Ted Kremenek | 5f76431 | 2011-08-20 05:59:58 +0000 | [diff] [blame] | 1 | //===- ExprEngineCXX.cpp - ExprEngine support for C++ -----------*- C++ -*-===// |
Zhongxing Xu | cb7464a | 2010-04-19 12:51:02 +0000 | [diff] [blame] | 2 | // |
| 3 | // The LLVM Compiler Infrastructure |
| 4 | // |
| 5 | // This file is distributed under the University of Illinois Open Source |
| 6 | // License. See LICENSE.TXT for details. |
| 7 | // |
| 8 | //===----------------------------------------------------------------------===// |
| 9 | // |
| 10 | // This file defines the C++ expression evaluation engine. |
| 11 | // |
| 12 | //===----------------------------------------------------------------------===// |
| 13 | |
Argyrios Kyrtzidis | eb48bd1 | 2011-03-01 01:16:03 +0000 | [diff] [blame] | 14 | #include "clang/StaticAnalyzer/Core/CheckerManager.h" |
Ted Kremenek | 9b66371 | 2011-02-10 01:03:03 +0000 | [diff] [blame] | 15 | #include "clang/StaticAnalyzer/Core/PathSensitive/AnalysisManager.h" |
| 16 | #include "clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h" |
Jordan Rose | f540c54 | 2012-07-26 21:39:41 +0000 | [diff] [blame] | 17 | #include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h" |
Zhongxing Xu | cb7464a | 2010-04-19 12:51:02 +0000 | [diff] [blame] | 18 | #include "clang/AST/DeclCXX.h" |
Ted Kremenek | 337e4db | 2012-03-10 01:34:17 +0000 | [diff] [blame] | 19 | #include "clang/AST/StmtCXX.h" |
Zhongxing Xu | cb7464a | 2010-04-19 12:51:02 +0000 | [diff] [blame] | 20 | |
| 21 | using namespace clang; |
Ted Kremenek | 9ef6537 | 2010-12-23 07:20:52 +0000 | [diff] [blame] | 22 | using namespace ento; |
Zhongxing Xu | cb7464a | 2010-04-19 12:51:02 +0000 | [diff] [blame] | 23 | |
Ted Kremenek | eea72a9 | 2011-07-28 23:07:36 +0000 | [diff] [blame] | 24 | void ExprEngine::CreateCXXTemporaryObject(const MaterializeTemporaryExpr *ME, |
| 25 | ExplodedNode *Pred, |
| 26 | ExplodedNodeSet &Dst) { |
Anna Zaks | aa0aeb1 | 2011-10-24 21:19:59 +0000 | [diff] [blame] | 27 | StmtNodeBuilder Bldr(Pred, Dst, *currentBuilderContext); |
Ted Kremenek | 6a835dd | 2011-10-02 00:54:48 +0000 | [diff] [blame] | 28 | const Expr *tempExpr = ME->GetTemporaryExpr()->IgnoreParens(); |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 29 | ProgramStateRef state = Pred->getState(); |
Ted Kremenek | 5eca482 | 2012-01-06 22:09:28 +0000 | [diff] [blame] | 30 | const LocationContext *LCtx = Pred->getLocationContext(); |
Zhongxing Xu | cb7464a | 2010-04-19 12:51:02 +0000 | [diff] [blame] | 31 | |
Ted Kremenek | 6a835dd | 2011-10-02 00:54:48 +0000 | [diff] [blame] | 32 | // Bind the temporary object to the value of the expression. Then bind |
| 33 | // the expression to the location of the object. |
Ted Kremenek | 5eca482 | 2012-01-06 22:09:28 +0000 | [diff] [blame] | 34 | SVal V = state->getSVal(tempExpr, Pred->getLocationContext()); |
Zhongxing Xu | cb7464a | 2010-04-19 12:51:02 +0000 | [diff] [blame] | 35 | |
Ted Kremenek | 6a835dd | 2011-10-02 00:54:48 +0000 | [diff] [blame] | 36 | const MemRegion *R = |
Ted Kremenek | 5eca482 | 2012-01-06 22:09:28 +0000 | [diff] [blame] | 37 | svalBuilder.getRegionManager().getCXXTempObjectRegion(ME, LCtx); |
Zhongxing Xu | cb7464a | 2010-04-19 12:51:02 +0000 | [diff] [blame] | 38 | |
Ted Kremenek | 6a835dd | 2011-10-02 00:54:48 +0000 | [diff] [blame] | 39 | state = state->bindLoc(loc::MemRegionVal(R), V); |
Ted Kremenek | 5eca482 | 2012-01-06 22:09:28 +0000 | [diff] [blame] | 40 | Bldr.generateNode(ME, Pred, state->BindExpr(ME, LCtx, loc::MemRegionVal(R))); |
Zhongxing Xu | cb7464a | 2010-04-19 12:51:02 +0000 | [diff] [blame] | 41 | } |
| 42 | |
Jordan Rose | 362a31c | 2012-07-02 19:28:12 +0000 | [diff] [blame] | 43 | void ExprEngine::VisitCXXConstructExpr(const CXXConstructExpr *CE, |
Ted Kremenek | 5fe9872 | 2011-04-08 22:42:35 +0000 | [diff] [blame] | 44 | ExplodedNode *Pred, |
| 45 | ExplodedNodeSet &destNodes) { |
Jordan Rose | 888c90a | 2012-07-26 20:04:13 +0000 | [diff] [blame] | 46 | const LocationContext *LCtx = Pred->getLocationContext(); |
Jordan Rose | 075f6fb | 2012-07-26 20:04:16 +0000 | [diff] [blame] | 47 | ProgramStateRef State = Pred->getState(); |
| 48 | |
Jordan Rose | 888c90a | 2012-07-26 20:04:13 +0000 | [diff] [blame] | 49 | const MemRegion *Target = 0; |
| 50 | |
| 51 | switch (CE->getConstructionKind()) { |
| 52 | case CXXConstructExpr::CK_Complete: { |
Jordan Rose | 075f6fb | 2012-07-26 20:04:16 +0000 | [diff] [blame] | 53 | // See if we're constructing an existing region by looking at the next |
| 54 | // element in the CFG. |
| 55 | const CFGBlock *B = currentBuilderContext->getBlock(); |
| 56 | if (currentStmtIdx + 1 < B->size()) { |
| 57 | CFGElement Next = (*B)[currentStmtIdx+1]; |
| 58 | |
| 59 | // Is this a constructor for a local variable? |
Jordan Rose | e460c46 | 2012-07-26 20:04:25 +0000 | [diff] [blame] | 60 | if (const CFGStmt *StmtElem = dyn_cast<CFGStmt>(&Next)) { |
| 61 | if (const DeclStmt *DS = dyn_cast<DeclStmt>(StmtElem->getStmt())) { |
| 62 | if (const VarDecl *Var = dyn_cast<VarDecl>(DS->getSingleDecl())) { |
| 63 | if (Var->getInit()->IgnoreImplicit() == CE) { |
| 64 | QualType Ty = Var->getType(); |
| 65 | if (const ArrayType *AT = getContext().getAsArrayType(Ty)) { |
| 66 | // FIXME: Handle arrays, which run the same constructor for |
| 67 | // every element. This workaround will just run the first |
| 68 | // constructor (which should still invalidate the entire array). |
| 69 | SVal Base = State->getLValue(Var, LCtx); |
| 70 | Target = State->getLValue(AT->getElementType(), |
| 71 | getSValBuilder().makeZeroArrayIndex(), |
| 72 | Base).getAsRegion(); |
| 73 | } else { |
| 74 | Target = State->getLValue(Var, LCtx).getAsRegion(); |
| 75 | } |
| 76 | } |
| 77 | } |
| 78 | } |
| 79 | } |
| 80 | |
Jordan Rose | 3a0a9e3 | 2012-07-26 20:04:21 +0000 | [diff] [blame] | 81 | // Is this a constructor for a member? |
| 82 | if (const CFGInitializer *InitElem = dyn_cast<CFGInitializer>(&Next)) { |
| 83 | const CXXCtorInitializer *Init = InitElem->getInitializer(); |
| 84 | assert(Init->isAnyMemberInitializer()); |
| 85 | |
| 86 | const CXXMethodDecl *CurCtor = cast<CXXMethodDecl>(LCtx->getDecl()); |
| 87 | Loc ThisPtr = getSValBuilder().getCXXThis(CurCtor, |
| 88 | LCtx->getCurrentStackFrame()); |
| 89 | SVal ThisVal = State->getSVal(ThisPtr); |
| 90 | |
| 91 | if (Init->isIndirectMemberInitializer()) { |
| 92 | SVal Field = State->getLValue(Init->getIndirectMember(), ThisVal); |
Jordan Rose | e460c46 | 2012-07-26 20:04:25 +0000 | [diff] [blame] | 93 | Target = Field.getAsRegion(); |
Jordan Rose | 3a0a9e3 | 2012-07-26 20:04:21 +0000 | [diff] [blame] | 94 | } else { |
| 95 | SVal Field = State->getLValue(Init->getMember(), ThisVal); |
Jordan Rose | e460c46 | 2012-07-26 20:04:25 +0000 | [diff] [blame] | 96 | Target = Field.getAsRegion(); |
Jordan Rose | 3a0a9e3 | 2012-07-26 20:04:21 +0000 | [diff] [blame] | 97 | } |
| 98 | } |
| 99 | |
Jordan Rose | 075f6fb | 2012-07-26 20:04:16 +0000 | [diff] [blame] | 100 | // FIXME: This will eventually need to handle new-expressions as well. |
| 101 | } |
| 102 | |
| 103 | // If we couldn't find an existing region to construct into, we'll just |
Jordan Rose | 888c90a | 2012-07-26 20:04:13 +0000 | [diff] [blame] | 104 | // generate a symbolic region, which is fine. |
Jordan Rose | 075f6fb | 2012-07-26 20:04:16 +0000 | [diff] [blame] | 105 | |
Jordan Rose | 888c90a | 2012-07-26 20:04:13 +0000 | [diff] [blame] | 106 | break; |
| 107 | } |
| 108 | case CXXConstructExpr::CK_NonVirtualBase: |
| 109 | case CXXConstructExpr::CK_VirtualBase: |
| 110 | case CXXConstructExpr::CK_Delegating: { |
| 111 | const CXXMethodDecl *CurCtor = cast<CXXMethodDecl>(LCtx->getDecl()); |
| 112 | Loc ThisPtr = getSValBuilder().getCXXThis(CurCtor, |
| 113 | LCtx->getCurrentStackFrame()); |
Jordan Rose | 075f6fb | 2012-07-26 20:04:16 +0000 | [diff] [blame] | 114 | SVal ThisVal = State->getSVal(ThisPtr); |
Jordan Rose | 888c90a | 2012-07-26 20:04:13 +0000 | [diff] [blame] | 115 | |
| 116 | if (CE->getConstructionKind() == CXXConstructExpr::CK_Delegating) { |
| 117 | Target = ThisVal.getAsRegion(); |
| 118 | } else { |
| 119 | // Cast to the base type. |
| 120 | QualType BaseTy = CE->getType(); |
| 121 | SVal BaseVal = getStoreManager().evalDerivedToBase(ThisVal, BaseTy); |
Jordan Rose | e460c46 | 2012-07-26 20:04:25 +0000 | [diff] [blame] | 122 | Target = BaseVal.getAsRegion(); |
Jordan Rose | 888c90a | 2012-07-26 20:04:13 +0000 | [diff] [blame] | 123 | } |
| 124 | break; |
| 125 | } |
| 126 | } |
| 127 | |
Jordan Rose | d563d3f | 2012-07-30 20:22:09 +0000 | [diff] [blame^] | 128 | CallEventManager &CEMgr = getStateManager().getCallEventManager(); |
| 129 | CallEventRef<CXXConstructorCall> Call = |
| 130 | CEMgr.getCXXConstructorCall(CE, Target, State, LCtx); |
Zhongxing Xu | cb7464a | 2010-04-19 12:51:02 +0000 | [diff] [blame] | 131 | |
Jordan Rose | 362a31c | 2012-07-02 19:28:12 +0000 | [diff] [blame] | 132 | ExplodedNodeSet DstPreVisit; |
| 133 | getCheckerManager().runCheckersForPreStmt(DstPreVisit, Pred, CE, *this); |
Jordan Rose | 96479da | 2012-07-02 19:28:16 +0000 | [diff] [blame] | 134 | ExplodedNodeSet DstPreCall; |
| 135 | getCheckerManager().runCheckersForPreCall(DstPreCall, DstPreVisit, |
Jordan Rose | d563d3f | 2012-07-30 20:22:09 +0000 | [diff] [blame^] | 136 | *Call, *this); |
Ted Kremenek | 5fe9872 | 2011-04-08 22:42:35 +0000 | [diff] [blame] | 137 | |
Jordan Rose | 362a31c | 2012-07-02 19:28:12 +0000 | [diff] [blame] | 138 | ExplodedNodeSet DstInvalidated; |
Anna Zaks | e81ce25 | 2012-07-19 23:38:13 +0000 | [diff] [blame] | 139 | StmtNodeBuilder Bldr(DstPreCall, DstInvalidated, *currentBuilderContext); |
Jordan Rose | 96479da | 2012-07-02 19:28:16 +0000 | [diff] [blame] | 140 | for (ExplodedNodeSet::iterator I = DstPreCall.begin(), E = DstPreCall.end(); |
Jordan Rose | 362a31c | 2012-07-02 19:28:12 +0000 | [diff] [blame] | 141 | I != E; ++I) |
Jordan Rose | d563d3f | 2012-07-30 20:22:09 +0000 | [diff] [blame^] | 142 | defaultEvalCall(Bldr, *I, *Call); |
Ted Kremenek | 5fe9872 | 2011-04-08 22:42:35 +0000 | [diff] [blame] | 143 | |
Jordan Rose | 96479da | 2012-07-02 19:28:16 +0000 | [diff] [blame] | 144 | ExplodedNodeSet DstPostCall; |
| 145 | getCheckerManager().runCheckersForPostCall(DstPostCall, DstInvalidated, |
Jordan Rose | d563d3f | 2012-07-30 20:22:09 +0000 | [diff] [blame^] | 146 | *Call, *this); |
Jordan Rose | 96479da | 2012-07-02 19:28:16 +0000 | [diff] [blame] | 147 | getCheckerManager().runCheckersForPostStmt(destNodes, DstPostCall, CE, *this); |
Zhongxing Xu | cb7464a | 2010-04-19 12:51:02 +0000 | [diff] [blame] | 148 | } |
| 149 | |
Jordan Rose | 888c90a | 2012-07-26 20:04:13 +0000 | [diff] [blame] | 150 | void ExprEngine::VisitCXXDestructor(QualType ObjectType, |
| 151 | const MemRegion *Dest, |
| 152 | const Stmt *S, |
| 153 | ExplodedNode *Pred, |
| 154 | ExplodedNodeSet &Dst) { |
Jordan Rose | d563d3f | 2012-07-30 20:22:09 +0000 | [diff] [blame^] | 155 | const LocationContext *LCtx = Pred->getLocationContext(); |
| 156 | ProgramStateRef State = Pred->getState(); |
| 157 | |
Jordan Rose | e460c46 | 2012-07-26 20:04:25 +0000 | [diff] [blame] | 158 | // FIXME: We need to run the same destructor on every element of the array. |
| 159 | // This workaround will just run the first destructor (which will still |
| 160 | // invalidate the entire array). |
| 161 | if (const ArrayType *AT = getContext().getAsArrayType(ObjectType)) { |
| 162 | ObjectType = AT->getElementType(); |
Jordan Rose | d563d3f | 2012-07-30 20:22:09 +0000 | [diff] [blame^] | 163 | Dest = State->getLValue(ObjectType, getSValBuilder().makeZeroArrayIndex(), |
| 164 | loc::MemRegionVal(Dest)).getAsRegion(); |
Jordan Rose | e460c46 | 2012-07-26 20:04:25 +0000 | [diff] [blame] | 165 | } |
| 166 | |
Jordan Rose | 888c90a | 2012-07-26 20:04:13 +0000 | [diff] [blame] | 167 | const CXXRecordDecl *RecordDecl = ObjectType->getAsCXXRecordDecl(); |
| 168 | assert(RecordDecl && "Only CXXRecordDecls should have destructors"); |
| 169 | const CXXDestructorDecl *DtorDecl = RecordDecl->getDestructor(); |
| 170 | |
Jordan Rose | d563d3f | 2012-07-30 20:22:09 +0000 | [diff] [blame^] | 171 | CallEventManager &CEMgr = getStateManager().getCallEventManager(); |
| 172 | CallEventRef<CXXDestructorCall> Call = |
| 173 | CEMgr.getCXXDestructorCall(DtorDecl, S, Dest, State, LCtx); |
Ted Kremenek | b1b5daf | 2011-10-23 02:31:52 +0000 | [diff] [blame] | 174 | |
Jordan Rose | 8d276d3 | 2012-07-10 22:07:47 +0000 | [diff] [blame] | 175 | ExplodedNodeSet DstPreCall; |
| 176 | getCheckerManager().runCheckersForPreCall(DstPreCall, Pred, |
Jordan Rose | d563d3f | 2012-07-30 20:22:09 +0000 | [diff] [blame^] | 177 | *Call, *this); |
Zhongxing Xu | b13453b | 2010-11-20 06:53:12 +0000 | [diff] [blame] | 178 | |
Jordan Rose | 8d276d3 | 2012-07-10 22:07:47 +0000 | [diff] [blame] | 179 | ExplodedNodeSet DstInvalidated; |
Anna Zaks | e81ce25 | 2012-07-19 23:38:13 +0000 | [diff] [blame] | 180 | StmtNodeBuilder Bldr(DstPreCall, DstInvalidated, *currentBuilderContext); |
Jordan Rose | 8d276d3 | 2012-07-10 22:07:47 +0000 | [diff] [blame] | 181 | for (ExplodedNodeSet::iterator I = DstPreCall.begin(), E = DstPreCall.end(); |
| 182 | I != E; ++I) |
Jordan Rose | d563d3f | 2012-07-30 20:22:09 +0000 | [diff] [blame^] | 183 | defaultEvalCall(Bldr, *I, *Call); |
Jordan Rose | 8d276d3 | 2012-07-10 22:07:47 +0000 | [diff] [blame] | 184 | |
| 185 | ExplodedNodeSet DstPostCall; |
| 186 | getCheckerManager().runCheckersForPostCall(Dst, DstInvalidated, |
Jordan Rose | d563d3f | 2012-07-30 20:22:09 +0000 | [diff] [blame^] | 187 | *Call, *this); |
Zhongxing Xu | b13453b | 2010-11-20 06:53:12 +0000 | [diff] [blame] | 188 | } |
| 189 | |
Argyrios Kyrtzidis | d2592a3 | 2010-12-22 18:53:44 +0000 | [diff] [blame] | 190 | void ExprEngine::VisitCXXNewExpr(const CXXNewExpr *CNE, ExplodedNode *Pred, |
Zhongxing Xu | cb7464a | 2010-04-19 12:51:02 +0000 | [diff] [blame] | 191 | ExplodedNodeSet &Dst) { |
Jordan Rose | 70cbf3c | 2012-07-02 22:21:47 +0000 | [diff] [blame] | 192 | // FIXME: Much of this should eventually migrate to CXXAllocatorCall. |
| 193 | // Also, we need to decide how allocators actually work -- they're not |
| 194 | // really part of the CXXNewExpr because they happen BEFORE the |
| 195 | // CXXConstructExpr subexpression. See PR12014 for some discussion. |
Anna Zaks | aa0aeb1 | 2011-10-24 21:19:59 +0000 | [diff] [blame] | 196 | StmtNodeBuilder Bldr(Pred, Dst, *currentBuilderContext); |
Ted Kremenek | 41c5f49 | 2011-03-31 04:04:48 +0000 | [diff] [blame] | 197 | |
Anna Zaks | ebae6d0 | 2011-10-24 18:26:19 +0000 | [diff] [blame] | 198 | unsigned blockCount = currentBuilderContext->getCurrentBlockCount(); |
Ted Kremenek | 3133f79 | 2012-02-17 23:13:45 +0000 | [diff] [blame] | 199 | const LocationContext *LCtx = Pred->getLocationContext(); |
Ted Kremenek | c8413fd | 2010-12-02 07:49:45 +0000 | [diff] [blame] | 200 | DefinedOrUnknownSVal symVal = |
Jordan Rose | 70cbf3c | 2012-07-02 22:21:47 +0000 | [diff] [blame] | 201 | svalBuilder.getConjuredSymbolVal(0, CNE, LCtx, CNE->getType(), blockCount); |
Jordan Rose | e38c1c2 | 2012-06-20 01:32:01 +0000 | [diff] [blame] | 202 | ProgramStateRef State = Pred->getState(); |
Ted Kremenek | 41c5f49 | 2011-03-31 04:04:48 +0000 | [diff] [blame] | 203 | |
Jordan Rose | d563d3f | 2012-07-30 20:22:09 +0000 | [diff] [blame^] | 204 | CallEventManager &CEMgr = getStateManager().getCallEventManager(); |
| 205 | CallEventRef<CXXAllocatorCall> Call = |
| 206 | CEMgr.getCXXAllocatorCall(CNE, State, LCtx); |
| 207 | |
Jordan Rose | 70cbf3c | 2012-07-02 22:21:47 +0000 | [diff] [blame] | 208 | // Invalidate placement args. |
Jordan Rose | d563d3f | 2012-07-30 20:22:09 +0000 | [diff] [blame^] | 209 | // FIXME: Once we figure out how we want allocators to work, |
| 210 | // we should be using the usual pre-/(default-)eval-/post-call checks here. |
| 211 | State = Call->invalidateRegions(blockCount); |
Jordan Rose | 70cbf3c | 2012-07-02 22:21:47 +0000 | [diff] [blame] | 212 | |
Ted Kremenek | 41c5f49 | 2011-03-31 04:04:48 +0000 | [diff] [blame] | 213 | if (CNE->isArray()) { |
| 214 | // FIXME: allocating an array requires simulating the constructors. |
| 215 | // For now, just return a symbolicated region. |
Jordan Rose | 70cbf3c | 2012-07-02 22:21:47 +0000 | [diff] [blame] | 216 | const MemRegion *NewReg = cast<loc::MemRegionVal>(symVal).getRegion(); |
| 217 | QualType ObjTy = CNE->getType()->getAs<PointerType>()->getPointeeType(); |
| 218 | const ElementRegion *EleReg = |
| 219 | getStoreManager().GetElementZeroRegion(NewReg, ObjTy); |
Jordan Rose | e38c1c2 | 2012-06-20 01:32:01 +0000 | [diff] [blame] | 220 | State = State->BindExpr(CNE, Pred->getLocationContext(), |
Ted Kremenek | 5eca482 | 2012-01-06 22:09:28 +0000 | [diff] [blame] | 221 | loc::MemRegionVal(EleReg)); |
Jordan Rose | e38c1c2 | 2012-06-20 01:32:01 +0000 | [diff] [blame] | 222 | Bldr.generateNode(CNE, Pred, State); |
Ted Kremenek | 41c5f49 | 2011-03-31 04:04:48 +0000 | [diff] [blame] | 223 | return; |
| 224 | } |
Zhongxing Xu | cb7464a | 2010-04-19 12:51:02 +0000 | [diff] [blame] | 225 | |
Jordan Rose | 70cbf3c | 2012-07-02 22:21:47 +0000 | [diff] [blame] | 226 | // FIXME: Once we have proper support for CXXConstructExprs inside |
| 227 | // CXXNewExpr, we need to make sure that the constructed object is not |
| 228 | // immediately invalidated here. (The placement call should happen before |
| 229 | // the constructor call anyway.) |
Jordan Rose | e38c1c2 | 2012-06-20 01:32:01 +0000 | [diff] [blame] | 230 | FunctionDecl *FD = CNE->getOperatorNew(); |
| 231 | if (FD && FD->isReservedGlobalPlacementOperator()) { |
| 232 | // Non-array placement new should always return the placement location. |
| 233 | SVal PlacementLoc = State->getSVal(CNE->getPlacementArg(0), LCtx); |
| 234 | State = State->BindExpr(CNE, LCtx, PlacementLoc); |
Jordan Rose | 70cbf3c | 2012-07-02 22:21:47 +0000 | [diff] [blame] | 235 | } else { |
| 236 | State = State->BindExpr(CNE, LCtx, symVal); |
Jordan Rose | e38c1c2 | 2012-06-20 01:32:01 +0000 | [diff] [blame] | 237 | } |
| 238 | |
Jordan Rose | 89e5aaf | 2012-07-16 23:38:09 +0000 | [diff] [blame] | 239 | // If the type is not a record, we won't have a CXXConstructExpr as an |
| 240 | // initializer. Copy the value over. |
| 241 | if (const Expr *Init = CNE->getInitializer()) { |
| 242 | if (!isa<CXXConstructExpr>(Init)) { |
| 243 | QualType ObjTy = CNE->getType()->getAs<PointerType>()->getPointeeType(); |
| 244 | (void)ObjTy; |
| 245 | assert(!ObjTy->isRecordType()); |
| 246 | SVal Location = State->getSVal(CNE, LCtx); |
| 247 | if (isa<Loc>(Location)) |
| 248 | State = State->bindLoc(cast<Loc>(Location), State->getSVal(Init, LCtx)); |
| 249 | } |
| 250 | } |
| 251 | |
Jordan Rose | e38c1c2 | 2012-06-20 01:32:01 +0000 | [diff] [blame] | 252 | Bldr.generateNode(CNE, Pred, State); |
Zhongxing Xu | cb7464a | 2010-04-19 12:51:02 +0000 | [diff] [blame] | 253 | } |
| 254 | |
Argyrios Kyrtzidis | d2592a3 | 2010-12-22 18:53:44 +0000 | [diff] [blame] | 255 | void ExprEngine::VisitCXXDeleteExpr(const CXXDeleteExpr *CDE, |
Anna Zaks | ebae6d0 | 2011-10-24 18:26:19 +0000 | [diff] [blame] | 256 | ExplodedNode *Pred, ExplodedNodeSet &Dst) { |
Erik Verbruggen | 4fafeb6 | 2012-02-29 08:42:57 +0000 | [diff] [blame] | 257 | StmtNodeBuilder Bldr(Pred, Dst, *currentBuilderContext); |
| 258 | ProgramStateRef state = Pred->getState(); |
| 259 | Bldr.generateNode(CDE, Pred, state); |
Zhongxing Xu | 6b85138 | 2010-04-21 02:17:31 +0000 | [diff] [blame] | 260 | } |
Zhongxing Xu | cb7464a | 2010-04-19 12:51:02 +0000 | [diff] [blame] | 261 | |
Ted Kremenek | 337e4db | 2012-03-10 01:34:17 +0000 | [diff] [blame] | 262 | void ExprEngine::VisitCXXCatchStmt(const CXXCatchStmt *CS, |
| 263 | ExplodedNode *Pred, |
| 264 | ExplodedNodeSet &Dst) { |
| 265 | const VarDecl *VD = CS->getExceptionDecl(); |
Ted Kremenek | ce612f5 | 2012-03-16 05:58:15 +0000 | [diff] [blame] | 266 | if (!VD) { |
| 267 | Dst.Add(Pred); |
| 268 | return; |
| 269 | } |
| 270 | |
Ted Kremenek | 337e4db | 2012-03-10 01:34:17 +0000 | [diff] [blame] | 271 | const LocationContext *LCtx = Pred->getLocationContext(); |
| 272 | SVal V = svalBuilder.getConjuredSymbolVal(CS, LCtx, VD->getType(), |
| 273 | currentBuilderContext->getCurrentBlockCount()); |
| 274 | ProgramStateRef state = Pred->getState(); |
| 275 | state = state->bindLoc(state->getLValue(VD, LCtx), V); |
| 276 | |
| 277 | StmtNodeBuilder Bldr(Pred, Dst, *currentBuilderContext); |
| 278 | Bldr.generateNode(CS, Pred, state); |
| 279 | } |
| 280 | |
Argyrios Kyrtzidis | d2592a3 | 2010-12-22 18:53:44 +0000 | [diff] [blame] | 281 | void ExprEngine::VisitCXXThisExpr(const CXXThisExpr *TE, ExplodedNode *Pred, |
Zhongxing Xu | 6b85138 | 2010-04-21 02:17:31 +0000 | [diff] [blame] | 282 | ExplodedNodeSet &Dst) { |
Anna Zaks | aa0aeb1 | 2011-10-24 21:19:59 +0000 | [diff] [blame] | 283 | StmtNodeBuilder Bldr(Pred, Dst, *currentBuilderContext); |
Anna Zaks | ebae6d0 | 2011-10-24 18:26:19 +0000 | [diff] [blame] | 284 | |
Zhongxing Xu | cb7464a | 2010-04-19 12:51:02 +0000 | [diff] [blame] | 285 | // Get the this object region from StoreManager. |
Ted Kremenek | 5eca482 | 2012-01-06 22:09:28 +0000 | [diff] [blame] | 286 | const LocationContext *LCtx = Pred->getLocationContext(); |
Zhongxing Xu | cb7464a | 2010-04-19 12:51:02 +0000 | [diff] [blame] | 287 | const MemRegion *R = |
Ted Kremenek | c8413fd | 2010-12-02 07:49:45 +0000 | [diff] [blame] | 288 | svalBuilder.getRegionManager().getCXXThisRegion( |
Zhongxing Xu | cb7464a | 2010-04-19 12:51:02 +0000 | [diff] [blame] | 289 | getContext().getCanonicalType(TE->getType()), |
Ted Kremenek | 5eca482 | 2012-01-06 22:09:28 +0000 | [diff] [blame] | 290 | LCtx); |
Zhongxing Xu | cb7464a | 2010-04-19 12:51:02 +0000 | [diff] [blame] | 291 | |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 292 | ProgramStateRef state = Pred->getState(); |
Zhongxing Xu | cb7464a | 2010-04-19 12:51:02 +0000 | [diff] [blame] | 293 | SVal V = state->getSVal(loc::MemRegionVal(R)); |
Ted Kremenek | 5eca482 | 2012-01-06 22:09:28 +0000 | [diff] [blame] | 294 | Bldr.generateNode(TE, Pred, state->BindExpr(TE, LCtx, V)); |
Zhongxing Xu | cb7464a | 2010-04-19 12:51:02 +0000 | [diff] [blame] | 295 | } |