Ted Kremenek | 294fd0a | 2011-08-20 06:00:03 +0000 | [diff] [blame] | 1 | //=-- ExprEngineCallAndReturn.cpp - Support for call/return -----*- C++ -*-===// |
| 2 | // |
| 3 | // The LLVM Compiler Infrastructure |
| 4 | // |
| 5 | // This file is distributed under the University of Illinois Open Source |
| 6 | // License. See LICENSE.TXT for details. |
| 7 | // |
| 8 | //===----------------------------------------------------------------------===// |
| 9 | // |
| 10 | // This file defines ExprEngine's support for calls and returns. |
| 11 | // |
| 12 | //===----------------------------------------------------------------------===// |
| 13 | |
Anna Zaks | e90d3f8 | 2012-08-09 00:21:33 +0000 | [diff] [blame] | 14 | #define DEBUG_TYPE "ExprEngine" |
| 15 | |
Ted Kremenek | d4aeb80 | 2012-07-02 20:21:52 +0000 | [diff] [blame] | 16 | #include "clang/Analysis/Analyses/LiveVariables.h" |
Ted Kremenek | 294fd0a | 2011-08-20 06:00:03 +0000 | [diff] [blame] | 17 | #include "clang/StaticAnalyzer/Core/CheckerManager.h" |
| 18 | #include "clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h" |
Jordan Rose | f540c54 | 2012-07-26 21:39:41 +0000 | [diff] [blame] | 19 | #include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h" |
Ted Kremenek | 294fd0a | 2011-08-20 06:00:03 +0000 | [diff] [blame] | 20 | #include "clang/AST/DeclCXX.h" |
Benjamin Kramer | 4a5f724 | 2012-04-01 19:30:51 +0000 | [diff] [blame] | 21 | #include "llvm/ADT/SmallSet.h" |
Anna Zaks | e90d3f8 | 2012-08-09 00:21:33 +0000 | [diff] [blame] | 22 | #include "llvm/ADT/Statistic.h" |
Benjamin Kramer | 4a5f724 | 2012-04-01 19:30:51 +0000 | [diff] [blame] | 23 | #include "llvm/Support/SaveAndRestore.h" |
Ted Kremenek | 294fd0a | 2011-08-20 06:00:03 +0000 | [diff] [blame] | 24 | |
Jordan Rose | 2f9c40a | 2012-07-31 18:22:40 +0000 | [diff] [blame] | 25 | #define CXX_INLINING_ENABLED 1 |
| 26 | |
Ted Kremenek | 294fd0a | 2011-08-20 06:00:03 +0000 | [diff] [blame] | 27 | using namespace clang; |
| 28 | using namespace ento; |
| 29 | |
Anna Zaks | e90d3f8 | 2012-08-09 00:21:33 +0000 | [diff] [blame] | 30 | STATISTIC(NumOfDynamicDispatchPathSplits, |
| 31 | "The # of times we split the path due to imprecise dynamic dispatch info"); |
| 32 | |
Ted Kremenek | 3070e13 | 2012-01-07 01:03:17 +0000 | [diff] [blame] | 33 | void ExprEngine::processCallEnter(CallEnter CE, ExplodedNode *Pred) { |
| 34 | // Get the entry block in the CFG of the callee. |
Ted Kremenek | 0849ade | 2012-01-12 19:25:46 +0000 | [diff] [blame] | 35 | const StackFrameContext *calleeCtx = CE.getCalleeContext(); |
| 36 | const CFG *CalleeCFG = calleeCtx->getCFG(); |
Ted Kremenek | 3070e13 | 2012-01-07 01:03:17 +0000 | [diff] [blame] | 37 | const CFGBlock *Entry = &(CalleeCFG->getEntry()); |
| 38 | |
| 39 | // Validate the CFG. |
| 40 | assert(Entry->empty()); |
| 41 | assert(Entry->succ_size() == 1); |
| 42 | |
| 43 | // Get the solitary sucessor. |
| 44 | const CFGBlock *Succ = *(Entry->succ_begin()); |
| 45 | |
| 46 | // Construct an edge representing the starting location in the callee. |
Ted Kremenek | 0849ade | 2012-01-12 19:25:46 +0000 | [diff] [blame] | 47 | BlockEdge Loc(Entry, Succ, calleeCtx); |
Ted Kremenek | 3070e13 | 2012-01-07 01:03:17 +0000 | [diff] [blame] | 48 | |
Jordan Rose | e54cfc7 | 2012-07-10 22:07:57 +0000 | [diff] [blame] | 49 | ProgramStateRef state = Pred->getState(); |
Ted Kremenek | 3070e13 | 2012-01-07 01:03:17 +0000 | [diff] [blame] | 50 | |
| 51 | // Construct a new node and add it to the worklist. |
| 52 | bool isNew; |
| 53 | ExplodedNode *Node = G.getNode(Loc, state, false, &isNew); |
| 54 | Node->addPredecessor(Pred, G); |
| 55 | if (isNew) |
| 56 | Engine.getWorkList()->enqueue(Node); |
Ted Kremenek | 294fd0a | 2011-08-20 06:00:03 +0000 | [diff] [blame] | 57 | } |
| 58 | |
Anna Zaks | 0b3ade8 | 2012-04-20 21:59:08 +0000 | [diff] [blame] | 59 | // Find the last statement on the path to the exploded node and the |
| 60 | // corresponding Block. |
| 61 | static std::pair<const Stmt*, |
| 62 | const CFGBlock*> getLastStmt(const ExplodedNode *Node) { |
| 63 | const Stmt *S = 0; |
Anna Zaks | 0b3ade8 | 2012-04-20 21:59:08 +0000 | [diff] [blame] | 64 | const StackFrameContext *SF = |
| 65 | Node->getLocation().getLocationContext()->getCurrentStackFrame(); |
Jordan Rose | 888c90a | 2012-07-26 20:04:13 +0000 | [diff] [blame] | 66 | |
| 67 | // Back up through the ExplodedGraph until we reach a statement node. |
Ted Kremenek | 256ef64 | 2012-01-11 01:06:27 +0000 | [diff] [blame] | 68 | while (Node) { |
| 69 | const ProgramPoint &PP = Node->getLocation(); |
Jordan Rose | 888c90a | 2012-07-26 20:04:13 +0000 | [diff] [blame] | 70 | |
Ted Kremenek | 256ef64 | 2012-01-11 01:06:27 +0000 | [diff] [blame] | 71 | if (const StmtPoint *SP = dyn_cast<StmtPoint>(&PP)) { |
Anna Zaks | 0b3ade8 | 2012-04-20 21:59:08 +0000 | [diff] [blame] | 72 | S = SP->getStmt(); |
Anna Zaks | 0b3ade8 | 2012-04-20 21:59:08 +0000 | [diff] [blame] | 73 | break; |
Jordan Rose | 888c90a | 2012-07-26 20:04:13 +0000 | [diff] [blame] | 74 | } else if (const CallExitEnd *CEE = dyn_cast<CallExitEnd>(&PP)) { |
| 75 | S = CEE->getCalleeContext()->getCallSite(); |
| 76 | if (S) |
| 77 | break; |
| 78 | // If we have an implicit call, we'll probably end up with a |
| 79 | // StmtPoint inside the callee, which is acceptable. |
| 80 | // (It's possible a function ONLY contains implicit calls -- such as an |
| 81 | // implicitly-generated destructor -- so we shouldn't just skip back to |
| 82 | // the CallEnter node and keep going.) |
| 83 | } else if (const CallEnter *CE = dyn_cast<CallEnter>(&PP)) { |
| 84 | // If we reached the CallEnter for this function, it has no statements. |
| 85 | if (CE->getCalleeContext() == SF) |
| 86 | break; |
Ted Kremenek | 256ef64 | 2012-01-11 01:06:27 +0000 | [diff] [blame] | 87 | } |
Jordan Rose | 888c90a | 2012-07-26 20:04:13 +0000 | [diff] [blame] | 88 | |
| 89 | Node = *Node->pred_begin(); |
Ted Kremenek | 256ef64 | 2012-01-11 01:06:27 +0000 | [diff] [blame] | 90 | } |
Jordan Rose | 888c90a | 2012-07-26 20:04:13 +0000 | [diff] [blame] | 91 | |
| 92 | const CFGBlock *Blk = 0; |
| 93 | if (S) { |
| 94 | // Now, get the enclosing basic block. |
| 95 | while (Node && Node->pred_size() >=1 ) { |
| 96 | const ProgramPoint &PP = Node->getLocation(); |
| 97 | if (isa<BlockEdge>(PP) && |
| 98 | (PP.getLocationContext()->getCurrentStackFrame() == SF)) { |
| 99 | BlockEdge &EPP = cast<BlockEdge>(PP); |
| 100 | Blk = EPP.getDst(); |
| 101 | break; |
| 102 | } |
| 103 | Node = *Node->pred_begin(); |
| 104 | } |
| 105 | } |
| 106 | |
Anna Zaks | 0b3ade8 | 2012-04-20 21:59:08 +0000 | [diff] [blame] | 107 | return std::pair<const Stmt*, const CFGBlock*>(S, Blk); |
Ted Kremenek | 256ef64 | 2012-01-11 01:06:27 +0000 | [diff] [blame] | 108 | } |
| 109 | |
Anna Zaks | 0b3ade8 | 2012-04-20 21:59:08 +0000 | [diff] [blame] | 110 | /// The call exit is simulated with a sequence of nodes, which occur between |
| 111 | /// CallExitBegin and CallExitEnd. The following operations occur between the |
| 112 | /// two program points: |
| 113 | /// 1. CallExitBegin (triggers the start of call exit sequence) |
| 114 | /// 2. Bind the return value |
| 115 | /// 3. Run Remove dead bindings to clean up the dead symbols from the callee. |
| 116 | /// 4. CallExitEnd (switch to the caller context) |
| 117 | /// 5. PostStmt<CallExpr> |
| 118 | void ExprEngine::processCallExit(ExplodedNode *CEBNode) { |
| 119 | // Step 1 CEBNode was generated before the call. |
| 120 | |
| 121 | const StackFrameContext *calleeCtx = |
| 122 | CEBNode->getLocationContext()->getCurrentStackFrame(); |
Ted Kremenek | 7fa9b4f | 2012-06-01 20:04:04 +0000 | [diff] [blame] | 123 | |
| 124 | // The parent context might not be a stack frame, so make sure we |
| 125 | // look up the first enclosing stack frame. |
| 126 | const StackFrameContext *callerCtx = |
| 127 | calleeCtx->getParent()->getCurrentStackFrame(); |
| 128 | |
Ted Kremenek | 294fd0a | 2011-08-20 06:00:03 +0000 | [diff] [blame] | 129 | const Stmt *CE = calleeCtx->getCallSite(); |
Anna Zaks | 0b3ade8 | 2012-04-20 21:59:08 +0000 | [diff] [blame] | 130 | ProgramStateRef state = CEBNode->getState(); |
| 131 | // Find the last statement in the function and the corresponding basic block. |
| 132 | const Stmt *LastSt = 0; |
| 133 | const CFGBlock *Blk = 0; |
| 134 | llvm::tie(LastSt, Blk) = getLastStmt(CEBNode); |
| 135 | |
Jordan Rose | 852aa0d | 2012-07-10 22:07:52 +0000 | [diff] [blame] | 136 | // Step 2: generate node with bound return value: CEBNode -> BindedRetNode. |
Anna Zaks | 0b3ade8 | 2012-04-20 21:59:08 +0000 | [diff] [blame] | 137 | |
Ted Kremenek | 294fd0a | 2011-08-20 06:00:03 +0000 | [diff] [blame] | 138 | // If the callee returns an expression, bind its value to CallExpr. |
Jordan Rose | 852aa0d | 2012-07-10 22:07:52 +0000 | [diff] [blame] | 139 | if (CE) { |
| 140 | if (const ReturnStmt *RS = dyn_cast_or_null<ReturnStmt>(LastSt)) { |
| 141 | const LocationContext *LCtx = CEBNode->getLocationContext(); |
| 142 | SVal V = state->getSVal(RS, LCtx); |
Jordan Rose | 57c0336 | 2012-07-30 23:39:47 +0000 | [diff] [blame] | 143 | state = state->BindExpr(CE, callerCtx, V); |
Jordan Rose | 852aa0d | 2012-07-10 22:07:52 +0000 | [diff] [blame] | 144 | } |
Anna Zaks | 0b3ade8 | 2012-04-20 21:59:08 +0000 | [diff] [blame] | 145 | |
Jordan Rose | 852aa0d | 2012-07-10 22:07:52 +0000 | [diff] [blame] | 146 | // Bind the constructed object value to CXXConstructExpr. |
| 147 | if (const CXXConstructExpr *CCE = dyn_cast<CXXConstructExpr>(CE)) { |
| 148 | loc::MemRegionVal This = |
| 149 | svalBuilder.getCXXThis(CCE->getConstructor()->getParent(), calleeCtx); |
| 150 | SVal ThisV = state->getSVal(This); |
Anna Zaks | 0b3ade8 | 2012-04-20 21:59:08 +0000 | [diff] [blame] | 151 | |
Jordan Rose | 852aa0d | 2012-07-10 22:07:52 +0000 | [diff] [blame] | 152 | // Always bind the region to the CXXConstructExpr. |
Jordan Rose | 57c0336 | 2012-07-30 23:39:47 +0000 | [diff] [blame] | 153 | state = state->BindExpr(CCE, callerCtx, ThisV); |
Jordan Rose | 852aa0d | 2012-07-10 22:07:52 +0000 | [diff] [blame] | 154 | } |
Ted Kremenek | 294fd0a | 2011-08-20 06:00:03 +0000 | [diff] [blame] | 155 | } |
Anna Zaks | 0b3ade8 | 2012-04-20 21:59:08 +0000 | [diff] [blame] | 156 | |
Anna Zaks | 0b3ade8 | 2012-04-20 21:59:08 +0000 | [diff] [blame] | 157 | // Step 3: BindedRetNode -> CleanedNodes |
| 158 | // If we can find a statement and a block in the inlined function, run remove |
| 159 | // dead bindings before returning from the call. This is important to ensure |
| 160 | // that we report the issues such as leaks in the stack contexts in which |
| 161 | // they occurred. |
| 162 | ExplodedNodeSet CleanedNodes; |
| 163 | if (LastSt && Blk) { |
Jordan Rose | 48b6247 | 2012-07-10 22:08:01 +0000 | [diff] [blame] | 164 | static SimpleProgramPointTag retValBind("ExprEngine : Bind Return Value"); |
| 165 | PostStmt Loc(LastSt, calleeCtx, &retValBind); |
| 166 | bool isNew; |
| 167 | ExplodedNode *BindedRetNode = G.getNode(Loc, state, false, &isNew); |
| 168 | BindedRetNode->addPredecessor(CEBNode, G); |
| 169 | if (!isNew) |
| 170 | return; |
| 171 | |
Anna Zaks | 0b3ade8 | 2012-04-20 21:59:08 +0000 | [diff] [blame] | 172 | NodeBuilderContext Ctx(getCoreEngine(), Blk, BindedRetNode); |
| 173 | currentBuilderContext = &Ctx; |
| 174 | // Here, we call the Symbol Reaper with 0 statement and caller location |
| 175 | // context, telling it to clean up everything in the callee's context |
| 176 | // (and it's children). We use LastStmt as a diagnostic statement, which |
| 177 | // which the PreStmtPurge Dead point will be associated. |
| 178 | removeDead(BindedRetNode, CleanedNodes, 0, callerCtx, LastSt, |
| 179 | ProgramPoint::PostStmtPurgeDeadSymbolsKind); |
| 180 | currentBuilderContext = 0; |
Anna Zaks | 144e52b | 2012-06-01 23:48:40 +0000 | [diff] [blame] | 181 | } else { |
| 182 | CleanedNodes.Add(CEBNode); |
Anna Zaks | 0b3ade8 | 2012-04-20 21:59:08 +0000 | [diff] [blame] | 183 | } |
| 184 | |
| 185 | for (ExplodedNodeSet::iterator I = CleanedNodes.begin(), |
| 186 | E = CleanedNodes.end(); I != E; ++I) { |
| 187 | |
| 188 | // Step 4: Generate the CallExit and leave the callee's context. |
| 189 | // CleanedNodes -> CEENode |
Jordan Rose | 852aa0d | 2012-07-10 22:07:52 +0000 | [diff] [blame] | 190 | CallExitEnd Loc(calleeCtx, callerCtx); |
Anna Zaks | 0b3ade8 | 2012-04-20 21:59:08 +0000 | [diff] [blame] | 191 | bool isNew; |
Jordan Rose | 48b6247 | 2012-07-10 22:08:01 +0000 | [diff] [blame] | 192 | ProgramStateRef CEEState = (*I == CEBNode) ? state : (*I)->getState(); |
| 193 | ExplodedNode *CEENode = G.getNode(Loc, CEEState, false, &isNew); |
Anna Zaks | 0b3ade8 | 2012-04-20 21:59:08 +0000 | [diff] [blame] | 194 | CEENode->addPredecessor(*I, G); |
| 195 | if (!isNew) |
| 196 | return; |
| 197 | |
| 198 | // Step 5: Perform the post-condition check of the CallExpr and enqueue the |
| 199 | // result onto the work list. |
| 200 | // CEENode -> Dst -> WorkList |
Anna Zaks | 0b3ade8 | 2012-04-20 21:59:08 +0000 | [diff] [blame] | 201 | NodeBuilderContext Ctx(Engine, calleeCtx->getCallSiteBlock(), CEENode); |
| 202 | SaveAndRestore<const NodeBuilderContext*> NBCSave(currentBuilderContext, |
| 203 | &Ctx); |
| 204 | SaveAndRestore<unsigned> CBISave(currentStmtIdx, calleeCtx->getIndex()); |
| 205 | |
Jordan Rose | 57c0336 | 2012-07-30 23:39:47 +0000 | [diff] [blame] | 206 | CallEventManager &CEMgr = getStateManager().getCallEventManager(); |
| 207 | CallEventRef<> Call = CEMgr.getCaller(calleeCtx, CEEState); |
| 208 | |
| 209 | ExplodedNodeSet DstPostCall; |
| 210 | getCheckerManager().runCheckersForPostCall(DstPostCall, CEENode, *Call, |
| 211 | *this, true); |
| 212 | |
| 213 | ExplodedNodeSet Dst; |
| 214 | if (isa<ObjCMethodCall>(Call)) { |
| 215 | getCheckerManager().runCheckersForPostObjCMessage(Dst, DstPostCall, |
| 216 | cast<ObjCMethodCall>(*Call), |
| 217 | *this, true); |
| 218 | } else if (CE) { |
| 219 | getCheckerManager().runCheckersForPostStmt(Dst, DstPostCall, CE, |
| 220 | *this, true); |
| 221 | } else { |
| 222 | Dst.insert(DstPostCall); |
| 223 | } |
Anna Zaks | 0b3ade8 | 2012-04-20 21:59:08 +0000 | [diff] [blame] | 224 | |
| 225 | // Enqueue the next element in the block. |
| 226 | for (ExplodedNodeSet::iterator PSI = Dst.begin(), PSE = Dst.end(); |
| 227 | PSI != PSE; ++PSI) { |
| 228 | Engine.getWorkList()->enqueue(*PSI, calleeCtx->getCallSiteBlock(), |
| 229 | calleeCtx->getIndex()+1); |
| 230 | } |
Ted Kremenek | 242384d | 2012-01-07 00:10:49 +0000 | [diff] [blame] | 231 | } |
Ted Kremenek | 294fd0a | 2011-08-20 06:00:03 +0000 | [diff] [blame] | 232 | } |
| 233 | |
Ted Kremenek | 0849ade | 2012-01-12 19:25:46 +0000 | [diff] [blame] | 234 | static unsigned getNumberStackFrames(const LocationContext *LCtx) { |
| 235 | unsigned count = 0; |
| 236 | while (LCtx) { |
| 237 | if (isa<StackFrameContext>(LCtx)) |
| 238 | ++count; |
| 239 | LCtx = LCtx->getParent(); |
| 240 | } |
| 241 | return count; |
| 242 | } |
| 243 | |
Anna Zaks | 6cc0969 | 2012-03-13 22:15:58 +0000 | [diff] [blame] | 244 | // Determine if we should inline the call. |
Ted Kremenek | 7fa9b4f | 2012-06-01 20:04:04 +0000 | [diff] [blame] | 245 | bool ExprEngine::shouldInlineDecl(const Decl *D, ExplodedNode *Pred) { |
| 246 | AnalysisDeclContext *CalleeADC = AMgr.getAnalysisDeclContext(D); |
Anna Zaks | 6cc0969 | 2012-03-13 22:15:58 +0000 | [diff] [blame] | 247 | const CFG *CalleeCFG = CalleeADC->getCFG(); |
| 248 | |
Ted Kremenek | 01561d1 | 2012-04-17 01:36:03 +0000 | [diff] [blame] | 249 | // It is possible that the CFG cannot be constructed. |
| 250 | // Be safe, and check if the CalleeCFG is valid. |
| 251 | if (!CalleeCFG) |
| 252 | return false; |
| 253 | |
Anna Zaks | 6cc0969 | 2012-03-13 22:15:58 +0000 | [diff] [blame] | 254 | if (getNumberStackFrames(Pred->getLocationContext()) |
| 255 | == AMgr.InlineMaxStackDepth) |
| 256 | return false; |
| 257 | |
Ted Kremenek | 7fa9b4f | 2012-06-01 20:04:04 +0000 | [diff] [blame] | 258 | if (Engine.FunctionSummaries->hasReachedMaxBlockCount(D)) |
Anna Zaks | 3bbd8cd | 2012-03-30 05:48:10 +0000 | [diff] [blame] | 259 | return false; |
| 260 | |
Anna Zaks | 6cc0969 | 2012-03-13 22:15:58 +0000 | [diff] [blame] | 261 | if (CalleeCFG->getNumBlockIDs() > AMgr.InlineMaxFunctionSize) |
| 262 | return false; |
| 263 | |
Ted Kremenek | 10f77ad | 2012-06-22 23:55:50 +0000 | [diff] [blame] | 264 | // Do not inline variadic calls (for now). |
| 265 | if (const BlockDecl *BD = dyn_cast<BlockDecl>(D)) { |
| 266 | if (BD->isVariadic()) |
| 267 | return false; |
Anna Zaks | 5903a37 | 2012-03-27 20:02:53 +0000 | [diff] [blame] | 268 | } |
Ted Kremenek | 10f77ad | 2012-06-22 23:55:50 +0000 | [diff] [blame] | 269 | else if (const FunctionDecl *FD = dyn_cast<FunctionDecl>(D)) { |
| 270 | if (FD->isVariadic()) |
| 271 | return false; |
| 272 | } |
Anna Zaks | 5903a37 | 2012-03-27 20:02:53 +0000 | [diff] [blame] | 273 | |
Ted Kremenek | d4aeb80 | 2012-07-02 20:21:52 +0000 | [diff] [blame] | 274 | // It is possible that the live variables analysis cannot be |
| 275 | // run. If so, bail out. |
| 276 | if (!CalleeADC->getAnalysis<RelaxedLiveVariables>()) |
| 277 | return false; |
| 278 | |
Ted Kremenek | 10f77ad | 2012-06-22 23:55:50 +0000 | [diff] [blame] | 279 | return true; |
Anna Zaks | 5903a37 | 2012-03-27 20:02:53 +0000 | [diff] [blame] | 280 | } |
| 281 | |
Anna Zaks | e90d3f8 | 2012-08-09 00:21:33 +0000 | [diff] [blame] | 282 | /// The GDM component containing the dynamic dispatch bifurcation info. When |
| 283 | /// the exact type of the receiver is not known, we want to explore both paths - |
| 284 | /// one on which we do inline it and the other one on which we don't. This is |
| 285 | /// done to ensure we do not drop coverage. |
| 286 | /// This is the map from the receiver region to a bool, specifying either we |
| 287 | /// consider this region's information precise or not along the given path. |
| 288 | namespace clang { |
| 289 | namespace ento { |
Anna Zaks | 6960f6e | 2012-08-09 21:02:41 +0000 | [diff] [blame] | 290 | enum DynamicDispatchMode { DynamicDispatchModeInlined = 1, |
| 291 | DynamicDispatchModeConservative }; |
| 292 | |
Anna Zaks | e90d3f8 | 2012-08-09 00:21:33 +0000 | [diff] [blame] | 293 | struct DynamicDispatchBifurcationMap {}; |
| 294 | typedef llvm::ImmutableMap<const MemRegion*, |
Anna Zaks | 6960f6e | 2012-08-09 21:02:41 +0000 | [diff] [blame] | 295 | unsigned int> DynamicDispatchBifur; |
Anna Zaks | e90d3f8 | 2012-08-09 00:21:33 +0000 | [diff] [blame] | 296 | template<> struct ProgramStateTrait<DynamicDispatchBifurcationMap> |
| 297 | : public ProgramStatePartialTrait<DynamicDispatchBifur> { |
| 298 | static void *GDMIndex() { static int index; return &index; } |
| 299 | }; |
Anna Zaks | 6960f6e | 2012-08-09 21:02:41 +0000 | [diff] [blame] | 300 | |
Anna Zaks | e90d3f8 | 2012-08-09 00:21:33 +0000 | [diff] [blame] | 301 | }} |
Anna Zaks | 5903a37 | 2012-03-27 20:02:53 +0000 | [diff] [blame] | 302 | |
Anna Zaks | e90d3f8 | 2012-08-09 00:21:33 +0000 | [diff] [blame] | 303 | bool ExprEngine::inlineCall(const CallEvent &Call, const Decl *D, |
| 304 | NodeBuilder &Bldr, ExplodedNode *Pred, |
| 305 | ProgramStateRef State) { |
| 306 | assert(D); |
Jordan Rose | ee158bc | 2012-07-09 16:54:49 +0000 | [diff] [blame] | 307 | |
Jordan Rose | c36b30c | 2012-07-12 00:16:25 +0000 | [diff] [blame] | 308 | const LocationContext *CurLC = Pred->getLocationContext(); |
| 309 | const StackFrameContext *CallerSFC = CurLC->getCurrentStackFrame(); |
Ted Kremenek | 7fa9b4f | 2012-06-01 20:04:04 +0000 | [diff] [blame] | 310 | const LocationContext *ParentOfCallee = 0; |
Jordan Rose | 69f87c9 | 2012-07-02 19:28:09 +0000 | [diff] [blame] | 311 | |
Jordan Rose | ef15831 | 2012-07-31 01:07:55 +0000 | [diff] [blame] | 312 | // FIXME: Refactor this check into a hypothetical CallEvent::canInline. |
Jordan Rose | 69f87c9 | 2012-07-02 19:28:09 +0000 | [diff] [blame] | 313 | switch (Call.getKind()) { |
| 314 | case CE_Function: |
Jordan Rose | 2f9c40a | 2012-07-31 18:22:40 +0000 | [diff] [blame] | 315 | break; |
Jordan Rose | 69f87c9 | 2012-07-02 19:28:09 +0000 | [diff] [blame] | 316 | case CE_CXXMember: |
Jordan Rose | e54cfc7 | 2012-07-10 22:07:57 +0000 | [diff] [blame] | 317 | case CE_CXXMemberOperator: |
Jordan Rose | 2f9c40a | 2012-07-31 18:22:40 +0000 | [diff] [blame] | 318 | if (!CXX_INLINING_ENABLED) |
| 319 | return false; |
Jordan Rose | 69f87c9 | 2012-07-02 19:28:09 +0000 | [diff] [blame] | 320 | break; |
Jordan Rose | ef15831 | 2012-07-31 01:07:55 +0000 | [diff] [blame] | 321 | case CE_CXXConstructor: { |
Jordan Rose | 2f9c40a | 2012-07-31 18:22:40 +0000 | [diff] [blame] | 322 | if (!CXX_INLINING_ENABLED) |
| 323 | return false; |
| 324 | |
Jordan Rose | ef15831 | 2012-07-31 01:07:55 +0000 | [diff] [blame] | 325 | // Only inline constructors and destructors if we built the CFGs for them |
| 326 | // properly. |
| 327 | const AnalysisDeclContext *ADC = CallerSFC->getAnalysisDeclContext(); |
| 328 | if (!ADC->getCFGBuildOptions().AddImplicitDtors || |
| 329 | !ADC->getCFGBuildOptions().AddInitializers) |
| 330 | return false; |
| 331 | |
| 332 | const CXXConstructorCall &Ctor = cast<CXXConstructorCall>(Call); |
| 333 | |
| 334 | // FIXME: We don't handle constructors or destructors for arrays properly. |
| 335 | const MemRegion *Target = Ctor.getCXXThisVal().getAsRegion(); |
| 336 | if (Target && isa<ElementRegion>(Target)) |
| 337 | return false; |
| 338 | |
| 339 | // FIXME: This is a hack. We don't handle temporary destructors |
| 340 | // right now, so we shouldn't inline their constructors. |
| 341 | const CXXConstructExpr *CtorExpr = Ctor.getOriginExpr(); |
| 342 | if (CtorExpr->getConstructionKind() == CXXConstructExpr::CK_Complete) |
| 343 | if (!Target || !isa<DeclRegion>(Target)) |
| 344 | return false; |
| 345 | |
| 346 | break; |
| 347 | } |
Jordan Rose | da5fc53 | 2012-07-26 20:04:00 +0000 | [diff] [blame] | 348 | case CE_CXXDestructor: { |
Jordan Rose | 2f9c40a | 2012-07-31 18:22:40 +0000 | [diff] [blame] | 349 | if (!CXX_INLINING_ENABLED) |
| 350 | return false; |
| 351 | |
Jordan Rose | da5fc53 | 2012-07-26 20:04:00 +0000 | [diff] [blame] | 352 | // Only inline constructors and destructors if we built the CFGs for them |
| 353 | // properly. |
| 354 | const AnalysisDeclContext *ADC = CallerSFC->getAnalysisDeclContext(); |
| 355 | if (!ADC->getCFGBuildOptions().AddImplicitDtors || |
| 356 | !ADC->getCFGBuildOptions().AddInitializers) |
| 357 | return false; |
Jordan Rose | 3a0a9e3 | 2012-07-26 20:04:21 +0000 | [diff] [blame] | 358 | |
Jordan Rose | ef15831 | 2012-07-31 01:07:55 +0000 | [diff] [blame] | 359 | const CXXDestructorCall &Dtor = cast<CXXDestructorCall>(Call); |
| 360 | |
Jordan Rose | e460c46 | 2012-07-26 20:04:25 +0000 | [diff] [blame] | 361 | // FIXME: We don't handle constructors or destructors for arrays properly. |
Jordan Rose | ef15831 | 2012-07-31 01:07:55 +0000 | [diff] [blame] | 362 | const MemRegion *Target = Dtor.getCXXThisVal().getAsRegion(); |
Jordan Rose | e460c46 | 2012-07-26 20:04:25 +0000 | [diff] [blame] | 363 | if (Target && isa<ElementRegion>(Target)) |
| 364 | return false; |
| 365 | |
Jordan Rose | da5fc53 | 2012-07-26 20:04:00 +0000 | [diff] [blame] | 366 | break; |
| 367 | } |
Jordan Rose | 70cbf3c | 2012-07-02 22:21:47 +0000 | [diff] [blame] | 368 | case CE_CXXAllocator: |
Jordan Rose | 2f9c40a | 2012-07-31 18:22:40 +0000 | [diff] [blame] | 369 | if (!CXX_INLINING_ENABLED) |
| 370 | return false; |
| 371 | |
Jordan Rose | 70cbf3c | 2012-07-02 22:21:47 +0000 | [diff] [blame] | 372 | // Do not inline allocators until we model deallocators. |
| 373 | // This is unfortunate, but basically necessary for smart pointers and such. |
| 374 | return false; |
Jordan Rose | 69f87c9 | 2012-07-02 19:28:09 +0000 | [diff] [blame] | 375 | case CE_Block: { |
| 376 | const BlockDataRegion *BR = cast<BlockCall>(Call).getBlockRegion(); |
Jordan Rose | ee158bc | 2012-07-09 16:54:49 +0000 | [diff] [blame] | 377 | assert(BR && "If we have the block definition we should have its region"); |
Jordan Rose | 69f87c9 | 2012-07-02 19:28:09 +0000 | [diff] [blame] | 378 | AnalysisDeclContext *BlockCtx = AMgr.getAnalysisDeclContext(D); |
Ted Kremenek | 7fa9b4f | 2012-06-01 20:04:04 +0000 | [diff] [blame] | 379 | ParentOfCallee = BlockCtx->getBlockInvocationContext(CallerSFC, |
Jordan Rose | 69f87c9 | 2012-07-02 19:28:09 +0000 | [diff] [blame] | 380 | cast<BlockDecl>(D), |
Ted Kremenek | 7fa9b4f | 2012-06-01 20:04:04 +0000 | [diff] [blame] | 381 | BR); |
Jordan Rose | 69f87c9 | 2012-07-02 19:28:09 +0000 | [diff] [blame] | 382 | break; |
| 383 | } |
| 384 | case CE_ObjCMessage: |
Anna Zaks | e90d3f8 | 2012-08-09 00:21:33 +0000 | [diff] [blame] | 385 | if (!(getAnalysisManager().IPAMode == DynamicDispatch || |
| 386 | getAnalysisManager().IPAMode == DynamicDispatchBifurcate)) |
Anna Zaks | e13056a | 2012-07-30 20:31:18 +0000 | [diff] [blame] | 387 | return false; |
Anna Zaks | 9dc5167 | 2012-07-26 00:27:51 +0000 | [diff] [blame] | 388 | break; |
Ted Kremenek | 7fa9b4f | 2012-06-01 20:04:04 +0000 | [diff] [blame] | 389 | } |
Jordan Rose | ee158bc | 2012-07-09 16:54:49 +0000 | [diff] [blame] | 390 | |
| 391 | if (!shouldInlineDecl(D, Pred)) |
Ted Kremenek | 256ef64 | 2012-01-11 01:06:27 +0000 | [diff] [blame] | 392 | return false; |
| 393 | |
Ted Kremenek | 7fa9b4f | 2012-06-01 20:04:04 +0000 | [diff] [blame] | 394 | if (!ParentOfCallee) |
| 395 | ParentOfCallee = CallerSFC; |
Anna Zaks | 8235f9c | 2012-03-02 19:05:03 +0000 | [diff] [blame] | 396 | |
Jordan Rose | 852aa0d | 2012-07-10 22:07:52 +0000 | [diff] [blame] | 397 | // This may be NULL, but that's fine. |
Jordan Rose | 69f87c9 | 2012-07-02 19:28:09 +0000 | [diff] [blame] | 398 | const Expr *CallE = Call.getOriginExpr(); |
Jordan Rose | 69f87c9 | 2012-07-02 19:28:09 +0000 | [diff] [blame] | 399 | |
Ted Kremenek | 7fa9b4f | 2012-06-01 20:04:04 +0000 | [diff] [blame] | 400 | // Construct a new stack frame for the callee. |
| 401 | AnalysisDeclContext *CalleeADC = AMgr.getAnalysisDeclContext(D); |
| 402 | const StackFrameContext *CalleeSFC = |
Jordan Rose | 69f87c9 | 2012-07-02 19:28:09 +0000 | [diff] [blame] | 403 | CalleeADC->getStackFrame(ParentOfCallee, CallE, |
Ted Kremenek | 7fa9b4f | 2012-06-01 20:04:04 +0000 | [diff] [blame] | 404 | currentBuilderContext->getBlock(), |
| 405 | currentStmtIdx); |
| 406 | |
Jordan Rose | c36b30c | 2012-07-12 00:16:25 +0000 | [diff] [blame] | 407 | CallEnter Loc(CallE, CalleeSFC, CurLC); |
Jordan Rose | e54cfc7 | 2012-07-10 22:07:57 +0000 | [diff] [blame] | 408 | |
| 409 | // Construct a new state which contains the mapping from actual to |
| 410 | // formal arguments. |
Anna Zaks | e90d3f8 | 2012-08-09 00:21:33 +0000 | [diff] [blame] | 411 | State = State->enterStackFrame(Call, CalleeSFC); |
Jordan Rose | e54cfc7 | 2012-07-10 22:07:57 +0000 | [diff] [blame] | 412 | |
Ted Kremenek | 7fa9b4f | 2012-06-01 20:04:04 +0000 | [diff] [blame] | 413 | bool isNew; |
Jordan Rose | e54cfc7 | 2012-07-10 22:07:57 +0000 | [diff] [blame] | 414 | if (ExplodedNode *N = G.getNode(Loc, State, false, &isNew)) { |
Ted Kremenek | 7fa9b4f | 2012-06-01 20:04:04 +0000 | [diff] [blame] | 415 | N->addPredecessor(Pred, G); |
| 416 | if (isNew) |
| 417 | Engine.getWorkList()->enqueue(N); |
Ted Kremenek | 256ef64 | 2012-01-11 01:06:27 +0000 | [diff] [blame] | 418 | } |
Anna Zaks | e90d3f8 | 2012-08-09 00:21:33 +0000 | [diff] [blame] | 419 | |
| 420 | // If we decided to inline the call, the successor has been manually |
| 421 | // added onto the work list so remove it from the node builder. |
| 422 | Bldr.takeNodes(Pred); |
| 423 | |
Ted Kremenek | 7fa9b4f | 2012-06-01 20:04:04 +0000 | [diff] [blame] | 424 | return true; |
Ted Kremenek | 256ef64 | 2012-01-11 01:06:27 +0000 | [diff] [blame] | 425 | } |
| 426 | |
Anna Zaks | e81ce25 | 2012-07-19 23:38:13 +0000 | [diff] [blame] | 427 | static ProgramStateRef getInlineFailedState(ProgramStateRef State, |
Jordan Rose | 69f87c9 | 2012-07-02 19:28:09 +0000 | [diff] [blame] | 428 | const Stmt *CallE) { |
Anna Zaks | e81ce25 | 2012-07-19 23:38:13 +0000 | [diff] [blame] | 429 | void *ReplayState = State->get<ReplayWithoutInlining>(); |
Anna Zaks | 5903a37 | 2012-03-27 20:02:53 +0000 | [diff] [blame] | 430 | if (!ReplayState) |
| 431 | return 0; |
Jordan Rose | 28038f3 | 2012-07-10 22:07:42 +0000 | [diff] [blame] | 432 | |
| 433 | assert(ReplayState == (const void*)CallE && "Backtracked to the wrong call."); |
| 434 | (void)CallE; |
| 435 | |
Anna Zaks | e81ce25 | 2012-07-19 23:38:13 +0000 | [diff] [blame] | 436 | return State->remove<ReplayWithoutInlining>(); |
Ted Kremenek | 10520d7 | 2012-02-09 21:59:52 +0000 | [diff] [blame] | 437 | } |
| 438 | |
Ted Kremenek | 294fd0a | 2011-08-20 06:00:03 +0000 | [diff] [blame] | 439 | void ExprEngine::VisitCallExpr(const CallExpr *CE, ExplodedNode *Pred, |
| 440 | ExplodedNodeSet &dst) { |
| 441 | // Perform the previsit of the CallExpr. |
| 442 | ExplodedNodeSet dstPreVisit; |
| 443 | getCheckerManager().runCheckersForPreStmt(dstPreVisit, Pred, CE, *this); |
Anna Zaks | 5903a37 | 2012-03-27 20:02:53 +0000 | [diff] [blame] | 444 | |
Jordan Rose | d563d3f | 2012-07-30 20:22:09 +0000 | [diff] [blame] | 445 | // Get the call in its initial state. We use this as a template to perform |
| 446 | // all the checks. |
| 447 | CallEventManager &CEMgr = getStateManager().getCallEventManager(); |
Jordan Rose | 645baee | 2012-08-13 23:46:05 +0000 | [diff] [blame^] | 448 | CallEventRef<> CallTemplate |
Jordan Rose | d563d3f | 2012-07-30 20:22:09 +0000 | [diff] [blame] | 449 | = CEMgr.getSimpleCall(CE, Pred->getState(), Pred->getLocationContext()); |
Anna Zaks | 5903a37 | 2012-03-27 20:02:53 +0000 | [diff] [blame] | 450 | |
Jordan Rose | 69f87c9 | 2012-07-02 19:28:09 +0000 | [diff] [blame] | 451 | // Evaluate the function call. We try each of the checkers |
Ted Kremenek | 294fd0a | 2011-08-20 06:00:03 +0000 | [diff] [blame] | 452 | // to see if the can evaluate the function call. |
| 453 | ExplodedNodeSet dstCallEvaluated; |
Jordan Rose | 69f87c9 | 2012-07-02 19:28:09 +0000 | [diff] [blame] | 454 | for (ExplodedNodeSet::iterator I = dstPreVisit.begin(), E = dstPreVisit.end(); |
| 455 | I != E; ++I) { |
Jordan Rose | d563d3f | 2012-07-30 20:22:09 +0000 | [diff] [blame] | 456 | evalCall(dstCallEvaluated, *I, *CallTemplate); |
Jordan Rose | 69f87c9 | 2012-07-02 19:28:09 +0000 | [diff] [blame] | 457 | } |
| 458 | |
Ted Kremenek | 294fd0a | 2011-08-20 06:00:03 +0000 | [diff] [blame] | 459 | // Finally, perform the post-condition check of the CallExpr and store |
| 460 | // the created nodes in 'Dst'. |
Jordan Rose | 69f87c9 | 2012-07-02 19:28:09 +0000 | [diff] [blame] | 461 | // Note that if the call was inlined, dstCallEvaluated will be empty. |
| 462 | // The post-CallExpr check will occur in processCallExit. |
Ted Kremenek | 294fd0a | 2011-08-20 06:00:03 +0000 | [diff] [blame] | 463 | getCheckerManager().runCheckersForPostStmt(dst, dstCallEvaluated, CE, |
| 464 | *this); |
| 465 | } |
| 466 | |
Jordan Rose | 69f87c9 | 2012-07-02 19:28:09 +0000 | [diff] [blame] | 467 | void ExprEngine::evalCall(ExplodedNodeSet &Dst, ExplodedNode *Pred, |
Jordan Rose | 645baee | 2012-08-13 23:46:05 +0000 | [diff] [blame^] | 468 | const CallEvent &Call) { |
Jordan Rose | d563d3f | 2012-07-30 20:22:09 +0000 | [diff] [blame] | 469 | // WARNING: At this time, the state attached to 'Call' may be older than the |
| 470 | // state in 'Pred'. This is a minor optimization since CheckerManager will |
| 471 | // use an updated CallEvent instance when calling checkers, but if 'Call' is |
| 472 | // ever used directly in this function all callers should be updated to pass |
| 473 | // the most recent state. (It is probably not worth doing the work here since |
| 474 | // for some callers this will not be necessary.) |
| 475 | |
Jordan Rose | 96479da | 2012-07-02 19:28:16 +0000 | [diff] [blame] | 476 | // Run any pre-call checks using the generic call interface. |
| 477 | ExplodedNodeSet dstPreVisit; |
| 478 | getCheckerManager().runCheckersForPreCall(dstPreVisit, Pred, Call, *this); |
| 479 | |
| 480 | // Actually evaluate the function call. We try each of the checkers |
| 481 | // to see if the can evaluate the function call, and get a callback at |
| 482 | // defaultEvalCall if all of them fail. |
| 483 | ExplodedNodeSet dstCallEvaluated; |
| 484 | getCheckerManager().runCheckersForEvalCall(dstCallEvaluated, dstPreVisit, |
| 485 | Call, *this); |
| 486 | |
| 487 | // Finally, run any post-call checks. |
| 488 | getCheckerManager().runCheckersForPostCall(Dst, dstCallEvaluated, |
| 489 | Call, *this); |
Jordan Rose | 69f87c9 | 2012-07-02 19:28:09 +0000 | [diff] [blame] | 490 | } |
| 491 | |
Anna Zaks | e81ce25 | 2012-07-19 23:38:13 +0000 | [diff] [blame] | 492 | ProgramStateRef ExprEngine::bindReturnValue(const CallEvent &Call, |
| 493 | const LocationContext *LCtx, |
| 494 | ProgramStateRef State) { |
| 495 | const Expr *E = Call.getOriginExpr(); |
| 496 | if (!E) |
| 497 | return State; |
| 498 | |
| 499 | // Some method families have known return values. |
| 500 | if (const ObjCMethodCall *Msg = dyn_cast<ObjCMethodCall>(&Call)) { |
| 501 | switch (Msg->getMethodFamily()) { |
| 502 | default: |
| 503 | break; |
| 504 | case OMF_autorelease: |
| 505 | case OMF_retain: |
| 506 | case OMF_self: { |
| 507 | // These methods return their receivers. |
| 508 | return State->BindExpr(E, LCtx, Msg->getReceiverSVal()); |
Anna Zaks | e81ce25 | 2012-07-19 23:38:13 +0000 | [diff] [blame] | 509 | } |
| 510 | } |
Jordan Rose | e460c46 | 2012-07-26 20:04:25 +0000 | [diff] [blame] | 511 | } else if (const CXXConstructorCall *C = dyn_cast<CXXConstructorCall>(&Call)){ |
| 512 | return State->BindExpr(E, LCtx, C->getCXXThisVal()); |
Anna Zaks | e81ce25 | 2012-07-19 23:38:13 +0000 | [diff] [blame] | 513 | } |
| 514 | |
| 515 | // Conjure a symbol if the return value is unknown. |
| 516 | QualType ResultTy = Call.getResultType(); |
| 517 | SValBuilder &SVB = getSValBuilder(); |
| 518 | unsigned Count = currentBuilderContext->getCurrentBlockCount(); |
| 519 | SVal R = SVB.getConjuredSymbolVal(0, E, LCtx, ResultTy, Count); |
| 520 | return State->BindExpr(E, LCtx, R); |
| 521 | } |
| 522 | |
Anna Zaks | e90d3f8 | 2012-08-09 00:21:33 +0000 | [diff] [blame] | 523 | // Conservatively evaluate call by invalidating regions and binding |
| 524 | // a conjured return value. |
| 525 | void ExprEngine::conservativeEvalCall(const CallEvent &Call, NodeBuilder &Bldr, |
| 526 | ExplodedNode *Pred, ProgramStateRef State) { |
| 527 | unsigned Count = currentBuilderContext->getCurrentBlockCount(); |
| 528 | State = Call.invalidateRegions(Count, State); |
| 529 | State = bindReturnValue(Call, Pred->getLocationContext(), State); |
| 530 | |
| 531 | // And make the result node. |
| 532 | Bldr.generateNode(Call.getProgramPoint(), State, Pred); |
| 533 | } |
| 534 | |
Anna Zaks | e81ce25 | 2012-07-19 23:38:13 +0000 | [diff] [blame] | 535 | void ExprEngine::defaultEvalCall(NodeBuilder &Bldr, ExplodedNode *Pred, |
Jordan Rose | d563d3f | 2012-07-30 20:22:09 +0000 | [diff] [blame] | 536 | const CallEvent &CallTemplate) { |
| 537 | // Make sure we have the most recent state attached to the call. |
| 538 | ProgramStateRef State = Pred->getState(); |
| 539 | CallEventRef<> Call = CallTemplate.cloneWithState(State); |
Anna Zaks | e81ce25 | 2012-07-19 23:38:13 +0000 | [diff] [blame] | 540 | |
Anna Zaks | 5960f4a | 2012-08-09 18:43:00 +0000 | [diff] [blame] | 541 | if (!getAnalysisManager().shouldInlineCall()) { |
| 542 | conservativeEvalCall(*Call, Bldr, Pred, State); |
| 543 | return; |
| 544 | } |
Jordan Rose | 69f87c9 | 2012-07-02 19:28:09 +0000 | [diff] [blame] | 545 | // Try to inline the call. |
Jordan Rose | 28038f3 | 2012-07-10 22:07:42 +0000 | [diff] [blame] | 546 | // The origin expression here is just used as a kind of checksum; |
Jordan Rose | d563d3f | 2012-07-30 20:22:09 +0000 | [diff] [blame] | 547 | // this should still be safe even for CallEvents that don't come from exprs. |
| 548 | const Expr *E = Call->getOriginExpr(); |
| 549 | ProgramStateRef InlinedFailedState = getInlineFailedState(State, E); |
| 550 | |
| 551 | if (InlinedFailedState) { |
| 552 | // If we already tried once and failed, make sure we don't retry later. |
| 553 | State = InlinedFailedState; |
Anna Zaks | 5960f4a | 2012-08-09 18:43:00 +0000 | [diff] [blame] | 554 | } else { |
Anna Zaks | e90d3f8 | 2012-08-09 00:21:33 +0000 | [diff] [blame] | 555 | RuntimeDefinition RD = Call->getRuntimeDefinition(); |
Anna Zaks | fc05dec | 2012-08-09 02:57:02 +0000 | [diff] [blame] | 556 | const Decl *D = RD.getDecl(); |
Anna Zaks | e90d3f8 | 2012-08-09 00:21:33 +0000 | [diff] [blame] | 557 | if (D) { |
| 558 | // Explore with and without inlining the call. |
Anna Zaks | 5960f4a | 2012-08-09 18:43:00 +0000 | [diff] [blame] | 559 | if (RD.mayHaveOtherDefinitions() && |
Anna Zaks | e90d3f8 | 2012-08-09 00:21:33 +0000 | [diff] [blame] | 560 | getAnalysisManager().IPAMode == DynamicDispatchBifurcate) { |
Anna Zaks | 5960f4a | 2012-08-09 18:43:00 +0000 | [diff] [blame] | 561 | BifurcateCall(RD.getDispatchRegion(), *Call, D, Bldr, Pred); |
Anna Zaks | e90d3f8 | 2012-08-09 00:21:33 +0000 | [diff] [blame] | 562 | return; |
Anna Zaks | e90d3f8 | 2012-08-09 00:21:33 +0000 | [diff] [blame] | 563 | } |
Anna Zaks | 5960f4a | 2012-08-09 18:43:00 +0000 | [diff] [blame] | 564 | // We are not bifurcating and we do have a Decl, so just inline. |
| 565 | if (inlineCall(*Call, D, Bldr, Pred, State)) |
| 566 | return; |
Anna Zaks | e90d3f8 | 2012-08-09 00:21:33 +0000 | [diff] [blame] | 567 | } |
Anna Zaks | e81ce25 | 2012-07-19 23:38:13 +0000 | [diff] [blame] | 568 | } |
Jordan Rose | 69f87c9 | 2012-07-02 19:28:09 +0000 | [diff] [blame] | 569 | |
| 570 | // If we can't inline it, handle the return value and invalidate the regions. |
Anna Zaks | e90d3f8 | 2012-08-09 00:21:33 +0000 | [diff] [blame] | 571 | conservativeEvalCall(*Call, Bldr, Pred, State); |
Jordan Rose | 69f87c9 | 2012-07-02 19:28:09 +0000 | [diff] [blame] | 572 | } |
| 573 | |
Anna Zaks | e90d3f8 | 2012-08-09 00:21:33 +0000 | [diff] [blame] | 574 | void ExprEngine::BifurcateCall(const MemRegion *BifurReg, |
| 575 | const CallEvent &Call, const Decl *D, |
| 576 | NodeBuilder &Bldr, ExplodedNode *Pred) { |
| 577 | assert(BifurReg); |
| 578 | |
| 579 | // Check if we've performed the split already - note, we only want |
| 580 | // to split the path once per memory region. |
| 581 | ProgramStateRef State = Pred->getState(); |
Anna Zaks | 6960f6e | 2012-08-09 21:02:41 +0000 | [diff] [blame] | 582 | const unsigned int *BState = |
| 583 | State->get<DynamicDispatchBifurcationMap>(BifurReg); |
Anna Zaks | 5960f4a | 2012-08-09 18:43:00 +0000 | [diff] [blame] | 584 | if (BState) { |
| 585 | // If we are on "inline path", keep inlining if possible. |
Anna Zaks | 6960f6e | 2012-08-09 21:02:41 +0000 | [diff] [blame] | 586 | if (*BState == DynamicDispatchModeInlined) |
Anna Zaks | 5960f4a | 2012-08-09 18:43:00 +0000 | [diff] [blame] | 587 | if (inlineCall(Call, D, Bldr, Pred, State)) |
| 588 | return; |
| 589 | // If inline failed, or we are on the path where we assume we |
| 590 | // don't have enough info about the receiver to inline, conjure the |
| 591 | // return value and invalidate the regions. |
| 592 | conservativeEvalCall(Call, Bldr, Pred, State); |
| 593 | return; |
Anna Zaks | e90d3f8 | 2012-08-09 00:21:33 +0000 | [diff] [blame] | 594 | } |
| 595 | |
| 596 | // If we got here, this is the first time we process a message to this |
| 597 | // region, so split the path. |
| 598 | ProgramStateRef IState = |
Anna Zaks | 6960f6e | 2012-08-09 21:02:41 +0000 | [diff] [blame] | 599 | State->set<DynamicDispatchBifurcationMap>(BifurReg, |
| 600 | DynamicDispatchModeInlined); |
Anna Zaks | e90d3f8 | 2012-08-09 00:21:33 +0000 | [diff] [blame] | 601 | inlineCall(Call, D, Bldr, Pred, IState); |
| 602 | |
| 603 | ProgramStateRef NoIState = |
Anna Zaks | 6960f6e | 2012-08-09 21:02:41 +0000 | [diff] [blame] | 604 | State->set<DynamicDispatchBifurcationMap>(BifurReg, |
| 605 | DynamicDispatchModeConservative); |
Anna Zaks | e90d3f8 | 2012-08-09 00:21:33 +0000 | [diff] [blame] | 606 | conservativeEvalCall(Call, Bldr, Pred, NoIState); |
| 607 | |
| 608 | NumOfDynamicDispatchPathSplits++; |
| 609 | return; |
| 610 | } |
| 611 | |
| 612 | |
Ted Kremenek | 294fd0a | 2011-08-20 06:00:03 +0000 | [diff] [blame] | 613 | void ExprEngine::VisitReturnStmt(const ReturnStmt *RS, ExplodedNode *Pred, |
| 614 | ExplodedNodeSet &Dst) { |
Ted Kremenek | 256ef64 | 2012-01-11 01:06:27 +0000 | [diff] [blame] | 615 | |
| 616 | ExplodedNodeSet dstPreVisit; |
| 617 | getCheckerManager().runCheckersForPreStmt(dstPreVisit, Pred, RS, *this); |
| 618 | |
| 619 | StmtNodeBuilder B(dstPreVisit, Dst, *currentBuilderContext); |
| 620 | |
| 621 | if (RS->getRetValue()) { |
| 622 | for (ExplodedNodeSet::iterator it = dstPreVisit.begin(), |
| 623 | ei = dstPreVisit.end(); it != ei; ++it) { |
| 624 | B.generateNode(RS, *it, (*it)->getState()); |
Ted Kremenek | 294fd0a | 2011-08-20 06:00:03 +0000 | [diff] [blame] | 625 | } |
Ted Kremenek | 294fd0a | 2011-08-20 06:00:03 +0000 | [diff] [blame] | 626 | } |
Ted Kremenek | 294fd0a | 2011-08-20 06:00:03 +0000 | [diff] [blame] | 627 | } |