType(Ex->getType()); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2449 | // |
Ted Kremenek | 60595da | 2008-11-15 04:01:56 +0000 | [diff] [blame] | 2450 | // if (DstT != SrcT) // Perform promotions. |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2451 | // V = EvalCast(V, DstT); |
| 2452 | // |
Ted Kremenek | 60595da | 2008-11-15 04:01:56 +0000 | [diff] [blame] | 2453 | // if (V.isUnknownOrUndef()) { |
| 2454 | // MakeNode(Dst, U, *I, BindExpr(St, U, V)); |
| 2455 | // continue; |
| 2456 | // } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2457 | |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 2458 | switch (U->getOpcode()) { |
| 2459 | default: |
| 2460 | assert(false && "Invalid Opcode."); |
| 2461 | break; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2462 | |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 2463 | case UnaryOperator::Not: |
Ted Kremenek | 60a6e0c | 2008-10-01 00:21:14 +0000 | [diff] [blame] | 2464 | // FIXME: Do we need to handle promotions? |
Ted Kremenek | 8e02934 | 2009-08-27 22:17:37 +0000 | [diff] [blame] | 2465 | state = state->BindExpr(U, EvalComplement(cast<NonLoc>(V))); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2466 | break; |
| 2467 | |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 2468 | case UnaryOperator::Minus: |
Ted Kremenek | 60a6e0c | 2008-10-01 00:21:14 +0000 | [diff] [blame] | 2469 | // FIXME: Do we need to handle promotions? |
Ted Kremenek | 8e02934 | 2009-08-27 22:17:37 +0000 | [diff] [blame] | 2470 | state = state->BindExpr(U, EvalMinus(cast<NonLoc>(V))); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2471 | break; |
| 2472 | |
| 2473 | case UnaryOperator::LNot: |
| 2474 | |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 2475 | // C99 6.5.3.3: "The expression !E is equivalent to (0==E)." |
| 2476 | // |
| 2477 | // Note: technically we do "E == 0", but this is the same in the |
| 2478 | // transfer functions as "0 == E". |
Ted Kremenek | 6c07bdb | 2009-06-26 00:05:51 +0000 | [diff] [blame] | 2479 | SVal Result; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2480 | |
Zhongxing Xu | 1c96b24 | 2008-10-17 05:57:07 +0000 | [diff] [blame] | 2481 | if (isa<Loc>(V)) { |
Zhongxing Xu | d91ee27 | 2009-06-23 09:02:15 +0000 | [diff] [blame] | 2482 | Loc X = ValMgr.makeNull(); |
Ted Kremenek | 6c07bdb | 2009-06-26 00:05:51 +0000 | [diff] [blame] | 2483 | Result = EvalBinOp(state, BinaryOperator::EQ, cast<Loc>(V), X, |
| 2484 | U->getType()); |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 2485 | } |
| 2486 | else { |
Ted Kremenek | 60595da | 2008-11-15 04:01:56 +0000 | [diff] [blame] | 2487 | nonloc::ConcreteInt X(getBasicVals().getValue(0, Ex->getType())); |
Ted Kremenek | cd8f6ac | 2009-10-06 01:39:48 +0000 | [diff] [blame] | 2488 | Result = EvalBinOp(state, BinaryOperator::EQ, cast<NonLoc>(V), X, |
Ted Kremenek | 6c07bdb | 2009-06-26 00:05:51 +0000 | [diff] [blame] | 2489 | U->getType()); |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 2490 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2491 | |
Ted Kremenek | 8e02934 | 2009-08-27 22:17:37 +0000 | [diff] [blame] | 2492 | state = state->BindExpr(U, Result); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2493 | |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 2494 | break; |
| 2495 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2496 | |
Ted Kremenek | a8538d9 | 2009-02-13 01:45:31 +0000 | [diff] [blame] | 2497 | MakeNode(Dst, U, *I, state); |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 2498 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2499 | |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 2500 | return; |
| 2501 | } |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 2502 | } |
| 2503 | |
| 2504 | // Handle ++ and -- (both pre- and post-increment). |
| 2505 | |
| 2506 | assert (U->isIncrementDecrementOp()); |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 2507 | ExplodedNodeSet Tmp; |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 2508 | Expr* Ex = U->getSubExpr()->IgnoreParens(); |
Zhongxing Xu | 6d69b5d | 2008-10-16 06:09:51 +0000 | [diff] [blame] | 2509 | VisitLValue(Ex, Pred, Tmp); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2510 | |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 2511 | for (ExplodedNodeSet::iterator I = Tmp.begin(), E = Tmp.end(); I!=E; ++I) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2512 | |
Ted Kremenek | a8538d9 | 2009-02-13 01:45:31 +0000 | [diff] [blame] | 2513 | const GRState* state = GetState(*I); |
Ted Kremenek | 3ff1259 | 2009-06-19 17:10:32 +0000 | [diff] [blame] | 2514 | SVal V1 = state->getSVal(Ex); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2515 | |
| 2516 | // Perform a load. |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 2517 | ExplodedNodeSet Tmp2; |
Ted Kremenek | a8538d9 | 2009-02-13 01:45:31 +0000 | [diff] [blame] | 2518 | EvalLoad(Tmp2, Ex, *I, state, V1); |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 2519 | |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 2520 | for (ExplodedNodeSet::iterator I2 = Tmp2.begin(), E2 = Tmp2.end(); I2!=E2; ++I2) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2521 | |
Ted Kremenek | a8538d9 | 2009-02-13 01:45:31 +0000 | [diff] [blame] | 2522 | state = GetState(*I2); |
Ted Kremenek | 5b9bd21 | 2009-09-11 22:07:28 +0000 | [diff] [blame] | 2523 | SVal V2_untested = state->getSVal(Ex); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2524 | |
| 2525 | // Propagate unknown and undefined values. |
Ted Kremenek | 5b9bd21 | 2009-09-11 22:07:28 +0000 | [diff] [blame] | 2526 | if (V2_untested.isUnknownOrUndef()) { |
| 2527 | MakeNode(Dst, U, *I2, state->BindExpr(U, V2_untested)); |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 2528 | continue; |
Ted Kremenek | 5b9bd21 | 2009-09-11 22:07:28 +0000 | [diff] [blame] | 2529 | } |
| 2530 | DefinedSVal V2 = cast<DefinedSVal>(V2_untested); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2531 | |
| 2532 | // Handle all other values. |
Ted Kremenek | 50d0ac2 | 2008-02-15 22:09:30 +0000 | [diff] [blame] | 2533 | BinaryOperator::Opcode Op = U->isIncrementOp() ? BinaryOperator::Add |
| 2534 | : BinaryOperator::Sub; |
Ted Kremenek | 21028dd | 2009-03-11 03:54:24 +0000 | [diff] [blame] | 2535 | |
Zhongxing Xu | a52ad4e | 2009-08-05 02:51:59 +0000 | [diff] [blame] | 2536 | // If the UnaryOperator has non-location type, use its type to create the |
| 2537 | // constant value. If the UnaryOperator has location type, create the |
| 2538 | // constant with int type and pointer width. |
| 2539 | SVal RHS; |
| 2540 | |
| 2541 | if (U->getType()->isAnyPointerType()) |
| 2542 | RHS = ValMgr.makeIntValWithPtrWidth(1, false); |
| 2543 | else |
| 2544 | RHS = ValMgr.makeIntVal(1, U->getType()); |
| 2545 | |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2546 | SVal Result = EvalBinOp(state, Op, V2, RHS, U->getType()); |
| 2547 | |
Ted Kremenek | bb9b271 | 2009-03-20 20:10:45 +0000 | [diff] [blame] | 2548 | // Conjure a new symbol if necessary to recover precision. |
Ted Kremenek | af48fdd | 2009-04-21 22:38:05 +0000 | [diff] [blame] | 2549 | if (Result.isUnknown() || !getConstraintManager().canReasonAbout(Result)){ |
Ted Kremenek | 5b9bd21 | 2009-09-11 22:07:28 +0000 | [diff] [blame] | 2550 | DefinedOrUnknownSVal SymVal = |
Ted Kremenek | 8780679 | 2009-09-27 20:45:21 +0000 | [diff] [blame] | 2551 | ValMgr.getConjuredSymbolVal(NULL, Ex, |
| 2552 | Builder->getCurrentBlockCount()); |
Ted Kremenek | 5b9bd21 | 2009-09-11 22:07:28 +0000 | [diff] [blame] | 2553 | Result = SymVal; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2554 | |
Ted Kremenek | af48fdd | 2009-04-21 22:38:05 +0000 | [diff] [blame] | 2555 | // If the value is a location, ++/-- should always preserve |
Ted Kremenek | 6c07bdb | 2009-06-26 00:05:51 +0000 | [diff] [blame] | 2556 | // non-nullness. Check if the original value was non-null, and if so |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2557 | // propagate that constraint. |
Ted Kremenek | af48fdd | 2009-04-21 22:38:05 +0000 | [diff] [blame] | 2558 | if (Loc::IsLocType(U->getType())) { |
Ted Kremenek | 5b9bd21 | 2009-09-11 22:07:28 +0000 | [diff] [blame] | 2559 | DefinedOrUnknownSVal Constraint = |
| 2560 | SVator.EvalEQ(state, V2, ValMgr.makeZeroVal(U->getType())); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2561 | |
Ted Kremenek | 5b9bd21 | 2009-09-11 22:07:28 +0000 | [diff] [blame] | 2562 | if (!state->Assume(Constraint, true)) { |
Ted Kremenek | af48fdd | 2009-04-21 22:38:05 +0000 | [diff] [blame] | 2563 | // It isn't feasible for the original value to be null. |
| 2564 | // Propagate this constraint. |
Ted Kremenek | 5b9bd21 | 2009-09-11 22:07:28 +0000 | [diff] [blame] | 2565 | Constraint = SVator.EvalEQ(state, SymVal, |
| 2566 | ValMgr.makeZeroVal(U->getType())); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2567 | |
Ted Kremenek | 5b9bd21 | 2009-09-11 22:07:28 +0000 | [diff] [blame] | 2568 | |
| 2569 | state = state->Assume(Constraint, false); |
Ted Kremenek | a591bc0 | 2009-06-18 22:57:13 +0000 | [diff] [blame] | 2570 | assert(state); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2571 | } |
| 2572 | } |
Ted Kremenek | af48fdd | 2009-04-21 22:38:05 +0000 | [diff] [blame] | 2573 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2574 | |
Ted Kremenek | 8e02934 | 2009-08-27 22:17:37 +0000 | [diff] [blame] | 2575 | state = state->BindExpr(U, U->isPostfix() ? V2 : Result); |
Ted Kremenek | cf78b6a | 2008-02-06 22:50:25 +0000 | [diff] [blame] | 2576 | |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2577 | // Perform the store. |
Ted Kremenek | a8538d9 | 2009-02-13 01:45:31 +0000 | [diff] [blame] | 2578 | EvalStore(Dst, U, *I2, state, V1, Result); |
Ted Kremenek | 5b6dc2d | 2008-02-07 01:08:27 +0000 | [diff] [blame] | 2579 | } |
Ted Kremenek | 469ecbd | 2008-04-21 23:43:38 +0000 | [diff] [blame] | 2580 | } |
Ted Kremenek | 5b6dc2d | 2008-02-07 01:08:27 +0000 | [diff] [blame] | 2581 | } |
| 2582 | |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 2583 | void GRExprEngine::VisitAsmStmt(AsmStmt* A, ExplodedNode* Pred, ExplodedNodeSet& Dst) { |
Ted Kremenek | ef44bfb | 2008-03-17 21:11:24 +0000 | [diff] [blame] | 2584 | VisitAsmStmtHelperOutputs(A, A->begin_outputs(), A->end_outputs(), Pred, Dst); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2585 | } |
Ted Kremenek | ef44bfb | 2008-03-17 21:11:24 +0000 | [diff] [blame] | 2586 | |
| 2587 | void GRExprEngine::VisitAsmStmtHelperOutputs(AsmStmt* A, |
| 2588 | AsmStmt::outputs_iterator I, |
| 2589 | AsmStmt::outputs_iterator E, |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 2590 | ExplodedNode* Pred, ExplodedNodeSet& Dst) { |
Ted Kremenek | ef44bfb | 2008-03-17 21:11:24 +0000 | [diff] [blame] | 2591 | if (I == E) { |
| 2592 | VisitAsmStmtHelperInputs(A, A->begin_inputs(), A->end_inputs(), Pred, Dst); |
| 2593 | return; |
| 2594 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2595 | |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 2596 | ExplodedNodeSet Tmp; |
Zhongxing Xu | 6d69b5d | 2008-10-16 06:09:51 +0000 | [diff] [blame] | 2597 | VisitLValue(*I, Pred, Tmp); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2598 | |
Ted Kremenek | ef44bfb | 2008-03-17 21:11:24 +0000 | [diff] [blame] | 2599 | ++I; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2600 | |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 2601 | for (ExplodedNodeSet::iterator NI = Tmp.begin(), NE = Tmp.end(); NI != NE; ++NI) |
Ted Kremenek | ef44bfb | 2008-03-17 21:11:24 +0000 | [diff] [blame] | 2602 | VisitAsmStmtHelperOutputs(A, I, E, *NI, Dst); |
| 2603 | } |
| 2604 | |
| 2605 | void GRExprEngine::VisitAsmStmtHelperInputs(AsmStmt* A, |
| 2606 | AsmStmt::inputs_iterator I, |
| 2607 | AsmStmt::inputs_iterator E, |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 2608 | ExplodedNode* Pred, ExplodedNodeSet& Dst) { |
Ted Kremenek | ef44bfb | 2008-03-17 21:11:24 +0000 | [diff] [blame] | 2609 | if (I == E) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2610 | |
Ted Kremenek | ef44bfb | 2008-03-17 21:11:24 +0000 | [diff] [blame] | 2611 | // We have processed both the inputs and the outputs. All of the outputs |
Zhongxing Xu | 1c96b24 | 2008-10-17 05:57:07 +0000 | [diff] [blame] | 2612 | // should evaluate to Locs. Nuke all of their values. |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2613 | |
Ted Kremenek | ef44bfb | 2008-03-17 21:11:24 +0000 | [diff] [blame] | 2614 | // FIXME: Some day in the future it would be nice to allow a "plug-in" |
| 2615 | // which interprets the inline asm and stores proper results in the |
| 2616 | // outputs. |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2617 | |
Ted Kremenek | a8538d9 | 2009-02-13 01:45:31 +0000 | [diff] [blame] | 2618 | const GRState* state = GetState(Pred); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2619 | |
Ted Kremenek | ef44bfb | 2008-03-17 21:11:24 +0000 | [diff] [blame] | 2620 | for (AsmStmt::outputs_iterator OI = A->begin_outputs(), |
| 2621 | OE = A->end_outputs(); OI != OE; ++OI) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2622 | |
| 2623 | SVal X = state->getSVal(*OI); |
Zhongxing Xu | 1c96b24 | 2008-10-17 05:57:07 +0000 | [diff] [blame] | 2624 | assert (!isa<NonLoc>(X)); // Should be an Lval, or unknown, undef. |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2625 | |
Zhongxing Xu | 1c96b24 | 2008-10-17 05:57:07 +0000 | [diff] [blame] | 2626 | if (isa<Loc>(X)) |
Ted Kremenek | 3ff1259 | 2009-06-19 17:10:32 +0000 | [diff] [blame] | 2627 | state = state->bindLoc(cast<Loc>(X), UnknownVal()); |
Ted Kremenek | ef44bfb | 2008-03-17 21:11:24 +0000 | [diff] [blame] | 2628 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2629 | |
Ted Kremenek | a8538d9 | 2009-02-13 01:45:31 +0000 | [diff] [blame] | 2630 | MakeNode(Dst, A, Pred, state); |
Ted Kremenek | ef44bfb | 2008-03-17 21:11:24 +0000 | [diff] [blame] | 2631 | return; |
| 2632 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2633 | |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 2634 | ExplodedNodeSet Tmp; |
Ted Kremenek | ef44bfb | 2008-03-17 21:11:24 +0000 | [diff] [blame] | 2635 | Visit(*I, Pred, Tmp); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2636 | |
Ted Kremenek | ef44bfb | 2008-03-17 21:11:24 +0000 | [diff] [blame] | 2637 | ++I; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2638 | |
Ted Kremenek | e1ccccf | 2009-09-03 03:02:58 +0000 | [diff] [blame] | 2639 | for (ExplodedNodeSet::iterator NI = Tmp.begin(), NE = Tmp.end(); NI!=NE; ++NI) |
Ted Kremenek | ef44bfb | 2008-03-17 21:11:24 +0000 | [diff] [blame] | 2640 | VisitAsmStmtHelperInputs(A, I, E, *NI, Dst); |
| 2641 | } |
| 2642 | |
Ted Kremenek | e1ccccf | 2009-09-03 03:02:58 +0000 | [diff] [blame] | 2643 | void GRExprEngine::EvalReturn(ExplodedNodeSet& Dst, ReturnStmt* S, |
| 2644 | ExplodedNode* Pred) { |
Ted Kremenek | 6b31e8e | 2008-04-16 23:05:51 +0000 | [diff] [blame] | 2645 | assert (Builder && "GRStmtNodeBuilder must be defined."); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2646 | |
| 2647 | unsigned size = Dst.size(); |
Ted Kremenek | b053396 | 2008-04-18 20:35:30 +0000 | [diff] [blame] | 2648 | |
Ted Kremenek | 186350f | 2008-04-23 20:12:28 +0000 | [diff] [blame] | 2649 | SaveAndRestore<bool> OldSink(Builder->BuildSinks); |
| 2650 | SaveOr OldHasGen(Builder->HasGeneratedNode); |
Ted Kremenek | b053396 | 2008-04-18 20:35:30 +0000 | [diff] [blame] | 2651 | |
Ted Kremenek | 729a9a2 | 2008-07-17 23:15:45 +0000 | [diff] [blame] | 2652 | getTF().EvalReturn(Dst, *this, *Builder, S, Pred); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2653 | |
Ted Kremenek | b053396 | 2008-04-18 20:35:30 +0000 | [diff] [blame] | 2654 | // Handle the case where no nodes where generated. |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2655 | |
Ted Kremenek | b053396 | 2008-04-18 20:35:30 +0000 | [diff] [blame] | 2656 | if (!Builder->BuildSinks && Dst.size() == size && !Builder->HasGeneratedNode) |
Ted Kremenek | 6b31e8e | 2008-04-16 23:05:51 +0000 | [diff] [blame] | 2657 | MakeNode(Dst, S, Pred, GetState(Pred)); |
| 2658 | } |
| 2659 | |
Ted Kremenek | e1ccccf | 2009-09-03 03:02:58 +0000 | [diff] [blame] | 2660 | void GRExprEngine::VisitReturnStmt(ReturnStmt* S, ExplodedNode* Pred, |
| 2661 | ExplodedNodeSet& Dst) { |
Ted Kremenek | 02737ed | 2008-03-31 15:02:58 +0000 | [diff] [blame] | 2662 | |
| 2663 | Expr* R = S->getRetValue(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2664 | |
Ted Kremenek | 02737ed | 2008-03-31 15:02:58 +0000 | [diff] [blame] | 2665 | if (!R) { |
Ted Kremenek | 6b31e8e | 2008-04-16 23:05:51 +0000 | [diff] [blame] | 2666 | EvalReturn(Dst, S, Pred); |
Ted Kremenek | 02737ed | 2008-03-31 15:02:58 +0000 | [diff] [blame] | 2667 | return; |
| 2668 | } |
Ted Kremenek | 6b31e8e | 2008-04-16 23:05:51 +0000 | [diff] [blame] | 2669 | |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 2670 | ExplodedNodeSet Tmp; |
Ted Kremenek | 5917d78 | 2008-11-21 00:27:44 +0000 | [diff] [blame] | 2671 | Visit(R, Pred, Tmp); |
Ted Kremenek | 02737ed | 2008-03-31 15:02:58 +0000 | [diff] [blame] | 2672 | |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 2673 | for (ExplodedNodeSet::iterator I = Tmp.begin(), E = Tmp.end(); I != E; ++I) { |
Ted Kremenek | 3ff1259 | 2009-06-19 17:10:32 +0000 | [diff] [blame] | 2674 | SVal X = (*I)->getState()->getSVal(R); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2675 | |
Ted Kremenek | 5917d78 | 2008-11-21 00:27:44 +0000 | [diff] [blame] | 2676 | // Check if we return the address of a stack variable. |
| 2677 | if (isa<loc::MemRegionVal>(X)) { |
| 2678 | // Determine if the value is on the stack. |
| 2679 | const MemRegion* R = cast<loc::MemRegionVal>(&X)->getRegion(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2680 | |
Ted Kremenek | ea20cd7 | 2009-06-23 18:05:21 +0000 | [diff] [blame] | 2681 | if (R && R->hasStackStorage()) { |
Ted Kremenek | 5917d78 | 2008-11-21 00:27:44 +0000 | [diff] [blame] | 2682 | // Create a special node representing the error. |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 2683 | if (ExplodedNode* N = Builder->generateNode(S, GetState(*I), *I)) { |
Ted Kremenek | 5917d78 | 2008-11-21 00:27:44 +0000 | [diff] [blame] | 2684 | N->markAsSink(); |
| 2685 | RetsStackAddr.insert(N); |
| 2686 | } |
| 2687 | continue; |
| 2688 | } |
Ted Kremenek | 02737ed | 2008-03-31 15:02:58 +0000 | [diff] [blame] | 2689 | } |
Ted Kremenek | 5917d78 | 2008-11-21 00:27:44 +0000 | [diff] [blame] | 2690 | // Check if we return an undefined value. |
| 2691 | else if (X.isUndef()) { |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 2692 | if (ExplodedNode* N = Builder->generateNode(S, GetState(*I), *I)) { |
Ted Kremenek | 5917d78 | 2008-11-21 00:27:44 +0000 | [diff] [blame] | 2693 | N->markAsSink(); |
| 2694 | RetsUndef.insert(N); |
| 2695 | } |
| 2696 | continue; |
| 2697 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2698 | |
Ted Kremenek | 6b31e8e | 2008-04-16 23:05:51 +0000 | [diff] [blame] | 2699 | EvalReturn(Dst, S, *I); |
Ted Kremenek | 5917d78 | 2008-11-21 00:27:44 +0000 | [diff] [blame] | 2700 | } |
Ted Kremenek | 02737ed | 2008-03-31 15:02:58 +0000 | [diff] [blame] | 2701 | } |
Ted Kremenek | 55deb97 | 2008-03-25 00:34:37 +0000 | [diff] [blame] | 2702 | |
Ted Kremenek | e695e1c | 2008-04-15 23:06:53 +0000 | [diff] [blame] | 2703 | //===----------------------------------------------------------------------===// |
| 2704 | // Transfer functions: Binary operators. |
| 2705 | //===----------------------------------------------------------------------===// |
| 2706 | |
Ted Kremenek | 4d4dd85 | 2008-02-13 17:41:41 +0000 | [diff] [blame] | 2707 | void GRExprEngine::VisitBinaryOperator(BinaryOperator* B, |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 2708 | ExplodedNode* Pred, |
| 2709 | ExplodedNodeSet& Dst) { |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 2710 | |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 2711 | ExplodedNodeSet Tmp1; |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 2712 | Expr* LHS = B->getLHS()->IgnoreParens(); |
| 2713 | Expr* RHS = B->getRHS()->IgnoreParens(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2714 | |
Fariborz Jahanian | 09105f5 | 2009-08-20 17:02:02 +0000 | [diff] [blame] | 2715 | // FIXME: Add proper support for ObjCImplicitSetterGetterRefExpr. |
| 2716 | if (isa<ObjCImplicitSetterGetterRefExpr>(LHS)) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2717 | Visit(RHS, Pred, Dst); |
Ted Kremenek | 759623e | 2008-12-06 02:39:30 +0000 | [diff] [blame] | 2718 | return; |
| 2719 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2720 | |
Ted Kremenek | 5b6dc2d | 2008-02-07 01:08:27 +0000 | [diff] [blame] | 2721 | if (B->isAssignmentOp()) |
Zhongxing Xu | 6d69b5d | 2008-10-16 06:09:51 +0000 | [diff] [blame] | 2722 | VisitLValue(LHS, Pred, Tmp1); |
Ted Kremenek | 5b6dc2d | 2008-02-07 01:08:27 +0000 | [diff] [blame] | 2723 | else |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 2724 | Visit(LHS, Pred, Tmp1); |
Ted Kremenek | cb448ca | 2008-01-16 00:53:15 +0000 | [diff] [blame] | 2725 | |
Ted Kremenek | e1ccccf | 2009-09-03 03:02:58 +0000 | [diff] [blame] | 2726 | for (ExplodedNodeSet::iterator I1=Tmp1.begin(), E1=Tmp1.end(); I1!=E1; ++I1) { |
Ted Kremenek | 3ff1259 | 2009-06-19 17:10:32 +0000 | [diff] [blame] | 2727 | SVal LeftV = (*I1)->getState()->getSVal(LHS); |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 2728 | ExplodedNodeSet Tmp2; |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 2729 | Visit(RHS, *I1, Tmp2); |
Zhongxing Xu | 6403b57 | 2009-09-02 13:26:26 +0000 | [diff] [blame] | 2730 | |
| 2731 | ExplodedNodeSet CheckedSet; |
| 2732 | CheckerVisit(B, CheckedSet, Tmp2, true); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2733 | |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 2734 | // With both the LHS and RHS evaluated, process the operation itself. |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2735 | |
| 2736 | for (ExplodedNodeSet::iterator I2=CheckedSet.begin(), E2=CheckedSet.end(); |
Zhongxing Xu | 6403b57 | 2009-09-02 13:26:26 +0000 | [diff] [blame] | 2737 | I2 != E2; ++I2) { |
Ted Kremenek | aa1c4e5 | 2008-02-21 18:02:17 +0000 | [diff] [blame] | 2738 | |
Ted Kremenek | 5b9bd21 | 2009-09-11 22:07:28 +0000 | [diff] [blame] | 2739 | const GRState *state = GetState(*I2); |
| 2740 | const GRState *OldSt = state; |
Ted Kremenek | 3ff1259 | 2009-06-19 17:10:32 +0000 | [diff] [blame] | 2741 | SVal RightV = state->getSVal(RHS); |
Ted Kremenek | 5b9bd21 | 2009-09-11 22:07:28 +0000 | [diff] [blame] | 2742 | |
Ted Kremenek | cf78b6a | 2008-02-06 22:50:25 +0000 | [diff] [blame] | 2743 | BinaryOperator::Opcode Op = B->getOpcode(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2744 | |
Zhongxing Xu | 73af2d5 | 2009-10-21 11:42:22 +0000 | [diff] [blame] | 2745 | if (Op == BinaryOperator::Assign) { |
| 2746 | // EXPERIMENTAL: "Conjured" symbols. |
| 2747 | // FIXME: Handle structs. |
| 2748 | QualType T = RHS->getType(); |
| 2749 | |
| 2750 | if ((RightV.isUnknown()||!getConstraintManager().canReasonAbout(RightV)) |
| 2751 | && (Loc::IsLocType(T) || (T->isScalarType()&&T->isIntegerType()))) { |
| 2752 | unsigned Count = Builder->getCurrentBlockCount(); |
| 2753 | RightV = ValMgr.getConjuredSymbolVal(NULL, B->getRHS(), Count); |
| 2754 | } |
| 2755 | |
| 2756 | // Simulate the effects of a "store": bind the value of the RHS |
| 2757 | // to the L-Value represented by the LHS. |
| 2758 | EvalStore(Dst, B, LHS, *I2, state->BindExpr(B, RightV), LeftV, RightV); |
| 2759 | continue; |
| 2760 | } |
| 2761 | |
| 2762 | if (!B->isAssignmentOp()) { |
| 2763 | // Process non-assignments except commas or short-circuited |
| 2764 | // logical expressions (LAnd and LOr). |
| 2765 | SVal Result = EvalBinOp(state, Op, LeftV, RightV, B->getType()); |
| 2766 | |
| 2767 | if (Result.isUnknown()) { |
| 2768 | if (OldSt != state) { |
| 2769 | // Generate a new node if we have already created a new state. |
| 2770 | MakeNode(Dst, B, *I2, state); |
Ted Kremenek | 361fa8e | 2008-03-12 21:45:47 +0000 | [diff] [blame] | 2771 | } |
Zhongxing Xu | 73af2d5 | 2009-10-21 11:42:22 +0000 | [diff] [blame] | 2772 | else |
| 2773 | Dst.Add(*I2); |
| 2774 | |
Ted Kremenek | e38718e | 2008-04-16 18:21:25 +0000 | [diff] [blame] | 2775 | continue; |
Ted Kremenek | ab2b8c5 | 2008-01-23 19:59:44 +0000 | [diff] [blame] | 2776 | } |
Zhongxing Xu | 73af2d5 | 2009-10-21 11:42:22 +0000 | [diff] [blame] | 2777 | |
| 2778 | state = state->BindExpr(B, Result); |
| 2779 | |
| 2780 | if (Result.isUndef()) { |
| 2781 | // The operands were *not* undefined, but the result is undefined. |
| 2782 | // This is a special node that should be flagged as an error. |
| 2783 | if (ExplodedNode *UndefNode = Builder->generateNode(B, state, *I2)){ |
| 2784 | UndefNode->markAsSink(); |
| 2785 | UndefResults.insert(UndefNode); |
Ted Kremenek | 89063af | 2008-02-21 19:15:37 +0000 | [diff] [blame] | 2786 | } |
Ted Kremenek | e38718e | 2008-04-16 18:21:25 +0000 | [diff] [blame] | 2787 | continue; |
Ted Kremenek | cf78b6a | 2008-02-06 22:50:25 +0000 | [diff] [blame] | 2788 | } |
Zhongxing Xu | 73af2d5 | 2009-10-21 11:42:22 +0000 | [diff] [blame] | 2789 | |
| 2790 | // Otherwise, create a new node. |
| 2791 | MakeNode(Dst, B, *I2, state); |
| 2792 | continue; |
Ted Kremenek | ab2b8c5 | 2008-01-23 19:59:44 +0000 | [diff] [blame] | 2793 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2794 | |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 2795 | assert (B->isCompoundAssignmentOp()); |
| 2796 | |
Ted Kremenek | cad2996 | 2009-02-07 00:52:24 +0000 | [diff] [blame] | 2797 | switch (Op) { |
| 2798 | default: |
| 2799 | assert(0 && "Invalid opcode for compound assignment."); |
| 2800 | case BinaryOperator::MulAssign: Op = BinaryOperator::Mul; break; |
| 2801 | case BinaryOperator::DivAssign: Op = BinaryOperator::Div; break; |
| 2802 | case BinaryOperator::RemAssign: Op = BinaryOperator::Rem; break; |
| 2803 | case BinaryOperator::AddAssign: Op = BinaryOperator::Add; break; |
| 2804 | case BinaryOperator::SubAssign: Op = BinaryOperator::Sub; break; |
| 2805 | case BinaryOperator::ShlAssign: Op = BinaryOperator::Shl; break; |
| 2806 | case BinaryOperator::ShrAssign: Op = BinaryOperator::Shr; break; |
| 2807 | case BinaryOperator::AndAssign: Op = BinaryOperator::And; break; |
| 2808 | case BinaryOperator::XorAssign: Op = BinaryOperator::Xor; break; |
| 2809 | case BinaryOperator::OrAssign: Op = BinaryOperator::Or; break; |
Ted Kremenek | 934e3e9 | 2008-10-27 23:02:39 +0000 | [diff] [blame] | 2810 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2811 | |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 2812 | // Perform a load (the LHS). This performs the checks for |
| 2813 | // null dereferences, and so on. |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 2814 | ExplodedNodeSet Tmp3; |
Ted Kremenek | 3ff1259 | 2009-06-19 17:10:32 +0000 | [diff] [blame] | 2815 | SVal location = state->getSVal(LHS); |
Ted Kremenek | a8538d9 | 2009-02-13 01:45:31 +0000 | [diff] [blame] | 2816 | EvalLoad(Tmp3, LHS, *I2, state, location); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2817 | |
| 2818 | for (ExplodedNodeSet::iterator I3=Tmp3.begin(), E3=Tmp3.end(); I3!=E3; |
Zhongxing Xu | 6403b57 | 2009-09-02 13:26:26 +0000 | [diff] [blame] | 2819 | ++I3) { |
Ted Kremenek | a8538d9 | 2009-02-13 01:45:31 +0000 | [diff] [blame] | 2820 | state = GetState(*I3); |
Ted Kremenek | 3ff1259 | 2009-06-19 17:10:32 +0000 | [diff] [blame] | 2821 | SVal V = state->getSVal(LHS); |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 2822 | |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 2823 | // Get the computation type. |
Ted Kremenek | 32c3fa4 | 2009-07-21 21:03:30 +0000 | [diff] [blame] | 2824 | QualType CTy = |
| 2825 | cast<CompoundAssignOperator>(B)->getComputationResultType(); |
Ted Kremenek | 60595da | 2008-11-15 04:01:56 +0000 | [diff] [blame] | 2826 | CTy = getContext().getCanonicalType(CTy); |
Eli Friedman | ab3a852 | 2009-03-28 01:22:36 +0000 | [diff] [blame] | 2827 | |
Ted Kremenek | 32c3fa4 | 2009-07-21 21:03:30 +0000 | [diff] [blame] | 2828 | QualType CLHSTy = |
| 2829 | cast<CompoundAssignOperator>(B)->getComputationLHSType(); |
| 2830 | CLHSTy = getContext().getCanonicalType(CLHSTy); |
Eli Friedman | ab3a852 | 2009-03-28 01:22:36 +0000 | [diff] [blame] | 2831 | |
Ted Kremenek | 60595da | 2008-11-15 04:01:56 +0000 | [diff] [blame] | 2832 | QualType LTy = getContext().getCanonicalType(LHS->getType()); |
| 2833 | QualType RTy = getContext().getCanonicalType(RHS->getType()); |
Eli Friedman | ab3a852 | 2009-03-28 01:22:36 +0000 | [diff] [blame] | 2834 | |
| 2835 | // Promote LHS. |
Ted Kremenek | 32c3fa4 | 2009-07-21 21:03:30 +0000 | [diff] [blame] | 2836 | llvm::tie(state, V) = SVator.EvalCast(V, state, CLHSTy, LTy); |
Eli Friedman | ab3a852 | 2009-03-28 01:22:36 +0000 | [diff] [blame] | 2837 | |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2838 | // Compute the result of the operation. |
Ted Kremenek | 32c3fa4 | 2009-07-21 21:03:30 +0000 | [diff] [blame] | 2839 | SVal Result; |
| 2840 | llvm::tie(state, Result) = SVator.EvalCast(EvalBinOp(state, Op, V, |
| 2841 | RightV, CTy), |
| 2842 | state, B->getType(), CTy); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2843 | |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 2844 | if (Result.isUndef()) { |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 2845 | // The operands were not undefined, but the result is undefined. |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 2846 | if (ExplodedNode* UndefNode = Builder->generateNode(B, state, *I3)) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2847 | UndefNode->markAsSink(); |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 2848 | UndefResults.insert(UndefNode); |
| 2849 | } |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 2850 | continue; |
| 2851 | } |
Ted Kremenek | 9ff267d | 2008-10-20 23:13:25 +0000 | [diff] [blame] | 2852 | |
| 2853 | // EXPERIMENTAL: "Conjured" symbols. |
| 2854 | // FIXME: Handle structs. |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2855 | |
Ted Kremenek | 60595da | 2008-11-15 04:01:56 +0000 | [diff] [blame] | 2856 | SVal LHSVal; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2857 | |
| 2858 | if ((Result.isUnknown() || |
Ted Kremenek | 276c6ac | 2009-03-11 02:24:48 +0000 | [diff] [blame] | 2859 | !getConstraintManager().canReasonAbout(Result)) |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2860 | && (Loc::IsLocType(CTy) |
Ted Kremenek | 276c6ac | 2009-03-11 02:24:48 +0000 | [diff] [blame] | 2861 | || (CTy->isScalarType() && CTy->isIntegerType()))) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2862 | |
Ted Kremenek | 9ff267d | 2008-10-20 23:13:25 +0000 | [diff] [blame] | 2863 | unsigned Count = Builder->getCurrentBlockCount(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2864 | |
Ted Kremenek | 60595da | 2008-11-15 04:01:56 +0000 | [diff] [blame] | 2865 | // The symbolic value is actually for the type of the left-hand side |
| 2866 | // expression, not the computation type, as this is the value the |
| 2867 | // LValue on the LHS will bind to. |
Ted Kremenek | 8780679 | 2009-09-27 20:45:21 +0000 | [diff] [blame] | 2868 | LHSVal = ValMgr.getConjuredSymbolVal(NULL, B->getRHS(), LTy, Count); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2869 | |
Zhongxing Xu | 1c0c233 | 2008-11-23 05:52:28 +0000 | [diff] [blame] | 2870 | // However, we need to convert the symbol to the computation type. |
Ted Kremenek | 32c3fa4 | 2009-07-21 21:03:30 +0000 | [diff] [blame] | 2871 | llvm::tie(state, Result) = SVator.EvalCast(LHSVal, state, CTy, LTy); |
Ted Kremenek | 9ff267d | 2008-10-20 23:13:25 +0000 | [diff] [blame] | 2872 | } |
Ted Kremenek | 60595da | 2008-11-15 04:01:56 +0000 | [diff] [blame] | 2873 | else { |
| 2874 | // The left-hand side may bind to a different value then the |
| 2875 | // computation type. |
Ted Kremenek | 32c3fa4 | 2009-07-21 21:03:30 +0000 | [diff] [blame] | 2876 | llvm::tie(state, LHSVal) = SVator.EvalCast(Result, state, LTy, CTy); |
Ted Kremenek | 60595da | 2008-11-15 04:01:56 +0000 | [diff] [blame] | 2877 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2878 | |
| 2879 | EvalStore(Dst, B, LHS, *I3, state->BindExpr(B, Result), |
Zhongxing Xu | 5032ffe | 2009-08-25 06:51:30 +0000 | [diff] [blame] | 2880 | location, LHSVal); |
Ted Kremenek | 1b8bd4d | 2008-04-29 21:04:26 +0000 | [diff] [blame] | 2881 | } |
Ted Kremenek | cb448ca | 2008-01-16 00:53:15 +0000 | [diff] [blame] | 2882 | } |
Ted Kremenek | d27f816 | 2008-01-15 23:55:06 +0000 | [diff] [blame] | 2883 | } |
Ted Kremenek | d27f816 | 2008-01-15 23:55:06 +0000 | [diff] [blame] | 2884 | } |
Ted Kremenek | ee98546 | 2008-01-16 18:18:48 +0000 | [diff] [blame] | 2885 | |
| 2886 | //===----------------------------------------------------------------------===// |
Ted Kremenek | e01c987 | 2008-02-14 22:36:46 +0000 | [diff] [blame] | 2887 | // Visualization. |
Ted Kremenek | ee98546 | 2008-01-16 18:18:48 +0000 | [diff] [blame] | 2888 | //===----------------------------------------------------------------------===// |
| 2889 | |
Ted Kremenek | aa66a32 | 2008-01-16 21:46:15 +0000 | [diff] [blame] | 2890 | #ifndef NDEBUG |
Ted Kremenek | 4d4dd85 | 2008-02-13 17:41:41 +0000 | [diff] [blame] | 2891 | static GRExprEngine* GraphPrintCheckerState; |
Ted Kremenek | e97ca06 | 2008-03-07 20:57:30 +0000 | [diff] [blame] | 2892 | static SourceManager* GraphPrintSourceManager; |
Ted Kremenek | 3b4f670 | 2008-01-30 23:24:39 +0000 | [diff] [blame] | 2893 | |
Ted Kremenek | aa66a32 | 2008-01-16 21:46:15 +0000 | [diff] [blame] | 2894 | namespace llvm { |
| 2895 | template<> |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 2896 | struct VISIBILITY_HIDDEN DOTGraphTraits<ExplodedNode*> : |
Ted Kremenek | aa66a32 | 2008-01-16 21:46:15 +0000 | [diff] [blame] | 2897 | public DefaultDOTGraphTraits { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2898 | |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 2899 | static std::string getNodeAttributes(const ExplodedNode* N, void*) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2900 | |
Ted Kremenek | a3fadfc | 2008-02-14 22:54:53 +0000 | [diff] [blame] | 2901 | if (GraphPrintCheckerState->isImplicitNullDeref(N) || |
Ted Kremenek | 9dca062 | 2008-02-19 00:22:37 +0000 | [diff] [blame] | 2902 | GraphPrintCheckerState->isExplicitNullDeref(N) || |
Ted Kremenek | 4a4e524 | 2008-02-28 09:25:22 +0000 | [diff] [blame] | 2903 | GraphPrintCheckerState->isUndefDeref(N) || |
| 2904 | GraphPrintCheckerState->isUndefStore(N) || |
| 2905 | GraphPrintCheckerState->isUndefControlFlow(N) || |
Ted Kremenek | 5e03fcb | 2008-02-29 23:14:48 +0000 | [diff] [blame] | 2906 | GraphPrintCheckerState->isUndefResult(N) || |
Ted Kremenek | 2ded35a | 2008-02-29 23:53:11 +0000 | [diff] [blame] | 2907 | GraphPrintCheckerState->isBadCall(N) || |
| 2908 | GraphPrintCheckerState->isUndefArg(N)) |
Ted Kremenek | a3fadfc | 2008-02-14 22:54:53 +0000 | [diff] [blame] | 2909 | return "color=\"red\",style=\"filled\""; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2910 | |
Ted Kremenek | 8cc13ea | 2008-02-28 20:32:03 +0000 | [diff] [blame] | 2911 | if (GraphPrintCheckerState->isNoReturnCall(N)) |
| 2912 | return "color=\"blue\",style=\"filled\""; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2913 | |
Ted Kremenek | a3fadfc | 2008-02-14 22:54:53 +0000 | [diff] [blame] | 2914 | return ""; |
| 2915 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2916 | |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 2917 | static std::string getNodeLabel(const ExplodedNode* N, void*,bool ShortNames){ |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2918 | |
Ted Kremenek | 53ba0b6 | 2009-06-24 23:06:47 +0000 | [diff] [blame] | 2919 | std::string sbuf; |
| 2920 | llvm::raw_string_ostream Out(sbuf); |
Ted Kremenek | 803c9ed | 2008-01-23 22:30:44 +0000 | [diff] [blame] | 2921 | |
| 2922 | // Program Location. |
Ted Kremenek | aa66a32 | 2008-01-16 21:46:15 +0000 | [diff] [blame] | 2923 | ProgramPoint Loc = N->getLocation(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2924 | |
Ted Kremenek | aa66a32 | 2008-01-16 21:46:15 +0000 | [diff] [blame] | 2925 | switch (Loc.getKind()) { |
| 2926 | case ProgramPoint::BlockEntranceKind: |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2927 | Out << "Block Entrance: B" |
Ted Kremenek | aa66a32 | 2008-01-16 21:46:15 +0000 | [diff] [blame] | 2928 | << cast<BlockEntrance>(Loc).getBlock()->getBlockID(); |
| 2929 | break; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2930 | |
Ted Kremenek | aa66a32 | 2008-01-16 21:46:15 +0000 | [diff] [blame] | 2931 | case ProgramPoint::BlockExitKind: |
| 2932 | assert (false); |
| 2933 | break; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2934 | |
Ted Kremenek | aa66a32 | 2008-01-16 21:46:15 +0000 | [diff] [blame] | 2935 | default: { |
Ted Kremenek | 5f85e17 | 2009-07-22 22:35:28 +0000 | [diff] [blame] | 2936 | if (StmtPoint *L = dyn_cast<StmtPoint>(&Loc)) { |
| 2937 | const Stmt* S = L->getStmt(); |
Ted Kremenek | 8c35475 | 2008-12-16 22:02:27 +0000 | [diff] [blame] | 2938 | SourceLocation SLoc = S->getLocStart(); |
| 2939 | |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2940 | Out << S->getStmtClassName() << ' ' << (void*) S << ' '; |
Chris Lattner | e4f2142 | 2009-06-30 01:26:17 +0000 | [diff] [blame] | 2941 | LangOptions LO; // FIXME. |
| 2942 | S->printPretty(Out, 0, PrintingPolicy(LO)); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2943 | |
| 2944 | if (SLoc.isFileID()) { |
Ted Kremenek | 8c35475 | 2008-12-16 22:02:27 +0000 | [diff] [blame] | 2945 | Out << "\\lline=" |
Chris Lattner | 7da5aea | 2009-02-04 00:55:58 +0000 | [diff] [blame] | 2946 | << GraphPrintSourceManager->getInstantiationLineNumber(SLoc) |
| 2947 | << " col=" |
| 2948 | << GraphPrintSourceManager->getInstantiationColumnNumber(SLoc) |
| 2949 | << "\\l"; |
Ted Kremenek | 8c35475 | 2008-12-16 22:02:27 +0000 | [diff] [blame] | 2950 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2951 | |
Ted Kremenek | 5f85e17 | 2009-07-22 22:35:28 +0000 | [diff] [blame] | 2952 | if (isa<PreStmt>(Loc)) |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2953 | Out << "\\lPreStmt\\l;"; |
Ted Kremenek | 5f85e17 | 2009-07-22 22:35:28 +0000 | [diff] [blame] | 2954 | else if (isa<PostLoad>(Loc)) |
Ted Kremenek | 7090d54 | 2009-05-07 18:27:16 +0000 | [diff] [blame] | 2955 | Out << "\\lPostLoad\\l;"; |
| 2956 | else if (isa<PostStore>(Loc)) |
| 2957 | Out << "\\lPostStore\\l"; |
| 2958 | else if (isa<PostLValue>(Loc)) |
| 2959 | Out << "\\lPostLValue\\l"; |
| 2960 | else if (isa<PostLocationChecksSucceed>(Loc)) |
| 2961 | Out << "\\lPostLocationChecksSucceed\\l"; |
| 2962 | else if (isa<PostNullCheckFailed>(Loc)) |
| 2963 | Out << "\\lPostNullCheckFailed\\l"; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2964 | |
Ted Kremenek | 8c35475 | 2008-12-16 22:02:27 +0000 | [diff] [blame] | 2965 | if (GraphPrintCheckerState->isImplicitNullDeref(N)) |
| 2966 | Out << "\\|Implicit-Null Dereference.\\l"; |
| 2967 | else if (GraphPrintCheckerState->isExplicitNullDeref(N)) |
| 2968 | Out << "\\|Explicit-Null Dereference.\\l"; |
| 2969 | else if (GraphPrintCheckerState->isUndefDeref(N)) |
| 2970 | Out << "\\|Dereference of undefialied value.\\l"; |
| 2971 | else if (GraphPrintCheckerState->isUndefStore(N)) |
| 2972 | Out << "\\|Store to Undefined Loc."; |
Ted Kremenek | 8c35475 | 2008-12-16 22:02:27 +0000 | [diff] [blame] | 2973 | else if (GraphPrintCheckerState->isUndefResult(N)) |
| 2974 | Out << "\\|Result of operation is undefined."; |
| 2975 | else if (GraphPrintCheckerState->isNoReturnCall(N)) |
| 2976 | Out << "\\|Call to function marked \"noreturn\"."; |
| 2977 | else if (GraphPrintCheckerState->isBadCall(N)) |
| 2978 | Out << "\\|Call to NULL/Undefined."; |
| 2979 | else if (GraphPrintCheckerState->isUndefArg(N)) |
| 2980 | Out << "\\|Argument in call is undefined"; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2981 | |
Ted Kremenek | 8c35475 | 2008-12-16 22:02:27 +0000 | [diff] [blame] | 2982 | break; |
| 2983 | } |
| 2984 | |
Ted Kremenek | aa66a32 | 2008-01-16 21:46:15 +0000 | [diff] [blame] | 2985 | const BlockEdge& E = cast<BlockEdge>(Loc); |
| 2986 | Out << "Edge: (B" << E.getSrc()->getBlockID() << ", B" |
| 2987 | << E.getDst()->getBlockID() << ')'; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2988 | |
Ted Kremenek | b38911f | 2008-01-30 23:03:39 +0000 | [diff] [blame] | 2989 | if (Stmt* T = E.getSrc()->getTerminator()) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2990 | |
Ted Kremenek | e97ca06 | 2008-03-07 20:57:30 +0000 | [diff] [blame] | 2991 | SourceLocation SLoc = T->getLocStart(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2992 | |
Ted Kremenek | b38911f | 2008-01-30 23:03:39 +0000 | [diff] [blame] | 2993 | Out << "\\|Terminator: "; |
Chris Lattner | e4f2142 | 2009-06-30 01:26:17 +0000 | [diff] [blame] | 2994 | LangOptions LO; // FIXME. |
| 2995 | E.getSrc()->printTerminator(Out, LO); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2996 | |
Ted Kremenek | 9b5551d | 2008-03-09 03:30:59 +0000 | [diff] [blame] | 2997 | if (SLoc.isFileID()) { |
| 2998 | Out << "\\lline=" |
Chris Lattner | 7da5aea | 2009-02-04 00:55:58 +0000 | [diff] [blame] | 2999 | << GraphPrintSourceManager->getInstantiationLineNumber(SLoc) |
| 3000 | << " col=" |
| 3001 | << GraphPrintSourceManager->getInstantiationColumnNumber(SLoc); |
Ted Kremenek | 9b5551d | 2008-03-09 03:30:59 +0000 | [diff] [blame] | 3002 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3003 | |
Ted Kremenek | daeb9a7 | 2008-02-13 23:08:21 +0000 | [diff] [blame] | 3004 | if (isa<SwitchStmt>(T)) { |
| 3005 | Stmt* Label = E.getDst()->getLabel(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3006 | |
| 3007 | if (Label) { |
Ted Kremenek | daeb9a7 | 2008-02-13 23:08:21 +0000 | [diff] [blame] | 3008 | if (CaseStmt* C = dyn_cast<CaseStmt>(Label)) { |
| 3009 | Out << "\\lcase "; |
Chris Lattner | e4f2142 | 2009-06-30 01:26:17 +0000 | [diff] [blame] | 3010 | LangOptions LO; // FIXME. |
| 3011 | C->getLHS()->printPretty(Out, 0, PrintingPolicy(LO)); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3012 | |
Ted Kremenek | daeb9a7 | 2008-02-13 23:08:21 +0000 | [diff] [blame] | 3013 | if (Stmt* RHS = C->getRHS()) { |
| 3014 | Out << " .. "; |
Chris Lattner | e4f2142 | 2009-06-30 01:26:17 +0000 | [diff] [blame] | 3015 | RHS->printPretty(Out, 0, PrintingPolicy(LO)); |
Ted Kremenek | daeb9a7 | 2008-02-13 23:08:21 +0000 | [diff] [blame] | 3016 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3017 | |
Ted Kremenek | daeb9a7 | 2008-02-13 23:08:21 +0000 | [diff] [blame] | 3018 | Out << ":"; |
| 3019 | } |
| 3020 | else { |
| 3021 | assert (isa<DefaultStmt>(Label)); |
| 3022 | Out << "\\ldefault:"; |
| 3023 | } |
| 3024 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3025 | else |
Ted Kremenek | daeb9a7 | 2008-02-13 23:08:21 +0000 | [diff] [blame] | 3026 | Out << "\\l(implicit) default:"; |
| 3027 | } |
| 3028 | else if (isa<IndirectGotoStmt>(T)) { |
Ted Kremenek | b38911f | 2008-01-30 23:03:39 +0000 | [diff] [blame] | 3029 | // FIXME |
| 3030 | } |
| 3031 | else { |
| 3032 | Out << "\\lCondition: "; |
| 3033 | if (*E.getSrc()->succ_begin() == E.getDst()) |
| 3034 | Out << "true"; |
| 3035 | else |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3036 | Out << "false"; |
Ted Kremenek | b38911f | 2008-01-30 23:03:39 +0000 | [diff] [blame] | 3037 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3038 | |
Ted Kremenek | b38911f | 2008-01-30 23:03:39 +0000 | [diff] [blame] | 3039 | Out << "\\l"; |
| 3040 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3041 | |
Ted Kremenek | 4a4e524 | 2008-02-28 09:25:22 +0000 | [diff] [blame] | 3042 | if (GraphPrintCheckerState->isUndefControlFlow(N)) { |
| 3043 | Out << "\\|Control-flow based on\\lUndefined value.\\l"; |
Ted Kremenek | 3b4f670 | 2008-01-30 23:24:39 +0000 | [diff] [blame] | 3044 | } |
Ted Kremenek | aa66a32 | 2008-01-16 21:46:15 +0000 | [diff] [blame] | 3045 | } |
| 3046 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3047 | |
Ted Kremenek | aed9b6a | 2008-02-28 10:21:43 +0000 | [diff] [blame] | 3048 | Out << "\\|StateID: " << (void*) N->getState() << "\\|"; |
Ted Kremenek | 016f52f | 2008-02-08 21:10:02 +0000 | [diff] [blame] | 3049 | |
Ted Kremenek | b65be70 | 2009-06-18 01:23:53 +0000 | [diff] [blame] | 3050 | const GRState *state = N->getState(); |
| 3051 | state->printDOT(Out); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3052 | |
Ted Kremenek | 803c9ed | 2008-01-23 22:30:44 +0000 | [diff] [blame] | 3053 | Out << "\\l"; |
Ted Kremenek | aa66a32 | 2008-01-16 21:46:15 +0000 | [diff] [blame] | 3054 | return Out.str(); |
| 3055 | } |
| 3056 | }; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3057 | } // end llvm namespace |
Ted Kremenek | aa66a32 | 2008-01-16 21:46:15 +0000 | [diff] [blame] | 3058 | #endif |
| 3059 | |
Ted Kremenek | ffe0f43 | 2008-03-07 22:58:01 +0000 | [diff] [blame] | 3060 | #ifndef NDEBUG |
Ted Kremenek | 7ec07fd | 2008-03-12 17:18:20 +0000 | [diff] [blame] | 3061 | template <typename ITERATOR> |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 3062 | ExplodedNode* GetGraphNode(ITERATOR I) { return *I; } |
Ted Kremenek | 7ec07fd | 2008-03-12 17:18:20 +0000 | [diff] [blame] | 3063 | |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 3064 | template <> ExplodedNode* |
| 3065 | GetGraphNode<llvm::DenseMap<ExplodedNode*, Expr*>::iterator> |
| 3066 | (llvm::DenseMap<ExplodedNode*, Expr*>::iterator I) { |
Ted Kremenek | 7ec07fd | 2008-03-12 17:18:20 +0000 | [diff] [blame] | 3067 | return I->first; |
| 3068 | } |
Ted Kremenek | ffe0f43 | 2008-03-07 22:58:01 +0000 | [diff] [blame] | 3069 | #endif |
| 3070 | |
| 3071 | void GRExprEngine::ViewGraph(bool trim) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3072 | #ifndef NDEBUG |
Ted Kremenek | ffe0f43 | 2008-03-07 22:58:01 +0000 | [diff] [blame] | 3073 | if (trim) { |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 3074 | std::vector<ExplodedNode*> Src; |
Ted Kremenek | 940abcc | 2009-03-11 01:41:22 +0000 | [diff] [blame] | 3075 | |
| 3076 | // Flush any outstanding reports to make sure we cover all the nodes. |
| 3077 | // This does not cause them to get displayed. |
| 3078 | for (BugReporter::iterator I=BR.begin(), E=BR.end(); I!=E; ++I) |
| 3079 | const_cast<BugType*>(*I)->FlushReports(BR); |
| 3080 | |
| 3081 | // Iterate through the reports and get their nodes. |
| 3082 | for (BugReporter::iterator I=BR.begin(), E=BR.end(); I!=E; ++I) { |
Ted Kremenek | e1ccccf | 2009-09-03 03:02:58 +0000 | [diff] [blame] | 3083 | for (BugType::const_iterator I2=(*I)->begin(), E2=(*I)->end(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3084 | I2!=E2; ++I2) { |
Ted Kremenek | 940abcc | 2009-03-11 01:41:22 +0000 | [diff] [blame] | 3085 | const BugReportEquivClass& EQ = *I2; |
| 3086 | const BugReport &R = **EQ.begin(); |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 3087 | ExplodedNode *N = const_cast<ExplodedNode*>(R.getEndNode()); |
Ted Kremenek | 940abcc | 2009-03-11 01:41:22 +0000 | [diff] [blame] | 3088 | if (N) Src.push_back(N); |
| 3089 | } |
| 3090 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3091 | |
Ted Kremenek | 7ec07fd | 2008-03-12 17:18:20 +0000 | [diff] [blame] | 3092 | ViewGraph(&Src[0], &Src[0]+Src.size()); |
Ted Kremenek | ffe0f43 | 2008-03-07 22:58:01 +0000 | [diff] [blame] | 3093 | } |
Ted Kremenek | 493d7a2 | 2008-03-11 18:25:33 +0000 | [diff] [blame] | 3094 | else { |
| 3095 | GraphPrintCheckerState = this; |
| 3096 | GraphPrintSourceManager = &getContext().getSourceManager(); |
Ted Kremenek | ae6814e | 2008-08-13 21:24:49 +0000 | [diff] [blame] | 3097 | |
Ted Kremenek | ffe0f43 | 2008-03-07 22:58:01 +0000 | [diff] [blame] | 3098 | llvm::ViewGraph(*G.roots_begin(), "GRExprEngine"); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3099 | |
Ted Kremenek | 493d7a2 | 2008-03-11 18:25:33 +0000 | [diff] [blame] | 3100 | GraphPrintCheckerState = NULL; |
| 3101 | GraphPrintSourceManager = NULL; |
| 3102 | } |
| 3103 | #endif |
| 3104 | } |
| 3105 | |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 3106 | void GRExprEngine::ViewGraph(ExplodedNode** Beg, ExplodedNode** End) { |
Ted Kremenek | 493d7a2 | 2008-03-11 18:25:33 +0000 | [diff] [blame] | 3107 | #ifndef NDEBUG |
| 3108 | GraphPrintCheckerState = this; |
| 3109 | GraphPrintSourceManager = &getContext().getSourceManager(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3110 | |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 3111 | std::auto_ptr<ExplodedGraph> TrimmedG(G.Trim(Beg, End).first); |
Ted Kremenek | 493d7a2 | 2008-03-11 18:25:33 +0000 | [diff] [blame] | 3112 | |
Ted Kremenek | cf118d4 | 2009-02-04 23:49:09 +0000 | [diff] [blame] | 3113 | if (!TrimmedG.get()) |
Benjamin Kramer | 6cb7c1a | 2009-08-23 12:08:50 +0000 | [diff] [blame] | 3114 | llvm::errs() << "warning: Trimmed ExplodedGraph is empty.\n"; |
Ted Kremenek | cf118d4 | 2009-02-04 23:49:09 +0000 | [diff] [blame] | 3115 | else |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3116 | llvm::ViewGraph(*TrimmedG->roots_begin(), "TrimmedGRExprEngine"); |
| 3117 | |
Ted Kremenek | 3b4f670 | 2008-01-30 23:24:39 +0000 | [diff] [blame] | 3118 | GraphPrintCheckerState = NULL; |
Ted Kremenek | e97ca06 | 2008-03-07 20:57:30 +0000 | [diff] [blame] | 3119 | GraphPrintSourceManager = NULL; |
Ted Kremenek | e01c987 | 2008-02-14 22:36:46 +0000 | [diff] [blame] | 3120 | #endif |
Ted Kremenek | ee98546 | 2008-01-16 18:18:48 +0000 | [diff] [blame] | 3121 | } |