Ted Kremenek | c62abc1 | 2009-04-21 21:51:34 +0000 | [diff] [blame] | 1 | //== Store.cpp - Interface for maps from Locations to Values ----*- C++ -*--==// |
| 2 | // |
| 3 | // The LLVM Compiler Infrastructure |
| 4 | // |
| 5 | // This file is distributed under the University of Illinois Open Source |
| 6 | // License. See LICENSE.TXT for details. |
| 7 | // |
| 8 | //===----------------------------------------------------------------------===// |
| 9 | // |
| 10 | // This file defined the types Store and StoreManager. |
| 11 | // |
| 12 | //===----------------------------------------------------------------------===// |
| 13 | |
| 14 | #include "clang/Analysis/PathSensitive/Store.h" |
| 15 | #include "clang/Analysis/PathSensitive/GRState.h" |
| 16 | |
| 17 | using namespace clang; |
| 18 | |
Ted Kremenek | f7a0cf4 | 2009-07-29 21:43:22 +0000 | [diff] [blame] | 19 | StoreManager::StoreManager(GRStateManager &stateMgr) |
| 20 | : ValMgr(stateMgr.getValueManager()), StateMgr(stateMgr), |
Ted Kremenek | c62abc1 | 2009-04-21 21:51:34 +0000 | [diff] [blame] | 21 | MRMgr(ValMgr.getRegionManager()) {} |
| 22 | |
Zhongxing Xu | 09270cc | 2009-10-14 06:55:01 +0000 | [diff] [blame] | 23 | const MemRegion *StoreManager::MakeElementRegion(const MemRegion *Base, |
Zhongxing Xu | 652be34 | 2009-11-16 04:49:44 +0000 | [diff] [blame] | 24 | QualType EleTy, uint64_t index) { |
Ted Kremenek | 19e1f0b | 2009-08-01 06:17:29 +0000 | [diff] [blame] | 25 | SVal idx = ValMgr.makeArrayIndex(index); |
Zhongxing Xu | 09270cc | 2009-10-14 06:55:01 +0000 | [diff] [blame] | 26 | return MRMgr.getElementRegion(EleTy, idx, Base, ValMgr.getContext()); |
Ted Kremenek | 411af40 | 2009-07-06 22:23:45 +0000 | [diff] [blame] | 27 | } |
| 28 | |
Ted Kremenek | 19e1f0b | 2009-08-01 06:17:29 +0000 | [diff] [blame] | 29 | // FIXME: Merge with the implementation of the same method in MemRegion.cpp |
Ted Kremenek | 169077d | 2009-07-06 23:47:19 +0000 | [diff] [blame] | 30 | static bool IsCompleteType(ASTContext &Ctx, QualType Ty) { |
Ted Kremenek | 6217b80 | 2009-07-29 21:53:49 +0000 | [diff] [blame] | 31 | if (const RecordType *RT = Ty->getAs<RecordType>()) { |
Ted Kremenek | 169077d | 2009-07-06 23:47:19 +0000 | [diff] [blame] | 32 | const RecordDecl *D = RT->getDecl(); |
| 33 | if (!D->getDefinition(Ctx)) |
| 34 | return false; |
| 35 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 36 | |
Ted Kremenek | 169077d | 2009-07-06 23:47:19 +0000 | [diff] [blame] | 37 | return true; |
| 38 | } |
| 39 | |
Zhongxing Xu | 09270cc | 2009-10-14 06:55:01 +0000 | [diff] [blame] | 40 | const MemRegion *StoreManager::CastRegion(const MemRegion *R, QualType CastToTy) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 41 | |
Ted Kremenek | 48ce7de | 2009-07-06 20:21:51 +0000 | [diff] [blame] | 42 | ASTContext& Ctx = StateMgr.getContext(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 43 | |
Ted Kremenek | b9a4425 | 2009-07-06 22:39:40 +0000 | [diff] [blame] | 44 | // Handle casts to Objective-C objects. |
Ted Kremenek | 19e1f0b | 2009-08-01 06:17:29 +0000 | [diff] [blame] | 45 | if (CastToTy->isObjCObjectPointerType()) |
Zhongxing Xu | 479529e | 2009-11-10 02:17:20 +0000 | [diff] [blame] | 46 | return R->StripCasts(); |
Ted Kremenek | 19e1f0b | 2009-08-01 06:17:29 +0000 | [diff] [blame] | 47 | |
Ted Kremenek | 63b9cfe | 2009-07-18 06:27:51 +0000 | [diff] [blame] | 48 | if (CastToTy->isBlockPointerType()) { |
Ted Kremenek | abd46e1 | 2009-08-28 04:49:15 +0000 | [diff] [blame] | 49 | // FIXME: We may need different solutions, depending on the symbol |
Ted Kremenek | 63b9cfe | 2009-07-18 06:27:51 +0000 | [diff] [blame] | 50 | // involved. Blocks can be casted to/from 'id', as they can be treated |
Ted Kremenek | abd46e1 | 2009-08-28 04:49:15 +0000 | [diff] [blame] | 51 | // as Objective-C objects. This could possibly be handled by enhancing |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 52 | // our reasoning of downcasts of symbolic objects. |
Ted Kremenek | abd46e1 | 2009-08-28 04:49:15 +0000 | [diff] [blame] | 53 | if (isa<CodeTextRegion>(R) || isa<SymbolicRegion>(R)) |
Zhongxing Xu | 09270cc | 2009-10-14 06:55:01 +0000 | [diff] [blame] | 54 | return R; |
Ted Kremenek | 63b9cfe | 2009-07-18 06:27:51 +0000 | [diff] [blame] | 55 | |
| 56 | // We don't know what to make of it. Return a NULL region, which |
| 57 | // will be interpretted as UnknownVal. |
Zhongxing Xu | 09270cc | 2009-10-14 06:55:01 +0000 | [diff] [blame] | 58 | return NULL; |
Ted Kremenek | 63b9cfe | 2009-07-18 06:27:51 +0000 | [diff] [blame] | 59 | } |
Ted Kremenek | 411af40 | 2009-07-06 22:23:45 +0000 | [diff] [blame] | 60 | |
Ted Kremenek | 48ce7de | 2009-07-06 20:21:51 +0000 | [diff] [blame] | 61 | // Now assume we are casting from pointer to pointer. Other cases should |
| 62 | // already be handled. |
Ted Kremenek | 6217b80 | 2009-07-29 21:53:49 +0000 | [diff] [blame] | 63 | QualType PointeeTy = CastToTy->getAs<PointerType>()->getPointeeType(); |
Ted Kremenek | 9a108eb | 2009-08-02 04:12:53 +0000 | [diff] [blame] | 64 | QualType CanonPointeeTy = Ctx.getCanonicalType(PointeeTy); |
| 65 | |
| 66 | // Handle casts to void*. We just pass the region through. |
Douglas Gregor | a4923eb | 2009-11-16 21:35:15 +0000 | [diff] [blame] | 67 | if (CanonPointeeTy.getLocalUnqualifiedType() == Ctx.VoidTy) |
Zhongxing Xu | 09270cc | 2009-10-14 06:55:01 +0000 | [diff] [blame] | 68 | return R; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 69 | |
Ted Kremenek | 9a108eb | 2009-08-02 04:12:53 +0000 | [diff] [blame] | 70 | // Handle casts from compatible types. |
Ted Kremenek | 19e1f0b | 2009-08-01 06:17:29 +0000 | [diff] [blame] | 71 | if (R->isBoundable()) |
| 72 | if (const TypedRegion *TR = dyn_cast<TypedRegion>(R)) { |
| 73 | QualType ObjTy = Ctx.getCanonicalType(TR->getValueType(Ctx)); |
Ted Kremenek | 9a108eb | 2009-08-02 04:12:53 +0000 | [diff] [blame] | 74 | if (CanonPointeeTy == ObjTy) |
Zhongxing Xu | 09270cc | 2009-10-14 06:55:01 +0000 | [diff] [blame] | 75 | return R; |
Ted Kremenek | 19e1f0b | 2009-08-01 06:17:29 +0000 | [diff] [blame] | 76 | } |
| 77 | |
Ted Kremenek | 48ce7de | 2009-07-06 20:21:51 +0000 | [diff] [blame] | 78 | // Process region cast according to the kind of the region being cast. |
Ted Kremenek | fc8f57c | 2009-07-06 22:56:37 +0000 | [diff] [blame] | 79 | switch (R->getKind()) { |
Ted Kremenek | 67d1287 | 2009-12-07 22:05:27 +0000 | [diff] [blame] | 80 | case MemRegion::GenericMemSpaceRegionKind: |
| 81 | case MemRegion::StackLocalsSpaceRegionKind: |
| 82 | case MemRegion::StackArgumentsSpaceRegionKind: |
| 83 | case MemRegion::HeapSpaceRegionKind: |
| 84 | case MemRegion::GlobalsSpaceRegionKind: { |
Ted Kremenek | fc8f57c | 2009-07-06 22:56:37 +0000 | [diff] [blame] | 85 | assert(0 && "Invalid region cast"); |
| 86 | break; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 87 | } |
Ted Kremenek | eb1c7a0 | 2009-11-25 01:32:22 +0000 | [diff] [blame] | 88 | |
| 89 | case MemRegion::FunctionTextRegionKind: |
Ted Kremenek | bf0fe6c | 2009-11-25 23:58:21 +0000 | [diff] [blame] | 90 | case MemRegion::BlockTextRegionKind: |
| 91 | case MemRegion::BlockDataRegionKind: { |
Ted Kremenek | 63b9cfe | 2009-07-18 06:27:51 +0000 | [diff] [blame] | 92 | // CodeTextRegion should be cast to only a function or block pointer type, |
Zhongxing Xu | 09270cc | 2009-10-14 06:55:01 +0000 | [diff] [blame] | 93 | // although they can in practice be casted to anything, e.g, void*, char*, |
| 94 | // etc. |
| 95 | // Just return the region. |
| 96 | return R; |
Ted Kremenek | fc8f57c | 2009-07-06 22:56:37 +0000 | [diff] [blame] | 97 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 98 | |
Ted Kremenek | fc8f57c | 2009-07-06 22:56:37 +0000 | [diff] [blame] | 99 | case MemRegion::StringRegionKind: |
Ted Kremenek | fc8f57c | 2009-07-06 22:56:37 +0000 | [diff] [blame] | 100 | case MemRegion::ObjCObjectRegionKind: |
Ted Kremenek | fc8f57c | 2009-07-06 22:56:37 +0000 | [diff] [blame] | 101 | // FIXME: Need to handle arbitrary downcasts. |
Ted Kremenek | 19e1f0b | 2009-08-01 06:17:29 +0000 | [diff] [blame] | 102 | case MemRegion::SymbolicRegionKind: |
| 103 | case MemRegion::AllocaRegionKind: |
Ted Kremenek | fc8f57c | 2009-07-06 22:56:37 +0000 | [diff] [blame] | 104 | case MemRegion::CompoundLiteralRegionKind: |
Ted Kremenek | fc8f57c | 2009-07-06 22:56:37 +0000 | [diff] [blame] | 105 | case MemRegion::FieldRegionKind: |
| 106 | case MemRegion::ObjCIvarRegionKind: |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 107 | case MemRegion::VarRegionKind: |
Zhongxing Xu | 09270cc | 2009-10-14 06:55:01 +0000 | [diff] [blame] | 108 | return MakeElementRegion(R, PointeeTy); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 109 | |
Ted Kremenek | 19e1f0b | 2009-08-01 06:17:29 +0000 | [diff] [blame] | 110 | case MemRegion::ElementRegionKind: { |
| 111 | // If we are casting from an ElementRegion to another type, the |
| 112 | // algorithm is as follows: |
| 113 | // |
| 114 | // (1) Compute the "raw offset" of the ElementRegion from the |
| 115 | // base region. This is done by calling 'getAsRawOffset()'. |
| 116 | // |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 117 | // (2a) If we get a 'RegionRawOffset' after calling |
Ted Kremenek | 19e1f0b | 2009-08-01 06:17:29 +0000 | [diff] [blame] | 118 | // 'getAsRawOffset()', determine if the absolute offset |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 119 | // can be exactly divided into chunks of the size of the |
| 120 | // casted-pointee type. If so, create a new ElementRegion with |
Ted Kremenek | 19e1f0b | 2009-08-01 06:17:29 +0000 | [diff] [blame] | 121 | // the pointee-cast type as the new ElementType and the index |
| 122 | // being the offset divded by the chunk size. If not, create |
| 123 | // a new ElementRegion at offset 0 off the raw offset region. |
| 124 | // |
| 125 | // (2b) If we don't a get a 'RegionRawOffset' after calling |
| 126 | // 'getAsRawOffset()', it means that we are at offset 0. |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 127 | // |
Ted Kremenek | 19e1f0b | 2009-08-01 06:17:29 +0000 | [diff] [blame] | 128 | // FIXME: Handle symbolic raw offsets. |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 129 | |
Ted Kremenek | 19e1f0b | 2009-08-01 06:17:29 +0000 | [diff] [blame] | 130 | const ElementRegion *elementR = cast<ElementRegion>(R); |
| 131 | const RegionRawOffset &rawOff = elementR->getAsRawOffset(); |
| 132 | const MemRegion *baseR = rawOff.getRegion(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 133 | |
Ted Kremenek | 19e1f0b | 2009-08-01 06:17:29 +0000 | [diff] [blame] | 134 | // If we cannot compute a raw offset, throw up our hands and return |
| 135 | // a NULL MemRegion*. |
| 136 | if (!baseR) |
Zhongxing Xu | 09270cc | 2009-10-14 06:55:01 +0000 | [diff] [blame] | 137 | return NULL; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 138 | |
Ted Kremenek | 19e1f0b | 2009-08-01 06:17:29 +0000 | [diff] [blame] | 139 | int64_t off = rawOff.getByteOffset(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 140 | |
Ted Kremenek | 19e1f0b | 2009-08-01 06:17:29 +0000 | [diff] [blame] | 141 | if (off == 0) { |
| 142 | // Edge case: we are at 0 bytes off the beginning of baseR. We |
| 143 | // check to see if type we are casting to is the same as the base |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 144 | // region. If so, just return the base region. |
Ted Kremenek | 19e1f0b | 2009-08-01 06:17:29 +0000 | [diff] [blame] | 145 | if (const TypedRegion *TR = dyn_cast<TypedRegion>(baseR)) { |
| 146 | QualType ObjTy = Ctx.getCanonicalType(TR->getValueType(Ctx)); |
| 147 | QualType CanonPointeeTy = Ctx.getCanonicalType(PointeeTy); |
| 148 | if (CanonPointeeTy == ObjTy) |
Zhongxing Xu | 09270cc | 2009-10-14 06:55:01 +0000 | [diff] [blame] | 149 | return baseR; |
Ted Kremenek | 19e1f0b | 2009-08-01 06:17:29 +0000 | [diff] [blame] | 150 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 151 | |
Ted Kremenek | 19e1f0b | 2009-08-01 06:17:29 +0000 | [diff] [blame] | 152 | // Otherwise, create a new ElementRegion at offset 0. |
Zhongxing Xu | 09270cc | 2009-10-14 06:55:01 +0000 | [diff] [blame] | 153 | return MakeElementRegion(baseR, PointeeTy); |
Ted Kremenek | 19e1f0b | 2009-08-01 06:17:29 +0000 | [diff] [blame] | 154 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 155 | |
Ted Kremenek | 19e1f0b | 2009-08-01 06:17:29 +0000 | [diff] [blame] | 156 | // We have a non-zero offset from the base region. We want to determine |
| 157 | // if the offset can be evenly divided by sizeof(PointeeTy). If so, |
| 158 | // we create an ElementRegion whose index is that value. Otherwise, we |
| 159 | // create two ElementRegions, one that reflects a raw offset and the other |
| 160 | // that reflects the cast. |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 161 | |
Ted Kremenek | 19e1f0b | 2009-08-01 06:17:29 +0000 | [diff] [blame] | 162 | // Compute the index for the new ElementRegion. |
| 163 | int64_t newIndex = 0; |
| 164 | const MemRegion *newSuperR = 0; |
| 165 | |
| 166 | // We can only compute sizeof(PointeeTy) if it is a complete type. |
| 167 | if (IsCompleteType(Ctx, PointeeTy)) { |
| 168 | // Compute the size in **bytes**. |
| 169 | int64_t pointeeTySize = (int64_t) (Ctx.getTypeSize(PointeeTy) / 8); |
| 170 | |
| 171 | // Is the offset a multiple of the size? If so, we can layer the |
| 172 | // ElementRegion (with elementType == PointeeTy) directly on top of |
| 173 | // the base region. |
| 174 | if (off % pointeeTySize == 0) { |
| 175 | newIndex = off / pointeeTySize; |
| 176 | newSuperR = baseR; |
| 177 | } |
| 178 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 179 | |
Ted Kremenek | 19e1f0b | 2009-08-01 06:17:29 +0000 | [diff] [blame] | 180 | if (!newSuperR) { |
| 181 | // Create an intermediate ElementRegion to represent the raw byte. |
| 182 | // This will be the super region of the final ElementRegion. |
Zhongxing Xu | 09270cc | 2009-10-14 06:55:01 +0000 | [diff] [blame] | 183 | newSuperR = MakeElementRegion(baseR, Ctx.CharTy, off); |
Ted Kremenek | 19e1f0b | 2009-08-01 06:17:29 +0000 | [diff] [blame] | 184 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 185 | |
Zhongxing Xu | 09270cc | 2009-10-14 06:55:01 +0000 | [diff] [blame] | 186 | return MakeElementRegion(newSuperR, PointeeTy, newIndex); |
Ted Kremenek | 48ce7de | 2009-07-06 20:21:51 +0000 | [diff] [blame] | 187 | } |
| 188 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 189 | |
Zhongxing Xu | 09270cc | 2009-10-14 06:55:01 +0000 | [diff] [blame] | 190 | assert(0 && "unreachable"); |
| 191 | return 0; |
Ted Kremenek | 48ce7de | 2009-07-06 20:21:51 +0000 | [diff] [blame] | 192 | } |
Ted Kremenek | 1894dce | 2009-08-25 20:51:30 +0000 | [diff] [blame] | 193 | |
| 194 | |
| 195 | /// CastRetrievedVal - Used by subclasses of StoreManager to implement |
| 196 | /// implicit casts that arise from loads from regions that are reinterpreted |
| 197 | /// as another region. |
Zhongxing Xu | 652be34 | 2009-11-16 04:49:44 +0000 | [diff] [blame] | 198 | SVal StoreManager::CastRetrievedVal(SVal V, const TypedRegion *R, |
| 199 | QualType castTy) { |
Zhongxing Xu | 652be34 | 2009-11-16 04:49:44 +0000 | [diff] [blame] | 200 | if (castTy.isNull()) |
| 201 | return V; |
| 202 | |
Ted Kremenek | 27e05ed | 2009-11-19 19:04:08 +0000 | [diff] [blame] | 203 | assert(ValMgr.getContext().hasSameUnqualifiedType(castTy, |
| 204 | R->getValueType(ValMgr.getContext()))); |
Zhongxing Xu | 652be34 | 2009-11-16 04:49:44 +0000 | [diff] [blame] | 205 | return V; |
Ted Kremenek | 1894dce | 2009-08-25 20:51:30 +0000 | [diff] [blame] | 206 | } |
| 207 | |
Ted Kremenek | 81a9583 | 2009-12-03 03:27:11 +0000 | [diff] [blame] | 208 | const GRState *StoreManager::InvalidateRegions(const GRState *state, |
| 209 | const MemRegion * const *I, |
| 210 | const MemRegion * const *End, |
| 211 | const Expr *E, |
| 212 | unsigned Count, |
| 213 | InvalidatedSymbols *IS) { |
| 214 | for ( ; I != End ; ++I) |
| 215 | state = InvalidateRegion(state, *I, E, Count, IS); |
| 216 | |
| 217 | return state; |
| 218 | } |
Ted Kremenek | 67d1287 | 2009-12-07 22:05:27 +0000 | [diff] [blame] | 219 | |
| 220 | //===----------------------------------------------------------------------===// |
| 221 | // Common getLValueXXX methods. |
| 222 | //===----------------------------------------------------------------------===// |
| 223 | |
| 224 | /// getLValueCompoundLiteral - Returns an SVal representing the lvalue |
| 225 | /// of a compound literal. Within RegionStore a compound literal |
| 226 | /// has an associated region, and the lvalue of the compound literal |
| 227 | /// is the lvalue of that region. |
| 228 | SVal StoreManager::getLValueCompoundLiteral(const CompoundLiteralExpr* CL, |
| 229 | const LocationContext *LC) { |
| 230 | return loc::MemRegionVal(MRMgr.getCompoundLiteralRegion(CL, LC)); |
| 231 | } |