Ted Kremenek | c62abc1 | 2009-04-21 21:51:34 +0000 | [diff] [blame] | 1 | //== Store.cpp - Interface for maps from Locations to Values ----*- C++ -*--==// |
| 2 | // |
| 3 | // The LLVM Compiler Infrastructure |
| 4 | // |
| 5 | // This file is distributed under the University of Illinois Open Source |
| 6 | // License. See LICENSE.TXT for details. |
| 7 | // |
| 8 | //===----------------------------------------------------------------------===// |
| 9 | // |
| 10 | // This file defined the types Store and StoreManager. |
| 11 | // |
| 12 | //===----------------------------------------------------------------------===// |
| 13 | |
Ted Kremenek | 1309f9a | 2010-01-25 04:41:41 +0000 | [diff] [blame] | 14 | #include "clang/Checker/PathSensitive/Store.h" |
| 15 | #include "clang/Checker/PathSensitive/GRState.h" |
Ken Dyck | 199c3d6 | 2010-01-11 17:06:35 +0000 | [diff] [blame] | 16 | #include "clang/AST/CharUnits.h" |
Ted Kremenek | c62abc1 | 2009-04-21 21:51:34 +0000 | [diff] [blame] | 17 | |
| 18 | using namespace clang; |
| 19 | |
Ted Kremenek | f7a0cf4 | 2009-07-29 21:43:22 +0000 | [diff] [blame] | 20 | StoreManager::StoreManager(GRStateManager &stateMgr) |
| 21 | : ValMgr(stateMgr.getValueManager()), StateMgr(stateMgr), |
Zhongxing Xu | 2a393db | 2010-02-08 06:00:22 +0000 | [diff] [blame] | 22 | MRMgr(ValMgr.getRegionManager()), Ctx(stateMgr.getContext()) {} |
Ted Kremenek | c62abc1 | 2009-04-21 21:51:34 +0000 | [diff] [blame] | 23 | |
Jordy Rose | ff59efd | 2010-08-03 20:44:35 +0000 | [diff] [blame] | 24 | Store StoreManager::EnterStackFrame(const GRState *state, |
| 25 | const StackFrameContext *frame) { |
| 26 | return state->getStore(); |
| 27 | } |
| 28 | |
Zhongxing Xu | 09270cc | 2009-10-14 06:55:01 +0000 | [diff] [blame] | 29 | const MemRegion *StoreManager::MakeElementRegion(const MemRegion *Base, |
Zhongxing Xu | 652be34 | 2009-11-16 04:49:44 +0000 | [diff] [blame] | 30 | QualType EleTy, uint64_t index) { |
Ted Kremenek | 02282ac | 2010-09-15 03:13:30 +0000 | [diff] [blame] | 31 | NonLoc idx = ValMgr.makeArrayIndex(index); |
Zhongxing Xu | 09270cc | 2009-10-14 06:55:01 +0000 | [diff] [blame] | 32 | return MRMgr.getElementRegion(EleTy, idx, Base, ValMgr.getContext()); |
Ted Kremenek | 411af40 | 2009-07-06 22:23:45 +0000 | [diff] [blame] | 33 | } |
| 34 | |
Ted Kremenek | 19e1f0b | 2009-08-01 06:17:29 +0000 | [diff] [blame] | 35 | // FIXME: Merge with the implementation of the same method in MemRegion.cpp |
Ted Kremenek | 169077d | 2009-07-06 23:47:19 +0000 | [diff] [blame] | 36 | static bool IsCompleteType(ASTContext &Ctx, QualType Ty) { |
Ted Kremenek | 6217b80 | 2009-07-29 21:53:49 +0000 | [diff] [blame] | 37 | if (const RecordType *RT = Ty->getAs<RecordType>()) { |
Ted Kremenek | 169077d | 2009-07-06 23:47:19 +0000 | [diff] [blame] | 38 | const RecordDecl *D = RT->getDecl(); |
Douglas Gregor | 952b017 | 2010-02-11 01:04:33 +0000 | [diff] [blame] | 39 | if (!D->getDefinition()) |
Ted Kremenek | 169077d | 2009-07-06 23:47:19 +0000 | [diff] [blame] | 40 | return false; |
| 41 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 42 | |
Ted Kremenek | 169077d | 2009-07-06 23:47:19 +0000 | [diff] [blame] | 43 | return true; |
| 44 | } |
| 45 | |
Zhongxing Xu | 856c6bc | 2010-04-19 11:47:28 +0000 | [diff] [blame] | 46 | const ElementRegion *StoreManager::GetElementZeroRegion(const MemRegion *R, |
| 47 | QualType T) { |
Ted Kremenek | 02282ac | 2010-09-15 03:13:30 +0000 | [diff] [blame] | 48 | NonLoc idx = ValMgr.makeZeroArrayIndex(); |
Zhongxing Xu | 856c6bc | 2010-04-19 11:47:28 +0000 | [diff] [blame] | 49 | assert(!T.isNull()); |
| 50 | return MRMgr.getElementRegion(T, idx, R, Ctx); |
| 51 | } |
| 52 | |
Zhongxing Xu | 09270cc | 2009-10-14 06:55:01 +0000 | [diff] [blame] | 53 | const MemRegion *StoreManager::CastRegion(const MemRegion *R, QualType CastToTy) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 54 | |
Ted Kremenek | 48ce7de | 2009-07-06 20:21:51 +0000 | [diff] [blame] | 55 | ASTContext& Ctx = StateMgr.getContext(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 56 | |
Ted Kremenek | b9a4425 | 2009-07-06 22:39:40 +0000 | [diff] [blame] | 57 | // Handle casts to Objective-C objects. |
Ted Kremenek | 19e1f0b | 2009-08-01 06:17:29 +0000 | [diff] [blame] | 58 | if (CastToTy->isObjCObjectPointerType()) |
Zhongxing Xu | 479529e | 2009-11-10 02:17:20 +0000 | [diff] [blame] | 59 | return R->StripCasts(); |
Ted Kremenek | 19e1f0b | 2009-08-01 06:17:29 +0000 | [diff] [blame] | 60 | |
Ted Kremenek | 63b9cfe | 2009-07-18 06:27:51 +0000 | [diff] [blame] | 61 | if (CastToTy->isBlockPointerType()) { |
Ted Kremenek | abd46e1 | 2009-08-28 04:49:15 +0000 | [diff] [blame] | 62 | // FIXME: We may need different solutions, depending on the symbol |
Ted Kremenek | 63b9cfe | 2009-07-18 06:27:51 +0000 | [diff] [blame] | 63 | // involved. Blocks can be casted to/from 'id', as they can be treated |
Ted Kremenek | abd46e1 | 2009-08-28 04:49:15 +0000 | [diff] [blame] | 64 | // as Objective-C objects. This could possibly be handled by enhancing |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 65 | // our reasoning of downcasts of symbolic objects. |
Ted Kremenek | abd46e1 | 2009-08-28 04:49:15 +0000 | [diff] [blame] | 66 | if (isa<CodeTextRegion>(R) || isa<SymbolicRegion>(R)) |
Zhongxing Xu | 09270cc | 2009-10-14 06:55:01 +0000 | [diff] [blame] | 67 | return R; |
Ted Kremenek | 63b9cfe | 2009-07-18 06:27:51 +0000 | [diff] [blame] | 68 | |
| 69 | // We don't know what to make of it. Return a NULL region, which |
| 70 | // will be interpretted as UnknownVal. |
Zhongxing Xu | 09270cc | 2009-10-14 06:55:01 +0000 | [diff] [blame] | 71 | return NULL; |
Ted Kremenek | 63b9cfe | 2009-07-18 06:27:51 +0000 | [diff] [blame] | 72 | } |
Ted Kremenek | 411af40 | 2009-07-06 22:23:45 +0000 | [diff] [blame] | 73 | |
Ted Kremenek | 48ce7de | 2009-07-06 20:21:51 +0000 | [diff] [blame] | 74 | // Now assume we are casting from pointer to pointer. Other cases should |
| 75 | // already be handled. |
Ted Kremenek | 6217b80 | 2009-07-29 21:53:49 +0000 | [diff] [blame] | 76 | QualType PointeeTy = CastToTy->getAs<PointerType>()->getPointeeType(); |
Ted Kremenek | 9a108eb | 2009-08-02 04:12:53 +0000 | [diff] [blame] | 77 | QualType CanonPointeeTy = Ctx.getCanonicalType(PointeeTy); |
| 78 | |
| 79 | // Handle casts to void*. We just pass the region through. |
Douglas Gregor | a4923eb | 2009-11-16 21:35:15 +0000 | [diff] [blame] | 80 | if (CanonPointeeTy.getLocalUnqualifiedType() == Ctx.VoidTy) |
Zhongxing Xu | 09270cc | 2009-10-14 06:55:01 +0000 | [diff] [blame] | 81 | return R; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 82 | |
Ted Kremenek | 9a108eb | 2009-08-02 04:12:53 +0000 | [diff] [blame] | 83 | // Handle casts from compatible types. |
Ted Kremenek | 19e1f0b | 2009-08-01 06:17:29 +0000 | [diff] [blame] | 84 | if (R->isBoundable()) |
| 85 | if (const TypedRegion *TR = dyn_cast<TypedRegion>(R)) { |
Zhongxing Xu | 018220c | 2010-08-11 06:10:55 +0000 | [diff] [blame] | 86 | QualType ObjTy = Ctx.getCanonicalType(TR->getValueType()); |
Ted Kremenek | 9a108eb | 2009-08-02 04:12:53 +0000 | [diff] [blame] | 87 | if (CanonPointeeTy == ObjTy) |
Zhongxing Xu | 09270cc | 2009-10-14 06:55:01 +0000 | [diff] [blame] | 88 | return R; |
Ted Kremenek | 19e1f0b | 2009-08-01 06:17:29 +0000 | [diff] [blame] | 89 | } |
| 90 | |
Ted Kremenek | 48ce7de | 2009-07-06 20:21:51 +0000 | [diff] [blame] | 91 | // Process region cast according to the kind of the region being cast. |
Ted Kremenek | fc8f57c | 2009-07-06 22:56:37 +0000 | [diff] [blame] | 92 | switch (R->getKind()) { |
Ted Kremenek | de0d263 | 2010-01-05 02:18:06 +0000 | [diff] [blame] | 93 | case MemRegion::CXXThisRegionKind: |
Ted Kremenek | 67d1287 | 2009-12-07 22:05:27 +0000 | [diff] [blame] | 94 | case MemRegion::GenericMemSpaceRegionKind: |
| 95 | case MemRegion::StackLocalsSpaceRegionKind: |
| 96 | case MemRegion::StackArgumentsSpaceRegionKind: |
| 97 | case MemRegion::HeapSpaceRegionKind: |
Ted Kremenek | 2b87ae4 | 2009-12-11 06:43:27 +0000 | [diff] [blame] | 98 | case MemRegion::UnknownSpaceRegionKind: |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 99 | case MemRegion::NonStaticGlobalSpaceRegionKind: |
| 100 | case MemRegion::StaticGlobalSpaceRegionKind: { |
Ted Kremenek | fc8f57c | 2009-07-06 22:56:37 +0000 | [diff] [blame] | 101 | assert(0 && "Invalid region cast"); |
| 102 | break; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 103 | } |
Ted Kremenek | 1e4a32a | 2010-09-01 23:00:46 +0000 | [diff] [blame] | 104 | |
Ted Kremenek | eb1c7a0 | 2009-11-25 01:32:22 +0000 | [diff] [blame] | 105 | case MemRegion::FunctionTextRegionKind: |
Ted Kremenek | bf0fe6c | 2009-11-25 23:58:21 +0000 | [diff] [blame] | 106 | case MemRegion::BlockTextRegionKind: |
Ted Kremenek | 1e4a32a | 2010-09-01 23:00:46 +0000 | [diff] [blame] | 107 | case MemRegion::BlockDataRegionKind: |
Ted Kremenek | fc8f57c | 2009-07-06 22:56:37 +0000 | [diff] [blame] | 108 | case MemRegion::StringRegionKind: |
Ted Kremenek | fc8f57c | 2009-07-06 22:56:37 +0000 | [diff] [blame] | 109 | // FIXME: Need to handle arbitrary downcasts. |
Ted Kremenek | 19e1f0b | 2009-08-01 06:17:29 +0000 | [diff] [blame] | 110 | case MemRegion::SymbolicRegionKind: |
| 111 | case MemRegion::AllocaRegionKind: |
Ted Kremenek | fc8f57c | 2009-07-06 22:56:37 +0000 | [diff] [blame] | 112 | case MemRegion::CompoundLiteralRegionKind: |
Ted Kremenek | fc8f57c | 2009-07-06 22:56:37 +0000 | [diff] [blame] | 113 | case MemRegion::FieldRegionKind: |
| 114 | case MemRegion::ObjCIvarRegionKind: |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 115 | case MemRegion::VarRegionKind: |
Zhongxing Xu | 02fe28c | 2010-11-26 08:52:48 +0000 | [diff] [blame] | 116 | case MemRegion::CXXTempObjectRegionKind: |
| 117 | case MemRegion::CXXBaseObjectRegionKind: |
Zhongxing Xu | 09270cc | 2009-10-14 06:55:01 +0000 | [diff] [blame] | 118 | return MakeElementRegion(R, PointeeTy); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 119 | |
Ted Kremenek | 19e1f0b | 2009-08-01 06:17:29 +0000 | [diff] [blame] | 120 | case MemRegion::ElementRegionKind: { |
| 121 | // If we are casting from an ElementRegion to another type, the |
| 122 | // algorithm is as follows: |
| 123 | // |
| 124 | // (1) Compute the "raw offset" of the ElementRegion from the |
| 125 | // base region. This is done by calling 'getAsRawOffset()'. |
| 126 | // |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 127 | // (2a) If we get a 'RegionRawOffset' after calling |
Ted Kremenek | 19e1f0b | 2009-08-01 06:17:29 +0000 | [diff] [blame] | 128 | // 'getAsRawOffset()', determine if the absolute offset |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 129 | // can be exactly divided into chunks of the size of the |
| 130 | // casted-pointee type. If so, create a new ElementRegion with |
Ted Kremenek | 19e1f0b | 2009-08-01 06:17:29 +0000 | [diff] [blame] | 131 | // the pointee-cast type as the new ElementType and the index |
| 132 | // being the offset divded by the chunk size. If not, create |
| 133 | // a new ElementRegion at offset 0 off the raw offset region. |
| 134 | // |
| 135 | // (2b) If we don't a get a 'RegionRawOffset' after calling |
| 136 | // 'getAsRawOffset()', it means that we are at offset 0. |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 137 | // |
Ted Kremenek | 19e1f0b | 2009-08-01 06:17:29 +0000 | [diff] [blame] | 138 | // FIXME: Handle symbolic raw offsets. |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 139 | |
Ted Kremenek | 19e1f0b | 2009-08-01 06:17:29 +0000 | [diff] [blame] | 140 | const ElementRegion *elementR = cast<ElementRegion>(R); |
Zhongxing Xu | 7caf9b3 | 2010-08-02 04:56:14 +0000 | [diff] [blame] | 141 | const RegionRawOffset &rawOff = elementR->getAsArrayOffset(); |
Ted Kremenek | 19e1f0b | 2009-08-01 06:17:29 +0000 | [diff] [blame] | 142 | const MemRegion *baseR = rawOff.getRegion(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 143 | |
Ted Kremenek | 19e1f0b | 2009-08-01 06:17:29 +0000 | [diff] [blame] | 144 | // If we cannot compute a raw offset, throw up our hands and return |
| 145 | // a NULL MemRegion*. |
| 146 | if (!baseR) |
Zhongxing Xu | 09270cc | 2009-10-14 06:55:01 +0000 | [diff] [blame] | 147 | return NULL; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 148 | |
Ken Dyck | 199c3d6 | 2010-01-11 17:06:35 +0000 | [diff] [blame] | 149 | CharUnits off = CharUnits::fromQuantity(rawOff.getByteOffset()); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 150 | |
Ken Dyck | 199c3d6 | 2010-01-11 17:06:35 +0000 | [diff] [blame] | 151 | if (off.isZero()) { |
Ted Kremenek | 19e1f0b | 2009-08-01 06:17:29 +0000 | [diff] [blame] | 152 | // Edge case: we are at 0 bytes off the beginning of baseR. We |
| 153 | // check to see if type we are casting to is the same as the base |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 154 | // region. If so, just return the base region. |
Ted Kremenek | 19e1f0b | 2009-08-01 06:17:29 +0000 | [diff] [blame] | 155 | if (const TypedRegion *TR = dyn_cast<TypedRegion>(baseR)) { |
Zhongxing Xu | 018220c | 2010-08-11 06:10:55 +0000 | [diff] [blame] | 156 | QualType ObjTy = Ctx.getCanonicalType(TR->getValueType()); |
Ted Kremenek | 19e1f0b | 2009-08-01 06:17:29 +0000 | [diff] [blame] | 157 | QualType CanonPointeeTy = Ctx.getCanonicalType(PointeeTy); |
| 158 | if (CanonPointeeTy == ObjTy) |
Zhongxing Xu | 09270cc | 2009-10-14 06:55:01 +0000 | [diff] [blame] | 159 | return baseR; |
Ted Kremenek | 19e1f0b | 2009-08-01 06:17:29 +0000 | [diff] [blame] | 160 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 161 | |
Ted Kremenek | 19e1f0b | 2009-08-01 06:17:29 +0000 | [diff] [blame] | 162 | // Otherwise, create a new ElementRegion at offset 0. |
Zhongxing Xu | 09270cc | 2009-10-14 06:55:01 +0000 | [diff] [blame] | 163 | return MakeElementRegion(baseR, PointeeTy); |
Ted Kremenek | 19e1f0b | 2009-08-01 06:17:29 +0000 | [diff] [blame] | 164 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 165 | |
Ted Kremenek | 19e1f0b | 2009-08-01 06:17:29 +0000 | [diff] [blame] | 166 | // We have a non-zero offset from the base region. We want to determine |
| 167 | // if the offset can be evenly divided by sizeof(PointeeTy). If so, |
| 168 | // we create an ElementRegion whose index is that value. Otherwise, we |
| 169 | // create two ElementRegions, one that reflects a raw offset and the other |
| 170 | // that reflects the cast. |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 171 | |
Ted Kremenek | 19e1f0b | 2009-08-01 06:17:29 +0000 | [diff] [blame] | 172 | // Compute the index for the new ElementRegion. |
| 173 | int64_t newIndex = 0; |
| 174 | const MemRegion *newSuperR = 0; |
| 175 | |
| 176 | // We can only compute sizeof(PointeeTy) if it is a complete type. |
| 177 | if (IsCompleteType(Ctx, PointeeTy)) { |
| 178 | // Compute the size in **bytes**. |
Ken Dyck | 199c3d6 | 2010-01-11 17:06:35 +0000 | [diff] [blame] | 179 | CharUnits pointeeTySize = Ctx.getTypeSizeInChars(PointeeTy); |
Ted Kremenek | 974d97b | 2010-04-07 00:46:49 +0000 | [diff] [blame] | 180 | if (!pointeeTySize.isZero()) { |
| 181 | // Is the offset a multiple of the size? If so, we can layer the |
| 182 | // ElementRegion (with elementType == PointeeTy) directly on top of |
| 183 | // the base region. |
| 184 | if (off % pointeeTySize == 0) { |
| 185 | newIndex = off / pointeeTySize; |
| 186 | newSuperR = baseR; |
| 187 | } |
Ted Kremenek | 19e1f0b | 2009-08-01 06:17:29 +0000 | [diff] [blame] | 188 | } |
| 189 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 190 | |
Ted Kremenek | 19e1f0b | 2009-08-01 06:17:29 +0000 | [diff] [blame] | 191 | if (!newSuperR) { |
| 192 | // Create an intermediate ElementRegion to represent the raw byte. |
| 193 | // This will be the super region of the final ElementRegion. |
Ken Dyck | 199c3d6 | 2010-01-11 17:06:35 +0000 | [diff] [blame] | 194 | newSuperR = MakeElementRegion(baseR, Ctx.CharTy, off.getQuantity()); |
Ted Kremenek | 19e1f0b | 2009-08-01 06:17:29 +0000 | [diff] [blame] | 195 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 196 | |
Zhongxing Xu | 09270cc | 2009-10-14 06:55:01 +0000 | [diff] [blame] | 197 | return MakeElementRegion(newSuperR, PointeeTy, newIndex); |
Ted Kremenek | 48ce7de | 2009-07-06 20:21:51 +0000 | [diff] [blame] | 198 | } |
| 199 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 200 | |
Zhongxing Xu | 09270cc | 2009-10-14 06:55:01 +0000 | [diff] [blame] | 201 | assert(0 && "unreachable"); |
| 202 | return 0; |
Ted Kremenek | 48ce7de | 2009-07-06 20:21:51 +0000 | [diff] [blame] | 203 | } |
Ted Kremenek | 1894dce | 2009-08-25 20:51:30 +0000 | [diff] [blame] | 204 | |
| 205 | |
| 206 | /// CastRetrievedVal - Used by subclasses of StoreManager to implement |
| 207 | /// implicit casts that arise from loads from regions that are reinterpreted |
| 208 | /// as another region. |
Ted Kremenek | c50e6df | 2010-01-11 02:33:26 +0000 | [diff] [blame] | 209 | SVal StoreManager::CastRetrievedVal(SVal V, const TypedRegion *R, |
| 210 | QualType castTy, bool performTestOnly) { |
Ted Kremenek | 852274d | 2009-12-16 03:18:58 +0000 | [diff] [blame] | 211 | |
Zhongxing Xu | 652be34 | 2009-11-16 04:49:44 +0000 | [diff] [blame] | 212 | if (castTy.isNull()) |
| 213 | return V; |
Ted Kremenek | 852274d | 2009-12-16 03:18:58 +0000 | [diff] [blame] | 214 | |
| 215 | ASTContext &Ctx = ValMgr.getContext(); |
Zhongxing Xu | 2f4a6b2 | 2009-12-09 08:32:57 +0000 | [diff] [blame] | 216 | |
Ted Kremenek | c50e6df | 2010-01-11 02:33:26 +0000 | [diff] [blame] | 217 | if (performTestOnly) { |
| 218 | // Automatically translate references to pointers. |
Zhongxing Xu | 018220c | 2010-08-11 06:10:55 +0000 | [diff] [blame] | 219 | QualType T = R->getValueType(); |
Ted Kremenek | c50e6df | 2010-01-11 02:33:26 +0000 | [diff] [blame] | 220 | if (const ReferenceType *RT = T->getAs<ReferenceType>()) |
| 221 | T = Ctx.getPointerType(RT->getPointeeType()); |
| 222 | |
| 223 | assert(ValMgr.getContext().hasSameUnqualifiedType(castTy, T)); |
| 224 | return V; |
| 225 | } |
| 226 | |
| 227 | if (const Loc *L = dyn_cast<Loc>(&V)) |
Ted Kremenek | 9c14953 | 2010-12-01 21:57:22 +0000 | [diff] [blame^] | 228 | return ValMgr.getSValBuilder().evalCastL(*L, castTy); |
Ted Kremenek | c50e6df | 2010-01-11 02:33:26 +0000 | [diff] [blame] | 229 | else if (const NonLoc *NL = dyn_cast<NonLoc>(&V)) |
Ted Kremenek | 9c14953 | 2010-12-01 21:57:22 +0000 | [diff] [blame^] | 230 | return ValMgr.getSValBuilder().evalCastNL(*NL, castTy); |
Ted Kremenek | c50e6df | 2010-01-11 02:33:26 +0000 | [diff] [blame] | 231 | |
Zhongxing Xu | 652be34 | 2009-11-16 04:49:44 +0000 | [diff] [blame] | 232 | return V; |
Ted Kremenek | 1894dce | 2009-08-25 20:51:30 +0000 | [diff] [blame] | 233 | } |
| 234 | |
Zhongxing Xu | c1511e0 | 2010-02-08 07:58:06 +0000 | [diff] [blame] | 235 | SVal StoreManager::getLValueFieldOrIvar(const Decl* D, SVal Base) { |
| 236 | if (Base.isUnknownOrUndef()) |
| 237 | return Base; |
| 238 | |
| 239 | Loc BaseL = cast<Loc>(Base); |
| 240 | const MemRegion* BaseR = 0; |
| 241 | |
| 242 | switch (BaseL.getSubKind()) { |
| 243 | case loc::MemRegionKind: |
| 244 | BaseR = cast<loc::MemRegionVal>(BaseL).getRegion(); |
| 245 | break; |
| 246 | |
| 247 | case loc::GotoLabelKind: |
| 248 | // These are anormal cases. Flag an undefined value. |
| 249 | return UndefinedVal(); |
| 250 | |
| 251 | case loc::ConcreteIntKind: |
| 252 | // While these seem funny, this can happen through casts. |
| 253 | // FIXME: What we should return is the field offset. For example, |
| 254 | // add the field offset to the integer value. That way funny things |
| 255 | // like this work properly: &(((struct foo *) 0xa)->f) |
| 256 | return Base; |
| 257 | |
| 258 | default: |
| 259 | assert(0 && "Unhandled Base."); |
| 260 | return Base; |
| 261 | } |
| 262 | |
| 263 | // NOTE: We must have this check first because ObjCIvarDecl is a subclass |
| 264 | // of FieldDecl. |
| 265 | if (const ObjCIvarDecl *ID = dyn_cast<ObjCIvarDecl>(D)) |
| 266 | return loc::MemRegionVal(MRMgr.getObjCIvarRegion(ID, BaseR)); |
| 267 | |
| 268 | return loc::MemRegionVal(MRMgr.getFieldRegion(cast<FieldDecl>(D), BaseR)); |
| 269 | } |
Zhongxing Xu | 5253568 | 2010-02-08 08:17:02 +0000 | [diff] [blame] | 270 | |
Ted Kremenek | 02282ac | 2010-09-15 03:13:30 +0000 | [diff] [blame] | 271 | SVal StoreManager::getLValueElement(QualType elementType, NonLoc Offset, |
Zhongxing Xu | 5253568 | 2010-02-08 08:17:02 +0000 | [diff] [blame] | 272 | SVal Base) { |
| 273 | |
| 274 | // If the base is an unknown or undefined value, just return it back. |
| 275 | // FIXME: For absolute pointer addresses, we just return that value back as |
| 276 | // well, although in reality we should return the offset added to that |
| 277 | // value. |
| 278 | if (Base.isUnknownOrUndef() || isa<loc::ConcreteInt>(Base)) |
| 279 | return Base; |
| 280 | |
Zhongxing Xu | 5253568 | 2010-02-08 08:17:02 +0000 | [diff] [blame] | 281 | const MemRegion* BaseRegion = cast<loc::MemRegionVal>(Base).getRegion(); |
| 282 | |
| 283 | // Pointer of any type can be cast and used as array base. |
| 284 | const ElementRegion *ElemR = dyn_cast<ElementRegion>(BaseRegion); |
| 285 | |
| 286 | // Convert the offset to the appropriate size and signedness. |
Ted Kremenek | 02282ac | 2010-09-15 03:13:30 +0000 | [diff] [blame] | 287 | Offset = cast<NonLoc>(ValMgr.convertToArrayIndex(Offset)); |
Zhongxing Xu | 5253568 | 2010-02-08 08:17:02 +0000 | [diff] [blame] | 288 | |
| 289 | if (!ElemR) { |
| 290 | // |
| 291 | // If the base region is not an ElementRegion, create one. |
| 292 | // This can happen in the following example: |
| 293 | // |
| 294 | // char *p = __builtin_alloc(10); |
| 295 | // p[1] = 8; |
| 296 | // |
| 297 | // Observe that 'p' binds to an AllocaRegion. |
| 298 | // |
| 299 | return loc::MemRegionVal(MRMgr.getElementRegion(elementType, Offset, |
| 300 | BaseRegion, Ctx)); |
| 301 | } |
| 302 | |
| 303 | SVal BaseIdx = ElemR->getIndex(); |
| 304 | |
| 305 | if (!isa<nonloc::ConcreteInt>(BaseIdx)) |
| 306 | return UnknownVal(); |
| 307 | |
| 308 | const llvm::APSInt& BaseIdxI = cast<nonloc::ConcreteInt>(BaseIdx).getValue(); |
Jordy Rose | e701117 | 2010-08-16 01:15:17 +0000 | [diff] [blame] | 309 | |
| 310 | // Only allow non-integer offsets if the base region has no offset itself. |
| 311 | // FIXME: This is a somewhat arbitrary restriction. We should be using |
Ted Kremenek | 846eabd | 2010-12-01 21:28:31 +0000 | [diff] [blame] | 312 | // SValBuilder here to add the two offsets without checking their types. |
Jordy Rose | e701117 | 2010-08-16 01:15:17 +0000 | [diff] [blame] | 313 | if (!isa<nonloc::ConcreteInt>(Offset)) { |
| 314 | if (isa<ElementRegion>(BaseRegion->StripCasts())) |
| 315 | return UnknownVal(); |
| 316 | |
| 317 | return loc::MemRegionVal(MRMgr.getElementRegion(elementType, Offset, |
| 318 | ElemR->getSuperRegion(), |
| 319 | Ctx)); |
| 320 | } |
| 321 | |
Zhongxing Xu | 5253568 | 2010-02-08 08:17:02 +0000 | [diff] [blame] | 322 | const llvm::APSInt& OffI = cast<nonloc::ConcreteInt>(Offset).getValue(); |
| 323 | assert(BaseIdxI.isSigned()); |
| 324 | |
| 325 | // Compute the new index. |
Ted Kremenek | 02282ac | 2010-09-15 03:13:30 +0000 | [diff] [blame] | 326 | nonloc::ConcreteInt NewIdx(ValMgr.getBasicValueFactory().getValue(BaseIdxI + |
| 327 | OffI)); |
Zhongxing Xu | 5253568 | 2010-02-08 08:17:02 +0000 | [diff] [blame] | 328 | |
| 329 | // Construct the new ElementRegion. |
| 330 | const MemRegion *ArrayR = ElemR->getSuperRegion(); |
| 331 | return loc::MemRegionVal(MRMgr.getElementRegion(elementType, NewIdx, ArrayR, |
| 332 | Ctx)); |
| 333 | } |